RPi 3B+ not accepting latest firmware to allow kernel to boot

Ubuntu Support Template

Ubuntu Version:
26.04 ARM64+raspi

I’m running 26.04 (server) on a Raspberry Pi 3B+. The kernel will not boot past 7.0.0-1010

When I try to install 7.0.0-1011, it seems to install OK, but then when I reboot, I get the following message when I log in:

New boot assets in /boot/firmware/new failed. Fallen back to known good
state. Use piboot-try --reset-new to re-test boot assets. If you are able
to determine the boot failure is due to a bug, please file an issue:
ubuntu-bug flash-kernel 

The device falls back to the older kernel.

Following the instructions in the message doesn’t do anything. I’ve tried removing and reinstalling the offending kernel, with no progress being made.

I also tried on a Pi Zero 2W, with the same result.

It works OK on a Pi 4. I don’t have a Pi 5, thus haven’t been able to test on one.

It is looking to me as though the issue occurs only on the Pi models that don’t use the EEPROM system that the later models do.

I’ve filed a bug at Bug #2155094 “RPi 3B New boot assets in /boot/firmware/new faile...” : Bugs : Ubuntu

The 3B+ and 2W still work, but given the serious kernel bugs recently, I don’t feel comfortable leaving the devices running an older kernel. Any workarounds in the meantime would be gratefully received.

1 Like

Can’t help you on the actual issue; you seem to have hit a bug and reported it already. :clap:

It’s unfortunate that your upgrade path seems to be blocked for the time being, so you may need to assess your exposure level yourself in the meantime and apply said workarounds where available and applicable. I can only offer some solace, maybe, and some info on mitigating your current circumstances:

Take a look at the blog, which has several articles on the recent CVE’s, workarounds included; I haven’t read them all in detail, though.
https://ubuntu.com/blog/tag/vulnerabilities

Seeing that the recent headline grabbing vulnerabilities are almost exclusively LPE (local privilege escalation) issues, I think, you could be reasonably safe from those, because those require a malicious user to be already logged in. That user would also have to be one which doesn’t already possess root (sudo) privileges. They don’t need LPE exploits to do damage; they could just sudo rm -rf / (CAUTION, just an example of how to DoS a system permanently; don’t run!!!), if they wanted. To compromise a server from the outside, i.e. without already having one foot in the door by being logged in to a shell, requires an additional vulnerability in some public facing web service.

To summarize, LPE’s don’t concern you or your server, if you are the only one with access to it, or if other users have the same level of access as you, for they don’t gain anything they don’t already have. If, however, you have unprivileged users accessing your server by, say, SSH, that could be problem, for they can escalate their privileges which breaks the contract of limited access, you’ve put in place to begin with.

In the case of remotely exploitable issues, however, you should always apply the workarounds ASAP, even if it means to temporarily disable some functionality, for they could be the stepping stone to then use said LPE’s to escalate privileges further; unless you have some SLA (Service Level Agreement) commitments to uphold, that is; then it becomes a balancing act of how much risk you are willing to take vs. how much money/trust/<currency> you can afford to lose.

2 Likes

Thank you for the info. I’ve bookmarked the Blog.

As it happens, several of the recent vulnerabilities don’t apply to me, as the kernel modules aren’t installed. For another one, I already have the workaround in place.

Also since they are LPEs, I’m more or less covered, as no one else has access to the hardware.

There has also been some progress on the bug front.

1 Like

What you’re seeing here is a real regression in flash-kernel / piboot-try behavior on non-EEPROM Broadcom boards (like BCM2837 on Raspberry Pi 3B+ and Zero 2W) when moving into the 7.0.0-1011 kernel series on noble/dev branches.

The system is not broken. piboot-try is doing its job: it boots the new kernel, runs validation, and then rolls back to 7.0.0-1010 because the “new boot assets in /boot/firmware/new” step fails validation. So you don’t get a brick, but you do get stuck in a loop where apt keeps trying to push the broken update and wasting writes on the boot partition.

