Merge branch 'master' of git://git.denx.de/u-boot

Signed-off-by: Stefano Babic <sbabic@denx.de>

17 files changed, 431 insertions, 57 deletions

diff --git a/lib/Kconfig b/lib/Kconfig
index 034af724b5d..70bf8e7a464 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -373,7 +373,6 @@ config SHA256
 	  The SHA256 algorithm produces a 256-bit (32-byte) hash value
 	  (digest).
 
-
 config SHA512
 	bool "Enable SHA512 support"
 	help
@@ -399,6 +398,66 @@ config SHA_HW_ACCEL
 	  hashing algorithms. This affects the 'hash' command and also the
 	  hash_lookup_algo() function.
 
+if SPL
+
+config SPL_SHA1
+	bool "Enable SHA1 support in SPL"
+	default y if SHA1
+	help
+	  This option enables support of hashing using SHA1 algorithm.
+	  The hash is calculated in software.
+	  The SHA1 algorithm produces a 160-bit (20-byte) hash value
+	  (digest).
+
+config SPL_SHA256
+	bool "Enable SHA256 support in SPL"
+	default y if SHA256
+	help
+	  This option enables support of hashing using SHA256 algorithm.
+	  The hash is calculated in software.
+	  The SHA256 algorithm produces a 256-bit (32-byte) hash value
+	  (digest).
+
+config SPL_SHA512
+	bool "Enable SHA512 support in SPL"
+	default y if SHA512
+	help
+	  This option enables support of hashing using SHA512 algorithm.
+	  The hash is calculated in software.
+	  The SHA512 algorithm produces a 512-bit (64-byte) hash value
+	  (digest).
+
+config SPL_SHA384
+	bool "Enable SHA384 support in SPL"
+	default y if SHA384
+	select SPL_SHA512
+	help
+	  This option enables support of hashing using SHA384 algorithm.
+	  The hash is calculated in software. This is also selects SHA512,
+	  because these implementations share the bulk of the code..
+	  The SHA384 algorithm produces a 384-bit (48-byte) hash value
+	  (digest).
+
+config SPL_SHA_HW_ACCEL
+	bool "Enable hardware acceleration for SHA hash functions"
+	default y if SHA_HW_ACCEL
+	help
+	  This option enables hardware acceleration for the SHA1 and SHA256
+	  hashing algorithms. This affects the 'hash' command and also the
+	  hash_lookup_algo() function.
+
+config SPL_SHA_PROG_HW_ACCEL
+	bool "Enable Progressive hashing support using hardware in SPL"
+	depends on SHA_PROG_HW_ACCEL
+	default y
+	help
+	  This option enables hardware-acceleration for SHA progressive
+	  hashing.
+	  Data can be streamed in a block at a time and the hashing is
+	  performed in hardware.
+
+endif
+
 if SHA_HW_ACCEL
 
 config SHA512_HW_ACCEL
@@ -437,6 +496,11 @@ config SPL_MD5
 	  security applications, but it can be useful for providing a quick
 	  checksum of a block of data.
 
+config CRC32
+	def_bool y
+	help
+	  Enables CRC32 support in U-Boot. This is normally required.
+
 config CRC32C
 	bool
 
diff --git a/lib/Makefile b/lib/Makefile
index 962470f4962..5ddbc77ed6d 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -96,9 +96,7 @@ obj-y += display_options.o
 CFLAGS_display_options.o := $(if $(BUILD_TAG),-DBUILD_TAG='"$(BUILD_TAG)"')
 obj-$(CONFIG_BCH) += bch.o
 obj-$(CONFIG_MMC_SPI) += crc7.o
-#ifndef CONFIG_TPL_BUILD
-obj-y += crc32.o
-#endif
+obj-$(CONFIG_$(SPL_TPL_)CRC32) += crc32.o
 obj-$(CONFIG_CRC32C) += crc32c.o
 obj-y += ctype.o
 obj-y += div64.o
@@ -134,6 +132,7 @@ obj-$(CONFIG_OID_REGISTRY) += oid_registry.o
 obj-$(CONFIG_SSCANF) += sscanf.o
 endif
 
