[PATCH v2025.09.y 00/49] Backports for v2025.09.1

[PATCH v2025.09.y 00/49] Backports for v2025.09.1

[Ahmad Fatoum]

We intend to maintain v2025.09.y upstream until Yocto Whinlatter becomes
EOL in April 2026.

All fixes included in this series are backports from master and have
mostly been part of newer releases.

Ahmad Fatoum (20):
  scripts: rockchip: rkimage: reinstate OpenSSL 1.1 compatibility
  range: fix corner cases when exclusive end is zero
  state: guard against empty variable set in DT
  ARM: i.MX8M: romapi: skip zero_page_access() if MMU is disabled
  ARM: mmu: have zero_page_remappable() check MMU status
  ARM: mmu: fix hang when reserved memory at start of RAM
  poller: activate POLLER_WARN_OVERTIME only on third strike
  bootm: fix boot override inheritance
  fs: qemu_fw_cfg: make use of the automount
  fs: qemu_fw_cfg: handle non-existent opt/org.barebox.env key
    gracefully
  boards: qemu-virt: drop fitimage-pubkey.dts
  sandbox: fix race with .old_version removal
  mci: am654-sdhci: correctly configure SLOTTYPE_EMBEDDED
  net: arp: collect context into new struct pending_arp
  net: reset pending ARP state when request is done
  test: populate qemu_bin, even if missing features
  test: exit directly when invoking QEMU states on non-QEMU targets
  param: make setting a parameter to the same string value a no-op
  i2c: omap: fix probe on am335x
  net: 9p: fix variable name in BAREBOX_MAGICVAR

Alexander Shiyan (4):
  clk: rockchip: rk3588: Add PLL rate for 1500 MHz
  ARM: dts: rockchip: Set initial CPU frequencies for RK3588
  ARM: dts: rockchip: Set CPLL frequency for RK3588
  commands: truncate: fix multiple file handling with relative sizes

Chali Anis (1):
  pci: pci-tegra: fix null pointer assignation.

Jonas Rebmann (3):
  virtio: Stop spamming debug buffer
  tlv: register_device() error handling
  lib: base64: Fix out-of-bounds potential by respecting dst_len

Maud Spierings (6):
  ARM: i.MX: Fix the iomux DSE defines for imx8mp
  net: designware-imx: don't set txclk when mode is (r)mii
  scripts: imx: Makefile.mingw64: add _GNU_SOURCE
  scripts: imx: add pread implementation for mingw target
  ARM: i.MX8M: Fix the RAM size calculation for DDR3
  pmdomain: fix collision in names when registering

Michael Grzeschik (1):
  clk: clk_set_parent: skip any operation if current and new parents are
    equal

Philipp Zabel (1):
  ARM: i.MX6: configure AIPS registers only if trusted

Sascha Hauer (13):
  mci: sdhci: am654: Use sdhci_wait_idle()
  ARM: dts: am62lx: fix secondary core startup
  mtd: peb: mtd_peb_read(): move error message to caller
  fs: nfs: drop PROG_NFS special casing
  fs: nfs: do not read past packets
  clk: rockchip rk3588: configure CPLL in driver
  fs: fix automount when last filename component is a automountpoint
  ARM: K3: am62l: don't put sysfwdata into 1st stage image
  ARM: k3: make some firmware files SoC specific
  ARM: k3: am62l: Add dedicated config option for OP-TEE
  ARM: k3: am62l: fix dependencies on k3img input files
  i2c: implement i2c_unregister_device()
  eeprom: at24: unregister devices in error path

 Makefile                                    |   2 +
 arch/arm/cpu/mmu-common.c                   |   8 +-
 arch/arm/dts/k3-am62l-barebox.dtsi          |   4 +
 arch/arm/dts/rk3588.dtsi                    |  11 +-
 arch/arm/mach-imx/esdctl.c                  |   5 +-
 arch/arm/mach-imx/imx6.c                    |   8 +
 arch/arm/mach-imx/romapi.c                  |   9 +-
 commands/truncate.c                         |  11 +-
 common/Kconfig                              |   2 +-
 common/boards/qemu-virt/Makefile            |   3 +-
 common/boards/qemu-virt/board.c             |   5 +-
 common/boards/qemu-virt/fitimage-pubkey.dts |   3 -
 common/boot.c                               |   5 +-
 common/bootm.c                              |   7 +-
 common/poller.c                             |   4 +-
 common/state/backend_format_raw.c           |  16 +-
 common/state/state.c                        |   8 +-
 common/tlv/bus.c                            |   7 +-
 conftest.py                                 |   6 +-
 drivers/base/power.c                        |   4 +-
 drivers/clk/clk.c                           |   3 +
 drivers/clk/rockchip/clk-rk3588.c           |   8 +
 drivers/eeprom/at24.c                       |   5 +-
 drivers/i2c/busses/i2c-omap.c               |   5 +-
 drivers/i2c/i2c.c                           |   6 +
 drivers/mci/am654-sdhci.c                   |   5 +-
 drivers/mtd/peb.c                           |   2 +-
 drivers/mtd/ubi/io.c                        |   8 +
 drivers/net/designware_imx.c                |   5 +
 drivers/pci/pci-tegra.c                     |   2 +-
 drivers/virtio/virtio_ring.c                |   4 +-
 firmware/Kconfig                            |   4 +
 fs/devfs-core.c                             |   6 +
 fs/fs.c                                     |  10 +-
 fs/nfs.c                                    | 330 ++++++++++++++------
 fs/qemu_fw_cfg.c                            |  36 +--
 images/Makefile.k3                          |  62 ++--
 include/bootm-overrides.h                   |   7 +-
 include/driver.h                            |   2 +
 include/i2c/i2c.h                           |   2 +
 include/linux/list.h                        |  14 +
 include/mach/imx/iomux-mx8mp.h              |   4 +-
 include/range.h                             |  31 +-
 include/zero_page.h                         |  12 +-
 lib/base64.c                                |  10 +-
 lib/parameter.c                             |   2 +
 net/9p/mod.c                                |   2 +-
 net/net.c                                   |  47 ++-
 scripts/imx/Makefile.mingw64                |   4 +-
 scripts/imx/pread.c                         |  25 ++
 scripts/rkimage.c                           |  15 +-
 test/strategy.py                            |   3 +
 52 files changed, 557 insertions(+), 252 deletions(-)
 delete mode 100644 common/boards/qemu-virt/fitimage-pubkey.dts
 create mode 100644 scripts/imx/pread.c

-- 
2.47.3

[PATCH v2025.09.y 01/49] mci: sdhci: am654: Use sdhci_wait_idle()

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

sdhci_wait_idle() is what Linux does and it works fine in barebox.
sdhci_wait_idle_data() instead also waits for the SDHCI_CMD_INHIBIT_DATA
bit which shouldn't be necessary.

Link: https://lore.barebox.org/20250828113442.3543907-2-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit a2876b0468eeda34846a88bb3ce6fec9718035b5)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/mci/am654-sdhci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mci/am654-sdhci.c b/drivers/mci/am654-sdhci.c
index 24abf10492c1..17d3f7627005 100644
--- a/drivers/mci/am654-sdhci.c
+++ b/drivers/mci/am654-sdhci.c
@@ -463,7 +463,7 @@ static int am654_sdhci_send_cmd(struct mci_host *mci, struct mci_cmd *cmd,
 	int ret;
 	dma_addr_t dma;
 
-	ret = sdhci_wait_idle_data(&host->sdhci, cmd);
+	ret = sdhci_wait_idle(&host->sdhci, cmd, data);
 	if (ret)
 		return ret;
 
-- 
2.47.3

[PATCH v2025.09.y 02/49] clk: rockchip: rk3588: Add PLL rate for 1500 MHz

[Ahmad Fatoum]

From: Alexander Shiyan <eagle.alexander923@gmail.com>

At least one RK3588 clock (CPLL) uses 1.5 GHz, so let's add
that frequency to the PLL table.
This change is taken from the mainline Linux kernel.

Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Link: https://lore.barebox.org/20250924060906.6791-1-eagle.alexander923@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit dc780c20b06749773dfc38e177957beae14960ab)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/clk/rockchip/clk-rk3588.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/clk/rockchip/clk-rk3588.c b/drivers/clk/rockchip/clk-rk3588.c
index f6d16ed0cf30..5aecfb3b1b71 100644
--- a/drivers/clk/rockchip/clk-rk3588.c
+++ b/drivers/clk/rockchip/clk-rk3588.c
@@ -88,6 +88,7 @@ static struct rockchip_pll_rate_table rk3588_pll_rates[] = {
 	RK3588_PLL_RATE(1560000000, 2, 260, 1, 0),
 	RK3588_PLL_RATE(1536000000, 2, 256, 1, 0),
 	RK3588_PLL_RATE(1512000000, 2, 252, 1, 0),
+	RK3588_PLL_RATE(1500000000, 2, 250, 1, 0),
 	RK3588_PLL_RATE(1488000000, 2, 248, 1, 0),
 	RK3588_PLL_RATE(1464000000, 2, 244, 1, 0),
 	RK3588_PLL_RATE(1440000000, 2, 240, 1, 0),
-- 
2.47.3

[PATCH v2025.09.y 03/49] ARM: i.MX6: configure AIPS registers only if trusted

[Ahmad Fatoum]

From: Philipp Zabel <p.zabel@pengutronix.de>

Bail out of AIPS configuration if OP-TEE has cleared the MTW
("master trusted for write access") bit for the ARM core master
to lock down AIPS configuration.

Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://lore.barebox.org/20250925122603.3345276-1-p.zabel@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 4fbda28fa7ec6d6cc0e480b19cc52c955b5154dd)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/mach-imx/imx6.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm/mach-imx/imx6.c b/arch/arm/mach-imx/imx6.c
index ed6cde801ec7..0cf2c17d6b90 100644
--- a/arch/arm/mach-imx/imx6.c
+++ b/arch/arm/mach-imx/imx6.c
@@ -31,8 +31,16 @@
 #define MX6_OCOTP_CFG0			0x410
 #define MX6_OCOTP_CFG1			0x420
 
+#define BM_MPR_MPROT1_MTW		(0x1 << 25)
+
 static void imx6_configure_aips(void __iomem *aips)
 {
+	u32 mpr = readl(aips);
+
+	/* Bail if CPU ist not trusted for write accesses. */
+	if (!(mpr & BM_MPR_MPROT1_MTW))
+		return;
+
 	/*
 	 * Set all MPROTx to be non-bufferable, trusted for R/W,
 	 * not forced to user-mode.
-- 
2.47.3

[PATCH v2025.09.y 04/49] ARM: dts: rockchip: Set initial CPU frequencies for RK3588

[Ahmad Fatoum]

From: Alexander Shiyan <eagle.alexander923@gmail.com>

During system boot, the cpufreq driver reports unlisted initial frequencies:
cpufreq: cpufreq_policy_online: CPU0: Running at unlisted initial frequency: 900000 kHz, changing to: 1200000 kHz
cpufreq: cpufreq_policy_online: CPU4: Running at unlisted initial frequency: 816000 kHz, changing to: 1200000 kHz
cpufreq: cpufreq_policy_online: CPU6: Running at unlisted initial frequency: 816000 kHz, changing to: 1200000 kHz

Add assigned-clock-rates to the SCMI clock controller node in the device
tree to establish proper initial frequencies.
This ensures all CPU cores boot at valid frequencies that match the
cpufreq policy, eliminating the warning messages and unnecessary
frequency changes during initialization.

Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Link: https://lore.barebox.org/20250929135857.965181-1-eagle.alexander923@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 1b91aafee348423090c1347307674fd17729c00c)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/dts/rk3588.dtsi | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/arm/dts/rk3588.dtsi b/arch/arm/dts/rk3588.dtsi
index 667dd0c5a873..416700cf0ecd 100644
--- a/arch/arm/dts/rk3588.dtsi
+++ b/arch/arm/dts/rk3588.dtsi
@@ -8,7 +8,12 @@ dmc: memory-controller {
 };
 
 &scmi_clk {
-	assigned-clocks = <&scmi_clk SCMI_CLK_CPUB01>,
-			  <&scmi_clk SCMI_CLK_CPUB23>;
-	assigned-clock-rates = <816000000>, <816000000>;
+	assigned-clocks =
+		<&scmi_clk SCMI_CLK_CPUL>,
+		<&scmi_clk SCMI_CLK_CPUB01>,
+		<&scmi_clk SCMI_CLK_CPUB23>;
+	assigned-clock-rates =
+		<1200000000>,
+		<1200000000>,
+		<1200000000>;
 };
-- 
2.47.3

[PATCH v2025.09.y 05/49] ARM: dts: rockchip: Set CPLL frequency for RK3588

[Ahmad Fatoum]

From: Alexander Shiyan <eagle.alexander923@gmail.com>

Explicitly configure CPLL frequency to 1500 MHz to ensure system
stability and reliable operation.
The change aligns with Rockchip's recommended practices for clock
configuration in embedded systems using RK3588 SoCs.

Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Link: https://lore.barebox.org/20250929135857.965181-2-eagle.alexander923@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 09c87c85e098fdfcec00200b68c8ae285e1cd47c)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/dts/rk3588.dtsi | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/dts/rk3588.dtsi b/arch/arm/dts/rk3588.dtsi
index 416700cf0ecd..42d692a9bdd1 100644
--- a/arch/arm/dts/rk3588.dtsi
+++ b/arch/arm/dts/rk3588.dtsi
@@ -1,6 +1,9 @@
 // SPDX-License-Identifier: (GPL-2.0+ OR MIT)
 
 / {
+	assigned-clocks = <&cru PLL_CPLL>;
+	assigned-clock-rates = <1500000000>;
+
 	dmc: memory-controller {
 		compatible = "rockchip,rk3588-dmc";
 		rockchip,pmu = <&pmu1grf>;
-- 
2.47.3

[PATCH v2025.09.y 06/49] scripts: rockchip: rkimage: reinstate OpenSSL 1.1 compatibility

[Ahmad Fatoum]

The new signing support made the rkimage utility require OpenSSL 3.0.

We will keep that requirement for signing, but for usage without
signing, let's skip the signing bits optional and report an error on
attempting to sign.

