[Galaxy Note GT-N7000 General] Entropy512:
There doesn't need to be any other case. We have all the proof we need now.

I instrumented a kernel that would show if the stock recovery was attempting to use the mmc_erase() function during a wipe by printing an error instead of going forward with the erase - it does.

<4>[ 38.129797] mmc_can_erase: called
<4>[ 38.129828] mmc_erase: mmc_erase() disabled for protection. from = 2293760, nr = 4194272, arg = 1
<3>[ 38.129879] end_request: I/O error, dev mmcblk0, sector 2293760
<6>[ 40.220059] pet_watchdog_timer_fn kicking...be65
<6>[ 42.860276] sec-battery sec-battery: sec_bat_check_vf: Battery Health (1)
<6>[ 42.860946] smb328-charger 19-0034: smb328_get_charging_health : charging status A(0x02)
<6>[ 42.861601] smb328-charger 19-0034: smb328_get_charging_health : charging status B(0x00)
<6>[ 42.862250] smb328-charger 19-0034: smb328_get_charging_health : charging status C(0x05)
<6>[ 42.862296] smb328-charger 19-0034: smb328_get_property: smb328_get_property (2,1)
<6>[ 42.934618] EXT4-fs (mmcblk0p1): mounted filesystem with ordered data mode. Opts:
<6>[ 43.094984] lcd panel: s6e8ax0_check_fb, fb2
<6>[ 43.225179] lcd panel: s6e8ax0_check_fb, fb2
<4>[ 43.226739] mmc_can_erase: called
<4>[ 43.226769] mmc_erase: mmc_erase() disabled for protection. from = 106496, nr = 409600, arg = 1
<3>[ 43.226817] end_request: I/O error, dev mmcblk0, sector 106496

(full dmesg attached).

I'm in the process of uploading the source for the test kernel and initramfs used - the initramfs is 100% stock except for enabling ADB in recovery so the dmesg could be pulled. The only kernel changes are build fixes and rendering the kernel safe by disabling mmc_erase()

Edit: Kernel repo is at https://github.com/Entropy512/n7000_erasetest_kernel/commits/master

Most important commit for this test is: https://github.com/Entropy512/n7000_erasetest_kernel/commit/c9b5be55339417831a507de9e41a0493113c8076 - All other commits are just cleaning it up so it will actually build. Samsung broke their Makefile by hardcoding stuff they shouldn't have, as usual.

Initramfs repo is at - https://github.com/Entropy512/n7000_initramfs_dangerous/commits/master - Bone stock XXLPY other than:

1) Adding placeholder files in empty directories. The kernel build script removes these at build time. (git doesn't like empty directories...)

2) Enabling ADB during recovery (can't collect the dmesg attached without this).

At this point we have proof positive that Samsung's stock kernels have all three of the prerequisites for eMMC damage:

1) The data I just collected proves that their stock recovery attempts to execute mmc_erase() if permitted to do so. (Note that removing MMC_CAP_ERASE blocks the erase process earlier in the call chain than mmc_erase() - in this case I left MMC_CAP_ERASE enabled but disabled mmc_erase() itself.)

2) Their kernels have MMC_CAP_ERASE set in the MSHCI host driver, which permits attempts from userspace to issue an ERASE command to succeed and send ERASE commands to the eMMC chip

3) It's been proven that nearly every shipped GT-N7000, SGH-I777, GT-I9100, and SPH-D710 has MAG4FA, VYL00M, or KYL00M fwrev 0x19, which is proven to be unable to handle ERASE commands.