+obj-y += abuf.o
 obj-y += date.o
 obj-y += rtc-lib.o
 obj-$(CONFIG_LIB_ELF) += elf.o
diff --git a/lib/abuf.c b/lib/abuf.c
new file mode 100644
index 00000000000..4b17e0b8c0d
--- /dev/null
+++ b/lib/abuf.c
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Handles a buffer that can be allocated and freed
+ *
+ * Copyright 2021 Google LLC
+ * Written by Simon Glass <sjg@chromium.org>
+ */
+
+#include <common.h>
+#include <abuf.h>
+#include <malloc.h>
+#include <mapmem.h>
+#include <string.h>
+
+void abuf_set(struct abuf *abuf, void *data, size_t size)
+{
+	abuf_uninit(abuf);
+	abuf->data = data;
+	abuf->size = size;
+}
+
+void abuf_map_sysmem(struct abuf *abuf, ulong addr, size_t size)
+{
+	abuf_set(abuf, map_sysmem(addr, size), size);
+}
+
+bool abuf_realloc(struct abuf *abuf, size_t new_size)
+{
+	void *ptr;
+
+	if (!new_size) {
+		/* easy case, just need to uninit, freeing any allocation */
+		abuf_uninit(abuf);
+		return true;
+	} else if (abuf->alloced) {
+		/* currently allocated, so need to reallocate */
+		ptr = realloc(abuf->data, new_size);
+		if (!ptr)
+			return false;
+		abuf->data = ptr;
+		abuf->size = new_size;
+		return true;
+	} else if (new_size <= abuf->size) {
+		/*
+		 * not currently alloced and new size is no larger. Just update
+		 * it. Data is lost off the end if new_size < abuf->size
+		 */
+		abuf->size = new_size;
+		return true;
+	} else {
+		/* not currently allocated and new size is larger. Alloc and
+		 * copy in data. The new space is not inited.
+		 */
+		ptr = memdup(abuf->data, new_size);
+		if (!ptr)
+			return false;
+		abuf->data = ptr;
+		abuf->size = new_size;
+		abuf->alloced = true;
+		return true;
+	}
+}
+
+void *abuf_uninit_move(struct abuf *abuf, size_t *sizep)
+{
+	void *ptr;
+
+	if (sizep)
+		*sizep = abuf->size;
+	if (!abuf->size)
+		return NULL;
+	if (abuf->alloced) {
+		ptr = abuf->data;
+	} else {
+		ptr = memdup(abuf->data, abuf->size);
+		if (!ptr)
+			return NULL;
+	}
+	/* Clear everything out so there is no record of the data */
+	abuf_init(abuf);
+
+	return ptr;
+}
+
+void abuf_init_set(struct abuf *abuf, void *data, size_t size)
+{
+	abuf_init(abuf);
+	abuf_set(abuf, data, size);
+}
+
+void abuf_init_move(struct abuf *abuf, void *data, size_t size)
+{
+	abuf_init_set(abuf, data, size);
+	abuf->alloced = true;
+}
+
+void abuf_uninit(struct abuf *abuf)
+{
+	if (abuf->alloced)
+		free(abuf->data);
+	abuf_init(abuf);
+}
+
+void abuf_init(struct abuf *abuf)
+{
+	abuf->data = NULL;
+	abuf->size = 0;
+	abuf->alloced = false;
+}
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 3d5a5cd189e..83d584a60e5 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -336,7 +336,7 @@ config EFI_LOAD_FILE2_INITRD
 
 config EFI_SECURE_BOOT
 	bool "Enable EFI secure boot support"
-	depends on EFI_LOADER
+	depends on EFI_LOADER && FIT_SIGNATURE
 	select HASH
 	select SHA256
 	select RSA
diff --git a/lib/efi_loader/efi_gop.c b/lib/efi_loader/efi_gop.c
index 1206b2d7a2c..7683a34a965 100644
--- a/lib/efi_loader/efi_gop.c
+++ b/lib/efi_loader/efi_gop.c
@@ -64,6 +64,27 @@ out:
 	return EFI_EXIT(ret);
 }
 
