summaryrefslogtreecommitdiff
path: root/libfdt
Commit message (Collapse)AuthorAgeFilesLines
* libfdt: Replace deprecated 0-length arrays with proper flexible arraysKees Cook2023-01-291-2/+2
| | | | | | | | | | | | | | | Replace the 0-length arrays in structures with proper flexible arrays. This will avoid warnings when building under GCC 13 with -fstrict-flex-arrays, which the Linux kernel will be doing soon: In file included from ../lib/fdt_ro.c:2: ../lib/../scripts/dtc/libfdt/fdt_ro.c: In function 'fdt_get_name': ../lib/../scripts/dtc/libfdt/fdt_ro.c:319:24: warning: 'strrchr' reading 1 or more bytes from a region of size 0 [-Wstringop-overread] 319 | leaf = strrchr(nameptr, '/'); | ^~~~~~~~~~~~~~~~~~~~~ Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: prevent integer overflow in fdt_next_tagTadeusz Struk2022-10-121-5/+12
| | | | | | | | | | | | Since fdt_next_tag() in a public API function all input parameters, including the fdt blob should not be trusted. It is possible to forge a blob with invalid property length that will cause integer overflow during offset calculation. To prevent that, validate the property length read from the blob before doing calculations. Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> Message-Id: <20221005232931.3016047-1-tadeusz.struk@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: add fdt_get_property_by_offset_w helperTadeusz Struk2022-10-121-0/+7
| | | | | | | | | | Add a new fdt_get_property_by_offset_w helper function. It is a wrapper on fdt_get_property_by_offset that returns a writable pointer to a property at a given offset. Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> Message-Id: <20221011182611.116011-1-tadeusz.struk@linaro.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libdtc: remove duplicate judgmentsJia Xianhua2022-09-161-3/+0
| | | | | | | | There is no need to check the VALID_DTB repeatedly, and can be combined into one if statement. Signed-off-by: Jia Xianhua <jiaxianhua@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Don't mask fdt_get_name() returned errorPierre-Clément Tosi2022-07-301-1/+4
| | | | | | | | | | | Return the error code from fdt_get_name() (contained in len when the result is NULL) instead of masking it with FDT_ERR_BADSTRUCTURE. Fixes: fda71da26e7f ("libfdt: Handle failed get_name() on BEGIN_NODE") Reported-by: Mike McTernan <mikemcternan@google.com> Signed-off-by: Pierre-Clément Tosi <ptosi@google.com> Message-Id: <20220729130019.804288-1-ptosi@google.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Allow static building with mesonTero Tervala2022-07-271-1/+7
| | | | | | | | | Added "static-build" option in the meson_options.txt. Setting it to "true" allows static building. Signed-off-by: Tero Tervala <tero.tervala@unikie.com> Message-Id: <20220629163557.932298-1-tero.tervala@unikie.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Handle failed get_name() on BEGIN_NODEPierre-Clément Tosi2022-07-261-1/+1
| | | | | | | | | | Validate the return value of fdt_get_name() as an ill-formed DT, causing it to fail, could result in fdt_check_full() dereferencing NULL. fixes: a2def5479950 ("libfdt: Check that the root-node name is empty") Signed-off-by: Pierre-Clément Tosi <ptosi@google.com> Message-Id: <20220714083848.958492-1-ptosi@google.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Fix a UB when fdt_get_string return nullLoveSy2021-12-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | When fdt_get_string return null, `namep` is not correctly reset. From the document of `fdt_getprop_by_offset`, the parameter `namep` will be always overwritten (that is, it will be overwritten without exception of error occurance). As for the caller (like https://github.com/topjohnwu/Magisk/blob/e097c097feb881f6097b6d1dc346f310bc92f5d6/native/jni/magiskboot/dtb.cpp#L42), the code may be like: ```cpp size_t size; const char *name; auto *value = fdt_getprop_by_offset(fdt, prop, &name, &size); ``` and if `value == nullptr`, `size` is also be overwritten correctly but `name` is not, which is quite inconsistent. This commit makes sure `name` and `size` behavior consistently (reset to reasonable value) when error occurs. Signed-off-by: LoveSy <shana@zju.edu.cn> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: overlay: make overlay_get_target() publicVikram Garhwal2021-11-183-22/+26
| | | | | | | | | | | This is done to get the target path for the overlay nodes which is very useful in many cases. For example, Xen hypervisor needs it when applying overlays because Xen needs to do further processing of the overlay nodes, e.g. mapping of resources(IRQs and IOMMUs) to other VMs, creation of SMMU pagetables, etc. Signed-off-by: Vikram Garhwal <fnu.vikram@xilinx.com> Message-Id: <1637204036-382159-2-git-send-email-fnu.vikram@xilinx.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fix an incorrect integer promotionElvira Khabirova2021-11-171-1/+1
| | | | | | | | | | UINT32_MAX is an integer of type unsigned int. UINT32_MAX + 1 overflows unless explicitly computed as unsigned long long. This led to some invalid addresses being treated as valid. Cast UINT32_MAX to uint64_t explicitly. Signed-off-by: Elvira Khabirova <e.khabirova@omp.ru>
