pvmfw/src/fdt.rs - android_packages_modules_Virtualization - Gitiles

 // Copyright 2022, The Android Open Source Project
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.

 //! High-level FDT functions.

 use crate::cstr;
 use crate::helpers::GUEST_PAGE_SIZE;
 use crate::RebootReason;
 use core::ffi::CStr;
 use core::ops::Range;
 use fdtpci::PciMemoryFlags;
 use fdtpci::PciRangeType;
 use libfdt::AddressRange;
 use libfdt::CellIterator;
 use libfdt::Fdt;
 use libfdt::FdtError;
 use log::debug;
 use log::error;
 use tinyvec::ArrayVec;

 /// Extract from /config the address range containing the pre-loaded kernel. Absence of /config is
 /// not an error.
 fn read_kernel_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
     let addr = cstr!("kernel-address");
     let size = cstr!("kernel-size");

     if let Some(config) = fdt.node(cstr!("/config"))? {
         if let (Some(addr), Some(size)) = (config.getprop_u32(addr)?, config.getprop_u32(size)?) {
             let addr = addr as usize;
             let size = size as usize;

             return Ok(Some(addr..(addr + size)));
         }
     }

     Ok(None)
 }

 /// Extract from /chosen the address range containing the pre-loaded ramdisk. Absence is not an
 /// error as there can be initrd-less VM.
 fn read_initrd_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
     let start = cstr!("linux,initrd-start");
     let end = cstr!("linux,initrd-end");

     if let Some(chosen) = fdt.chosen()? {
         if let (Some(start), Some(end)) = (chosen.getprop_u32(start)?, chosen.getprop_u32(end)?) {
             return Ok(Some((start as usize)..(end as usize)));
         }
     }

     Ok(None)
 }

 /// Read the first range in /memory node in DT
 fn read_memory_range_from(fdt: &Fdt) -> libfdt::Result<Range<usize>> {
     fdt.memory()?.ok_or(FdtError::NotFound)?.next().ok_or(FdtError::NotFound)
 }

 /// Check if memory range is ok
 fn validate_memory_range(range: &Range<usize>) -> Result<(), RebootReason> {
     let base = range.start;
     if base as u64 != DeviceTreeInfo::RAM_BASE_ADDR {
         error!("Memory base address {:#x} is not {:#x}", base, DeviceTreeInfo::RAM_BASE_ADDR);
         return Err(RebootReason::InvalidFdt);
     }

     let size = range.len();
     if size % GUEST_PAGE_SIZE != 0 {
         error!("Memory size {:#x} is not a multiple of page size {:#x}", size, GUEST_PAGE_SIZE);
         return Err(RebootReason::InvalidFdt);
     }

     if size == 0 {
         error!("Memory size is 0");
         return Err(RebootReason::InvalidFdt);
     }
     Ok(())
 }

 /// Read the number of CPUs from DT
 fn read_num_cpus_from(fdt: &Fdt) -> libfdt::Result<usize> {
     Ok(fdt.compatible_nodes(cstr!("arm,arm-v8"))?.count())
 }

 /// Validate number of CPUs
 fn validate_num_cpus(num_cpus: usize) -> Result<(), RebootReason> {
     if num_cpus == 0 {
         error!("Number of CPU can't be 0");
         return Err(RebootReason::InvalidFdt);
     }
     Ok(())
 }

 #[derive(Debug)]
 #[allow(dead_code)] // TODO: remove this
 struct PciInfo {
     ranges: [PciAddrRange; 2],
     irq_masks: ArrayVec<[PciIrqMask; PciInfo::MAX_IRQS]>,
     irq_maps: ArrayVec<[PciIrqMap; PciInfo::MAX_IRQS]>,
 }

 impl PciInfo {
     const IRQ_MASK_CELLS: usize = 4;
     const IRQ_MAP_CELLS: usize = 10;
     const MAX_IRQS: usize = 8;
 }

 type PciAddrRange = AddressRange<(u32, u64), u64, u64>;
 type PciIrqMask = [u32; PciInfo::IRQ_MASK_CELLS];
 type PciIrqMap = [u32; PciInfo::IRQ_MAP_CELLS];

 /// Iterator that takes N cells as a chunk
 struct CellChunkIterator<'a, const N: usize> {
     cells: CellIterator<'a>,
 }

 impl<'a, const N: usize> CellChunkIterator<'a, N> {
     fn new(cells: CellIterator<'a>) -> Self {
         Self { cells }
     }
 }

 impl<'a, const N: usize> Iterator for CellChunkIterator<'a, N> {
     type Item = [u32; N];
     fn next(&mut self) -> Option<Self::Item> {
         let mut ret: Self::Item = [0; N];
         for i in ret.iter_mut() {
             *i = self.cells.next()?;
         }
         Some(ret)
     }
 }

