diff mbox series

[wrynose,38/60] qemuriscv.inc: default to fw_dynamic.elf as QEMU BIOS

Message ID cfb8875e37a46b88b9ad1f3756a348d005394420.1791707817.git.yoann.congal@smile.fr
State New
Headers show
Series [wrynose,01/60] glibc: set status for CVE-2011-0536 and CVE-2025-0577 | expand

Commit Message

Yoann Congal Oct. 11, 2026, 8:40 a.m. UTC 
From: Harish Sadineni <Harish.Sadineni@windriver.com>

QEMU RISC-V can hang at boot when using fw_jump.elf as the BIOS if
the kernel Image is large enough to overlap the memory region where
the FDT (device tree blob) is loaded. This was observed with
KERNEL_DEBUG-enabled 6.18 kernel builds, which inflate the Image
size (e.g. ~27M -> ~33M on qemuriscv64), but the underlying issue is
not specific to KERNEL_DEBUG or to any one kernel version, it is a
property of fw_jump.elf's fixed compile-time boot address layout
which does not adapt to a larger next-stage image.

This was confirmed by dumping guest memory from the QEMU monitor at
the kernel load address and finding the FDT magic number
(0xd00dfeed, see scripts/dtc/libfdt/fdt.h) sitting where kernel code
should be, i.e. the DTB and Image had started to overlap [1].

fw_dynamic.elf instead receives next-stage boot information at
runtime from the prior boot stage rather than assuming a fixed
address, avoiding this overlap.

[1] https://lists.openembedded.org/g/openembedded-core/message/246090

[YOCTO #16409]

Suggested-by: Trevor Gamblin <tgamblin@baylibre.com>
Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 51b72fb2e8917a8627023f419b27a1d83132a361)
Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/conf/machine/include/riscv/qemuriscv.inc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/meta/conf/machine/include/riscv/qemuriscv.inc b/meta/conf/machine/include/riscv/qemuriscv.inc
index bac376ce5a8..d8522fd552e 100644
--- a/meta/conf/machine/include/riscv/qemuriscv.inc
+++ b/meta/conf/machine/include/riscv/qemuriscv.inc
@@ -29,7 +29,10 @@  QB_SMP ?= "-smp 4"
 QB_KERNEL_CMDLINE_APPEND = "earlycon=sbi"
 QB_CPU:riscv64 ?= "-cpu rva23s64,pmp=true"
 QB_MACHINE = "-machine virt"
-QB_DEFAULT_BIOS = "fw_jump.elf"
+# fw_jump.elf's memory layout can be overrun by a sufficiently large kernel Image,
+# causing it to overlap the FDT load address and hang QEMU at boot (see [YOCTO #16409]),
+# so use fw_dynamic.elf in that case instead, which avoids the overlap.
+QB_DEFAULT_BIOS = "fw_dynamic.elf"
 QB_TAP_OPT = "-netdev tap,id=net0,ifname=@TAP@,script=no,downscript=no"
 QB_NETWORK_DEVICE = "-device virtio-net-device,netdev=net0,mac=@MAC@"
 QB_ROOTFS_OPT = "-drive id=disk0,file=@ROOTFS@,if=none,format=raw -device virtio-blk-device,drive=disk0"