[From nobody Fri Nov 13 14:33:08 2026
Received: (at submit) by bugs.debian.org; 22 Jun 2026 12:02:40 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-15.1 required=4.0 tests=BAYES_00,
 BODY_INCLUDES_PACKAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,
 DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD,HAS_PACKAGE,SPF_HELO_NONE,
 SPF_PASS autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 97; hammy, 146; neutral, 319; spammy,
 4. =?UTF-8?Q?spammytokens:1.000-5--u8:=E5=B7=AE,
 _1.000-2--u8:=E6=88=AA, ?= 0.995-1--H*F:N*Zheng, 
 =?UTF-8?Q?0.990-+--u8:=E6=95=AC?= hammytokens:0.000-+--trixie,
 0.000-+--UD:kernel.org, 
 0.000-+--riscv64, 0.000-+--sk:cdimage, 0.000-+--grubcommon
Return-path: <lufei.zheng@spacemit.com>
Received: from va-2-29.ptr.blmpb.com ([209.127.231.29]:19486)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128)
 (Exim 4.96) (envelope-from <lufei.zheng@spacemit.com>)
 id 1wbdML-00FEW7-30 for submit@bugs.debian.org;
 Mon, 22 Jun 2026 12:02:40 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
 s=feishu2303021642; d=spacemit.com; t=1782128810; h=from:subject:
 mime-version:from:date:message-id:subject:to:cc:reply-to:content-type:
 mime-version:in-reply-to:message-id;
 bh=u6I4PcwqeDZiaoCKYWvM0swpvuXMuRBdOmjmSrQiTgo=;
 b=jpfe1QqJtiqRfY/iyHpORuuqzmvviuKsMZ0wvHjcdm77h+hUemppppdwii+7qbASaZYvdY
 khP7HkUJL6idlx6sDH1VpUeuOWn+6Ugi82/uF4tNmdbp/n8QmQc/4hGzGmwzy/jehnw0My
 Tse42G35CRmHcWDQ+tAk5ldEuL/0HRgyhJOyvB288k1zfWQL8FW+T2VWHYPdthd7LnkeF2
 7EvEAZHoytrfucIXbo94aKxBtCkaatRwEtCCCrAX18QsXYwvJWC618mXkyHBJ1V9njgUti
 I1TWwOA95g4wnLgIlcQNwBuEp//g/9STZCriXeTLOaqpc6uH2CGBNqLdiXQWyA==
To: "submit@bugs.debian.org" <submit@bugs.debian.org>
X-Lms-Return-Path: <lba+16a3920a8+37d843+bugs.debian.org+lufei.zheng@spacemit.com>
From: "Lufei Zheng" <lufei.zheng@spacemit.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Date: Mon, 22 Jun 2026 19:46:48 +0800
Message-Id: <446002886bbbf01e9217ad222d686ef2ad1051a8.c31b1537.106f.4d66.8fa8.2b86cb1e6403@feishu.cn>
Subject: grub-efi-riscv64: relocation overflow crash on systems with
 multi-range memory layout (>4GB RAM)
X-Greylist: delayed 931 seconds by postgrey-1.37 at buxtehude;
 Mon, 22 Jun 2026 12:02:37 UTC
Delivered-To: submit@bugs.debian.org

Package: grub-efi-riscv64
Version: 2.12-9+deb13u2
Severity: grave
Tags: upstream

grub-efi-riscv64: relocation overflow crash on systems with multi-range mem=
ory layout (>4GB physical RAM)

-- System Information:
Hardware: SpacemiT V100-C2201 (RISC-V, SpacemiT V100 SoC)
Debian Release: 13 (trixie)
APT: APT version 3.x
Kernel: 6.12.86+deb13-riscv64 (riscv64)
Locale: (not relevant)

-- Description:

When booting the Debian riscv64 DVD installer (from
https://cdimage.debian.org/debian-cd/current/riscv64/iso-dvd/) on a
SpacemiT V100 RISC-V server (128 GB RAM), GRUB crashes immediately
with "relocation overflow" before loading any menu or kernel.

