Hi all,
We have a barebox Release for September, I just released
barebox-2026.09.0.
This release fixes vulnerabilities in the FIT image code. Most important
one is fixed with "FIT: resolve FIT images case-sensitively". This
vulnerability allowed to trick barebox into verifying one FIT image node
while booting another. The issue showed up in a security audit and is
fixed in this release, stable updates for v2026.04 and v2026.08 will
follow shortly.
Another issue fixed is that a hash node in a FIT image defines its
algorithm. We used to look only at the first hash node. If that says
crc32 then barebox would use that to verify the image data. This is
changed to iterate over the available algos from strong to weak and
see if one of them can verify the image data. crc32, md5 and sha1 are
explicitly no longer allowed. Note that this vulnerability requires
a signed FIT image with crc32 as hashing algorithm, something a properly
signed FIT image shouldn't have, but as crc32 used to be the
pre-secure-boot standard, it could well have leaked into images.
On the brighter side this release adds support for the Novarq Tactical
1000 board which is a switch built around the Microchip LAN9696. Also
the PXA support has been revived, with the PXA3xx as a fully supported
device tree platform.
For the usual flow of patches that went into this release see below.
Have Fun!
Sascha
----------------------------------------------------------------
Ahmad Fatoum (35):
Documentation: security: mention long term stable release
clk: tolerate clocks registered without a name
efi: payload: gracefully handle OOM in initrd allocation
ARM: lds: place EFI runtime code and data in separate PT_LOAD segments
efi: loader: map code-type page allocations executable
ARM: allow CONFIG_ARM_MMU_PERMISSIONS together with EFI_RUNTIME
test: py: efiloader: test EFI ResetSystem from booted Linux
bootm: remove previously deprecated CONFIG_BOOTM_OPTEE
commands: cpuinfo: unify command description
virtio_blk: write back the block cache before resetting the device
efi: loader: don't truncate the status in
efi_init_runtime_variable_supported()
efi: loader: fix sign of the error passed to ERR_PTR()
efi: loader: disk: don't require block-size aligned I/O buffers
efi: loader: select PRINTF_WCHAR
boot: don't use the nfs:// mount path after freeing it
net: dsa: don't index the port array one entry past its end
libfile: advance offset in pread_full() on short reads
libfile: allow fixup_path_case() to resolve directories
fs: don't leak the parent path when openat() fails after the lookup
ARM64: efi-header: declare the code section writable
ARM64: lds: place relocation tables explicitly
common: boards: qemu: read the command line from the cmdline fw_cfg key
efi: loader: fix EFI_EXIT2 tracing an uninitialized status
fs: efivarfs: initialize dummy data written on variable creation
sandbox: actually build the assembly setjmp/longjmp/initjmp
clk: k3: pll: initialize success flag in ti_pll_wait_for_lock
ARM: i.MX9: initialize max_speed in imx9_cpu_speed_grade_hz
defaultenv: don't pass environment path to zero env
Makefile: fix security_%config configurator targets
FIT: reject non-zero hashed-strings offset
FIT: reject configuration properties that are not NUL-terminated
crypto: ecdsa: validate the signature and digest lengths
crypto: rsa: check the PKCS#1 v1.5 block header and minimum length
Documentation: security: note FIT configuration choice being unsigned
ARM64: clocksource: drop too early error message
Bruno Produit (Patch the Planet in collaboration with OpenAI) (1):
FIT: resolve FIT images case-sensitively
Chali Anis (1):
bcm283x: debug_ll: add RaspberryPi 4 PL011 UART support
Fabian Pflug (1):
ARM: boards: i.MX93: use kernel dts
Michael Riesch (2):
clang-format: do not allow short enums on a single line
clang-format: align consecutive macros
Oleksij Rempel (8):
ARM: introduce ARCH_MICROCHIP for ARM64 Microchip SoCs
serial: atmel: add lan9696 (Microchip LAN969X) support
