Skip to content

abootimg: Fix gzip decompressed kernel size passed to load_image() - #15

Merged
quic-kdybcio merged 1 commit into
qualcomm:mainfrom
shawngsc:abooting-decompress-fix
Apr 13, 2026
Merged

abootimg: Fix gzip decompressed kernel size passed to load_image()#15
quic-kdybcio merged 1 commit into
qualcomm:mainfrom
shawngsc:abooting-decompress-fix

Conversation

@shawngsc

@shawngsc shawngsc commented Apr 9, 2026

Copy link
Copy Markdown

gzip_decompress() was discarding the out_consumed return value from miniz_oxide's decompress(), leaving FastbootBuffer::len set to the full 128 MiB allocation. load_image() then passed that oversized buffer to UEFI's LoadImage, causing it to fail with LOAD_ERROR since the trailing zeroes don't constitute a valid PE image.

Fix by returning out_consumed from gzip_decompress() and updating kernel.len to the actual decompressed size before calling load_image().

It fixes the failure below seen on qcs9100-ride when booting Image.gz built into abootimg.

Dev_Common_Speed: Dev Bus Speed: Super, state 2
Allocated E18000 bytes
Response: DATA00E18000 (12)
Response: OKAY (4)
kernel: 0xBA5780@0x1000
ramdisk: 0x240224@0xBA7000
dtb: 0x2FBDC@0xDE8000
ERROR: Encountered NULL ImageContext
Error: Failed to load kernel image

Fixes: 87a7388 ("abootimg: Implement decompress")

gzip_decompress() was discarding the out_consumed return value from
miniz_oxide's decompress(), leaving FastbootBuffer::len set to the full
128 MiB allocation. load_image() then passed that oversized buffer to
UEFI's LoadImage, causing it to fail with LOAD_ERROR since the trailing
zeroes don't constitute a valid PE image.

Fix by returning out_consumed from gzip_decompress() and updating
kernel.len to the actual decompressed size before calling load_image().

It fixes the failure below seen on qcs9100-ride when booting Image.gz
built into abootimg.

  Dev_Common_Speed: Dev Bus Speed: Super, state 2
  Allocated E18000 bytes
  Response: DATA00E18000 (12)
  Response: OKAY (4)
  kernel: 0xBA5780@0x1000
  ramdisk: 0x240224@0xBA7000
  dtb: 0x2FBDC@0xDE8000
  ERROR: Encountered NULL ImageContext
  Error: Failed to load kernel image

Fixes: 87a7388 ("abootimg: Implement decompress")
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
@quic-kdybcio

Copy link
Copy Markdown
Contributor

causing it to fail with LOAD_ERROR since the trailing zeroes don't constitute a valid PE image

Hm, interesting.. I've been running GZ-compressed kernels for quite a while and haven't seen this issue. May it be that I just got lucky.. Do you have CONFIG_EFI(_STUB)=y?

@shawngsc

shawngsc commented Apr 9, 2026

Copy link
Copy Markdown
Author

Hm, interesting.. I've been running GZ-compressed kernels for quite a while and haven't seen this issue. May it be that I just got lucky.. Do you have CONFIG_EFI(_STUB)=y?

Yes, I have the options.

@quic-kdybcio

Copy link
Copy Markdown
Contributor

FWIW the PR looks good, but for reference could you do xxd -e arch/arm64/boot/Image | head -n 30 on an image that failed to load?

Here's one that didn't:

