Prepare v2025.04-rc4

-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmfPdnYACgkQFHw5/5Y0
 tyw17wv+KqFxDoJKTGVWeP4fu+zhTQlFo0f2tAlWylAdJnDP6nR/I49zid2mjRbZ
 2Bq3mE3G2Ag1efJ3UGHck0Zn1O9OpqVvk734IHSJFygN77l2xmNSMXZd8MLOsbaU
 4JXhxbLUdumCSkwVjjc9/sN+kJUfpwmFBwjqPWmE8rVU+IjApdZP0hBmfxACivl3
 p0JJZ870JkgSd5KuAGO/MUbinl/QYOdpitbo2EinOyqnLnivw5PzlcAYF0STNcgJ
 XfsT7Ap9T3woPTkT1mXGo+0gBs1OPxXcXp6nywFY75EVIGYRetDEXr8/jf74Jg83
 XK8+mqFP+bhlLOMydCdRHyQU8+WGNPfWtcOa7ekC3DjR9Kf7VwoTujqa9B9ILg6m
 UBagI/zUIWGAHi4oe2vMV16nR1cPT1ZexPoswZJrj/iDC6WaN0gWwDQgcPODm0UL
 rPYYNPWne/iGYgbkhy1zqZMEj7ytnvtjaVMRFdbTSwWUR3s23q9btqjlOwfXbtYZ
 0ENfAAu0
 =xGcd
 -----END PGP SIGNATURE-----

Merge tag 'v2025.04-rc4' into next

This uses Heinrich's merge of lib/efi_loader/efi_net.c which results in
no changes.

.mailmap

@@ -42,6 +42,7 @@ Durga Challa <durga.challa@amd.com> <vnsl.durga.challa@xilinx.com>
 Eugen Hristev <eugen.hristev@linaro.org> <eugen.hristev@microchip.com>
 Eugen Hristev <eugen.hristev@linaro.org> <eugen.hristev@collabora.com>
 Fabio Estevam <fabio.estevam@nxp.com>
+Greg Malysa <malysagreg@gmail.com> <greg.malysa@timesys.com>
 Harini Katakam <harini.katakam@amd.com> <harini.katakam@xilinx.com>
 Harsha <harsha.harsha@amd.com> <harsha.harsha@xilinx.com>
 Heiko Stuebner <heiko.stuebner@cherry.de> <heiko.stuebner@theobroma-systems.com>
@@ -123,6 +124,7 @@ Srinivas Neeli <srinivas.neeli@amd.com> <srinivas.neeli@xilinx.com>
 Stefan Roese <sr@denx.de> <stroese>
 Stefano Babic <sbabic@denx.de>
 Stefano Stabellini <stefano.stabellini@amd.com> <stefano.stabellini@xilinx.com>
+Sumit Garg <sumit.garg@kernel.org> <sumit.garg@linaro.org>
 Tom Rini <trini@konsulko.com> <trini@ti.com>
 Tomas Thoresen <tomas.thoresen@amd.com> <tomast@xilinx.com>
 TsiChung Liew <Tsi-Chung.Liew@freescale.com>

MAINTAINERS

@@ -617,7 +617,7 @@ F:	arch/arm/dts/am335x-sancloud*
 
 ARM SC5XX
 M:	Nathan Barrett-Morrison <nathan.morrison@timesys.com>
-M:	Greg Malysa <greg.malysa@timesys.com>
+M:	Greg Malysa <malysagreg@gmail.com>
 M:	Ian Roberts <ian.roberts@timesys.com>
 M:	Vasileios Bimpikas <vasileios.bimpikas@analog.com>
 M:	Utsav Agarwal <utsav.agarwal@analog.com>
@@ -641,7 +641,7 @@ F:	include/env/adi/
 ARM SNAPDRAGON
 M:	Caleb Connolly <caleb.connolly@linaro.org>
 M:	Neil Armstrong <neil.armstrong@linaro.org>
-R:	Sumit Garg <sumit.garg@linaro.org>
+R:	Sumit Garg <sumit.garg@kernel.org>
 L:	u-boot-qcom@groups.io
 S:	Maintained
 T:	git https://source.denx.de/u-boot/custodians/u-boot-snapdragon.git
@@ -1045,9 +1045,10 @@ F:	common/cyclic.c
 F:	include/cyclic.h
 
 DEVICETREE REBASING SUBTREE
-M:	Sumit Garg <sumit.garg@linaro.org>
+M:	Sumit Garg <sumit.garg@kernel.org>
 S:	Maintained
 F:	dts/upstream/
+N:	OF_UPSTREAM
 
 DFU
 M:	Lukasz Majewski <lukma@denx.de>
@@ -1453,7 +1454,7 @@ S:	Maintained
 F:	tools/patman/
 
 PCIe DWC IMX
-M:	Sumit Garg <sumit.garg@linaro.org>
+M:	Sumit Garg <sumit.garg@kernel.org>
 S:	Maintained
 F:	drivers/pci/pcie_dw_imx.c
 F:	drivers/phy/phy-imx8m-pcie.c

Makefile

@@ -3,7 +3,7 @@
 VERSION = 2025
 PATCHLEVEL = 04
 SUBLEVEL =
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME =
 
 # *DOCUMENTATION*
@@ -829,7 +829,7 @@ KBUILD_HOSTCFLAGS += $(if $(CONFIG_TOOLS_DEBUG),-g)
 UBOOTINCLUDE    := \
 	-Iinclude \
 	$(if $(KBUILD_SRC), -I$(srctree)/include) \
-	$(if $(CONFIG_MBEDTLS_LIB), \
+	$(if $(CONFIG_$(XPL_)MBEDTLS_LIB), \
 		"-DMBEDTLS_CONFIG_FILE=\"mbedtls_def_config.h\"" \
 		-I$(srctree)/lib/mbedtls \
 		-I$(srctree)/lib/mbedtls/port \

arch/arm/dts/k3-am625-phycore-som-binman.dtsi

@@ -321,8 +321,11 @@
 					compression = "none";
 					load = <0x8F000000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_rtc_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_rtc_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
 					};
 				};
@@ -333,8 +336,11 @@
 					compression = "none";
 					load = <0x8F001000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_spi_not_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_spi_not_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
 					};
 				};
@@ -345,8 +351,11 @@
 					compression = "none";
 					load = <0x8F002000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
 					};
 				};
@@ -357,8 +366,11 @@
 					compression = "none";
 					load = <0x8F003000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
 					};
 				};

arch/arm/dts/k3-am642-phycore-som-binman.dtsi

@@ -363,8 +363,11 @@
 					compression = "none";
 					load = <0x8F000000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_rtc_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_rtc_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-rtc.dtbo";
 					};
 				};
@@ -375,8 +378,11 @@
 					compression = "none";
 					load = <0x8F001000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_spi_not_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_spi_not_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-spi-nor.dtbo";
 					};
 				};
@@ -387,8 +393,11 @@
 					compression = "none";
 					load = <0x8F002000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_eth_phy_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_eth_phy_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-disable-eth-phy.dtbo";
 					};
 				};
@@ -399,8 +408,11 @@
 					compression = "none";
 					load = <0x8F003000>;
 					arch = "arm";
-
+					ti-secure {
-					blob-ext {
+						content = <&am6xx_phycore_disable_qspi_nor_dtbo>;
+						keyfile = "custMpk.pem";
+					};
+					am6xx_phycore_disable_qspi_nor_dtbo: blob-ext {
 						filename = "dts/upstream/src/arm64/ti/k3-am6xx-phycore-qspi-nor.dtbo";
 					};
 				};

arch/arm/dts/rk3308-rock-s0-u-boot.dtsi

@@ -7,6 +7,14 @@
 	bootph-some-ram;
 };
 
+&gpio4 {
+	bootph-pre-ram;
+};
+
+&sdmmc_2030 {
+	bootph-pre-ram;
+};
+
 &uart0 {
 	bootph-all;
 	clock-frequency = <24000000>;
@@ -16,6 +24,10 @@
 	bootph-all;
 };
 
+&vcc_sd {
+	bootph-pre-ram;
+};
+
 &vdd_core {
 	regulator-init-microvolt = <1015000>;
 };

arch/arm/dts/rk3399-nanopi-r4s-u-boot.dtsi

@@ -36,3 +36,8 @@
 		};
 	};
 };
+
+&u2phy1_host {
+	phy-supply = <&vdd_5v>;
+	status = "okay";
+};

arch/arm/mach-imx/imx8m/Kconfig

@@ -92,6 +92,8 @@ config TARGET_IMX8MM_EVK
 	select FSL_CAAM
 	select ARCH_MISC_INIT
 	select SPL_CRYPTO if SPL
+	imply BOOTSTD_FULL
+	imply BOOTSTD_BOOTCOMMAND
 	imply OF_UPSTREAM
 
 config TARGET_IMX8MM_ICORE_MX8MM

arch/arm/mach-stm32mp/stm32mp1/cpu.c

@@ -82,7 +82,7 @@ void dram_bank_mmu_setup(int bank)
 		option = DCACHE_DEFAULT_OPTION;
 		if (use_lmb &&
 		    (lmb_is_reserved_flags(i << MMU_SECTION_SHIFT, LMB_NOMAP) ||
-		    addr >= gd->ram_top)
+		     (gd->ram_top && addr >= gd->ram_top))
 		   )
 			option = 0; /* INVALID ENTRY in TLB */
 		set_section_dcache(i, option);

arch/arm/mach-versal2/include/mach/hardware.h

@@ -51,7 +51,8 @@ struct crp_regs {
 #define PMC_TAP_VERSION		(PMC_TAP + 0x4)
 # define PMC_VERSION_MASK	GENMASK(7, 0)
 # define PS_VERSION_MASK	GENMASK(15, 8)
-# define PS_VERSION_PRODUCTION	0x20
+# define PS_VERSION_MAJOR	GENMASK(7, 4)
+# define PS_VERSION_MINOR	GENMASK(3, 0)
 # define RTL_VERSION_MASK	GENMASK(23, 16)
 # define PLATFORM_MASK		GENMASK(27, 24)
 # define PLATFORM_VERSION_MASK	GENMASK(31, 28)

arch/x86/cpu/intel_common/intel_opregion.c

@@ -31,6 +31,7 @@ static int locate_vbt(char **vbtp, int *sizep)
 	size = vbt.size;
 	if (size > sizeof(vbt_data))
 		return log_msg_ret("vbt", -E2BIG);
+	vbt.image_pos += CONFIG_ROM_SIZE;
 	ret = spi_flash_read_dm(dev, vbt.image_pos, size, vbt_data);
 	if (ret)
 		return log_msg_ret("read", ret);

arch/x86/lib/fsp2/fsp_init.c

@@ -107,7 +107,6 @@ int fsp_locate_fsp(enum fsp_type_t type, struct binman_entry *entry,
 		   bool use_spi_flash, struct udevice **devp,
 		   struct fsp_header **hdrp, ulong *rom_offsetp)
 {
-	ulong mask = CONFIG_ROM_SIZE - 1;
 	struct udevice *dev;
 	ulong rom_offset = 0;
 	uint map_size;
@@ -141,7 +140,7 @@ int fsp_locate_fsp(enum fsp_type_t type, struct binman_entry *entry,
 		if (ret)
 			return log_msg_ret("binman entry", ret);
 		if (!use_spi_flash)
-			rom_offset = (map_base & mask) - CONFIG_ROM_SIZE;
+			rom_offset = map_base + CONFIG_ROM_SIZE;
 	} else {
 		ret = -ENOENT;
 		if (false)

board/freescale/imx8mp_evk/imx8mp_evk.env

@@ -16,6 +16,7 @@ mmcroot=/dev/mmcblk1p2 rootwait rw
 mmcautodetect=yes
 mmcargs=setenv bootargs ${jh_clk} ${mcore_clk} console=${console} root=${mmcroot}
 prepare_mcore=setenv mcore_clk clk-imx8mp.mcore_booted
+kernel_addr_r=CONFIG_SYS_LOAD_ADDR
 loadimage=fatload mmc ${mmcdev}:${mmcpart} ${loadaddr} ${image}
 loadfdt=fatload mmc ${mmcdev}:${mmcpart} ${fdt_addr_r} ${fdtfile}
 mmcboot=echo Booting from mmc ...;

board/freescale/imx93_evk/imx93_evk.env

@@ -16,6 +16,7 @@ mmcroot=/dev/mmcblk1p2 rootwait rw
 mmcautodetect=yes
 mmcargs=setenv bootargs ${jh_clk} ${mcore_clk} console=${console} root=${mmcroot}
 prepare_mcore=setenv mcore_clk clk-imx93.mcore_booted
+kernel_addr_r=CONFIG_SYS_LOAD_ADDR
 loadimage=fatload mmc ${mmcdev}:${mmcpart} ${loadaddr} ${image}
 loadfdt=fatload mmc ${mmcdev}:${mmcpart} ${fdt_addr_r} ${fdtfile}
 loadcntr=fatload mmc ${mmcdev}:${mmcpart} ${cntr_addr} ${cntr_file}

board/freescale/ls1021atsn/ls1021atsn.c

@@ -166,10 +166,9 @@ void board_init_f(ulong dummy)
 
 	get_clocks();
 
-#if defined(CONFIG_DEEP_SLEEP)
+	if (CONFIG_IS_ENABLED(DEEP_SLEEP))
-	if (is_warm_boot())
+		if (is_warm_boot())
-		fsl_dp_disable_console();
+			fsl_dp_disable_console();
-#endif
 
 	preloader_console_init();
 