+static __always_inline struct efi_gop_pixel efi_vid30_to_blt_col(u32 vid)
+{
+	struct efi_gop_pixel blt = {
+		.reserved = 0,
+	};
+
+	blt.blue  = (vid & 0x3ff) >> 2;
+	vid >>= 10;
+	blt.green = (vid & 0x3ff) >> 2;
+	vid >>= 10;
+	blt.red   = (vid & 0x3ff) >> 2;
+	return blt;
+}
+
+static __always_inline u32 efi_blt_col_to_vid30(struct efi_gop_pixel *blt)
+{
+	return (u32)(blt->red   << 2) << 20 |
+	       (u32)(blt->green << 2) << 10 |
+	       (u32)(blt->blue  << 2);
+}
+
 static __always_inline struct efi_gop_pixel efi_vid16_to_blt_col(u16 vid)
 {
 	struct efi_gop_pixel blt = {
@@ -191,6 +212,9 @@ static __always_inline efi_status_t gop_blt_int(struct efi_gop *this,
 				if (vid_bpp == 32)
 					pix = *(struct efi_gop_pixel *)&fb32[
 						slineoff + j + sx];
+				else if (vid_bpp == 30)
+					pix = efi_vid30_to_blt_col(fb32[
+						slineoff + j + sx]);
 				else
 					pix = efi_vid16_to_blt_col(fb16[
 						slineoff + j + sx]);
@@ -207,6 +231,9 @@ static __always_inline efi_status_t gop_blt_int(struct efi_gop *this,
 			case EFI_BLT_VIDEO_TO_VIDEO:
 				if (vid_bpp == 32)
 					fb32[dlineoff + j + dx] = *(u32 *)&pix;
+				else if (vid_bpp == 30)
+					fb32[dlineoff + j + dx] =
+						efi_blt_col_to_vid30(&pix);
 				else
 					fb16[dlineoff + j + dx] =
 						efi_blt_col_to_vid16(&pix);
@@ -231,7 +258,10 @@ static efi_uintn_t gop_get_bpp(struct efi_gop *this)
 #else
 	case LCD_COLOR32:
 #endif
-		vid_bpp = 32;
+		if (gopobj->info.pixel_format == EFI_GOT_BGRA8)
+			vid_bpp = 32;
+		else
+			vid_bpp = 30;
 		break;
 #ifdef CONFIG_DM_VIDEO
 	case VIDEO_BPP16:
@@ -277,6 +307,17 @@ static efi_status_t gop_blt_buf_to_vid16(struct efi_gop *this,
 			   dy, width, height, delta, 16);
 }
 
+static efi_status_t gop_blt_buf_to_vid30(struct efi_gop *this,
+					 struct efi_gop_pixel *buffer,
+					 u32 foo, efi_uintn_t sx,
+					 efi_uintn_t sy, efi_uintn_t dx,
+					 efi_uintn_t dy, efi_uintn_t width,
+					 efi_uintn_t height, efi_uintn_t delta)
+{
+	return gop_blt_int(this, buffer, EFI_BLT_BUFFER_TO_VIDEO, sx, sy, dx,
+			   dy, width, height, delta, 30);
+}
+
 static efi_status_t gop_blt_buf_to_vid32(struct efi_gop *this,
 					 struct efi_gop_pixel *buffer,
 					 u32 foo, efi_uintn_t sx,
@@ -394,6 +435,10 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, struct efi_gop_pixel *buffer,
 			ret = gop_blt_buf_to_vid32(this, buffer, operation, sx,
 						   sy, dx, dy, width, height,
 						   delta);
+		else if (vid_bpp == 30)
+			ret = gop_blt_buf_to_vid30(this, buffer, operation, sx,
+						   sy, dx, dy, width, height,
+						   delta);
 		else
 			ret = gop_blt_buf_to_vid16(this, buffer, operation, sx,
 						   sy, dx, dy, width, height,
@@ -432,7 +477,7 @@ efi_status_t EFIAPI gop_blt(struct efi_gop *this, struct efi_gop_pixel *buffer,
 efi_status_t efi_gop_register(void)
 {
 	struct efi_gop_obj *gopobj;
-	u32 bpix, col, row;
+	u32 bpix, format, col, row;
 	u64 fb_base, fb_size;
 	void *fb;
 	efi_status_t ret;
@@ -449,6 +494,7 @@ efi_status_t efi_gop_register(void)
 
 	priv = dev_get_uclass_priv(vdev);
 	bpix = priv->bpix;
+	format = priv->format;
 	col = video_get_xsize(vdev);
 	row = video_get_ysize(vdev);
 	fb_base = (uintptr_t)priv->fb;
@@ -458,6 +504,7 @@ efi_status_t efi_gop_register(void)
 	int line_len;
 
