ESP8266 Debug Notes
来自Jack's Lab
目录 |
1 Fatal Exception 0
1.1 现象
ets Jan 8 2013,rst cause:1, boot mode:(3,7) load 0x40100000, len 27700, room 16 tail 4 chksum 0x76 load 0x3ffe8000, len 992, room 4 tail 12 chksum 0xa9 ho 0 tail 12 room 4 load 0x3ffe83e0, len 5084, room 12 tail 0 chksum 0xee csum 0xee Fatal exception (0): epc1=0x4024097c, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000 Fatal exception (0): epc1=0x4024097c, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000 Fatal exception (0): epc1=0x4024097c, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000 Fatal exception (0): ...... ......
1.2 分析
出错指令地址 epc1 = 0x4024097c , Flash maped at 0x40200000, so it's located at flash, try to look at the code:
comcat@jackslab:/work/noduino-sdk/examples/plug-minik$ ../../toolchain/xtensa-lx106-elf/bin/xtensa-lx106-elf-objdump -S build/app.out > app.s comcat@jackslab:/work/noduino-sdk/examples/plug-minik$ cat app.s | grep 4024097c 4024097c: fffe61 l32r a6, 40240974 <user_rf_pre_init+0x45c>
在 user_rf_pre_init 这个函数里，RF init 相关，Flash 0xFC000 的地方，放了一些 RF 初始化参数，是不是和这个相关呢？貌似刚刚这个区被清 0 了？！
1.3 解决
重新写入 esp_init_data_default.bin 到 0xFC000，问题解决。
- 貌似 esptool 写入数据没那么可靠，一次写 6 个 bin 文件，也会造成这个现象，改为一次写 2、3 个，问题也消失！（存疑）
- Poor Power!
2 Reset issue
2.1 现象
小K mini，AirKiss 配置成功后，MQTT: Published，然后就重启了。。。
TYPE: AIRKISS T|sniffer on ch:7 SC_STATUS_GETTING_SSID_PSWD SC_TYPE:SC_TYPE_AIRKISS Store the ssid and password into flash f r-1, scandone state: 0 -> 2 (b0) state: 2 -> 3 (0) state: 3 -> 5 (10) connected with Noduino-AP channel 7 dhcp client start... cnt ip:192.168.5.73,mask:255.255.255.0,gw:192.168.5.1 TCP: Connect to ip 101.200.202.247:1883 MQTT: Connected to broker 101.200.202.247:1883 MQTT: Sending, type: 1, id: 0000 TCP: Sent TCP: data received 4 bytes MQTT: Connected to 101.200.202.247:1883 MQTT: Connected MQTT: queue subscribe, topic"/app2dev/gh_95fae12220_04063fb88d9a8e47", id: 1 MQTT: queuing publish, length: 64, queue size(66/2048) MQTT: Sending, type: 8, id: 0001 TCP: Sent TCP: data received 5 bytes MQTT: Subscribe successful MQTT: Sending, type: 3, id: 0000 TCP: Sent MQTT: Published SC_STATUS_LINK_OVER free heap size:40424 state: 5 -> 0 (0) rm 0 del if0 usl TCP: Reconnect to 101.200.202.247:1883 ets Jan 8 2013,rst cause:1, boot mode:(3,0) ...... ......
小K mini sketch/plug:
ets Jan 8 2013,rst cause:1, boot mode:(3,2) load 0x40100000, len 31268, room 16 tail 4 chksum 0xca load 0x3ffe8000, len 1008, room 4 tail 12 chksum 0x3d ho 0 tail 12 room 4 load 0x3ffe83f0, len 5068, room 12 tail 0 chksum 0x8b csum 0x8b r\0x18\0x02\0x8e\0x1b\0xc39l\0xc0\0xc4\0x9e\0x1b\0xf2\0x85 ets Jan 8 2013,rst cause:1, boot mode:(3,2) ...... ......
2.2 解决
原始固件残留造成的混乱，需要先整个擦除整个 Flash 再 make flash 烧写固件，问题即解决：
comcat@jackslab:/work/xwifi/noduino-sdk/examples/plug-minik$ ../../toolchain/bin/esptool.py -p /dev/ttyUSB0 erase_flash Connecting... head: 0 ;total: 0 erase size : 0
重新再进一次刷机模式，然后刷机：
comcat@jackslab:/work/xwifi/noduino-sdk/examples/plug-minik$ make flash
3 Fatal exception 0
3.1 现象
ets Jan 8 2013,rst cause:2, boot mode:(3,6) load 0x40100000, len 29588, room 16 tail 4 chksum 0x1e load 0x3ffe8000, len 944, room 4 tail 12 chksum 0x11 ho 0 tail 12 room 4 load 0x3ffe83b0, len 7120, room 12 tail 4 chksum 0xe2 csum 0xe2 don't use rtc mem data r\0x18\0x02S System started ... mode : sta(18:fe:34:fe:62:4a) + softAP(1a:fe:34:fe:62:4a) add if0 add if1 dhcp server start:(ip:192.168.4.1,mask:255.255.255.0,gw:192.168.4.1) bcn 100 f r0, => Simple POST mjyun_wan_init: init scandone state: 0 -> 2 (b0) state: 2 -> 3 (0) state: 3 -> 5 (10) add 0 aid 7 connected with GAGA-comcat, channel 7 dhcp client start... cnt ip:192.168.1.80,mask:255.255.255.0,gw:192.168.1.1 mjyun_wan_delete: delete mjyun_wan_create: create Platform: MJYUN_CONNECTING mjyun_wan_check_ip: check product ID mjyun_wan_check_ip: try create device mjyun_wan_device_create: request mjyun_wan_device_create: memory left=41128 Fatal exception 0(IllegalInstructionCause): epc1=0x4027d41c, epc2=0x00000000, epc3=0x00000000, excvaddr=0x00000000, depc=0x00000000 ets Jan 8 2013,rst cause:2, boot mode:(3,6) load 0x40100000, len 29588, room 16 tail 4 chksum 0x1e load 0x3ffe8000, len 944, room 4 ...... ......
