[PATCH] ramips: fix Unifi 6 Lite boot failure with v5.15 kernels

Bjørn Mork bjorn at mork.no
Thu Nov 3 10:54:47 PDT 2022 

The Unifi 6 Lite U-Boot does not relocate the Device Tree Blobs
found in the FIT image.  It behaves as if fdt_high is set to
0xffffffff whether or not this variable is defined.

Kernel commit 79edff12060f ("scripts/dtc: Update to upstream
version v1.6.0-51-g183df9e9c2b9"), included in v5.12, imported
dtc commit 5e735860c478 ("libfdt: Check for 8-byte address
alignment in fdt_ro_probe_()") into the kernel

The result is that we must ensure that the "data" property of
all the "flat_dt" type images is 8 byte aligned inside the FIT

There is currently no provision in mkimage or dtc for aligning
properties with the blob.  They are naturally 4 byte aligned.
Giving us 50% probability of a soft bricking image.

Work around the missing aligment features in mkimage and dtc
by padding the kernel image and rerunning mkimage if the first
attempt failed.

Example boot log when using a misaligned FIT image:

reading kernel 0 from: 0x1d0000, size: 0x002d5000
   Using 'config at 1' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel-1' kernel subimage
     Description:  MIPS OpenWrt Linux-5.15.76
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x860000e4
     Data Size:    2956005 Bytes = 2.8 MiB
     Architecture: MIPS
     OS:           Linux
     Load Address: 0x80001000
     Entry Point:  0x80001000
     Hash algo:    crc32
     Hash value:   e1bc9460
     Hash algo:    sha1
     Hash value:   6510c4ada31aeea81f2e8e537f78cb367e1c7fab
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Using 'config at 1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  MIPS OpenWrt ubnt_unifi-6-lite device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x862d1d0c
     Data Size:    11387 Bytes = 11.1 KiB
     Architecture: MIPS
     Hash algo:    crc32
     Hash value:   16bb5a14
     Hash algo:    sha1
     Hash value:   40f26bf28e33bbe661fec716929f2003301f5e4d
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x862d1d0c
   Uncompressing Kernel Image ... OK
   Using Device Tree in place at 862d1d0c, end 862d7986
[    0.000000] Linux version 5.15.76 (bjorn at canardo) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 11.3.0 r21167-1673b7dca384) 11.3.0, GNU ld (GNU Binutils) 2.37) #0 SMP Wed Nov 2 15:53:34 2022
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] OF: fdt: No valid device tree found, continuing without
[    0.000000] percpu: Embedded 11 pages/cpu s15632 r8192 d21232 u45056
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64960
[    0.000000] Kernel command line: rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Writing ErrCtl register=0004a000
[    0.000000] Readback ErrCtl register=0004a000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 248504K/262144K available (7250K kernel code, 660K rwdata, 1536K rodata, 1228K init, 242K bss, 13640K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] Kernel panic - not syncing: Failed to find mediatek,mt7621-sysc node
[    0.000000] Rebooting in 1 seconds..
[    0.000000] Reboot failed -- System halted

Signed-off-by: Bjørn Mork <bjorn at mork.no>
---
The code below will probably look stupid to anyone with a clue. but I
hope it serves as an illustration of what we need to do.  I'd appreciate
it if anyone can teach me
 - how to do alignment inside a FIT using mkimage, or
 - how to find the position of the embedded fdt blobs in the FIT, or
 - how to check whether a value is aligned

In any case,  believe fixing this ASAP is critical. As it is now, any
image with a 5.15 kernel is just as likely to brick the device as is to
boot.


 target/linux/ramips/image/mt7621.mk | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 3ef4cf4efb8f..e3b11abd14ce 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -132,6 +132,23 @@ define Build/zyxel-nwa-fit
 	@mv $@.new $@
 endef
 
+define Build/fit-dtalign
+	$(TOPDIR)/scripts/mkits.sh \
+		-D $(DEVICE_NAME) -o $@.its -k $@ \
+		-C $(word 1,$(1)) \
+		-d $(word 2,$(1)) \
+		-a $(KERNEL_LOADADDR) -e $(if $(KERNEL_ENTRY),$(KERNEL_ENTRY),$(KERNEL_LOADADDR)) \
+		-c $(if $(DEVICE_DTS_CONFIG),$(DEVICE_DTS_CONFIG),"config-1") \
+		-A $(LINUX_KARCH) -v $(LINUX_VERSION)
+	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f $@.its $@.new
+	( pos=$$(grep -aob $$(echo -ne  "\xd0\x0d\xfe\xed") $@.new | cut -f1 -d: | tail -1); \
+	  if [ "$$pos" -ne "$$((8*($$pos/8)))" ]; then \
+			dd if=/dev/zero bs=4 count=1 >> $@; \
+			PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f $@.its $@.new; \
+	  fi )
+	@mv $@.new $@
+endef
+
 define Device/dsa-migration
   DEVICE_COMPAT_VERSION := 1.1
   DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
@@ -1960,7 +1977,7 @@ define Device/ubnt_unifi-6-lite
   DEVICE_MODEL := UniFi 6 Lite
   DEVICE_DTS_CONFIG := config at 1
   DEVICE_PACKAGES += kmod-mt7603 kmod-mt7915e
-  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL := kernel-bin | lzma | fit-dtalign lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   IMAGE_SIZE := 15424k
 endef
 TARGET_DEVICES += ubnt_unifi-6-lite
-- 
2.30.2

More information about the openwrt-devel mailing list