linux-kernel - Re: [PATCH RESEND v5 06/13] spi: airoha: fix reading/writing of flashes with more than one plane per lun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f5e10c75-9263-416d-a3de-32af4bb7c2dc@collabora.com>
Date: Wed, 1 Oct 2025 13:34:11 +0200
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
To: Mikhail Kshevetskiy <mikhail.kshevetskiy@...sys.eu>,
 Lorenzo Bianconi <lorenzo@...nel.org>, Ray Liu <ray.liu@...oha.com>,
 Mark Brown <broonie@...nel.org>, Andy Shevchenko <andy@...nel.org>,
 linux-arm-kernel@...ts.infradead.org, linux-spi@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: Andreas Gnau <andreas.gnau@...sys.eu>
Subject: Re: [PATCH RESEND v5 06/13] spi: airoha: fix reading/writing of
 flashes with more than one plane per lun

Il 30/09/25 04:26, Mikhail Kshevetskiy ha scritto:
> Attaching UBI on the flash with more than one plane per lun will lead to
> the following error:
> 
> [    2.980989] spi-nand spi0.0: Micron SPI NAND was found.
> [    2.986309] spi-nand spi0.0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 128
> [    2.994978] 2 fixed-partitions partitions found on MTD device spi0.0
> [    3.001350] Creating 2 MTD partitions on "spi0.0":
> [    3.006159] 0x000000000000-0x000000020000 : "bl2"
> [    3.011663] 0x000000020000-0x000010000000 : "ubi"
> ...
> [    6.391748] ubi0: attaching mtd1
> [    6.412545] ubi0 error: ubi_attach: PEB 0 contains corrupted VID header, and the data does not contain all 0xFF
> [    6.422677] ubi0 error: ubi_attach: this may be a non-UBI PEB or a severe VID header corruption which requires manual inspection
> [    6.434249] Volume identifier header dump:
> [    6.438349]     magic     55424923
> [    6.441482]     version   1
> [    6.444007]     vol_type  0
> [    6.446539]     copy_flag 0
> [    6.449068]     compat    0
> [    6.451594]     vol_id    0
> [    6.454120]     lnum      1
> [    6.456651]     data_size 4096
> [    6.459442]     used_ebs  1061644134
> [    6.462748]     data_pad  0
> [    6.465274]     sqnum     0
> [    6.467805]     hdr_crc   61169820
> [    6.470943] Volume identifier header hexdump:
> [    6.475308] hexdump of PEB 0 offset 4096, length 126976
> [    6.507391] ubi0 warning: ubi_attach: valid VID header but corrupted EC header at PEB 4
> [    6.515415] ubi0 error: ubi_compare_lebs: unsupported on-flash UBI format
> [    6.522222] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd1, error -22
> [    6.529294] UBI error: cannot attach mtd1
> 
> Non dirmap reading works good. Looking to spi_mem_no_dirmap_read() code we'll see:
> 
> 	static ssize_t spi_mem_no_dirmap_read(struct spi_mem_dirmap_desc *desc,
> 					      u64 offs, size_t len, void *buf)
> 	{
> 		struct spi_mem_op op = desc->info.op_tmpl;
> 		int ret;
> 
> // --- see here ---
> 		op.addr.val = desc->info.offset + offs;
> //-----------------
> 		op.data.buf.in = buf;
> 		op.data.nbytes = len;
> 		ret = spi_mem_adjust_op_size(desc->mem, &op);
> 		if (ret)
> 		return ret;
> 
> 		ret = spi_mem_exec_op(desc->mem, &op);
> 		if (ret)
> 			return ret;
> 
> 		return op.data.nbytes;
> 	}
> 
> The similar happens for spi_mem_no_dirmap_write(). Thus the address
> passed to the flash should take in the account the value of
> desc->info.offset.
> 
> This patch fix dirmap reading/writing of flashes with more than one
> plane per lun.
> 
> Fixes: a403997c12019 ("spi: airoha: add SPI-NAND Flash controller driver")
> Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@...sys.eu>

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>