clk: add Microchip LAN966X / LAN969X generic clock controller driver
pinctrl: ocelot: port Microsemi/Microchip Ocelot pinctrl from Linux
gpio: add Microchip SGPIO (serial GPIO) driver
reset: add Microchip sparx5 / LAN969X / LAN966X switch reset driver
spi: atmel-quadspi: add Microchip LAN966X / LAN969X support
ARM: add Novarq Tactical 1000 board
Sascha Hauer (49):
PBL: add pbl_sha256()
ARM: pbl: add PBL support for crypto extensions
input: gpio-keys: initialize the input value with the current gpioval
net: designware: eqos: keep virtual RX buffer address around
ARM: pxa: remove PXA25x and PXA27x support
video: remove the PXA framebuffer driver
ARM: cache: drive the XSC3 cache with the ARMv4 functions
mci: pxamci: get the clock from the clk API
pwm: pxa: get the clock from the clk API
serial: pxa: get the clock from the clk API
clk: pxa: add a device tree clock driver for PXA3xx
mtd: nand: nand_mrvl_nfc: honour marvell,nand-keep-config
mtd: nand: nand_mrvl_nfc: support the nand-controller bindings
mtd: nand: mrvl_nfc: keep the ready latch across a STATUS command
mtd: nand: mrvl_nfc: do not report a command timeout as an error
mci: pxamci: probe from the device tree
serial: pxa: add device tree support
serial: pxa: provide the Linux console name
gpio: pxa: add a driver and switch the architecture to GPIOLIB
ARM: pxa: add DEBUG_LL support
ARM: pxa: let the board select the SoC
ARM: pxa: enable device tree support
scripts: add pxa-image
ARM: pxa: add a NAND first stage loader
filetype: detect PXA3xx NTIM images
ARM: pxa: add a barebox update handler for NAND
clocksource: add a driver for the PXA OS timer and its watchdog
ARM: pxa: move over to MULTIARCH
ARM: pxa: reset straight away and without complaining
ARM: pxa: add Raumfeld Speaker board support
ARM: multi_v5_v6_defconfig: enable PXA support
Release v2026.08.0: Move migration-master to release path
migration guide: Create new migration guide for next release
Merge branch 'for-next/efi'
Merge branch 'for-next/imx'
Merge branch 'for-next/microchip'
Merge branch 'for-next/misc'
Merge branch 'for-next/pbl-clocksource'
Merge branch 'for-next/pbl-sha'
Merge branch 'for-next/pxa'
Merge branch 'for-next/xhci'
Documentation: Officially accept GitHub pull requests
FIT: Do not accept insecure hashing algos for signed images
Merge remote-tracking branch 'github-ghsa-jhvm-7xq8-rvgm/advisory-fix-2'
Merge remote-tracking branch 'github-ghsa-jhvm-7xq8-rvgm/advisory-fix-1'
Merge remote-tracking branch 'github-ghsa-jhvm-7xq8-rvgm/advisory-fix-4'
Merge remote-tracking branch 'github-ghsa-jhvm-7xq8-rvgm/advisory-fix-3'
ci: pytest: test against Debian 13.7.0 image
Release v2026.09.0
Stefan Kerkmann (6):
RISC-V: setup_c: avoid clearing BSS twice
ARM/ARM64/RISC-V: pbl: add constructor support
clocksource: allow re-init for same clock
drivers: arm_architected_timer: refactor for pbl compatibility
ARM64: enable PBL_CLOCKSOURCE compatibility
linux/iopoll: enable polled timeouts for PBL_CLOCKSOURCE
Stephano Cetola (7):
usb: xhci: tolerate COMP_CTX_STATE in abort_td's final completion check
usb: xhci: reset_ep: wait for real completion, not the caller's timeout
usb: xhci: reset_ep: fix misaligned pointer in Set TR Dequeue Pointer
usb: xhci: xhci_bulk_tx: re-fetch ep_ctx after resetting a halted endpoint
usb: xhci: wait a real interval for interrupt endpoint transfers
ARM: mmu64: fix arch_remap_range permission-strip order
spi: rockchip: initialize bus_num to -1
Thomas Bonnefille (1):
sandbox: enable keytoc in hosttools_defconfig
Ulrich Ölmann (4):
security: Kconfig.policy: fix typos
commands: Kconfig: fix typo
common: Sconfig: fix help text of BOOT_UNSIGNED_IMAGES
common: Kconfig.debug: fix typos
[email protected] (2):
partitions: efi: reject partitions with negative size
partitions: efi: reject partitions with negative size
zhengxiaojun (1):
net: designware_eqs: set upper 32bit address for DMA descriptors to
support 64-bit addressing
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
