mtd: spi-nor: disallow further writes to SR if WP# is low

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=47b8edbf0d43dcb9fda83833c05470edf59c31e3
Commit:     47b8edbf0d43dcb9fda83833c05470edf59c31e3
Parent:     f8860802da84aa2bbc9f316e549a349fb40cda63
Author:     Brian Norris <computersforpeace at gmail.com>
AuthorDate: Fri Jan 29 11:25:33 2016 -0800
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Mon Mar 7 18:01:55 2016 -0800

    mtd: spi-nor: disallow further writes to SR if WP# is low
    
    Locking the flash is most useful if it provides real hardware security.
    Otherwise, it's little more than a software permission bit.
    
    A reasonable use case that provides real HW security might be like
    follows:
    
    (1) hardware WP# is deasserted
    (2) program flash
    (3) flash range is protected via status register
    (4) hardware WP# is asserted
    (5) flash protection range can no longer be changed, until WP# is
        deasserted
    
    In this way, flash protection is co-owned by hardware and software.
    
    Now, one would expect to be able to perform step (3) with
    ioctl(MEMLOCK), except that the spi-nor driver does not set the Status
    Register Protect bit (a.k.a. Status Register Write Disable (SRWD)), so
    even though the range is now locked, it does not satisfy step (5) -- it
    can still be changed by a call to ioctl(MEMUNLOCK).
    
    So, let's enable status register protection after the first lock
    command, and disable protection only when the flash is fully unlocked.
    
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
    Tested-by: Ezequiel Garcia <ezequiel at vanguardiasur.com.ar>
---
 drivers/mtd/spi-nor/spi-nor.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index 680bc15..6fcd9d7 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -540,6 +540,9 @@ static int stm_lock(struct spi_nor *nor, loff_t ofs, uint64_t len)
 
 	status_new = (status_old & ~mask) | val;
 
+	/* Disallow further writes if WP pin is asserted */
+	status_new |= SR_SRWD;
+
 	/* Don't bother if they're the same */
 	if (status_new == status_old)
 		return 0;
@@ -605,6 +608,10 @@ static int stm_unlock(struct spi_nor *nor, loff_t ofs, uint64_t len)
 
 	status_new = (status_old & ~mask) | val;
 
+	/* Don't protect status register if we're fully unlocked */
+	if (lock_len == mtd->size)
+		status_new &= ~SR_SRWD;
+
 	/* Don't bother if they're the same */
 	if (status_new == status_old)
 		return 0;