Merge tag 'u-boot-imx-master-20250411' of https://gitlab.denx.de/u-boot/custodians/u-boot-imx

CI: https://source.denx.de/u-boot/custodians/u-boot-imx/-/pipelines/25652

- Add i.MX8MP LDB support.
- Various phycore-imx93 environment improvements.
- Add support for Toradex SMARC iMX8MP.
diff --git a/Makefile b/Makefile
index e83672b..bb9ef67 100644
--- a/Makefile
+++ b/Makefile
@@ -2231,7 +2231,7 @@
 	       itb.fit.fit itb.fit.itb itb.map spl.map mkimage-out.rom.mkimage \
 	       mkimage.rom.mkimage mkimage-in-simple-bin* rom.map simple-bin* \
 	       idbloader-spi.img lib/efi_loader/helloworld_efi.S *.itb \
-	       Test* capsule*.*.efi-capsule capsule*.map
+	       Test* capsule*.*.efi-capsule capsule*.map capsule_esl_file
 
 # Directories & files removed with 'make mrproper'
 MRPROPER_DIRS  += include/config include/generated spl tpl vpl \
diff --git a/arch/arm/cpu/armv8/start.S b/arch/arm/cpu/armv8/start.S
index d3a8a7c..829a620 100644
--- a/arch/arm/cpu/armv8/start.S
+++ b/arch/arm/cpu/armv8/start.S
@@ -334,6 +334,9 @@
 	/*
 	 * All slaves will enter EL2 and optionally EL1.
 	 */
+#if defined(CONFIG_ARMV8_PSCI) && !defined(CONFIG_XPL_BUILD)
+        bl      psci_setup_vectors
+#endif
 	adr	x4, lowlevel_in_el2
 	ldr	x5, =ES_TO_AARCH64
 	bl	armv8_switch_to_el2
diff --git a/board/beagle/beagleboneai64/beagleboneai64.c b/board/beagle/beagleboneai64/beagleboneai64.c
index e8d07f1..99eb897 100644
--- a/board/beagle/beagleboneai64/beagleboneai64.c
+++ b/board/beagle/beagleboneai64/beagleboneai64.c
@@ -45,14 +45,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/beagle/beagleplay/beagleplay.c b/board/beagle/beagleplay/beagleplay.c
index fae69b3..7863581 100644
--- a/board/beagle/beagleplay/beagleplay.c
+++ b/board/beagle/beagleplay/beagleplay.c
@@ -41,14 +41,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/libre-computer/aml-a311d-cc/aml-a311d-cc.c b/board/libre-computer/aml-a311d-cc/aml-a311d-cc.c
index 294f788..b3b78bf 100644
--- a/board/libre-computer/aml-a311d-cc/aml-a311d-cc.c
+++ b/board/libre-computer/aml-a311d-cc/aml-a311d-cc.c
@@ -31,8 +31,6 @@
 {
 	if (interface && strcmp(interface, "ram") == 0)
 		env_set("dfu_alt_info", "fitimage ram 0x08080000 0x4000000");
-	else if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
 }
 #endif
 
diff --git a/board/libre-computer/aml-s805x-ac/aml-s805x-ac.c b/board/libre-computer/aml-s805x-ac/aml-s805x-ac.c
index 1ec9a5b..daece29 100644
--- a/board/libre-computer/aml-s805x-ac/aml-s805x-ac.c
+++ b/board/libre-computer/aml-s805x-ac/aml-s805x-ac.c
@@ -38,8 +38,6 @@
 {
 	if (interface && strcmp(interface, "ram") == 0)
 		env_set("dfu_alt_info", "fitimage ram 0x08080000 0x4000000");
-	else if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
 }
 #endif
 
diff --git a/board/libre-computer/aml-s905d3-cc/aml-s905d3-cc.c b/board/libre-computer/aml-s905d3-cc/aml-s905d3-cc.c
index b552035..09a69b0 100644
--- a/board/libre-computer/aml-s905d3-cc/aml-s905d3-cc.c
+++ b/board/libre-computer/aml-s905d3-cc/aml-s905d3-cc.c
@@ -31,8 +31,6 @@
 {
 	if (interface && strcmp(interface, "ram") == 0)
 		env_set("dfu_alt_info", "fitimage ram 0x08080000 0x4000000");
-	else if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
 }
 #endif
 
