wandering1/STM32F4-Base
1
0
Fork 0
Code Issues 30 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

fix(nand-ftl): 传输失败不再误标坏块 + format 不再被脏缓存挡死（#79）
CI / 静态门禁 (pre-commit) (push) Failing after 42s
Details
CI / 主机侧单测 (MSVC) (push) Failing after 43s
Details
CI / 静态门禁 (pre-commit) (pull_request) Failing after 45s
Details
CI / 主机侧单测 (MSVC) (pull_request) Failing after 45s
Details

Browse Source 
根因（真机定案，问题 #79）：旧 dhara_nand_erase/prog() 把一切失败一律
mark_bad，而 mark_block_bad 每次**立即持久化**板级 BBT（不可撤销）——
一次传输层/等忙抖动就把好块永久记成坏块。台架 129 个好块（1016–1142
连续段）被固化，journal prepare_head() 连续 8 次撞 is_bad → TOO_BAD →
Cache flush FAIL → reformat 又被同一页挡住 → 整卷禁用、重启不恢复。

- 修复①：只有芯片明确回 E_FAIL/P_FAIL（状态位证据）才标坏；
  传输/超时失败只报 DHARA_E_BAD_BLOCK 让 dhara 重试，不标坏
- 修复②：nand_ftl_format() 尽力刷一次脏缓存，失败即丢弃并继续
  dhara_map_clear()（格式化语义本就是销毁映射；旧实现第一步返回，
  恢复动作在同一页死锁，f_mkfs 全在旧映射上必失败）
- C4 还债：新增跨调用失败类快照 nand_ftl_fault_get/clear（20 B，
  resume/读/刷/同步四点位记账）；defaultTask 探针按类分流，
  BSP_ERR_NO_SPACE 跳过重格式化（容量问题不该用 mkfs 解）
- 哨兵与诊断：init 解锁块保护（A0h）后补回读校验（与 B0h ECC 同族
  缺口，实测本板 A0h=0，非本次根因，留作哨兵）；gd5f_bbt_load()
  合并后坏块数 > 出厂扫描时打「BBT after merge」，现场可区分
  真坏与误标固化
- 测试：主机单测 149→178 全绿；新增 format 死锁（TC-NANDPORT-800..
  813b）、传输失败不标坏（207 语义翻转 + 208/505）；牙齿检查过——
  把修复回退即见红
- 真机：恢复动作 A 重建 BBT 清除已固化误标（3/3 PASSED，BBT
  version=71）；产品镜像复烧 [FS] FATFS mounted、配置出厂模板
  落盘、0 条 flush FAIL——#79 真机闭环（旧卷内容随 map clear
  作废，台架卷为可弃数据）
- 文档：存储架构说明 §10.4 口径修正 + 新增 §10.4.1/§10.4.2（页级
  失败升级链与误标持久化机理），存储维护与容量恢复 §2 补板级 BBT
  独立持久化注记 + §2.1（动作 A 此前静默失效），登记簿 C4 销项
- Keil 0 错 0 警（Code=255552，与烧录验证镜像一致）；doc-links 213
  文档通过
This commit is contained in:
super_agent_bot
2026-11-04 18:16:36 +08:00
parent 2b848c4a0b
commit 0d21d9bf04
11 changed files with 665 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/host/nand_port/nand_port_test.c
+220 -8
View File
@@ -109,6 +109,12 @@ static int s_fail_check_ecc;
static int s_fail_program_load;
static int s_fail_program_exec;
static int s_fail_block_erase;
/* 定向坏页注入（问题 #79）：非 0 时，**只有**该物理页的 program_exec 失败 */
static uint32_t s_fail_program_page = 0u;
/* 传输层失败注入（问题 #79）：非 0 时 erase / program_exec 返回传输/超时错误
* （GD5F_ERROR，芯片**没有**回 E_FAIL/P_FAIL），用于验证"不得标坏块"。 */
static int s_fail_erase_transport;
static int s_fail_exec_transport;
/* ---- SPI 原语（stub/gd5f2gq5ue.h 声明，签名与真实驱动逐字一致） ---- */
@@ -190,6 +196,15 @@ int32_t gd5f_program_exec(uint32_t page_addr) {
if (s_fail_program_exec != 0) {
return GD5F_PROGRAM_FAIL;
}
if (s_fail_exec_transport != 0) {
return GD5F_ERROR; /* 传输/等忙失败：芯片没回 P_FAIL */
}
/* 定向坏页注入（问题 #79）：现场是**某一个 PPA 恒写不进去**，其余页正常。
* 全局 s_fail_program_exec 无法复现"只有那一页坏"的形态——它连格式化