@@ -187,9 +186,11 @@ void board_init_f(ulong dummy)
 	 * it from SD since it has already been reserved in memory
 	 * in last boot.
 	 */
-	if (is_warm_boot()) {
+	if (CONFIG_IS_ENABLED(DEEP_SLEEP)) {
-		second_uboot = (void (*)(void))CONFIG_TEXT_BASE;
+		if (is_warm_boot()) {
-		second_uboot();
+			second_uboot = (void (*)(void))CONFIG_TEXT_BASE;
+			second_uboot();
+		}
 	}
 
 	board_init_r(NULL, 0);

board/freescale/ls1021atwr/ls1021atwr.c

@@ -417,10 +417,9 @@ void board_init_f(ulong dummy)
 
 	get_clocks();
 
-#if defined(CONFIG_DEEP_SLEEP)
+	if (CONFIG_IS_ENABLED(DEEP_SLEEP))
-	if (is_warm_boot())
+		if (is_warm_boot())
-		fsl_dp_disable_console();
+			fsl_dp_disable_console();
-#endif
 
 	preloader_console_init();
 
@@ -438,9 +437,11 @@ void board_init_f(ulong dummy)
 	 * it from SD since it has already been reserved in memeory
 	 * in last boot.
 	 */
-	if (is_warm_boot()) {
+	if (CONFIG_IS_ENABLED(DEEP_SLEEP)) {
-		second_uboot = (void (*)(void))CONFIG_TEXT_BASE;
+		if (is_warm_boot()) {
-		second_uboot();
+			second_uboot = (void (*)(void))CONFIG_TEXT_BASE;
+			second_uboot();
+		}
 	}
 
 	board_init_r(NULL, 0);

board/toradex/verdin-am62/verdin-am62.c

@@ -15,6 +15,7 @@
 #include <init.h>
 #include <k3-ddrss.h>
 #include <spl.h>
+#include <asm/arch/k3-ddr.h>
 
 #include "../common/tdx-cfg-block.h"
 
@@ -43,6 +44,9 @@ int dram_init_banksize(void)
 	if (ret)
 		printf("Error setting up memory banksize. %d\n", ret);
 
+	/* Use the detected RAM size, we only support 1 bank right now. */
+	gd->bd->bi_dram[0].size = gd->ram_size;
+
 	return ret;
 }
 
@@ -108,6 +112,13 @@ int board_late_init(void)
 #define CORE_VOLTAGE			0x80000000
 #define MCU_CTRL_LFXOSC_32K_BYPASS_VAL	BIT(4)
 
+#if IS_ENABLED(CONFIG_XPL_BUILD)
+void spl_perform_fixups(struct spl_image_info *spl_image)
+{
+	fixup_memory_node(spl_image);
+}
+#endif
+
 #ifdef CONFIG_SPL_BOARD_INIT
 void spl_board_init(void)
 {

board/xilinx/zynq/board.c

@@ -179,6 +179,7 @@ void set_dfu_alt_info(char *interface, char *devstr)
 	memset(buf, 0, sizeof(buf));
 
 	switch ((zynq_slcr_get_boot_mode()) & ZYNQ_BM_MASK) {
+#if defined(CONFIG_SPL_FS_LOAD_PAYLOAD_NAME)
 	case ZYNQ_BM_SD:
 		snprintf(buf, DFU_ALT_BUF_LEN,
 			 "mmc 0=boot.bin fat 0 1;"
@@ -192,6 +193,7 @@ void set_dfu_alt_info(char *interface, char *devstr)
 			 CONFIG_SPL_FS_LOAD_PAYLOAD_NAME,
 			 CONFIG_SYS_SPI_U_BOOT_OFFS);
 		break;
+#endif
 #endif
 	default:
 		return;

cmd/Kconfig

@@ -2169,7 +2169,6 @@ config WGET_HTTPS
 	select ASYMMETRIC_PUBLIC_KEY_SUBTYPE
 	select X509_CERTIFICATE_PARSER
 	select PKCS7_MESSAGE_PARSER
-	select MBEDTLS_LIB_CRYPTO
 	select MBEDTLS_LIB_TLS
 	select RSA_VERIFY_WITH_PKEY
 	select X509_CERTIFICATE_PARSER

cmd/ufetch.c

@@ -24,8 +24,8 @@
 DECLARE_GLOBAL_DATA_PTR;
 
 #define LINE_WIDTH 40
-#define BLUE "\033[38;5;4m"
+#define BLUE "\033[34m"
-#define YELLOW "\033[38;5;11m"
+#define YELLOW "\033[33m"
 #define BOLD "\033[1m"
 #define RESET "\033[0m"
 static const char * const logo_lines[] = {

common/board_f.c

@@ -828,13 +828,13 @@ static int initf_dm(void)
 
 	bootstage_start(BOOTSTAGE_ID_ACCUM_DM_F, "dm_f");
 	ret = dm_init_and_scan(true);
-	bootstage_accum(BOOTSTAGE_ID_ACCUM_DM_F);
 	if (ret)
 		return ret;
 
 	ret = dm_autoprobe();
 	if (ret)
 		return ret;
+	bootstage_accum(BOOTSTAGE_ID_ACCUM_DM_F);
 
 	if (IS_ENABLED(CONFIG_TIMER_EARLY)) {
 		ret = dm_timer_init();

common/miiphyutil.c

@@ -30,7 +30,7 @@
 #define debug(fmt, args...)
 #endif /* MII_DEBUG */
 
-static struct list_head mii_devs;
+static LIST_HEAD(mii_devs);
 static struct mii_dev *current_mii;
 
 /*
@@ -55,16 +55,6 @@ struct mii_dev *miiphy_get_dev_by_name(const char *devname)
 	return NULL;
 }
 
-/*****************************************************************************
- *
- * Initialize global data. Need to be called before any other miiphy routine.
- */
-void miiphy_init(void)
-{
-	INIT_LIST_HEAD(&mii_devs);
-	current_mii = NULL;
-}
-
 void mdio_init(struct mii_dev *bus)
 {
 	memset(bus, 0, sizeof(*bus));

configs/amd_versal2_virt_defconfig

@@ -70,7 +70,6 @@ CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_NET_LWIP=y
 CONFIG_NET_RANDOM_ETHADDR=y
-CONFIG_TFTP_BLOCKSIZE=4096
 CONFIG_SIMPLE_PM_BUS=y
 CONFIG_CLK_CCF=y
 CONFIG_CLK_SCMI=y

configs/imx8mm_evk_defconfig

@@ -25,7 +25,8 @@ CONFIG_FIT=y
 CONFIG_FIT_EXTERNAL_OFFSET=0x3000
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_OF_SYSTEM_SETUP=y
-CONFIG_DEFAULT_FDT_FILE="imx8mp-evk.dtb"
+CONFIG_BOOTCOMMAND="bootflow scan -lb; run bsp_bootcmd"
+CONFIG_DEFAULT_FDT_FILE="imx8mm-evk.dtb"
 CONFIG_SYS_CBSIZE=2048
 CONFIG_SYS_PBSIZE=2074
 CONFIG_BOARD_LATE_INIT=y

configs/imx8mm_evk_fspi_defconfig

@@ -5,7 +5,6 @@ CONFIG_SYS_MALLOC_LEN=0x2000000
 CONFIG_SPL_GPIO=y
 CONFIG_SPL_LIBCOMMON_SUPPORT=y
 CONFIG_SPL_LIBGENERIC_SUPPORT=y
-CONFIG_ENV_SOURCE_FILE="imx8mn_evk"
 CONFIG_SF_DEFAULT_SPEED=40000000
 CONFIG_SF_DEFAULT_MODE=0
 CONFIG_ENV_SIZE=0x1000
@@ -29,7 +28,8 @@ CONFIG_FIT=y
 CONFIG_FIT_EXTERNAL_OFFSET=0x3000
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_OF_SYSTEM_SETUP=y
-CONFIG_DEFAULT_FDT_FILE="imx8mp-evk.dtb"
+CONFIG_BOOTCOMMAND="bootflow scan -lb; run bsp_bootcmd"
+CONFIG_DEFAULT_FDT_FILE="imx8mm-evk.dtb"
 CONFIG_SYS_CBSIZE=2048
 CONFIG_SYS_PBSIZE=2074
 CONFIG_BOARD_LATE_INIT=y

configs/imx8mq_evk_defconfig

@@ -32,7 +32,7 @@ CONFIG_FIT_EXTERNAL_OFFSET=0x3000
 CONFIG_SPL_LOAD_FIT=y
 CONFIG_OF_SYSTEM_SETUP=y
 CONFIG_BOOTCOMMAND="bootflow scan -lb; run bsp_bootcmd"
-CONFIG_DEFAULT_FDT_FILE="imx8mp-evk.dtb"
+CONFIG_DEFAULT_FDT_FILE="imx8mq-evk.dtb"
 CONFIG_SYS_PBSIZE=1050
 CONFIG_BOARD_EARLY_INIT_F=y
 CONFIG_BOARD_LATE_INIT=y

configs/nanopi-r3s-rk3566_defconfig

@@ -54,7 +54,6 @@ CONFIG_PHY_REALTEK=y
 CONFIG_DWC_ETH_QOS=y
 CONFIG_DWC_ETH_QOS_ROCKCHIP=y
 CONFIG_RTL8169=y
-CONFIG_NVME_PCI=y
 CONFIG_PCIE_DW_ROCKCHIP=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_NANENG_COMBOPHY=y

configs/qcom_defconfig

@@ -45,6 +45,7 @@ CONFIG_USE_DEFAULT_ENV_FILE=y
 CONFIG_DEFAULT_ENV_FILE="board/qualcomm/default.env"
 CONFIG_BUTTON_QCOM_PMIC=y
 CONFIG_CLK=y
+CONFIG_CLK_STUB=y
 CONFIG_CLK_QCOM_APQ8016=y
 CONFIG_CLK_QCOM_APQ8096=y
 CONFIG_CLK_QCOM_QCM2290=y

configs/rock-s0-rk3308_defconfig

@@ -2,6 +2,7 @@ CONFIG_ARM=y
 CONFIG_SKIP_LOWLEVEL_INIT=y
 CONFIG_COUNTER_FREQUENCY=24000000
 CONFIG_ARCH_ROCKCHIP=y
+CONFIG_SPL_GPIO=y
 CONFIG_DEFAULT_DEVICE_TREE="rockchip/rk3308-rock-s0"
 CONFIG_DM_RESET=y
 CONFIG_ROCKCHIP_RK3308=y
@@ -53,6 +54,7 @@ CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PINCTRL=y
 CONFIG_REGULATOR_PWM=y
 CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_SPL_DM_REGULATOR_FIXED=y
 CONFIG_PWM_ROCKCHIP=y
 CONFIG_RAM=y
 CONFIG_BAUDRATE=1500000

configs/sandbox_defconfig

@@ -354,7 +354,6 @@ CONFIG_ADDR_MAP=y
 CONFIG_PANIC_HANG=y
 CONFIG_CMD_DHRYSTONE=y
 CONFIG_MBEDTLS_LIB=y
-CONFIG_MBEDTLS_LIB_CRYPTO=y
 CONFIG_HKDF_MBEDTLS=y
 CONFIG_ECDSA=y
 CONFIG_ECDSA_VERIFY=y

configs/sandbox_vpl_defconfig

@@ -252,8 +252,6 @@ CONFIG_FS_CBFS=y
 CONFIG_FS_CRAMFS=y
 # CONFIG_SPL_USE_TINY_PRINTF is not set
 CONFIG_CMD_DHRYSTONE=y
-CONFIG_VPL_SHA1_LEGACY=y
-CONFIG_VPL_SHA256_LEGACY=y
 CONFIG_RSA_VERIFY_WITH_PKEY=y
 CONFIG_TPM=y
 CONFIG_ZSTD=y

configs/snow_defconfig

@@ -34,6 +34,8 @@ CONFIG_SYS_PBSIZE=1024
 CONFIG_SILENT_CONSOLE=y
 CONFIG_BLOBLIST=y
 # CONFIG_SPL_BLOBLIST is not set
+CONFIG_BLOBLIST_FIXED=y
+CONFIG_BLOBLIST_ADDR=0x43d00000
 # CONFIG_SPL_FRAMEWORK is not set
 CONFIG_SPL_FOOTPRINT_LIMIT=y
 CONFIG_SPL_MAX_FOOTPRINT=0x3800

configs/xilinx_versal_net_virt_defconfig

@@ -70,7 +70,6 @@ CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_NET_LWIP=y
 CONFIG_NET_RANDOM_ETHADDR=y
-CONFIG_TFTP_BLOCKSIZE=4096
 CONFIG_SIMPLE_PM_BUS=y
 CONFIG_CLK_VERSAL=y
 CONFIG_DFU_RAM=y

configs/xilinx_versal_virt_defconfig

@@ -74,7 +74,6 @@ CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
 CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 CONFIG_NET_LWIP=y
 CONFIG_NET_RANDOM_ETHADDR=y
-CONFIG_TFTP_BLOCKSIZE=4096
 CONFIG_SIMPLE_PM_BUS=y
 CONFIG_CLK_VERSAL=y
 CONFIG_DFU_TIMEOUT=y

doc/develop/release_cycle.rst

@@ -74,7 +74,7 @@ For the next scheduled release, release candidates were made on::
 
 * U-Boot v2025.04-rc3 was released on Mon 24 February 2025.
 
-.. * U-Boot v2025.04-rc4 was released on Mon 10 March 2025.
+* U-Boot v2025.04-rc4 was released on Mon 10 March 2025.
 
 .. * U-Boot v2025.04-rc5 was released on Mon 24 March 2025.
 

drivers/clk/Kconfig

@@ -96,6 +96,13 @@ config SPL_CLK_GPIO
 	  Enable this option to add GPIO-controlled clock gate driver
 	  in U-Boot SPL.
 
