Pages that are already written cannot be overwritten, at least not without a full block erase, so it has to do a remap to append data.
Directly logging to an SD card (i.e. lots of small writes) is the fastest way to destroy it.
Directly logging to an SD card (i.e. lots of small writes) is the fastest way to destroy it.
Couldn't you perform a file append without the need for a block erase? By keeping the unwritten area as all ones until written?
If you attempt to clear bits from 1 to 0 on an already written page, it will generally not work.
I say generally, because I have actually tried this using raw NAND flash on an embedded Linux device. I found a chip, where it did work, but not very reliably.
I also had an MLC chip, where it did not work, but instead caused random bit-flips on seemingly unrelated pages. I used this trick to systematically hammer down on the pages and figure out the pairings (only document in the NDA version of the datasheet), but failed to reproduce this on a different, more expensive MLC NAND.
But even if appending in this fashion did somehow work, you would still need to update a data structure somewhere else anyway, telling you the exact amount of data written (including cases where you actually append 0xff bytes).
normally with raw nand you use ecc, right? was there any ecc happening in your tests, either on the nand chip or in the linux driver? it seems like if you started with a page with valid ecc data and then tried to bash an arbitrary payload 1 bit in it to 0, you'd have a real challenge updating the ecc data to be consistent with the updated payload
yes, reasonably priced ones have an internal ECC engine, very cheap ones don't. The Linux NAND framwork has software ECC engines for those (see also: previous discussion on HN[1]).
> was there any ecc happening in your tests?
I deliberately turned it off. Linux has an ioctl for that. If the chip supports it, you can read/write without ECC or even directly into the OOB area where ECC data would normally be stored. The problem with the more expensive MLC NAND was that it had some smarts built in. It could discover overwrite attempts, as well as certain write patterns and apply a scrambling mask to the bits, so that the stored bits would (hopefully) not diffuse over to their neighbors.
> if you started with a page with valid ecc data and then tried to bash an arbitrary payload 1 bit in it to 0, you'd have a real challenge updating the ecc data to be consistent with the updated payload
If you are implementing a raw flash driver, there is a "nandbiterrs" test that does roughly what you describe: it bashes an increasing number of bit errors into a page and reads it back with ECC re-enabled, checking how many errors are successfully corrected during read, before the ECC engine gives up.
unfortunately the daunting task in front of me is to do this without linux or gcc, because what i want is a self-hosted operating system on a microcontroller that happens not to have an mmu or enough ram for gcc. my experience with sd cards in the past has been depressingly terrible reliability so i bought some slc nand chips with a public datasheet and without built-in ecc logic
> You cannot do single byte writes on NAND.
This isn't true - that the OP wrote here certainly does work (at least for many places I've tested and used it). I've used it to do all sorts of low level logging in small devices (and I've thoroughly tested many, many chips to complete destruction to see how things degrade). I have not yet seen a place it fails and I've done it on dozens or projects. I guess there may be places wear leveling fights with this, but if you dig into the particular device you have you can usually find low level details to make it work. The places I've pushed it are all commercial projects for which we characterize long term failure by running the flash parts fast enough to destroy the flash, to ensure that once in the field the expected lifetimes meet any guarantees we need to provide.
Also, if you've never ran a flash chip to death, try it - it's interesting. Get a small SD card and hammer it withRead/write cycles until you start getting errors, then log and watch how those errors propagate. Good stuff :)
Every chip I've tested does indeed let you erase a block (which sets all bits to 0 or 1 depending on chip), then append bits to that block by changing the bits you need.
To append, you don't need to update some other data structure, just append a single bit of the correct type, then a bit scan of the page tells you where the data ends. Or, if you have another page telling how many "slots" of yourData are used, again append s single bit. Then small appends only cost a bit.
On top of this implement wear leveling (unless the chip does - most bigger ones do, but some low level devices don't).
