* [PATCH net-next v5 1/3] net: wwan: core: propagate modem control signals to port drivers
2026-08-19 22:49 [PATCH net-next v5 0/3] net: wwan: support DTR/RTS on AT ports via MHI IP_CTRL Peter Hunt
@ 2026-08-19 22:49 ` Peter Hunt
2026-08-19 22:49 ` [PATCH net-next v5 2/3] bus: mhi: host: pci_generic: enumerate IP_CTRL channel for Sierra EM919x/EM929x Peter Hunt
2026-08-19 22:49 ` [PATCH net-next v5 3/3] net: wwan: mhi_wwan_ctrl: drive DTR/RTS via the IP_CTRL channel Peter Hunt
2 siblings, 0 replies; 4+ messages in thread
From: Peter Hunt @ 2026-08-19 22:49 UTC (permalink / raw)
To: loic.poulain, mani, ryazanov.s.a
Cc: johannes, netdev, mhi, linux-arm-msm, linux-kernel, Peter Hunt
The WWAN character device emulates the TTY modem-control ioctls
(TIOCMGET/TIOCMSET/TIOCMBIC/TIOCMBIS) for AT and QCDM ports, but the
result is only stored in port->at_data.mdmbits and never reaches the port
driver. A driver therefore cannot act on the host raising or dropping
DTR/RTS, even though some modems depend on it (e.g. they withhold
unsolicited AT result codes until the host asserts DTR).
Add an optional ->dtr_rts(port, mdmbits) operation to struct wwan_port_ops.
Drivers that implement it receive the full TIOCM bitmask so they can assert
or de-assert DTR and RTS independently. The wwan core tracks the full TIOCM
bitmask in port->at_data.mdmbits and calls ->dtr_rts when it changes, gated
on WWAN_PORT_AT to match the open/close raise/drop behaviour.
Also raise DTR/RTS in wwan_port_op_start on first open of an AT port when
the driver implements ->dtr_rts, and drop them in wwan_port_op_stop on
last close. This mirrors TTY semantics (DTR is asserted on open) and means
individual drivers do not need to implement this themselves.
at_data.mdmbits is protected by data_lock. In the ioctl path the ->dtr_rts
call is deferred until ops_lock is held, where mdmbits is re-read under
data_lock, so the value passed to the driver always reflects the committed
bitmask under ops_lock and is serialised against concurrent ioctls and
against port removal (which nulls port->ops under ops_lock).
wwan_remove_port() is also updated to call ->dtr_rts(port, 0) before
->stop() when a port is removed while still open, mirroring the last-close
de-assert path.
Signed-off-by: Peter Hunt <peter.hunt@opengear.com>
---
v5: Change ->dtr_rts signature from bool to unsigned int mdmbits so DTR
and RTS can be driven independently; re-read mdmbits inside ops_lock
in the ioctl path to close a concurrent-ioctl ordering race; add
de-assert call to wwan_remove_port() for the hot-unplug case; update
kernel-doc to note the op is AT-only and describe the mdmbits argument
v4: Protect at_data.mdmbits in wwan_port_op_start/stop under data_lock;
release data_lock and acquire ops_lock with a NULL check before calling
->dtr_rts from the ioctl path; gate ioctl ->dtr_rts on WWAN_PORT_AT to
match open/close behaviour; reduce boolean to TIOCM_DTR only
v3: Replace ->tiocmget/->tiocmset with ->dtr_rts(port, bool on) modelled
on tty_port_operations.dtr_rts; raise/drop DTR/RTS in
wwan_port_op_start/stop rather than in the driver (Loic Poulain)
---
drivers/net/wwan/wwan_core.c | 40 +++++++++++++++++++++++++++++++++++-