+config CLK_STUB
+	bool "Stub clock driver"
+	depends on CLK
+	help
+	  Enable this to provide a stub clock driver for non-essential clock
+	  controllers.
+
 config CLK_BCM6345
 	bool "Clock controller driver for BCM6345"
 	depends on CLK && ARCH_BMIPS

drivers/clk/Makefile

@@ -11,6 +11,7 @@ obj-$(CONFIG_$(PHASE_)CLK_CCF) += clk.o clk-divider.o clk-mux.o clk-gate.o
 obj-$(CONFIG_$(PHASE_)CLK_CCF) += clk-fixed-factor.o
 obj-$(CONFIG_$(PHASE_)CLK_COMPOSITE_CCF) += clk-composite.o
 obj-$(CONFIG_$(PHASE_)CLK_GPIO) += clk-gpio.o
+obj-$(CONFIG_$(PHASE_)CLK_STUB) += clk-stub.o
 
 obj-y += adi/
 obj-y += analogbits/

drivers/clk/clk-stub.c

@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Stub clk driver for non-essential clocks.
+ *
+ * This driver should be used for clock controllers
+ * which are described as dependencies in DT but aren't
+ * actually necessary for hardware functionality.
+ */
+
+#include <clk-uclass.h>
+#include <dm.h>
+
+/* NOP parent nodes to stub clocks */
+static const struct udevice_id nop_parent_ids[] = {
+	{ .compatible = "qcom,rpm-proc" },
+	{ .compatible = "qcom,glink-rpm" },
+	{ .compatible = "qcom,rpm-sm6115" },
+	{ }
+};
+
+U_BOOT_DRIVER(nop_parent) = {
+	.name = "nop_parent",
+	.id = UCLASS_NOP,
+	.of_match = nop_parent_ids,
+	.bind = dm_scan_fdt_dev,
+	.flags = DM_FLAG_DEFAULT_PD_CTRL_OFF,
+};
+
+static ulong stub_clk_set_rate(struct clk *clk, ulong rate)
+{
+	return (clk->rate = rate);
+}
+
+static ulong stub_clk_get_rate(struct clk *clk)
+{
+	return clk->rate;
+}
+
+static int stub_clk_nop(struct clk *clk)
+{
+	return 0;
+}
+
+static struct clk_ops stub_clk_ops = {
+	.set_rate = stub_clk_set_rate,
+	.get_rate = stub_clk_get_rate,
+	.enable = stub_clk_nop,
+	.disable = stub_clk_nop,
+};
+
+static const struct udevice_id stub_clk_ids[] = {
+	{ .compatible = "qcom,rpmcc" },
+	{ .compatible = "qcom,sm8150-rpmh-clk" },
+	{ .compatible = "qcom,sm8250-rpmh-clk" },
+	{ .compatible = "qcom,sm8550-rpmh-clk" },
+	{ .compatible = "qcom,sm8650-rpmh-clk" },
+	{ }
+};
+
+U_BOOT_DRIVER(clk_stub) = {
+	.name = "clk_stub",
+	.id = UCLASS_CLK,
+	.ops = &stub_clk_ops,
+	.of_match = stub_clk_ids,
+	.flags = DM_FLAG_DEFAULT_PD_CTRL_OFF,
+};
+

drivers/clk/clk_versal.c

@@ -106,8 +106,8 @@ struct versal_clk_priv {
 	struct versal_clock *clk;
 };
 
-static ulong pl_alt_ref_clk;
+static ulong pl_alt_ref_clk __section(".data");
-static ulong ref_clk;
+static ulong ref_clk __section(".data");
 
 struct versal_pm_query_data {
 	u32 qid;
@@ -116,8 +116,8 @@ struct versal_pm_query_data {
 	u32 arg3;
 };
 
-static struct versal_clock *clock;
+static struct versal_clock *clock __section(".data");
-static unsigned int clock_max_idx;
+static unsigned int clock_max_idx __section(".data");
 
 #define PM_QUERY_DATA	35
 
@@ -679,12 +679,21 @@ static int versal_clk_probe(struct udevice *dev)
 
 	debug("%s\n", __func__);
 
-	ret = versal_clock_get_freq_by_name("pl_alt_ref_clk",
+	ret = versal_clock_get_freq_by_name("pl_alt_ref",
 					    dev, &pl_alt_ref_clk);
+	if (ret == -ENODATA) {
+		/* Fallback to old DT binding clk name "pl_alt_ref_clk"	*/
+		ret = versal_clock_get_freq_by_name("pl_alt_ref_clk",
+						    dev, &pl_alt_ref_clk);
+	}
 	if (ret < 0)
 		return -EINVAL;
 
-	ret = versal_clock_get_freq_by_name("ref_clk", dev, &ref_clk);
+	ret = versal_clock_get_freq_by_name("ref", dev, &ref_clk);
+	if (ret == -ENODATA) {
+		/* Fallback to old DT binding clk name "ref_clk" */
+		ret = versal_clock_get_freq_by_name("ref_clk", dev, &ref_clk);
+	}
 	if (ret < 0)
 		return -EINVAL;
 

drivers/clk/rockchip/clk_rk3568.c

@@ -2680,7 +2680,7 @@ static ulong rk3568_clk_set_rate(struct clk *clk, ulong rate)
 	return ret;
 };
 
-#if (IS_ENABLED(OF_CONTROL)) || (!IS_ENABLED(OF_PLATDATA))
+#if (CONFIG_IS_ENABLED(OF_CONTROL)) || (!CONFIG_IS_ENABLED(OF_PLATDATA))
 static int rk3568_gmac0_src_set_parent(struct clk *clk, struct clk *parent)
 {
 	struct rk3568_clk_priv *priv = dev_get_priv(clk->dev);
@@ -2859,7 +2859,7 @@ static int rk3568_clk_set_parent(struct clk *clk, struct clk *parent)
 static struct clk_ops rk3568_clk_ops = {
 	.get_rate = rk3568_clk_get_rate,
 	.set_rate = rk3568_clk_set_rate,
-#if (IS_ENABLED(OF_CONTROL)) || (!IS_ENABLED(OF_PLATDATA))
+#if (CONFIG_IS_ENABLED(OF_CONTROL)) || (!CONFIG_IS_ENABLED(OF_PLATDATA))
 	.set_parent = rk3568_clk_set_parent,
 #endif
 };

drivers/clk/rockchip/clk_rk3588.c

@@ -1822,7 +1822,7 @@ static ulong rk3588_clk_set_rate(struct clk *clk, ulong rate)
  */
 #define ROCKCHIP_MMC_DELAY_ELEMENT_PSEC 60
 
-#if (IS_ENABLED(OF_CONTROL)) || (!IS_ENABLED(OF_PLATDATA))
+#if (CONFIG_IS_ENABLED(OF_CONTROL)) || (!CONFIG_IS_ENABLED(OF_PLATDATA))
 static int __maybe_unused rk3588_dclk_vop_set_parent(struct clk *clk,
 						     struct clk *parent)
 {
@@ -1915,7 +1915,7 @@ static int rk3588_clk_set_parent(struct clk *clk, struct clk *parent)
 static struct clk_ops rk3588_clk_ops = {
 	.get_rate = rk3588_clk_get_rate,
 	.set_rate = rk3588_clk_set_rate,
-#if (IS_ENABLED(OF_CONTROL)) || (!IS_ENABLED(OF_PLATDATA))
+#if (CONFIG_IS_ENABLED(OF_CONTROL)) || (!CONFIG_IS_ENABLED(OF_PLATDATA))
 	.set_parent = rk3588_clk_set_parent,
 #endif
 };

drivers/core/root.c

@@ -295,22 +295,29 @@ void *dm_priv_to_rw(void *priv)
  * all its children recursively to do the same.
  *
  * @dev: Device to (maybe) probe
+ * @pre_reloc_only: Probe only devices marked with the DM_FLAG_PRE_RELOC flag
  * Return 0 if OK, -ve on error
  */
-static int dm_probe_devices(struct udevice *dev)
+static int dm_probe_devices(struct udevice *dev, bool pre_reloc_only)
 {
+	ofnode node = dev_ofnode(dev);
 	struct udevice *child;
+	int ret;
+
+	if (pre_reloc_only &&
+	    (!ofnode_valid(node) || !ofnode_pre_reloc(node)) &&
+	    !(dev->driver->flags & DM_FLAG_PRE_RELOC))
+		goto probe_children;
 
 	if (dev_get_flags(dev) & DM_FLAG_PROBE_AFTER_BIND) {
-		int ret;
-
 		ret = device_probe(dev);
 		if (ret)
 			return ret;
 	}
 
+probe_children:
 	list_for_each_entry(child, &dev->child_head, sibling_node)
-		dm_probe_devices(child);
+		dm_probe_devices(child, pre_reloc_only);
 
 	return 0;
 }
@@ -319,7 +326,7 @@ int dm_autoprobe(void)
 {
 	int ret;
 
-	ret = dm_probe_devices(gd->dm_root);
+	ret = dm_probe_devices(gd->dm_root, !(gd->flags & GD_FLG_RELOC));
 	if (ret)
 		return log_msg_ret("pro", ret);
 

drivers/crypto/fsl/fsl_hash.c

@@ -183,6 +183,7 @@ int caam_hash(const unsigned char *pbuf, unsigned int buf_len,
 {
 	int ret = 0;
 	uint32_t *desc;
+	unsigned long pbuf_aligned;
 	unsigned int size;
 
 	desc = malloc_cache_aligned(sizeof(int) * MAX_CAAM_DESCSIZE);
@@ -191,8 +192,9 @@ int caam_hash(const unsigned char *pbuf, unsigned int buf_len,
 		return -ENOMEM;
 	}
 
-	size = ALIGN(buf_len, ARCH_DMA_MINALIGN);
+	pbuf_aligned = ALIGN_DOWN((unsigned long)pbuf, ARCH_DMA_MINALIGN);
-	flush_dcache_range((unsigned long)pbuf, (unsigned long)pbuf + size);
+	size = ALIGN(buf_len + ((unsigned long)pbuf - pbuf_aligned), ARCH_DMA_MINALIGN);
+	flush_dcache_range(pbuf_aligned, pbuf_aligned + size);
 
 	inline_cnstr_jobdesc_hash(desc, pbuf, buf_len, pout,
 				  driver_hash[algo].alg_type,

drivers/gpio/Kconfig

@@ -516,7 +516,7 @@ config ZYNQ_GPIO
 
 config DM_74X164
 	bool "74x164 serial-in/parallel-out 8-bits shift register"
-	depends on DM_GPIO
+	depends on DM_GPIO && DM_SPI
 	help
 	  Driver for 74x164 compatible serial-in/parallel-out 8-outputs
 	  shift registers, such as 74lv165, 74hc595.

drivers/led/led-uclass.c

@@ -273,8 +273,12 @@ static const char *led_get_function_name(struct udevice *dev)
 	/* Now try to detect function label name */
 	func = dev_read_string(dev, "function");
 	cp = dev_read_u32(dev, "color", &color);
-	// prevent coverity scan error CID 541279: (TAINTED_SCALAR)
+	/*
-	if (color < LED_COLOR_ID_WHITE || color >= LED_COLOR_ID_MAX)
+	 *  prevent coverity scan error CID 541279: (TAINTED_SCALAR)
+	 *  only check the upper bound. No need to check the lower bound
+	 *  as color is from type u32 and never can be lower than 0.
+	 */
+	if (color >= LED_COLOR_ID_MAX)
 		cp = -EINVAL;
 
 	if (cp == 0 || func) {

drivers/net/tsec.c

@@ -278,6 +278,24 @@ static int tsec_send(struct udevice *dev, void *packet, int length)
 	return result;
 }
 
+static int tsec_free_pkt(struct udevice *dev, uchar *packet, int length)
+{
+	struct tsec_private *priv = (struct tsec_private *)dev_get_priv(dev);
+	u16 status;
+
+	out_be16(&priv->rxbd[priv->rx_idx].length, 0);
+
+	status = RXBD_EMPTY;
+	/* Set the wrap bit if this is the last element in the list */
+	if ((priv->rx_idx + 1) == PKTBUFSRX)
+		status |= RXBD_WRAP;
+	out_be16(&priv->rxbd[priv->rx_idx].status, status);
+
+	priv->rx_idx = (priv->rx_idx + 1) % PKTBUFSRX;
+
+	return 0;
+}
+
 static int tsec_recv(struct udevice *dev, int flags, uchar **packetp)
 {
 	struct tsec_private *priv = (struct tsec_private *)dev_get_priv(dev);
@@ -296,6 +314,9 @@ static int tsec_recv(struct udevice *dev, int flags, uchar **packetp)
 			ret = length - 4;
 		} else {
 			printf("Got error %x\n", (status & RXBD_STATS));
+
+			/* Rearm the packet buffer */
+			tsec_free_pkt(dev, NULL, 0);
 		}
 	}
 
@@ -307,24 +328,6 @@ static int tsec_recv(struct udevice *dev, int flags, uchar **packetp)
 	return ret;
 }
 
