[PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Yicong Yang]

The DW uart could get into the cases where a bogus RX timeout
interrupt is asserted but no available data. This could be
workaround by doing a bogus read.

Currently the driver's using the standard RBR (receive buffer
register) for this bogus read. However the reading of RBR
in this case is allowed to raise a hardware error if vendor
choose to implement in this way (our platform). It's also
allowed to do the bogus read using SRBR (shadow RBR) for
workaround which won't raise the hardware error. So change
to use the SRBR to workaround the issue if it's available.

Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
---
 drivers/tty/serial/8250/8250_dw.c    | 15 +++++++++++++--
 drivers/tty/serial/8250/8250_dwlib.c |  3 +++
 drivers/tty/serial/8250/8250_dwlib.h |  4 ++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 84ffba045ffa..fea7dfa30e78 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -440,8 +440,19 @@ static int dw8250_handle_irq(struct uart_port *p)
 	if (!up->dma && rx_timeout) {
 		status = serial_lsr_in(up);
 
-		if (!(status & (UART_LSR_DR | UART_LSR_BI)))
-			serial_port_in(p, UART_RX);
+		if (!(status & (UART_LSR_DR | UART_LSR_BI))) {
+			/*
+			 * Do the bogus read from Shadow RBR (SRBR) if provided.
+			 * Both RBR and SRBR are supported ways to workaround
+			 * this problem. But read RBR can cause hardware error
+			 * (PSLVERR) if hardware choose to implement in this way
+			 * (implement REG_TIMEOUT_WIDTH to 0), whereas SRBR won't.
+			 */
+			if (d->data.shadow_support)
+				serial_port_in(p, DW_UART_SRBR_0);
+			else
+				serial_port_in(p, UART_RX);
+		}
 	}
 
 	/* Manually stop the Rx DMA transfer when acting as flow controller */
diff --git a/drivers/tty/serial/8250/8250_dwlib.c b/drivers/tty/serial/8250/8250_dwlib.c
index 8859e66d2d71..19d997a59541 100644
--- a/drivers/tty/serial/8250/8250_dwlib.c
+++ b/drivers/tty/serial/8250/8250_dwlib.c
@@ -247,5 +247,8 @@ void dw8250_setup_port(struct uart_port *p)
 
 	if (reg & DW_UART_CPR_SIR_MODE)
 		up->capabilities |= UART_CAP_IRDA;
+
+	if (reg & DW_UART_CPR_SHADOW)
+		pd->shadow_support = true;
 }
 EXPORT_SYMBOL_GPL(dw8250_setup_port);
diff --git a/drivers/tty/serial/8250/8250_dwlib.h b/drivers/tty/serial/8250/8250_dwlib.h
index 1fe52332e774..3ad412d984ed 100644
--- a/drivers/tty/serial/8250/8250_dwlib.h
+++ b/drivers/tty/serial/8250/8250_dwlib.h
@@ -13,6 +13,7 @@
 #include "8250.h"
 
 /* Offsets for the DesignWare specific registers */
+#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */
 #define DW_UART_USR	0x1f /* UART Status Register */
 #define DW_UART_DMASA	0xa8 /* DMA Software Ack */
 #define DW_UART_TCR	0xac /* Transceiver Control Register (RS485) */
@@ -90,6 +91,9 @@ struct dw8250_port_data {
 
 	/* RS485 variables */
 	bool			hw_rs485_support;
+
+	/* Support Shadow registers */
+	bool			shadow_support;
 };
 
 void dw8250_do_set_termios(struct uart_port *p, struct ktermios *termios, const struct ktermios *old);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Andy Shevchenko]

On Mon, Jun 29, 2026 at 03:55:10PM +0800, Yicong Yang wrote:
> The DW uart could get into the cases where a bogus RX timeout
> interrupt is asserted but no available data. This could be
> workaround by doing a bogus read.
> 
> Currently the driver's using the standard RBR (receive buffer
> register) for this bogus read. However the reading of RBR
> in this case is allowed to raise a hardware error if vendor
> choose to implement in this way (our platform). It's also
> allowed to do the bogus read using SRBR (shadow RBR) for
> workaround which won't raise the hardware error. So change
> to use the SRBR to workaround the issue if it's available.