00000000: fa405a4d 15456427 00000000 00000000  MZ@.'dE.........
00000010: 06590000 00000000 0000000a 00000000  ..Y.............
00000020: 00000000 00000000 00000000 00000000  ................
00000030: 00000000 00000000 644d5241 00000040  ........ARMd@...
00000040: 00004550 0002aa64 00000000 00000000  PE..d...........
00000050: 00000000 020600a8 1402020b 05250000  ..............%.
00000060: 01330000 00000000 051db500 00010000  ..3.............
00000070: 00000000 00000000 00010000 00000200  ................
00000080: 00000000 00000003 00000000 00000000  ................
00000090: 06590000 00010000 00000000 0100000a  ..Y.............
000000a0: 00000000 00000000 00000000 00000000  ................
000000b0: 00000000 00000000 00000000 00000000  ................
000000c0: 00000000 00000007 00000000 00000000  ................
000000d0: 00000000 00000000 00000000 00000000  ................
000000e0: 00000000 00000000 00000000 00000000  ................
000000f0: 00000000 00000000 052887d8 0000001c  ..........(.....
00000100: 7865742e 00000074 05250000 00010000  .text.....%.....
00000110: 05250000 00010000 00000000 00000000  ..%.............
00000120: 00000000 60000020 7461642e 00000061  .... ..`.data...
00000130: 01330000 05260000 006f4a00 05260000  ..3...&..Jo...&.
00000140: 00000000 00000000 00000000 c0000040  ............@...
00000150: 00000040 d503201f d503201f d503201f  @.... ... ... ..
00000160: d503201f d503201f d503201f d503201f  . ... ... ... ..
00000170: d503201f d503201f d503201f d503201f  . ... ... ... ..
00000180: d503201f d503201f d503201f d503201f  . ... ... ... ..
00000190: d503201f d503201f d503201f d503201f  . ... ... ... ..
000001a0: d503201f d503201f d503201f d503201f  . ... ... ... ..
000001b0: d503201f d503201f d503201f d503201f  . ... ... ... ..
000001c0: d503201f d503201f d503201f d503201f  . ... ... ... ..
000001d0: d503201f d503201f d503201f d503201f  . ... ... ... ..

@shawngsc

shawngsc commented Apr 9, 2026

Copy link
Copy Markdown
Author

Here is the one that failed.

00000000: fa405a4d 145fc83b 00000000 00000000   MZ@.;._.........
00000010: 022f0000 00000000 0000000a 00000000   ../.............
00000020: 00000000 00000000 00000000 00000000   ................
00000030: 00000000 00000000 644d5241 00000040   ........ARMd@...
00000040: 00004550 0002aa64 00000000 00000000   PE..d...........
00000050: 00000000 020600a0 1402020b 018c0000   ................
00000060: 00a20000 00000000 01872d0c 00010000   .........-......
00000070: 00000000 00000000 00010000 00000200   ................
00000080: 00000000 00000003 00000000 00000000   ................
00000090: 022f0000 00010000 00000000 0100000a   ../.............
000000a0: 00000000 00000000 00000000 00000000   ................
000000b0: 00000000 00000000 00000000 00000000   ................
000000c0: 00000000 00000006 00000000 00000000   ................
000000d0: 00000000 00000000 00000000 00000000   ................
000000e0: 00000000 00000000 00000000 00000000   ................
000000f0: 00000000 00000000 7865742e 00000074   .........text...
00000100: 018c0000 00010000 018c0000 00010000   ................
00000110: 00000000 00000000 00000000 60000020   ............ ..`
00000120: 7461642e 00000061 00a20000 018d0000   .data...........
00000130: 00968a00 018d0000 00000000 00000000   ................
00000140: 00000000 c0000040 d503201f d503201f   ....@.... ... ..
00000150: d503201f d503201f d503201f d503201f   . ... ... ... ..
00000160: d503201f d503201f d503201f d503201f   . ... ... ... ..
00000170: d503201f d503201f d503201f d503201f   . ... ... ... ..
00000180: d503201f d503201f d503201f d503201f   . ... ... ... ..
00000190: d503201f d503201f d503201f d503201f   . ... ... ... ..
000001a0: d503201f d503201f d503201f d503201f   . ... ... ... ..
000001b0: d503201f d503201f d503201f d503201f   . ... ... ... ..
000001c0: d503201f d503201f d503201f d503201f   . ... ... ... ..
000001d0: d503201f d503201f d503201f d503201f   . ... ... ... ..

@quic-kdybcio

Copy link
Copy Markdown
Contributor

I don't know for sure and I don't really want to spend more time digging, but..

I would guesstimate that my image having the section table (starts with .text in the hexdump) 16B-aligned may be the difference and the bootloader may be making some assumptions about that.. I couldn't find confirmation on the MS docs site, but the interested reader could probably read the sources behind LoadImage in EDK2 and get the answer

seems like that's a combination of CONFIG_EFI_DEBUG=n and CONFIG_ARM64_BTI_KERNEL=y that makes it be aligned like this

@quic-kdybcio
quic-kdybcio merged commit ae5a1ab into qualcomm:main Apr 13, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants