linux-kernel - Re: [PATCH] spi: spi-qpic-snand: use correct CW_PER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b2e4d6b1-25bc-4b2e-ae54-6588f1573131@oss.qualcomm.com>
Date: Fri, 1 Aug 2025 13:08:46 +0200
From: Konrad Dybcio <konrad.dybcio@....qualcomm.com>
To: Gabor Juhos <j4g8y7@...il.com>, Mark Brown <broonie@...nel.org>,
        Md Sadre Alam <quic_mdalam@...cinc.com>,
        Varadarajan Narayanan <quic_varada@...cinc.com>,
        Sricharan Ramabadhran <quic_srichara@...cinc.com>
Cc: linux-spi@...r.kernel.org, linux-mtd@...ts.infradead.org,
        linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] spi: spi-qpic-snand: use correct CW_PER_PAGE value for
 OOB write

On 8/1/25 9:58 AM, Gabor Juhos wrote:
> The qcom_spi_program_oob() function uses only the last codeword to write
> the OOB data into the flash, but it sets the CW_PER_PAGE field in the
> CFG0 register as it would use all codewords.
> 
> It seems that this confuses the hardware somehow, and any access to the
> flash fails with a timeout error after the function is called. The problem
> can be easily reproduced with the following commands:
> 
>     # dd if=/dev/zero bs=2176 count=1 > /tmp/test.bin
>     1+0 records in
>     1+0 records out
>     # flash_erase /dev/mtd4 0 0
>     Erasing 128 Kibyte @ 0 -- 100 % complete
>     # nandwrite -O /dev/mtd4 /tmp/test.bin
>     Writing data to block 0 at offset 0x0
>     # nanddump -o /dev/mtd4 >/dev/null
>     ECC failed: 0
>     ECC corrected: 0
>     Number of bad blocks: 0
>     Number of bbt blocks: 0
>     Block size 131072, page size 2048, OOB size 128
>     Dumping data starting at 0x00000000 and ending at 0x00020000...
>     [   33.197605] qcom_snand 79b0000.spi: failure to read oob
>     libmtd: error!: MEMREADOOB64 ioctl failed for mtd4, offset 0 (eraseblock 0)
>             error 110 (Operation timed out)
>     [   35.277582] qcom_snand 79b0000.spi: failure in submitting cmd descriptor
>     libmtd: error!: cannot read 2048 bytes from mtd4 (eraseblock 0, offset 2048)
>             error 110 (Operation timed out)
>     nanddump: error!: mtd_read
> 
> Change the code to use the correct CW_PER_PAGE value to avoid this.
> 
> Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
> Signed-off-by: Gabor Juhos <j4g8y7@...il.com>
> ---
>  drivers/spi/spi-qpic-snand.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/spi/spi-qpic-snand.c b/drivers/spi/spi-qpic-snand.c
> index 0cfa0d960fd3c245c2bbf4f5e02d0fc0b13e7696..5216d60e01aab26f927baaea24296571a77527cb 100644
> --- a/drivers/spi/spi-qpic-snand.c
> +++ b/drivers/spi/spi-qpic-snand.c
> @@ -1196,7 +1196,7 @@ static int qcom_spi_program_oob(struct qcom_nand_controller *snandc,
>  	u32 cfg0, cfg1, ecc_bch_cfg, ecc_buf_cfg;
>  
>  	cfg0 = (ecc_cfg->cfg0 & ~CW_PER_PAGE_MASK) |
> -	       FIELD_PREP(CW_PER_PAGE_MASK, num_cw - 1);
> +	       FIELD_PREP(CW_PER_PAGE_MASK, 0);

FWIW I'm just a fly-by reviewer for this driver, but the docs say:

The value is the number of codewords per page minus one
"NOTE: This field must be cleared for block erase operation"

Konrad