Re: [PATCH v4 03/16] spi: parse spi-max-post-config-frequency into post_config_max_speed_hz

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] spi->post_config_max_speed_hz is not capped by the SPI controller's maximum speed in spi_setup().
--

commit 7b33747ab555fad6b7ce057a971c3935bb2ff311
Author: Santhosh Kumar K <s-k6@ti.com>

spi: parse spi-max-post-config-frequency into post_config_max_speed_hz

This patch adds post_config_max_speed_hz to struct spi_device and parses
it from the spi-max-post-config-frequency device tree property. It allows
SPI devices to operate at a conservative speed initially and a higher speed
after controller-side configuration like PHY tuning.

> diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
> index 104279858f567..c423d5c9af202 100644
> --- a/drivers/spi/spi.c
> +++ b/drivers/spi/spi.c
> @@ -2601,6 +2601,8 @@ static int of_spi_parse_dt(struct spi_controller *ctlr, struct spi_device *spi,
>  	/* Device speed */
>  	if (!of_property_read_u32(nc, "spi-max-frequency", &value))
>  		spi->max_speed_hz = value;
> +	if (!of_property_read_u32(nc, "spi-max-post-config-frequency", &value))
> +		spi->post_config_max_speed_hz = value;

[Severity: Medium]
Does post_config_max_speed_hz also need to be capped against the SPI
controller's maximum speed limits?

Currently in __spi_setup(), max_speed_hz is explicitly checked and capped
against spi->controller->max_speed_hz:

drivers/spi/spi.c:__spi_setup() {
    ...
	if (spi->controller->max_speed_hz &&
	    (!spi->max_speed_hz ||
	     spi->max_speed_hz > spi->controller->max_speed_hz))
		spi->max_speed_hz = spi->controller->max_speed_hz;
    ...
}

However, post_config_max_speed_hz skips this validation. This allows an
uncapped, out-of-bounds frequency from the device tree to be passed down
to controller drivers. For instance, an excessively high frequency could later
cause a divisor calculation underflow in drivers like cqspi_config_baudrate_div()
when the frequency bypasses the max_speed_hz cap.

>  
>  	/* Device CS delays */
>  	of_spi_parse_dt_cs_delay(nc, &spi->cs_setup, "spi-cs-setup-delay-ns");

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618073725.84733-1-s-k6@ti.com?part=3