Closed thchi12 closed 4 years ago
andreiw
commented
5 years ago If you could boot with a debug UEFI build, with serial cable attached, and paste me all messages you see after starting windows, that would be helpful - I want to see if I can at least recognise the version being booted.
You need to go into Device Manager->Rasperry Pi Configuration->HypDxe Configuration and set Debug Log Mask to 0xF.
thchi12
commented
5 years ago Routing SD to SdHost InstallProtocolInterface: 0ACA4444-7AD0-4286-B02E-87FA7E2A5711 0 InstallProtocolInterface: 09576E91-6D3F-11D2-8E39-00A0C969723B 39C84CA0 Loading driver 6B38F7B4-AD98-40E9-9093-ACA2B5A253C4 InstallProtocolInterface: 5B1B31A1-9562-11D2-8E3F-00A0C969723B 391E9D40 add-symbol-file /home/andreiw/src/rpi3/Build/RaspberryPiPkg-AARCH64/DEBUG_GCC5/A ARCH64/MdeModulePkg/Universal/Disk/DiskIoDxe/DiskIoDxe/DEBUG/DiskIoDxe.dll 0x39C 77000 Loading driver at 0x00039C76000 EntryPoint=0x00039C77D3C DiskIoDxe.efi InstallProtocolInterface: BC62157E-3E33-4FEC-9920-2D3B36D750DF 391EAA98 ProtectUefiImageCommon - 0x391E9D40
InstallProtocolInterface: 387477C1-69C7-11D2-8E39-00A0C969723B 39A269C0 InstallProtocolInterface: DD9E7534-7762-4698-8C14-F58517A625AA 39A26AA8 InstallProtocolInterface: 387477C2-69C7-11D2-8E39-00A0C969723B 39A269D8 InstallProtocolInterface: 09576E91-6D3F-11D2-8E39-00A0C969723B 39A34518 InstallProtocolInterface: D3B36F2B-D551-11D4-9A46-0090273FC14D 0 InstallProtocolInterface: D3B36F2C-D551-11D4-9A46-0090273FC14D 0 InstallProtocolInterface: D3B36F2D-D551-11D4-9A46-0090273FC14D 0
ESC (setup), F1 (shell), ENTER (boot)InstallProtocolInterface: 240612B7-A063-11D 4-9A3A-0090273FC14D 391BB020
UsbRootHubInit: root hub 391BBC18 - max speed 2, 1 ports
UsbEnumeratePort: port 0 state - 503, change - 01 on 391BBC18
UsbEnumeratePort: Device Connect/Disconnect Normally
UsbEnumeratePort: new device connected at port 0
UsbEnumerateNewDev: hub port 0 is reset
UsbEnumerateNewDev: device is of 2 speed
UsbEnumerateNewDev: device uses translator (0, 0)
UsbEnumerateNewDev: device is now ADDRESSED at 1
UsbEnumerateNewDev: max packet size for EP 0 is 64
UsbBuildDescTable: device has 1 configures
UsbGetOneConfig: total length is 41
UsbParseConfigDesc: config 1 has 1 interfaces
UsbParseInterfaceDesc: interface 0(setting 0) has 1 endpoints
UsbParseInterfaceDesc: interface 0(setting 1) has 1 endpoints
Data Stage Error for device 0x1: 0x2
RequestType 0x80
Request 0x6
Value 0x300
Index 0x0
Length 0x2
UsbBuildDescTable: get language ID table Unsupported
UsbEnumerateNewDev: device 1 is now in CONFIGED state
UsbSelectConfig: config 1 selected for device 1
UsbSelectSetting: setting 0 selected for interface 0
InstallProtocolInterface: 09576E91-6D3F-11D2-8E39-00A0C969723B 391BAB18
InstallProtocolInterface: 2B2F68D6-0CD2-44CF-8E8B-BBA20B1B5B75 391BADC0
UsbConnectDriver: found a hub device
UsbHubInit: hub 1 has 5 ports
UsbHubInit: hub 1 initialized
UsbBusStart: usb bus started on 391DC998, root hub 391BBC18
BlockSize : 512
LastBlock : E6DFFF
BlockSize : 512
LastBlock : E5CFFF
