1 // SPDX-License-Identifier: (GPL-2.0-or-later OR BSD-2-Clause)
2 /*
3 * libfdt - Flat Device Tree manipulation
4 * Copyright (C) 2006 David Gibson, IBM Corporation.
5 */
6 #include "libfdt_env.h"
7
8 #include <fdt.h>
9 #include <libfdt.h>
10
11 #include "libfdt_internal.h"
12
13 /*
14 * Minimal sanity check for a read-only tree. fdt_ro_probe_() checks
15 * that the given buffer contains what appears to be a flattened
16 * device tree with sane information in its header.
17 */
fdt_ro_probe_(const void * fdt)18 int32_t fdt_ro_probe_(const void *fdt)
19 {
20 uint32_t totalsize = fdt_totalsize(fdt);
21
22 if (can_assume(VALID_DTB))
23 return totalsize;
24
25 if (fdt_magic(fdt) == FDT_MAGIC) {
26 /* Complete tree */
27 if (!can_assume(LATEST)) {
28 if (fdt_version(fdt) < FDT_FIRST_SUPPORTED_VERSION)
29 return -FDT_ERR_BADVERSION;
30 if (fdt_last_comp_version(fdt) >
31 FDT_LAST_SUPPORTED_VERSION)
32 return -FDT_ERR_BADVERSION;
33 }
34 } else if (fdt_magic(fdt) == FDT_SW_MAGIC) {
35 /* Unfinished sequential-write blob */
36 if (!can_assume(VALID_INPUT) && fdt_size_dt_struct(fdt) == 0)
37 return -FDT_ERR_BADSTATE;
38 } else {
39 return -FDT_ERR_BADMAGIC;
40 }
41
42 if (totalsize < INT32_MAX)
43 return totalsize;
44 else
45 return -FDT_ERR_TRUNCATED;
46 }
47
check_off_(uint32_t hdrsize,uint32_t totalsize,uint32_t off)48 static int check_off_(uint32_t hdrsize, uint32_t totalsize, uint32_t off)
49 {
50 return (off >= hdrsize) && (off <= totalsize);
51 }
52
check_block_(uint32_t hdrsize,uint32_t totalsize,uint32_t base,uint32_t size)53 static int check_block_(uint32_t hdrsize, uint32_t totalsize,
54 uint32_t base, uint32_t size)
55 {
56 if (!check_off_(hdrsize, totalsize, base))
57 return 0; /* block start out of bounds */
58 if ((base + size) < base)
59 return 0; /* overflow */
60 if (!check_off_(hdrsize, totalsize, base + size))
61 return 0; /* block end out of bounds */
62 return 1;
63 }
64
fdt_header_size_(uint32_t version)65 size_t fdt_header_size_(uint32_t version)
66 {
67 if (version <= 1)
68 return FDT_V1_SIZE;
69 else if (version <= 2)
70 return FDT_V2_SIZE;
71 else if (version <= 3)
72 return FDT_V3_SIZE;
73 else if (version <= 16)
74 return FDT_V16_SIZE;
75 else
76 return FDT_V17_SIZE;
77 }
78
fdt_header_size(const void * fdt)79 size_t fdt_header_size(const void *fdt)
80 {
81 return can_assume(LATEST) ? FDT_V17_SIZE :
82 fdt_header_size_(fdt_version(fdt));
83 }
84
fdt_check_header(const void * fdt)85 int fdt_check_header(const void *fdt)
86 {
87 size_t hdrsize;
88
89 if (fdt_magic(fdt) != FDT_MAGIC)
90 return -FDT_ERR_BADMAGIC;
91 if (!can_assume(LATEST)) {
92 if ((fdt_version(fdt) < FDT_FIRST_SUPPORTED_VERSION)
93 || (fdt_last_comp_version(fdt) >
94 FDT_LAST_SUPPORTED_VERSION))
95 return -FDT_ERR_BADVERSION;
96 if (fdt_version(fdt) < fdt_last_comp_version(fdt))
97 return -FDT_ERR_BADVERSION;
98 }
99 hdrsize = fdt_header_size(fdt);
100 if (!can_assume(VALID_DTB)) {
101
102 if ((fdt_totalsize(fdt) < hdrsize)
103 || (fdt_totalsize(fdt) > INT_MAX))