diff --git a/board/phytec/common/k3/board.c b/board/phytec/common/k3/board.c
index 7d2146d..828973a 100644
--- a/board/phytec/common/k3/board.c
+++ b/board/phytec/common/k3/board.c
@@ -82,14 +82,6 @@
 }
 #endif
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 #if IS_ENABLED(CONFIG_ENV_IS_IN_FAT) || IS_ENABLED(CONFIG_ENV_IS_IN_MMC)
 int mmc_get_env_dev(void)
 {
diff --git a/board/ti/am62px/evm.c b/board/ti/am62px/evm.c
index 75359fa..379d1a5 100644
--- a/board/ti/am62px/evm.c
+++ b/board/ti/am62px/evm.c
@@ -41,14 +41,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/ti/am62x/evm.c b/board/ti/am62x/evm.c
index 279ceba..3051a0a 100644
--- a/board/ti/am62x/evm.c
+++ b/board/ti/am62x/evm.c
@@ -74,14 +74,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/ti/am64x/evm.c b/board/ti/am64x/evm.c
index 6a17737..35fd30d 100644
--- a/board/ti/am64x/evm.c
+++ b/board/ti/am64x/evm.c
@@ -54,14 +54,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/ti/j721e/evm.c b/board/ti/j721e/evm.c
index 1fa78ff..0525f6e 100644
--- a/board/ti/j721e/evm.c
+++ b/board/ti/j721e/evm.c
@@ -65,14 +65,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/ti/j784s4/evm.c b/board/ti/j784s4/evm.c
index d317f3e..c6e46b7 100644
--- a/board/ti/j784s4/evm.c
+++ b/board/ti/j784s4/evm.c
@@ -40,14 +40,6 @@
 	.images = fw_images,
 };
 
-#if IS_ENABLED(CONFIG_SET_DFU_ALT_INFO)
-void set_dfu_alt_info(char *interface, char *devstr)
-{
-	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
-		env_set("dfu_alt_info", update_info.dfu_string);
-}
-#endif
-
 int board_init(void)
 {
 	return 0;
diff --git a/board/xilinx/common/board.h b/board/xilinx/common/board.h
index 64d6576..cb86c4c 100644
--- a/board/xilinx/common/board.h
+++ b/board/xilinx/common/board.h
@@ -18,4 +18,7 @@
 char *soc_name_decode(void);
 
 bool soc_detection(void);
+
+void configure_capsule_updates(void);
+
 #endif /* BOARD_XILINX_COMMON_BOARD_H */
diff --git a/board/xilinx/versal/board.c b/board/xilinx/versal/board.c
index b4483d0..0553073 100644
--- a/board/xilinx/versal/board.c
+++ b/board/xilinx/versal/board.c
@@ -8,6 +8,7 @@
 #include <cpu_func.h>
 #include <dfu.h>
 #include <env.h>
+#include <efi_loader.h>
 #include <fdtdec.h>
 #include <init.h>
 #include <env_internal.h>
@@ -280,6 +281,9 @@
 {
 	int ret;
 
+	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
+		configure_capsule_updates();
+
 	if (!(gd->flags & GD_FLG_ENV_DEFAULT)) {
 		debug("Saved variables - Skipping\n");
 		return 0;
@@ -356,8 +360,6 @@
 }
 #endif
 
-#if defined(CONFIG_SET_DFU_ALT_INFO)
-
 #define DFU_ALT_BUF_LEN		SZ_1K
 
 static void mtd_found_part(u32 *base, u32 *size)
@@ -385,7 +387,7 @@
 	}
 }
 
-void set_dfu_alt_info(char *interface, char *devstr)
+void configure_capsule_updates(void)
 {
 	int bootseq = 0, len = 0;
 	u32 multiboot = versal_multi_boot();
@@ -393,9 +395,6 @@
 
