"ECC failed" boot error after pulling power cable while flashing with 'kobs-ng init'

[andreashaas]

Hi all,

we use a iMX28 for a linux based product.

For the firmware upgrade 'kobs-ng init' is called to flash the SB file.

This works quite well, except when the power cable is pulled while flashing:

# kobs-ng init -v /tmp/pn-switch-develop_V1.00.101.sb --chip_0_size=0x2800000

MTD CONFIG:

  chip_0_device_path = "/dev/mtd0"

  chip_0_size = 41943040

  chip_1_device_path = "(null)"

  search_exponent = 2

  data_setup_time = 80

  data_hold_time = 60

  address_setup_time = 25

  data_sample_time = 6

  row_address_size = 3

  column_address_size = 2

  read_command_code1 = 0

  read_command_code2 = 48

  boot_stream_major_versiot_stream_minor_version = 0

  boot_stream_sub_version = 0

  ncb_version = 3

  boot_stream_1_address = 0

  boot_stream_2_address = 0

/tmp/pn-switch-develop_V1.00.101.sb: verifying using key '00000000000000000000000000000000'

boot image header:

  m_digest = 0c9029a68fc410d58af49ac3db439c0fde09a205

  m_signature = STMP

  m_majorVersion = 1

  m_minorVersion = 1

  m_flags = ROM_DISPLAY_PROGRESS (1)

  m_imageBlocks = 355172

  m_firstBootTagBlock = 9

  m_firstBootableSectionID = 0

  m_keyCount = 1

  m_keyDictionaryBlock = 7

  m_headerBlocks = 6

  m_sectionCount = 1

  m_sectionHeaderSize = 1

  m_timestamp = Thu Dec  3 10:19:26 2015

  m_productVersion.m_majorsion.m_minor = 0x9909

  m_productVersion.m_revision = 0x9909

  m_componentVersion.m_major = 0x9909

  m_componentVersion.m_minor = 0x9909

  m_componentVersion.m_revision = 0x9909

  m_driveTag = 0

* Using user supplied key='00000000000000000000000000000000'

section header #0:

  m_identifier = 0

  m_offset = 10

  m_length = 355160

  m_flags = ROM_SECTION_BOOTABLE (0x1)

* calculated-mac = 5bfb4000c36534ce809ec68e0408d4e

dek dictionary entry #0:

  m_mac = 5bfb4000c36534ce809ec687e0408d4e

  m_dek = b91ce39a505bff1a2dee2f7e0ac7771f

* Key matched at #0

* session_key = 00000000000000000000000000000000

LOAD m_address=0x00000000 m_count=0x00002270

LOAD m_address=0x00008000 m_count=0x00000020

CALL m_address=0x00008000 m_data=0x00000000

LOAD m_address=0x40000100 m_count=0x00023950

LOAD m_address=0x42000000 m_count=0x00545910

LOAD m_address=0x00008000 m_count=0x00000020

CALL m_address=0x00008000 m_data=0x00000000

* read SHA1 = 052187aed4a5080756760c04cd5a8ed82a366f4a

* calc SHA1 = 052187aed4a5080756760c04cd5a8ed82a366f4a

/tmp/pn-switch-develop_V1.00.101.sb: is a valid bootstream for key '00000000000000000000000000000000'

mtd: opening: "/dev/mtd0"

mtd: '/dev/mtd0' bad block @ 0x1d80000 (MTD)

Cannot open NFC geometry node: "/sys/bus/platform/devices/gpmi-nfc.0/nfc_geometry", but we can calculate it ourselves.NFC geometry :

