blob: e0927c8f2829d712bd629ea4a311a98782676513 [file] [log] [blame]
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +00001// Copyright 2022, The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15//! High-level FDT functions.
16
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090017use crate::bootargs::BootArgsIterator;
Jaewan Kim52477ae2023-11-21 21:20:52 +090018use crate::device_assignment::{DeviceAssignmentInfo, VmDtbo};
Jiyong Park00ceff32023-03-13 05:43:23 +000019use crate::helpers::GUEST_PAGE_SIZE;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +090020use crate::Box;
Jiyong Park00ceff32023-03-13 05:43:23 +000021use crate::RebootReason;
Seungjae Yoo013f4c42024-01-02 13:04:19 +090022use alloc::collections::BTreeMap;
Jiyong Parke9d87e82023-03-21 19:28:40 +090023use alloc::ffi::CString;
Jiyong Parkc23426b2023-04-10 17:32:27 +090024use alloc::vec::Vec;
Jiyong Park0ee65392023-03-27 20:52:45 +090025use core::cmp::max;
26use core::cmp::min;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000027use core::ffi::CStr;
Alice Wangabc7d632023-06-14 09:10:14 +000028use core::fmt;
Jiyong Park9c63cd12023-03-21 17:53:07 +090029use core::mem::size_of;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000030use core::ops::Range;
Pierre-Clément Tosi1bf532b2023-11-13 11:06:20 +000031use cstr::cstr;
Jiyong Park00ceff32023-03-13 05:43:23 +000032use fdtpci::PciMemoryFlags;
33use fdtpci::PciRangeType;
34use libfdt::AddressRange;
35use libfdt::CellIterator;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +000036use libfdt::Fdt;
37use libfdt::FdtError;
Jiyong Park9c63cd12023-03-21 17:53:07 +090038use libfdt::FdtNode;
Alice Wang56ec45b2023-06-15 08:30:32 +000039use libfdt::FdtNodeMut;
Jiyong Park83316122023-03-21 09:39:39 +090040use log::debug;
Jiyong Park00ceff32023-03-13 05:43:23 +000041use log::error;
Jiyong Parkc23426b2023-04-10 17:32:27 +090042use log::info;
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +000043use log::warn;
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +000044use static_assertions::const_assert;
Jiyong Park00ceff32023-03-13 05:43:23 +000045use tinyvec::ArrayVec;
Alice Wanga3971062023-06-13 11:48:53 +000046use vmbase::fdt::SwiotlbInfo;
Alice Wang63f4c9e2023-06-12 09:36:43 +000047use vmbase::layout::{crosvm::MEM_START, MAX_VIRT_ADDR};
Alice Wangeacb7382023-06-05 12:53:54 +000048use vmbase::memory::SIZE_4KB;
49use vmbase::util::flatten;
Alice Wang4be4dd02023-06-07 07:50:40 +000050use vmbase::util::RangeExt as _;
Pierre-Clément Tosi0edc4d62024-02-05 14:13:53 +000051use zerocopy::AsBytes as _;
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000052
Alice Wangabc7d632023-06-14 09:10:14 +000053/// An enumeration of errors that can occur during the FDT validation.
54#[derive(Clone, Debug)]
55pub enum FdtValidationError {
56 /// Invalid CPU count.
57 InvalidCpuCount(usize),
58}
59
60impl fmt::Display for FdtValidationError {
61 fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
62 match self {
63 Self::InvalidCpuCount(num_cpus) => write!(f, "Invalid CPU count: {num_cpus}"),
64 }
65 }
66}
67
Jiyong Park6a8789a2023-03-21 14:50:59 +090068/// Extract from /config the address range containing the pre-loaded kernel. Absence of /config is
69/// not an error.
70fn read_kernel_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
Jiyong Parkb87f3302023-03-21 10:03:11 +090071 let addr = cstr!("kernel-address");
72 let size = cstr!("kernel-size");
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +000073
Jiyong Parkb87f3302023-03-21 10:03:11 +090074 if let Some(config) = fdt.node(cstr!("/config"))? {
Pierre-Clément Tosic3811b82022-11-29 11:24:16 +000075 if let (Some(addr), Some(size)) = (config.getprop_u32(addr)?, config.getprop_u32(size)?) {
76 let addr = addr as usize;
77 let size = size as usize;
78
79 return Ok(Some(addr..(addr + size)));
80 }
81 }
82
83 Ok(None)
84}
85
Jiyong Park6a8789a2023-03-21 14:50:59 +090086/// Extract from /chosen the address range containing the pre-loaded ramdisk. Absence is not an
87/// error as there can be initrd-less VM.
88fn read_initrd_range_from(fdt: &Fdt) -> libfdt::Result<Option<Range<usize>>> {
Jiyong Parkb87f3302023-03-21 10:03:11 +090089 let start = cstr!("linux,initrd-start");
90 let end = cstr!("linux,initrd-end");
Pierre-Clément Tosia0934c12022-11-25 20:54:11 +000091
92 if let Some(chosen) = fdt.chosen()? {
93 if let (Some(start), Some(end)) = (chosen.getprop_u32(start)?, chosen.getprop_u32(end)?) {
94 return Ok(Some((start as usize)..(end as usize)));
95 }
96 }
97
98 Ok(None)
99}
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000100
Jiyong Park9c63cd12023-03-21 17:53:07 +0900101fn patch_initrd_range(fdt: &mut Fdt, initrd_range: &Range<usize>) -> libfdt::Result<()> {
102 let start = u32::try_from(initrd_range.start).unwrap();
103 let end = u32::try_from(initrd_range.end).unwrap();
104
105 let mut node = fdt.chosen_mut()?.ok_or(FdtError::NotFound)?;
106 node.setprop(cstr!("linux,initrd-start"), &start.to_be_bytes())?;
107 node.setprop(cstr!("linux,initrd-end"), &end.to_be_bytes())?;
108 Ok(())
109}
110
Jiyong Parke9d87e82023-03-21 19:28:40 +0900111fn read_bootargs_from(fdt: &Fdt) -> libfdt::Result<Option<CString>> {
112 if let Some(chosen) = fdt.chosen()? {
113 if let Some(bootargs) = chosen.getprop_str(cstr!("bootargs"))? {
114 // We need to copy the string to heap because the original fdt will be invalidated
115 // by the templated DT
116 let copy = CString::new(bootargs.to_bytes()).map_err(|_| FdtError::BadValue)?;
117 return Ok(Some(copy));
118 }
119 }
120 Ok(None)
121}
122
123fn patch_bootargs(fdt: &mut Fdt, bootargs: &CStr) -> libfdt::Result<()> {
124 let mut node = fdt.chosen_mut()?.ok_or(FdtError::NotFound)?;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900125 // This function is called before the verification is done. So, we just copy the bootargs to
126 // the new FDT unmodified. This will be filtered again in the modify_for_next_stage function
127 // if the VM is not debuggable.
Jiyong Parke9d87e82023-03-21 19:28:40 +0900128 node.setprop(cstr!("bootargs"), bootargs.to_bytes_with_nul())
129}
130
Alice Wang0d527472023-06-13 14:55:38 +0000131/// Reads and validates the memory range in the DT.
