The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.
Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.
Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.
Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.
Update the docs to cover this. The FIT spec can be updated separately.
Signed-off-by: Simon Glass <simon.glass@canonical.com>
Closes: https://lore.kernel.org/u-boot/20260302220937.3682128-1-trini@konsulko.com/
Reported-by: Apple Security Engineering and Architecture (SEAR)
Tested-by: Tom Rini <trini@konsulko.com>
Add a simple unit test for testing the RAUC bootmethod. Provide only the
very basic tests for now, running a scan and list, to verify correct
detection of the RAUC bootmethod. More advanced boot tests of this
bootmethod can be added in a separate patch.
This requires another mmc image (mmc10) to contain the following
partitions:
1. boot A: contains a dummy boot.scr
2. root A: contains an empty root filesystem
3. boot B: contains a dummy boot.scr
4. root B: contains an empty root filesystem
The bootmeth_rauc scans all four partitions for existence and expects a
boot script in each boot partition.
Also add BOOTMETH_RAUC as a dependency on sandbox so that we can test
this with:
$ ./test/py/test.py -B sandbox --build -k test_ut # build the mmc10.img
$ ./test/py/test.py -B sandbox --build -k bootflow_rauc
Signed-off-by: Martin Schwan <m.schwan@phytec.de>
Reviewed-by: Simon Glass <simon.glass@canonical.com>
[trini: mmc9 is now in use, switch to mmc10]
Signed-off-by: Tom Rini <trini@konsulko.com>
Add simple test for zip/unzip/gzwrite commands. The test works as
follows. First, create three buffers with a bit of space between
each of them, fill them with random data, then compress data in
buffer 1 into buffer 2, decompress data in buffer 2 either directly
into buffer 3 or into MMC 1 and then read them back into buffer 3,
and finally compare buffer 1 and buffer 3, they have to be identical.
The buffers are filled with random data to detect out of bounds writes.
Test for various sizes, both small and large and unaligned.
The test uses ut_assert_skip_to_line() to skip over gzwrite progress
bar. Since the progress bar updates fill up the console record buffer,
increase the size of it to compensate.
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Tested-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Remove DECLARE_GLOBAL_DATA_PTR from files where gd is not used, and
drop the unnecessary inclusion of asm/global_data.h.
Headers should be included directly by the files that need them,
rather than indirectly via global_data.h.
Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com> #STMicroelectronics boards and STM32MP1 ram test driver
Tested-by: Anshul Dalal <anshuld@ti.com> #TI boards
Acked-by: Yao Zi <me@ziyao.cc> #TH1520
Signed-off-by: Peng Fan <peng.fan@nxp.com>
snprintf is used, need to include vsprintf.h. Otherwise there will
be build error after asm/global_data.h is removed.
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Add a test for binding of multiple drivers with the same compatible. If
one of the drivers returns -ENODEV the other one needs to be bound.
Reviewed-by: Simon Glass <simon.glass@canonical.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Signed-off-by: Markus Schneider-Pargmann (TI.com) <msp@baylibre.com>
Pull request efi-2026-04-rc1-2
CI: https://source.denx.de/u-boot/custodians/u-boot-efi/-/pipelines/29050
Documentation:
* Update StarFive JH7110 common description
* Add TI AM62D documentation
* Update urllib3 version for building
* Update links to doc/develop/falcon.rst
* Describe QEMU networking
* kdoc: handle the obsolescensce of docutils.ErrorString()
* Fix typo "addtional" -> "additional" in pflash section.
UEFI:
* Fix boot failure from FIT with compressed EFI binary
Others:
* cmd/meminfo: Correct displaying addresses above 4 GiB
* test:
- Consider configuration in meminfo test
- Consider initf_malloc is only traced with EARLY_TRACE
- Clean up test_trace.py code
The GitHub dependabot tool has reported a "medium" priority bug
CVE-2026-22701, with this package. Update to the patched version.
Reported-by: GitHub dependabot
Signed-off-by: Tom Rini <trini@konsulko.com>
The output of the meminfo command depends on several Kconfig variables.
These need to be taken into account to provide valid test results.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Simon Glass <simon.glass@canonical.com>
u-boot-dfu-20260116
CI: https://source.denx.de/u-boot/custodians/u-boot-dfu/-/pipelines/29018
Android:
* Fix missing dependency for BOOTMETH_ANDROID
* Add bootconfig support
* Add 'get ramdisk' command to abootimg
DFU:
* Improve error handling in dfu_fill_entity()
USB Gadget:
* ci_udc: Ensure ci_ep->desc is valid before using it
* ci_udc: Add additional debug prints
Add test to verify that androidboot.* parameters are correctly extracted
from bootargs and appended to the bootconfig section when using
'abootimg get ramdisk' with boot image v4 and vendor_boot image.
