The GitHub dependabot tool has reported a "medium" priority bug
CVE-2025-68146, with this package. Update to the patched version.

Reported-by: GitHub dependabot
Signed-off-by: Tom Rini <trini@konsulko.com>

Support for using "u-boot,dm-..." rather than "bootph-..." has been
deprecated since February 2023. Any platforms using this have had a
console message saying to migrate by 2023.07. Go and remove all support
here now, for the v2026.01 release.

The results of this change that aren't clear from the above are that we
still have a checkpatch.pl error message, and document in
doc/develop/spl.rst that they have been migrated since 2023. We also
change the key2dtsi.py tool to use the correct bootph phase rather than
the legacy phase.

Signed-off-by: Tom Rini <trini@konsulko.com>

The general python documentation for the subprocess class recommends
that run() be used in all cases that it can handle. What we do in
RunAndLog is simple enough that run() is easy to switch to. In fact,
looking at this exposed a problem we have today, which is that we had
combined stdout and stderr but then looked at both stdout and stderr as
if they were separate. Stop combining them.

Signed-off-by: Tom Rini <trini@konsulko.com>

Add test cases to validate FDT and TPM eventlog handoff from TF-A
and OP-TEE via bloblist.

For FDT, the nodes 'reserved-memory' and 'firmware' appended by
OP-TEE indicates a successful handoff.

For TPM eventlog, the events 'SECURE_RT_EL3', 'SECURE_RT_EL1_OPTEE'
and 'SECURE_RT_EL1_OPTEE_EXTRA1' created by TF-A indicates a
successful handoff.

Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
Reviewed-by: Tom Rini <trini@konsulko.com>

Our pytest package was pinned to a release from 2021. The minimum
compatible with labgrid v25.0.x is pytest 7.0.0. Update to the current
relase which is currently 8.4.2

Signed-off-by: Tom Rini <trini@konsulko.com>

The EFI secure boot tests install a security data base.
Other EFI tests assume that secure boot is not enabled.
Add the missing tear-down at the end of each secboot test sequence.

Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tested-by: Tom Rini <trini@konsulko.com>

This reverts commit 4d84fa1261eb27d57687f2e4c404a78b8653c183, reversing
changes made to b82a1fa7ddc7f3be2f3b75898d5dc44c34420bdd.

I had missed some feedback on this series from earlier, and we have
since had reports of regressions due to this as well. For now, revert
this.

Signed-off-by: Tom Rini <trini@konsulko.com>

Aristo Chen <jj251510319013@gmail.com> says:

This patch series enhances FIT image robustness by adding **memory
region overlap detection** to `mkimage` and fixing existing overlaps
in DTS files and `binman` tests.

The primary goal is to prevent runtime memory corruption from
conflicting load addresses in FIT images.

Key Changes:

1.  `mkimage` Overlap Detection: A new validation in
    `tools/fit_image.c` checks for overlapping load addresses
    within FIT configurations. `mkimage` now errors out with
    detailed info on conflicts, preventing bad FIT image creation.

2.  New Test Case: A Python test verifies the new detection.
    It intentionally creates an overlap (kernel and FDT)
    to confirm correct error handling.

3.  Fixes for Existing Overlaps:
    * Board DTS (k3-am6xx): Adjusted load addresses for TI
      firmware stubs to prevent conflicts. This resolves
      previously undetected overlaps.
    * `binman` Tests: Fixed several tests. U-Boot load
      addresses were shifted to avoid ATF conflicts. A new
      linker script for TEE ELF sections ensures distinct
      memory layouts.

4.  Documentation: Added guidance for developers on how to
    determine ELF load addresses using readelf, linker scripts,
    and objdump when working with binman FIT images.

Impact:

This series improves FIT image reliability by catching overlaps
at build time, helping developers resolve issues before runtime
failures.

Link: https://lore.kernel.org/r/20250914110021.4103-1-aristo.chen@canonical.com

Add a new test case to verify that mkimage properly detects and reports
memory region overlaps in FIT image configurations.

The test creates a FIT image with kernel and FDT components that have
the same load address (0x40000), which should trigger the overlap
detection logic and cause mkimage to fail with an appropriate error
message.

Test verifies:
- mkimage returns non-zero exit code when overlap is detected
- Error message contains "Error: Overlap detected:"
- Error message identifies the specific overlapping components
  (kernel@1 and fdt@1)

This test ensures the overlap detection feature works correctly and
prevents deployment of FIT images with conflicting memory layouts
that could cause runtime failures.

Signed-off-by: Aristo Chen <aristo.chen@canonical.com>

Introduce two new parameters to be used with mkimage -f auto to bundle
TFA BL31 image into fitImage, using auto-generated fitImage. Add -y to
specify TFA BL31 file name and -Y to specify TFA BL31 load and entry
point address. This is meant to be used with systems which boot all of
TFA BL31, Linux and its DT from a single fitImage, all booted by U-Boot.

Example invocation:
"
$ mkimage -E -A arm64 -C none -e 0x50200000 -a 0x50200000 -f auto \
          -d arch/arm64/boot/Image \
	  -b arch/arm64/boot/dts/renesas/r8a779g3-sparrow-hawk.dtb \
	  -y ../tfa/build/rcar_gen4/release/bl31.bin -Y 0x46400000 \
	  /path/to/output/fitImage
"

Documentation update and test are also included, the test validates
both positive and negative test cases, where fitImage does not include
TFA BL31 and does include TFA BL31 blobs.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>