 	ALLOC_CACHE_ALIGN_BUFFER(char, buf, DFU_ALT_BUF_LEN);
 
-	if (env_get("dfu_alt_info"))
-		return;
-
 	memset(buf, 0, sizeof(buf));
 
 	multiboot = env_get_hex("multiboot", multiboot);
@@ -436,7 +435,6 @@
 		return;
 	}
 
-	env_set("dfu_alt_info", buf);
-	puts("DFU alt info setting: done\n");
+	update_info.dfu_string = strdup(buf);
+	debug("Capsule DFU: %s\n", update_info.dfu_string);
 }
-#endif
diff --git a/board/xilinx/zynq/board.c b/board/xilinx/zynq/board.c
index 8dbfa56..5efef61 100644
--- a/board/xilinx/zynq/board.c
+++ b/board/xilinx/zynq/board.c
@@ -7,6 +7,7 @@
 #include <config.h>
 #include <debug_uart.h>
 #include <dfu.h>
+#include <efi_loader.h>
 #include <init.h>
 #include <log.h>
 #include <dm/uclass.h>
@@ -52,6 +53,9 @@
 	char *new_targets;
 	char *env_targets;
 
+	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
+		configure_capsule_updates();
+
 	if (!(gd->flags & GD_FLG_ENV_DEFAULT)) {
 		debug("Saved variables - Skipping\n");
 		return 0;
@@ -165,17 +169,12 @@
 	}
 }
 
-#if defined(CONFIG_SET_DFU_ALT_INFO)
-
 #define DFU_ALT_BUF_LEN                SZ_1K
 
-void set_dfu_alt_info(char *interface, char *devstr)
+void configure_capsule_updates(void)
 {
 	ALLOC_CACHE_ALIGN_BUFFER(char, buf, DFU_ALT_BUF_LEN);
 
-	if (env_get("dfu_alt_info"))
-		return;
-
 	memset(buf, 0, sizeof(buf));
 
 	switch ((zynq_slcr_get_boot_mode()) & ZYNQ_BM_MASK) {
@@ -199,7 +198,6 @@
 		return;
 	}
 
-	env_set("dfu_alt_info", buf);
-	puts("DFU alt info setting: done\n");
+	update_info.dfu_string = strdup(buf);
+	debug("Capsule DFU: %s\n", update_info.dfu_string);
 }
-#endif
diff --git a/board/xilinx/zynqmp/zynqmp.c b/board/xilinx/zynqmp/zynqmp.c
index 820fb25..33205d4 100644
--- a/board/xilinx/zynqmp/zynqmp.c
+++ b/board/xilinx/zynqmp/zynqmp.c
@@ -11,6 +11,7 @@
 #include <dfu.h>
 #include <env.h>
 #include <env_internal.h>
+#include <efi_loader.h>
 #include <init.h>
 #include <log.h>
 #include <net.h>
@@ -526,6 +527,9 @@
 	usb_ether_init();
 #endif
 
+	if (IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT))
+		configure_capsule_updates();
+
 	multiboot = multi_boot();
 	if (multiboot >= 0)
 		env_set_hex("multiboot", multiboot);
@@ -631,8 +635,6 @@
 }
 #endif
 
-#if defined(CONFIG_SET_DFU_ALT_INFO)
-
 #define DFU_ALT_BUF_LEN		SZ_1K
 
 static void mtd_found_part(u32 *base, u32 *size)
@@ -660,15 +662,12 @@
 	}
 }
 
-void set_dfu_alt_info(char *interface, char *devstr)
+void configure_capsule_updates(void)
 {
 	int multiboot, bootseq = 0, len = 0;
 
 	ALLOC_CACHE_ALIGN_BUFFER(char, buf, DFU_ALT_BUF_LEN);
 
