In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
spi: imx: reconfigure for PIO when DMA cannot be started<\/p>\n
When spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:
\nspi_imx_setupxfer() sets CTRL.SMC and clears dynamic_burst, and
\nspi_imx_dma_transfer() programs the dynamic-burst BURST_LENGTH and the
\nSDMA watermarks.<\/p>\n
If the DMA descriptor cannot be prepared (dmaengine_prep_slave_single()
\nreturns NULL), the transfer is failed with SPI_TRANS_FAIL_NO_START and
\nfalls back to PIO. The dynamic-burst DMA path uses its own bounce
\nbuffers instead of the SPI core’s mapping, so xfer->{tx,rx}_sg_mapped
\nare not set and the core’s DMA->PIO retry is skipped; the driver falls
\nback to PIO internally. But none of the DMA-mode configuration is
\nundone, so the PIO transfer runs with CTRL.SMC set, the wrong burst
\nlength and dynamic_burst cleared, and the transferred data is corrupted.<\/p>\n
This is easily hit on i.MX8MP boards that describe ECSPI DMA in the
\ndevice tree but run SDMA on ROM firmware (no external sdma-imx7d.bin):
\nevery ECSPI DMA prepare fails. An Infineon SLB9670 TPM on ECSPI1 then
\nreturns shifted TPM2_GetCapability data, is flagged “field failure
\nmode”, \/dev\/tpmrm0 is never created.<\/p>\n
Set controller->fallback before re-running spi_imx_setupxfer() so the
\nECSPI is reconfigured exactly like a normal PIO transfer. With
\ncontroller->fallback set, spi_imx_setupxfer() sees spi_imx_can_dma()
\nreturn false, so it clears spi_imx->usedma and reprograms the controller
\n(clears CTRL.SMC, restores dynamic_burst and the PIO burst length). No
\nexplicit spi_imx->usedma = false is needed: setupxfer() already updates
\nit from the can_dma() result.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
spi: imx: reconfigure for PIO when DMA cannot be started<\/p>\n
When spi_imx_can_dma() selects DMA, the ECSPI is configured for DMA:
\nspi_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6796","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}