iMX6ULL - 4k NAND flash boot issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

iMX6ULL - 4k NAND flash boot issue

3,128 Views
arekkaras
Contributor III

Hello,

I have a board based on imx6ULL processor which boots from NAND flash.

Up to now I was using 1G NAND flash and everything is working fine with this memory.

Recently, I have changed memory to 4G device (Micron MT29F4G08ABAEAWP) - and with this memory I am not able to boot.

I can flash it properly with kobs-ng if I load u-boot via USB.

Here is flashing log:

kobs-ng init -x u-boot.imx.nand --search_exponent=1 -v
MTD CONFIG:
  chip_0_device_path = "/dev/mtd0"
  chip_1_device_path = "(null)"
  search_exponent = 1
  data_setup_time = 80
  data_hold_time = 60
  address_setup_time = 25
  data_sample_time = 6
  row_address_size = 3
  column_address_size = 2
  read_command_code1 = 0
  read_command_code2 = 48
  boot_stream_major_version = 1
  boot_stream_minor_version = 0
  boot_stream_sub_version = 0
  ncb_version = 3
  boot_stream_1_address = 0
  boot_stream_2_address = 0
         -- We add the 1k-padding to the uboot.
.tmp_kobs_ng: verifying using key '00000000000000000000000000000000'
.tmp_kobs_ng: is a valid bootstream for key '00000000000000000000000000000000'
mtd: Linux 4.1
mtd: use new bch layout raw access mode
mtd: opening: "/dev/mtd0"
Cannot open BCH geometry node: "/sys/kernel/debug/gpmi-nand/bch_geometry"
NFC geometry :
        ECC Strength       : 16
        Page Size in Bytes : 4320
        Metadata size      : 10
        ECC Chunk Size in byte : 512
        ECC Chunk count        : 8
        Block Mark Byte Offset : 3904
        Block Mark Bit Offset  : 0
====================================================
mtd: opened '/dev/mtd0' - '(null)'
mtd: max_boot_stream_size_in_bytes = 1572864
mtd: boot_stream_size_in_bytes = 528384
mtd: boot_stream_size_in_pages = 129
mtd: #1 0x00100000 - 0x00280000 (0x00181000)
mtd: #2 0x00280000 - 0x00400000 (0x00301000)
FCB
  m_u32Checksum = 0x00000000
  m_u32FingerPrint = 0x20424346
  m_u32Version = 0x01000000
  m_NANDTiming.m_u8DataSetup = 80
  m_NANDTiming.m_u8DataHold = 60
  m_NANDTiming.m_u8AddressSetup = 25
  m_NANDTiming.m_u8DSAMPLE_TIME = 6
  m_u32PageDataSize = 4096
  m_u32TotalPageSize = 4320
  m_u32SectorsPerBlock = 64
  m_u32NumberOfNANDs = 0
  m_u32TotalInternalDie = 0
  m_u32CellType = 0
  m_u32EccBlockNEccType = 8
  m_u32EccBlock0Size = 512
  m_u32EccBlockNSize = 512
  m_u32EccBlock0EccType = 8
  m_u32MetadataBytes = 10
  m_u32NumEccBlocksPerPage = 7
  m_u32EccBlockNEccLevelSDK = 0
  m_u32EccBlock0SizeSDK = 0
  m_u32EccBlockNSizeSDK = 0
  m_u32EccBlock0EccLevelSDK = 0
  m_u32NumEccBlocksPerPageSDK = 0
  m_u32MetadataBytesSDK = 0
  m_u32EraseThreshold = 0
  m_u32Firmware1_startingPage = 256
  m_u32Firmware2_startingPage = 640
  m_u32PagesInFirmware1 = 129
  m_u32PagesInFirmware2 = 129
  m_u32DBBTSearchAreaStartAddress = 128
  m_u32BadBlockMarkerByte = 3904
  m_u32BadBlockMarkerStartBit = 0
  m_u32BBMarkerPhysicalOffset = 4096
  m_u32BCHType = 0
  m_NANDTMTiming.m_u32TMTiming2_ReadLatency = 0
  m_NANDTMTiming.m_u32TMTiming2_PreambleDelay = 0
  m_NANDTMTiming.m_u32TMTiming2_CEDelay = 0
  m_NANDTMTiming.m_u32TMTiming2_PostambleDelay = 0
  m_NANDTMTiming.m_u32TMTiming2_CmdAddPause = 0
  m_NANDTMTiming.m_u32TMTiming2_DataPause = 0
  m_NANDTMTiming.m_u32TMSpeed = 0
  m_NANDTMTiming.m_u32TMTiming1_BusyTimeout = 0
  m_u32DISBBM = 0
  m_u32BBMarkerPhysicalOffsetInSpareData = 0
  m_u32OnfiSyncEnable = 0
  m_NANDONFITiming.m_u32ONFISpeed = 0
  m_NANDONFITiming.m_u32ONFITiming_ReadLatency = 0
  m_NANDONFITiming.m_u32ONFITiming_CEDelay = 0
  m_NANDONFITiming.m_u32ONFITiming_PreambleDelay = 0
  m_NANDONFITiming.m_u32ONFITiming_PostambleDelay = 0
  m_NANDONFITiming.m_u32ONFITiming_CmdAddPause = 0
  m_NANDONFITiming.m_u32ONFITiming_DataPause = 0
  m_NANDONFITiming.m_u32ONFITiming_BusyTimeout = 0
  m_u32DISBBSearch = 0
  m_u32RandomizerEnable = 0
  m_u32ReadRetryEnable = 0
  m_u32ReadRetrySeqLength = 0
DBBT
  m_u32Checksum = 0x00000000
  m_u32FingerPrint = 0x54424244
  m_u32Version = 0x01000000
  m_u32DBBTNumOfPages = 0
Firmware: image #0 @ 0x100000 size 0x81000 - available 0x180000
Firmware: image #1 @ 0x280000 size 0x81000 - available 0x180000
-------------- Start to write the [ FCB ] -----
mtd: erasing @0:0x0-0x40000
mtd: Writing FCB0 [ @0:0x0 ] (10e0) *
mtd: erasing @0:0x40000-0x80000
mtd: Writing FCB1 [ @0:0x40000 ] (10e0) *
mtd_commit_bcb(FCB): status 0

