[PATCH 0/2] serial: tegra: Fix 32-bit overflows in the clock rate adjustment

[PATCH 0/2] serial: tegra: Fix 32-bit overflows in the clock rate adjustment

[Patrick Fischer via B4 Relay]

On 32-bit ARM, both the clock rate adjustment from
"nvidia,adjust-baud-rates" and the check of the resulting rate overflow
a 32-bit long at the high baud rates the adjustment is meant for. On
the Tegra Note 7 (Tegra114), Bluetooth at 3 Mbaud therefore ran with a
UART clock 5.6 % too low, and the check computed -0.18 % and let it
pass.

UART clock at 3 Mbaud with a tolerance of 136 for 1 to 4 Mbaud
(pll_p 408 MHz):

                    requested    configured   check
  without patches   47.79 MHz    45.33 MHz    -0.18 %
  with patches      48.65 MHz    48.00 MHz     0.00 %

With both patches and the unchanged tolerance of 136, Bluetooth on the
Tegra Note 7 works at 3 Mbaud: the UART clock is 48.00 MHz, and the
WL1801 scans and connects to a paired device without HCI errors.

With a deliberately wrong tolerance of -500, which gives 45.33 MHz at
3 Mbaud, the check now reports the deviation (out of range by -555,
i.e. -5.55 %) instead of letting it pass.

Both bugs date back to v5.4. 64-bit platforms are not affected.

Tool use (see Documentation/process/generated-content.rst): both
patches, their changelogs and this cover letter were prepared with an
LLM coding assistant (Claude Code), which traced the wrong clock rates
I measured on the device to the overflows, wrote the fixes and drafted
the texts. It also recalculated the old and new arithmetic for the
affected rates in a small userspace program; the results match the
rates measured on the device. I reviewed the changes and ran the tests
on the device.

---
Patrick Fischer (2):
      serial: tegra: Fix overflow in tegra_get_tolerance_rate()
      serial: tegra: Fix overflow in tegra_check_rate_in_range()

 drivers/tty/serial/serial-tegra.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
---
base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
change-id: 20261023-upstream-serial-tegra-overflow-48d3d0f7afd9

Best regards,
--  
Patrick Fischer <admin@tsv-stahl-riesa.de>

[PATCH 1/2] serial: tegra: Fix overflow in tegra_get_tolerance_rate()

[Patrick Fischer via B4 Relay]

From: Patrick Fischer <admin@tsv-stahl-riesa.de>

tegra_get_tolerance_rate() raises or lowers the UART clock rate by the
tolerance from "nvidia,adjust-baud-rates", given in units of 0.01 %. It
calculates rate * tolerance in a long, which is only 32 bits wide on
32-bit ARM. With a tolerance of 136 this overflows from a clock rate of
about 15.8 MHz, i.e. from about 1 Mbaud, and the rate ends up adjusted
in the wrong direction.

The Tegra Note 7 (Tegra114) uses a tolerance of 136 for 1 to 4 Mbaud on
its Bluetooth UART, as in the downstream device tree. For 3 Mbaud the
driver asks for 47.79 MHz instead of 48.65 MHz, the clock rounds that
down to 408 MHz / 9 = 45.33 MHz (-5.6 %), and the WL1801 controller
stops answering after the switch to 3 Mbaud (HCI commands time out
with -110). The same overflow gives 23.31 MHz instead of 24 MHz at
1.5 Mbaud; both rates were confirmed on the device.

Do the multiplication in 64 bits. With that the driver asks for
48.65 MHz at 3 Mbaud and gets 48.00 MHz.

Tested on the Tegra Note 7 with the tolerance of 136: Bluetooth comes
up at 3 Mbaud, scans and connects to a paired device, and the HCI
counters show no errors.

64-bit platforms are not affected.

Fixes: f04a3cc8d455 ("serial: tegra: add support to adjust baud rate")
Cc: stable@vger.kernel.org
Signed-off-by: Patrick Fischer <admin@tsv-stahl-riesa.de>
---
 drivers/tty/serial/serial-tegra.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index b0fc4ae3686f..cc09fbc3aad8 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -18,6 +18,7 @@
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/irq.h>
+#include <linux/math64.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/pagemap.h>
@@ -368,8 +369,8 @@ static long tegra_get_tolerance_rate(struct tegra_uart_port *tup,
 	for (i = 0; i < tup->n_adjustable_baud_rates; ++i) {
 		if (baud >= tup->baud_tolerance[i].lower_range_baud &&
 		    baud <= tup->baud_tolerance[i].upper_range_baud)
-			return (rate + (rate *
-				tup->baud_tolerance[i].tolerance) / 10000);
+			return rate + div_s64((s64)rate *
+				tup->baud_tolerance[i].tolerance, 10000);
 	}
 
 	return rate;