132///
133/// Only one memory range is expected with the crosvm setup for now.
134fn read_and_validate_memory_range(fdt: &Fdt) -> Result<Range<usize>, RebootReason> {
135 let mut memory = fdt.memory().map_err(|e| {
136 error!("Failed to read memory range from DT: {e}");
137 RebootReason::InvalidFdt
138 })?;
139 let range = memory.next().ok_or_else(|| {
140 error!("The /memory node in the DT contains no range.");
141 RebootReason::InvalidFdt
142 })?;
143 if memory.next().is_some() {
144 warn!(
145 "The /memory node in the DT contains more than one memory range, \
146 while only one is expected."
147 );
148 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900149 let base = range.start;
Alice Wange243d462023-06-06 15:18:12 +0000150 if base != MEM_START {
151 error!("Memory base address {:#x} is not {:#x}", base, MEM_START);
Jiyong Park00ceff32023-03-13 05:43:23 +0000152 return Err(RebootReason::InvalidFdt);
153 }
154
Jiyong Park6a8789a2023-03-21 14:50:59 +0900155 let size = range.len();
Jiyong Park00ceff32023-03-13 05:43:23 +0000156 if size % GUEST_PAGE_SIZE != 0 {
157 error!("Memory size {:#x} is not a multiple of page size {:#x}", size, GUEST_PAGE_SIZE);
158 return Err(RebootReason::InvalidFdt);
159 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000160
Jiyong Park6a8789a2023-03-21 14:50:59 +0900161 if size == 0 {
162 error!("Memory size is 0");
163 return Err(RebootReason::InvalidFdt);
164 }
Alice Wang0d527472023-06-13 14:55:38 +0000165 Ok(range)
Jiyong Park00ceff32023-03-13 05:43:23 +0000166}
167
Jiyong Park9c63cd12023-03-21 17:53:07 +0900168fn patch_memory_range(fdt: &mut Fdt, memory_range: &Range<usize>) -> libfdt::Result<()> {
Pierre-Clément Tosi0edc4d62024-02-05 14:13:53 +0000169 let addr = u64::try_from(MEM_START).unwrap();
170 let size = u64::try_from(memory_range.len()).unwrap();
Jiyong Park0ee65392023-03-27 20:52:45 +0900171 fdt.node_mut(cstr!("/memory"))?
172 .ok_or(FdtError::NotFound)?
Pierre-Clément Tosi0edc4d62024-02-05 14:13:53 +0000173 .setprop_inplace(cstr!("reg"), [addr.to_be(), size.to_be()].as_bytes())
Jiyong Park9c63cd12023-03-21 17:53:07 +0900174}
175
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000176#[derive(Debug, Default)]
177struct CpuInfo {}
Jiyong Park6a8789a2023-03-21 14:50:59 +0900178
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000179fn read_cpu_info_from(fdt: &Fdt) -> libfdt::Result<ArrayVec<[CpuInfo; DeviceTreeInfo::MAX_CPUS]>> {
180 let mut cpus = ArrayVec::new();
181
182 let mut cpu_nodes = fdt.compatible_nodes(cstr!("arm,arm-v8"))?;
183 for _cpu in cpu_nodes.by_ref().take(cpus.capacity()) {
184 let info = CpuInfo {};
185 cpus.push(info);
Jiyong Park6a8789a2023-03-21 14:50:59 +0900186 }
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000187 if cpu_nodes.next().is_some() {
188 warn!("DT has more than {} CPU nodes: discarding extra nodes.", cpus.capacity());
189 }
190
191 Ok(cpus)
Jiyong Park9c63cd12023-03-21 17:53:07 +0900192}
193
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000194fn validate_cpu_info(cpus: &[CpuInfo]) -> Result<(), FdtValidationError> {
195 if cpus.is_empty() {
196 return Err(FdtValidationError::InvalidCpuCount(0));
197 }
198
199 Ok(())
200}
201
202fn patch_cpus(fdt: &mut Fdt, cpus: &[CpuInfo]) -> libfdt::Result<()> {
203 const COMPAT: &CStr = cstr!("arm,arm-v8");
204 let mut next = fdt.root_mut()?.next_compatible(COMPAT)?;
205 for _cpu in cpus {
206 next = next.ok_or(FdtError::NoSpace)?.next_compatible(COMPAT)?;
Jiyong Park9c63cd12023-03-21 17:53:07 +0900207 }
208 while let Some(current) = next {
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000209 next = current.delete_and_next_compatible(COMPAT)?;
Jiyong Park9c63cd12023-03-21 17:53:07 +0900210 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900211 Ok(())
Jiyong Park00ceff32023-03-13 05:43:23 +0000212}
213
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900214/// Read candidate properties' names from DT which could be overlaid
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900215fn parse_vm_ref_dt(fdt: &Fdt) -> libfdt::Result<BTreeMap<CString, Vec<u8>>> {
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900216 let mut property_map = BTreeMap::new();
Seungjae Yooed67fd52023-11-29 18:54:36 +0900217 if let Some(avf_node) = fdt.node(cstr!("/avf"))? {
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900218 for property in avf_node.properties()? {
219 let name = property.name()?;
220 let value = property.value()?;
221 property_map.insert(
222 CString::new(name.to_bytes()).map_err(|_| FdtError::BadValue)?,
223 value.to_vec(),
224 );
Seungjae Yooed67fd52023-11-29 18:54:36 +0900225 }
226 }
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900227 Ok(property_map)
Seungjae Yooed67fd52023-11-29 18:54:36 +0900228}
229
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900230/// Overlay VM reference DT into VM DT based on the props_info. Property is overlaid in vm_dt only
231/// when it exists both in vm_ref_dt and props_info. If the values mismatch, it returns error.
232fn validate_vm_ref_dt(
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900233 vm_dt: &mut Fdt,
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900234 vm_ref_dt: &Fdt,
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900235 props_info: &BTreeMap<CString, Vec<u8>>,
Seungjae Yoo192e99c2023-12-15 16:42:39 +0900236) -> libfdt::Result<()> {
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900237 let mut root_vm_dt = vm_dt.root_mut()?;
238 let mut avf_vm_dt = root_vm_dt.add_subnode(cstr!("avf"))?;
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900239 // TODO(b/318431677): Validate nodes beyond /avf.
