[PATCH v2025.09.y 00/58] Backports for v2025.09.1

[PATCH v2025.09.y 00/58] Backports for v2025.09.1

[Ahmad Fatoum]

Yocto Whinlatter still has a month to go until EOL.

Let's backport some fixes accrued in master in the meantime.

Ahmad Fatoum (35):
  drivers: don't propagate of_alias_get_id's -ENODEV out of probe
  bug: add support for CONFIG_DEBUG_BUGVERBOSE
  sandbox: fix make dependency for sandbox
  ARM: cpu: common: skip R_ARM_NONE relocations
  virtio: ring: fix stale data in queue after reset
  scripts: Makefile.lib: suppress graph_port warnings for overlays
  ARM: Rockchip: rk3576-prtpuk: suppress video graph warning
  kbuild: fold rmdirs into rmfiles
  FIT: fix double free issue with >1 reference count
  net: phy: mdio_bus: fix freeing of cdev name before devfs_remove
  bootm: fix bootm override saving/restoring
  common: tlv: fix link error when CONFIG_NET is disabled
  include: array_size.h: make header self-contained
  of: overlay: propagate error unflattening DTBO
  efi: fix potential NULL dereference
  FIT: fix potential underflow of stack array
  of: fdt: fix double free in fdt_ensure_space
  of: overlay: initialize ret to fix garbage return value
  firmware: xilinx-fpga: fix double free in probe error path
  driver: fix missing va_end in dev_add_alias error path
  net: eth: avoid overlapping memcpy in eth_set_ethaddr
  pmdomain: fix dereference before NULL check in genpd_get_from_provider
  net: phy: add NULL check for phy driver in page accessors
  open: add missing mode argument to O_CREAT calls
  hush: add NULL check for gl_pathv after do_glob_in_argv
  i2c: rk3x: fix NULL pointer dereference on repeated NACK
  mci: imx-esdhc: remove misleading NULL check for cmd pointer
  mci: spi: initialize r1 to fix garbage return value
  virtio: fix variable shadowing in virtqueue_add_sgs input scatter loop
  video: mode-helpers: preserve sync polarity in fb_videomode conversion
  scripts: include: break dependency of list.h on kernel.h
  jwt: fix buffer overflow and double-free in jwt_part_parse
  of: fdt: fix heap-buffer-overflow in fdt_machine_is_compatible
  powerpc: fix initjmp storing function pointer at wrong offset
  of: fdt: refuse / in property and node names

Alexander Shiyan (1):
  mtd: nand: mxc_nand: use clk_get_optional for clock handling

Bruno Knittel (1):
  ARM: socfpga: arria10-reset-manager: release UART0

Chali Anis (1):
  clk: clkdev: fix format security.

Fabian Pflug (1):
  i.MX: HAB: fix field return unlock fuse uid

Hemanth Kumar M D (1):
  scripts: fix build failure with glibc 2.43

Ivaylo Ivanov (1):
  video: simplefb-client: switch to dev_get_resource

Jonas Rebmann (2):
  common: tlv: Correct eth address list fixup
  Makefile: include scripts/ in compile_commands.json

Matthias Zoechmann (2):
  scripts: imx: fix string in further auth block
  scripts: imx-image: support DCD_WRITE on closed dev

Maud Spierings (1):
  RISC-V: dts: fix generation of dtbs-list

Sascha Hauer (10):
  mci: am654-sdhci: Wait for transfer complete interrupt with
    MMC_RSP_BUSY cmd
  firmware: handle firmware files being links correctly
  driver: implement get_free_deviceid_from()
  gpio: Fix GPIOD_ASIS flag
  ARM: rockchip: dmc: use define instead of hardcoded value
  ARM: rockchip: atf: Fix memend
  regulator: fix handling of off_on_delay
  regulator: fixed: handle startup-delay-us property
  net: r8169: drain RX descriptor ring
  FIT: reconstruct hashed-nodes property during verification

Tobias Waldekranz (1):
  MIPS: qemu-malta_defconfig: Use largest possible relocation table

zhengxiaojun (1):
  mmc: resolve conflict between MMC_CAP_NONREMOVABLE and
    MMC_CAP_1_8V_DDR

 Makefile                                      |  15 +-
 arch/arm/cpu/common.c                         |  30 ++--
 arch/arm/dts/rk3576-prtpuk-linux.dts          |   4 +-
 arch/arm/mach-imx/Kconfig                     |  33 ++---
 arch/arm/mach-rockchip/atf.c                  |  12 +-
 arch/arm/mach-rockchip/dmc.c                  |   4 +-
 arch/arm/mach-socfpga/arria10-reset-manager.c |   1 +
 arch/mips/configs/qemu-malta_defconfig        |   1 +
 arch/powerpc/lib/setjmp.S                     |   4 +-
 arch/riscv/dts/Makefile                       |   8 +-
 commands/echo.c                               |   2 +-
 commands/edit.c                               |   2 +-
 commands/uimage.c                             |   2 +-
 commands/uncompress.c                         |   2 +-
 common/Kconfig                                |  11 ++
 common/bbu.c                                  |   2 +-
 common/boot.c                                 |   4 +-
 common/bootm.c                                |   6 +-
 common/console_common.c                       |   2 +-
 common/fastboot.c                             |   4 +-
 common/globalvar.c                            |   2 +-
 common/hush.c                                 |   3 +
 common/image-fit.c                            | 135 +++++++++++++++---
 common/tlv/barebox.c                          |  30 ++--
 common/tlv/parser.c                           |   5 +
 drivers/base/driver.c                         |  14 +-
 drivers/base/power.c                          |   4 +-
 drivers/clk/sifive/sifive-prci.c              |   2 +-
 drivers/firmware/xilinx-fpga.c                |   4 +-
 drivers/gpio/gpio-clps711x.c                  |   2 +-
 drivers/gpio/gpio-imx.c                       |   5 +-
 drivers/gpio/gpio-mxs.c                       |   2 +-
 drivers/gpio/gpio-omap.c                      |   5 +-
 drivers/gpio/gpio-orion.c                     |   5 +-
 drivers/gpio/gpio-vf610.c                     |  14 +-
 drivers/gpio/gpiolib.c                        |  15 +-
 drivers/i2c/busses/i2c-rk3x.c                 |   3 +-
 drivers/mci/am654-sdhci.c                     |   8 +-
 drivers/mci/imx-esdhc-common.c                |   2 +-
 drivers/mci/mci_spi.c                         |   2 +-
 drivers/mtd/nand/raw/mxc_nand.c               |   3 +-
 drivers/net/phy/mdio_bus.c                    |   2 +-
 drivers/net/phy/phy-core.c                    |   4 +-
 drivers/net/r8169_main.c                      |  39 ++---
 drivers/of/fdt.c                              |  26 +++-
 drivers/of/overlay.c                          |   5 +-
 drivers/regulator/core.c                      |  15 +-
 drivers/regulator/fixed.c                     |   3 +
 drivers/spi/imx_spi.c                         |   5 +-
 drivers/usb/gadget/function/dfu.c             |   6 +-
 drivers/usb/imx/imx-usb-phy.c                 |   2 +-
 drivers/usb/musb/phy-am335x.c                 |   3 +-
 drivers/video/mode-helpers.c                  |   4 +
 drivers/video/simplefb-client.c               |   4 +-
 drivers/virtio/virtio_ring.c                  |   3 +-
 efi/efivar-filename.c                         |   3 +
 firmware/Makefile                             |  23 +--
 images/Makefile                               |   2 +
 images/Makefile.sandbox                       |   2 +-
 include/asm-generic/bug.h                     |  26 +++-
 include/bootm-overrides.h                     |   6 +-
 include/driver.h                              |   7 +-
 include/fcntl.h                               |   2 +-
 include/gpio.h                                |   2 +
 include/linux/array_size.h                    |   3 +-
 include/linux/gpio/consumer.h                 |   2 +-
 include/mach/imx/habv4-imx8-gencsf.h          |   2 +-
 include/mach/imx/imx-header.h                 |   2 +
 include/mci.h                                 |   2 +-
 include/regulator.h                           |   3 +
 lib/libfile.c                                 |   4 +-
 lib/xymodem.c                                 |   2 +-
 net/eth.c                                     |   3 +-
 scripts/Makefile.lib                          |   4 +-
 scripts/imx/imx-image.c                       |  19 ++-
 scripts/imx/imx.c                             |  24 +++-
 scripts/include/linux/container_of.h          |  18 +++
 scripts/include/linux/kernel.h                |  14 +-
 scripts/include/linux/list.h                  |   2 +-
 scripts/include/linux/types.h                 |   3 +-
 security/jwt.c                                |   3 +-
 81 files changed, 480 insertions(+), 238 deletions(-)
 create mode 100644 scripts/include/linux/container_of.h

-- 
2.47.3

[PATCH v2025.09.y 01/58] clk: clkdev: fix format security.

[Ahmad Fatoum]

From: Chali Anis <chalianis1@gmail.com>

not a string literal and no format
arguments [-Werror=format-security]

(cherry picked from commit 85e8514df331cbc72b85a4819420a1d5559998c7)

Fixes: 61da1fea5d3c ("clk: sifive: Fix missing conversion to struct clk_hw")
Signed-off-by: Chali Anis <chalianis1@gmail.com>
Link: https://lore.barebox.org/20250830182917.1378282-1-chalianis1@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/clk/sifive/sifive-prci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/sifive/sifive-prci.c b/drivers/clk/sifive/sifive-prci.c
index 349629d82aa9..dbbf05655850 100644
--- a/drivers/clk/sifive/sifive-prci.c
+++ b/drivers/clk/sifive/sifive-prci.c
@@ -508,7 +508,7 @@ static int __prci_register_clocks(struct device *dev, struct __prci_data *pd,
 			return PTR_ERR(clk);
 		}
 
-		r = clk_register_clkdev(clk, pic->name, dev_name(dev));
+		r = clk_register_clkdev(clk, pic->name, "%s", dev_name(dev));
 		if (r) {
 			dev_warn(dev, "Failed to register clkdev for %s: %d\n",
 				 clk_hw_get_name(&pic->hw), r);
-- 
2.47.3

[PATCH v2025.09.y 02/58] scripts: imx: fix string in further auth block

[Ahmad Fatoum]

From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>

If an additional block to be authenticated is added via
'hab_do_block off+size@addr' the CST tool will fail.
It seems that an own line is expected for each authentication
block. Add a '\' and linefeed after the comma to avoid a fail of CST.

(cherry picked from commit 8a8dffde3e6f7c6fd2ba19ac8444304be67e1e3a)

Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
Link: https://lore.barebox.org/20250901-imx6-usb-uuu-v1-1-1194bb6135ae@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 scripts/imx/imx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/imx/imx.c b/scripts/imx/imx.c
index 26027f0f3548..6dabaf59c159 100644
--- a/scripts/imx/imx.c
+++ b/scripts/imx/imx.c
@@ -488,7 +488,7 @@ static int do_hab_blocks(struct config_data *data, int argc, char *argv[])
 			return -EINVAL;
 		}
 
-		ret = asprintf(&str, ", 0x%08x 0x%08x 0x%08x \"%s\"", addr, off, size, data->outfile);
+		ret = asprintf(&str, ", \\\n 0x%08x 0x%08x 0x%08x \"%s\"", addr, off, size, data->outfile);
 		if (ret < 0)
 			return -ENOMEM;
 
-- 
2.47.3

[PATCH v2025.09.y 03/58] scripts: imx-image: support DCD_WRITE on closed dev

[Ahmad Fatoum]

From: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>

If an image is loaded by serial download protocol with DCD_WRITE ROM
command on closed i.mx6 devices, the DCD table block loaded into the
OCRAM must be signed.
This patch adds the option '-a' to apply the additional authentication
block for the OCRAM section into the CSF.
The load address for the block is fixed to '0x00910000' which is the
default address configured in mfg-tools of NXP.

(cherry picked from commit c722f8cf43690effcfe0031b1d9507a0957f5bf3)

Signed-off-by: Matthias Zoechmann <matthias.zoechmann@ife-doors.com>
Link: https://lore.barebox.org/20250901-imx6-usb-uuu-v1-2-1194bb6135ae@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 include/mach/imx/imx-header.h |  2 ++
 scripts/imx/imx-image.c       | 19 ++++++++++++++++++-
 scripts/imx/imx.c             | 22 ++++++++++++++++++++++
 3 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/include/mach/imx/imx-header.h b/include/mach/imx/imx-header.h
index 08329e3d0561..e8ead33a9ead 100644
--- a/include/mach/imx/imx-header.h
+++ b/include/mach/imx/imx-header.h
@@ -115,6 +115,7 @@ struct config_data {
 	int (*write_mem)(const struct config_data *data, uint32_t addr,
 			 uint32_t val, int width, int set_bits, int clear_bits);
 	int (*nop)(const struct config_data *data);
+	int (*get_dcd_length)(void);
 	char *csf;
 	char *flexspi_csf;
 	int sign_image;
@@ -122,6 +123,7 @@ struct config_data {
 	int encrypt_image;
 	size_t dek_size;
 	bool hab_qspi_support;
+	bool dcd_usb_image;
 };
 
 #define MAX_RECORDS_DCD_V2 1024
diff --git a/scripts/imx/imx-image.c b/scripts/imx/imx-image.c
index a8ac34091fc0..c08857a6157e 100644
--- a/scripts/imx/imx-image.c
+++ b/scripts/imx/imx-image.c
@@ -495,6 +495,9 @@ static void usage(const char *prgname)
 		"             variable 'CST'\n"
 		"-u           create USB image suitable for imx-usb-loader\n"
 		"             necessary for signed images (-s) only\n"
+		"-a           authenticate additionaly the DCD block loaded via\n"
+		"             'SDP: DCD_WRITE' to the internal RAM on i.mx6 devices\n"
+		"             necessary for usb images (-u) only\n"
 		"-h           this help\n", prgname);
 	exit(1);
 }
@@ -662,6 +665,11 @@ static int nop(const struct config_data *data)
 	}
 }
 
+static int get_dcd_length(void)
+{
+	return sizeof(uint32_t) + (curdcd * sizeof(uint32_t));
+}
+
 /*
  * This uses the Freescale Code Signing Tool (CST) to sign the image.
  * The cst is expected to be executable as 'cst' or if exists, the content
@@ -875,6 +883,7 @@ int main(int argc, char *argv[])
 		.write_mem = write_mem,
 		.check = check,
 		.nop = nop,
+		.get_dcd_length = get_dcd_length
 	};
 	uint32_t *bb_header;
 	size_t sizeof_bb_header;
@@ -883,7 +892,7 @@ int main(int argc, char *argv[])
 
 	prgname = argv[0];
 
-	while ((opt = getopt(argc, argv, "c:hf:o:p:bduse")) != -1) {
+	while ((opt = getopt(argc, argv, "c:hf:o:p:bduase")) != -1) {
 		switch (opt) {
 		case 'c':
 			configfile = optarg;
@@ -909,6 +918,9 @@ int main(int argc, char *argv[])
 		case 'u':
 			create_usb_image = true;
 			break;
+		case 'a':
+			data.dcd_usb_image = true;
+			break;
 		case 'e':
 			data.encrypt_image = 1;
 			break;
@@ -969,6 +981,11 @@ int main(int argc, char *argv[])
 		create_usb_image = 0;
 	}
 
+	if (data.dcd_usb_image && !create_usb_image) {
+		fprintf(stderr, "Warning: the -a option only has effect with usb images\n");
+		data.dcd_usb_image = false;
+	}
+
 	if (data.image_ivt_offset == 0xffffffff) {
 		if (create_usb_image)
 			data.image_ivt_offset = 0x0;
diff --git a/scripts/imx/imx.c b/scripts/imx/imx.c
index 6dabaf59c159..26efe6d813dc 100644
--- a/scripts/imx/imx.c
+++ b/scripts/imx/imx.c
@@ -430,6 +430,28 @@ static int do_hab_blocks(struct config_data *data, int argc, char *argv[])
 		ret = asprintf(&str, "Blocks = 0x%08x 0x%08x 0x%08x \"%s\"",
 			data->image_load_addr + data->image_ivt_offset, offset,
 			signed_size - data->image_ivt_offset, data->outfile);
+
+		if (data->dcd_usb_image && (data->cpu_type == IMX_CPU_IMX6)) {
+			char *str_dcd_blk;
+			uint32_t dcd_offset = offset + offsetof(struct imx_flash_header_v2, dcd_header);
+			uint32_t dcd_length = data->get_dcd_length();
+
+			if(!dcd_length) {
+				fprintf(stderr, "failed to get dcd length\n");
+				return -EINVAL;
+			}
+
+			ret |= asprintf(&str_dcd_blk, ", \\\n 0x00910000 0x%08x 0x%08x \"%s\"",
+				dcd_offset, dcd_length, data->outfile);
+
+			str = strcata(str, str_dcd_blk);
+			free(str_dcd_blk);
+
+			if(!str) {
+				return -ENOMEM;
+			}
+		}
+
 		if (data->flexspi_csf)
 			ret |= asprintf(&flexspi_str,
 					"Blocks = 0x%08x 0x%08x 0x%08x \"%s\"",
-- 
2.47.3

[PATCH v2025.09.y 04/58] mci: am654-sdhci: Wait for transfer complete interrupt with MMC_RSP_BUSY cmd

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

The MMC_RSP_BUSY flag indicates that we have to wait for the transfer
completion interrupt. Other SDHCI drivers do this, but the am654 driver
missed it.

(cherry picked from commit 0b7c6416b9684a2c304cf18366c5feb3b4a38867)

Link: https://lore.barebox.org/20250828113442.3543907-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/mci/am654-sdhci.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/mci/am654-sdhci.c b/drivers/mci/am654-sdhci.c
index bb67c8bf4693..4ceea226f717 100644
--- a/drivers/mci/am654-sdhci.c
+++ b/drivers/mci/am654-sdhci.c
@@ -458,7 +458,7 @@ static int am654_sdhci_send_cmd(struct mci_host *mci, struct mci_cmd *cmd,
 				struct mci_data *data)
 {
 	struct am654_sdhci_plat *host = container_of(mci, struct am654_sdhci_plat, mci);
-	u32 command, xfer;
+	u32 mask, command, xfer;
 	int ret;
 	dma_addr_t dma;
 
@@ -468,6 +468,10 @@ static int am654_sdhci_send_cmd(struct mci_host *mci, struct mci_cmd *cmd,
 
 	sdhci_write32(&host->sdhci, SDHCI_INT_STATUS, ~0);
 
+	mask = SDHCI_INT_CMD_COMPLETE;
+	if (cmd->resp_type & MMC_RSP_BUSY)
+		mask |= SDHCI_INT_XFER_COMPLETE;
+
 	sdhci_write8(&host->sdhci, SDHCI_TIMEOUT_CONTROL, 0xe);
 
 	sdhci_setup_data_dma(&host->sdhci, data, &dma);
@@ -480,7 +484,7 @@ static int am654_sdhci_send_cmd(struct mci_host *mci, struct mci_cmd *cmd,
 	sdhci_write32(&host->sdhci, SDHCI_ARGUMENT, cmd->cmdarg);
 	sdhci_write16(&host->sdhci, SDHCI_COMMAND, command);
 
-	ret = sdhci_wait_for_done(&host->sdhci, SDHCI_INT_CMD_COMPLETE);
+	ret = sdhci_wait_for_done(&host->sdhci, mask);
 	if (ret) {
 		sdhci_teardown_data(&host->sdhci, data, dma);
 		goto error;
-- 
2.47.3

[PATCH v2025.09.y 05/58] video: simplefb-client: switch to dev_get_resource

[Ahmad Fatoum]

From: Ivaylo Ivanov <ivo.ivanov.ivanov1@gmail.com>

If the framebuffer memory resource resides in ram, it has already
been requested and mapped, so only get the resource to avoid
requesting a busy resource. This is also the approach for linux.