* libfdt: Add static lib to meson buildRob Herring2021-11-111-0/+5
| | | | | | | | | | The meson build is not building the static libfdt, so add it. Signed-off-by: Rob Herring <robh@kernel.org> Message-Id: <20211111003329.2347536-1-robh@kernel.org> Reviewed-by: Simon Glass <sjg@chromium.org> Tested-by: Simon Glass <sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Add ALIGNMENT error stringGeorg Kotheimer2021-08-021-0/+1
| | | | | | | | The ALIGNMENT error was missing a string, leading to <unknown error> being returned. Signed-off-by: Georg Kotheimer <georg.kotheimer@kernkonzept.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* fdtget: Fix signedness comparisons warningsAndre Przywara2021-06-211-0/+7
| | | | | | | | | | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in the different legs of the conditional operator, in fdtget.c. In the questionable expression, we are constructing a 16-bit value out of two unsigned 8-bit values, however are relying on the compiler's automatic expansion of the uint8_t to a larger type, to survive the left shift. This larger type happens to be an "int", so this part of the expression becomes signed. Fix this by explicitly blowing up the uint8_t to a larger *unsigned* type, before doing the left shift. And while we are at it, convert the hardly readable conditional operator usage into a sane switch/case expression. This fixes "make fdtget", when compiled with -Wsign-compare. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20210618172030.9684-3-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Fix CID 1461557David Gibson2021-06-081-5/+8
| | | | | | | | | | | | Coverity gets a bit confused by loading fdt_size_dt_strings() and using it in a memmove(). In fact this is safe because the callers have verified this information (via FDT_RW_PROBE() in fdt_pack() or construction in fdt_open_into()). Passing in strings_size like we already do struct_size seems to get Coverity to follow what's going on here. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Add FDT alignment check to fdt_check_header()Rob Herring2021-04-071-0/+4
| | | | | | | | | | | | | Only checking the FDT alignment in fdt_ro_probe_() means that fdt_check_header() can pass, but then subsequent API calls fail on alignment checks. Let's add an alignment check to fdt_check_header() so alignment errors are found up front. Cc: Tom Rini <trini@konsulko.com> Cc: Frank Rowand <frowand.list@gmail.com> Signed-off-by: Rob Herring <robh@kernel.org> Message-Id: <20210406190712.2118098-1-robh@kernel.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Check that the root-node name is emptySimon Glass2021-03-231-0/+10
| | | | | | | | | | | | | | | | The root node is supposed to have an empty name, but at present this is not checked. The behaviour of such a tree is not well defined. Most software rightly assumes that the root node is at offset 0 and does not check the name. This oddity was discovered as part of a security investigation into U-Boot verified boot. Add a check for this to fdt_check_full(). Signed-off-by: Simon Glass <sjg@chromium.org> Reported-by: Arie Haenel <arie.haenel@intel.com> Reported-by: Julien Lenoir <julien.lenoir@intel.com> Message-Id: <20210323010410.3222701-2-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Check that there is only one root nodeSimon Glass2021-03-231-0/+7
| | | | | | | | | | | | | | | At present it is possible to have two root nodes and even access nodes in the 'second' root. Such trees should not be considered valid. This was discovered as part of a security investigation into U-Boot verified boot. Add a check for this to fdt_check_full(). Signed-off-by: Simon Glass <sjg@chromium.org> Reported-by: Arie Haenel <arie.haenel@intel.com> Reported-by: Julien Lenoir <julien.lenoir@intel.com> Message-Id: <20210323000926.3210733-1-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Fix a possible "unchecked return value" warningDavid Gibson2021-03-091-1/+4
| | | | | | | | | | | | | | | | Apparently the unchecked return value of the first fdt_next_tag() call in fdt_add_subnode_namelen() is tripping Coverity Scan in some circumstances, although it appears not to for the scan on our project itself. This fdt_next_tag() should always return FDT_BEGIN_NODE, since otherwise the fdt_subnode_offset_namelen() above would have returned BADOFFSET or BADSTRUCTURE. Still, add a check to shut Coverity up, gated by a can_assume() to avoid bloat in small builds. Reported-by: Ryan Long <ryan.long@oarcorp.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* Set last_comp_version correctly in new dtb and fix potential version issues ↵Justin Covell2021-01-043-2/+5
| | | | | | | | | | | | | | | in fdt_open_into Changes in v3: - Remove noop version sets - Set version correctly on loaded fdt in fdt_open_into Fixes: f1879e1a50eb ("Add limited read-only support for older (V2 and V3) device tree to libfdt.") Signed-off-by: Justin Covell <jujugoboom@gmail.com> Message-Id: <20201229041749.2187-1-jujugoboom@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Tweak description of assume-aligned load helpersDavid Gibson2020-12-161-7/+7
