linux-kernel - Re: [PATCH v2] mtd: spinand: add support for Foresee FS35ND01G-S1Y2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Mar 2021 21:44:40 +0900
From:   Daniel Palmer <daniel@...f.com>
To:     Miquel Raynal <miquel.raynal@...tlin.com>
Cc:     linux-mtd@...ts.infradead.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] mtd: spinand: add support for Foresee FS35ND01G-S1Y2

Hi Miquel,

Sorry for the resend. Gmail randomly switched to HTML email so the
original version seems to have bounced.

On Mon, 15 Feb 2021 at 20:16, Miquel Raynal <miquel.raynal@...tlin.com> wrote:
> > "2. Spare area 800H to 83FH is all available for user.
> >  ECC parity codes are programmed in
> > additional space and not user accessible."
> >
> > It would seem that the pages are actually bigger than 2K + 64 or there
> > is some other place they keep the ECC.
> > Or both datasheets are lying. Somewhere else in the datasheets it says
> > that writes to the ECC area will be ignored but that doesn't make a
> > lot of sense if the ECC area isn't user accessible in the first place.
> >
> > I didn't think about it at the time but I can take a dump of the OOB
> > area of my FS35ND01G-S1Y2 to confirm it's all 0xff except for any
> > factory marked bad blocks.
>
> I see. Can you please try the following:
>
> nandwrite -o /dev/mtdx /dev/zero
> nanddump -ol1 /dev/mtdx
> If the entire area is effectively free to be used, you should see 0's
> everywhere. Otherwise you should have ff's somewhere.

Sorry I didn't follow up sooner on this. I needed to order another of
this flash chip to test with as I couldn't destroy the data on the one
I have.

Anyhow:

Erased the page with flash erase (I'm forcing it to erase bad blocks
here as I mess up the marker, I have a hack to allow erasing bad
blocks..)
Everything is 0xFF for that page.

# flash_erase -N /dev/mtd1 0 1
Erasing 128 Kibyte @ 0 -- 100 % complete
# nanddump --bb=dumpbad -n -l2048 -o -c -s 0x0 /dev/mtd1
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00000800...
0x00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
....
0x000007f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
  OOB Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
  OOB Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
  OOB Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
  OOB Data: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|

Write zeros into the page and OOB.
Get all zeros back including the OOB.

# nandwrite -o /dev/mtd1 /dev/zero
Writing data to block 0 at offset 0x0
Bad block at 0, 1 block(s) will be skipped
Writing data to block 1 at offset 0x20000
# nandwrite -N -o /dev/mtd1 /dev/zero
Writing data to block 0 at offset 0x0
# nanddump --bb=dumpbad -n -l2048 -o -c -s 0x0 /dev/mtd1
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00000800...
0x00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
...
0x000007f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  OOB Data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  OOB Data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  OOB Data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
  OOB Data: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|................|

Erase the page again and writing random junk into it.
Seeing random junk everywhere including the OOB.

# flash_erase -N /dev/mtd1 0 1
Erasing 128 Kibyte @ 0 -- 100 % complete
# nandwrite -N -o /dev/mtd1 /dev/urandom
Writing data to [  230.506260] random: nandwrite: uninitialized
urandom read (2048 bytes read)
block 0 at offse[  230.514705] random: nandwrite: uninitialized
urandom read (64 bytes read)
t 0x0
# nanddump --bb=dumpbad -n -l2048 -o -c -s 0x0 /dev/mtd1
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00000800...
0x00000000: 5e 24 bd 5f d9 c6 ce c5 b1 85 52 4d 27 94 c9 98  |^$._......RM'...|
...
0x000007f0: fa 9f 7f 7d ce 99 33 88 d6 9f 99 7d 84 e7 0c 4d  |...}..3....}...M|
  OOB Data: b1 81 07 6a 8d 47 8b ed 89 88 ac 62 e8 ae 48 54  |...j.G.....b..HT|
  OOB Data: 7d b2 ea 73 f3 29 ba 65 e6 45 cb 8b 1a c6 5b dc  |}..s.).e.E....[.|
  OOB Data: b2 2e 77 56 e0 e1 04 59 86 31 7a e5 bd 43 f9 48  |..wV...Y.1z..C.H|
  OOB Data: 52 05 b2 f1 65 64 59 22 79 50 ec 89 55 6b 6e 23  |R...edY"yP..Ukn#|

I think this shows that the datasheet is right in that the complete 64
bytes of "spare area" is usable.
I have no idea where it puts the ECC though. :)

Thanks,

Daniel