[PATCH 0/2] dtc: Resync fdt_check_full function

[PATCH 0/2] dtc: Resync fdt_check_full function

[Tom Rini]

Hey all,

As part of the resync to dtc version v1.7.2-35-g52f07dcca47c from the
Linux Kernel, we missed updating the fdt_check_full function because it
exists in its own file in upstream dtc and the kernel doesn't import it,
as reported by Anton Ivanov. This short series brings in the upstream
fdt_check.c file and then implements our size-saving option, but in the
modern way.

The size-saving portion will be upstreamed and I'll update this series
if needed based on upstream feedback.

-- 
Tom

[PATCH 1/2] dtc: Resync fdt_check_full() with upstream version v1.7.2-35-g52f07dcca47c

[Tom Rini]

In the upstream project, the function fdt_check_full has been moved from
fdt_ro.c to its own file, fdt_check.c. This file is not included in the
Linux kernel copy and so has not been synced over. As we do need and use
the fdt_check_full function, bring that file over as of the current
upstream we are synced to. Remove our copy of this function from
fdt_ro.c and add fdt_check.o and 1-liner fdt_check.c where needed. Note
that for now, this will increase size in some cases as upstream does not
have a size reduction method here.

Signed-off-by: Tom Rini <trini@konsulko.com>
---
 lib/libfdt/Makefile                |  1 +
 lib/libfdt/fdt_check.c             |  2 +
 scripts/dtc/Makefile               |  2 +-
 scripts/dtc/libfdt/Makefile.libfdt |  2 +-
 scripts/dtc/libfdt/fdt_check.c     | 96 ++++++++++++++++++++++++++++++
 scripts/dtc/libfdt/fdt_ro.c        | 88 ---------------------------
 scripts/dtc/update-dtc-source.sh   |  2 +-
 tools/Makefile                     |  3 +-
 tools/libfdt/fdt_check.c           |  2 +
 9 files changed, 106 insertions(+), 92 deletions(-)
 create mode 100644 lib/libfdt/fdt_check.c
 create mode 100644 scripts/dtc/libfdt/fdt_check.c
 create mode 100644 tools/libfdt/fdt_check.c

diff --git a/lib/libfdt/Makefile b/lib/libfdt/Makefile
index c492377032b7..b4113cfb478f 100644
--- a/lib/libfdt/Makefile
+++ b/lib/libfdt/Makefile
@@ -5,6 +5,7 @@
 
 obj-y += \
 	fdt.o \
+	fdt_check.o \
 	fdt_ro.o \
 	fdt_wip.o \
 	fdt_strerror.o \
diff --git a/lib/libfdt/fdt_check.c b/lib/libfdt/fdt_check.c
new file mode 100644
index 000000000000..b7fa4a7c0bbb
--- /dev/null
+++ b/lib/libfdt/fdt_check.c
@@ -0,0 +1,2 @@
+#include <linux/libfdt_env.h>
+#include "../../scripts/dtc/libfdt/fdt_check.c"
diff --git a/scripts/dtc/Makefile b/scripts/dtc/Makefile
index 2ba8dba03be4..6aecae1c6dda 100644
--- a/scripts/dtc/Makefile
+++ b/scripts/dtc/Makefile
@@ -10,7 +10,7 @@ dtc-objs	+= dtc-lexer.lex.o dtc-parser.tab.o
 
 # The upstream project builds libfdt as a separate library.  We are choosing to
 # instead directly link the libfdt object files into fdtoverlay.
-libfdt-objs	:= fdt.o fdt_ro.o fdt_wip.o fdt_sw.o fdt_rw.o fdt_strerror.o fdt_empty_tree.o fdt_addresses.o fdt_overlay.o
+libfdt-objs	:= fdt.o fdt_ro.o fdt_wip.o fdt_sw.o fdt_rw.o fdt_strerror.o fdt_empty_tree.o fdt_addresses.o fdt_overlay.o fdt_check.o
 libfdt		= $(addprefix libfdt/,$(libfdt-objs))
 fdtoverlay-objs	:= $(libfdt) fdtoverlay.o util.o
 
