<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1255">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>Memory Corruption in Linux kernel MPC8347 revision 3</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P> <FONT SIZE=2>Hi Everyone.<BR>
I am working on the Linux port for MPC8347 revision 3 custom build board<BR>
with DDR2 memory.<BR>
<BR>
I've successfully ported U-boot (latest git) and the kernel itself,<BR>
however during kernel boot I am encountering serious memory corruption<BR>
errors. The log for one of the examples is at the bottom of this<BR>
message.<BR>
<BR>
Basically, the corruption is always happening somewhere at memory<BR>
management intensive tasks such as networking, JFFS2 mounting etc.<BR>
<BR>
As far as I can see, it is not related to some specific driver, because<BR>
even it happens even at kernel configured at absolute minimum, ( console<BR>
serial driver only and even without it)<BR>
The place of the corruption depends on kernel configuration.<BR>
<BR>
The DDR2 memory controller is configured correctly as far as I can tell,<BR>
since :<BR>
1. DDR2 controller register values are taken from VxWorks bootrom<BR>
that works on this board without any problems.<BR>
2. u-boot mtest passes successfully<BR>
3. u-boot alternative mtest passes successfully<BR>
4. My own custom mem tests in u-boot pass successfully<BR>
5. If I manage two boot the board into shell prompt (with absolute<BR>
minimum configuration) memtester application is also successful.<BR>
<BR>
The minimum configuration that is one I am able to boot into shell is a<BR>
kernel configured with serial console and small busybox JFFS2 file<BR>
system in the flash. In this configuration, the boot fails the first<BR>
time JFFS2 root FS is mounted. However it does boot after reset.<BR>
<BR>
I've tried different kernels with the same results starting from, I<BR>
think, 2.6.16 up to 2.6.22<BR>
I tried the kernel that is provided by Freescale for 834x reference<BR>
boards. ( with my board support of course)<BR>
<BR>
I tried booting both OF flat trees (powerpc) and bd_t based builds (ppc)<BR>
<BR>
I've also tried all memory management options :<BR>
SLAB, SLOB and SLUB (in the latest kernel). They all failed at some<BR>
point of time, so the assumption is that the problem is not in the<BR>
memory management facilities.<BR>
<BR>
The board manufacturer swears that DDR2 memory controller values are<BR>
correct and should work perfectly.<BR>
<BR>
So now I almost out of options and I am seeking your help.<BR>
Any type of input on this issue would be greatly appreciated.<BR>
<BR>
Thanks,<BR>
Boris<BR>
<BR>
PS. Note that an below example represents failure during DHCP<BR>
autoconfiguration. However the similar error happens even when<BR>
networking is disabled completely. just in a different place.<BR>
<BR>
=> bootm<BR>
## Booting image at 00400000 ...<BR>
Image Name: Linux-.6.21.5<BR>
Created: 2007-07-10 14:20:19 UTC<BR>
Image Type: PowerPC Linux Kernel Image (gzip compressed)<BR>
Data Size: 898361 Bytes = 877.3 kB<BR>
Load Address: 00000000<BR>
Entry Point: 00000000<BR>
Verifying Checksum ... OK<BR>
Uncompressing Kernel Image ... OK<BR>
## Current stack ends at 0x07FA3CF8 => set upper limit to 0x00800000<BR>
## cmdline at 0x007FFF00 ... 0x007FFF41<BR>
bd address = 0x07FA3FBC<BR>
memstart = 0x00000000<BR>
memsize = 0x08000000<BR>
flashstart = 0xFE000000<BR>
flashsize = 0x02000000<BR>
flashoffset = 0x00033000<BR>
sramstart = 0x00000000<BR>
sramsize = 0x00000000<BR>
bootflags = 0x00000001<BR>
intfreq = 528 MHz<BR>
busfreq = 264 MHz<BR>
ethaddr = 00:04:9F:EF:23:35<BR>
eth1addr = 00:E0:0C:00:7E:25<BR>
IP addr = 10.2.222.20<BR>
baudrate = 115200 bps<BR>
No initrd<BR>
## Transferring control to Linux (at address 00000000) ...<BR>
!!!! of_flat_tree = 00000000<BR>
Booting without OF Flat tree<BR>
Linux version .6.21.5 (me@localhost) (gcc version<BR>
4.0.0 (DENX ELDK 4.1 4.0.0)) #24 Tue Jul 10 17:20:09 IDT 2007<BR>
Zone PFN ranges:<BR>
DMA 0 -> 32768<BR>
Normal 32768 -> 32768<BR>
early_node_map[1] active PFN ranges<BR>
0: 0 -> 32768<BR>
Built 1 zonelists. Total pages: 32512<BR>
Kernel command line: console=ttyS0,115200 root=/dev/mtdblock1<BR>
rootfstype=jffs2 ip=dhcp<BR>
IPIC (128 IRQ sources, 8 External IRQs) at fe000700<BR>
PID hash table entries: 512 (order: 9, 2048 bytes)<BR>
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)<BR>
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)<BR>
Memory: 127744k available (1584k kernel code, 444k data, 84k init, 0k<BR>
highmem)<BR>
Mount-cache hash table entries: 512<BR>
NET: Registered protocol family 16<BR>
Setup MTD partitions<BR>
Generic PHY: Registered new driver<BR>
NET: Registered protocol family 2<BR>
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)<BR>
TCP established hash table entries: 4096 (order: 3, 32768 bytes)<BR>
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)<BR>
TCP: Hash tables configured (established 4096 bind 4096)<BR>
TCP reno registered<BR>
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.<BR>
io scheduler noop registered<BR>
io scheduler anticipatory registered (default)<BR>
io scheduler deadline registered<BR>
io scheduler cfq registered<BR>
Serial: 8250/16550 driver $Revision: 1.90 $ 2 ports, IRQ sharing<BR>
disabled<BR>
serial8250.0: ttyS0 at MMIO 0xe0004500 (irq = 9) is a 16550A<BR>
serial8250.0: ttyS1 at MMIO 0xe0004600 (irq = 10) is a 16550A<BR>
Gianfar MII Bus: probed<BR>
eth0: Gianfar Ethernet Controller Version 1.2, 00:04:9f:ef:23:35<BR>
eth0: Running with NAPI disabled<BR>
eth0: 64/64 RX/TX BD ring size<BR>
Broadcom BCM5241: Registered new driver<BR>
physmap platform flash device: 02000000 at fe000000<BR>
physmap-flash.0: Found 1 x16 devices at 0x0 in 8-bit bank<BR>
Amd/Fujitsu Extended Query Table at 0x0040<BR>
physmap-flash.0: CFI does not contain boot bank location. Assuming top.<BR>
number of CFI chips: 1<BR>
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.<BR>
cmdlinepart partition parsing not available<BR>
RedBoot partition parsing not available<BR>
Using physmap partition information<BR>
Creating 2 MTD partitions on "physmap-flash.0":<BR>
0x00000000-0x00100000 : "uboot"<BR>
0x00100000-0x02000000 : "rootfs"<BR>
IPv4 over IPv4 tunneling driver<BR>
GRE over IPv4 tunneling driver<BR>
TCP cubic registered<BR>
NET: Registered protocol family 1<BR>
NET: Registered protocol family 17<BR>
!!!! Gianfar init_phy. phy_id = 0:01<BR>
!!!! phy_attach. phy_id = 0:01<BR>
!!!! phy_attach device found. phy_id = 0:01<BR>
Sending DHCP requests .<3>slab: Internal list corruption detected in<BR>
cache 'files_cache'(21), slabp c0344000(16). Hexdump:<BR>
<BR>
000: 00 10 01 00 00 20 02 00 00 00 00 70 c0 34 40 70<BR>
010: 00 00 00 10 00 00 ff 10 00 00 00 00 ff ff ff fe<BR>
020: ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe<BR>
030: ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe<BR>
040: ff ff ff fe ff ff ff fe ff ff ff fe ff ff ff fe<BR>
050: ff ff ff fe ff ff ff fe ff ff ff fd 00 00 00 11<BR>
060: 00 00 00 12 00 00 00 13 00 00 00 14 ff ff ff ff<BR>
------------[ cut here ]------------<BR>
kernel BUG at mm/slab.c:2936!<BR>
Oops: Exception in kernel mode, sig: 5 [#1]<BR>
NIP: C0050F80 LR: C0050F80 CTR: 00000000<BR>
REGS: c034fe00 TRAP: 0700 Not tainted (.6.21.5)<BR>
MSR: 00021032 <ME,IR,DR> CR: 24004002 XER: 00000000<BR>
TASK = c032a3c0[3] 'events/0' THREAD: c034e000<BR>
GPR00: C0050F80 C034FEB0 C032A3C0 00000001 00000DF5 FFFFFFFF C00F5B54<BR>
00000010<BR>
GPR08: C01D0000 C01E0000 00000DF5 00000DF5 00000000 00F1C5DB 07FFD000<BR>
FFFFFFFF<BR>
GPR16: 00000001 00000000 00000000 00800000 00000000 007FFF00 00000000<BR>
C033DAA0<BR>
GPR24: C0339C90 00000007 00000000 C01B0000 C01B0000 C0344000 C033DAA0<BR>
00000070<BR>
NIP [C0050F80] check_slabp+0xe4/0x11c<BR>
LR [C0050F80] check_slabp+0xe4/0x11c<BR>
Call Trace:<BR>
[C034FEB0] [C0050F80] check_slabp+0xe4/0x11c (unreliable)<BR>
[C034FED0] [C0051450] free_block+0x88/0x138<BR>
[C034FF00] [C0052188] drain_array+0xa0/0xe0<BR>
[C034FF20] [C0052228] cache_reap+0x60/0x144<BR>
[C034FF40] [C00257B0] run_workqueue+0xd0/0x170<BR>
[C034FF60] [C0025960] worker_thread+0x110/0x144<BR>
[C034FFC0] [C00298E4] kthread+0x74/0xb0<BR>
[C034FFF0] [C0005F38] kernel_thread+0x44/0x60<BR>
Instruction dump:<BR>
387b6538 7c9df8ae 4bfc2b49 3bff0001 813e0020 5529103a 3929001c 7f9f4840<BR>
419cffcc 3c60c01b 3863336c 4bfc2b25 <0fe00000> 48000000 80030020<BR>
2f800000<BR>
</FONT>
</P>
</BODY>
</HTML>