 	bpix = panel_info.vl_bpix;
+	format = VIDEO_UNKNOWN;
 	col = panel_info.vl_col;
 	row = panel_info.vl_row;
 	fb_base = gd->fb_base;
@@ -517,7 +564,15 @@ efi_status_t efi_gop_register(void)
 	if (bpix == LCD_COLOR32)
 #endif
 	{
-		gopobj->info.pixel_format = EFI_GOT_BGRA8;
+		if (format == VIDEO_X2R10G10B10) {
+			gopobj->info.pixel_format = EFI_GOT_BITMASK;
+			gopobj->info.pixel_bitmask[0] = 0x3ff00000; /* red */
+			gopobj->info.pixel_bitmask[1] = 0x000ffc00; /* green */
+			gopobj->info.pixel_bitmask[2] = 0x000003ff; /* blue */
+			gopobj->info.pixel_bitmask[3] = 0xc0000000; /* reserved */
+		} else {
+			gopobj->info.pixel_format = EFI_GOT_BGRA8;
+		}
 	} else {
 		gopobj->info.pixel_format = EFI_GOT_BITMASK;
 		gopobj->info.pixel_bitmask[0] = 0xf800; /* red */
diff --git a/lib/fdtdec.c b/lib/fdtdec.c
index af92e65bde6..959b337cdc8 100644
--- a/lib/fdtdec.c
+++ b/lib/fdtdec.c
@@ -1293,7 +1293,8 @@ static int fdtdec_init_reserved_memory(void *blob)
 
 int fdtdec_add_reserved_memory(void *blob, const char *basename,
 			       const struct fdt_memory *carveout,
-			       uint32_t *phandlep, bool no_map)
+			       const char **compatibles, unsigned int count,
+			       uint32_t *phandlep, unsigned long flags)
 {
 	fdt32_t cells[4] = {}, *ptr = cells;
 	uint32_t upper, lower, phandle;
@@ -1363,6 +1364,12 @@ int fdtdec_add_reserved_memory(void *blob, const char *basename,
 	if (node < 0)
 		return node;
 
+	if (flags & FDTDEC_RESERVED_MEMORY_NO_MAP) {
+		err = fdt_setprop(blob, node, "no-map", NULL, 0);
+		if (err < 0)
+			return err;
+	}
+
 	if (phandlep) {
 		err = fdt_generate_phandle(blob, &phandle);
 		if (err < 0)
@@ -1393,8 +1400,24 @@ int fdtdec_add_reserved_memory(void *blob, const char *basename,
 	if (err < 0)
 		return err;
 
-	if (no_map) {
-		err = fdt_setprop(blob, node, "no-map", NULL, 0);
+	if (compatibles && count > 0) {
+		size_t length = 0, len = 0;
+		unsigned int i;
+		char *buffer;
+
+		for (i = 0; i < count; i++)
+			length += strlen(compatibles[i]) + 1;
+
+		buffer = malloc(length);
+		if (!buffer)
+			return -FDT_ERR_INTERNAL;
+
+		for (i = 0; i < count; i++)
+			len += strlcpy(buffer + len, compatibles[i],
+				       length - len) + 1;
+
+		err = fdt_setprop(blob, node, "compatible", buffer, length);
+		free(buffer);
 		if (err < 0)
 			return err;
 	}
@@ -1406,8 +1429,11 @@ int fdtdec_add_reserved_memory(void *blob, const char *basename,
 	return 0;
 }
 
-int fdtdec_get_carveout(const void *blob, const char *node, const char *name,
-			unsigned int index, struct fdt_memory *carveout)
+int fdtdec_get_carveout(const void *blob, const char *node,
+			const char *prop_name, unsigned int index,
+			struct fdt_memory *carveout, const char **name,
+			const char ***compatiblesp, unsigned int *countp,
+			unsigned long *flags)
 {
 	const fdt32_t *prop;
 	uint32_t phandle;
@@ -1418,9 +1444,9 @@ int fdtdec_get_carveout(const void *blob, const char *node, const char *name,
 	if (offset < 0)
 		return offset;
 
-	prop = fdt_getprop(blob, offset, name, &len);
+	prop = fdt_getprop(blob, offset, prop_name, &len);
 	if (!prop) {
-		debug("failed to get %s for %s\n", name, node);
+		debug("failed to get %s for %s\n", prop_name, node);
 		return -FDT_ERR_NOTFOUND;
 	}
 