The test verifies:
- androidboot.* parameters are removed from bootargs
- They are appended to the bootconfig section in the ramdisk
- Non-androidboot parameters remain in bootargs
- The bootconfig trailer is properly updated
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Guillaume La Roque (TI.com) <glaroque@baylibre.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://lore.kernel.org/r/20260112-bootconfig-v5-5-79b242159ac7@baylibre.com
[mkorpershoek: dropped whitespace changes from original patch]
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Set ubconfig to None and add a check in the show_timings() function of
test/py/test.py to ensure that the global ubconfig variable was actually
initialized before access attributes.
If tests fail early, e.g. because --build failed, ubconfig may not have
been initialized yet and results in an exception in an atexit handler.
Adding this check avoids unnecessary noise in the output.
Exception ignored in atexit callback: <function cleanup at 0x7de475ea6b60>
Traceback (most recent call last):
File "u-boot/test/py/conftest.py", line 669, in cleanup
show_timings()
File "u-boot/test/py/conftest.py", line 616, in show_timings
if ubconfig.timing:
^^^^^^^^
NameError: name 'ubconfig' is not defined
Tested-by: Mattijs Korpershoek <mkorpershoek@kernel.org> # sandbox
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Signed-off-by: David Lechner <dlechner@baylibre.com>
We should avoid overwhelming users with non-essential messages.
The message 'Starting the controller' is not written for EHCI.
We should not write it for XHCI either.
Adjust the Python test accordingly.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Add support for converting single-copy environment to redundant environment.
In case CRC checks on both redundant environment copies fail, try one more
CRC check on the primary environment copy and treat it as single environment.
If that check does pass, rewrite the single-copy environment into redundant
environment format, indicate the environment is valid, and import that as
usual primary copy of redundant environment. Follow up 'env save' will then
store two environment copies and the system will continue to operate as
regular redundant environment system.
Add test which validates this upgrade path. The test starts with spi.bin
which is pre-populated as single-copy environment and then upgrades that
environment to dual-copy environment.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Add test for environment stored in SPI NOR. The test works in a very
similar way to the current test for environment stored in ext4 FS,
except it generates spi.bin file backing the SPI NOR.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Many boards use CONFIG_LMB=y but not all, e.g.
amd_versal2_mini_defconfig. Building this board with CONFIG_UNIT_TEST=y
fails:
aarch64-linux-gnu-ld:
test/lib/lmb.c:411:(.text.test_noreserved+0x428):
undefined reference to `lmb_free'
We should be able to enable CONFIG_UNIT_TEST on any board.
With this patch the LMB test is only built if LMB is enabled which
overcomes the build issue.
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
CMD_NET_LWIP has never existed so it cannot be right. I'm guessing the
intent was to allow print_eth() to be called when NET_LWIP is defined
(NET means "legacy networking stack" as opposed to NET_LWIP which is the
newest (and incompatible) stack). There probably was some mix-up
between CMD_NET and NET options.
The dependency on CMD_NET seems unnecessary as it seems perfectly fine
to run bdinfo without CMD_NET (build and run tested). So let's instead
make the dependency on NET || NET_LWIP.
Let's sync the unit test as well.
Fixes: 95744d2527 ("cmd: bdinfo: enable -e when CONFIG_CMD_NET_LWIP=y")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Document the bdinfo -a, -e and -m options in the long help, but only
when they can be used. The string concatenation is a bit odd with two
newlines, but it does render properly once in U-Boot CLI.
Tested-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
The usage of the LMB library and the device-tree source are not related.
Remove the dependency in the bdinfo output and adjust the unit test.
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
* Expected values must always be the first arguments.
* Long values on 64 bit systems require ut_asserteq_64() for checking
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The GitHub dependabot tool has reported a "medium" priority bug
CVE-2025-68146, with this package. Update to the patched version.
Reported-by: GitHub dependabot
Signed-off-by: Tom Rini <trini@konsulko.com>
This pull request brings together a set of fixes and enhancements across
the SoCFPGA platform family, with a focus on MMC/SPL robustness, EFI
boot enablement, and Agilex5 SD/eMMC support.
CI: https://source.denx.de/u-boot/custodians/u-boot-socfpga/-/pipelines/28776
Highlights:
*
SPL / MMC:
o
Fix Kconfig handling for
SYS_MMCSD_RAW_MODE_U_BOOT_USE_PARTITION_TYPE
o
Correct raw sector calculations and respect explicit sector values
when loading U-Boot from MMC in SPL
o
Adjust raw MMC loading logic for SoCFPGA platforms
*
EFI boot:
o
Permit EFI booting on SoCFPGA platforms
o
Disable mkeficapsule tool build for Arria 10 where unsupported
*
Agilex5:
o
Upgrade SDHCI controller from SD4HC to SD6HC
o
Enable MMC and Cadence SDHCI support in defconfig
o
Add dedicated eMMC device tree and defconfig for Agilex5 SoCDK
o
Revert incorrect GPIO configuration for SDIO_SEL
o
Refine U-Boot DT handling for SD and eMMC boot variants
*
SPI:
o
Allow disabling the DesignWare SPI driver in SPL via Kconfig
*
Board / configuration fixes:
o
Enable random MAC address generation for Cyclone V
o
Fix DE0-Nano-SoC boot configuration
o
Remove obsolete or conflicting options from multiple legacy
SoCFPGA defconfigs
While this change was intended to fix a mistake in the code, of calling
the ERR_PTR macro but not making use of the result, it seems that
functionally platforms depend on the loop not existing here. The TI K3
families of platforms for example were broken by this commit.