ECC Strength       : 8

Page Size in Bytes : 2112

Metadata size      : 10

ECC Chunk Size in byte : 512

ECC Chunk count        : 4

Block Mark Byte Offset : 1999

Block Mark Bit Offset  ===================================================

mtd: opened '/dev/mtd0' - '(null)'

mtd: max_boot_stream_size_in_bytes = 20447232

mtd: boot_stream_size_in_bytes = 5682752

mtd: boot_stream_size_in_pages = 2775

mtd: #1 0x00100000 - 0x01480000 (0x0066b640)

mtd: #2 0x01480000 - 0x02800000 (0x019eb640)

mtd: Bad blocks is 1

FCB

  m_u32Checksum = 0x00000000

  m_u32FingerPrint = 0x20424346

  m_u32Version = 0x01000000

  m_NANDTiming.m_u8DataSetup = 80

  m_NANDTiming.m_u8DataHold = 60

  m_NANDTiming.m_u8AddressSetup = 25

  m_NANDTiming.m_u8DSAMPLE_TIME = 6

  m_u32PageDataSize = 2048

  m_u32TotalPageSize = 2112

  m_u32SectorsPerBlock = 64

  m_u32NumberOfNANDs = 0

  m_u32TotalInternalDie = 0

  m_u32CellType = 0

  m_u32EccBlockNEccType = 4

  m_u32EccBlock0Size = 512

  m_u32EccBlockNSize = 512

  m_u32EccBlock0EccType = 4

  m_u32MetadataBytes = 10

  m_u32NumEccBlocksPerPage = 3

  m_u32EccBlockNEccLevelSDK = 0

  m_u32EccBlock0SizeSDK = 0

  m_u32EccBlockNSizeSDK = 0

  m_u32EccBlock0EccLevelSDK = 0

  m_u32NumEccBlocksPerPageSDK = 0

  m_u32MetadataBytesSDK = 0

  m_u32EraseThreshold = 0

  m_u32BootPatch = 0

  m_u32PatchSectors = 0

  m_u32Firmware1_startingPage = 512

  m_u32Firmware2_startingPage = 10496

  m_u32PagesInFirmware1 = 2775

  m_u32PagesInFirmware2 = 2775

  m_u32DBBTSearchAreaStartAddress = 0

  m_u32BadBlockMarkerByte = 1999

  m_u32BadBlockMarkerStartBit = 0

  m_u32BBMarkerPhysicalOffset = 2048

DBBT

  m_u32Checksum = 0x00000000

  m_u32FingerPrint = 0x5442444

  m_u32Version = 0x01000000

  m_u32NumberBB = 1

  m_u32Number2KPagesBB = 1

Firmware: image #0 @ 0x100000 size 0x56b800 - available 0x1380000

Firmware: image #1 @ 0x1480000 size 0x56b800 - available 0x1380000

NCB versions differ, 3 is used.

------- Start to write the [ FCB ] -----

mtd: erasing @0:0x0-0x20000

mtd: Writing FCB0 [ @0:0x0 ] (840) *

mtd: erasing @0:0x20000-0x40000

mtd: Writing FCB1 [ @0:0x20000 ] (840) *

mtd: erasing @0:0x40000-0x60000

mtd: Writing FCB2 [ @0:0x40000 ] (840) *

mtd: erasing @0:0x60000-0x80000

mtd: Writing FCB3 [ @0:0x60000 ] (840) *

mtd_commit_bcb(FCB): status 0

DBBT checksum length : 176

-------------- Start to write the DBBT ] -----

mtd: erasing @0:0x80000-0xa0000

mtd: Writing DBBT0 [ @0:0x80000 ] (800) *

mtd: erasing @0:0xa0000-0xc0000

mtd: Writing DBBT1 [ @0:0xa0000 ] (800) *

mtd: erasing @0:0xc0000-0xe0000

mtd: Writing DBBT2 [ @0:0xc0000 ] (800) *

mtd: erasing @0:0xe0000-0x100000

mtd: Writing DBBT3 [ @0:0xe0000 ] (800) *

mtd_commit_bcb(DBBT): status 0

mtd: DBBT search area 256

mtd: PUTTING down DBBT0 BBTN0 @0x82000 (0)

