Merge branch '2024-01-12-assorted-fixes'

- Allow defconfigs to #include files (so we can construct a defconfig
  from fragments), update phy-mtk-tphy binding, assorted test fixes,
  allow building host tools without cryptographic libraries again,
  android_ab bugfix, and make some SPL debugging cases easier.

20 files changed, 193 insertions, 237 deletions

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 1fd7aacc38..2d4458b7b5 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -79,6 +79,15 @@ config SPL_SYS_NO_VECTOR_TABLE
 	depends on SPL
 	bool
 
+config SPL_USE_SEPARATE_FAULT_HANDLERS
+	bool "Use separate fault handlers instead of a single common one"
+	depends on !SPL_SYS_NO_VECTOR_TABLE && !ARM64 && !CPU_V7M
+	help
+	  Instead of a common fault handler, generate a separate one for
+	  undefined_instruction, software_interrupt, prefetch_abort etc.
+	  This is for debugging purposes, when you want to set breakpoints
+	  on them separately.
+
 config LINUX_KERNEL_IMAGE_HEADER
 	depends on ARM64
 	bool
diff --git a/arch/arm/lib/vectors.S b/arch/arm/lib/vectors.S
index 843f9b9c28..b6b879339d 100644
--- a/arch/arm/lib/vectors.S
+++ b/arch/arm/lib/vectors.S
@@ -138,11 +138,29 @@ _fiq:			.word fiq
 #if !CONFIG_IS_ENABLED(SYS_NO_VECTOR_TABLE)
 	.align	5
 undefined_instruction:
+#if CONFIG_IS_ENABLED(USE_SEPARATE_FAULT_HANDLERS)
+	b	undefined_instruction
+#endif
 software_interrupt:
+#if CONFIG_IS_ENABLED(USE_SEPARATE_FAULT_HANDLERS)
+	b	software_interrupt
+#endif
 prefetch_abort:
+#if CONFIG_IS_ENABLED(USE_SEPARATE_FAULT_HANDLERS)
+	b	prefetch_abort
+#endif
 data_abort:
+#if CONFIG_IS_ENABLED(USE_SEPARATE_FAULT_HANDLERS)
+	b	data_abort
+#endif
 not_used:
+#if CONFIG_IS_ENABLED(USE_SEPARATE_FAULT_HANDLERS)
+	b	not_used
+#endif
 irq:
+#if CONFIG_IS_ENABLED(USE_SEPARATE_FAULT_HANDLERS)
+	b	irq
+#endif
 fiq:
 1:
 	b	1b			/* hang and never return */
diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig
index c80d8587b1..2058c95ca2 100644
--- a/arch/arm/mach-mvebu/Kconfig
+++ b/arch/arm/mach-mvebu/Kconfig
@@ -15,6 +15,7 @@ config ARMADA_32BIT
 	select SUPPORT_SPL
 	select SYS_L2_PL310 if !SYS_L2CACHE_OFF
 	select TRANSLATION_OFFSET
+	select TOOLS_KWBIMAGE if SPL
 	select SPL_SYS_NO_VECTOR_TABLE if SPL
 	select ARCH_VERY_EARLY_INIT
 