...

>  /* Offsets for the DesignWare specific registers */
> +#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */

Is this a name per DesignWare databook for UART? I mean that _0 part.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Ilpo Järvinen]

On Mon, 29 Jun 2026, Andy Shevchenko wrote:

> On Mon, Jun 29, 2026 at 03:55:10PM +0800, Yicong Yang wrote:
> > The DW uart could get into the cases where a bogus RX timeout
> > interrupt is asserted but no available data. This could be
> > workaround by doing a bogus read.
> > 
> > Currently the driver's using the standard RBR (receive buffer
> > register) for this bogus read. However the reading of RBR
> > in this case is allowed to raise a hardware error if vendor
> > choose to implement in this way (our platform). It's also
> > allowed to do the bogus read using SRBR (shadow RBR) for
> > workaround which won't raise the hardware error. So change
> > to use the SRBR to workaround the issue if it's available.
> 
> ...
> 
> >  /* Offsets for the DesignWare specific registers */
> > +#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */
> 
> Is this a name per DesignWare databook for UART? I mean that _0 part.

They have 16 consecutive registers for it. There isn't underscore in the 
databook but n is apparently part of the name.

-- 
 i.

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Andy Shevchenko]

On Mon, Jun 29, 2026 at 06:14:02PM +0300, Ilpo Järvinen wrote:
> On Mon, 29 Jun 2026, Andy Shevchenko wrote:
> > On Mon, Jun 29, 2026 at 03:55:10PM +0800, Yicong Yang wrote:

...

> > >  /* Offsets for the DesignWare specific registers */
> > > +#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */
> > 
> > Is this a name per DesignWare databook for UART? I mean that _0 part.
> 
> They have 16 consecutive registers for it. There isn't underscore in the 
> databook but n is apparently part of the name.

Oh, okay.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Ilpo Järvinen]

On Mon, 29 Jun 2026, Yicong Yang wrote:

> The DW uart could get into the cases where a bogus RX timeout
> interrupt is asserted but no available data. This could be
> workaround by doing a bogus read.
> 
> Currently the driver's using the standard RBR (receive buffer
> register) for this bogus read. However the reading of RBR
> in this case is allowed to raise a hardware error if vendor
> choose to implement in this way (our platform). It's also
> allowed to do the bogus read using SRBR (shadow RBR) for
> workaround which won't raise the hardware error. So change
> to use the SRBR to workaround the issue if it's available.
> 
> Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
> ---
>  drivers/tty/serial/8250/8250_dw.c    | 15 +++++++++++++--
>  drivers/tty/serial/8250/8250_dwlib.c |  3 +++
>  drivers/tty/serial/8250/8250_dwlib.h |  4 ++++
>  3 files changed, 20 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
> index 84ffba045ffa..fea7dfa30e78 100644
> --- a/drivers/tty/serial/8250/8250_dw.c
> +++ b/drivers/tty/serial/8250/8250_dw.c
> @@ -440,8 +440,19 @@ static int dw8250_handle_irq(struct uart_port *p)
>  	if (!up->dma && rx_timeout) {
>  		status = serial_lsr_in(up);
>  
> -		if (!(status & (UART_LSR_DR | UART_LSR_BI)))
> -			serial_port_in(p, UART_RX);
> +		if (!(status & (UART_LSR_DR | UART_LSR_BI))) {
> +			/*
> +			 * Do the bogus read from Shadow RBR (SRBR) if provided.
> +			 * Both RBR and SRBR are supported ways to workaround

Hi,

I've not come across this being mentioned anywhere else than in kernel 
related context, but you seem to imply there something that tells about 
"supported ways"?

If there's no such thing, I'm bit hesitant to declare presence of SRBR 
guarantees reading it universally solves this issue.

BUT, I suppose it does on your HW since you must have hit this code path, 
and thus PSLVERR, yourself to actually discover this issue so I assume 
you've then also confirmed that this patch solves the issue in your case 
which isn't entirely without merit either.