diff --git a/scripts/dtc/libfdt/Makefile.libfdt b/scripts/dtc/libfdt/Makefile.libfdt
index e54639738c8e..b6d8fc02dd0b 100644
--- a/scripts/dtc/libfdt/Makefile.libfdt
+++ b/scripts/dtc/libfdt/Makefile.libfdt
@@ -8,7 +8,7 @@ LIBFDT_soname = libfdt.$(SHAREDLIB_EXT).1
 LIBFDT_INCLUDES = fdt.h libfdt.h libfdt_env.h
 LIBFDT_VERSION = version.lds
 LIBFDT_SRCS = fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c fdt_empty_tree.c \
-	fdt_addresses.c fdt_overlay.c
+	fdt_addresses.c fdt_overlay.c fdt_check.c
 LIBFDT_OBJS = $(LIBFDT_SRCS:%.c=%.o)
 LIBFDT_LIB = libfdt-$(DTC_VERSION).$(SHAREDLIB_EXT)
 
diff --git a/scripts/dtc/libfdt/fdt_check.c b/scripts/dtc/libfdt/fdt_check.c
new file mode 100644
index 000000000000..a21ebbc9239f
--- /dev/null
+++ b/scripts/dtc/libfdt/fdt_check.c
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: (GPL-2.0-or-later OR BSD-2-Clause)
+/*
+ * libfdt - Flat Device Tree manipulation
+ * Copyright (C) 2006 David Gibson, IBM Corporation.
+ */
+#include "libfdt_env.h"
+
+#include <fdt.h>
+#include <libfdt.h>
+
+#include "libfdt_internal.h"
+
+int fdt_check_full(const void *fdt, size_t bufsize)
+{
+	int err;
+	int num_memrsv;
+	int offset, nextoffset = 0;
+	uint32_t tag;
+	unsigned int depth = 0;
+	const void *prop;
+	const char *propname;
+	bool expect_end = false;
+
+	if (bufsize < FDT_V1_SIZE)
+		return -FDT_ERR_TRUNCATED;
+	if (bufsize < fdt_header_size(fdt))
+		return -FDT_ERR_TRUNCATED;
+	err = fdt_check_header(fdt);
+	if (err != 0)
+		return err;
+	if (bufsize < fdt_totalsize(fdt))
+		return -FDT_ERR_TRUNCATED;
+
+	num_memrsv = fdt_num_mem_rsv(fdt);
+	if (num_memrsv < 0)
+		return num_memrsv;
+
+	while (1) {
+		offset = nextoffset;
+		tag = fdt_next_tag(fdt, offset, &nextoffset);
+
+		if (nextoffset < 0)
+			return nextoffset;
+
+		/* If we see two root nodes, something is wrong */
+		if (expect_end && tag != FDT_END)
+			return -FDT_ERR_BADSTRUCTURE;
+
+		switch (tag) {
+		case FDT_NOP:
+			break;
+
+		case FDT_END:
+			if (depth != 0)
+				return -FDT_ERR_BADSTRUCTURE;
+			return 0;
+
+		case FDT_BEGIN_NODE:
+			depth++;
+			if (depth > INT_MAX)
+				return -FDT_ERR_BADSTRUCTURE;
+
+			/* The root node must have an empty name */
+			if (depth == 1) {
+				const char *name;
+				int len;
+
+				name = fdt_get_name(fdt, offset, &len);
+				if (!name)
+					return len;
+
+				if (*name || len)
+					return -FDT_ERR_BADSTRUCTURE;
+			}
+			break;
+
+		case FDT_END_NODE:
+			if (depth == 0)
+				return -FDT_ERR_BADSTRUCTURE;
+			depth--;
+			if (depth == 0)
+				expect_end = true;
+			break;
+
+		case FDT_PROP:
+			prop = fdt_getprop_by_offset(fdt, offset, &propname,
+						     &err);
+			if (!prop)
+				return err;
+			break;
+
+		default:
+			return -FDT_ERR_INTERNAL;
+		}
+	}
+}
diff --git a/scripts/dtc/libfdt/fdt_ro.c b/scripts/dtc/libfdt/fdt_ro.c
index 3e7e26b4398e..065baa707355 100644
--- a/scripts/dtc/libfdt/fdt_ro.c
+++ b/scripts/dtc/libfdt/fdt_ro.c
@@ -884,91 +884,3 @@ int fdt_node_offset_by_compatible(const void *fdt, int startoffset,
 
