dtc crash; pnv_dt_serial cannot find lpc's phandle
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Qemu version:
QEMU emulator version 4.0.50 (v4.0.0-
Copyright (c) 2003-2019 Fabrice Bellard and the QEMU Project developers
dtc version:
Version: DTC 1.5.0-g5c3513f6
-------
pnv_dt_serial has a line which is supposed to set the interrupt-parent of the "isa-serial@i3f8" node to the phandle of "lpc@0".
To that end, it calls fdt_get_phandle as shown below:
_FDT((fdt_
The function fdt_get_phandle fails to find the property "phandle" (or "linux,phandle") for the lpc node. Consequently, pnv_dt_serial sets the interrupt-parent to 0.
Now boot the qemu-system-ppc64 powernv machine, and extract the fdt by using the qemu monitor's pmemsave command, taking help of the OPAL firmware's messages to locate the fdt in the physical ram.
qemu-system-ppc64 -m 1g -machine powernv,num-chips=1 \
-cpu power9 -smp 2,cores=2,threads=1 -accel tcg,thread=multi \
-kernel ./vmlinux \
-append 'disable_radix' \
-serial mon:stdio -nographic -nodefaults
The kernel vmlinux contains nothing but a single instruction which loops infintely, so that we can gather OPAL's messages, especially the one below:
[ 0.168845963,5] INIT: Starting kernel at 0x20000000, fdt at 0x304b0b70 14404 bytes
Once the fdt is dumped to a file, run the following:
'dtc -O dtb -I dts -o out.dts dtb'
After a few warnings, the dtc application crashes because an assertion was fired.
out.dts: Warning (unit_address_
out.dts: Warning (simple_bus_reg): /lpcm-opb@
out.dts: Warning (avoid_
out.dts: Warning (unique_
out.dts: Warning (chosen_
dtc: livetree.c:575: get_node_
Aborted (core dumped)
The assertion is fired because get_node_by_phandle receives a phandle value of 0, which is unexpected, unless fixups are needed (They are not, when running the dtc command).
Back inside pnv_dt_serial, if the line that sets "interrupt-parent" for the serial device node is commented out, the dtc crash is prevented. Looking at hw/ppc/e500.c, it takes care of allocating necessary phandle values in the nodes, so a similar method can be adopted for powernv.
The dtb is attached.
Edit: Add version, Correct filenames.
description: | updated |
Changed in qemu: | |
status: | Incomplete → Fix Released |
IIUC there are two bugs here
1) The powernv machine in qemu is attempting to use a phandle for node that doesn't have one. It will need to assign a phandle to that node and re-use it elsewhere. This should be pretty straightforward.
2) dtc is crashing with an assertion - that shouldn't happen, even on bad input it should error out rather than crashing. The problem also occurs with current upstream dtc - I'll try to investigate this.
Btw, I'm assuming where you say 'dtc -O dtb -I dts -o out.dts dtb' you actually meant 'dtc -I dtb -O dts -o out.dts dtb' (i.e. -I and -O swapped around), since you're trying to decompile a blob to source rather than the other way around.