I found a Bug that fits your case

This is basically Bug #2155094 territory. Until that’s fixed upstream, you have three realistic ways to deal with it.

  1. Just freeze the working kernel (cleanest fix)
    If you don’t care about testing 1011 right now, stop apt from touching it:

sudo apt-mark hold linux-image-7.0.0-1010-raspi linux-headers-7.0.0-1010-raspi

This prevents repeated upgrade attempts and stops the boot partition from being rewritten over and over. This is what most sane setups should do until the bug is resolved.

  1. Force the boot pipeline to retry properly (experimental)
    The failure happens because non-EEPROM Pi setups rely entirely on FAT32 boot assets (/boot/firmware: bootcode.bin, start.elf, fixup.dat etc). piboot-try expects a success marker from the newer boot validation flow, but that marker never gets set in this broken path.

If you believe the kernel itself is fine and only the post-install hook is failing, you can reset the state and force reinstallation:

sudo piboot-try --reset-new
sudo flash-kernel --force

If the system refuses to boot after this, you’re not bricked — just recover by pulling the SD card and copying everything back from /boot/firmware/backup/ into /boot/firmware/.

  1. Nuke the staging state (fix broken flags)
    If apt keeps spamming the same error every boot or login, your state in /boot/firmware/new is likely corrupted or stuck.

Clean it up:

sudo rm -rf /boot/firmware/new/\*
sudo dpkg --configure -a

Then reboot and let flash-kernel regenerate everything cleanly.

Bottom line:

  • Nothing is actually dead
  • 1011 is the broken point
  • piboot-try rollback is working as designed
  • your real issue is the update pipeline, not the hardware
2 Likes

That’s my bug report that you refer to. :slight_smile:

As the relevant people are aware of it, I think I’ll leave things alone for now. I strongly suspect that the problem isn’t with the actual kernel, but I’d rather not try experimenting at this point. I’ve set apt-mark hold as suggested.

Thanks.

2 Likes

Holding 1010 is the right move for now. 1011 is still broken in that flash-kernel path on Pi 3B+/Zero 2W, so you’re not really losing anything important by staying back.

That bug report will help upstream sort out the piboot-try / boot assets validation issue sooner.

Just keep it pinned until the fix lands in the packaging tree, then you can drop the hold and upgrade normally again.

2 Likes

That does not prevent the kernel from automatically loading them on demand, though, hence the workarounds which replace the install command with a call to /bin/false in a /etc/modprobe.d/*.conf override. But as long as you don’t do something that triggers said autoload, you should be fine.

That only prevents that particular version from being removed, I’m afraid. Since kernel images are installed whenever the top-level metapackage, e.g. linux-generic, is upgraded, which in turn pulls in the respective linux-image-<version>-raspi, it won’t prevent said writes to the boot partition. If one wanted to do that, the command would have to be something like:

sudo apt-mark hold linux-generic

You can find out, which linux-generic* to put on hold by running:

aptitude why linux-image-$(uname -r)

I don’t have a Pi, so this excerpt is from my amd64 laptop; just to get the idea:

i   linux-generic-hwe-24.04       Depends linux-image-generic-hwe-24.04 (= 6.17.0-35.35~24.04.1)
i A linux-image-generic-hwe-24.04 Depends linux-image-6.17.0-35-generic

In my case, I would have to apt-mark hold linux-generic-hwe-24.04 to prevent any new version from installing. I think, the equivalent in your case should be all that’s required, because you are not waiting for a newer kernel version but instead for a fixed flash-kernel version; once that happens, just sudo apt-mark unhold .... Or, you can just take the slightly bigger hammer and:

sudo apt-mark hold linux-generic\*

(mind the \* to prevent Bash from interpreting it as a shell pattern)

1 Like

I should chime in here quickly (as the person responsible for piboot-try and the whole A/B boot fun on the Pi). I’m currently working on the various bugs related to this (including the one listed). At the moment there seem to be several different categories which are gradually getting sorted out:

  • The first is people on the Pi 4 or Pi 5 who upgraded but have out of date EEPROMs that can’t boot the 7.0 kernel. In this case the fix is simply to sudo rpi-eeprom-update -a, then sudo piboot-try --reset-new and reboot (to re-try the new assets)
  • The second is people who dist-upgraded (bypassing the do-release-upgrade route) and found themselves with a system half-in half-out of resolute (with an old raspi meta-package, but an upgraded flash-kernel which no longer “knows” about the Pi in resolute). The solution here is sudo apt install piboot-try, accept the removal of flash-kernel as part of that process, and then check your meta package (ubuntu-server-raspi or ubuntu-desktop-raspi) is up to date. A further fix is in the works to clean up this route (unofficial though it is, if we can fix it, we should)
  • The third are people with older model Pis (3, 3+, Zero 2W, i.e. the non-EEPROM ones) that seem to be “stuck” unable to boot the latest kernel upgrade, i.e. the subject of this post. Still not sure what’s going on here – I’ve been unable to reliably reproduce the situation on my boards here so far

One quick clarification is probably warranted to ease some minds though:

When piboot-try marks the new assets “bad” (because, for whatever reason, they failed to boot), it will warn about this on every login. However, that doesn’t mean it’s retrying them on every boot; it’s not. Nor will every apt operation attempt to re-write the new assets; only those that call the flash-kernel hook (new kernel versions, anything that affects the initramfs, or the bootloader binaries themselves). So don’t worry too much about writes to the boot partition: those will only occur when there’s something actually new to test.

The warning on every login is probably annoying, but I was wary about having login hooks that also write state (instead of simply reading it, which is all the current ones do). Maybe I can add some option to piboot-try to suppress the warning (piboot-try --yes-i-know-stfu), but that’s probably a “later” thing.

Anyway, apologies for the login noise – bear with me, and hopefully I can get all this sorted before resolute’s .1 release!

5 Likes

If you believe the kernel itself is fine and only the post-install hook is failing, you can reset the state and force reinstallation:

sudo piboot-try --reset-new
sudo flash-kernel --force

Another quick clarification: calling flash-kernel itself is enough to reset the “new” state. More precisely: flash-kernel will wipe and completely re-write the “new” directory when called (implicitly resetting it to “unknown” state). The --reset-new flag for piboot-try simply resets the new state to “unknown” without re-writing anything else.

It’s mostly useful for retesting boot assets when you believe the failure to be transient or due to some external factor (e.g. someone pulled the power plug in the middle of booting the new assets: there’s nothing actually wrong with the assets and you want to re-test them without changing anything else).

3 Likes

Hi there @waveform , appreciate the helpful response. I know you probably have a lot on your plate at the moment, but I was just wondering if this bug is also related to one of the known issues that you mentioned, or is it a different issue that I somehow brought on myself?

As a workaround I eventually switched to the flash-kernel-piboot method and it works, but I’m not sure why.

In general I guess I don’t really understand the RPi boot process and where all the potential failure points and safeguards are located, as I’m much more familiar with a traditional BIOS system (or begrudgingly UEFI) with GRUB2.

@sb56637 that’s second case I mentioned (a half-complete dist-upgrade). Your solution of installing flash-kernel-piboot is a round-about method of installing piboot-try (in resolute, flash-kernel-piboot is just an empty transitional package that depends on piboot-try so it’s the same effect).

1 Like

I’m going to consolidate all these issues under a few tickets in a bit. However, on the main issue (fall-back from kernel revision 1011 on the older boards), I’ve been unable to reproduce it locally despite dozens of attempts and all possible boards (3A+, 3B+, 3B, Zero 2W). Further, I haven’t got any journal logs showing what’s going on because I suspect the boot step which is failing, is failing to get to the point where the rootfs is mounted (so the journal never gets written).

As a result, what I really need is someone who is reliably experiencing this problem, who is happy to hook up a serial terminal to their Pi and add the output to a bug.

I’ll consolidate the tickets, and then write up some comprehensive instructions on grabbing good serial output (ideally we want early-boot serial in case anything’s going wrong there, and systemd’s output which involves switching the order of the console= params in the kernel command line).