include/linux/wwan.h | 3 +++
2 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wwan/wwan_core.c b/drivers/net/wwan/wwan_core.c
index ffbcf11e4e68..3a6a0c5a3acf 100644
--- a/drivers/net/wwan/wwan_core.c
+++ b/drivers/net/wwan/wwan_core.c
@@ -685,6 +685,12 @@ void wwan_remove_port(struct wwan_port *port)
mutex_lock(&port->ops_lock);
if (port->start_count) {
+ if (port->type == WWAN_PORT_AT && port->ops->dtr_rts) {
+ mutex_lock(&port->data_lock);
+ port->at_data.mdmbits &= ~(TIOCM_DTR | TIOCM_RTS);
+ mutex_unlock(&port->data_lock);
+ port->ops->dtr_rts(port, 0);
+ }
port->ops->stop(port);
port->start_count = 0;
}
@@ -759,8 +765,17 @@ static int wwan_port_op_start(struct wwan_port *port)
if (!port->start_count)
ret = port->ops->start(port);
- if (!ret)
+ if (!ret) {
port->start_count++;
+ /* Mirror TTY semantics: raise DTR/RTS on first open of an AT port */
+ if (port->start_count == 1 && port->type == WWAN_PORT_AT &&
+ port->ops->dtr_rts) {
+ mutex_lock(&port->data_lock);
+ port->at_data.mdmbits |= TIOCM_DTR | TIOCM_RTS;
+ mutex_unlock(&port->data_lock);
+ port->ops->dtr_rts(port, port->at_data.mdmbits);
+ }
+ }
out_unlock:
mutex_unlock(&port->ops_lock);
@@ -773,6 +788,13 @@ static void wwan_port_op_stop(struct wwan_port *port)
mutex_lock(&port->ops_lock);
port->start_count--;
if (!port->start_count) {
+ /* Mirror TTY semantics: drop DTR/RTS on last close of an AT port */
+ if (port->ops && port->type == WWAN_PORT_AT && port->ops->dtr_rts) {
+ mutex_lock(&port->data_lock);
+ port->at_data.mdmbits &= ~(TIOCM_DTR | TIOCM_RTS);
+ mutex_unlock(&port->data_lock);
+ port->ops->dtr_rts(port, port->at_data.mdmbits);
+ }
if (port->ops)
port->ops->stop(port);
skb_queue_purge(&port->rxq);
@@ -980,6 +1002,7 @@ static long wwan_port_fops_at_ioctl(struct wwan_port *port, unsigned int cmd,
unsigned long arg)
{
int ret = 0;
+ bool call_dtr_rts = false;
mutex_lock(&port->data_lock);
@@ -1036,6 +1059,8 @@ static long wwan_port_fops_at_ioctl(struct wwan_port *port, unsigned int cmd,
port->at_data.mdmbits |= mdmbits;
else
port->at_data.mdmbits = mdmbits;
+ if (port->type == WWAN_PORT_AT)
+ call_dtr_rts = true;
break;
}
@@ -1061,6 +1086,19 @@ static long wwan_port_fops_at_ioctl(struct wwan_port *port, unsigned int cmd,
mutex_unlock(&port->data_lock);
+ if (call_dtr_rts) {
+ unsigned int bits;
+
+ mutex_lock(&port->ops_lock);
+ if (port->ops && port->ops->dtr_rts) {
+ mutex_lock(&port->data_lock);
+ bits = port->at_data.mdmbits;
+ mutex_unlock(&port->data_lock);
+ port->ops->dtr_rts(port, bits);
+ }
+ mutex_unlock(&port->ops_lock);
+ }
+
return ret;
}
diff --git a/include/linux/wwan.h b/include/linux/wwan.h
index 1e0e2cb53579..57406139304e 100644
--- a/include/linux/wwan.h
+++ b/include/linux/wwan.h
@@ -57,6 +57,8 @@ struct wwan_port;
* @tx_blocking: Optional blocking routine that sends WWAN port protocol data
* to the device.
* @tx_poll: Optional routine that sets additional TX poll flags.
+ * @dtr_rts: Optional routine that updates the modem control lines to match
+ * @mdmbits (a TIOCM_* bitmask). Only called for WWAN_PORT_AT ports.
*
* The wwan_port_ops structure contains a list of low-level operations
* that control a WWAN port device. All functions are mandatory unless specified.