diff --git a/board/ti/am335x/u-boot.lds b/board/ti/am335x/u-boot.lds
deleted file mode 100644
index 087dee8bb2..0000000000
--- a/board/ti/am335x/u-boot.lds
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * Copyright (c) 2004-2008 Texas Instruments
- *
- * (C) Copyright 2002
- * Gary Jennejohn, DENX Software Engineering, <garyj@denx.de>
- *
- * See file CREDITS for list of people who contributed to this
- * project.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of
- * the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
- * MA 02111-1307 USA
- */
-
-OUTPUT_FORMAT("elf32-littlearm", "elf32-littlearm", "elf32-littlearm")
-OUTPUT_ARCH(arm)
-ENTRY(_start)
-SECTIONS
-{
-	. = 0x00000000;
-
-	. = ALIGN(4);
-	.text :
-	{
-		*(.__image_copy_start)
-		*(.vectors)
-		CPUDIR/start.o (.text*)
-		board/ti/am335x/built-in.o (.text*)
-	}
-
-	/* This needs to come before *(.text*) */
-	.__efi_runtime_start : {
-		*(.__efi_runtime_start)
-	}
-
-	.efi_runtime : {
-		*(.text.efi_runtime*)
-		*(.rodata.efi_runtime*)
-		*(.data.efi_runtime*)
-	}
-
-	.__efi_runtime_stop : {
-		*(.__efi_runtime_stop)
-	}
-
-	.text_rest :
-	{
-		*(.text*)
-	}
-
-	. = ALIGN(4);
-	.rodata : { *(SORT_BY_ALIGNMENT(SORT_BY_NAME(.rodata*))) }
-
-	. = ALIGN(4);
-	.data : {
-		*(.data*)
-	}
-
-	. = ALIGN(4);
-
-	. = .;
-
-	. = ALIGN(4);
-	__u_boot_list : {
-		KEEP(*(SORT(__u_boot_list*)));
-	}
-
-	. = ALIGN(4);
-
-	.efi_runtime_rel_start :
-	{
-		*(.__efi_runtime_rel_start)
-	}
-
-	.efi_runtime_rel : {
-		*(.rel*.efi_runtime)
-		*(.rel*.efi_runtime.*)
-	}
-
-	.efi_runtime_rel_stop :
-	{
-		*(.__efi_runtime_rel_stop)
-	}
-
-	. = ALIGN(4);
-
-	.image_copy_end :
-	{
-		*(.__image_copy_end)
-	}
-
-	.rel_dyn_start :
-	{
-		*(.__rel_dyn_start)
-	}
-
-	.rel.dyn : {
-		*(.rel*)
-	}
-
-	.rel_dyn_end :
-	{
-		*(.__rel_dyn_end)
-	}
-
-	.hash : { *(.hash*) }
-
-	.end :
-	{
-		*(.__end)
-	}
-
-	_image_binary_end = .;
-
-	/*
-	 * Deprecated: this MMU section is used by pxa at present but
-	 * should not be used by new boards/CPUs.
-	 */
-	. = ALIGN(4096);
-	.mmutable : {
-		*(.mmutable)
-	}
-
-/*
- * Compiler-generated __bss_start and __bss_end, see arch/arm/lib/bss.c
- * __bss_base and __bss_limit are for linker only (overlay ordering)
- */
-
-	.bss_start __rel_dyn_start (OVERLAY) : {
-		KEEP(*(.__bss_start));
-		__bss_base = .;
-	}
-
-	.bss __bss_base (OVERLAY) : {
-		*(.bss*)
-		 . = ALIGN(4);
-		 __bss_limit = .;
-	}
-
-	.bss_end __bss_limit (OVERLAY) : {
-		KEEP(*(.__bss_end));
-	}
-
-	.dynsym _image_binary_end : { *(.dynsym) }
-	.dynbss : { *(.dynbss) }
-	.dynstr : { *(.dynstr*) }
-	.dynamic : { *(.dynamic*) }
-	.gnu.hash : { *(.gnu.hash) }
-	.plt : { *(.plt*) }
-	.interp : { *(.interp*) }
-	.gnu : { *(.gnu*) }
-	.ARM.exidx : { *(.ARM.exidx*) }
-}
diff --git a/boot/Kconfig b/boot/Kconfig
index 9f5b8a0cb2..0894ecf4df 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -1687,7 +1687,7 @@ menu "Configuration editor"
 
 config CEDIT
 	bool "Configuration editor"
-	depends on BOOTSTD
+	depends on EXPO
 	help
 	  Provides a way to deal with board configuration and present it to
 	  the user for adjustment.
diff --git a/boot/Makefile b/boot/Makefile
index a90ebea5a8..a47e002746 100644
--- a/boot/Makefile
+++ b/boot/Makefile
@@ -33,11 +33,11 @@ obj-$(CONFIG_$(SPL_TPL_)BOOTMETH_EFILOADER) += bootmeth_efi.o
 obj-$(CONFIG_$(SPL_TPL_)BOOTMETH_CROS) += bootm.o bootm_os.o bootmeth_cros.o
 obj-$(CONFIG_$(SPL_TPL_)BOOTMETH_SANDBOX) += bootmeth_sandbox.o
 obj-$(CONFIG_$(SPL_TPL_)BOOTMETH_SCRIPT) += bootmeth_script.o
+obj-$(CONFIG_$(SPL_TPL_)CEDIT) += cedit.o
 ifdef CONFIG_$(SPL_TPL_)BOOTSTD_FULL
 obj-$(CONFIG_BOOTEFI_BOOTMGR) += bootmeth_efi_mgr.o
 obj-$(CONFIG_$(SPL_TPL_)EXPO) += bootflow_menu.o
 obj-$(CONFIG_$(SPL_TPL_)BOOTSTD) += bootflow_menu.o
-obj-$(CONFIG_$(SPL_TPL_)CEDIT) += cedit.o
 endif
 
 obj-$(CONFIG_$(SPL_TPL_)OF_LIBFDT) += fdt_support.o
diff --git a/boot/android_ab.c b/boot/android_ab.c
index 0f20a34e51..c9df6d2b4b 100644
--- a/boot/android_ab.c
+++ b/boot/android_ab.c
@@ -336,7 +336,14 @@ int ab_select_slot(struct blk_desc *dev_desc, struct disk_partition *part_info,
 
 	if (store_needed) {
 		abc->crc32_le = ab_control_compute_crc(abc);
-		ab_control_store(dev_desc, part_info, abc, 0);
+		ret = ab_control_store(dev_desc, part_info, abc, 0);
+		if (ret < 0) {
+#if ANDROID_AB_BACKUP_OFFSET
+			free(backup_abc);
+#endif
+			free(abc);
+			return ret;
+		}
 	}
 