-------------- Start to write the [ DBBT ] -----
mtd: erasing @0:0x80000-0xc0000
mtd: Writing DBBT0 [ @0:0x80000 ] (1000) *
mtd: erasing @0:0xc0000-0x100000
mtd: Writing DBBT1 [ @0:0xc0000 ] (1000) *
mtd_commit_bcb(DBBT): status 0

---------- Start to write the [ .tmp_kobs_ng ]----
mtd: Writting .tmp_kobs_ng: #0 @0: 0x00100000 - 0x00181000
mtd: erasing @0:0x100000-0x140000
mtd: erasing @0:0x140000-0x180000
mtd: erasing @0:0x180000-0x1c0000
mtd: We write one page for save guard. *
mtd: Writting .tmp_kobs_ng: #1 @0: 0x00280000 - 0x00301000
mtd: erasing @0:0x280000-0x2c0000
mtd: erasing @0:0x2c0000-0x300000
mtd: erasing @0:0x300000-0x340000
mtd: We write one page for save guard. *

I have followed description found in topics i.MX6Q NAND boot issues and NAND BOOT fail on iMX6UL  but still no success.

Here is boot room log buffer content:

J-Link>mem32 0x000001e0 1
Memory access: CPU temp. halted: https://wiki.segger.com/Memory_accesses#Legacy_stop_mode
000001E0 = 00901CF4
J-Link>mem8 0x00901CF4 0x100
00901CF4 = 02 00 01 00 F0 00 02 00 00 00 03 00 00 00 04 00
00901D04 = 00 00 05 00 00 00 06 00 00 00 07 00 F0 00 07 00
00901D14 = 00 00 08 00 00 01 00 00 33 00 08 00 01 00 05 00
00901D24 = 00 00 06 00 00 00 07 00 F0 00 07 00 00 00 08 00
00901D34 = 80 02 00 00 33 00 08 00 FF 1F 06 00 01 20 06 00
00901D44 = 00 00 07 00 33 00 07 00 00 00 0C 00 00 00 00 00
00901D54 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D64 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D74 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D84 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D94 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DA4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DB4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DC4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DD4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DE4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

