// SPDX-License-Identifier: (GPL-2.0-or-later OR BSD-2-Clause)
/*
 * libfdt - Flat Device Tree manipulation
 * Copyright (C) 2016 Free Electrons
 * Copyright (C) 2016 NextThing Co.
 */
#include "libfdt_env.h"

#include <fdt.h>
#include <libfdt.h>

#include "libfdt_internal.h"

/**
 * overlay_get_target_phandle - retrieves the target phandle of a fragment
 * @fdto: pointer to the device tree overlay blob
 * @fragment: node offset of the fragment in the overlay
 *
 * overlay_get_target_phandle() retrieves the target phandle of an
 * overlay fragment when that fragment uses a phandle (target
 * property) instead of a path (target-path property).
 *
 * returns:
 *      the phandle pointed by the target property
 *      0, if the phandle was not found
 *      -1, if the phandle was malformed
 */
static uint32_t overlay_get_target_phandle(const void *fdto, int fragment)
{
        const fdt32_t *val;
        int len;

        val = fdt_getprop(fdto, fragment, "target", &len);
        if (!val)
                return 0;

        if ((len != sizeof(*val)) || (fdt32_to_cpu(*val) == (uint32_t)-1))
                return (uint32_t)-1;

        return fdt32_to_cpu(*val);
}

int fdt_overlay_target_offset(const void *fdt, const void *fdto,
                              int fragment_offset, char const **pathp)
{
        uint32_t phandle;
        const char *path = NULL;
        int path_len = 0, ret;

        /* Try first to do a phandle based lookup */
        phandle = overlay_get_target_phandle(fdto, fragment_offset);
        if (phandle == (uint32_t)-1)
                return -FDT_ERR_BADPHANDLE;

        /* no phandle, try path */
        if (!phandle) {
                /* And then a path based lookup */
                path = fdt_getprop(fdto, fragment_offset, "target-path", &path_len);
                if (path)
                        ret = fdt_path_offset(fdt, path);
                else
                        ret = path_len;
        } else
                ret = fdt_node_offset_by_phandle(fdt, phandle);

        /*
        * If we haven't found either a target or a
        * target-path property in a node that contains a
        * __overlay__ subnode (we wouldn't be called
        * otherwise), consider it a improperly written
        * overlay
        */
        if (ret < 0 && path_len == -FDT_ERR_NOTFOUND)
                ret = -FDT_ERR_BADOVERLAY;

        /* return on error */
        if (ret < 0)
                return ret;

        /* return pointer to path (if available) */
        if (pathp)
                *pathp = path ? path : NULL;

        return ret;
}

/**
 * overlay_phandle_add_offset - Increases a phandle by an offset
 * @fdt: Base device tree blob
 * @node: Device tree overlay blob
 * @name: Name of the property to modify (phandle or linux,phandle)
 * @delta: offset to apply
 *
 * overlay_phandle_add_offset() increments a node phandle by a given
 * offset.
 *
 * returns:
 *      0 on success.
 *      Negative error code on error
 */
static int overlay_phandle_add_offset(void *fdt, int node,
                                      const char *name, uint32_t delta)
{
        fdt32_t *valp, val;
        int len;

        valp = fdt_getprop_w(fdt, node, name, &len);
        if (!valp)
                return len;

        if (len != sizeof(val))
                return -FDT_ERR_BADPHANDLE;

        val = fdt32_ld(valp);
        if (val + delta < val || val + delta == (uint32_t)-1)
                return -FDT_ERR_NOPHANDLES;

        fdt32_st(valp, val + delta);
        return 0;
}

/**
 * overlay_adjust_node_phandles - Offsets the phandles of a node
 * @fdto: Device tree overlay blob
 * @node: Offset of the node we want to adjust
 * @delta: Offset to shift the phandles of
 *
 * overlay_adjust_node_phandles() adds a constant to all the phandles
 * of a given node. This is mainly use as part of the overlay
 * application process, when we want to update all the overlay
 * phandles to not conflict with the overlays of the base device tree.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_adjust_node_phandles(void *fdto, int node,
                                        uint32_t delta)
{
        int child;
        int ret;

        ret = overlay_phandle_add_offset(fdto, node, "phandle", delta);
        if (ret && ret != -FDT_ERR_NOTFOUND)
                return ret;

        ret = overlay_phandle_add_offset(fdto, node, "linux,phandle", delta);
        if (ret && ret != -FDT_ERR_NOTFOUND)
                return ret;

        fdt_for_each_subnode(child, fdto, node) {
                ret = overlay_adjust_node_phandles(fdto, child, delta);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_adjust_local_phandles - Adjust the phandles of a whole overlay
 * @fdto: Device tree overlay blob
 * @delta: Offset to shift the phandles of
 *
 * overlay_adjust_local_phandles() adds a constant to all the
 * phandles of an overlay. This is mainly use as part of the overlay
 * application process, when we want to update all the overlay
 * phandles to not conflict with the overlays of the base device tree.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_adjust_local_phandles(void *fdto, uint32_t delta)
{
        /*
         * Start adjusting the phandles from the overlay root
         */
        return overlay_adjust_node_phandles(fdto, 0, delta);
}

/**
 * overlay_update_local_node_references - Adjust the overlay references
 * @fdto: Device tree overlay blob
 * @tree_node: Node offset of the node to operate on
 * @fixup_node: Node offset of the matching local fixups node
 * @delta: Offset to shift the phandles of
 *
 * overlay_update_local_nodes_references() update the phandles
 * pointing to a node within the device tree overlay by adding a
 * constant delta.
 *
 * This is mainly used as part of a device tree application process,
 * where you want the device tree overlays phandles to not conflict
 * with the ones from the base device tree before merging them.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_update_local_node_references(void *fdto,
                                                int tree_node,
                                                int fixup_node,
                                                uint32_t delta)
{
        int fixup_prop;
        int fixup_child;
        int ret;

        fdt_for_each_property_offset(fixup_prop, fdto, fixup_node) {
                const fdt32_t *fixup_val;
                const char *name;
                char *tree_val;
                int fixup_len;
                int tree_len;
                int i;

                fixup_val = fdt_getprop_by_offset(fdto, fixup_prop,
                                                  &name, &fixup_len);
                if (!fixup_val)
                        return fixup_len;

                if (fixup_len % sizeof(uint32_t))
                        return -FDT_ERR_BADOVERLAY;
                fixup_len /= sizeof(uint32_t);

                tree_val = fdt_getprop_w(fdto, tree_node, name, &tree_len);
                if (!tree_val) {
                        if (tree_len == -FDT_ERR_NOTFOUND)
                                return -FDT_ERR_BADOVERLAY;

                        return tree_len;
                }

                for (i = 0; i < fixup_len; i++) {
                        fdt32_t *refp;

                        refp = (fdt32_t *)(tree_val + fdt32_ld_(fixup_val + i));

                        /*
                         * phandles to fixup can be unaligned, so use
                         * fdt32_{ld,st}() to read/write them.
                         */
                        fdt32_st(refp, fdt32_ld(refp) + delta);
                }
        }

        fdt_for_each_subnode(fixup_child, fdto, fixup_node) {
                const char *fixup_child_name = fdt_get_name(fdto, fixup_child,
                                                            NULL);
                int tree_child;

                tree_child = fdt_subnode_offset(fdto, tree_node,
                                                fixup_child_name);
                if (tree_child == -FDT_ERR_NOTFOUND)
                        return -FDT_ERR_BADOVERLAY;
                if (tree_child < 0)
                        return tree_child;

                ret = overlay_update_local_node_references(fdto,
                                                           tree_child,
                                                           fixup_child,
                                                           delta);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_update_local_references - Adjust the overlay references
 * @fdto: Device tree overlay blob
 * @delta: Offset to shift the phandles of
 *
 * overlay_update_local_references() update all the phandles pointing
 * to a node within the device tree overlay by adding a constant
 * delta to not conflict with the base overlay.
 *
 * This is mainly used as part of a device tree application process,
 * where you want the device tree overlays phandles to not conflict
 * with the ones from the base device tree before merging them.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_update_local_references(void *fdto, uint32_t delta)
{
        int fixups;

        fixups = fdt_path_offset(fdto, "/__local_fixups__");
        if (fixups < 0) {
                /* There's no local phandles to adjust, bail out */
                if (fixups == -FDT_ERR_NOTFOUND)
                        return 0;

                return fixups;
        }

        /*
         * Update our local references from the root of the tree
         */
        return overlay_update_local_node_references(fdto, 0, fixups,
                                                    delta);
}

/**
 * overlay_fixup_one_phandle - Set an overlay phandle to the base one
 * @fdto: Device tree overlay blob
 * @symbols_off: Node offset of the symbols node in the base device tree
 * @path: Path to a node holding a phandle in the overlay
 * @path_len: number of path characters to consider
 * @name: Name of the property holding the phandle reference in the overlay
 * @name_len: number of name characters to consider
 * @poffset: Offset within the overlay property where the phandle is stored
 * @phandle: Phandle referencing the node
 *
 * overlay_fixup_one_phandle() resolves an overlay phandle pointing to
 * a node in the base device tree.
 *
 * This is part of the device tree overlay application process, when
 * you want all the phandles in the overlay to point to the actual
 * base dt nodes.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_fixup_one_phandle(void *fdto, int symbols_off,
                                     const char *path, uint32_t path_len,
                                     const char *name, uint32_t name_len,
                                     int poffset, uint32_t phandle)
{
        fdt32_t phandle_prop;
        int fixup_off;

        if (symbols_off < 0)
                return symbols_off;

        fixup_off = fdt_path_offset_namelen(fdto, path, path_len);
        if (fixup_off == -FDT_ERR_NOTFOUND)
                return -FDT_ERR_BADOVERLAY;
        if (fixup_off < 0)
                return fixup_off;

        phandle_prop = cpu_to_fdt32(phandle);
        return fdt_setprop_inplace_namelen_partial(fdto, fixup_off,
                                                   name, name_len, poffset,
                                                   &phandle_prop,
                                                   sizeof(phandle_prop));
}

/**
 * overlay_fixup_phandle - Set an overlay phandle to the base one
 * @fdt: Base Device Tree blob
 * @fdto: Device tree overlay blob
 * @symbols_off: Node offset of the symbols node in the base device tree
 * @property: Property offset in the overlay holding the list of fixups
 *
 * overlay_fixup_phandle() resolves all the overlay phandles pointed
 * to in a __fixups__ property, and updates them to match the phandles
 * in use in the base device tree.
 *
 * This is part of the device tree overlay application process, when
 * you want all the phandles in the overlay to point to the actual
 * base dt nodes.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_fixup_phandle(void *fdt, void *fdto, int symbols_off,
                                 int property)
{
        const char *value;
        const char *label;
        int len;
        const char *symbol_path;
        int prop_len;
        int symbol_off;
        uint32_t phandle;

        value = fdt_getprop_by_offset(fdto, property,
                                      &label, &len);
        if (!value) {
                if (len == -FDT_ERR_NOTFOUND)
                        return -FDT_ERR_INTERNAL;

                return len;
        }

        symbol_path = fdt_getprop(fdt, symbols_off, label, &prop_len);
        if (!symbol_path)
                return prop_len;
        
        symbol_off = fdt_path_offset(fdt, symbol_path);
        if (symbol_off < 0)
                return symbol_off;
        