Reported-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Cc: Michael Tretter <m.tretter@pengutronix.de>
Fixes: 54da6347b273 ("scripts: rockchip: implement image signing")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Tested-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Link: https://lore.barebox.org/20250930134652.3035951-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit fddbc93cb9fe864b97d9f1af5177f2172fd33972)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 scripts/rkimage.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/scripts/rkimage.c b/scripts/rkimage.c
index 9b3ae8bbfff7..e5b6d61c4a9d 100644
--- a/scripts/rkimage.c
+++ b/scripts/rkimage.c
@@ -13,7 +13,6 @@
 #include <stdbool.h>
 
 #include <openssl/bn.h>
-#include <openssl/core_names.h>
 /*
  * TODO Switch from the OpenSSL ENGINE API to the PKCS#11 provider and the
  * PROVIDER API: https://github.com/latchset/pkcs11-provider
@@ -64,7 +63,7 @@ static void idb_hash(struct newidb *idb)
 		sha512(idbu8, size, idbu8 + size);
 }
 
-static EVP_PKEY *load_key_pkcs11(const char *path)
+static __attribute__((unused)) EVP_PKEY *load_key_pkcs11(const char *path)
 {
 	const char *engine_id = "pkcs11";
 	ENGINE *e;
@@ -95,7 +94,7 @@ static EVP_PKEY *load_key_pkcs11(const char *path)
 	return pkey;
 }
 
-static EVP_PKEY *load_key_file(const char *path)
+static __attribute__((unused)) EVP_PKEY *load_key_file(const char *path)
 {
 	BIO *key;
 	EVP_PKEY *pkey = NULL;
@@ -180,6 +179,9 @@ static int create_newidb(struct newidb *idb)
 	return 0;
 }
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/core_names.h>
+
 static int rsa_get_params(EVP_PKEY *key, BIGNUM *e, BIGNUM *n, BIGNUM *np)
 {
 	BN_CTX *ctx = BN_CTX_new();
@@ -356,6 +358,13 @@ static int sign_newidb(struct newidb *idb, const char *path)
 
 	return ret;
 }
+#else
+static int sign_newidb(struct newidb *idb, const char *path)
+{
+       fprintf(stderr, "Signing support requires at least OpenSSL 3.0\n");
+       return -ENOSYS;
+}
+#endif
 
 struct option cbootcmd[] = {
 	{"help", 0, NULL, 'h'},
-- 
2.47.3

[PATCH v2025.09.y 07/49] ARM: dts: am62lx: fix secondary core startup

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

Disable the rti1 watchdog which fixes startup of the secondary CPU core
under Linux.

Enabling the rti1 watchdog leads to enabling its power domain,
<&scmi_pds 61> in this case. With this starting the secondary core fails
under Linux:

[    5.095816] CPU1: failed to come online
[    5.095832] CPU1: failed in unknown state : 0x0
[    5.095892] smp: Brought up 1 node, 1 CPU
[    5.095898] SMP: Total of 1 processors activated.

I don't know what's exactly going on here, but it seems enabling the
power domain either indirectly starts the secondary core in barebox
already or it causes some weird power state for the secondary CPU from
which the Tf-A can't recover later.

The device node is the same as under Linux later, but in Linux the rti1
watchdog is configured after the secondary CPU has been started.

Link: https://lore.barebox.org/20251007085117.941408-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit bad67240e49fa1bf9b5ce6cc1338d3f16770759d)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/dts/k3-am62l-barebox.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/dts/k3-am62l-barebox.dtsi b/arch/arm/dts/k3-am62l-barebox.dtsi
index 34bf42c01f06..43cf039d013f 100644
--- a/arch/arm/dts/k3-am62l-barebox.dtsi
+++ b/arch/arm/dts/k3-am62l-barebox.dtsi
@@ -11,6 +11,10 @@ &gpio2 {
 	status = "okay";
 };
 
+&rti1 {
+	status = "disabled";
+};
+
 &wkup_gpio0 {
 	status = "okay";
 };
-- 
2.47.3

[PATCH v2025.09.y 08/49] ARM: i.MX: Fix the iomux DSE defines for imx8mp

[Ahmad Fatoum]

From: Maud Spierings <maud_spierings@hotmail.com>

The DSE field has a deceptive layout, DSE 2 is a higher value than DSE 4

See reference manual 8.2.2.1.3 or the description of any IOMUXC_SW_PAD_X
register in 8.2.4.144+

Fixes: 3c0d42752e9a ("arm: imx: add initial imx8mp support")
Signed-off-by: Maud Spierings <maud_spierings@hotmail.com>
Link: https://lore.barebox.org/20251019-iomux-v1-1-e049726947ce@hotmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 7f0f37f7bc7750f31f427ca271ccfe4c9a763fde)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 include/mach/imx/iomux-mx8mp.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/mach/imx/iomux-mx8mp.h b/include/mach/imx/iomux-mx8mp.h
index 98e340d3dad1..da5cfe3048ca 100644
--- a/include/mach/imx/iomux-mx8mp.h
+++ b/include/mach/imx/iomux-mx8mp.h
@@ -1081,8 +1081,8 @@ enum {
 };
 
 #define MX8MP_PAD_CTL_DSE1	(0 << 1)
-#define MX8MP_PAD_CTL_DSE2	(1 << 1)
-#define MX8MP_PAD_CTL_DSE4	(2 << 1)
+#define MX8MP_PAD_CTL_DSE2	(2 << 1)
+#define MX8MP_PAD_CTL_DSE4	(1 << 1)
 #define MX8MP_PAD_CTL_DSE6	(3 << 1)
 #define MX8MP_PAD_CTL_FSEL	BIT(4)
 #define MX8MP_PAD_CTL_ODE	BIT(5)
-- 
2.47.3

[PATCH v2025.09.y 09/49] virtio: Stop spamming debug buffer

[Ahmad Fatoum]

From: Jonas Rebmann <jre@pengutronix.de>

At log level 7, this permanently prints over a hundred times per second,
probably unneeded debug print, drop it.

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251014-virtiospam-v1-1-138c7a8dd3de@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit d4131710d095c6a36b338dace449a365f4ea4810)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/virtio/virtio_ring.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 284721aeff5b..c1c84e49615f 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -241,10 +241,8 @@ void *virtqueue_get_buf(struct virtqueue *vq, unsigned int *len)
 	u16 last_used;
 	void *ret;
 
-	if (!more_used(vq)) {
-		vq_debug(vq, "No more buffers in queue\n");
+	if (!more_used(vq))
 		return NULL;
-	}
 
 	/* Only get used array entries after they have been exposed by host */
 	virtio_rmb();
-- 
2.47.3

[PATCH v2025.09.y 10/49] clk: clk_set_parent: skip any operation if current and new parents are equal

[Ahmad Fatoum]

From: Michael Grzeschik <m.grzeschik@pengutronix.de>

When an clk is defined with only one parent it probably has no
set_parent function. Therefor changing the parent would return with
-EINVAL. We check for this case and skip this function in this case.

Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251013094943.1299607-1-m.grzeschik@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit c8ad4cc8956f886e50eceeb52fffc38e7ff01d26)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/clk/clk.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index 89a007a12c5b..ac5b83cf8b40 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -302,6 +302,9 @@ int clk_set_parent(struct clk *clk, struct clk *newparent)
 	if (IS_ERR(newparent))
 		return PTR_ERR(newparent);
 
+	if (newparent == curparent)
+		return 0;
+
 	if (!clk->num_parents)
 		return -EINVAL;
 	if (!clk->ops->set_parent)
-- 
2.47.3

[PATCH v2025.09.y 11/49] range: fix corner cases when exclusive end is zero

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

Unlike inclusive ranges, exclusive ranges can be empty and
region_overlap_end_exclusive() goes beyond that and checks that ranges
are neither empty nor does the end precede the start.

This is problematic for a range that stretches to the maximum value of a
type. Exclusive end in that case would be 0 and 0 comes before all
non-zero numbers, so the region_overlap_end_exclusive() would always
return false.

Fix this by normalizing end to be inclusive first thing in the function.
And for extra safety, enforce that the function may only be called with
arguments that are all of the same unsigned type.

This resolves a MMU hang on an STM32MP1 board with 1G RAM that had
memory stretching from 0xc00000000 to 0xffffffff inclusive as
remap_range_end_sans_text() would not detect the text area overlap and
then all of RAM, including where barebox is running from would be mapped
non-executable.

Fixes: 768fdb36f30e ("partition: define new region_overlap_end_exclusive helper")
Reported-by: Sohaib Mohamed <sohaib.amhmd@gmail.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20251101105542.3830943-1-a.fatoum@barebox.org
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 3e2d06afabe166e575c66e3d9faa2070933ebb1c)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 include/range.h | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/include/range.h b/include/range.h
index bb41dc78ac43..b5dc5cdb4d39 100644
--- a/include/range.h
+++ b/include/range.h
@@ -3,6 +3,8 @@
 #define _RANGE_H__
 
 #include <linux/types.h>
+#include <linux/compiler.h>
+#include <linux/build_bug.h>
 
 /**
  * region_overlap_end_inclusive - check whether a pair of [start, end] ranges overlap
@@ -29,17 +31,26 @@ static inline bool region_overlap_end_inclusive(u64 starta, u64 enda,
  * @enda:   end of the first range (exclusive)
  * @startb: start of the second range
  * @endb:   end of the second range (exclusive)
+ *
+ * NOTE: end of zero is always interpreted to mean including the maximum
+ * value of the type.
  */
-static inline bool region_overlap_end_exclusive(u64 starta, u64 enda,
-						u64 startb, u64 endb)
-{
-	/* Empty ranges don't overlap */
-	if (starta >= enda || startb >= endb)
-		return false;
-
-	return region_overlap_end_inclusive(starta, enda - 1,
-					    startb, endb - 1);
-}
+#define region_overlap_end_exclusive(starta, enda, startb, endb)	\
+({									\
+	u64 __starta = (starta), __enda = (enda) - 1;			\
+	u64 __startb = (startb), __endb = (endb) - 1;			\
+									\
+	static_assert(__same_type((starta), (enda)));			\
+	static_assert(__same_type((enda), (startb)));			\
+	static_assert(__same_type((startb), (endb)));			\
+	static_assert(((typeof(endb))-1) > 0);				\
+									\
+	/* Empty ranges don't overlap */				\
+	(__starta <= __enda && __startb <= __endb)			\
+		 ? region_overlap_end_inclusive(__starta, __enda,	\
+						__startb, __endb)	\
+		 : false;						\
+})
 
 
 /**
-- 
2.47.3

[PATCH v2025.09.y 12/49] mtd: peb: mtd_peb_read(): move error message to caller

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

Move the error message about a failure to read a PEB to the caller.
In some cases like for example i.MX6 with NAND boot it can happen
that mtd_peb_read() is called on the NAND blocks containing the FCB.
These are not protected with regular ECC, so are not readable. The error
message is expected and harmless. UBI needs this error message though,
so move it there. Other callers have their own error message already.

Link: https://lore.barebox.org/20251029131617.1607191-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 7605338da017da2492d83e919f7a88eefe4cd306)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/mtd/peb.c    | 2 +-
 drivers/mtd/ubi/io.c | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/peb.c b/drivers/mtd/peb.c
index 840fc1799a38..10ccf188c798 100644
--- a/drivers/mtd/peb.c
+++ b/drivers/mtd/peb.c
@@ -239,7 +239,7 @@ int mtd_peb_read(struct mtd_info *mtd, void *buf, int pnum, int offset,
 		if (mtd_is_eccerr(err) && retries++ < MTD_IO_RETRIES)
 			goto retry;
 
-		dev_err(&mtd->dev, "error %d%s while reading %d bytes from PEB %d:%d\n",
+		dev_dbg(&mtd->dev, "error %d%s while reading %d bytes from PEB %d:%d\n",
 			err, errstr, len, pnum, offset);
 		return err;
 	}
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index 88df185789df..340a601426a0 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -115,6 +115,14 @@ int ubi_io_read(const struct ubi_device *ubi, void *buf, int pnum, int offset,
 	ret = mtd_peb_read(ubi->mtd, buf, pnum, offset, len);
 	if (mtd_is_bitflip(ret))
 		return UBI_IO_BITFLIPS;
+
+	if (ret) {
+		const char *errstr = mtd_is_eccerr(ret) ? " (ECC error)" : "";
+
+		ubi_err(ubi, "error %d%s while reading %d bytes from PEB %d:%d\n",
+			ret, errstr, len, pnum, offset);
+	}
+
 	return ret;
 }
 
-- 
2.47.3

[PATCH v2025.09.y 13/49] state: guard against empty variable set in DT

[Ahmad Fatoum]

We always initialize state->variables, but there are two places in the
code that assume there is at least one entry already.

Change them to use list_first_entry_or_null/list_last_entry_or_null as
appropriate to catch this issue gracefully.

This should have only affected state nodes without children, which is
not a useful device tree description, but nevertheless we should handle
that somehow instead of reading uninitialized values that may trigger
a panic or other misbehavior.

Reported-by: Fabian Pfitzner <f.pfitzner@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251103111624.1848136-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit f1b549a97e503ccc227d2f103fa73351ebf3fca1)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/state/backend_format_raw.c | 16 ++++++++++++++--
 common/state/state.c              |  8 +++++---
 include/linux/list.h              | 14 ++++++++++++++
 3 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/common/state/backend_format_raw.c b/common/state/backend_format_raw.c
index 5fb38cd711da..b7b88dd5b94e 100644
--- a/common/state/backend_format_raw.c
+++ b/common/state/backend_format_raw.c
@@ -198,6 +198,18 @@ static int backend_format_raw_unpack(struct state_backend_format *format,
 	return ret;
 }
 
+static inline size_t state_data_size(struct state *state)
+{
+	const struct state_variable *sv;
+
+	/* Make use of the fact that the list is sorted in ascending order */
+	sv = list_last_entry_or_null(&state->variables, struct state_variable, list);
+	if (!sv)
+		return 0;
+
+	return sv->start + sv->size;
+}
+
 static int backend_format_raw_pack(struct state_backend_format *format,
 				   struct state *state, void ** buf_out,
 				   ssize_t * len_out)
@@ -216,8 +228,8 @@ static int backend_format_raw_pack(struct state_backend_format *format,
 			return ret;
 	}
 
-	sv = list_last_entry(&state->variables, struct state_variable, list);
-	size_data = sv->start + sv->size;
+	size_data = state_data_size(state);
+
 	size_full = size_data + sizeof(*header) + backend_raw->digest_length;
 
 	buf = xzalloc(size_full);
diff --git a/common/state/state.c b/common/state/state.c
index ac6cd6e57276..bafc07dfe751 100644
--- a/common/state/state.c
+++ b/common/state/state.c
@@ -405,10 +405,12 @@ int state_from_node(struct state *state, struct device_node *node, bool create)
 	if (create) {
 		const struct state_variable *sv;
 
-		/* start with second entry */
-		sv = list_first_entry(&state->variables, struct state_variable,
-				      list);
+		/* no variable = no variable overlap */
+		sv = list_first_entry_or_null(&state->variables, struct state_variable, list);
+		if (!sv)
+			return 0;
 
+		/* start with second entry */
 		list_for_each_entry_continue(sv, &state->variables, list) {
 			const struct state_variable *last_sv;
 
diff --git a/include/linux/list.h b/include/linux/list.h
index b90ea3e125d0..a036e3d07c07 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -529,6 +529,20 @@ static inline void list_splice_tail_init(struct list_head *list,
 	pos__ != head__ ? list_entry(pos__, type, member) : NULL; \
 })
 
+/**
+ * list_last_entry_or_null - get the last element from a list
+ * @ptr:	the list head to take the element from.
+ * @type:	the type of the struct this is embedded in.
+ * @member:	the name of the list_head within the struct.
+ *
+ * Note that if the list is empty, it returns NULL.
+ */
+#define list_last_entry_or_null(ptr, type, member) ({ \
+	struct list_head *head__ = (ptr); \
+	struct list_head *pos__ = READ_ONCE(head__->prev); \
+	pos__ != head__ ? list_entry(pos__, type, member) : NULL; \
+})
+
 /**
  * list_next_entry - get the next element in list
  * @pos:	the type * to cursor
-- 
2.47.3

[PATCH v2025.09.y 14/49] fs: nfs: drop PROG_NFS special casing

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

For rpc_prog == PROG_NFS the nfs error is checked in rpc_check_reply()
and erroneous packets are discarded right away. This is unnecessary
since the nfs error is checked by the callers anyway. Drop the duplicate
error checking to simplify the code.