And boot memory content:

mem8 0x907400 0x100
00907400 = 00 00 00 00 00 00 00 F0 7F 87 00 10 08 00 00 00
00907410 = 00 00 D2 01 E8 40 CC 01 E4 04 02 0C 40 68 FF FF
00907420 = FF FF 02 0C 40 6C FF FF FF FF 02 0C 40 70 FF FF
00907430 = FF FF 02 0C 40 74 FF FF FF FF 02 0C 40 78 FF FF
00907440 = FF FF 02 0C 40 7C FF FF FF FF 02 0C 40 80 FF FF
00907450 = FF FF 02 0E 04 B4 00 0C 00 00 02 0E 04 AC 00 00
00907460 = 00 00 02 0E 02 7C 00 00 00 30 02 0E 02 50 00 00
00907470 = 00 30 02 0E 02 4C 00 00 00 30 02 0E 04 90 00 00
00907480 = 00 30 02 0E 02 88 00 00 00 30 02 0E 02 70 00 00
00907490 = 00 00 02 0E 02 60 00 00 00 30 02 0E 02 64 00 00
009074A0 = 00 30 02 0E 04 A0 00 00 00 30 02 0E 04 94 00 02
009074B0 = 00 00 02 0E 02 80 00 00 00 30 02 0E 02 84 00 00
009074C0 = 00 30 02 0E 04 B0 00 02 00 00 02 0E 04 98 00 00
009074D0 = 00 30 02 0E 04 A4 00 00 00 30 02 0E 02 44 00 00
009074E0 = 00 30 02 0E 02 48 00 00 00 30 02 1B 00 1C 00 00
009074F0 = 80 00 02 1B 08 00 A1 39 00 03 02 1B 08 0C 00 00

Attached are files with NAND dumps from page 0 and page 128 (first u-boot page).

WHat I have found is that this NAND memory has non-standard OOB area size - 224 bytes.

Could this be an issue for boot rom ?

Regards

Arek Karaś

Labels (2)
0 Kudos
6 Replies

1,850 Views
arekkaras
Contributor III

Finally, I have managed this.

What I found is that kobs-ng incorrectly programs FCB block when debugfs is not mounted on Linux.

It seams that kobs-ng is using debugfs to obtain NAND flash geometry, but if it can not find debugfs entry it puts just warning and tries different method for obtaining NAND/BCH parameters.

Interesting thing is that for this particular NAND flash chip geometry obtained from debugfs differs from one obtained in different way (mtd query ?)

Here is difference:

pastedImage_1.png

IMHO, kobs-ng should refuse to write ANND flash if it can not find debugfs entry, or at least warn that this could lead to boot issues.

Regards

Arek

0 Kudos

1,850 Views
igorpadykov
NXP Employee
NXP Employee

Hi Arkadiusz

in general 224 bytes nand should work, one can try to program

image with mfg tools from below link, preferably using latest bsps

https://www.nxp.com/support/developer-resources/run-time-software/i.mx-developer-resources/i.mx-6ser...

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

0 Kudos

1,850 Views
arekkaras
Contributor III

Hi Igor,

I did some log buffer analysis, based on this https://community.nxp.com/servlet/JiveServlet/download/880961-1-400476/MX6%20boot%20%20log_buffer.pd...  document:

00901CF4 = 00010002        ROM_LOG_BOOTMODE_INTERNAL
           000200F0        ROM_LOG_SEC_CONFIG_OPEN
           00030000        ROM_LOG_DIR_BT_DIS_VALUE0
           00040000        ROM_LOG_BT_FUSE_SEL_VALUE0
           00050000        ROM_LOG_PRIM_IMAGE_SELECT
           00060000        ROM_LOG_PRIM_BOOTDEVICE_NAND
           00070000        ROM_LOG_DEVICE_INIT_CALL
           000700F0        ROM_LOG_DEVICE_INIT_PASS
           00080000        ROM_LOG_DEVICE_READ_DATA_CALL
           00000100        -> page number pointing to firmware 1 starting page
           00080033        ROM_LOG_DEVICE_READ_DATA_FAIL
           00050001        ROM_LOG_SEC_IMAGE_SELECT
           00060000        ROM_LOG_PRIM_BOOTDEVICE_NAND
           00070000        ROM_LOG_DEVICE_INIT_CALL
           000700F0        ROM_LOG_DEVICE_INIT_PASS
           00080000        ROM_LOG_DEVICE_READ_DATA_CALL
           00000280        -> page number pointing to firmware 2 starting page
           00080033        ROM_LOG_DEVICE_READ_DATA_FAIL
           00061FFF        ROM_LOG_REC_BOOTDEVICE_NONE
           00062001     ?????
           00070000        ROM_LOG_DEVICE_INIT_CALL
           00070033        ROM_LOG_DEVICE_INIT_FAIL
           000C0000        ROM_LOG_SDP_ENTRY
           00000000

Could please have a look on it ?