 	return offset; /* error from fdt_next_node() */
 }
-
-#if !defined(FDT_ASSUME_MASK) || FDT_ASSUME_MASK != 0xff
-int fdt_check_full(const void *fdt, size_t bufsize)
-{
-	int err;
-	int num_memrsv;
-	int offset, nextoffset = 0;
-	uint32_t tag;
-	unsigned depth = 0;
-	const void *prop;
-	const char *propname;
-	bool expect_end = false;
-
-	if (bufsize < FDT_V1_SIZE)
-		return -FDT_ERR_TRUNCATED;
-	err = fdt_check_header(fdt);
-	if (err != 0)
-		return err;
-	if (bufsize < fdt_totalsize(fdt))
-		return -FDT_ERR_TRUNCATED;
-
-	num_memrsv = fdt_num_mem_rsv(fdt);
-	if (num_memrsv < 0)
-		return num_memrsv;
-
-	while (1) {
-		offset = nextoffset;
-		tag = fdt_next_tag(fdt, offset, &nextoffset);
-
-		if (nextoffset < 0)
-			return nextoffset;
-
-		/* If we see two root nodes, something is wrong */
-		if (expect_end && tag != FDT_END)
-			return -FDT_ERR_BADLAYOUT;
-
-		switch (tag) {
-		case FDT_NOP:
-			break;
-
-		case FDT_END:
-			if (depth != 0)
-				return -FDT_ERR_BADSTRUCTURE;
-			return 0;
-
-		case FDT_BEGIN_NODE:
-			depth++;
-			if (depth > INT_MAX)
-				return -FDT_ERR_BADSTRUCTURE;
-
-			/* The root node must have an empty name */
-			if (depth == 1) {
-				const char *name;
-				int len;
-
-				name = fdt_get_name(fdt, offset, &len);
-				if (*name || len)
-					return -FDT_ERR_BADLAYOUT;
-			}
-			break;
-
-		case FDT_END_NODE:
-			if (depth == 0)
-				return -FDT_ERR_BADSTRUCTURE;
-			depth--;
-			if (depth == 0)
-				expect_end = true;
-			break;
-
-		case FDT_PROP:
-			prop = fdt_getprop_by_offset(fdt, offset, &propname,
-						     &err);
-			if (!prop)
-				return err;
-			break;
-
-		default:
-			return -FDT_ERR_INTERNAL;
-		}
-	}
-}
-#else
-int fdt_check_full(const void __always_unused *fdt,
-		   size_t __always_unused bufsize)
-{
-	return 0;
-}
-#endif /* #if !defined(FDT_ASSUME_MASK) || FDT_ASSUME_MASK != 0xff */
diff --git a/scripts/dtc/update-dtc-source.sh b/scripts/dtc/update-dtc-source.sh
index 94627541533e..2b62da683681 100755
--- a/scripts/dtc/update-dtc-source.sh
+++ b/scripts/dtc/update-dtc-source.sh
@@ -34,7 +34,7 @@ DTC_LINUX_PATH=`pwd`/scripts/dtc
 DTC_SOURCE="checks.c data.c dtc.c dtc.h flattree.c fstree.c livetree.c srcpos.c \
 		srcpos.h treesource.c util.c util.h version_gen.h \
 		dtc-lexer.l dtc-parser.y"
-LIBFDT_SOURCE="fdt.c fdt.h fdt_addresses.c fdt_empty_tree.c \
+LIBFDT_SOURCE="fdt.c fdt.h fdt_addresses.c fdt_empty_tree.c fdt_check.c \
 		fdt_overlay.c fdt_ro.c fdt_rw.c fdt_strerror.c fdt_sw.c \
 		fdt_wip.c libfdt.h libfdt_env.h libfdt_internal.h"
 FDTOVERLAY_SOURCE=fdtoverlay.c
diff --git a/tools/Makefile b/tools/Makefile
index 1a5f425ecdaa..535a5d51c89e 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -82,7 +82,8 @@ HOSTCFLAGS_image-host.o += \
 # The following files are synced with upstream DTC.
 # Use synced versions from scripts/dtc/libfdt/.
 LIBFDT_OBJS := $(addprefix libfdt/, fdt.o fdt_ro.o fdt_wip.o fdt_sw.o fdt_rw.o \
-		fdt_strerror.o fdt_empty_tree.o fdt_addresses.o fdt_overlay.o)
+		fdt_strerror.o fdt_empty_tree.o fdt_addresses.o fdt_overlay.o \
+		fdt_check.o)
 
 RSA_OBJS-$(CONFIG_TOOLS_LIBCRYPTO) := $(addprefix generated/lib/rsa/, \
 					rsa-sign.o rsa-verify.o \
diff --git a/tools/libfdt/fdt_check.c b/tools/libfdt/fdt_check.c
new file mode 100644
index 000000000000..a17a0194f5c5
--- /dev/null
+++ b/tools/libfdt/fdt_check.c
@@ -0,0 +1,2 @@
+#include "fdt_host.h"
+#include "../scripts/dtc/libfdt/fdt_check.c"
-- 
2.43.0

[PATCH 2/2] dtc: libfdt: Introduce a can_assume check in fdt_check_full

[Tom Rini]

The current upstream method of having a function omit various tests is
to use the can_assume macro. Take the logic we had previously been using
and instead make it a can_assume(PERFECT) check within fdt_check_full
itself.

