blob: 5fbc7671e7f33a465b4d20193ae3df28072d6b50 [file] [log] [blame]
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +00001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! High-level FDT functions.
16
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090017use crate::bootargs::BootArgsIterator;
Jaewan Kimc6e023b2023-10-12 15:11:05 +090018use crate::device_assignment::DeviceAssignmentInfo;
19use crate::device_assignment::VmDtbo;
Jiyong Park00ceff32023-03-13 05:43:23 +000020use crate::helpers::GUEST_PAGE_SIZE;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090021use crate::Box;
Jiyong Park00ceff32023-03-13 05:43:23 +000022use crate::RebootReason;
Jiyong Parke9d87e82023-03-21 19:28:40 +090023use alloc::ffi::CString;
Jiyong Parkc23426b2023-04-10 17:32:27 +090024use alloc::vec::Vec;
Jiyong Park0ee65392023-03-27 20:52:45 +090025use core::cmp::max;
26use core::cmp::min;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000027use core::ffi::CStr;
Alice Wangabc7d632023-06-14 09:10:14 +000028use core::fmt;
Jiyong Park9c63cd12023-03-21 17:53:07 +090029use core::mem::size_of;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000030use core::ops::Range;
Pierre-Clément Tosi1bf532b2023-11-13 11:06:20 +000031use cstr::cstr;
Jiyong Park00ceff32023-03-13 05:43:23 +000032use fdtpci::PciMemoryFlags;
33use fdtpci::PciRangeType;
34use libfdt::AddressRange;
35use libfdt::CellIterator;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +000036use libfdt::Fdt;
37use libfdt::FdtError;
Jiyong Park9c63cd12023-03-21 17:53:07 +090038use libfdt::FdtNode;
Alice Wang56ec45b2023-06-15 08:30:32 +000039use libfdt::FdtNodeMut;
Jiyong Park83316122023-03-21 09:39:39 +090040use log::debug;
Jiyong Park00ceff32023-03-13 05:43:23 +000041use log::error;
Jiyong Parkc23426b2023-04-10 17:32:27 +090042use log::info;
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +000043use log::warn;
Jiyong Park00ceff32023-03-13 05:43:23 +000044use tinyvec::ArrayVec;
Alice Wanga3971062023-06-13 11:48:53 +000045use vmbase::fdt::SwiotlbInfo;
Alice Wang63f4c9e2023-06-12 09:36:43 +000046use vmbase::layout::{crosvm::MEM_START, MAX_VIRT_ADDR};
Alice Wangeacb7382023-06-05 12:53:54 +000047use vmbase::memory::SIZE_4KB;
48use vmbase::util::flatten;
Alice Wang4be4dd02023-06-07 07:50:40 +000049use vmbase::util::RangeExt as _;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000050
Alice Wangabc7d632023-06-14 09:10:14 +000051/// An enumeration of errors that can occur during the FDT validation.
52#[derive(Clone, Debug)]
53pub enum FdtValidationError {
54 /// Invalid CPU count.
55 InvalidCpuCount(usize),
56}
57
58impl fmt::Display for FdtValidationError {
59 fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
60 match self {
61 Self::InvalidCpuCount(num_cpus) => write!(f, "Invalid CPU count: {num_cpus}"),
62 }
63 }
64}
65
Jiyong Park6a8789a2023-03-21 14:50:59 +090066/// Extract from /config the address range containing the pre-loaded kernel. Absence of /config is
67/// not an error.
68fn read_kernel_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
Jiyong Parkb87f3302023-03-21 10:03:11 +090069 let addr = cstr!("kernel-address");
70 let size = cstr!("kernel-size");
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +000071
Jiyong Parkb87f3302023-03-21 10:03:11 +090072 if let Some(config) = fdt.node(cstr!("/config"))? {
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +000073 if let (Some(addr), Some(size)) = (config.getprop_u32(addr)?, config.getprop_u32(size)?) {
74 let addr = addr as usize;
75 let size = size as usize;
76
77 return Ok(Some(addr..(addr + size)));
78 }
79 }
80
81 Ok(None)
82}
83
Jiyong Park6a8789a2023-03-21 14:50:59 +090084/// Extract from /chosen the address range containing the pre-loaded ramdisk. Absence is not an
85/// error as there can be initrd-less VM.
86fn read_initrd_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
Jiyong Parkb87f3302023-03-21 10:03:11 +090087 let start = cstr!("linux,initrd-start");
88 let end = cstr!("linux,initrd-end");
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000089
90 if let Some(chosen) = fdt.chosen()? {
91 if let (Some(start), Some(end)) = (chosen.getprop_u32(start)?, chosen.getprop_u32(end)?) {
92 return Ok(Some((start as usize)..(end as usize)));
93 }
94 }
95
96 Ok(None)
97}
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +000098
Jiyong Park9c63cd12023-03-21 17:53:07 +090099fn patch_initrd_range(fdt: &mut Fdt, initrd_range: &Range<usize>) -> libfdt::Result<()> {
100 let start = u32::try_from(initrd_range.start).unwrap();
101 let end = u32::try_from(initrd_range.end).unwrap();
102
103 let mut node = fdt.chosen_mut()?.ok_or(FdtError::NotFound)?;
104 node.setprop(cstr!("linux,initrd-start"), &start.to_be_bytes())?;
105 node.setprop(cstr!("linux,initrd-end"), &end.to_be_bytes())?;
106 Ok(())
107}
108
Jiyong Parke9d87e82023-03-21 19:28:40 +0900109fn read_bootargs_from(fdt: &Fdt) -> libfdt::Result<Option<CString>> {
110 if let Some(chosen) = fdt.chosen()? {
111 if let Some(bootargs) = chosen.getprop_str(cstr!("bootargs"))? {
112 // We need to copy the string to heap because the original fdt will be invalidated
113 // by the templated DT
114 let copy = CString::new(bootargs.to_bytes()).map_err(|_| FdtError::BadValue)?;
115 return Ok(Some(copy));
116 }
117 }
118 Ok(None)
119}
120
121fn patch_bootargs(fdt: &mut Fdt, bootargs: &CStr) -> libfdt::Result<()> {
122 let mut node = fdt.chosen_mut()?.ok_or(FdtError::NotFound)?;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900123 // This function is called before the verification is done. So, we just copy the bootargs to
124 // the new FDT unmodified. This will be filtered again in the modify_for_next_stage function
125 // if the VM is not debuggable.
Jiyong Parke9d87e82023-03-21 19:28:40 +0900126 node.setprop(cstr!("bootargs"), bootargs.to_bytes_with_nul())
127}
128
Alice Wang0d527472023-06-13 14:55:38 +0000129/// Reads and validates the memory range in the DT.
