如何在 Linux 中正常关机并防止 SDCARD 损坏

Question

I am working on Embedded Linux System which mounts a SDCARD ( formatted as FAT32) and writes about 500KB of Data per second continuously .

Now to handle Power failures, we designed a battery which gives a backup of about 3 seconds .

This enables us to complete graceful shutdown .

We have only one process writing data to the SDCARD .So no other process will access the SDCARD in anyway.

During Power failure and during shutdown process We use fflush and fsync and then finally fclose of the current file in which data is written to.

We even have verified with oscilloscope by probing the hardware lines that data transaction becomes active with the SDCARD when we call fflush and fsync during shutdown process. ie cache data is being tried to be written to SDCARD during this time . That makes me believe that fflush and fsync is implemented correctly .

Only thing i didnot do is umount the SDCARD as it takes longer time.

But still in about 10 tries , we can see the SDCARD root partition getting corrupted and files are missing .

Is umount necessary for a proper graceful shutdown . What i understand is mount only creates a link of the inode of the root of this filesystem with rest of the file system . and umount only removes the link .

What is the perfect way or steps to ensure protection of the SDCARD while shutting down in Embedded Linux .

Below is the code which gets executed during the shutdown process currently. is umount call necessary .

    if(fflush(file)<0)
        printf("Failed  fflush errno=%d",errno);
    if(fsync(fileno(file))<0)
        printf ("Failed  fsync errno=%d",errno);
    if(fclose(file)<0)
        printf("Failed  fclose errno=%d",errno);
    file=NULL;

Answer 1

You are doing almost right, however, there is a catch: your SD device might require additional time to flush its own internal buffers.

The needed time is dependent on the precise chipset (and of course, brand, model, etc...).

In order to properly shutdown the system, you need to have a backup battery that allows you to be safe: consider that backup batteries on enterprise RAID cards ranges from 2 to 5 minutes, and the manufacturer knows exactly every hardware details.

Unfortunately, after fsync() you have to wait for more time. In similar circumstances, our RasperryPi devices are safe towards corruption with a backup battery that allows the device to operate for at least 20 seconds (although 10-15 is safe in our case) just to play easy.