Hacker News Reader

Comment by michaelt | Hacker News Reader

> For example, lets consider that we wrote to the sector 1024 on the SDCARD, and this address got initially mapped to physical sector 1024 itself on flash. Later we overwrite the contents, but this time write cannot go to the same physical address because it needs to be erased before programmed again.

Maybe someone here will know the answer to something I've been wondering for a while: When appending to a file with writes smaller than a sector, does this remapping process trigger every time? Or is the controller smart enough that it can append without remapping, even though to overwrite would need remapping?

Obviously for an SD card used for saving photos or videos you could write a sector at a time - but for an SD card in a temperature logger or similar, your appends might be a lot smaller.

View on HN

Pages that are already written cannot be overwritten, at least not without a full block erase, so it has to do a remap to append data.

Directly logging to an SD card (i.e. lots of small writes) is the fastest way to destroy it.

As I understand it, you need a block erase to change bits from 0 to 1 then you can selectively set bits back from 1 to 0.

Couldn't you perform a file append without the need for a block erase? By keeping the unwritten area as all ones until written?

You cannot do single byte writes on NAND. You have erase blocks (typically several 100k to M range) that are divided into pages (typically a few to several dozen k), some devices have sub-pages but that's about it, that's the smallest unit of data you can write.

If you attempt to clear bits from 1 to 0 on an already written page, it will generally not work.

I say generally, because I have actually tried this using raw NAND flash on an embedded Linux device. I found a chip, where it did work, but not very reliably.

I also had an MLC chip, where it did not work, but instead caused random bit-flips on seemingly unrelated pages. I used this trick to systematically hammer down on the pages and figure out the pairings (only document in the NDA version of the datasheet), but failed to reproduce this on a different, more expensive MLC NAND.

But even if appending in this fashion did somehow work, you would still need to update a data structure somewhere else anyway, telling you the exact amount of data written (including cases where you actually append 0xff bytes).

thank you so much! this is something i've been wondering about for years, and figuring it out obviously took you a huge amount of work

normally with raw nand you use ecc, right? was there any ecc happening in your tests, either on the nand chip or in the linux driver? it seems like if you started with a page with valid ecc data and then tried to bash an arbitrary payload 1 bit in it to 0, you'd have a real challenge updating the ecc data to be consistent with the updated payload

> normally with raw nand you use ecc, right?

yes, reasonably priced ones have an internal ECC engine, very cheap ones don't. The Linux NAND framwork has software ECC engines for those (see also: previous discussion on HN[1]).

> was there any ecc happening in your tests?

I deliberately turned it off. Linux has an ioctl for that. If the chip supports it, you can read/write without ECC or even directly into the OOB area where ECC data would normally be stored. The problem with the more expensive MLC NAND was that it had some smarts built in. It could discover overwrite attempts, as well as certain write patterns and apply a scrambling mask to the bits, so that the stored bits would (hopefully) not diffuse over to their neighbors.

> if you started with a page with valid ecc data and then tried to bash an arbitrary payload 1 bit in it to 0, you'd have a real challenge updating the ecc data to be consistent with the updated payload

If you are implementing a raw flash driver, there is a "nandbiterrs" test that does roughly what you describe: it bashes an increasing number of bit errors into a page and reads it back with ECC re-enabled, checking how many errors are successfully corrected during read, before the ECC engine gives up.

[1] https://news.ycombinator.com/item?id=38361139

thank you very much; this is priceless wisdom

unfortunately the daunting task in front of me is to do this without linux or gcc, because what i want is a self-hosted operating system on a microcontroller that happens not to have an mmu or enough ram for gcc. my experience with sd cards in the past has been depressingly terrible reliability so i bought some slc nand chips with a public datasheet and without built-in ecc logic

>> Couldn't you perform a file append without the need for a block erase?

> You cannot do single byte writes on NAND.

This isn't true - that the OP wrote here certainly does work (at least for many places I've tested and used it). I've used it to do all sorts of low level logging in small devices (and I've thoroughly tested many, many chips to complete destruction to see how things degrade). I have not yet seen a place it fails and I've done it on dozens or projects. I guess there may be places wear leveling fights with this, but if you dig into the particular device you have you can usually find low level details to make it work. The places I've pushed it are all commercial projects for which we characterize long term failure by running the flash parts fast enough to destroy the flash, to ensure that once in the field the expected lifetimes meet any guarantees we need to provide.

Also, if you've never ran a flash chip to death, try it - it's interesting. Get a small SD card and hammer it withRead/write cycles until you start getting errors, then log and watch how those errors propagate. Good stuff :)

Every chip I've tested does indeed let you erase a block (which sets all bits to 0 or 1 depending on chip), then append bits to that block by changing the bits you need.

To append, you don't need to update some other data structure, just append a single bit of the correct type, then a bit scan of the page tells you where the data ends. Or, if you have another page telling how many "slots" of yourData are used, again append s single bit. Then small appends only cost a bit.

On top of this implement wear leveling (unless the chip does - most bigger ones do, but some low level devices don't).

Other projects I've worked on professionally are products for desoldering flash from captured and destroyed enemy devices which are then read raw and reconstructed, fault tolerant and error shielding for NASA space ops with flash, reverse engineering proprietary flash protocols for Secret Service (weird, right? but they pay) uses. I somewhat often get called for consulting on precisely these types of issues. So I do know a bit about low level flash abuse :)

I was talking about bare NAND flash, not eMMC or anything otherwise "fancy" with builtin FTL. What you say is certainly true for those.

None of the projects you describe sound "cheap" or like they involve devices first-and-foremost optimized for cost, and are unlikely to involve such dirt-cheap, raw NAND devices that are becoming increasingly rare even in the super-cheap embedded space.