130///
131/// Only one memory range is expected with the crosvm setup for now.
132fn read_and_validate_memory_range(fdt: &Fdt) -> Result<Range<usize>, RebootReason> {
133 let mut memory = fdt.memory().map_err(|e| {
134 error!("Failed to read memory range from DT: {e}");
135 RebootReason::InvalidFdt
136 })?;
137 let range = memory.next().ok_or_else(|| {
138 error!("The /memory node in the DT contains no range.");
139 RebootReason::InvalidFdt
140 })?;
141 if memory.next().is_some() {
142 warn!(
143 "The /memory node in the DT contains more than one memory range, \
144 while only one is expected."
145 );
146 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900147 let base = range.start;
Alice Wange243d462023-06-06 15:18:12 +0000148 if base != MEM_START {
149 error!("Memory base address {:#x} is not {:#x}", base, MEM_START);
Jiyong Park00ceff32023-03-13 05:43:23 +0000150 return Err(RebootReason::InvalidFdt);
151 }
152
Jiyong Park6a8789a2023-03-21 14:50:59 +0900153 let size = range.len();
Jiyong Park00ceff32023-03-13 05:43:23 +0000154 if size % GUEST_PAGE_SIZE != 0 {
155 error!("Memory size {:#x} is not a multiple of page size {:#x}", size, GUEST_PAGE_SIZE);
156 return Err(RebootReason::InvalidFdt);
157 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000158
Jiyong Park6a8789a2023-03-21 14:50:59 +0900159 if size == 0 {
160 error!("Memory size is 0");
161 return Err(RebootReason::InvalidFdt);
162 }
Alice Wang0d527472023-06-13 14:55:38 +0000163 Ok(range)
Jiyong Park00ceff32023-03-13 05:43:23 +0000164}
165
Jiyong Park9c63cd12023-03-21 17:53:07 +0900166fn patch_memory_range(fdt: &mut Fdt, memory_range: &Range<usize>) -> libfdt::Result<()> {
167 let size = memory_range.len() as u64;
Jiyong Park0ee65392023-03-27 20:52:45 +0900168 fdt.node_mut(cstr!("/memory"))?
169 .ok_or(FdtError::NotFound)?
Alice Wange243d462023-06-06 15:18:12 +0000170 .setprop_inplace(cstr!("reg"), flatten(&[MEM_START.to_be_bytes(), size.to_be_bytes()]))
Jiyong Park9c63cd12023-03-21 17:53:07 +0900171}
172
Jiyong Park6a8789a2023-03-21 14:50:59 +0900173/// Read the number of CPUs from DT
174fn read_num_cpus_from(fdt: &Fdt) -> libfdt::Result<usize> {
175 Ok(fdt.compatible_nodes(cstr!("arm,arm-v8"))?.count())
176}
177
178/// Validate number of CPUs
Alice Wangabc7d632023-06-14 09:10:14 +0000179fn validate_num_cpus(num_cpus: usize) -> Result<(), FdtValidationError> {
180 if num_cpus == 0 || DeviceTreeInfo::gic_patched_size(num_cpus).is_none() {
181 Err(FdtValidationError::InvalidCpuCount(num_cpus))
182 } else {
183 Ok(())
Jiyong Park6a8789a2023-03-21 14:50:59 +0900184 }
Jiyong Park9c63cd12023-03-21 17:53:07 +0900185}
186
187/// Patch DT by keeping `num_cpus` number of arm,arm-v8 compatible nodes, and pruning the rest.
188fn patch_num_cpus(fdt: &mut Fdt, num_cpus: usize) -> libfdt::Result<()> {
189 let cpu = cstr!("arm,arm-v8");
190 let mut next = fdt.root_mut()?.next_compatible(cpu)?;
191 for _ in 0..num_cpus {
192 next = if let Some(current) = next {
193 current.next_compatible(cpu)?
194 } else {
195 return Err(FdtError::NoSpace);
196 };
197 }
198 while let Some(current) = next {
199 next = current.delete_and_next_compatible(cpu)?;
200 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900201 Ok(())
Jiyong Park00ceff32023-03-13 05:43:23 +0000202}
203
Seungjae Yooed67fd52023-11-29 18:54:36 +0900204fn read_vendor_public_key_from(fdt: &Fdt) -> libfdt::Result<Option<Vec<u8>>> {
205 if let Some(avf_node) = fdt.node(cstr!("/avf"))? {
206 if let Some(vendor_public_key) = avf_node.getprop(cstr!("vendor_public_key"))? {
207 return Ok(Some(vendor_public_key.to_vec()));
208 }
209 }
210 Ok(None)
211}
212
213fn patch_vendor_public_key(fdt: &mut Fdt, vendor_public_key: &[u8]) -> libfdt::Result<()> {
214 let mut root_node = fdt.root_mut()?;
215 let mut avf_node = root_node.add_subnode(cstr!("/avf"))?;
216 avf_node.setprop(cstr!("vendor_public_key"), vendor_public_key)?;
217 Ok(())
218}
219
Jiyong Park00ceff32023-03-13 05:43:23 +0000220#[derive(Debug)]
Jiyong Park00ceff32023-03-13 05:43:23 +0000221struct PciInfo {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900222 ranges: [PciAddrRange; 2],
223 irq_masks: ArrayVec<[PciIrqMask; PciInfo::MAX_IRQS]>,
224 irq_maps: ArrayVec<[PciIrqMap; PciInfo::MAX_IRQS]>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000225}
226
Jiyong Park6a8789a2023-03-21 14:50:59 +0900227impl PciInfo {
228 const IRQ_MASK_CELLS: usize = 4;
229 const IRQ_MAP_CELLS: usize = 10;
Nikita Ioffe85d80262023-07-12 17:34:07 +0100230 const MAX_IRQS: usize = 10;
Jiyong Park00ceff32023-03-13 05:43:23 +0000231}
232
Jiyong Park6a8789a2023-03-21 14:50:59 +0900233type PciAddrRange = AddressRange<(u32, u64), u64, u64>;
234type PciIrqMask = [u32; PciInfo::IRQ_MASK_CELLS];
235type PciIrqMap = [u32; PciInfo::IRQ_MAP_CELLS];
Jiyong Park00ceff32023-03-13 05:43:23 +0000236
237/// Iterator that takes N cells as a chunk
238struct CellChunkIterator<'a, const N: usize> {
239 cells: CellIterator<'a>,
240}
241
242impl<'a, const N: usize> CellChunkIterator<'a, N> {
243 fn new(cells: CellIterator<'a>) -> Self {
244 Self { cells }
245 }
246}
247
248impl<'a, const N: usize> Iterator for CellChunkIterator<'a, N> {
249 type Item = [u32; N];
250 fn next(&mut self) -> Option<Self::Item> {
251 let mut ret: Self::Item = [0; N];
252 for i in ret.iter_mut() {
253 *i = self.cells.next()?;
254 }
255 Some(ret)
256 }
257}
258
Jiyong Park6a8789a2023-03-21 14:50:59 +0900259/// Read pci host controller ranges, irq maps, and irq map masks from DT