Running grubriscv64.efi from the UEFI shell produces:

=C2=A0 InstallProtocolInterface: 752F3136-4E16-4FDC-A22A-E5F46812F4CA 83FFF=
720
=C2=A0 CpuSetMemoryAttributes: Set memory attributes not supported yet
=C2=A0 relocation overflow
=C2=A0 Aborted. Press any key to exit

This is a known upstream bug in grub-core/kern/riscv/dl.c,
grub_arch_dl_relocate_symbols(), where R_RISCV_CALL / R_RISCV_CALL_PLT
relocation handling checks:

=C2=A0 if (off !=3D (grub_int32_t) off)
=C2=A0=C2=A0=C2=A0 return grub_error (GRUB_ERR_BAD_MODULE, "relocation over=
flow");

The offset `off =3D sym_addr - (grub_addr_t) place` overflows int32 because
UEFI allocates GRUB's EFI image in high memory (above 4 GB) when the
physical address space contains a multi-range layout.

-- Memory layout on this machine:

The SpacemiT V100 has 128 GB RAM exposed via ACPI SRAT as two NUMA nodes
with non-contiguous ranges:

=C2=A0 Node 0: [mem 0x00000000-0xffffffff] (first 4 GB, with holes)
=C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0 [mem 0xc0100000000-0xc0fffffffff] (=
range above 768 GB)
=C2=A0 Node 1: [mem 0xe0000000000-0xe0fffffffff]

Because the low 4 GB region is heavily fragmented by firmware/MMIO
reservations, UEFI places the GRUB EFI image at an address such as
0xBDCCB000 (per the log above =E2=80=94 still within 32-bit range on this
machine, but the loaded modules end up relocated far above), causing
the R_RISCV_CALL relocation offset to exceed =C2=B12 GB.

This is documented in the upstream RISC-V initiative tracker:
=C2=A0 https://lf-rise.atlassian.net/wiki/spaces/HOME/pages/8586141/DI_01_0=
1+GRUB+-+Relocation+overflow+on+RISC-V+with+multi-range+memory+layout

And the related LKML thread:
=C2=A0 https://lore.kernel.org/all/CAKmqyKMtAzt5saCUMd4vXYfgAQibpzQJAhtTSuS=
b+yeKhcYpfw@mail.gmail.com/T/

-- Impact:

The Debian riscv64 installer is completely unbootable on RISC-V
systems with large RAM (e.g., SpacemiT V100, or any system where UEFI
may allocate GRUB's image or its modules outside the =C2=B12 GB window of
each other).

-- Steps to reproduce:

1. Download https://cdimage.debian.org/debian-cd/current/riscv64/iso-dvd/
2. Write to USB or mount the ISO
3. Boot on a SpacemiT V100 (or similar RISC-V system with >4 GB RAM
=C2=A0=C2=A0 and fragmented low memory)
4. GRUB immediately crashes with "relocation overflow"

-- Fix:

The fix requires GRUB to emit a PLT/trampoline for R_RISCV_CALL
relocations that cannot be satisfied within =C2=B12 GB, similar to how
other architectures handle out-of-range relocations. The upstream RISC-V
RISE initiative (project DI_01_01) is tracking this fix.

A workaround may be to link GRUB as a position-independent image or
to ensure the EFI memory allocator keeps all GRUB code and modules
within a contiguous =C2=B12 GB region, but a proper fix in dl.c is needed.

-- Additional info:

=C2=A0 grub-efi-riscv64: =C2=A0 =C2=A0 2.12-9+deb13u2
=C2=A0 grub-efi-riscv64-bin: 2.12-9+deb13u2
=C2=A0 grub-common: =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0 2.12-9+deb13u2
=C2=A0 grub2-common: =C2=A0 =C2=A0 =C2=A0 =C2=A0 2.12-9+deb13u2

=C2=A0 CPU ISA: rv64imafdcvh + (extensive extensions including V, Zb*, Zk*)
=C2=A0 MMU: sv48
=C2=A0 EFI: v2.7 by SpacemiT
=C2=A0 BIOS: SpacemiT v1.0.0