 #if ANDROID_AB_BACKUP_OFFSET
@@ -345,8 +352,13 @@ int ab_select_slot(struct blk_desc *dev_desc, struct disk_partition *part_info,
 	 * to the backup offset
 	 */
 	if (memcmp(backup_abc, abc, sizeof(*abc)) != 0) {
-		ab_control_store(dev_desc, part_info, abc,
-				 ANDROID_AB_BACKUP_OFFSET);
+		ret = ab_control_store(dev_desc, part_info, abc,
+				       ANDROID_AB_BACKUP_OFFSET);
+		if (ret < 0) {
+			free(backup_abc);
+			free(abc);
+			return ret;
+		}
 	}
 	free(backup_abc);
 #endif
diff --git a/boot/bootm.c b/boot/bootm.c
index 7a050ed41a..d071537d69 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -644,6 +644,7 @@ static int bootm_load_os(struct bootm_headers *images, int boot_progress)
 		if (!load)
 			return 1;
 		os.load = load;
+		images->ep = load;
 		debug("Allocated %lx bytes at %lx for kernel (size %lx) decompression\n",
 		      req_size, load, image_len);
 	}
diff --git a/doc/device-tree-bindings/phy/phy-mtk-tphy.txt b/doc/device-tree-bindings/phy/phy-mtk-tphy.txt
index 3042c39d09..300e236b5b 100644
--- a/doc/device-tree-bindings/phy/phy-mtk-tphy.txt
+++ b/doc/device-tree-bindings/phy/phy-mtk-tphy.txt
@@ -52,6 +52,15 @@ Optional properties (port (child) node):
 		  "da_ref": the reference clock of analog phy, used if the clocks
 			of analog and digital phys are separated, otherwise uses
 			"ref" clock only if needed.
+- mediatek,eye-vrt	: The selection of VRT reference voltage (U2 phy),
+		  the value is [1, 7]
+- mediatek,eye-term	: The selection of HS_TX TERM reference voltage (U2 phy),
+		  the value is [1, 7]
+- mediatek,discth	: The selection of disconnect threshold (U2 phy),
+		  the value is [1, 15]
+- mediatek,pre-emphasis	: The level of pre-emphasis which used to widen
+		  the eye opening and boost eye swing,
+		  the value is [1, 3]
 
 Example:
 
diff --git a/drivers/phy/phy-mtk-tphy.c b/drivers/phy/phy-mtk-tphy.c
index 1883f9f83e..ea9edf212c 100644
--- a/drivers/phy/phy-mtk-tphy.c
+++ b/drivers/phy/phy-mtk-tphy.c
@@ -47,6 +47,11 @@
 #define PA0_USB20_PLL_PREDIV		GENMASK(7, 6)
 #define PA0_RG_USB20_INTR_EN		BIT(5)
 
+#define U3P_USBPHYACR1			0x004
+#define PA1_RG_INTR_CAL			GENMASK(23, 19)
+#define PA1_RG_VRT_SEL			GENMASK(14, 12)
+#define PA1_RG_TERM_SEL			GENMASK(10, 8)
+
 #define U3P_USBPHYACR2			0x008
 #define PA2_RG_U2PLL_BW			GENMASK(21, 19)
 
@@ -56,8 +61,10 @@
 #define PA5_RG_U2_HS_100U_U3_EN		BIT(11)
 
 #define U3P_USBPHYACR6			0x018
+#define PA6_RG_U2_PRE_EMP		GENMASK(31, 30)
 #define PA6_RG_U2_BC11_SW_EN		BIT(23)
 #define PA6_RG_U2_OTG_VBUSCMP_EN	BIT(20)
+#define PA6_RG_U2_DISCTH		GENMASK(7, 4)
 #define PA6_RG_U2_SQTH			GENMASK(3, 0)
 
 #define U3P_U2PHYACR4			0x020
@@ -240,7 +247,7 @@ struct u3phy_banks {
 
 struct mtk_phy_instance {
 	void __iomem *port_base;
-	const struct device_node *np;
+	struct device_node *np;
 	union {
 		struct u2phy_banks u2_banks;
 		struct u3phy_banks u3_banks;
@@ -250,6 +257,11 @@ struct mtk_phy_instance {
 	struct clk da_ref_clk;	/* reference clock of analog phy */
 	u32 index;
 	u32 type;
+
+	u32 eye_vrt;
+	u32 eye_term;
+	u32 discth;
+	u32 pre_emphasis;
 };
 
 struct mtk_tphy {
@@ -564,6 +576,47 @@ static void phy_v2_banks_init(struct mtk_tphy *tphy,
 	}
 }
 