-	if (env_get("dfu_alt_info"))
-		return;
-
 	memset(buf, 0, sizeof(buf));
 
 	multiboot = multi_boot();
@@ -732,10 +731,9 @@
 		return;
 	}
 
-	env_set("dfu_alt_info", buf);
-	puts("DFU alt info setting: done\n");
+	update_info.dfu_string = strdup(buf);
+	debug("Capsule DFU: %s\n", update_info.dfu_string);
 }
-#endif
 
 #if defined(CONFIG_SPL_SPI_LOAD)
 unsigned int spl_spi_get_uboot_offs(struct spi_flash *flash)
diff --git a/boot/bootm.c b/boot/bootm.c
index 854ac7e..f5cbb10 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -545,7 +545,8 @@
 	     images.os.type == IH_TYPE_KERNEL_NOLOAD ||
 	     images.os.type == IH_TYPE_MULTI) &&
 	    (images.os.os == IH_OS_LINUX || images.os.os == IH_OS_VXWORKS ||
-	     images.os.os == IH_OS_EFI || images.os.os == IH_OS_TEE)) {
+	     images.os.os == IH_OS_EFI || images.os.os == IH_OS_TEE ||
+	     images.os.os == IH_OS_ELF)) {
 		return bootm_find_images(img_addr, conf_ramdisk, conf_fdt, 0,
 					 0);
 	}
diff --git a/boot/bootm_os.c b/boot/bootm_os.c
index e9522cd..dc9d3e6 100644
--- a/boot/bootm_os.c
+++ b/boot/bootm_os.c
@@ -402,7 +402,7 @@
 	if (flag != BOOTM_STATE_OS_GO)
 		return 0;
 
-	bootelf(bmi->images->ep, flags, 0, NULL);
+	bootelf(bmi->images->ep, flags, bmi->argc, bmi->argv);
 
 	return 1;
 }
@@ -507,7 +507,9 @@
 
 	ret = efi_binary_run(image_buf, images->os.image_len,
 			     images->ft_len
-			     ? images->ft_addr : EFI_FDT_USE_INTERNAL);
+			     ? images->ft_addr : EFI_FDT_USE_INTERNAL,
+				 (void *)images->initrd_start,
+				 (size_t)(images->initrd_end - images->initrd_start));
 
 	return ret;
 }
diff --git a/boot/image-fit-sig.c b/boot/image-fit-sig.c
index a121de6..f23e9d5 100644
--- a/boot/image-fit-sig.c
+++ b/boot/image-fit-sig.c
@@ -191,6 +191,11 @@
 	int noffset;
 	int key_node;
 
+#ifdef USE_HOSTCC
+	if (!key_blob)
+		return 0;
+#endif
+
 	/* Work out what we need to verify */
 	*no_sigsp = 1;
 	key_node = fdt_subnode_offset(key_blob, 0, FIT_SIG_NODENAME);
@@ -477,6 +482,11 @@
 	bool reqd_policy_all = true;
 	const char *reqd_mode;
 
+#ifdef USE_HOSTCC
+	if (!key_blob)
+		return 0;
+#endif
+
 	/*
 	 * We don't support this since libfdt considers names with the
 	 * name root but different @ suffix to be equal
diff --git a/cmd/Kconfig b/cmd/Kconfig
index ecef664..c2ce519 100644
--- a/cmd/Kconfig
+++ b/cmd/Kconfig
@@ -185,6 +185,7 @@
 config CMD_FWU_METADATA
 	bool "fwu metadata read"
 	depends on FWU_MULTI_BANK_UPDATE
+	imply HEXDUMP if FWU_MDATA_V2
 	help
 	  Command to read the metadata and dump it's contents
 