 /// Read pci host controller ranges, irq maps, and irq map masks from DT
 fn read_pci_info_from(fdt: &Fdt) -> libfdt::Result<PciInfo> {
     let node =
         fdt.compatible_nodes(cstr!("pci-host-cam-generic"))?.next().ok_or(FdtError::NotFound)?;

     let mut ranges = node.ranges::<(u32, u64), u64, u64>()?.ok_or(FdtError::NotFound)?;
     let range0 = ranges.next().ok_or(FdtError::NotFound)?;
     let range1 = ranges.next().ok_or(FdtError::NotFound)?;

     let irq_masks = node.getprop_cells(cstr!("interrupt-map-mask"))?.ok_or(FdtError::NotFound)?;
     let irq_masks = CellChunkIterator::<{ PciInfo::IRQ_MASK_CELLS }>::new(irq_masks);
     let irq_masks: ArrayVec<[PciIrqMask; PciInfo::MAX_IRQS]> =
         irq_masks.take(PciInfo::MAX_IRQS).collect();

     let irq_maps = node.getprop_cells(cstr!("interrupt-map"))?.ok_or(FdtError::NotFound)?;
     let irq_maps = CellChunkIterator::<{ PciInfo::IRQ_MAP_CELLS }>::new(irq_maps);
     let irq_maps: ArrayVec<[PciIrqMap; PciInfo::MAX_IRQS]> =
         irq_maps.take(PciInfo::MAX_IRQS).collect();

     Ok(PciInfo { ranges: [range0, range1], irq_masks, irq_maps })
 }

 fn validate_pci_info(pci_info: &PciInfo) -> Result<(), RebootReason> {
     for range in pci_info.ranges.iter() {
         validate_pci_addr_range(range)?;
     }
     for irq_mask in pci_info.irq_masks.iter() {
         validate_pci_irq_mask(irq_mask)?;
     }
     for (idx, irq_map) in pci_info.irq_maps.iter().enumerate() {
         validate_pci_irq_map(irq_map, idx)?;
     }
     Ok(())
 }

 fn validate_pci_addr_range(range: &PciAddrRange) -> Result<(), RebootReason> {
     let mem_flags = PciMemoryFlags(range.addr.0);
     let range_type = mem_flags.range_type();
     let prefetchable = mem_flags.prefetchable();
     let bus_addr = range.addr.1;
     let cpu_addr = range.parent_addr;
     let size = range.size;

     if range_type != PciRangeType::Memory64 {
         error!("Invalid range type {:?} for bus address {:#x} in PCI node", range_type, bus_addr);
         return Err(RebootReason::InvalidFdt);
     }
     if prefetchable {
         error!("PCI bus address {:#x} in PCI node is prefetchable", bus_addr);
         return Err(RebootReason::InvalidFdt);
     }
     // Enforce ID bus-to-cpu mappings, as used by crosvm.
     if bus_addr != cpu_addr {
         error!("PCI bus address: {:#x} is different from CPU address: {:#x}", bus_addr, cpu_addr);
         return Err(RebootReason::InvalidFdt);
     }

     if bus_addr.checked_add(size).is_none() {
         error!("PCI address range size {:#x} too big", size);
         return Err(RebootReason::InvalidFdt);
     }

     Ok(())
 }

 fn validate_pci_irq_mask(irq_mask: &PciIrqMask) -> Result<(), RebootReason> {
     const IRQ_MASK_ADDR_HI: u32 = 0xf800;
     const IRQ_MASK_ADDR_ME: u32 = 0x0;
     const IRQ_MASK_ADDR_LO: u32 = 0x0;
     const IRQ_MASK_ANY_IRQ: u32 = 0x7;
     const EXPECTED: PciIrqMask =
         [IRQ_MASK_ADDR_HI, IRQ_MASK_ADDR_ME, IRQ_MASK_ADDR_LO, IRQ_MASK_ANY_IRQ];
     if *irq_mask != EXPECTED {
         error!("Invalid PCI irq mask {:#?}", irq_mask);
         return Err(RebootReason::InvalidFdt);
     }
     Ok(())
 }

 fn validate_pci_irq_map(irq_map: &PciIrqMap, idx: usize) -> Result<(), RebootReason> {
     const PCI_DEVICE_IDX: usize = 11;
     const PCI_IRQ_ADDR_ME: u32 = 0;
     const PCI_IRQ_ADDR_LO: u32 = 0;
     const PCI_IRQ_INTC: u32 = 1;
     const AARCH64_IRQ_BASE: u32 = 4; // from external/crosvm/aarch64/src/lib.rs
     const GIC_SPI: u32 = 0;
     const IRQ_TYPE_LEVEL_HIGH: u32 = 4;

     let pci_addr = (irq_map[0], irq_map[1], irq_map[2]);
     let pci_irq_number = irq_map[3];
     let _controller_phandle = irq_map[4]; // skipped.
     let gic_addr = (irq_map[5], irq_map[6]); // address-cells is <2> for GIC
                                              // interrupt-cells is <3> for GIC
     let gic_peripheral_interrupt_type = irq_map[7];
     let gic_irq_number = irq_map[8];
     let gic_irq_type = irq_map[9];

     let phys_hi: u32 = (0x1 << PCI_DEVICE_IDX) * (idx + 1) as u32;
     let expected_pci_addr = (phys_hi, PCI_IRQ_ADDR_ME, PCI_IRQ_ADDR_LO);

     if pci_addr != expected_pci_addr {
         error!("PCI device address {:#x} {:#x} {:#x} in interrupt-map is different from expected address \
                {:#x} {:#x} {:#x}",
                pci_addr.0, pci_addr.1, pci_addr.2, expected_pci_addr.0, expected_pci_addr.1, expected_pci_addr.2);
         return Err(RebootReason::InvalidFdt);
     }

     if pci_irq_number != PCI_IRQ_INTC {
         error!(
             "PCI INT# {:#x} in interrupt-map is different from expected value {:#x}",
             pci_irq_number, PCI_IRQ_INTC
         );
         return Err(RebootReason::InvalidFdt);
     }

     if gic_addr != (0, 0) {
         error!(
             "GIC address {:#x} {:#x} in interrupt-map is different from expected address \
                {:#x} {:#x}",
             gic_addr.0, gic_addr.1, 0, 0
         );
         return Err(RebootReason::InvalidFdt);
     }

     if gic_peripheral_interrupt_type != GIC_SPI {
         error!("GIC peripheral interrupt type {:#x} in interrupt-map is different from expected value \
                {:#x}", gic_peripheral_interrupt_type, GIC_SPI);
         return Err(RebootReason::InvalidFdt);
     }

     let irq_nr: u32 = AARCH64_IRQ_BASE + (idx as u32);
     if gic_irq_number != irq_nr {
         error!(
             "GIC irq number {:#x} in interrupt-map is unexpected. Expected {:#x}",
             gic_irq_number, irq_nr
         );
         return Err(RebootReason::InvalidFdt);
     }

     if gic_irq_type != IRQ_TYPE_LEVEL_HIGH {
         error!(
             "IRQ type in {:#x} is invalid. Must be LEVEL_HIGH {:#x}",
             gic_irq_type, IRQ_TYPE_LEVEL_HIGH
         );
         return Err(RebootReason::InvalidFdt);
     }
     Ok(())
 }

 #[derive(Default, Debug)]
 #[allow(dead_code)] // TODO: remove this
 struct SerialInfo {
     addrs: ArrayVec<[u64; Self::MAX_SERIALS]>,
 }

 impl SerialInfo {
     const MAX_SERIALS: usize = 4;
 }

 fn read_serial_info_from(fdt: &Fdt) -> libfdt::Result<SerialInfo> {
     let mut addrs: ArrayVec<[u64; SerialInfo::MAX_SERIALS]> = Default::default();
     for node in fdt.compatible_nodes(cstr!("ns16550a"))?.take(SerialInfo::MAX_SERIALS) {
         let reg = node.reg()?.ok_or(FdtError::NotFound)?.next().ok_or(FdtError::NotFound)?;
         addrs.push(reg.addr);
     }
     Ok(SerialInfo { addrs })
 }

 #[derive(Debug)]
 #[allow(dead_code)] // TODO: remove this
 struct SwiotlbInfo {
     size: u64,
     align: u64,
 }

 fn read_swiotlb_info_from(fdt: &Fdt) -> libfdt::Result<SwiotlbInfo> {
     let node =
         fdt.compatible_nodes(cstr!("restricted-dma-pool"))?.next().ok_or(FdtError::NotFound)?;
     let size = node.getprop_u64(cstr!("size"))?.ok_or(FdtError::NotFound)?;
     let align = node.getprop_u64(cstr!("alignment"))?.ok_or(FdtError::NotFound)?;
     Ok(SwiotlbInfo { size, align })
 }

 fn validate_swiotlb_info(swiotlb_info: &SwiotlbInfo) -> Result<(), RebootReason> {
     let size = swiotlb_info.size;
     let align = swiotlb_info.align;

     if size == 0 || (size % GUEST_PAGE_SIZE as u64) != 0 {
         error!("Invalid swiotlb size {:#x}", size);
         return Err(RebootReason::InvalidFdt);
     }

     if (align % GUEST_PAGE_SIZE as u64) != 0 {
         error!("Invalid swiotlb alignment {:#x}", align);
         return Err(RebootReason::InvalidFdt);
     }
     Ok(())
 }

