[PATCH v2] spi: cadence-quadspi: fix incorrect supports_op() return value

[PATCH v2] spi: cadence-quadspi: fix incorrect supports_op() return value

[Matthias Schiffer]

Since the conversion to spi-mem, the driver advertised support for
various operations that cqspi_set_protocol() was never expected to handle
correctly - in particuar all non-DTR operations with command or address
buswidth > 1. For DTR, all operations except for 8-8-8 would fail, as
cqspi_set_protocol() returns -EINVAL.

In non-DTR mode, this resulted in data corruption for SPI-NOR flashes that
support such operations. As a minimal fix that can be backported to stable
kernels, simply disallow the unsupported operations again to avoid this
issue.

Fixes: a314f6367787 ("mtd: spi-nor: Convert cadence-quadspi to use spi-mem framework")
Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>
---

As discussed, here's the minimal fix to disallow the accidentally enabled
1-X-X and X-X-X operations again. As a bonus, I also added proper handling
for non-8-8-8 DTR ops to cqspi_supports_mem_op() to avoid -EINVAL in
cqspi_set_protocol() for these ops.

The patch is based on spi for-5.18 now. It will unfortunately not
cherry-pick cleanly to 5.10 and 5.15, but I can take care of submitting a
backport patch once this is in Linus's tree.

I also have patches for 5.19/next that add proper support for 1-X-X and
X-X-X (without DTR for now, as I haven't tested DTR), which remove most
of the code of cqspi_set_protocol(). I will submit the follow-up patches
once this fix patch is accepted.


 drivers/spi/spi-cadence-quadspi.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/spi/spi-cadence-quadspi.c b/drivers/spi/spi-cadence-quadspi.c
index b0c9f62ccefb..c898321d4e94 100644
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -1437,9 +1437,24 @@ static bool cqspi_supports_mem_op(struct spi_mem *mem,
 	all_false = !op->cmd.dtr && !op->addr.dtr && !op->dummy.dtr &&
 		    !op->data.dtr;
 
-	/* Mixed DTR modes not supported. */
-	if (!(all_true || all_false))
+	if (all_true) {
+		/* Right now we only support 8-8-8 DTR mode. */
+		if (op->cmd.nbytes && op->cmd.buswidth != 8)
+			return false;
+		if (op->addr.nbytes && op->addr.buswidth != 8)
+			return false;
+		if (op->data.nbytes && op->data.buswidth != 8)
+			return false;
+	} else if (all_false) {
+		/* Only 1-1-X ops are supported without DTR */
+		if (op->cmd.nbytes && op->cmd.buswidth > 1)
+			return false;
+		if (op->addr.nbytes && op->addr.buswidth > 1)
+			return false;
+	} else {
+		/* Mixed DTR modes are not supported. */
 		return false;
+	}
 
 	return spi_mem_default_supports_op(mem, op);
 }
-- 
2.25.1

Re: [PATCH v2] spi: cadence-quadspi: fix incorrect supports_op() return value

[Mark Brown]

On Wed, 6 Apr 2022 15:28:32 +0200, Matthias Schiffer wrote:
> Since the conversion to spi-mem, the driver advertised support for
> various operations that cqspi_set_protocol() was never expected to handle
> correctly - in particuar all non-DTR operations with command or address
> buswidth > 1. For DTR, all operations except for 8-8-8 would fail, as
> cqspi_set_protocol() returns -EINVAL.
> 
> In non-DTR mode, this resulted in data corruption for SPI-NOR flashes that
> support such operations. As a minimal fix that can be backported to stable
> kernels, simply disallow the unsupported operations again to avoid this
> issue.
> 
> [...]

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-next

Thanks!

[1/1] spi: cadence-quadspi: fix incorrect supports_op() return value
      commit: f1d388f216aeb41a5df518815ae559d14a6d438e

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

Re: [PATCH v2] spi: cadence-quadspi: fix incorrect supports_op() return value

[Pratyush Yadav]

On 06/04/22 03:28PM, Matthias Schiffer wrote:
> Since the conversion to spi-mem, the driver advertised support for
> various operations that cqspi_set_protocol() was never expected to handle
> correctly - in particuar all non-DTR operations with command or address
> buswidth > 1. For DTR, all operations except for 8-8-8 would fail, as
> cqspi_set_protocol() returns -EINVAL.
> 
> In non-DTR mode, this resulted in data corruption for SPI-NOR flashes that
> support such operations. As a minimal fix that can be backported to stable
> kernels, simply disallow the unsupported operations again to avoid this
> issue.
> 
> Fixes: a314f6367787 ("mtd: spi-nor: Convert cadence-quadspi to use spi-mem framework")
> Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com>

I suppose it is too late now since the patch is already applied. But 
FWIW,

Reviewed-by: Pratyush Yadav <p.yadav@ti.com>

-- 
Regards,
Pratyush Yadav
Texas Instruments Inc.