I think the reason why 4.14.x works is because of commit 9d63f17661e2
("spi-nor: intel-spi: Fix broken software sequencing codes").

The current theory is that for certain serial flashes (those                    
                                                                                
                                            
with SPI_NOR_HAS_LOCK set in drivers/mtd/spi-nor/spi-nor.c) Linux               
                                                                                
                                                     
SPI-NOR core wants to clear the status register (SR) in addition to             
                                                                                
                                                     
reading the chip JEDEC ID. This is done to make sure protection bits            
                                                                                
                                                     
(BP0, BP1 and BP2) are cleared.                                                 
                                                                                
                                                     
                                                                                
                                                                                
                                                     
The sequence looks like this:                                                   
                                                                                
                                                     
                                                                                
                                                                                
                                                     
  WREN (write enable)                                                           
                                                                                
                                                     
  WRSR with 0 (write status register)                                           
                                                                                
                                                     
                                                                                
                                                                                
                                                     
However, the intel-spi driver had an off-by-one bug that causes it to           
                                                                                
                                                     
write two bytes instead of one. So the above sequence actually looks            
                                                                                
                                                     
like:                                                                           
                                                                                
                                                     
                                                                                
                                                                                
                                                     
  WREN (write enable)                                                           
                                                                                
                                                     
  WRSR with 0, X (write status register)                                        
                                                                                
                                                     
                                                                                
                                                                                
                                                     
Where X is something that is in FDATA[1] FIFO. Most likely this is part         
                                                                                
                                                     
of the just read chip JEDEC ID. Now, WRSR command is weird in a sense           
                                                                                
                                                     
that it allows writing both the status register and the control                 
                                                                                
                                                     
register even though there are separate commands to read them. If the X         
                                                                                
                                                     
above has bit 6 set we end up writing this to the control register which        
                                                                                
                                                     
means that we have:                                                             
                                                                                
                                                     
                                                                                
                                                                                
                                                     
  SR=0x00 CR=0x40                                                               
                                                                                
                                                     
                                                                                
                                                                                
                                                     
(CR value can be something else but bit 6 needs to be set)

Because BP0, BP1 and BP2 in SR are 0 and CMP in CR is 1, this means that        
                                                                                
                                                     
the whole chip becomes read-only (CMP complements BP0, BP1 and BP2) and         
                                                                                
                                                     
this prevents the BIOS from saving settings anymore.

The off-by-one bug was already fixed in the mainline kernel by                  
                                                                                
                                               
commit 9d63f17661e2 ("spi-nor: intel-spi: Fix broken software sequencing        
                                                                                
                                                            
codes") in September.

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1734147

Title:
  Ubuntu 17.10 corrupting BIOS - many LENOVO laptops models

Status in Linux:
  Unknown
Status in linux package in Ubuntu:
  Confirmed
Status in linux-hwe-edge package in Ubuntu:
  Confirmed
Status in linux-oem package in Ubuntu:
  Confirmed
Status in linux source package in Xenial:
  Invalid
Status in linux-hwe-edge source package in Xenial:
  Fix Released
Status in linux-oem source package in Xenial:
  Fix Released
Status in linux source package in Artful:
  Fix Released
Status in linux-hwe-edge source package in Artful:
  Invalid
Status in linux-oem source package in Artful:
  Invalid
Status in linux package in openSUSE:
  New

Bug description:
  Description: An update to linux kernel on Ubuntu 17.10 that enabled
  the intel-spi-* drivers made Insyde BIOS unusable. Main issues were
  Settings being not stored, USB Boot impossible and EFI entries read-
  only.

  Fix: The issue was fixed in Kernel Version 4.13.0-21. But previous
  affected machines still suffered from a broken BIOS.

  Repair: Boot Linux and Install Kernel Version 4.14.9. Reboot into
  Linux and BIOS should be restored to a working state.

  ---

  Test Case: Fix has been verified by our HWE team on affected hardware.

  Regression Potential: Minimal, it's unlikely anyone is actually doing
  anything which requires this driver.

  ---

  Affected Machines:

  Lenovo B40-70
  Lenovo B50-70
  Lenovo B50-80
  Lenovo Flex-3
  Lenovo Flex-10
  Lenovo G40-30
  Lenovo G50-30
  Lenovo G50-70
  Lenovo G50-80
  Lenovo S20-30
  Lenovo U31-70
  Lenovo Y50-70
  Lenovo Y70-70
  Lenovo Yoga Thinkpad (20C0)
  Lenovo Yoga 2 11" - 20332
  Lenovo Z50-70
  Lenovo Z51-70
  Lenovo ideapad 100-15IBY

  Acer Aspire E5-771G
  Acer Aspire ES1-111M-C1LE
  Acer TravelMate B113
  Toshiba Satellite S55T-B5233
  Toshiba Satellite L50-B-1R7
  Toshiba Satellite S50-B-13G
  Dell Inspiron 15-3531
  Mediacom Smartbook 14 Ultra M-SB14UC
  Acer Aspire E3-111-C0UM

  ---

  Original Description:

  Basically on Lenovo Y50-70 after installing Ubuntu 17.10, many users
  reported a corrupted BIOS.

  It's not possible to save new settings in BIOS anymore and after
  rebooting, the system starts with the old settings.

  Moreover (and most important) USB booting is not possible anymore
  since USB is not recognized. It's very serious, since our machines do
  not have a CDROM.

  Lenovo forums at the moment are full of topics regading this issue.

  Thank you!!

To manage notifications about this bug go to:
https://bugs.launchpad.net/linux/+bug/1734147/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to     : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to