260fn read_pci_info_from(fdt: &Fdt) -> libfdt::Result<PciInfo> {
261 let node =
262 fdt.compatible_nodes(cstr!("pci-host-cam-generic"))?.next().ok_or(FdtError::NotFound)?;
263
264 let mut ranges = node.ranges::<(u32, u64), u64, u64>()?.ok_or(FdtError::NotFound)?;
265 let range0 = ranges.next().ok_or(FdtError::NotFound)?;
266 let range1 = ranges.next().ok_or(FdtError::NotFound)?;
267
268 let irq_masks = node.getprop_cells(cstr!("interrupt-map-mask"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosiaa0f6552023-07-12 14:49:35 +0000269 let mut chunks = CellChunkIterator::<{ PciInfo::IRQ_MASK_CELLS }>::new(irq_masks);
270 let irq_masks = (&mut chunks).take(PciInfo::MAX_IRQS).collect();
271
272 if chunks.next().is_some() {
273 warn!("Input DT has more than {} PCI entries!", PciInfo::MAX_IRQS);
274 return Err(FdtError::NoSpace);
275 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900276
277 let irq_maps = node.getprop_cells(cstr!("interrupt-map"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosiaa0f6552023-07-12 14:49:35 +0000278 let mut chunks = CellChunkIterator::<{ PciInfo::IRQ_MAP_CELLS }>::new(irq_maps);
279 let irq_maps = (&mut chunks).take(PciInfo::MAX_IRQS).collect();
280
281 if chunks.next().is_some() {
282 warn!("Input DT has more than {} PCI entries!", PciInfo::MAX_IRQS);
283 return Err(FdtError::NoSpace);
284 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900285
286 Ok(PciInfo { ranges: [range0, range1], irq_masks, irq_maps })
287}
288
Jiyong Park0ee65392023-03-27 20:52:45 +0900289fn validate_pci_info(pci_info: &PciInfo, memory_range: &Range<usize>) -> Result<(), RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900290 for range in pci_info.ranges.iter() {
Jiyong Park0ee65392023-03-27 20:52:45 +0900291 validate_pci_addr_range(range, memory_range)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900292 }
293 for irq_mask in pci_info.irq_masks.iter() {
294 validate_pci_irq_mask(irq_mask)?;
295 }
296 for (idx, irq_map) in pci_info.irq_maps.iter().enumerate() {
297 validate_pci_irq_map(irq_map, idx)?;
298 }
299 Ok(())
300}
301
Jiyong Park0ee65392023-03-27 20:52:45 +0900302fn validate_pci_addr_range(
303 range: &PciAddrRange,
304 memory_range: &Range<usize>,
305) -> Result<(), RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900306 let mem_flags = PciMemoryFlags(range.addr.0);
307 let range_type = mem_flags.range_type();
308 let prefetchable = mem_flags.prefetchable();
309 let bus_addr = range.addr.1;
310 let cpu_addr = range.parent_addr;
311 let size = range.size;
312
313 if range_type != PciRangeType::Memory64 {
314 error!("Invalid range type {:?} for bus address {:#x} in PCI node", range_type, bus_addr);
315 return Err(RebootReason::InvalidFdt);
316 }
317 if prefetchable {
318 error!("PCI bus address {:#x} in PCI node is prefetchable", bus_addr);
319 return Err(RebootReason::InvalidFdt);
320 }
321 // Enforce ID bus-to-cpu mappings, as used by crosvm.
322 if bus_addr != cpu_addr {
323 error!("PCI bus address: {:#x} is different from CPU address: {:#x}", bus_addr, cpu_addr);
324 return Err(RebootReason::InvalidFdt);
325 }
326
Jiyong Park0ee65392023-03-27 20:52:45 +0900327 let Some(bus_end) = bus_addr.checked_add(size) else {
328 error!("PCI address range size {:#x} overflows", size);
329 return Err(RebootReason::InvalidFdt);
330 };
Alice Wang63f4c9e2023-06-12 09:36:43 +0000331 if bus_end > MAX_VIRT_ADDR.try_into().unwrap() {
Jiyong Park0ee65392023-03-27 20:52:45 +0900332 error!("PCI address end {:#x} is outside of translatable range", bus_end);
333 return Err(RebootReason::InvalidFdt);
334 }
335
336 let memory_start = memory_range.start.try_into().unwrap();
337 let memory_end = memory_range.end.try_into().unwrap();
338
339 if max(bus_addr, memory_start) < min(bus_end, memory_end) {
340 error!(
341 "PCI address range {:#x}-{:#x} overlaps with main memory range {:#x}-{:#x}",
342 bus_addr, bus_end, memory_start, memory_end
343 );
Jiyong Park6a8789a2023-03-21 14:50:59 +0900344 return Err(RebootReason::InvalidFdt);
345 }
346
347 Ok(())
348}
349
350fn validate_pci_irq_mask(irq_mask: &PciIrqMask) -> Result<(), RebootReason> {
Jiyong Park00ceff32023-03-13 05:43:23 +0000351 const IRQ_MASK_ADDR_HI: u32 = 0xf800;
352 const IRQ_MASK_ADDR_ME: u32 = 0x0;
353 const IRQ_MASK_ADDR_LO: u32 = 0x0;
354 const IRQ_MASK_ANY_IRQ: u32 = 0x7;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900355 const EXPECTED: PciIrqMask =
Jiyong Park00ceff32023-03-13 05:43:23 +0000356 [IRQ_MASK_ADDR_HI, IRQ_MASK_ADDR_ME, IRQ_MASK_ADDR_LO, IRQ_MASK_ANY_IRQ];
Jiyong Park6a8789a2023-03-21 14:50:59 +0900357 if *irq_mask != EXPECTED {
358 error!("Invalid PCI irq mask {:#?}", irq_mask);
359 return Err(RebootReason::InvalidFdt);
Jiyong Park00ceff32023-03-13 05:43:23 +0000360 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900361 Ok(())
Jiyong Park00ceff32023-03-13 05:43:23 +0000362}
363
Jiyong Park6a8789a2023-03-21 14:50:59 +0900364fn validate_pci_irq_map(irq_map: &PciIrqMap, idx: usize) -> Result<(), RebootReason> {
Jiyong Park00ceff32023-03-13 05:43:23 +0000365 const PCI_DEVICE_IDX: usize = 11;
366 const PCI_IRQ_ADDR_ME: u32 = 0;
367 const PCI_IRQ_ADDR_LO: u32 = 0;
368 const PCI_IRQ_INTC: u32 = 1;
369 const AARCH64_IRQ_BASE: u32 = 4; // from external/crosvm/aarch64/src/lib.rs
370 const GIC_SPI: u32 = 0;
371 const IRQ_TYPE_LEVEL_HIGH: u32 = 4;
372
Jiyong Park6a8789a2023-03-21 14:50:59 +0900373 let pci_addr = (irq_map[0], irq_map[1], irq_map[2]);
374 let pci_irq_number = irq_map[3];
375 let _controller_phandle = irq_map[4]; // skipped.
376 let gic_addr = (irq_map[5], irq_map[6]); // address-cells is <2> for GIC
377 // interrupt-cells is <3> for GIC
378 let gic_peripheral_interrupt_type = irq_map[7];
379 let gic_irq_number = irq_map[8];
380 let gic_irq_type = irq_map[9];
Jiyong Park00ceff32023-03-13 05:43:23 +0000381
Jiyong Park6a8789a2023-03-21 14:50:59 +0900382 let phys_hi: u32 = (0x1 << PCI_DEVICE_IDX) * (idx + 1) as u32;
383 let expected_pci_addr = (phys_hi, PCI_IRQ_ADDR_ME, PCI_IRQ_ADDR_LO);
Jiyong Park00ceff32023-03-13 05:43:23 +0000384
Jiyong Park6a8789a2023-03-21 14:50:59 +0900385 if pci_addr != expected_pci_addr {
386 error!("PCI device address {:#x} {:#x} {:#x} in interrupt-map is different from expected address \
387 {:#x} {:#x} {:#x}",
388 pci_addr.0, pci_addr.1, pci_addr.2, expected_pci_addr.0, expected_pci_addr.1, expected_pci_addr.2);
389 return Err(RebootReason::InvalidFdt);
390 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000391
Jiyong Park6a8789a2023-03-21 14:50:59 +0900392 if pci_irq_number != PCI_IRQ_INTC {
393 error!(
394 "PCI INT# {:#x} in interrupt-map is different from expected value {:#x}",
395 pci_irq_number, PCI_IRQ_INTC
396 );
397 return Err(RebootReason::InvalidFdt);
398 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000399
Jiyong Park6a8789a2023-03-21 14:50:59 +0900400 if gic_addr != (0, 0) {
401 error!(
402 "GIC address {:#x} {:#x} in interrupt-map is different from expected address \
403 {:#x} {:#x}",
404 gic_addr.0, gic_addr.1, 0, 0
405 );
406 return Err(RebootReason::InvalidFdt);
407 }
408
409 if gic_peripheral_interrupt_type != GIC_SPI {
410 error!("GIC peripheral interrupt type {:#x} in interrupt-map is different from expected value \
411 {:#x}", gic_peripheral_interrupt_type, GIC_SPI);
412 return Err(RebootReason::InvalidFdt);
413 }
414
415 let irq_nr: u32 = AARCH64_IRQ_BASE + (idx as u32);
416 if gic_irq_number != irq_nr {
417 error!(
418 "GIC irq number {:#x} in interrupt-map is unexpected. Expected {:#x}",
419 gic_irq_number, irq_nr
420 );
421 return Err(RebootReason::InvalidFdt);
422 }
423
424 if gic_irq_type != IRQ_TYPE_LEVEL_HIGH {
425 error!(
426 "IRQ type in {:#x} is invalid. Must be LEVEL_HIGH {:#x}",
427 gic_irq_type, IRQ_TYPE_LEVEL_HIGH
428 );
429 return Err(RebootReason::InvalidFdt);
Jiyong Park00ceff32023-03-13 05:43:23 +0000430 }
431 Ok(())
432}
433
Jiyong Park9c63cd12023-03-21 17:53:07 +0900434fn patch_pci_info(fdt: &mut Fdt, pci_info: &PciInfo) -> libfdt::Result<()> {
435 let mut node = fdt
436 .root_mut()?
437 .next_compatible(cstr!("pci-host-cam-generic"))?
438 .ok_or(FdtError::NotFound)?;
439
440 let irq_masks_size = pci_info.irq_masks.len() * size_of::<PciIrqMask>();
441 node.trimprop(cstr!("interrupt-map-mask"), irq_masks_size)?;
442
443 let irq_maps_size = pci_info.irq_maps.len() * size_of::<PciIrqMap>();
444 node.trimprop(cstr!("interrupt-map"), irq_maps_size)?;
445
446 node.setprop_inplace(
447 cstr!("ranges"),
448 flatten(&[pci_info.ranges[0].to_cells(), pci_info.ranges[1].to_cells()]),
449 )
450}
451
Jiyong Park00ceff32023-03-13 05:43:23 +0000452#[derive(Default, Debug)]
Jiyong Park6a8789a2023-03-21 14:50:59 +0900453struct SerialInfo {
454 addrs: ArrayVec<[u64; Self::MAX_SERIALS]>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000455}
456
457impl SerialInfo {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900458 const MAX_SERIALS: usize = 4;
Jiyong Park00ceff32023-03-13 05:43:23 +0000459}
460
Jiyong Park6a8789a2023-03-21 14:50:59 +0900461fn read_serial_info_from(fdt: &Fdt) -> libfdt::Result<SerialInfo> {
462 let mut addrs: ArrayVec<[u64; SerialInfo::MAX_SERIALS]> = Default::default();
463 for node in fdt.compatible_nodes(cstr!("ns16550a"))?.take(SerialInfo::MAX_SERIALS) {
Alice Wang6ff2d0c2023-09-19 15:28:43 +0000464 let reg = node.first_reg()?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900465 addrs.push(reg.addr);
Jiyong Park00ceff32023-03-13 05:43:23 +0000466 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900467 Ok(SerialInfo { addrs })
Jiyong Park00ceff32023-03-13 05:43:23 +0000468}
469
Jiyong Park9c63cd12023-03-21 17:53:07 +0900470/// Patch the DT by deleting the ns16550a compatible nodes whose address are unknown
471fn patch_serial_info(fdt: &mut Fdt, serial_info: &SerialInfo) -> libfdt::Result<()> {
472 let name = cstr!("ns16550a");
473 let mut next = fdt.root_mut()?.next_compatible(name);
474 while let Some(current) = next? {
475 let reg = FdtNode::from_mut(&current)
476 .reg()?
