iMX6ULL - 4k NAND flash boot issue

arekkaras · ‎03-03-2018

Hello,

I have a board based on imx6ULL processor which boots from NAND flash.

Up to now I was using 1G NAND flash and everything is working fine with this memory.

Recently, I have changed memory to 4G device (Micron MT29F4G08ABAEAWP) - and with this memory I am not able to boot.

I can flash it properly with kobs-ng if I load u-boot via USB.

Here is flashing log:

kobs-ng init -x u-boot.imx.nand --search_exponent=1 -v
MTD CONFIG:
chip_0_device_path = "/dev/mtd0"
chip_1_device_path = "(null)"
search_exponent = 1
data_setup_time = 80
data_hold_time = 60
address_setup_time = 25
data_sample_time = 6
row_address_size = 3
column_address_size = 2
read_command_code1 = 0
read_command_code2 = 48
boot_stream_major_version = 1
boot_stream_minor_version = 0
boot_stream_sub_version = 0
ncb_version = 3
boot_stream_1_address = 0
boot_stream_2_address = 0
         -- We add the 1k-padding to the uboot.
.tmp_kobs_ng: verifying using key '00000000000000000000000000000000'
.tmp_kobs_ng: is a valid bootstream for key '00000000000000000000000000000000'
mtd: Linux 4.1
mtd: use new bch layout raw access mode
mtd: opening: "/dev/mtd0"
Cannot open BCH geometry node: "/sys/kernel/debug/gpmi-nand/bch_geometry"
NFC geometry :
        ECC Strength       : 16
        Page Size in Bytes : 4320
        Metadata size      : 10
        ECC Chunk Size in byte : 512
        ECC Chunk count        : 8
        Block Mark Byte Offset : 3904
        Block Mark Bit Offset : 0
====================================================
mtd: opened '/dev/mtd0' - '(null)'
mtd: max_boot_stream_size_in_bytes = 1572864
mtd: boot_stream_size_in_bytes = 528384
mtd: boot_stream_size_in_pages = 129
mtd: #1 0x00100000 - 0x00280000 (0x00181000)
mtd: #2 0x00280000 - 0x00400000 (0x00301000)
FCB
m_u32Checksum = 0x00000000
m_u32FingerPrint = 0x20424346
m_u32Version = 0x01000000
m_NANDTiming.m_u8DataSetup = 80
m_NANDTiming.m_u8DataHold = 60
m_NANDTiming.m_u8AddressSetup = 25
m_NANDTiming.m_u8DSAMPLE_TIME = 6
m_u32PageDataSize = 4096
m_u32TotalPageSize = 4320
m_u32SectorsPerBlock = 64
m_u32NumberOfNANDs = 0
m_u32TotalInternalDie = 0
m_u32CellType = 0
m_u32EccBlockNEccType = 8
m_u32EccBlock0Size = 512
m_u32EccBlockNSize = 512
m_u32EccBlock0EccType = 8
m_u32MetadataBytes = 10
m_u32NumEccBlocksPerPage = 7
m_u32EccBlockNEccLevelSDK = 0
m_u32EccBlock0SizeSDK = 0
m_u32EccBlockNSizeSDK = 0