PartitionValidMbr: Bad MBR partition size EndingLBA(DEB56E8B) > LastLBA(E5CFFF)
BlockSize : 512
LastBlock : E5CFFF
PartitionValidMbr: Bad MBR partition size EndingLBA(DEB56E8B) > LastLBA(E5CFFF)
[Bds]RegisterKeyNotify: 0000/000D 80000000/00 Success
[Bds]OsIndication: 0000000000000000
[Bds]=============Begin Load Options Dumping ...=============
Driver Options:
SysPrep Options:
Boot OUsbEnumeratePort: port 0 state - 101, change - 01 on 391BAD98
UsbEnumeratePort: Device Connect/Disconnect Normally
UsbEnumeratePort: new device connected at port 0
UsbEnumerateNewDev: hub port 0 is reset
UsbEnumerateNewDev: device is of 2 speed
UsbEnumerateNewDev: device uses translator (0, 0)
UsbEnumerateNewDev: device is now ADDRESSED at 2
UsbEnumerateNewDev: max packet size for EP 0 is 64
UsbBuildDescTable: device has 1 configures
UsbGetOneConfig: total length is 39
UsbParseConfigDesc: config 1 has 1 interfaces
UsbParseInterfaceDesc: interface 0(setting 0) has 3 endpoints
Data Stage Error for device 0x2: 0x2
RequestType 0x80
Request 0x6
Value 0x300
Index 0x0
Length 0x2
UsbBuildDescTable: get language ID table Unsupported
UsbEnumerateNewDev: device 2 is now in CONFIGED state
UsbSelectConfig: config 1 selected for device 2
UsbSelectSetting: setting 0 selected for interface 0
InstallProtocolInterface: 09576E91-6D3F-11D2-8E39-00A0C969723B 391B9818
InstallProtocolInterface: 2B2F68D6-0CD2-44CF-8E8B-BBA20B1B5B75 391BC340
UsbConnectDriver: TPL before connect is 8, 391B9898
UsbConnectDriver: TPL after connect is 8
UsbSelectConfig: failed to connect driver Not Found, ignored
ptions:
Boot0000: UiApp 0x0109
Boot0001: USB Port 1 0x0001
Boot0002: USB Port 2 0x0001
Boot0003: USB Port 3 0x0001
Boot0004: USB Port 4 0x0001
Boot0005: uSD on Arasan MMC Host 0x0001
Boot0006: uSD on SD Host 0x0001
Boot0007: UEFI Shell 0x0001
PlatformRecovery Options:
PlatformRecovery0000: Default PlatformRecovery 0x0001
[Bds]=============End Load Options Dumping=============
[Bds]BdsWait ...Zzzzzzzzzzzz...
[Bds]BdsWait(5)..Zzzz...
.[Bds]BdsWait(4)..Zzzz...
.[Bds]BdsWait(3)..Zzzz...
.[Bds]BdsWait(2)..Zzzz...
.[Bds]BdsWait(1)..Zzzz...
..
[Bds]Exit the waiting!
[Bds]Stop Hotkey Service!
[Bds]UnregisterKeyNotify: 000B/0000 Success
[Bds]UnregisterKeyNotify: 0017/0000 Success
[Bds]UnregisterKeyNotify: 0000/000D Success
FSOpen: Open 'RPI_EFI.FD' Success
Variables dumped!
DxeCorePerformanceLib: ACPI Boot Performance Table address = 0x36590000
Memory Previous Current Next
Type Pages Pages Pages
====== ======== ======== ========
09 00000000 00000090 000000B4
0A 00000000 00000000 00000000
00 00000000 00000090 000000B4
06 0000012C 00000370 0000044C
05 00000096 00000290 00000334
03 000003E8 000002C8 000003E8
04 00002EE0 00000E41 00002EE0
01 00000014 00000000 00000014
02 00000000 00000000 00000000
Memory Type Information settings change.
[Bds]Booting USB Port 1
[Bds] Expand VenHw(4BF1704C-03F4-46D5-BCA6-82FA580BADFD)/USB(0x0,0x0)/USB(0x1,0x 0) ->
▒f▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒`>▒▒_▒▒▒▒▒▒0000▒▒T0T0
andreiw
commented
5 years ago Thanks. The stuff at the bottom seems weirdly truncated.