477 .ok_or(FdtError::NotFound)?
478 .next()
479 .ok_or(FdtError::NotFound)?;
480 next = if !serial_info.addrs.contains(&reg.addr) {
481 current.delete_and_next_compatible(name)
482 } else {
483 current.next_compatible(name)
484 }
485 }
486 Ok(())
487}
488
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700489fn validate_swiotlb_info(
490 swiotlb_info: &SwiotlbInfo,
491 memory: &Range<usize>,
492) -> Result<(), RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900493 let size = swiotlb_info.size;
494 let align = swiotlb_info.align;
Jiyong Park00ceff32023-03-13 05:43:23 +0000495
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700496 if size == 0 || (size % GUEST_PAGE_SIZE) != 0 {
Jiyong Park00ceff32023-03-13 05:43:23 +0000497 error!("Invalid swiotlb size {:#x}", size);
498 return Err(RebootReason::InvalidFdt);
499 }
500
Pierre-Clément Tosibe3a97b2023-05-19 14:56:23 +0000501 if let Some(align) = align.filter(|&a| a % GUEST_PAGE_SIZE != 0) {
Jiyong Park00ceff32023-03-13 05:43:23 +0000502 error!("Invalid swiotlb alignment {:#x}", align);
503 return Err(RebootReason::InvalidFdt);
504 }
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700505
Alice Wang9cfbfd62023-06-14 11:19:03 +0000506 if let Some(addr) = swiotlb_info.addr {
507 if addr.checked_add(size).is_none() {
508 error!("Invalid swiotlb range: addr:{addr:#x} size:{size:#x}");
509 return Err(RebootReason::InvalidFdt);
510 }
511 }
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700512 if let Some(range) = swiotlb_info.fixed_range() {
513 if !range.is_within(memory) {
514 error!("swiotlb range {range:#x?} not part of memory range {memory:#x?}");
515 return Err(RebootReason::InvalidFdt);
516 }
517 }
518
Jiyong Park6a8789a2023-03-21 14:50:59 +0900519 Ok(())
Jiyong Park00ceff32023-03-13 05:43:23 +0000520}
521
Jiyong Park9c63cd12023-03-21 17:53:07 +0900522fn patch_swiotlb_info(fdt: &mut Fdt, swiotlb_info: &SwiotlbInfo) -> libfdt::Result<()> {
523 let mut node =
524 fdt.root_mut()?.next_compatible(cstr!("restricted-dma-pool"))?.ok_or(FdtError::NotFound)?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700525
526 if let Some(range) = swiotlb_info.fixed_range() {
Pierre-Clément Tosic27c4272023-05-19 15:46:26 +0000527 node.setprop_addrrange_inplace(
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700528 cstr!("reg"),
529 range.start.try_into().unwrap(),
530 range.len().try_into().unwrap(),
531 )?;
Pierre-Clément Tosibe3a97b2023-05-19 14:56:23 +0000532 node.nop_property(cstr!("size"))?;
533 node.nop_property(cstr!("alignment"))?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700534 } else {
Pierre-Clément Tosic27c4272023-05-19 15:46:26 +0000535 node.nop_property(cstr!("reg"))?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700536 node.setprop_inplace(cstr!("size"), &swiotlb_info.size.to_be_bytes())?;
Pierre-Clément Tosibe3a97b2023-05-19 14:56:23 +0000537 node.setprop_inplace(cstr!("alignment"), &swiotlb_info.align.unwrap().to_be_bytes())?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700538 }
539
Jiyong Park9c63cd12023-03-21 17:53:07 +0900540 Ok(())
541}
542
543fn patch_gic(fdt: &mut Fdt, num_cpus: usize) -> libfdt::Result<()> {
544 let node = fdt.compatible_nodes(cstr!("arm,gic-v3"))?.next().ok_or(FdtError::NotFound)?;
545 let mut ranges = node.reg()?.ok_or(FdtError::NotFound)?;
546 let range0 = ranges.next().ok_or(FdtError::NotFound)?;
547 let mut range1 = ranges.next().ok_or(FdtError::NotFound)?;
548
549 let addr = range0.addr;
Alice Wangabc7d632023-06-14 09:10:14 +0000550 // `validate_num_cpus()` checked that this wouldn't panic
551 let size = u64::try_from(DeviceTreeInfo::gic_patched_size(num_cpus).unwrap()).unwrap();
Jiyong Park9c63cd12023-03-21 17:53:07 +0900552
553 // range1 is just below range0
554 range1.addr = addr - size;
555 range1.size = Some(size);
556
557 let range0 = range0.to_cells();
558 let range1 = range1.to_cells();
559 let value = [
560 range0.0, // addr
561 range0.1.unwrap(), //size
562 range1.0, // addr
563 range1.1.unwrap(), //size
564 ];
565
566 let mut node =
567 fdt.root_mut()?.next_compatible(cstr!("arm,gic-v3"))?.ok_or(FdtError::NotFound)?;
568 node.setprop_inplace(cstr!("reg"), flatten(&value))
569}
570
571fn patch_timer(fdt: &mut Fdt, num_cpus: usize) -> libfdt::Result<()> {
572 const NUM_INTERRUPTS: usize = 4;
573 const CELLS_PER_INTERRUPT: usize = 3;
574 let node = fdt.compatible_nodes(cstr!("arm,armv8-timer"))?.next().ok_or(FdtError::NotFound)?;
575 let interrupts = node.getprop_cells(cstr!("interrupts"))?.ok_or(FdtError::NotFound)?;
576 let mut value: ArrayVec<[u32; NUM_INTERRUPTS * CELLS_PER_INTERRUPT]> =
577 interrupts.take(NUM_INTERRUPTS * CELLS_PER_INTERRUPT).collect();
578
579 let num_cpus: u32 = num_cpus.try_into().unwrap();
580 let cpu_mask: u32 = (((0x1 << num_cpus) - 1) & 0xff) << 8;
581 for v in value.iter_mut().skip(2).step_by(CELLS_PER_INTERRUPT) {
582 *v |= cpu_mask;
583 }
584 for v in value.iter_mut() {
585 *v = v.to_be();
586 }
587
Andrew Walbran20bb4e42023-07-07 13:55:55 +0100588 // SAFETY: array size is the same
Jiyong Park9c63cd12023-03-21 17:53:07 +0900589 let value = unsafe {
590 core::mem::transmute::<
591 [u32; NUM_INTERRUPTS * CELLS_PER_INTERRUPT],
592 [u8; NUM_INTERRUPTS * CELLS_PER_INTERRUPT * size_of::<u32>()],
593 >(value.into_inner())
594 };
595
596 let mut node =
597 fdt.root_mut()?.next_compatible(cstr!("arm,armv8-timer"))?.ok_or(FdtError::NotFound)?;
598 node.setprop_inplace(cstr!("interrupts"), value.as_slice())
599}
600
Jiyong Park00ceff32023-03-13 05:43:23 +0000601#[derive(Debug)]
Jiyong Park6a8789a2023-03-21 14:50:59 +0900602pub struct DeviceTreeInfo {
603 pub kernel_range: Option<Range<usize>>,