* 之后的新写入也一起打死，反而测不出"换个页就能写"这个关键结论。 */
if ((s_fail_program_page != 0u) && (page_addr == s_fail_program_page)) {
return GD5F_PROGRAM_FAIL;
}
/* 严格语义探针：目标页已有非 0xFF 字节 = 双编程（is_free 误判的现场证据） */
for (i = 0; i < FAKE_PAGE_SIZE; i++) {
@@ -217,6 +232,9 @@ int32_t gd5f_block_erase(uint32_t block_addr) {
if (s_fail_block_erase != 0) {
return GD5F_ERASE_FAIL;
}
if (s_fail_erase_transport != 0) {
return GD5F_ERROR; /* 传输/等忙失败：芯片没回 E_FAIL */
}
(void)memset(&s_chip[block_addr * FAKE_PAGES_PER_BLOCK][0], 0xFF,
(size_t)FAKE_PAGES_PER_BLOCK * FAKE_PAGE_SIZE);
return GD5F_OK;
@@ -282,6 +300,9 @@ static void fake_chip_reset(void) {
s_fail_program_load = 0;
s_fail_program_exec = 0;
s_fail_block_erase = 0;
s_fail_program_page = 0u; /* 定向坏页注入复位（0 = 不注入，0 号页本身也不允许当靶） */
s_fail_erase_transport = 0;
s_fail_exec_transport = 0;
g_nandtest_err_count = 0;
g_nandtest_info_count = 0;
g_nandtest_debug_count = 0;
@@ -659,9 +680,10 @@ static void tc_prog(void) {
CHECK(g_fake_mark_bad_cnt == 1u, "program failure marks exactly one block bad");
CHECK(g_fake_mark_bad_log[0] == 2u, "the block marked bad is the page's own block");
/* TC-NANDPORT-207：program_load 失败（装载阶段）-> 同样 BAD_BLOCK + 标坏该块，
* 且在 exec 之前就短路（真实芯片：02h 都没成，10h 自然不发） */
printf("[TC-NANDPORT-207] program_load failure -> BAD_BLOCK + mark bad\n");
/* TC-NANDPORT-207：program_load 失败（装载阶段）-> BAD_BLOCK，但**不标坏块**。
* 【#79 修复】装载失败是传输层问题（02h 都没送达芯片），芯片从未回 P_FAIL，
* 把块标坏等于把"线抖了一下"固化成永久坏块。旧实现在此标坏，本用例把守。 */
printf("[TC-NANDPORT-207] program_load failure -> BAD_BLOCK, NO mark bad\n");
fake_chip_reset();
s_fail_program_load = 1;
err = DHARA_E_NONE;
@@ -669,8 +691,21 @@ static void tc_prog(void) {
"program_load failure -> -1");
CHECK(err == DHARA_E_BAD_BLOCK, "program_load failure -> DHARA_E_BAD_BLOCK");
CHECK(g_fake_program_exec_cnt == 0u, "load failure short-circuits before program_exec");
CHECK(g_fake_mark_bad_cnt == 1u, "load failure marks exactly one block bad");
CHECK(g_fake_mark_bad_log[0] == 3u, "the block marked bad is the page's own block");
CHECK(g_fake_mark_bad_cnt == 0u, "load failure must NOT mark bad (transport, not media)");
CHECK(fake_bad_unchanged(), "load failure leaves the BBT untouched");
/* TC-NANDPORT-208：program_exec 传输/超时失败（芯片未回 P_FAIL）-> 不标坏块。
* 【#79 核心】真机现场：出厂 0 坏块、底层写全部成功，而持久化 BBT 把
* 1016–1142 连续段判坏——正是这类失败被旧实现标坏并固化所致。 */
printf("[TC-NANDPORT-208] program_exec transport failure -> BAD_BLOCK, NO mark bad\n");
fake_chip_reset();
s_fail_exec_transport = 1;
err = DHARA_E_NONE;
CHECK(dhara_nand_prog(&s_ut_nand, 4u * 64u, page_buf, &err) == -1,
