From Sp305x wiki

Supported Chips

A variety of NAND Flash chips may be found in these units. They are all large-block MLC devices. Some devices may even contain 2 chips (or at least, the SoC seems to support that).

• Samsung K9GAG08U0M -- id: ec d5 14 b6 74 -- Geometry: (4096 + 128) bytes/page, 128 pages/block, 4096 blocks (2GB)
• Samsung K9LAG08U0M -- id: ec d5 55 25 68 -- Geometry: (2048 + 64) bytes/page, 128 pages/block, 8192 blocks (2GB)

General structure

The first page of NAND contains the "NandRsv" block, an example of which is:

00000000   4E414E44  20525356  EFBE990F  66009AFF  NAND RSV....f...
00000010   63000000  03000000  00000000  66000000  c...........f...
00000020   00000000  57000C00  0000FFFF  34991300  ....W.......4...
00000030   00000000  FFFFFFFF  FFFFFFFF  FFFFFFFF  ................

This may be interpreted as:

asciiName = [NAND RSV] signature = [0xbeef] checksum = [ff9a]
 nrFwBlks = [0x3]     fwStartBlk = [0x63]  nrFwBlks2 = [0x0] fwStartBlk2 = [0x66]
   nrRsvA = [0x57]        nrRsvB = [0xc]      nrRsvC = [0x0]   nrRsvBlks = [0x66]

It specifies a "reserved" region of memory at the end of flash, and then divides it up into up to 5 chunks -- RsvA, RsvB, RsvC, firmware1 and firmware2. A, B and C contain resource files for the firmware; when present, these are FAT filesystems that cannot be seen by the USB Mass Storage driver.

The second page contains a blocklist ("mapTable") for the reserved region -- it contains a mapping of logical NAND blocks to physical NAND blocks. Note that there are 0x66 entires, corresponding to nrRsvBlks.

00001080   FF0F FE0F  FD0F FC0F  FB0F FA0F  F90F F80F
00001090   F70F F60F  F50F F40F  F30F F20F  F10F F00F
000010A0   EF0F EE0F  ED0F EC0F  EB0F EA0F  E90F E80F
000010B0   E70F E60F  E50F E40F  E30F E20F  E10F E00F
000010C0   DF0F DE0F  DD0F DC0F  DB0F DA0F  D90F D80F
000010D0   D70F D60F  D50F D40F  D30F D20F  D10F D00F
000010E0   CF0F CE0F  CD0F CC0F  CB0F CA0F  C90F C80F
000010F0   C70F C60F  C50F C40F  C30F C20F  C10F C00F
00001100   BF0F BE0F  BD0F BC0F  BB0F BA0F  B90F B80F
00001110   B70F B60F  B50F B40F  B30F B20F  B10F B00F
00001120   AF0F AE0F  AD0F AC0F  AB0F AA0F  A90F A80F
00001130   A70F A60F  A50F A40F  A30F A20F  A10F A00F
00001140   9F0F 9E0F  9D0F 9C0F  9B0F 9A0F  0000 0000

In this example, there 3 blocks (1.5MB) of "firmware", starting at block 0x63 and ending at block 0x65. These are indices into the mapTable -- so the boot ROM reads them in the order 0x0F9C, 0x0F9B, 0x0F9A.

Spare area

All support NAND-flash chips are believed to be large-block chips, which means they have 8 or 16 bytes of "spare" (aka Out-Of-Band / OOB) data per 512 bytes of data. The chips I've looked at have been of the type with 16 bytes per 512 bytes -- for a chip with 4096-byte pages, each page will be followed by 8 16-bit "ECC lines".

For the above blocklist, the spare area is:

00002080   FF 14 2E C8  7C 92 38 74  78 55 E2 F6  B5 6B 5A 30
00002090   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84
000020A0   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84
000020B0   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84
000020C0   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84
000020D0   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84
000020E0   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84
000020F0   FF 14 2E 9E  6B 25 94 F7  A7 5A BE B3  29 92 95 84

The first byte is always 'FF' (to indicate this is a valid block). The next four bits are flags (?), followed by a 12-bit block number; this is the "logical" block number that this physical block has been mapped to (in this case, 0x42e). The remaining 13 bytes are ECC data for a 512-byte chunk of data.