linux-kernel - [PATCH 2/2] mtd: spi-nor: macronix: use RDCR opcode 0x15

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250922155635.749975-3-maarten@zanders.be>
Date: Mon, 22 Sep 2025 17:56:33 +0200
From: Maarten Zanders <maarten@...ders.be>
To: Tudor Ambarus <tudor.ambarus@...aro.org>,
	Pratyush Yadav <pratyush@...nel.org>,
	Michael Walle <mwalle@...nel.org>,
	Miquel Raynal <miquel.raynal@...tlin.com>,
	Richard Weinberger <richard@....at>,
	Vignesh Raghavendra <vigneshr@...com>,
	Boris Brezillon <bbrezillon@...nel.org>
Cc: Maarten Zanders <maarten@...ders.be>,
	linux-mtd@...ts.infradead.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH 2/2] mtd: spi-nor: macronix: use RDCR opcode 0x15

Macronix devices use opcode 0x15 to read the configuration register (CR)
instead of the default 0x35. On parts such as the MX25L12833F, reading
the CR with 0x35 returns garbage values, which are then written back
when updating the status register (SR). This may unintentionally program
OTP bits (e.g. top/bottom block protection) and change other default
values.

Other Macronix parts avoid this issue because their SFDP data specifies
that CR is not read (BFPT_DWORD15_QER_SR2_BIT1_NO_RD), and the driver
assumes CR defaults to all zeroes which matches the hardware register.

Set the RDCR opcode to 0x15 for Macronix flashes to avoid corrupt CR
writes in cases where it is used.

Note that for affected parts, the block protection mechanism might
remain broken through the OTP bit: locking an upper block (which is the
only one supported by the driver) is now locking the lower block in HW.

Fixes: 10526d85e4c6 ("mtd: spi-nor: Move Macronix bits out of core.c")
Signed-off-by: Maarten Zanders <maarten@...ders.be>
---
 drivers/mtd/spi-nor/macronix.c | 1 +
 include/linux/mtd/spi-nor.h    | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/drivers/mtd/spi-nor/macronix.c b/drivers/mtd/spi-nor/macronix.c
index e97f5cbd9aad..de3f3d963f86 100644
--- a/drivers/mtd/spi-nor/macronix.c
+++ b/drivers/mtd/spi-nor/macronix.c
@@ -322,6 +322,7 @@ static int macronix_nor_late_init(struct spi_nor *nor)
 	if (!nor->params->set_4byte_addr_mode)
 		nor->params->set_4byte_addr_mode = spi_nor_set_4byte_addr_mode_en4b_ex4b;
 	nor->params->set_octal_dtr = macronix_nor_set_octal_dtr;
+	nor->params->rdcr_opcode = SPINOR_OP_RDCR_MX;

 	return 0;
 }
diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h
index cdcfe0fd2e7d..e35405b126c2 100644
--- a/include/linux/mtd/spi-nor.h
+++ b/include/linux/mtd/spi-nor.h
@@ -92,6 +92,9 @@
 #define SPINOR_OP_RD_EVCR      0x65    /* Read EVCR register */
 #define SPINOR_OP_WD_EVCR      0x61    /* Write EVCR register */

+/* Used for Macronix flashes only. */
+#define SPINOR_OP_RDCR_MX	0x15	/* Read configuration register */
+
 /* Used for GigaDevices and Winbond flashes. */
 #define SPINOR_OP_ESECR		0x44	/* Erase Security registers */
 #define SPINOR_OP_PSECR		0x42	/* Program Security registers */
-- 
2.51.0