@@ -70,6 +72,7 @@ struct wwan_port_ops {
int (*tx_blocking)(struct wwan_port *port, struct sk_buff *skb);
__poll_t (*tx_poll)(struct wwan_port *port, struct file *filp,
poll_table *wait);
+ void (*dtr_rts)(struct wwan_port *port, unsigned int mdmbits);
};
/** struct wwan_port_caps - The WWAN port capbilities
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH net-next v5 2/3] bus: mhi: host: pci_generic: enumerate IP_CTRL channel for Sierra EM919x/EM929x
2026-08-19 22:49 [PATCH net-next v5 0/3] net: wwan: support DTR/RTS on AT ports via MHI IP_CTRL Peter Hunt
2026-08-19 22:49 ` [PATCH net-next v5 1/3] net: wwan: core: propagate modem control signals to port drivers Peter Hunt
@ 2026-08-19 22:49 ` Peter Hunt
2026-08-19 22:49 ` [PATCH net-next v5 3/3] net: wwan: mhi_wwan_ctrl: drive DTR/RTS via the IP_CTRL channel Peter Hunt
2 siblings, 0 replies; 4+ messages in thread
From: Peter Hunt @ 2026-08-19 22:49 UTC (permalink / raw)
To: loic.poulain, mani, ryazanov.s.a
Cc: johannes, netdev, mhi, linux-arm-msm, linux-kernel, Peter Hunt
IP_CTRL is a standard Qualcomm MHI control channel (channels 18/19) that
carries the host serial control lines (DTR/RTS) to the modem; it is not
Sierra-specific. It was not enumerated for any device in pci_generic, so
the host had no way to drive those signals.
Enumerate it in the Sierra em919x channel config (shared by the EM919x
and EM929x) using the control event ring. This is the device the change
was tested against; other Qualcomm modem configs that expose IP_CTRL can
enable it the same way, since the mhi_wwan_ctrl DTR support that consumes
it, added by the following patch in this series, is device-agnostic and
binds purely by channel name.
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Peter Hunt <peter.hunt@opengear.com>
---
v4: Reword present-tense forward reference to the consumer in patch 3
---
drivers/bus/mhi/host/pci_generic.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c
index 0d0d9c7ffa4b..ba47dd153837 100644
--- a/drivers/bus/mhi/host/pci_generic.c
+++ b/drivers/bus/mhi/host/pci_generic.c
@@ -728,6 +728,8 @@ static const struct mhi_channel_config mhi_sierra_em919x_channels[] = {
MHI_CHANNEL_CONFIG_DL(13, "MBIM", 128, 0),
MHI_CHANNEL_CONFIG_UL(14, "QMI", 32, 0),
MHI_CHANNEL_CONFIG_DL(15, "QMI", 32, 0),
+ MHI_CHANNEL_CONFIG_UL(18, "IP_CTRL", 32, 0),
+ MHI_CHANNEL_CONFIG_DL(19, "IP_CTRL", 32, 0),
MHI_CHANNEL_CONFIG_UL(32, "DUN", 32, 0),
MHI_CHANNEL_CONFIG_DL(33, "DUN", 32, 0),
MHI_CHANNEL_CONFIG_HW_UL(100, "IP_HW0", 512, 1),
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH net-next v5 3/3] net: wwan: mhi_wwan_ctrl: drive DTR/RTS via the IP_CTRL channel
2026-08-19 22:49 [PATCH net-next v5 0/3] net: wwan: support DTR/RTS on AT ports via MHI IP_CTRL Peter Hunt
2026-08-19 22:49 ` [PATCH net-next v5 1/3] net: wwan: core: propagate modem control signals to port drivers Peter Hunt
2026-08-19 22:49 ` [PATCH net-next v5 2/3] bus: mhi: host: pci_generic: enumerate IP_CTRL channel for Sierra EM919x/EM929x Peter Hunt
@ 2026-08-19 22:49 ` Peter Hunt
2 siblings, 0 replies; 4+ messages in thread
From: Peter Hunt @ 2026-08-19 22:49 UTC (permalink / raw)
To: loic.poulain, mani, ryazanov.s.a
Cc: johannes, netdev, mhi, linux-arm-msm, linux-kernel, Peter Hunt
Qualcomm/Sierra SDX55/SDX65 modems withhold unsolicited AT result codes
(URCs such as +CREG, and the +DMI OMA-DM/LwM2M session indications) on
an AT port until the host asserts DTR. mhi_wwan_ctrl exposed the AT
(DUN) ports but had no way to signal DTR, so URCs never reached
userspace.