-static int tsec_free_pkt(struct udevice *dev, uchar *packet, int length)
-{
-	struct tsec_private *priv = (struct tsec_private *)dev_get_priv(dev);
-	u16 status;
-
-	out_be16(&priv->rxbd[priv->rx_idx].length, 0);
-
-	status = RXBD_EMPTY;
-	/* Set the wrap bit if this is the last element in the list */
-	if ((priv->rx_idx + 1) == PKTBUFSRX)
-		status |= RXBD_WRAP;
-	out_be16(&priv->rxbd[priv->rx_idx].status, status);
-
-	priv->rx_idx = (priv->rx_idx + 1) % PKTBUFSRX;
-
-	return 0;
-}
-
 static void tsec_halt(struct udevice *dev)
 {
 	struct tsec_private *priv;

drivers/pinctrl/qcom/pinctrl-sm8250.c

@@ -107,7 +107,7 @@ static unsigned int sm8250_get_function_mux(__maybe_unused unsigned int pin, uns
 static struct msm_pinctrl_data sm8250_data = {
 	.pin_data = {
 		.pin_offsets = sm8250_pin_offsets,
-		.pin_count = ARRAY_SIZE(sm8250_pin_offsets),
+		.pin_count = 184,
 		.special_pins_start = 180,
 		.special_pins_data = sm8250_special_pins_data,
 	},

drivers/power/regulator/qcom-rpmh-regulator.c

@@ -481,6 +481,13 @@ static const struct rpmh_vreg_init_data pm8150_vreg_data[] = {
 
 static const struct rpmh_vreg_init_data pm8150l_vreg_data[] = {
 	RPMH_VREG("ldo1",   "ldo%s1",  &pmic5_pldo_lv,   "vdd-l1-l8"),
+	RPMH_VREG("ldo4",   "ldo%s4",  &pmic5_pldo,      "vdd-l4-l5-l6"),
+	RPMH_VREG("ldo5",   "ldo%s5",  &pmic5_pldo,      "vdd-l4-l5-l6"),
+	RPMH_VREG("ldo6",   "ldo%s6",  &pmic5_pldo,      "vdd-l4-l5-l6"),
+	RPMH_VREG("ldo7",   "ldo%s7",  &pmic5_pldo,      "vdd-l7-l11"),
+	RPMH_VREG("ldo8",   "ldo%s8",  &pmic5_pldo_lv,   "vdd-l1-l8"),
+	RPMH_VREG("ldo9",   "ldo%s9",  &pmic5_pldo,      "vdd-l9-l10"),
+	RPMH_VREG("ldo10",  "ldo%s10", &pmic5_pldo,      "vdd-l9-l10"),
 	RPMH_VREG("ldo11",  "ldo%s11", &pmic5_pldo,      "vdd-l7-l11"),
 	{}
 };

drivers/soc/soc_amd_versal2.c

@@ -35,7 +35,9 @@ static int soc_amd_versal2_get_revision(struct udevice *dev, char *buf, int size
 {
 	struct soc_amd_versal2_priv *priv = dev_get_priv(dev);
 
-	return snprintf(buf, size, "v%d", priv->revision);
+	return snprintf(buf, size, "v%d.%d",
+			(u32)FIELD_GET(PS_VERSION_MAJOR, priv->revision),
+			(u32)FIELD_GET(PS_VERSION_MINOR, priv->revision));
 }
 
 static const struct soc_ops soc_amd_versal2_ops = {

fs/squashfs/sqfs.c

@@ -1712,7 +1712,8 @@ static int sqfs_size_nest(const char *filename, loff_t *size)
 	case SQFS_LSYMLINK_TYPE:
 		if (++symlinknest == MAX_SYMLINK_NEST) {
 			*size = 0;
-			return -ELOOP;
+			ret = -ELOOP;
+			break;
 		}
 
 		symlink = (struct squashfs_symlink_inode *)ipos;

include/crypto/mscode.h

@@ -10,6 +10,7 @@
 #include <crypto/hash_info.h>
 #endif
 #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+#include "mbedtls_options.h"
 #include <mbedtls/asn1.h>
 #include <mbedtls/oid.h>
 #endif

include/crypto/pkcs7_parser.h

@@ -12,6 +12,7 @@
 #include <crypto/pkcs7.h>
 #include <crypto/x509_parser.h>
 #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+#include "mbedtls_options.h"
 #include <mbedtls/pkcs7.h>
 #include <library/x509_internal.h>
 #include <mbedtls/asn1.h>

include/mcheck.h

@@ -1,18 +1,7 @@
-/* SPDX-License-Identifier: GPL-2.1+ */
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
 /*
  * Copyright (C) 1996-2024 Free Software Foundation, Inc.
  * This file is part of the GNU C Library.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- * <https://www.gnu.org/licenses/>.
  */
 #ifndef _MCHECK_H
 #define _MCHECK_H       1

include/miiphy.h

@@ -33,8 +33,6 @@ int miiphy_is_1000base_x(const char *devname, unsigned char addr);
 int miiphy_link(const char *devname, unsigned char addr);
 #endif
 
-void miiphy_init(void);
-
 int miiphy_set_current_dev(const char *devname);
 const char *miiphy_get_current_dev(void);
 struct mii_dev *mdio_get_current_dev(void);

include/u-boot/sha1.h

@@ -18,17 +18,7 @@
 #include <linux/types.h>
 
 #if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
-/*
+#include "mbedtls_options.h"
- * FIXME:
- * MbedTLS define the members of "mbedtls_sha256_context" as private,
- * but "state" needs to be access by arch/arm/cpu/armv8/sha1_ce_glue.
- * MBEDTLS_ALLOW_PRIVATE_ACCESS needs to be enabled to allow the external
- * access.
- * Directly including <external/mbedtls/library/common.h> is not allowed,
- * since this will include <malloc.h> and break the sandbox test.
- */
-#define MBEDTLS_ALLOW_PRIVATE_ACCESS
-
 #include <mbedtls/sha1.h>
 #endif
 

include/u-boot/sha256.h

@@ -7,17 +7,7 @@
 #include <linux/types.h>
 
 #if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
-/*
+#include "mbedtls_options.h"
- * FIXME:
- * MbedTLS define the members of "mbedtls_sha256_context" as private,
- * but "state" needs to be access by arch/arm/cpu/armv8/sha256_ce_glue.
- * MBEDTLS_ALLOW_PRIVATE_ACCESS needs to be enabled to allow the external
- * access.
- * Directly including <external/mbedtls/library/common.h> is not allowed,
- * since this will include <malloc.h> and break the sandbox test.
- */
-#define MBEDTLS_ALLOW_PRIVATE_ACCESS
-
 #include <mbedtls/sha256.h>
 #endif
 

lib/mbedtls/Kconfig

@@ -1,57 +1,54 @@
+# For U-Boot Proper
+
 choice
-	prompt "Select crypto libraries"
+	prompt "Crypto libraries (U-Boot Proper)"
-	default LEGACY_CRYPTO
+	default LEGACY_HASHING_AND_CRYPTO
 	help
 	  Select crypto libraries.
-	  LEGACY_CRYPTO for legacy crypto libraries,
+	  LEGACY_HASHING_AND_CRYPTO for legacy crypto libraries,
 	  MBEDTLS_LIB for MbedTLS libraries.
 
-config LEGACY_CRYPTO
+config LEGACY_HASHING_AND_CRYPTO
 	bool "legacy crypto libraries"
-	select LEGACY_CRYPTO_BASIC
+	select LEGACY_HASHING
-	select LEGACY_CRYPTO_CERT
+	select LEGACY_CRYPTO
 
 config MBEDTLS_LIB
 	bool "MbedTLS libraries"
 	select MBEDTLS_LIB_X509
 endchoice
 
-if LEGACY_CRYPTO || MBEDTLS_LIB_CRYPTO_ALT
+if LEGACY_HASHING_AND_CRYPTO || MBEDTLS_LIB_HASHING_ALT
 
-config LEGACY_CRYPTO_BASIC
+config LEGACY_HASHING
-	bool "legacy basic crypto libraries"
+	bool "Use U-Boot legacy hashing libraries"
 	select MD5_LEGACY if MD5
 	select SHA1_LEGACY if SHA1
 	select SHA256_LEGACY if SHA256
 	select SHA512_LEGACY if SHA512
 	select SHA384_LEGACY if SHA384
-	select SPL_MD5_LEGACY if SPL_MD5
-	select SPL_SHA1_LEGACY if SPL_SHA1
-	select SPL_SHA256_LEGACY if SPL_SHA256
-	select SPL_SHA512_LEGACY if SPL_SHA512
-	select SPL_SHA384_LEGACY if SPL_SHA384
 	help
-	  Enable legacy basic crypto libraries.
+	  Enable U-Boot legacy hashing libraries.
 
-if LEGACY_CRYPTO_BASIC
+if LEGACY_HASHING
 
 config SHA1_LEGACY
 	bool "Enable SHA1 support with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SHA1
+	depends on LEGACY_HASHING && SHA1
 	help
 	  This option enables support of hashing using SHA1 algorithm
 	  with legacy crypto library.
 
 config SHA256_LEGACY
 	bool "Enable SHA256 support with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SHA256
+	depends on LEGACY_HASHING && SHA256
 	help
 	  This option enables support of hashing using SHA256 algorithm
 	  with legacy crypto library.
 
 config SHA512_LEGACY
 	bool "Enable SHA512 support with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SHA512
+	depends on LEGACY_HASHING && SHA512
 	default y if TI_SECURE_DEVICE && FIT_SIGNATURE
 	help
 	  This option enables support of hashing using SHA512 algorithm
@@ -59,7 +56,7 @@ config SHA512_LEGACY
 
 config SHA384_LEGACY
 	bool "Enable SHA384 support with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SHA384
+	depends on LEGACY_HASHING && SHA384
 	select SHA512_LEGACY
 	help
 	  This option enables support of hashing using SHA384 algorithm
@@ -67,95 +64,16 @@ config SHA384_LEGACY
 
 config MD5_LEGACY
 	bool "Enable MD5 support with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && MD5
+	depends on LEGACY_HASHING && MD5
 	help
 	  This option enables support of hashing using MD5 algorithm
 	  with legacy crypto library.
 
-if SPL
+endif # LEGACY_HASHING
 
-config SPL_SHA1_LEGACY
+config LEGACY_CRYPTO
-	bool "Enable SHA1 support in SPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SPL_SHA1
-	help
-	  This option enables support of hashing using SHA1 algorithm
-	  with legacy crypto library.
-
-config SPL_SHA256_LEGACY
-	bool "Enable SHA256 support in SPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SPL_SHA256
-	help
-	  This option enables support of hashing using SHA256 algorithm
-	  with legacy crypto library.
-
-config SPL_SHA512_LEGACY
-	bool "Enable SHA512 support in SPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SPL_SHA512
-	help
-	  This option enables support of hashing using SHA512 algorithm
-	  with legacy crypto library.
-
-config SPL_SHA384_LEGACY
-	bool "Enable SHA384 support in SPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SPL_SHA384
-	select SPL_SHA512_LEGACY
-	help
-	  This option enables support of hashing using SHA384 algorithm
-	  with legacy crypto library.
-
-config SPL_MD5_LEGACY
-	bool "Enable MD5 support in SPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && SPL_MD5
-	help
-	  This option enables support of hashing using MD5 algorithm
-	  with legacy crypto library.
-
-endif # SPL
-
-if VPL
-
-config VPL_SHA1_LEGACY
-	bool "Enable SHA1 support in VPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && VPL_SHA1
-	help
-	  This option enables support of hashing using SHA1 algorithm
-	  with legacy crypto library.
-
-config VPL_SHA256_LEGACY
-	bool "Enable SHA256 support in VPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && VPL_SHA256
-	help
-	  This option enables support of hashing using SHA256 algorithm
-	  with legacy crypto library.
-
-config VPL_SHA512_LEGACY
-	bool "Enable SHA512 support in VPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && VPL_SHA512
-	help
-	  This option enables support of hashing using SHA512 algorithm
-	  with legacy crypto library.
-
-config VPL_SHA384_LEGACY
-	bool "Enable SHA384 support in VPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && VPL_SHA384
-	select VPL_SHA512_LEGACY
-	help
-	  This option enables support of hashing using SHA384 algorithm
-	  with legacy crypto library.
-
-config VPL_MD5_LEGACY
-	bool "Enable MD5 support in VPL with legacy crypto library"
-	depends on LEGACY_CRYPTO_BASIC && VPL_MD5
-	help
-	  This option enables support of hashing using MD5 algorithm
-	  with legacy crypto library.
-
-endif # VPL
-
-endif # LEGACY_CRYPTO_BASIC
-
-config LEGACY_CRYPTO_CERT
 	bool "legacy certificate libraries"
+	depends on LEGACY_HASHING_AND_CRYPTO
 	select ASN1_DECODER_LEGACY if ASN1_DECODER
 	select ASYMMETRIC_PUBLIC_KEY_LEGACY if \
 		ASYMMETRIC_PUBLIC_KEY_SUBTYPE
@@ -163,24 +81,20 @@ config LEGACY_CRYPTO_CERT
 	select X509_CERTIFICATE_PARSER_LEGACY if X509_CERTIFICATE_PARSER
 	select PKCS7_MESSAGE_PARSER_LEGACY if PKCS7_MESSAGE_PARSER
 	select MSCODE_PARSER_LEGACY if MSCODE_PARSER
-	select SPL_ASN1_DECODER_LEGACY if SPL_ASN1_DECODER
-	select SPL_ASYMMETRIC_PUBLIC_KEY_LEGACY if \
-		SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
-	select SPL_RSA_PUBLIC_KEY_PARSER_LEGACY if SPL_RSA_PUBLIC_KEY_PARSER
 	help
 	  Enable legacy certificate libraries.
 