-- 
2.56.0

Re: [PATCH 1/2] serial: tegra: Fix overflow in tegra_get_tolerance_rate()

[sashiko-bot]

> From: Patrick Fischer <admin@tsv-stahl-riesa.de>
> 
> tegra_get_tolerance_rate() raises or lowers the UART clock rate by the
> tolerance from "nvidia,adjust-baud-rates", given in units of 0.01 %. It
> calculates rate * tolerance in a long, which is only 32 bits wide on
> 32-bit ARM. With a tolerance of 136 this overflows from a clock rate of
> about 15.8 MHz, i.e. from about 1 Mbaud, and the rate ends up adjusted
> in the wrong direction.
> 
> The Tegra Note 7 (Tegra114) uses a tolerance of 136 for 1 to 4 Mbaud on
> its Bluetooth UART, as in the downstream device tree. For 3 Mbaud the
> driver asks for 47.79 MHz instead of 48.65 MHz, the clock rounds that
> down to 408 MHz / 9 = 45.33 MHz (-5.6 %), and the WL1801 controller
> stops answering after the switch to 3 Mbaud (HCI commands time out
> with -110). The same overflow gives 23.31 MHz instead of 24 MHz at
> 1.5 Mbaud; both rates were confirmed on the device.
> 
> Do the multiplication in 64 bits. With that the driver asks for
> 48.65 MHz at 3 Mbaud and gets 48.00 MHz.
> 
> Tested on the Tegra Note 7 with the tolerance of 136: Bluetooth comes
> up at 3 Mbaud, scans and connects to a paired device, and the HCI
> counters show no errors.
> 
> 64-bit platforms are not affected.
> 
> Fixes: f04a3cc8d455 ("serial: tegra: add support to adjust baud rate")
> Cc: stable@vger.kernel.org
> Signed-off-by: Patrick Fischer <admin@tsv-stahl-riesa.de>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025-upstream-serial-tegra-overflow-v1-0-267b5b7a79ee@tsv-stahl-riesa.de?part=1

Re: [PATCH 1/2] serial: tegra: Fix overflow in tegra_get_tolerance_rate()

[Svyatoslav Ryhel]

пн, 26 жовт. 2026 р. о 00:50 Patrick Fischer via B4 Relay
<devnull+admin.tsv-stahl-riesa.de@kernel.org> пише:
>
> From: Patrick Fischer <admin@tsv-stahl-riesa.de>
>
> tegra_get_tolerance_rate() raises or lowers the UART clock rate by the
> tolerance from "nvidia,adjust-baud-rates", given in units of 0.01 %. It
> calculates rate * tolerance in a long, which is only 32 bits wide on
> 32-bit ARM. With a tolerance of 136 this overflows from a clock rate of
> about 15.8 MHz, i.e. from about 1 Mbaud, and the rate ends up adjusted
> in the wrong direction.
>
> The Tegra Note 7 (Tegra114) uses a tolerance of 136 for 1 to 4 Mbaud on
> its Bluetooth UART, as in the downstream device tree. For 3 Mbaud the
> driver asks for 47.79 MHz instead of 48.65 MHz, the clock rounds that
> down to 408 MHz / 9 = 45.33 MHz (-5.6 %), and the WL1801 controller
> stops answering after the switch to 3 Mbaud (HCI commands time out
> with -110). The same overflow gives 23.31 MHz instead of 24 MHz at
> 1.5 Mbaud; both rates were confirmed on the device.
>
> Do the multiplication in 64 bits. With that the driver asks for
> 48.65 MHz at 3 Mbaud and gets 48.00 MHz.
>
> Tested on the Tegra Note 7 with the tolerance of 136: Bluetooth comes
> up at 3 Mbaud, scans and connects to a paired device, and the HCI
> counters show no errors.
>
> 64-bit platforms are not affected.
>
> Fixes: f04a3cc8d455 ("serial: tegra: add support to adjust baud rate")
> Cc: stable@vger.kernel.org
> Signed-off-by: Patrick Fischer <admin@tsv-stahl-riesa.de>
> ---
>  drivers/tty/serial/serial-tegra.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>

Tested-by: Svyatoslav Ryhel <clamor95@gmail.com> # Tegratab (P1988) and LG P895
Reviewed-by: Svyatoslav Ryhel <clamor95@gmail.com>

[PATCH 2/2] serial: tegra: Fix overflow in tegra_check_rate_in_range()

[Patrick Fischer via B4 Relay]

From: Patrick Fischer <admin@tsv-stahl-riesa.de>

tegra_check_rate_in_range() calculates the deviation of the configured
from the required clock rate as (configured_rate - required_rate) *
10000 in a long, which is only 32 bits wide on 32-bit ARM. This
overflows as soon as the two rates differ by more than about 214.7 kHz,
so the check lets through exactly the large deviations it is meant to
catch.