m_u32EccBlock0EccLevelSDK = 0
m_u32NumEccBlocksPerPageSDK = 0
m_u32MetadataBytesSDK = 0
m_u32EraseThreshold = 0
m_u32Firmware1_startingPage = 256
m_u32Firmware2_startingPage = 640
m_u32PagesInFirmware1 = 129
m_u32PagesInFirmware2 = 129
m_u32DBBTSearchAreaStartAddress = 128
m_u32BadBlockMarkerByte = 3904
m_u32BadBlockMarkerStartBit = 0
m_u32BBMarkerPhysicalOffset = 4096
m_u32BCHType = 0
m_NANDTMTiming.m_u32TMTiming2_ReadLatency = 0
m_NANDTMTiming.m_u32TMTiming2_PreambleDelay = 0
m_NANDTMTiming.m_u32TMTiming2_CEDelay = 0
m_NANDTMTiming.m_u32TMTiming2_PostambleDelay = 0
m_NANDTMTiming.m_u32TMTiming2_CmdAddPause = 0
m_NANDTMTiming.m_u32TMTiming2_DataPause = 0
m_NANDTMTiming.m_u32TMSpeed = 0
m_NANDTMTiming.m_u32TMTiming1_BusyTimeout = 0
m_u32DISBBM = 0
m_u32BBMarkerPhysicalOffsetInSpareData = 0
m_u32OnfiSyncEnable = 0
m_NANDONFITiming.m_u32ONFISpeed = 0
m_NANDONFITiming.m_u32ONFITiming_ReadLatency = 0
m_NANDONFITiming.m_u32ONFITiming_CEDelay = 0
m_NANDONFITiming.m_u32ONFITiming_PreambleDelay = 0
m_NANDONFITiming.m_u32ONFITiming_PostambleDelay = 0
m_NANDONFITiming.m_u32ONFITiming_CmdAddPause = 0
m_NANDONFITiming.m_u32ONFITiming_DataPause = 0
m_NANDONFITiming.m_u32ONFITiming_BusyTimeout = 0
m_u32DISBBSearch = 0
m_u32RandomizerEnable = 0
m_u32ReadRetryEnable = 0
m_u32ReadRetrySeqLength = 0
DBBT
m_u32Checksum = 0x00000000
m_u32FingerPrint = 0x54424244
m_u32Version = 0x01000000
m_u32DBBTNumOfPages = 0
Firmware: image #0 @ 0x100000 size 0x81000 - available 0x180000
Firmware: image #1 @ 0x280000 size 0x81000 - available 0x180000
-------------- Start to write the [ FCB ] -----
mtd: erasing @0:0x0-0x40000
mtd: Writing FCB0 [ @0:0x0 ] (10e0) *
mtd: erasing @0:0x40000-0x80000
mtd: Writing FCB1 [ @0:0x40000 ] (10e0) *
mtd_commit_bcb(FCB): status 0
-------------- Start to write the [ DBBT ] -----
mtd: erasing @0:0x80000-0xc0000
mtd: Writing DBBT0 [ @0:0x80000 ] (1000) *
mtd: erasing @0:0xc0000-0x100000
mtd: Writing DBBT1 [ @0:0xc0000 ] (1000) *
mtd_commit_bcb(DBBT): status 0
---------- Start to write the [ .tmp_kobs_ng ]----
mtd: Writting .tmp_kobs_ng: #0 @0: 0x00100000 - 0x00181000
mtd: erasing @0:0x100000-0x140000
mtd: erasing @0:0x140000-0x180000
mtd: erasing @0:0x180000-0x1c0000
mtd: We write one page for save guard. *
mtd: Writting .tmp_kobs_ng: #1 @0: 0x00280000 - 0x00301000
mtd: erasing @0:0x280000-0x2c0000
mtd: erasing @0:0x2c0000-0x300000
mtd: erasing @0:0x300000-0x340000
mtd: We write one page for save guard. *