Carry the host serial-control lines to the modem over the dedicated
IP_CTRL MHI channel, which this module now also binds. IP_CTRL uses a
separate mhi_driver with its own callbacks so the AT/QMI/MBIM data path
is untouched; the control-channel device for each MHI controller is
tracked in a small registry so an AT port drives the IP_CTRL channel of
its own modem (multiple modems are supported).
The wwan core (patch 1) raises DTR/RTS on first open and drops them on
last close for any AT port whose driver implements ->dtr_rts, so no
open/close handling is needed here. The new ->dtr_rts op lets userspace
assert or de-assert them via TIOCMSET/TIOCMBIC/TIOCMBIS. Received
device->host serial state messages are silently discarded; a single
recycled sink buffer keeps the IP_CTRL DL ring live so the modem's
transmit path does not stall.
->dtr_rts is void, following the tty_port_operations model it is modelled
on. Delivery is best-effort: at_data.mdmbits always reflects the committed
userspace intent for TIOCMGET regardless of whether the IP_CTRL message was
queued, and the next ioctl or open/close cycle will resynchronise the modem
state. mhi_queue_buf failing on a stable IP_CTRL channel is not expected in
normal operation; the DL sink buffer ensures the channel remains open.
Signed-off-by: Peter Hunt <peter.hunt@opengear.com>
---
drivers/net/wwan/mhi_wwan_ctrl.c | 190 ++++++++++++++++++++++++++++++-
1 file changed, 189 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wwan/mhi_wwan_ctrl.c b/drivers/net/wwan/mhi_wwan_ctrl.c
index a31d8540fbb8..1cb91b59256e 100644
--- a/drivers/net/wwan/mhi_wwan_ctrl.c
+++ b/drivers/net/wwan/mhi_wwan_ctrl.c
@@ -1,8 +1,12 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (c) 2021, Linaro Ltd <loic.poulain@linaro.org> */
#include <linux/kernel.h>
+#include <linux/list.h>
#include <linux/mhi.h>
#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/termios.h>
#include <linux/wwan.h>
/* MHI wwan flags */
@@ -14,6 +18,31 @@ enum mhi_wwan_flags {
#define MHI_WWAN_MAX_MTU 0x8000
+/* IP_CTRL channel message that sets the modem's DTR/RTS control lines */
+struct mhi_dtr_ctrl_msg {
+ __le32 preamble;
+ __le32 msg_id;
+ __le32 dest_id;
+ __le32 size;
+ __le32 msg;
+} __packed;
+
+#define MHI_DTR_CTRL_MAGIC 0x4C525443 /* 'CTRL' */
+#define MHI_DTR_MSG_DTR BIT(0)
+#define MHI_DTR_MSG_RTS BIT(1)
+#define MHI_DTR_HOST_STATE 0x10
+
+/* Per-controller IP_CTRL channel, used to signal DTR/RTS to that modem */
+struct mhi_wwan_dtr {
+ struct mhi_controller *cntrl;
+ struct mhi_device *mhi_dev;
+ struct list_head node;
+ u8 rx_buf[sizeof(struct mhi_dtr_ctrl_msg)]; /* sink for modem serial-state DL */