240 let avf_node = vm_ref_dt.node(cstr!("/avf"))?.ok_or(FdtError::NotFound)?;
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900241 for (name, value) in props_info.iter() {
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900242 if let Some(ref_value) = avf_node.getprop(name)? {
243 if value != ref_value {
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900244 error!(
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900245 "Property mismatches while applying overlay VM reference DT. \
246 Name:{:?}, Value from host as hex:{:x?}, Value from VM reference DT as hex:{:x?}",
247 name, value, ref_value
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900248 );
249 return Err(FdtError::BadValue);
250 }
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900251 avf_vm_dt.setprop(name, ref_value)?;
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900252 }
253 }
Seungjae Yooed67fd52023-11-29 18:54:36 +0900254 Ok(())
255}
256
Jiyong Park00ceff32023-03-13 05:43:23 +0000257#[derive(Debug)]
Jiyong Park00ceff32023-03-13 05:43:23 +0000258struct PciInfo {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900259 ranges: [PciAddrRange; 2],
260 irq_masks: ArrayVec<[PciIrqMask; PciInfo::MAX_IRQS]>,
261 irq_maps: ArrayVec<[PciIrqMap; PciInfo::MAX_IRQS]>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000262}
263
Jiyong Park6a8789a2023-03-21 14:50:59 +0900264impl PciInfo {
265 const IRQ_MASK_CELLS: usize = 4;
266 const IRQ_MAP_CELLS: usize = 10;
Nikita Ioffe85d80262023-07-12 17:34:07 +0100267 const MAX_IRQS: usize = 10;
Jiyong Park00ceff32023-03-13 05:43:23 +0000268}
269
Jiyong Park6a8789a2023-03-21 14:50:59 +0900270type PciAddrRange = AddressRange<(u32, u64), u64, u64>;
271type PciIrqMask = [u32; PciInfo::IRQ_MASK_CELLS];
272type PciIrqMap = [u32; PciInfo::IRQ_MAP_CELLS];
Jiyong Park00ceff32023-03-13 05:43:23 +0000273
274/// Iterator that takes N cells as a chunk
275struct CellChunkIterator<'a, const N: usize> {
276 cells: CellIterator<'a>,
277}
278
279impl<'a, const N: usize> CellChunkIterator<'a, N> {
280 fn new(cells: CellIterator<'a>) -> Self {
281 Self { cells }
282 }
283}
284
285impl<'a, const N: usize> Iterator for CellChunkIterator<'a, N> {
286 type Item = [u32; N];
287 fn next(&mut self) -> Option<Self::Item> {
288 let mut ret: Self::Item = [0; N];
289 for i in ret.iter_mut() {
290 *i = self.cells.next()?;
291 }
292 Some(ret)
293 }
294}
295
Jiyong Park6a8789a2023-03-21 14:50:59 +0900296/// Read pci host controller ranges, irq maps, and irq map masks from DT
297fn read_pci_info_from(fdt: &Fdt) -> libfdt::Result<PciInfo> {
298 let node =
299 fdt.compatible_nodes(cstr!("pci-host-cam-generic"))?.next().ok_or(FdtError::NotFound)?;
300
301 let mut ranges = node.ranges::<(u32, u64), u64, u64>()?.ok_or(FdtError::NotFound)?;
302 let range0 = ranges.next().ok_or(FdtError::NotFound)?;
303 let range1 = ranges.next().ok_or(FdtError::NotFound)?;
304
305 let irq_masks = node.getprop_cells(cstr!("interrupt-map-mask"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosiaa0f6552023-07-12 14:49:35 +0000306 let mut chunks = CellChunkIterator::<{ PciInfo::IRQ_MASK_CELLS }>::new(irq_masks);
307 let irq_masks = (&mut chunks).take(PciInfo::MAX_IRQS).collect();
308
309 if chunks.next().is_some() {
310 warn!("Input DT has more than {} PCI entries!", PciInfo::MAX_IRQS);
311 return Err(FdtError::NoSpace);
312 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900313
314 let irq_maps = node.getprop_cells(cstr!("interrupt-map"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosiaa0f6552023-07-12 14:49:35 +0000315 let mut chunks = CellChunkIterator::<{ PciInfo::IRQ_MAP_CELLS }>::new(irq_maps);
316 let irq_maps = (&mut chunks).take(PciInfo::MAX_IRQS).collect();
317
318 if chunks.next().is_some() {
319 warn!("Input DT has more than {} PCI entries!", PciInfo::MAX_IRQS);
320 return Err(FdtError::NoSpace);
321 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900322
323 Ok(PciInfo { ranges: [range0, range1], irq_masks, irq_maps })
324}
325
Jiyong Park0ee65392023-03-27 20:52:45 +0900326fn validate_pci_info(pci_info: &PciInfo, memory_range: &Range<usize>) -> Result<(), RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900327 for range in pci_info.ranges.iter() {
Jiyong Park0ee65392023-03-27 20:52:45 +0900328 validate_pci_addr_range(range, memory_range)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900329 }
330 for irq_mask in pci_info.irq_masks.iter() {
331 validate_pci_irq_mask(irq_mask)?;
332 }
333 for (idx, irq_map) in pci_info.irq_maps.iter().enumerate() {
334 validate_pci_irq_map(irq_map, idx)?;
335 }
336 Ok(())
337}
338
Jiyong Park0ee65392023-03-27 20:52:45 +0900339fn validate_pci_addr_range(
340 range: &PciAddrRange,
341 memory_range: &Range<usize>,
342) -> Result<(), RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900343 let mem_flags = PciMemoryFlags(range.addr.0);
344 let range_type = mem_flags.range_type();
345 let prefetchable = mem_flags.prefetchable();
346 let bus_addr = range.addr.1;
347 let cpu_addr = range.parent_addr;
348 let size = range.size;
349
350 if range_type != PciRangeType::Memory64 {
351 error!("Invalid range type {:?} for bus address {:#x} in PCI node", range_type, bus_addr);
352 return Err(RebootReason::InvalidFdt);
353 }
354 if prefetchable {
355 error!("PCI bus address {:#x} in PCI node is prefetchable", bus_addr);
356 return Err(RebootReason::InvalidFdt);
357 }
358 // Enforce ID bus-to-cpu mappings, as used by crosvm.