+static void phy_parse_property(struct mtk_tphy *tphy,
+			       struct mtk_phy_instance *instance)
+{
+	ofnode node = np_to_ofnode(instance->np);
+
+	if (instance->type != PHY_TYPE_USB2)
+		return;
+
+	ofnode_read_u32(node, "mediatek,eye-vrt", &instance->eye_vrt);
+	ofnode_read_u32(node, "mediatek,eye-term", &instance->eye_term);
+	ofnode_read_u32(node, "mediatek,discth", &instance->discth);
+	ofnode_read_u32(node, "mediatek,pre-emphasis", &instance->pre_emphasis);
+
+	dev_dbg(tphy->dev, "vrt:%d, term:%d, disc:%d, emp:%d\n",
+		instance->eye_vrt, instance->eye_term,
+		instance->discth, instance->pre_emphasis);
+}
+
+static void u2_phy_props_set(struct mtk_tphy *tphy,
+			     struct mtk_phy_instance *instance)
+{
+	struct u2phy_banks *u2_banks = &instance->u2_banks;
+	void __iomem *com = u2_banks->com;
+
+	if (instance->eye_vrt)
+		clrsetbits_le32(com + U3P_USBPHYACR1, PA1_RG_VRT_SEL,
+				FIELD_PREP(PA1_RG_VRT_SEL, instance->eye_vrt));
+
+	if (instance->eye_term)
+		clrsetbits_le32(com + U3P_USBPHYACR1, PA1_RG_TERM_SEL,
+				FIELD_PREP(PA1_RG_TERM_SEL, instance->eye_term));
+
+	if (instance->discth)
+		clrsetbits_le32(com + U3P_USBPHYACR6, PA6_RG_U2_DISCTH,
+				FIELD_PREP(PA6_RG_U2_DISCTH, instance->discth));
+
+	if (instance->pre_emphasis)
+		clrsetbits_le32(com + U3P_USBPHYACR6, PA6_RG_U2_PRE_EMP,
+				FIELD_PREP(PA6_RG_U2_PRE_EMP, instance->pre_emphasis));
+}
+
 static int mtk_phy_init(struct phy *phy)
 {
 	struct mtk_tphy *tphy = dev_get_priv(phy->dev);
@@ -586,6 +639,7 @@ static int mtk_phy_init(struct phy *phy)
 	switch (instance->type) {
 	case PHY_TYPE_USB2:
 		u2_phy_instance_init(tphy, instance);
+		u2_phy_props_set(tphy, instance);
 		break;
 	case PHY_TYPE_USB3:
 		u3_phy_instance_init(tphy, instance);
@@ -692,6 +746,8 @@ static int mtk_phy_xlate(struct phy *phy,
 		return -EINVAL;
 	}
 
+	phy_parse_property(tphy, instance);
+
 	return 0;
 }
 
diff --git a/include/image.h b/include/image.h
index 432ec927b1..21de70f0c9 100644
--- a/include/image.h
+++ b/include/image.h
@@ -1465,7 +1465,7 @@ int calculate_hash(const void *data, int data_len, const char *algo,
  * device
  */
 #if defined(USE_HOSTCC)
-# if defined(CONFIG_FIT_SIGNATURE)
+# if CONFIG_IS_ENABLED(FIT_SIGNATURE)
 #  define IMAGE_ENABLE_SIGN	1
 #  define FIT_IMAGE_ENABLE_VERIFY	1
 #  include <openssl/evp.h>
diff --git a/scripts/kconfig/Makefile b/scripts/kconfig/Makefile
index 2d97aab8d2..5ce5845e82 100644
--- a/scripts/kconfig/Makefile
+++ b/scripts/kconfig/Makefile
@@ -93,7 +93,8 @@ endif
 endif
 
 %_defconfig: $(obj)/conf
-	$(Q)$< $(silent) --defconfig=arch/$(SRCARCH)/configs/$@ $(Kconfig)
+	$(Q)$(CPP) -nostdinc -I $(srctree) -undef -x assembler-with-cpp $(srctree)/arch/$(SRCARCH)/configs/$@ -o generated_defconfig
+	$(Q)$< $(silent) --defconfig=generated_defconfig $(Kconfig)
 
 # Added for U-Boot (backward compatibility)
 %_config: %_defconfig
diff --git a/test/Kconfig b/test/Kconfig
index e842c01308..e2ec0994a2 100644
--- a/test/Kconfig
+++ b/test/Kconfig
@@ -67,7 +67,7 @@ endif
 
 config UT_BOOTSTD
 	bool "Unit tests for standard boot"
-	depends on UNIT_TEST && SANDBOX
+	depends on UNIT_TEST && BOOTSTD && SANDBOX
 	default y
 
 config UT_COMPRESSION
diff --git a/test/Makefile b/test/Makefile
index 9aeef02f9e..ed312cd0a4 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -26,7 +26,7 @@ obj-$(CONFIG_UT_TIME) += time_ut.o
 obj-y += ut.o
 
 ifeq ($(CONFIG_SPL_BUILD),)
-obj-$(CONFIG_$(SPL_)UT_BOOTSTD) += boot/
+obj-y += boot/
 obj-$(CONFIG_UNIT_TEST) += common/
 obj-y += log/
 obj-$(CONFIG_$(SPL_)UT_UNICODE) += unicode_ut.o
diff --git a/test/fs/fs-test.sh b/test/fs/fs-test.sh
index dec2634de3..257b50fd06 100755
--- a/test/fs/fs-test.sh
+++ b/test/fs/fs-test.sh
@@ -23,7 +23,7 @@
 # --------------------------------------------
 
