CVE-2026-46148: spi: microchip-core-qspi: control built-in cs manually
In the Linux kernel, the following vulnerability has been resolved:
spi: microchip-core-qspi: control built-in cs manually
The coreQSPI IP supports only a single chip select, which is automagically operated by the hardware - set low when the transmit buffer first gets written to and set high when the number of bytes written to the TOTALBYTES field of the FRAMES register have been sent on the bus. Additional devices must use GPIOs for their chip selects. It was reported to me that if there are two devices attached to this QSPI controller that the in-built chip select is set low while linux tries to access the device attached to the GPIO.
This went undetected as the boards that connected multiple devices to the SPI controller all exclusively used GPIOs for chip selects, not relying on the built-in chip select at all. It turns out that this was because the built-in chip select, when controlled automagically, is set low when active and high when inactive, thereby ruling out its use for active-high devices or devices that need to transmit with the chip select disabled.
Modify the driver so that it controls chip select directly, retaining the behaviour for memops of setting the chip select active for the entire duration of the transfer in the execop callback. For regular transfers, implement the setcs callback for the core to use.
As part of this, the existing setup callback, mchpcoreqspisetupop(), is removed. Modifying the CLKIDLE field is not safe to do during operation when there are multiple devices, so this code is removed entirely. Setting the MASTER and ENABLE fields is something that can be done once at probe, it doesn't need to be re-run for each device. Instead the new setup callback sets the built-in chip select to its inactive state for active-low devices, as the reset value of the chip select in software controlled mode is low.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the coreQSPI driver so the built-in chip select is controlled directly by driver code (manual software control) instead of relying on the hardware automatic toggling.
spi: microchip-core-qspi driver (Linux kernel) chip_select_control = manual - Configuration
Implement the SPI set_cs callback for the core driver and use it for regular transfers so chip-select lines for additional devices can be driven via GPIOs or software as appropriate.
spi: microchip-core-qspi driver (Linux kernel) set_cs callback = implement - Configuration
Retain the existing behaviour for mem_ops: ensure exec_op sets the built-in chip select active for the entire duration of the memory transfer.
spi: microchip-core-qspi driver (Linux kernel) mem_ops exec_op chip-select behaviour = retain full-transfer cs active - Configuration
Remove the existing mchp_coreqspi_setup_op setup callback and related code from the driver.
spi: microchip-core-qspi driver (Linux kernel) mchp_coreqspi_setup_op = remove - Configuration
Remove code that modifies the CLKIDLE field during operation; do not change CLKIDLE at runtime when multiple devices may be present.
spi: microchip-core-qspi driver (Linux kernel) CLKIDLE runtime modification = remove - Configuration
Move setting of the MASTER and ENABLE fields to driver probe time so they are configured once at probe rather than re-run for each device.
spi: microchip-core-qspi driver (Linux kernel) MASTER and ENABLE initialization = probe-only - Configuration
In the new setup callback, set the built-in chip select to its inactive state for active-low devices (because the reset value in software-controlled mode is low).
spi: microchip-core-qspi driver (Linux kernel) setup callback chip-select reset state = inactive for active-low devices