... Matched DBGKD_GET_VERSION64 @ FFFFF803B657EF20 relative to FFFFF803B657EF60 Unknown build 16232, trying to match ....
I was then expecting either "Couldn't locate hal!HalpInterruptRegisterController patch site" or "Invalid hal!HalpInterruptRegisterController patch site". And finally - "Couldn't patch HAL for InterruptControllerBcm".
I can't promise I'll find the time to deal with this old build. The next step is to get a disassembly of hal!HalpInterruptRegisterController. Either through WinDBG or even dumpbin. If I have a disassembly I can at least propose a fix and let you test it...
thchi12
commented
5 years ago So it seems the hal ext needed to make this build to work is missing, like the previous several server builds... it would be great to figure out what makes arm32 iot builds to boot..
andreiw
commented
5 years ago The code to patch was in hal.dll, not an ext... it may be true that this build has no Pi support, yet only a disassembly of the method in question can provide the answer...
A
24 сент. 2018 г., в 1:28, thchi12 notifications@github.com написал(а):
So it seems the hal ext needed to make this build to work is missing, like the previous several server builds...
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
thchi12
commented
5 years ago Maybe we can take a look in arm32 iot hals or recent rs5 hals to get some ideas for booting this?
andreiw
commented
5 years ago I’d start with a disassembly of the specific hal.dll method I mentioned. It may be trivial at that point (or the build really may just not have rpi support!)
It’s an old build tho, right? (I am not saying the chase isn’t worth it, just want to confirm we didn’t regress on some new builds)
A
25 сент. 2018 г., в 0:42, thchi12 notifications@github.com написал(а):
Maybe we can take a look in arm32 iot hals or recent rs5 hals to get some ideas for booting this?
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
andreiw
commented
5 years ago I mean you have windbg/kd... when you get a 5c, reload public syms (it will probably get the hal syms, but nothing else), disassemble the hal!HalpInterruptRegisterController and paste here...
A
25 сент. 2018 г., в 0:42, thchi12 notifications@github.com написал(а):
Maybe we can take a look in arm32 iot hals or recent rs5 hals to get some ideas for booting this?
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
thchi12
commented
5 years ago yes, that's a quite old build which may be detected accidentally..
thchi12
commented
5 years ago it should work. I can boot this in qemu 2.12
andreiw
commented
5 years ago Polite ping for a hal!HalpInterruptRegisterController disassembly, if you have WinDBG going...
A
25 сент. 2018 г., в 1:01, Andrei Warkentin andrey.warkentin@gmail.com написал(а):
hal!HalpInterruptRegisterControlle
thchi12
commented
5 years ago I'll do this later. Since I'm completely noob and what operations should I do to get that?
andreiw
commented
5 years ago Well, you need WinDBG talking to the NT kernel on Pi, but I am assuming you got that far and have debugging turned on in the BCD (since you know about the 0x5C).
Anyway. Set the initial break point (Ctrl-Alt-K in WinDBG), reboot the Pi, and wait for the debugger to break in. Now type "bp hal! HalpInterruptRegisterController" and then "g" to continue (or press "F5"). It should stop at the breakpoint after a little bit of running. Now you can open the disassemble window (or follow instructions in https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/disassembly-window) and just paste code into this bug ticket. Make sure to get to the end.
thchi12
commented
5 years ago Well it gives lots of things.. Which should I paste here?
