linux-kernel - Re: [PATCH][RFC] mtd: spinand: fix detection of GD5FxGQ4xA flash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20191105192031.2847438c@xps13>
Date:   Tue, 5 Nov 2019 19:20:31 +0100
From:   Miquel Raynal <miquel.raynal@...tlin.com>
To:     Boris Brezillon <boris.brezillon@...labora.com>
Cc:     Chuanhong Guo <gch981213@...il.com>, linux-mtd@...ts.infradead.org,
        Jeff Kletsky <git-commits@...ycomm.com>,
        Richard Weinberger <richard@....at>,
        David Woodhouse <dwmw2@...radead.org>,
        Brian Norris <computersforpeace@...il.com>,
        Vignesh Raghavendra <vigneshr@...com>,
        Frieder Schrempf <frieder.schrempf@...tron.de>,
        Boris Brezillon <bbrezillon@...nel.org>,
        Stefan Roese <sr@...x.de>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH][RFC] mtd: spinand: fix detection of GD5FxGQ4xA flash

Hi Boris,

Boris Brezillon <boris.brezillon@...labora.com> wrote on Sun, 3 Nov
2019 14:27:41 +0100:

> On Sun, 3 Nov 2019 20:03:21 +0800
> Chuanhong Guo <gch981213@...il.com> wrote:
> 
> > Hi!
> > 
> > On Tue, Oct 29, 2019 at 12:41 AM Miquel Raynal
> > <miquel.raynal@...tlin.com> wrote:  
> > >
> > > Hello,
> > >
> > > Chuanhong Guo <gch981213@...il.com> wrote on Wed, 16 Oct 2019 09:38:24
> > > +0800:
> > >    
> > > > GD5FxGQ4xA didn't follow the SPI spec to keep MISO low while slave is
> > > > reading, and instead MISO is kept high. As a result, the first byte
> > > > of id becomes 0xFF.
> > > > Since the first byte isn't supposed to be checked at all, this patch
> > > > just removed that check.
> > > >
> > > > While at it, redo the comment above to better explain what's happening.
> > > >
> > > > Fixes: cfd93d7c908e ("mtd: spinand: Add support for GigaDevice GD5F1GQ4UFxxG")
> > > > Signed-off-by: Chuanhong Guo <gch981213@...il.com>
> > > > CC: Jeff Kletsky <git-commits@...ycomm.com>
> > > > ---
> > > > RFC:
> > > > I doubt whether this patch is a proper fix for the underlying problem:
> > > > The actual problem is that we have two different implementation of read id
> > > > command: One replies immediately after master sending 0x9f and the other
> > > > need to send 0x9f and an offset byte (found in winbond and early GD flashes.)    
> > 
> > Correction: Only early GigaDevice nand chips uses this implementation.
> > Winbond chips uses a dummy byte instead of an address byte so there's
> > no problem for Winbond chips.
> >   
> > > > Current code only works if SPI master is properly implemented (i.e. keep MOSI
> > > > low while reading.)    
> > >
> > > I am not entirely against the fix, but this is a SPI host controller
> > > issue, right? Can you try to fix the controller driver instead?    
> > 
> > I think this is a spi nand framework issue. GigaDevice uses an unusual
> > READ ID implementation, and as a result, both host controller and chip
> > are reading during the first byte after 0x9f command: chip is reading
> > the address/offset byte and host is expecting the first ID byte.
> > Here lies two problems:
> > 1. According to the sequence diagram in their datasheet, MISO pin is
> > in High-Z state during the 0x9f command and the offset byte, and host
> > could read anything during this time instead of a fixed 0x0 or 0xff
> > byte, so the check of first byte should be removed. This is what this
> > patch is doing.
> > 2. If there's a buggy SPI host controller that didn't keep MOSI low
> > during reading operation, the chip will get 0xff as ID offset, causing
> > the read vendor/device ID to be swapped. I never met such a controller
> > so far, but if there is one, it will be a silicon bug that can't be
> > fixed by software. To fix this one, we'll have to make a second
> > read-id implementation in spi nand framework.  
> 
> I realize how fragile this ID-based detection is when manufacturers
> decide to not follow the standard READID semantic (one 0x9f command byte
> followed by 1 or more input cycles encoding the ID). Let's imagine you
> have a valid manuf ID byte in ID[0], and the device ID (ID[1]) matches
> the Winbond or Gigadevice manufacturer ID, and ID[3] (extended Device ID
> byte?) matches a valid Winbond/Gigadevice device ID. If you skip the
> check on ID[0] you might erroneously detect a Winbond or Gigadevice
> NAND, while it's actually something else.
> 
> Note that I don't really have a solution to make this detection more
> robust.
> 
> > 
> > The second problem only exist in theory, so my preference is to apply
> > this patch and fix only the first problem for now.  
> 
> I think we should fix that problem now. Maybe by doing a 3 steps
> detection:
> 
> 1/ READID + ID[]
> 2/ READID + DUMMY + ID[]
> 3/ READID + ADDR + ID[]
> 
> At each step we would check if the returned ID matches a valid NAND,
> and if it does, stop there.

I like the idea. That will be way more robust.

Thanks,
Miquèl