@@ -1431,7 +1457,7 @@ int fdtdec_get_carveout(const void *blob, const char *node, const char *name,
 
 	if (len < (sizeof(phandle) * (index + 1))) {
 		debug("invalid phandle index\n");
-		return -FDT_ERR_BADPHANDLE;
+		return -FDT_ERR_NOTFOUND;
 	}
 
 	phandle = fdt32_to_cpu(prop[index]);
@@ -1442,6 +1468,48 @@ int fdtdec_get_carveout(const void *blob, const char *node, const char *name,
 		return offset;
 	}
 
+	if (name)
+		*name = fdt_get_name(blob, offset, NULL);
+
+	if (compatiblesp) {
+		const char **compatibles = NULL;
+		const char *start, *end, *ptr;
+		unsigned int count = 0;
+
+		prop = fdt_getprop(blob, offset, "compatible", &len);
+		if (!prop)
+			goto skip_compat;
+
+		start = ptr = (const char *)prop;
+		end = start + len;
+
+		while (ptr < end) {
+			ptr = strchrnul(ptr, '\0');
+			count++;
+			ptr++;
+		}
+
+		compatibles = malloc(sizeof(ptr) * count);
+		if (!compatibles)
+			return -FDT_ERR_INTERNAL;
+
+		ptr = start;
+		count = 0;
+
+		while (ptr < end) {
+			compatibles[count] = ptr;
+			ptr = strchrnul(ptr, '\0');
+			count++;
+			ptr++;
+		}
+
+skip_compat:
+		*compatiblesp = compatibles;
+
+		if (countp)
+			*countp = count;
+	}
+
 	carveout->start = fdtdec_get_addr_size_auto_noparent(blob, offset,
 							     "reg", 0, &size,
 							     true);
@@ -1452,19 +1520,28 @@ int fdtdec_get_carveout(const void *blob, const char *node, const char *name,
 
 	carveout->end = carveout->start + size - 1;
 
+	if (flags) {
+		*flags = 0;
+
+		if (fdtdec_get_bool(blob, offset, "no-map"))
+			*flags |= FDTDEC_RESERVED_MEMORY_NO_MAP;
+	}
+
 	return 0;
 }
 
 int fdtdec_set_carveout(void *blob, const char *node, const char *prop_name,
-			unsigned int index, const char *name,
-			const struct fdt_memory *carveout)
+			unsigned int index, const struct fdt_memory *carveout,
+			const char *name, const char **compatibles,
+			unsigned int count, unsigned long flags)
 {
 	uint32_t phandle;
 	int err, offset, len;
 	fdt32_t value;
 	void *prop;
 
-	err = fdtdec_add_reserved_memory(blob, name, carveout, &phandle, false);
+	err = fdtdec_add_reserved_memory(blob, name, carveout, compatibles,
+					 count, &phandle, flags);
 	if (err < 0) {
 		debug("failed to add reserved memory: %d\n", err);
 		return err;
@@ -1536,8 +1613,6 @@ int fdtdec_setup(void)
 		puts("Failed to read control FDT\n");
 		return -1;
 	}
-# elif defined(CONFIG_OF_PRIOR_STAGE)
-	gd->fdt_blob = (void *)(uintptr_t)prior_stage_fdt_address;
 # endif
 # ifndef CONFIG_SPL_BUILD
 	/* Allow the early environment to override the fdt address */
diff --git a/lib/fdtdec_test.c b/lib/fdtdec_test.c
index e0c6e0971cd..85351c75ca2 100644
--- a/lib/fdtdec_test.c
+++ b/lib/fdtdec_test.c
@@ -189,8 +189,8 @@ static int make_fdt_carveout_device(void *fdt, uint32_t na, uint32_t ns)
 	offset = CHECK(fdt_add_subnode(fdt, 0, name + 1));
 	CHECK(fdt_setprop(fdt, offset, "reg", cells, (na + ns) * sizeof(*cells)));
 
-	return fdtdec_set_carveout(fdt, name, "memory-region", 0,
-				   "framebuffer", &carveout);
+	return fdtdec_set_carveout(fdt, name, "memory-region", 0, &carveout,
+				   "framebuffer", NULL, 0, 0);
 }
 
 static int check_fdt_carveout(void *fdt, uint32_t address_cells,
@@ -214,7 +214,8 @@ static int check_fdt_carveout(void *fdt, uint32_t address_cells,
 	printf("carveout: %pap-%pap na=%u ns=%u: ", &expected.start,
 	       &expected.end, address_cells, size_cells);
 