| | | | | | | | There's a small inaccuracy in the comment describing these new helpers. This corrects it, and reformats while we're there. Fixes: f98f28ab ("libfdt: Internally perform potentially unaligned loads") Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Internally perform potentially unaligned loadsTom Rini2020-12-163-15/+32
| | | | | | | | | | | | | | | | | | | | | Commits 6dcb8ba4 "libfdt: Add helpers for accessing unaligned words" introduced changes to support unaligned reads for ARM platforms and 11738cf01f15 "libfdt: Don't use memcpy to handle unaligned reads on ARM" improved the performance of these helpers. On further discussion, while there are potential cases where we could be used on platforms that do not fixup unaligned reads for us, making this choice the default is very expensive in terms of binary size and access time. To address this, introduce and use new fdt{32,64}_ld_ functions that call fdt{32,64}_to_cpu() as was done prior to the above mentioned commits. Leave the existing load functions as unaligned-safe and include comments in both cases. Reviewed-by: Rob Herring <robh@kernel.org> Signed-off-by: Tom Rini <trini@konsulko.com> Message-Id: <20201211022736.31657-1-trini@konsulko.com> Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Check for 8-byte address alignment in fdt_ro_probe_()Tom Rini2020-11-242-1/+9
| | | | | | | | | | The device tree must be loaded in to memory at an 8-byte aligned address. Add a check for this condition in fdt_ro_probe_() and a new error code to return if we are not. Signed-off-by: Tom Rini <trini@konsulko.com> Message-Id: <20201104130605.28874-1-trini@konsulko.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* build-sys: add meson buildMarc-André Lureau2020-10-211-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The meson build system allows projects to "vendor" dtc easily, thanks to subproject(). QEMU has recently switched to meson, and adding meson support to dtc will help to handle the QEMU submodule. meson rules are arguably simpler to write and maintain than the hand-crafted/custom Makefile. meson support various backends, and default build options (including coverage, sanitizer, debug/release etc, see: https://mesonbuild.com/Builtin-options.html) Compare to the Makefiles, the same build targets should be built and installed and the same tests should be run ("meson test" can be provided extra test arguments for running the equivalent of checkm/checkv). There is no support EXTRAVERSION/LOCAL_VERSION/CONFIG_LOCALVERSION, instead the version is simply set with project(), and vcs_tag() is used for git/dirty version reporting (This is most common and is hopefully enough. If necessary, configure-time options could be added for extra versioning.). libfdt shared library is build following regular naming conventions: instead of libfdt.so.1 -> libfdt-1.6.0.so (with current build-sys), libfdt.so.1 -> libfdt.so.1.6.0. I am not sure why the current build system use an uncommon naming pattern. I also included a libfdt.pc pkg-config file, as convenience. Both Linux native build and mingw cross-build pass. CI pass. Tests are only run on native build. The current Makefiles are left in-tree, and make/check still work. Eventually, the Makefiles could be marked as deprecated, to start a transition period and avoid having to maintain 2 build systems in the near future. (run_tests.sh could eventually be replaced by the meson test runner, which would have several advantages in term of flexibility/features, but this is left for another day) Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20201012073405.1682782-3-marcandre.lureau@redhat.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Fix kernel-doc commentsAndre Przywara2020-10-131-36/+75
| | | | | | | | | | | | | | | | | | The API documentation in libfdt.h seems to follow the Linux kernel's kernel-doc format[1]. Running "scripts/kernel-doc -v -none" on the file reports some problems, mostly missing return values and missing parameter descriptions. Fix those up by providing the missing bits, and fixing the other small issues reported by the script. Signed-off-by: Andre Przywara <andre.przywara@arm.com> [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/doc-guide/kernel-doc.rst Message-Id: <20201012165331.25016-1-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_strerror(): Fix comparison warningAndre Przywara2020-10-021-2/+2
| | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_strerror(). Force FDT_ERRTABSIZE to be signed (it's surely small enough to fit), so that the types match. Also move the minus sign to errval, as this is actually what we use in the next line. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20201001164630.4980-7-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_get_string(): Fix sequential write comparison warningsAndre Przywara2020-10-021-4/+6
| | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in comparisons in fdt_get_string(). Introduce a new usigned variable, which holds the actual (negated) stroffset value, so we avoid negating all the other variables and have proper types everywhere. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20201001164630.4980-6-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: libfdt_wip: Fix comparison warningAndre Przywara2020-10-021-1/+1
| | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_setprop_inplace_namelen_partial(). fdt_getprop_namelen() will only return negative error values in "proplen" if the return value is NULL. So we can rely on "proplen" being positive in our case and can safely cast it to an unsigned type. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20201001164630.4980-5-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_create_with_flags(): Fix comparison warningAndre Przywara2020-10-021-2/+2
| | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_create_with_flags(). By making hdrsize a signed integer (we are sure it's a very small number), we avoid all the casts and have matching types. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20201001164630.4980-4-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_move(): Fix comparison warningsAndre Przywara2020-10-021-1/+4
| | | | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in comparisons in fdt_move(). This stems from "bufsize" being passed in as a signed integer, even though we would expect a buffer size to be positive. Short of changing the prototype, check that bufsize is not negative, and cast it to an unsigned type in the comparison. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20201001164630.4980-3-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_add_string_(): Fix comparison warningAndre Przywara2020-10-021-7/+7
| | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_add_string_(). Make all variables unsigned, and express the negative offset trick via subtractions in the code. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20201001164630.4980-2-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_node_offset_by_phandle(): Fix comparison warningAndre Przywara2020-09-251-1/+1
| | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_node_offset_by_phandle(). Uses a better suited bitwise NOT operator to denote the special value of -1, which automatically results in an unsigned type. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-14-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: overlay: Fix comparison warningAndre Przywara2020-09-251-1/+2
| | | | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in overlay_update_local_node_references(). This happens because the division of a signed int by an unsigned int promotes the dividend to unsigned first (ANSI C standard 6.1.3.8). As in this case we basically just divide by 4, we can do the division separately earlier, which preserves the original type. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-12-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_resize(): Fix comparison warningAndre Przywara2020-09-241-1/+4
| | | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_resize(). A negative buffer size will surely do us no good, so let's rule this case out first. In the actual comparison we then know that a cast to an unsigned type is safe. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-10-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_splice_(): Fix comparison warningAndre Przywara2020-09-241-1/+1
| | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_splice_(). Since we just established that oldlen is not negative, we can safely cast it to an unsigned type. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-8-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_get_string(): Fix comparison warningsSimon Glass2020-09-241-2/+2
| | | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in comparisons in fdt_get_string(). In the first two cases, we have just established that the signed values are not negative, so it's safe to cast the values to an unsigned type. Signed-off-by: Simon Glass <sjg@chromium.org> Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-7-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_grab_space_(): Fix comparison warningAndre Przywara2020-09-231-2/+2
| | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in a comparison in fdt_grab_space_(). All the involved values cannot be negative, so let's switch the types of the local variables to unsigned to make the compiler happy. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-4-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_mem_rsv(): Fix comparison warningsAndre Przywara2020-09-231-2/+2
| | | | | | | | | | | | With -Wsign-compare, compilers warn about a mismatching signedness in comparisons in fdt_mem_rsv(). Since all involved values must be positive, change the used types to be unsigned. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-3-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fdt_offset_ptr(): Fix comparison warningsAndre Przywara2020-09-231-3/+7