-if LEGACY_CRYPTO_CERT
+if LEGACY_CRYPTO
 
 config ASN1_DECODER_LEGACY
 	bool "ASN1 decoder with legacy certificate library"
-	depends on LEGACY_CRYPTO_CERT && ASN1_DECODER
+	depends on LEGACY_CRYPTO && ASN1_DECODER
 	help
 	  This option chooses legacy certificate library for ASN1 decoder.
 
 config ASYMMETRIC_PUBLIC_KEY_LEGACY
 	bool "Asymmetric public key crypto with legacy certificate library"
-	depends on LEGACY_CRYPTO_CERT && ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+	depends on LEGACY_CRYPTO && ASYMMETRIC_PUBLIC_KEY_SUBTYPE
 	help
 	  This option chooses legacy certificate library for asymmetric public
 	  key crypto algorithm.
@@ -211,68 +125,41 @@ config PKCS7_MESSAGE_PARSER_LEGACY
 
 config MSCODE_PARSER_LEGACY
 	bool "MS authenticode parser with legacy certificate library"
-	depends on LEGACY_CRYPTO_CERT && MSCODE_PARSER
+	depends on LEGACY_CRYPTO && MSCODE_PARSER
 	select ASN1_DECODER_LEGACY
 	help
 	  This option chooses legacy certificate library for MS authenticode
 	  parser.
 
-if SPL
-
-config SPL_ASN1_DECODER_LEGACY
-	bool "ASN1 decoder with legacy certificate library in SPL"
-	depends on LEGACY_CRYPTO_CERT && SPL_ASN1_DECODER
-	help
-	  This option chooses legacy certificate library for ASN1 decoder in
-	  SPL.
-
-config SPL_ASYMMETRIC_PUBLIC_KEY_LEGACY
-	bool "Asymmetric public key crypto with legacy certificate library in SPL"
-	depends on LEGACY_CRYPTO_CERT && SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
-	help
-	  This option chooses legacy certificate library for asymmetric public
-	  key crypto algorithm in SPL.
-
-config SPL_RSA_PUBLIC_KEY_PARSER_LEGACY
-	bool "RSA public key parser with legacy certificate library in SPL"
-	depends on SPL_ASYMMETRIC_PUBLIC_KEY_LEGACY
-	select SPL_ASN1_DECODER_LEGACY
-	help
-	  This option chooses legacy certificate library for RSA public key
-	  parser in SPL.
-
-endif # SPL
-
-endif # LEGACY_CRYPTO_CERT
-
 endif # LEGACY_CRYPTO
 
+endif # LEGACY_HASHING_AND_CRYPTO || MBEDTLS_LIB_HASHING_ALT
+
 if MBEDTLS_LIB
 
-config MBEDTLS_LIB_CRYPTO_ALT
+config MBEDTLS_LIB_HASHING_ALT
-	bool "MbedTLS crypto alternatives"
+	bool "Replace MbedTLS native hashing with U-Boot legacy libraries"
 	depends on MBEDTLS_LIB && !MBEDTLS_LIB_CRYPTO
-	select LEGACY_CRYPTO_BASIC
+	select LEGACY_HASHING
 	default y if MBEDTLS_LIB && !MBEDTLS_LIB_CRYPTO
 	help
-	  Enable MbedTLS crypto alternatives.
+	  Enable MbedTLS hashing alternatives and replace them with legacy hashing
+	  libraries.
+	  This allows user to use U-Boot legacy hashing algorithms together with
+	  other MbedTLS modules.
 	  Mutually incompatible with MBEDTLS_LIB_CRYPTO.
 
 config MBEDTLS_LIB_CRYPTO
-	bool "MbedTLS crypto libraries"
+	bool "Use MbedTLS native crypto libraries for hashing"
+	default y if MBEDTLS_LIB
 	select MD5_MBEDTLS if MD5
 	select SHA1_MBEDTLS if SHA1
 	select SHA256_MBEDTLS if SHA256
 	select SHA512_MBEDTLS if SHA512
 	select SHA384_MBEDTLS if SHA384
-	select SPL_MD5_MBEDTLS if SPL_MD5
-	select SPL_SHA1_MBEDTLS if SPL_SHA1
-	select SPL_SHA256_MBEDTLS if SPL_SHA256
-	select SPL_SHA512_MBEDTLS if SPL_SHA512
-	select SPL_SHA384_MBEDTLS if SPL_SHA384
 	help
-	  Enable MbedTLS crypto libraries.
+	  Enable MbedTLS native crypto libraries.
-	  Mutually incompatible with MBEDTLS_LIB_CRYPTO_ALT.
+	  Mutually incompatible with MBEDTLS_LIB_HASHING_ALT.
 
 if MBEDTLS_LIB_CRYPTO
 
@@ -344,53 +231,6 @@ config HKDF_MBEDTLS
 	  This option enables support of key derivation using HKDF algorithm
 	  with MbedTLS crypto library.
 
-if SPL
-
-config SPL_SHA1_MBEDTLS
-	bool "Enable SHA1 support in SPL with MbedTLS crypto library"
-	depends on MBEDTLS_LIB_CRYPTO && SPL_SHA1
-	help
-	  This option enables support of hashing using SHA1 algorithm
-	  with MbedTLS crypto library.
-
-config SPL_SHA256_MBEDTLS
-	bool "Enable SHA256 support in SPL with MbedTLS crypto library"
-	depends on MBEDTLS_LIB_CRYPTO && SPL_SHA256
-	help
-	  This option enables support of hashing using SHA256 algorithm
-	  with MbedTLS crypto library.
-
-config SPL_SHA512_MBEDTLS
-	bool "Enable SHA512 support in SPL with MbedTLS crypto library"
-	depends on MBEDTLS_LIB_CRYPTO && SPL_SHA512
-	help
-	  This option enables support of hashing using SHA512 algorithm
-	  with MbedTLS crypto library.
-
-config SPL_SHA384_MBEDTLS
-	bool "Enable SHA384 support in SPL with MbedTLS crypto library"
-	depends on MBEDTLS_LIB_CRYPTO && SPL_SHA384
-	select SPL_SHA512
-	help
-	  This option enables support of hashing using SHA384 algorithm
-	  with MbedTLS crypto library.
-
-config SPL_MD5_MBEDTLS
-	bool "Enable MD5 support in SPL with MbedTLS crypto library"
-	depends on MBEDTLS_LIB_CRYPTO && SPL_MD5
-	help
-	  This option enables support of hashing using MD5 algorithm
-	  with MbedTLS crypto library.
-
-config SPL_HKDF_MBEDTLS
-	bool "Enable HKDF support in SPL with MbedTLS crypto library"
-	depends on MBEDTLS_LIB_CRYPTO
-	help
-	  This option enables support of key derivation using HKDF algorithm
-	  with MbedTLS crypto library.
-
-endif # SPL
-
 endif # MBEDTLS_LIB_CRYPTO
 
 config MBEDTLS_LIB_X509
@@ -402,10 +242,6 @@ config MBEDTLS_LIB_X509
 	select X509_CERTIFICATE_PARSER_MBEDTLS if X509_CERTIFICATE_PARSER
 	select PKCS7_MESSAGE_PARSER_MBEDTLS if PKCS7_MESSAGE_PARSER
 	select MSCODE_PARSER_MBEDTLS if MSCODE_PARSER
-	select SPL_ASN1_DECODER_MBEDTLS if SPL_ASN1_DECODER
-	select SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS if \
-		SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
-	select SPL_RSA_PUBLIC_KEY_PARSER_MBEDTLS if SPL_RSA_PUBLIC_KEY_PARSER
 	help
 	  Enable MbedTLS certificate libraries.
 
@@ -456,32 +292,6 @@ config MSCODE_PARSER_MBEDTLS
 	  This option chooses MbedTLS certificate library for MS authenticode
 	  parser.
 
-if SPL
-
-config SPL_ASN1_DECODER_MBEDTLS
-	bool "ASN1 decoder with MbedTLS certificate library in SPL"
-	depends on MBEDTLS_LIB_X509 && SPL_ASN1_DECODER
-	help
-	  This option chooses MbedTLS certificate library for ASN1 decoder in
-	  SPL.
-
-config SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS
-	bool "Asymmetric public key crypto with MbedTLS certificate library in SPL"
-	depends on MBEDTLS_LIB_X509 && SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
-	help
-	  This option chooses MbedTLS certificate library for asymmetric public
-	  key crypto algorithm in SPL.
-
-config SPL_RSA_PUBLIC_KEY_PARSER_MBEDTLS
-	bool "RSA public key parser with MbedTLS certificate library in SPL"
-	depends on SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS
-	select SPL_ASN1_DECODER_MBEDTLS
-	help
-	  This option chooses MbedTLS certificate library for RSA public key
-	  parser in SPL.
-
-endif # SPL
-
 endif # MBEDTLS_LIB_X509
 
 config MBEDTLS_LIB_TLS
@@ -490,10 +300,546 @@ config MBEDTLS_LIB_TLS
 	depends on X509_CERTIFICATE_PARSER_MBEDTLS
 	depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS
 	depends on ASN1_DECODER_MBEDTLS
-	depends on ASYMMETRIC_PUBLIC_KEY_MBEDTLS
+	depends on MBEDTLS_LIB
-	depends on MBEDTLS_LIB_CRYPTO
 	help
 	  Enable MbedTLS TLS library. Required for HTTPs support
 	  in wget
 
