[spi-0115]spi: dw: use "smp_mb()" to avoid sending spi data error

Bug #1859744 reported by Fred Kimmy on 2020-01-15
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kunpeng920
Undecided
Unassigned
Ubuntu-18.04
Undecided
Unassigned
Ubuntu-18.04-hwe
Undecided
Ike Panhc
Ubuntu-19.10
Undecided
Ike Panhc
Ubuntu-20.04
Undecided
Ike Panhc
Upstream-kernel
Undecided
Unassigned
linux (Ubuntu)
Undecided
Ike Panhc
Eoan
Undecided
Ike Panhc
Focal
Undecided
Ike Panhc

Bug Description

[Impact]
Sometimes, TPM fails because SPI data error

[Fix]
bfda044533b2 spi: dw: use "smp_mb()" to avoid sending spi data error

[Test]
Reboot system few times and no TPM error message

[Regression Potential]
Only on SPI function. Already tested on focal kernel

[Bug Description]

Because of out-of-order execution about some CPU architecture,
In this debug stage we find Completing spi interrupt enable ->
prodrucing TXEI interrupt -> running "interrupt_transfer" function
will prior to set "dw->rx and dws->rx_end" data, so this patch add
memory barrier to enable dw->rx and dw->rx_end to be visible and
solve to send SPI data error.
eg:
it will fix to this following low possibility error in testing environment
which using SPI control to connect TPM Modules

kernel: tpm tpm0: Operation Timed out
kernel: tpm tpm0: tpm_relinquish_locality: : error -1

[Steps to Reproduce]
1) enable ima and tpm
2)reboot this system
3)

[Actual Results]
kernel: tpm tpm0: Operation Timed out
kernel: tpm tpm0: tpm_relinquish_locality: : error -1

[Expected Results]
ok

[Reproducibility]
low probabilities

[Additional information]
(Firmware version, kernel version, affected hardware, etc. if required):

[Resolution]
bfda044533b2 spi: dw: use "smp_mb()" to avoid sending spi data error

CVE References

Ike Panhc (ikepanhc) wrote :

bug 1859743 is also mention "EFI/stub: tpm: enable tpm eventlog function for ARM64 platform" in resolution. Is this a duplicate bug or another patch shall be mentioned?

Changed in kunpeng920:
status: New → Incomplete
tags: added: ikeradar
Fred Kimmy (kongzizaixian) wrote :

thi patchset will slove this new bug, not bug 1859743 issue.

Changed in kunpeng920:
status: Incomplete → New
Ike Panhc (ikepanhc) wrote :

Assuming patch "spi: dw: use "smp_mb()" to avoid sending spi data error" is the fix.

description: updated
Ike Panhc (ikepanhc) wrote :

In linux-next but not hit mainline yet.

$ git show bfda044533b2
commit bfda044533b213985bc62bd7ca96f2b984d21b80
Author: Xinwei Kong <email address hidden>
Date: Fri Jan 3 10:52:10 2020 +0800

    spi: dw: use "smp_mb()" to avoid sending spi data error

    Because of out-of-order execution about some CPU architecture,
    In this debug stage we find Completing spi interrupt enable ->
    prodrucing TXEI interrupt -> running "interrupt_transfer" function
    will prior to set "dw->rx and dws->rx_end" data, so this patch add
    memory barrier to enable dw->rx and dw->rx_end to be visible and
    solve to send SPI data error.
    eg:
    it will fix to this following low possibility error in testing environment
    which using SPI control to connect TPM Modules

    kernel: tpm tpm0: Operation Timed out
    kernel: tpm tpm0: tpm_relinquish_locality: : error -1

    Signed-off-by: fengsheng <email address hidden>
    Signed-off-by: Xinwei Kong <email address hidden>
    Link: https://lore<email address hidden>
    Signed-off-by: Mark Brown <email address hidden>

diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index c547ae38ed69..310492e21b33 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -297,6 +297,9 @@ static int dw_spi_transfer_one(struct spi_controller *master,
        dws->len = transfer->len;
        spin_unlock_irqrestore(&dws->buf_lock, flags);

+ /* Ensure dw->rx and dw->rx_end are visible */
+ smp_mb();
+
        spi_enable_chip(dws, 0);

