u-boot.git/test/py/tests/test_fit.py, branch main

Merge patch series "bootm: bound noload kernel decompression to the allocated buffer"

2026-06-17T15:54:27Z

Aristo Chen says: For a compressed kernel_noload image, bootm_load_os() allocates a decompression buffer of ALIGN(image_len * 4, SZ_1M) and then passes CONFIG_SYS_BOOTM_LEN (typically 128 MiB on arm64) to image_decomp() as the output limit. The decompressors honour whatever limit they are given, so a kernel that decompresses to more than four times its compressed size runs past the end of the allocated buffer and silently corrupts adjacent memory. A 4x compression ratio is at the edge of what modern compressors (zstd, xz) achieve on real kernels, and is trivially exceeded by crafted, highly compressible payloads, so this is reachable both accidentally and intentionally. The overflow can land on already-loaded boot artefacts (FDT, ramdisk, loadables), U-Boot's own data, or memory-mapped device registers; the existing post-decompression overlap check in bootm_load_os() only catches overlap with the FIT itself. Patch 1 plumbs the actual allocation size through to image_decomp() and handle_decomp_error() via a single decomp_len variable, so decompression stops at the buffer boundary and fails cleanly when the image is too large. The non-noload code path is unchanged and continues to use CONFIG_SYS_BOOTM_LEN. A clarifying note is printed when the failure is gated by the per-image buffer, so the generic "increase CONFIG_SYS_BOOTM_LEN" advice does not mislead. Patch 2 raises the noload-decompression headroom from 4x to 8x. The 4x factor is at the edge of what zstd and xz achieve on real kernels, so well-compressed vendor kernels can fail to boot at runtime once the bound is enforced. 8x covers them comfortably while remaining bounded. Patch 3 adds two sandbox py-tests against the per-image buffer at the final 8x value: one that exceeds the buffer and must be rejected, and one that matches the buffer exactly and must succeed (guarding the boundary). Tested on sandbox: both new tests pass; the existing test_fit_compressed_images_load (which covers the load-address path) and the other tests in test/py/tests/test_fit.py continue to pass. Link: https://lore.kernel.org/r/20260605154255.833334-1-aristo.chen@canonical.com

test/py: test kernel_noload decompression buffer overflow

2026-06-17T15:53:20Z

Add sandbox tests that exercise the per-image decompression buffer that bootm_load_os() allocates for a compressed kernel_noload image (ALIGN(image_len * 8, SZ_1M)). The overflow test builds a FIT whose decompressed size far exceeds the per-image buffer and asserts that 'bootm loados' rejects it with a decompression error rather than overflowing. The boundary test builds a FIT whose decompressed size equals the per-image buffer exactly and asserts that 'bootm loados' succeeds, guarding against an off-by-one rejection at the buffer limit. Signed-off-by: Aristo Chen

Merge patch series "boot/fit: use fdt_for_each_subnode() in image-fit.c"

2026-05-25T19:44:28Z

Aristo Chen says: This series ends with replacing the verbose fdt_next_node() + ndepth idiom in boot/image-fit.c with fdt_for_each_subnode(), bringing the file in line with boot/image-fit-sig.c. Six of the seven sites in image-fit.c predate the macro by 2-6 years; the seventh was copy-pasted from a neighbour in 2015 just after the macro landed. The old idiom is legacy, not a deliberate technical choice. Converting straight to the macro turned out to need a prerequisite, which is patch 1. fit_print_contents() reads the default-config property using the loop variable left over after iterating /images children. With /images defined first in the source (the conventional layout) libfdt's walker happens to leave that variable pointing at /configurations and the read works. With /configurations defined first the read returns NULL and the "Default Configuration" line is silently omitted. fdt_for_each_subnode()'s post-loop value is unconditionally a negative error code, so a naive conversion would have made the missing line the unconditional behaviour. Patch 1 reads the property from confs_noffset directly and removes the layout dependency. Patch 2 adds a regression test for the configs-before-images layout, which had no coverage. Patch 3 is the mechanical conversion at all seven sites, equivalence-preserving as described in the per-patch message. Link: https://lore.kernel.org/r/20260508213217.3807786-1-aristo.chen@canonical.com

test: fit: regression test for default-config print with reversed node order

2026-05-25T19:44:10Z

Add a test that builds a FIT whose /configurations node is defined before /images in the source, runs iminfo, and asserts that the "Default Configuration: ''" line appears in the output. Before the fix in the preceding commit ("boot/fit: read default-config property from the configurations node"), fit_print_contents() read the default-config property using the loop variable left over from iterating /images children. With /images defined first that variable accidentally pointed at /configurations and the line printed correctly; with /configurations defined first the read returned NULL and the line was silently omitted. The new test exercises the latter layout, which had no coverage. iminfo and the fit_print_contents() path had no test coverage at all before this commit. Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

test: fit: Use shared make_fname from fit_util

2026-05-08T21:49:27Z

test_fit.py declares a local make_fname closure that is byte-identical to fit_util.make_fname. Drop the local copy and call the shared helper at all seven call sites so there is one definition to maintain. No behavioural change. Both implementations return os.path.join(ubman.config.build_dir, basename). Signed-off-by: Aristo Chen Reviewed-by: Simon Glass

test: Add fsetup fixture and prepare helper for FIT test

2026-04-22T22:52:14Z

Create an 'fsetup' fixture which sets up files and parameters, and a prepare() helper which builds a FIT with given parameter overrides. Update check_equal() and check_not_equal() to look up filenames from a params dict by key, reducing the number of local variables needed. Split the single test_fit_operations() into individual test functions so that each appears separately in the results. Signed-off-by: Simon Glass

test: Convert FIT test to use a class

2026-04-22T22:52:14Z

Move this test over to use a class instead of a function, so we can easily split it into some related tests. Move the TODO so it is part of the comment for the class. Tidy up some function comments while we are here. Signed-off-by: Simon Glass

test: Update fit test to fix a few Python warnings

2026-04-22T22:52:14Z

Fix some warnings and disable one that cannot be fixed. Signed-off-by: Simon Glass

test: Add a check for a missing kernel

2026-04-22T22:52:14Z

U-Boot should complain if the kernel is missing, so add a check for this in test_fit_base() Signed-off-by: Simon Glass

test: Rename test_fit() to test_fit_base()

2026-04-22T22:52:14Z

The current name is uses as a root name by a few other tests, such as test_fit_ecdsa() which makes it hard to run just this test. Rename it to test_fit_base() Signed-off-by: Simon Glass