 endif # MBEDTLS_LIB
+
+# For SPL
+
+if SPL
+
+choice
+	prompt "Crypto libraries (SPL)"
+	default SPL_LEGACY_HASHING_AND_CRYPTO
+	help
+	  Select crypto libraries in SPL.
+	  SPL_LEGACY_HASHING_AND_CRYPTO for legacy crypto libraries,
+	  SPL_MBEDTLS_LIB for MbedTLS libraries.
+
+config SPL_LEGACY_HASHING_AND_CRYPTO
+	bool "legacy crypto libraries"
+	select SPL_LEGACY_HASHING
+	select SPL_LEGACY_CRYPTO
+
+config SPL_MBEDTLS_LIB
+	bool "MbedTLS libraries"
+	select SPL_MBEDTLS_LIB_X509
+endchoice
+
+if SPL_LEGACY_HASHING_AND_CRYPTO || SPL_MBEDTLS_LIB_HASHING_ALT
+
+config SPL_LEGACY_HASHING
+	bool "Use U-Boot legacy hashing libraries (SPL)"
+	select SPL_MD5_LEGACY if SPL_MD5
+	select SPL_SHA1_LEGACY if SPL_SHA1
+	select SPL_SHA256_LEGACY if SPL_SHA256
+	select SPL_SHA512_LEGACY if SPL_SHA512
+	select SPL_SHA384_LEGACY if SPL_SHA384
+	help
+	  Enable U-Boot legacy hashing libraries in SPL.
+
+if SPL_LEGACY_HASHING
+
+config SPL_SHA1_LEGACY
+	bool "Enable SHA1 support with legacy crypto library (SPL)"
+	depends on SPL_LEGACY_HASHING && SPL_SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm
+	  with legacy crypto library in SPL.
+
+config SPL_SHA256_LEGACY
+	bool "Enable SHA256 support with legacy crypto library (SPL)"
+	depends on SPL_LEGACY_HASHING && SPL_SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm
+	  with legacy crypto library in SPL.
+
+config SPL_SHA512_LEGACY
+	bool "Enable SHA512 support with legacy crypto library (SPL)"
+	depends on SPL_LEGACY_HASHING && SPL_SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm
+	  with legacy crypto library in SPL.
+
+config SPL_SHA384_LEGACY
+	bool "Enable SHA384 support with legacy crypto library (SPL)"
+	depends on SPL_LEGACY_HASHING && SPL_SHA384
+	select SPL_SHA512_LEGACY
+	help
+	  This option enables support of hashing using SHA384 algorithm
+	  with legacy crypto library in SPL.
+
+config SPL_MD5_LEGACY
+	bool "Enable MD5 support with legacy crypto library (SPL)"
+	depends on SPL_LEGACY_HASHING && SPL_MD5
+	help
+	  This option enables support of hashing using MD5 algorithm
+	  with legacy crypto library in SPL.
+
+endif # SPL_LEGACY_HASHING
+
+config SPL_LEGACY_CRYPTO
+	bool "legacy certificate libraries (SPL)"
+	depends on SPL_LEGACY_HASHING_AND_CRYPTO
+	select SPL_ASN1_DECODER_LEGACY if SPL_ASN1_DECODER
+	select SPL_ASYMMETRIC_PUBLIC_KEY_LEGACY if \
+		SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+	select SPL_RSA_PUBLIC_KEY_PARSER_LEGACY if SPL_RSA_PUBLIC_KEY_PARSER
+	help
+	  Enable legacy certificate libraries in SPL.
+
+if SPL_LEGACY_CRYPTO
+
+config SPL_ASN1_DECODER_LEGACY
+	bool "ASN1 decoder with legacy certificate library (SPL)"
+	depends on SPL_LEGACY_CRYPTO && SPL_ASN1_DECODER
+	help
+	  This option chooses legacy certificate library for ASN1 decoder in
+	  SPL.
+
+config SPL_ASYMMETRIC_PUBLIC_KEY_LEGACY
+	bool "Asymmetric public key crypto with legacy certificate library (SPL)"
+	depends on SPL_LEGACY_CRYPTO && SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+	help
+	  This option chooses legacy certificate library for asymmetric public
+	  key crypto algorithm in SPL.
+
+config SPL_RSA_PUBLIC_KEY_PARSER_LEGACY
+	bool "RSA public key parser with legacy certificate library (SPL)"
+	depends on SPL_ASYMMETRIC_PUBLIC_KEY_LEGACY
+	select SPL_ASN1_DECODER_LEGACY
+	help
+	  This option chooses legacy certificate library for RSA public key
+	  parser in SPL.
+
+endif # SPL_LEGACY_CRYPTO
+
+endif # SPL_LEGACY_HASHING_AND_CRYPTO || SPL_MBEDTLS_LIB_HASHING_ALT
+
+if SPL_MBEDTLS_LIB
+
+config SPL_MBEDTLS_LIB_HASHING_ALT
+	bool "Replace MbedTLS native hashing with U-Boot legacy libraries (SPL)"
+	depends on SPL_MBEDTLS_LIB && !SPL_MBEDTLS_LIB_CRYPTO
+	select SPL_LEGACY_HASHING
+	default y if SPL_MBEDTLS_LIB && !SPL_MBEDTLS_LIB_CRYPTO
+	help
+	  Enable MbedTLS hashing alternatives and replace them with legacy hashing
+	  libraries in SPL.
+	  This allows user to use U-Boot legacy hashing algorithms together with
+	  other MbedTLS modules.
+	  Mutually incompatible with SPL_MBEDTLS_LIB_CRYPTO.
+
+config SPL_MBEDTLS_LIB_CRYPTO
+	bool "Use MbedTLS native crypto libraries for hashing (SPL)"
+	default y if SPL_MBEDTLS_LIB
+	select SPL_MD5_MBEDTLS if SPL_MD5
+	select SPL_SHA1_MBEDTLS if SPL_SHA1
+	select SPL_SHA256_MBEDTLS if SPL_SHA256
+	select SPL_SHA512_MBEDTLS if SPL_SHA512
+	select SPL_SHA384_MBEDTLS if SPL_SHA384
+	help
+	  Enable MbedTLS native crypto libraries in SPL.
+
+if SPL_MBEDTLS_LIB_CRYPTO
+
+config SPL_SHA1_MBEDTLS
+	bool "Enable SHA1 support with MbedTLS crypto library (SPL)"
+	depends on SPL_MBEDTLS_LIB_CRYPTO && SPL_SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm
+	  with MbedTLS crypto library in SPL.
+
+config SPL_SHA256_MBEDTLS
+	bool "Enable SHA256 support with MbedTLS crypto library (SPL)"
+	depends on SPL_MBEDTLS_LIB_CRYPTO && SPL_SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm
+	  with MbedTLS crypto library in SPL.
+
+config SPL_SHA512_MBEDTLS
+	bool "Enable SHA512 support with MbedTLS crypto library (SPL)"
+	depends on SPL_MBEDTLS_LIB_CRYPTO && SPL_SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm
+	  with MbedTLS crypto library in SPL.
+
+config SPL_SHA384_MBEDTLS
+	bool "Enable SHA384 support with MbedTLS crypto library (SPL)"
+	depends on SPL_MBEDTLS_LIB_CRYPTO && SPL_SHA384
+	select SPL_SHA512
+	help
+	  This option enables support of hashing using SHA384 algorithm
+	  with MbedTLS crypto library in SPL.
+
+config SPL_MD5_MBEDTLS
+	bool "Enable MD5 support with MbedTLS crypto library (SPL)"
+	depends on SPL_MBEDTLS_LIB_CRYPTO && SPL_MD5
+	help
+	  This option enables support of hashing using MD5 algorithm
+	  with MbedTLS crypto library in SPL.
+
+config SPL_HKDF_MBEDTLS
+	bool "Enable HKDF support with MbedTLS crypto library (SPL)"
+	depends on SPL_MBEDTLS_LIB_CRYPTO
+	help
+	  This option enables support of key derivation using HKDF algorithm
+	  with MbedTLS crypto library in SPL.
+
+endif # SPL_MBEDTLS_LIB_CRYPTO
+
+config SPL_MBEDTLS_LIB_X509
+	bool "MbedTLS certificate libraries (SPL)"
+	select SPL_ASN1_DECODER_MBEDTLS if SPL_ASN1_DECODER
+	select SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS if \
+		SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+	select SPL_RSA_PUBLIC_KEY_PARSER_MBEDTLS if SPL_RSA_PUBLIC_KEY_PARSER
+	help
+	  Enable MbedTLS certificate libraries in SPL.
+
+if SPL_MBEDTLS_LIB_X509
+
+config SPL_ASN1_DECODER_MBEDTLS
+	bool "ASN1 decoder with MbedTLS certificate library (SPL)"
+	depends on SPL_MBEDTLS_LIB_X509 && SPL_ASN1_DECODER
+	help
+	  This option chooses MbedTLS certificate library for ASN1 decoder in
+	  SPL.
+
+config SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS
+	bool "Asymmetric public key crypto with MbedTLS certificate library (SPL)"
+	depends on SPL_MBEDTLS_LIB_X509 && SPL_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
+	help
+	  This option chooses MbedTLS certificate library for asymmetric public
+	  key crypto algorithm in SPL.
+
+config SPL_RSA_PUBLIC_KEY_PARSER_MBEDTLS
+	bool "RSA public key parser with MbedTLS certificate library (SPL)"
+	depends on SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS
+	select SPL_ASN1_DECODER_MBEDTLS
+	help
+	  This option chooses MbedTLS certificate library for RSA public key
+	  parser in SPL.
+
+endif # SPL_MBEDTLS_LIB_X509
+
+config SPL_MBEDTLS_LIB_TLS
+	bool "MbedTLS TLS library (SPL)"
+	depends on SPL_RSA_PUBLIC_KEY_PARSER_MBEDTLS
+	depends on SPL_X509_CERTIFICATE_PARSER_MBEDTLS
+	depends on SPL_ASYMMETRIC_PUBLIC_KEY_MBEDTLS
+	depends on SPL_ASN1_DECODER_MBEDTLS
+	depends on SPL_MBEDTLS_LIB
+	help
+	  Enable MbedTLS TLS library in SPL. Required for HTTPs support
+	  in wget
+
+endif # SPL_MBEDTLS_LIB
+
+endif # SPL
+
+# For TPL
+
+if TPL
+
+choice
+	prompt "Crypto libraries (TPL)"
+	default TPL_LEGACY_HASHING_AND_CRYPTO
+	help
+	  Select crypto libraries in TPL.
+	  TPL_LEGACY_HASHING_AND_CRYPTO for legacy crypto libraries,
+	  TPL_MBEDTLS_LIB for MbedTLS libraries.
+
+config TPL_LEGACY_HASHING_AND_CRYPTO
+	bool "legacy crypto libraries"
+	select TPL_LEGACY_HASHING
+	select TPL_LEGACY_CRYPTO
+
+config TPL_MBEDTLS_LIB
+	bool "MbedTLS libraries"
+
+endchoice
+
+if TPL_LEGACY_HASHING_AND_CRYPTO || TPL_MBEDTLS_LIB_HASHING_ALT
+
+config TPL_LEGACY_HASHING
+	bool "Use U-Boot legacy hashing libraries (TPL)"
+	select TPL_MD5_LEGACY if TPL_MD5
+	select TPL_SHA1_LEGACY if TPL_SHA1
+	select TPL_SHA256_LEGACY if TPL_SHA256
+	select TPL_SHA512_LEGACY if TPL_SHA512
+	select TPL_SHA384_LEGACY if TPL_SHA384
+	help
+	  Enable U-Boot legacy hashing libraries in TPL.
+
+if TPL_LEGACY_HASHING
+
+config TPL_SHA1_LEGACY
+	bool "Enable SHA1 support with legacy crypto library (TPL)"
+	depends on TPL_LEGACY_HASHING && TPL_SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm
+	  with legacy crypto library in TPL.
+
+config TPL_SHA256_LEGACY
+	bool "Enable SHA256 support with legacy crypto library (TPL)"
+	depends on TPL_LEGACY_HASHING && TPL_SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm
+	  with legacy crypto library in TPL.
+
+config TPL_SHA512_LEGACY
+	bool "Enable SHA512 support with legacy crypto library (TPL)"
+	depends on TPL_LEGACY_HASHING && TPL_SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm
+	  with legacy crypto library in TPL.
+
+config TPL_SHA384_LEGACY
+	bool "Enable SHA384 support with legacy crypto library (TPL)"
+	depends on TPL_LEGACY_HASHING && TPL_SHA384
+	select TPL_SHA512_LEGACY
+	help
+	  This option enables support of hashing using SHA384 algorithm
+	  with legacy crypto library in TPL.
+
+config TPL_MD5_LEGACY
+	bool "Enable MD5 support with legacy crypto library (TPL)"
+	depends on TPL_LEGACY_HASHING && TPL_MD5
+	help
+	  This option enables support of hashing using MD5 algorithm
+	  with legacy crypto library in TPL.
+
+endif # TPL_LEGACY_HASHING
+
+endif # TPL_LEGACY_HASHING_AND_CRYPTO || TPL_MBEDTLS_LIB_HASHING_ALT
+
+if TPL_MBEDTLS_LIB
+
+config TPL_MBEDTLS_LIB_HASHING_ALT
+	bool "Replace MbedTLS native hashing with U-Boot legacy libraries (TPL)"
+	depends on TPL_MBEDTLS_LIB && !TPL_MBEDTLS_LIB_CRYPTO
+	select TPL_LEGACY_HASHING
+	default y if TPL_MBEDTLS_LIB && !TPL_MBEDTLS_LIB_CRYPTO
+	help
+	  Enable MbedTLS hashing alternatives and replace them with legacy hashing
+	  libraries in TPL.
+	  This allows user to use U-Boot legacy hashing algorithms together with
+	  other MbedTLS modules.
+	  Mutually incompatible with TPL_MBEDTLS_LIB_CRYPTO.
+
+config TPL_MBEDTLS_LIB_CRYPTO
+	bool "Use MbedTLS native crypto libraries for hashing (TPL)"
+	default y if TPL_MBEDTLS_LIB
+	select TPL_MD5_MBEDTLS if TPL_MD5
+	select TPL_SHA1_MBEDTLS if TPL_SHA1
+	select TPL_SHA256_MBEDTLS if TPL_SHA256
+	select TPL_SHA512_MBEDTLS if TPL_SHA512
+	select TPL_SHA384_MBEDTLS if TPL_SHA384
+	help
+	  Enable MbedTLS native crypto libraries in TPL.
+
+if TPL_MBEDTLS_LIB_CRYPTO
+
+config TPL_SHA1_MBEDTLS
+	bool "Enable SHA1 support with MbedTLS crypto library (TPL)"
+	depends on TPL_MBEDTLS_LIB_CRYPTO && TPL_SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm
+	  with MbedTLS crypto library in TPL.
+
+config TPL_SHA256_MBEDTLS
+	bool "Enable SHA256 support with MbedTLS crypto library (TPL)"
+	depends on TPL_MBEDTLS_LIB_CRYPTO && TPL_SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm
+	  with MbedTLS crypto library in TPL.
+
+config TPL_SHA512_MBEDTLS
+	bool "Enable SHA512 support with MbedTLS crypto library (TPL)"
+	depends on TPL_MBEDTLS_LIB_CRYPTO && TPL_SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm
+	  with MbedTLS crypto library in TPL.
+
+config TPL_SHA384_MBEDTLS
+	bool "Enable SHA384 support with MbedTLS crypto library (TPL)"
+	depends on TPL_MBEDTLS_LIB_CRYPTO && TPL_SHA384
+	select TPL_SHA512
+	help
+	  This option enables support of hashing using SHA384 algorithm
+	  with MbedTLS crypto library in TPL.
+
+config TPL_MD5_MBEDTLS
+	bool "Enable MD5 support with MbedTLS crypto library (TPL)"
+	depends on TPL_MBEDTLS_LIB_CRYPTO && TPL_MD5
+	help
+	  This option enables support of hashing using MD5 algorithm
+	  with MbedTLS crypto library in TPL.
+
+config TPL_HKDF_MBEDTLS
+	bool "Enable HKDF support with MbedTLS crypto library (TPL)"
+	depends on TPL_MBEDTLS_LIB_CRYPTO
+	help
+	  This option enables support of key derivation using HKDF algorithm
+	  with MbedTLS crypto library in TPL.
+
+endif # TPL_MBEDTLS_LIB_CRYPTO
+
+endif # TPL_MBEDTLS_LIB
+
+endif # TPL
+
+# For VPL
+
+if VPL
+
+choice
+	prompt "Crypto libraries (VPL)"
+	default VPL_LEGACY_HASHING_AND_CRYPTO
+	help
+	  Select crypto libraries in VPL.
+	  VPL_LEGACY_HASHING_AND_CRYPTO for legacy crypto libraries,
+	  VPL_MBEDTLS_LIB for MbedTLS libraries.
+
+config VPL_LEGACY_HASHING_AND_CRYPTO
+	bool "legacy crypto libraries"
+	select VPL_LEGACY_HASHING
+
+config VPL_MBEDTLS_LIB
+	bool "MbedTLS libraries"
+
+endchoice
+
+if VPL_LEGACY_HASHING_AND_CRYPTO || VPL_MBEDTLS_LIB_HASHING_ALT
+
+config VPL_LEGACY_HASHING
+	bool "Use U-Boot legacy hashing libraries (VPL)"
+	select VPL_MD5_LEGACY if VPL_MD5
+	select VPL_SHA1_LEGACY if VPL_SHA1
+	select VPL_SHA256_LEGACY if VPL_SHA256
+	select VPL_SHA512_LEGACY if VPL_SHA512
+	select VPL_SHA384_LEGACY if VPL_SHA384
+	help
+	  Enable U-Boot legacy hashing libraries in VPL.
+
+if VPL_LEGACY_HASHING
+
+config VPL_SHA1_LEGACY
+	bool "Enable SHA1 support with legacy crypto library (VPL)"
+	depends on VPL_LEGACY_HASHING && VPL_SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm
+	  with legacy crypto library in VPL.
+
+config VPL_SHA256_LEGACY
+	bool "Enable SHA256 support with legacy crypto library (VPL)"
+	depends on VPL_LEGACY_HASHING && VPL_SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm
+	  with legacy crypto library in VPL.
+
+config VPL_SHA512_LEGACY
+	bool "Enable SHA512 support with legacy crypto library (VPL)"
+	depends on VPL_LEGACY_HASHING && VPL_SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm
+	  with legacy crypto library in VPL.
+
+config VPL_SHA384_LEGACY
+	bool "Enable SHA384 support with legacy crypto library (VPL)"
+	depends on VPL_LEGACY_HASHING && VPL_SHA384
+	select VPL_SHA512_LEGACY
+	help
+	  This option enables support of hashing using SHA384 algorithm
+	  with legacy crypto library in VPL.
+
+config VPL_MD5_LEGACY
+	bool "Enable MD5 support with legacy crypto library (VPL)"
+	depends on VPL_LEGACY_HASHING && VPL_MD5
+	help
+	  This option enables support of hashing using MD5 algorithm
+	  with legacy crypto library in VPL.
+
+endif # VPL_LEGACY_HASHING
+
+endif # VPL_LEGACY_HASHING_AND_CRYPTO || VPL_MBEDTLS_LIB_HASHING_ALT
+
+if VPL_MBEDTLS_LIB
+
+config VPL_MBEDTLS_LIB_HASHING_ALT
+	bool "Replace MbedTLS native hashing with U-Boot legacy libraries (VPL)"
+	depends on VPL_MBEDTLS_LIB && !VPL_MBEDTLS_LIB_CRYPTO
+	select VPL_LEGACY_HASHING
+	default y if VPL_MBEDTLS_LIB && !VPL_MBEDTLS_LIB_CRYPTO
+	help
+	  Enable MbedTLS hashing alternatives and replace them with legacy hashing
+	  libraries in VPL.
+	  This allows user to use U-Boot legacy hashing algorithms together with
+	  other MbedTLS modules.
+	  Mutually incompatible with VPL_MBEDTLS_LIB_CRYPTO.
+
+config VPL_MBEDTLS_LIB_CRYPTO
+	bool "Use MbedTLS native crypto libraries for hashing (VPL)"
+	default y if VPL_MBEDTLS_LIB
+	select VPL_MD5_MBEDTLS if VPL_MD5
+	select VPL_SHA1_MBEDTLS if VPL_SHA1
+	select VPL_SHA256_MBEDTLS if VPL_SHA256
+	select VPL_SHA512_MBEDTLS if VPL_SHA512
+	select VPL_SHA384_MBEDTLS if VPL_SHA384
+	help
+	  Enable MbedTLS native crypto libraries in VPL.
+
+if VPL_MBEDTLS_LIB_CRYPTO
+
+config VPL_SHA1_MBEDTLS
+	bool "Enable SHA1 support with MbedTLS crypto library (VPL)"
+	depends on VPL_MBEDTLS_LIB_CRYPTO && VPL_SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm
+	  with MbedTLS crypto library in VPL.
+
+config VPL_SHA256_MBEDTLS
+	bool "Enable SHA256 support with MbedTLS crypto library (VPL)"
+	depends on VPL_MBEDTLS_LIB_CRYPTO && VPL_SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm
+	  with MbedTLS crypto library in VPL.
+
+config VPL_SHA512_MBEDTLS
+	bool "Enable SHA512 support with MbedTLS crypto library (VPL)"
+	depends on VPL_MBEDTLS_LIB_CRYPTO && VPL_SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm
+	  with MbedTLS crypto library in VPL.
+
+config VPL_SHA384_MBEDTLS
+	bool "Enable SHA384 support with MbedTLS crypto library (VPL)"
+	depends on VPL_MBEDTLS_LIB_CRYPTO && VPL_SHA384
+	select VPL_SHA512
+	help
+	  This option enables support of hashing using SHA384 algorithm
+	  with MbedTLS crypto library in VPL.
+
+config VPL_MD5_MBEDTLS
+	bool "Enable MD5 support with MbedTLS crypto library (VPL)"
+	depends on VPL_MBEDTLS_LIB_CRYPTO && VPL_MD5
+	help
+	  This option enables support of hashing using MD5 algorithm
+	  with MbedTLS crypto library in VPL.
+
+config VPL_HKDF_MBEDTLS
+	bool "Enable HKDF support with MbedTLS crypto library (VPL)"
+	depends on VPL_MBEDTLS_LIB_CRYPTO
+	help
+	  This option enables support of key derivation using HKDF algorithm
+	  with MbedTLS crypto library in VPL.
+
+endif # VPL_MBEDTLS_LIB_CRYPTO
+
+endif # VPL_MBEDTLS_LIB
+
+endif # VPL