        phandle = fdt_get_phandle(fdt, symbol_off);
        if (!phandle)
                return -FDT_ERR_NOTFOUND;

        do {
                const char *path, *name, *fixup_end;
                const char *fixup_str = value;
                uint32_t path_len, name_len;
                uint32_t fixup_len;
                const char *sep;
                char *endptr;
                int poffset, ret;

                fixup_end = memchr(value, '\0', len);
                if (!fixup_end)
                        return -FDT_ERR_BADOVERLAY;
                fixup_len = fixup_end - fixup_str;

                len -= fixup_len + 1;
                value += fixup_len + 1;

                path = fixup_str;
                sep = memchr(fixup_str, ':', fixup_len);
                if (!sep || *sep != ':')
                        return -FDT_ERR_BADOVERLAY;

                path_len = sep - path;
                if (path_len == (fixup_len - 1))
                        return -FDT_ERR_BADOVERLAY;

                fixup_len -= path_len + 1;
                name = sep + 1;
                sep = memchr(name, ':', fixup_len);
                if (!sep || *sep != ':')
                        return -FDT_ERR_BADOVERLAY;

                name_len = sep - name;
                if (!name_len)
                        return -FDT_ERR_BADOVERLAY;

                poffset = strtoul(sep + 1, &endptr, 10);
                if ((*endptr != '\0') || (endptr <= (sep + 1)))
                        return -FDT_ERR_BADOVERLAY;

                ret = overlay_fixup_one_phandle(fdto, symbols_off,
                                                path, path_len, name, name_len,
                                                poffset, phandle);
                if (ret)
                        return ret;
        } while (len > 0);

        return 0;
}

/**
 * overlay_fixup_phandles - Resolve the overlay phandles to the base
 *                          device tree
 * @fdt: Base Device Tree blob
 * @fdto: Device tree overlay blob
 *
 * overlay_fixup_phandles() resolves all the overlay phandles pointing
 * to nodes in the base device tree.
 *
 * This is one of the steps of the device tree overlay application
 * process, when you want all the phandles in the overlay to point to
 * the actual base dt nodes.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_fixup_phandles(void *fdt, void *fdto)
{
        int fixups_off, symbols_off;
        int property;

        /* We can have overlays without any fixups */
        fixups_off = fdt_path_offset(fdto, "/__fixups__");
        if (fixups_off == -FDT_ERR_NOTFOUND)
                return 0; /* nothing to do */
        if (fixups_off < 0)
                return fixups_off;

        /* And base DTs without symbols */
        symbols_off = fdt_path_offset(fdt, "/__symbols__");
        if ((symbols_off < 0 && (symbols_off != -FDT_ERR_NOTFOUND)))
                return symbols_off;

        fdt_for_each_property_offset(property, fdto, fixups_off) {
                int ret;

                ret = overlay_fixup_phandle(fdt, fdto, symbols_off, property);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_adjust_local_conflicting_phandle: Changes a phandle value
 * @fdto: Device tree overlay
 * @node: The node the phandle is set for
 * @fdt_phandle: The new value for the phandle
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_adjust_local_conflicting_phandle(void *fdto, int node,
                                                    uint32_t fdt_phandle)
{
        const fdt32_t *php;
        int len, ret;

        php = fdt_getprop(fdto, node, "phandle", &len);
        if (php && len == sizeof(*php)) {
                ret = fdt_setprop_inplace_u32(fdto, node, "phandle", fdt_phandle);
                if (ret)
                        return ret;
        }

        php = fdt_getprop(fdto, node, "linux,phandle", &len);
        if (php && len == sizeof(*php)) {
                ret = fdt_setprop_inplace_u32(fdto, node, "linux,phandle", fdt_phandle);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_update_node_conflicting_references - Recursively replace phandle values
 * @fdto: Device tree overlay blob
 * @tree_node: Node to recurse into
 * @fixup_node: Node offset of the matching local fixups node
 * @fdt_phandle: Value to replace phandles with
 * @fdto_phandle: Value to be replaced
 *
 * Replaces all phandles with value @fdto_phandle by @fdt_phandle.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_update_node_conflicting_references(void *fdto, int tree_node,
                                                      int fixup_node,
                                                      uint32_t fdt_phandle,
                                                      uint32_t fdto_phandle)
{
        int fixup_prop;
        int fixup_child;
        int ret;

        fdt_for_each_property_offset(fixup_prop, fdto, fixup_node) {
                const fdt32_t *fixup_val;
                const char *name;
                char *tree_val;
                int fixup_len;
                int tree_len;
                int i;

                fixup_val = fdt_getprop_by_offset(fdto, fixup_prop,
                                                  &name, &fixup_len);
                if (!fixup_val)
                        return fixup_len;

                if (fixup_len % sizeof(uint32_t))
                        return -FDT_ERR_BADOVERLAY;
                fixup_len /= sizeof(uint32_t);

                tree_val = fdt_getprop_w(fdto, tree_node, name, &tree_len);
                if (!tree_val) {
                        if (tree_len == -FDT_ERR_NOTFOUND)
                                return -FDT_ERR_BADOVERLAY;

                        return tree_len;
                }

                for (i = 0; i < fixup_len; i++) {
                        fdt32_t *refp;
                        uint32_t valp;

                        refp = (fdt32_t *)(tree_val + fdt32_ld_(fixup_val + i));
                        valp = fdt32_ld(refp);

                        if (valp == fdto_phandle)
                                fdt32_st(refp, fdt_phandle);
                }
        }

        fdt_for_each_subnode(fixup_child, fdto, fixup_node) {
                const char *fixup_child_name = fdt_get_name(fdto, fixup_child, NULL);
                int tree_child;

                tree_child = fdt_subnode_offset(fdto, tree_node, fixup_child_name);

                if (tree_child == -FDT_ERR_NOTFOUND)
                        return -FDT_ERR_BADOVERLAY;
                if (tree_child < 0)
                        return tree_child;

                ret = overlay_update_node_conflicting_references(fdto, tree_child,
                                                                 fixup_child,
                                                                 fdt_phandle,
                                                                 fdto_phandle);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_update_local_conflicting_references - Recursively replace phandle values
 * @fdto: Device tree overlay blob
 * @fdt_phandle: Value to replace phandles with
 * @fdto_phandle: Value to be replaced
 *
 * Replaces all phandles with value @fdto_phandle by @fdt_phandle.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_update_local_conflicting_references(void *fdto,
                                                       uint32_t fdt_phandle,
                                                       uint32_t fdto_phandle)
{
        int fixups;

        fixups = fdt_path_offset(fdto, "/__local_fixups__");
        if (fixups == -FDT_ERR_NOTFOUND)
                return 0;
        if (fixups < 0)
                return fixups;

        return overlay_update_node_conflicting_references(fdto, 0, fixups,
                                                          fdt_phandle,
                                                          fdto_phandle);
}

/**
 * overlay_prevent_phandle_overwrite_node - Helper function for overlay_prevent_phandle_overwrite
 * @fdt: Base Device tree blob
 * @fdtnode: Node in fdt that is checked for an overwrite
 * @fdto: Device tree overlay blob
 * @fdtonode: Node in fdto matching @fdtnode
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_prevent_phandle_overwrite_node(void *fdt, int fdtnode,
                                                  void *fdto, int fdtonode)
{
        uint32_t fdt_phandle, fdto_phandle;
        int fdtochild;

        fdt_phandle = fdt_get_phandle(fdt, fdtnode);
        fdto_phandle = fdt_get_phandle(fdto, fdtonode);

        if (fdt_phandle && fdto_phandle) {
                int ret;

                ret = overlay_adjust_local_conflicting_phandle(fdto, fdtonode,
                                                               fdt_phandle);
                if (ret)
                        return ret;