 # pre-requisite binaries list.
-PREREQ_BINS="md5sum mkfs mount umount dd fallocate mkdir"
+PREREQ_BINS="sha256sum mkfs mount umount dd fallocate mkdir"
 
 # All generated output files from this test will be in $OUT_DIR
 # Hence everything is sandboxed.
@@ -44,9 +44,9 @@ SMALL_FILE="1MB.file"
 # $BIG_FILE is the name of the 2.5GB file in the file system image
 BIG_FILE="2.5GB.file"
 
-# $MD5_FILE will have the expected md5s when we do the test
+# $HASH_FILE will have the expected hashes when we do the test
 # They shall have a suffix which represents their file system (ext4/fat16/...)
-MD5_FILE="${OUT_DIR}/md5s.list"
+HASH_FILE="${OUT_DIR}/hash.list"
 
 # $OUT shall be the prefix of the test output. Their suffix will be .out
 OUT="${OUT_DIR}/fs-test"
@@ -103,7 +103,7 @@ function compile_sandbox() {
 # Clean out all generated files other than the file system images
 # We save time by not deleting and recreating the file system images
 function prepare_env() {
-	rm -f ${MD5_FILE}.* ${OUT}.*
+	rm -f ${HASH_FILE}.* ${OUT}.*
 	mkdir -p ${OUT_DIR}
 }
 
@@ -254,14 +254,14 @@ setenv filesize
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_SMALL
 printenv filesize
 # Test Case 4b - Read full 1MB of small file
-md5sum $addr \$filesize
+hash sha256 $addr \$filesize
 setenv filesize
 
 # Test Case 5a - First 1MB of big file
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_BIG $length 0x0
 printenv filesize
 # Test Case 5b - First 1MB of big file
-md5sum $addr \$filesize
+hash sha256 $addr \$filesize
 setenv filesize
 
 # fails for ext as no offset support
@@ -269,7 +269,7 @@ setenv filesize
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_BIG $length 0x9C300000
 printenv filesize
 # Test Case 6b - Last 1MB of big file
-md5sum $addr \$filesize
+hash sha256 $addr \$filesize
 setenv filesize
 
 # fails for ext as no offset support
@@ -277,7 +277,7 @@ setenv filesize
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_BIG $length 0x7FF00000
 printenv filesize
 # Test Case 7b - One from the last 1MB chunk of 2GB
-md5sum $addr \$filesize
+hash sha256 $addr \$filesize
 setenv filesize
 
 # fails for ext as no offset support
@@ -285,7 +285,7 @@ setenv filesize
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_BIG $length 0x80000000
 printenv filesize
 # Test Case 8b - One from the start 1MB chunk from 2GB
-md5sum $addr \$filesize
+hash sha256 $addr \$filesize
 setenv filesize
 
 # fails for ext as no offset support
@@ -293,7 +293,7 @@ setenv filesize
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_BIG $length 0x7FF80000
 printenv filesize
 # Test Case 9b - One 1MB chunk crossing the 2GB boundary
-md5sum $addr \$filesize
+hash sha256 $addr \$filesize
 setenv filesize
 
 # Generic failure case
@@ -309,8 +309,8 @@ ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_SMALL
 ${PREFIX}${WRITE} host${SUFFIX} $addr ${FPATH}$FILE_WRITE \$filesize
 mw.b $addr 00 100
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_WRITE
-# Test Case 11b - Check md5 of written to is same as the one read from
-md5sum $addr \$filesize
+# Test Case 11b - Check hash of written to is same as the one read from
+hash sha256 $addr \$filesize
 setenv filesize
 #
 
@@ -327,13 +327,13 @@ ${PREFIX}load host${SUFFIX} $addr ${FPATH}$FILE_SMALL
 ${PREFIX}${WRITE} host${SUFFIX} $addr ${FPATH}./${FILE_WRITE}2 \$filesize
 mw.b $addr 00 100
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}./${FILE_WRITE}2
-# Test Case 13b - Check md5 of written to is same as the one read from
-md5sum $addr \$filesize
+# Test Case 13b - Check hash of written to is same as the one read from
+hash sha256 $addr \$filesize
 setenv filesize
 mw.b $addr 00 100
 ${PREFIX}load host${SUFFIX} $addr ${FPATH}${FILE_WRITE}2
-# Test Case 13c - Check md5 of written to is same as the one read from
-md5sum $addr \$filesize
+# Test Case 13c - Check hash of written to is same as the one read from
+ hasheshash sha256 $addr \$filesize
 setenv filesize
 #
 reset
@@ -342,7 +342,7 @@ EOF
 }
 
 # 1st argument is the name of the image file.
-# 2nd argument is the file where we generate the md5s of the files
+# 2nd argument is the file where we generate the hashes of the files
 # generated with the appropriate start and length that we use to test.
 # It creates the necessary files in the image to test.
 # $GB2p5 is the path of the big file (2.5 GB)
@@ -380,29 +380,29 @@ function create_files() {
 	sudo rm -f "${MB1}.w"
 	sudo rm -f "${MB1}.w2"
 
