July 2021 - U-Boot

[PATCH v2] test/py: efi_capsule: align with efidebug syntax changes
by AKASHI Takahiro 20 Jul '21

20 Jul '21

After the commit c70f44817d46 ("efi_loader: simplify 'printenv -e'"), "-all" option is no longer necessary. Just remove them in the test script. Fixes: c70f44817d46 ("efi_loader: simplify 'printenv -e'") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- v2: no change --- test/py/tests/test_efi_capsule/test_capsule_firmware.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware.py b/test/py/tests/test_efi_capsule/test_capsule_firmware.py index 4697ca6f1c5c..9eeaae27d626 100644 --- a/test/py/tests/test_efi_capsule/test_capsule_firmware.py +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware.py @@ -85,7 +85,7 @@ class TestEfiCapsuleFirmwareFit(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e -all Capsule0000') + 'env print -e Capsule0000') output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, @@ -160,7 +160,7 @@ class TestEfiCapsuleFirmwareFit(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e -all Capsule0000') + 'env print -e Capsule0000') output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, @@ -227,7 +227,7 @@ class TestEfiCapsuleFirmwareFit(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e -all Capsule0000') + 'env print -e Capsule0000') output = u_boot_console.run_command_list(['efidebug capsule esrt']) -- 2.31.0

1 0

[PATCH v2] efi_loader: remove asm/setjmp.h from efi_api.h
by AKASHI Takahiro 20 Jul '21

20 Jul '21

In the commit c982874e930d ("efi_loader: refactor efi_setup_loaded_image()"), setjmp-related definitions were moved to efi_loaded_image_obj in efi_loader.h. So setjmp.h is no longer refererenced in efi_api.h. This also fixes some error when efi_api.h will be included in mkeficapsule.c. Fixes: c982874e930d ("efi_loader: refactor efi_setup_loaded_image()") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- v2: move asm/setjmp.h from efi_loader.h to efi_boottime.c --- include/efi_api.h | 4 ---- include/efi_loader.h | 1 + lib/efi_loader/efi_boottime.c | 1 + 3 files changed, 2 insertions(+), 4 deletions(-) diff --git a/include/efi_api.h b/include/efi_api.h index 18a1adf02390..e854a8b3a112 100644 --- a/include/efi_api.h +++ b/include/efi_api.h @@ -20,10 +20,6 @@ #include <charset.h> #include <pe.h> -#ifdef CONFIG_EFI_LOADER -#include <asm/setjmp.h> -#endif - /* UEFI spec version 2.8 */ #define EFI_SPECIFICATION_VERSION (2 << 16 | 80) diff --git a/include/efi_loader.h b/include/efi_loader.h index b81180cfda8b..e6d41cfb359f 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -17,6 +17,7 @@ #include <pe.h> struct blk_desc; +struct jmp_buf_data; static inline int guidcmp(const void *g1, const void *g2) { diff --git a/lib/efi_loader/efi_boottime.c b/lib/efi_loader/efi_boottime.c index f6d5ba05e34a..0b98e9181373 100644 --- a/lib/efi_loader/efi_boottime.c +++ b/lib/efi_loader/efi_boottime.c @@ -20,6 +20,7 @@ #include <usb.h> #include <watchdog.h> #include <asm/global_data.h> +#include <asm/setjmp.h> #include <linux/libfdt_env.h> DECLARE_GLOBAL_DATA_PTR; -- 2.31.0

1 0

[PATCH v2] efi_loader: capsule: remove authentication data
by AKASHI Takahiro 20 Jul '21