                ret = overlay_update_local_conflicting_references(fdto,
                                                                  fdt_phandle,
                                                                  fdto_phandle);
                if (ret)
                        return ret;
        }

        fdt_for_each_subnode(fdtochild, fdto, fdtonode) {
                const char *name = fdt_get_name(fdto, fdtochild, NULL);
                int fdtchild;
                int ret;

                fdtchild = fdt_subnode_offset(fdt, fdtnode, name);
                if (fdtchild == -FDT_ERR_NOTFOUND)
                        /*
                         * no further overwrites possible here as this node is
                         * new
                         */
                        continue;

                ret = overlay_prevent_phandle_overwrite_node(fdt, fdtchild,
                                                             fdto, fdtochild);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_prevent_phandle_overwrite - Fixes overlay phandles to not overwrite base phandles
 * @fdt: Base Device Tree blob
 * @fdto: Device tree overlay blob
 *
 * Checks recursively if applying fdto overwrites phandle values in the base
 * dtb. When such a phandle is found, the fdto is changed to use the fdt's
 * phandle value to not break references in the base.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_prevent_phandle_overwrite(void *fdt, void *fdto)
{
        int fragment;

        fdt_for_each_subnode(fragment, fdto, 0) {
                int overlay;
                int target;
                int ret;

                overlay = fdt_subnode_offset(fdto, fragment, "__overlay__");
                if (overlay == -FDT_ERR_NOTFOUND)
                        continue;

                if (overlay < 0)
                        return overlay;

                target = fdt_overlay_target_offset(fdt, fdto, fragment, NULL);
                if (target == -FDT_ERR_NOTFOUND)
                        /*
                         * The subtree doesn't exist in the base, so nothing
                         * will be overwritten.
                         */
                        continue;
                else if (target < 0)
                        return target;

                ret = overlay_prevent_phandle_overwrite_node(fdt, target,
                                                             fdto, overlay);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_apply_node - Merges a node into the base device tree
 * @fdt: Base Device Tree blob
 * @target: Node offset in the base device tree to apply the fragment to
 * @fdto: Device tree overlay blob
 * @node: Node offset in the overlay holding the changes to merge
 *
 * overlay_apply_node() merges a node into a target base device tree
 * node pointed.
 *
 * This is part of the final step in the device tree overlay
 * application process, when all the phandles have been adjusted and
 * resolved and you just have to merge overlay into the base device
 * tree.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_apply_node(void *fdt, int target,
                              void *fdto, int node)
{
        int property;
        int subnode;

        fdt_for_each_property_offset(property, fdto, node) {
                const char *name;
                const void *prop;
                int prop_len;
                int ret;

                prop = fdt_getprop_by_offset(fdto, property, &name,
                                             &prop_len);
                if (prop_len == -FDT_ERR_NOTFOUND)
                        return -FDT_ERR_INTERNAL;
                if (prop_len < 0)
                        return prop_len;

                ret = fdt_setprop(fdt, target, name, prop, prop_len);
                if (ret)
                        return ret;
        }

        fdt_for_each_subnode(subnode, fdto, node) {
                const char *name = fdt_get_name(fdto, subnode, NULL);
                int nnode;
                int ret;

                nnode = fdt_add_subnode(fdt, target, name);
                if (nnode == -FDT_ERR_EXISTS) {
                        nnode = fdt_subnode_offset(fdt, target, name);
                        if (nnode == -FDT_ERR_NOTFOUND)
                                return -FDT_ERR_INTERNAL;
                }

                if (nnode < 0)
                        return nnode;

                ret = overlay_apply_node(fdt, nnode, fdto, subnode);
                if (ret)
                        return ret;
        }

        return 0;
}

/**
 * overlay_merge - Merge an overlay into its base device tree
 * @fdt: Base Device Tree blob
 * @fdto: Device tree overlay blob
 *
 * overlay_merge() merges an overlay into its base device tree.
 *
 * This is the next to last step in the device tree overlay application
 * process, when all the phandles have been adjusted and resolved and
 * you just have to merge overlay into the base device tree.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_merge(void *fdt, void *fdto)
{
        int fragment;

        fdt_for_each_subnode(fragment, fdto, 0) {
                int overlay;
                int target;
                int ret;