Link: https://lore.barebox.org/20251104-nfs-v1-1-3e69e5c82a41@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit dbdfa94f2408631018a85a68e5956a254737afed)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/nfs.c | 26 +++-----------------------
 1 file changed, 3 insertions(+), 23 deletions(-)

diff --git a/fs/nfs.c b/fs/nfs.c
index 17e1e7cfa1f1..bac5cd5a183f 100644
--- a/fs/nfs.c
+++ b/fs/nfs.c
@@ -421,14 +421,10 @@ static uint32_t *rpc_add_credentials(uint32_t *p)
 	return p;
 }
 
-static int rpc_check_reply(struct packet *pkt, int rpc_prog,
-			   uint32_t rpc_id, int *nfserr)
+static int rpc_check_reply(struct packet *pkt, uint32_t rpc_id)
 {
-	uint32_t *data;
 	struct rpc_reply rpc;
 
-	*nfserr = 0;
-
 	memcpy(&rpc, pkt->data, sizeof(rpc));
 
 	if (ntoh32(rpc.id) != rpc_id)
@@ -440,15 +436,6 @@ static int rpc_check_reply(struct packet *pkt, int rpc_prog,
 		return -EINVAL;
 	}
 
-	if (rpc_prog != PROG_NFS)
-		return 0;
-
-	data = (uint32_t *)(pkt->data + sizeof(struct rpc_reply));
-	*nfserr = ntoh32(net_read_uint32(data));
-	*nfserr = -*nfserr;
-
-	debug("%s: err %d\n", __func__, *nfserr);
-
 	return 0;
 }
 
@@ -468,7 +455,6 @@ static struct packet *rpc_req(struct nfs_priv *npriv, int rpc_prog,
 	unsigned short dport;
 	int ret;
 	unsigned char *payload = net_udp_get_payload(npriv->con);
-	int nfserr;
 	int tries = 0;
 	struct packet *packet;
 
@@ -530,8 +516,7 @@ static struct packet *rpc_req(struct nfs_priv *npriv, int rpc_prog,
 
 		packet = list_first_entry(&npriv->packets, struct packet, list);
 
-		ret = rpc_check_reply(packet, rpc_prog,
-				      npriv->rpc_id, &nfserr);
+		ret = rpc_check_reply(packet, npriv->rpc_id);
 		if (ret == -EAGAIN) {
 			nfs_free_packet(packet);
 			continue;
@@ -539,12 +524,7 @@ static struct packet *rpc_req(struct nfs_priv *npriv, int rpc_prog,
 			nfs_free_packet(packet);
 			return ERR_PTR(ret);
 		} else {
-			if (rpc_prog == PROG_NFS && nfserr) {
-				nfs_free_packet(packet);
-				return ERR_PTR(nfserr);
-			} else {
-				return packet;
-			}
+			return packet;
 		}
 	}
 }
-- 
2.47.3

[PATCH v2025.09.y 15/49] fs: nfs: do not read past packets

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

The NFS code has hardly any length checks and it blindly trusts length
values in incoming packets. Fix this by introducing a nfs_packet_read()
which is consistently used to read from an incoming packet.

After a packet has been consumed it must be freed with
nfs_free_packet(). This wasn't done in several error cases and is fixed
here as well.

Link: https://lore.barebox.org/20251104-nfs-v1-2-3e69e5c82a41@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 5be38817bc771cc68b667f01047c4e3cac081787)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/nfs.c | 306 ++++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 233 insertions(+), 73 deletions(-)

diff --git a/fs/nfs.c b/fs/nfs.c
index bac5cd5a183f..4367da17ace8 100644
--- a/fs/nfs.c
+++ b/fs/nfs.c
@@ -130,7 +130,8 @@ struct nfs_fh {
 
 struct packet {
 	struct list_head list;
-	int len;
+	unsigned int len;
+	unsigned int pos;
 	char data[];
 };
 
@@ -393,6 +394,51 @@ static int decode_filename(struct xdr_stream *xdr, char *name, u32 *length)
 	return -EIO;
 }
 
+/*
+ * Read @len bytes from a NFS packets. Returns a pointer to the data
+ * or NULL if the packet doesn't contain enough data
+ */
+static void *nfs_packet_read(struct packet *nfs_packet, unsigned int len)
+{
+	void *ret;
+
+	if (nfs_packet->pos + len > nfs_packet->len) {
+		nfs_packet->pos = nfs_packet->len;
+		return NULL;
+	}
+
+	ret = &nfs_packet->data[0];
+	ret += nfs_packet->pos;
+
+	nfs_packet->pos += len;
+
+	return ret;
+}
+
+/*
+ * Return the remaining packet data as an allocated buffer
+ */
+static void *nfs_packet_memdup_rest(struct packet *nfs_packet, unsigned int *len)
+{
+	void *p;
+
+	*len = nfs_packet->len - nfs_packet->pos;
+
+	p = nfs_packet_read(nfs_packet, *len);
+	if (!p)
+		return NULL;
+
+	return xmemdup(p, *len);
+}
+
+/*
+ * Align the read pointer of a NFS packet
+ */
+static void nfs_read_align(struct packet *nfs_packet, unsigned int align)
+{
+	nfs_packet->pos = ALIGN(nfs_packet->pos, align);
+}
+
 /*
  * rpc_add_credentials - Add RPC authentication/verifier entries
  */
@@ -424,8 +470,13 @@ static uint32_t *rpc_add_credentials(uint32_t *p)
 static int rpc_check_reply(struct packet *pkt, uint32_t rpc_id)
 {
 	struct rpc_reply rpc;
+	void *p;
 
-	memcpy(&rpc, pkt->data, sizeof(rpc));
+	p = nfs_packet_read(pkt, sizeof(rpc));
+	if (!p)
+		return -EINVAL;
+
+	memcpy(&rpc, p, sizeof(rpc));
 
 	if (ntoh32(rpc.id) != rpc_id)
 		return -EAGAIN;
@@ -537,6 +588,8 @@ static int rpc_lookup_req(struct nfs_priv *npriv, uint32_t prog, uint32_t ver)
 	uint32_t data[16];
 	struct packet *nfs_packet;
 	uint32_t port;
+	void *p;
+	int ret;
 
 	data[0] = 0; data[1] = 0;	/* auth credential */
 	data[2] = 0; data[3] = 0;	/* auth verifier */
@@ -549,7 +602,13 @@ static int rpc_lookup_req(struct nfs_priv *npriv, uint32_t prog, uint32_t ver)
 	if (IS_ERR(nfs_packet))
 		return PTR_ERR(nfs_packet);
 
-	port = ntoh32(net_read_uint32(nfs_packet->data + sizeof(struct rpc_reply)));
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
+	port = ntoh32(net_read_uint32(p));
 
 	nfs_free_packet(nfs_packet);
 
@@ -560,6 +619,11 @@ static int rpc_lookup_req(struct nfs_priv *npriv, uint32_t prog, uint32_t ver)
 	}
 
 	return port;
+
+err_free_packet:
+	nfs_free_packet(nfs_packet);
+
+	return ret;
 }
 
 static uint32_t *nfs_add_uint32(uint32_t *p, uint32_t val)
@@ -672,8 +736,10 @@ static int nfs_fattr3_to_stat(uint32_t *p, struct inode *inode)
 	return 0;
 }
 
-static uint32_t *nfs_read_post_op_attr(uint32_t *p, struct inode *inode)
+static int nfs_read_post_op_attr(struct packet *nfs_packet, struct inode *inode)
 {
+	void *p;
+
 	/*
 	 * union post_op_attr switch (bool attributes_follow) {
 	 * case TRUE:
@@ -683,12 +749,18 @@ static uint32_t *nfs_read_post_op_attr(uint32_t *p, struct inode *inode)
 	 * };
 	 */
 
-	if (ntoh32(net_read_uint32(p++))) {
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p)
+		return -EINVAL;
+
+	if (ntoh32(net_read_uint32(p))) {
+		p = nfs_packet_read(nfs_packet, 21 * sizeof(uint32_t));
+		if (!p)
+			return -EINVAL;
 		nfs_fattr3_to_stat(p, inode);
-		p += 21;
 	}
 
-	return p;
+	return 0;
 }
 
 /*
@@ -700,6 +772,7 @@ static int nfs_mount_req(struct nfs_priv *npriv)
 	uint32_t *p, status;
 	int len;
 	int pathlen;
+	int ret;
 	struct packet *nfs_packet;
 
 	pathlen = strlen(npriv->path);
@@ -722,31 +795,50 @@ static int nfs_mount_req(struct nfs_priv *npriv)
 	if (IS_ERR(nfs_packet))
 		return PTR_ERR(nfs_packet);
 
-	p = (void *)nfs_packet->data + sizeof(struct rpc_reply);
-
 	/*
 	 * Theoretically the error status is one of MNT3ERR_..., but the NFS
 	 * constants are identical.
 	 */
-	status = ntoh32(net_read_uint32(p++));
-	if (status != NFS3_OK) {
-		int ret;
-		pr_err("Mounting failed: %s\n", nfserrstr(status, &ret));
-		return ret;
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
 	}
 
-	npriv->rootfh.size = ntoh32(net_read_uint32(p++));
+	status = ntoh32(net_read_uint32(p));
+	if (status != NFS3_OK) {
+		pr_err("Mounting failed: %s\n", nfserrstr(status, &ret));
+		goto err_free_packet;
+	}
+
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
+	npriv->rootfh.size = ntoh32(net_read_uint32(p));
 	if (npriv->rootfh.size > NFS3_FHSIZE) {
 		printf("%s: file handle too big: %lu\n",
 		       __func__, (unsigned long)npriv->rootfh.size);
-		nfs_free_packet(nfs_packet);
-		return -EIO;
+		ret = -EIO;
+		goto err_free_packet;
 	}
+
+	p = nfs_packet_read(nfs_packet, npriv->rootfh.size);
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
 	memcpy(npriv->rootfh.data, p, npriv->rootfh.size);
 
+	ret = 0;
+
+err_free_packet:
 	nfs_free_packet(nfs_packet);
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -787,6 +879,7 @@ static int nfs_lookup_req(struct nfs_priv *npriv, struct nfs_fh *fh,
 	uint32_t data[1024];
 	uint32_t *p, status;
 	int len;
+	int ret = 0;
 	struct packet *nfs_packet;
 
 	/*
@@ -827,29 +920,50 @@ static int nfs_lookup_req(struct nfs_priv *npriv, struct nfs_fh *fh,
 	if (IS_ERR(nfs_packet))
 		return PTR_ERR(nfs_packet);
 
-	p = (void *)nfs_packet->data + sizeof(struct rpc_reply);
-	status = ntoh32(net_read_uint32(p++));
-	if (status != NFS3_OK) {
-		int ret;
-		pr_err("Lookup failed: %s\n", nfserrstr(status, &ret));
-		return ret;
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
 	}
 
-	ninode->fh.size = ntoh32(net_read_uint32(p++));
+	status = ntoh32(net_read_uint32(p));
+	if (status != NFS3_OK) {
+		pr_err("Lookup failed: %s\n", nfserrstr(status, &ret));
+		goto err_free_packet;
+	}
+
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
+	ninode->fh.size = ntoh32(net_read_uint32(p));
 	if (ninode->fh.size > NFS3_FHSIZE) {
-		nfs_free_packet(nfs_packet);
 		debug("%s: file handle too big: %u\n", __func__,
 		      ninode->fh.size);
-		return -EIO;
+		ret = -EIO;
+		goto err_free_packet;
 	}
+
+	p = nfs_packet_read(nfs_packet, ninode->fh.size);
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
 	memcpy(ninode->fh.data, p, ninode->fh.size);
-	p += DIV_ROUND_UP(ninode->fh.size, 4);
 
-	nfs_read_post_op_attr(p, inode);
+	nfs_read_align(nfs_packet, 4);
 
+	nfs_read_post_op_attr(nfs_packet, inode);
+
+	ret = 0;
+
+err_free_packet:
 	nfs_free_packet(nfs_packet);
 
-	return 0;
+	return ret;
 }
 
 /*
@@ -862,7 +976,8 @@ static void *nfs_readdirattr_req(struct nfs_priv *npriv, struct nfs_dir *dir)
 	uint32_t *p, status;
 	int len;
 	struct packet *nfs_packet;
-	void *buf;
+	void *buf = NULL;
+	int ret;
 
 	/*
 	 * struct READDIR3args {
@@ -917,37 +1032,43 @@ static void *nfs_readdirattr_req(struct nfs_priv *npriv, struct nfs_dir *dir)
 	if (IS_ERR(nfs_packet))
 		return NULL;
 
-	p = (void *)nfs_packet->data + sizeof(struct rpc_reply);
-	status = ntoh32(net_read_uint32(p++));
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
+	status = ntoh32(net_read_uint32(p));
 	if (status != NFS3_OK) {
 		pr_err("Readdir failed: %s\n", nfserrstr(status, NULL));
-		return NULL;
+		ret = -EIO;
+		goto err_free_packet;
 	}
 
-	p = nfs_read_post_op_attr(p, NULL);
+	ret = nfs_read_post_op_attr(nfs_packet, NULL);
+	if (ret)
+		goto err_free_packet;
 
 	/* update cookieverf */
-	memcpy(dir->cookieverf, p, NFS3_COOKIEVERFSIZE);
-	p += NFS3_COOKIEVERFSIZE / 4;
-
-	len = (void *)nfs_packet->data + nfs_packet->len - (void *)p;
-	if (!len) {
-		printf("%s: huh, no payload left\n", __func__);
-		nfs_free_packet(nfs_packet);
-		return NULL;
+	p = nfs_packet_read(nfs_packet, NFS3_COOKIEVERFSIZE);
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
 	}
 
-	buf = xzalloc(len);
+	memcpy(dir->cookieverf, p, NFS3_COOKIEVERFSIZE);
 
-	memcpy(buf, p, len);
-
-	nfs_free_packet(nfs_packet);
+	buf = nfs_packet_memdup_rest(nfs_packet, &len);
 
 	xdr_init(&dir->stream, buf, len);
 
-	/* now xdr points to dirlist3 res.resok.reply */
+	ret = 0;
 
-	return buf;
+	/* now xdr points to dirlist3 res.resok.reply */
+err_free_packet:
+	nfs_free_packet(nfs_packet);
+
+	return ret ? NULL : buf;
 }
 
 /*
@@ -1000,19 +1121,37 @@ static int nfs_read_req(struct file_priv *priv, uint64_t offset,
 	if (IS_ERR(nfs_packet))
 		return PTR_ERR(nfs_packet);
 
-	p = (void *)nfs_packet->data + sizeof(struct rpc_reply);
-	status = ntoh32(net_read_uint32(p++));
-	if (status != NFS3_OK) {
-		pr_err("Read failed: %s\n", nfserrstr(status, &ret));
-		return ret;
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
 	}
 