lib/mbedtls/Makefile

@@ -6,60 +6,60 @@
 MBEDTLS_LIB_DIR = external/mbedtls/library
 
 # shim layer for hash
-obj-$(CONFIG_$(SPL_)MD5_MBEDTLS) += md5.o
+obj-$(CONFIG_$(XPL_)MD5_MBEDTLS) += md5.o
-obj-$(CONFIG_$(SPL_)SHA1_MBEDTLS) += sha1.o
+obj-$(CONFIG_$(XPL_)SHA1_MBEDTLS) += sha1.o
-obj-$(CONFIG_$(SPL_)SHA256_MBEDTLS) += sha256.o
+obj-$(CONFIG_$(XPL_)SHA256_MBEDTLS) += sha256.o
-obj-$(CONFIG_$(SPL_)SHA512_MBEDTLS) += sha512.o
+obj-$(CONFIG_$(XPL_)SHA512_MBEDTLS) += sha512.o
 
 # x509 libraries
-obj-$(CONFIG_$(SPL_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \
+obj-$(CONFIG_$(XPL_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \
 	public_key.o
-obj-$(CONFIG_$(SPL_)X509_CERTIFICATE_PARSER_MBEDTLS) += \
+obj-$(CONFIG_$(XPL_)X509_CERTIFICATE_PARSER_MBEDTLS) += \
 	x509_cert_parser.o
-obj-$(CONFIG_$(SPL_)PKCS7_MESSAGE_PARSER_MBEDTLS) += pkcs7_parser.o
+obj-$(CONFIG_$(XPL_)PKCS7_MESSAGE_PARSER_MBEDTLS) += pkcs7_parser.o
-obj-$(CONFIG_$(SPL_)MSCODE_PARSER_MBEDTLS) += mscode_parser.o
+obj-$(CONFIG_$(XPL_)MSCODE_PARSER_MBEDTLS) += mscode_parser.o
-obj-$(CONFIG_$(SPL_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += rsa_helper.o
+obj-$(CONFIG_$(XPL_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += rsa_helper.o
 
 # MbedTLS crypto library
-obj-$(CONFIG_MBEDTLS_LIB) += mbedtls_lib_crypto.o
+obj-$(CONFIG_$(XPL_)MBEDTLS_LIB) += mbedtls_lib_crypto.o
 mbedtls_lib_crypto-y := \
 	$(MBEDTLS_LIB_DIR)/platform_util.o \
 	$(MBEDTLS_LIB_DIR)/constant_time.o \
 	$(MBEDTLS_LIB_DIR)/md.o
 
-mbedtls_lib_crypto-$(CONFIG_$(SPL_)MD5_MBEDTLS) += $(MBEDTLS_LIB_DIR)/md5.o
+mbedtls_lib_crypto-$(CONFIG_$(XPL_)MD5_MBEDTLS) += $(MBEDTLS_LIB_DIR)/md5.o
-mbedtls_lib_crypto-$(CONFIG_$(SPL_)SHA1_MBEDTLS) += $(MBEDTLS_LIB_DIR)/sha1.o
+mbedtls_lib_crypto-$(CONFIG_$(XPL_)SHA1_MBEDTLS) += $(MBEDTLS_LIB_DIR)/sha1.o
-mbedtls_lib_crypto-$(CONFIG_$(SPL_)SHA256_MBEDTLS) += \
+mbedtls_lib_crypto-$(CONFIG_$(XPL_)SHA256_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/sha256.o
-mbedtls_lib_crypto-$(CONFIG_$(SPL_)SHA512_MBEDTLS) += \
+mbedtls_lib_crypto-$(CONFIG_$(XPL_)SHA512_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/sha512.o
-mbedtls_lib_crypto-$(CONFIG_$(SPL_)HKDF_MBEDTLS) += \
+mbedtls_lib_crypto-$(CONFIG_$(XPL_)HKDF_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/hkdf.o
 
 # MbedTLS X509 library
-obj-$(CONFIG_MBEDTLS_LIB_X509) += mbedtls_lib_x509.o
+obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_X509) += mbedtls_lib_x509.o
 mbedtls_lib_x509-y := $(MBEDTLS_LIB_DIR)/x509.o
-mbedtls_lib_x509-$(CONFIG_$(SPL_)ASN1_DECODER_MBEDTLS) += \
+mbedtls_lib_x509-$(CONFIG_$(XPL_)ASN1_DECODER_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/asn1parse.o \
 	$(MBEDTLS_LIB_DIR)/asn1write.o \
 	$(MBEDTLS_LIB_DIR)/oid.o
-mbedtls_lib_x509-$(CONFIG_$(SPL_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += \
+mbedtls_lib_x509-$(CONFIG_$(XPL_)RSA_PUBLIC_KEY_PARSER_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/bignum.o \
 	$(MBEDTLS_LIB_DIR)/bignum_core.o \
 	$(MBEDTLS_LIB_DIR)/rsa.o \
 	$(MBEDTLS_LIB_DIR)/rsa_alt_helpers.o
-mbedtls_lib_x509-$(CONFIG_$(SPL_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \
+mbedtls_lib_x509-$(CONFIG_$(XPL_)ASYMMETRIC_PUBLIC_KEY_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/pk.o \
 	$(MBEDTLS_LIB_DIR)/pk_wrap.o \
 	$(MBEDTLS_LIB_DIR)/pkparse.o
-mbedtls_lib_x509-$(CONFIG_$(SPL_)X509_CERTIFICATE_PARSER_MBEDTLS) += \
+mbedtls_lib_x509-$(CONFIG_$(XPL_)X509_CERTIFICATE_PARSER_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/x509_crl.o \
 	$(MBEDTLS_LIB_DIR)/x509_crt.o
-mbedtls_lib_x509-$(CONFIG_$(SPL_)PKCS7_MESSAGE_PARSER_MBEDTLS) += \
+mbedtls_lib_x509-$(CONFIG_$(XPL_)PKCS7_MESSAGE_PARSER_MBEDTLS) += \
 	$(MBEDTLS_LIB_DIR)/pkcs7.o
 
 #mbedTLS TLS support
-obj-$(CONFIG_MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o
+obj-$(CONFIG_$(XPL_)MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o
 mbedtls_lib_tls-y := \
 	$(MBEDTLS_LIB_DIR)/mps_reader.o \
 	$(MBEDTLS_LIB_DIR)/mps_trace.o \

lib/mbedtls/mbedtls_def_config.h

@@ -11,12 +11,12 @@
  * Author: Raymond Mao <raymond.mao@linaro.org>
  */
 
-#if defined CONFIG_MBEDTLS_LIB
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB)
 
 #if CONFIG_IS_ENABLED(MD5)
 #define MBEDTLS_MD_C
 #define MBEDTLS_MD5_C
-#if defined CONFIG_MBEDTLS_LIB_CRYPTO_ALT
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_HASHING_ALT)
 #define MBEDTLS_MD5_ALT
 #endif
 #endif
@@ -24,7 +24,7 @@
 #if CONFIG_IS_ENABLED(SHA1)
 #define MBEDTLS_MD_C
 #define MBEDTLS_SHA1_C
-#if defined CONFIG_MBEDTLS_LIB_CRYPTO_ALT
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_HASHING_ALT)
 #define MBEDTLS_SHA1_ALT
 #endif
 #endif
@@ -32,7 +32,7 @@
 #if CONFIG_IS_ENABLED(SHA256)
 #define MBEDTLS_MD_C
 #define MBEDTLS_SHA256_C
-#if defined CONFIG_MBEDTLS_LIB_CRYPTO_ALT
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_HASHING_ALT)
 #define MBEDTLS_SHA256_ALT
 #endif
 #if CONFIG_IS_ENABLED(SHA256_SMALLER)
@@ -48,7 +48,7 @@
 #if CONFIG_IS_ENABLED(SHA512)
 #define MBEDTLS_MD_C
 #define MBEDTLS_SHA512_C
-#if defined CONFIG_MBEDTLS_LIB_CRYPTO_ALT
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_HASHING_ALT)
 #define MBEDTLS_SHA512_ALT
 #endif
 #if CONFIG_IS_ENABLED(SHA512_SMALLER)
@@ -60,7 +60,7 @@
 #define MBEDTLS_HKDF_C
 #endif
 
-#if defined CONFIG_MBEDTLS_LIB_X509
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
 
 #if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER)
 #define MBEDTLS_X509_USE_C
@@ -89,9 +89,9 @@
 #define MBEDTLS_ASN1_WRITE_C
 #endif
 
-#endif /* #if defined CONFIG_MBEDTLS_LIB_X509 */
+#endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
 
-#if IS_ENABLED(CONFIG_MBEDTLS_LIB_TLS)
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS)
 #include "rtc.h"
 
 /* Generic options */
@@ -106,25 +106,36 @@
 #define MBEDTLS_ENTROPY_C
 #define MBEDTLS_NO_PLATFORM_ENTROPY
 #define MBEDTLS_SSL_PROTO_TLS1_2
+#if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER)
 #define MBEDTLS_SSL_SERVER_NAME_INDICATION
+#endif
 #define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
 