On the Tegra Note 7 (Tegra114) the Bluetooth UART ran at 45.33 MHz
instead of 48 MHz at 3 Mbaud (-5.6 %, see the previous patch). The
check calculated -0.18 % and let it pass, although the limit is 4 %.

Do the multiplication in 64 bits.

Tested on the Tegra Note 7 with a tolerance of -500 for 1 to 4 Mbaud,
which gives 45.33 MHz at 3 Mbaud: the driver now logs
"configured baud rate is out of range by -555" and does not apply the
rate. With the tolerance of 136 (48.00 MHz) it logs nothing.

64-bit platforms are not affected.

Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors")
Cc: stable@vger.kernel.org
Signed-off-by: Patrick Fischer <admin@tsv-stahl-riesa.de>
---
 drivers/tty/serial/serial-tegra.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index cc09fbc3aad8..cb5ef8aac198 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -380,8 +380,8 @@ static int tegra_check_rate_in_range(struct tegra_uart_port *tup)
 {
 	long diff;
 
-	diff = ((long)(tup->configured_rate - tup->required_rate) * 10000)
-		/ tup->required_rate;
+	diff = div_s64((s64)(tup->configured_rate - tup->required_rate) * 10000,
+		       tup->required_rate);
 	if (diff < (tup->cdata->error_tolerance_low_range * 100) ||
 	    diff > (tup->cdata->error_tolerance_high_range * 100)) {
 		dev_err(tup->uport.dev,

-- 
2.56.0

Re: [PATCH 2/2] serial: tegra: Fix overflow in tegra_check_rate_in_range()

[sashiko-bot]

> From: Patrick Fischer <admin@tsv-stahl-riesa.de>
> 
> tegra_check_rate_in_range() calculates the deviation of the configured
> from the required clock rate as (configured_rate - required_rate) *
> 10000 in a long, which is only 32 bits wide on 32-bit ARM. This
> overflows as soon as the two rates differ by more than about 214.7 kHz,
> so the check lets through exactly the large deviations it is meant to
> catch.
> 
> On the Tegra Note 7 (Tegra114) the Bluetooth UART ran at 45.33 MHz
> instead of 48 MHz at 3 Mbaud (-5.6 %, see the previous patch). The
> check calculated -0.18 % and let it pass, although the limit is 4 %.
> 
> Do the multiplication in 64 bits.
> 
> Tested on the Tegra Note 7 with a tolerance of -500 for 1 to 4 Mbaud,
> which gives 45.33 MHz at 3 Mbaud: the driver now logs
> "configured baud rate is out of range by -555" and does not apply the
> rate. With the tolerance of 136 (48.00 MHz) it logs nothing.
> 
> 64-bit platforms are not affected.
> 
> Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors")
> Cc: stable@vger.kernel.org
> Signed-off-by: Patrick Fischer <admin@tsv-stahl-riesa.de>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261025-upstream-serial-tegra-overflow-v1-0-267b5b7a79ee@tsv-stahl-riesa.de?part=2

Re: [PATCH 2/2] serial: tegra: Fix overflow in tegra_check_rate_in_range()

[Svyatoslav Ryhel]

пн, 26 жовт. 2026 р. о 00:50 Patrick Fischer via B4 Relay
<devnull+admin.tsv-stahl-riesa.de@kernel.org> пише:
>
> From: Patrick Fischer <admin@tsv-stahl-riesa.de>
>
> tegra_check_rate_in_range() calculates the deviation of the configured
> from the required clock rate as (configured_rate - required_rate) *
> 10000 in a long, which is only 32 bits wide on 32-bit ARM. This
> overflows as soon as the two rates differ by more than about 214.7 kHz,
> so the check lets through exactly the large deviations it is meant to
> catch.
>
> On the Tegra Note 7 (Tegra114) the Bluetooth UART ran at 45.33 MHz
> instead of 48 MHz at 3 Mbaud (-5.6 %, see the previous patch). The
> check calculated -0.18 % and let it pass, although the limit is 4 %.
>
> Do the multiplication in 64 bits.
>
> Tested on the Tegra Note 7 with a tolerance of -500 for 1 to 4 Mbaud,
> which gives 45.33 MHz at 3 Mbaud: the driver now logs
> "configured baud rate is out of range by -555" and does not apply the
> rate. With the tolerance of 136 (48.00 MHz) it logs nothing.
>
> 64-bit platforms are not affected.
>
> Fixes: d781ec21bae6 ("serial: tegra: report clk rate errors")
> Cc: stable@vger.kernel.org
> Signed-off-by: Patrick Fischer <admin@tsv-stahl-riesa.de>
> ---
>  drivers/tty/serial/serial-tegra.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>

Tested-by: Svyatoslav Ryhel <clamor95@gmail.com> # Tegratab (P1988) and LG P895
Reviewed-by: Svyatoslav Ryhel <clamor95@gmail.com>