> +			 * this problem. But read RBR can cause hardware error
> +			 * (PSLVERR) if hardware choose to implement in this way
> +			 * (implement REG_TIMEOUT_WIDTH to 0), whereas SRBR won't.
> +			 */
> +			if (d->data.shadow_support)
> +				serial_port_in(p, DW_UART_SRBR_0);
> +			else
> +				serial_port_in(p, UART_RX);

How about:
			serial_port_in(p, d->data.shadow_support ? DW_UART_SRBR_0
								 : UART_RX);

--
 i.

> +		}
>  	}
>  
>  	/* Manually stop the Rx DMA transfer when acting as flow controller */
> diff --git a/drivers/tty/serial/8250/8250_dwlib.c b/drivers/tty/serial/8250/8250_dwlib.c
> index 8859e66d2d71..19d997a59541 100644
> --- a/drivers/tty/serial/8250/8250_dwlib.c
> +++ b/drivers/tty/serial/8250/8250_dwlib.c
> @@ -247,5 +247,8 @@ void dw8250_setup_port(struct uart_port *p)
>  
>  	if (reg & DW_UART_CPR_SIR_MODE)
>  		up->capabilities |= UART_CAP_IRDA;
> +
> +	if (reg & DW_UART_CPR_SHADOW)
> +		pd->shadow_support = true;
>  }
>  EXPORT_SYMBOL_GPL(dw8250_setup_port);
> diff --git a/drivers/tty/serial/8250/8250_dwlib.h b/drivers/tty/serial/8250/8250_dwlib.h
> index 1fe52332e774..3ad412d984ed 100644
> --- a/drivers/tty/serial/8250/8250_dwlib.h
> +++ b/drivers/tty/serial/8250/8250_dwlib.h
> @@ -13,6 +13,7 @@
>  #include "8250.h"
>  
>  /* Offsets for the DesignWare specific registers */
> +#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */
>  #define DW_UART_USR	0x1f /* UART Status Register */

It seems USR and now SRBR_0 are without regshift whereas the reset of 
the register defines are with it.

Somewhat unrelated to this patch, I really hate this 
dw8250_readl/writel_ext() mess even more now... Why are those needed 
anyway, should the .serial_in/out callbacks handle those byte-order, etc. 
variations just fine?

Are those _ext calls only required for some early things during probe?
I guess 8250_lpss hasn't setup the callbacks yet before calling 
dw8250_setup_port() (I'm not even sure where it gets set with it after 
looking for it for a few minutes)?

-- 
 i.

>  #define DW_UART_DMASA	0xa8 /* DMA Software Ack */
>  #define DW_UART_TCR	0xac /* Transceiver Control Register (RS485) */
> @@ -90,6 +91,9 @@ struct dw8250_port_data {
>  
>  	/* RS485 variables */
>  	bool			hw_rs485_support;
> +
> +	/* Support Shadow registers */
> +	bool			shadow_support;
>  };
>  
>  void dw8250_do_set_termios(struct uart_port *p, struct ktermios *termios, const struct ktermios *old);
> 

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Andy Shevchenko]

On Mon, Jun 29, 2026 at 06:56:28PM +0300, Ilpo Järvinen wrote:
> On Mon, 29 Jun 2026, Yicong Yang wrote:

...

> > +			if (d->data.shadow_support)
> > +				serial_port_in(p, DW_UART_SRBR_0);
> > +			else
> > +				serial_port_in(p, UART_RX);
> 
> How about:
> 			serial_port_in(p, d->data.shadow_support ? DW_UART_SRBR_0
> 								 : UART_RX);

I was thinking of even just having the value of the register offset somewhere
in dw8250_data and call this unconditionally.

			serial_port_in(p, d->srbr);

Of course this has to be carefully initialised in time with UART_RX.

...

> >  /* Offsets for the DesignWare specific registers */
> > +#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */
> >  #define DW_UART_USR	0x1f /* UART Status Register */
> 
> It seems USR and now SRBR_0 are without regshift whereas the reset of 
> the register defines are with it.
> 
> Somewhat unrelated to this patch, I really hate this 
> dw8250_readl/writel_ext() mess even more now... Why are those needed 
> anyway, should the .serial_in/out callbacks handle those byte-order, etc. 
> variations just fine?

