u-boot/u-boot.git, branch CHECK/v2-check-decomp-header

test: fit: cover the kernel_noload lzma header-size and unknown-size paths

2026-08-18T20:36:57+00:00

Exercise bootm_lzma_uncompressed_size() end-to-end on sandbox: - test_fit_kernel_noload_decomp_lzma_hdr_sized boots a 6 MiB kernel_noload payload that lzma compresses far past the 8x fallback heuristic, so the boot only succeeds when bootm sizes the buffer from the header's uncompressed-size field. Streaming encoders write the "unknown" marker into that field, so the test compresses with Python's lzma module and patches the real size into the fixed 8-byte field, matching what LZMA SDK style encoders record. - test_fit_kernel_noload_decomp_lzma_unknown_size leaves the marker in place and checks that bootm falls back to the 8x heuristic buffer and still boots the image. No external tool is required: Python's lzma module is part of the standard library. Signed-off-by: Aristo Chen

bootm: size the noload lzma decompression buffer from the header

2026-08-18T20:36:57+00:00

Add a small static helper bootm_lzma_uncompressed_size() that reads the uncompressed size out of the .lzma-alone header, and wire it into bootm_load_os() alongside gzip, lz4, and zstd. The .lzma-alone format keeps the uncompressed size in a fixed 8-byte field right after the 5-byte properties block; a marker of all ones means the size is unknown, and the caller falls back to the 8x heuristic in that case. Streaming encoders (xz-utils' 'lzma' shim, Python's lzma.FORMAT_ALONE) write the unknown marker, while LZMA SDK style encoders record the real size. Signed-off-by: Aristo Chen

test: fit: cover the kernel_noload lz4 header-size path

2026-08-18T20:36:57+00:00

Add test_fit_kernel_noload_decomp_lz4_hdr_sized: a 6 MiB payload whose lz4 compression ratio is past the 8x heuristic decompresses cleanly because Content_Size is consulted. The tool must be invoked with --content-size so the frame's FLG bit is set. The test is guarded by @pytest.mark.requiredtool('lz4') so it skips on hosts that do not ship the lz4 command. Signed-off-by: Aristo Chen

bootm: size the noload lz4 decompression buffer from Content_Size

2026-08-18T20:36:57+00:00

Add a small static helper bootm_lz4_uncompressed_size() that parses the lz4 frame header and returns Content_Size when the FLG bit is set, and wire it into bootm_load_os() alongside gzip and zstd. The header parse mirrors ulz4fn()'s validation (magic, version==1, reserved bits, independent-block flag) so the helper does not accept a frame the decoder itself would reject. Only Content_Size is extracted; the full validation still runs inside ulz4fn() during the actual decompression call. The lz4 command needs the --content-size option to set the FLG bit that carries the size; frames produced without it fall back to the existing 8x heuristic. Signed-off-by: Aristo Chen

test: fit: cover the kernel_noload zstd header-size path

2026-08-18T20:36:57+00:00

Parametrise NOLOAD_ITS on the compression field so a single template can drive gzip, zstd, and future format tests, and update the existing gzip callers to pass compression='gzip'. Add test_fit_kernel_noload_decomp_zstd_hdr_sized: a 6 MiB payload whose zstd compression ratio is past the 8x heuristic decompresses cleanly because Frame_Content_Size is consulted. The test is guarded by @pytest.mark.requiredtool('zstd') so it skips on hosts that do not ship the zstd command. Signed-off-by: Aristo Chen

bootm: size the noload zstd decompression buffer from Frame_Content_Size

2026-08-18T20:36:57+00:00

Add a small static helper bootm_zstd_uncompressed_size() that returns the frame's Frame_Content_Size via zstd_get_frame_header(), and wire it into bootm_load_os() as a new case in the size-hint switch alongside the existing gzip case. zstd_get_frame_header() and the frame-parsing code behind it ship with the zstd decompressor, which is already linked into any board that enables ZSTD, so calling it here adds no new zstd code to the image. The returned value is used as an allocation hint only and is capped by the caller; full validation still runs inside zstd_decompress() during the actual decompression. Signed-off-by: Aristo Chen

test: fit: cover the kernel_noload gzip header-size and lying-header paths

2026-08-18T20:36:57+00:00

Reshape and extend the kernel_noload decompression pytests to match the new bootm behaviour that reads ISIZE from the gzip trailer: - Rename test_fit_kernel_noload_decomp_overflow to test_fit_kernel_noload_decomp_gzip_lying_hdr. Its setup (a 4 MiB payload of zeros gzipped) used to force the failure via the 8x heuristic starving the buffer; now that bootm reads ISIZE, the honest trailer sizes the buffer correctly, so overwrite ISIZE with a tiny value instead and verify the resulting decompression is still stopped at the buffer boundary. This is the direct test of the CONFIG_SYS_BOOTM_LEN cap on the attacker-controlled header value. - Add test_fit_kernel_noload_decomp_gzip_hdr_sized: a 6 MiB gzipped payload whose compression ratio is past the 8x heuristic decompresses cleanly because ISIZE is consulted. - Rename the pre-existing test_fit_kernel_noload_decomp_boundary to test_fit_kernel_noload_decomp_gzip_boundary so every noload_decomp test carries the compressor in its name. Signed-off-by: Aristo Chen

bootm: size the noload gzip decompression buffer from ISIZE

2026-08-18T20:36:57+00:00

For a compressed kernel_noload image, bootm_load_os() allocates a per-image decompression buffer of ALIGN(image_len * 8, SZ_1M). The 8x multiplier is a heuristic that comfortably covers what zstd and xz achieve on real kernels, but a highly compressible payload (say, a run of zeros) can exceed it and fail decompression. gzip carries the original size in the last 4 bytes of the stream (ISIZE, modulo 2^32). Where the compressed image is a gzip stream, read ISIZE and use ALIGN(hdr_size, SZ_1M) as the buffer, capped at CONFIG_SYS_BOOTM_LEN because the value is attacker-controlled. For non-gzip streams or when ISIZE cannot be trusted, fall back to the existing 8x multiplier. The size read is done via a small static helper in bootm.c, wired up via a switch on os.comp so the same pattern can be extended to other formats without adding a new public interface. The other formats U-Boot supports (lzma, lz4, zstd) also carry a size hint and are added in follow-up patches. Suggested-by: Simon Glass Signed-off-by: Aristo Chen

global_data: Only include driver model fields when DM is enabled

2026-08-18T00:46:29+00:00

The struct list_head dmtag_list, struct udevice *dm_root, struct list_head uclass_root_s and struct list_head *uclass_root fields in struct global_data takes up 24/48 bytes of memory on ARMv7/AArch64. However, these fields are only used when $(PHASE_)DM is enabled. Guard driver model related fields using CONFIG_IS_ENABLED(DM) to save memory space when U-Boot proper is built with DM=y and xPL is built without xPL_DM. Signed-off-by: Jonas Karlman Reviewed-by: Tom Rini Reviewed-by: Simon Glass

buildman: Differentiate 32-bit and 64-bit LoongArch variants

2026-08-18T00:46:29+00:00

Similar to RISC-V and ARM, 32-bit and 64-bit LoongArch cannot be distinguished solely by CONFIG_SYS_ARCH, but require different toolchains if multilib is disabled in compiler, which is the case of toolchain provided by kernel.org. Override the parsed arch parameter for LoongArch configs based on CONFIG_ARCH_LA64 Kconfig symbol. Signed-off-by: Yao Zi Reviewed-by: Simon Glass