This message and any attachment are confidential and may be privileged or o=
therwise protected from disclosure. If you are not an intended recipient of=
 this message, please delete it and any attachment from your system and not=
ify the sender immediately by reply e-mail. Unintended recipients should no=
t use, copy, disclose or take any action based on this message or any infor=
mation contained in this message. Emails cannot be guaranteed to be secure =
or error free as they can be intercepted, amended, lost or destroyed, and y=
ou should take full responsibility for security checking.=20
=20
=E6=9C=AC=E9=82=AE=E4=BB=B6=E5=8F=8A=E5=85=B6=E4=BB=BB=E4=BD=95=E9=99=84=E4=
=BB=B6=E5=85=B7=E6=9C=89=E4=BF=9D=E5=AF=86=E6=80=A7=E8=B4=A8=EF=BC=8C=E5=B9=
=B6=E5=8F=AF=E8=83=BD=E5=8F=97=E5=85=B6=E4=BB=96=E4=BF=9D=E6=8A=A4=E6=88=96=
=E4=B8=8D=E5=85=81=E8=AE=B8=E8=A2=AB=E6=8A=AB=E9=9C=B2=E7=BB=99=E7=AC=AC=E4=
=B8=89=E6=96=B9=E3=80=82=E5=A6=82=E9=98=81=E4=B8=8B=E8=AF=AF=E6=94=B6=E5=88=
=B0=E6=9C=AC=E9=82=AE=E4=BB=B6=EF=BC=8C=E6=95=AC=E8=AF=B7=E7=AB=8B=E5=8D=B3=
=E4=BB=A5=E5=9B=9E=E5=A4=8D=E7=94=B5=E5=AD=90=E9=82=AE=E4=BB=B6=E7=9A=84=E6=
=96=B9=E5=BC=8F=E9=80=9A=E7=9F=A5=E5=8F=91=E4=BB=B6=E4=BA=BA=EF=BC=8C=E5=B9=
=B6=E5=B0=86=E6=9C=AC=E9=82=AE=E4=BB=B6=E5=8F=8A=E5=85=B6=E4=BB=BB=E4=BD=95=
=E9=99=84=E4=BB=B6=E4=BB=8E=E9=98=81=E4=B8=8B=E7=B3=BB=E7=BB=9F=E4=B8=AD=E4=
=BA=88=E4=BB=A5=E5=88=A0=E9=99=A4=E3=80=82=E5=A6=82=E9=98=81=E4=B8=8B=E5=B9=
=B6=E9=9D=9E=E6=9C=AC=E9=82=AE=E4=BB=B6=E5=86=99=E6=98=8E=E4=B9=8B=E6=94=B6=
=E4=BB=B6=E4=BA=BA=EF=BC=8C=E6=95=AC=E8=AF=B7=E5=88=87=E5=8B=BF=E4=BD=BF=E7=
=94=A8=E3=80=81=E5=A4=8D=E5=88=B6=E3=80=81=E6=8A=AB=E9=9C=B2=E6=9C=AC=E9=82=
=AE=E4=BB=B6=E6=88=96=E5=85=B6=E4=BB=BB=E4=BD=95=E5=86=85=E5=AE=B9=EF=BC=8C=
=E4=BA=A6=E8=AF=B7=E5=88=87=E5=8B=BF=E4=BE=9D=E6=9C=AC=E9=82=AE=E4=BB=B6=E6=
=88=96=E5=85=B6=E4=BB=BB=E4=BD=95=E5=86=85=E5=AE=B9=E8=80=8C=E9=87=87=E5=8F=
=96=E4=BB=BB=E4=BD=95=E8=A1=8C=E5=8A=A8=E3=80=82=E7=94=B5=E5=AD=90=E9=82=AE=
=E4=BB=B6=E6=97=A0=E6=B3=95=E4=BF=9D=E8=AF=81=E6=98=AF=E4=B8=80=E7=A7=8D=E5=
=AE=89=E5=85=A8=E5=92=8C=E4=B8=8D=E4=BC=9A=E5=87=BA=E7=8E=B0=E4=BB=BB=E4=BD=
=95=E5=B7=AE=E9=94=99=E7=9A=84=E9=80=9A=E4=BF=A1=E6=96=B9=E5=BC=8F=EF=BC=8C=
=E5=8F=AF=E8=83=BD=E4=BC=9A=E8=A2=AB=E6=8B=A6=E6=88=AA=E3=80=81=E4=BF=AE=E6=
=94=B9=E3=80=81=E4=B8=A2=E5=A4=B1=E6=88=96=E6=8D=9F=E5=9D=8F=EF=BC=8C=E6=94=
=B6=E4=BB=B6=E4=BA=BA=E9=9C=80=E8=87=AA=E8=A1=8C=E8=B4=9F=E8=B4=A3=E5=81=9A=
=E5=A5=BD=E5=AE=89=E5=85=A8=E6=A3=80=E6=9F=A5=E3=80=82
]