linux-kernel - Re: [PATCH v3] mtd: spinand: add support for Foresee FS35ND0*G parts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Aug 2021 23:19:02 +0900
From:   Daniel Palmer <daniel@...f.com>
To:     Miquel Raynal <miquel.raynal@...tlin.com>
Cc:     linux-mtd@...ts.infradead.org, richard@....at,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH v3] mtd: spinand: add support for Foresee FS35ND0*G parts

Hi Miquel,

> > +     /*
> > +      * The datasheet says *successful* with 4 bits flipped.
> > +      * nandbiterrs always complains that the read reported
> > +      * successful but the data is incorrect.
> > +      */
> > +     case FS35ND01G_S1Y2_STATUS_ECC_4_BITFLIPS:
> > +             return 4;
>
> This is a real issue. Can you use the nandflipbits tool from the
> mtd-utils package (you should take a recent version of the package) and
> try to observe what happens when you insert a 4th bitflip in a section?
>
> I generally believe the tool more than the datasheet :)

Maybe I'm using it incorrectly but I can't get a 4 bit flipped
situation to happen.

I erased the paged so it's all 0xFF:

# flash_erase /dev/mtd0 0x8000000 1
Erasing 128 Kibyte @ 8000000 -- 100 % complete
# nanddump --bb=dumpbad -s 0x8000000 -l 1 -c -p /dev/mtd0
ECC failed: 0
ECC corrected: 6234
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x08000000 and ending at 0x08000001...
ECC: 3 corrected bitflip(s) at offset 0x08000000
0x08000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|

Then used nandflipbits to flip a bunch of bits in the first byte and
then a few other bytes:

# nanddump --bb=dumpbad -s 0x8000000 -l 1 -c -p /dev/mtd0
ECC failed: 0
ECC corrected: 6246
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x08000000 and ending at 0x08000001...
ECC: 3 corrected bitflip(s) at offset 0x08000000
0x08000000: f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000010: eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000020: ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
0x08000060: ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|

Anyhow,
I think we should probably return -EBADMSG if the 4 bit flips status
appears as nandbiterrs always complains that the data is wrong.

Cheers,

Daniel