20 Jul '21

If capsule authentication is disabled and yet a capsule file is signed, its signature must be removed from image data to flush. Otherwise, the firmware will be corrupted after update. Fixes: 04be98bd6bcf ("efi: capsule: Add support for uefi capsule authentication") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- v2: rebase v1 on top of Ilias's patch --- lib/efi_loader/efi_capsule.c | 70 +++++++++++++++++++++++++++++------- 1 file changed, 57 insertions(+), 13 deletions(-) diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index 3c029378de0a..26990bc2df4a 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -218,6 +218,39 @@ skip: return NULL; } +/** + * efi_remove_auth_hdr - remove authentication data from image + * @image: Pointer to pointer to Image + * @image_size: Pointer to Image size + * + * Remove the authentication data from image if possible. + * Update @image and @image_size. + * + * Return: status code + */ +static efi_status_t efi_remove_auth_hdr(void **image, efi_uintn_t *image_size) +{ + struct efi_firmware_image_authentication *auth_hdr; + efi_status_t ret = EFI_INVALID_PARAMETER; + + auth_hdr = (struct efi_firmware_image_authentication *)*image; + if (*image_size < sizeof(*auth_hdr)) + goto out; + + if (auth_hdr->auth_info.hdr.dwLength <= + offsetof(struct win_certificate_uefi_guid, cert_data)) + goto out; + + *image = (uint8_t *)*image + sizeof(auth_hdr->monotonic_count) + + auth_hdr->auth_info.hdr.dwLength; + *image_size = *image_size - auth_hdr->auth_info.hdr.dwLength - + sizeof(auth_hdr->monotonic_count); + + ret = EFI_SUCCESS; +out: + return ret; +} + #if defined(CONFIG_EFI_CAPSULE_AUTHENTICATE) static int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) @@ -254,21 +287,15 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (capsule == NULL || capsule_size == 0) goto out; - auth_hdr = (struct efi_firmware_image_authentication *)capsule; - if (capsule_size < sizeof(*auth_hdr)) - goto out; - - if (auth_hdr->auth_info.hdr.dwLength <= - offsetof(struct win_certificate_uefi_guid, cert_data)) + *image = (uint8_t *)capsule; + *image_size = capsule_size; + if (efi_remove_auth_hdr(image, image_size) != EFI_SUCCESS) goto out; + auth_hdr = (struct efi_firmware_image_authentication *)capsule; if (guidcmp(&auth_hdr->auth_info.cert_type, &efi_guid_cert_type_pkcs7)) goto out; - *image = (uint8_t *)capsule + sizeof(auth_hdr->monotonic_count) + - auth_hdr->auth_info.hdr.dwLength; - *image_size = capsule_size - auth_hdr->auth_info.hdr.dwLength - - sizeof(auth_hdr->monotonic_count); memcpy(&monotonic_count, &auth_hdr->monotonic_count, sizeof(monotonic_count)); @@ -348,7 +375,7 @@ static efi_status_t efi_capsule_update_firmware( { struct efi_firmware_management_capsule_header *capsule; struct efi_firmware_management_capsule_image_header *image; - size_t capsule_size; + size_t capsule_size, image_binary_size; void *image_binary, *vendor_code; efi_handle_t *handles; efi_uintn_t no_handles; @@ -410,13 +437,30 @@ static efi_status_t efi_capsule_update_firmware( } /* do update */ + if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && + !(image->image_capsule_support & + CAPSULE_SUPPORT_AUTHENTICATION)) { + /* no signature */ + ret = EFI_SECURITY_VIOLATION; + goto out; + } + image_binary = (void *)image + sizeof(*image); - vendor_code = image_binary + image->update_image_size; + image_binary_size = image->update_image_size; + vendor_code = image_binary + image_binary_size; + if (!IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && + (image->image_capsule_support & + CAPSULE_SUPPORT_AUTHENTICATION)) { + ret = efi_remove_auth_hdr(&image_binary, + &image_binary_size); + if (ret != EFI_SUCCESS) + goto out; + } abort_reason = NULL; ret = EFI_CALL(fmp->set_image(fmp, image->update_image_index, image_binary, - image->update_image_size, + image_binary_size, vendor_code, NULL, &abort_reason)); if (ret != EFI_SUCCESS) { -- 2.31.0

1 0

[PATCH] efi_loader: capsule: remove authentication data
by AKASHI Takahiro 20 Jul '21