 #[derive(Debug)]
 #[allow(dead_code)] // TODO: remove this
 pub struct DeviceTreeInfo {
     pub kernel_range: Option<Range<usize>>,
     pub initrd_range: Option<Range<usize>>,
     pub memory_range: Range<usize>,
     num_cpus: usize,
     pci_info: PciInfo,
     serial_info: SerialInfo,
     swiotlb_info: SwiotlbInfo,
 }

 impl DeviceTreeInfo {
     const RAM_BASE_ADDR: u64 = 0x8000_0000;
 }

 pub fn sanitize_device_tree(fdt: &mut libfdt::Fdt) -> Result<DeviceTreeInfo, RebootReason> {
     let info = parse_device_tree(fdt)?;
     debug!("Device tree info: {:?}", info);

     // TODO: replace fdt with the template DT
     // TODO: patch the replaced fdt using info
     Ok(info)
 }

 fn parse_device_tree(fdt: &libfdt::Fdt) -> Result<DeviceTreeInfo, RebootReason> {
     let kernel_range = read_kernel_range_from(fdt).map_err(|e| {
         error!("Failed to read kernel range from DT: {e}");
         RebootReason::InvalidFdt
     })?;

     let initrd_range = read_initrd_range_from(fdt).map_err(|e| {
         error!("Failed to read initrd range from DT: {e}");
         RebootReason::InvalidFdt
     })?;

     let memory_range = read_memory_range_from(fdt).map_err(|e| {
         error!("Failed to read memory range from DT: {e}");
         RebootReason::InvalidFdt
     })?;
     validate_memory_range(&memory_range)?;

     let num_cpus = read_num_cpus_from(fdt).map_err(|e| {
         error!("Failed to read num cpus from DT: {e}");
         RebootReason::InvalidFdt
     })?;
     validate_num_cpus(num_cpus)?;

     let pci_info = read_pci_info_from(fdt).map_err(|e| {
         error!("Failed to read pci info from DT: {e}");
         RebootReason::InvalidFdt
     })?;
     validate_pci_info(&pci_info)?;

     let serial_info = read_serial_info_from(fdt).map_err(|e| {
         error!("Failed to read serial info from DT: {e}");
         RebootReason::InvalidFdt
     })?;

     let swiotlb_info = read_swiotlb_info_from(fdt).map_err(|e| {
         error!("Failed to read swiotlb info from DT: {e}");
         RebootReason::InvalidFdt
     })?;
     validate_swiotlb_info(&swiotlb_info)?;

     Ok(DeviceTreeInfo {
         kernel_range,
         initrd_range,
         memory_range,
         num_cpus,
         pci_info,
         serial_info,
         swiotlb_info,
     })
 }

 /// Modifies the input DT according to the fields of the configuration.
 pub fn modify_for_next_stage(
     fdt: &mut Fdt,
     bcc: &[u8],
     new_instance: bool,
     strict_boot: bool,
 ) -> libfdt::Result<()> {
     fdt.unpack()?;

     add_dice_node(fdt, bcc.as_ptr() as usize, bcc.len())?;

     set_or_clear_chosen_flag(fdt, cstr!("avf,strict-boot"), strict_boot)?;
     set_or_clear_chosen_flag(fdt, cstr!("avf,new-instance"), new_instance)?;

     fdt.pack()?;

     Ok(())
 }

 /// Add a "google,open-dice"-compatible reserved-memory node to the tree.
 fn add_dice_node(fdt: &mut Fdt, addr: usize, size: usize) -> libfdt::Result<()> {
     // We reject DTs with missing reserved-memory node as validation should have checked that the
     // "swiotlb" subnode (compatible = "restricted-dma-pool") was present.
     let mut reserved_memory =
         fdt.node_mut(cstr!("/reserved-memory"))?.ok_or(libfdt::FdtError::NotFound)?;

     let mut dice = reserved_memory.add_subnode(cstr!("dice"))?;

     dice.appendprop(cstr!("compatible"), b"google,open-dice\0")?;

     dice.appendprop(cstr!("no-map"), &[])?;

     let addr = addr.try_into().unwrap();
     let size = size.try_into().unwrap();
     dice.appendprop_addrrange(cstr!("reg"), addr, size)?;

     Ok(())
 }

 fn set_or_clear_chosen_flag(fdt: &mut Fdt, flag: &CStr, value: bool) -> libfdt::Result<()> {
     // TODO(b/249054080): Refactor to not panic if the DT doesn't contain a /chosen node.
     let mut chosen = fdt.chosen_mut()?.unwrap();
     if value {
         chosen.setprop_empty(flag)?;
     } else {
         match chosen.delprop(flag) {
             Ok(()) | Err(FdtError::NotFound) => (),
             Err(e) => return Err(e),
         }
     }

     Ok(())
 }
	// Copyright 2022, The Android Open Source Project
	//
	// Licensed under the Apache License, Version 2.0 (the "License");
	// you may not use this file except in compliance with the License.
	// You may obtain a copy of the License at
	//
	// http://www.apache.org/licenses/LICENSE-2.0
	//
	// Unless required by applicable law or agreed to in writing, software
	// distributed under the License is distributed on an "AS IS" BASIS,
	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	// See the License for the specific language governing permissions and
	// limitations under the License.