104 return -FDT_ERR_TRUNCATED;
105
106 /* Bounds check memrsv block */
107 if (!check_off_(hdrsize, fdt_totalsize(fdt),
108 fdt_off_mem_rsvmap(fdt)))
109 return -FDT_ERR_TRUNCATED;
110 }
111
112 if (!can_assume(VALID_DTB)) {
113 /* Bounds check structure block */
114 if (!can_assume(LATEST) && fdt_version(fdt) < 17) {
115 if (!check_off_(hdrsize, fdt_totalsize(fdt),
116 fdt_off_dt_struct(fdt)))
117 return -FDT_ERR_TRUNCATED;
118 } else {
119 if (!check_block_(hdrsize, fdt_totalsize(fdt),
120 fdt_off_dt_struct(fdt),
121 fdt_size_dt_struct(fdt)))
122 return -FDT_ERR_TRUNCATED;
123 }
124
125 /* Bounds check strings block */
126 if (!check_block_(hdrsize, fdt_totalsize(fdt),
127 fdt_off_dt_strings(fdt),
128 fdt_size_dt_strings(fdt)))
129 return -FDT_ERR_TRUNCATED;
130 }
131
132 return 0;
133 }
134
fdt_offset_ptr(const void * fdt,int offset,unsigned int len)135 const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len)
136 {
137 unsigned int uoffset = offset;
138 unsigned int absoffset = offset + fdt_off_dt_struct(fdt);
139
140 if (offset < 0)
141 return NULL;
142
143 if (!can_assume(VALID_INPUT))
144 if ((absoffset < uoffset)
145 || ((absoffset + len) < absoffset)
146 || (absoffset + len) > fdt_totalsize(fdt))
147 return NULL;
148
149 if (can_assume(LATEST) || fdt_version(fdt) >= 0x11)
150 if (((uoffset + len) < uoffset)
151 || ((offset + len) > fdt_size_dt_struct(fdt)))
152 return NULL;
153
154 return fdt_offset_ptr_(fdt, offset);
155 }
156
fdt_next_tag(const void * fdt,int startoffset,int * nextoffset)157 uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)
158 {
159 const fdt32_t *tagp, *lenp;
160 uint32_t tag;
161 int offset = startoffset;
162 const char *p;
163
164 *nextoffset = -FDT_ERR_TRUNCATED;
165 tagp = fdt_offset_ptr(fdt, offset, FDT_TAGSIZE);
166 if (!can_assume(VALID_DTB) && !tagp)
167 return FDT_END; /* premature end */
168 tag = fdt32_to_cpu(*tagp);
169 offset += FDT_TAGSIZE;
170
171 *nextoffset = -FDT_ERR_BADSTRUCTURE;
172 switch (tag) {
173 case FDT_BEGIN_NODE:
174 /* skip name */
175 do {
176 p = fdt_offset_ptr(fdt, offset++, 1);
177 } while (p && (*p != '\0'));
178 if (!can_assume(VALID_DTB) && !p)
179 return FDT_END; /* premature end */
180 break;
181
182 case FDT_PROP:
183 lenp = fdt_offset_ptr(fdt, offset, sizeof(*lenp));
184 if (!can_assume(VALID_DTB) && !lenp)
185 return FDT_END; /* premature end */
186 /* skip-name offset, length and value */
187 offset += sizeof(struct fdt_property) - FDT_TAGSIZE
188 + fdt32_to_cpu(*lenp);
189 if (!can_assume(LATEST) &&
190 fdt_version(fdt) < 0x10 && fdt32_to_cpu(*lenp) >= 8 &&
191 ((offset - fdt32_to_cpu(*lenp)) % 8) != 0)
192 offset += 4;
193 break;
194
195 case FDT_END:
196 case FDT_END_NODE:
197 case FDT_NOP:
198 break;
199
200 default:
201 return FDT_END;
202 }
203
204 if (!fdt_offset_ptr(fdt, startoffset, offset - startoffset))
205 return FDT_END; /* premature end */
206
207 *nextoffset = FDT_TAGALIGN(offset);
208 return tag;
209 }
210