20 Jul '21

If capsule authentication is disabled and yet a capsule file is signed, its signature must be removed from image data to flush. Otherwise, the firmware will be corrupted after update. Fixes: 04be98bd6bcf ("efi: capsule: Add support for uefi capsule authentication") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- lib/efi_loader/efi_capsule.c | 70 +++++++++++++++++++++++++++++------- 1 file changed, 57 insertions(+), 13 deletions(-) diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index b0dffd3ac9ce..5d156c730faa 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -206,6 +206,39 @@ skip: return NULL; } +/** + * efi_remove_auth_hdr - remove authentication data from image + * @image: Pointer to pointer to Image + * @image_size: Pointer to Image size + * + * Remove the authentication data from image if possible. + * Update @image and @image_size. + * + * Return: status code + */ +static efi_status_t efi_remove_auth_hdr(void **image, efi_uintn_t *image_size) +{ + struct efi_firmware_image_authentication *auth_hdr; + efi_status_t ret = EFI_INVALID_PARAMETER; + + auth_hdr = (struct efi_firmware_image_authentication *)*image; + if (*image_size < sizeof(*auth_hdr)) + goto out; + + if (auth_hdr->auth_info.hdr.dwLength <= + offsetof(struct win_certificate_uefi_guid, cert_data)) + goto out; + + *image = (uint8_t *)*image + sizeof(auth_hdr->monotonic_count) + + auth_hdr->auth_info.hdr.dwLength; + *image_size = *image_size - auth_hdr->auth_info.hdr.dwLength - + sizeof(auth_hdr->monotonic_count); + + ret = EFI_SUCCESS; +out: + return ret; +} + #if defined(CONFIG_EFI_CAPSULE_AUTHENTICATE) #if defined(CONFIG_EFI_PKEY_DTB_EMBED) @@ -271,21 +304,15 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (capsule == NULL || capsule_size == 0) goto out; - auth_hdr = (struct efi_firmware_image_authentication *)capsule; - if (capsule_size < sizeof(*auth_hdr)) - goto out; - - if (auth_hdr->auth_info.hdr.dwLength <= - offsetof(struct win_certificate_uefi_guid, cert_data)) + *image = (uint8_t *)capsule; + *image_size = capsule_size; + if (efi_remove_auth_hdr(image, image_size) != EFI_SUCCESS) goto out; + auth_hdr = (struct efi_firmware_image_authentication *)capsule; if (guidcmp(&auth_hdr->auth_info.cert_type, &efi_guid_cert_type_pkcs7)) goto out; - *image = (uint8_t *)capsule + sizeof(auth_hdr->monotonic_count) + - auth_hdr->auth_info.hdr.dwLength; - *image_size = capsule_size - auth_hdr->auth_info.hdr.dwLength - - sizeof(auth_hdr->monotonic_count); memcpy(&monotonic_count, &auth_hdr->monotonic_count, sizeof(monotonic_count)); @@ -367,7 +394,7 @@ static efi_status_t efi_capsule_update_firmware( { struct efi_firmware_management_capsule_header *capsule; struct efi_firmware_management_capsule_image_header *image; - size_t capsule_size; + size_t capsule_size, image_binary_size; void *image_binary, *vendor_code; efi_handle_t *handles; efi_uintn_t no_handles; @@ -429,13 +456,30 @@ static efi_status_t efi_capsule_update_firmware( } /* do update */ + if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && + !(image->image_capsule_support & + CAPSULE_SUPPORT_AUTHENTICATION)) { + /* no signature */ + ret = EFI_SECURITY_VIOLATION; + goto out; + } + image_binary = (void *)image + sizeof(*image); - vendor_code = image_binary + image->update_image_size; + image_binary_size = image->update_image_size; + vendor_code = image_binary + image_binary_size; + if (!IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && + (image->image_capsule_support & + CAPSULE_SUPPORT_AUTHENTICATION)) { + ret = efi_remove_auth_hdr(&image_binary, + &image_binary_size); + if (ret != EFI_SUCCESS) + goto out; + } abort_reason = NULL; ret = EFI_CALL(fmp->set_image(fmp, image->update_image_index, image_binary, - image->update_image_size, + image_binary_size, vendor_code, NULL, &abort_reason)); if (ret != EFI_SUCCESS) { -- 2.31.0