Aren't there is a possibility to have the register stride for the first ones as
1 for backward compatibility with 16550, while providing the features like CPR
and UCV that needs a 32-bit accessors? IIRC that was the reason for _ext() IO.

> Are those _ext calls only required for some early things during probe?
> I guess 8250_lpss hasn't setup the callbacks yet before calling 
> dw8250_setup_port() (I'm not even sure where it gets set with it after 
> looking for it for a few minutes)?


-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Yicong Yang]

On 6/29/26 11:56 PM, Ilpo Järvinen wrote:
> On Mon, 29 Jun 2026, Yicong Yang wrote:
> 
>> The DW uart could get into the cases where a bogus RX timeout
>> interrupt is asserted but no available data. This could be
>> workaround by doing a bogus read.
>>
>> Currently the driver's using the standard RBR (receive buffer
>> register) for this bogus read. However the reading of RBR
>> in this case is allowed to raise a hardware error if vendor
>> choose to implement in this way (our platform). It's also
>> allowed to do the bogus read using SRBR (shadow RBR) for
>> workaround which won't raise the hardware error. So change
>> to use the SRBR to workaround the issue if it's available.
>>
>> Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
>> ---
>>  drivers/tty/serial/8250/8250_dw.c    | 15 +++++++++++++--
>>  drivers/tty/serial/8250/8250_dwlib.c |  3 +++
>>  drivers/tty/serial/8250/8250_dwlib.h |  4 ++++
>>  3 files changed, 20 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
>> index 84ffba045ffa..fea7dfa30e78 100644
>> --- a/drivers/tty/serial/8250/8250_dw.c
>> +++ b/drivers/tty/serial/8250/8250_dw.c
>> @@ -440,8 +440,19 @@ static int dw8250_handle_irq(struct uart_port *p)
>>  	if (!up->dma && rx_timeout) {
>>  		status = serial_lsr_in(up);
>>  
>> -		if (!(status & (UART_LSR_DR | UART_LSR_BI)))
>> -			serial_port_in(p, UART_RX);
>> +		if (!(status & (UART_LSR_DR | UART_LSR_BI))) {
>> +			/*
>> +			 * Do the bogus read from Shadow RBR (SRBR) if provided.
>> +			 * Both RBR and SRBR are supported ways to workaround
> 
> Hi,
> 
> I've not come across this being mentioned anywhere else than in kernel 
> related context, but you seem to imply there something that tells about 
> "supported ways"?
> 

in fact we got this workaround method that's documented in the synopsys
dw_uart issue report, so comment "supported" here. quote the related part
of the workaround below:

  [read USR[3] for the rx fifo status]
  If the read value is '0' (indicating the RX FIFO is empty), do a dummy
  read of the RBR or shadow RBR (SRBR) register without processing the
  invalid read data.

  ...Note: Reading the RBR results in a PSLVERR immediately if
  REG_TIMEOUT_WIDTH parameter is set to '0'. Whereas, reading SRBR does
  not result in PSLVERR.

> If there's no such thing, I'm bit hesitant to declare presence of SRBR 
> guarantees reading it universally solves this issue.
> 
> BUT, I suppose it does on your HW since you must have hit this code path, 
> and thus PSLVERR, yourself to actually discover this issue so I assume 
> you've then also confirmed that this patch solves the issue in your case 
> which isn't entirely without merit either.
> 

actually it's hard to reproduce, only once at boot time in our several
hundreds reboot test. we locate the code line here by the backtrace of
the system error. the issue hasn't reproduced yet on the patched kernel
(hundred reboots so far, but still going on), and I suppose it's correct
as provided by the IP designer.

>> +			 * this problem. But read RBR can cause hardware error
>> +			 * (PSLVERR) if hardware choose to implement in this way
>> +			 * (implement REG_TIMEOUT_WIDTH to 0), whereas SRBR won't.
>> +			 */
>> +			if (d->data.shadow_support)
>> +				serial_port_in(p, DW_UART_SRBR_0);
>> +			else
>> +				serial_port_in(p, UART_RX);
> 
> How about:
> 			serial_port_in(p, d->data.shadow_support ? DW_UART_SRBR_0
> 								 : UART_RX);
> 

will do. it also looks fine to me.

thanks.