diff --git a/cmd/blk_common.c b/cmd/blk_common.c
index 4c05a4e..5652970 100644
--- a/cmd/blk_common.c
+++ b/cmd/blk_common.c
@@ -107,6 +107,23 @@
 			printf("%ld blocks written: %s\n", n,
 			       n == cnt ? "OK" : "ERROR");
 			return n == cnt ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
+		} else if (strcmp(argv[1], "erase") == 0) {
+			lbaint_t blk = hextoul(argv[2], NULL);
+			ulong cnt = hextoul(argv[3], NULL);
+			struct blk_desc *desc;
+			ulong n;
+
+			printf("\n%s erase: device %d block # "LBAFU", count %lu ... ",
+			       if_name, *cur_devnump, blk, cnt);
+
+			if (blk_get_desc(uclass_id, *cur_devnump, &desc))
+				return CMD_RET_FAILURE;
+
+			n = blk_derase(desc, blk, cnt);
+
+			printf("%ld blocks erased: %s\n", n,
+			       n == cnt ? "OK" : "ERROR");
+			return n == cnt ? CMD_RET_SUCCESS : CMD_RET_FAILURE;
 		} else {
 			return CMD_RET_USAGE;
 		}
diff --git a/cmd/bootefi.c b/cmd/bootefi.c
index c1454ff..dce8285 100644
--- a/cmd/bootefi.c
+++ b/cmd/bootefi.c
@@ -211,7 +211,7 @@
 		}
 	}
 
-	ret = efi_binary_run(image_buf, size, fdt);
+	ret = efi_binary_run(image_buf, size, fdt, NULL, 0);
 
 	if (ret != EFI_SUCCESS)
 		return CMD_RET_FAILURE;
diff --git a/cmd/fwu_mdata.c b/cmd/fwu_mdata.c
index 9c048d6..5b5a2e4 100644
--- a/cmd/fwu_mdata.c
+++ b/cmd/fwu_mdata.c
@@ -7,6 +7,7 @@
 #include <dm.h>
 #include <fwu.h>
 #include <fwu_mdata.h>
+#include <hexdump.h>
 #include <log.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -45,6 +46,30 @@
 			       img_info->accepted == 0x1 ? "yes" : "no");
 		}
 	}
+
+	if (data->version == 2) {
+		struct fwu_mdata *mdata = data->fwu_mdata;
+		struct fwu_fw_store_desc *desc;
+		void *end;
+		u32 diff;
+
+		/*
+		 * fwu_mdata defines only header that's why taking it as array
+		 * which exactly point to image description location
+		 */
+		desc = (struct fwu_fw_store_desc *)&mdata[1];
+
+		/* Number of entries is taken from for loop - variable i */
+		end = &desc->img_entry[i];
+		debug("mdata %p, desc %p, end %p\n", mdata, desc, end);
+
+		diff = data->metadata_size - ((void *)end - (void *)mdata);
+		if (diff) {
+			printf("Custom fields covered by CRC len: 0x%x\n", diff);
+			print_hex_dump_bytes("CUSTOM ", DUMP_PREFIX_OFFSET,
+					     end, diff);
+		}
+	}
 }
 
 int do_fwu_mdata_read(struct cmd_tbl *cmdtp, int flag,
diff --git a/cmd/scsi.c b/cmd/scsi.c
index c286bdc..9f76134 100644
--- a/cmd/scsi.c
+++ b/cmd/scsi.c
@@ -60,7 +60,8 @@
 	"scsi read addr blk# cnt - read `cnt' blocks starting at block `blk#'\n"
 	"     to memory address `addr'\n"
 	"scsi write addr blk# cnt - write `cnt' blocks starting at block\n"
-	"     `blk#' from memory address `addr'"
+	"     `blk#' from memory address `addr'\n"
+	"scsi erase blk# cnt - erase `cnt' blocks starting at block `blk#'"
 );
 
 U_BOOT_CMD(
diff --git a/common/board_r.c b/common/board_r.c
index 8d69db1..f12e0c8 100644
--- a/common/board_r.c
+++ b/common/board_r.c
@@ -169,7 +169,8 @@
 	 */
 	efi_save_gd();
 
-	efi_runtime_relocate(gd->relocaddr, NULL);
+	if (!(gd->flags & GD_FLG_SKIP_RELOC))
+		efi_runtime_relocate(gd->relocaddr, NULL);
 