359 if bus_addr != cpu_addr {
360 error!("PCI bus address: {:#x} is different from CPU address: {:#x}", bus_addr, cpu_addr);
361 return Err(RebootReason::InvalidFdt);
362 }
363
Jiyong Park0ee65392023-03-27 20:52:45 +0900364 let Some(bus_end) = bus_addr.checked_add(size) else {
365 error!("PCI address range size {:#x} overflows", size);
366 return Err(RebootReason::InvalidFdt);
367 };
Alice Wang63f4c9e2023-06-12 09:36:43 +0000368 if bus_end > MAX_VIRT_ADDR.try_into().unwrap() {
Jiyong Park0ee65392023-03-27 20:52:45 +0900369 error!("PCI address end {:#x} is outside of translatable range", bus_end);
370 return Err(RebootReason::InvalidFdt);
371 }
372
373 let memory_start = memory_range.start.try_into().unwrap();
374 let memory_end = memory_range.end.try_into().unwrap();
375
376 if max(bus_addr, memory_start) < min(bus_end, memory_end) {
377 error!(
378 "PCI address range {:#x}-{:#x} overlaps with main memory range {:#x}-{:#x}",
379 bus_addr, bus_end, memory_start, memory_end
380 );
Jiyong Park6a8789a2023-03-21 14:50:59 +0900381 return Err(RebootReason::InvalidFdt);
382 }
383
384 Ok(())
385}
386
387fn validate_pci_irq_mask(irq_mask: &PciIrqMask) -> Result<(), RebootReason> {
Jiyong Park00ceff32023-03-13 05:43:23 +0000388 const IRQ_MASK_ADDR_HI: u32 = 0xf800;
389 const IRQ_MASK_ADDR_ME: u32 = 0x0;
390 const IRQ_MASK_ADDR_LO: u32 = 0x0;
391 const IRQ_MASK_ANY_IRQ: u32 = 0x7;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900392 const EXPECTED: PciIrqMask =
Jiyong Park00ceff32023-03-13 05:43:23 +0000393 [IRQ_MASK_ADDR_HI, IRQ_MASK_ADDR_ME, IRQ_MASK_ADDR_LO, IRQ_MASK_ANY_IRQ];
Jiyong Park6a8789a2023-03-21 14:50:59 +0900394 if *irq_mask != EXPECTED {
395 error!("Invalid PCI irq mask {:#?}", irq_mask);
396 return Err(RebootReason::InvalidFdt);
Jiyong Park00ceff32023-03-13 05:43:23 +0000397 }
Jiyong Park6a8789a2023-03-21 14:50:59 +0900398 Ok(())
Jiyong Park00ceff32023-03-13 05:43:23 +0000399}
400
Jiyong Park6a8789a2023-03-21 14:50:59 +0900401fn validate_pci_irq_map(irq_map: &PciIrqMap, idx: usize) -> Result<(), RebootReason> {
Jiyong Park00ceff32023-03-13 05:43:23 +0000402 const PCI_DEVICE_IDX: usize = 11;
403 const PCI_IRQ_ADDR_ME: u32 = 0;
404 const PCI_IRQ_ADDR_LO: u32 = 0;
405 const PCI_IRQ_INTC: u32 = 1;
406 const AARCH64_IRQ_BASE: u32 = 4; // from external/crosvm/aarch64/src/lib.rs
407 const GIC_SPI: u32 = 0;
408 const IRQ_TYPE_LEVEL_HIGH: u32 = 4;
409
Jiyong Park6a8789a2023-03-21 14:50:59 +0900410 let pci_addr = (irq_map[0], irq_map[1], irq_map[2]);
411 let pci_irq_number = irq_map[3];
412 let _controller_phandle = irq_map[4]; // skipped.
413 let gic_addr = (irq_map[5], irq_map[6]); // address-cells is <2> for GIC
414 // interrupt-cells is <3> for GIC
415 let gic_peripheral_interrupt_type = irq_map[7];
416 let gic_irq_number = irq_map[8];
417 let gic_irq_type = irq_map[9];
Jiyong Park00ceff32023-03-13 05:43:23 +0000418
Jiyong Park6a8789a2023-03-21 14:50:59 +0900419 let phys_hi: u32 = (0x1 << PCI_DEVICE_IDX) * (idx + 1) as u32;
420 let expected_pci_addr = (phys_hi, PCI_IRQ_ADDR_ME, PCI_IRQ_ADDR_LO);
Jiyong Park00ceff32023-03-13 05:43:23 +0000421
Jiyong Park6a8789a2023-03-21 14:50:59 +0900422 if pci_addr != expected_pci_addr {
423 error!("PCI device address {:#x} {:#x} {:#x} in interrupt-map is different from expected address \
424 {:#x} {:#x} {:#x}",
425 pci_addr.0, pci_addr.1, pci_addr.2, expected_pci_addr.0, expected_pci_addr.1, expected_pci_addr.2);
426 return Err(RebootReason::InvalidFdt);
427 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000428
Jiyong Park6a8789a2023-03-21 14:50:59 +0900429 if pci_irq_number != PCI_IRQ_INTC {
430 error!(
431 "PCI INT# {:#x} in interrupt-map is different from expected value {:#x}",
432 pci_irq_number, PCI_IRQ_INTC
433 );
434 return Err(RebootReason::InvalidFdt);
435 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000436
Jiyong Park6a8789a2023-03-21 14:50:59 +0900437 if gic_addr != (0, 0) {
438 error!(
439 "GIC address {:#x} {:#x} in interrupt-map is different from expected address \
440 {:#x} {:#x}",
441 gic_addr.0, gic_addr.1, 0, 0
442 );
443 return Err(RebootReason::InvalidFdt);
444 }
445
446 if gic_peripheral_interrupt_type != GIC_SPI {
447 error!("GIC peripheral interrupt type {:#x} in interrupt-map is different from expected value \
448 {:#x}", gic_peripheral_interrupt_type, GIC_SPI);
449 return Err(RebootReason::InvalidFdt);
450 }
451
452 let irq_nr: u32 = AARCH64_IRQ_BASE + (idx as u32);
453 if gic_irq_number != irq_nr {
454 error!(
455 "GIC irq number {:#x} in interrupt-map is unexpected. Expected {:#x}",
456 gic_irq_number, irq_nr
457 );
458 return Err(RebootReason::InvalidFdt);
459 }
460
461 if gic_irq_type != IRQ_TYPE_LEVEL_HIGH {
462 error!(
463 "IRQ type in {:#x} is invalid. Must be LEVEL_HIGH {:#x}",
464 gic_irq_type, IRQ_TYPE_LEVEL_HIGH
465 );
466 return Err(RebootReason::InvalidFdt);
Jiyong Park00ceff32023-03-13 05:43:23 +0000467 }
468 Ok(())
469}
470
Jiyong Park9c63cd12023-03-21 17:53:07 +0900471fn patch_pci_info(fdt: &mut Fdt, pci_info: &PciInfo) -> libfdt::Result<()> {
472 let mut node = fdt
473 .root_mut()?
474 .next_compatible(cstr!("pci-host-cam-generic"))?
475 .ok_or(FdtError::NotFound)?;
476
477 let irq_masks_size = pci_info.irq_masks.len() * size_of::<PciIrqMask>();
478 node.trimprop(cstr!("interrupt-map-mask"), irq_masks_size)?;
479
480 let irq_maps_size = pci_info.irq_maps.len() * size_of::<PciIrqMap>();
481 node.trimprop(cstr!("interrupt-map"), irq_maps_size)?;
482
483 node.setprop_inplace(
484 cstr!("ranges"),
485 flatten(&[pci_info.ranges[0].to_cells(), pci_info.ranges[1].to_cells()]),
486 )
487}
488
Jiyong Park00ceff32023-03-13 05:43:23 +0000489#[derive(Default, Debug)]
Jiyong Park6a8789a2023-03-21 14:50:59 +0900490struct SerialInfo {
491 addrs: ArrayVec<[u64; Self::MAX_SERIALS]>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000492}
493
494impl SerialInfo {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900495 const MAX_SERIALS: usize = 4;
Jiyong Park00ceff32023-03-13 05:43:23 +0000496}
497
Jiyong Park6a8789a2023-03-21 14:50:59 +0900498fn read_serial_info_from(fdt: &Fdt) -> libfdt::Result<SerialInfo> {
Pierre-Clément Tosibe893612024-02-05 14:23:44 +0000499 let mut addrs = ArrayVec::new();
500
501 let mut serial_nodes = fdt.compatible_nodes(cstr!("ns16550a"))?;
502 for node in serial_nodes.by_ref().take(addrs.capacity()) {
Alice Wang6ff2d0c2023-09-19 15:28:43 +0000503 let reg = node.first_reg()?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900504 addrs.push(reg.addr);
Jiyong Park00ceff32023-03-13 05:43:23 +0000505 }
Pierre-Clément Tosibe893612024-02-05 14:23:44 +0000506 if serial_nodes.next().is_some() {
507 warn!("DT has more than {} UART nodes: discarding extra nodes.", addrs.capacity());
508 }
509
Jiyong Park6a8789a2023-03-21 14:50:59 +0900510 Ok(SerialInfo { addrs })
Jiyong Park00ceff32023-03-13 05:43:23 +0000511}
512
Jiyong Park9c63cd12023-03-21 17:53:07 +0900513/// Patch the DT by deleting the ns16550a compatible nodes whose address are unknown
514fn patch_serial_info(fdt: &mut Fdt, serial_info: &SerialInfo) -> libfdt::Result<()> {
515 let name = cstr!("ns16550a");
516 let mut next = fdt.root_mut()?.next_compatible(name);
517 while let Some(current) = next? {
518 let reg = FdtNode::from_mut(&current)
519 .reg()?
