From 1a2c26aab4a4818b5da7fbe5fc9e98076518fdc0 Mon Sep 17 00:00:00 2001 From: davidmonterocrespo24 Date: Sat, 16 May 2026 06:46:04 +0200 Subject: [PATCH] fix(pi3): decompressed kernel + explicit earlycon PL011 address MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two more defects making Pi 3 boot silently: 1. The kernel8.img that ships in the Pi OS armhf boot partition is a gzip-compressed PE-COFF Image (first 4 bytes 0x1f8b0800). QEMU's `-kernel` does NOT auto-decompress; it tries to execute the gzip header as ARM code and the CPU faults immediately. Result: zero bytes on ttyAMA0, simulator looks dead. Switch the asset_id to a pre-decompressed kernel (24 MiB raw vs 9.7 MiB gzipped) so QEMU gets a valid Image to boot. 2. Even with a real kernel, the original cmdline `console=ttyAMA0` alone wasn't enough — the kernel can't initialise the BCM2837 PL011 UART early enough for `printk` to reach the serial console under QEMU's bare-metal boot (no Pi firmware to set it up beforehand). Adding `earlycon=pl011,mmio32,0x3f201000` makes the kernel program the UART itself in the early boot path. Verified: boot output starts streaming within 100 ms of QEMU launch instead of never. The cmdline also locks the baud rate at 115200 to match the agetty drop-in created by scripts/configure-pi3-autologin.sh. --- .../app/services/boot_images/manifest.json | 6 +++--- backend/app/services/qemu_manager.py | 21 +++++++++++++------ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/backend/app/services/boot_images/manifest.json b/backend/app/services/boot_images/manifest.json index 2c688c27..ecbad73b 100644 --- a/backend/app/services/boot_images/manifest.json +++ b/backend/app/services/boot_images/manifest.json @@ -8,9 +8,9 @@ { "name": "kernel8.img", "asset_id": "kernel8-pi3", - "sha256": "495bf3ec05ad1de29cb884ec3d5e89bfc824740f537d40cbe6be59ee1cdc6ef9", - "size_bytes": 9695883, - "version": "2026-04-21" + "sha256": "2f87328ab8d36c266ac0545e59a7eed53841e146a75e0010929d3dafd0209310", + "size_bytes": 24367616, + "version": "2026-03-11+raw" }, { "name": "bcm2710-rpi-3-b.dtb", diff --git a/backend/app/services/qemu_manager.py b/backend/app/services/qemu_manager.py index 04ef8df4..be805166 100644 --- a/backend/app/services/qemu_manager.py +++ b/backend/app/services/qemu_manager.py @@ -184,13 +184,22 @@ class QemuManager: # ttyAMA1 → GPIO shim protocol '-serial', f'tcp:127.0.0.1:{inst.gpio_port},server,nowait', '-append', + # earlycon=pl011,mmio32,0x3f201000 — without explicit address + # the kernel doesn't initialise the BCM2837 PL011 UART early + # enough for any output to reach ttyAMA0; we get a silent + # boot followed by a "broken simulator" report. The address + # matches the BCM2837 SoC peripheral mapping (Pi 3 base + # 0x3f000000 + PL011 offset 0x201000). + # # No `quiet`: surface kernel boot messages to ttyAMA0 so the - # user sees progress while the 5.4 GiB Pi OS rootfs comes up - # (~30-60 s wall on a QEMU-emulated Cortex-A53 quad). No - # `init=/bin/sh`: let systemd run normally so a real - # `serial-getty@ttyAMA0` lands the user at a login prompt - # instead of a silent non-interactive shell. - 'console=ttyAMA0 root=/dev/mmcblk0p2 rootwait rw ' + # user sees progress while the 5.4 GiB Pi OS rootfs comes up. + # No `init=/bin/sh`: let systemd run normally; the SD image + # ships with a serial-getty@ttyAMA0 autologin drop-in (baked + # by scripts/configure-pi3-autologin.sh) so the user lands + # at a root shell without credentials. + 'earlycon=pl011,mmio32,0x3f201000 ' + 'console=ttyAMA0,115200 ' + 'root=/dev/mmcblk0p2 rootwait rw ' 'dwc_otg.lpm_enable=0', ]