"program_exec transport failure -> -1");
CHECK(err == DHARA_E_BAD_BLOCK, "program_exec transport failure -> DHARA_E_BAD_BLOCK");
CHECK(g_fake_mark_bad_cnt == 0u, "exec transport failure must NOT mark bad");
CHECK(fake_bad_unchanged(), "exec transport failure leaves the BBT untouched");
}
/* ===================== TC-NANDPORT-300..307：dhara_nand_read ===================== */
@@ -867,15 +902,27 @@ static void tc_erase(void) {
CHECK(dhara_nand_erase(&s_ut_nand, UT_OOB_BLOCK - 1u, &err) == 0,
"erase block == num_blocks - 1 -> 0");
/* TC-NANDPORT-504：擦除失败 -> BAD_BLOCK + 标坏该块 */
printf("[TC-NANDPORT-504] erase failure -> BAD_BLOCK + mark bad\n");
/* TC-NANDPORT-504：芯片回 E_FAIL 的擦除失败 -> BAD_BLOCK + 标坏该块（正确处置） */
printf("[TC-NANDPORT-504] erase E_FAIL -> BAD_BLOCK + mark bad\n");
fake_chip_reset();
s_fail_block_erase = 1;
err = DHARA_E_NONE;
CHECK(dhara_nand_erase(&s_ut_nand, 3u, &err) == -1, "block_erase failure -> -1");
CHECK(err == DHARA_E_BAD_BLOCK, "block_erase failure -> DHARA_E_BAD_BLOCK");
CHECK(g_fake_mark_bad_cnt == 1u, "erase failure marks exactly one block bad");
CHECK(g_fake_mark_bad_cnt == 1u, "erase E_FAIL marks exactly one block bad");
CHECK(g_fake_mark_bad_log[0] == 3u, "the block marked bad is the one that failed");
/* TC-NANDPORT-505：擦除传输/超时失败（芯片未回 E_FAIL）-> 不标坏块。
* 【#79 核心】这是把 129 个好块误标并持久化的那条路径；标坏是**不可撤销**
* 的持久化动作，只有芯片明确回 E_FAIL 才允许。 */
printf("[TC-NANDPORT-505] erase transport failure -> BAD_BLOCK, NO mark bad\n");
fake_chip_reset();
s_fail_erase_transport = 1;
err = DHARA_E_NONE;
CHECK(dhara_nand_erase(&s_ut_nand, 5u, &err) == -1, "erase transport failure -> -1");
CHECK(err == DHARA_E_BAD_BLOCK, "erase transport failure -> DHARA_E_BAD_BLOCK");
CHECK(g_fake_mark_bad_cnt == 0u, "erase transport failure must NOT mark bad");
CHECK(fake_bad_unchanged(), "erase transport failure leaves the BBT untouched");
}
/* ===================== TC-NANDPORT-600..605：is_bad / mark_bad ===================== */
@@ -981,6 +1028,168 @@ static void tc_dhara_scenario(void) {
"write + resume scenario: zero double-program violations (scenario guard)");
}
/* ===================== TC-NANDPORT-800..813：问题 #79 回归 =====================
*
* 现场（2026-11-04 台架，两次独立捕获）：
* 探针写 /fschk.tmp → disk_write → ftl_flush_cache 对 LPN=211 反复 TOO_BAD
* → 判卷损坏 → storage_bring_up 调 nand_ftl_format() 想重建
* → **旧版 format 先 flush 同一脏页、失败即 return** → map 从没被清过
* → f_mkfs 在旧映射上跑 → 3 轮重试耗尽 → storage disabled（每次启动必现）。
*
* 本组测三件事：
* ① 脏缓存写不进去时，format **仍然成功**并清掉映射（修复点）；
* ② format 后脏缓存被丢弃，不会带着旧 LPN 幽灵继续写（配套不变量）；
* ③ 失败快照（C4）真的把"操作 / 失败类 / LPN / 次数"带出函数边界（新能力）。
*