> --
>  i.
> 
>> +		}
>>  	}
>>  
>>  	/* Manually stop the Rx DMA transfer when acting as flow controller */
>> diff --git a/drivers/tty/serial/8250/8250_dwlib.c b/drivers/tty/serial/8250/8250_dwlib.c
>> index 8859e66d2d71..19d997a59541 100644
>> --- a/drivers/tty/serial/8250/8250_dwlib.c
>> +++ b/drivers/tty/serial/8250/8250_dwlib.c
>> @@ -247,5 +247,8 @@ void dw8250_setup_port(struct uart_port *p)
>>  
>>  	if (reg & DW_UART_CPR_SIR_MODE)
>>  		up->capabilities |= UART_CAP_IRDA;
>> +
>> +	if (reg & DW_UART_CPR_SHADOW)
>> +		pd->shadow_support = true;
>>  }
>>  EXPORT_SYMBOL_GPL(dw8250_setup_port);
>> diff --git a/drivers/tty/serial/8250/8250_dwlib.h b/drivers/tty/serial/8250/8250_dwlib.h
>> index 1fe52332e774..3ad412d984ed 100644
>> --- a/drivers/tty/serial/8250/8250_dwlib.h
>> +++ b/drivers/tty/serial/8250/8250_dwlib.h
>> @@ -13,6 +13,7 @@
>>  #include "8250.h"
>>  
>>  /* Offsets for the DesignWare specific registers */
>> +#define DW_UART_SRBR_0	0x0c /* Shadow Receive Buffer Register */
>>  #define DW_UART_USR	0x1f /* UART Status Register */
> 
> It seems USR and now SRBR_0 are without regshift whereas the reset of 
> the register defines are with it.
> 
> Somewhat unrelated to this patch, I really hate this 
> dw8250_readl/writel_ext() mess even more now... Why are those needed 
> anyway, should the .serial_in/out callbacks handle those byte-order, etc. 
> variations just fine?
> 
> Are those _ext calls only required for some early things during probe?
> I guess 8250_lpss hasn't setup the callbacks yet before calling 
> dw8250_setup_port() (I'm not even sure where it gets set with it after 
> looking for it for a few minutes)?
>

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 3928 bytes --]

On Wed, 1 Jul 2026, Yicong Yang wrote:
> On 6/29/26 11:56 PM, Ilpo Järvinen wrote:
> > On Mon, 29 Jun 2026, Yicong Yang wrote:
> > 
> >> The DW uart could get into the cases where a bogus RX timeout
> >> interrupt is asserted but no available data. This could be
> >> workaround by doing a bogus read.
> >>
> >> Currently the driver's using the standard RBR (receive buffer
> >> register) for this bogus read. However the reading of RBR
> >> in this case is allowed to raise a hardware error if vendor
> >> choose to implement in this way (our platform). It's also
> >> allowed to do the bogus read using SRBR (shadow RBR) for
> >> workaround which won't raise the hardware error. So change
> >> to use the SRBR to workaround the issue if it's available.
> >>
> >> Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
> >> ---
> >>  drivers/tty/serial/8250/8250_dw.c    | 15 +++++++++++++--
> >>  drivers/tty/serial/8250/8250_dwlib.c |  3 +++
> >>  drivers/tty/serial/8250/8250_dwlib.h |  4 ++++
> >>  3 files changed, 20 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
> >> index 84ffba045ffa..fea7dfa30e78 100644
> >> --- a/drivers/tty/serial/8250/8250_dw.c
> >> +++ b/drivers/tty/serial/8250/8250_dw.c
> >> @@ -440,8 +440,19 @@ static int dw8250_handle_irq(struct uart_port *p)
> >>  	if (!up->dma && rx_timeout) {
> >>  		status = serial_lsr_in(up);
> >>  
> >> -		if (!(status & (UART_LSR_DR | UART_LSR_BI)))
> >> -			serial_port_in(p, UART_RX);
> >> +		if (!(status & (UART_LSR_DR | UART_LSR_BI))) {
> >> +			/*
> >> +			 * Do the bogus read from Shadow RBR (SRBR) if provided.
> >> +			 * Both RBR and SRBR are supported ways to workaround
> > 
> > Hi,
> > 
> > I've not come across this being mentioned anywhere else than in kernel 
> > related context, but you seem to imply there something that tells about 
> > "supported ways"?
> > 
> 
> in fact we got this workaround method that's documented in the synopsys
> dw_uart issue report, so comment "supported" here. quote the related part
> of the workaround below:
> 
>   [read USR[3] for the rx fifo status]
>   If the read value is '0' (indicating the RX FIFO is empty), do a dummy
>   read of the RBR or shadow RBR (SRBR) register without processing the
>   invalid read data.
> 
>   ...Note: Reading the RBR results in a PSLVERR immediately if
>   REG_TIMEOUT_WIDTH parameter is set to '0'. Whereas, reading SRBR does
>   not result in PSLVERR.