        /* Handle per transfer options for bpw and speed */

Ike Panhc (ikepanhc) on 2020-02-04
description: updated
Ike Panhc (ikepanhc) on 2020-02-09
Changed in linux (Ubuntu):
assignee: nobody → Ike Panhc (ikepanhc)
status: New → In Progress
Ike Panhc (ikepanhc) wrote :
Ike Panhc (ikepanhc) wrote :

DW SPI patches does not backport for 4.15 kernel. Set to Won't Fix. See bug 1826142

Changed in kunpeng920:
status: New → Fix Committed
Ike Panhc (ikepanhc) on 2020-02-24
tags: removed: ikeradar
Ike Panhc (ikepanhc) on 2020-03-03
Changed in linux (Ubuntu Eoan):
status: New → In Progress
assignee: nobody → Ike Panhc (ikepanhc)
Changed in kunpeng920:
status: Fix Committed → In Progress
Ike Panhc (ikepanhc) wrote :
Ike Panhc (ikepanhc) on 2020-03-11
description: updated

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-focal
Changed in linux (Ubuntu Eoan):
status: In Progress → Fix Committed
Ike Panhc (ikepanhc) on 2020-03-14
Changed in kunpeng920:
status: In Progress → Fix Committed
Ike Panhc (ikepanhc) wrote :

Thanks. 5.4.0-18.22 works fine to me.

tags: added: verification-done-focal
removed: verification-needed-focal
Launchpad Janitor (janitor) wrote :
Download full text (81.5 KiB)

This bug was fixed in the package linux - 5.4.0-18.22

---------------
linux (5.4.0-18.22) focal; urgency=medium

  * focal/linux: 5.4.0-18.22 -proposed tracker (LP: #1866488)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * Add sysfs attribute to show remapped NVMe (LP: #1863621)
    - SAUCE: ata: ahci: Add sysfs attribute to show remapped NVMe device count

  * [20.04 FEAT] Compression improvements in Linux kernel (LP: #1830208)
    - lib/zlib: add s390 hardware support for kernel zlib_deflate
    - s390/boot: rename HEAP_SIZE due to name collision
    - lib/zlib: add s390 hardware support for kernel zlib_inflate
    - s390/boot: add dfltcc= kernel command line parameter
    - lib/zlib: add zlib_deflate_dfltcc_enabled() function
    - btrfs: use larger zlib buffer for s390 hardware compression
    - [Config] Introducing s390x specific kernel config option CONFIG_ZLIB_DFLTCC

  * [UBUNTU 20.04] s390x/pci: increase CONFIG_PCI_NR_FUNCTIONS to 512 in kernel
    config (LP: #1866056)
    - [Config] Increase CONFIG_PCI_NR_FUNCTIONS from 64 to 512 starting with focal
      on s390x

  * CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set (LP: #1865332)
    - [Config] CONFIG_IP_MROUTE_MULTIPLE_TABLES=y

  * Dell XPS 13 9300 Intel 1650S wifi [34f0:1651] fails to load firmware
    (LP: #1865962)
    - iwlwifi: remove IWL_DEVICE_22560/IWL_DEVICE_FAMILY_22560
    - iwlwifi: 22000: fix some indentation
    - iwlwifi: pcie: rx: use rxq queue_size instead of constant
    - iwlwifi: allocate more receive buffers for HE devices
    - iwlwifi: remove some outdated iwl22000 configurations
    - iwlwifi: assume the driver_data is a trans_cfg, but allow full cfg

  * [FOCAL][REGRESSION] Intel Gen 9 brightness cannot be controlled
    (LP: #1861521)
    - Revert "USUNTU: SAUCE: drm/i915: Force DPCD backlight mode on Dell Precision
      4K sku"
    - Revert "UBUNTU: SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd
      Gen 4K AMOLED panel"
    - SAUCE: drm/dp: Introduce EDID-based quirks
    - SAUCE: drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED
      panel
    - SAUCE: drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels

  * [20.04 FEAT] Enable proper kprobes on ftrace support (LP: #1865858)
    - s390/ftrace: save traced function caller
    - s390: support KPROBES_ON_FTRACE

  * alsa/sof: load different firmware on different platforms (LP: #1857409)
    - ASoC: SOF: Intel: hda: use fallback for firmware name
    - ASoC: Intel: acpi-match: split CNL tables in three
    - ASoC: SOF: Intel: Fix CFL and CML FW nocodec binary names.

