Subject: tpm_tis: fix stall after iowrite*()s
From: Haris Okanovic <>
Date: Tue Aug 15 15:13:08 2017 -0500

From: Haris Okanovic <>

ioread8() operations to TPM MMIO addresses can stall the cpu when
immediately following a sequence of iowrite*()'s to the same region.

For example, cyclitest measures ~400us latency spikes when a non-RT
usermode application communicates with an SPI-based TPM chip (Intel Atom
E3940 system, PREEMPT_RT kernel). The spikes are caused by a
stalling ioread8() operation following a sequence of 30+ iowrite8()s to
the same address. I believe this happens because the write sequence is
buffered (in cpu or somewhere along the bus), and gets flushed on the
first LOAD instruction (ioread*()) that follows.

The enclosed change appears to fix this issue: read the TPM chip's
access register (status code) after every iowrite*() operation to
amortize the cost of flushing data to chip across multiple instructions.

Signed-off-by: Haris Okanovic <>
Signed-off-by: Sebastian Andrzej Siewior <>
Signed-off-by: Thomas Gleixner <>

 drivers/char/tpm/tpm_tis.c |   29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)
@ drivers/char/tpm/tpm_tis.c:53 @ static inline struct tpm_tis_tcg_phy *to
 	return container_of(data, struct tpm_tis_tcg_phy, priv);
+ * Flushes previous write operations to chip so that a subsequent
+ * ioread*()s won't stall a cpu.
+ */
+static inline void tpm_tis_flush(void __iomem *iobase)
+	ioread8(iobase + TPM_ACCESS(0));
+#define tpm_tis_flush(iobase) do { } while (0)
+static inline void tpm_tis_iowrite8(u8 b, void __iomem *iobase, u32 addr)
+	iowrite8(b, iobase + addr);
+	tpm_tis_flush(iobase);
+static inline void tpm_tis_iowrite32(u32 b, void __iomem *iobase, u32 addr)
+	iowrite32(b, iobase + addr);
+	tpm_tis_flush(iobase);
 static int interrupts = -1;
 module_param(interrupts, int, 0444);
 MODULE_PARM_DESC(interrupts, "Enable interrupts");
@ drivers/char/tpm/tpm_tis.c:213 @ static int tpm_tcg_write_bytes(struct tp
 	switch (io_mode) {
 	case TPM_TIS_PHYS_8:
 		while (len--)
-			iowrite8(*value++, phy->iobase + addr);
+			tpm_tis_iowrite8(*value++, phy->iobase, addr);
 	case TPM_TIS_PHYS_16:
 		return -EINVAL;
 	case TPM_TIS_PHYS_32:
-		iowrite32(le32_to_cpu(*((__le32 *)value)), phy->iobase + addr);
+		tpm_tis_iowrite32(le32_to_cpu(*((__le32 *)value)), phy->iobase, addr);