3.2 分析
多次尝试发现都在 0x4027d41c 这个地址出异常，那就看看这个地址的指令是个什么：
comcat@jackslab:/work/xwifi/noduino-sdk/sketch/mjyun$ ../../toolchain/xtensa-lx106-elf/bin/xtensa-lx106-elf-objdump -S build/app.out >app.s comcat@jackslab:/work/xwifi/noduino-sdk/sketch/mjyun$ vim app.s
0x4027d41c 处，是函数 http_post 的入口：
4027d41c <http_post>:
* <port> is optional
*/
void ICACHE_FLASH_ATTR http_post(const char *url, const char *headers,
const char *post_data,
http_callback_t callback_handle)
{
4027d41c: e0c112 addi a1, a1, -32
4027d41f: 7109 s32i.n a0, a1, 28
4027d421: 61f9 s32i.n a15, a1, 24
并无异常，单独验证 http_post，也没有问题。于是改成直接用 http_request 则出错地址依然一样；初始化的时候 http_post() 请求一下，发现出错地址往后移动了一点
晚上 DDD 回去试了，用老 SDK 的编译环境验证了一下，确认是 ld 链接脚本不一致引起的
很快发现，链接脚本里把 irom 段都放在 0x4028 0000 之前，就没问题了
3.3 解决
进一步判断，是 mjyun_config.h 的这个：
/* * SPI flash settings * NOTICE---this is for 512KB spi flash. * you can change to other sector if you use other size spi flash. */ #define MJYUN_STORAGE_SECTOR (0x7C)
我们都用的 4MB 的flash 。。。，4MB Flash 正确的用户参数地址应该在 0x3FC000 开始处
因此改为 0x3FC 问题解决
4 Flash Related
1. 0x0 address bin read error
ets Jan 8 2013,rst cause:1, boot mode:(3,2) ets_main.c
2.spi mode error( use quad mode for dual flash)
ets Jan 8 2013,rst cause:1, boot mode:(3,2) load 0x40100000, len 612, room 16 tail 4 chksum 0xef load 0x88888888, len -2004318072, room 4 flash read err, ets_unpack_flash_code ets_main.c
3.boot load jump error.(user.bin not correct)
ets Jan 8 2013,rst cause:1, boot mode:(3,2) load 0x40100000, len 612, room 16 tail 4 chksum 0x12 load 0x3ffe8000, len 788, room 4 tail 0 chksum 0x50 load 0x3ffe8314, len 264, room 8 tail 0 chksum 0x4a csum 0x4a 2nd boot version : 1.1 SPI Speed : 40MHz SPI Mode : DIO SPI Flash Size : 4Mbit jump to run user1 user code done
4.dual flash(boot+user.bin mode) ==>use download tool version v0.9.3.1 and above
ets Jan 8 2013,rst cause:1, boot mode:(3,3) load 0x40100000, len 612, room 16 tail 4 chksum 0x12 load 0x3ffe8000, len 788, room 4 tail 0 chksum 0x50 load 0x3ffe8314, len 264, room 8 tail 0 chksum 0x4a csum 0x4a 2nd boot version : 1.1 SPI Speed : 40MHz SPI Mode : SPI Flash Size : 4Mbit jump to run user1 Fatal exception (28): epc1=0x401001a4, epc2=0x00000000, epc3=0x00000000, excvaddr=0x0000009c, depc=0x00000000 Fatal exception (28): epc1=0x401001a4, epc2=0x00000000, epc3=0x00000000, excvaddr=0x0000009c, depc=0x00000000 Fatal exception (28): epc1=0x401001a4, epc2=0x00000000, epc3=0x00000000, excvaddr=0x0000009c, depc=0x00000000
5. MX25L12835F，DIO OK, when changing to QIO:
ets Jan 8 2013,rst cause:2, boot mode:(3,6) load 0x40100000, len 26876, room 16 tail 12 chksum 0xef ho 0 tail 12 room 4 load 0x00000000, len 0, room 12 tail 0 chksum 0xef load 0x00000000, len 0, room 4 tail 0 chksum 0xef csum 0xef csum err ets_main.c
6. 小 K mini，MXIC 25L80，worked in DOUT, when changed to QIO （DIO 错误类似）:
ets Jan 8 2013,rst cause:1, boot mode:(3,2) load 0x40100000, len 27700, room 16 tail 4 chksum 0xef load 0x00000000, len 0, room 4 tail 0 chksum 0xef ho 12 tail 0 room 4 load 0x00000000, len 0, room 12 tail 0 chksum 0xef csum 0xef csum err ets_main.c
QOUT:
ets Jan 8 2013,rst cause:1, boot mode:(3,2) load 0x40100000, len 26876, room 16 tail 12 chksum 0xef ho 0 tail 12 room 4 load 0xcccccccc, len -858993460, room 12 flash read err, ets_unpack_flash_code ets_main.c
