Re: [PATCH 3/7] spi: spi-qpic-snand: use the common qcom_nandc_config_page_write() function

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] spi: qpic-snand: OOB data ignored during combined data and
  OOB operations [1]
--

commit 62e1a50299465a13da198b1f4ac1536c497b8877
Author: Gabor Juhos <j4g8y7@gmail.com>

spi: spi-qpic-snand: use the common qcom_nandc_config_page_write() function

This commit replaces the local qcom_spi_config_page_write() helper with the
common qcom_nandc_config_page_write() function from the qpic_common module.

> diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
> index cf75c142303f8..a825bdb93a8a1 100644
> --- a/drivers/spi/spi-qpic-snand.c
> +++ b/drivers/spi/spi-qpic-snand.c

[ ... ]

> @@ -1194,7 +1188,7 @@ static int qcom_spi_program_ecc(struct qcom_nand_controller *snandc,
>  	snandc->regs->ecc_bch_cfg = cpu_to_le32(ecc_bch_cfg);
>  	snandc->regs->exec = cpu_to_le32(1);
>  
> -	qcom_spi_config_page_write(snandc);
> +	qcom_nandc_config_page_write(snandc);

[Severity: Critical]
This problem wasn't introduced by this patch, but does qcom_spi_program_ecc()
and qcom_spi_read_page_ecc() ignore the caller-supplied OOB data during
combined page and OOB operations [1]?

When the spinand framework performs a combined operation via
spinand_write_page() or spinand_read_page(), op->data.buf points to a single
contiguous buffer containing both the page data and OOB data.  However, both
functions hardcode oob_buf to the internal snandc->qspi->oob_buf without
copying the caller's OOB payload in from op->data.buf.out + mtd->writesize on
writes, or copying the read OOB data back out to op->data.buf.in +
mtd->writesize on reads:

drivers/spi/spi-qpic-snand.c:qcom_spi_program_ecc() {
	...
	if (snandc->qspi->data_buf)
		data_buf = snandc->qspi->data_buf;

	oob_buf = snandc->qspi->oob_buf;
	...
}

As a result, combined reads return stale or uninitialized OOB bytes to the
caller, and combined writes silently program garbage into the flash OOB area.

[1] https://sashiko.dev/#/bug/linux-7dd8ed16-d251-4477-8c16-a5a7a68cc6e1

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-qpic-snand-use-common-functions-v1-0-1e8601e2db84@gmail.com?part=3

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/