Re: [PATCH] serial: 8250: clear stuck RX-timeout interrupt on LPC32xx (PORT_LPC3220)

[Andy Shevchenko]

On Fri, Jul 17, 2026 at 09:35:30AM -0300, Ryan Wilbur wrote:
> The LPC32xx UART can latch an RX character-timeout interrupt while the
> RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT (0x0c) but LSR.DR is
> clear. A character timeout is only cleared by reading RHR, but
> serial8250_rx_chars() reads RHR only when LSR.DR is set, so nothing ever
> clears the condition. The interrupt is level-triggered and re-fires
> immediately, so on a single-core ARM926 the resulting interrupt
> storm livelocks the CPU.
> 
> It is reproducible when userspace repeatedly opens the front-panel port
> (ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and
> the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping
> the soft-lockup detector in serial8250_handle_irq_locked().
> 
> Fix this by doing one throwaway RHR read to clear the timeout. It is gated
> on PORT_LPC3220 and only fires when the FIFO is empty (LSR.DR clear), so
> no real received data is ever discarded, and it is a no-op on healthy
> UARTs which never report a timeout with DR==0.
> 
> This is the same class of bug already worked around for other 8250 cores;
> see commit 424d79183af0 ("serial: 8250_dw: Avoid "too much work" from bogus rx timeout interrupt")
> which reports the identical iir=0xcc/lsr=0x60. See also
> UART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271.

...

> +	/*
> +	 * On PORT_LPC3220 the UART can raise an RX character-timeout
> +	 * interrupt with an empty RX FIFO (IIR reports RX_TIMEOUT but
> +	 * LSR.DR is clear). The timeout is only cleared by reading RHR,
> +	 * but the RX path below is skipped when the FIFO is empty, so
> +	 * nothing clears it. IRQ then re-fires immediately and livelocks
> +	 * this single-core. Do one throwaway RHR read to clear it.

> +	 * Same bug worked around for other 8250 cores (8250_dw, 8250_omap, 8250_bcm7271).

This is 8250-port.c.

> +	 */
> +	if (port->type == PORT_LPC3220 &&

Why do we have this then?

> +	    (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT &&
> +	    !(status & UART_LSR_DR))
> +		serial_in(up, UART_RX);

-- 
With Best Regards,
Andy Shevchenko