-	# Generate the md5sums of reads that we will test against small file
-	dd if="${MB1}" bs=1M skip=0 count=1 2> /dev/null | md5sum > "$2"
+	# Generate the hashes of reads that we will test against small file
+	dd if="${MB1}" bs=1M skip=0 count=1 2> /dev/null | sha256sum > "$2"
 
-	# Generate the md5sums of reads that we will test against big file
+	# Generate the hashes of reads that we will test against big file
 	# One from beginning of file.
 	dd if="${GB2p5}" bs=1M skip=0 count=1 \
-		2> /dev/null | md5sum >> "$2"
+		2> /dev/null | sha256sum >> "$2"
 
 	# One from end of file.
 	dd if="${GB2p5}" bs=1M skip=2499 count=1 \
-		2> /dev/null | md5sum >> "$2"
+		2> /dev/null | sha256sum >> "$2"
 
 	# One from the last 1MB chunk of 2GB
 	dd if="${GB2p5}" bs=1M skip=2047 count=1 \
-		2> /dev/null | md5sum >> "$2"
+		2> /dev/null | sha256sum >> "$2"
 
 	# One from the start 1MB chunk from 2GB
 	dd if="${GB2p5}" bs=1M skip=2048 count=1 \
-		2> /dev/null | md5sum >> "$2"
+		2> /dev/null | sha256sum >> "$2"
 
 	# One 1MB chunk crossing the 2GB boundary
 	dd if="${GB2p5}" bs=512K skip=4095 count=2 \
-		2> /dev/null | md5sum >> "$2"
+		2> /dev/null | sha256sum >> "$2"
 
 	sync
 	sudo umount "$MOUNT_DIR"
@@ -422,35 +422,35 @@ function pass_fail() {
 	fi
 }
 
-# 1st parameter is the string which leads to an md5 generation
+# 1st parameter is the string which leads to an hash generation
 # 2nd parameter is the file we grep, for that string
-# 3rd parameter is the name of the file which has md5s in it
-# 4th parameter is the line # in the md5 file that we match it against
-# This function checks if the md5 of the file in the sandbox matches
+# 3rd parameter is the name of the file which has hashes in it
+# 4th parameter is the line # in the hash file that we match against
+# This function checks if the hash of the file in the sandbox matches
 # that calculated while generating the file
 # 5th parameter is the string to print with the result
-check_md5() {
-	# md5sum in u-boot has output of form:
-	# md5 for 01000008 ... 01100007 ==> <md5>
-	# the 7th field is the actual md5
-	md5_src=`grep -A2 "$1" "$2" | grep "md5 for" | tr -d '\r'`
-	md5_src=($md5_src)
-	md5_src=${md5_src[6]}
-
-	# The md5 list, each line is of the form:
-	# - <md5>
-	# the 2nd field is the actual md5
-	md5_dst=`sed -n $4p $3`
-	md5_dst=($md5_dst)
-	md5_dst=${md5_dst[0]}
+check_hash() {
+	# hash cmd output in u-boot has output of form:
+	# sha256 for 01000008 ... 01100007 ==> <hash>
+	# the 7th field is the actual hash
+	hash_src=`grep -A2 "$1" "$2" | grep "sha256 for" | tr -d '\r'`
+	hash_src=($hash_src)
+	hash_src=${hash_src[6]}
+
+	# The hash list, each line is of the form:
+	# - <hash>
+	# the 2nd field is the actual hash
+	hash_dst=`sed -n $4p $3`
+	hash_dst=($hash_dst)
+	hash_dst=${hash_dst[0]}
 
 	# For a pass they should match.
-	[ "$md5_src" = "$md5_dst" ]
+	[ "$hash_src" = "$hash_dst" ]
 	pass_fail "$5"
 }
 
 # 1st parameter is the name of the output file to check
-# 2nd parameter is the name of the file containing the md5 expected
+# 2nd parameter is the name of the file containing the expected hash
 # 3rd parameter is the name of the small file
 # 4th parameter is the name of the big file
 # 5th paramter is the name of the written file
@@ -483,34 +483,34 @@ function check_results() {
 	# Check read full mb of 1MB.file
 	grep -A4 "Test Case 4a " "$1" | grep -q "filesize=100000"
 	pass_fail "TC4: load of $3 size"
-	check_md5 "Test Case 4b " "$1" "$2" 1 "TC4: load from $3"
+	check_hash "Test Case 4b " "$1" "$2" 1 "TC4: load from $3"
 
 	# Check first mb of 2.5GB.file
 	grep -A4 "Test Case 5a " "$1" | grep -q "filesize=100000"
 	pass_fail "TC5: load of 1st MB from $4 size"
-	check_md5 "Test Case 5b " "$1" "$2" 2 "TC5: load of 1st MB from $4"
+	check_hash "Test Case 5b " "$1" "$2" 2 "TC5: load of 1st MB from $4"
 
 	# Check last mb of 2.5GB.file
 	grep -A4 "Test Case 6a " "$1" | grep -q "filesize=100000"
 	pass_fail "TC6: load of last MB from $4 size"
-	check_md5 "Test Case 6b " "$1" "$2" 3 "TC6: load of last MB from $4"
+	check_hash "Test Case 6b " "$1" "$2" 3 "TC6: load of last MB from $4"
 