Signed-off-by: Tom Rini <trini@konsulko.com>
---
I will be submitting this change upstream and will follow up if needed
here.
---
 scripts/dtc/libfdt/fdt_check.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/dtc/libfdt/fdt_check.c b/scripts/dtc/libfdt/fdt_check.c
index a21ebbc9239f..7509c11d8580 100644
--- a/scripts/dtc/libfdt/fdt_check.c
+++ b/scripts/dtc/libfdt/fdt_check.c
@@ -21,6 +21,8 @@ int fdt_check_full(const void *fdt, size_t bufsize)
 	const char *propname;
 	bool expect_end = false;
 
+	if (can_assume(PERFECT))
+		return 0;
 	if (bufsize < FDT_V1_SIZE)
 		return -FDT_ERR_TRUNCATED;
 	if (bufsize < fdt_header_size(fdt))
-- 
2.43.0

Re: [PATCH 1/2] dtc: Resync fdt_check_full() with upstream version v1.7.2-35-g52f07dcca47c

[Simon Glass]

On 2026-05-26T20:19:26, Tom Rini <trini@konsulko.com> wrote:
> dtc: Resync fdt_check_full() with upstream version v1.7.2-35-g52f07dcca47c
>
> In the upstream project, the function fdt_check_full has been moved from
> fdt_ro.c to its own file, fdt_check.c. This file is not included in the
> Linux kernel copy and so has not been synced over. As we do need and use
> the fdt_check_full function, bring that file over as of the current
> upstream we are synced to. Remove our copy of this function from
> fdt_ro.c and add fdt_check.o and 1-liner fdt_check.c where needed. Note
> that for now, this will increase size in some cases as upstream does not
> have a size reduction method here.
>
> Signed-off-by: Tom Rini <trini@konsulko.com>
>
> lib/libfdt/Makefile                |  1 +
>  lib/libfdt/fdt_check.c             |  2 +
>  scripts/dtc/Makefile               |  2 +-
>  scripts/dtc/libfdt/Makefile.libfdt |  2 +-
>  scripts/dtc/libfdt/fdt_check.c     | 96 ++++++++++++++++++++++++++++++++++++++
>  scripts/dtc/libfdt/fdt_ro.c        | 88 ----------------------------------
>  scripts/dtc/update-dtc-source.sh   |  2 +-
>  tools/Makefile                     |  3 +-
>  tools/libfdt/fdt_check.c           |  2 +
>  9 files changed, 106 insertions(+), 92 deletions(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

Re: [PATCH 2/2] dtc: libfdt: Introduce a can_assume check in fdt_check_full

[Simon Glass]

Hi Tom,

On 2026-05-26T20:19:26, Tom Rini <trini@konsulko.com> wrote:
> dtc: libfdt: Introduce a can_assume check in fdt_check_full
>
> The current upstream method of having a function omit various tests is
> to use the can_assume macro. Take the logic we had previously been using
> and instead make it a can_assume(PERFECT) check within fdt_check_full
> itself.
>
> Signed-off-by: Tom Rini <trini@konsulko.com>
>
> scripts/dtc/libfdt/fdt_check.c | 2 ++
>  1 file changed, 2 insertions(+)

> diff --git a/scripts/dtc/libfdt/fdt_check.c b/scripts/dtc/libfdt/fdt_check.c
> @@ -21,6 +21,8 @@ int fdt_check_full(const void *fdt, size_t bufsize)
>       const char *propname;
>       bool expect_end = false;
>
> +     if (can_assume(PERFECT))
> +             return 0;

Just to note that this of course affects image-fit.c too, so FITs are
no-longer validated if used in SPL. People can change the mask though.

I suggest stronger wording in the commit message since  'Take the
logic we had previously been using' reads as a no-op refactor to me.
I'm assuming that the motivation here is code size so you could
mention too.