* 假芯片的失败注入是**按页**的（s_fail_program_exec 是全局开关），而现场是
* "某个 LPN 的写回恒定失败"。这里用"让 program_exec 恒失败"逼近同一形态：
* 脏页写不进去 → flush 必失败，正是旧版 return 的那个分支。
*/
/* 把脏缓存喂进去：直接经 FatFs 叶子的 disk_write 不可行（那会先触发 init），
* 故手工构一个与 disk_write 相同的前置状态：缓存里有一页待写数据。 */
static void prep_dirty_cache(uint32_t lpn, uint8_t seed) {
fake_chip_reset();
s_cached_lpn = (dhara_sector_t)lpn;
fake_fill_pattern(s_cache_buf, FTL_PAGE_SIZE, seed);
s_cache_dirty = 1u;
}
static void tc_format_survives_flush_failure(void) {
uint8_t before[FTL_PAGE_SIZE];
/* ---- 前置：一个已建好、里面真有数据的卷（模拟台架"卷原本可用"） ---- */
fake_chip_reset();
s_ut_nand.log2_page_size = 11u;
s_ut_nand.log2_ppb = 6u;
s_ut_nand.num_blocks = (unsigned int)FAKE_USABLE_BLOCKS;
dhara_map_init(&s_map, &s_ut_nand, s_page_buf, 4);
memset(s_cache_buf, 0, FTL_PAGE_SIZE);
s_cached_lpn = (dhara_sector_t)-1;
s_cache_dirty = 0;
s_initialized = 1;
(void)dhara_map_clear(&s_map);
{
dhara_error_t e;
(void)dhara_map_sync(&s_map, &e);
}
fake_fill_pattern(s_cache_buf, FTL_PAGE_SIZE, 0xA5u);
{
dhara_error_t e;
CHECK(dhara_map_write(&s_map, 0u, s_cache_buf, &e) == 0,
"TC-NANDPORT-800 precondition: sector 0 written");
}
fake_fill_pattern(s_cache_buf, FTL_PAGE_SIZE, 0x5Au);
{
dhara_error_t e;
CHECK(dhara_map_write(&s_map, 1u, s_cache_buf, &e) == 0,
"TC-NANDPORT-801 precondition: sector 1 written");
}
CHECK(dhara_map_size(&s_map) == 2u, "TC-NANDPORT-802 precondition: 2 sectors used");
/* ---- 关键形态：缓存脏着（脏页写不出去），此时调 format() ----
* 阶段 A 用"介质整体写不动"逼近最坏情况：program_load 全失败 ⇒ dhara 反复
* 标坏块 + 重试 8 次后 TOO_BAD，正是 `Cache flush FAIL: LPN=211 … TOO_BAD`
* 那条日志的来源。这一阶段**只断言死锁被打破**，不断言 format 返回 OK——
* 介质真的全写不动时它本来就落不了盘，报错是诚实的。 */
memset(s_cache_buf, 0xC3, FTL_PAGE_SIZE);
s_cached_lpn = (dhara_sector_t)211u; /* 与现场 LPN=211 同形 */
s_cache_dirty = 1u;
memcpy(before, s_cache_buf, FTL_PAGE_SIZE);
s_fail_program_load = 1;
(void)nand_ftl_format();
/* ★ 本单的核心断言：**旧实现到这里 map 一个字节都没清**
* （它在 ftl_flush_cache() 失败那行就 return 了，dhara_map_clear 从未执行）。
* 新实现必须已经把 map 清空、缓存作废——这正是"恢复动作本身被永久挡住"
* 这条死锁的破点。 */
CHECK(dhara_map_size(&s_map) == 0u,
"TC-NANDPORT-804 format clears the map even when dirty-cache flush fails (fix for #79)");
CHECK(s_cache_dirty == 0u, "TC-NANDPORT-805 format discards the dirty cache flag");
CHECK(s_cached_lpn == (dhara_sector_t)-1,
"TC-NANDPORT-806 format invalidates cached LPN (no ghost page reuse)");
CHECK(memcmp(s_cache_buf, before, FTL_PAGE_SIZE) == 0,
"TC-NANDPORT-807 format does not fabricate page content");
/* ---- 阶段 B：介质可用后（新片上电 = 无坏块积累、map 重新 resume），
* format 必须产出真正可写的空卷。现场对应"下次可写的格式化"。 ---- */
fake_chip_reset(); /* 同时复位全部失败注入 */
