On Wednesday 09 May 2007 14:30, Andrea Conti wrote:
> This is the dump of a working mikrotik boot partition, created
> with "nanddump -ni" under 2.6.19.2
> It should contain a single file named "kernel"
>
> http://www.alyf.net/rb/boot-dump.bz2

$ hexdump -C boot-dump
00000000  01 00 00 00 01 00 00 00  ff ff 6b 65 72 6e 65 6c  |..........kernel|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100  00 00 00 00 00 00 00 00  00 00 ff ff a4 81 00 00  |................|
00000110  00 00 00 00 00 00 00 00  ad 43 6d 38 ad 43 6d 38  |.........Cm8.Cm8|
00000120  ad 43 6d 38 00 00 00 00  ff ff ff ff ff ff ff ff  |.Cm8............|
00000130  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
000001c0  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 00 00  |................|
000001d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|
*
000001f0  ff ff ff ff ff ff ff ff  00 00 00 00 00 00 00 00  |................|
00000200  00 00 10 00 00 ff 7f 01  ff f0 0f 70 81 aa 5a 97  |...........p..Z.|
00000210  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000220  02 00 08 00 01 00 00 00  40 00 28 80 34 00 00 00  |........@.(.4...|
00000230  44 fb 1f 00 01 10 00 50  34 00 20 00 03 00 28 00  |D......P4. ...(.|
00000240  14 00 13 00 00 00 00 70  70 73 19 00 70 93 29 80  |.......pps..p.).|
00000250  70 93 29 80 18 00 00 00  18 00 00 00 04 00 00 00  |p.).............|

The line starting at 00000200 is the oob/spare for the first page.
This contains 6 bytes of ECC, 1 byte of block-status (6th byte),
and 8 bytes of Yaffs PackedTags1 -- the question is, how is it ordered?
The ordering has to be consistent between readers and writers.

The autoplacement ordering in MTD is defined by the following in
nand_base.c:

static struct nand_oobinfo nand_oob_16 = {
        .useecc = MTD_NANDECC_AUTOPLACE,
        .eccbytes = 6,
        .eccpos = {0, 1, 2, 3, 6, 7},
        .oobfree = { {8, 8} }
};

Whether this ordering is used or not depend on the (oobinfo) argument passed
to MTD via the ioctl (from userspace) or the MTD driver read/write functions.
The current version of Yaffs(1) has the following:

#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18))
static struct nand_oobinfo yaffs_oobinfo = {
        .useecc = 1,		/* MTD_NANDECC_PLACE */
        .eccbytes = 6,
        .eccpos = {8, 9, 10, 13, 14, 15}
};
#endif

So that's a different ordering.  And the mikrotik boot may have another?!

Now Charles is really good and decoding tags and guessing the right answer.
I think is looks like the Tags start at the beginning and MTD's ECC is at
the end -- so so perhaps the ordering from Yaffs' yaffs_oobinfo.

You could try using the yaffs_oobinfo as your default in MTD.  Make sure
you do this experiment only on data you can afford to loose!  There are
also some other orderings out there, some with the ECC bytes in a different
sequence.

One could take the page data (512 bytes) and compute the 6 ECC bytes,
then look for them in this sample -- this could reveal the answer.

-Ian