-	CHECK(fdtdec_get_carveout(fdt, name, "memory-region", 0, &carveout));
+	CHECK(fdtdec_get_carveout(fdt, name, "memory-region", 0, &carveout,
+				  NULL, NULL, NULL, NULL));
 
 	if ((carveout.start != expected.start) ||
 	    (carveout.end != expected.end)) {
diff --git a/lib/gunzip.c b/lib/gunzip.c
index bee3b9261f3..a8e498d98d8 100644
--- a/lib/gunzip.c
+++ b/lib/gunzip.c
@@ -84,32 +84,32 @@ int gunzip(void *dst, int dstlen, unsigned char *src, unsigned long *lenp)
 
 #ifdef CONFIG_CMD_UNZIP
 __weak
-void gzwrite_progress_init(u64 expectedsize)
+void gzwrite_progress_init(ulong expectedsize)
 {
 	putc('\n');
 }
 
 __weak
 void gzwrite_progress(int iteration,
-		     u64 bytes_written,
-		     u64 total_bytes)
+		     ulong bytes_written,
+		     ulong total_bytes)
 {
 	if (0 == (iteration & 3))
-		printf("%llu/%llu\r", bytes_written, total_bytes);
+		printf("%lu/%lu\r", bytes_written, total_bytes);
 }
 
 __weak
 void gzwrite_progress_finish(int returnval,
-			     u64 bytes_written,
-			     u64 total_bytes,
+			     ulong bytes_written,
+			     ulong total_bytes,
 			     u32 expected_crc,
 			     u32 calculated_crc)
 {
 	if (0 == returnval) {
-		printf("\n\t%llu bytes, crc 0x%08x\n",
+		printf("\n\t%lu bytes, crc 0x%08x\n",
 		       total_bytes, calculated_crc);
 	} else {
-		printf("\n\tuncompressed %llu of %llu\n"
+		printf("\n\tuncompressed %lu of %lu\n"
 		       "\tcrcs == 0x%08x/0x%08x\n",
 		       bytes_written, total_bytes,
 		       expected_crc, calculated_crc);
@@ -119,15 +119,15 @@ void gzwrite_progress_finish(int returnval,
 int gzwrite(unsigned char *src, int len,
 	    struct blk_desc *dev,
 	    unsigned long szwritebuf,
-	    u64 startoffs,
-	    u64 szexpected)
+	    ulong startoffs,
+	    ulong szexpected)
 {
 	int i, flags;
 	z_stream s;
 	int r = 0;
 	unsigned char *writebuf;
 	unsigned crc = 0;
-	u64 totalfilled = 0;
+	ulong totalfilled = 0;
 	lbaint_t blksperbuf, outblock;
 	u32 expected_crc;
 	u32 payload_size;
@@ -142,7 +142,7 @@ int gzwrite(unsigned char *src, int len,
 	}
 
 	if (startoffs & (dev->blksz-1)) {
-		printf("%s: start offset %llu not a multiple of %lu\n",
+		printf("%s: start offset %lu not a multiple of %lu\n",
 		       __func__, startoffs, dev->blksz);
 		return -1;
 	}
@@ -182,12 +182,12 @@ int gzwrite(unsigned char *src, int len,
 	if (szexpected == 0) {
 		szexpected = le32_to_cpu(szuncompressed);
 	} else if (szuncompressed != (u32)szexpected) {
-		printf("size of %llx doesn't match trailer low bits %x\n",
+		printf("size of %lx doesn't match trailer low bits %x\n",
 		       szexpected, szuncompressed);
 		return -1;
 	}
 	if (lldiv(szexpected, dev->blksz) > (dev->lba - outblock)) {
-		printf("%s: uncompressed size %llu exceeds device size\n",
+		printf("%s: uncompressed size %lu exceeds device size\n",
 		       __func__, szexpected);
 		return -1;
 	}
diff --git a/lib/hash-checksum.c b/lib/hash-checksum.c
index d732ecc38fd..8f2a42f9a08 100644
--- a/lib/hash-checksum.c
+++ b/lib/hash-checksum.c
@@ -17,7 +17,7 @@
 #include <image.h>
 
 int hash_calculate(const char *name,
-		    const struct image_region region[],
+		    const struct image_region *region,
 		    int region_count, uint8_t *checksum)
 {
 	struct hash_algo *algo;
diff --git a/lib/lmb.c b/lib/lmb.c
index 793647724c3..676b3a0bda6 100644
--- a/lib/lmb.c
+++ b/lib/lmb.c
@@ -153,7 +153,7 @@ static void lmb_reserve_common(struct lmb *lmb, void *fdt_blob)
 	arch_lmb_reserve(lmb);
 	board_lmb_reserve(lmb);
 