dhara_map_init(&s_map, &s_ut_nand, s_page_buf, 4);
memset(s_cache_buf, 0, FTL_PAGE_SIZE);
s_cached_lpn = (dhara_sector_t)-1;
s_cache_dirty = 0;
s_initialized = 1;
nand_ftl_fault_clear();
{
int rc = nand_ftl_format();
CHECK(rc == GD5F_OK, "TC-NANDPORT-808 on recovered media: format returns OK");
CHECK(dhara_map_size(&s_map) == 0u,
"TC-NANDPORT-808b on recovered media: map is empty after format");
}
{
dhara_error_t e;
int wrc;
fake_fill_pattern(s_cache_buf, FTL_PAGE_SIZE, 0x11u);
wrc = dhara_map_write(&s_map, 0u, s_cache_buf, &e);
CHECK(wrc == 0, "TC-NANDPORT-809 after format: new volume accepts writes");
CHECK(dhara_map_size(&s_map) == 1u, "TC-NANDPORT-810 after format: map counts 1 sector");
}
/* ---- 失败快照（C4）：新能力，把失败类带出函数边界 ---- */
nand_ftl_fault_clear();
{
nand_ftl_fault_t f;
nand_ftl_fault_get(&f);
CHECK(f.active == 0u, "TC-NANDPORT-811 fault snapshot clear -> inactive");
CHECK(f.count == 0u, "TC-NANDPORT-811b fault snapshot clear -> count reset");
}
/* 造一次可归类的失败：脏缓存 + 写不动 */
fake_chip_reset();
memset(s_cache_buf, 0x77, FTL_PAGE_SIZE);
s_cached_lpn = (dhara_sector_t)211u;
s_cache_dirty = 1u;
s_fail_program_load = 1;
{
bsp_err_t cls = ftl_flush_cache();
nand_ftl_fault_t f;
CHECK(cls != BSP_OK, "TC-NANDPORT-812a injected flush failure returns an error class");
nand_ftl_fault_get(&f);
CHECK(f.active == 1u, "TC-NANDPORT-812 fault snapshot becomes active after a failure");
CHECK(f.op == NAND_FTL_OP_FLUSH, "TC-NANDPORT-812b snapshot records the failing operation");
CHECK(f.cls == (int32_t)cls, "TC-NANDPORT-812c snapshot records the failure class");
CHECK(f.lpn == 211u, "TC-NANDPORT-812d snapshot records the failing LPN");
CHECK(f.count == 1u, "TC-NANDPORT-812e snapshot counts the failure");
}
/* 再失败一次：count 累计（现场是同一页撞 15 次） */
{
nand_ftl_fault_t f;
(void)ftl_flush_cache();
nand_ftl_fault_get(&f);
CHECK(f.count == 2u, "TC-NANDPORT-813 repeated failures accumulate (same-page retry)");
CHECK(f.lpn == 211u, "TC-NANDPORT-813b repeated failures keep the same LPN");
}
s_fail_program_load = 0;
s_fail_program_page = 0u;
nand_ftl_fault_clear();
s_initialized = 0;
s_cached_lpn = (dhara_sector_t)-1;
s_cache_dirty = 0;
}
/* ===================== main ===================== */
int main(void) {
@@ -1023,6 +1232,9 @@ int main(void) {
printf("-- dhara map scenario (real dhara, fake chip) --\n");
tc_dhara_scenario();
printf("-- format survives dirty-cache flush failure + fault snapshot (issue #79) --\n");
tc_format_survives_flush_failure();
printf("\n=== NAND Port Tests: %d/%d PASSED (failed=%d) ===\n",
s_passed, s_total, s_failed);
return (s_failed == 0) ? 0 : 1;