520 .ok_or(FdtError::NotFound)?
521 .next()
522 .ok_or(FdtError::NotFound)?;
523 next = if !serial_info.addrs.contains(&reg.addr) {
524 current.delete_and_next_compatible(name)
525 } else {
526 current.next_compatible(name)
527 }
528 }
529 Ok(())
530}
531
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700532fn validate_swiotlb_info(
533 swiotlb_info: &SwiotlbInfo,
534 memory: &Range<usize>,
535) -> Result<(), RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900536 let size = swiotlb_info.size;
537 let align = swiotlb_info.align;
Jiyong Park00ceff32023-03-13 05:43:23 +0000538
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700539 if size == 0 || (size % GUEST_PAGE_SIZE) != 0 {
Jiyong Park00ceff32023-03-13 05:43:23 +0000540 error!("Invalid swiotlb size {:#x}", size);
541 return Err(RebootReason::InvalidFdt);
542 }
543
Pierre-Clément Tosibe3a97b2023-05-19 14:56:23 +0000544 if let Some(align) = align.filter(|&a| a % GUEST_PAGE_SIZE != 0) {
Jiyong Park00ceff32023-03-13 05:43:23 +0000545 error!("Invalid swiotlb alignment {:#x}", align);
546 return Err(RebootReason::InvalidFdt);
547 }
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700548
Alice Wang9cfbfd62023-06-14 11:19:03 +0000549 if let Some(addr) = swiotlb_info.addr {
550 if addr.checked_add(size).is_none() {
551 error!("Invalid swiotlb range: addr:{addr:#x} size:{size:#x}");
552 return Err(RebootReason::InvalidFdt);
553 }
554 }
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700555 if let Some(range) = swiotlb_info.fixed_range() {
556 if !range.is_within(memory) {
557 error!("swiotlb range {range:#x?} not part of memory range {memory:#x?}");
558 return Err(RebootReason::InvalidFdt);
559 }
560 }
561
Jiyong Park6a8789a2023-03-21 14:50:59 +0900562 Ok(())
Jiyong Park00ceff32023-03-13 05:43:23 +0000563}
564
Jiyong Park9c63cd12023-03-21 17:53:07 +0900565fn patch_swiotlb_info(fdt: &mut Fdt, swiotlb_info: &SwiotlbInfo) -> libfdt::Result<()> {
566 let mut node =
567 fdt.root_mut()?.next_compatible(cstr!("restricted-dma-pool"))?.ok_or(FdtError::NotFound)?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700568
569 if let Some(range) = swiotlb_info.fixed_range() {
Pierre-Clément Tosic27c4272023-05-19 15:46:26 +0000570 node.setprop_addrrange_inplace(
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700571 cstr!("reg"),
572 range.start.try_into().unwrap(),
573 range.len().try_into().unwrap(),
574 )?;
Pierre-Clément Tosibe3a97b2023-05-19 14:56:23 +0000575 node.nop_property(cstr!("size"))?;
576 node.nop_property(cstr!("alignment"))?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700577 } else {
Pierre-Clément Tosic27c4272023-05-19 15:46:26 +0000578 node.nop_property(cstr!("reg"))?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700579 node.setprop_inplace(cstr!("size"), &swiotlb_info.size.to_be_bytes())?;
Pierre-Clément Tosibe3a97b2023-05-19 14:56:23 +0000580 node.setprop_inplace(cstr!("alignment"), &swiotlb_info.align.unwrap().to_be_bytes())?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700581 }
582
Jiyong Park9c63cd12023-03-21 17:53:07 +0900583 Ok(())
584}
585
586fn patch_gic(fdt: &mut Fdt, num_cpus: usize) -> libfdt::Result<()> {
587 let node = fdt.compatible_nodes(cstr!("arm,gic-v3"))?.next().ok_or(FdtError::NotFound)?;
588 let mut ranges = node.reg()?.ok_or(FdtError::NotFound)?;
589 let range0 = ranges.next().ok_or(FdtError::NotFound)?;
590 let mut range1 = ranges.next().ok_or(FdtError::NotFound)?;
591
592 let addr = range0.addr;
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000593 // `read_cpu_info_from()` guarantees that we have at most MAX_CPUS.
594 const_assert!(DeviceTreeInfo::gic_patched_size(DeviceTreeInfo::MAX_CPUS).is_some());
Alice Wangabc7d632023-06-14 09:10:14 +0000595 let size = u64::try_from(DeviceTreeInfo::gic_patched_size(num_cpus).unwrap()).unwrap();
Jiyong Park9c63cd12023-03-21 17:53:07 +0900596
597 // range1 is just below range0
598 range1.addr = addr - size;
599 range1.size = Some(size);
600
Pierre-Clément Tosieea2a982024-02-05 15:10:59 +0000601 let (addr0, size0) = range0.to_cells();
602 let (addr1, size1) = range1.to_cells();
603 let value = [addr0, size0.unwrap(), addr1, size1.unwrap()];
Jiyong Park9c63cd12023-03-21 17:53:07 +0900604
605 let mut node =
606 fdt.root_mut()?.next_compatible(cstr!("arm,gic-v3"))?.ok_or(FdtError::NotFound)?;
607 node.setprop_inplace(cstr!("reg"), flatten(&value))
608}
609
610fn patch_timer(fdt: &mut Fdt, num_cpus: usize) -> libfdt::Result<()> {
611 const NUM_INTERRUPTS: usize = 4;
612 const CELLS_PER_INTERRUPT: usize = 3;
613 let node = fdt.compatible_nodes(cstr!("arm,armv8-timer"))?.next().ok_or(FdtError::NotFound)?;
614 let interrupts = node.getprop_cells(cstr!("interrupts"))?.ok_or(FdtError::NotFound)?;
615 let mut value: ArrayVec<[u32; NUM_INTERRUPTS * CELLS_PER_INTERRUPT]> =
616 interrupts.take(NUM_INTERRUPTS * CELLS_PER_INTERRUPT).collect();
617
618 let num_cpus: u32 = num_cpus.try_into().unwrap();
619 let cpu_mask: u32 = (((0x1 << num_cpus) - 1) & 0xff) << 8;
620 for v in value.iter_mut().skip(2).step_by(CELLS_PER_INTERRUPT) {
621 *v |= cpu_mask;
622 }
623 for v in value.iter_mut() {
624 *v = v.to_be();
625 }
626
Pierre-Clément Tosi0edc4d62024-02-05 14:13:53 +0000627 let value = value.into_inner();
Jiyong Park9c63cd12023-03-21 17:53:07 +0900628
629 let mut node =
630 fdt.root_mut()?.next_compatible(cstr!("arm,armv8-timer"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosi0edc4d62024-02-05 14:13:53 +0000631 node.setprop_inplace(cstr!("interrupts"), value.as_bytes())
Jiyong Park9c63cd12023-03-21 17:53:07 +0900632}
633
Jiyong Park00ceff32023-03-13 05:43:23 +0000634#[derive(Debug)]
Jiyong Park6a8789a2023-03-21 14:50:59 +0900635pub struct DeviceTreeInfo {
636 pub kernel_range: Option<Range<usize>>,
637 pub initrd_range: Option<Range<usize>>,
638 pub memory_range: Range<usize>,
Jiyong Parke9d87e82023-03-21 19:28:40 +0900639 bootargs: Option<CString>,
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000640 cpus: ArrayVec<[CpuInfo; DeviceTreeInfo::MAX_CPUS]>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000641 pci_info: PciInfo,
642 serial_info: SerialInfo,
Srivatsa Vaddagiri37713ec2023-04-20 04:04:08 -0700643 pub swiotlb_info: SwiotlbInfo,
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900644 device_assignment: Option<DeviceAssignmentInfo>,