+};
+
+static LIST_HEAD(mhi_wwan_dtr_list);
+static DEFINE_MUTEX(mhi_wwan_dtr_lock);
+
struct mhi_wwan_dev {
/* Lower level is a mhi dev, upper level is a wwan port */
struct mhi_device *mhi_dev;
@@ -103,6 +132,61 @@ static void mhi_wwan_ctrl_refill_work(struct work_struct *work)
}
}
+/* Signal the modem's DTR/RTS lines over its own controller's IP_CTRL channel */
+static int mhi_wwan_ctrl_send_dtr(struct mhi_wwan_dev *mhiwwan, unsigned int mdmbits)
+{
+ struct mhi_controller *cntrl = mhiwwan->mhi_dev->mhi_cntrl;
+ struct mhi_device *ctrl_dev = NULL;
+ struct mhi_dtr_ctrl_msg *dtr_msg;
+ struct mhi_wwan_dtr *dtr;
+ u32 msg = 0;
+ int ret;
+
+ guard(mutex)(&mhi_wwan_dtr_lock);
+
+ list_for_each_entry(dtr, &mhi_wwan_dtr_list, node) {
+ if (dtr->cntrl == cntrl) {
+ ctrl_dev = dtr->mhi_dev;
+ break;
+ }
+ }
+ if (!ctrl_dev) {
+ dev_dbg(&mhiwwan->mhi_dev->dev,
+ "IP_CTRL not enumerated; DTR/RTS not signalled to modem\n");
+ return 0;
+ }
+
+ dtr_msg = kzalloc_obj(*dtr_msg);
+ if (!dtr_msg)
+ return -ENOMEM;
+
+ if (mdmbits & TIOCM_DTR)
+ msg |= MHI_DTR_MSG_DTR;
+ if (mdmbits & TIOCM_RTS)
+ msg |= MHI_DTR_MSG_RTS;
+
+ dtr_msg->preamble = cpu_to_le32(MHI_DTR_CTRL_MAGIC);
+ dtr_msg->msg_id = cpu_to_le32(MHI_DTR_HOST_STATE);
+ dtr_msg->dest_id = cpu_to_le32(mhiwwan->mhi_dev->ul_chan_id);
+ dtr_msg->size = cpu_to_le32(sizeof(__le32));
+ dtr_msg->msg = cpu_to_le32(msg);
+
+ ret = mhi_queue_buf(ctrl_dev, DMA_TO_DEVICE, dtr_msg, sizeof(*dtr_msg),
+ MHI_EOT);
+ if (ret) {
+ dev_dbg(&mhiwwan->mhi_dev->dev,
+ "failed to queue DTR/RTS signal: %d\n", ret);
+ kfree(dtr_msg);
+ }
+
+ return ret;
+}
+
+static void mhi_wwan_ctrl_dtr_rts(struct wwan_port *port, unsigned int mdmbits)
+{
+ mhi_wwan_ctrl_send_dtr(wwan_port_get_drvdata(port), mdmbits);
+}
+
static int mhi_wwan_ctrl_start(struct wwan_port *port)
{
struct mhi_wwan_dev *mhiwwan = wwan_port_get_drvdata(port);
@@ -163,6 +247,7 @@ static const struct wwan_port_ops wwan_pops = {
.start = mhi_wwan_ctrl_start,
.stop = mhi_wwan_ctrl_stop,
.tx = mhi_wwan_ctrl_tx,
+ .dtr_rts = mhi_wwan_ctrl_dtr_rts,
};
static void mhi_ul_xfer_cb(struct mhi_device *mhi_dev,
@@ -255,6 +340,71 @@ static void mhi_wwan_ctrl_remove(struct mhi_device *mhi_dev)
kfree(mhiwwan);
}
+/* IP_CTRL channel driver, bound separately so the data-port path is untouched */
+static void mhi_wwan_dtr_ul_xfer_cb(struct mhi_device *mhi_dev,
+ struct mhi_result *mhi_result)
+{
+ /* MHI core has done with the buffer, release it */
+ kfree(mhi_result->buf_addr);
+}
+
+static void mhi_wwan_dtr_dl_xfer_cb(struct mhi_device *mhi_dev,
+ struct mhi_result *mhi_result)
