linux-kernel - Re: [PATCH v3] mtd: spinand: add support for Foresee FS35ND0*G parts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Aug 2021 17:03:54 +0200
From:   Miquel Raynal <miquel.raynal@...tlin.com>
To:     Daniel Palmer <daniel@...f.com>
Cc:     linux-mtd@...ts.infradead.org, richard@....at,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH v3] mtd: spinand: add support for Foresee FS35ND0*G
 parts

Hi Daniel,

Daniel Palmer <daniel@...f.com> wrote on Mon, 23 Aug 2021 23:54:20
+0900:

> Hi Miquel,
> 
> On Mon, 23 Aug 2021 at 23:21, Miquel Raynal <miquel.raynal@...tlin.com> wrote:
> > I am not sure to follow, above the software says "3 corrected bf" while  
> 
> Due to the status being "between 0 and 3 bitflips" I think it'll
> basically report 3 most of the time.
> As a refresher we seem to have a status for 0 - 3 flips but ok, 4 bit
> flips but ok, and >4 flips no go.
> In most cases (0 - 3) the driver is reporting 3.
> 
> > I thought the problem was when getting 4 bf, but the dump show many
> > more. Can you show me how it behaves:
> > * erase (like you did)
> > * insert {1, 2, 3, 4, 5} bf and show the dump each time?  
> 
> Here's a complete log of erasing the page then flipping all the bits
> in the first byte.
> 
> # flash_erase /dev/mtd0 0x8000000 1
> Erasing 128 Kibyte @ 8000000 -- 100 % complete
> # nanddump --bb=dumpbad -s 0x8000000 -l 1 -c -p /dev/mtd0 | head -n 10
> ECC failed: 0
> ECC corrected: 6249
> Number of bad blocks: 0
> Number of bbt blocks: 0
> Block size 131072, page size 2048, OOB size 64
> Dumping data starting at 0x08000000 and ending at 0x08000001...
> ECC: 3 corrected bitflip(s) at offset 0x08000000
> 0x08000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000090: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> # nandflipbits /dev/mtd0 0@...000000
> # nanddump --bb=dumpbad -s 0x8000000 -l 1 -c -p /dev/mtd0 | head -n 10
> ECC failed: 0
> ECC corrected: 6252
> Number of bad blocks: 0
> Number of bbt blocks: 0
> Block size 131072, page size 2048, OOB size 64
> Dumping data starting at 0x08000000 and ending at 0x08000001...
> ECC: 3 corrected bitflip(s) at offset 0x08000000
> 0x08000000: fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|

How is this result possible? You are dumping with the ECC engine
enabled, it reports 3 bf (meaning that it is actually running, at least
the software really thinks there is an on-die engine enabled) but the
data has not been corrected. I expect the first byte to be 0xFF after
correction. Only with -n (raw dump) we should see this.

> 0x08000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000030: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000040: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000050: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000060: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000070: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
> 0x08000090: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|

Thanks,
Miquèl