Page corruption when writing non-sequential pages in an MLC NAND eraseblock

[Avery Pennarun]

Hi everyone,

Does this sound familiar?

Setup:
- Linux 2.6.37 or 3.2.26 (apologies for the old versions, but I
couldn't find any related patches in newer kernels and these are
embedded systems that are a bit hard to upgrade)
- Micron MT29F16G08CBACAWP - MLC NAND
- 1 Mbyte eraseblocks
- 1 kbyte pages
- Tested on two different hardware platforms (MIPS and ARM devices)

Steps:
- Disable ECC to avoid any confusion (ECC turns out to not affect the
test results, but I wanted to make sure)
- Erase any eraseblock
- Write all-zeroes to page 0x18 of that eraseblock; read it back -> ok
- Write all-zeroes to page 0x12 of that eraseblock; read it back ->
FAIL, all 0xff instead
- Read page 0x18 -> completely random data (about 12% of bits are flipped)

More details:
- It doesn't happen with a related Micron SLC NAND
- If you write the pages in the opposite order there is no problem
- Delays before/after reading and writing, and the sequence of reads,
has no effect
- This turns out to happen for any pair of pages, where pairs are
always exactly 6 pages apart (n and n+6), other than the first and
last 4 pages in each eraseblock, which are paired with different pages
to make the math work out

I've read about the concept of MLC "paired pages" causing corruption
elsewhere, but it supposedly only happens when you get a power
failure.  It's happening for me during normal runtime, which seems
wrong.

Has anyone heard of this?

Thanks,

Avery