I have followed description found in topics i.MX6Q NAND boot issues and NAND BOOT fail on iMX6UL but still no success.

Here is boot room log buffer content:

J-Link>mem32 0x000001e0 1
Memory access: CPU temp. halted: https://wiki.segger.com/Memory_accesses#Legacy_stop_mode
000001E0 = 00901CF4
J-Link>mem8 0x00901CF4 0x100
00901CF4 = 02 00 01 00 F0 00 02 00 00 00 03 00 00 00 04 00
00901D04 = 00 00 05 00 00 00 06 00 00 00 07 00 F0 00 07 00
00901D14 = 00 00 08 00 00 01 00 00 33 00 08 00 01 00 05 00
00901D24 = 00 00 06 00 00 00 07 00 F0 00 07 00 00 00 08 00
00901D34 = 80 02 00 00 33 00 08 00 FF 1F 06 00 01 20 06 00
00901D44 = 00 00 07 00 33 00 07 00 00 00 0C 00 00 00 00 00
00901D54 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D64 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D74 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D84 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901D94 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DA4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DB4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DC4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DD4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00901DE4 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

And boot memory content:

mem8 0x907400 0x100
00907400 = 00 00 00 00 00 00 00 F0 7F 87 00 10 08 00 00 00
00907410 = 00 00 D2 01 E8 40 CC 01 E4 04 02 0C 40 68 FF FF
00907420 = FF FF 02 0C 40 6C FF FF FF FF 02 0C 40 70 FF FF
00907430 = FF FF 02 0C 40 74 FF FF FF FF 02 0C 40 78 FF FF
00907440 = FF FF 02 0C 40 7C FF FF FF FF 02 0C 40 80 FF FF
00907450 = FF FF 02 0E 04 B4 00 0C 00 00 02 0E 04 AC 00 00
00907460 = 00 00 02 0E 02 7C 00 00 00 30 02 0E 02 50 00 00
00907470 = 00 30 02 0E 02 4C 00 00 00 30 02 0E 04 90 00 00
00907480 = 00 30 02 0E 02 88 00 00 00 30 02 0E 02 70 00 00
00907490 = 00 00 02 0E 02 60 00 00 00 30 02 0E 02 64 00 00
009074A0 = 00 30 02 0E 04 A0 00 00 00 30 02 0E 04 94 00 02
009074B0 = 00 00 02 0E 02 80 00 00 00 30 02 0E 02 84 00 00
009074C0 = 00 30 02 0E 04 B0 00 02 00 00 02 0E 04 98 00 00
009074D0 = 00 30 02 0E 04 A4 00 00 00 30 02 0E 02 44 00 00
009074E0 = 00 30 02 0E 02 48 00 00 00 30 02 1B 00 1C 00 00
009074F0 = 80 00 02 1B 08 00 A1 39 00 03 02 1B 08 0C 00 00

Attached are files with NAND dumps from page 0 and page 128 (first u-boot page).

WHat I have found is that this NAND memory has non-standard OOB area size - 224 bytes.

Could this be an issue for boot rom ?

Regards

Arek Karaś

arekkaras · ‎03-06-2018

Finally, I have managed this.

What I found is that kobs-ng incorrectly programs FCB block when debugfs is not mounted on Linux.

It seams that kobs-ng is using debugfs to obtain NAND flash geometry, but if it can not find debugfs entry it puts just warning and tries different method for obtaining NAND/BCH parameters.

Interesting thing is that for this particular NAND flash chip geometry obtained from debugfs differs from one obtained in different way (mtd query ?)

Here is difference:

IMHO, kobs-ng should refuse to write ANND flash if it can not find debugfs entry, or at least warn that this could lead to boot issues.

Regards

Arek

igorpadykov · ‎03-04-2018

Hi Arkadiusz

in general 224 bytes nand should work, one can try to program

image with mfg tools from below link, preferably using latest bsps

https://www.nxp.com/support/developer-resources/run-time-software/i.mx-developer-resources/i.mx-6ser...

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

arekkaras · ‎03-05-2018

Hi Igor,

I did some log buffer analysis, based on this https://community.nxp.com/servlet/JiveServlet/download/880961-1-400476/MX6%20boot%20%20log_buffer.pd... document:

00901CF4 = 00010002       ROM_LOG_BOOTMODE_INTERNAL
           000200F0       ROM_LOG_SEC_CONFIG_OPEN
           00030000       ROM_LOG_DIR_BT_DIS_VALUE0
           00040000    ROM_LOG_BT_FUSE_SEL_VALUE0
           00050000       ROM_LOG_PRIM_IMAGE_SELECT
           00060000       ROM_LOG_PRIM_BOOTDEVICE_NAND
           00070000       ROM_LOG_DEVICE_INIT_CALL
           000700F0        ROM_LOG_DEVICE_INIT_PASS
           00080000       ROM_LOG_DEVICE_READ_DATA_CALL
           00000100       -> page number pointing to firmware 1 starting page
           00080033       ROM_LOG_DEVICE_READ_DATA_FAIL
           00050001    ROM_LOG_SEC_IMAGE_SELECT
           00060000       ROM_LOG_PRIM_BOOTDEVICE_NAND
           00070000       ROM_LOG_DEVICE_INIT_CALL
           000700F0       ROM_LOG_DEVICE_INIT_PASS
           00080000        ROM_LOG_DEVICE_READ_DATA_CALL
           00000280       -> page number pointing to firmware 2 starting page
           00080033       ROM_LOG_DEVICE_READ_DATA_FAIL
           00061FFF       ROM_LOG_REC_BOOTDEVICE_NONE
           00062001    ?????
           00070000       ROM_LOG_DEVICE_INIT_CALL
           00070033       ROM_LOG_DEVICE_INIT_FAIL
           000C0000       ROM_LOG_SDP_ENTRY
           00000000

Could please have a look on it ?