-	p = nfs_read_post_op_attr(p, NULL);
+	status = ntoh32(net_read_uint32(p));
+	if (status != NFS3_OK) {
+		pr_err("Read failed: %s\n", nfserrstr(status, &ret));
+		goto err_free_packet;
+	}
+
+	ret = nfs_read_post_op_attr(nfs_packet, NULL);
+	if (ret) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
+
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
 
 	rlen = ntoh32(net_read_uint32(p));
 
-	/* skip over count */
-	p += 1;
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
 
 	eof = ntoh32(net_read_uint32(p));
 
@@ -1020,18 +1159,23 @@ static int nfs_read_req(struct file_priv *priv, uint64_t offset,
 	 * skip over eof and count embedded in the representation of data
 	 * assuming it equals rlen above.
 	 */
-	p += 2;
+	nfs_packet_read(nfs_packet, sizeof(uint32_t));
 
 	if (readlen && !rlen && !eof) {
-		nfs_free_packet(nfs_packet);
-		return -EIO;
+		ret = -EIO;
+		goto err_free_packet;
 	}
 
+	p = nfs_packet_read(nfs_packet, rlen);
+
 	kfifo_put(priv->fifo, (char *)p, rlen);
 
+	ret = 0;
+
+err_free_packet:
 	nfs_free_packet(nfs_packet);
 
-	return 0;
+	return ret;
 }
 
 static void nfs_handler(void *ctx, char *p, unsigned len)
@@ -1043,6 +1187,7 @@ static void nfs_handler(void *ctx, char *p, unsigned len)
 	packet = xmalloc(sizeof(*packet) + len);
 	memcpy(packet->data, pkt, len);
 	packet->len = len;
+	packet->pos = 0;
 
 	list_add_tail(&packet->list, &npriv->packets);
 }
@@ -1066,6 +1211,7 @@ static int nfs_readlink_req(struct nfs_priv *npriv, struct nfs_fh *fh,
 	uint32_t data[1024];
 	uint32_t *p, status;
 	uint32_t len;
+	int ret;
 	struct packet *nfs_packet;
 
 	/*
@@ -1100,29 +1246,43 @@ static int nfs_readlink_req(struct nfs_priv *npriv, struct nfs_fh *fh,
 	if (IS_ERR(nfs_packet))
 		return PTR_ERR(nfs_packet);
 
-	p = (void *)nfs_packet->data + sizeof(struct rpc_reply);
-	status = ntoh32(net_read_uint32(p++));
-	if (status != NFS3_OK) {
-		int ret;
-		pr_err("Readlink failed: %s\n", nfserrstr(status, &ret));
-		return ret;
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
 	}
 
-	p = nfs_read_post_op_attr(p, NULL);
+	status = ntoh32(net_read_uint32(p));
+	if (status != NFS3_OK) {
+		pr_err("Readlink failed: %s\n", nfserrstr(status, &ret));
+		goto err_free_packet;
+	}
+
+	nfs_read_post_op_attr(nfs_packet, NULL);
+
+	p = nfs_packet_read(nfs_packet, sizeof(uint32_t));
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
 
 	len = ntoh32(net_read_uint32(p)); /* new path length */
 
-	len = min_t(unsigned int, len,
-		    nfs_packet->len - sizeof(struct rpc_reply) - sizeof(uint32_t));
-
-	p++;
+	p = nfs_packet_read(nfs_packet, len);
+	if (!p) {
+		ret = -EINVAL;
+		goto err_free_packet;
+	}
 
 	*target = xzalloc(len + 1);
 	memcpy(*target, p, len);
 
+	ret = 0;
+
+err_free_packet:
 	nfs_free_packet(nfs_packet);
 
-	return 0;
+	return ret;
 }
 
 static const char *nfs_get_link(struct dentry *dentry, struct inode *inode)
-- 
2.47.3

[PATCH v2025.09.y 16/49] ARM: i.MX8M: romapi: skip zero_page_access() if MMU is disabled

[Ahmad Fatoum]

imx8m_get_bootrom_log() anticipates three situations in which it can be
called:

  1) From PBL running in EL3
  2) From barebox proper running in EL2
  3) From barebox proper hacked to run in EL3 without TF-A

No board makes use of situation 3), but it's occasionally useful
in debugging. To handle that last case, commit b0d0ac502c49
("ARM: i.MX8M: bootrom: access OCRAM directly if running in EL3")
remaps the zero page as it would overlay the BootROM, which is located
at physical address 0.

This worked fine for a while, because zero page control was not
available in the PBL, but this changed with commit
99944ef03dc1 ("ARM: mmu: provide zero page control in PBL") leading to
buggy behavior for situation 1): zero_page_access() would now remap the
zero page, even though barebox never initialized the TTBR.

This was observed to crash TF-A (presumably, because when it unmasks
exceptions) on an i.MX8MP.

Fix by only calling zero_page_access/faulting when our newly dynamic
zero_page_remappable() returns true.

Fixes: 99944ef03dc1 ("ARM: mmu: provide zero page control in PBL")
Reported-by: Holger Assmann <has@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251028143238.1782982-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 3b47d3cc24a1fbece237aef93932bf2ec88058fc)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/mach-imx/romapi.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-imx/romapi.c b/arch/arm/mach-imx/romapi.c
index a4143d372ae8..eaaadc661cc8 100644
--- a/arch/arm/mach-imx/romapi.c
+++ b/arch/arm/mach-imx/romapi.c
@@ -237,14 +237,19 @@ int imx93_romapi_load_image(void *adr)
 const u32 *imx8m_get_bootrom_log(void)
 {
 	if (current_el() == 3) {
+		bool remap_zero_page = zero_page_remappable();
 		ulong *rom_log_addr_offset = (void *)0x9e0;
 		ulong rom_log_addr;
 
 		OPTIMIZER_HIDE_VAR(rom_log_addr_offset);
 
-		zero_page_access();
+		if (remap_zero_page)
+			zero_page_access();
+
 		rom_log_addr = *rom_log_addr_offset;
-		zero_page_faulting();
+
+		if (remap_zero_page)
+			zero_page_faulting();
 
 		if (rom_log_addr < MX8M_OCRAM_BASE_ADDR ||
 		    rom_log_addr >= MX8M_OCRAM_BASE_ADDR + MX8M_OCRAM_MAX_SIZE ||
-- 
2.47.3

[PATCH v2025.09.y 17/49] ARM: mmu: have zero_page_remappable() check MMU status

[Ahmad Fatoum]

zero_page_access() and zero_page_faulting() call remap_range(), which
assumes the TTBR was initialized to page tables set up by barebox.

It's thus not safe to call them from generic code prior to enabling the
MMU, but we are doing just that. In preparation for fixing, let's make
zero_page_remappable reflect MMU status.

While at it, also drop the duplicate zero_page_access() prototype.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251028143238.1782982-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 594850b2de53300ae25c103e4ec88b2dac418106)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/cpu/mmu-common.c |  5 +++++
 include/zero_page.h       | 12 ++++++------
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/arch/arm/cpu/mmu-common.c b/arch/arm/cpu/mmu-common.c
index 033ba01ea4c8..92e06b06077f 100644
--- a/arch/arm/cpu/mmu-common.c
+++ b/arch/arm/cpu/mmu-common.c
@@ -81,6 +81,11 @@ void *dma_alloc_writecombine(struct device *dev, size_t size, dma_addr_t *dma_ha
 	return dma_alloc_map(dev, size, dma_handle, MAP_WRITECOMBINE);
 }
 
+bool zero_page_remappable(void)
+{
+	return get_cr() & CR_M;
+}
+
 void zero_page_access(void)
 {
 	remap_range(0x0, PAGE_SIZE, MAP_CACHED);
diff --git a/include/zero_page.h b/include/zero_page.h
index 8dd66a1efb9b..072e71be581e 100644
--- a/include/zero_page.h
+++ b/include/zero_page.h
@@ -20,12 +20,12 @@ void zero_page_faulting(void);
  */
 void zero_page_access(void);
 
-void zero_page_access(void);
-
-static inline bool zero_page_remappable(void)
-{
-	return true;
-}
+/**
+ * zero_page_remappable() - check if zero page can be remapped
+ *
+ * Check if MMU is enabled and zero page remapping support is available.
+ */
+bool zero_page_remappable(void);
 
 #else
 
-- 
2.47.3

[PATCH v2025.09.y 18/49] ARM: mmu: fix hang when reserved memory at start of RAM

[Ahmad Fatoum]

If the memory bank starts at address 0 and the start of the SDRAM is a
reserved region, remap_range_end_sans_text() is called with start = 0,
end = 0, which is interpreted by the function to mean that it spans
the whole of RAM.

Fix the issue by not calling remap_range_end_sans_text() for empty
ranges. This fixes an early hang observed on the Raspberry Pi 3.

In the unlikely case, there is no reserved memory region and the first
bank is indeed 4G of size, we also end up with start = 0, end = 0, but
this is already being handled correctly.

Of course, this fix introduces a corner case in return: A reserved memory
entry spanning the whole lower 4G becomes unsupported on 32-bit, but
that should be a non-issue  as such a system would be fairly useless and
64-bit is not affected...

A wholesale replacement of this function is under way, so we'll
hopefully get rid of this error prone code altogether in v2026.01.0.

Fixes: 3e2d06afabe1 ("range: fix corner cases when exclusive end is zero")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251107182750.3367036-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit ee135d98586b68892add6d139929298b69da1878)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/cpu/mmu-common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/cpu/mmu-common.c b/arch/arm/cpu/mmu-common.c
index 92e06b06077f..b3d9e9579686 100644
--- a/arch/arm/cpu/mmu-common.c
+++ b/arch/arm/cpu/mmu-common.c
@@ -149,7 +149,8 @@ static void mmu_remap_memory_banks(void)
 
 		/* Skip reserved regions */
 		for_each_reserved_region(bank, rsv) {
-			remap_range_end_sans_text(pos, rsv->start, MAP_CACHED);
+			if (pos != rsv->start)
+				remap_range_end_sans_text(pos, rsv->start, MAP_CACHED);
 			pos = rsv->end + 1;
 		}
 
-- 
2.47.3

[PATCH v2025.09.y 19/49] clk: rockchip rk3588: configure CPLL in driver

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

The rk3588 CPLL should be configured to 1.5GHz and 09c87c85e0 ("ARM:
dts: rockchip: Set CPLL frequency for RK3588") does this. It does it
however after the assigned-clocks/assigned-clock-rates properties of the
"rockchip,rk3588-cru" node have been evaluated which contain a setting
of CLK_150M_SRC which is a child clock of the CPLL.  Configuring the
CPLL after CLK_150M_SRC alters the setting of the just configured 150M
clock again.

We must make sure to configure the CPLL before its child clocks. For
this we could overwrite the assigned-* properties in the
"rockchip,rk3588-cru" node, but with that we would miss future updates
to this property, so configure the CPLL in the driver code instead right
before we call into of_clk_add_provider().

Fixes: 09c87c85e0 ("ARM: dts: rockchip: Set CPLL frequency for RK3588")
Tested-by: Michael Tretter <m.tretter@pengutronix.de>
Link: https://lore.barebox.org/20251028072625.2781087-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 45b4b47cc650b0552d4920d0a353a860f6d2468c)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/dts/rk3588.dtsi          | 3 ---
 drivers/clk/rockchip/clk-rk3588.c | 7 +++++++
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/arm/dts/rk3588.dtsi b/arch/arm/dts/rk3588.dtsi
index 42d692a9bdd1..416700cf0ecd 100644
--- a/arch/arm/dts/rk3588.dtsi
+++ b/arch/arm/dts/rk3588.dtsi
@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: (GPL-2.0+ OR MIT)
 
 / {
-	assigned-clocks = <&cru PLL_CPLL>;
-	assigned-clock-rates = <1500000000>;
-
 	dmc: memory-controller {
 		compatible = "rockchip,rk3588-dmc";
 		rockchip,pmu = <&pmu1grf>;
diff --git a/drivers/clk/rockchip/clk-rk3588.c b/drivers/clk/rockchip/clk-rk3588.c
index 5aecfb3b1b71..eb6b4fde1451 100644
--- a/drivers/clk/rockchip/clk-rk3588.c
+++ b/drivers/clk/rockchip/clk-rk3588.c
@@ -2500,6 +2500,13 @@ static void __init rk3588_clk_init(struct device_node *np)
 
 	rockchip_register_restart_notifier(ctx, RK3588_GLB_SRST_FST);
 
+	/*
+	 * CPLL must run at 1.5GHz. Do this here instead via assigned-clocks
+	 * in the device tree so that we do not have to overwrite the properties
+	 * in the upstream device tree.
+	 */
+	clk_set_rate(ctx->clk_data.clks[PLL_CPLL], 1500000000);
+
 	rockchip_clk_of_add_provider(np, ctx);
 }
 
-- 
2.47.3

[PATCH v2025.09.y 20/49] poller: activate POLLER_WARN_OVERTIME only on third strike

[Ahmad Fatoum]

This warning was meant to address the case that a poller repeatedly
takes too long that interactive usage is impacted.

I frequently see this warning during initial USB gadget set up and that
is not really useful to show every user and developers can use the
poller command, so let's wait until we are on our third (2nd when
counting from 0) overtime to print the one time warning.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251112151058.540654-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 3c54bb21e0f04805e7b6fb16e6d977900ebfceb0)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/Kconfig  | 2 +-
 common/poller.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/common/Kconfig b/common/Kconfig
index eb2fb1da1e09..3a2044585a3d 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -1099,7 +1099,7 @@ config POLLER_WARN_OVERTIME
 	help
 	  Pollers are meant to poll and quickly execute actions.
 	  exceeding the maximum runtime of POLLER_MAX_RUNTIME_MS
-	  will trigger a one-time warning.
+	  three times will trigger a one-time warning.
 
 config BTHREAD
 	bool "barebox co-operative (green) thread infrastructure"
diff --git a/common/poller.c b/common/poller.c
index 5dc2be97211d..ca0d68d6cb27 100644
--- a/common/poller.c
+++ b/common/poller.c
@@ -135,8 +135,8 @@ void poller_call(void)
 		duration_ms = ktime_ms_delta(ktime_get(), start);
 		if (duration_ms > POLLER_MAX_RUNTIME_MS) {
 			if (IS_ENABLED(CONFIG_POLLER_WARN_OVERTIME) &&
-			    !poller->overtime)
-				pr_warn("'%s' took unexpectedly long: %llums\n",
+			    poller->overtime == 2)
+				pr_warn("'%s' takes unexpectedly long: %llums\n",
 					poller->name, duration_ms);
 
 			if (poller->overtime < U16_MAX)
-- 
2.47.3

[PATCH v2025.09.y 21/49] bootm: fix boot override inheritance

[Ahmad Fatoum]

Nested boot calls were incorrectly handled by the override mechanism,
although they are a common occurrence e.g. when using bootchooser:

 - boot command enumerates entries including bootchooser and boots the
   "bootchooser" entry
 - bootchooser boot enumerates entries for its targets and boots
   one of these entries

Each boot entry boot calls bootm_set_overrides(), which is broken in the
nested case for two reasons:

 - bootm_set_overrides(&be->overrides) reverts the overrides for the
   first nested boot entry, because it doesn't first check if the
   individual overrides (as opposed to the pointer to the struct
   containing them) is NULL

 - bootm_set_overrides(NULL) additionally reverts the overrides for
   all later boot entries, because instead of restoring the previous
   override state, it discards it.