-	if (IMAGE_ENABLE_OF_LIBFDT && fdt_blob)
+	if (CONFIG_IS_ENABLED(OF_LIBFDT) && fdt_blob)
 		boot_fdt_add_mem_rsv_regions(lmb, fdt_blob);
 }
 
diff --git a/lib/lz4_wrapper.c b/lib/lz4_wrapper.c
index cdbcd05bd43..ebcb5c09a22 100644
--- a/lib/lz4_wrapper.c
+++ b/lib/lz4_wrapper.c
@@ -6,10 +6,10 @@
 #include <common.h>
 #include <compiler.h>
 #include <image.h>
-#include <lz4.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <asm/unaligned.h>
+#include <u-boot/lz4.h>
 
 static u16 LZ4_readLE16(const void *src)
 {
diff --git a/lib/optee/optee.c b/lib/optee/optee.c
index 766d0d9e3fa..b0362240446 100644
--- a/lib/optee/optee.c
+++ b/lib/optee/optee.c
@@ -161,6 +161,7 @@ int optee_copy_fdt_nodes(void *new_blob)
 					.start = res.start,
 					.end = res.end,
 				};
+				unsigned long flags = FDTDEC_RESERVED_MEMORY_NO_MAP;
 				char *oldname, *nodename, *tmp;
 
 				oldname = strdup(name);
@@ -177,7 +178,8 @@ int optee_copy_fdt_nodes(void *new_blob)
 				ret = fdtdec_add_reserved_memory(new_blob,
 								 nodename,
 								 &carveout,
-								 NULL, true);
+								 NULL, 0,
+								 NULL, flags);
 				free(oldname);
 
 				if (ret < 0)
diff --git a/lib/rsa/rsa-sign.c b/lib/rsa/rsa-sign.c
index c27a784c429..0579e5294ee 100644
--- a/lib/rsa/rsa-sign.c
+++ b/lib/rsa/rsa-sign.c
@@ -401,15 +401,14 @@ static int rsa_sign_with_key(EVP_PKEY *pkey, struct padding_algo *padding_algo,
 		goto err_sign;
 	}
 
-#ifdef CONFIG_FIT_RSASSA_PSS
-	if (padding_algo && !strcmp(padding_algo->name, "pss")) {
+	if (CONFIG_IS_ENABLED(FIT_RSASSA_PSS) && padding_algo &&
+	    !strcmp(padding_algo->name, "pss")) {
 		if (EVP_PKEY_CTX_set_rsa_padding(ckey,
 						 RSA_PKCS1_PSS_PADDING) <= 0) {
 			ret = rsa_err("Signer padding setup failed");
 			goto err_sign;
 		}
 	}
-#endif /* CONFIG_FIT_RSASSA_PSS */
 
 	for (i = 0; i < region_count; i++) {
 		if (!EVP_DigestSignUpdate(context, region[i].data,
diff --git a/lib/rsa/rsa-verify.c b/lib/rsa/rsa-verify.c
index ad6d33d043a..600c93ab810 100644
--- a/lib/rsa/rsa-verify.c
+++ b/lib/rsa/rsa-verify.c
@@ -102,7 +102,7 @@ U_BOOT_PADDING_ALGO(pkcs_15) = {
 };
 #endif
 
-#ifdef CONFIG_FIT_RSASSA_PSS
+#if CONFIG_IS_ENABLED(FIT_RSASSA_PSS)
 static void u32_i2osp(uint32_t val, uint8_t *buf)
 {
 	buf[0] = (uint8_t)((val >> 24) & 0xff);
@@ -313,7 +313,6 @@ U_BOOT_PADDING_ALGO(pss) = {
 
