1、问题描述
硬件：DM6467T+NANDFLASH（MT29F4G08BAB)+DDR做的一款办卡产品，
软件系统包括UBL、UBOOT、KERNEL、FS（cramfs）系统。
该产品一般情况下，从UBL到FS（cramfs）启动正常。
但是，（1）常温存储26块，存储2个月后，发现3块，FS（cramfs）无法启动，
（2）高温70度存储26块，存储12小时后，发现2块，FS（cramfs）无法启动，
（3）高温70度存储26块，存储12小时后，都是好的，
FS（cramfs）无法启动问题运行日志见附件日志文件。
出现该问题后重新烧写FS（cramfs）系统即可正常启动。
2、定位处理
通过在KERNEL中添加打印信息发现，FS（cramfs）无法启动，是因为KERNEL启动FS（cramfs）时，通过内核接口读取NANDFLASH的数据时，发现ECC校验错误（6467计算的ECC和NANDFLASH中读取出来的不一样），于是校正错误，校正后系统就挂了，无法启动。
发现程序跑进如下程序的if ((diff >> (12 + 3)) < chip->ecc.size) 条件语句，执行dat[diff >> (12 + 3)] ^= BIT((diff >> 12) & 7);后系统就会挂了。
static int nand_davinci_correct_1bit(struct mtd_info *mtd, u_char *dat, u_char *read_ecc, u_char *calc_ecc)
{
struct nand_chip *chip = mtd->priv;
uint32_t eccNand = read_ecc[0] | (read_ecc[1] << 8) |(read_ecc[2] << 16);
uint32_t eccCalc = calc_ecc[0] | (calc_ecc[1] << 8) | (calc_ecc[2] << 16);
uint32_t diff = eccCalc ^ eccNand;
if (diff)
{
if ((((diff >> 12) ^ diff) & 0xfff) == 0xfff)
{
/* Correctable error */
if ((diff >> (12 + 3)) < chip->ecc.size)
{
dat[diff >> (12 + 3)] ^= BIT((diff >> 12) & 7);
printk("[%s, %d]: gxl \n", __func__, __LINE__);
return 1;
}
else
{
printk("[%s, %d]: gxl \n", __func__, __LINE__);
return -1;
}
}
else if (!(diff & (diff - 1)))
{
/* Single bit ECC error in the ECC itself,
* nothing to fix */
printk("[%s, %d]: gxl \n", __func__, __LINE__);
return 1;
}
else
{
/* Uncorrectable error */
printk("[%s, %d]: gxl \n", __func__, __LINE__);
return -1;
}
}
return 0;
}
3、系统启动日志：
TI UBL Version: 1.50
Booting Catalog Boot Loader
BootMode = NAND
Starting NAND Copy...
Valid magicnum, 0xA1ACED66, found in block 0x00000006.
DONE
Jumping to entry point at 0x81080000.
U-Boot 2009.08 ( 1鏈04 2016 - 17:25:28)
gxl Cores: ARM 495 MHz
gxl DSP: 990 MHz
gxl DDR: 396 MHz
I2C: ready
DRAM: 256 MB
NAND: 512 MiB
In: serial
Out: serial
Err: serial
ARM Clock :- 495MHz
DDR Clock :- 396MHz
EEPROM @ 0x50 read FAILED!!!
Net: Ethernet PHY: GENERIC @ 0x00
DaVinci EMAC
Hit any key to stop autoboot: 0
Loading from NAND 512MiB 3,3V 8-bit, offset 0x800000
Image Name: Linux-2.6.32-rc2-davinci1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1852816 Bytes = 1.8 MB
Load Address: 80008000
Entry Point: 80008000
## Booting kernel from Legacy Image at 80700000 ...
Image Name: Linux-2.6.32-rc2-davinci1
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1852816 Bytes = 1.8 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
Starting kernel ...
Uncompressing Linux......................................................................................................................... done, booting the kernel.
Linux version 2.6.32-rc2-davinci1 (guoxl@guoxl-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #49 PREEMPT Tue Apr 19 14:26:48 CST 2016
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: DaVinci DM646x EVM
Memory policy: ECC disabled, Data cache writeback
DaVinci dm6467_rev3.x variant 0x1
PLL1: input = 33 MHz [ * 30 ] --> 999 MHz output.
PLL2: input = 33 MHz [ * 24 ] --> 799 MHz output.
Built 1 zonelists in Zone order, mobility grouping off. Total pages: 20320
Kernel command line: mem=80M console=ttyS0,115200n8 root=/dev/mtdblock3 rw rootfstype=cramfs ip=192.168.1.100:192.168.1.200:192.168.1.1:255.255.255.0::eth0:off eth=00:0c:29:94:d7:d6 video=dm64xxfb:output=pal
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 80MB = 80MB total
Memory: 77152KB available (3488K code, 320K data, 120K init, 0K highmem)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:245
Console: colour dummy device 80x30
Calibrating delay loop... 249.03 BogoMIPS (lpj=1245184)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
DaVinci: 43 gpio irqs
NET: Registered protocol family 16
MUX: Setting register STSOMUX_DISABLE
PINMUX0 (0x00000000) = 0x00000000 -> 0x00000000
MUX: Setting register STSIMUX_DISABLE
PINMUX0 (0x00000000) = 0x00000000 -> 0x00000000
MUX: Setting register PTSOMUX_DISABLE
PINMUX0 (0x00000000) = 0x00000000 -> 0x00000000
MUX: Setting register PTSIMUX_DISABLE
PINMUX0 (0x00000000) = 0x00000000 -> 0x00000000
MUX: initialized ATAEN
MUX: Setting register ATAEN
PINMUX0 (0x00000000) = 0x00000000 -> 0x00000001
bio: create slab <bio-0> at 0
SCSI subsystem initialized
vpif vpif: vpif probe success
ch0 default output "COMPOSITE", mode "NTSC"
ch1 default output "", mode ""
Switching to clocksource timer0_1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
JFFS2 version 2.2. (NAND) 漏 2001-2006 Red Hat, Inc.
