u-boot.git/test, branch main

Merge patch series "vbe: bound FIT external-data reads against the firmware area"

2026-07-16T18:06:40Z

Aristo Chen says: vbe_read_fit() loads a firmware-phase FIT from a fixed firmware area on a block device and then issues a follow-up blk_read() to pull in the image, and optionally an FDT, referenced by the FIT's image node. The source offset on the device and the read length both come from the FIT itself, via data-position or data-offset and data-size. Those properties live on mutable boot media and can be controlled by an attacker with write access to the firmware area. On the TPL or VPL path, and on the bootmeth bootflow path reached via abrec_read_bootflow_fw() and vbe_simple_read_bootflow_fw(), the follow-up blk_read() runs before any signature or hash check on the loaded phase. Patch 1 is a sandbox test-tree preparation. The firmware1 node in arch/sandbox/dts/test.dts declared area-size = 0xe00000 (14 MiB), but the binman fw-update section in sandbox_vpl.dtsi is 32 MiB and the FIT inside it carries ~16 MiB of external data, so the FIT already extended past the declared area. The mismatch was tolerated because no caller bounded the external-data load against area_size. Patch 1 raises area-size to match the binman section size so test_vbe_vpl keeps passing once the bound is enforced. The patches are ordered so the test is never broken in the middle of the series. Patch 2 adds the missing range check, confining the FIT-supplied [load_addr, load_addr + len) window to [addr, addr + area_size] before block numbers and lengths are computed, and applying the same constraint to fdt_load_addr and fdt_size. The check is written in subtraction-only form against the trusted area_size so the comparison cannot itself overflow. Patch 3 adds two sandbox unit tests under test/boot/ that construct synthetic FITs with out-of-range data-position and oversized data-size, write them to mmc1, and confirm vbe_read_fit() returns -E2BIG for each before issuing the follow-up blk_read(). Deferring the external-data blk_read() until after the phase has been signature-verified would be a stronger structural fix and was discussed on the v1 thread. Simon confirmed the bounded read is the right first step and that the verify-then-load change should be a separate series, so this v3 stays scoped to the bound. Link: https://lore.kernel.org/r/20260705034414.2247-1-aristo.chen@canonical.com

test: vbe: cover vbe_read_fit() external-data bounds checks

2026-07-16T18:06:15Z

vbe_read_fit() rejects FITs whose external-data window extends past the trusted firmware area on disk by returning -E2BIG. Add two sandbox unit tests that construct synthetic FITs with attacker-controlled data-position and data-size values, write them to mmc1, and assert vbe_read_fit() catches each one before issuing the follow-up blk_read(). vbe_read_fit_oob_position uses a data-position past area_size, which trips the load_addr - addr > area_size clause. vbe_read_fit_oversize_data keeps data-position inside the area but picks a data-size that overruns area_size - (load_addr - addr), tripping the third clause. The two remaining bound clauses stay unreachable from a sandbox test. The load_addr < addr guard trivially holds when addr comes from CONFIG_VAL(TEXT_BASE), which is 0 on sandbox, and the FDT-region bound sits behind a !CONFIG_SANDBOX guard in vbe_read_fit(), so fdt_size stays 0 and that block is skipped in this test environment. The new file follows the existing bootstd VBE test layout and writes the FIT at block 16, past the version and nvdata blocks already used by bootstd_setup_for_tests(). Suggested-by: Simon Glass Reviewed-by: Simon Glass Signed-off-by: Aristo Chen

Merge tag 'mmc-for-2026.10-rc1' of https://git.u-boot-project.org/u-boot/custodians/u-boot-mmc

2026-07-14T13:59:50Z

CI: https://git.u-boot-project.org/u-boot/custodians/u-boot-mmc/-/pipelines/614 - Add PMBUS regulator, thermal and test - Add regulator helper to set voltage within an acceptable range - Update dw_mmc to use in-spec voltage range for vqmmc - Fix regulator_enable/disable() macros - Clear LPUART OR STAT in tstc to avoid hang - Add MAINTAINERS entry for SDHCI

test: cmd: part: fix integer handling in setup_gpt_partitions()

2026-07-13T23:06:37Z

Coverity reports an INTEGER_OVERFLOW issue because ut_asserteq() compares an unsigned int (mmc_dev_num) with ret, which can hold a negative error code. Addresses-Coverity-ID: CID 646439: Integer handling issues (INTEGER_OVERFLOW) Signed-off-by: Dario Binacchi Reviewed-by: Quentin Schulz

test: dm: pmbus: test pmbus command and framework

2026-07-13T03:24:45Z

Add dm unit tests that drive every pmbus subcommand handler against the sandbox PMBus chip emulator: dev (select by bus:addr and by regulator-name), list, info, telemetry, status, dump, read, write, clear, vout, scan and help. Tested using: ./u-boot -T -c "ut dm pmbus*" Signed-off-by: Vincent Jardin Reviewed-by: Simon Glass Signed-off-by: Peng Fan

test: dm: regulator: Add regulator_set_value_clamp() tests

2026-07-12T08:18:32Z

Add a sandbox LDO3 with a configurable 1.8V to 3.3V range and use it to test regulator_set_value_clamp(). Test in-range requests, clamping against the regulator limits, invalid ranges outside the regulator limits and a min value higher than max. Signed-off-by: Jonas Karlman Reviewed-by: Peng Fan Signed-off-by: Peng Fan

Merge branch 'next'

2026-07-07T00:26:12Z

test: Stop running the patman tests

2026-07-06T14:28:51Z

The patman tests no longer exist in the tree, so drop them from the test/run script (used by 'make tcheck' and friends) and from the tools-testing example in the documentation. Signed-off-by: Simon Glass

test: bootdev: scan with a broken high-priority device

2026-07-03T16:14:25Z

Add bootdev_hunt_fallthrough() test to verify that 'bootflow scan -l' falls back to a lower-priority bootdev when a higher-priority hunter fails. Introduce a simple 'sandbox-bootdev' device for the test. The new bootdev can be configured to produce an error at the hunting stage. Introduce new host_set_flags_by_label() API and a flags field to 'host_sb_plat' to simulate a bootdev hunter failure for the test. Adjust boot{dev,flow} tests which depend on bootdev hunters. Signed-off-by: Denis Mukhin Reviewed-by: Simon Glass

treewide: Staticize and constify acpi ops

2026-06-29T21:29:44Z

Set the acpi_ops structure as static const where applicable. The The structure is not accessible from outside of drivers and is not going to be modified at runtime. The structure may be unused in a couple of drivers depending on their configuration, mark those sites with __maybe_unused . Signed-off-by: Marek Vasut Reviewed-by: Simon Glass