| Message ID | 20220127154639.2090164-17-peter.maydell@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | arm: Fix handling of unrecognized functions in PSCI emulation | expand |
On 1/28/22 02:46, Peter Maydell wrote: > If we're using PSCI emulation, we add a /psci node to the device tree > we pass to the guest. At the moment, if the dtb already has a /psci > node in it, we retain it, rather than replacing it. (This behaviour > was added in commit c39770cd637765 in 2018.) > > This is a problem if the existing node doesn't match our PSCI > emulation. In particular, it might specify the wrong method (HVC vs > SMC), or wrong function IDs for cpu_suspend/cpu_off/etc, in which > case the guest will not get the behaviour it wants when it makes PSCI > calls. > > An example of this is trying to boot the highbank or midway board > models using the device tree supplied in the kernel sources: this > device tree includes a /psci node that specifies function IDs that > don't match the (PSCI 0.2 compliant) IDs that QEMU uses. The dtb > cpu_suspend function ID happens to match the PSCI 0.2 cpu_off ID, so > the guest hangs after booting when the kernel tries to idle the CPU > and instead it gets turned off. > > Instead of retaining an existing /psci node, delete it entirely > and replace it with a node whose properties match QEMU's PSCI > emulation behaviour. This matches the way we handle /memory nodes, > where we also delete any existing nodes and write in ones that > match the way QEMU is going to behave. > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > I'm not confident about the FDT API to use to remove an > existing node -- I used qemu_fdt_nop_node() as that matches the > code in boot.c that's removing the memory nodes. There is > also an fdt_del_node(), though... It all depends on whether we've got saved offsets for nodes in the DTB, I guess. fdt_del_node says that it changes node offsets, and fdt_nop_node says that it doesn't. Anyway, Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
diff --git a/hw/arm/boot.c b/hw/arm/boot.c index b46f1fe889e..b1e95978f26 100644 --- a/hw/arm/boot.c +++ b/hw/arm/boot.c @@ -478,12 +478,13 @@ static void fdt_add_psci_node(void *fdt) } /* - * If /psci node is present in provided DTB, assume that no fixup - * is necessary and all PSCI configuration should be taken as-is + * A pre-existing /psci node might specify function ID values + * that don't match QEMU's PSCI implementation. Delete the whole + * node and put our own in instead. */ rc = fdt_path_offset(fdt, "/psci"); if (rc >= 0) { - return; + qemu_fdt_nop_node(fdt, "/psci"); } qemu_fdt_add_subnode(fdt, "/psci");
If we're using PSCI emulation, we add a /psci node to the device tree we pass to the guest. At the moment, if the dtb already has a /psci node in it, we retain it, rather than replacing it. (This behaviour was added in commit c39770cd637765 in 2018.) This is a problem if the existing node doesn't match our PSCI emulation. In particular, it might specify the wrong method (HVC vs SMC), or wrong function IDs for cpu_suspend/cpu_off/etc, in which case the guest will not get the behaviour it wants when it makes PSCI calls. An example of this is trying to boot the highbank or midway board models using the device tree supplied in the kernel sources: this device tree includes a /psci node that specifies function IDs that don't match the (PSCI 0.2 compliant) IDs that QEMU uses. The dtb cpu_suspend function ID happens to match the PSCI 0.2 cpu_off ID, so the guest hangs after booting when the kernel tries to idle the CPU and instead it gets turned off. Instead of retaining an existing /psci node, delete it entirely and replace it with a node whose properties match QEMU's PSCI emulation behaviour. This matches the way we handle /memory nodes, where we also delete any existing nodes and write in ones that match the way QEMU is going to behave. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- I'm not confident about the FDT API to use to remove an existing node -- I used qemu_fdt_nop_node() as that matches the code in boot.c that's removing the memory nodes. There is also an fdt_del_node(), though... --- hw/arm/boot.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)