Fix both of these by having bootm_set_overrides return the old
overrides, so they can be reinstated.

Reported-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251110133346.1552720-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit d2dae53f0dc51406ee8e51708518357e2b557227)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/boot.c             | 5 +++--
 common/bootm.c            | 7 +++++--
 include/bootm-overrides.h | 7 +++++--
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/common/boot.c b/common/boot.c
index d755805d9314..07bd288df29d 100644
--- a/common/boot.c
+++ b/common/boot.c
@@ -156,6 +156,7 @@ BAREBOX_MAGICVAR(global.boot.watchdog_timeout,
 
 int boot_entry(struct bootentry *be, int verbose, int dryrun)
 {
+	struct bootm_overrides old;
 	int ret;
 
 	pr_info("Booting entry '%s'\n", be->title);
@@ -170,13 +171,13 @@ int boot_entry(struct bootentry *be, int verbose, int dryrun)
 		}
 	}
 
-	bootm_set_overrides(&be->overrides);
+	old = bootm_set_overrides(be->overrides);
 
 	ret = be->boot(be, verbose, dryrun);
 	if (ret && ret != -ENOMEDIUM)
 		pr_err("Booting entry '%s' failed: %pe\n", be->title, ERR_PTR(ret));
 
-	bootm_set_overrides(NULL);
+	bootm_set_overrides(old);
 
 	globalvar_set_match("linux.bootargs.dyn.", "");
 
diff --git a/common/bootm.c b/common/bootm.c
index 15b18c12faa1..34c72282d6ba 100644
--- a/common/bootm.c
+++ b/common/bootm.c
@@ -976,9 +976,12 @@ int bootm_boot(struct bootm_data *bootm_data)
 }
 
 #ifdef CONFIG_BOOT_OVERRIDE
-void bootm_set_overrides(const struct bootm_overrides *overrides)
+struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides)
 {
-	bootm_overrides = overrides ? *overrides : (struct bootm_overrides){};
+	struct bootm_overrides old = bootm_overrides;
+	/* bootm_merge_overrides copies only actual (non-NULL) overrides */
+	bootm_merge_overrides(&bootm_overrides, &overrides);
+	return old;
 }
 #endif
 
diff --git a/include/bootm-overrides.h b/include/bootm-overrides.h
index 19557f63acd9..4a270b95afcc 100644
--- a/include/bootm-overrides.h
+++ b/include/bootm-overrides.h
@@ -8,9 +8,12 @@ struct bootm_overrides {
 };
 
 #ifdef CONFIG_BOOT_OVERRIDE
-void bootm_set_overrides(const struct bootm_overrides *overrides);
+struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides_new);
 #else
-static inline void bootm_set_overrides(const struct bootm_overrides *overrides) {}
+static inline struct bootm_overrides bootm_set_overrides(const struct bootm_overrides overrides)
+{
+	return (struct bootm_overrides) {};
+}
 #endif
 
 static inline void bootm_merge_overrides(struct bootm_overrides *dst,
-- 
2.47.3

[PATCH v2025.09.y 22/49] commands: truncate: fix multiple file handling with relative sizes

[Ahmad Fatoum]

From: Alexander Shiyan <eagle.alexander923@gmail.com>

Fix bug where processing multiple files with -s +SIZE option
would use incorrect sizes for files after the first one, because the
size variable was being overwritten.

Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Link: https://lore.barebox.org/20251119185307.931800-1-eagle.alexander923@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 6981db707661f68a1aea4f0969360cb0af7fd530)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 commands/truncate.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/commands/truncate.c b/commands/truncate.c
index 5c6d74257da1..83661fbaf63b 100644
--- a/commands/truncate.c
+++ b/commands/truncate.c
@@ -59,23 +59,26 @@ static int do_truncate(int argc, char *argv[])
 			continue;
 		}
 
+		off_t target_size = size;
+
 		if (modify) {
 			struct stat st;
 
 			if (fstat(fd, &st) == -1) {
 				perror("fstat");
 				ret = 1;
-				goto close;
+				close(fd);
+				continue;
 			}
 
-			size = st.st_size + modify * size;
+			target_size = st.st_size + size;
 		}
 
-		if (ftruncate(fd, size) == -1) {
+		if (ftruncate(fd, target_size) == -1) {
 			perror("truncate");
 			ret = 1;
 		}
-close:
+
 		close(fd);
 	}
 
-- 
2.47.3

[PATCH v2025.09.y 23/49] fs: qemu_fw_cfg: make use of the automount

[Ahmad Fatoum]

We assume /mnt/fw_cfg to be the fw_cfg mount path at other places
already, so let's drop some complexity by just using the automount.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251125062603.2614867-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 332be0eec5f8b0683838fda48889efd8de76c9b1)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/devfs-core.c  |  6 ++++++
 fs/qemu_fw_cfg.c | 27 +++++----------------------
 include/driver.h |  2 ++
 3 files changed, 13 insertions(+), 22 deletions(-)

diff --git a/fs/devfs-core.c b/fs/devfs-core.c
index 92e7c5823ed0..4f8230e124eb 100644
--- a/fs/devfs-core.c
+++ b/fs/devfs-core.c
@@ -86,6 +86,12 @@ struct cdev *cdev_by_name(const char *filename)
 	return cdev_readlink(cdev);
 }
 
+struct device *device_find_by_file_path(const char *filename)
+{
+	struct cdev *cdev = cdev_by_name(devpath_to_name(filename));
+	return cdev ? cdev->dev : NULL;
+}
+
 struct cdev *cdev_by_device_node(struct device_node *node)
 {
 	struct cdev *cdev;
diff --git a/fs/qemu_fw_cfg.c b/fs/qemu_fw_cfg.c
index caf541574649..49115beeb21d 100644
--- a/fs/qemu_fw_cfg.c
+++ b/fs/qemu_fw_cfg.c
@@ -411,32 +411,15 @@ coredevice_initcall(qemu_fw_cfg_fs_init);
 
 static int qemu_fw_cfg_early_mount(void)
 {
-	struct cdev *cdev;
-	struct device *dev;
-	const char *mntpath;
-	int dirfd, fd;
-
-	cdev = cdev_by_name("fw_cfg");
-	if (!cdev)
-		return 0;
+	int fd;
 
 	/*
-	 * Trigger a mount, so ramfb device can be detected and
-	 * environment can be loaded
+	 * Also triggers the automount, so ramfb device can be detected
 	 */
-	mntpath = cdev_mount(cdev);
-	if (IS_ERR(mntpath))
-		return PTR_ERR(mntpath);
-
-	dirfd = open(mntpath, O_PATH | O_DIRECTORY);
-	if (dirfd < 0)
-		return dirfd;
-
-	fd = openat(dirfd, "by_name/etc/ramfb", O_WRONLY);
-	close(dirfd);
+	fd = open("/mnt/fw_cfg/by_name/etc/ramfb", O_WRONLY);
 	if (fd >= 0) {
-		dev = device_alloc("qemu-ramfb", DEVICE_ID_SINGLE);
-		dev->parent = cdev->dev;
+		struct device *dev = device_alloc("qemu-ramfb", DEVICE_ID_SINGLE);
+		dev->parent = device_find_by_file_path("/dev/fw_cfg");
 		dev->platform_data = (void *)(uintptr_t)fd;
 		platform_device_register(dev);
 	}
diff --git a/include/driver.h b/include/driver.h
index c130a3cd63fd..143ca18e4e39 100644
--- a/include/driver.h
+++ b/include/driver.h
@@ -477,6 +477,8 @@ int cdev_fdopen(struct cdev *cdev, unsigned long flags);
 int cdev_close(struct cdev *cdev);
 int cdev_flush(struct cdev *cdev);
 
+struct device *device_find_by_file_path(const char *filepath);
+
 typedef int (*cdev_alias_processor_t)(struct cdev *, void *data);
 
 #ifdef CONFIG_CDEV_ALIAS
-- 
2.47.3

[PATCH v2025.09.y 24/49] fs: qemu_fw_cfg: handle non-existent opt/org.barebox.env key gracefully

[Ahmad Fatoum]

QEMU fw_cfg file system driver is the sole user of
defaultenv_append_runtime_directory() and it passes a path that's not
necessarily available.

When that happens, this is not noticed until the loop in defaultenv_load()
aborts early with an -ENOENT preventing load of an external environment.

Fix this as by not adding the directory if it doesn't exist.

Fixes: 31dfb561d1a4 ("fs: qemu_fw_cfg: support populating environment via QEMU fw_cfg")
Reported-by: Jan Lübbe <j.luebbe@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251125062603.2614867-5-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit cfa4f62c104c6b9232b5bad5b0a5e7e5341a9870)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/qemu_fw_cfg.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/qemu_fw_cfg.c b/fs/qemu_fw_cfg.c
index 49115beeb21d..b28f4df99c25 100644
--- a/fs/qemu_fw_cfg.c
+++ b/fs/qemu_fw_cfg.c
@@ -20,6 +20,8 @@
 #include <linux/err.h>
 #include <linux/ctype.h>
 
+#define FW_CFG_BAREBOX_ENV	"/mnt/fw_cfg/by_name/opt/org.barebox.env"
+
 struct fw_cfg_fs_inode {
 	struct inode inode;
 	const char *name;
@@ -375,8 +377,6 @@ static int fw_cfg_fs_probe(struct device *dev)
 	if (ret)
 		goto free_data;
 
-	defaultenv_append_runtime_directory("/mnt/fw_cfg/by_name/opt/org.barebox.env");
-
 	return 0;
 free_data:
 	free(data);
@@ -411,10 +411,12 @@ coredevice_initcall(qemu_fw_cfg_fs_init);
 
 static int qemu_fw_cfg_early_mount(void)
 {
+	struct stat s;
 	int fd;
 
 	/*
-	 * Also triggers the automount, so ramfb device can be detected
+	 * Also triggers the automount, so both ramfb device can be detected
+	 * and environment can be loaded
 	 */
 	fd = open("/mnt/fw_cfg/by_name/etc/ramfb", O_WRONLY);
 	if (fd >= 0) {
@@ -424,6 +426,9 @@ static int qemu_fw_cfg_early_mount(void)
 		platform_device_register(dev);
 	}
 
+	if (!stat(FW_CFG_BAREBOX_ENV, &s) && S_ISDIR(s.st_mode))
+		defaultenv_append_runtime_directory(FW_CFG_BAREBOX_ENV);
+
 	return 0;
 }
 late_initcall(qemu_fw_cfg_early_mount);
-- 
2.47.3

[PATCH v2025.09.y 25/49] boards: qemu-virt: drop fitimage-pubkey.dts

[Ahmad Fatoum]

CONFIG_BOOTM_FITIMAGE_PUBKEY was removed in v2025.09.0 and the device
tree snippet that we merged at runtime into the DT we receive from QEMU
is now empty and no longer serves a purpose.

Remove it as it's actually detrimental: of_merge_nodes is a low-level
operation that doesn't handle duplicate nodes and when
CONFIG_EXTERNAL_DTS_FRAGMENTS adds a state node of its own, the barebox
barebox live device tree ends up with the state twice.

Reported-by: Jan Lübbe <j.luebbe@pengutronix.de>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251126140914.4081895-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit f018a6e4606ef31c6975af6b960aa7824f79df73)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/boards/qemu-virt/Makefile            | 3 +--
 common/boards/qemu-virt/board.c             | 5 +----
 common/boards/qemu-virt/fitimage-pubkey.dts | 3 ---
 3 files changed, 2 insertions(+), 9 deletions(-)
 delete mode 100644 common/boards/qemu-virt/fitimage-pubkey.dts

diff --git a/common/boards/qemu-virt/Makefile b/common/boards/qemu-virt/Makefile
index 30bf4f1955ee..7f47c9b08544 100644
--- a/common/boards/qemu-virt/Makefile
+++ b/common/boards/qemu-virt/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
 obj-y += board.o
-obj-y += qemu-virt-flash.dtbo.o fitimage-pubkey.dtb.o
+obj-y += qemu-virt-flash.dtbo.o
 ifeq ($(CONFIG_RISCV),y)
 DTC_CPP_FLAGS_qemu-virt-flash.dtbo := -DCONFIG_RISCV
 endif
@@ -9,5 +9,4 @@ ifeq ($(CONFIG_ARM),y)
 DTC_CPP_FLAGS_qemu-virt-flash.dtbo := -DCONFIG_ARM
 endif
 
-clean-files := *.dtb *.dtb.S .*.dtc .*.pre .*.dts *.dtb.z
 clean-files += *.dtbo *.dtbo.S .*.dtso
diff --git a/common/boards/qemu-virt/board.c b/common/boards/qemu-virt/board.c
index 9882b0c31a3c..a8884f26f9c1 100644
--- a/common/boards/qemu-virt/board.c
+++ b/common/boards/qemu-virt/board.c
@@ -54,7 +54,7 @@ BAREBOX_DEEP_PROBE_ENABLE(virt_of_match);
 static int virt_board_driver_init(void)
 {
 	struct device_node *root = of_get_root_node();
-	struct device_node *flash, *pubkey;
+	struct device_node *flash;
 	const struct of_device_id *id;
 	void (*init)(void);
 
@@ -75,9 +75,6 @@ static int virt_board_driver_init(void)
 	if (flash && of_device_is_available(flash))
 		of_overlay_apply_dtbo(root, __dtbo_qemu_virt_flash_start);
 
-	pubkey = of_unflatten_dtb(__dtb_fitimage_pubkey_start, INT_MAX);
-	of_merge_nodes(root, pubkey);
-
 	/* fragment may have added aliases to the DT */
 	of_alias_scan();
 
diff --git a/common/boards/qemu-virt/fitimage-pubkey.dts b/common/boards/qemu-virt/fitimage-pubkey.dts
deleted file mode 100644
index 1419fa0da5d5..000000000000
--- a/common/boards/qemu-virt/fitimage-pubkey.dts
+++ /dev/null
@@ -1,3 +0,0 @@
-/dts-v1/;
-
-/{ };
-- 
2.47.3

[PATCH v2025.09.y 26/49] pci: pci-tegra: fix null pointer assignation.

[Ahmad Fatoum]

From: Chali Anis <chalianis1@gmail.com>

By the time we set pcie->pci.parent pcie->dev is null. Initialize it
before usage.

