Hi Igor,

On 2026-10-11T13:10:26, Igor Opaniuk <[email protected]> wrote:
> bootm: set os.arch for Android boot images
>
> bootm_find_os() leaves images.os.arch at IH_ARCH_INVALID for Android boot
> images, so the arm64 Image relocation in bootm_load_os() (booti_setup()) is
> skipped. An uncompressed kernel from a v3/v4 boot image is then executed in
> place at boot.img + page size, which is not 2 MiB aligned. The kernel
> reports "Kernel image misaligned at boot, please fix your bootloader!" and
> dies early (observed as a stack overflow in start_kernel() with a GKI 6.12
> kernel on QEMU virt).
>
> Mark the kernel with the default architecture, like the legacy and FIT
> paths effectively do, so booti_setup() moves it to a properly aligned
> address.

The legacy and FIT paths read the arch from the image header rather
than using a default. Please can you say that the Android header has
no arch field, so IH_ARCH_DEFAULT is the best we can do? Also, the
in-place case is not specific to v3/v4:
android_image_get_kernel_addr() returns kernel_ptr for any
uncompressed kernel with the default kernel address, or with
ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR set.

>
> Signed-off-by: Igor Opaniuk <[email protected]>
>
> boot/bootm.c | 1 +
>  1 file changed, 1 insertion(+)

> diff --git a/boot/bootm.c b/boot/bootm.c
> @@ -432,6 +432,7 @@ static int bootm_find_os(const char *cmd_name, const char 
> *addr_fit)
> +             images.os.arch = IH_ARCH_DEFAULT;

Just to check, have you looked beyond arm64? Perhaps it would be safer
to limit this to arm64 with IS_ENABLED(CONFIG_ARM64), or explain in
the commit message why it is safe. What do you think?

BTW, for a v0-v2 image whose ramdisk is used in place, booti_setup()
can now move the kernel forward by up to 2 MiB. The memmove() copies
image_size bytes, which includes BSS, so it overwrites the start of
the ramdisk that follows the kernel in boot.img. Executing in place
already has a similar problem, since the kernel clears its BSS early,
so this is not a regression, but it may be worth a note. The following
LMB reservation also still covers the old load range rather than the
relocated one, but that already happens with FIT.

Reviewed-by: Simon Glass <[email protected]>

Regards,
Simon

Reply via email to