1 1

IMX8M Mini HAB secure boot - working?
by Tim Harvey 20 Jul '21

20 Jul '21

Greetings, Has anyone successfully used secure boot with IMX8M Mini or other IMX8M? Peng's recent series got merged with the exception of what looks like the addition of couple of 'caam' commands to blob/deblob DEK's. There are no guides yet however I'm following the guides for the downstream NXP U-Boot and thus far have been able to get the SPL to boot with no HAB events but when it tries to authenticate the FIT image it validate_ivt fails with 'Error: Invalid IVT structure'. I'm not entirely clear if my CSF is wrong, or in the wrong place or if there is something missing. Best regards, Tim

3 6

[PATCH] test/py: efi_capsule: aligned with efidebug syntax changes
by AKASHI Takahiro 20 Jul '21

20 Jul '21

After the commit c70f44817d46 ("efi_loader: simplify 'printenv -e'"), "-all" option is no longer necessary. Just remove them in the test script. Fixes: c70f44817d46 ("efi_loader: simplify 'printenv -e'") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- test/py/tests/test_efi_capsule/test_capsule_firmware.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/py/tests/test_efi_capsule/test_capsule_firmware.py b/test/py/tests/test_efi_capsule/test_capsule_firmware.py index 4697ca6f1c5c..9eeaae27d626 100644 --- a/test/py/tests/test_efi_capsule/test_capsule_firmware.py +++ b/test/py/tests/test_efi_capsule/test_capsule_firmware.py @@ -85,7 +85,7 @@ class TestEfiCapsuleFirmwareFit(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e -all Capsule0000') + 'env print -e Capsule0000') output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, @@ -160,7 +160,7 @@ class TestEfiCapsuleFirmwareFit(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e -all Capsule0000') + 'env print -e Capsule0000') output = u_boot_console.run_command_list([ 'host bind 0 %s' % disk_img, @@ -227,7 +227,7 @@ class TestEfiCapsuleFirmwareFit(object): # need to run uefi command to initiate capsule handling output = u_boot_console.run_command( - 'env print -e -all Capsule0000') + 'env print -e Capsule0000') output = u_boot_console.run_command_list(['efidebug capsule esrt']) -- 2.31.0

2 2

[PATCH] efi_loader: move asm/setjmp.h to efi_loader.h
by AKASHI Takahiro 20 Jul '21

20 Jul '21

In the commit c982874e930d ("efi_loader: refactor efi_setup_loaded_image()"), setjmp-related definitions were moved to efi_loaded_image_obj in efi_loader.h. So setjmp.h is no longer refererenced in efi_api.h. This also fixes some error when efi_api.h will be included in mkeficapsule.c. On the other hand, a tweak will be necessary in common/main.c as some architectures have no setjmp support. Fixes: c982874e930d ("efi_loader: refactor efi_setup_loaded_image()") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- common/main.c | 6 ++++++ include/efi_api.h | 4 ---- include/efi_loader.h | 1 + 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/common/main.c b/common/main.c index ae5bcdb32f8b..a41c57c26611 100644 --- a/common/main.c +++ b/common/main.c @@ -16,7 +16,13 @@ #include <init.h> #include <net.h> #include <version.h> +#ifdef CONFIG_EFI_LOADER +/* + * Unfortunately, efi_loader requires setjmp.h, but there are + * some architectures which have no support for setjmp. + */ #include <efi_loader.h> +#endif static void run_preboot_environment_command(void) { diff --git a/include/efi_api.h b/include/efi_api.h index 18a1adf02390..e854a8b3a112 100644 --- a/include/efi_api.h +++ b/include/efi_api.h @@ -20,10 +20,6 @@ #include <charset.h> #include <pe.h> -#ifdef CONFIG_EFI_LOADER -#include <asm/setjmp.h> -#endif - /* UEFI spec version 2.8 */ #define EFI_SPECIFICATION_VERSION (2 << 16 | 80) diff --git a/include/efi_loader.h b/include/efi_loader.h index de1a496a9726..6994a951bc19 100644 --- a/include/efi_loader.h +++ b/include/efi_loader.h @@ -15,6 +15,7 @@ #include <efi_api.h> #include <image.h> #include <pe.h> +#include <asm/setjmp.h> struct blk_desc; -- 2.31.0