Fixes: fd3be9d95f34 ("pci: add pci_controller_init()")
Signed-off-by: Chali Anis <chalianis1@gmail.com>
Link: https://lore.barebox.org/20251127034024.3381739-1-chalianis1@gmail.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 7d544d38174d30b5edf5f072f28582329f7fd410)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/pci/pci-tegra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pci/pci-tegra.c b/drivers/pci/pci-tegra.c
index b7f8297d153e..dabe63500a4a 100644
--- a/drivers/pci/pci-tegra.c
+++ b/drivers/pci/pci-tegra.c
@@ -1240,13 +1240,13 @@ static int tegra_pcie_probe(struct device *dev)
 	if (!pcie)
 		return -ENOMEM;
 
+	pcie->dev = dev;
 	pcie->pci.parent = pcie->dev;
 	pci_controller_init(&pcie->pci);
 
 	INIT_LIST_HEAD(&pcie->buses);
 	INIT_LIST_HEAD(&pcie->ports);
 	pcie->soc_data = device_get_match_data(dev);
-	pcie->dev = dev;
 
 	err = tegra_pcie_parse_dt(pcie);
 	if (err < 0) {
-- 
2.47.3

[PATCH v2025.09.y 27/49] sandbox: fix race with .old_version removal

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

On sandbox, .old_version is created and removed by the barebox.o recipe
and the barebox ELF itself is never built and instead it's a symlink
created by the barebox__ rule override.

Drop the rm -f .old_version in that case, so the file is not removed too soon.

A cleaner way would be to factor this logic out to a shell script like
Linux does as it's serialized anyway and there's no benefit of having
the steps as make targets, but that's left as future exercise.

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20251128104143.1578832-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit d0c80df5b5378fca1e5f21387a5597ad9555ad40)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 Makefile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Makefile b/Makefile
index a6bff68a30e3..cc83061fccab 100644
--- a/Makefile
+++ b/Makefile
@@ -1047,7 +1047,9 @@ PHONY += install
 # barebox image
 barebox: $(BAREBOX_LDS) $(BAREBOX_OBJS) $(kallsyms.o) FORCE
 	$(call if_changed_rule,barebox__)
+ifeq ($(BAREBOX_PROPER),barebox)
 	$(Q)rm -f .old_version
+endif
 
 barebox.fit: images/barebox-$(CONFIG_ARCH_LINUX_NAME).fit
 	$(Q)ln -fsn $< $@
-- 
2.47.3

[PATCH v2025.09.y 28/49] net: designware-imx: don't set txclk when mode is (r)mii

[Ahmad Fatoum]

From: Maud Spierings <maudspierings@gocontroll.com>

Add an early exit to eqos_set_txclk() when the mode is (r)mii.

The "tx" clock is actually something called the "slice 81 clock" which
must always be 50M for the rmii mode. This will later get divided into
the actual tx clock /2 or /20 which does match those clock rates. Still
the provided clock != tx clock when the mode is rmii.

Linux also excludes the mii mode from this clock lookup, even though
the clock rates actually seem to match there. I am not aware why it is
also excluded, it may be best to wait with merging this until [1] has
found an answer. But for now I thought it would be best to match Linux
behaviour.

Link: https://lore.kernel.org/all/aRclKDeHzfJSzpQ3@shell.armlinux.org.uk/ [1]

Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Link: https://lore.barebox.org/20251114-eqos_rmii-v1-1-4a20cf7cb4c0@gocontroll.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 7302e971fcd4153e7407db0abe6a1ddeb5f96f29)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/net/designware_imx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/designware_imx.c b/drivers/net/designware_imx.c
index ec3558fad026..bc3136f8ff7e 100644
--- a/drivers/net/designware_imx.c
+++ b/drivers/net/designware_imx.c
@@ -59,10 +59,15 @@ static unsigned long eqos_get_csr_clk_rate_imx(struct eqos *eqos)
 
 static int eqos_set_txclk(struct eqos *eqos, int speed)
 {
+	phy_interface_t interface = eqos->interface;
 	struct eqos_imx_priv *priv = eqos->priv;
 	unsigned long rate;
 	int ret;
 
+	if (interface == PHY_INTERFACE_MODE_RMII ||
+	    interface == PHY_INTERFACE_MODE_MII)
+		return 0;
+
 	switch (speed) {
 	case SPEED_10:
 		rate = 2500000;
-- 
2.47.3

[PATCH v2025.09.y 29/49] mci: am654-sdhci: correctly configure SLOTTYPE_EMBEDDED

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

struct am654_sdhci_plat::non_removable is set no where, so drop it in
favor of struct mci_host::non_removable, which is actually populated by
the MCI core to reflect the non-removable device tree property.

This aligns us with Linux behavior, but hasn't been tested on real
hardware.

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20251128104040.1491636-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 1d04259898e90e58b1ac4277d112d39f10843c13)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/mci/am654-sdhci.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mci/am654-sdhci.c b/drivers/mci/am654-sdhci.c
index 17d3f7627005..bb67c8bf4693 100644
--- a/drivers/mci/am654-sdhci.c
+++ b/drivers/mci/am654-sdhci.c
@@ -156,7 +156,6 @@ struct am654_sdhci_plat {
 	bool fails_without_test_cd;
 
 	struct regmap *base;
-	bool non_removable;
 	u32 otap_del_sel[ARRAY_SIZE(td)];
 	u32 itap_del_sel[ARRAY_SIZE(td)];
 	u32 trm_icp;
@@ -359,7 +358,7 @@ static int am654_sdhci_init(struct mci_host *mci, struct device *dev)
 		regmap_update_bits(plat->base, PHY_CTRL1, IOMUX_ENABLE_MASK, 0);
 
 	/* Set slot type based on SD or eMMC */
-	if (plat->non_removable)
+	if (mci->non_removable)
 		ctl_cfg_2 = SLOTTYPE_EMBEDDED;
 
 	regmap_update_bits(plat->base, CTL_CFG_2, SLOTTYPE_MASK, ctl_cfg_2);
-- 
2.47.3

[PATCH v2025.09.y 30/49] scripts: imx: Makefile.mingw64: add _GNU_SOURCE

[Ahmad Fatoum]

From: Maud Spierings <maudspierings@gocontroll.com>

imx.c uses asprintf which requires _GNU_SOURCE to be defined, include
defines.h to define it.

Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251201-imx_usb-v2-1-95ec2a0e8694@gocontroll.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit ef66b9e0f1c7e2ec80ff8d57715d8794fa0949b4)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 scripts/imx/Makefile.mingw64 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/imx/Makefile.mingw64 b/scripts/imx/Makefile.mingw64
index e012d833f1b4..101b39e9178d 100644
--- a/scripts/imx/Makefile.mingw64
+++ b/scripts/imx/Makefile.mingw64
@@ -30,7 +30,7 @@ $(if $(obj),, \
 # $(realpath ...) resolves symlinks
 obj := $(realpath $(obj))
 
-CPPFLAGS := -I $(LIBUSB_MINGW)/include/libusb-1.0 -I $(src)/../include/ -I $(src)/../../include/mach/
+CPPFLAGS := -I $(LIBUSB_MINGW)/include/libusb-1.0 -I $(src)/../include/ -I $(src)/../../include/mach/ -include $(src)/../include/defines.h
 LDFLAGS := -L $(LIBUSB_MINGW)/lib -lusb-1.0 -static
 
 OBJECTS := $(addprefix $(obj)/, imx.o imx-usb-loader.o)
-- 
2.47.3

[PATCH v2025.09.y 31/49] scripts: imx: add pread implementation for mingw target

[Ahmad Fatoum]

From: Maud Spierings <maudspierings@gocontroll.com>

Add a simple pread implementation for the mingw target so imx-usb-loader
can be compiled for windows.

This function is actually only called by bareboxtlv, which I don't think
targets being compiled for windows, so it is a bit of a dead weight.

Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251201-imx_usb-v2-2-95ec2a0e8694@gocontroll.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 969c9b94b58de50ab0db2eeef0a4dcfad4f5da5c)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 scripts/imx/Makefile.mingw64 |  2 +-
 scripts/imx/pread.c          | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 scripts/imx/pread.c

diff --git a/scripts/imx/Makefile.mingw64 b/scripts/imx/Makefile.mingw64
index 101b39e9178d..a7be48ae5333 100644
--- a/scripts/imx/Makefile.mingw64
+++ b/scripts/imx/Makefile.mingw64
@@ -33,7 +33,7 @@ obj := $(realpath $(obj))
 CPPFLAGS := -I $(LIBUSB_MINGW)/include/libusb-1.0 -I $(src)/../include/ -I $(src)/../../include/mach/ -include $(src)/../include/defines.h
 LDFLAGS := -L $(LIBUSB_MINGW)/lib -lusb-1.0 -static
 
-OBJECTS := $(addprefix $(obj)/, imx.o imx-usb-loader.o)
+OBJECTS := $(addprefix $(obj)/, imx.o imx-usb-loader.o pread.o)
 
 $(obj)/%.o: $(src)/%.c
 	@$(CC) -c -o $@ $< $(CPPFLAGS)
diff --git a/scripts/imx/pread.c b/scripts/imx/pread.c
new file mode 100644
index 000000000000..febb6f32432c
--- /dev/null
+++ b/scripts/imx/pread.c
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// SPDX-FileCopyrightText: 2025 Maud Spierings, GOcontroll B.V.
+
+#include <stdint.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+ssize_t pread(int fd, void *buf, size_t count, off_t offset)
+{
+	int offset_start, now;
+
+	offset_start = lseek(fd, 0, SEEK_CUR);
+	if (offset_start < 0)
+		return offset_start;
+
+	now = lseek(fd, offset, SEEK_SET);
+	if (now < 0)
+		return now;
+
+	now = read(fd, buf, count);
+
+	lseek(fd, offset_start, SEEK_SET);
+
+	return now;
+}
-- 
2.47.3

[PATCH v2025.09.y 32/49] net: arp: collect context into new struct pending_arp

[Ahmad Fatoum]

The ARP code employs two global variables to communicate between the
code sending off the ARP request and the response that runs in the
poller:

- arp_wait_ip, which is the IP to be resolved
- arp_ether, which on success will point to the resulting MAC address

To make the relation between these two clearer and to prepare for the
follow-up fix, collect them into a common struct.

No functional change expected.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251128124939.108159-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 8ed55472688ae35f214562b0f96cc9a89f295c6a)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 net/net.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/net/net.c b/net/net.c
index 4703842f4377..795afed159aa 100644
--- a/net/net.c
+++ b/net/net.c
@@ -110,26 +110,33 @@ int setenv_ip(const char *name, IPaddr_t ip)
 	return 0;
 }
 
-static unsigned char *arp_ether;
-static IPaddr_t arp_wait_ip;
+/**
+ * struct pending_arp - Pending ARP state
+ * @ip: input IPv4 address whose resolution is being requested 
+ * @ether: output MAC addess buffer after receing a response
+ */
+static struct pending_arp {
+	IPaddr_t ip;
+	unsigned char *ether;
+} pending_arp;
 
 static void arp_handler(struct arprequest *arp)
 {
 	IPaddr_t tmp;
 
 	/* are we waiting for a reply */
-	if (!arp_wait_ip)
+	if (!pending_arp.ip)
 		return;
 
 	tmp = net_read_ip(&arp->ar_data[6]);
 
 	/* matched waiting packet's address */
-	if (tmp == arp_wait_ip) {
+	if (tmp == pending_arp.ip) {
 		/* save address for later use */
-		memcpy(arp_ether, &arp->ar_data[0], 6);
+		memcpy(pending_arp.ether, &arp->ar_data[0], 6);
 
 		/* no arp request pending now */
-		arp_wait_ip = 0;
+		pending_arp.ip = 0;
 	}
 }
 
@@ -162,6 +169,7 @@ static int arp_request(struct eth_device *edev, IPaddr_t dest, unsigned char *et
 	static char *arp_packet;
 	struct ethernet *et;
 	unsigned retries = 0;
+	IPaddr_t arp_wait_ip;
 	int ret;
 
 	if (!edev)
@@ -207,14 +215,15 @@ static int arp_request(struct eth_device *edev, IPaddr_t dest, unsigned char *et
 
 	net_write_ip(arp->ar_data + 16, arp_wait_ip);
 
-	arp_ether = ether;
+	pending_arp.ether = ether;
+	pending_arp.ip = arp_wait_ip;
 
 	ret = eth_send(edev, arp_packet, ETHER_HDR_SIZE + ARP_HDR_SIZE);
 	if (ret)
 		return ret;
 	arp_start = get_time_ns();
 
-	while (arp_wait_ip) {
+	while (pending_arp.ip) {
 		if (ctrlc())
 			return -EINTR;
 
-- 
2.47.3

[PATCH v2025.09.y 33/49] net: reset pending ARP state when request is done

[Ahmad Fatoum]

net_new() creates a struct net_connection and calls arp_request()
to resolve unicast addresses. On success, arp_request() will
populate a buffer within the net_connection with the destination MAC
address.

If arp_request() aborts due to an error, it will leave the global
pending_arp.ether pointing at the buffer, which is promptly freed
leading to a dangling pointer and a use-after-free if we happen to get
an ARP response just after the error occurred.

Fix this memory safety issue by always clearing all of  pending_arp once
we are done with it, including error cases.

Reported-by: Sohaib Mohamed <sohaib.amhmd@gmail.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251128124939.108159-2-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit effaa57f9a9476ecc5d07be92255769631ecb624)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 net/net.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/net/net.c b/net/net.c
index 795afed159aa..9c5999604b67 100644
--- a/net/net.c
+++ b/net/net.c
@@ -220,24 +220,28 @@ static int arp_request(struct eth_device *edev, IPaddr_t dest, unsigned char *et
 
 	ret = eth_send(edev, arp_packet, ETHER_HDR_SIZE + ARP_HDR_SIZE);
 	if (ret)
-		return ret;
+		goto out;
 	arp_start = get_time_ns();
 
 	while (pending_arp.ip) {
-		if (ctrlc())
-			return -EINTR;
+		if (ctrlc()) {
+			ret = -EINTR;
+			goto out;
+		}
 
 		if (is_timeout(arp_start, 3 * SECOND)) {
 			printf("T ");
 			arp_start = get_time_ns();
 			ret = eth_send(edev, arp_packet, ETHER_HDR_SIZE + ARP_HDR_SIZE);
 			if (ret)
-				return ret;
+				goto out;
 			retries++;
 		}
 
-		if (retries > PKT_NUM_RETRIES)
-			return -ETIMEDOUT;
+		if (retries > PKT_NUM_RETRIES) {
+			ret = -ETIMEDOUT;
+			goto out;
+		}
 
 		net_poll();
 	}
@@ -245,7 +249,11 @@ static int arp_request(struct eth_device *edev, IPaddr_t dest, unsigned char *et
 	pr_debug("Got ARP REPLY for %pI4: %02x:%02x:%02x:%02x:%02x:%02x\n",
 		 &dest, ether[0], ether[1], ether[2], ether[3], ether[4],
 		 ether[5]);
-	return 0;
+
+out:
+	pending_arp.ip = 0;
+	pending_arp.ether = NULL;
+	return ret;
 }
 
 void net_poll(void)
-- 
2.47.3

[PATCH v2025.09.y 34/49] test: populate qemu_bin, even if missing features

[Ahmad Fatoum]

If the YAML lists no features, the lookup for qemu_bin is prematurely
aborted, even for QEMU environment configs.