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

Re: [PATCH 2/2] dtc: libfdt: Introduce a can_assume check in fdt_check_full

[Rasmus Villemoes]

On Tue, May 26 2026, Tom Rini <trini@konsulko.com> wrote:

> The current upstream method of having a function omit various tests is
> to use the can_assume macro. Take the logic we had previously been using
> and instead make it a can_assume(PERFECT) check within fdt_check_full
> itself.
>
> Signed-off-by: Tom Rini <trini@konsulko.com>
> ---
> I will be submitting this change upstream and will follow up if needed
> here.
> ---
>  scripts/dtc/libfdt/fdt_check.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/scripts/dtc/libfdt/fdt_check.c b/scripts/dtc/libfdt/fdt_check.c
> index a21ebbc9239f..7509c11d8580 100644
> --- a/scripts/dtc/libfdt/fdt_check.c
> +++ b/scripts/dtc/libfdt/fdt_check.c
> @@ -21,6 +21,8 @@ int fdt_check_full(const void *fdt, size_t bufsize)
>  	const char *propname;
>  	bool expect_end = false;
>  
> +	if (can_assume(PERFECT))
> +		return 0;

Is this right? I think that would require changing can_assume() to test
if the given mask is a subset of FDT_ASSUME_MASK, not merely intersects
it. When called with a single-bit mask, those are of course the same
thing.

Because as-is, can_assume(PERFECT) is true if FDT_ASSUME_MASK has any
non-zero value, but I don't think FDT_ASSUME_MASK=ASSUME_LATEST, for
example, should imply "perfect".

Rasmus

Re: [PATCH 2/2] dtc: libfdt: Introduce a can_assume check in fdt_check_full

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1130 bytes --]

On Tue, May 26, 2026 at 11:41:26PM -0500, Simon Glass wrote:
> Hi Tom,
> 
> On 2026-05-26T20:19:26, Tom Rini <trini@konsulko.com> wrote:
> > dtc: libfdt: Introduce a can_assume check in fdt_check_full
> >
> > The current upstream method of having a function omit various tests is
> > to use the can_assume macro. Take the logic we had previously been using
> > and instead make it a can_assume(PERFECT) check within fdt_check_full
> > itself.
> >
> > Signed-off-by: Tom Rini <trini@konsulko.com>
> >
> > scripts/dtc/libfdt/fdt_check.c | 2 ++
> >  1 file changed, 2 insertions(+)
> 
> > diff --git a/scripts/dtc/libfdt/fdt_check.c b/scripts/dtc/libfdt/fdt_check.c
> > @@ -21,6 +21,8 @@ int fdt_check_full(const void *fdt, size_t bufsize)
> >       const char *propname;
> >       bool expect_end = false;
> >
> > +     if (can_assume(PERFECT))
> > +             return 0;
> 
> Just to note that this of course affects image-fit.c too, so FITs are
> no-longer validated if used in SPL. People can change the mask though.

There's no functional change to what we have today, actually, really.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 2/2] dtc: libfdt: Introduce a can_assume check in fdt_check_full

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1734 bytes --]

On Wed, May 27, 2026 at 11:49:28AM +0200, Rasmus Villemoes wrote:
> On Tue, May 26 2026, Tom Rini <trini@konsulko.com> wrote:
> 
> > The current upstream method of having a function omit various tests is
> > to use the can_assume macro. Take the logic we had previously been using
> > and instead make it a can_assume(PERFECT) check within fdt_check_full
> > itself.
> >
> > Signed-off-by: Tom Rini <trini@konsulko.com>
> > ---
> > I will be submitting this change upstream and will follow up if needed
> > here.
> > ---
> >  scripts/dtc/libfdt/fdt_check.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/scripts/dtc/libfdt/fdt_check.c b/scripts/dtc/libfdt/fdt_check.c
> > index a21ebbc9239f..7509c11d8580 100644
> > --- a/scripts/dtc/libfdt/fdt_check.c
> > +++ b/scripts/dtc/libfdt/fdt_check.c
> > @@ -21,6 +21,8 @@ int fdt_check_full(const void *fdt, size_t bufsize)
> >  	const char *propname;
> >  	bool expect_end = false;
> >  
> > +	if (can_assume(PERFECT))
> > +		return 0;
> 
> Is this right? I think that would require changing can_assume() to test
> if the given mask is a subset of FDT_ASSUME_MASK, not merely intersects
> it. When called with a single-bit mask, those are of course the same
> thing.
> 
> Because as-is, can_assume(PERFECT) is true if FDT_ASSUME_MASK has any
> non-zero value, but I don't think FDT_ASSUME_MASK=ASSUME_LATEST, for
> example, should imply "perfect".

Honestly (and I mentioned this to David in his reply on the
devicetree-compiler list) the usage of the mask today is either 0xff or
0x0 and nothing in between. Which means yes, I wonder a little about the
can_assume macro as opposed to how the mask was used originally.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]