While at it, use IOMEM for mem->start and drop an unnecessary newline.

(cherry picked from commit c31d855177ff9390876378885d7f8352411cb40b)

Signed-off-by: Ivaylo Ivanov <ivo.ivanov.ivanov1@gmail.com>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20250902140006.1410408-2-ivo.ivanov.ivanov1@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/video/simplefb-client.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/video/simplefb-client.c b/drivers/video/simplefb-client.c
index 1c0ee3e7d426..d4e36df61298 100644
--- a/drivers/video/simplefb-client.c
+++ b/drivers/video/simplefb-client.c
@@ -97,7 +97,7 @@ static int simplefb_probe(struct device *dev)
 	if (ret)
 		return ret;
 
-	mem = dev_request_mem_resource(dev, 0);
+	mem = dev_get_resource(dev, IORESOURCE_MEM, 0);
 	if (IS_ERR(mem)) {
 		dev_err(dev, "No memory resource\n");
 		return PTR_ERR(mem);
@@ -117,7 +117,7 @@ static int simplefb_probe(struct device *dev)
 	info->blue = params.format->blue;
 	info->transp = params.format->transp;
 
-	info->screen_base = (void *)mem->start;
+	info->screen_base = IOMEM(mem->start);
 	info->screen_size = resource_size(mem);
 
 	/*
-- 
2.47.3

[PATCH v2025.09.y 06/58] MIPS: qemu-malta_defconfig: Use largest possible relocation table

[Ahmad Fatoum]

From: Tobias Waldekranz <tobias@waldekranz.com>

With the upcoming device-mapper selftest, enabling CONFIG_DISK and
CONFIG_DM_BLK pushed the resulting relocation table over the 0x8000
default.

Given that the target hardware is QEMU, RAM is unlikely to be a scarce
resource. Therefore, go for the maximum allowed to avoid being back
here again when the next thing is added.

(cherry picked from commit 42226e38383a35b2e56fc9ad548c29da3ca497ff)

Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Link: https://lore.barebox.org/20250909131843.2260573-6-tobias@waldekranz.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/mips/configs/qemu-malta_defconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/configs/qemu-malta_defconfig b/arch/mips/configs/qemu-malta_defconfig
index 5f2b4470b817..e5bc8ff8cbc5 100644
--- a/arch/mips/configs/qemu-malta_defconfig
+++ b/arch/mips/configs/qemu-malta_defconfig
@@ -1,3 +1,4 @@
+CONFIG_MIPS_RELOCATION_TABLE_SIZE=0x10000
 CONFIG_BOARD_QEMU_MALTA=y
 CONFIG_IMAGE_COMPRESSION_XZKERN=y
 CONFIG_NAME="qemu-malta_defconfig"
-- 
2.47.3

[PATCH v2025.09.y 07/58] firmware: handle firmware files being links correctly

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

Sometimes firmware files can be links. When rebuilding barebox correctly
rebuilds the firmware when file the link points to is updated, but the
firmware is not rebuilt when the link itself is changed to link to
another file.

Fix this by including the sha256sum directly in the generated assembly
file by using .byte rather than generating a file containing the
binary sha256sum and include that using .incbin. This way the generated
assembly file for sure changes when the firmware file changes and it's
rebuilt when necessary (and not when it's not).

Reproducer:

export ARCH=arm
make imx_v8_defconfig
echo foo > firmware/foo
echo bar > firmware/bar
ln -sf foo firmware/imx8mm-bl31.bin
make

The following should rebuild the barebox image including the updated
firmware, but doesn't:

ln -sf bar firmware/imx8mm-bl31.bin
make

(cherry picked from commit 3065a332e49881a892e4a6230069bc3923952b18)

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20250917095834.2727068-1-s.hauer@pengutronix.de
Link: https://lore.barebox.org/20250917130505.2972322-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 firmware/Makefile | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/firmware/Makefile b/firmware/Makefile
index 0c9da2996ffc..1fe770a2d900 100644
--- a/firmware/Makefile
+++ b/firmware/Makefile
@@ -57,6 +57,10 @@ FWSTR     = $(subst /,_,$(subst .,_,$(subst -,_,$(FWNAME))))
 FWNAME_EXISTS = $(if $(wildcard $(FIRMWARE_DIR)/$(FWNAME)),1,0)
 
 filechk_fwbin = { \
+	SHA=$$(sha256sum $(FIRMWARE_DIR)/$(FWNAME) |		\
+		sed 's/ .*$$//;s/../0x&, /g;s/, $$//')		\
+		2>/dev/null					;\
+	\
 	echo "/* Generated by $(src)/Makefile */"		;\
 	echo "\#include <asm-generic/pointer.h>"		;\
 	echo ".section .note.GNU-stack,\"\",%progbits"		;\
@@ -80,29 +84,26 @@ filechk_fwbin = { \
 	echo "    .p2align ASM_LGPTR"				;\
 	echo ".global _fw_$(FWSTR)_sha_start"			;\
 	echo "_fw_$(FWSTR)_sha_start:"				;\
-	echo "    .incbin \"$(fwobjdir)/$(FWNAME).sha.bin\""	;\
+	echo "    .byte $${SHA}"				;\
 	echo ".global _fw_$(FWSTR)_sha_end"			;\
 	echo "_fw_$(FWSTR)_sha_end:"				;\
+	echo "\#if $(FWNAME_EXISTS)"				;\
+	echo ".if _fw_$(FWSTR)_sha_start + 32 - _fw_$(FWSTR)_sha_end";\
+	echo ".error \"sha256sum invalid\""			;\
+	echo ".endif"						;\
+	echo "\#endif"						;\
 }
 
 filechk_fwbin_ext = { \
 	$(filechk_fwbin)					;\
 }
 
-$(obj)/%.gen.S: $(obj)/%.sha.bin FORCE
+$(obj)/%.gen.S: FORCE
 	$(call filechk,fwbin,.rodata.$(FWSTR),)
 
-$(obj)/%.extgen.S: $(obj)/%.sha.bin FORCE
+$(obj)/%.extgen.S: FORCE
 	$(call filechk,fwbin_ext,.pblext.$(FWSTR),a)
 
-$(obj)/%.sha.bin: $(obj)/%.sum FORCE
-	$(call if_changed,sha256bin)
-
-$(obj)/%.sum: FORCE
-	$(if $(wildcard $(FIRMWARE_DIR)/$*), $(call if_changed,sha256sum,$(FIRMWARE_DIR)/$*), @touch $@)
-
-clean-files += *.sha.bin *.sum
-
 # This dependency is used if missing firmware should fail the build immediately
 fwdep-required-y = $(FIRMWARE_DIR)/%
 # This dependency expands to nothing if the file doesn't exist. This allows
-- 
2.47.3

[PATCH v2025.09.y 08/58] drivers: don't propagate of_alias_get_id's -ENODEV out of probe

[Ahmad Fatoum]

of_alias_get_id() returns -ENODEV on failure and propagating it gives
the user nothing to hint at there being a problem, so let's improve upon
that by either falling back to dynamic ID selections if possible or
returning a more fitting error code instead.

(cherry picked from commit e688d63a116a3288500b1f6324d26282f1ed4238)

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251113075904.990058-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/gpio/gpio-clps711x.c  |  2 +-
 drivers/gpio/gpio-imx.c       |  5 ++---
 drivers/gpio/gpio-mxs.c       |  2 +-
 drivers/gpio/gpio-omap.c      |  5 ++---
 drivers/gpio/gpio-orion.c     |  5 ++---
 drivers/gpio/gpio-vf610.c     | 14 ++++----------
 drivers/spi/imx_spi.c         |  5 +----
 drivers/usb/imx/imx-usb-phy.c |  2 +-
 drivers/usb/musb/phy-am335x.c |  3 +--
 9 files changed, 15 insertions(+), 28 deletions(-)

diff --git a/drivers/gpio/gpio-clps711x.c b/drivers/gpio/gpio-clps711x.c
index a59bdd212a9c..8b8e91b825c5 100644
--- a/drivers/gpio/gpio-clps711x.c
+++ b/drivers/gpio/gpio-clps711x.c
@@ -15,7 +15,7 @@ static int clps711x_gpio_probe(struct device *dev)
 	struct bgpio_chip *bgc;
 
 	if (id < 0 || id > 4)
-		return -ENODEV;
+		return -EINVAL;
 
 	iores = dev_request_mem_resource(dev, 0);
 	if (IS_ERR(iores))
diff --git a/drivers/gpio/gpio-imx.c b/drivers/gpio/gpio-imx.c
index d9499c66cdae..31c62a251bee 100644
--- a/drivers/gpio/gpio-imx.c
+++ b/drivers/gpio/gpio-imx.c
@@ -135,9 +135,8 @@ static int imx_gpio_probe(struct device *dev)
 	imxgpio->chip.ops = &imx_gpio_ops;
 	if (dev->id < 0) {
 		imxgpio->chip.base = of_alias_get_id(dev->of_node, "gpio");
-		if (imxgpio->chip.base < 0)
-			return imxgpio->chip.base;
-		imxgpio->chip.base *= 32;
+		if (imxgpio->chip.base >= 0)
+			imxgpio->chip.base *= 32;
 	} else {
 		imxgpio->chip.base = dev->id * 32;
 	}
diff --git a/drivers/gpio/gpio-mxs.c b/drivers/gpio/gpio-mxs.c
index df698eb19167..00a9b72dfc86 100644
--- a/drivers/gpio/gpio-mxs.c
+++ b/drivers/gpio/gpio-mxs.c
@@ -112,7 +112,7 @@ static int mxs_gpio_probe(struct device *dev)
 	if (dev->id < 0) {
 		id = of_alias_get_id(dev->of_node, "gpio");
 		if (id < 0)
-			return id;
+			return -ENOENT;
 		mxsgpio->base = dev_get_mem_region(dev->parent, 0);
 		mxsgpio->chip.base = id * 32;
 	} else {
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index ed043286b7ff..f5abd63a90f8 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -135,9 +135,8 @@ static int omap_gpio_probe(struct device *dev)
 	omapgpio->chip.ops = &omap_gpio_ops;
 	if (dev->id < 0) {
 		omapgpio->chip.base = of_alias_get_id(dev->of_node, "gpio");
-		if (omapgpio->chip.base < 0)
-			return omapgpio->chip.base;
-		omapgpio->chip.base *= 32;
+		if (omapgpio->chip.base >= 0)
+			omapgpio->chip.base *= 32;
 	} else {
 		omapgpio->chip.base = dev->id * 32;
 	}
diff --git a/drivers/gpio/gpio-orion.c b/drivers/gpio/gpio-orion.c
index 0a1b50069b98..0760205c2610 100644
--- a/drivers/gpio/gpio-orion.c
+++ b/drivers/gpio/gpio-orion.c
@@ -95,10 +95,9 @@ static int orion_gpio_probe(struct device *dev)
 	gpio->chip.ops = &orion_gpio_ops;
 
 	id = of_alias_get_id(dev->of_node, "gpio");
-	if (id < 0)
-		return id;
+	if (id >= 0)
+		gpio->chip.base = id * 32;
 
-	gpio->chip.base = id * 32;
 	gpio->chip.ngpio = 32;
 	of_property_read_u32(dev->of_node, "ngpios", &gpio->chip.ngpio);
 
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index eefbaa70230f..5ce508469eb2 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -198,22 +198,16 @@ static int vf610_gpio_probe(struct device *dev)
 		port->gpio_base = IOMEM(iores->start);
 	}
 
+	port->chip.dev = dev;
 	port->chip.ops  = &vf610_gpio_ops;
 	if (dev->id < 0) {
 		port->chip.base = of_alias_get_id(dev->of_node, "gpio");
-		if (port->chip.base < 0) {
-			ret = port->chip.base;
-			dev_dbg(dev, "Failed to get GPIO alias\n");
-			goto free_port;
-		}
+		if (port->chip.base >= 0)
+			port->chip.base *= VF610_GPIO_PER_PORT;
 	} else {
-		port->chip.base = dev->id;
+		port->chip.base = dev->id * VF610_GPIO_PER_PORT;
 	}
 
-
-	port->chip.base *= VF610_GPIO_PER_PORT;
-	port->chip.dev = dev;
-
 	return gpiochip_add(&port->chip);
 
 free_port:
diff --git a/drivers/spi/imx_spi.c b/drivers/spi/imx_spi.c
index bfb4b413ebab..941a164b7631 100644
--- a/drivers/spi/imx_spi.c
+++ b/drivers/spi/imx_spi.c
@@ -603,10 +603,7 @@ static int imx_spi_probe(struct device *dev)
 		master->num_chipselect = pdata->num_chipselect;
 		imx->cs_array = pdata->chipselect;
 	} else if (IS_ENABLED(CONFIG_OFDEVICE)) {
-		ret = of_alias_get_id(dev->of_node, "spi");
-		if (ret < 0)
-			goto err_free;
-		master->bus_num = ret;
+		master->bus_num = of_alias_get_id(dev->of_node, "spi");;
 		imx_spi_dt_probe(imx);
 	}
 
diff --git a/drivers/usb/imx/imx-usb-phy.c b/drivers/usb/imx/imx-usb-phy.c
index 3dcaa1e1f438..7f9f5bebdee0 100644
--- a/drivers/usb/imx/imx-usb-phy.c
+++ b/drivers/usb/imx/imx-usb-phy.c
@@ -154,7 +154,7 @@ static int imx_usbphy_probe(struct device *dev)
 
 	ret = of_alias_get_id(np, "usbphy");
 	if (ret < 0) {
-		dev_dbg(dev, "failed to get alias id, errno %d\n", ret);
+		ret = dev_err_probe(dev, -ENOENT, "failed to get alias id\n");
 		goto err_free;
 	}
 	imxphy->port_id = ret;
diff --git a/drivers/usb/musb/phy-am335x.c b/drivers/usb/musb/phy-am335x.c
index f2a12182e021..d3ebbef302a1 100644
--- a/drivers/usb/musb/phy-am335x.c
+++ b/drivers/usb/musb/phy-am335x.c
@@ -45,8 +45,7 @@ static int am335x_phy_probe(struct device *dev)
 
 	am_usbphy->id = of_alias_get_id(dev->of_node, "phy");
 	if (am_usbphy->id < 0) {
-		dev_err(dev, "Missing PHY id: %d\n", am_usbphy->id);
-		ret = am_usbphy->id;
+		ret = dev_err_probe(dev, -ENOENT, "Missing PHY id\n");
 		goto err_release;
 	}
 
-- 
2.47.3

[PATCH v2025.09.y 09/58] ARM: socfpga: arria10-reset-manager: release UART0

[Ahmad Fatoum]

From: Bruno Knittel <bruno.knittel@bruker.com>

UART0 is also a dedictated peripheral. Release from reset to have
earlier serial for debugging.

(cherry picked from commit 0ecec7397757dc5cfc3338c2c7f0af13b19907bd)

Signed-off-by: Bruno Knittel <bruno.knittel@bruker.com>
Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Link: https://lore.barebox.org/20251114-v2025-11-0-topic-socfpga-arria10-v1-1-e091cddacea5@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/mach-socfpga/arria10-reset-manager.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/mach-socfpga/arria10-reset-manager.c b/arch/arm/mach-socfpga/arria10-reset-manager.c
index 6f209e704520..01534cd74b87 100644
--- a/arch/arm/mach-socfpga/arria10-reset-manager.c
+++ b/arch/arm/mach-socfpga/arria10-reset-manager.c
@@ -86,6 +86,7 @@ void arria10_reset_deassert_dedicated_peripherals(void)
 	mask = ARRIA10_RSTMGR_PER1MODRST_I2C3 |
 	       ARRIA10_RSTMGR_PER1MODRST_I2C4 |
 	       ARRIA10_RSTMGR_PER1MODRST_I2C2 |
+	       ARRIA10_RSTMGR_PER1MODRST_UART0 |
 	       ARRIA10_RSTMGR_PER1MODRST_UART1 |
 	       ARRIA10_RSTMGR_PER1MODRST_GPIO2;
 	clrbits_le32(ARRIA10_RSTMGR_ADDR + ARRIA10_RSTMGR_PER1MODRST, mask);
-- 
2.47.3

[PATCH v2025.09.y 10/58] bug: add support for CONFIG_DEBUG_BUGVERBOSE

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

This can be used to remove panic strings from barebox, when there is no
way to look at them anyway.

Also add a CONFIG_BUG symbol as it will make it easier to port kernel
code that checks for the symbol without having to patch it.

(cherry picked from commit 32755105119edba33ec62b13217381610b04e4a8)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20251128125616.136559-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/Kconfig            | 11 +++++++++++
 include/asm-generic/bug.h | 26 +++++++++++++++++++-------
 2 files changed, 30 insertions(+), 7 deletions(-)

diff --git a/common/Kconfig b/common/Kconfig
index 3a2044585a3d..c01e53eef31d 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -902,6 +902,17 @@ config PBL_CONSOLE
 	  must be running at the address it's linked at and bss must
 	  be cleared. On ARM that would be after setup_c().
 
+config BUG
+	def_bool y
+
+config DEBUG_BUGVERBOSE
+	bool "Verbose BUG() reporting"
+	depends on BUG
+	default y
+	help
+	  Say Y here to make WARN_ONCE() and BUG() panics output the file name
+	  and line number of the BUG/WARN call as well as the EIP and oops trace.
+
 source "common/ratp/Kconfig"
 
 config PARTITION
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 389327adfc5d..ca75b1c7646e 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -6,15 +6,27 @@
 #include <linux/compiler.h>
 #include <printf.h>
 
-#define BUG() do { \
-	printf("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __FUNCTION__); \
-	panic("BUG!"); \
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+#define __bug_printf printf
+#define __bug_panic panic
+#define __bug_dump_stack dump_stack
+#else
+#define __bug_printf no_printf
+#define __bug_panic panic_no_stacktrace
+#define __bug_dump_stack (void)0
+#endif
+
+#define BUG() do {						\
+	__bug_printf("BUG: failure at %s:%d/%s()!\n",		\
+		     __FILE__, __LINE__, __FUNCTION__);		\
+	__bug_panic("BUG!"); \
 } while (0)
 #define BUG_ON(condition) do { if (unlikely((condition)!=0)) BUG(); } while(0)
 
 
-#define __WARN() do { 								\
-	printf("WARNING: at %s:%d/%s()!\n", __FILE__, __LINE__, __FUNCTION__);	\
+#define __WARN() do { 							\
+	__bug_printf("WARNING: at %s:%d/%s()!\n",			\
+		     __FILE__, __LINE__, __FUNCTION__);			\
 } while (0)
 
 #ifndef WARN_ON
@@ -31,7 +43,7 @@
 	int __ret_warn_on = !!(condition);				\
 	if (unlikely(__ret_warn_on)) {					\
 		__WARN();						\
-		printf("WARNING: " format);				\
+		__bug_printf("WARNING: " format);			\
 	}								\
 	unlikely(__ret_warn_on);					\
 })
@@ -44,7 +56,7 @@
 	if (unlikely(__ret_warn_once)) {	\
 		if (WARN(!__warned, format)) {	\
 			__warned = 1;		\
-			dump_stack();		\
+			__bug_dump_stack();	\
 		}				\
 	}					\
 	unlikely(__ret_warn_once);		\
-- 
2.47.3

[PATCH v2025.09.y 11/58] driver: implement get_free_deviceid_from()

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

get_free_deviceid() starts looking for a free device ID starting from
zero. Add get_free_deviceid_from() which takes a start ID to look from
which is useful when some lower device IDs shall be reserved, for
example by device tree aliases.