Okay, thanks.

> > If there's no such thing, I'm bit hesitant to declare presence of SRBR 
> > guarantees reading it universally solves this issue.
> > 
> > BUT, I suppose it does on your HW since you must have hit this code path, 
> > and thus PSLVERR, yourself to actually discover this issue so I assume 
> > you've then also confirmed that this patch solves the issue in your case 
> > which isn't entirely without merit either.
> > 
> 
> actually it's hard to reproduce, only once at boot time in our several
> hundreds reboot test. we locate the code line here by the backtrace of
> the system error. the issue hasn't reproduced yet on the patched kernel
> (hundred reboots so far, but still going on), and I suppose it's correct
> as provided by the IP designer.

For testing, you could have logged when this condition is actually hit 
in the first place. I usually do that to increase my own confidence if the 
problem is particularly hard to reproduce.

I don't know if it always triggers PSLVERR or if that's some % of !(status 
& (UART_LSR_DR | UART_LSR_BI)) cases because RBR read is racy with Rx but 
that could also be determined if similar debug is applied without the 
patch, I guess.

But with clearly more boots and it working, that's probably enough as 
evidence together with the issue report offering it as a workaround.

-- 
 i.

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Yicong Yang]

On 7/1/26 2:18 AM, Ilpo Järvinen wrote:
> On Wed, 1 Jul 2026, Yicong Yang wrote:
>> On 6/29/26 11:56 PM, Ilpo Järvinen wrote:
>>> On Mon, 29 Jun 2026, Yicong Yang wrote:
>>>
>>>> The DW uart could get into the cases where a bogus RX timeout
>>>> interrupt is asserted but no available data. This could be
>>>> workaround by doing a bogus read.
>>>>
>>>> Currently the driver's using the standard RBR (receive buffer
>>>> register) for this bogus read. However the reading of RBR
>>>> in this case is allowed to raise a hardware error if vendor
>>>> choose to implement in this way (our platform). It's also
>>>> allowed to do the bogus read using SRBR (shadow RBR) for
>>>> workaround which won't raise the hardware error. So change
>>>> to use the SRBR to workaround the issue if it's available.
>>>>
>>>> Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
>>>> ---
>>>>  drivers/tty/serial/8250/8250_dw.c    | 15 +++++++++++++--
>>>>  drivers/tty/serial/8250/8250_dwlib.c |  3 +++
>>>>  drivers/tty/serial/8250/8250_dwlib.h |  4 ++++
>>>>  3 files changed, 20 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
>>>> index 84ffba045ffa..fea7dfa30e78 100644
>>>> --- a/drivers/tty/serial/8250/8250_dw.c
>>>> +++ b/drivers/tty/serial/8250/8250_dw.c
>>>> @@ -440,8 +440,19 @@ static int dw8250_handle_irq(struct uart_port *p)
>>>>  	if (!up->dma && rx_timeout) {
>>>>  		status = serial_lsr_in(up);
>>>>  
>>>> -		if (!(status & (UART_LSR_DR | UART_LSR_BI)))
>>>> -			serial_port_in(p, UART_RX);
>>>> +		if (!(status & (UART_LSR_DR | UART_LSR_BI))) {
>>>> +			/*
>>>> +			 * Do the bogus read from Shadow RBR (SRBR) if provided.
>>>> +			 * Both RBR and SRBR are supported ways to workaround
>>>
>>> Hi,
>>>
>>> I've not come across this being mentioned anywhere else than in kernel 
>>> related context, but you seem to imply there something that tells about 
>>> "supported ways"?
>>>
>>
>> in fact we got this workaround method that's documented in the synopsys
>> dw_uart issue report, so comment "supported" here. quote the related part
>> of the workaround below:
>>
>>   [read USR[3] for the rx fifo status]
>>   If the read value is '0' (indicating the RX FIFO is empty), do a dummy
>>   read of the RBR or shadow RBR (SRBR) register without processing the
>>   invalid read data.
>>
>>   ...Note: Reading the RBR results in a PSLVERR immediately if
>>   REG_TIMEOUT_WIDTH parameter is set to '0'. Whereas, reading SRBR does
>>   not result in PSLVERR.
> 
> Okay, thanks.
> 
>>> If there's no such thing, I'm bit hesitant to declare presence of SRBR 
>>> guarantees reading it universally solves this issue.
>>>
>>> BUT, I suppose it does on your HW since you must have hit this code path, 
>>> and thus PSLVERR, yourself to actually discover this issue so I assume 
>>> you've then also confirmed that this patch solves the issue in your case 
>>> which isn't entirely without merit either.
>>>
>>
>> actually it's hard to reproduce, only once at boot time in our several
>> hundreds reboot test. we locate the code line here by the backtrace of
>> the system error. the issue hasn't reproduced yet on the patched kernel
>> (hundred reboots so far, but still going on), and I suppose it's correct
>> as provided by the IP designer.
> 
> For testing, you could have logged when this condition is actually hit 
> in the first place. I usually do that to increase my own confidence if the 
> problem is particularly hard to reproduce.