The original context of the discussion (see: a few comments up) is on-die NAND flash, inside SD cards, which TFA is about.

The flash chips I brought up for comparison were from an extremely cost-optimized, embedded device that I worked on ~2016. The more expensive one already being on the upper end, regarding smarts & cost, but still exposing the flash directly (plus ECC & bad block management, but no FTL).

I mostly work with industrial devices, and also maintain the Linux user space for raw flash (mtd-utils). I have seen my fair share of broken flash devices over the years (often in-field) and also have a my own little pile of broken industrial SD cards on my desk :)

> I was talking about bare NAND flash

Same here.

> None of the projects you describe sound "cheap" or like they involve devices first-and-foremost optimized for cost

A lot of them are low cost PIC microcontrollers, which are super cheap, and the lowest cost MCUs were chosen precisely because at large commercial sale scale saving pennies on HW is very important. The reason we went to such lengths to reuse bits at the lowest level is because of needing the lowest cost devices on those projects.

Some were higher end, but I think it's more useful on low end chips.

> low cost PIC microcontrollers

ahhh, I think there's the source of our confusion: I suspect you are actually talking about NOR flash?

NOR flash is physically organized different from NAND. It typically does allow single word/byte or sometimes even bit level accesses, like you described. NOR flash is also much more reliable, often not needing any wear leveling at all. The downside is that NOR flash has orders of magnitudes lower data density.

Microcontrollers would use NOR flash internally for program memory, precisely because it allows direct, single-cycle access to individual opcodes. With NAND flash, program memory would have to be read page-wise and require some sort of instruction cache in between. Other EEPROM-like devices (e.g. AT28Fxxx) also use NOR flash for pretty much the same reasons.

On some embedded Linux devices, NOR flash is used for config/boot loader/kernel, while the rootfs lives on NAND.

> ahhh, I think there's the source of our confusion: I suspect you are actually talking about NOR flash?

Nope. PIC has on device NOR (which I've tested), and often has external NAND flash (depending on design choices), such as using SDCard interfaces.

Here's [1] a Micron tech doc on their NAND chips stating quite clearly they allow exactly what I described doing above: "A NAND Flash block is 128KB. Erasing a block sets all bits to 1 (and all bytes to FFh). Programming is necessary to change erased bits from 1 to 0. The smallest entity that can be programmed is a byte."

There's plenty of manufacturers and chip types that guarantee one can do this. It is tech notes like that led me to do some testing to see if devices fall into spec on R/W cycles before death when evaluating which chips to ship in consumer products that need this.

[1] https://user.eng.umd.edu/~blj/CS-590.26/micron-tn2919.pdf

I remember the change from SLC to MLC at the PocketCHIP's UBIFS. Then it soft-bricked itself a lot.

AFAIK, it's not clear how much difference in wear a series of writes cause when compared to writes and erases.

I do know that very old flash firmwares applied that idea, and that new flash evolved in a direction where the wear caused by an erase is closer to the one caused by a write. If modern firmwares do not use it, it's probably because there isn't a lot to gain.

Probably not for a variety of reasons. The SSD itself does not know about files or appends; only block reads and writes. If the OS fills the unused space with zeros then it's going to write a block with trailing zeros, not ones. Most SSDs also scramble or encrypt data before writing to flash.

That could explain why my dashcam is working fine after ten years whereas my previous job's IoT devices regularly ate SD cards. (Then again, the IoT devices were also overheating badly whereas the dashcam was designed for its purpose, kept cool while running, and runs on a low duty cycle)

What are you supposed to do, then? Buffer up writes and accept that you'll lose logs a minute or so before a power outage?

As much hell as we had with those SD cards I'd rather put tiny iPod spinners in them...

Losing the logs on a power outage may be a good compromise. Alternatively, you can buffer on a battery-powered RAM unit, accept that your cards will be short-lived, immediately send the logs through some network, not log...

When you are designing the hardware, you have lots and lots of choices.

Yeah. This company wasn't big enough to entertain battery backups, and the product was not expensive enough to add hardware that didn't bring in more sales.

And we logged too much to pull all the logs over WAN all the time, resulting in a clever hack for remotely browsing logs with (relative) security

Honestly we could have batched up the logs.

There are industrial microSD's with pSLC memory, e.g. Kingston's SDCIT2 line. Those are significantly more durable - in a few years of using them I haven't managed to kill a single one. Much pricier per-GB, though.

I've seen some flash drives that prepare a pool of free AU blocks which is common with Phison controllers

They prepare and erase a new pool only when it's full causing bursts in speeds and long periods of unresponsiveness (10 sec) while writing, reading is blocked as well. You can see it as a zigzag in file transfer speed graphs. This is not to be confused with OS buffer flushing.

While I couldn't find any official info for the reasons behind it, it's assumed that the erase speed is slow on low quality flash and hence the controller has to pool in order to erase pages in parallel, increasing speed when copying small files between computers on plug and unplug.

In my case it was about 500MB before before freezing on a 128GB flash drive.

It sort of depends, but in general flash cannot write a page without erasing it first. Sometimes you can set, but not un-set bits (can be a 0 or 1 depending, usually 0 is 'set') without erasing a page.

At the lowest level this means to update a page you have to first read it all back out, apply your modifications, then write back in a single operation. You must always write the full page size.

In high level contexts like SD cards or SSDs being driven by an operating system, all of this is handled transparently in the background. If you're using raw flash in an embedded context, you usually have to manage this yourself (or let a library do it for you).

Reply on news.ycombinator.com