Split up the try/except clauses to fix this.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251128172107.35323-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 0f474e5b689fc22990abe83984aeef12349ddaef)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 conftest.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/conftest.py b/conftest.py
index 06321c938dba..2f72d3fe5322 100644
--- a/conftest.py
+++ b/conftest.py
@@ -128,9 +128,13 @@ def strategy(request, target, pytestconfig):
     try:
         main = target.env.config.data["targets"]["main"]
         features = main["features"]
-        qemu_bin = main["drivers"]["QEMUDriver"]["qemu_bin"]
     except KeyError:
         features = []
+
+    try:
+        main = target.env.config.data["targets"]["main"]
+        qemu_bin = main["drivers"]["QEMUDriver"]["qemu_bin"]
+    except KeyError:
         qemu_bin = None
 
     virtio = None
-- 
2.47.3

[PATCH v2025.09.y 35/49] ARM: i.MX8M: Fix the RAM size calculation for DDR3

[Ahmad Fatoum]

From: Maud Spierings <maudspierings@gocontroll.com>

The default value in the MSTR register for DDRC_MSTR_DEVICE_CONFIG is
16bit which causes the calculation to be half of the actual RAM. Add the
BIT() define for DDR3 and add it to the workaround for calculating the
correct amount of RAM like LPDDR4.

Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Link: https://lore.barebox.org/20251127-ddr3_size-v1-1-cb26cadcb348@gocontroll.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 44fc50076c854f2a05cbc9801bcc1108bc26b1b7)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 arch/arm/mach-imx/esdctl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-imx/esdctl.c b/arch/arm/mach-imx/esdctl.c
index 4c4c3528e1a6..935c3d32571d 100644
--- a/arch/arm/mach-imx/esdctl.c
+++ b/arch/arm/mach-imx/esdctl.c
@@ -325,6 +325,7 @@ static int vf610_ddrmc_add_mem(void *mmdcbase, const struct imx_esdctl_data *dat
 #define DDRC_ADDRMAP0_CS_BIT0			GENMASK(4, 0)
 
 #define DDRC_MSTR				0x0000
+#define DDRC_MSTR_DDR3				BIT(0)
 #define DDRC_MSTR_DDR4				BIT(4)
 #define DDRC_MSTR_LPDDR4			BIT(5)
 #define DDRC_MSTR_DATA_BUS_WIDTH		GENMASK(13, 12)
@@ -508,8 +509,8 @@ static resource_size_t imx8m_ddrc_sdram_size(void __iomem *ddrc, unsigned buswid
 		FIELD_GET(DDRC_ADDRMAP6_LPDDR4_6GB_12GB_24GB, addrmap[6]);
 	u32 mstr = readl(ddrc + DDRC_MSTR);
 
-	/* Device config is ignored and taken as 32-bit for LPDDR4 */
-	if (mstr & DDRC_MSTR_LPDDR4)
+	/* Device config is ignored and taken as 32-bit for LPDDR4 and DDR3 */
+	if (mstr & DDRC_MSTR_LPDDR4 || mstr & DDRC_MSTR_DDR3)
 		imx_ddrc_set_mstr_device_config(&mstr, buswidth);
 
 	return imx_ddrc_sdram_size(ddrc, addrmap,
-- 
2.47.3

[PATCH v2025.09.y 36/49] test: exit directly when invoking QEMU states on non-QEMU targets

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum@barebox.org>

Instead of running into a lot of later errors, let's just abort
immediately when trying to use --interactive with a target that doesn't
support it.

Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
Link: https://lore.barebox.org/20251128105010.2507689-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 043af2b68ff5d4d821b80a050b9401c1128eb6a9)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 test/strategy.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/test/strategy.py b/test/strategy.py
index 11406b97f5f1..a89e79214ba8 100644
--- a/test/strategy.py
+++ b/test/strategy.py
@@ -77,6 +77,9 @@ class BareboxTestStrategy(Strategy):
             if state == "qemu_dump_dtb":
                 self.qemu.machine += f",dumpdtb={self.target.name}.dtb"
 
+            if self.qemu is None:
+                pytest.exit(f"Can't enter {state} for non-QEMU target")
+
             cmd = self.qemu.get_qemu_base_args()
 
             cmd.append("-serial")
-- 
2.47.3

[PATCH v2025.09.y 37/49] tlv: register_device() error handling

[Ahmad Fatoum]

From: Jonas Rebmann <jre@pengutronix.de>

register_device() returns 0 on success, or an error, which must be
handled appropriately.

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
Link: https://lore.barebox.org/20251201-tlv-hardening-v1-1-5dcaa5f7aed5@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit debc16173615aacedd389152ce400096b6f49c5f)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/tlv/bus.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/common/tlv/bus.c b/common/tlv/bus.c
index 4dbffd365667..7ca4f82fcf18 100644
--- a/common/tlv/bus.c
+++ b/common/tlv/bus.c
@@ -21,6 +21,7 @@ struct tlv_device *tlv_register_device(struct tlv_header *header,
 	const char *name = NULL;
 	struct device *dev;
 	static int id = 0;
+	int ret;
 
 	tlvdev = xzalloc(sizeof(*tlvdev));
 
@@ -44,7 +45,11 @@ struct tlv_device *tlv_register_device(struct tlv_header *header,
 
 	dev->device_node = of_new_node(of_new_node(NULL, NULL), dev_name(dev));
 	dev->device_node->dev = dev;
-	register_device(dev);
+	ret = register_device(dev);
+	if (ret) {
+		free(tlvdev);
+		return ERR_PTR(ret);
+	}
 
 	return tlvdev;
 }
-- 
2.47.3

[PATCH v2025.09.y 38/49] fs: fix automount when last filename component is a automountpoint

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

When opening a directory in openat() as indicated with the O_DIRECTORY
flag, pass the LOOKUP_DIRECTOY flag to filename_lookup() to make sure
the target is actually a directory. By doing this we can skip the check
afterwards.

filename_lookup() only triggers the automount on the last component when
the LOOKUP_DIRECTORY flag is set, so with this change when /mnt/mmc2.3/
is a automountpoint a

stat /mnt/mmc2.3/

now triggers automounting. This also fixes tab completion with
"ls /mnt/mmc2.3/<tab>" which previously didn't trigger autmounting.

Fixes: a1da0079d1 ("fs: implement opendir in terms of fdopendir")
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251202092256.1565823-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 500df27eb054f86ce232c5bb30c3a7ea8f771e61)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 fs/fs.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/fs/fs.c b/fs/fs.c
index 54bd35786857..3eaf9084d096 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -2606,7 +2606,12 @@ int openat(int dirfd, const char *pathname, int flags)
 	}
 
 	if (!(flags & O_CREAT) || error == -EEXIST) {
-		error = filename_lookup(dirfd, getname(pathname), LOOKUP_FOLLOW, &path);
+		unsigned f = LOOKUP_FOLLOW;
+
+		if (flags & O_DIRECTORY)
+			f |= LOOKUP_DIRECTORY;
+
+		error = filename_lookup(dirfd, getname(pathname), f, &path);
 		dentry = path.dentry;
 	}
 
@@ -2636,9 +2641,6 @@ int openat(int dirfd, const char *pathname, int flags)
 		}
 
 		flags |= O_DIRECTORY;
-	} else if (flags & O_DIRECTORY) {
-		error = -ENOTDIR;
-		goto out1;
 	}
 
 	inode = d_inode(dentry);
-- 
2.47.3

[PATCH v2025.09.y 39/49] ARM: K3: am62l: don't put sysfwdata into 1st stage image

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

SYSFWDATA is not needed for the tiboot3 stage. Drop it.

Link: https://lore.barebox.org/20251202-k3-deps-v1-1-68404d3b2c70@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 429f52b9f4932b9533e7a2ed089334c955031bb2)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 images/Makefile.k3 | 2 --
 1 file changed, 2 deletions(-)

diff --git a/images/Makefile.k3 b/images/Makefile.k3
index 1a8bfe641a8e..190ada2c40f2 100644
--- a/images/Makefile.k3
+++ b/images/Makefile.k3
@@ -77,7 +77,6 @@ INNERDATA_start_am62lx_evm.pblb.k3_am62lx_img=$(INNERDATA_am62lx)
 KEY_start_am62lx_evm.pblb.k3_am62lx_img=$(KEY_custmpk)
 
 SYSFW_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(SYSFW_am62lx_hs_fs)
-SYSFWDATA_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(SYSFWDATA_am62lx)
 INNERDATA_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(INNERDATA_am62lx)
 TFA_BL1_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(FIRMWARE_DIR)/am62lx-bl1.bin
 KEY_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(KEY_custmpk)
@@ -126,7 +125,6 @@ quiet_cmd_k3_am62lx_tiboot3_image = K3_am62lx_tiboot3_IMG   $@
 		$(srctree)/scripts/k3img					\
 			$(TFA_BL1_$(@F)):1:16:160:70800000			\
 			$(SYSFW_$(@F)):2:0:0:00040000				\
-			$(SYSFWDATA_$(@F)):18:0:0:0006c000			\
 			$(INNERDATA_$(@F)):3:0:0:00000000			\
 			--key "$(KEY_$(@F))"					\
 			--out $@
-- 
2.47.3

[PATCH v2025.09.y 40/49] ARM: k3: make some firmware files SoC specific

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

On AM625 SYSFWDATA and DMDATA are really SoC specific, so drop the
possibility to overwrite them per board.

On AM62L TFA, SYSFW, SYSFWDATA, INNERDATA and the signing key are really
SoC specific, so drop the possibility to overwrite them per board.

Link: https://lore.barebox.org/20251202-k3-deps-v1-2-68404d3b2c70@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit e7189c9722ab64be703044d24d243a7bb7f1e4ad)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 images/Makefile.k3 | 40 +++++++++++-----------------------------
 1 file changed, 11 insertions(+), 29 deletions(-)

diff --git a/images/Makefile.k3 b/images/Makefile.k3
index 190ada2c40f2..992d1557275c 100644
--- a/images/Makefile.k3
+++ b/images/Makefile.k3
@@ -34,8 +34,6 @@ INNERDATA_am625=$(FIRMWARE_DIR)/ti-linux-firmware/ti-sysfw/ti-fs-firmware-am62x-
 
 ## TI am625(sip)-SK ##
 SYSFW_start_am625_sk_r5.pblb.k3_am62x_img=$(SYSFW_am625_hs_fs)
-SYSFWDATA_start_am625_sk_r5.pblb.k3_am62x_img=$(SYSFWDATA_am625)
-DMDATA_start_am625_sk_r5.pblb.k3_am62x_img=$(DMDATA_am625)
 INNERDATA_start_am625_sk_r5.pblb.k3_am62x_img=$(INNERDATA_am625)
 KEY_start_am625_sk_r5.pblb.k3_am62x_img=$(KEY_custmpk)
 
@@ -44,8 +42,6 @@ FILE_barebox-am625-sk-r5.img = start_am625_sk_r5.pblb.k3_am62x_img
 image-$(CONFIG_MACH_AM625_SK) += barebox-am625-sk-r5.img
 
 SYSFW_start_am625sip_sk_r5.pblb.k3_am62x_img=$(SYSFW_am625_hs_fs)
-SYSFWDATA_start_am625sip_sk_r5.pblb.k3_am62x_img=$(SYSFWDATA_am625)
-DMDATA_start_am625sip_sk_r5.pblb.k3_am62x_img=$(DMDATA_am625)
 INNERDATA_start_am625sip_sk_r5.pblb.k3_am62x_img=$(INNERDATA_am625)
 KEY_start_am625sip_sk_r5.pblb.k3_am62x_img=$(KEY_custmpk)
 
@@ -55,8 +51,6 @@ image-$(CONFIG_MACH_AM625_SK) += barebox-am625sip-sk-r5.img
 
 ## BeaglePlay ##
 SYSFW_start_beagleplay_r5.pblb.k3_am62x_img=$(SYSFW_am625_gp)
-SYSFWDATA_start_beagleplay_r5.pblb.k3_am62x_img=$(SYSFWDATA_am625)
-DMDATA_start_beagleplay_r5.pblb.k3_am62x_img=$(DMDATA_am625)
 KEY_start_beagleplay_r5.pblb.k3_am62x_img=$(KEY_degenerate)
 
 pblb-$(CONFIG_MACH_BEAGLEPLAY) += start_beagleplay_r5
@@ -68,18 +62,10 @@ endif
 SYSFWDATA_am62lx=$(objtree)/arch/arm/mach-k3/combined-sysfw-cfg-am62l.k3cfg
 SYSFW_am62lx_hs_fs=$(FIRMWARE_DIR)/ti-linux-firmware/ti-sysfw/ti-fs-firmware-am62lx-hs-enc.bin
 INNERDATA_am62lx=$(FIRMWARE_DIR)/ti-linux-firmware/ti-sysfw/ti-fs-firmware-am62lx-hs-cert.bin
+TFA_BL31_am62lx=$(FIRMWARE_DIR)/am62lx-bl31.bin
 
 ## TI am62lx-EVM ##
-SYSFW_start_am62lx_evm.pblb.k3_am62lx_img=$(SYSFW_am62lx_hs_fs)
-SYSFWDATA_start_am62lx_evm.pblb.k3_am62lx_img=$(SYSFWDATA_am62lx)
-TFA_start_am62lx_evm.pblb.k3_am62lx_img=$(FIRMWARE_DIR)/am62lx-bl31.bin
-INNERDATA_start_am62lx_evm.pblb.k3_am62lx_img=$(INNERDATA_am62lx)
-KEY_start_am62lx_evm.pblb.k3_am62lx_img=$(KEY_custmpk)
-
-SYSFW_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(SYSFW_am62lx_hs_fs)
-INNERDATA_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(INNERDATA_am62lx)
 TFA_BL1_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(FIRMWARE_DIR)/am62lx-bl1.bin
-KEY_start_am62lx_evm.pblb.k3_am62lx_tiboot3_img=$(KEY_custmpk)
 
 pblb-$(CONFIG_MACH_AM62LX_EVM) += start_am62lx_evm
 FILE_barebox-am62lx-evm.img = start_am62lx_evm.pblb.k3_am62lx_img
@@ -96,37 +82,33 @@ quiet_cmd_k3_am62x_image = K3_am62x_IMG   $@
 		$(srctree)/scripts/k3img					\
 			$<:1:16:0:43c00000					\
 			$(SYSFW_$(@F)):2:0:0:00040000				\
-			$(SYSFWDATA_$(@F)):18:0:0:00067000			\
+			$(SYSFWDATA_am625):18:0:0:00067000			\
 			$$inner							\
-			$(DMDATA_$(@F)):17:16:0:43c3a800			\
+			$(DMDATA_am625):17:16:0:43c3a800			\
 			--key "$(KEY_$(@F))" --out $@
 
 quiet_cmd_k3_am62lx_image = K3_am62lx_IMG   $@
       cmd_k3_am62lx_image = \
-		if [ -n "$(INNERDATA_$(@F))" ]; then				\
-			inner="$(INNERDATA_$(@F)):3:0:0:00000000";		\
-		fi;								\
-										\
 		if [ -e "$(FIRMWARE_DIR)/am62lx-bl32.bin" ]; then		\
 			optee=$(FIRMWARE_DIR)/am62lx-bl32.bin:17:16:0:80200000;	\
 		fi;								\
 										\
 		$(srctree)/scripts/k3img					\
-			$(TFA_$(@F)):1:16:0:80000000				\
-			$(SYSFW_$(@F)):2:0:0:00040000				\
-			$(SYSFWDATA_$(@F)):18:0:0:0006c000			\
-			$$inner							\
+			$(TFA_BL31_am62lx):1:16:0:80000000			\
+			$(SYSFW_am62lx_hs_fs):2:0:0:00040000			\
+			$(SYSFWDATA_am62lx):18:0:0:0006c000			\
+			$(INNERDATA_am62lx):3:0:0:00000000			\
 			$$optee							\
 			$<:17:16:0:82000000					\
-			--key "$(KEY_$(@F))" --out $@
+			--key "$(KEY_custmpk)" --out $@
 
 quiet_cmd_k3_am62lx_tiboot3_image = K3_am62lx_tiboot3_IMG   $@
       cmd_k3_am62lx_tiboot3_image = \
 		$(srctree)/scripts/k3img					\
 			$(TFA_BL1_$(@F)):1:16:160:70800000			\
-			$(SYSFW_$(@F)):2:0:0:00040000				\
-			$(INNERDATA_$(@F)):3:0:0:00000000			\
-			--key "$(KEY_$(@F))"					\
+			$(SYSFW_am62lx_hs_fs):2:0:0:00040000			\
+			$(INNERDATA_am62lx):3:0:0:00000000			\
+			--key "$(KEY_custmpk)"					\
 			--out $@
 
 $(obj)/%.k3_am62x_img: $(obj)/% scripts/k3img FORCE
-- 
2.47.3

[PATCH v2025.09.y 41/49] ARM: k3: am62l: Add dedicated config option for OP-TEE

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

Until now we compiled in the OP-TEE binary into the AM62l images when it
exists. The when-it-exists part makes it hard to add a dependeny on the
file, so add a dedicated config option for it.