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900645 vm_ref_dt_props_info: BTreeMap<CString, Vec<u8>>,
Jiyong Park00ceff32023-03-13 05:43:23 +0000646}
647
648impl DeviceTreeInfo {
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000649 const MAX_CPUS: usize = 16;
650
651 const fn gic_patched_size(num_cpus: usize) -> Option<usize> {
Alice Wangabc7d632023-06-14 09:10:14 +0000652 const GIC_REDIST_SIZE_PER_CPU: usize = 32 * SIZE_4KB;
653
654 GIC_REDIST_SIZE_PER_CPU.checked_mul(num_cpus)
655 }
Jiyong Park00ceff32023-03-13 05:43:23 +0000656}
657
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900658pub fn sanitize_device_tree(
659 fdt: &mut [u8],
660 vm_dtbo: Option<&mut [u8]>,
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900661 vm_ref_dt: Option<&[u8]>,
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900662) -> Result<DeviceTreeInfo, RebootReason> {
663 let fdt = Fdt::from_mut_slice(fdt).map_err(|e| {
664 error!("Failed to load FDT: {e}");
665 RebootReason::InvalidFdt
666 })?;
667
668 let vm_dtbo = match vm_dtbo {
669 Some(vm_dtbo) => Some(VmDtbo::from_mut_slice(vm_dtbo).map_err(|e| {
670 error!("Failed to load VM DTBO: {e}");
671 RebootReason::InvalidFdt
672 })?),
673 None => None,
674 };
675
676 let info = parse_device_tree(fdt, vm_dtbo.as_deref())?;
Jiyong Park83316122023-03-21 09:39:39 +0900677
Jiyong Parke9d87e82023-03-21 19:28:40 +0900678 fdt.copy_from_slice(pvmfw_fdt_template::RAW).map_err(|e| {
679 error!("Failed to instantiate FDT from the template DT: {e}");
680 RebootReason::InvalidFdt
681 })?;
682
Jaewan Kim9220e852023-12-01 10:58:40 +0900683 fdt.unpack().map_err(|e| {
684 error!("Failed to unpack DT for patching: {e}");
685 RebootReason::InvalidFdt
686 })?;
687
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900688 if let Some(device_assignment_info) = &info.device_assignment {
689 let vm_dtbo = vm_dtbo.unwrap();
690 device_assignment_info.filter(vm_dtbo).map_err(|e| {
691 error!("Failed to filter VM DTBO: {e}");
692 RebootReason::InvalidFdt
693 })?;
694 // SAFETY: Damaged VM DTBO isn't used in this API after this unsafe block.
695 // VM DTBO can't be reused in any way as Fdt nor VmDtbo outside of this API because
696 // it can only be instantiated after validation.
697 unsafe {
698 fdt.apply_overlay(vm_dtbo.as_mut()).map_err(|e| {
699 error!("Failed to apply filtered VM DTBO: {e}");
700 RebootReason::InvalidFdt
701 })?;
702 }
703 }
704
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900705 if let Some(vm_ref_dt) = vm_ref_dt {
706 let vm_ref_dt = Fdt::from_slice(vm_ref_dt).map_err(|e| {
707 error!("Failed to load VM reference DT: {e}");
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900708 RebootReason::InvalidFdt
709 })?;
710
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900711 validate_vm_ref_dt(fdt, vm_ref_dt, &info.vm_ref_dt_props_info).map_err(|e| {
712 error!("Failed to apply VM reference DT: {e}");
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900713 RebootReason::InvalidFdt
714 })?;
715 }
716
Jiyong Park9c63cd12023-03-21 17:53:07 +0900717 patch_device_tree(fdt, &info)?;
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900718
Jaewan Kim19b984f2023-12-04 15:16:50 +0900719 // TODO(b/317201360): Ensure no overlapping in <reg> among devices
720
Jaewan Kim9220e852023-12-01 10:58:40 +0900721 fdt.pack().map_err(|e| {
722 error!("Failed to unpack DT after patching: {e}");
723 RebootReason::InvalidFdt
724 })?;
725
Jiyong Park6a8789a2023-03-21 14:50:59 +0900726 Ok(info)
Jiyong Park83316122023-03-21 09:39:39 +0900727}
728
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900729fn parse_device_tree(fdt: &Fdt, vm_dtbo: Option<&VmDtbo>) -> Result<DeviceTreeInfo, RebootReason> {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900730 let kernel_range = read_kernel_range_from(fdt).map_err(|e| {
731 error!("Failed to read kernel range from DT: {e}");
732 RebootReason::InvalidFdt
733 })?;
734
735 let initrd_range = read_initrd_range_from(fdt).map_err(|e| {
736 error!("Failed to read initrd range from DT: {e}");
737 RebootReason::InvalidFdt
738 })?;
739
Alice Wang0d527472023-06-13 14:55:38 +0000740 let memory_range = read_and_validate_memory_range(fdt)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900741
Jiyong Parke9d87e82023-03-21 19:28:40 +0900742 let bootargs = read_bootargs_from(fdt).map_err(|e| {
743 error!("Failed to read bootargs from DT: {e}");
744 RebootReason::InvalidFdt
745 })?;
746
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000747 let cpus = read_cpu_info_from(fdt).map_err(|e| {
748 error!("Failed to read CPU info from DT: {e}");
Jiyong Park6a8789a2023-03-21 14:50:59 +0900749 RebootReason::InvalidFdt
750 })?;
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000751 validate_cpu_info(&cpus).map_err(|e| {
752 error!("Failed to validate CPU info from DT: {e}");
Alice Wangabc7d632023-06-14 09:10:14 +0000753 RebootReason::InvalidFdt
754 })?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900755
756 let pci_info = read_pci_info_from(fdt).map_err(|e| {
757 error!("Failed to read pci info from DT: {e}");
758 RebootReason::InvalidFdt
759 })?;
Jiyong Park0ee65392023-03-27 20:52:45 +0900760 validate_pci_info(&pci_info, &memory_range)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900761
762 let serial_info = read_serial_info_from(fdt).map_err(|e| {
763 error!("Failed to read serial info from DT: {e}");
764 RebootReason::InvalidFdt
765 })?;
766
Alice Wang9cfbfd62023-06-14 11:19:03 +0000767 let swiotlb_info = SwiotlbInfo::new_from_fdt(fdt).map_err(|e| {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900768 error!("Failed to read swiotlb info from DT: {e}");
769 RebootReason::InvalidFdt
770 })?;
Srivatsa Vaddagiri2df297f2023-04-12 03:11:05 -0700771 validate_swiotlb_info(&swiotlb_info, &memory_range)?;
Jiyong Park6a8789a2023-03-21 14:50:59 +0900772
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900773 let device_assignment = match vm_dtbo {
Jaewan Kim52477ae2023-11-21 21:20:52 +0900774 Some(vm_dtbo) => {
775 if let Some(hypervisor) = hyp::get_device_assigner() {
776 DeviceAssignmentInfo::parse(fdt, vm_dtbo, hypervisor).map_err(|e| {
777 error!("Failed to parse device assignment from DT and VM DTBO: {e}");
778 RebootReason::InvalidFdt
779 })?
