From 9b1acd812487c3a5e34c5c82e124ca4b0aa60b7a Mon Sep 17 00:00:00 2001 From: Michal Orzel Date: Wed, 15 Apr 2026 13:37:00 +0200 Subject: [PATCH] xen/dt-overlay: attach resources for child nodes in overlay handle_attach_overlay_nodes() only calls handle_device() on the top-level overlay nodes tracked in entry->nodes_address[]. Child nodes that have their own reg, interrupts, or iommus properties are never processed, so their IRQs are not routed, MMIO regions are not mapped, and IOMMU setup is skipped. Introduce handle_device_and_children() which recursively walks the subtree rooted at each overlay node and calls handle_device() on every descendant, ensuring all resources in the overlay are properly attached. Note that the attach error path has a pre-existing bug: on partial failure, the tracking rangesets are destroyed without first revoking the IRQ/MMIO permissions and IOMMU assignments that were already granted by the successful handle_device() calls. Add a TODO comment to flag this. Signed-off-by: Michal Orzel Reviewed-by: Luca Fancellu Acked-by: Stefano Stabellini --- xen/common/device-tree/dt-overlay.c | 34 +++++++++++++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/xen/common/device-tree/dt-overlay.c b/xen/common/device-tree/dt-overlay.c index d3d4669718..f203e189f5 100644 --- a/xen/common/device-tree/dt-overlay.c +++ b/xen/common/device-tree/dt-overlay.c @@ -841,6 +841,30 @@ static long handle_add_overlay_nodes(void *overlay_fdt, return rc; } +static int handle_device_and_children(struct domain *d, + struct dt_device_node *dev, + p2m_type_t p2mt, + struct rangeset *iomem_ranges, + struct rangeset *irq_ranges) +{ + int rc; + struct dt_device_node *child; + + rc = handle_device(d, dev, p2mt, iomem_ranges, irq_ranges); + if ( rc ) + return rc; + + dt_for_each_child_node(dev, child) + { + rc = handle_device_and_children(d, child, p2mt, + iomem_ranges, irq_ranges); + if ( rc ) + return rc; + } + + return 0; +} + static long handle_attach_overlay_nodes(struct domain *d, const void *overlay_fdt, uint32_t overlay_fdt_size) @@ -898,8 +922,9 @@ static long handle_attach_overlay_nodes(struct domain *d, } write_lock(&dt_host_lock); - rc = handle_device(d, overlay_node, p2m_mmio_direct_c, - entry->iomem_ranges, entry->irq_ranges); + rc = handle_device_and_children(d, overlay_node, p2m_mmio_direct_c, + entry->iomem_ranges, + entry->irq_ranges); write_unlock(&dt_host_lock); if ( rc ) { @@ -915,6 +940,11 @@ static long handle_attach_overlay_nodes(struct domain *d, out: spin_unlock(&overlay_lock); + /* + * TODO: IRQ/MMIO permissions and IOMMU assignments granted by + * handle_device() before the failure are not revoked here. We only + * destroy the tracking rangesets, leaking the actual grants. + */ if ( entry ) { rangeset_destroy(entry->irq_ranges);