 	# Check last 1mb chunk of 2gb from 2.5GB file
 	grep -A4 "Test Case 7a " "$1" | grep -q "filesize=100000"
 	pass_fail "TC7: load of last 1mb chunk of 2GB from $4 size"
-	check_md5 "Test Case 7b " "$1" "$2" 4 \
+	check_hash "Test Case 7b " "$1" "$2" 4 \
 		"TC7: load of last 1mb chunk of 2GB from $4"
 
 	# Check first 1mb chunk after 2gb from 2.5GB file
 	grep -A4 "Test Case 8a " "$1" | grep -q "filesize=100000"
 	pass_fail "TC8: load 1st MB chunk after 2GB from $4 size"
-	check_md5 "Test Case 8b " "$1" "$2" 5 \
+	check_hash "Test Case 8b " "$1" "$2" 5 \
 		"TC8: load 1st MB chunk after 2GB from $4"
 
 	# Check 1mb chunk crossing the 2gb boundary from 2.5GB file
 	grep -A4 "Test Case 9a " "$1" | grep -q "filesize=100000"
 	pass_fail "TC9: load 1MB chunk crossing 2GB boundary from $4 size"
-	check_md5 "Test Case 9b " "$1" "$2" 6 \
+	check_hash "Test Case 9b " "$1" "$2" 6 \
 		"TC9: load 1MB chunk crossing 2GB boundary from $4"
 
 	# Check 2mb chunk from the last 1MB of 2.5GB file loads 1MB
@@ -520,7 +520,7 @@ function check_results() {
 	# Check 1mb chunk write
 	grep -A2 "Test Case 11a " "$1" | grep -q '1048576 bytes written'
 	pass_fail "TC11: 1MB write to $3.w - write succeeded"
-	check_md5 "Test Case 11b " "$1" "$2" 1 \
+	check_hash "Test Case 11b " "$1" "$2" 1 \
 		"TC11: 1MB write to $3.w - content verified"
 
 	# Check lookup of 'dot' directory
@@ -530,9 +530,9 @@ function check_results() {
 	# Check directory traversal
 	grep -A2 "Test Case 13a " "$1" | grep -q '1048576 bytes written'
 	pass_fail "TC13: 1MB write to ./$3.w2 - write succeeded"
-	check_md5 "Test Case 13b " "$1" "$2" 1 \
+	check_hash "Test Case 13b " "$1" "$2" 1 \
 		"TC13: 1MB read from ./$3.w2 - content verified"
-	check_md5 "Test Case 13c " "$1" "$2" 1 \
+	check_hash "Test Case 13c " "$1" "$2" 1 \
 		"TC13: 1MB read from $3.w2 - content verified"
 
 	echo "** End $1"
@@ -543,7 +543,7 @@ function check_results() {
 # be performed.
 function test_fs_nonfs() {
 	echo "Creating files in $fs image if not already present."
-	create_files $IMAGE $MD5_FILE_FS
+	create_files $IMAGE $HASH_FILE_FS
 
 	OUT_FILE="${OUT}.$1.${fs}.out"
 	test_image $IMAGE $fs $SMALL_FILE $BIG_FILE $1 "" \
@@ -552,7 +552,7 @@ function test_fs_nonfs() {
 	grep -v -e "File System is consistent\|update journal finished" \
 		-e "reading .*\.file\|writing .*\.file.w" \
 		< ${OUT_FILE} > ${OUT_FILE}_clean
-	check_results ${OUT_FILE}_clean $MD5_FILE_FS $SMALL_FILE \
+	check_results ${OUT_FILE}_clean $HASH_FILE_FS $SMALL_FILE \
 		$BIG_FILE
 	TOTAL_FAIL=$((TOTAL_FAIL + FAIL))
 	TOTAL_PASS=$((TOTAL_PASS + PASS))
@@ -580,12 +580,12 @@ for fs in ext4 fat16 fat32; do
 
 	echo "Creating $fs image if not already present."
 	IMAGE=${IMG}.${fs}.img
-	MD5_FILE_FS="${MD5_FILE}.${fs}"
+	HASH_FILE_FS="${HASH_FILE}.${fs}"
 	create_image $IMAGE $fs
 
 	# host commands test
 	echo "Creating files in $fs image if not already present."
-	create_files $IMAGE $MD5_FILE_FS
+	create_files $IMAGE $HASH_FILE_FS
 
 	# Lets mount the image and test host hostfs commands
 	mkdir -p "$MOUNT_DIR"
@@ -606,7 +606,7 @@ for fs in ext4 fat16 fat32; do
 	sudo umount "$MOUNT_DIR"
 	rmdir "$MOUNT_DIR"
 
-	check_results $OUT_FILE $MD5_FILE_FS $SMALL_FILE $BIG_FILE
+	check_results $OUT_FILE $HASH_FILE_FS $SMALL_FILE $BIG_FILE
 	TOTAL_FAIL=$((TOTAL_FAIL + FAIL))
 	TOTAL_PASS=$((TOTAL_PASS + PASS))
 	echo "Summary: PASS: $PASS FAIL: $FAIL"
diff --git a/tools/Kconfig b/tools/Kconfig
index 6e23f44d55..f01ed783e6 100644
--- a/tools/Kconfig
+++ b/tools/Kconfig
@@ -25,6 +25,11 @@ config TOOLS_LIBCRYPTO
 	  This selection does not affect target features, such as runtime FIT
 	  signature verification.
 