780 } else {
781 warn!(
782 "Device assignment is ignored because device assigning hypervisor is missing"
783 );
784 None
785 }
786 }
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900787 None => None,
788 };
789
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900790 let vm_ref_dt_props_info = parse_vm_ref_dt(fdt).map_err(|e| {
Seungjae Yoo013f4c42024-01-02 13:04:19 +0900791 error!("Failed to read names of properties under /avf from DT: {e}");
792 RebootReason::InvalidFdt
793 })?;
Seungjae Yooed67fd52023-11-29 18:54:36 +0900794
Jiyong Park00ceff32023-03-13 05:43:23 +0000795 Ok(DeviceTreeInfo {
Jiyong Park6a8789a2023-03-21 14:50:59 +0900796 kernel_range,
797 initrd_range,
798 memory_range,
Jiyong Parke9d87e82023-03-21 19:28:40 +0900799 bootargs,
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000800 cpus,
Jiyong Park6a8789a2023-03-21 14:50:59 +0900801 pci_info,
802 serial_info,
803 swiotlb_info,
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900804 device_assignment,
Seungjae Yoof0af81d2024-01-17 13:48:36 +0900805 vm_ref_dt_props_info,
Jiyong Park00ceff32023-03-13 05:43:23 +0000806 })
807}
808
Jiyong Park9c63cd12023-03-21 17:53:07 +0900809fn patch_device_tree(fdt: &mut Fdt, info: &DeviceTreeInfo) -> Result<(), RebootReason> {
810 if let Some(initrd_range) = &info.initrd_range {
811 patch_initrd_range(fdt, initrd_range).map_err(|e| {
812 error!("Failed to patch initrd range to DT: {e}");
813 RebootReason::InvalidFdt
814 })?;
815 }
816 patch_memory_range(fdt, &info.memory_range).map_err(|e| {
817 error!("Failed to patch memory range to DT: {e}");
818 RebootReason::InvalidFdt
819 })?;
Jiyong Parke9d87e82023-03-21 19:28:40 +0900820 if let Some(bootargs) = &info.bootargs {
821 patch_bootargs(fdt, bootargs.as_c_str()).map_err(|e| {
822 error!("Failed to patch bootargs to DT: {e}");
823 RebootReason::InvalidFdt
824 })?;
825 }
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000826 patch_cpus(fdt, &info.cpus).map_err(|e| {
Jiyong Park9c63cd12023-03-21 17:53:07 +0900827 error!("Failed to patch cpus to DT: {e}");
828 RebootReason::InvalidFdt
829 })?;
830 patch_pci_info(fdt, &info.pci_info).map_err(|e| {
831 error!("Failed to patch pci info to DT: {e}");
832 RebootReason::InvalidFdt
833 })?;
834 patch_serial_info(fdt, &info.serial_info).map_err(|e| {
835 error!("Failed to patch serial info to DT: {e}");
836 RebootReason::InvalidFdt
837 })?;
838 patch_swiotlb_info(fdt, &info.swiotlb_info).map_err(|e| {
839 error!("Failed to patch swiotlb info to DT: {e}");
840 RebootReason::InvalidFdt
841 })?;
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000842 patch_gic(fdt, info.cpus.len()).map_err(|e| {
Jiyong Park9c63cd12023-03-21 17:53:07 +0900843 error!("Failed to patch gic info to DT: {e}");
844 RebootReason::InvalidFdt
845 })?;
Pierre-Clément Tosi689e4732024-02-05 14:39:51 +0000846 patch_timer(fdt, info.cpus.len()).map_err(|e| {
Jiyong Park9c63cd12023-03-21 17:53:07 +0900847 error!("Failed to patch timer info to DT: {e}");
848 RebootReason::InvalidFdt
849 })?;
Jaewan Kimc6e023b2023-10-12 15:11:05 +0900850 if let Some(device_assignment) = &info.device_assignment {
851 // Note: We patch values after VM DTBO is overlaid because patch may require more space
852 // then VM DTBO's underlying slice is allocated.
853 device_assignment.patch(fdt).map_err(|e| {
854 error!("Failed to patch device assignment info to DT: {e}");
855 RebootReason::InvalidFdt
856 })?;
857 }
Jiyong Parke9d87e82023-03-21 19:28:40 +0900858
Jiyong Park9c63cd12023-03-21 17:53:07 +0900859 Ok(())
860}
861
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000862/// Modifies the input DT according to the fields of the configuration.
863pub fn modify_for_next_stage(
864 fdt: &mut Fdt,
865 bcc: &[u8],
866 new_instance: bool,
867 strict_boot: bool,
Alan Stokes65618332023-12-15 14:09:25 +0000868 debug_policy: Option<&[u8]>,
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900869 debuggable: bool,
Pierre-Clément Tosi80251972023-07-12 12:51:12 +0000870 kaslr_seed: u64,
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000871) -> libfdt::Result<()> {
Pierre-Clément Tosieb887ac2023-05-02 13:33:37 +0000872 if let Some(debug_policy) = debug_policy {
873 let backup = Vec::from(fdt.as_slice());
874 fdt.unpack()?;
875 let backup_fdt = Fdt::from_slice(backup.as_slice()).unwrap();
876 if apply_debug_policy(fdt, backup_fdt, debug_policy)? {
877 info!("Debug policy applied.");
878 } else {
879 // apply_debug_policy restored fdt to backup_fdt so unpack it again.
