linux-kernel - Re: [PATCH 2/2] mtd: spi-nor: macronix: use RDCR opcode 0x15

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <DD08QRGQSU2G.1GB9CNQJV82CW@kernel.org>
Date: Tue, 23 Sep 2025 16:14:35 +0200
From: "Michael Walle" <mwalle@...nel.org>
To: "Maarten Zanders" <maarten@...ders.be>, "Tudor Ambarus"
 <tudor.ambarus@...aro.org>, "Pratyush Yadav" <pratyush@...nel.org>, "Miquel
 Raynal" <miquel.raynal@...tlin.com>, "Richard Weinberger" <richard@....at>,
 "Vignesh Raghavendra" <vigneshr@...com>, "Boris Brezillon"
 <bbrezillon@...nel.org>
Cc: <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/2] mtd: spi-nor: macronix: use RDCR opcode 0x15

Hi Maarten,

On Mon Sep 22, 2025 at 5:56 PM CEST, Maarten Zanders wrote:
> Macronix devices use opcode 0x15 to read the configuration register (CR)
> instead of the default 0x35. On parts such as the MX25L12833F, reading
> the CR with 0x35 returns garbage values, which are then written back
> when updating the status register (SR). This may unintentionally program
> OTP bits (e.g. top/bottom block protection) and change other default
> values.
>
> Other Macronix parts avoid this issue because their SFDP data specifies
> that CR is not read (BFPT_DWORD15_QER_SR2_BIT1_NO_RD), and the driver
> assumes CR defaults to all zeroes which matches the hardware register.

Why isn't that also true for this device? It supports SFDP. Does it
have a wrong value there?

Could you dump please the SFDP and post it here, see [1].

> Set the RDCR opcode to 0x15 for Macronix flashes to avoid corrupt CR
> writes in cases where it is used.
>
> Note that for affected parts, the block protection mechanism might
> remain broken through the OTP bit: locking an upper block (which is the
> only one supported by the driver) is now locking the lower block in HW.
>
> Fixes: 10526d85e4c6 ("mtd: spi-nor: Move Macronix bits out of core.c")

I doubt that this is the correct Fixes tag as this only moves code
around.

But I'm also not convinced that we should fix it that way. I just
had a look at a random macronix flash MX25L12805D and it doesn't
have that opcode. Thus, just adding that to all the macronix flashes
doesn't make much sense. But it also doesn't seem to have a WRSR
command that takes 16bits.. and the core unconditonally set
SNOR_F_HAS_16BIT_SR. Hum.

So maybe just clear the SNOR_F_HAS_16BIT_SR or add SNOR_F_NO_READ_CR
for the macronix flashes by default as a fix. Not sure what's better
here. Then on top of that you might add the RDCR opcode, although
I'm not sure for what it is used then.

In any case, there seems to be another issue with your flash and the
SFDP tables.

-michael

[1] https://docs.kernel.org/driver-api/mtd/spi-nor.html

> Signed-off-by: Maarten Zanders <maarten@...ders.be>
> ---
>  drivers/mtd/spi-nor/macronix.c | 1 +
>  include/linux/mtd/spi-nor.h    | 3 +++
>  2 files changed, 4 insertions(+)
>
> diff --git a/drivers/mtd/spi-nor/macronix.c b/drivers/mtd/spi-nor/macronix.c
> index e97f5cbd9aad..de3f3d963f86 100644
> --- a/drivers/mtd/spi-nor/macronix.c
> +++ b/drivers/mtd/spi-nor/macronix.c
> @@ -322,6 +322,7 @@ static int macronix_nor_late_init(struct spi_nor *nor)
>  	if (!nor->params->set_4byte_addr_mode)
>  		nor->params->set_4byte_addr_mode = spi_nor_set_4byte_addr_mode_en4b_ex4b;
>  	nor->params->set_octal_dtr = macronix_nor_set_octal_dtr;
> +	nor->params->rdcr_opcode = SPINOR_OP_RDCR_MX;
>  
>  	return 0;
>  }
> diff --git a/include/linux/mtd/spi-nor.h b/include/linux/mtd/spi-nor.h
> index cdcfe0fd2e7d..e35405b126c2 100644
> --- a/include/linux/mtd/spi-nor.h
> +++ b/include/linux/mtd/spi-nor.h
> @@ -92,6 +92,9 @@
>  #define SPINOR_OP_RD_EVCR      0x65    /* Read EVCR register */
>  #define SPINOR_OP_WD_EVCR      0x61    /* Write EVCR register */
>  
> +/* Used for Macronix flashes only. */
> +#define SPINOR_OP_RDCR_MX	0x15	/* Read configuration register */
> +
>  /* Used for GigaDevices and Winbond flashes. */
>  #define SPINOR_OP_ESECR		0x44	/* Erase Security registers */
>  #define SPINOR_OP_PSECR		0x42	/* Program Security registers */


Download attachment "signature.asc" of type "application/pgp-signature" (298 bytes)