2 2

[PATCH] efi_loader: capsule: remove authentication data
by AKASHI Takahiro 20 Jul '21

20 Jul '21

If capsule authentication is disabled and yet a capsule file is signed, its signature must be removed from image data to flush. Otherwise, the firmware will be corrupted after update. Fixes: 04be98bd6bcf ("efi: capsule: Add support for uefi capsule authentication") Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- lib/efi_loader/efi_capsule.c | 70 +++++++++++++++++++++++++++++------- 1 file changed, 57 insertions(+), 13 deletions(-) diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index b0dffd3ac9ce..5d156c730faa 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -206,6 +206,39 @@ skip: return NULL; } +/** + * efi_remove_auth_hdr - remove authentication data from image + * @image: Pointer to pointer to Image + * @image_size: Pointer to Image size + * + * Remove the authentication data from image if possible. + * Update @image and @image_size. + * + * Return: status code + */ +static efi_status_t efi_remove_auth_hdr(void **image, efi_uintn_t *image_size) +{ + struct efi_firmware_image_authentication *auth_hdr; + efi_status_t ret = EFI_INVALID_PARAMETER; + + auth_hdr = (struct efi_firmware_image_authentication *)*image; + if (*image_size < sizeof(*auth_hdr)) + goto out; + + if (auth_hdr->auth_info.hdr.dwLength <= + offsetof(struct win_certificate_uefi_guid, cert_data)) + goto out; + + *image = (uint8_t *)*image + sizeof(auth_hdr->monotonic_count) + + auth_hdr->auth_info.hdr.dwLength; + *image_size = *image_size - auth_hdr->auth_info.hdr.dwLength - + sizeof(auth_hdr->monotonic_count); + + ret = EFI_SUCCESS; +out: + return ret; +} + #if defined(CONFIG_EFI_CAPSULE_AUTHENTICATE) #if defined(CONFIG_EFI_PKEY_DTB_EMBED) @@ -271,21 +304,15 @@ efi_status_t efi_capsule_authenticate(const void *capsule, efi_uintn_t capsule_s if (capsule == NULL || capsule_size == 0) goto out; - auth_hdr = (struct efi_firmware_image_authentication *)capsule; - if (capsule_size < sizeof(*auth_hdr)) - goto out; - - if (auth_hdr->auth_info.hdr.dwLength <= - offsetof(struct win_certificate_uefi_guid, cert_data)) + *image = (uint8_t *)capsule; + *image_size = capsule_size; + if (efi_remove_auth_hdr(image, image_size) != EFI_SUCCESS) goto out; + auth_hdr = (struct efi_firmware_image_authentication *)capsule; if (guidcmp(&auth_hdr->auth_info.cert_type, &efi_guid_cert_type_pkcs7)) goto out; - *image = (uint8_t *)capsule + sizeof(auth_hdr->monotonic_count) + - auth_hdr->auth_info.hdr.dwLength; - *image_size = capsule_size - auth_hdr->auth_info.hdr.dwLength - - sizeof(auth_hdr->monotonic_count); memcpy(&monotonic_count, &auth_hdr->monotonic_count, sizeof(monotonic_count)); @@ -367,7 +394,7 @@ static efi_status_t efi_capsule_update_firmware( { struct efi_firmware_management_capsule_header *capsule; struct efi_firmware_management_capsule_image_header *image; - size_t capsule_size; + size_t capsule_size, image_binary_size; void *image_binary, *vendor_code; efi_handle_t *handles; efi_uintn_t no_handles; @@ -429,13 +456,30 @@ static efi_status_t efi_capsule_update_firmware( } /* do update */ + if (IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && + !(image->image_capsule_support & + CAPSULE_SUPPORT_AUTHENTICATION)) { + /* no signature */ + ret = EFI_SECURITY_VIOLATION; + goto out; + } + image_binary = (void *)image + sizeof(*image); - vendor_code = image_binary + image->update_image_size; + image_binary_size = image->update_image_size; + vendor_code = image_binary + image_binary_size; + if (!IS_ENABLED(CONFIG_EFI_CAPSULE_AUTHENTICATE) && + (image->image_capsule_support & + CAPSULE_SUPPORT_AUTHENTICATION)) { + ret = efi_remove_auth_hdr(&image_binary, + &image_binary_size); + if (ret != EFI_SUCCESS) + goto out; + } abort_reason = NULL; ret = EFI_CALL(fmp->set_image(fmp, image->update_image_index, image_binary, - image->update_image_size, + image_binary_size, vendor_code, NULL, &abort_reason)); if (ret != EFI_SUCCESS) { -- 2.31.0

