From 0688a7549bdbb7d023fae9727618e78508e7c85e Mon Sep 17 00:00:00 2001 From: vhaudiquet Date: Sun, 30 Aug 2026 00:32:36 +0200 Subject: [PATCH] stub: fall back to fixed coreboot table address; DTB buffer reads zeros MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 9, hex dump decoded: x0 = 0x5F800000 (= _fit_fdt_start, depthcharge's own FDT buffer; the kernel reserves 5f800000-5f815fff for it) dt[0..3] = all zeros — no FDT magic at payload entry OVL_L0_ADDR = 0xFD536000 (real scanout, top-of-DRAM reserved region) The device-era boot path flattens the fixed-up tree into _fit_fdt_start and hands off that pointer. Why the kernel sees a valid FDT there while the payload sees zeros is open (leading suspicion: cache flush behavior differing with the ~30 MB pmOS kernel vs the 18 KB stub). For the stub this is moot: the coreboot table address is a memlayout constant on this board (0xffed9000, confirmed by the kernel's coreboot driver, sysfs tags and /sys/firmware/fdt). find_coreboot_reg failure now falls back to it instead of halting; the stub no longer depends on the DTB. find_framebuffer failure still dumps the raw LBIO bytes. Payload adbea06f... flashed and verified. host_test and qemu_test pass. --- RESEARCH.md | 29 +++++++++++++++++++++++++++++ krane-fb-stub-payload.bin | Bin 159744 -> 159744 bytes krane-fb-stub.bin | Bin 18976 -> 18912 bytes main.c | 20 +++++++++++++------- 4 files changed, 42 insertions(+), 7 deletions(-) diff --git a/RESEARCH.md b/RESEARCH.md index 803f0ca..66308c8 100644 --- a/RESEARCH.md +++ b/RESEARCH.md @@ -400,6 +400,35 @@ stage, word 15 = raw OVL_L0_ADDR value). Payload `10760e3c…` flashed (cmp + vbutil OK). host_test and qemu_test pass. +## Round 9 — dump decoded: x0's FDT buffer is empty; LBIO fallback + +The hex dump worked. Transcription (`C0DE0001` = DTB stage failure): + + x0 = 0x5F800000 + dt[0..3] = 0, 0, 0, 0 (no FDT magic — buffer is zeros) + OVL_L0_ADDR = 0xFD536000 (real scanout, top-of-DRAM + reserved region, matches + /proc/iomem fae00000-ffdfffff) + +x0 = `_fit_fdt_start` (device-era