| | | | | | | | | | | | | | | With -Wsign-compare, compilers warn about mismatching signedness in comparisons in fdt_offset_ptr(). This mostly stems from "offset" being passed in as a signed integer, even though the function would not really tolerate negative values. Short of changing the prototype, check that offset is not negative, and use an unsigned type internally. Signed-off-by: Andre Przywara <andre.przywara@arm.com> Message-Id: <20200921165303.9115-2-andre.przywara@arm.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fix fdt_check_node_offset_ w/ VALID_INPUTFrank Mehnert2020-08-141-6/+10
| | | | | | | | | | | | | fdt_check_node_offset_() checks for a valid offset but also changes the offset by calling fdt_next_tag(). Hence, do not skip this function if ASSUME_VALID_INPUT is set but only omit the initial offset check in that case. As this function works very similar to fdt_check_prop_offset_(), do the offset check there as well depending on ASSUME_VALID_INPUT. Message-Id: <1913141.TlUzK5foHS@noys4> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fix fdt_check_full buffer overrunPatrick Oppenlander2020-07-101-0/+2
| | | | | | | | | | | | | fdt_check_header assumes that its argument points to a complete header and can read data beyond the FDT_V1_SIZE bytes which fdt_check_full can provide. fdt_header_size can safely return a header size with FDT_V1_SIZE bytes available and will return a usable value even for a corrupted header. Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Message-Id: <20200709041451.338548-1-patrick.oppenlander@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: add extern "C" for C++Patrick Oppenlander2020-06-191-0/+8
| | | | | | Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Message-Id: <20200616011217.15253-1-patrick.oppenlander@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: trivial typo fixPatrick Oppenlander2020-06-181-1/+1
| | | | | | Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Message-Id: <20200618042117.131731-1-patrick.oppenlander@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Correct condition for reordering blocksSimon Glass2020-06-161-1/+1
| | | | | | | | | This condition uses bitwise OR but should be logical OR. Fix it. Signed-off-by: Simon Glass <sjg@chromium.org> Reported-by: kernel test robot <lkp@intel.com> Message-Id: <20200615160033.87328-1-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: fix undefined behaviour in fdt_splice_()Jan Beulich2020-03-061-6/+7
| | | | | | | | | | | | | | libfdt: fix undefined behaviour in fdt_splice_() Along the lines of commit d0b3ab0a0f46 ("libfdt: Fix undefined behaviour in fdt_offset_ptr()"), fdt_splice_() similarly may not use pointer arithmetic to do overflow checks. (The left side of the checks added by d4c7c25c9ed1 ["libfdt: check for potential overrun in _fdt_splice()"] doesn't really lend itself to similar replacement though.) Signed-off-by: Jan Beulich <jbeulich@suse.com> Message-Id: <f2d09e81-7cb8-c5cc-9699-1ac05b0626ff@suse.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Use VALID_INPUT for FDT_ERR_BADSTATE checksSimon Glass2020-03-032-4/+5
| | | | | | | | | | This error indicates a logic bug in the code calling libfdt, so VALID_DTB is not really the right check. Update it to use VALID_INPUT instead. Signed-off-by: Simon Glass <sjg@chromium.org> Suggested-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200302190255.51426-4-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Add support for disabling internal checksSimon Glass2020-03-032-2/+11
| | | | | | | | | | | If libfdt returns -FDT_ERR_INTERNAL that generally indicates a bug in the library. Add a new assumption for these cases since it should be save to disable these checks regardless of the input. Signed-off-by: Simon Glass <sjg@chromium.org> Suggested-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200302190255.51426-3-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Improve comments in some of the assumptionsSimon Glass2020-03-031-3/+12
| | | | | | | | | Add a little more detail in a few of these comments. Signed-off-by: Simon Glass <sjg@chromium.org> Suggested-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200302190255.51426-2-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Fix a few typosSimon Glass2020-03-031-3/+3
| | | | | | | | | | Fix 'saftey' and 'additional' typos noticed in the assumption series. Reword the ASSUME_NO_ROLLBACK slightly to improve clarity. Signed-off-by: Simon Glass <sjg@chromium.org> Suggested-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200302190255.51426-1-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Allow exclusion of fdt_check_full()Simon Glass2020-02-243-64/+75
| | | | | | | | | | This function is used to perform a full check of the device tree. Allow it to be excluded if all assumptions are enabled. Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200220214557.176528-9-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
* libfdt: Add support for disabling ordering check/fixupSimon Glass2020-02-241-1/+2
| | | | | | | | | | Add a way to remove this check and the reordering code, which is unnecessary if the dtb is known to be correctly ordered. Signed-off-by: Simon Glass <sjg@chromium.org> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Message-Id: <20200220214557.176528-8-sjg@chromium.org> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
View Lorry Controller Status