2 2

[PATCH] efi_loader: capsule: remove unused guid
by AKASHI Takahiro 20 Jul '21

20 Jul '21

EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID is never used. Just remove it. Signed-off-by: AKASHI Takahiro <takahiro.akashi(a)linaro.org> --- lib/efi_loader/efi_capsule.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c index 84ddaf50d13f..b0dffd3ac9ce 100644 --- a/lib/efi_loader/efi_capsule.c +++ b/lib/efi_loader/efi_capsule.c @@ -208,9 +208,6 @@ skip: #if defined(CONFIG_EFI_CAPSULE_AUTHENTICATE) -const efi_guid_t efi_guid_capsule_root_cert_guid = - EFI_FIRMWARE_MANAGEMENT_CAPSULE_ID_GUID; - #if defined(CONFIG_EFI_PKEY_DTB_EMBED) int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len) { -- 2.31.0

2 2

U-Boot loaded RAMDisk crashes Linux on MT7623
by Daniel Golle 20 Jul '21

20 Jul '21

Hi, I writing in the hope that someone has a good idea about why U-boot is handing over a broken memory address for a loaded ramdisk which results in Linux crashing very early on boot on MediaTek's MT7623N SoC (ARMv7). If anyone has a good idea why this is happening, I'd be very glad, as this currently prevents me from updating that target in OpenWrt. Background: OpenWrt used to have the initramdisk built-into the kernel itself. Having it separate is nicer as then you won't need to recompile the kernel or even have a compiler installed in order to modify the ramdisk. This already works great on MT7622 and it'd be great to have it the same way on MT7623 (and MT7629 in future). So when loading a uImage.FIT with RAMDisk subimage to me it looks like U-Boot is not translating the address of the ramdisk correctly, see logs below: U-Boot> tftpboot 0x88000000 openwrt-mediatek-mt7623-bpi_bananapi-r2-initramfs-recovery.itb Using ethernet@1b100000 device TFTP from server 192.168.5.2; our IP address is 192.168.5.100 Filename 'openwrt-mediatek-mt7623-bpi_bananapi-r2-initramfs-recovery.itb'. Load address: 0x88000000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# 13 MiB/s done Bytes transferred = 10492520 (a01a68 hex) U-Boot> bootm ## Loading kernel from FIT Image at 88000000 ... Using 'config-1' configuration Trying 'kernel-1' kernel subimage Description: ARM OpenWrt Linux-5.10.51 Type: Kernel Image Compression: gzip compressed Data Start: 0x880000e4 Data Size: 4944975 Bytes = 4.7 MiB Architecture: ARM OS: Linux Load Address: 0x80008000 Entry Point: 0x80008000 Hash algo: crc32 Hash value: 9da8225f Hash algo: sha1 Hash value: ea4e69501bed0925ecdee0bb6b3a3b489fedc38c Verifying Hash Integrity ... crc32+ sha1+ OK ## Loading ramdisk from FIT Image at 88000000 ... Using 'config-1' configuration Trying 'initrd-1' ramdisk subimage Description: ARM OpenWrt bpi_bananapi-r2 initrd Type: RAMDisk Image Compression: Unknown Compression Data Start: 0x884b7668 Data Size: 5511960 Bytes = 5.3 MiB Architecture: ARM OS: Linux Load Address: unavailable Entry Point: unavailable Hash algo: crc32 Hash value: 01e5fbf0 Hash algo: sha1 Hash value: 6ceb78df26920d97dee505ddeb0318e0c1522ba0 Verifying Hash Integrity ... crc32+ sha1+ OK WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file! ## Loading fdt from FIT Image at 88000000 ... Using 'config-1' configuration Trying 'fdt-1' fdt subimage Description: ARM OpenWrt bpi_bananapi-r2 device tree blob Type: Flat Device Tree