What means" ROM_LOG_DEVICE_READ_DATA_FAIL" ? Is reading of DCD data block from image ?

I have found also something strange in boot data buffer, at memory address 0x907400:

00907400 = 00 00 00 00 00 00 00 F0 7F 87 00 10 08 00 00 00
00907410 = 00 00 D2 01 E8 40 CC 01 E4 04 02 0C 40 68 FF FF
00907420 = FF FF 02 0C 40 6C FF FF FF FF 02 0C 40 70 FF FF
00907430 = FF FF 02 0C 40 74 FF FF FF FF 02 0C 40 78 FF FF
00907440 = FF FF 02 0C 40 7C FF FF FF FF 02 0C 40 80 FF FF
00907450 = FF FF 02 0E 04 B4 00 0C 00 00 02 0E 04 AC 00 00
00907460 = 00 00 02 0E 02 7C 00 00 00 30 02 0E 02 50 00 00
00907470 = 00 30 02 0E 02 4C 00 00 00 30 02 0E 04 90 00 00
00907480 = 00 30 02 0E 02 88 00 00 00 30 02 0E 02 70 00 00
00907490 = 00 00 02 0E 02 60 00 00 00 30 02 0E 02 64 00 00
009074A0 = 00 30 02 0E 04 A0 00 00 00 30 02 0E 04 94 00 02
009074B0 = 00 00 02 0E 02 80 00 00 00 30 02 0E 02 84 00 00
009074C0 = 00 30 02 0E 04 B0 00 02 00 00 02 0E 04 98 00 00
009074D0 = 00 30 02 0E 04 A4 00 00 00 30 02 0E 02 44 00 00
009074E0 = 00 30 02 0E 02 48 00 00 00 30 02 1B 00 1C 00 00
009074F0 = 80 00 02 1B 08 00 A1 39 00 03 02 1B 08 0C 00 00
00907500 = 00 00 02 1B 08 3C 41 57 01 55 02 1B 08 48 40 40
00907510 = 47 4A 02 1B 08 50 40 40 55 50 02 1B 08 1C 33 33
00907520 = 33 33 02 1B 08 20 33 33 33 33 02 1B 08 2C F3 33
00907530 = 33 33 02 1B 08 30 F3 33 33 33 02 1B 08 C0 00 92
00907540 = 10 12 02 1B 08 B8 00 00 08 00 02 1B 00 04 00 02
00907550 = 00 2D 02 1B 00 08 1B 33 30 30 02 1B 00 0C 67 6B
00907560 = 52 F3 02 1B 00 10 B6 6D 0B 63 02 1B 00 14 01 FF
00907570 = 00 DB 02 1B 00 18 00 20 17 40 02 1B 00 1C 00 00
00907580 = 80 00 02 1B 00 2C 00 00 26 D2 02 1B 00 30 00 6B
00907590 = 10 23 02 1B 00 40 00 00 00 4F 02 1B 00 00 84 18
009075A0 = 00 00 02 1B 08 90 23 40 0A 38 02 1B 00 1C 02 00
009075B0 = 80 32 02 1B 00 1C 00 00 80 33 02 1B 00 1C 00 04
009075C0 = 80 31 02 1B 00 1C 15 20 80 30 02 1B 00 1C 04 00
009075D0 = 80 40 02 1B 00 20 00 00 08 00 02 1B 08 18 00 00
009075E0 = 02 27 02 1B 00 04 D2 70 9A 92 71 26 94 27 06 47
009075F0 = B3 64 9D 00 02 55 2D 02 1B 04 04 00 01 10 06 02
00907600 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907610 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907620 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907630 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907640 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907650 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907660 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907670 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907680 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907690 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076A0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076B0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076C0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076D0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076E0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009076F0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907700 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907710 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907720 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907730 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907740 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907750 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907760 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907770 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907780 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00907790 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077A0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077B0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077C0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
009077D0 = 00 00 00 00 00 00 00 00 00 A2 22 E1 6A 2C D6 E2
009077E0 = F9 29 17 83 26 23 00 00 00 00 00 00 08 00 00 00
009077F0 = 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