---------- Start to write the [ /tmp/pn-switch-develop_V1.00.101.sb ]----

mtd: Writting /tmp/pn-switch-develop_V1.00.101.sb: #0 @0: 0x00100000 - 0x0066b800

mtd: erasing @0:0x100000-0x120000

mtd: erasing @0:0x120000-0x140000

mtd: erasing @0:0x140000-0x160000

mtd: erasing @0:0x160000-0x180000

mtd: erasing @0:0x180000-0x1a0000

mtd: erasing @0:0x1a0000-0x1c0000

mtd: erasing @0:0x1c0000-0x1e0000

mtd: erasing @0:0x1e0000-0x200000

mtd: erasing @0:0x200000-0x220000

mtd: erasing @0:0x220000-0x240000

mtd: erasing @0:0x240000-0x260000

mtd: erasing @0:0x260000-0x280000

mtd: erasing @0:0x280000-0x2a0000

mtd: erasing @0:0x2a0000-0x2c0000

mtd: erasing @0:0x2c0000-0x2e0000

mtd: erasing @0:0x2e0000-0x300000

mtd: erasing @0:0x300000-0x320000

mtd: erasing @0:0x320000-0x340000

mtd: erasing @0:0x340000-0x360000

mtd: erasing @0:0x360000-0x380000

mtd: erasing @0:0x380000-0x3a0000

mtd: erasing @0:0x3a0000-0x3c0000

mtd: erasing @0:0x3c0000-0x3e0000

mtd: erasing @0:0x3e0000-0x400000

mtd: erasing @0:0x400000-0x420000

mtd: erasing @0:0x420000-0x440000

mtd: erasing @0:0x440000-0x460000

mtd: erasing @0:0x460000-0x480000

mtd: erasing @0:0x480000-0x4a0000

mtd: erasing @0:0x4a0000-0x4c0000

mtd: erasing @0:0x4c0000-0x4e0000

mtd: erasing @0:0x4e0000-0x500000

mtd: erasing @0:0x500000-0x520000

mtd: erasing @0:0x520000-0x540000

mtd: erasing @0:0x540000-0x560000

mtd: erasing @0:0x560000-0x580000

mtd: erasing @0:0x580000-0x5a0000

mtd: erasing @0:0x5a0000-0x5c0000

mtd: erasing @0:0x5c0000-0x5e0000

mtd: erasing @0:0x5e0000-0x600000

mtd: erasing @0:0x600000-0x620000

mtd: erasing @0:0x620000-0x640000

mtd: erasing @0:0x640000-0x660000

mtd: erasing @0:0x660000-0x680000

mtd: The last page is not full : 1600

mtd: We write one page for save guard. *

mtd: Writting /tmp/pn-switch-develop_V1.00.101.sb: #1 @0: 0x01480000 - 0x019eb800

mtd: erasing @0:0x1480000-0x14a0000

mtd: erasing @0:0x14a0000-0x14c0000

mtd: erasing @0:0x14c0000-0x14e0000

mtd: erasing @0:0x14e0000-0x1500000

mtd: erasing @0:0x1500000-0x1520000

mtd: erasing @0:0x1520000-0x1540000

mtd: erasing @0:0x1540000-0x1560000

mtd: erasing @0:0x1560000-0x1580000

mtd: erasing @0:0x1580000-0x15a0000

mtd: erasing @0:0x15a0000-0x15c0000

mtd: erasing @0:0x15c0000-0x15e0000

mtd: erasing @0:0x15e0000-0x1600000

mtd: erasing @0:0x1600000-0x1620000

mtd: erasing @0:0x1620000-0x1640000

mtd: erasing @0:0x1640000-0x1660000

mtd: erasing @0:0x1660000-0x1680000

HTLLCLL0x8050800f

According to this document​, ​error code 8050800f stands for "ECC failed - data is not valid".

I understand ECC (Error Correction Coding) can fail as a result of brownouts.

But I can not understand, why ECC failures prevent my device from booting from the NAND flash:

• 'kobs-ng init' writes the boot stream two times
• I pulled the power cable after the first boot stream has been sucessfully written

Why can't the iMX28 gracefully ignore the ECC failure and boot from the first boot stream?

Regards,

Andreas

[igorpadykov]

Hi Andreas

when procesor voltages fall below specified datasheet ranges,

it may operate unstable and unpredictably, possibly writing wrong data

on wrong nand addresses, so both nand boot streams could be damaged.

Best regards

igor