	//! High-level FDT functions.

	use crate::cstr;
	use crate::helpers::GUEST_PAGE_SIZE;
	use crate::RebootReason;
	use core::ffi::CStr;
	use core::ops::Range;
	use fdtpci::PciMemoryFlags;
	use fdtpci::PciRangeType;
	use libfdt::AddressRange;
	use libfdt::CellIterator;
	use libfdt::Fdt;
	use libfdt::FdtError;
	use log::debug;
	use log::error;
	use tinyvec::ArrayVec;

	/// Extract from /config the address range containing the pre-loaded kernel. Absence of /config is
	/// not an error.
	fn read_kernel_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
	let addr = cstr!("kernel-address");
	let size = cstr!("kernel-size");

	if let Some(config) = fdt.node(cstr!("/config"))? {
	if let (Some(addr), Some(size)) = (config.getprop_u32(addr)?, config.getprop_u32(size)?) {
	let addr = addr as usize;
	let size = size as usize;

	return Ok(Some(addr..(addr + size)));
	}
	}

	Ok(None)
	}

	/// Extract from /chosen the address range containing the pre-loaded ramdisk. Absence is not an
	/// error as there can be initrd-less VM.
	fn read_initrd_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
	let start = cstr!("linux,initrd-start");
	let end = cstr!("linux,initrd-end");

	if let Some(chosen) = fdt.chosen()? {
	if let (Some(start), Some(end)) = (chosen.getprop_u32(start)?, chosen.getprop_u32(end)?) {
	return Ok(Some((start as usize)..(end as usize)));
	}
	}

	Ok(None)
	}

	/// Read the first range in /memory node in DT
	fn read_memory_range_from(fdt: &Fdt) -> libfdt::Result<Range<usize>> {
	fdt.memory()?.ok_or(FdtError::NotFound)?.next().ok_or(FdtError::NotFound)
	}

	/// Check if memory range is ok
	fn validate_memory_range(range: &Range<usize>) -> Result<(), RebootReason> {
	let base = range.start;
	if base as u64 != DeviceTreeInfo::RAM_BASE_ADDR {
	error!("Memory base address {:#x} is not {:#x}", base, DeviceTreeInfo::RAM_BASE_ADDR);
	return Err(RebootReason::InvalidFdt);
	}

	let size = range.len();
	if size % GUEST_PAGE_SIZE != 0 {
	error!("Memory size {:#x} is not a multiple of page size {:#x}", size, GUEST_PAGE_SIZE);
	return Err(RebootReason::InvalidFdt);
	}

	if size == 0 {
	error!("Memory size is 0");
	return Err(RebootReason::InvalidFdt);
	}
	Ok(())
	}

	/// Read the number of CPUs from DT
	fn read_num_cpus_from(fdt: &Fdt) -> libfdt::Result<usize> {
	Ok(fdt.compatible_nodes(cstr!("arm,arm-v8"))?.count())
	}

	/// Validate number of CPUs
	fn validate_num_cpus(num_cpus: usize) -> Result<(), RebootReason> {
	if num_cpus == 0 {
	error!("Number of CPU can't be 0");
	return Err(RebootReason::InvalidFdt);
	}
	Ok(())
	}

	#[derive(Debug)]
	#[allow(dead_code)] // TODO: remove this
	struct PciInfo {
	ranges: [PciAddrRange; 2],
	irq_masks: ArrayVec<[PciIrqMask; PciInfo::MAX_IRQS]>,
	irq_maps: ArrayVec<[PciIrqMap; PciInfo::MAX_IRQS]>,
	}

	impl PciInfo {
	const IRQ_MASK_CELLS: usize = 4;
	const IRQ_MAP_CELLS: usize = 10;
	const MAX_IRQS: usize = 8;
	}

	type PciAddrRange = AddressRange<(u32, u64), u64, u64>;
	type PciIrqMask = [u32; PciInfo::IRQ_MASK_CELLS];
	type PciIrqMap = [u32; PciInfo::IRQ_MAP_CELLS];

	/// Iterator that takes N cells as a chunk
	struct CellChunkIterator<'a, const N: usize> {
	cells: CellIterator<'a>,
	}

	impl<'a, const N: usize> CellChunkIterator<'a, N> {
	fn new(cells: CellIterator<'a>) -> Self {
	Self { cells }
	}
	}

	impl<'a, const N: usize> Iterator for CellChunkIterator<'a, N> {
	type Item = [u32; N];
	fn next(&mut self) -> Option<Self::Item> {
	let mut ret: Self::Item = [0; N];
	for i in ret.iter_mut() {
	*i = self.cells.next()?;
	}
	Some(ret)
	}
	}