  * [UBUNTU 20.04] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x
    starting with focal (LP: #1865452)
    - [Config] Enable CONFIG_NET_SWITCHDEV in kernel config for s390x starting
      with focal

  * Focal update: v5.4.24 upstream stable release (LP: #1866333)
    - io_uring: grab ->fs as part of async offload
    - EDAC: skx_common: downgrade message importance on missing PCI device
    - net: dsa: b53: Ensure the default VID is untagged
    - net: fib_rules: Correctly set table field when table number exceeds 8 bit...

Changed in linux (Ubuntu Focal):
status: In Progress → Fix Released

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-eoan' to 'verification-done-eoan'. If the problem still exists, change the tag 'verification-needed-eoan' to 'verification-failed-eoan'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-eoan
Ike Panhc (ikepanhc) wrote :

Thanks. kernel 5.3.0-43.36 works for me.

tags: added: verification-done-eoan
removed: verification-needed-eoan
Launchpad Janitor (janitor) wrote :
Download full text (49.1 KiB)

This bug was fixed in the package linux - 5.3.0-46.38

---------------
linux (5.3.0-46.38) eoan; urgency=medium

  * eoan/linux: 5.3.0-43.36 -proposed tracker (LP: #1867301)

  * Fix AMD Stoney Ridge screen flickering under 4K resolution (LP: #1864005)
    - iommu/amd: Disable IOMMU on Stoney Ridge systems

  * Allow BPF tracing under lockdown (LP: #1868626)
    - Revert "UBUNTU: SAUCE: (efi-lockdown) Lock down kprobes"
    - Revert "bpf: Restrict bpf when kernel lockdown is in confidentiality mode"

  * Missing wireless network interface after kernel 5.3.0-43 upgrade with eoan
    (LP: #1868442)
    - iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * iSCSI-target: Deleting a LUN hangs in the kernel (LP: #1862682)
    - scsi: Revert "target/core: Inline transport_lun_remove_cmd()"

  * Stop using get_scalar_status command in Dell AIO uart backlight driver
    (LP: #1865402)
    - SAUCE: platform/x86: dell-uart-backlight: add get_display_mode command

  * Eoan update: upstream stable patchset 2020-03-11 (LP: #1867051)
    - Revert "drm/sun4i: dsi: Change the start delay calculation"
    - ovl: fix lseek overflow on 32bit
    - kernel/module: Fix memleak in module_add_modinfo_attrs()
    - media: iguanair: fix endpoint sanity check
    - ocfs2: fix oops when writing cloned file
    - x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
    - udf: Allow writing to 'Rewritable' partitions
    - printk: fix exclusive_console replaying
    - iwlwifi: mvm: fix NVM check for 3168 devices
    - sparc32: fix struct ipc64_perm type definition
    - cls_rsvp: fix rsvp_policy
    - gtp: use __GFP_NOWARN to avoid memalloc warning
    - l2tp: Allow duplicate session creation with UDP
    - net: hsr: fix possible NULL deref in hsr_handle_frame()
    - net_sched: fix an OOB access in cls_tcindex
    - net: stmmac: Delete txtimer in suspend()
    - bnxt_en: Fix TC queue mapping.
    - tcp: clear tp->total_retrans in tcp_disconnect()
    - tcp: clear tp->delivered in tcp_disconnect()
    - tcp: clear tp->data_segs{in|out} in tcp_disconnect()
    - tcp: clear tp->segs_{in|out} in tcp_disconnect()
    - rxrpc: Fix use-after-free in rxrpc_put_local()
    - rxrpc: Fix insufficient receive notification generation
    - rxrpc: Fix missing active use pinning of rxrpc_local object
    - rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
    - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
    - mfd: dln2: More sanity checking for endpoints
    - ipc/msg.c: consolidate all xxxctl_down() functions
    - tracing: Fix sched switch start/stop refcount racy updates
    - rcu: Avoid data-race in rcu_gp_fqs_check_wake()
    - brcmfmac: Fix memory leak in brcmf_usbdev_qinit
    - usb: typec: tcpci: mask event interrupts when remove driver
    - usb: gadget: legacy: set max_speed to super-speed
    - usb: gadget: f_ncm: Use atomic_t to track in-flight request
    - usb: gadget: f_ecm: Use atomic_t to track in-flight request
    - ALSA: usb-audio: Fix endianess in descriptor validatio...

Changed in linux (Ubuntu Eoan):
status: Fix Committed → Fix Released
Ike Panhc (ikepanhc) on 2020-04-27
Changed in kunpeng920:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers