u-boot.git/test/boot/Makefile, branch main

Merge patch series "vbe: bound FIT external-data reads against the firmware area"

2026-07-16T18:06:40Z

Aristo Chen says: vbe_read_fit() loads a firmware-phase FIT from a fixed firmware area on a block device and then issues a follow-up blk_read() to pull in the image, and optionally an FDT, referenced by the FIT's image node. The source offset on the device and the read length both come from the FIT itself, via data-position or data-offset and data-size. Those properties live on mutable boot media and can be controlled by an attacker with write access to the firmware area. On the TPL or VPL path, and on the bootmeth bootflow path reached via abrec_read_bootflow_fw() and vbe_simple_read_bootflow_fw(), the follow-up blk_read() runs before any signature or hash check on the loaded phase. Patch 1 is a sandbox test-tree preparation. The firmware1 node in arch/sandbox/dts/test.dts declared area-size = 0xe00000 (14 MiB), but the binman fw-update section in sandbox_vpl.dtsi is 32 MiB and the FIT inside it carries ~16 MiB of external data, so the FIT already extended past the declared area. The mismatch was tolerated because no caller bounded the external-data load against area_size. Patch 1 raises area-size to match the binman section size so test_vbe_vpl keeps passing once the bound is enforced. The patches are ordered so the test is never broken in the middle of the series. Patch 2 adds the missing range check, confining the FIT-supplied [load_addr, load_addr + len) window to [addr, addr + area_size] before block numbers and lengths are computed, and applying the same constraint to fdt_load_addr and fdt_size. The check is written in subtraction-only form against the trusted area_size so the comparison cannot itself overflow. Patch 3 adds two sandbox unit tests under test/boot/ that construct synthetic FITs with out-of-range data-position and oversized data-size, write them to mmc1, and confirm vbe_read_fit() returns -E2BIG for each before issuing the follow-up blk_read(). Deferring the external-data blk_read() until after the phase has been signature-verified would be a stronger structural fix and was discussed on the v1 thread. Simon confirmed the bounded read is the right first step and that the verify-then-load change should be a separate series, so this v3 stays scoped to the bound. Link: https://lore.kernel.org/r/20260705034414.2247-1-aristo.chen@canonical.com

test: vbe: cover vbe_read_fit() external-data bounds checks

2026-07-16T18:06:15Z

vbe_read_fit() rejects FITs whose external-data window extends past the trusted firmware area on disk by returning -E2BIG. Add two sandbox unit tests that construct synthetic FITs with attacker-controlled data-position and data-size values, write them to mmc1, and assert vbe_read_fit() catches each one before issuing the follow-up blk_read(). vbe_read_fit_oob_position uses a data-position past area_size, which trips the load_addr - addr > area_size clause. vbe_read_fit_oversize_data keeps data-position inside the area but picks a data-size that overruns area_size - (load_addr - addr), tripping the third clause. The two remaining bound clauses stay unreachable from a sandbox test. The load_addr < addr guard trivially holds when addr comes from CONFIG_VAL(TEXT_BASE), which is 0 on sandbox, and the FDT-region bound sits behind a !CONFIG_SANDBOX guard in vbe_read_fit(), so fdt_size stays 0 and that block is skipped in this test environment. The new file follows the existing bootstd VBE test layout and writes the FIT at block 16, past the version and nvdata blocks already used by bootstd_setup_for_tests(). Suggested-by: Simon Glass Reviewed-by: Simon Glass Signed-off-by: Aristo Chen

Merge patch series "various memory related fixups"

2026-06-15T17:04:48Z

rs@ti.com says: From: Randolph Sapp Nitpicks and fixes from the discovery thread on adding PocketBeagle2 support [1]. This does a lot of general setup required for the device, but these modifications themselves aren't device specific. For those specifically interested in PocketBeagle2 support and don't care about these details, my development branch is public [2]. That first patch may provoke some opinions, but honestly if that warning was still present I wouldn't have spent a week poking holes in both the EFI and LMB allocations systems. Please let me know if there is a specific usecase that it breaks though. [1] https://lore.kernel.org/all/DHHC66BBMD27.YHGIH43C6XBK@ti.com/ [2] https://github.com/StaticRocket/u-boot/tree/feature/pocketbeagle2 Link: https://lore.kernel.org/r/20260604155038.3182-1-rs@ti.com

test: boot: add a fdt reserved region check

2026-06-15T17:04:39Z

Add a image_fdt suite and a check for boot_fdt_add_mem_rsv_regions. This will ensure the user is properly informed of any reservation failures. It will also validate that reservations are cleaned up correctly when switching FDTs. Signed-off-by: Randolph Sapp Reviewed-by: Simon Glass Acked-by: Ilias Apalodimas

test: boot: add runtime unit test for fit_verity_build_cmdline()

2026-05-27T19:41:33Z

Add test/boot/fit_verity.c with four tests that construct FIT blobs in memory and exercise fit_verity_build_cmdline(). Signed-off-by: Daniel Golle Reviewed-by: Simon Glass

test: Do not build expo and cedit test if no SDL

2025-10-15T20:17:13Z

expo and cedit tests depend on the host having the SDL library. Build these tests only if VIDEO_SANDBOX_SDL config is enabled. Signed-off-by: Kory Maincent Reviewed-by: Simon Glass

Kbuild: Always use $(PHASE_)

2025-04-11T18:16:44Z

It is confusing to have both "$(PHASE_)" and "$(XPL_)" be used in our Makefiles as part of the macros to determine when to do something in our Makefiles based on what phase of the build we are in. For consistency, bring this down to a single macro and use "$(PHASE_)" only. Signed-off-by: Tom Rini

bootm: test: Move test into boot

2024-11-13T17:56:01Z

This test doesn't belong at the top level. Move it into the boot/ directory, to match its implementation. This test is currently dependent on bloblist, but the real dependency is on sandbox, so update that. Signed-off-by: Simon Glass Tested-by: Tom Rini # rpi_3, rpi_4, rpi_arm64, am64x_evm_a53, am64-sk

test/boot: Make BOOTSTD tests depend on UT_BOOTSTD

2024-08-23T21:59:39Z

While we have a symbol for controlling if we will be testing BOOTSTD or not, and it depends on SANDBOX, we do not control the building of test/boot/ content correctly. Guard the current bootstd tests with a check for UT_BOOTSTD and leave the measurement test available. Reviewed-by: Simon Glass Signed-off-by: Tom Rini

upl: Add basic tests

2024-08-09T22:03:20Z

Add some unit tests to check that we can write a UPL handoff and read it back. Signed-off-by: Simon Glass