	/// Read pci host controller ranges, irq maps, and irq map masks from DT
	fn read_pci_info_from(fdt: &Fdt) -> libfdt::Result<PciInfo> {
	let node =
	fdt.compatible_nodes(cstr!("pci-host-cam-generic"))?.next().ok_or(FdtError::NotFound)?;

	let mut ranges = node.ranges::<(u32, u64), u64, u64>()?.ok_or(FdtError::NotFound)?;
	let range0 = ranges.next().ok_or(FdtError::NotFound)?;
	let range1 = ranges.next().ok_or(FdtError::NotFound)?;

	let irq_masks = node.getprop_cells(cstr!("interrupt-map-mask"))?.ok_or(FdtError::NotFound)?;
	let irq_masks = CellChunkIterator::<{ PciInfo::IRQ_MASK_CELLS }>::new(irq_masks);
	let irq_masks: ArrayVec<[PciIrqMask; PciInfo::MAX_IRQS]> =
	irq_masks.take(PciInfo::MAX_IRQS).collect();

	let irq_maps = node.getprop_cells(cstr!("interrupt-map"))?.ok_or(FdtError::NotFound)?;
	let irq_maps = CellChunkIterator::<{ PciInfo::IRQ_MAP_CELLS }>::new(irq_maps);
	let irq_maps: ArrayVec<[PciIrqMap; PciInfo::MAX_IRQS]> =
	irq_maps.take(PciInfo::MAX_IRQS).collect();

	Ok(PciInfo { ranges: [range0, range1], irq_masks, irq_maps })
	}

	fn validate_pci_info(pci_info: &PciInfo) -> Result<(), RebootReason> {
	for range in pci_info.ranges.iter() {
	validate_pci_addr_range(range)?;
	}
	for irq_mask in pci_info.irq_masks.iter() {
	validate_pci_irq_mask(irq_mask)?;
	}
	for (idx, irq_map) in pci_info.irq_maps.iter().enumerate() {
	validate_pci_irq_map(irq_map, idx)?;
	}
	Ok(())
	}

	fn validate_pci_addr_range(range: &PciAddrRange) -> Result<(), RebootReason> {
	let mem_flags = PciMemoryFlags(range.addr.0);
	let range_type = mem_flags.range_type();
	let prefetchable = mem_flags.prefetchable();
	let bus_addr = range.addr.1;
	let cpu_addr = range.parent_addr;
	let size = range.size;

	if range_type != PciRangeType::Memory64 {
	error!("Invalid range type {:?} for bus address {:#x} in PCI node", range_type, bus_addr);
	return Err(RebootReason::InvalidFdt);
	}
	if prefetchable {
	error!("PCI bus address {:#x} in PCI node is prefetchable", bus_addr);
	return Err(RebootReason::InvalidFdt);
	}
	// Enforce ID bus-to-cpu mappings, as used by crosvm.
	if bus_addr != cpu_addr {
	error!("PCI bus address: {:#x} is different from CPU address: {:#x}", bus_addr, cpu_addr);
	return Err(RebootReason::InvalidFdt);
	}

	if bus_addr.checked_add(size).is_none() {
	error!("PCI address range size {:#x} too big", size);
	return Err(RebootReason::InvalidFdt);
	}

	Ok(())
	}

	fn validate_pci_irq_mask(irq_mask: &PciIrqMask) -> Result<(), RebootReason> {
	const IRQ_MASK_ADDR_HI: u32 = 0xf800;
	const IRQ_MASK_ADDR_ME: u32 = 0x0;
	const IRQ_MASK_ADDR_LO: u32 = 0x0;
	const IRQ_MASK_ANY_IRQ: u32 = 0x7;
	const EXPECTED: PciIrqMask =
	[IRQ_MASK_ADDR_HI, IRQ_MASK_ADDR_ME, IRQ_MASK_ADDR_LO, IRQ_MASK_ANY_IRQ];
	if *irq_mask != EXPECTED {
	error!("Invalid PCI irq mask {:#?}", irq_mask);
	return Err(RebootReason::InvalidFdt);
	}
	Ok(())
	}

	fn validate_pci_irq_map(irq_map: &PciIrqMap, idx: usize) -> Result<(), RebootReason> {
	const PCI_DEVICE_IDX: usize = 11;
	const PCI_IRQ_ADDR_ME: u32 = 0;
	const PCI_IRQ_ADDR_LO: u32 = 0;
	const PCI_IRQ_INTC: u32 = 1;
	const AARCH64_IRQ_BASE: u32 = 4; // from external/crosvm/aarch64/src/lib.rs
	const GIC_SPI: u32 = 0;
	const IRQ_TYPE_LEVEL_HIGH: u32 = 4;