That looks like a job for me. I think I can get hold of the right kind of serial cable locally, I’m reliably experiencing the problem, and I have some familiarity with using serial connections.

I’ll see if I can get a cable tomorrow and go from there.

1 Like

I’ve consolidated the bug regarding the Pi not accepting the latest kernel revision under LP: #2155094, and placed (typically long winded!) instructions for serial debugging under comment 9 of that bug if anyone wants to give it a whirl!

2 Likes

I’ve been asked to try and summarize everything here so we can conclude this thread. The following applies specifically to the issue @irihapeti ran into. There are some other boot issues currently being dealt with, but I suggest we don’t confuse this thread any further (than I already have!). So, if you’re running into something other than the issue below, please feel free to start another thread (or ping me from another open one).

Root cause

The issue here was that 26.04 switched initramfs generation from the initramfs-tools package to dracut. The latter unfortunately has rather silly defaults for compression (zstd level 15 with multi-threading) which work perfectly fine if you’re on a fat multi-core machine with 8+GB of RAM, but is a terrible choice on anything with a minimal set of RAM like a Pi Zero 2W (512MB) or 3B (1GB), depending on what else is loaded (for reference, zstd at level 15 will happily eat 500MB or more in the course of its duties).

It’s not the first time we’ve seen this; I had to workaround the exact same settings in initramfs-tools a few years ago. However, it turns out there’s a compounding error in dracut which we weren’t aware of: when the compressor fails and runs out of RAM, dracut merrily exits with “0” (indicating “success”). This leads the flash-kernel hook to assume that the initramfs was generated successfully (it wasn’t) so it writes it to the boot partition in the “new” slot for piboot-try to test.

At the next boot, piboot-try does its thing, the initramfs duly fails and piboot-try falls back to the original assets. On the plus side: yay, piboot-try works! On the minus side: I didn’t really want it to get a work-out this soon after resolute’s release…

Are you affected?

You can tell if you’re affected by checking the size of the initramfs in your /boot folder:

$ ls -lh /boot/initrd.img-*
-rw------- 1 root root 67M Jul  3 13:46 /boot/initrd.img-7.0.0-1011-raspi
-rw------- 1 root root 67M Jul  3 06:30 /boot/initrd.img-7.0.0-1014-raspi

The size of all such files should be in the region of ~60MB. If they’re a much smaller (e.g. a few hundred KB) instead, then you’re hitting this issue.

Workarounds

There is an SRU to fix this working its way through the system. If you don’t want to tinker with anything, just wait for the SRU to land and this will be resolved. In the meantime piboot-try should keep you booting successfully. To re-iterate a note from further up: piboot-try is not testing the “bad” assets on every boot, but it will (annoyingly) warn you on every login that the “new” assets are “bad”.

If you want to workaround it right now, you can do the following:

$ cat << EOF | sudo tee /etc/dracut.conf.d/zz-compress.conf
compress_level_zstd="1"
compress_level_xz="1"
EOF

(I included xz as that is another compressor that eats a very large amount of RAM with the defaults that dracut uses; this guards against users configuring a different compressor and inadvertantly running into this same issue)

The SRU will (eventually) create those same settings (but in a different file, so the upgrade won’t collide). Once the settings are in place, regenerate any truncated initramfs images. For example, if you saw the 1014 revision was truncated:

$ sudo dracut --force /boot/initrd.img-7.0.0-1014-raspi 7.0.0-1014-raspi

Repeat for each truncated version (replacing both version strings in the command as necessary). Once finished, copy the boot assets to the boot partition with flash-kernel:

$ sudo flash-kernel

At the next boot (assuming all goes well) you should find yourself on the newest version.

3 Likes

@waveform Thank you very much for the summary and for the workaround while we’re waiting for the official fix. I’ve marked this as the solution.

I’ll just say that, when I first encountered this issue, I thought maybe I’d done something wrong, not that I’d run into an “interesting” bug. As with many things of this kind, I’ve learned a lot along the way.

1 Like

This topic was automatically closed 18 hours after the last reply. New replies are no longer allowed.