 /* RSA */
+#if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER) && \
+	CONFIG_IS_ENABLED(RSA_PUBLIC_KEY_PARSER)
 #define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
 #define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
 #define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+#endif
 #define MBEDTLS_GCM_C
 
 /* ECDSA */
+#if CONFIG_IS_ENABLED(ASN1_DECODER)
 #define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECP_C
 #define MBEDTLS_ECDH_C
+#endif
 #define MBEDTLS_ECDSA_DETERMINISTIC
 #define MBEDTLS_HMAC_DRBG_C
-#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+
-#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
 #define MBEDTLS_CAN_ECDH
 #define MBEDTLS_PK_CAN_ECDSA_SIGN
-#define MBEDTLS_ECP_C
+#if CONFIG_IS_ENABLED(X509_CERTIFICATE_PARSER)
+#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+#endif
+
 #define MBEDTLS_ECP_DP_SECP256K1_ENABLED
 #define MBEDTLS_ECP_DP_SECP192R1_ENABLED
 #define MBEDTLS_ECP_DP_SECP224R1_ENABLED
@@ -138,6 +149,6 @@
 #define MBEDTLS_ECP_DP_BP384R1_ENABLED
 #define MBEDTLS_ECP_DP_BP512R1_ENABLED
 
-#endif /* #if defined CONFIG_MBEDTLS_LIB_TLS */
+#endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB_TLS) */
 
-#endif /* #if defined CONFIG_MBEDTLS_LIB */
+#endif /* #if CONFIG_IS_ENABLED(MBEDTLS_LIB) */

lib/mbedtls/port/mbedtls_options.h

@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Internal build options for MbedTLS
+ *
+ * Copyright (c) 2025 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+
+#ifndef _MBEDTLS_OPT_H
+#define _MBEDTLS_OPT_H
+
+/*
+ * FIXME:
+ * U-Boot/MbedTLS port requires to access a few of members which are defined
+ * as private in MbedTLS context.
+ * E.g: x509_internal.h, mbedtls_sha256_context and mbedtls_sha1_context.
+ * MBEDTLS_ALLOW_PRIVATE_ACCESS needs to be enabled to allow the external
+ * access, but directly including <external/mbedtls/library/common.h> is not
+ * allowed, since this will include <malloc.h> and break the sandbox test.
+ */
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS
+
+#endif /* _MBEDTLS_OPT_H */

net/eth_common.c

@@ -31,11 +31,6 @@ int eth_env_set_enetaddr_by_index(const char *base_name, int index,
 void eth_common_init(void)
 {
 	bootstage_mark(BOOTSTAGE_ID_NET_ETH_START);
-#if CONFIG_IS_ENABLED(ETH)
-#if defined(CONFIG_MII) || defined(CONFIG_CMD_MII) || defined(CONFIG_PHYLIB)
-	miiphy_init();
-#endif
-#endif
 }
 
 int eth_mac_skip(int index)

scripts/checkpatch.pl

@@ -7205,8 +7205,8 @@ sub process {
 
 # check for IS_ENABLED() without CONFIG_<FOO> ($rawline for comments too)
 		if ($rawline =~ /\bIS_ENABLED\s*\(\s*(\w+)\s*\)/ && $1 !~ /^${CONFIG_}/) {
-			WARN("IS_ENABLED_CONFIG",
+			ERROR("IS_ENABLED_CONFIG",
-			     "IS_ENABLED($1) is normally used as IS_ENABLED(${CONFIG_}$1)\n" . $herecurr);
+			     "IS_ENABLED($1) must be used as IS_ENABLED(${CONFIG_}$1)\n" . $herecurr);
 		}
 
 # check for #if defined CONFIG_<FOO> || defined CONFIG_<FOO>_MODULE

tools/binman/binman.rst

@@ -823,24 +823,6 @@ multiple-images:
             };
         };
 
-end-at-4gb:
-    For x86 machines the ROM offsets start just before 4GB and extend
-    up so that the image finished at the 4GB boundary. This boolean
-    option can be enabled to support this. The image size must be
-    provided so that binman knows when the image should start. For an
-    8MB ROM, the offset of the first entry would be 0xfff80000 with
-    this option, instead of 0 without this option.
-
-skip-at-start:
-    This property specifies the entry offset of the first entry.
-
-    For PowerPC mpc85xx based CPU, CONFIG_TEXT_BASE is the entry
-    offset of the first entry. It can be 0xeff40000 or 0xfff40000 for
-    nor flash boot, 0x201000 for sd boot etc.
-
-    'end-at-4gb' property is not applicable where CONFIG_TEXT_BASE +
-    Image size != 4gb.
-
 align-default:
     Specifies the default alignment for entries in this section if they do
     not specify an alignment. Note that this only applies to top-level entries
@@ -957,6 +939,35 @@ filename:
     section in different image, since there is currently no way to share data
     between images other than through files.
 
+end-at-4gb:
+    For x86 machines the ROM offsets start just before 4GB and extend
+    up so that the image finished at the 4GB boundary. This boolean
+    option can be enabled to support this. The image size must be
+    provided so that binman knows when the image should start. For an
+    8MB ROM, the offset of the first entry would be 0xfff80000 with
+    this option, instead of 0 without this option.
+
+skip-at-start:
+    This property specifies the entry offset of the first entry in the section.
+    It is useful when the Binman image is written to a particular offset in the
+    media. It allows the offset of the first entry to be the media offset, even
+    though it is at the start of the image. It effectively creates a hole at the
+    start of the image, an implied, empty area.
+
+    For example, if the image is written to offset 4K on the media, set
+    skip-at-start to 0x1000. At runtime, the Binman image will assume that it
+    has be written at offset 4K and all symbols and offsets will take account of
+    that. The image-pos values will also be adjusted. The effect is similar to
+    adding an empty 4K region at the start, except that Binman does not actually
+    output it.
+
+    For PowerPC mpc85xx based CPU, CONFIG_TEXT_BASE is the entry
+    offset of the first entry. It can be 0xeff40000 or 0xfff40000 for
+    nor flash boot, 0x201000 for sd boot etc.
+
+    'end-at-4gb' property is not applicable where CONFIG_TEXT_BASE +
+    Image size != 4gb.
+
 Image Properties
 ----------------
 

tools/binman/entry.py

@@ -392,9 +392,8 @@ class Entry(object):
         """Set the value of device-tree properties calculated by binman"""
         state.SetInt(self._node, 'offset', self.offset)
         state.SetInt(self._node, 'size', self.size)
-        base = self.section.GetRootSkipAtStart() if self.section else 0
         if self.image_pos is not None:
-            state.SetInt(self._node, 'image-pos', self.image_pos - base)
+            state.SetInt(self._node, 'image-pos', self.image_pos)
         if self.GetImage().allow_repack:
             if self.orig_offset is not None:
                 state.SetInt(self._node, 'orig-offset', self.orig_offset, True)
@@ -722,7 +721,7 @@ class Entry(object):
             is_elf = self.GetDefaultFilename() == self.elf_fname
 
             symbols_base = self.symbols_base
-            if symbols_base is None and self.GetImage()._end_4gb:
+            if symbols_base is None and self.GetImage()._end_at_4gb:
                 symbols_base = 0
 
             elf.LookupAndWriteSymbols(self.elf_fname, self, section.GetImage(),

tools/binman/etype/fmap.py

@@ -65,7 +65,7 @@ class Entry_fmap(Entry):
                 if entry.image_pos is None:
                     pos = 0
                 else:
-                    pos = entry.image_pos - entry.GetRootSkipAtStart()
+                    pos = entry.image_pos
 
                 # Drop @ symbols in name
                 name = entry.name.replace('@', '')
@@ -75,8 +75,6 @@ class Entry_fmap(Entry):
                     _AddEntries(areas, subentry)
             else:
                 pos = entry.image_pos
-                if pos is not None:
-                    pos -= entry.section.GetRootSkipAtStart()
                 areas.append(fmap_util.FmapArea(pos or 0, entry.size or 0,
                                                 entry.name, flags))
 

tools/binman/etype/section.py

@@ -165,7 +165,7 @@ class Entry_section(Entry):
         self._pad_byte = 0
         self._sort = False
         self._skip_at_start = None
-        self._end_4gb = False
+        self._end_at_4gb = False
         self._ignore_missing = False
         self._filename = None
         self.align_default = 0
@@ -187,9 +187,9 @@ class Entry_section(Entry):
         super().ReadNode()
         self._pad_byte = fdt_util.GetInt(self._node, 'pad-byte', 0)
         self._sort = fdt_util.GetBool(self._node, 'sort-by-offset')
-        self._end_4gb = fdt_util.GetBool(self._node, 'end-at-4gb')
+        self._end_at_4gb = fdt_util.GetBool(self._node, 'end-at-4gb')
         self._skip_at_start = fdt_util.GetInt(self._node, 'skip-at-start')
-        if self._end_4gb:
+        if self._end_at_4gb:
             if not self.size:
                 self.Raise("Section size must be provided when using end-at-4gb")
             if self._skip_at_start is not None:
@@ -801,7 +801,7 @@ class Entry_section(Entry):
         if not entry:
             self._Raise("Unable to set offset/size for unknown entry '%s'" %
                         name)
-        entry.SetOffsetSize(self._skip_at_start + offset if offset is not None
+        entry.SetOffsetSize(offset + self._skip_at_start if offset is not None
                             else None, size)
 
     def GetEntryOffsets(self):

tools/binman/ftest.py

@@ -2308,16 +2308,17 @@ class TestFunctional(unittest.TestCase):
         fhdr, fentries = fmap_util.DecodeFmap(data[32:])
 
         self.assertEqual(0x100, fhdr.image_size)
+        base = (1 << 32) - 0x100
 
-        self.assertEqual(0, fentries[0].offset)
+        self.assertEqual(base, fentries[0].offset)
         self.assertEqual(4, fentries[0].size)
         self.assertEqual(b'U_BOOT', fentries[0].name)
 
-        self.assertEqual(4, fentries[1].offset)
+        self.assertEqual(base + 4, fentries[1].offset)
         self.assertEqual(3, fentries[1].size)
         self.assertEqual(b'INTEL_MRC', fentries[1].name)
 
-        self.assertEqual(32, fentries[2].offset)
+        self.assertEqual(base + 32, fentries[2].offset)
         self.assertEqual(fmap_util.FMAP_HEADER_LEN +
                          fmap_util.FMAP_AREA_LEN * 3, fentries[2].size)
         self.assertEqual(b'FMAP', fentries[2].name)
@@ -2330,27 +2331,28 @@ class TestFunctional(unittest.TestCase):
         fhdr, fentries = fmap_util.DecodeFmap(data[36:])
 
         self.assertEqual(0x180, fhdr.image_size)
+        base = (1 << 32) - 0x180
         expect_size = fmap_util.FMAP_HEADER_LEN + fmap_util.FMAP_AREA_LEN * 4
         fiter = iter(fentries)
 
         fentry = next(fiter)
         self.assertEqual(b'U_BOOT', fentry.name)
-        self.assertEqual(0, fentry.offset)
+        self.assertEqual(base, fentry.offset)
         self.assertEqual(4, fentry.size)
 
         fentry = next(fiter)
         self.assertEqual(b'SECTION', fentry.name)
-        self.assertEqual(4, fentry.offset)
+        self.assertEqual(base + 4, fentry.offset)
         self.assertEqual(0x20 + expect_size, fentry.size)
 
         fentry = next(fiter)
         self.assertEqual(b'INTEL_MRC', fentry.name)
-        self.assertEqual(4, fentry.offset)
+        self.assertEqual(base + 4, fentry.offset)
         self.assertEqual(3, fentry.size)
 
         fentry = next(fiter)
         self.assertEqual(b'FMAP', fentry.name)
-        self.assertEqual(36, fentry.offset)
+        self.assertEqual(base + 36, fentry.offset)
         self.assertEqual(expect_size, fentry.size)
 
     def testElf(self):
@@ -3546,8 +3548,8 @@ class TestFunctional(unittest.TestCase):
         image = control.images['image']
         entries = image.GetEntries()
         desc = entries['intel-descriptor']
-        self.assertEqual(0xff800000, desc.offset);
+        self.assertEqual(0xff800000, desc.offset)
-        self.assertEqual(0xff800000, desc.image_pos);
+        self.assertEqual(0xff800000, desc.image_pos)
 
     def testReplaceCbfs(self):
         """Test replacing a single file in CBFS without changing the size"""
@@ -3789,8 +3791,8 @@ class TestFunctional(unittest.TestCase):
 
         image = control.images['image']
         entries = image.GetEntries()
-        expected_ptr = entries['intel-fit'].image_pos - (1 << 32)
+        expected_ptr = entries['intel-fit'].image_pos #- (1 << 32)
-        self.assertEqual(expected_ptr, ptr)
+        self.assertEqual(expected_ptr, ptr + (1 << 32))
 
     def testPackIntelFitMissing(self):
         """Test detection of a FIT pointer with not FIT region"""
@@ -4784,7 +4786,7 @@ class TestFunctional(unittest.TestCase):
         entry = image.GetEntries()['fdtmap']
         self.assertEqual(orig_entry.offset, entry.offset)
         self.assertEqual(orig_entry.size, entry.size)
-        self.assertEqual(16, entry.image_pos)
+        self.assertEqual((1 << 32) - 0x400 + 16, entry.image_pos)
 
         u_boot = image.GetEntries()['section'].GetEntries()['u-boot']