	let pci_addr = (irq_map[0], irq_map[1], irq_map[2]);
	let pci_irq_number = irq_map[3];
	let _controller_phandle = irq_map[4]; // skipped.
	let gic_addr = (irq_map[5], irq_map[6]); // address-cells is <2> for GIC
	// interrupt-cells is <3> for GIC
	let gic_peripheral_interrupt_type = irq_map[7];
	let gic_irq_number = irq_map[8];
	let gic_irq_type = irq_map[9];

	let phys_hi: u32 = (0x1 << PCI_DEVICE_IDX) * (idx + 1) as u32;
	let expected_pci_addr = (phys_hi, PCI_IRQ_ADDR_ME, PCI_IRQ_ADDR_LO);

	if pci_addr != expected_pci_addr {
	error!("PCI device address {:#x} {:#x} {:#x} in interrupt-map is different from expected address \
	{:#x} {:#x} {:#x}",
	pci_addr.0, pci_addr.1, pci_addr.2, expected_pci_addr.0, expected_pci_addr.1, expected_pci_addr.2);
	return Err(RebootReason::InvalidFdt);
	}

	if pci_irq_number != PCI_IRQ_INTC {
	error!(
	"PCI INT# {:#x} in interrupt-map is different from expected value {:#x}",
	pci_irq_number, PCI_IRQ_INTC
	);
	return Err(RebootReason::InvalidFdt);
	}

	if gic_addr != (0, 0) {
	error!(
	"GIC address {:#x} {:#x} in interrupt-map is different from expected address \
	{:#x} {:#x}",
	gic_addr.0, gic_addr.1, 0, 0
	);
	return Err(RebootReason::InvalidFdt);
	}

	if gic_peripheral_interrupt_type != GIC_SPI {
	error!("GIC peripheral interrupt type {:#x} in interrupt-map is different from expected value \
	{:#x}", gic_peripheral_interrupt_type, GIC_SPI);
	return Err(RebootReason::InvalidFdt);
	}

	let irq_nr: u32 = AARCH64_IRQ_BASE + (idx as u32);
	if gic_irq_number != irq_nr {
	error!(
	"GIC irq number {:#x} in interrupt-map is unexpected. Expected {:#x}",
	gic_irq_number, irq_nr
	);
	return Err(RebootReason::InvalidFdt);
	}

	if gic_irq_type != IRQ_TYPE_LEVEL_HIGH {
	error!(
	"IRQ type in {:#x} is invalid. Must be LEVEL_HIGH {:#x}",
	gic_irq_type, IRQ_TYPE_LEVEL_HIGH
	);
	return Err(RebootReason::InvalidFdt);
	}
	Ok(())
	}

	#[derive(Default, Debug)]
	#[allow(dead_code)] // TODO: remove this
	struct SerialInfo {
	addrs: ArrayVec<[u64; Self::MAX_SERIALS]>,
	}

	impl SerialInfo {
	const MAX_SERIALS: usize = 4;
	}

	fn read_serial_info_from(fdt: &Fdt) -> libfdt::Result<SerialInfo> {
	let mut addrs: ArrayVec<[u64; SerialInfo::MAX_SERIALS]> = Default::default();
	for node in fdt.compatible_nodes(cstr!("ns16550a"))?.take(SerialInfo::MAX_SERIALS) {
	let reg = node.reg()?.ok_or(FdtError::NotFound)?.next().ok_or(FdtError::NotFound)?;
	addrs.push(reg.addr);
	}
	Ok(SerialInfo { addrs })
	}

	#[derive(Debug)]
	#[allow(dead_code)] // TODO: remove this
	struct SwiotlbInfo {
	size: u64,
	align: u64,
	}

	fn read_swiotlb_info_from(fdt: &Fdt) -> libfdt::Result<SwiotlbInfo> {
	let node =
	fdt.compatible_nodes(cstr!("restricted-dma-pool"))?.next().ok_or(FdtError::NotFound)?;
	let size = node.getprop_u64(cstr!("size"))?.ok_or(FdtError::NotFound)?;
	let align = node.getprop_u64(cstr!("alignment"))?.ok_or(FdtError::NotFound)?;
	Ok(SwiotlbInfo { size, align })
	}

	fn validate_swiotlb_info(swiotlb_info: &SwiotlbInfo) -> Result<(), RebootReason> {
	let size = swiotlb_info.size;
	let align = swiotlb_info.align;

	if size == 0 \|\| (size % GUEST_PAGE_SIZE as u64) != 0 {
	error!("Invalid swiotlb size {:#x}", size);
	return Err(RebootReason::InvalidFdt);
	}

	if (align % GUEST_PAGE_SIZE as u64) != 0 {
	error!("Invalid swiotlb alignment {:#x}", align);
	return Err(RebootReason::InvalidFdt);
	}
	Ok(())
	}

