linux-kernel - Re: [PATCH v3] mtd: spinand: add support for Foresee FS35ND0*G parts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Aug 2021 16:21:48 +0200
From:   Miquel Raynal <miquel.raynal@...tlin.com>
To:     Daniel Palmer <daniel@...f.com>
Cc:     linux-mtd@...ts.infradead.org, richard@....at,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH v3] mtd: spinand: add support for Foresee FS35ND0*G
 parts

Hi Daniel,

Daniel Palmer <daniel@...f.com> wrote on Mon, 23 Aug 2021 23:19:02
+0900:

> Hi Miquel,
> 
> > > +     /*
> > > +      * The datasheet says *successful* with 4 bits flipped.
> > > +      * nandbiterrs always complains that the read reported
> > > +      * successful but the data is incorrect.
> > > +      */
> > > +     case FS35ND01G_S1Y2_STATUS_ECC_4_BITFLIPS:
> > > +             return 4;  
> >
> > This is a real issue. Can you use the nandflipbits tool from the
> > mtd-utils package (you should take a recent version of the package) and
> > try to observe what happens when you insert a 4th bitflip in a section?
> >
> > I generally believe the tool more than the datasheet :)  
> 
> Maybe I'm using it incorrectly but I can't get a 4 bit flipped
> situation to happen.
> 
> I erased the paged so it's all 0xFF:
> 
> # flash_erase /dev/mtd0 0x8000000 1
> Erasing 128 Kibyte @ 8000000 -- 100 % complete
> # nanddump --bb=dumpbad -s 0x8000000 -l 1 -c -p /dev/mtd0
> ECC failed: 0
> ECC corrected: 6234
> Number of bad blocks: 0
> Number of bbt blocks: 0
> Block size 131072, page size 2048, OOB size 64
> Dumping data starting at 0x08000000 and ending at 0x08000001...
> ECC: 3 corrected bitflip(s) at offset 0x08000000
> 0x08000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 
> Then used nandflipbits to flip a bunch of bits in the first byte and
> then a few other bytes:
> 
> # nanddump --bb=dumpbad -s 0x8000000 -l 1 -c -p /dev/mtd0
> ECC failed: 0
> ECC corrected: 6246
> Number of bad blocks: 0
> Number of bbt blocks: 0
> Block size 131072, page size 2048, OOB size 64
> Dumping data starting at 0x08000000 and ending at 0x08000001...
> ECC: 3 corrected bitflip(s) at offset 0x08000000
> 0x08000000: f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000010: eb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000020: ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000060: ef ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 
> Anyhow,
> I think we should probably return -EBADMSG if the 4 bit flips status
> appears as nandbiterrs always complains that the data is wrong.

I am not sure to follow, above the software says "3 corrected bf" while
I thought the problem was when getting 4 bf, but the dump show many
more. Can you show me how it behaves:
* erase (like you did)
* insert {1, 2, 3, 4, 5} bf and show the dump each time?

Thanks,
Miquèl