thanks for the kind and useful guidance :) did add a log message in the
workaround branch so we'll know if the issue hits.

> 
> I don't know if it always triggers PSLVERR or if that's some % of !(status 
> & (UART_LSR_DR | UART_LSR_BI)) cases because RBR read is racy with Rx but 
> that could also be determined if similar debug is applied without the 
> patch, I guess.

as the PSLVERR is caused by the reading of RBR so even in the latter case
we should still using the SRBR here if availabe to avoid the PSLVERR as
long as we enter this branch, I suppose this should be the safest way.

> 
> But with clearly more boots and it working, that's probably enough as 
> evidence together with the issue report offering it as a workaround.
> 

sure, will wait a bit and try to catch the condition.

thanks.

Re: [PATCH] serial: 8250_dw: Prefer SRBR in bogus RX timeout workaround if available

[Ilpo Järvinen]

[-- Attachment #1: Type: text/plain, Size: 5298 bytes --]

On Wed, 1 Jul 2026, Yicong Yang wrote:

> On 7/1/26 2:18 AM, Ilpo Järvinen wrote:
> > On Wed, 1 Jul 2026, Yicong Yang wrote:
> >> On 6/29/26 11:56 PM, Ilpo Järvinen wrote:
> >>> On Mon, 29 Jun 2026, Yicong Yang wrote:
> >>>
> >>>> The DW uart could get into the cases where a bogus RX timeout
> >>>> interrupt is asserted but no available data. This could be
> >>>> workaround by doing a bogus read.
> >>>>
> >>>> Currently the driver's using the standard RBR (receive buffer
> >>>> register) for this bogus read. However the reading of RBR
> >>>> in this case is allowed to raise a hardware error if vendor
> >>>> choose to implement in this way (our platform). It's also
> >>>> allowed to do the bogus read using SRBR (shadow RBR) for
> >>>> workaround which won't raise the hardware error. So change
> >>>> to use the SRBR to workaround the issue if it's available.
> >>>>
> >>>> Signed-off-by: Yicong Yang <yang.yicong@picoheart.com>
> >>>> ---
> >>>>  drivers/tty/serial/8250/8250_dw.c    | 15 +++++++++++++--
> >>>>  drivers/tty/serial/8250/8250_dwlib.c |  3 +++
> >>>>  drivers/tty/serial/8250/8250_dwlib.h |  4 ++++
> >>>>  3 files changed, 20 insertions(+), 2 deletions(-)
> >>>>
> >>>> diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
> >>>> index 84ffba045ffa..fea7dfa30e78 100644
> >>>> --- a/drivers/tty/serial/8250/8250_dw.c
> >>>> +++ b/drivers/tty/serial/8250/8250_dw.c
> >>>> @@ -440,8 +440,19 @@ static int dw8250_handle_irq(struct uart_port *p)
> >>>>  	if (!up->dma && rx_timeout) {
> >>>>  		status = serial_lsr_in(up);
> >>>>  
> >>>> -		if (!(status & (UART_LSR_DR | UART_LSR_BI)))
> >>>> -			serial_port_in(p, UART_RX);
> >>>> +		if (!(status & (UART_LSR_DR | UART_LSR_BI))) {
> >>>> +			/*
> >>>> +			 * Do the bogus read from Shadow RBR (SRBR) if provided.
> >>>> +			 * Both RBR and SRBR are supported ways to workaround
> >>>
> >>> Hi,
> >>>
> >>> I've not come across this being mentioned anywhere else than in kernel 
> >>> related context, but you seem to imply there something that tells about 
> >>> "supported ways"?
> >>>
> >>