msgmni has been set to 150
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x1c20000 (irq = 40) is a ST16654
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x1c20400 (irq = 41) is a ST16654
serial8250.0: ttyS2 at MMIO 0x1c20800 (irq = 42) is a ST16654
brd: module loaded
loop: module loaded
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xdc (Micron NAND 512MiB 3,3V 8-bit)
Scanning device for bad blocks
Creating 5 MTD partitions on "davinci_nand.0":
0x000000000000-0x000000080000 : "params"
0x000000080000-0x000000800000 : "bootloader"
0x000000800000-0x000000c00000 : "kernel"
0x000000c00000-0x000002c00000 : "rootfs"
0x000002c00000-0x000020000000 : "yaffs2"
davinci_nand davinci_nand.0: controller rev. 2.2
Fixed MDIO Bus: probed
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
console [netcon0] enabled
netconsole: network logging started
mice: PS/2 mouse device common for all mice
rtc-ds1307 1-0032: rtc core: registered ds1307 as rtc0
rtc-ds1307 1-0032: 56 bytes nvram
i2c /dev entries driver
Linux video capture interface: v2.00
ths7303 1-002c: chip found @ 0x58 (DaVinci I2C adapter)
ths7303 1-002c: ths7303 write failed
ths7303: probe of 1-002c failed with error -121
vpif_display vpif_display: Error registering v4l2 subdevice
vpif_display vpif_display: VPIF IRQ request failed
tvp5158 1-0058: tvp5158 1-0058 decoder driver registered !!
Patch is downloading.
tvp5158 1-0058: Reg(0x00): 0x00
vpif_capture vpif_capture: registered sub device tvp514x-0
vpif_capture vpif_capture: DM646x VPIF Capture driver initialized
Trying to register davinci display video device.
layer=c3177a00,layer->video_dev=c3177b70
Trying to register davinci display video device.
layer=c3177000,layer->video_dev=c3177170
davinci_init:DaVinci V4L2 Display Driver V1.0 loaded
watchdog watchdog: heartbeat 60 sec
NET: Registered protocol family 26
GRE over IPv4 tunneling driver
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
Bridge firewalling registered
Clocks: disable unused mcasp0
Clocks: disable unused mcasp1
Clocks: disable unused emac
Clocks: disable unused spi0
Clocks: disable unused timer1
Clocks: disable unused pci
davinci_emac_probe: using random MAC addr: 9a:2b:63:aa:87:31
emac-mii: probed
rtc-ds1307 1-0032: setting system clock to 2018-12-22 13:06:19 UTC (1545483979)
eth0: attached PHY driver [Marvell 88E1111] (mii_bus:phy_addr=1:00, id=1410cc2)
IP-Config: Complete:
device=eth0, addr=192.168.1.100, mask=255.255.255.0, gw=192.168.1.1,
host=192.168.1.100, domain=, nis-domain=(none),
bootserver=192.168.1.200, rootserver=192.168.1.200, rootpath=
VFS: Mounted root (cramfs filesystem) readonly on device 31:3.
Freeing init memory: 120K
end_request: I/O error, dev mtdblock3, sector 2088
Buffer I/O error on device mtdblock3, logical block 261
Error -5 while decompressing!
c03ce7be(2621)->c3537000(4096)
Error -3 while decompressing!
c03cf1fb(1836)->c3538000(4096)
Error -3 while decompressing!
c03cf927(2111)->c3539000(4096)
INIT: version 2.86 booting
Error -5 while decompressing!
c03ca7be(2621)->c3537000(4096)
Kernel panic - not syncing: Attempted to kill init!
Backtrace:
[<c002a7d0>] (dump_backtrace+0x0/0x114) from [<c02c2c68>] (dump_stack+0x18/0x1c)
r7:c3029ee0 r6:c3024000 r5:c3024000 r4:c03b3fb0
[<c02c2c50>] (dump_stack+0x0/0x1c) from [<c02c2cc0>] (panic+0x54/0x124)
[<c02c2c6c>] (panic+0x0/0x124) from [<c003f68c>] (do_exit+0x74/0x684)
r3:c03971b4 r2:c3028000 r1:c3029e58 r0:c0340cc6
[<c003f618>] (do_exit+0x0/0x684) from [<c003fd5c>] (do_group_exit+0xc0/0xf4)
[<c003fc9c>] (do_group_exit+0x0/0xf4) from [<c004b730>] (get_signal_to_deliver+0x3a4/0x404)
r7:c3029ee0 r6:40160000 r5:c3028000 r4:00000007
[<c004b38c>] (get_signal_to_deliver+0x0/0x404) from [<c00291fc>] (do_notify_resume+0x64/0x5c4)
[<c0029198>] (do_notify_resume+0x0/0x5c4) from [<c0026f08>] (work_pending+0x1c/0x20)