Other projects I've worked on professionally are products for desoldering flash from captured and destroyed enemy devices which are then read raw and reconstructed, fault tolerant and error shielding for NASA space ops with flash, reverse engineering proprietary flash protocols for Secret Service (weird, right? but they pay) uses. I somewhat often get called for consulting on precisely these types of issues. So I do know a bit about low level flash abuse :)
None of the projects you describe sound "cheap" or like they involve devices first-and-foremost optimized for cost, and are unlikely to involve such dirt-cheap, raw NAND devices that are becoming increasingly rare even in the super-cheap embedded space.
The original context of the discussion (see: a few comments up) is on-die NAND flash, inside SD cards, which TFA is about.
The flash chips I brought up for comparison were from an extremely cost-optimized, embedded device that I worked on ~2016. The more expensive one already being on the upper end, regarding smarts & cost, but still exposing the flash directly (plus ECC & bad block management, but no FTL).
I mostly work with industrial devices, and also maintain the Linux user space for raw flash (mtd-utils). I have seen my fair share of broken flash devices over the years (often in-field) and also have a my own little pile of broken industrial SD cards on my desk :)
Same here.
> None of the projects you describe sound "cheap" or like they involve devices first-and-foremost optimized for cost
A lot of them are low cost PIC microcontrollers, which are super cheap, and the lowest cost MCUs were chosen precisely because at large commercial sale scale saving pennies on HW is very important. The reason we went to such lengths to reuse bits at the lowest level is because of needing the lowest cost devices on those projects.
Some were higher end, but I think it's more useful on low end chips.
ahhh, I think there's the source of our confusion: I suspect you are actually talking about NOR flash?
NOR flash is physically organized different from NAND. It typically does allow single word/byte or sometimes even bit level accesses, like you described. NOR flash is also much more reliable, often not needing any wear leveling at all. The downside is that NOR flash has orders of magnitudes lower data density.
Microcontrollers would use NOR flash internally for program memory, precisely because it allows direct, single-cycle access to individual opcodes. With NAND flash, program memory would have to be read page-wise and require some sort of instruction cache in between. Other EEPROM-like devices (e.g. AT28Fxxx) also use NOR flash for pretty much the same reasons.
On some embedded Linux devices, NOR flash is used for config/boot loader/kernel, while the rootfs lives on NAND.
Nope. PIC has on device NOR (which I've tested), and often has external NAND flash (depending on design choices), such as using SDCard interfaces.
Here's [1] a Micron tech doc on their NAND chips stating quite clearly they allow exactly what I described doing above: "A NAND Flash block is 128KB. Erasing a block sets all bits to 1 (and all bytes to FFh). Programming is necessary to change erased bits from 1 to 0. The smallest entity that can be programmed is a byte."
There's plenty of manufacturers and chip types that guarantee one can do this. It is tech notes like that led me to do some testing to see if devices fall into spec on R/W cycles before death when evaluating which chips to ship in consumer products that need this.
[1] https://user.eng.umd.edu/~blj/CS-590.26/micron-tn2919.pdf
I do know that very old flash firmwares applied that idea, and that new flash evolved in a direction where the wear caused by an erase is closer to the one caused by a write. If modern firmwares do not use it, it's probably because there isn't a lot to gain.
What are you supposed to do, then? Buffer up writes and accept that you'll lose logs a minute or so before a power outage?
As much hell as we had with those SD cards I'd rather put tiny iPod spinners in them...
When you are designing the hardware, you have lots and lots of choices.
And we logged too much to pull all the logs over WAN all the time, resulting in a clever hack for remotely browsing logs with (relative) security
Honestly we could have batched up the logs.
They prepare and erase a new pool only when it's full causing bursts in speeds and long periods of unresponsiveness (10 sec) while writing, reading is blocked as well. You can see it as a zigzag in file transfer speed graphs. This is not to be confused with OS buffer flushing.
While I couldn't find any official info for the reasons behind it, it's assumed that the erase speed is slow on low quality flash and hence the controller has to pool in order to erase pages in parallel, increasing speed when copying small files between computers on plug and unplug.
In my case it was about 500MB before before freezing on a 128GB flash drive.