What means" ROM_LOG_DEVICE_READ_DATA_FAIL" ? Is reading of DCD data block from image ?

I have found also something strange in boot data buffer, at memory address 0x907400:

00907400 = 00 00 00 00 00 00 00 F0 7F 87 00 10 08 00 00 00
00907410 = 00 00 D2 01 E8 40 CC 01 E4 04 02 0C 40 68 FF FF
00907420 = FF FF 02 0C 40 6C FF FF FF FF 02 0C 40 70 FF FF
00907430 = FF FF 02 0C 40 74 FF FF FF FF 02 0C 40 78 FF FF
00907440 = FF FF 02 0C 40 7C FF FF FF FF 02 0C 40 80 FF FF
00907450 = FF FF 02 0E 04 B4 00 0C 00 00 02 0E 04 AC 00 00
00907460 = 00 00 02 0E 02 7C 00 00 00 30 02 0E 02 50 00 00
00907470 = 00 30 02 0E 02 4C 00 00 00 30 02 0E 04 90 00 00
00907480 = 00 30 02 0E 02 88 00 00 00 30 02 0E 02 70 00 00
00907490 = 00 00 02 0E 02 60 00 00 00 30 02 0E 02 64 00 00
009074A0 = 00 30 02 0E 04 A0 00 00 00 30 02 0E 04 94 00 02
009074B0 = 00 00 02 0E 02 80 00 00 00 30 02 0E 02 84 00 00
009074C0 = 00 30 02 0E 04 B0 00 02 00 00 02 0E 04 98 00 00
009074D0 = 00 30 02 0E 04 A4 00 00 00 30 02 0E 02 44 00 00
009074E0 = 00 30 02 0E 02 48 00 00 00 30 02 1B 00 1C 00 00
009074F0 = 80 00 02 1B 08 00 A1 39 00 03 02 1B 08 0C 00 00
00907500 = 00 00 02 1B 08 3C 41 57 01 55 02 1B 08 48 40 40
00907510 = 47 4A 02 1B 08 50 40 40 55 50 02 1B 08 1C 33 33
00907520 = 33 33 02 1B 08 20 33 33 33 33 02 1B 08 2C F3 33
00907530 = 33 33 02 1B 08 30 F3 33 33 33 02 1B 08 C0 00 92
00907540 = 10 12 02 1B 08 B8 00 00 08 00 02 1B 00 04 00 02
00907550 = 00 2D 02 1B 00 08 1B 33 30 30 02 1B 00 0C 67 6B
00907560 = 52 F3 02 1B 00 10 B6 6D 0B 63 02 1B 00 14 01 FF
00907570 = 00 DB 02 1B 00 18 00 20 17 40 02 1B 00 1C 00 00
00907580 = 80 00 02 1B 00 2C 00 00 26 D2 02 1B 00 30 00 6B
00907590 = 10 23 02 1B 00 40 00 00 00 4F 02 1B 00 00 84 18
009075A0 = 00 00 02 1B 08 90 23 40 0A 38 02 1B 00 1C 02 00
009075B0 = 80 32 02 1B 00 1C 00 00 80 33 02 1B 00 1C 00 04
009075C0 = 80 31 02 1B 00 1C 15 20 80 30 02 1B 00 1C 04 00
009075D0 = 80 40 02 1B 00 20 00 00 08 00 02 1B 08 18 00 00
009075E0 = 02 27 02 1B 00 04 D2 70 9A 92 71 26 94 27 06 47
009075F0 = B3 64 9D 00 02 55 2D 02 1B 04 04 00 01 10 06 02
00907600 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907610 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907620 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907630 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907640 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907650 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907660 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907670 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907680 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907690 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076A0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076B0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076C0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076D0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076E0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076F0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907700 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907710 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907720 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907730 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907740 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907750 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907760 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907770 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907780 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907790 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077A0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077B0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077C0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077D0 = 00 00 00 00 00 00 00 00 00 A2 22 E1 6A 2C D6 E2
009077E0 = F9 29 17 83 26 23 00 00 00 00 00 00 08 00 00 00
009077F0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If  Iassume correctly, this is raw data read from NAND flash ? If so, in bold I marked ECC blocks. However, after first marked ECC data, real data seams to be corrupted or missing. Raw content of NAND flash in this area is:

        02 1b 00 04 d2 70 9a 92  71 26 94 27 06 47 b3 64
        9d 00 02 55 2d 02 1b 04  04 00 01 10 06 02 1b 00
        1c 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00

As you can see, bytes with underscore are missing in data buffer - so ECC validation will fail and this wille result in boot error! I am right in my assumptions ? Do you have any idea why boot may read incorrect data from NAND ?

I did several tests with u-boot and Linux  and didn't found any issue with this NAND flash.

Regards

Arek

0 Kudos

1,850 Views
arekkaras
Contributor III

One more thing - after stopping processor with JATG, i dumped als oBCH module registers:

mem32 0x1808000 0x5f
01808000 = 00000000 00000000 00000000 00000000
01808010 = 0000FE04 0000FE04 0000FE04 0000FE04
01808020 = 00000000 00000000 00000000 00000000
01808030 = 00000000 00000000 00000000 00000000
01808040 = 00000000 00000000 00000000 00000000
01808050 = 00000000 00000000 00000000 00000000
01808060 = 00000000 00000000 00000000 00000000
01808070 = E4E4E4E4 E4E4E4E4 E4E4E4E4 E4E4E4E4
01808080 = 070A4080 070A4080 070A4080 070A4080
01808090 = 10DA4080 10DA4080 10DA4080 10DA4080
018080A0 = 070A4080 070A4080 070A4080 070A4080
018080B0 = 10DA4080 10DA4080 10DA4080 10DA4080
018080C0 = 070A4080 070A4080 070A4080 070A4080
018080D0 = 10DA4080 10DA4080 10DA4080 10DA4080
018080E0 = 070A4080 070A4080 070A4080 070A4080
018080F0 = 10DA4080 10DA4080 10DA4080 10DA4080
01808100 = 00000000 00000000 00000000 00000000
01808110 = 00000000 00000000 00000000 00000000
01808120 = 00000000 00000000 00000000 00000000
01808130 = 00000000 00000000 00000000 00000000
01808140 = 00000000 00000000 00000000 00000000
01808150 = 20484342 20484342 20484342 20484342
01808160 = 01000000 01000000 01000000 01000000
01808170 = 00000000 00000000 00000000

As you can see, BCH module reports uncorrectable error.

0 Kudos

1,850 Views
igorpadykov
NXP Employee
NXP Employee

Hi Arkadiusz

reason may be that image is written incorrectly with wrong ecc

settings. Please try with mfg tool, check that this nand is present

in linux/..mtd/nand/nand_ids.c, if not - add additional record for that particular

nand. If necessary, rebuild mfg tools firmware (files in mfg tool ../firmware folder)

using sect.6.2 Manufacturing Tool, MFGTool Yocto Guide included in

https://www.nxp.com/webapp/Download?colCode=L4.1.15_2.0.0-LINUX-DOCS 

Best regards
igor

0 Kudos

1,850 Views
arekkaras
Contributor III

Hi Igor,

thank you for your suggestion.

I will try to flash with MFG tool and test.

But, could you please in meantime have a look on bot rom log buffer content

and try to obtain why processor stays in serial download mode ?

Regards

Arek

2018-03-05 6:07 GMT+01:00 igorpadykov <admin@community.nxp.com>:

NXP Community

<https://community.freescale.com/resources/statics/1000/35400-NXP-Community-Email-banner-600x75.jpg>

Re: iMX6ULL - 4k NAND flash boot issue

reply from igorpadykov

<https://community.nxp.com/people/igorpadykov?et=watches.email.thread> in *i.MX

Community* - View the full discussion

<https://community.nxp.com/message/992074?commentID=992074&et=watches.email.thread#comment-992074>

0 Kudos