+config TOOLS_KWBIMAGE
+	bool "Enable kwbimage support in host tools"
+	default y
+	select TOOLS_LIBCRYPTO
+
 config TOOLS_FIT
 	def_bool y
 	help
@@ -46,6 +51,7 @@ config TOOLS_FIT_RSASSA_PSS
 	  Support the rsassa-pss signature scheme in the tools builds
 
 config TOOLS_FIT_SIGNATURE
+	depends on TOOLS_LIBCRYPTO
 	def_bool y
 	help
 	  Enable signature verification of FIT uImages in the tools builds
diff --git a/tools/Makefile b/tools/Makefile
index 1aa1e36137..6a4280e366 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -94,6 +94,8 @@ LIBCRYPTO_OBJS-$(CONFIG_TOOLS_LIBCRYPTO) := \
 			generated/lib/fdt-libcrypto.o \
 			sunxi_toc0.o
 
+KWB_IMAGE_OBJS-$(CONFIG_TOOLS_LIBCRYPTO) := kwbimage.o
+
 ROCKCHIP_OBS = generated/lib/rc4.o rkcommon.o rkimage.o rksd.o rkspi.o
 
 # common objs for dumpimage and mkimage
@@ -114,7 +116,7 @@ dumpimage-mkimage-objs := aisimage.o \
 			imximage.o \
 			imx8image.o \
 			imx8mimage.o \
-			kwbimage.o \
+			$(KWB_IMAGE_OBJS-y) \
 			generated/lib/md5.o \
 			lpc32xximage.o \
 			mxsimage.o \
diff --git a/tools/fit_image.c b/tools/fit_image.c
index 71e031c855..beef1fa86e 100644
--- a/tools/fit_image.c
+++ b/tools/fit_image.c
@@ -61,7 +61,7 @@ static int fit_add_file_data(struct image_tool_params *params, size_t size_inc,
 		ret = fit_set_timestamp(ptr, 0, time);
 	}
 
-	if (!ret)
+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE) && !ret)
 		ret = fit_pre_load_data(params->keydir, dest_blob, ptr);
 
 	if (!ret) {
diff --git a/tools/image-host.c b/tools/image-host.c
index ca4950312f..90bc9f905f 100644
--- a/tools/image-host.c
+++ b/tools/image-host.c
@@ -14,8 +14,10 @@
 #include <image.h>
 #include <version.h>
 
+#if CONFIG_IS_ENABLED(FIT_SIGNATURE)
 #include <openssl/pem.h>
 #include <openssl/evp.h>
+#endif
 
 /**
  * fit_set_hash_value - set hash value in requested has node
@@ -1131,6 +1133,7 @@ static int fit_config_add_verification_data(const char *keydir,
 	return 0;
 }
 
+#if CONFIG_IS_ENABLED(FIT_SIGNATURE)
 /*
  * 0) open file (open)
  * 1) read certificate (PEM_read_X509)
@@ -1239,6 +1242,7 @@ int fit_pre_load_data(const char *keydir, void *keydest, void *fit)
  out:
 	return ret;
 }
+#endif
 
 int fit_cipher_data(const char *keydir, void *keydest, void *fit,
 		    const char *comment, int require_keys,
diff --git a/tools/mkimage.c b/tools/mkimage.c
index 6dfe3e1d42..ac62ebbde9 100644
--- a/tools/mkimage.c
+++ b/tools/mkimage.c
@@ -115,7 +115,7 @@ static void usage(const char *msg)
 		"          -B => align size in hex for FIT structure and header\n"
 		"          -b => append the device tree binary to the FIT\n"
 		"          -t => update the timestamp in the FIT\n");
-#ifdef CONFIG_FIT_SIGNATURE
+#if CONFIG_IS_ENABLED(FIT_SIGNATURE)
 	fprintf(stderr,
 		"Signing / verified boot options: [-k keydir] [-K dtb] [ -c <comment>] [-p addr] [-r] [-N engine]\n"
 		"          -k => set directory containing private keys\n"
@@ -130,8 +130,9 @@ static void usage(const char *msg)
 		"          -o => algorithm to use for signing\n");
 #else
 	fprintf(stderr,
-		"Signing / verified boot not supported (CONFIG_FIT_SIGNATURE undefined)\n");
+		"Signing / verified boot not supported (CONFIG_TOOLS_FIT_SIGNATURE undefined)\n");
 #endif
+
 	fprintf(stderr, "       %s -V ==> print version information and exit\n",
 		params.cmdname);
 	fprintf(stderr, "Use '-T list' to see a list of available image types\n");