linux-kernel - Re: [PATCH 2/4] spi: cadence-quadspi: Flush posted register writes before DAC access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <mafs0tt1ithcn.fsf@kernel.org>
Date: Thu, 04 Sep 2025 16:36:24 +0200
From: Pratyush Yadav <pratyush@...nel.org>
To: Santhosh Kumar K <s-k6@...com>
Cc: <miquel.raynal@...tlin.com>,  <broonie@...nel.org>,  <vigneshr@...com>,
  <marex@...x.de>,  <computersforpeace@...il.com>,
  <grmoore@...nsource.altera.com>,  <theo.lebrun@...tlin.com>,
  <linux-spi@...r.kernel.org>,  <linux-kernel@...r.kernel.org>,
  <praneeth@...com>,  <p-mantena@...com>,  <a-dutta@...com>,
  <u-kumar1@...com>,  Pratyush Yadav <pratyush@...nel.org>,
  <stable@...r.kernel.org>
Subject: Re: [PATCH 2/4] spi: cadence-quadspi: Flush posted register writes
 before DAC access

On Thu, Sep 04 2025, Santhosh Kumar K wrote:

> From: Pratyush Yadav <pratyush@...nel.org>
>
> cqspi_read_setup() and cqspi_write_setup() program the address width as
> the last step in the setup. This is likely to be immediately followed by
> a DAC region read/write. On TI K3 SoCs the DAC region is on a different
> endpoint from the register region. This means that the order of the two
> operations is not guaranteed, and they might be reordered at the
> interconnect level. It is possible that the DAC read/write goes through
> before the address width update goes through. In this situation if the
> previous command used a different address width the OSPI command is sent
> with the wrong number of address bytes, resulting in an invalid command
> and undefined behavior.
>
> Read back the size register to make sure the write gets flushed before
> accessing the DAC region.
>
> Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
> CC: stable@...r.kernel.org
> Signed-off-by: Pratyush Yadav <pratyush@...nel.org>
> Signed-off-by: Santhosh Kumar K <s-k6@...com>

Same as the previous,

Reviewed-by: Pratyush Yadav <pratyush@...nel.org>

[...]

-- 
Regards,
Pratyush Yadav