+{
+ struct mhi_wwan_dtr *dtr = dev_get_drvdata(&mhi_dev->dev);
+
+ /* Modem serial state not needed; requeue the sink buffer to keep DL ring live */
+ mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, dtr->rx_buf,
+ sizeof(dtr->rx_buf), MHI_EOT);
+}
+
+static int mhi_wwan_dtr_probe(struct mhi_device *mhi_dev,
+ const struct mhi_device_id *id)
+{
+ struct mhi_wwan_dtr *dtr;
+ int ret;
+
+ dtr = kzalloc_obj(*dtr);
+ if (!dtr)
+ return -ENOMEM;
+
+ ret = mhi_prepare_for_transfer(mhi_dev);
+ if (ret) {
+ kfree(dtr);
+ return ret;
+ }
+
+ dtr->cntrl = mhi_dev->mhi_cntrl;
+ dtr->mhi_dev = mhi_dev;
+ dev_set_drvdata(&mhi_dev->dev, dtr);
+
+ ret = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, dtr->rx_buf,
+ sizeof(dtr->rx_buf), MHI_EOT);
+ if (ret) {
+ mhi_unprepare_from_transfer(mhi_dev);
+ kfree(dtr);
+ return ret;
+ }
+
+ mutex_lock(&mhi_wwan_dtr_lock);
+ list_add(&dtr->node, &mhi_wwan_dtr_list);
+ mutex_unlock(&mhi_wwan_dtr_lock);
+
+ return 0;
+}
+
+static void mhi_wwan_dtr_remove(struct mhi_device *mhi_dev)
+{
+ struct mhi_wwan_dtr *dtr = dev_get_drvdata(&mhi_dev->dev);
+
+ mutex_lock(&mhi_wwan_dtr_lock);
+ list_del(&dtr->node);
+ mutex_unlock(&mhi_wwan_dtr_lock);
+
+ mhi_unprepare_from_transfer(mhi_dev);
+ kfree(dtr);
+}
+
static const struct mhi_device_id mhi_wwan_ctrl_match_table[] = {
{ .chan = "DUN", .driver_data = WWAN_PORT_AT },
{ .chan = "DUN2", .driver_data = WWAN_PORT_AT },
@@ -278,7 +428,45 @@ static struct mhi_driver mhi_wwan_ctrl_driver = {
},
};
-module_mhi_driver(mhi_wwan_ctrl_driver);
+static const struct mhi_device_id mhi_wwan_dtr_match_table[] = {
+ { .chan = "IP_CTRL" },
+ {},
+};
+MODULE_DEVICE_TABLE(mhi, mhi_wwan_dtr_match_table);
+
+static struct mhi_driver mhi_wwan_dtr_driver = {
+ .id_table = mhi_wwan_dtr_match_table,
+ .remove = mhi_wwan_dtr_remove,
+ .probe = mhi_wwan_dtr_probe,
+ .ul_xfer_cb = mhi_wwan_dtr_ul_xfer_cb,
+ .dl_xfer_cb = mhi_wwan_dtr_dl_xfer_cb,
+ .driver = {
+ .name = "mhi_wwan_dtr",
+ },
+};
+
+static int __init mhi_wwan_ctrl_init(void)
+{
+ int ret;
+
+ ret = mhi_driver_register(&mhi_wwan_dtr_driver);
+ if (ret)
+ return ret;
+
+ ret = mhi_driver_register(&mhi_wwan_ctrl_driver);
+ if (ret)
+ mhi_driver_unregister(&mhi_wwan_dtr_driver);
+
+ return ret;
+}
+module_init(mhi_wwan_ctrl_init);
+
+static void __exit mhi_wwan_ctrl_exit(void)
+{
+ mhi_driver_unregister(&mhi_wwan_ctrl_driver);
+ mhi_driver_unregister(&mhi_wwan_dtr_driver);
+}
+module_exit(mhi_wwan_ctrl_exit);
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("MHI WWAN CTRL Driver");
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread