Re: [BUG] UBIFS corruption on powerpc 32-bit targets

[Zhihao Cheng <chengzhihao1@huawei.com>]

在 2026/2/3 17:12, Tomas Alvarez Vanoli 写道:
>> Hi,
>> What is the type of volume ubi1:0, ro or rw?
> 
> root@kmcent2:~# ubinfo -d 1 -N cfg
> Volume ID:   0 (on ubi1)
> Type:        dynamic
> Alignment:   1
> Size:        1058 LEBs (134340608 bytes, 128.1 MiB)
> State:       OK
> Name:        cfg
> Character device major/minor: 246:1
> 
>> You could dump the mtd image for 'ubi1' by the command 'dd if=/dev/mtd10
>> of=mtd_image bs=1M', and send the file 'mtd_image' to us by email, maybe
>> we could get more information from the image.
> 
> I started some consultation with the cybersecurity department. Unfortunately,
> the nand image contains our full application software and third parties'
> proprietary software so it might not be possible.
> 
> Are there any analysis tools you'd recommend looking into?

Try 'fsck.ubifs -g3 -y /dev/ubi0_1'.
Attention, fsck will change the ubifs image content, you could dump the 
mtd image to another device(or virtual machine) and run fsck on it.
https://www.linux-mtd.infradead.org/?p=mtd-utils.git;a=summary

> 
>> BTW, are there any abnormal history logs about ubi1 before the error message?
> 
> Not really, in the application where the error happens, with kernel 6.12,
> everything looks good until the panic happens.
> 
> We also have "known-good stable application" that boots when no other
> application exists (here I refer to kernel + rootfs as application), which
> runs kernel 4.14.20 and there I see this (before 6.12.x has ever ran on the
> board):
> 
> UBIFS: parse sync
> UBIFS (ubi1:0): background thread "ubifs_bgt1_0" started, PID 106
> UBIFS (ubi1:0): recovery needed
> UBIFS (ubi1:0): recovery completed
> UBIFS (ubi1:0): UBIFS: mounted UBI device 1, volume 0, name "cfg"
> UBIFS (ubi1:0): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes:
> 2048 bytes/2048 bytes
> UBIFS (ubi1:0): FS size: 132943872 bytes (126 MiB, 1047 LEBs), journal size
> 6602752 bytes (6 MiB, 52 LEBs)
> UBIFS (ubi1:0): reserved for root: 4952683 bytes (4836 KiB)
> UBIFS (ubi1:0): media format: w5/r0 (latest is w5/r0), UUID
> DC7EC969-1F4D-4669-9D31-16C57EAB96DA, small LPT model
> 
> The part where it says recovery needed/completed looks strange but it does not
> complain about any errors anyway.

The 'recovery' message means that ubifs has experienced an unclean 
reboot. It is a normal message.
> 
>> Try following commands?
>> nanddump -n -o -f flash_image /dev/mtdX
>> nandwrite -o -n /dev/mtdY flash_image
> 

nanddump -o (-n) -f flash_image /dev/mtdX
flash_eraseall /dev/mtd0
nandwrite -o (-n) /dev/mtdY flash_image
or
dd of=flash_image if=/dev/mtdX bs=1M
flash_eraseall /dev/mtdY
dd if=flash_image of=/dev/mtdY bs=1M

> This results in a flooding of ECC errors like this one:
> ubi1 error: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB
> 29:0, read 64 bytes
> 
> I have to erase the nand from u-boot to recover it.
> NAND chips on both boards are the same, from boot logs:
> nand: device found, Manufacturer ID: 0x01, Chip ID: 0xac
> nand: AMD/Spansion S34MS04G2
> nand: 512 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
> Bad block table found at page 262080, version 0x01
> Bad block table found at page 262016, version 0x01
> 
> Best regards,
> Tomas Alvarez Vanoli
> 


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/