src/arch/arm/fit.c: the flattened tree +is placed in depthcharge's own `_fit_fdt_start.._fit_fdt_end` buffer and +that pointer is handed off). The kernel later reserves exactly +`5f800000-5f815fff` for its FDT (size ≈ the live fdt's 86738 bytes), so +the pointer is right — but for the payload boot the buffer content reads +as zeros. Why the kernel sees a valid FDT there while the payload sees +zeros is still OPEN (cache/flush difference vs the pmOS kernel boot is +the leading suspicion; the pmOS kernel is ~30 MB vs our 18 KB stub — +decompression footprint differs). For the stub this does not matter: + +**Fallback added**: if `find_coreboot_reg` fails, use the fixed coreboot +table address `0xffed9000` (coreboot memlayout constant on this board; +confirmed by the kernel's own coreboot driver, sysfs tags, and +`/sys/firmware/fdt`). The stub no longer depends on the DTB at all. +`find_framebuffer` failure still dumps the raw LBIO bytes. + +Payload `adbea06f…` flashed (cmp + vbutil OK). host_test and qemu_test +pass. + Recovery: power-cycle, boot USB (unchanged), `dd if=mmcblk0p1-pmos-backup.img of=/dev/mmcblk0p1 bs=4M conv=fsync`. diff --git a/krane-fb-stub-payload.bin b/krane-fb-stub-payload.bin index 7ba97d57c094486b03e666cc88a488d353cf11de..149f2ee6ea33ba9f096592aba57a6a63ddf89a33 100644 GIT binary patch delta 2251 zcmYjS3s6&68vf6{Nl0R(31U^CkN`!&$ASeVv(OwVKJZZ`+*McB2@jpBQER|%HG=m7 zDlFOVa7E2p+Zu5xkJ^#eL5bB0YIW7B3w^HBSrf#fu!{ItK*hWNb(~%A%$e_;|8f3v z{_p?K6?_`Or)ip`~Y&dttsT!BM`gcdB1$DE!o)wvm-#DJePYw(m4*AX8T{YVCGYTK2{It8IKj$;U zw99qVqZcpLC90-O|G4zm@^@$QvmUf@*`wymZ%H4+6h&Z)Q~1w7TBD-&f9z{#(9d z(zV5;yf#iq8MyiI&zX};=5BCq;0N~RHyjFa?7sYiSBTi;aSX(^)h1tdx^@)pQTf&S z*5ZP?^KTt4US1WS-kx>$lXVjwFLoQl*Z-@sOZ7$5mYk6(p2gRmjHNlwCB>J<>EWUK z=&PsB&x|Wm)*e5ZR(Y&`VszfU;;$zLFI%VkX4lXMn*R7tbb~#iyOdwgK6cEeIy9#@wxy;biLqQ>R-F3P#znKgQ_h^S z?z>ud(>iVQj_Vh%ZRs7{y3kx5QZV_ajWxkVKcDDNahmqc&s|XV||p(H2Cp=k?FL>2CQ8mz}Y}$2Uf;FyYV^d z>@xy^^RcAyW!tuA5(j!