604 pub initrd_range: Option<Range<usize>>,
605 pub memory_range: Range<usize>,
Jiyong Parke9d87e82023-03-21 19:28:40 +0900606 bootargs: Option<CString>,
Jiyong Park6a8789a2023-03-21 14:50:59 +0900607 num_cpus: usize,
Jiyong Park00ceff32023-03-13 05:43:23 +0000608 pci_info: PciInfo,
609 serial_info: SerialInfo,
Srivatsa Vaddagiri37713ec2023-04-20 04:04:08 -0700610 pub swiotlb_info: SwiotlbInfo,
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900611 device_assignment: Option<DeviceAssignmentInfo>,
Seungjae Yooed67fd52023-11-29 18:54:36 +0900612 vendor_public_key: Option<Vec<u8>>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000613}
614
615impl DeviceTreeInfo {
Alice Wangabc7d632023-06-14 09:10:14 +0000616 fn gic_patched_size(num_cpus: usize) -> Option<usize> {
617 const GIC_REDIST_SIZE_PER_CPU: usize = 32 * SIZE_4KB;
618
619 GIC_REDIST_SIZE_PER_CPU.checked_mul(num_cpus)
620 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000621}
622
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900623pub fn sanitize_device_tree(
624 fdt: &mut [u8],
625 vm_dtbo: Option<&mut [u8]>,
626) -> Result<DeviceTreeInfo, RebootReason> {
627 let fdt = Fdt::from_mut_slice(fdt).map_err(|e| {
628 error!("Failed to load FDT: {e}");
629 RebootReason::InvalidFdt
630 })?;
631
632 let vm_dtbo = match vm_dtbo {
633 Some(vm_dtbo) => Some(VmDtbo::from_mut_slice(vm_dtbo).map_err(|e| {
634 error!("Failed to load VM DTBO: {e}");
635 RebootReason::InvalidFdt
636 })?),
637 None => None,
638 };
639
640 let info = parse_device_tree(fdt, vm_dtbo.as_deref())?;
Jiyong Park83316122023-03-21 09:39:39 +0900641
Jiyong Parke9d87e82023-03-21 19:28:40 +0900642 fdt.copy_from_slice(pvmfw_fdt_template::RAW).map_err(|e| {
643 error!("Failed to instantiate FDT from the template DT: {e}");
644 RebootReason::InvalidFdt
645 })?;
646
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900647 if let Some(device_assignment_info) = &info.device_assignment {
648 let vm_dtbo = vm_dtbo.unwrap();
649 device_assignment_info.filter(vm_dtbo).map_err(|e| {
650 error!("Failed to filter VM DTBO: {e}");
651 RebootReason::InvalidFdt
652 })?;
653 // SAFETY: Damaged VM DTBO isn't used in this API after this unsafe block.
654 // VM DTBO can't be reused in any way as Fdt nor VmDtbo outside of this API because
655 // it can only be instantiated after validation.
656 unsafe {
657 fdt.apply_overlay(vm_dtbo.as_mut()).map_err(|e| {
658 error!("Failed to apply filtered VM DTBO: {e}");
659 RebootReason::InvalidFdt
660 })?;
661 }
662 }
663
Jiyong Park9c63cd12023-03-21 17:53:07 +0900664 patch_device_tree(fdt, &info)?;
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900665
Jiyong Park6a8789a2023-03-21 14:50:59 +0900666 Ok(info)
Jiyong Park83316122023-03-21 09:39:39 +0900667}
668
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900669fn parse_device_tree(fdt: &Fdt, vm_dtbo: Option<&VmDtbo>) -> Result<DeviceTreeInfo, RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900670 let kernel_range = read_kernel_range_from(fdt).map_err(|e| {
671 error!("Failed to read kernel range from DT: {e}");
672 RebootReason::InvalidFdt
673 })?;
674
675 let initrd_range = read_initrd_range_from(fdt).map_err(|e| {
676 error!("Failed to read initrd range from DT: {e}");
677 RebootReason::InvalidFdt
678 })?;
679
Alice Wang0d527472023-06-13 14:55:38 +0000680 let memory_range = read_and_validate_memory_range(fdt)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900681
Jiyong Parke9d87e82023-03-21 19:28:40 +0900682 let bootargs = read_bootargs_from(fdt).map_err(|e| {
683 error!("Failed to read bootargs from DT: {e}");
684 RebootReason::InvalidFdt
685 })?;
686
Jiyong Park6a8789a2023-03-21 14:50:59 +0900687 let num_cpus = read_num_cpus_from(fdt).map_err(|e| {
688 error!("Failed to read num cpus from DT: {e}");
689 RebootReason::InvalidFdt
690 })?;
Alice Wangabc7d632023-06-14 09:10:14 +0000691 validate_num_cpus(num_cpus).map_err(|e| {
692 error!("Failed to validate num cpus from DT: {e}");
693 RebootReason::InvalidFdt
694 })?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900695
696 let pci_info = read_pci_info_from(fdt).map_err(|e| {
697 error!("Failed to read pci info from DT: {e}");
698 RebootReason::InvalidFdt
699 })?;
Jiyong Park0ee65392023-03-27 20:52:45 +0900700 validate_pci_info(&pci_info, &memory_range)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900701
702 let serial_info = read_serial_info_from(fdt).map_err(|e| {
703 error!("Failed to read serial info from DT: {e}");
704 RebootReason::InvalidFdt
705 })?;
706
Alice Wang9cfbfd62023-06-14 11:19:03 +0000707 let swiotlb_info = SwiotlbInfo::new_from_fdt(fdt).map_err(|e| {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900708 error!("Failed to read swiotlb info from DT: {e}");
709 RebootReason::InvalidFdt
710 })?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700711 validate_swiotlb_info(&swiotlb_info, &memory_range)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900712
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900713 let device_assignment = match vm_dtbo {
714 Some(vm_dtbo) => DeviceAssignmentInfo::parse(fdt, vm_dtbo).map_err(|e| {
715 error!("Failed to parse device assignment from DT and VM DTBO: {e}");
716 RebootReason::InvalidFdt
717 })?,
718 None => None,
719 };
720
Seungjae Yooed67fd52023-11-29 18:54:36 +0900721 // TODO(b/285854379) : A temporary solution lives. This is for enabling
722 // microdroid vendor partition for non-protected VM as well. When passing
723 // DT path containing vendor_public_key via fstab, init stage will check
724 // if vendor_public_key exists in the init stage, regardless the protection.