 #endif
 
-#if CONFIG_IS_ENABLED(FIT_SIGNATURE) || CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY)
 /**
  * rsa_verify_key() - Verify a signature against some data using RSA Key
  *
@@ -385,9 +384,7 @@ static int rsa_verify_key(struct image_sign_info *info,
 
 	return 0;
 }
-#endif
 
-#if CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY)
 /**
  * rsa_verify_with_pkey() - Verify a signature against some data using
  * only modulus and exponent as RSA key properties.
@@ -408,6 +405,9 @@ int rsa_verify_with_pkey(struct image_sign_info *info,
 	struct key_prop *prop;
 	int ret;
 
+	if (!CONFIG_IS_ENABLED(RSA_VERIFY_WITH_PKEY))
+		return -EACCES;
+
 	/* Public key is self-described to fill key_prop */
 	ret = rsa_gen_key_prop(info->key, info->keylen, &prop);
 	if (ret) {
@@ -422,13 +422,6 @@ int rsa_verify_with_pkey(struct image_sign_info *info,
 
 	return ret;
 }
-#else
-int rsa_verify_with_pkey(struct image_sign_info *info,
-			 const void *hash, uint8_t *sig, uint sig_len)
-{
-	return -EACCES;
-}
-#endif
 
 #if CONFIG_IS_ENABLED(FIT_SIGNATURE)
 /**
diff --git a/lib/string.c b/lib/string.c
index ba176fb08f7..78bd65c4136 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -659,6 +659,19 @@ void * memscan(void * addr, int c, size_t size)
 }
 #endif
 
+char *memdup(const void *src, size_t len)
+{
+	char *p;
+
+	p = malloc(len);
+	if (!p)
+		return NULL;
+
+	memcpy(p, src, len);
+
+	return p;
+}
+
 #ifndef __HAVE_ARCH_STRSTR
 /**
  * strstr - Find the first substring in a %NUL terminated string
diff --git a/lib/zstd/Makefile b/lib/zstd/Makefile
index 33c1df48ec8..12170892923 100644
--- a/lib/zstd/Makefile
+++ b/lib/zstd/Makefile
@@ -1,4 +1,4 @@
 obj-y += zstd_decompress.o
 
 zstd_decompress-y := huf_decompress.o decompress.o \
-		     entropy_common.o fse_decompress.o zstd_common.o
+		     entropy_common.o fse_decompress.o zstd_common.o zstd.o
diff --git a/lib/zstd/zstd.c b/lib/zstd/zstd.c
new file mode 100644
index 00000000000..bf9cd19cfa3
--- /dev/null
+++ b/lib/zstd/zstd.c
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright 2021 Google LLC
+ */
+
+#define LOG_CATEGORY	LOGC_BOOT
+
+#include <common.h>
+#include <abuf.h>
+#include <log.h>
+#include <malloc.h>
+#include <linux/zstd.h>
+
+int zstd_decompress(struct abuf *in, struct abuf *out)
+{
+	ZSTD_DStream *dstream;
+	ZSTD_inBuffer in_buf;
+	ZSTD_outBuffer out_buf;
+	void *workspace;
+	size_t wsize;
+	int ret;
+
+	wsize = ZSTD_DStreamWorkspaceBound(abuf_size(in));
+	workspace = malloc(wsize);
+	if (!workspace) {
+		debug("%s: cannot allocate workspace of size %zu\n", __func__,
+			wsize);
+		return -ENOMEM;
+	}
+
+	dstream = ZSTD_initDStream(abuf_size(in), workspace, wsize);
+	if (!dstream) {
+		log_err("%s: ZSTD_initDStream failed\n", __func__);
+		ret = -EPERM;
+		goto do_free;
+	}
+
+	in_buf.src = abuf_data(in);
+	in_buf.pos = 0;
+	in_buf.size = abuf_size(in);
+
+	out_buf.dst = abuf_data(out);
+	out_buf.pos = 0;
+	out_buf.size = abuf_size(out);
+
+	while (1) {
+		size_t res;
+
+		res = ZSTD_decompressStream(dstream, &out_buf, &in_buf);
+		if (ZSTD_isError(res)) {
+			ret = ZSTD_getErrorCode(res);
+			log_err("ZSTD_decompressStream error %d\n", ret);
+			goto do_free;
+		}
+
+		if (in_buf.pos >= abuf_size(in) || !res)
+			break;
+	}
+
+	ret = out_buf.pos;
+do_free:
+	free(workspace);
+	return ret;
+}