Link: https://lore.barebox.org/20251202-k3-deps-v1-3-68404d3b2c70@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 2711c4ca4fdce892567391e8f363d277c03505b3)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 firmware/Kconfig   | 4 ++++
 images/Makefile.k3 | 8 ++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/firmware/Kconfig b/firmware/Kconfig
index 14a1c3d3a844..1121615fe6d5 100644
--- a/firmware/Kconfig
+++ b/firmware/Kconfig
@@ -113,6 +113,10 @@ config FIRMWARE_LS1028A_ATF
 config FIRMWARE_LS1046A_ATF
 	bool
 
+config FIRMWARE_K3_AM62L_OPTEE
+	bool "install OP-TEE on K3 AM62L boards"
+	depends on MACH_AM62LX
+
 config HAVE_FIRMWARE_VERIFY_NEXT_IMAGE
 	bool
 
diff --git a/images/Makefile.k3 b/images/Makefile.k3
index 992d1557275c..bb49c0a9548a 100644
--- a/images/Makefile.k3
+++ b/images/Makefile.k3
@@ -87,10 +87,14 @@ quiet_cmd_k3_am62x_image = K3_am62x_IMG   $@
 			$(DMDATA_am625):17:16:0:43c3a800			\
 			--key "$(KEY_$(@F))" --out $@
 
+ifdef CONFIG_FIRMWARE_K3_AM62L_OPTEE
+AM62L_TIBOOT3_OPTEE = $(FIRMWARE_DIR)/am62lx-bl32.bin
+endif
+
 quiet_cmd_k3_am62lx_image = K3_am62lx_IMG   $@
       cmd_k3_am62lx_image = \
-		if [ -e "$(FIRMWARE_DIR)/am62lx-bl32.bin" ]; then		\
-			optee=$(FIRMWARE_DIR)/am62lx-bl32.bin:17:16:0:80200000;	\
+		if [ -n "$(AM62L_TIBOOT3_OPTEE)" ]; then			\
+			optee=$(AM62L_TIBOOT3_OPTEE):17:16:0:80200000;		\
 		fi;								\
 										\
 		$(srctree)/scripts/k3img					\
-- 
2.47.3

[PATCH v2025.09.y 42/49] ARM: k3: am62l: fix dependencies on k3img input files

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

Apart from the barebox image itself the k3img tool has several other
input files. Add proper dependencies on them to make sure the image
is rebuilt when one of the input files changes.

Link: https://lore.barebox.org/20251202-k3-deps-v1-4-68404d3b2c70@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit f1739aa759f076ecdea8ebe1d792db98c6d0ab68)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 images/Makefile.k3 | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/images/Makefile.k3 b/images/Makefile.k3
index bb49c0a9548a..7e779193b190 100644
--- a/images/Makefile.k3
+++ b/images/Makefile.k3
@@ -118,8 +118,16 @@ quiet_cmd_k3_am62lx_tiboot3_image = K3_am62lx_tiboot3_IMG   $@
 $(obj)/%.k3_am62x_img: $(obj)/% scripts/k3img FORCE
 	$(call if_changed,k3_am62x_image)
 
-$(obj)/%.k3_am62lx_img: $(obj)/% scripts/k3img FORCE
+$(obj)/%.k3_am62lx_img: $(obj)/% scripts/k3img FORCE \
+		$(TFA_BL31_am62lx)				\
+		$(INNERDATA_am62lx)				\
+		$(SYSFW_am62lx_hs_fs)				\
+		$(SYSFWDATA_am62lx)				\
+		$(AM62L_TIBOOT3_OPTEE)
 	$(call if_changed,k3_am62lx_image)
 
-$(obj)/%.k3_am62lx_tiboot3_img: $(obj)/% scripts/k3img FORCE
+$(obj)/%.k3_am62lx_tiboot3_img: $(obj)/% scripts/k3img FORCE 	\
+		$(SYSFW_am62lx_hs_fs)				\
+		$$(TFA_BL1_$$(@F))				\
+		$(INNERDATA_am62lx)
 	$(call if_changed,k3_am62lx_tiboot3_image)
-- 
2.47.3

[PATCH v2025.09.y 43/49] lib: base64: Fix out-of-bounds potential by respecting dst_len

[Ahmad Fatoum]

From: Jonas Rebmann <jre@pengutronix.de>

__decode_base64 generally writes the input in 3 bytes increments,
corresponding to 4 bytes increments in the base64 input buffer. This
means that in order to respect dst_len as the size of the output buffer,
the case of exceeding dst_len within a loop iteration must be
considered.

In such a case, refrain from writing the last one or two bytes if that
write would be past dst_len.

Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
Link: https://lore.barebox.org/20251202-base64-bounds-v2-1-34d3716c3f55@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit c99102d34c2d8f8c79cfaecf8968581031cbffef)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 lib/base64.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/base64.c b/lib/base64.c
index d5ab217528db..3e29f0a56c45 100644
--- a/lib/base64.c
+++ b/lib/base64.c
@@ -163,19 +163,19 @@ static int __decode_base64(char *p_dst, int dst_len, const char *src, bool url)
 		 */
 		if (count > 1)
 			*dst++ = six_bit[0] << 2 | six_bit[1] >> 4;
-		if (count > 2)
+		if (count > 2 && dst_len > 1)
 			*dst++ = six_bit[1] << 4 | six_bit[2] >> 2;
-		if (count > 3)
+		if (count > 3 && dst_len > 2)
 			*dst++ = six_bit[2] << 6 | six_bit[3];
+		/* last character was "=" */
+		if (count != 0)
+			length += min(count - 1, dst_len);
 		/*
 		 * Note that if we decode "AA==" and ate first '=',
 		 * we just decoded one char (count == 2) and now we'll
 		 * do the loop once more to decode second '='.
 		 */
 		dst_len -= count-1;
-		/* last character was "=" */
-		if (count != 0)
-			length += count - 1;
 	}
 ret:
 	p_dst = dst;
-- 
2.47.3

[PATCH v2025.09.y 44/49] param: make setting a parameter to the same string value a no-op

[Ahmad Fatoum]

setenv("global.bootm.root_param", getenv("global.bootm.root_param"))
triggers a use-after-free, because the value is free'd before being
duplicated and allocated again.

Let's just early exit in this case as there's nothing further to do.

This was noticed by KASAN when bootm_data_restore_defaults restored
global.bootm.root_param.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251211171706.2369329-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit c8cfce813f2f7e5df84bf2ba4364212c04102451)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 lib/parameter.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/parameter.c b/lib/parameter.c
index 274e6fcb8376..770c90ec48b4 100644
--- a/lib/parameter.c
+++ b/lib/parameter.c
@@ -131,6 +131,8 @@ int bobject_set_param(bobject_t _bobj, const char *name, const char *val)
 int bobject_param_set_generic(bobject_t _bobj, struct param_d *p,
 			  const char *val)
 {
+	if (val == p->value)
+		return 0;
 	free(p->value);
 	if (!val) {
 		p->value = NULL;
-- 
2.47.3

[PATCH v2025.09.y 45/49] i2c: omap: fix probe on am335x

[Ahmad Fatoum]

The AM335x uses ti,omap4-i2c as compatible for the I2C device tree
nodes, but that compatible unlike its brethern has no driver data as
it's determined using the machine compatible in the probe function
instead.

device_get_match_data() returning NULL is thus expected and should not
lead to an immediate error.

Fixes: 20d87123a638 ("treewide: replace dev_get_drvdata with device_get_match_data")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251212153649.365215-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit b3c4f9a12b8c127f0ae48a5eab082090a60dfdf2)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/i2c/busses/i2c-omap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 29378a96d722..c45483579250 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -1076,14 +1076,15 @@ i2c_omap_probe(struct device *pdev)
 	}
 
 	i2c_data = device_get_match_data(pdev);
-	if (!i2c_data)
-		return -ENODEV;
 
 	if (of_machine_is_compatible("ti,am33xx"))
 		i2c_data = &am33xx_data;
 	if (of_machine_is_compatible("ti,omap4"))
 		i2c_data = &omap4_data;
 
+	if (!i2c_data)
+		return -EINVAL;
+
 	i2c_omap->data = i2c_data;
 	i2c_omap->reg_shift = (i2c_data->flags >>
 					OMAP_I2C_FLAG_BUS_SHIFT__SHIFT) & 3;
-- 
2.47.3

[PATCH v2025.09.y 46/49] net: 9p: fix variable name in BAREBOX_MAGICVAR

[Ahmad Fatoum]

The variable is called global.9p.debug, not plan9debug.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251215075907.1222551-1-a.fatoum@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit 370f8098d2ab573c7800ab0be9631ed6a9ad61c5)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 net/9p/mod.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/9p/mod.c b/net/9p/mod.c
index ef071a1b490d..d6b3ba583428 100644
--- a/net/9p/mod.c
+++ b/net/9p/mod.c
@@ -26,7 +26,7 @@
 
 #ifdef CONFIG_NET_9P_DEBUG
 unsigned int p9_debug_level;	/* feature-rific global debug level  */
-BAREBOX_MAGICVAR(plan9debug, "9P debugging level");
+BAREBOX_MAGICVAR(global.9p.debug, "9P debugging level");
 
 void _p9_debug(enum p9_debug_flags level, const char *func,
 	       const char *fmt, ...)
-- 
2.47.3

[PATCH v2025.09.y 47/49] pmdomain: fix collision in names when registering

[Ahmad Fatoum]

From: Maud Spierings <maudspierings@gocontroll.com>

After adding the imx8m-blk-ctrl driver errors started appearing about
the genpd device already being registered.

incorperate some extra device details in the device name so this
possible collision goes away.

Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Link: https://lore.barebox.org/20251216-genpd_fix-v2-1-1dddd24a61ef@gocontroll.com
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit e2d7e032281158b54541392b4d8108de204137a1)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/base/power.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/base/power.c b/drivers/base/power.c
index d60a00f5735e..66ad6d05e815 100644
--- a/drivers/base/power.c
+++ b/drivers/base/power.c
@@ -481,11 +481,11 @@ struct device *genpd_dev_pm_attach_by_id(struct device *dev,
 	if (!virt_dev)
 		return ERR_PTR(-ENOMEM);
 
-	dev_set_name(virt_dev, "genpd");
+	dev_set_name(virt_dev, "genpd:%u:%s", index, dev_name(dev));
 	virt_dev->bus = &genpd_bus_type;
 	virt_dev->parent = dev;
 	virt_dev->of_node = dev->of_node;
-	virt_dev->id = index;
+	virt_dev->id = DEVICE_ID_SINGLE;
 
 	ret = device_register(virt_dev);
 	if (ret) {
-- 
2.47.3

[PATCH v2025.09.y 48/49] i2c: implement i2c_unregister_device()

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

We had no need so far, but we do in a followup patch.

Link: https://lore.barebox.org/20251217145156.1581678-2-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit aec4d23749922d10aed37641bc6c0fafccec4c09)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/i2c/i2c.c | 6 ++++++
 include/i2c/i2c.h | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/drivers/i2c/i2c.c b/drivers/i2c/i2c.c
index 7b11c350399d..658a0a2b7165 100644
--- a/drivers/i2c/i2c.c
+++ b/drivers/i2c/i2c.c
@@ -421,6 +421,12 @@ static struct i2c_client *i2c_new_device(struct i2c_adapter *adapter,
 	return client;
 }
 
+void i2c_unregister_device(struct i2c_client *client)
+{
+	unregister_device(&client->dev);
+	devinfo_del(&client->dev, i2c_info);
+}
+
 static void of_i2c_register_devices(struct i2c_adapter *adap)
 {
 	struct device_node *n;
diff --git a/include/i2c/i2c.h b/include/i2c/i2c.h
index 5c0174b0ddc7..fb3f43cabb9d 100644
--- a/include/i2c/i2c.h
+++ b/include/i2c/i2c.h
@@ -313,6 +313,8 @@ extern struct class i2c_adapter_class;
 extern struct i2c_client *
 i2c_new_dummy(struct i2c_adapter *adap, u16 address);
 
+void i2c_unregister_device(struct i2c_client *client);
+
 /* Return the adapter number for a specific adapter */
 static inline int i2c_adapter_id(struct i2c_adapter *adap)
 {
-- 
2.47.3

[PATCH v2025.09.y 49/49] eeprom: at24: unregister devices in error path

[Ahmad Fatoum]

From: Sascha Hauer <s.hauer@pengutronix.de>

The AT24 driver might register some i2c devices using i2c_new_dummy().
These are freed in the error path, but not unregistered which leads to
memory corruptions later.

Link: https://lore.barebox.org/20251217145156.1581678-3-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
(cherry picked from commit ebd2558bf99b3758854ac2b104cff7cfbd2cebb9)
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 drivers/eeprom/at24.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/eeprom/at24.c b/drivers/eeprom/at24.c
index 667d111b349d..feb11b1cbb18 100644
--- a/drivers/eeprom/at24.c
+++ b/drivers/eeprom/at24.c
@@ -492,8 +492,11 @@ static int at24_probe(struct device *dev)
 
 err_devfs_create:
 err_clients:
-	for (i = 1; i < num_addresses; i++)
+	for (i = 1; i < num_addresses; i++) {
+		if (at24->client[i])
+			i2c_unregister_device(at24->client[i]);
 		kfree(at24->client[i]);
+	}
 
 	if (gpio_is_valid(at24->wp_gpio))
 		gpio_free(at24->wp_gpio);
-- 
2.47.3