(cherry picked from commit 0850fd8e22fa5d270000dc5267416884e9fb9770)

Link: https://lore.barebox.org/20251208-nvmem-eeprom-v1-1-41ba588e2f3a@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/base/driver.c | 10 ++++------
 include/driver.h      |  7 ++++++-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index 61118385f1df..f15b252ea318 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -95,14 +95,12 @@ static struct device *get_device_by_name_id(const char *name, int id)
 	return NULL;
 }
 
-int get_free_deviceid(const char *name_template)
+int get_free_deviceid_from(const char *name_template, int id_from)
 {
-	int i = 0;
-
 	while (1) {
-		if (!get_device_by_name_id(name_template, i))
-			return i;
-		i++;
+		if (!get_device_by_name_id(name_template, id_from))
+			return id_from;
+		id_from++;
 	};
 }
 
diff --git a/include/driver.h b/include/driver.h
index 143ca18e4e39..6c7751bbb419 100644
--- a/include/driver.h
+++ b/include/driver.h
@@ -124,7 +124,12 @@ struct device *find_device(const char *str);
  * appending a number to the template. Dynamically created devices should
  * use this function rather than filling the id field themselves.
  */
-int get_free_deviceid(const char *name_template);
+int get_free_deviceid_from(const char *name_template, int id_from);
+
+static inline int get_free_deviceid(const char *name_template)
+{
+	return get_free_deviceid_from(name_template, 0);
+}
 
 int dev_add_alias(struct device *dev, const char *fmt, ...) __printf(2, 3);
 
-- 
2.47.3

[PATCH v2025.09.y 12/58] sandbox: fix make dependency for sandbox

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

The final barebox ELF didn't have a dependency on barebox.o, which means
that the final executable wasn't always updated.

Fix this by adding barebox.o into BAREBOX_PIGGY_OBJS, as the .elf
rule already has $(BAREBOX_PIGGY_OBJS) as dependency.

(cherry picked from commit 82854ee1ff6d63469cf3bd4a714371afc9508eec)

Fixes: 2aba0017c95a ("sandbox: switch to using PBL")
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260105081251.3244288-2-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 images/Makefile         | 2 ++
 images/Makefile.sandbox | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/images/Makefile b/images/Makefile
index 7406aee817a3..beb262acc144 100644
--- a/images/Makefile
+++ b/images/Makefile
@@ -58,6 +58,8 @@ $(pbl-lds): $(obj)/../arch/$(SRCARCH)/lib/pbl.lds.S FORCE
 
 ifeq ($(CONFIG_PBL_IMAGE_NO_PIGGY),)
 BAREBOX_PIGGY_OBJS = $(obj)/piggy.o $(obj)/sha_sum.o
+else
+BAREBOX_PIGGY_OBJS = $(obj)/../$(BAREBOX_PROPER)
 endif
 
 quiet_cmd_elf__ ?= LD      $@
diff --git a/images/Makefile.sandbox b/images/Makefile.sandbox
index 5f94b6e589e8..210a7bf48ac8 100644
--- a/images/Makefile.sandbox
+++ b/images/Makefile.sandbox
@@ -21,7 +21,7 @@ endif
 quiet_cmd_elf__ = LD      $@
       cmd_elf__ = $(linker) -o $@ $(BAREBOX_LDFLAGS) \
 	-Wl,-T,$(pbl-lds) -Wl,--defsym=main=$(2) -Wl,--whole-archive \
-	$(obj)/../$(BAREBOX_PROPER) $(BAREBOX_PBL_OBJS) -Wl,--no-whole-archive \
+	$(BAREBOX_PIGGY_OBJS) $(BAREBOX_PBL_OBJS) -Wl,--no-whole-archive \
 	-lrt -pthread $(SANDBOX_LIBS) $(LDFLAGS_$(@F))
 
 ifeq ($(CONFIG_FUZZ_EXTERNAL),y)
-- 
2.47.3

[PATCH v2025.09.y 13/58] gpio: Fix GPIOD_ASIS flag

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

GPIOs can be requested with GPIOD_ASIS and with this the GPIO should be
kept in its current state. This doesn't work currently as GPIOD_ASIS is
defined as 0 and the flags are then interpreted as GPIOF_INIT_LOW (also
0).

To fix this set GPIOD_ASIS to a bit value which makes it a flag which
can be explicitly tested for.

Note this is different than in Linux. Linux defines GPIOD_ASIS to 0 just
like barebox did, but in Linux the other GPIOD_* flags have an explicit
"change this setting" flag which we don't have in barebox. Introducing
these flags in barebox would mean we have to add the "change this
setting" flags in various other places, like for example
gpiod_request_one().

Motivation for this patch is the only current user of GPIOD_ASIS, the
fixed regulator driver. Without this patch regulators will already be
enabled in the fixed regulator drivers probe function.

(cherry picked from commit 6436a1dc83dd98c38b119a7efbe8b0a999172749)

Link: https://lore.barebox.org/20260105-riotboard-v1-3-789b844d7e36@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/gpio/gpiolib.c        | 15 +++++++++------
 include/gpio.h                |  2 ++
 include/linux/gpio/consumer.h |  2 +-
 3 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index ec4d8e889bb1..e1493ffb6640 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -622,6 +622,7 @@ static int gpiodesc_request_one(struct gpio_desc *desc, unsigned long lflags,
 	const bool logical     = (dflags & GPIOF_LOGICAL) == GPIOF_LOGICAL;
 	const bool init_active = (dflags & GPIOF_INIT_ACTIVE) == GPIOF_INIT_ACTIVE;
 	const bool init_high   = (dflags & GPIOF_INIT_HIGH) == GPIOF_INIT_HIGH;
+	const bool set         = (dflags & GPIOF_ASIS) == GPIOF_ASIS;
 
 	err = gpiodesc_request(desc, label);
 	if (err)
@@ -631,12 +632,14 @@ static int gpiodesc_request_one(struct gpio_desc *desc, unsigned long lflags,
 	if (active_low)
 		desc->flags |= OF_GPIO_ACTIVE_LOW;
 
-	if (dir_in)
-		err = gpiod_direction_input(desc);
-	else if (logical)
-		err = gpiod_direction_output(desc, init_active);
-	else
-		err = gpiod_direction_output_raw(desc, init_high);
+	if (!set) {
+		if (dir_in)
+			err = gpiod_direction_input(desc);
+		else if (logical)
+			err = gpiod_direction_output(desc, init_active);
+		else
+			err = gpiod_direction_output_raw(desc, init_high);
+	}
 
 	if (err)
 		gpiodesc_free(desc);
diff --git a/include/gpio.h b/include/gpio.h
index 92fd27b2b996..2264d0c495a4 100644
--- a/include/gpio.h
+++ b/include/gpio.h
@@ -114,6 +114,8 @@ static inline int gpio_is_valid(int gpio)
 #define GPIOF_OUT_INIT_ACTIVE	(GPIOF_DIR_OUT | GPIOF_INIT_ACTIVE)
 #define GPIOF_OUT_INIT_INACTIVE	(GPIOF_DIR_OUT | GPIOF_INIT_INACTIVE)
 
+#define GPIOF_ASIS	BIT(4)
+
 /**
  * struct gpio - a structure describing a GPIO with configuration
  * @gpio:	the GPIO number
diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
index c461f3f3108b..a425145351b0 100644
--- a/include/linux/gpio/consumer.h
+++ b/include/linux/gpio/consumer.h
@@ -13,7 +13,7 @@
  * and output value. These values cannot be OR'd.
  */
 enum gpiod_flags {
-	GPIOD_ASIS	= 0,
+	GPIOD_ASIS	= GPIOF_ASIS,
 	GPIOD_IN	= GPIOF_IN,
 	/*
 	 * To change this later to a different logic level (i.e. taking
-- 
2.47.3

[PATCH v2025.09.y 14/58] i.MX: HAB: fix field return unlock fuse uid

[Ahmad Fatoum]

From: Fabian Pflug <f.pflug@pengutronix.de>

The HABV4_CSF_UNLOCK_UID is not dependendend on HAB_CERTS_ENV, but just
the HABV4_CSF_UNLOCK_FIELD_RETURN.

The CST tool can't handle quoted UID strings so we need to define it on
the cmdline by using the -D switch. This removes the quotes within the
CSF file and the CST is happy.

(cherry picked from commit 84515796f00d28a3d286ace56e69d89ee5751565)

Signed-off-by: Fabian Pflug <f.pflug@pengutronix.de>
Link: https://lore.barebox.org/20251219-v2025-11-0-topic-imx6-field-return-v4-1-57eec237ceaf@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/mach-imx/Kconfig            | 33 ++++++++++++++--------------
 include/mach/imx/habv4-imx8-gencsf.h |  2 +-
 scripts/Makefile.lib                 |  2 +-
 3 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 0d745ce23158..4290b5888078 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -847,6 +847,23 @@ config HABV4_CSF_UNLOCK_FIELD_RETURN
 	  that the CONFIG_HABV4_CSF_UNLOCK_UID is set correct as
 	  well.
 
+config HABV4_CSF_UNLOCK_UID
+	depends on HABV4 && HABV4_CSF_UNLOCK_FIELD_RETURN
+	string "CSF Unlock UID"
+	help
+	  Device specific 64-bit UID required to unlock the field-return
+	  feature. This value must match the per device UNIQUE_ID fuses.
+
+	  The below example shows the expected format. The UNIQUE_ID is
+	  printed during boot by barebox:
+	    i.MX___ unique ID: 7766554433221100
+	  or it can be queried by Linux via:
+	    - cat /sys/devices/soc0/serial_number
+	      7766554433221100
+
+	  So this value have to be set:
+	    - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
+
 config HAB_CERTS_ENV
 	depends on HAB
 	bool "Specify certificates in environment"
@@ -867,7 +884,6 @@ config HAB_CERTS_ENV
 
 	  CONFIG_HABV4_TABLE_BIN
 	  CONFIG_HABV4_CSF_CRT_PEM
-	  CONFIG_HABV4_CSF_UNLOCK_UID
 	  CONFIG_HABV4_IMG_CRT_PEM
 
 config HABV4_SRK_INDEX
@@ -902,21 +918,6 @@ config HABV4_CSF_CRT_PEM
 	  This file will be inserted into the Command Sequence File
 	  (CSF) when using the CSF template that comes with barebox.
 
-config HABV4_CSF_UNLOCK_UID
-	depends on HABV4 && HABV4_CSF_UNLOCK_FIELD_RETURN
-	string "CSF Unlock UID"
-	help
-	  Device specific 64-bit UID Required to unlock the field-return
-          feature. This value must match the per device UNIQUE_ID fuses.
-
-	  The below example shows the expected format. The UNIQUE_ID is
-	  queried by Linux via:
-            - cat /sys/devices/soc0/serial_number
-	      7766554433221100
-
-	  So this value have to be set:
-	    - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
-
 config HABV4_IMG_CRT_PEM
 	string "Path to IMG certificate"
 	default "../crts/IMG1_1_sha256_4096_65537_v3_usr_crt.pem"
diff --git a/include/mach/imx/habv4-imx8-gencsf.h b/include/mach/imx/habv4-imx8-gencsf.h
index 480f88fa9552..d3fe3e34c68e 100644
--- a/include/mach/imx/habv4-imx8-gencsf.h
+++ b/include/mach/imx/habv4-imx8-gencsf.h
@@ -46,7 +46,7 @@ hab Features = SRK REVOKE
 hab [Unlock]
 hab Engine = OCOTP
 hab Features = FIELD RETURN
-hab UID = HABV4_CSF_UNLOCK_UID
+hab UID = CONFIG_HABV4_CSF_UNLOCK_UID
 #endif
 
 hab [Install Key]
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 2128361b3ae3..1c8a5ed06c53 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -585,7 +585,7 @@ imxcfg_cpp_flags  = -Wp,-MD,$(depfile) -nostdinc -x assembler-with-cpp \
       $(call overwrite-hab-env,CONFIG_HABV3_IMG_CRT_DER) \
       $(call overwrite-hab-env,CONFIG_HABV4_TABLE_BIN) \
       $(call overwrite-hab-env,CONFIG_HABV4_CSF_CRT_PEM) \
-      $(call overwrite-hab-env,CONFIG_HABV4_CSF_UNLOCK_UID) \
+      -DCONFIG_HABV4_CSF_UNLOCK_UID=$(CONFIG_HABV4_CSF_UNLOCK_UID) \
       $(call overwrite-hab-env,CONFIG_HABV4_IMG_CRT_PEM) \
 
 dcd-tmp = $(subst $(comma),_,$(dot-target).dcd.tmp)
-- 
2.47.3

[PATCH v2025.09.y 15/58] ARM: cpu: common: skip R_ARM_NONE relocations

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

Relocations may be turned into no-op in place by strip running on an
executable by having their type set to 0 (R_ARM_NONE).

This can happen with the incoming ELF loading in PBL support, so teach
relocate_to_current_adr() to skip these no-op relocation entries.

(cherry picked from commit 9ef816e176d9ace3a88911e37eb280552c2223e4)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260106081659.3491945-1-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/cpu/common.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/arch/arm/cpu/common.c b/arch/arm/cpu/common.c
index 339ef2db2534..5b65b0745b98 100644
--- a/arch/arm/cpu/common.c
+++ b/arch/arm/cpu/common.c
@@ -36,6 +36,7 @@ void sync_caches_for_execution(void)
 	arm_early_mmu_cache_flush();
 }
 
+#define R_ARM_NONE 0
 #define R_ARM_RELATIVE 23
 #define R_AARCH64_RELATIVE 1027
 
@@ -78,14 +79,19 @@ void __prereloc relocate_to_current_adr(void)
 #if defined(CONFIG_CPU_64)
 	while (dstart < dend) {
 		struct elf64_rela *rel = dstart;
+		unsigned long *fixup;
 
-		if (ELF64_R_TYPE(rel->r_info) == R_AARCH64_RELATIVE) {
-			unsigned long *fixup = (unsigned long *)(rel->r_offset + offset);
+		switch(ELF64_R_TYPE(rel->r_info)) {
+		case R_AARCH64_RELATIVE:
+			fixup = (unsigned long *)(rel->r_offset + offset);
 
 			*fixup = rel->r_addend + offset;
 			rel->r_addend += offset;
 			rel->r_offset += offset;
-		} else {
+			break;
+		case R_ARM_NONE:
+			break;
+		default:
 			putc_ll('>');
 			puthex_ll(rel->r_info);
 			putc_ll(' ');
@@ -104,20 +110,26 @@ void __prereloc relocate_to_current_adr(void)
 
 	while (dstart < dend) {
 		struct elf32_rel *rel = dstart;
+		unsigned long r, *fixup;
 
-		if (ELF32_R_TYPE(rel->r_info) == R_ARM_RELATIVE) {
-			unsigned long *fixup = (unsigned long *)(rel->r_offset + offset);
+		switch (ELF32_R_TYPE(rel->r_info)) {
+		case R_ARM_RELATIVE:
+			fixup = (unsigned long *)(rel->r_offset + offset);
 
 			*fixup = *fixup + offset;
 
 			rel->r_offset += offset;
-		} else if (ELF32_R_TYPE(rel->r_info) == R_ARM_ABS32) {
-			unsigned long r = dynsym[ELF32_R_SYM(rel->r_info) * 4 + 1];
-			unsigned long *fixup = (unsigned long *)(rel->r_offset + offset);
+			break;
+		case R_ARM_ABS32:
+			r = dynsym[ELF32_R_SYM(rel->r_info) * 4 + 1];
+			fixup = (unsigned long *)(rel->r_offset + offset);
 
 			*fixup = *fixup + r + offset;
 			rel->r_offset += offset;
-		} else {
+			break;
+		case R_ARM_NONE:
+			break;
+		default:
 			putc_ll('>');
 			puthex_ll(rel->r_info);
 			putc_ll(' ');
-- 
2.47.3

[PATCH v2025.09.y 16/58] mmc: resolve conflict between MMC_CAP_NONREMOVABLE and MMC_CAP_1_8V_DDR

[Ahmad Fatoum]

From: zhengxiaojun <zheng.xiaojun@foxmail.com>

Resolve conflict between MMC_CAP_NONREMOVABLE and MMC_CAP_1_8V_DDR.

(cherry picked from commit cf4a68050d630d63723280c50b207217577b6ef0)

Fixes: a382be0b4f ("mci: add option to detect non-removable cards during startup")
Signed-off-by: zhengxiaojun <zheng.xiaojun at foxmail.com>
Link: https://lore.barebox.org/tencent_C5E0959753A838615BF48C3792E12BC74A08@qq.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 include/mci.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/mci.h b/include/mci.h
index 3db33f914236..50214aaae7bb 100644
--- a/include/mci.h
+++ b/include/mci.h
@@ -58,7 +58,7 @@
 #define MMC_CAP_1_2V_DDR		(1 << 9)	/* Host supports eMMC DDR 1.2V */
 #define MMC_CAP_DDR			(MMC_CAP_3_3V_DDR | MMC_CAP_1_8V_DDR | \
 					 MMC_CAP_1_2V_DDR)
-#define MMC_CAP_NONREMOVABLE	(1 << 8)	/* Nonremovable e.g. eMMC */
+#define MMC_CAP_NONREMOVABLE	(1 << 10)	/* Nonremovable e.g. eMMC */
 #define MMC_CAP_UHS_SDR12	(1 << 16)	/* Host supports UHS SDR12 mode */
 #define MMC_CAP_UHS_SDR25	(1 << 17)	/* Host supports UHS SDR25 mode */
 #define MMC_CAP_UHS_SDR50	(1 << 18)	/* Host supports UHS SDR50 mode */
-- 
2.47.3

[PATCH v2025.09.y 17/58] virtio: ring: fix stale data in queue after reset

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

When resetting barebox for QEMU Virt or chainloading it, the log is
spammed with:

  virtio_net virtio1: id 65536 out of range

This is because we have two ways to allocate the vrings, either via
dma_alloc_coherent or memalign and the latter doesn't zero the queues.

A better fix that makes use of the DMA APIs unconditionally will follow
in a later release.

Co-developed-by: Claude <noreply@claude.ai>
[ahmad: Claude was pointed at QEMU, Linux and U-Boot implementations
 and found the discrepancy, but had a different less efficient fix]

(cherry picked from commit 40339821fad1a97afdd1d9ffcc3e97d21bf09c3d)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260112085548.2952525-1-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/virtio/virtio_ring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index c1c84e49615f..8b6469f54d2a 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -369,6 +369,8 @@ static void *vring_alloc_queue(struct virtio_device *vdev,
 			phys_addr_t phys_addr = virt_to_phys(queue);
 			*dma_handle = (dma_addr_t)phys_addr;
 
+			memset(queue, 0x00, PAGE_ALIGN(size));
+
 			/*
 			 * Sanity check: make sure we dind't truncate
 			 * the address.  The only arches I can find that
-- 
2.47.3

[PATCH v2025.09.y 18/58] scripts: Makefile.lib: suppress graph_port warnings for overlays

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

In overlays, often only part of a graph is applied with the rest in the
base device tree, so this warning is seldom useful. Disable it.

(cherry picked from commit c28e8f55611cf8c3d104a245bdffb33ccae5f90e)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260112085548.2952525-2-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 scripts/Makefile.lib | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 1c8a5ed06c53..b44cb3b9ea8a 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -390,7 +390,7 @@ ifeq ($(CONFIG_OF_OVERLAY_LIVE), y)
 DTC_FLAGS.dtb += -@
 endif
 
-DTC_FLAGS.dtbo += -Wno-avoid_default_addr_size -Wno-reg_format
+DTC_FLAGS.dtbo += -Wno-avoid_default_addr_size -Wno-reg_format -Wno-graph_port
 
 # Generate an assembly file to wrap the output of the device tree compiler
 quiet_cmd_dt_S_dtb = DTB     $@
-- 
2.47.3

[PATCH v2025.09.y 19/58] ARM: Rockchip: rk3576-prtpuk: suppress video graph warning

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

The &vp0 is incomplete and results in a warning, so move it into the
comment.

(cherry picked from commit b99251cf3c3ea3efc405057bbce8b2435d36fe5d)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260112085548.2952525-3-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/dts/rk3576-prtpuk-linux.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/dts/rk3576-prtpuk-linux.dts b/arch/arm/dts/rk3576-prtpuk-linux.dts
index 2085adbaa8f4..7cc28711df28 100644
--- a/arch/arm/dts/rk3576-prtpuk-linux.dts
+++ b/arch/arm/dts/rk3576-prtpuk-linux.dts
@@ -444,6 +444,7 @@ &vop_mmu {
 	status = "okay";
 };
 
+#if 0
 &vp0 {
 	vp0_out_dsi1: endpoint@ROCKCHIP_VOP2_EP_DP0 {
 		reg = <ROCKCHIP_VOP2_EP_DP0>;
@@ -451,7 +452,6 @@ vp0_out_dsi1: endpoint@ROCKCHIP_VOP2_EP_DP0 {
 	};
 };
 
-/*
 &pwm1 {
 	status = "okay";
 };
@@ -459,4 +459,4 @@ &pwm1 {
 &pwm2 {
 	status = "okay";
 };
-*/
+#endif
-- 
2.47.3

[PATCH v2025.09.y 20/58] kbuild: fold rmdirs into rmfiles

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

Linux doesn't differentiate between the two either and by adopting that,
we can have intermediary .tmp_*/ directories automatically deleted when
cleaning.

(cherry picked from commit 9914f8fdddac8ecf7fd8f3e8ab071a5fb86fb160)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260116160654.3981425-2-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 Makefile | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/Makefile b/Makefile
index d72a4551208a..8606a6576194 100644
--- a/Makefile
+++ b/Makefile
@@ -1301,8 +1301,7 @@ MRPROPER_FILES += .config .config.old .version .old_version \
 
 # clean - Delete most, but leave enough to build external modules
 #
-clean: rm-dirs  := $(CLEAN_DIRS)
-clean: rm-files := $(CLEAN_FILES)
+clean: rm-files := $(CLEAN_FILES) $(CLEAN_DIRS)
 clean-dirs      := $(addprefix _clean_,$(srctree) $(barebox-alldirs))
 
 PHONY += $(clean-dirs) clean archclean
@@ -1311,7 +1310,6 @@ $(clean-dirs):
 	$(Q)$(MAKE) $(clean)=$(patsubst _clean_%,%,$@)
 
 clean: archclean $(clean-dirs)
-	$(call cmd,rmdirs)
 	$(call cmd,rmfiles)
 	@find . $(RCS_FIND_IGNORE) \
 		\( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \
@@ -1323,8 +1321,7 @@ clean: archclean $(clean-dirs)
 
 # mrproper - Delete all generated files, including .config
 #
-mrproper: rm-dirs  := $(wildcard $(MRPROPER_DIRS))
-mrproper: rm-files := $(wildcard $(MRPROPER_FILES))
+mrproper: rm-files := $(wildcard $(MRPROPER_DIRS)) $(wildcard $(MRPROPER_FILES))
 mrproper-dirs      := $(addprefix _mrproper_,scripts)
 
 PHONY += $(mrproper-dirs) mrproper
@@ -1332,7 +1329,6 @@ $(mrproper-dirs):
 	$(Q)$(MAKE) $(clean)=$(patsubst _mrproper_%,%,$@)
 
 mrproper: clean $(mrproper-dirs)
-	$(call cmd,rmdirs)
 	$(call cmd,rmfiles)
 
 # distclean
@@ -1493,11 +1489,8 @@ target-dir = $(dir $@)
 # FIXME Should go into a make.lib or something
 # ===========================================================================
 
-quiet_cmd_rmdirs = $(if $(wildcard $(rm-dirs)),CLEAN   $(wildcard $(rm-dirs)))
-      cmd_rmdirs = rm -rf $(rm-dirs)
-
 quiet_cmd_rmfiles = $(if $(wildcard $(rm-files)),CLEAN   $(wildcard $(rm-files)))
-      cmd_rmfiles = rm -f $(rm-files)
+      cmd_rmfiles = rm -rf $(rm-files)
 
 
 a_flags = -Wp,-MD,$(depfile) $(KBUILD_AFLAGS) $(AFLAGS_KERNEL) \
-- 
2.47.3

[PATCH v2025.09.y 21/58] mtd: nand: mxc_nand: use clk_get_optional for clock handling

[Ahmad Fatoum]

From: Alexander Shiyan <eagle.alexander923@gmail.com>

On some platforms like i.MX51, the clock driver does not support GATE clocks,
and the clocks are always on. The current driver uses clk_get which fails
when the clock is not found, preventing the driver from probing.

This patch changes clk_get to clk_get_optional, allowing the driver to
continue probing even if the clock is not provided, assuming it is always
enabled.

(cherry picked from commit 092a3f95537b80c60bb9138cb4b3a7df1f751ed2)

Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Link: https://lore.barebox.org/20260114100923.1164051-1-eagle.alexander923@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/mtd/nand/raw/mxc_nand.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/nand/raw/mxc_nand.c b/drivers/mtd/nand/raw/mxc_nand.c
index de2ad2a028cb..e328eb0815c7 100644
--- a/drivers/mtd/nand/raw/mxc_nand.c
+++ b/drivers/mtd/nand/raw/mxc_nand.c
@@ -1809,7 +1809,8 @@ static int mxcnd_probe(struct device *dev)
 	nand_set_controller_data(this, host);
 	nand_set_flash_node(this, dev->of_node);
 
-	host->clk = clk_get(dev, NULL);
+	/* Clock support might not be implemented, so use the optional variant */
+	host->clk = clk_get_optional(dev, NULL);
 	if (IS_ERR(host->clk))
 		return PTR_ERR(host->clk);
 
-- 
2.47.3

[PATCH v2025.09.y 22/58] FIT: fix double free issue with >1 reference count

[Ahmad Fatoum]

fit_open() was recently changed to be reference counted. When the FIT is
already open, a handle will be returned with the canonical filename
being the only allocation incurred.

fit_close() however unconditionally frees the handle without regards to
the reference count.

Fix this and while at it, fix the memory leak for the canonical filename
as well.

(cherry picked from commit ba345a71e85e90d70c01a3a6ec06bf6258634d2c)

Reported-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Fixes: f3aadb274abe ("FIT: add support to cache opened fit images")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Link: https://lore.barebox.org/20260126104433.765071-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/image-fit.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/common/image-fit.c b/common/image-fit.c
index 6b44a79e9d1c..027b268928d3 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -1016,6 +1016,7 @@ struct fit_handle *fit_open(const char *_filename, bool verbose,
 
 	handle = fit_get_handle(filename);
 	if (handle) {
+		free(filename);
 		refcount_inc(&handle->users);
 		return handle;
 	}
@@ -1049,10 +1050,10 @@ struct fit_handle *fit_open(const char *_filename, bool verbose,
 	return handle;
 }
 
-static void __fit_close(struct fit_handle *handle)
+static bool __fit_close(struct fit_handle *handle)
 {
 	if (!refcount_dec_and_test(&handle->users))
-		return;
+		return false;
 
 	if (handle->root)
 		of_delete_node(handle->root);
@@ -1062,12 +1063,13 @@ static void __fit_close(struct fit_handle *handle)
 
 	free(handle->filename);
 	free(handle->fit_alloc);
+	return true;
 }
 
 void fit_close(struct fit_handle *handle)
 {
-	__fit_close(handle);
-	free(handle);
+	if (__fit_close(handle))
+		free(handle);
 }
 
 static int do_bootm_fit(struct image_data *data)
-- 
2.47.3

[PATCH v2025.09.y 23/58] net: phy: mdio_bus: fix freeing of cdev name before devfs_remove

[Ahmad Fatoum]

devfs_remove acces struct cdev::name to do an unlink on the path in
/dev. This leads to a use-after-free inside mdio_bus_remove.

Reorder the free after devfs_remove to fix this. This is the way that
other drivers in tree that have /free.*cdev(\.|->)name/ do it.

Issue was detected by KASAN being active during kernel boot.

(cherry picked from commit 0a67f4f35d64aa25318640ec2858c75f46d9a986)

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260126104153.547505-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/net/phy/mdio_bus.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index a7eda3f84a11..1381f70f1cf8 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -610,8 +610,8 @@ static void mdio_bus_remove(struct device *_dev)
 	if (drv->remove)
 		drv->remove(dev);
 
-	free(dev->cdev.name);
 	devfs_remove(&dev->cdev);
+	free(dev->cdev.name);
 	bus->phy_map[dev->addr] = NULL;
 }
 
-- 
2.47.3

[PATCH v2025.09.y 24/58] bootm: fix bootm override saving/restoring

[Ahmad Fatoum]

As bootm_set_overrides() only sets non-NULL members, it's not suitable
to restore old settings as once a member is non-NULL, it can't change
it.

This may lead to use-after-frees, as the original strings are free'd,
but the override keeps pointing at it.
Fix this by merging overrides only before the boot and resetting all
members after.

Fixes: d2dae53f0dc5 ("bootm: fix boot override inheritance")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260126104656.832582-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/boot.c             | 4 ++--
 common/bootm.c            | 6 +++++-
 include/bootm-overrides.h | 6 ++++--
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/common/boot.c b/common/boot.c
index 07bd288df29d..f54c812991ad 100644
--- a/common/boot.c
+++ b/common/boot.c
@@ -171,13 +171,13 @@ int boot_entry(struct bootentry *be, int verbose, int dryrun)
 		}
 	}
 
-	old = bootm_set_overrides(be->overrides);
+	old = bootm_save_overrides(be->overrides);
 
 	ret = be->boot(be, verbose, dryrun);
 	if (ret && ret != -ENOMEDIUM)
 		pr_err("Booting entry '%s' failed: %pe\n", be->title, ERR_PTR(ret));
 
-	bootm_set_overrides(old);
+	bootm_restore_overrides(old);
 
 	globalvar_set_match("linux.bootargs.dyn.", "");
 
diff --git a/common/bootm.c b/common/bootm.c
index 34c72282d6ba..0cdaf30613fc 100644
--- a/common/bootm.c
+++ b/common/bootm.c
@@ -976,13 +976,17 @@ int bootm_boot(struct bootm_data *bootm_data)
 }
 
 #ifdef CONFIG_BOOT_OVERRIDE
-struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides)
+struct bootm_overrides bootm_save_overrides(const struct bootm_overrides overrides)
 {
 	struct bootm_overrides old = bootm_overrides;
 	/* bootm_merge_overrides copies only actual (non-NULL) overrides */
 	bootm_merge_overrides(&bootm_overrides, &overrides);
 	return old;
 }
+void bootm_restore_overrides(const struct bootm_overrides overrides)
+{
+	bootm_overrides = overrides;
+}
 #endif
 
 static int do_bootm_compressed(struct image_data *img_data)
diff --git a/include/bootm-overrides.h b/include/bootm-overrides.h
index 4a270b95afcc..b807e5be310a 100644
--- a/include/bootm-overrides.h
+++ b/include/bootm-overrides.h
@@ -8,12 +8,14 @@ struct bootm_overrides {
 };
 
 #ifdef CONFIG_BOOT_OVERRIDE
-struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides_new);
+struct bootm_overrides bootm_save_overrides(const struct bootm_overrides overrides);
+void bootm_restore_overrides(const struct bootm_overrides overrides);
 #else
-static inline struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides)
+static inline struct bootm_overrides bootm_save_overrides(const struct bootm_overrides overrides)
 {
 	return (struct bootm_overrides) {};
 }
+static inline void bootm_restore_overrides(const struct bootm_overrides overrides) {}
 #endif
 
 static inline void bootm_merge_overrides(struct bootm_overrides *dst,
-- 
2.47.3

[PATCH v2025.09.y 25/58] common: tlv: Correct eth address list fixup

[Ahmad Fatoum]

From: Jonas Rebmann <jre@pengutronix.de>

The tlv_format_mac() function was written as if it would fixup a list of
MAC addresses, however that implementation was broken as it always
exited after adding the first MAC due to interpretation of any nonzero
exit value from of_property_sprintf() as an error, although it returns
the length of the resulting string upon success.

This was worked around by tlv_handle_eth_address_seq() invoking
tlv_format_mac() in a loop however tlv_handle_eth_address(), which is
specified to support an array of MAC addresses invoked tlv_format_mac()
on the list resulting in only the first MAC of that list ending up in
the devicetree fixup.

Remove the broken loop from tlv_format_mac() and clarify that it only
adds a single MAC. Fix and clean up the usage of tlv_format_mac() in
tlv_handle_eth_address() and tlv_handle_eth_address_seq().

(cherry picked from commit 925dba9ba412a4289ab13a842709b9bc501f64ab)

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
Link: https://lore.barebox.org/20260205-tlv-eth-list-fixup-v1-1-74ca31223cdb@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/tlv/barebox.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/common/tlv/barebox.c b/common/tlv/barebox.c
index b941463b31c7..f1ba79b23679 100644
--- a/common/tlv/barebox.c
+++ b/common/tlv/barebox.c
@@ -18,21 +18,26 @@ int tlv_handle_serial(struct tlv_device *dev, struct tlv_mapping *map, u16 len,
 
 int tlv_handle_eth_address(struct tlv_device *dev, struct tlv_mapping *map, u16 len, const u8 *val)
 {
+	int ret;
 	int i;
 
 	if (len % ETH_ALEN != 0)
 		return -EINVAL;
 
-	for (i = 0; i < len / ETH_ALEN; i++)
+	for (i = 0; i < len / ETH_ALEN; i++) {
 		eth_register_ethaddr(i, val + i * ETH_ALEN);
-
-	return tlv_format_mac(dev, map, len, val);
+		ret = tlv_format_mac(dev, map, ETH_ALEN, val + i * ETH_ALEN);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
 }
 
 int tlv_handle_eth_address_seq(struct tlv_device *dev, struct tlv_mapping *map, u16 len, const u8 *val)
 {
 	u8 eth_addr[ETH_ALEN];
 	int eth_count;
+	int ret;
 
 	eth_count = *val;
 
@@ -43,7 +48,9 @@ int tlv_handle_eth_address_seq(struct tlv_device *dev, struct tlv_mapping *map,
 
 	for (int i = 0; i < eth_count; i++, eth_addr_inc(eth_addr)) {
 		eth_register_ethaddr(i, eth_addr);
-		tlv_format_mac(dev, map, ETH_ALEN, eth_addr);
+		ret = tlv_format_mac(dev, map, ETH_ALEN, eth_addr);
+		if (ret < 0)
+			return ret;
 	}
 
 	return 0;
@@ -107,14 +114,15 @@ static struct device_node *of_append_node(struct device_node *root, const char *
 	return of_new_node(root, name);
 }
 
+/* add a single address-<num> entry to the property */
 int tlv_format_mac(struct tlv_device *dev, struct tlv_mapping *map, u16 len, const u8 *val)
 {
 	struct device_node *np = tlv_of_node(dev);
 	struct property *pp;
 	char propname[sizeof("address-4294967295")];
-	int base = 0, i, ret;
+	int base = 0, ret;
 
-	if (len % 6 != 0)
+	if (len != ETH_ALEN)
 		return -EINVAL;
 
 	np = of_append_node(np, map->prop);
@@ -124,12 +132,10 @@ int tlv_format_mac(struct tlv_device *dev, struct tlv_mapping *map, u16 len, con
 	for_each_property_of_node(np, pp)
 		base++;
 
-	for (i = base; i < base + len / 6; i++) {
-		snprintf(propname, sizeof(propname), "address-%u", i);
-		ret = of_property_sprintf(np, propname, "%*phC", 6, val);
-		if (ret)
-			return ret;
-	}
+	snprintf(propname, sizeof(propname), "address-%u", base);
+	ret = of_property_sprintf(np, propname, "%*phC", ETH_ALEN, val);
+	if (ret < 0)
+		return ret;
 
 	return 0;
 }
-- 
2.47.3

[PATCH v2025.09.y 26/58] common: tlv: fix link error when CONFIG_NET is disabled

[Ahmad Fatoum]

ethaddr_list and eth_of_get_fixup_node are used unconditionally in
of_tlv_fixup, but there is no dependency on CONFIG_NET for CONFIG_TLV.

Turn the ethernet-related fixup code into dead code if CONFIG_NET is
disabled and emit a warning to fix this.

(cherry picked from commit 53c72e610a314fc4a9a133e2615f0bc88af9df28)

Reported-by: 9l@9lo.re
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260205153540.2900244-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/tlv/parser.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/common/tlv/parser.c b/common/tlv/parser.c
index fc46092650b1..59d4c724f151 100644
--- a/common/tlv/parser.c
+++ b/common/tlv/parser.c
@@ -93,6 +93,11 @@ int of_tlv_fixup(struct device_node *root, void *ctx)
 	if (!ethaddrs)
 		return 0;
 
+	if (!IS_ENABLED(CONFIG_NET)) {
+		pr_warn("CONFIG_NET disabled, so skipping ethernet-address trimming in fixup\n");
+		return 0;
+	}
+
 	list_for_each_entry(addr, &ethaddr_list, list) {
 		char propname[sizeof("address-4294967295")];
 		const char *enetaddr_tlv_str;
-- 
2.47.3

[PATCH v2025.09.y 27/58] include: array_size.h: make header self-contained

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

The definition of __must_be_array is a bit hairy as it's defined in
<linux/compiler-gcc.h>, which is included by <linux/compiler_types.h>,
but has an implicit dependency on <linux/build_bug.h> for BUILD_BUG_ON_ZERO
in the definition of __must_be_array, but <linux/build_bug.h> itself
already includes <linux/compiler_types.h>.

Let's put a bandaid on this for users of ARRAY_SIZE, by including
<linux/build_bug.h> explicitly for <linux/array_size.h>.

(cherry picked from commit e15799eb76e10ae35d176145022c478874295a97)

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260209091513.3563412-2-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 include/linux/array_size.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/array_size.h b/include/linux/array_size.h
index 5411d730c819..d1ad53d950d4 100644
--- a/include/linux/array_size.h
+++ b/include/linux/array_size.h
@@ -2,7 +2,8 @@
 #ifndef _LINUX_ARRAY_SIZE_H
 #define _LINUX_ARRAY_SIZE_H
 
-#include <linux/compiler.h>
+#include <linux/compiler_types.h>
+#include <linux/build_bug.h>
 
 /**
  * ARRAY_SIZE - get the number of elements in array @arr
-- 
2.47.3

[PATCH v2025.09.y 28/58] RISC-V: dts: fix generation of dtbs-list

[Ahmad Fatoum]

From: Maud Spierings <maud_spierings@hotmail.com>

For some reason pbl-$(CONFIG) results in dtbs-list being empty. This breaks
the generic fit image generation. Switch to lwl-$(CONFIG) like arm.

(cherry picked from commit f406d6ef100dd15b2fff1fd5cad9ca9e941991e6)

Signed-off-by: Maud Spierings <maud_spierings@hotmail.com>
Link: https://lore.barebox.org/20260221-riscv_dtbs-v1-1-be58fc118bc2@hotmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/riscv/dts/Makefile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/arch/riscv/dts/Makefile b/arch/riscv/dts/Makefile
index 841f86064ae1..92cff9b84fa6 100644
--- a/arch/riscv/dts/Makefile
+++ b/arch/riscv/dts/Makefile
@@ -4,11 +4,11 @@
 # created.
 obj- += dummy.o
 
-pbl-$(CONFIG_BOARD_ERIZO_GENERIC) += erizo-generic.dtb.o
-pbl-$(CONFIG_BOARD_HIFIVE) += hifive-unmatched-a00.dtb.o \
+lwl-$(CONFIG_BOARD_ERIZO_GENERIC) += erizo-generic.dtb.o
+lwl-$(CONFIG_BOARD_HIFIVE) += hifive-unmatched-a00.dtb.o \
                               hifive-unleashed-a00.dtb.o
-pbl-$(CONFIG_BOARD_BEAGLEV) += jh7100-beaglev-starlight.dtb.o
-pbl-$(CONFIG_BOARD_LITEX_LINUX) += litex-linux.dtb.o
+lwl-$(CONFIG_BOARD_BEAGLEV) += jh7100-beaglev-starlight.dtb.o
+lwl-$(CONFIG_BOARD_LITEX_LINUX) += litex-linux.dtb.o
 
 clean-files := *.dtb *.dtb.S .*.dtc .*.pre .*.dts *.dtb.z
 clean-files += *.dtbo *.dtbo.S .*.dtso
-- 
2.47.3

[PATCH v2025.09.y 29/58] of: overlay: propagate error unflattening DTBO

[Ahmad Fatoum]

of_unflatten_dtb() may return an error pointer when parsing of the
device tree blob failed. Error pointers were not checked in
of_overlay_apply_dtbo() leading to a panic when they were later
dereferenced in of_copy_node().

Add an early exit to fix this.

(cherry picked from commit 5dacdb56e0cc1d824c2f924a06bee40553ef6677)

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260218122041.848881-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/of/overlay.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index d2cf2fa3f371..bad7769187f1 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -351,6 +351,9 @@ int of_overlay_apply_dtbo(struct device_node *root, const void *dtbo)
 	int ret;
 
 	overlay = of_unflatten_dtb(dtbo, INT_MAX);
+	if (IS_ERR(overlay))
+		return PTR_ERR(overlay);
+
 	ret = of_overlay_apply_tree(root, overlay);
 	of_delete_node(overlay);
 
-- 
2.47.3

[PATCH v2025.09.y 30/58] efi: fix potential NULL dereference

[Ahmad Fatoum]

Add NULL check for name buffer before writing to it.  When called with
name=NULL (for length query), the loop would dereference a NULL pointer.

(cherry picked from commit c54a80c2e557dafb970d21df9fd4a025908bee16)

Reported-by: clang-analyzer 19.1.7
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084758.3548990-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 efi/efivar-filename.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/efi/efivar-filename.c b/efi/efivar-filename.c
index 51d0130fa774..7660d6cb0c57 100644
--- a/efi/efivar-filename.c
+++ b/efi/efivar-filename.c
@@ -78,6 +78,9 @@ int __efivarfs_parse_filename(const char *filename, efi_guid_t *vendor,
 	if (ret)
 		return ret;
 
+	if (!name)
+		return 0;
+
 	for (i = 0; i < *namelen - 1; i++)
 		name[i] = filename[i];
 
-- 
2.47.3

[PATCH v2025.09.y 31/58] FIT: fix potential underflow of stack array

[Ahmad Fatoum]

Add a bounds check on depth before decrementing to prevent
stack underflow when a malformed FDT has END_NODE before BEGIN_NODE.

(cherry picked from commit 38ee3bd662a87ed0d54d2f8646d90130e2d5d11a)

Reported-by: clang-analyzer 19.1.7
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084142.3546363-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/image-fit.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/common/image-fit.c b/common/image-fit.c
index 027b268928d3..9748e5f1d8f0 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -153,6 +153,8 @@ static int fit_digest(struct fit_handle *handle, struct digest *digest,
 		case FDT_END_NODE:
 			dt_struct = dt_struct_advance(&f, dt_struct, FDT_TAGSIZE);
 
+			if (depth < 0)
+				return -ESPIPE;
 			include = want;
 			want = stack[depth--];
 			while (end > path && *--end != '/')
-- 
2.47.3

[PATCH v2025.09.y 32/58] of: fdt: fix double free in fdt_ensure_space

[Ahmad Fatoum]

fdt_ensure_space() frees the original buffer on memalign_realloc()
failure, but on error, the buffer is already freed by
memalign_realloc() unlike realloc().

Fix this by aligning memalign_realloc() behavior with normal realloc()
and adapting callers accordingly.

(cherry picked from commit 3d6d2414d85e43b53bc2e7b3e3986a888307a689)

Fixes: dd36494ae2 ("of: fdt: fix memory leak in fdt_ensure_space")
Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084142.3546363-3-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/of/fdt.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index f2f4aa03de2d..b529b4d1fe3d 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -421,10 +421,8 @@ static void *memalign_realloc(void *orig, size_t oldsize, size_t newsize)
 		return memalign(align, newsize);
 
 	newbuf = memalign(align, newsize);
-	if (!newbuf) {
-		free(orig);
+	if (!newbuf)
 		return NULL;
-	}
 
 	memcpy(newbuf, orig, oldsize);
 	free(orig);
@@ -606,10 +604,13 @@ void *of_flatten_dtb(struct device_node *node)
 	header.size_dt_strings = cpu_to_fdt32(fdt.str_nextofs);
 
 	if (fdt.dt_size - fdt.dt_nextofs < fdt.str_nextofs) {
-		fdt.dt = memalign_realloc(fdt.dt, fdt.dt_size,
+		void *newmem;
+
+		newmem = memalign_realloc(fdt.dt, fdt.dt_size,
 				fdt.dt_nextofs + fdt.str_nextofs);
-		if (!fdt.dt)
+		if (!newmem)
 			goto out_free;
+		fdt.dt = newmem;
 	}
 
 	memcpy(fdt.dt + fdt.dt_nextofs, fdt.strings, fdt.str_nextofs);
-- 
2.47.3

[PATCH v2025.09.y 33/58] of: overlay: initialize ret to fix garbage return value

[Ahmad Fatoum]

If the FIT image has no valid overlay configuration nodes, the
for_each_child_of_node loop never executes and ret is returned
uninitialized. Initialize it to 0 since having no overlay
configurations to apply is not an error.

(cherry picked from commit 2fb737e978c1e9baccdbb0ae2901bef387f39917)

Reported-by: GCC 14.2 -fanalyzer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084142.3546363-4-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/of/overlay.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
index bad7769187f1..76dc955a9300 100644
--- a/drivers/of/overlay.c
+++ b/drivers/of/overlay.c
@@ -540,7 +540,7 @@ static int of_overlay_global_fixup_fit(struct device_node *root,
 	enum bootm_verify verify = bootm_get_verify_mode();
 	struct device_node *conf_node;
 	struct fit_handle *fit;
-	int ret;
+	int ret = 0;
 
 	if (!IS_ENABLED(CONFIG_FITIMAGE)) {
 		pr_err("FIT based overlay handling requested while CONFIG_FITIMAGE=n\n");
-- 
2.47.3

[PATCH v2025.09.y 34/58] firmware: xilinx-fpga: fix double free in probe error path

[Ahmad Fatoum]

When firmwaremgr_register() fails, free(mgr) is called before jumping
to out_unreg. But the out: label (which out_unreg falls through to)
also calls free(mgr), resulting in a double free.

Remove the redundant free(mgr) before the goto, since the cleanup
labels already handle it.

(cherry picked from commit ca5f610b9232256a5e50e9722c74d082df4b484b)

Fixes: 2f4a47ef53 ("Added support for Zynq 7000 FPGA firmware loading")
Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/firmware/xilinx-fpga.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/firmware/xilinx-fpga.c b/drivers/firmware/xilinx-fpga.c
index 18d4e62ed1c3..7822521ef982 100644
--- a/drivers/firmware/xilinx-fpga.c
+++ b/drivers/firmware/xilinx-fpga.c
@@ -334,10 +334,8 @@ static int xilinx_fpga_probe(struct device *dev)
 	fh->device_node = dev->of_node;
 
 	ret = firmwaremgr_register(fh);
-	if (ret != 0) {
-		free(mgr);
+	if (ret != 0)
 		goto out_unreg;
-	}
 
 	return 0;
 out_unreg:
-- 
2.47.3

[PATCH v2025.09.y 35/58] driver: fix missing va_end in dev_add_alias error path

[Ahmad Fatoum]

dev_add_alias() calls va_start(va, fmt) but returns -ENOMEM without
calling va_end(va) if the allocation fails.

Add the missing va_end(va) call before the error return.

(cherry picked from commit 4959ca1bf487b20552b99fc5f3e49aa43aa11476)

Fixes: d914ef13a9 ("driver: add support for device aliases")
Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/base/driver.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/base/driver.c b/drivers/base/driver.c
index f15b252ea318..6a2a9efe66b0 100644
--- a/drivers/base/driver.c
+++ b/drivers/base/driver.c
@@ -637,8 +637,10 @@ int dev_add_alias(struct device *dev, const char *fmt, ...)
 	va_end(va_copy);
 
 	alias = malloc(struct_size(alias, name, len + 1));
-	if (!alias)
+	if (!alias) {
+		va_end(va);
 		return -ENOMEM;
+	}
 
 	vsnprintf(alias->name, len + 1, fmt, va);
 
-- 
2.47.3

[PATCH v2025.09.y 36/58] net: eth: avoid overlapping memcpy in eth_set_ethaddr

[Ahmad Fatoum]

eth_param_set_ethaddr() calls eth_set_ethaddr(edev, edev->ethaddr),
which results in memcpy(edev->ethaddr, ethaddr, ETH_ALEN) where source
and destination are the same buffer. This is undefined behavior with
memcpy.

Skip the memcpy when ethaddr already points to edev->ethaddr.

(cherry picked from commit 8d6fe4dff4e352a2226b9cf97e28b5204597c038)

Fixes: b9170a1bde ("net: eth: Remove ethaddr_param")
Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-3-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 net/eth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/eth.c b/net/eth.c
index 857bd2ee70dd..1cc95944ccbd 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -41,7 +41,8 @@ int eth_set_ethaddr(struct eth_device *edev, const char *ethaddr)
 	if (ret)
 		return ret;
 
-	memcpy(edev->ethaddr, ethaddr, ETH_ALEN);
+	if (ethaddr != edev->ethaddr)
+		memcpy(edev->ethaddr, ethaddr, ETH_ALEN);
 
 	return 0;
 }
-- 
2.47.3

[PATCH v2025.09.y 37/58] pmdomain: fix dereference before NULL check in genpd_get_from_provider

[Ahmad Fatoum]

genpd_get_from_provider() dereferences genpdspec->np in the variable
declaration before checking whether genpdspec itself is NULL.

(cherry picked from commit de2124f33968f8167f5371e5f8d7f6b0f2563fc5)

Fixes: abf97f3993 ("pmdomain: look up pmdomain even if not have_genpd_providers")
Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-4-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/base/power.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/base/power.c b/drivers/base/power.c
index 66ad6d05e815..b641e11ef3c3 100644
--- a/drivers/base/power.c
+++ b/drivers/base/power.c
@@ -255,13 +255,15 @@ static struct generic_pm_domain *genpd_get_from_provider(
 					struct of_phandle_args *genpdspec)
 {
 	struct generic_pm_domain *genpd = ERR_PTR(-ENOENT);
-	struct device_node *node = genpdspec->np;
 	struct of_genpd_provider *provider;
+	struct device_node *node;
 	int ret;
 
 	if (!genpdspec)
 		return ERR_PTR(-EINVAL);
 
+	node = genpdspec->np;
+
 	ret = of_device_ensure_probed(node);
 	if (ret) {
 		struct device_node *parent;
-- 
2.47.3

[PATCH v2025.09.y 38/58] net: phy: add NULL check for phy driver in page accessors

[Ahmad Fatoum]

to_phy_driver() can return NULL if the device has no driver bound.
While phy_read_page() and phy_write_page() are only called on bound
devices in practice, the existing error messages already hint at
this possibility ("PHY driver not loaded?").

Add a NULL check for phydrv before dereferencing it, consistent with
the existing error handling.

(cherry picked from commit 9403ba1be4c82ced708a94efc8539e8202a90f57)

Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-7-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/net/phy/phy-core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/phy/phy-core.c b/drivers/net/phy/phy-core.c
index b12f54ed3878..b30cb1dc7349 100644
--- a/drivers/net/phy/phy-core.c
+++ b/drivers/net/phy/phy-core.c
@@ -27,7 +27,7 @@ static int phy_read_page(struct phy_device *phydev)
 {
 	struct phy_driver *phydrv = to_phy_driver(phydev->dev.driver);
 
-	if (!phydrv->read_page) {
+	if (!phydrv || !phydrv->read_page) {
 		dev_warn_once(&phydev->dev, "read_page callback not available, PHY driver not loaded?\n");
 		return -EOPNOTSUPP;
 	}
@@ -39,7 +39,7 @@ static int phy_write_page(struct phy_device *phydev, int page)
 {
 	struct phy_driver *phydrv = to_phy_driver(phydev->dev.driver);
 
-	if (!phydrv->write_page) {
+	if (!phydrv || !phydrv->write_page) {
 		dev_warn_once(&phydev->dev, "write_page callback not available, PHY driver not loaded?\n");
 		return -EOPNOTSUPP;
 	}
-- 
2.47.3

[PATCH v2025.09.y 39/58] open: add missing mode argument to O_CREAT calls

[Ahmad Fatoum]

POSIX requires a third mode argument when open() is called with
O_CREAT. While barebox doesn't enforce file permissions, passing
mode satisfies static analyzers and is correct practice.

Also fix creat() to actually forward its mode parameter to open()
instead of silently discarding it.

Reported-by: GCC 14.2 -fanalyzer
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-8-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 commands/echo.c                   | 2 +-
 commands/edit.c                   | 2 +-
 commands/uimage.c                 | 2 +-
 commands/uncompress.c             | 2 +-
 common/bbu.c                      | 2 +-
 common/console_common.c           | 2 +-
 common/fastboot.c                 | 4 ++--
 common/globalvar.c                | 2 +-
 drivers/usb/gadget/function/dfu.c | 6 +++---
 include/fcntl.h                   | 2 +-
 lib/libfile.c                     | 4 ++--
 lib/xymodem.c                     | 2 +-
 12 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/commands/echo.c b/commands/echo.c
index 572b852ea32a..e39d9d30731b 100644
--- a/commands/echo.c
+++ b/commands/echo.c
@@ -96,7 +96,7 @@ static int do_echo(int argc, char *argv[])
 
 exit_parse:
 	if (file) {
-		fd = open(file, oflags);
+		fd = open(file, oflags, 0666);
 		if (fd < 0) {
 			perror("open");
 			return 1;
diff --git a/commands/edit.c b/commands/edit.c
index 28c9ab8877f7..c7262711d01f 100644
--- a/commands/edit.c
+++ b/commands/edit.c
@@ -243,7 +243,7 @@ static int save_file(const char *path)
 	int fd;
 	int ret = 0;
 
-	fd = open(path, O_WRONLY | O_TRUNC | O_CREAT);
+	fd = open(path, O_WRONLY | O_TRUNC | O_CREAT, 0666);
 	if (fd < 0) {
 		printf("could not open file for writing: %m\n");
 		return fd;
diff --git a/commands/uimage.c b/commands/uimage.c
index 72b827b5b276..d7e881b35f7d 100644
--- a/commands/uimage.c
+++ b/commands/uimage.c
@@ -67,7 +67,7 @@ static int do_uimage(int argc, char *argv[])
 	}
 
 	if (extract) {
-		fd = open(extract, O_WRONLY | O_CREAT | O_TRUNC);
+		fd = open(extract, O_WRONLY | O_CREAT | O_TRUNC, 0666);
 		if (fd < 0) {
 			perror("open");
 			ret = fd;
diff --git a/commands/uncompress.c b/commands/uncompress.c
index 10884d675b3d..32e60e78072a 100644
--- a/commands/uncompress.c
+++ b/commands/uncompress.c
@@ -23,7 +23,7 @@ static int do_uncompress(int argc, char *argv[])
 		return 1;
 	}
 
-	to = open(argv[2], O_WRONLY | O_CREAT);
+	to = open(argv[2], O_WRONLY | O_CREAT, 0666);
 	if (to < 0) {
 		perror("open");
 		ret = 1;
diff --git a/common/bbu.c b/common/bbu.c
index 03261583fe0b..1271ef2717f4 100644
--- a/common/bbu.c
+++ b/common/bbu.c
@@ -454,7 +454,7 @@ int bbu_std_file_handler(struct bbu_handler *handler,
 	if (ret)
 		return ret;
 
-	fd = open(data->devicefile, oflags);
+	fd = open(data->devicefile, oflags, 0666);
 	if (fd < 0)
 		return fd;
 
diff --git a/common/console_common.c b/common/console_common.c
index 5b7a64c99c29..1c2da748b613 100644
--- a/common/console_common.c
+++ b/common/console_common.c
@@ -195,7 +195,7 @@ int log_writefile(const char *filepath)
 	int ret = 0, nbytes = 0, fd = -1;
 	struct log_entry *log;
 
-	fd = open(filepath, O_WRONLY | O_CREAT | O_TRUNC);
+	fd = open(filepath, O_WRONLY | O_CREAT | O_TRUNC, 0644);
 	if (fd < 0)
 		return -errno;
 
diff --git a/common/fastboot.c b/common/fastboot.c
index e5c79c22376c..e60091efc704 100644
--- a/common/fastboot.c
+++ b/common/fastboot.c
@@ -440,7 +440,7 @@ static void cb_download(struct fastboot *fb, const char *cmd)
 		close(fb->download_fd);
 	}
 
-	fb->download_fd = open(fb->tempname, O_WRONLY | O_CREAT | O_TRUNC);
+	fb->download_fd = open(fb->tempname, O_WRONLY | O_CREAT | O_TRUNC, 0666);
 	if (fb->download_fd < 0) {
 		fastboot_tx_print(fb, FASTBOOT_MSG_FAIL, "internal error");
 			return;
@@ -588,7 +588,7 @@ static int fastboot_handle_sparse(struct fastboot *fb,
 			return ret;
 	}
 
-	fd = open(fentry->filename, flags);
+	fd = open(fentry->filename, flags, 0666);
 	if (fd < 0)
 		return -errno;
 
diff --git a/common/globalvar.c b/common/globalvar.c
index 77af6733a6a0..0472ecf9f58b 100644
--- a/common/globalvar.c
+++ b/common/globalvar.c
@@ -54,7 +54,7 @@ static int __nv_save(const char *prefix, const char *name, const char *val)
 
 	fname = basprintf("%s/%s", prefix, name);
 
-	fd = open(fname, O_CREAT | O_WRONLY | O_TRUNC);
+	fd = open(fname, O_CREAT | O_WRONLY | O_TRUNC, 0666);
 
 	free(fname);
 
diff --git a/drivers/usb/gadget/function/dfu.c b/drivers/usb/gadget/function/dfu.c
index 893dcc7f7007..e8977a96d666 100644
--- a/drivers/usb/gadget/function/dfu.c
+++ b/drivers/usb/gadget/function/dfu.c
@@ -259,14 +259,14 @@ static void dfu_do_open_dnload(struct dfu_work *dw)
 	pr_debug("do open dnload\n");
 
 	if (dfu_file_entry->flags & FILE_LIST_FLAG_SAFE) {
-		dfufd = open(DFU_TEMPFILE, O_WRONLY | O_CREAT);
+		dfufd = open(DFU_TEMPFILE, O_WRONLY | O_CREAT, 0666);
 	} else {
 		unsigned flags = O_WRONLY;
 
 		if (dfu_file_entry->flags & FILE_LIST_FLAG_CREATE)
 			flags |= O_CREAT | O_TRUNC;
 
-		dfufd = open(dfu_file_entry->filename, flags);
+		dfufd = open(dfu_file_entry->filename, flags, 0666);
 	}
 
 	if (dfufd < 0) {
@@ -325,7 +325,7 @@ static void dfu_do_copy(struct dfu_work *dw)
 	if (dfu_file_entry->flags & FILE_LIST_FLAG_CREATE)
 		flags |= O_CREAT | O_TRUNC;
 
-	fd = open(dfu_file_entry->filename, flags);
+	fd = open(dfu_file_entry->filename, flags, 0666);
 	if (fd < 0) {
 		perror("open");
 		dfu->dfu_state = DFU_STATE_dfuERROR;
diff --git a/include/fcntl.h b/include/fcntl.h
index db7926ee25fb..62dbf0f3c6d2 100644
--- a/include/fcntl.h
+++ b/include/fcntl.h
@@ -53,7 +53,7 @@ static inline int open(const char *pathname, int flags, ...)
 
 static inline int creat(const char *pathname, mode_t mode)
 {
-	return open(pathname, O_CREAT | O_WRONLY | O_TRUNC);
+	return open(pathname, O_CREAT | O_WRONLY | O_TRUNC, mode);
 }
 
 #endif /* __FCNTL_H */
diff --git a/lib/libfile.c b/lib/libfile.c
index 7ca13a34b41d..e976b32e2c1f 100644
--- a/lib/libfile.c
+++ b/lib/libfile.c
@@ -380,7 +380,7 @@ int write_file(const char *filename, const void *buf, size_t size)
 {
 	int fd, ret;
 
-	fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT);
+	fd = open(filename, O_WRONLY | O_TRUNC | O_CREAT, 0644);
 	if (fd < 0)
 		return fd;
 
@@ -476,7 +476,7 @@ int copy_file(const char *src, const char *dst, unsigned flags)
 		mode |= O_TRUNC;
 	}
 
-	dstfd = open(dst, mode);
+	dstfd = open(dst, mode, 0666);
 	if (dstfd < 0) {
 		printf("could not open %s: %m\n", dst);
 		ret = dstfd;
diff --git a/lib/xymodem.c b/lib/xymodem.c
index 84a91157713b..bd5e114ee270 100644
--- a/lib/xymodem.c
+++ b/lib/xymodem.c
@@ -394,7 +394,7 @@ static int xy_await_header(struct xyz_ctxt *proto)
 	xy_dbg("header received, filename=%s, file length=%d\n",
 	       proto->filename, proto->file_len);
 	if (proto->filename[0])
-		proto->fd = open(proto->filename, O_WRONLY | O_CREAT);
+		proto->fd = open(proto->filename, O_WRONLY | O_CREAT, 0666);
 	else
 		proto->state = PROTO_STATE_FINISHED_XFER;
 	proto->nb_received = 0;
-- 
2.47.3

[PATCH v2025.09.y 40/58] hush: add NULL check for gl_pathv after do_glob_in_argv

[Ahmad Fatoum]

If do_glob_in_argv is called with argc <= 0, the internal loop
never executes and gl_pathv remains NULL from the zero-initialized
globbuf. The subsequent globbuf.gl_pathv[0] dereference would then
crash. Add a NULL check to return early in this case.

(cherry picked from commit 02faac88eb51b0f65d5d05f2a088010959a1ece7)

Reported-by: GCC 14.2 -fanalyzer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-9-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 common/hush.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/common/hush.c b/common/hush.c
index aada3120ec4b..99e8ee8856ed 100644
--- a/common/hush.c
+++ b/common/hush.c
@@ -848,6 +848,9 @@ static int run_pipe_real(struct p_context *ctx, struct pipe *pi)
 
 	do_glob_in_argv(&globbuf, child->argc - i, &child->argv[i]);
 
+	if (!globbuf.gl_pathv)
+		return -1;
+
 	remove_quotes(globbuf.gl_pathc, globbuf.gl_pathv);
 
 	if (!strcmp(globbuf.gl_pathv[0], "getopt") &&
-- 
2.47.3

[PATCH v2025.09.y 41/58] i2c: rk3x: fix NULL pointer dereference on repeated NACK

[Ahmad Fatoum]

In the polling loop, if a NAKRCV interrupt triggers rk3x_i2c_stop()
which sets i2c->msg to NULL, a subsequent iteration with NAKRCV
still asserted will dereference the NULL msg pointer when checking
I2C_M_IGNORE_NAK. Add a NULL check so that a NULL msg falls through
to rk3x_i2c_stop(), which handles this case safely.

(cherry picked from commit 23c9bf0bc154145064d55798196d82f441241262)

Reported-by: GCC 14.2 -fanalyzer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-10-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/i2c/busses/i2c-rk3x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 1fdce1c8de84..d35f3e1c15c8 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -462,7 +462,8 @@ static void rk3x_i2c_irq(struct rk3x_i2c *i2c)
 
 		ipd &= ~REG_INT_NAKRCV;
 
-		if (!(i2c->msg->flags & I2C_M_IGNORE_NAK))
+		if (!i2c->msg ||
+		    !(i2c->msg->flags & I2C_M_IGNORE_NAK))
 			rk3x_i2c_stop(i2c, -ENXIO);
 	}
 
-- 
2.47.3

[PATCH v2025.09.y 42/58] mci: imx-esdhc: remove misleading NULL check for cmd pointer

[Ahmad Fatoum]

The ternary `cmd ? cmd->cmdidx : 0` suggests cmd can be NULL, but all
callers always pass a valid pointer and sdhci_set_cmd_xfer_mode()
unconditionally dereferences cmd a few lines later. Remove the
unnecessary guard to make the code consistent.

(cherry picked from commit 2a7768ce1640575f175760296ec033eee26a07af)

Reported-by: GCC 14.2 -fanalyzer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-11-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/mci/imx-esdhc-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mci/imx-esdhc-common.c b/drivers/mci/imx-esdhc-common.c
index 66f3edc670e0..050621d7fb06 100644
--- a/drivers/mci/imx-esdhc-common.c
+++ b/drivers/mci/imx-esdhc-common.c
@@ -327,7 +327,7 @@ int __esdhc_send_cmd(struct fsl_esdhc_host *host, struct mci_cmd *cmd,
 	dma_addr_t dma = SDHCI_NO_DMA;
 	int ret;
 
-	host->last_cmd = cmd ? cmd->cmdidx : 0;
+	host->last_cmd = cmd->cmdidx;
 
 	sdhci_write32(&host->sdhci, SDHCI_INT_STATUS, -1);
 
-- 
2.47.3

[PATCH v2025.09.y 43/58] mci: spi: initialize r1 to fix garbage return value

[Ahmad Fatoum]

If bcnt is 0, the while loop body never executes and r1 is returned
uninitialized. Initialize it to 0 (success) which is the correct
result when there are no blocks to write.

(cherry picked from commit 095bd13cf981aaceb4c0f5f7e9b14a3482c3be7e)

Reported-by: GCC 14.2 -fanalyzer
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260216084253.3547270-12-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/mci/mci_spi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mci/mci_spi.c b/drivers/mci/mci_spi.c
index 3ab90d768fbd..b495cdaafcf4 100644
--- a/drivers/mci/mci_spi.c
+++ b/drivers/mci/mci_spi.c
@@ -172,7 +172,7 @@ static uint mmc_spi_writedata(struct mmc_spi_host *host, const void *xbuf,
 			      uint32_t bcnt, uint32_t bsize, int multi)
 {
 	const uint8_t *buf = xbuf;
-	uint8_t r1;
+	uint8_t r1 = 0;
 	uint16_t crc = 0;
 	uint8_t tok[2];
 	int i;
-- 
2.47.3

[PATCH v2025.09.y 44/58] virtio: fix variable shadowing in virtqueue_add_sgs input scatter loop

[Ahmad Fatoum]

The inner for loop in the in_sgs processing section had a local
declaration 'struct scatterlist *sg = sgs[n]' that shadowed the loop
variable 'sg' from the enclosing for statement.

Remove the shadowing declaration so the loop variable is used
consistently, matching the out_sgs loop.
This aligns the loop with the logic above for out_sgs.

(cherry picked from commit 2731cfdb8dcc449b96b5829a2947866a5c6b19eb)

Reported-by: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260215171125.2646877-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/virtio/virtio_ring.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 8b6469f54d2a..d28aed7ad1e4 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -107,7 +107,6 @@ int virtqueue_add_sgs(struct virtqueue *vq, struct scatterlist *sgs[],
 
 	for (; n < (out_sgs + in_sgs); n++) {
 		for (sg = sgs[n]; sg; sg = sg_next(sg)) {
-			struct scatterlist *sg = sgs[n];
 			dma_addr_t addr = vring_map_one_sg(vq, sg, DMA_FROM_DEVICE);
 			if (vring_mapping_error(vq, addr))
 				goto unmap_release;
-- 
2.47.3

[PATCH v2025.09.y 45/58] video: mode-helpers: preserve sync polarity in fb_videomode conversion

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

The FB_SYNC_*_HIGH_ACT flags indicate that the respective sync signal is
active high when set and active low when unset.

The DISPLAY_FLAGS_*SYNC_* flags on the other hands have separate
non-zero _HIGH and _LOW flags, which fb_videomode_to_videomode() failed
to account for.

This causes a DPI sync polarity mismatch for MIPI-DSI panels with
negative sync polarity, which was hackily worked around by enabling the
video pattern generator intermittently.

Fix by explicitly setting the LOW polarity flags, which restores
DRM_MODE_FLAG_NHSYNC/NVSYNC after the fb_videomode round-trip.

(cherry picked from commit f66af1ff3a2042bfbadbfc952359d1cdc6fb07c3)

Reported-by: Claude Opus 4.6 <noreply@anthropic.com>
Fixes: 7fc6f7b5daa0 ("video: add videomode helpers")
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260213092906.3960051-1-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/video/mode-helpers.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/video/mode-helpers.c b/drivers/video/mode-helpers.c
index 4a1d31813e79..89abd8342bf4 100644
--- a/drivers/video/mode-helpers.c
+++ b/drivers/video/mode-helpers.c
@@ -143,8 +143,12 @@ void fb_videomode_to_videomode(const struct fb_videomode *fbmode,
 
 	if (fbmode->sync & FB_SYNC_HOR_HIGH_ACT)
 		vm->flags |= DISPLAY_FLAGS_HSYNC_HIGH;
+	else
+		vm->flags |= DISPLAY_FLAGS_HSYNC_LOW;
 	if (fbmode->sync & FB_SYNC_VERT_HIGH_ACT)
 		vm->flags |= DISPLAY_FLAGS_VSYNC_HIGH;
+	else
+		vm->flags |= DISPLAY_FLAGS_VSYNC_LOW;
 	if (fbmode->vmode & FB_VMODE_INTERLACED)
 		vm->flags |= DISPLAY_FLAGS_INTERLACED;
 	if (fbmode->vmode & FB_VMODE_DOUBLE)
-- 
2.47.3

[PATCH v2025.09.y 46/58] ARM: rockchip: dmc: use define instead of hardcoded value

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

(cherry picked from commit 698768100e5d602505e318dac8ae0c9f7f237b63)

Link: https://lore.barebox.org/20260223-rockchip-optee-v1-1-723493320d42@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/mach-rockchip/dmc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-rockchip/dmc.c b/arch/arm/mach-rockchip/dmc.c
index 3cb17b969414..9d056ada5513 100644
--- a/arch/arm/mach-rockchip/dmc.c
+++ b/arch/arm/mach-rockchip/dmc.c
@@ -215,8 +215,8 @@ size_t rk3588_ram_sizes(phys_addr_t *base, resource_size_t *size, size_t n)
 
 	memsize = size1 + size2;
 
-	base[i] = 0xa00000;
-	size[i] = min_t(resource_size_t, RK3588_INT_REG_START, memsize) - 0xa00000;
+	base[i] = RK3588_DRAM_BOTTOM;
+	size[i] = min_t(resource_size_t, RK3588_INT_REG_START, memsize) - RK3588_DRAM_BOTTOM;
 	i++;
 
 	if (i < n && memsize > SZ_4G) {
-- 
2.47.3

[PATCH v2025.09.y 47/58] ARM: rockchip: atf: Fix memend

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

In rk3588_barebox_entry() we do a:

	endmem = rk3588_ram0_size();

This is wrong, as the function name says it returns the (usable in this
case) RAM size. It doesn't count from 0x0 as we assume, but from
RK3588_DRAM_BOTTOM, which means that endmem is calculated by
RK3588_DRAM_BOTTOM too low.

Fix this and while at it use rk3588_ram_sizes(), as this returns usable
DRAM start and size, so exactly the data we need.

Without this fix we run into trouble on boards with 4GB or more of DRAM.
On these boards the 32bit DRAM space is limited by the beginning of the
internal register space. Without this fix the end of the memory range
we pass to barebox overlaps the internal register space. This likely
only didn't blow up because we ultimately do not use the end of DRAM
as OPTEE_SIZE is substracted from it. OP-TEE is in the lower DRAM on
Rockchip though, so the space we reserve for OP-TEE in the upper DRAM
was just unused.

(cherry picked from commit 502ef444770eebb7d0c7383934864e21f286cb95)

Link: https://lore.barebox.org/20260223-rockchip-optee-v1-2-723493320d42@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/mach-rockchip/atf.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/arch/arm/mach-rockchip/atf.c b/arch/arm/mach-rockchip/atf.c
index c4ed84aae6ad..a57c8d94e264 100644
--- a/arch/arm/mach-rockchip/atf.c
+++ b/arch/arm/mach-rockchip/atf.c
@@ -194,12 +194,14 @@ static int rk3588_fixup_mem(void *fdt)
 
 void __noreturn rk3588_barebox_entry(void *fdt)
 {
-	unsigned long membase, endmem;
+	phys_addr_t membase, memend;
+	resource_size_t memsize;
 
-	membase = RK3588_DRAM_BOTTOM;
-	endmem = rk3588_ram0_size();
+	rk3588_ram_sizes(&membase, &memsize, 1);
 
-	rk_scratch = (void *)arm_mem_scratch(endmem);
+	memend = membase + memsize;
+
+	rk_scratch = (void *)arm_mem_scratch(memend);
 
 	if (current_el() == 3) {
 		void *fdt_scratch = NULL;
@@ -223,7 +225,7 @@ void __noreturn rk3588_barebox_entry(void *fdt)
 	}
 
 	optee_set_membase(rk_scratch_get_optee_hdr());
-	barebox_arm_entry(membase, endmem - membase, fdt);
+	barebox_arm_entry(membase, memsize, fdt);
 }
 
 void rk3576_atf_load_bl31(void *fdt)
-- 
2.47.3

[PATCH v2025.09.y 48/58] regulator: fix handling of off_on_delay

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

In Linux the off_on_delay field in a regulator is described as:

> The guard time (in uS), before re-enabling a regulator

The primary user is the fixed regulator which puts the value of
the "off-on-delay-us" property into it.

In barebox we put the off_on_delay into the enable_time_us field
which is the delay we introduce when turning on a regulator. This
is wrong and fixed in this commit.

The off_on_delay is defined as the time we should take before
re-enabling a regulator. Linux does it the complicated way of
remembering the time when it was last disabled and delays the
re-enabling if necessary. We use the simple approach here of
just waiting the off_on_delay time in the regulator disable path.

(cherry picked from commit 8095b70ba4e9738f6ffec745e8448bd11a2ac348)

Fixes: 26a4c78917 ("regulator: add support for struct regulator_desc::off_on_delay")
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Link: https://lore.barebox.org/20260129-regulator-ramp-v1-1-6269bd55d432@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/regulator/core.c | 5 ++++-
 include/regulator.h      | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index f18622cba80c..6e18bc8a2d32 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -96,6 +96,9 @@ static int regulator_disable_rdev(struct regulator_dev *rdev)
 
 	rdev->enable_count--;
 
+	if (rdev->off_on_delay)
+		udelay(rdev->off_on_delay);
+
 	return regulator_disable(rdev->supply);
 }
 
@@ -309,7 +312,7 @@ int of_regulator_register(struct regulator_dev *rdev, struct device_node *node)
 	node->dev = rdev->dev;
 
 	if (rdev->desc->off_on_delay)
-		rdev->enable_time_us = rdev->desc->off_on_delay;
+		rdev->off_on_delay = rdev->desc->off_on_delay;
 
 	if (rdev->desc->fixed_uV && rdev->desc->n_voltages == 1)
 		rdev->min_uv = rdev->max_uv = rdev->desc->fixed_uV;
diff --git a/include/regulator.h b/include/regulator.h
index cb542b05c696..0b46714fcfa2 100644
--- a/include/regulator.h
+++ b/include/regulator.h
@@ -124,6 +124,7 @@ struct regulator_dev {
 	struct device_node *node;
 	int enable_count;
 	int enable_time_us;
+	unsigned int off_on_delay;
 	int min_uv;
 	int max_uv;
 	struct list_head consumer_list;
-- 
2.47.3

[PATCH v2025.09.y 49/58] regulator: fixed: handle startup-delay-us property

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

The "startup-delay-us" property of the fixed regulator has never been
handled by barebox. Handle it now.

The "startup-delay-us" property is specified as:

| startup time in microseconds

Then there's a regulator generic property "regulator-enable-ramp-delay"
which barebox handles, specified as:

| The time taken, in microseconds, for the supply rail to
| reach the target voltage, plus/minus whatever tolerance the board
| design requires. This property describes the total system ramp time
| required due to the combination of internal ramping of the regulator
| itself, and board design issues such as trace capacitance and load
| on the supply.

We just use the bigger of the two times as the time a regulator needs
to become stable.

(cherry picked from commit 531cdd2463c3038c59c18087d4ddee9e1f4feaf9)

Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Link: https://lore.barebox.org/20260129-regulator-ramp-v1-2-6269bd55d432@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/regulator/core.c  | 10 ++++++++--
 drivers/regulator/fixed.c |  3 +++
 include/regulator.h       |  2 ++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 6e18bc8a2d32..ec2ca4b19e62 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -297,6 +297,7 @@ int of_regulator_register(struct regulator_dev *rdev, struct device_node *node)
 {
 	const char *name;
 	int ret;
+	u32 val = 0;
 
 	if (!rdev || !node)
 		return -EINVAL;
@@ -313,12 +314,17 @@ int of_regulator_register(struct regulator_dev *rdev, struct device_node *node)
 
 	if (rdev->desc->off_on_delay)
 		rdev->off_on_delay = rdev->desc->off_on_delay;
+	if (rdev->desc->enable_time_us)
+		rdev->enable_time_us = rdev->desc->enable_time_us;
 
 	if (rdev->desc->fixed_uV && rdev->desc->n_voltages == 1)
 		rdev->min_uv = rdev->max_uv = rdev->desc->fixed_uV;
 
-	of_property_read_u32(node, "regulator-enable-ramp-delay",
-			&rdev->enable_time_us);
+	/* might be set by the regulator implementation already. Use the bigger value */
+	of_property_read_u32(node, "regulator-enable-ramp-delay", &val);
+	if (val > rdev->enable_time_us)
+		rdev->enable_time_us = val;
+
 	of_property_read_u32(node, "regulator-min-microvolt",
 			&rdev->min_uv);
 	of_property_read_u32(node, "regulator-max-microvolt",
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index 0edb5ceb104b..e00519c2fed5 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -61,6 +61,9 @@ static int regulator_fixed_probe(struct device *dev)
 	if (!of_property_read_u32(np, "off-on-delay-us", &delay))
 		fix->rdesc.off_on_delay = delay;
 
+	if (!of_property_read_u32(np, "startup-delay-us", &delay))
+		fix->rdesc.enable_time_us = delay;
+
 	if (of_find_property(np, "vin-supply", NULL))
 		fix->rdesc.supply_name = "vin";
 
diff --git a/include/regulator.h b/include/regulator.h
index 0b46714fcfa2..61920763d58f 100644
--- a/include/regulator.h
+++ b/include/regulator.h
@@ -64,6 +64,7 @@ struct regulator_bulk_data {
  * @volt_table: Voltage mapping table (if table based mapping)
  * @fixed_uV: Fixed voltage of rails.
  * @off_on_delay: guard time (in uS), before re-enabling a regulator
+ * @enable_time_us: Time taken for initial enable of regulator (in uS).
  */
 
 struct regulator_desc {
@@ -94,6 +95,7 @@ struct regulator_desc {
 	const unsigned int *volt_table;
 	int fixed_uV;
 	unsigned int off_on_delay;
+	unsigned int enable_time_us;
 };
 
 /**
-- 
2.47.3

[PATCH v2025.09.y 50/58] scripts: include: break dependency of list.h on kernel.h

[Ahmad Fatoum]

We already got rid of this dependency for the normal barebox build, so
break it up for the scripts/ build as well to avoid this nconf warning
on some distros:

  In file included from scripts/kconfig/nconf.c:15:
  scripts/kconfig/nconf.h:25:9: warning: ‘max’ redefined
     25 | #define max(a, b) ({\
        |         ^~~
  In file included from ./barebox/scripts/include/linux/list.h:5,
                   from ./barebox/scripts/include/list.h:5,
                   from scripts/kconfig/expr.h:15,
                   from scripts/kconfig/lkc.h:13,
                   from scripts/kconfig/nconf.c:14:
  ./barebox/scripts/include/linux/kernel.h:39:9: note: this is the location of the previous definition
     39 | #define max(x, y) ({                            \
        |         ^~~
  scripts/kconfig/nconf.h:30:9: warning: ‘min’ redefined

(cherry picked from commit a904368d55cfed72774dc42e544c9275f0fe851f)

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20260205143043.2831511-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 scripts/include/linux/container_of.h | 18 ++++++++++++++++++
 scripts/include/linux/kernel.h       | 14 +-------------
 scripts/include/linux/list.h         |  2 +-
 3 files changed, 20 insertions(+), 14 deletions(-)
 create mode 100644 scripts/include/linux/container_of.h

diff --git a/scripts/include/linux/container_of.h b/scripts/include/linux/container_of.h
new file mode 100644
index 000000000000..ca0ec95667b9
--- /dev/null
+++ b/scripts/include/linux/container_of.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _SCRIPTS_LINUX_CONTAINER_OF_H
+#define _SCRIPTS_LINUX_CONTAINER_OF_H
+
+#ifndef container_of
+/**
+ * container_of - cast a member of a structure out to the containing structure
+ * @ptr:	the pointer to the member.
+ * @type:	the type of the container struct this is embedded in.
+ * @member:	the name of the member within the struct.
+ *
+ */
+#define container_of(ptr, type, member) ({			\
+	const typeof(((type *)0)->member) * __mptr = (ptr);	\
+	(type *)((char *)__mptr - offsetof(type, member)); })
+#endif
+
+#endif	/* _SCRIPTS_LINUX_CONTAINER_OF_H */
diff --git a/scripts/include/linux/kernel.h b/scripts/include/linux/kernel.h
index f3083ff3545d..672f681931ec 100644
--- a/scripts/include/linux/kernel.h
+++ b/scripts/include/linux/kernel.h
@@ -5,6 +5,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <assert.h>
+#include <linux/container_of.h>
 
 #define __ALIGN_MASK(x, mask)	(((x) + (mask)) & ~(mask))
 #define ALIGN(x, a)		__ALIGN_MASK(x, (typeof(x))(a) - 1)
@@ -20,19 +21,6 @@
 #define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
 #endif
 
-#ifndef container_of
-/**
- * container_of - cast a member of a structure out to the containing structure
- * @ptr:	the pointer to the member.
- * @type:	the type of the container struct this is embedded in.
- * @member:	the name of the member within the struct.
- *
- */
-#define container_of(ptr, type, member) ({			\
-	const typeof(((type *)0)->member) * __mptr = (ptr);	\
-	(type *)((char *)__mptr - offsetof(type, member)); })
-#endif
-
 #define BUILD_BUG_ON_ZERO(e) (sizeof(struct { int:-!!(e); }))
 
 #ifndef max
diff --git a/scripts/include/linux/list.h b/scripts/include/linux/list.h
index d6b24f6b744d..d10e44469974 100644
--- a/scripts/include/linux/list.h
+++ b/scripts/include/linux/list.h
@@ -2,8 +2,8 @@
 #define __TOOLS_LINUX_LIST_H
 
 #include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/compiler.h>
+#include <linux/container_of.h>
 
 /*
  * Simple doubly linked list implementation.
-- 
2.47.3

[PATCH v2025.09.y 51/58] Makefile: include scripts/ in compile_commands.json

[Ahmad Fatoum]

From: Jonas Rebmann <jre@pengutronix.de>

Although in many cases, C files in scripts/ would, because they rely on
the host toolchain and no unusual compiler flags, work fine in clangd
without a compile commands database, the (typically cross) compile
commands of the first entry in compile_commands.json are applied as
defaults once generated via `make compile_commands.json`.

As valid .cmd files are already present in scripts/ and
gen_compile_commands.py supports reading all cmd files in a subtree
recursively, simply add scripts to the gen_compile_commands.py
invocation. All enabled code in scripts/ is now properly covered by
compile_commands.json

(cherry picked from commit 8292499af8e917ed414ec57c36369068cfb98e13)

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
Link: https://lore.barebox.org/20260217-scripts-compile-commands-hack-v1-1-85afb2af566b@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8606a6576194..28056c7d3d5e 100644
--- a/Makefile
+++ b/Makefile
@@ -1349,7 +1349,7 @@ quiet_cmd_gen_compile_commands = GEN     $@
       cmd_gen_compile_commands = $(PYTHON3) $< -a $(AR) -o $@ $(filter-out $<, $(real-prereqs))
 
 compile_commands.json: scripts/clang-tools/gen_compile_commands.py \
-	$(BAREBOX_OBJS) $(if $(CONFIG_PBL_IMAGE),$(BAREBOX_PBL_OBJS),) FORCE
+	$(BAREBOX_OBJS) $(if $(CONFIG_PBL_IMAGE),$(BAREBOX_PBL_OBJS),) scripts/ FORCE
 	$(call if_changed,gen_compile_commands)
 
 PHONY += compile_commands.json
-- 
2.47.3

[PATCH v2025.09.y 52/58] jwt: fix buffer overflow and double-free in jwt_part_parse

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

jwt_part_parse() allocates a buffer with xmalloc(len) and then writes
a NUL terminator at decoded_len, but when len is 0 (empty JWT parts
like "..sig"), this writes past the allocation.

Additionally, when jsmn_parse_alloc() fails, the function frees
part->content but doesn't NULL the pointer. The caller then calls
jwt_free() → jwt_part_free() which frees part->content again.

Fix both: allocate len + 1 to accommodate the NUL terminator, and
NULL out part->content after freeing it on the error path.

(cherry picked from commit ca92053262374b3dbd741c1435dd90bbed4ec1e9)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260302135258.197132-2-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 security/jwt.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/jwt.c b/security/jwt.c
index e4be17dcfac0..e828ccfd8cfe 100644
--- a/security/jwt.c
+++ b/security/jwt.c
@@ -55,12 +55,13 @@ static int jwt_part_parse(struct jwt_part *part, const char *content, size_t len
 {
 	size_t decoded_len;
 
-	part->content = xmalloc(len);
+	part->content = xmalloc(len + 1);
 	decoded_len = decode_base64url(part->content, len, content);
 	part->content[decoded_len] = '\0';
 	part->tokens = jsmn_parse_alloc(part->content, decoded_len, &part->token_count);
 	if (!part->tokens) {
 		free(part->content);
+		part->content = NULL;
 		return -EILSEQ;
 	}
 
-- 
2.47.3

[PATCH v2025.09.y 53/58] of: fdt: fix heap-buffer-overflow in fdt_machine_is_compatible

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

fdt_machine_is_compatible() reads the FDT property header fields
(len, nameoff) without first checking that the full struct fdt_property
fits within the FDT buffer. While the tag field (4 bytes) is validated
by dt_ptr_ok(fdt, tagp), the subsequent access to fdt_prop->len and
fdt_prop->nameoff (at offsets +4 and +8) can read past the buffer when
the FDT is truncated between the tag and the property header fields.

Add a dt_ptr_ok(fdt, fdt_prop) check before accessing the property
fields, matching the existing pattern in __of_unflatten_dtb().

Found by fuzz-fdt-compatible with AddressSanitizer.

(cherry picked from commit ef2e9ab5611cc5c8d4faec35f95915a4e204d3b2)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260302135258.197132-3-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/of/fdt.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index b529b4d1fe3d..2ef7658bc4ab 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -801,6 +801,9 @@ int fdt_machine_is_compatible(const struct fdt_header *fdt, size_t fdt_size, con
 
 		case FDT_PROP:
 			fdt_prop = (const void *)fdt + dt_struct;
+			if (!dt_ptr_ok(fdt, fdt_prop))
+				return 0;
+
 			len = fdt32_to_cpu(fdt_prop->len);
 
 			name = dt_string(&f, dt_strings, fdt32_to_cpu(fdt_prop->nameoff));
-- 
2.47.3

[PATCH v2025.09.y 54/58] powerpc: fix initjmp storing function pointer at wrong offset

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

initjmp was storing the function pointer at offset 88, which is the CR
(condition register) slot in the jmp_buf, instead of offset 84, which is
the LR (link register) slot. When longjmp later restored the buffer, it
would load uninitialized data into LR and jump to it, causing a crash.

This was caught by the setjmp selftest, which triggered a reboot loop on
qemu-ppce500.

(cherry picked from commit bb1ddbf129b6f0081f7c44b726d96f18eeaec6aa)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20260302134843.195007-3-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/powerpc/lib/setjmp.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/lib/setjmp.S b/arch/powerpc/lib/setjmp.S
index 021a57eebc3c..7f4d041ce213 100644
--- a/arch/powerpc/lib/setjmp.S
+++ b/arch/powerpc/lib/setjmp.S
@@ -79,8 +79,8 @@ END(longjmp)
 ENTRY(initjmp)
 	addi	r3,r3,7		# align to 8 byte boundary
 	rlwinm	r3,r3,0,0,28
-	stw	r5,0(r3)	# offset 0
-	stwu	r4,88(r3)	# offset 88
+	stw	r5,0(r3)	# offset 0 - stack pointer
+	stw	r4,84(r3)	# offset 84 - link register
 	li	r3,0
 	blr
 END(initjmp)
-- 
2.47.3

[PATCH v2025.09.y 55/58] net: r8169: drain RX descriptor ring

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

When not busy waiting for incoming packets we poll for new packets only
every 10ms. Each time only a single frame is fetched from the hardware.
On a network with many broadcast traffic there might be more than
100 packets/s incoming, which will sooner or later fill up our RX descriptor
ring. Unfortunately the Realtek Hardware has no way to gracefully handle
a RX queue overflow. Fix this by fetching multiple packets from the
hardware in each receive callback.

(cherry picked from commit ba8dab21987b75add872d7c0d4ca668c82f39e64)

Link: https://lore.barebox.org/20260302172630.2713540-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 drivers/net/r8169_main.c | 39 ++++++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/drivers/net/r8169_main.c b/drivers/net/r8169_main.c
index b74cc43ab064..bc2040a0173f 100644
--- a/drivers/net/r8169_main.c
+++ b/drivers/net/r8169_main.c
@@ -3013,14 +3013,19 @@ static void rtl8169_eth_rx(struct eth_device *edev)
 {
 	struct rtl8169_private *tp = edev->priv;
 	struct device *dev = &tp->pci_dev->dev;
-	unsigned int entry, pkt_size = 0;
-	u8 status;
+	unsigned int entry, pkt_size;
+	u32 opts;
+	int budget = NUM_RX_DESC;
 
-	entry = tp->cur_rx % NUM_RX_DESC;
+	while (budget-- > 0) {
+		entry = tp->cur_rx % NUM_RX_DESC;
+		opts = le32_to_cpu(tp->RxDescArray[entry].opts1);
 
-	if ((le32_to_cpu(tp->RxDescArray[entry].opts1) & DescOwn) == 0) {
-		if (!(le32_to_cpu(tp->RxDescArray[entry].opts1) & RxRES)) {
-			pkt_size = (le32_to_cpu(tp->RxDescArray[entry].opts1) & 0x1fff) - 4;
+		if (opts & DescOwn)
+			break;
+
+		if (!(opts & RxRES)) {
+			pkt_size = (opts & 0x1fff) - 4;
 
 			dma_sync_single_for_cpu(dev, tp->rx_buf_phys + entry * PKT_BUF_SIZE,
 						pkt_size, DMA_FROM_DEVICE);
@@ -3030,24 +3035,20 @@ static void rtl8169_eth_rx(struct eth_device *edev)
 
 			dma_sync_single_for_device(dev, tp->rx_buf_phys + entry * PKT_BUF_SIZE,
 						   pkt_size, DMA_FROM_DEVICE);
-
-			if (entry == NUM_RX_DESC - 1)
-				tp->RxDescArray[entry].opts1 = cpu_to_le32(DescOwn |
-					RingEnd | PKT_BUF_SIZE);
-			else
-				tp->RxDescArray[entry].opts1 =
-					cpu_to_le32(DescOwn | PKT_BUF_SIZE);
-			tp->RxDescArray[entry].addr = cpu_to_le64(tp->rx_buf_phys +
-					    entry * PKT_BUF_SIZE);
 		} else {
 			dev_err(&edev->dev, "rx error\n");
 		}
 
+		if (entry == NUM_RX_DESC - 1)
+			tp->RxDescArray[entry].opts1 = cpu_to_le32(DescOwn |
+				RingEnd | PKT_BUF_SIZE);
+		else
+			tp->RxDescArray[entry].opts1 =
+				cpu_to_le32(DescOwn | PKT_BUF_SIZE);
+		tp->RxDescArray[entry].addr = cpu_to_le64(tp->rx_buf_phys +
+				    entry * PKT_BUF_SIZE);
+
 		tp->cur_rx++;
-	} else {
-		status = RTL_R8(tp, IntrStatus);
-		RTL_W8(tp, IntrStatus, status & ~(TxErr | RxErr | SYSErr));
-		udelay(100);	/* wait */
 	}
 }
 
-- 
2.47.3

[PATCH v2025.09.y 56/58] of: fdt: refuse / in property and node names

[Ahmad Fatoum]

/ is used as delimiter between nodes, so seeing it in a device node name
hints at something fishy going on, so refuse that outright.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/barebox/177340042002.206359.73330334326620046.b4-ty@pengutronix.de
---
 drivers/of/fdt.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2ef7658bc4ab..8418549a4005 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -67,6 +67,14 @@ static inline bool is_reserved_name(const char *name)
 	return *name == '$';
 }
 
+static inline bool is_allowed_input_name(const char *name)
+{
+	/* We are stricter on input than on output, because we assume barebox
+	 * code won't attempt naming nodes bogously.
+	 */
+	return !is_reserved_name(name) && !strchr(name, '/');
+}
+
 static int of_reservemap_num_entries(const struct fdt_header *fdt)
 {
 	/*
@@ -248,7 +256,7 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 				node = root;
 			} else {
 				/* Only the root node may have an empty name */
-				if (!*pathp || is_reserved_name(pathp)) {
+				if (!*pathp || !is_allowed_input_name(pathp)) {
 					ret = -EINVAL;
 					goto err;
 				}
@@ -285,7 +293,7 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			nodep = fdt_prop->data;
 
 			name = dt_string(&f, dt_strings, fdt32_to_cpu(fdt_prop->nameoff));
-			if (!name || !node ||  is_reserved_name(name)) {
+			if (!name || !node ||  !is_allowed_input_name(name)) {
 				ret = -ESPIPE;
 				goto err;
 			}
-- 
2.47.3

[PATCH v2025.09.y 57/58] FIT: reconstruct hashed-nodes property during verification

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

The hashed-nodes property in FIT signed image configurations is used to
determine which nodes are hashed, but is itself not hashed, so could be
manipulated.

To fix this do not use the hashed-nodes property to calculate which
nodes must be hashed, but instead reconstruct the hashed nodes list by
the images used in a FIT configuration, the same way mkimage does it
when creating the image.