Compression: uncompressed Data Start: 0x889f9288 Data Size: 33453 Bytes = 32.7 KiB Architecture: ARM Hash algo: crc32 Hash value: a2599155 Hash algo: sha1 Hash value: 59c64737be8bda92b33417dfadca87e9c4662be2 Verifying Hash Integrity ... crc32+ sha1+ OK Booting using the fdt blob at 0x889f9288 Uncompressing Kernel Image Loading Ramdisk to ff4b9000, end ff9fab18 ... OK ^^^^^^^^^^ Using Device Tree in place at 889f9288, end 88a04534 Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 5.10.51 (daniel@box) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 8.4.0 r17073+11-8bb4437c01) 8.4.0, GNU ld (GNU Binutils) 2.34) #0 SMP PREEMPT Mon Jul 19 12:26:15 2021 [ 0.000000] CPU: ARMv7 Processor [410fc073] revision 3 (ARMv7), cr=10c5387d [ 0.000000] CPU: div instructions available: patching division code [ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache [ 0.000000] OF: fdt: Machine model: Bananapi BPI-R2 [ 0.000000] earlycon: uart8250 at MMIO32 0x11004000 (options '') [ 0.000000] printk: bootconsole [uart8250] enabled [ 0.000000] Memory policy: Data cache writealloc [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000080000000-0x00000000afffffff] [ 0.000000] HighMem [mem 0x00000000b0000000-0x00000000ffffefff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000080000000-0x00000000ffffefff] [ 0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x00000000ffffefff] [ 0.000000] 8<--- cut here --- [ 0.000000] Unable to handle kernel paging request at virtual address 3f9fab0c ^^^^^^^^^^ Xf8fabXX looks familiar, see above. Just 3XXXXXXX seems wrong, or at least not where physical memory ended up being mapped in Linux. I also don't understand why U-Boot is reloacing the RAMdisk in first place, shouldn't it be fine to just pass the address where it is loaded inside the FIT structure (0x884b7668)? [ 0.000000] pgd = (ptrval) [ 0.000000] [3f9fab0c] *pgd=00000000 [ 0.000000] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.10.51 #0 [ 0.000000] Hardware name: Mediatek Cortex-A7 (Device Tree) [ 0.000000] PC is at memcmp+0x10/0x50 [ 0.000000] LR is at start_kernel+0x8c/0x508 [ 0.000000] pc : [<c04b8098>] lr : [<c0c00a08>] psr: 200000d3 [ 0.000000] sp : c0d01fc0 ip : 3f9fab0c fp : 00000000 [ 0.000000] r10: 10c5387d r9 : 3f9fab08 r8 : c09c007c [ 0.000000] r7 : 3f9fab18 r6 : c0da1038 r5 : c0d04ec0 r4 : 3f9fab0c [ 0.000000] r3 : 00000023 r2 : 0000000c r1 : c09c007c r0 : 3f9fab0c [ 0.000000] Flags: nzCv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none [ 0.000000] Control: 10c5387d Table: 8000406a DAC: 00000051 [ 0.000000] Process swapper (pid: 0, stack limit = 0x(ptrval)) [ 0.000000] Stack: (0xc0d01fc0 to 0xc0d02000) [ 0.000000] 1fc0: 00000000 00000000 00000000 00000000 c0c28a54 00000000 00000000 c0c00330 [ 0.000000] 1fe0: 00000051 10c0387d 00000000 889f9288 410fc073 00000000 00000000 00000000 [ 0.000000] [<c04b8098>] (memcmp) from [<00000000>] (0x0) [ 0.000000] Code: e3520000 0a00000f e1a0c000 e5d13000 (e5d00000) [ 0.000000] random: get_random_bytes called from print_oops_end_marker+0x24/0x4c with crng_init=0 [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] Kernel panic - not syncing: Fatal exception [ 0.000000] Rebooting in 1 seconds.. [ 0.000000] Reboot failed -- System halted Anyway, all ideas are welcome :) Cheers Daniel

2 2