Rewrite Flattened Device Tree (FDT) parser with capacity bound and full validation

[dgarske]

This PR rewrites the FDT/FIT parser around a validated, capacity-bounded context API. Key improvements include:

• Full validation of DTB headers, block layouts, reservation maps, structure tokens, nesting, strings, and property bounds before use.
• Capacity-aware reads, mutations, relocation, and FIT sub-image loading across boot, update, and platform HAL paths.
• Fixes for malformed-input handling, integer overflow, out-of-bounds access, unterminated compatible strings, unsafe tree growth, and incorrect path/property matching.
• Updated FDT helpers for node/property lookup, insertion, deletion, resizing, memory reservations, and boot-time fixups.

Testing and coverage were expanded substantially:

• Added focused unit tests for validation failures, capacity limits, compatible string lists, path resolution, node/property mutation, reservation maps, and FIT behavior.
• Added a malformed-DTB corpus covering truncated, overlapping, overflowing, deeply nested, and otherwise invalid trees.
• Added CI execution of the corpus under AddressSanitizer and UndefinedBehaviorSanitizer, including hostile lookup probes.
• Updated the existing FDT parser, FIT gzip/FPGA, disk-update, and platform-specific tests for the new API.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Rewrites the FDT/FIT parsing and mutation logic around a validated, capacity-bounded fdt_ctx API, then updates boot paths, tooling, and unit tests to use the new interface and stronger validation model.

Changes:

• Introduces fdt_ctx + fdt_open()/fdt_size()/fdt_grow()/fdt_shrink() and rewrites FIT helpers to use validated contexts.
• Updates boot/update flows (update_ram.c, update_disk.c, HAL fixups) to pass explicit capacity bounds and avoid unsafe header-only assumptions.
• Expands unit tests and adds a malformed-DTB corpus runner for tools/fdt-parser, including ASan/UBSan CI coverage.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
tools/unit-tests/unit-update-disk.c	Updates DTS size helper signature to include capacity in disk update tests.
tools/unit-tests/unit-update-disk-oob.c	Same signature update for OOB disk update tests.
tools/unit-tests/unit-update-disk-fit.c	Reworks FIT mocks to use fdt_ctx/fdt_open() and updated FIT APIs.
tools/unit-tests/unit-t10xx-dts-memac.c	Aligns test DTB buffers, adjusts DTB layout, and uses fdt_ctx APIs for lookups.
tools/unit-tests/unit-fit-gzip.c	Adds fit_open() helper and updates callers to pass fdt_ctx*; aligns fixtures.
tools/unit-tests/unit-fit-fpga.c	Switches FIT fixtures/tests to validated fdt_ctx views; aligns blob buffer.
tools/unit-tests/unit-fdt.c	Major rewrite/expansion of parser tests (open/validate, compatible/path lookup, mutations, initrd fixup, peek-size, FIT behavior).
tools/unit-tests/unit-fdt-memrsv-wrap.c	Refactors regression test to link real src/fdt.c and exercise fdt_open() + bounded inserts.
tools/unit-tests/Makefile	Removes sed-based extraction, links real parser for memrsv-wrap test; adjusts generated-src cleanup.
tools/keytools/sign.c	Aligns signer’s minimum accepted FDT version to v17 to match boot parser support.
tools/fdt-parser/fdt-parser.c	Migrates tool to fdt_ctx APIs and adds -f corpus runner using forked processes.
tools/fdt-parser/README.md	Documents -f corpus mode and sanitizer build/run instructions.
tools/fdt-parser/Makefile	Enables corpus generator compilation via -DWOLFBOOT_FDT_CORPUS.
src/update_ram.c	Uses fdt_open() for FIT detection, bounds DTB parsing by sub-image length, and passes validated DTB ctx to initrd fixup.
src/update_disk.c	Same FIT detection + bounded DTB parsing + initrd fixup ctx flow for disk boots.
src/image.c	Uses fdt_peek_size() for header-only size discovery and updates DTS size API to capacity-bounded fdt_open().
src/fdt.c	New validated, capacity-bounded parser/mutator implementation plus corpus generator under WOLFBOOT_FDT_CORPUS.
src/boot_riscv.c	Updates hal_dts_fixup signature to include capacity bound.
src/boot_ppc.c	Updates hal_dts_fixup signature to include capacity bound.
src/boot_aarch64.c	Updates hal_dts_fixup signature to include capacity bound.
include/image.h	Updates wolfBoot_get_dts_size() signature and documents header-only callers should use fdt_peek_size().
include/fdt.h	Defines new fdt_ctx API surface, error model, supported version policy, and corpus hooks.
hal/zynq.c	Migrates fixups to validated fdt_ctx + fdt_grow() and bounded mutations.
hal/versal.c	Migrates fixups to validated fdt_ctx + fdt_grow() and bounded mutations.
hal/nxp_t2080.c	Migrates fixups to validated fdt_ctx, uses fdt_grow(), and updates node lookup approach.
hal/nxp_t10xx.c	Migrates fixups to validated fdt_ctx, uses fdt_grow(), and fixes endianness for written cells.
hal/mpfs250.c	Migrates fixups to validated fdt_ctx, bounds DDR→L2 copy via fdt_open(), and revalidates before copy-back.
hal/cm4.c	Replaces header-only checks with bounded fdt_open() + fdt_grow() for firmware DTB handling.
docs/Targets.md	Updates example output to omit FDT version in log line.
.github/workflows/test-parse-tools.yml	Adds ASan/UBSan execution of malformed-input corpus via fdt-parser -f.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 30 out of 30 changed files in this pull request and generated 3 comments.