880 fdt.unpack()?;
881 }
882 } else {
883 info!("No debug policy found.");
884 fdt.unpack()?;
885 }
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000886
Jiyong Parke9d87e82023-03-21 19:28:40 +0900887 patch_dice_node(fdt, bcc.as_ptr() as usize, bcc.len())?;
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000888
Alice Wang56ec45b2023-06-15 08:30:32 +0000889 if let Some(mut chosen) = fdt.chosen_mut()? {
890 empty_or_delete_prop(&mut chosen, cstr!("avf,strict-boot"), strict_boot)?;
891 empty_or_delete_prop(&mut chosen, cstr!("avf,new-instance"), new_instance)?;
Pierre-Clément Tosi80251972023-07-12 12:51:12 +0000892 chosen.setprop_inplace(cstr!("kaslr-seed"), &kaslr_seed.to_be_bytes())?;
Alice Wang56ec45b2023-06-15 08:30:32 +0000893 };
Jiyong Park32f37ef2023-05-17 16:15:58 +0900894 if !debuggable {
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900895 if let Some(bootargs) = read_bootargs_from(fdt)? {
896 filter_out_dangerous_bootargs(fdt, &bootargs)?;
897 }
898 }
899
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000900 fdt.pack()?;
901
902 Ok(())
903}
904
Jiyong Parke9d87e82023-03-21 19:28:40 +0900905/// Patch the "google,open-dice"-compatible reserved-memory node to point to the bcc range
906fn patch_dice_node(fdt: &mut Fdt, addr: usize, size: usize) -> libfdt::Result<()> {
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000907 // We reject DTs with missing reserved-memory node as validation should have checked that the
908 // "swiotlb" subnode (compatible = "restricted-dma-pool") was present.
Jiyong Parke9d87e82023-03-21 19:28:40 +0900909 let node = fdt.node_mut(cstr!("/reserved-memory"))?.ok_or(libfdt::FdtError::NotFound)?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000910
Jiyong Parke9d87e82023-03-21 19:28:40 +0900911 let mut node = node.next_compatible(cstr!("google,open-dice"))?.ok_or(FdtError::NotFound)?;
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000912
Jiyong Parke9d87e82023-03-21 19:28:40 +0900913 let addr: u64 = addr.try_into().unwrap();
914 let size: u64 = size.try_into().unwrap();
915 node.setprop_inplace(cstr!("reg"), flatten(&[addr.to_be_bytes(), size.to_be_bytes()]))
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000916}
917
Alice Wang56ec45b2023-06-15 08:30:32 +0000918fn empty_or_delete_prop(
919 fdt_node: &mut FdtNodeMut,
920 prop_name: &CStr,
921 keep_prop: bool,
922) -> libfdt::Result<()> {
923 if keep_prop {
924 fdt_node.setprop_empty(prop_name)
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000925 } else {
Alice Wang56ec45b2023-06-15 08:30:32 +0000926 fdt_node
927 .delprop(prop_name)
928 .or_else(|e| if e == FdtError::NotFound { Ok(()) } else { Err(e) })
Pierre-Clément Tosi4ba79662023-02-13 11:22:41 +0000929 }
Pierre-Clément Tosidb74cb12022-12-08 13:56:25 +0000930}
Jiyong Parkc23426b2023-04-10 17:32:27 +0900931
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000932/// Apply the debug policy overlay to the guest DT.
933///
934/// Returns Ok(true) on success, Ok(false) on recovered failure and Err(_) on corruption of the DT.
Pierre-Clément Tosieb887ac2023-05-02 13:33:37 +0000935fn apply_debug_policy(
936 fdt: &mut Fdt,
937 backup_fdt: &Fdt,
938 debug_policy: &[u8],
939) -> libfdt::Result<bool> {
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000940 let mut debug_policy = Vec::from(debug_policy);
941 let overlay = match Fdt::from_mut_slice(debug_policy.as_mut_slice()) {
Jiyong Parkc23426b2023-04-10 17:32:27 +0900942 Ok(overlay) => overlay,
943 Err(e) => {
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000944 warn!("Corrupted debug policy found: {e}. Not applying.");
945 return Ok(false);
Jiyong Parkc23426b2023-04-10 17:32:27 +0900946 }
947 };
Jiyong Parkc23426b2023-04-10 17:32:27 +0900948
Andrew Walbran20bb4e42023-07-07 13:55:55 +0100949 // SAFETY: on failure, the corrupted DT is restored using the backup.
Jiyong Parkc23426b2023-04-10 17:32:27 +0900950 if let Err(e) = unsafe { fdt.apply_overlay(overlay) } {
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000951 warn!("Failed to apply debug policy: {e}. Recovering...");
Jiyong Parkc23426b2023-04-10 17:32:27 +0900952 fdt.copy_from_slice(backup_fdt.as_slice())?;
Jiyong Parkc23426b2023-04-10 17:32:27 +0900953 // A successful restoration is considered success because an invalid debug policy
954 // shouldn't DOS the pvmfw
Pierre-Clément Tosia50167b2023-05-02 13:19:29 +0000955 Ok(false)
956 } else {
957 Ok(true)
Jiyong Parkc23426b2023-04-10 17:32:27 +0900958 }
Jiyong Parkc23426b2023-04-10 17:32:27 +0900959}
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900960
Pierre-Clément Tosi1fbc2e92023-05-02 17:28:17 +0000961fn has_common_debug_policy(fdt: &Fdt, debug_feature_name: &CStr) -> libfdt::Result<bool> {
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900962 if let Some(node) = fdt.node(cstr!("/avf/guest/common"))? {
963 if let Some(value) = node.getprop_u32(debug_feature_name)? {
964 return Ok(value == 1);
965 }
966 }
967 Ok(false) // if the policy doesn't exist or not 1, don't enable the debug feature
968}
969
970fn filter_out_dangerous_bootargs(fdt: &mut Fdt, bootargs: &CStr) -> libfdt::Result<()> {
Pierre-Clément Tosi1fbc2e92023-05-02 17:28:17 +0000971 let has_crashkernel = has_common_debug_policy(fdt, cstr!("ramdump"))?;
972 let has_console = has_common_debug_policy(fdt, cstr!("log"))?;
Jiyong Parkc5d2ef22023-04-11 01:23:46 +0900973
974 let accepted: &[(&str, Box<dyn Fn(Option<&str>) -> bool>)] = &[
975 ("panic", Box::new(|v| if let Some(v) = v { v == "=-1" } else { false })),
976 ("crashkernel", Box::new(|_| has_crashkernel)),
977 ("console", Box::new(|_| has_console)),
978 ];
979
980 // parse and filter out unwanted
981 let mut filtered = Vec::new();
982 for arg in BootArgsIterator::new(bootargs).map_err(|e| {
983 info!("Invalid bootarg: {e}");
984 FdtError::BadValue
985 })? {
986 match accepted.iter().find(|&t| t.0 == arg.name()) {
987 Some((_, pred)) if pred(arg.value()) => filtered.push(arg),
988 _ => debug!("Rejected bootarg {}", arg.as_ref()),
989 }
990 }
991
992 // flatten into a new C-string
993 let mut new_bootargs = Vec::new();
994 for (i, arg) in filtered.iter().enumerate() {
995 if i != 0 {
996 new_bootargs.push(b' '); // separator
997 }
998 new_bootargs.extend_from_slice(arg.as_ref().as_bytes());
999 }
1000 new_bootargs.push(b'\0');
1001
1002 let mut node = fdt.chosen_mut()?.ok_or(FdtError::NotFound)?;
1003 node.setprop(cstr!("bootargs"), new_bootargs.as_slice())
1004}