	#[derive(Debug)]
	#[allow(dead_code)] // TODO: remove this
	pub struct DeviceTreeInfo {
	pub kernel_range: Option<Range<usize>>,
	pub initrd_range: Option<Range<usize>>,
	pub memory_range: Range<usize>,
	num_cpus: usize,
	pci_info: PciInfo,
	serial_info: SerialInfo,
	swiotlb_info: SwiotlbInfo,
	}

	impl DeviceTreeInfo {
	const RAM_BASE_ADDR: u64 = 0x8000_0000;
	}

	pub fn sanitize_device_tree(fdt: &mut libfdt::Fdt) -> Result<DeviceTreeInfo, RebootReason> {
	let info = parse_device_tree(fdt)?;
	debug!("Device tree info: {:?}", info);

	// TODO: replace fdt with the template DT
	// TODO: patch the replaced fdt using info
	Ok(info)
	}

	fn parse_device_tree(fdt: &libfdt::Fdt) -> Result<DeviceTreeInfo, RebootReason> {
	let kernel_range = read_kernel_range_from(fdt).map_err(\|e\| {
	error!("Failed to read kernel range from DT: {e}");
	RebootReason::InvalidFdt
	})?;

	let initrd_range = read_initrd_range_from(fdt).map_err(\|e\| {
	error!("Failed to read initrd range from DT: {e}");
	RebootReason::InvalidFdt
	})?;

	let memory_range = read_memory_range_from(fdt).map_err(\|e\| {
	error!("Failed to read memory range from DT: {e}");
	RebootReason::InvalidFdt
	})?;
	validate_memory_range(&memory_range)?;

	let num_cpus = read_num_cpus_from(fdt).map_err(\|e\| {
	error!("Failed to read num cpus from DT: {e}");
	RebootReason::InvalidFdt
	})?;
	validate_num_cpus(num_cpus)?;

	let pci_info = read_pci_info_from(fdt).map_err(\|e\| {
	error!("Failed to read pci info from DT: {e}");
	RebootReason::InvalidFdt
	})?;
	validate_pci_info(&pci_info)?;

	let serial_info = read_serial_info_from(fdt).map_err(\|e\| {
	error!("Failed to read serial info from DT: {e}");
	RebootReason::InvalidFdt
	})?;

	let swiotlb_info = read_swiotlb_info_from(fdt).map_err(\|e\| {
	error!("Failed to read swiotlb info from DT: {e}");
	RebootReason::InvalidFdt
	})?;
	validate_swiotlb_info(&swiotlb_info)?;

	Ok(DeviceTreeInfo {
	kernel_range,
	initrd_range,
	memory_range,
	num_cpus,
	pci_info,
	serial_info,
	swiotlb_info,
	})
	}

	/// Modifies the input DT according to the fields of the configuration.
	pub fn modify_for_next_stage(
	fdt: &mut Fdt,
	bcc: &[u8],
	new_instance: bool,
	strict_boot: bool,
	) -> libfdt::Result<()> {
	fdt.unpack()?;

	add_dice_node(fdt, bcc.as_ptr() as usize, bcc.len())?;

	set_or_clear_chosen_flag(fdt, cstr!("avf,strict-boot"), strict_boot)?;
	set_or_clear_chosen_flag(fdt, cstr!("avf,new-instance"), new_instance)?;

	fdt.pack()?;

	Ok(())
	}

	/// Add a "google,open-dice"-compatible reserved-memory node to the tree.
	fn add_dice_node(fdt: &mut Fdt, addr: usize, size: usize) -> libfdt::Result<()> {
	// We reject DTs with missing reserved-memory node as validation should have checked that the
	// "swiotlb" subnode (compatible = "restricted-dma-pool") was present.
	let mut reserved_memory =
	fdt.node_mut(cstr!("/reserved-memory"))?.ok_or(libfdt::FdtError::NotFound)?;

	let mut dice = reserved_memory.add_subnode(cstr!("dice"))?;

	dice.appendprop(cstr!("compatible"), b"google,open-dice\0")?;

	dice.appendprop(cstr!("no-map"), &[])?;

	let addr = addr.try_into().unwrap();
	let size = size.try_into().unwrap();
	dice.appendprop_addrrange(cstr!("reg"), addr, size)?;

	Ok(())
	}

	fn set_or_clear_chosen_flag(fdt: &mut Fdt, flag: &CStr, value: bool) -> libfdt::Result<()> {
	// TODO(b/249054080): Refactor to not panic if the DT doesn't contain a /chosen node.
	let mut chosen = fdt.chosen_mut()?.unwrap();
	if value {
	chosen.setprop_empty(flag)?;
	} else {
	match chosen.delprop(flag) {
	Ok(()) \| Err(FdtError::NotFound) => (),
	Err(e) => return Err(e),
	}
	}

	Ok(())
	}