> >> in fact we got this workaround method that's documented in the synopsys
> >> dw_uart issue report, so comment "supported" here. quote the related part
> >> of the workaround below:
> >>
> >>   [read USR[3] for the rx fifo status]
> >>   If the read value is '0' (indicating the RX FIFO is empty), do a dummy
> >>   read of the RBR or shadow RBR (SRBR) register without processing the
> >>   invalid read data.
> >>
> >>   ...Note: Reading the RBR results in a PSLVERR immediately if
> >>   REG_TIMEOUT_WIDTH parameter is set to '0'. Whereas, reading SRBR does
> >>   not result in PSLVERR.
> > 
> > Okay, thanks.
> > 
> >>> If there's no such thing, I'm bit hesitant to declare presence of SRBR 
> >>> guarantees reading it universally solves this issue.
> >>>
> >>> BUT, I suppose it does on your HW since you must have hit this code path, 
> >>> and thus PSLVERR, yourself to actually discover this issue so I assume 
> >>> you've then also confirmed that this patch solves the issue in your case 
> >>> which isn't entirely without merit either.
> >>>
> >>
> >> actually it's hard to reproduce, only once at boot time in our several
> >> hundreds reboot test. we locate the code line here by the backtrace of
> >> the system error. the issue hasn't reproduced yet on the patched kernel
> >> (hundred reboots so far, but still going on), and I suppose it's correct
> >> as provided by the IP designer.
> > 
> > For testing, you could have logged when this condition is actually hit 
> > in the first place. I usually do that to increase my own confidence if the 
> > problem is particularly hard to reproduce.
> 
> thanks for the kind and useful guidance :) did add a log message in the
> workaround branch so we'll know if the issue hits.
> 
> > 
> > I don't know if it always triggers PSLVERR or if that's some % of !(status 
> > & (UART_LSR_DR | UART_LSR_BI)) cases because RBR read is racy with Rx but 
> > that could also be determined if similar debug is applied without the 
> > patch, I guess.
> 
> as the PSLVERR is caused by the reading of RBR so even in the latter case
> we should still using the SRBR here if availabe to avoid the PSLVERR as
> long as we enter this branch, I suppose this should be the safest way.

I was not commenting on how to fix it, but about probabilty of hitting 
PSLVERR when taking this branch.

Rx coming in (it's racing with the driver's code) may make the read not 
result in PSLVERR even when this branch is taken. It could be this does no 
matter and taking this branch in practice always results in PSLVERR if RBR 
is read, which means even any hit of this branch confirms SRBR does indeed 
work.

But if RBR reads do not always lead to PSLVERR because incoming Rx makes 
RBR read "safe" it's less clear how many times the branch should be taken 
before confidently declaring the fix works.

> > But with clearly more boots and it working, that's probably enough as 
> > evidence together with the issue report offering it as a workaround.
> > 
> 
> sure, will wait a bit and try to catch the condition.
> 
> thanks.
> 

-- 
 i.