linux-kernel - Re: [PATCH] mtd: rawnand: brcmnand: force raw OOB writes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 13 Jun 2020 11:01:56 +0200
From:   Álvaro Fernández Rojas <noltari@...il.com>
To:     Kamal Dasu <kdasu.kdev@...il.com>
Cc:     Brian Norris <computersforpeace@...il.com>,
        Miquel Raynal <miquel.raynal@...tlin.com>,
        Richard Weinberger <richard@....at>,
        "R, Vignesh" <vigneshr@...com>,
        Sumit Semwal <sumit.semwal@...aro.org>,
        MTD Maling List <linux-mtd@...ts.infradead.org>,
        bcm-kernel-feedback-list <bcm-kernel-feedback-list@...adcom.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        linaro-mm-sig@...ts.linaro.org
Subject: Re: [PATCH] mtd: rawnand: brcmnand: force raw OOB writes

Hi Kamal,

> El 12 jun 2020, a las 20:47, Kamal Dasu <kdasu.kdev@...il.com> escribió:
> 
> On Fri, Jun 5, 2020 at 1:07 PM Álvaro Fernández Rojas <noltari@...il.com> wrote:
>> 
>> MTD_OPS_AUTO_OOB is writting OOB with ECC enabled, which changes all ECC bytes
>> from an erased page to 0x00 when JFFS2 cleanmarkers are added with mtd-utils.
>>         | BBI |   JFFS2   |   ECC   |   JFFS2   | Spare  |
>> 00000800  ff ff 19 85 20 03 00 00  00 00 00 00 08 ff ff ff
>> 
>> However, if OOB is written with ECC disabled, the JFFS2 cleanmarkers are
>> correctly written without changing the ECC bytes:
>>         | BBI |   JFFS2   |   ECC   |   JFFS2   | Spare  |
>> 00000800  ff ff 19 85 20 03 ff ff  ff 00 00 00 08 ff ff ff
> 
> Both brcmand_write_oob_raw() and brcmnand_write_oob() use
> brcmnand_write() that uses PROGRAM_PAGE cmd, means also programs data
> areas and ECC when enabled  is always calculated on DATA+OOB.  since

Are you sure about that? I think that HW ECC is only calculated for DATA, not for OOB.
The fact that we’re not writing any DATA seems to be the problem that is changing all ECC bytes to 0x00.

> in both cases we only want to modify OOB, data is always assumed to be
> 0xffs (means erased state). So as far as this api always is used on
> the erased page it should be good. Are the sub-pages/oob areas read by
> jffs2  also read without ecc enabled?. Just want to be sure that it
> does not break any other utilities like nandwrite.

No, sub-pages/oob areas read by JFFS2 with ECC enabled.
I don’t think this breaks anything at all, since I tested nandwrite with OOB enabled and everything was written perfectly.

BTW, I tried another approach that forced MTD_OPS_AUTO_OOB to be written as raw OOB, but it was rejected:
http://patchwork.ozlabs.org/project/linux-mtd/patch/20200504094253.2741109-1-noltari@gmail.com/
https://lkml.org/lkml/2020/5/4/215

> 
>> 
>> Signed-off-by: Álvaro Fernández Rojas <noltari@...il.com>
>> ---
>> drivers/mtd/nand/raw/brcmnand/brcmnand.c | 9 +--------
>> 1 file changed, 1 insertion(+), 8 deletions(-)
>> 
>> diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
>> index 8f9ffb46a09f..566281770841 100644
>> --- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
>> +++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
>> @@ -2279,13 +2279,6 @@ static int brcmnand_write_page_raw(struct nand_chip *chip, const uint8_t *buf,
>>        return nand_prog_page_end_op(chip);
>> }
>> 
>> -static int brcmnand_write_oob(struct nand_chip *chip, int page)
>> -{
>> -       return brcmnand_write(nand_to_mtd(chip), chip,
>> -                             (u64)page << chip->page_shift, NULL,
>> -                             chip->oob_poi);
>> -}
>> -
>> static int brcmnand_write_oob_raw(struct nand_chip *chip, int page)
>> {
>>        struct mtd_info *mtd = nand_to_mtd(chip);
>> @@ -2642,7 +2635,7 @@ static int brcmnand_init_cs(struct brcmnand_host *host, struct device_node *dn)
>>        chip->ecc.write_oob_raw = brcmnand_write_oob_raw;
>>        chip->ecc.read_oob_raw = brcmnand_read_oob_raw;
>>        chip->ecc.read_oob = brcmnand_read_oob;
>> -       chip->ecc.write_oob = brcmnand_write_oob;
>> +       chip->ecc.write_oob = brcmnand_write_oob_raw;
>> 
>>        chip->controller = &ctrl->controller;
>> 
>> --
>> 2.26.2
>> 

Best regards,
Álvaro.