                /*
                 * Each fragments will have an __overlay__ node. If
                 * they don't, it's not supposed to be merged
                 */
                overlay = fdt_subnode_offset(fdto, fragment, "__overlay__");
                if (overlay == -FDT_ERR_NOTFOUND)
                        continue;

                if (overlay < 0)
                        return overlay;

                target = fdt_overlay_target_offset(fdt, fdto, fragment, NULL);
                if (target < 0)
                        return target;

                ret = overlay_apply_node(fdt, target, fdto, overlay);
                if (ret)
                        return ret;
        }

        return 0;
}

static int get_path_len(const void *fdt, int nodeoffset)
{
        int len = 0, namelen;
        const char *name;

        FDT_RO_PROBE(fdt);

        for (;;) {
                name = fdt_get_name(fdt, nodeoffset, &namelen);
                if (!name)
                        return namelen;

                /* root? we're done */
                if (namelen == 0)
                        break;

                nodeoffset = fdt_parent_offset(fdt, nodeoffset);
                if (nodeoffset < 0)
                        return nodeoffset;
                len += namelen + 1;
        }

        /* in case of root pretend it's "/" */
        if (len == 0)
                len++;
        return len;
}

/**
 * overlay_symbol_update - Update the symbols of base tree after a merge
 * @fdt: Base Device Tree blob
 * @fdto: Device tree overlay blob
 *
 * overlay_symbol_update() updates the symbols of the base tree with the
 * symbols of the applied overlay
 *
 * This is the last step in the device tree overlay application
 * process, allowing the reference of overlay symbols by subsequent
 * overlay operations.
 *
 * returns:
 *      0 on success
 *      Negative error code on failure
 */
static int overlay_symbol_update(void *fdt, void *fdto)
{
        int root_sym, ov_sym, prop, path_len, fragment, target;
        int len, frag_name_len, ret, rel_path_len;
        const char *s, *e;
        const char *path;
        const char *name;
        const char *frag_name;
        const char *rel_path;
        const char *target_path;
        char *buf;
        void *p;

        ov_sym = fdt_subnode_offset(fdto, 0, "__symbols__");

        /* if no overlay symbols exist no problem */
        if (ov_sym < 0)
                return 0;

        root_sym = fdt_subnode_offset(fdt, 0, "__symbols__");

        /* it no root symbols exist we should create them */
        if (root_sym == -FDT_ERR_NOTFOUND)
                root_sym = fdt_add_subnode(fdt, 0, "__symbols__");

        /* any error is fatal now */
        if (root_sym < 0)
                return root_sym;

        /* iterate over each overlay symbol */
        fdt_for_each_property_offset(prop, fdto, ov_sym) {
                path = fdt_getprop_by_offset(fdto, prop, &name, &path_len);
                if (!path)
                        return path_len;

                /* verify it's a string property (terminated by a single \0) */
                if (path_len < 1 || memchr(path, '\0', path_len) != &path[path_len - 1])
                        return -FDT_ERR_BADVALUE;

                /* keep end marker to avoid strlen() */
                e = path + path_len;

                if (*path != '/')
                        return -FDT_ERR_BADVALUE;

                /* get fragment name first */
                s = strchr(path + 1, '/');
                if (!s) {
                        /* Symbol refers to something that won't end
                         * up in the target tree */
                        continue;
                }

                frag_name = path + 1;
                frag_name_len = s - path - 1;