If Iassume correctly, this is raw data read from NAND flash ? If so, in bold I marked ECC blocks. However, after first marked ECC data, real data seams to be corrupted or missing. Raw content of NAND flash in this area is:

        02 1b 00 04 d2 70 9a 92 71 26 94 27 06 47 b3 64
        9d 00 02 55 2d 02 1b 04 04 00 01 10 06 02 1b 00
        1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

As you can see, bytes with underscore are missing in data buffer - so ECC validation will fail and this wille result in boot error! I am right in my assumptions ? Do you have any idea why boot may read incorrect data from NAND ?

I did several tests with u-boot and Linux and didn't found any issue with this NAND flash.

Regards

Arek

arekkaras · ‎03-05-2018

One more thing - after stopping processor with JATG, i dumped als oBCH module registers:

mem32 0x1808000 0x5f
01808000 = 00000000 00000000 00000000 00000000
01808010 = 0000FE04 0000FE04 0000FE04 0000FE04
01808020 = 00000000 00000000 00000000 00000000
01808030 = 00000000 00000000 00000000 00000000
01808040 = 00000000 00000000 00000000 00000000
01808050 = 00000000 00000000 00000000 00000000
01808060 = 00000000 00000000 00000000 00000000
01808070 = E4E4E4E4 E4E4E4E4 E4E4E4E4 E4E4E4E4
01808080 = 070A4080 070A4080 070A4080 070A4080
01808090 = 10DA4080 10DA4080 10DA4080 10DA4080
018080A0 = 070A4080 070A4080 070A4080 070A4080
018080B0 = 10DA4080 10DA4080 10DA4080 10DA4080
018080C0 = 070A4080 070A4080 070A4080 070A4080
018080D0 = 10DA4080 10DA4080 10DA4080 10DA4080
018080E0 = 070A4080 070A4080 070A4080 070A4080
018080F0 = 10DA4080 10DA4080 10DA4080 10DA4080
01808100 = 00000000 00000000 00000000 00000000
01808110 = 00000000 00000000 00000000 00000000
01808120 = 00000000 00000000 00000000 00000000
01808130 = 00000000 00000000 00000000 00000000
01808140 = 00000000 00000000 00000000 00000000
01808150 = 20484342 20484342 20484342 20484342
01808160 = 01000000 01000000 01000000 01000000
01808170 = 00000000 00000000 00000000

As you can see, BCH module reports uncorrectable error.

igorpadykov · ‎03-05-2018

Hi Arkadiusz

reason may be that image is written incorrectly with wrong ecc

settings. Please try with mfg tool, check that this nand is present

in linux/..mtd/nand/nand_ids.c, if not - add additional record for that particular

nand. If necessary, rebuild mfg tools firmware (files in mfg tool ../firmware folder)

using sect.6.2 Manufacturing Tool, MFGTool Yocto Guide included in

https://www.nxp.com/webapp/Download?colCode=L4.1.15_2.0.0-LINUX-DOCS

Best regards
igor

arekkaras · ‎03-05-2018

Hi Igor,

thank you for your suggestion.

I will try to flash with MFG tool and test.

But, could you please in meantime have a look on bot rom log buffer content

and try to obtain why processor stays in serial download mode ?

Regards

Arek

2018-03-05 6:07 GMT+01:00 igorpadykov <admin@community.nxp.com>:

NXP Community
<https://community.freescale.com/resources/statics/1000/35400-NXP-Community-Email-banner-600x75.jpg>
Re: iMX6ULL - 4k NAND flash boot issue
reply from igorpadykov
<https://community.nxp.com/people/igorpadykov?et=watches.email.thread> in *i.MX
Community* - View the full discussion
<https://community.nxp.com/message/992074?commentID=992074&et=watches.email.thread#comment-992074>

iMX6ULL - 4k NAND flash boot issue

iMX6ULL - 4k NAND flash boot issue

i.MX6UL

Linux