This reverts commit fe780310cf.
Reported-by: Nishanth Menon <nm@ti.com>
Reviewed-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
The current FDT decoding tests calculate the memory required
for FDT manipulation by directly adding a fixed margin to
fdt_totalsize(gd->fdt_blob). The static analyzer flagged
"gd->fdt_blob->totalsize" as a tainted value being passed
to fdt_open_into().
Ensure the size is validated by checking that the total size
is within a reasonable maximum FDT limit for unit tests.
Signed-off-by: Adriana Nicolae <adriana@arista.com>
Introduce two new parameters to be used with mkimage -f auto to bundle
TEE image into fitImage, using auto-generated fitImage. Add -z to specify
TEE file name and -Z to specify TEE load and entry point address. This is
meant to be used with systems which boot all of TEE, Linux and its DT from
a single fitImage, all booted by U-Boot.
Example invocation:
"
$ mkimage -E -A arm -C none -e 0xc0008000 -a 0xc0008000 -f auto \
-d arch/arm/boot/zImage \
-b arch/arm/boot/dts/st/stm32mp135f-dhcor-dhsbc.dtb \
-z ../optee_os/out/arm-plat-stm32mp1/core/tee-raw.bin \
-Z 0xde000000 \
/path/to/output/fitImage
"
Documentation update and test are also included, the test validates
both positive and negative test cases, where fitImage does not include
TEE and does include TEE blobs.
Acked-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Introduce generate_and_check_fit_image() and call it with various
parameters to test various configurations of the fitImage. This is
identical to the existing test, expect for the code duplication.
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Andrew Goodbody <andrew.goodbody@linaro.org> says:
Smatch reported an error where a value calculated by ERR_PTR was not
used. Fixing this to return the generated value led to a test failure
which meant updating the sandbox clock code so that it would still cause
the tests to pass with the above correction.
Debugging this problem led to a SIGSEGV which is addressed in 1/3.
Possible memory leaks noticed are addressed in 3/3.
Link: https://lore.kernel.org/r/20251121-clk_uclass_fix-v2-0-74f4ea10e194@linaro.org
In clk_set_default_get_by_id ret is passed to ERR_PTR but nothing is
done with the value that this calculates which is obviously not the
intention of the code. This is confirmed by the code around where this
function is called.
Instead return the value from ERR_PTR.
Then fixup the sandbox code so that the test dm_test_clk does not fail
as it relied on the broken behaviour.
Finally disable part of the test that does not work correctly with
CLK_AUTO_ID
This issue found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Newer versions of libfdt strictly check whether the FDT blob
passed to them is at 8-byte aligned offset, if it is not, then
the library fails checks with -FDT_ERR_ALIGNMENT . Currently,
'abootimg get dtb --index=1 addr size' may return non 8-byte
aligned FDT address which points directly into the abootimg.
Copy the result into temporary location before validation to
avoid FDT alignment check failure.
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Link: https://lore.kernel.org/r/20251119193311.127633-2-marek.vasut+renesas@mailbox.org
Signed-off-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
Heinrich Schuchardt <heinrich.schuchardt@canonical.com> says:
Many C unit tests are not executed if CONFIG_CONSOLE_RECORD is not set.
Hence Tom suggested to let UNIT_TEST imply CONSOLE_RECORD.
The first patch makes the skipped C unit tests visible.
The rest of the series deals with hidden bugs in our tests.
The 'fdt get value' command returned incorrect values on low-endian
systems. So this needed fixing too.
Link: https://lore.kernel.org/r/20251123225711.227016-1-heinrich.schuchardt@canonical.com
The cmd and the log test suites rely on CONFIG_CONSOLE_RECORD.
The log test suite is always built if CONFIG_UNIT_TEST=y.
The print_do_hex_dump test relies on CONFIG_HEXDUMP. Imply it too.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
The 32bit cells of a device-tree property are big-endian. When printing
them via 0x08x we must first convert to the host endianness.
Remove the restriction to 20 bytes length. This would not allow to read an
SHA256 value.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
On the power architecture the bdinfo command prints architecture specific
information. The test needs to accept these output lines.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