thchi12
commented
5 years ago No prior disassembly possible
hal!HalpInterruptRegisterController:
fffff803e62f1290 a9bd7bfd stp fp,lr,[sp,#-0x30]! fffff803e62f1294 a90153f3 stp x19,x20,[sp,#0x10]
fffff803e62f1298 a9025bf5 stp x21,x22,[sp,#0x20] fffff803e62f129c 910003fd mov fp,sp
fffff803e62f12a0 97ffe508 bl hal!_security_push_cookie (fffff803e62ea6c0)
fffff803e62f12a4 d10583ff sub sp,sp,#0x160 fffff803e62f12a8 f0000168 adrp x8,hal!HalpCoreDmaAlignment (fffff803e6320000) fffff803e62f12ac 39404108 ldrb w8,[x8,#0x10]
fffff803e62f12b0 aa0003f3 mov x19,x0 fffff803e62f12b4 aa0203f5 mov x21,x2
fffff803e62f12b8 34094888 cbz w8,hal!HalpInterruptRegisterController+0x12938 (fffff803e6303bc8)
fffff803e62f12bc b40949b3 cbz x19,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f12c0 b9400268 ldr w8,[x19] fffff803e62f12c4 7100051f cmp w8,#1
fffff803e62f12c8 54094941 bne hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f12cc b9400668 ldr w8,[x19,#4] fffff803e62f12d0 7103611f cmp w8,#0xD8
fffff803e62f12d4 540948e1 bne hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f12d8 b940c66c ldr w12,[x19,#0xC4] fffff803e62f12dc 7216559f tst w12,#0xFFFFFC00
fffff803e62f12e0 54094881 bne hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f12e4 b940be6d ldr w13,[x19,#0xBC] fffff803e62f12e8 3409484d cbz w13,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0) fffff803e62f12ec 51000da8 sub w8,w13,#3
fffff803e62f12f0 7100051f cmp w8,#1 fffff803e62f12f4 540946e8 bhi hal!HalpInterruptRegisterController+0x12940 (fffff803e6303bd0) fffff803e62f12f8 b940c266 ldr w6,[x19,#0xC0]
fffff803e62f12fc 310004df cmn w6,#1 fffff803e62f1300 54094780 beq hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0) fffff803e62f1304 2a0603e0 mov w0,w6
fffff803e62f1308 97ffe9ee bl hal!HalpInterruptLookupController (fffff803e62ebac0)
fffff803e62f130c b5094660 cbnz x0,hal!HalpInterruptRegisterController+0x12948 (fffff803e6303bd8)
fffff803e62f1310 f9402e68 ldr x8,[x19,#0x58] fffff803e62f1314 b40946e8 cbz x8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0) fffff803e62f1318 f9403268 ldr x8,[x19,#0x60]
fffff803e62f131c b40946a8 cbz x8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f1320 f9402268 ldr x8,[x19,#0x40] fffff803e62f1324 b4094668 cbz x8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0) fffff803e62f1328 3600006c tbz x12,#0,hal!HalpInterruptRegisterController+0xa4 (fffff803e62f1334) fffff803e62f132c f9400668 ldr x8,[x19,#8]
fffff803e62f1330 b4094608 cbz x8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f1334 f9400a68 ldr x8,[x19,#0x10] fffff803e62f1338 b40945c8 cbz x8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0) fffff803e62f133c 360800ac tbz x12,#1,hal!HalpInterruptRegisterController+0xc0 (fffff803e62f1350) fffff803e62f1340 f9400e68 ldr x8,[x19,#0x18]
fffff803e62f1344 b4094568 cbz x8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0)
fffff803e62f1348 b940ca68 ldr w8,[x19,#0xC8] fffff803e62f134c 34094528 cbz w8,hal!HalpInterruptRegisterController+0x12960 (fffff803e6303bf0) fffff803e62f1350 b940d668 ldr w8,[x19,#0xD4]
fffff803e62f1354 35094468 cbnz w8,hal!HalpInterruptRegisterController+0x12950 (fffff803e6303be0)
fffff803e62f1358 910323e8 add x8,sp,#0xC8 fffff803e62f135c 52800967 mov w7,#0x4B
fffff803e62f1360 f90003e8 str x8,[sp] fffff803e62f1364 52800005 mov w5,#0
fffff803e62f1368 52800024 mov w4,#1 fffff803e62f136c 53003da3 uxth w3,w13
fffff803e62f1370 52880002 mov w2,#0x4000 fffff803e62f1374 52800001 mov w1,#0
fffff803e62f1378 18000d80 ldr w0,hal!HalpInterruptRegisterController+0x298 (fffff803e62f1528)
andreiw
commented
5 years ago Indeed, can you disassemble at least past HalpInterruptRegisterController+80 (everything before)
A
27 сент. 2018 г., в 6:42, thchi12 notifications@github.com написал(а):
`` Well I think we still have the chance to boot this...
— You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.
andreiw
commented
5 years ago Okay I think I see a plausible chunk of code here... I'll reach out later today with a test build for you to try!
Checked with windbg and got a 0x5C. Files are available on uup.rg-adguard.net Just wondering this version doesn't include the hal ext needed or there's sth to do with the firmware. I'm using the 9.18 uefi.