The approach mirrors U-Boot commit 2092322b31c ("boot: Add
fit_config_get_hash_list() to build signed node list")

Fixes: ac55adb321 ("bootm: add initial FIT support")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.kernel.org/barebox/859a45ba-28c0-4d37-853f-39529ab2521b@pengutronix.de
---
 common/image-fit.c | 123 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 106 insertions(+), 17 deletions(-)

diff --git a/common/image-fit.c b/common/image-fit.c
index 9748e5f1d8f0..eae6e6efcf64 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -55,18 +55,6 @@ static char *dt_string(struct fdt_header *f, char *strstart, uint32_t ofs)
 		return strstart + ofs;
 }
 
-static int of_read_string_list(struct device_node *np, const char *name, struct string_list *sl)
-{
-	struct property *prop;
-	const char *s;
-
-	of_property_for_each_string(np, name, prop, s) {
-		string_list_add(sl, s);
-	}
-
-	return prop ? 0 : -EINVAL;
-}
-
 static int fit_digest(struct fit_handle *handle, struct digest *digest,
 		      struct string_list *inc_nodes, struct string_list *exc_props,
 		      uint32_t hashed_strings_start, uint32_t hashed_strings_size)
@@ -312,10 +300,106 @@ static int fit_check_signature(struct fit_handle *handle, struct device_node *si
 	return 0;
 }
 
+static int fit_config_build_hash_nodes(struct fit_handle *handle,
+				       struct device_node *conf_node,
+				       struct string_list *node_list)
+{
+	struct device_node *image_node, *child;
+	struct property *prop;
+	const char *unit;
+	int i, ret, count;
+
+	ret = string_list_add(node_list, "/");
+	if (ret)
+		return ret;
+	ret = string_list_add_asprintf(node_list, "%s", conf_node->full_name);
+	if (ret)
+		return ret;
+
+	for_each_property_of_node(conf_node, prop) {
+		if (!strcmp(prop->name, "description") ||
+		    !strcmp(prop->name, "compatible") ||
+		    !strcmp(prop->name, "default"))
+			continue;
+
+		count = of_property_count_strings(conf_node, prop->name);
+		for (i = 0; i < count; i++) {
+			if (of_property_read_string_index(conf_node, prop->name,
+							  i, &unit))
+				return -EINVAL;
+
+			if (strchr(unit, '/'))
+				return -EINVAL;
+
+			ret = string_list_add_asprintf(node_list, "/images/%s", unit);
+			if (ret)
+				return ret;
+
+			image_node = of_get_child_by_name(handle->images, unit);
+			if (!image_node)
+				return -EINVAL;
+
+			for_each_child_of_node(image_node, child) {
+				if (!of_node_has_prefix(child, "hash"))
+					continue;
+				ret = string_list_add_asprintf(node_list, "/images/%s/%s",
+							       unit, child->name);
+				if (ret)
+					return ret;
+			}
+		}
+	}
+
+	return 0;
+}
+
+static int fit_config_check_hash_nodes(struct device_node *sig_node,
+				       struct string_list *inc_nodes)
+{
+	struct string_list *entry;
+	const char *node;
+	int ret, i = 0;
+
+	/*
+	 * Check if the hashed-nodes property matches the list of nodes we calculated.
+	 * We don't use the hashed-nodes property finally, but let's check for consistency
+	 * to inform the user if something is wrong.
+	 */
+
+	string_list_for_each_entry(entry, inc_nodes) {
+
+		ret = of_property_read_string_index(sig_node, "hashed-nodes", i, &node);
+		if (ret) {
+			pr_err("Cannot read hashed-node[%u]: %pe\n", i,
+			       ERR_PTR(ret));
+			return ret;
+		}
+
+		if (strcmp(entry->str, node)) {
+			pr_err("hashed-node[%u] doesn't match calculated node: %s != %s\n",
+			       i, entry->str, node);
+			return -EINVAL;
+		}
+
+		i++;
+	}
+
+	ret = of_property_read_string_index(sig_node, "hashed-nodes", i,
+					    &node);
+	if (!ret) {
+		pr_err("hashed-nodes property has more entries than we calculated\n");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 /*
  * The consistency of the FTD structure was already checked by of_unflatten_dtb()
  */
-static int fit_verify_signature(struct fit_handle *handle, struct device_node *sig_node)
+static int fit_verify_signature(struct fit_handle *handle,
+				struct device_node *sig_node,
+				struct device_node *conf_node)
 {
 	uint32_t hashed_strings_start, hashed_strings_size;
 	struct string_list inc_nodes, exc_props;
@@ -329,6 +413,7 @@ static int fit_verify_signature(struct fit_handle *handle, struct device_node *s
 		pr_err("hashed-strings start not found in %pOF\n", sig_node);
 		return -EINVAL;
 	}
+
 	if (of_property_read_u32_index(sig_node, "hashed-strings", 1,
 	    &hashed_strings_size)) {
 		pr_err("hashed-strings size not found in %pOF\n", sig_node);
@@ -338,12 +423,16 @@ static int fit_verify_signature(struct fit_handle *handle, struct device_node *s
 	string_list_init(&inc_nodes);
 	string_list_init(&exc_props);
 
-	if (of_read_string_list(sig_node, "hashed-nodes", &inc_nodes)) {
-		pr_err("hashed-nodes property not found in %pOF\n", sig_node);
-		ret = -EINVAL;
+	ret = fit_config_build_hash_nodes(handle, conf_node, &inc_nodes);
+	if (ret) {
+		pr_err("Failed to build hash node list for %pOF\n", conf_node);
 		goto out_sl;
 	}
 
+	ret = fit_config_check_hash_nodes(sig_node, &inc_nodes);
+	if (ret)
+		goto out_sl;
+
 	string_list_add(&exc_props, "data");
 
 	digest = fit_alloc_digest(sig_node, &algo);
@@ -738,7 +827,7 @@ int fit_config_verify_signature(struct fit_handle *handle, struct device_node *c
 		if (handle->verbose)
 			of_print_nodes(sig_node, 0, ~0);
 
-		ret = fit_verify_signature(handle, sig_node);
+		ret = fit_verify_signature(handle, sig_node, conf_node);
 		if (ret < 0)
 			return ret;
 	}
-- 
2.47.3

[PATCH v2025.09.y 58/58] scripts: fix build failure with glibc 2.43

[Ahmad Fatoum]

From: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>

glibc 2.43 introduces linux/openat2.h through the fcntl include chain
(bits/fcntl-linux.h -> linux/openat2.h). This header expects the
__u64 type to be defined before inclusion.

In barebox scripts/include/linux/types.h the header <fcntl.h> was
included before the __u64 typedef, causing build failures such as:

  linux/openat2.h:20:9: error: unknown type name '__u64'

Move the inclusion of <fcntl.h> after the typedef definitions so that
__u64 and related types are defined before linux/openat2.h is parsed.

Signed-off-by: Hemanth Kumar M D <Hemanth.KumarMD@windriver.com>
Link: https://git.openembedded.org/openembedded-core/commit/meta/recipes-bsp/barebox?id=a217683514e051f996fe5675cf9accd44692f6ab
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.kernel.org/barebox/177340033069.206252.6842304138227246713.b4-ty@pengutronix.de
---
 scripts/include/linux/types.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/include/linux/types.h b/scripts/include/linux/types.h
index 5b0133345bb9..33cea1986df5 100644
--- a/scripts/include/linux/types.h
+++ b/scripts/include/linux/types.h
@@ -4,7 +4,6 @@
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
-#include <fcntl.h>
 
 typedef uint64_t __u64;
 typedef int64_t __s64;
@@ -15,6 +14,8 @@ typedef int16_t __s16;
 typedef uint8_t __u8;
 typedef int8_t __s8;
 
+#include <fcntl.h>
+
 #ifndef __linux__
 typedef long long loff_t;
 #endif
-- 
2.47.3

Re: [PATCH v2025.09.y 00/58] Backports for v2025.09.1

[Sascha Hauer]

On Fri, 13 Mar 2026 14:24:44 +0100, Ahmad Fatoum wrote:
> Yocto Whinlatter still has a month to go until EOL.
> 
> Let's backport some fixes accrued in master in the meantime.
> 
> Ahmad Fatoum (35):
>   drivers: don't propagate of_alias_get_id's -ENODEV out of probe
>   bug: add support for CONFIG_DEBUG_BUGVERBOSE
>   sandbox: fix make dependency for sandbox
>   ARM: cpu: common: skip R_ARM_NONE relocations
>   virtio: ring: fix stale data in queue after reset
>   scripts: Makefile.lib: suppress graph_port warnings for overlays
>   ARM: Rockchip: rk3576-prtpuk: suppress video graph warning
>   kbuild: fold rmdirs into rmfiles
>   FIT: fix double free issue with >1 reference count
>   net: phy: mdio_bus: fix freeing of cdev name before devfs_remove
>   bootm: fix bootm override saving/restoring
>   common: tlv: fix link error when CONFIG_NET is disabled
>   include: array_size.h: make header self-contained
>   of: overlay: propagate error unflattening DTBO
>   efi: fix potential NULL dereference
>   FIT: fix potential underflow of stack array
>   of: fdt: fix double free in fdt_ensure_space
>   of: overlay: initialize ret to fix garbage return value
>   firmware: xilinx-fpga: fix double free in probe error path
>   driver: fix missing va_end in dev_add_alias error path
>   net: eth: avoid overlapping memcpy in eth_set_ethaddr
>   pmdomain: fix dereference before NULL check in genpd_get_from_provider
>   net: phy: add NULL check for phy driver in page accessors
>   open: add missing mode argument to O_CREAT calls
>   hush: add NULL check for gl_pathv after do_glob_in_argv
>   i2c: rk3x: fix NULL pointer dereference on repeated NACK
>   mci: imx-esdhc: remove misleading NULL check for cmd pointer
>   mci: spi: initialize r1 to fix garbage return value
>   virtio: fix variable shadowing in virtqueue_add_sgs input scatter loop
>   video: mode-helpers: preserve sync polarity in fb_videomode conversion
>   scripts: include: break dependency of list.h on kernel.h
>   jwt: fix buffer overflow and double-free in jwt_part_parse
>   of: fdt: fix heap-buffer-overflow in fdt_machine_is_compatible
>   powerpc: fix initjmp storing function pointer at wrong offset
>   of: fdt: refuse / in property and node names
> 
> [...]

Applied, thanks!

[01/58] clk: clkdev: fix format security.
        https://git.pengutronix.de/cgit/barebox/commit/?id=23b684a70989 (link may not be stable)
[02/58] scripts: imx: fix string in further auth block
        https://git.pengutronix.de/cgit/barebox/commit/?id=ae678588fa65 (link may not be stable)
[03/58] scripts: imx-image: support DCD_WRITE on closed dev
        https://git.pengutronix.de/cgit/barebox/commit/?id=e2fa44f2c247 (link may not be stable)
[04/58] mci: am654-sdhci: Wait for transfer complete interrupt with MMC_RSP_BUSY cmd
        https://git.pengutronix.de/cgit/barebox/commit/?id=6d8ed233601c (link may not be stable)
[05/58] video: simplefb-client: switch to dev_get_resource
        https://git.pengutronix.de/cgit/barebox/commit/?id=1ccad7130118 (link may not be stable)
[06/58] MIPS: qemu-malta_defconfig: Use largest possible relocation table
        https://git.pengutronix.de/cgit/barebox/commit/?id=ac30473fdb47 (link may not be stable)
[07/58] firmware: handle firmware files being links correctly
        https://git.pengutronix.de/cgit/barebox/commit/?id=b24cb4e63754 (link may not be stable)
[08/58] drivers: don't propagate of_alias_get_id's -ENODEV out of probe
        https://git.pengutronix.de/cgit/barebox/commit/?id=b25ee6c49dcd (link may not be stable)
[09/58] ARM: socfpga: arria10-reset-manager: release UART0
        https://git.pengutronix.de/cgit/barebox/commit/?id=8258724fc487 (link may not be stable)
[10/58] bug: add support for CONFIG_DEBUG_BUGVERBOSE
        https://git.pengutronix.de/cgit/barebox/commit/?id=d1da24c36384 (link may not be stable)
[11/58] driver: implement get_free_deviceid_from()
        https://git.pengutronix.de/cgit/barebox/commit/?id=6eb262c5b83c (link may not be stable)
[12/58] sandbox: fix make dependency for sandbox
        https://git.pengutronix.de/cgit/barebox/commit/?id=80e53714c987 (link may not be stable)
[13/58] gpio: Fix GPIOD_ASIS flag
        https://git.pengutronix.de/cgit/barebox/commit/?id=dbb7385b599f (link may not be stable)
[14/58] i.MX: HAB: fix field return unlock fuse uid
        https://git.pengutronix.de/cgit/barebox/commit/?id=9326a0c475e6 (link may not be stable)
[15/58] ARM: cpu: common: skip R_ARM_NONE relocations
        https://git.pengutronix.de/cgit/barebox/commit/?id=e5eb57a73979 (link may not be stable)
[16/58] mmc: resolve conflict between MMC_CAP_NONREMOVABLE and MMC_CAP_1_8V_DDR
        https://git.pengutronix.de/cgit/barebox/commit/?id=8fe29887b161 (link may not be stable)
[17/58] virtio: ring: fix stale data in queue after reset
        https://git.pengutronix.de/cgit/barebox/commit/?id=5822aacb75b6 (link may not be stable)
[18/58] scripts: Makefile.lib: suppress graph_port warnings for overlays
        https://git.pengutronix.de/cgit/barebox/commit/?id=3bf5c487105a (link may not be stable)
[19/58] ARM: Rockchip: rk3576-prtpuk: suppress video graph warning
        https://git.pengutronix.de/cgit/barebox/commit/?id=6d5c9e44b11e (link may not be stable)
[20/58] kbuild: fold rmdirs into rmfiles
        https://git.pengutronix.de/cgit/barebox/commit/?id=e5e34be553b1 (link may not be stable)
[21/58] mtd: nand: mxc_nand: use clk_get_optional for clock handling
        https://git.pengutronix.de/cgit/barebox/commit/?id=5245ca36ddd8 (link may not be stable)
[22/58] FIT: fix double free issue with >1 reference count
        https://git.pengutronix.de/cgit/barebox/commit/?id=3e60a007c676 (link may not be stable)
[23/58] net: phy: mdio_bus: fix freeing of cdev name before devfs_remove
        https://git.pengutronix.de/cgit/barebox/commit/?id=55709075703f (link may not be stable)
[24/58] bootm: fix bootm override saving/restoring
        https://git.pengutronix.de/cgit/barebox/commit/?id=5e9f709b2b56 (link may not be stable)
[25/58] common: tlv: Correct eth address list fixup
        https://git.pengutronix.de/cgit/barebox/commit/?id=815862ac498e (link may not be stable)
[26/58] common: tlv: fix link error when CONFIG_NET is disabled
        https://git.pengutronix.de/cgit/barebox/commit/?id=174540be3743 (link may not be stable)
[27/58] include: array_size.h: make header self-contained
        https://git.pengutronix.de/cgit/barebox/commit/?id=c40fa04cccb1 (link may not be stable)
[28/58] RISC-V: dts: fix generation of dtbs-list
        https://git.pengutronix.de/cgit/barebox/commit/?id=34e1e79a8853 (link may not be stable)
[29/58] of: overlay: propagate error unflattening DTBO
        https://git.pengutronix.de/cgit/barebox/commit/?id=f511abc156b8 (link may not be stable)
[30/58] efi: fix potential NULL dereference
        https://git.pengutronix.de/cgit/barebox/commit/?id=9b3ffc1f6f18 (link may not be stable)
[31/58] FIT: fix potential underflow of stack array
        https://git.pengutronix.de/cgit/barebox/commit/?id=807ea7cde594 (link may not be stable)
[32/58] of: fdt: fix double free in fdt_ensure_space
        https://git.pengutronix.de/cgit/barebox/commit/?id=deb677d79fad (link may not be stable)
[33/58] of: overlay: initialize ret to fix garbage return value
        https://git.pengutronix.de/cgit/barebox/commit/?id=b3290dbd8a74 (link may not be stable)
[34/58] firmware: xilinx-fpga: fix double free in probe error path
        https://git.pengutronix.de/cgit/barebox/commit/?id=b99e16c02227 (link may not be stable)
[35/58] driver: fix missing va_end in dev_add_alias error path
        https://git.pengutronix.de/cgit/barebox/commit/?id=fb673c396fa8 (link may not be stable)
[36/58] net: eth: avoid overlapping memcpy in eth_set_ethaddr
        https://git.pengutronix.de/cgit/barebox/commit/?id=2d7427591555 (link may not be stable)
[37/58] pmdomain: fix dereference before NULL check in genpd_get_from_provider
        https://git.pengutronix.de/cgit/barebox/commit/?id=167672b110b2 (link may not be stable)
[38/58] net: phy: add NULL check for phy driver in page accessors
        https://git.pengutronix.de/cgit/barebox/commit/?id=d4d047b05f18 (link may not be stable)
[39/58] open: add missing mode argument to O_CREAT calls
        https://git.pengutronix.de/cgit/barebox/commit/?id=e91e5fa2d4ac (link may not be stable)
[40/58] hush: add NULL check for gl_pathv after do_glob_in_argv
        https://git.pengutronix.de/cgit/barebox/commit/?id=28233485b104 (link may not be stable)
[41/58] i2c: rk3x: fix NULL pointer dereference on repeated NACK
        https://git.pengutronix.de/cgit/barebox/commit/?id=017a73ac6ae7 (link may not be stable)
[42/58] mci: imx-esdhc: remove misleading NULL check for cmd pointer
        https://git.pengutronix.de/cgit/barebox/commit/?id=6d0e9f159d8c (link may not be stable)
[43/58] mci: spi: initialize r1 to fix garbage return value
        https://git.pengutronix.de/cgit/barebox/commit/?id=f0fc6ca923e7 (link may not be stable)
[44/58] virtio: fix variable shadowing in virtqueue_add_sgs input scatter loop
        https://git.pengutronix.de/cgit/barebox/commit/?id=ff0c2ac858f3 (link may not be stable)
[45/58] video: mode-helpers: preserve sync polarity in fb_videomode conversion
        https://git.pengutronix.de/cgit/barebox/commit/?id=0faf083d8c26 (link may not be stable)
[46/58] ARM: rockchip: dmc: use define instead of hardcoded value
        https://git.pengutronix.de/cgit/barebox/commit/?id=6e5bf8107858 (link may not be stable)
[47/58] ARM: rockchip: atf: Fix memend
        https://git.pengutronix.de/cgit/barebox/commit/?id=dbc07f2c0dcd (link may not be stable)
[48/58] regulator: fix handling of off_on_delay
        https://git.pengutronix.de/cgit/barebox/commit/?id=7d77fc780984 (link may not be stable)
[49/58] regulator: fixed: handle startup-delay-us property
        https://git.pengutronix.de/cgit/barebox/commit/?id=e55420747c4c (link may not be stable)
[50/58] scripts: include: break dependency of list.h on kernel.h
        https://git.pengutronix.de/cgit/barebox/commit/?id=388f1a4ed209 (link may not be stable)
[51/58] Makefile: include scripts/ in compile_commands.json
        https://git.pengutronix.de/cgit/barebox/commit/?id=6114e1696ce0 (link may not be stable)
[52/58] jwt: fix buffer overflow and double-free in jwt_part_parse
        https://git.pengutronix.de/cgit/barebox/commit/?id=887336a3893f (link may not be stable)
[53/58] of: fdt: fix heap-buffer-overflow in fdt_machine_is_compatible
        https://git.pengutronix.de/cgit/barebox/commit/?id=a93be0c08571 (link may not be stable)
[54/58] powerpc: fix initjmp storing function pointer at wrong offset
        https://git.pengutronix.de/cgit/barebox/commit/?id=9ef982408a17 (link may not be stable)
[55/58] net: r8169: drain RX descriptor ring
        https://git.pengutronix.de/cgit/barebox/commit/?id=61cd0e6d1130 (link may not be stable)
[56/58] of: fdt: refuse / in property and node names
        https://git.pengutronix.de/cgit/barebox/commit/?id=3565bfaa21e6 (link may not be stable)
[57/58] FIT: reconstruct hashed-nodes property during verification
        https://git.pengutronix.de/cgit/barebox/commit/?id=3e37da7f6ec9 (link may not be stable)
[58/58] scripts: fix build failure with glibc 2.43
        https://git.pengutronix.de/cgit/barebox/commit/?id=ad5a62c12de7 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>