}jtGMSStkH+Oc+hJ;kr$dbs+NaaO=+fVc?jL$^-w59^9q? zLzg6tLCk!; z1?4@mKWOcyClV*eDMkNI^sjj=CG}+UbZC5OjA%!vv=>fS<;|Wujj)#tNnF}XPRx*$ zRD(API2|L-4a7hgAaNEA&Le@FgWNZxUmmZd z=F&kaNsTvA<4u}S_$WKAfxym=1H-58-$34!8w4xd5}y~S0t-yYsIW#N8gDlg*Z}MY z7~qUZ(fDBMWpW_X=CL@`DCqE2@mDG2Zv7!Z--UE^p&JhrTYT7~c9|W(zjEGTK>Fj)HiI5H4s}*D( zLr1wEE65agmx2T{M!me4%hzLz`B;dPJ7U$%EJ z*nR;^OFQ1!8XWo;RX-bdYI`JsTqE zV7lA{=O%z*Kd9}wSetWWajt*_>@1$UVt~x+21qCwmbe5Jh?X?ymy6V9WPgyyGo;e? z5jZaNNt|{gH8a>jDx_JXr`}GMi3`9?_ADXhS%RujyNQ~6vWZz+glIz)s9B8}W;WnD zAJ^Nc87ipxc7!Ij8xQqs6c0nUvcTJ!Ma(_#5ObUo+tp6YKB?R)VNIlo)T!7@oxWa) zqeiR)HN6jE5X7jLI_Jo;A~p+(G@%g$>}Pr;?m9p}KueGS)LEf={+8gQCwHJ=HQ{(V zEV&~Q@ktQrj4^RmIWNrhRXXZraByLFvlXur8wq+L?4{u>kbS zuUdX6g!nyA{cnc9(q=Fz7`S_@ra6}1gBSA`(n07zQ zHp*RCi}DB0q%rbOBr12sih`Aeg_HAFu3cLQ#}OV delta 2304 zcmX|B3s6+o8UF8M*<}G?Sszr0u7HB1IufL^jl#)dNO<^QS;XQrJQfgp)n>s?fU5T* zXibO?SCpk#Wg%(=b%Z1;w`~N(VA8|~SVJ_nEFdbN4v3B5Ah-X`*fMkY&i&tyZ;#+~ z6`Zb(zf|!btmx;iMtt#R$>XxijU%a%WXHznvA{#$CwLwg9%pT_yp`nUF0E2IrjLGe zv-+!PrPq>uxX^!F`zJ5Nd^%Jf)Vs|%`p<~ilY^@Jp3n7g_YYB~hQ&jL?;ITeBC;>+ zMrCGlUS{yrv8pPKXMgPd50CBk@>rDp>lak^ov&ekWRDMjygf-Oqzmi%F3z04y&A2_g}`xm40pTvlR(aRpCv^(xzIn`M> zG_papGc+!8>#EB9f5g{cjk130GqibsA#+3;*-;lj^0%$_8`-+F_W8*8JwrBR|wy_{jq)*L`c3xA?A0P9d-P-_JO&4bH#vR^eBT^YY$~Xxj87DQw^M z67S6}M~Pt*|7_?bu)}y??bm6=d!O{i`Y<__x8cUwUyn5 zbD7%w&#z9^tex9+bTWF$*};y(J3q)>_AXiXpS0G2PMztz{^3Q!e9Sji9ur#^2JavH zM0NVdlrhJ94_mg2x5E~6O!;3-IiK*W=_T6!Yq>$z-){0SXuP-S`GWNFuF893`Hj&l z)`Z=T3AHbSBh$8Id~#sp=8C4|fS4S6=baH%Q+f5NnPD^DNgSVx8T1l^w z>POl^e93^=&v-SAB~kVF+9{FWUVM@VcDPoSEonYrbB2K=xCmV|BXpTSs0I+a7#hj~ zbJLr_3&boIq`5#3XV{z6R6Om}+Nac%iEdRZxY+)_hVtWM0W8kngXClcX8%>kmB z4i!wC9M^b{fXQg1Cc6WCd?QHQ@uiw?Rbf?~TA0wEd$ku#%#~j~}ia?i3;dkKG z+2BqN#1^F&upXe>L#cFzg_mao3(HDbNbCp(T@7fs46J{zJ0!*}1YTFeLTK%jY&oNY z#1*^76FET1#6U~79OTfR~B zderM*>G7`U8&N*MxP%bn*~8H@&K_2Qsw~5mDVvKi=Nep;f6Og=xt8+bTYwp!hqZO0 z%gaAD*B4XeU6fGwRM|ri2<9<2n4qE990VW*ftOV5|4|nObx-~A+aDZee*zNq*J5*9 z%a?f`?nGiWM52L6X+UvpDzKDlT2qx7vcQ%-0NSmOVH*-L?ittC)F+IN59wtnQH6r& zm84li9A?*ahgmB)%*dK@Pdq%RIe`KTk3$3u$b&0q_!