725 // Adding this temporary solution will prevent fatal in init stage for
726 // protected VM. However, this data is not trustable without validating
727 // with vendor public key value comes from ABL.
728 let vendor_public_key = read_vendor_public_key_from(fdt).map_err(|e| {
729 error!("Failed to read vendor_public_key from DT: {e}");
730 RebootReason::InvalidFdt
731 })?;
732
Jiyong Park00ceff32023-03-13 05:43:23 +0000733 Ok(DeviceTreeInfo {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900734 kernel_range,
735 initrd_range,
736 memory_range,
Jiyong Parke9d87e82023-03-21 19:28:40 +0900737 bootargs,
Jiyong Park6a8789a2023-03-21 14:50:59 +0900738 num_cpus,
739 pci_info,
740 serial_info,
741 swiotlb_info,
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900742 device_assignment,
Seungjae Yooed67fd52023-11-29 18:54:36 +0900743 vendor_public_key,
Jiyong Park00ceff32023-03-13 05:43:23 +0000744 })
745}
746
Jiyong Park9c63cd12023-03-21 17:53:07 +0900747fn patch_device_tree(fdt: &mut Fdt, info: &DeviceTreeInfo) -> Result<(), RebootReason> {
Jiyong Parke9d87e82023-03-21 19:28:40 +0900748 fdt.unpack().map_err(|e| {
749 error!("Failed to unpack DT for patching: {e}");
750 RebootReason::InvalidFdt
751 })?;
752
Jiyong Park9c63cd12023-03-21 17:53:07 +0900753 if let Some(initrd_range) = &info.initrd_range {
754 patch_initrd_range(fdt, initrd_range).map_err(|e| {
755 error!("Failed to patch initrd range to DT: {e}");
756 RebootReason::InvalidFdt
757 })?;
758 }
759 patch_memory_range(fdt, &info.memory_range).map_err(|e| {
760 error!("Failed to patch memory range to DT: {e}");
761 RebootReason::InvalidFdt
762 })?;
Jiyong Parke9d87e82023-03-21 19:28:40 +0900763 if let Some(bootargs) = &info.bootargs {
764 patch_bootargs(fdt, bootargs.as_c_str()).map_err(|e| {
765 error!("Failed to patch bootargs to DT: {e}");
766 RebootReason::InvalidFdt
767 })?;
768 }
Jiyong Park9c63cd12023-03-21 17:53:07 +0900769 patch_num_cpus(fdt, info.num_cpus).map_err(|e| {
770 error!("Failed to patch cpus to DT: {e}");
771 RebootReason::InvalidFdt
772 })?;
773 patch_pci_info(fdt, &info.pci_info).map_err(|e| {
774 error!("Failed to patch pci info to DT: {e}");
775 RebootReason::InvalidFdt
776 })?;
777 patch_serial_info(fdt, &info.serial_info).map_err(|e| {
778 error!("Failed to patch serial info to DT: {e}");
779 RebootReason::InvalidFdt
780 })?;
781 patch_swiotlb_info(fdt, &info.swiotlb_info).map_err(|e| {
782 error!("Failed to patch swiotlb info to DT: {e}");
783 RebootReason::InvalidFdt
784 })?;
785 patch_gic(fdt, info.num_cpus).map_err(|e| {
786 error!("Failed to patch gic info to DT: {e}");
787 RebootReason::InvalidFdt
788 })?;
789 patch_timer(fdt, info.num_cpus).map_err(|e| {
790 error!("Failed to patch timer info to DT: {e}");
791 RebootReason::InvalidFdt
792 })?;
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900793 if let Some(device_assignment) = &info.device_assignment {
794 // Note: We patch values after VM DTBO is overlaid because patch may require more space
795 // then VM DTBO's underlying slice is allocated.
796 device_assignment.patch(fdt).map_err(|e| {
797 error!("Failed to patch device assignment info to DT: {e}");
798 RebootReason::InvalidFdt
799 })?;
800 }
Seungjae Yooed67fd52023-11-29 18:54:36 +0900801 if let Some(vendor_public_key) = &info.vendor_public_key {
802 patch_vendor_public_key(fdt, vendor_public_key).map_err(|e| {
803 error!("Failed to patch vendor_public_key to DT: {e}");
804 RebootReason::InvalidFdt
805 })?;
806 }
Jiyong Parke9d87e82023-03-21 19:28:40 +0900807
808 fdt.pack().map_err(|e| {
809 error!("Failed to pack DT after patching: {e}");
810 RebootReason::InvalidFdt
811 })?;
812
Jiyong Park9c63cd12023-03-21 17:53:07 +0900813 Ok(())
814}
815
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000816/// Modifies the input DT according to the fields of the configuration.
817pub fn modify_for_next_stage(
818 fdt: &mut Fdt,
819 bcc: &[u8],
820 new_instance: bool,
821 strict_boot: bool,
Jiyong Parkc23426b2023-04-10 17:32:27 +0900822 debug_policy: Option<&mut [u8]>,
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900823 debuggable: bool,
Pierre-Clément Tosi80251972023-07-12 12:51:12 +0000824 kaslr_seed: u64,
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000825) -> libfdt::Result<()> {
Pierre-Clément Tosieb887ac2023-05-02 13:33:37 +0000826 if let Some(debug_policy) = debug_policy {
827 let backup = Vec::from(fdt.as_slice());
828 fdt.unpack()?;
829 let backup_fdt = Fdt::from_slice(backup.as_slice()).unwrap();
830 if apply_debug_policy(fdt, backup_fdt, debug_policy)? {
831 info!("Debug policy applied.");
832 } else {
833 // apply_debug_policy restored fdt to backup_fdt so unpack it again.
