linux-kernel - Re: [PATCH v5 2/2] mtd: rawnand: use bit-wise majority to recover the contents of ONFI parameter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 May 2018 14:03:11 +0200
From:   Boris Brezillon <boris.brezillon@...tlin.com>
To:     Jane Wan <Jane.Wan@...ia.com>
Cc:     miquel.raynal@...tlin.com, dwmw2@...radead.org,
        computersforpeace@...il.com, richard@....at, marek.vasut@...il.com,
        yamada.masahiro@...ionext.com, prabhakar.kushwaha@....com,
        shawnguo@...nel.org, jagdish.gediya@....com,
        shreeya.patel23498@...il.com, linux-mtd@...ts.infradead.org,
        linux-kernel@...r.kernel.org, ties.bos@...ia.com
Subject: Re: [PATCH v5 2/2] mtd: rawnand: use bit-wise majority to recover
 the contents of ONFI parameter

Hi Jane,

Subject prefix should be "[PATCH v5] ...", the 2/2 is no longer valid
since you only have one patch here.

On Wed,  9 May 2018 19:46:40 -0700
Jane Wan <Jane.Wan@...ia.com> wrote:

> Per ONFI specification (Rev. 4.0), if all parameter pages have invalid
> CRC values, the bit-wise majority may be used to recover the contents of
> the parameter pages from the parameter page copies present.
> 
> Signed-off-by: Jane Wan <Jane.Wan@...ia.com>
> ---

There should be a changelog here describing what has changed in each
version of the patch.

>  drivers/mtd/nand/raw/nand_base.c |   46 +++++++++++++++++++++++++++++++++-----
>  1 file changed, 41 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
> index 72f3a89..a7c2507 100644
> --- a/drivers/mtd/nand/raw/nand_base.c
> +++ b/drivers/mtd/nand/raw/nand_base.c
> @@ -5086,6 +5086,34 @@ static int nand_flash_detect_ext_param_page(struct nand_chip *chip,
>  	return ret;
>  }
>  
> +#define GET_BIT(bit, val)   (((val) >> (bit)) & 0x01)

Not sure we need that macro, see below.

> +
> +/*
> + * Recover data with bit-wise majority
> + */
> +static void nand_bit_wise_majority(const void **srcbufs,
> +				   void *dstbuf,
> +				   unsigned int nbufs,
> +				   unsigned int bufsize)

I'd prefer to have nbufs just after srcbufs and named nsrcbufs:

static void nand_bit_wise_majority(const void **srcbufs,
				   unsigned int nsrcbufs,
				   void *dstbuf,
				   unsigned int bufsize)

> +{
> +	int i, j, k;
> +	u8 v, m;
> +	u8 *p;
> +
> +	p = *(u8 **)srcbufs;

Nope, I'd like to support the cases where srcbufs are not contiguous,
so that does not work.

> +	for (i = 0; i < bufsize; i++) {
> +		v = 0;

You can declare the v variable here, since its scope is limited to the
for loop. BTW, v, m, can't we pick better names? I guess v is for val,
but I'm not even sure what m stands for.

> +		for (j = 0; j < 8; j++) {
> +			m = 0;
> +			for (k = 0; k < nbufs; k++)
> +				m += GET_BIT(j, p[k*bufsize + i]);

			for (k = 0; k < nbufs; k++) {
				const u8 *srcbuf = srcbufs[j];

				if (srcbuf[i] & BIT(k))
					m++;
			}

> +			if (m > nbufs/2)

Space between operands and operators please

			if (m > nbufs / 2)

> +				v |= BIT(j);
> +		}
> +		((u8 *)dstbuf)[i] = v;
> +	}
> +}
> +
>  /*
>   * Check if the NAND chip is ONFI compliant, returns 1 if it is, 0 otherwise.
>   */
> @@ -5102,7 +5130,7 @@ static int nand_flash_detect_onfi(struct nand_chip *chip)
>  		return 0;
>  
>  	/* ONFI chip: allocate a buffer to hold its parameter page */
> -	p = kzalloc(sizeof(*p), GFP_KERNEL);
> +	p = kzalloc((sizeof(*p) * 3), GFP_KERNEL);
>  	if (!p)
>  		return -ENOMEM;
>  
> @@ -5113,21 +5141,29 @@ static int nand_flash_detect_onfi(struct nand_chip *chip)
>  	}
>  
>  	for (i = 0; i < 3; i++) {
> -		ret = nand_read_data_op(chip, p, sizeof(*p), true);
> +		ret = nand_read_data_op(chip, &p[i], sizeof(*p), true);
>  		if (ret) {
>  			ret = 0;
>  			goto free_onfi_param_page;
>  		}
>  
> -		if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
> +		if (onfi_crc16(ONFI_CRC_BASE, (u8 *)&p[i], 254) ==
>  				le16_to_cpu(p->crc)) {
> +			if (i)
> +				memcpy(p, &p[i], sizeof(*p));
>  			break;
>  		}
>  	}
>  
>  	if (i == 3) {

		const void *srcbufs[3] = {p, p + 1, p + 2};

> -		pr_err("Could not find valid ONFI parameter page; aborting\n");
> -		goto free_onfi_param_page;
> +		pr_err("Could not find valid ONFI parameter page\n");
> +		pr_info("Recover ONFI params with bit-wise majority\n");
> +		nand_bit_wise_majority((const void **)&p, p, 3, sizeof(*p));

		nand_bit_wise_majority(srcbufs, ARRAY_SIZE(srcbufs), p,
				       sizeof(*p))

> +		if (onfi_crc16(ONFI_CRC_BASE, (u8 *)p, 254) !=
> +				le16_to_cpu(p->crc)) {
> +			pr_err("ONFI parameter recovery failed, aborting\n");
> +			goto free_onfi_param_page;
> +		}
>  	}
>  
>  	/* Check version */

Thanks,

Boris