+faFAbJ^4BemvRs0p(Hk@mT z7cugFkk^ko2QFJ_H_MMi)S#>lo3$cQTKvG406bXyf0#d>`E2Kb<1FZuV2^PUN>R=L zrE?3D}hjPD`=tFa-TOLj-t;| zSq|@DiE+WC94=x5e5kfH)rrZ5gUEz;W{~)uyI{_th%pBs{0_fAl(;aKof|=)=_piF;o8DaGfZZ4Y>J^Co1AQmo>aqawx=<8nBIjVZ;( zPZM}^hcigDVzL%=QmW;_jVpeRJHo^z=+utYGSB7kwB=xH{m@iY`;%;m(t-_egsXA% zP3RYo1-*`e_hU!bkXWZtwj1w)7m<$R=mC#PP&EkCiL}>;NbpeX0wlQ_cr=RLYp%mR z8wTt1(g3(xB$WeqcLI&+bVy8dMA(vVDpNVJ-F z!RBDVVnr?i@yA^=TrUz*gGCJ>pB^HY>L|hNKtCt)$-$$u6A9(OWD1!aSeKwLksxx2D-mlv7UJ{g%}>epw7*~hxMS@$VpK@VVE3-reIG-Iuo!!&8;sEc z)1WON#-Sg#XQHMOh1|Hx&AR{X)FFQYfku`hs=6ryF{7psKi!Mxaqmqf8i>GF=k3Jq- Pa-lSyTK?<=p_lv@NkNO@ diff --git a/krane-fb-stub.bin b/krane-fb-stub.bin index 0755eddaa9e79014b46b377fc986e8613c1984bc..e09c5816ef3a56a5c9f3661e8c33ba31f18bf805 100755 GIT binary patch delta 1615 zcmYjSZERCj7=F*aZFgJhXvYv_leQZU*B=A|jccOzP>C=k#@*cn!hRIS4+u9#3L3Fa zdbc4=nwVW`GzOD(BPOhWL=9%w#4tXB@go=-{b54F?HB@^gfJvf-FAHLByl%+^PKa3 zocBHN$GL@%n4M=&1&C^C-e;OzZ$+FQ_*1kB{GJl zW@Iw&x3l3!GE_$0s!U|v>6J{G0+!KmtVA?4#lVYDL1mmQ_HDO%?(BE_zwmRbpm1x5 zxRoNNmxH8{GP=FhImbR*bJsh%y+D+^C3~aJdAo=$a6wj^CF)-UssRN-2)^IL3u^U_ zg6cO4>VpnxxQqZBHt>-Y$-2QvOOZz>*}-Z(JcoXLeKl#e%!>1M&&>*r0z4k7r~Qu1 zAkw6I-jc%poN#1hX6dg(#|P>uy#>O--&Z_3?4sbf5KDk z)rBg3AL7}Tn^m-~^J(59NYV{NH3_9osma_8B?(F!orqbLUY-`(Ug#YYB9?UVc;~c; zd6D*Jq;?FBCb#m+#$=QEqu)?F8RSH>w);l;Xvv`wh}8Q67Z-8|m&NW>J}M8Qo?gZZE%In3yIX>jK3)OFO&z0XkT zmO0m;E;N|Y+NU-E!?%a`r-<}HiL@|Ew6d04(hh1%6%uI$yfKt8HJwPGLW#mWob$k` z0z0Ri=z;WYlsp@1rSxckv`eTv@rIm0bCuCJ*Vj_zhE7%(2KF037}*DaaALm=Tnc;_ zSP#qs!@yqP3gA&72j+kqxK);)DBAg8vkgpib)OpRmCXc6lY>Gm*BBW!Ls!TwpCqf? z%gjb}y1a!(LXJYdEWIM}Mfp{7QVItEtMUc8K6?t|Wy=(Gre;BbOm(cu43bg$RWZ~T znNbt?*iaWXta(0p(5xPW{`ORc^JDHP+7J6T4YF>c*(*EN+XVsz5&^ zO`dUm$}{$)(0CXHcq3JQ!rHz@)&Zc5yffr|7hbOjsL_y%4Ec8>$7NYAI^*^^`1fbU Q66a6x^@w*5H&-kF0>;El4gdfE delta 1704 zcmYjRe`pg|9RJ?EOPZvuHmO5ryP8&KY=p5g%NiK#BNmxfl%9c!`y;KDu5f?Ml>H%D z=UuIKongbXV~#o2Ynft;;$&>}9HXg9Vdw@%WMdP0Y1OKAV^*0~Y;T|E94zqidGGsu z-`}5mPM>6bB0XP1w1ocm3vc@OAob<_E6ln@zBOh)k-1trv!y}aY7hN&p3Heh<`gR# zzQ0Wxx_(|V_0FynIw>;)uA4|Mqm=Us*@oB1$;`;b$@rYe$T68RtJ<4KsD#X23fU`2 zo@wc;_BP5+pzo~rrM|DcOXO?;wwv^gL<#2|vK>az5YeGRi%eBsV+P^piqBAAmyFQj zPYrd^wF5cX84VR|-Org6$H{tA1KeMf~u_bn_min1Vf$ zCm622u$&Znb-zMQ<7+6`Pd=>$x%U=P)23?DgZ&EC3@o^bQ$cDP4N^_Zyql=;l35?8 zdt*;fWSCtQYr%DwUSCRc&Qd-nDReoHz2&;!