fdt_check_node_offset_(const void * fdt,int offset)211 int fdt_check_node_offset_(const void *fdt, int offset)
212 {
213 if (!can_assume(VALID_INPUT)
214 && ((offset < 0) || (offset % FDT_TAGSIZE)))
215 return -FDT_ERR_BADOFFSET;
216
217 if (fdt_next_tag(fdt, offset, &offset) != FDT_BEGIN_NODE)
218 return -FDT_ERR_BADOFFSET;
219
220 return offset;
221 }
222
fdt_check_prop_offset_(const void * fdt,int offset)223 int fdt_check_prop_offset_(const void *fdt, int offset)
224 {
225 if (!can_assume(VALID_INPUT)
226 && ((offset < 0) || (offset % FDT_TAGSIZE)))
227 return -FDT_ERR_BADOFFSET;
228
229 if (fdt_next_tag(fdt, offset, &offset) != FDT_PROP)
230 return -FDT_ERR_BADOFFSET;
231
232 return offset;
233 }
234
fdt_next_node(const void * fdt,int offset,int * depth)235 int fdt_next_node(const void *fdt, int offset, int *depth)
236 {
237 int nextoffset = 0;
238 uint32_t tag;
239
240 if (offset >= 0)
241 if ((nextoffset = fdt_check_node_offset_(fdt, offset)) < 0)
242 return nextoffset;
243
244 do {
245 offset = nextoffset;
246 tag = fdt_next_tag(fdt, offset, &nextoffset);
247
248 switch (tag) {
249 case FDT_PROP:
250 case FDT_NOP:
251 break;
252
253 case FDT_BEGIN_NODE:
254 if (depth)
255 (*depth)++;
256 break;
257
258 case FDT_END_NODE:
259 if (depth && ((--(*depth)) < 0))
260 return nextoffset;
261 break;
262
263 case FDT_END:
264 if ((nextoffset >= 0)
265 || ((nextoffset == -FDT_ERR_TRUNCATED) && !depth))
266 return -FDT_ERR_NOTFOUND;
267 else
268 return nextoffset;
269 }
270 } while (tag != FDT_BEGIN_NODE);
271
272 return offset;
273 }
274
fdt_first_subnode(const void * fdt,int offset)275 int fdt_first_subnode(const void *fdt, int offset)
276 {
277 int depth = 0;
278
279 offset = fdt_next_node(fdt, offset, &depth);
280 if (offset < 0 || depth != 1)
281 return -FDT_ERR_NOTFOUND;
282
283 return offset;
284 }
285
fdt_next_subnode(const void * fdt,int offset)286 int fdt_next_subnode(const void *fdt, int offset)
287 {
288 int depth = 1;
289
290 /*
291 * With respect to the parent, the depth of the next subnode will be
292 * the same as the last.
293 */
294 do {
295 offset = fdt_next_node(fdt, offset, &depth);
296 if (offset < 0 || depth < 1)
297 return -FDT_ERR_NOTFOUND;
298 } while (depth > 1);
299
300 return offset;
301 }
302
fdt_find_string_(const char * strtab,int tabsize,const char * s)303 const char *fdt_find_string_(const char *strtab, int tabsize, const char *s)
304 {
305 int len = strlen(s) + 1;
306 const char *last = strtab + tabsize - len;
307 const char *p;
308
309 for (p = strtab; p <= last; p++)
310 if (memcmp(p, s, len) == 0)
311 return p;
312 return NULL;
313 }
314
fdt_move(const void * fdt,void * buf,int bufsize)315 int fdt_move(const void *fdt, void *buf, int bufsize)
316 {
317 if (!can_assume(VALID_INPUT) && bufsize < 0)
318 return -FDT_ERR_NOSPACE;
319
320 FDT_RO_PROBE(fdt);
321
322 if (fdt_totalsize(fdt) > (unsigned int)bufsize)
323 return -FDT_ERR_NOSPACE;
324
325 memmove(buf, fdt, fdt_totalsize(fdt));
326 return 0;
327 }
328