Wiki > Main > TelechipsNAND (compare)
Difference: TelechipsNAND (r2 vs. r1)
This page is intended to collate known information about the Telechips NAND Flash Translation Layer (TNFTL). Various string references to "TNFTL" are present in the Logik DAX, Cowon D2 and iAudio 7 firmwares (and on the flash memory itself) so this information should be applicable to all these devices, and potentialy other Telechips-based devices.
Terminology used in this document:
NOTE: Information here has been gathered from a 4Gb Cowon D2 (2 banks of SAMSUNG K9LAG08U0M?; 2048+64 byte pages, 128 pages per block) and therefore will need confirmation and/or adjustments for other models, eg the 8Gb D2 has 4096+128 byte pages.
Each physical page is divided into a number of 512+16 byte sectors. The 16 bytes of spare/oob data appears immediately after the data for each sector (not at the end of each page as the SAMSUNG datasheet implies) and contains the following data:
Note that the factory bad block marking scheme suggested by the SAMSUNG datasheet (last page of each bad block has byte 2048 /= 0xFF) appears not to be used, since this byte will usually contain valid page data. It is not currently known how bad blocks are identified - is there a bad block table stored somewhere yet to be discovered?
All data stored on the device (except for reserved blocks and the NAND Boot area) is arranged in segments of 4 blocks, corresponding to the 4 planes referred to in the "Memory Map" section of SAMSUNG datasheet.
To read sequential data from a segment, use the following sequence:
0: Block n, page 0 1: Block n+0x1000, page 0 2: Block n+1, page 0 3: Block n+0x1001, page 0 4: Block n, page 1 ..etc..
The first Segment of each bank (ie. blocks 0, 1, 0x1000 and 0x1001 for K9LAG08U0M?) is reserved and contains the following data in Block 0, Page 0:
For bank 0 only, the following data is also present:
NB: the offsets here may be specific to the particular page size in use - needs confirmation.
Excluding the first two blocks of each bank (see above), pages within each block on the device are marked with one of the following block types:
Segments where the first sector is marked 0x12 or 0x22 are used to store logical Segment Number to Physical Address lookup tables for the Main Data area and Hidden Data area, respectively. This consists of a set of 32-bit values in sector 0 of each populated page, where each value represents the physical Block Number / 2. Note that page 0 appears to always be empty, apart from the block type identifier.
I've confirmed that, for the hidden data area (0x22) at least, the translation table contains 9 valid pointers to segments marked with Segment Numbers 0 to 8. The main data area will take more effort to confirm, as there are 3812 sequential segments spread across the two NAND banks.
These are the main data storage blocks. Each physical segment is marked with the logical Segment Number that the data belongs to. Sequential data can be read using the scheme detailed in "Block / Segment Layout".
These blocks appear to contain a cache of recently-written page data. Layout / usage TBC.
These blocks appear identical to blocks 0x13 and 0x23, except that the first page of the block is marked with an 0x17 identifier. The purpose of this is unknown.
Block n+0, Page 0 contains the string "TNFTLHIDDENSIGNATURE" plus four 0x00 bytes. Block n+1, Page 0 contains the 32-bit value 0x1cbb9
Block n+0, Page 0 contains the string "TNFTLMULTIHIDDENSIGNATURE", then 0x00 0x45 0x00. Block n+1, Page 0 contains the 32-bit value 0xfed
The NAND Boot Area is a sequence of blocks starting at the Block Number referenced in Bank 0, Block 0, Page 0 (see Reserved Blocks above). It consists of a header block which contains pointers to Block Numbers containing the D2 firmware (4Mb in size). Immediately following this is a second header block, and a second copy of the firmware.
To complete read support:
Required for write support:
I suspect we do need to implement wear-levelling, since the SAMSUNG datasheet states "even write-intensive systems can take advantage of the K9LAG08U0M?'s extended reliability of 5K program/erase cycles by providing ECC (Error Correction Code) with real time mapping out algorithm".
Less importantly (since we don't care about the hidden areas):
r2 - 13 Feb 2008 - 21:27:51 - RobPurchaseRevision r2 - 13 Feb 2008 - 21:27 - RobPurchase
Revision r1 - 12 Feb 2008 - 22:37 - RobPurchase
Copyright © by the contributing authors.