834 fdt.unpack()?;
835 }
836 } else {
837 info!("No debug policy found.");
838 fdt.unpack()?;
839 }
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000840
Jiyong Parke9d87e82023-03-21 19:28:40 +0900841 patch_dice_node(fdt, bcc.as_ptr() as usize, bcc.len())?;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000842
Alice Wang56ec45b2023-06-15 08:30:32 +0000843 if let Some(mut chosen) = fdt.chosen_mut()? {
844 empty_or_delete_prop(&mut chosen, cstr!("avf,strict-boot"), strict_boot)?;
845 empty_or_delete_prop(&mut chosen, cstr!("avf,new-instance"), new_instance)?;
Pierre-Clément Tosi80251972023-07-12 12:51:12 +0000846 chosen.setprop_inplace(cstr!("kaslr-seed"), &kaslr_seed.to_be_bytes())?;
Alice Wang56ec45b2023-06-15 08:30:32 +0000847 };
Jiyong Park32f37ef2023-05-17 16:15:58 +0900848 if !debuggable {
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900849 if let Some(bootargs) = read_bootargs_from(fdt)? {
850 filter_out_dangerous_bootargs(fdt, &bootargs)?;
851 }
852 }
853
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000854 fdt.pack()?;
855
856 Ok(())
857}
858
Jiyong Parke9d87e82023-03-21 19:28:40 +0900859/// Patch the "google,open-dice"-compatible reserved-memory node to point to the bcc range
860fn patch_dice_node(fdt: &mut Fdt, addr: usize, size: usize) -> libfdt::Result<()> {
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000861 // We reject DTs with missing reserved-memory node as validation should have checked that the
862 // "swiotlb" subnode (compatible = "restricted-dma-pool") was present.
Jiyong Parke9d87e82023-03-21 19:28:40 +0900863 let node = fdt.node_mut(cstr!("/reserved-memory"))?.ok_or(libfdt::FdtError::NotFound)?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000864
Jiyong Parke9d87e82023-03-21 19:28:40 +0900865 let mut node = node.next_compatible(cstr!("google,open-dice"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000866
Jiyong Parke9d87e82023-03-21 19:28:40 +0900867 let addr: u64 = addr.try_into().unwrap();
868 let size: u64 = size.try_into().unwrap();
869 node.setprop_inplace(cstr!("reg"), flatten(&[addr.to_be_bytes(), size.to_be_bytes()]))
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000870}
871
Alice Wang56ec45b2023-06-15 08:30:32 +0000872fn empty_or_delete_prop(
873 fdt_node: &mut FdtNodeMut,
874 prop_name: &CStr,
875 keep_prop: bool,
876) -> libfdt::Result<()> {
877 if keep_prop {
878 fdt_node.setprop_empty(prop_name)
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000879 } else {
Alice Wang56ec45b2023-06-15 08:30:32 +0000880 fdt_node
881 .delprop(prop_name)
882 .or_else(|e| if e == FdtError::NotFound { Ok(()) } else { Err(e) })
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000883 }
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000884}
Jiyong Parkc23426b2023-04-10 17:32:27 +0900885
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000886/// Apply the debug policy overlay to the guest DT.
887///
888/// Returns Ok(true) on success, Ok(false) on recovered failure and Err(_) on corruption of the DT.
Pierre-Clément Tosieb887ac2023-05-02 13:33:37 +0000889fn apply_debug_policy(
890 fdt: &mut Fdt,
891 backup_fdt: &Fdt,
892 debug_policy: &[u8],
893) -> libfdt::Result<bool> {
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000894 let mut debug_policy = Vec::from(debug_policy);
895 let overlay = match Fdt::from_mut_slice(debug_policy.as_mut_slice()) {
Jiyong Parkc23426b2023-04-10 17:32:27 +0900896 Ok(overlay) => overlay,
897 Err(e) => {
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000898 warn!("Corrupted debug policy found: {e}. Not applying.");
899 return Ok(false);
Jiyong Parkc23426b2023-04-10 17:32:27 +0900900 }
901 };
Jiyong Parkc23426b2023-04-10 17:32:27 +0900902
Andrew Walbran20bb4e42023-07-07 13:55:55 +0100903 // SAFETY: on failure, the corrupted DT is restored using the backup.
Jiyong Parkc23426b2023-04-10 17:32:27 +0900904 if let Err(e) = unsafe { fdt.apply_overlay(overlay) } {
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000905 warn!("Failed to apply debug policy: {e}. Recovering...");
Jiyong Parkc23426b2023-04-10 17:32:27 +0900906 fdt.copy_from_slice(backup_fdt.as_slice())?;
Jiyong Parkc23426b2023-04-10 17:32:27 +0900907 // A successful restoration is considered success because an invalid debug policy
908 // shouldn't DOS the pvmfw
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000909 Ok(false)
910 } else {
911 Ok(true)
Jiyong Parkc23426b2023-04-10 17:32:27 +0900912 }
Jiyong Parkc23426b2023-04-10 17:32:27 +0900913}
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900914
Pierre-Clément Tosi1fbc2e92023-05-02 17:28:17 +0000915fn has_common_debug_policy(fdt: &Fdt, debug_feature_name: &CStr) -> libfdt::Result<bool> {
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900916 if let Some(node) = fdt.node(cstr!("/avf/guest/common"))? {
917 if let Some(value) = node.getprop_u32(debug_feature_name)? {
918 return Ok(value == 1);
919 }
920 }
921 Ok(false) // if the policy doesn't exist or not 1, don't enable the debug feature
922}
923
924fn filter_out_dangerous_bootargs(fdt: &mut Fdt, bootargs: &CStr) -> libfdt::Result<()> {
Pierre-Clément Tosi1fbc2e92023-05-02 17:28:17 +0000925 let has_crashkernel = has_common_debug_policy(fdt, cstr!("ramdump"))?;
926 let has_console = has_common_debug_policy(fdt, cstr!("log"))?;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900927
928 let accepted: &[(&str, Box<dyn Fn(Option<&str>) -> bool>)] = &[
929 ("panic", Box::new(|v| if let Some(v) = v { v == "=-1" } else { false })),
930 ("crashkernel", Box::new(|_| has_crashkernel)),
931 ("console", Box::new(|_| has_console)),
932 ];
933
934 // parse and filter out unwanted
935 let mut filtered = Vec::new();
936 for arg in BootArgsIterator::new(bootargs).map_err(|e| {
937 info!("Invalid bootarg: {e}");
938 FdtError::BadValue
939 })? {
940 match accepted.iter().find(|&t| t.0 == arg.name()) {
941 Some((_, pred)) if pred(arg.value()) => filtered.push(arg),
942 _ => debug!("Rejected bootarg {}", arg.as_ref()),
943 }
944 }
945
946 // flatten into a new C-string
947 let mut new_bootargs = Vec::new();
948 for (i, arg) in filtered.iter().enumerate() {
949 if i != 0 {
950 new_bootargs.push(b' '); // separator
951 }
952 new_bootargs.extend_from_slice(arg.as_ref().as_bytes());
953 }
954 new_bootargs.push(b'\0');
955
956 let mut node = fdt.chosen_mut()?.ok_or(FdtError::NotFound)?;
957 node.setprop(cstr!("bootargs"), new_bootargs.as_slice())
958}