                /* verify format; safe since "s" lies in \0 terminated prop */
                len = sizeof("/__overlay__/") - 1;
                if ((e - s) > len && (memcmp(s, "/__overlay__/", len) == 0)) {
                        /* /<fragment-name>/__overlay__/<relative-subnode-path> */
                        rel_path = s + len;
                        rel_path_len = e - rel_path - 1;
                } else if ((e - s) == len
                           && (memcmp(s, "/__overlay__", len - 1) == 0)) {
                        /* /<fragment-name>/__overlay__ */
                        rel_path = "";
                        rel_path_len = 0;
                } else {
                        /* Symbol refers to something that won't end
                         * up in the target tree */
                        continue;
                }

                /* find the fragment index in which the symbol lies */
                ret = fdt_subnode_offset_namelen(fdto, 0, frag_name,
                                               frag_name_len);
                /* not found? */
                if (ret < 0)
                        return -FDT_ERR_BADOVERLAY;
                fragment = ret;

                /* an __overlay__ subnode must exist */
                ret = fdt_subnode_offset(fdto, fragment, "__overlay__");
                if (ret < 0)
                        return -FDT_ERR_BADOVERLAY;

                /* get the target of the fragment */
                ret = fdt_overlay_target_offset(fdt, fdto, fragment, &target_path);
                if (ret < 0)
                        return ret;
                target = ret;

                /* if we have a target path use */
                if (!target_path) {
                        ret = get_path_len(fdt, target);
                        if (ret < 0)
                                return ret;
                        len = ret;
                } else {
                        len = strlen(target_path);
                }

                ret = fdt_setprop_placeholder(fdt, root_sym, name,
                                len + (len > 1) + rel_path_len + 1, &p);
                if (ret < 0)
                        return ret;

                if (!target_path) {
                        /* again in case setprop_placeholder changed it */
                        ret = fdt_overlay_target_offset(fdt, fdto, fragment, &target_path);
                        if (ret < 0)
                                return ret;
                        target = ret;
                }

                buf = p;
                if (len > 1) { /* target is not root */
                        if (!target_path) {
                                ret = fdt_get_path(fdt, target, buf, len + 1);
                                if (ret < 0)
                                        return ret;
                        } else
                                memcpy(buf, target_path, len + 1);

                } else
                        len--;

                buf[len] = '/';
                memcpy(buf + len + 1, rel_path, rel_path_len);
                buf[len + 1 + rel_path_len] = '\0';
        }

        return 0;
}

int fdt_overlay_apply(void *fdt, void *fdto)
{
        uint32_t delta;
        int ret;

        FDT_RO_PROBE(fdt);
        FDT_RO_PROBE(fdto);

        ret = fdt_find_max_phandle(fdt, &delta);
        if (ret)
                goto err;

        /* Increase all phandles in the fdto by delta */
        ret = overlay_adjust_local_phandles(fdto, delta);
        if (ret)
                goto err;

        /* Adapt the phandle values in fdto to the above increase */
        ret = overlay_update_local_references(fdto, delta);
        if (ret)
                goto err;

        /* Update fdto's phandles using symbols from fdt */
        ret = overlay_fixup_phandles(fdt, fdto);
        if (ret)
                goto err;

        /* Don't overwrite phandles in fdt */
        ret = overlay_prevent_phandle_overwrite(fdt, fdto);
        if (ret)
                goto err;

        ret = overlay_merge(fdt, fdto);
        if (ret)
                goto err;

        ret = overlay_symbol_update(fdt, fdto);
        if (ret)
                goto err;

        /*
         * The overlay has been damaged, erase its magic.
         */
        fdt_set_magic(fdto, ~0);

        return 0;

err:
        /*
         * The overlay might have been damaged, erase its magic.
         */
        fdt_set_magic(fdto, ~0);

        /*
         * The base device tree might have been damaged, erase its
         * magic.
         */
        fdt_set_magic(fdt, ~0);

        return ret;
}