linux-kernel - Re: [PATCH] mtd: spi-nor: Enable locking for n25q00a

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87v7jfgzfw.fsf@bootlin.com>
Date: Wed, 12 Nov 2025 14:20:19 +0100
From: Miquel Raynal <miquel.raynal@...tlin.com>
To: Sean Anderson <sean.anderson@...ux.dev>
Cc: Tudor Ambarus <tudor.ambarus@...aro.org>,  Pratyush Yadav
 <pratyush@...nel.org>,  Michael Walle <mwalle@...nel.org>,
  linux-mtd@...ts.infradead.org,  Richard Weinberger <richard@....at>,
  linux-kernel@...r.kernel.org,  Vignesh Raghavendra <vigneshr@...com>
Subject: Re: [PATCH] mtd: spi-nor: Enable locking for n25q00a

> When you run "# flash_lock -i /dev/mtd/by-name/spi0.1", you privide no
> start/length values to the command. Hence, the defaults are picked: the
> entire device is considered for the check. The tool asks the kernel
> whether the range 0-0x7ffffff is *fully* locked. Answer is no, it is not
> fully locked.
>
> In the kernel there are two helpers for that, and they won't give you
> opposite results all the time:
> - is locked:
>     - returns true if the given range is fully locked
>     - returns false otherwise
> - is unlocked:
>     - returns yes if the given range is fully unlocked
>     - returns false otherwise
>
> So if you want the tool to tell you "yes", you should instead use the
> exact range you locked (1024-2047) or any subset of it.

I forgot to mention: I don't like this interface because it is not very
user friendly, but this is uAPI, so set in stone. As part of my journey
in the SPI NOR swp.c file, I wrote a debugfs interface to help
visualizing what is actually locked. It is absolutely trivial to do and
helps a lot. We might want to use that for writing some kind of testing
procedure — I will share it soon.

Thanks,
Miquèl