#uZA9J#Z603VkW`rO))(3;oxS-(cP- zkDWfc{<+gfJ>_*rHJe69%V;*VVoTXb1&ppkl_nK5M7nhlwiRFD}ZHdBf7WjL9C zZ)B)TI+T-)!C5ht2pQ`ALYkAQON|iO5h}5}st)EP8l0`dxr!{cijys!?NY}^f9NPK z;u&U zzu8g)hNXf^hZbY$RG=9WC3Liv;7}*O7JiBWEiY5zI+KTmPhl_aj-k`tB|N5=Q^yo^ zx`p|R4(uxDb^Q=NtscA?EvM9G=&F8w@zKr)dk-H|C@7r$fli2|oRy+-ZcjFnEi1sS zKvXxmjqGzs7(B3@H^~lTpDi2dD0kf>@X;iET!W7u*mV22Zl6O3TE(K`OewL<1O>D( zDjF@K6jvw_FQQ-^3B+F}b05hW;ouS+RJ6C&EiAa}ZnBE#T~<0gn_q2eilHj_$a-Gj zbsK!NuCapG>5^A7FhVc7CGL%fBTw(ixOcH!=XDdTP#XZzzJ$@2u3I~<@Yw1nZmo$5 zY696E4uZ`@_*`gb#Jp5wsBIFDwGq|+2KiO^9rTVVj4?jz4m187dRmHZC&MaVKK7BG@R5E@DJF z6>41%K~MzlhRt~-%O1M5$=4{A{V<*$_}fj?2Pj48;1;z04D1?_&|3KY7zO;fSxC-#3s??J0>i*o;40wTKn~P^4Z!~5Y9b?~FStjN zUmyXDIPfly36e5Y???5MOqZhyoZtC{V(Sey9N5EScYdc>pc6O&G~A+tcljAk#b9HtO`3P2lnr=Bg9jBN_=g#M3^s%IPLkv{J^Z#LCXQN2-8Ao@a7Y t=)Q;Szk5O_VSV>Zwi0_`D`aON6ECS);x(OS1ySELDwxLMo8A6){txS;d5-`9 diff --git a/main.c b/main.c index 563eb0c..ac9c2bb 100644 --- a/main.c +++ b/main.c @@ -401,6 +401,9 @@ static void checkpoint(const struct fbinfo *f, int r, int g, int b) delay_ms(2000); } +#define LBIO_FALLBACK_ADDR 0xffed9000ull /* coreboot memlayout, fixed */ +#define LBIO_FALLBACK_SIZE 0x380 + void cmain(u64 dtb) { struct fbinfo fb; @@ -409,14 +412,17 @@ void cmain(u64 dtb) stage0(); + /* + * NOTE: on this device the FDT buffer depthcharge hands off (x0 = + * _fit_fdt_start = 0x5F800000) reads as all zeros at payload entry, + * so the DTB parse fails (RESEARCH.md Round 9). The coreboot table + * address, however, is fixed by coreboot's memlayout and confirmed + * by the running kernel (sysfs + /sys/firmware/fdt), so fall back + * to it instead of relying on the DTB. + */ if (find_coreboot_reg((const void *)dtb, &lbio_addr, &lbio_size)) { - /* Dump the DTB header words + the x0 pointer itself. */ - const volatile u32 *dt = (const volatile u32 *)dtb; - u32 w[6] = { - (u32)dtb, (u32)(dtb >> 32), - dt[0], dt[1], dt[2], dt[3], - }; - fail_dump(0xC0DE0001u, w, 6); + lbio_addr = LBIO_FALLBACK_ADDR; + lbio_size = LBIO_FALLBACK_SIZE; } u32 l0 = read_scanout_addr();