 #endif
 	/*
diff --git a/common/console.c b/common/console.c
index b69bb18..275da2f 100644
--- a/common/console.c
+++ b/common/console.c
@@ -208,8 +208,8 @@
 			gd->jt->printf = printf;
 			break;
 		}
-		break;
 #endif
+		break;
 	default:		/* Invalid file ID */
 		error = -1;
 	}
diff --git a/doc/develop/uefi/uefi.rst b/doc/develop/uefi/uefi.rst
index 48d6110..3ca22b5 100644
--- a/doc/develop/uefi/uefi.rst
+++ b/doc/develop/uefi/uefi.rst
@@ -597,21 +597,6 @@
       [--fit | --raw | --guid <guid-string] \
       <image_blob> <capsule_file_name>
 
-4. Insert the signature list into a device tree in the following format::
-
-    {
-            signature {
-                    capsule-key = [ <binary of signature list> ];
-            }
-            ...
-    }
-
-You can perform step-4 through the Kconfig symbol
-CONFIG_EFI_CAPSULE_CRT_FILE. This symbol points to the signing key
-generated in step-2. As part of U-Boot build, the ESL certificate file will
-be generated from the signing key and automatically get embedded into the
-platform's dtb.
-
 Anti-rollback Protection
 ************************
 
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 834e028..0911d2f 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -576,6 +576,7 @@
 	bool
 	default y
 	depends on QFW && SMBIOS && !SANDBOX && !SYSINFO_SMBIOS
+	select BLOBLIST
 	help
 	  Hidden option to read SMBIOS tables from QEMU.
 
diff --git a/drivers/mmc/Kconfig b/drivers/mmc/Kconfig
index 6740591..3ea665d 100644
--- a/drivers/mmc/Kconfig
+++ b/drivers/mmc/Kconfig
@@ -528,6 +528,7 @@
 
 config MMC_SDHCI_ADMA_FORCE_32BIT
 	bool "Force 32 bit mode for ADMA on 64 bit platforms"
+	depends on MMC_SDHCI_ADMA || SPL_MMC_SDHCI_ADMA
 	help
 	  This forces SDHCI ADMA to be built for 32 bit descriptors, even
 	  on a 64 bit platform where they would otherwise be assumed to
@@ -537,6 +538,7 @@
 
 config MMC_SDHCI_ADMA_64BIT
 	bool "Use SHDCI ADMA with 64 bit descriptors"
+	depends on MMC_SDHCI_ADMA || SPL_MMC_SDHCI_ADMA
 	depends on !MMC_SDHCI_ADMA_FORCE_32BIT
 	default y if DMA_ADDR_T_64BIT
 	help
diff --git a/drivers/mmc/mmc-uclass.c b/drivers/mmc/mmc-uclass.c
index c8db4f8..9af84da 100644
--- a/drivers/mmc/mmc-uclass.c
+++ b/drivers/mmc/mmc-uclass.c
@@ -498,22 +498,12 @@
 		return ret;
 	}
 
-	ret = device_probe(dev);
-	if (ret) {
-		debug("Probing %s failed (err=%d)\n", dev->name, ret);
-
-		mmc_deinit(mmc);
-
-		return ret;
-	}
-
 	return 0;
 }
 
-static int mmc_blk_remove(struct udevice *dev)
+static int mmc_remove(struct udevice *dev)
 {
-	struct udevice *mmc_dev = dev_get_parent(dev);
-	struct mmc_uclass_priv *upriv = dev_get_uclass_priv(mmc_dev);
+	struct mmc_uclass_priv *upriv = dev_get_uclass_priv(dev);
 	struct mmc *mmc = upriv->mmc;
 
 	return mmc_deinit(mmc);
@@ -533,7 +523,6 @@
 	.id		= UCLASS_BLK,
 	.ops		= &mmc_blk_ops,
 	.probe		= mmc_blk_probe,
-	.remove		= mmc_blk_remove,
 	.flags		= DM_FLAG_OS_PREPARE,
 };
 #endif /* CONFIG_BLK */
@@ -543,4 +532,5 @@
 	.name		= "mmc",
 	.flags		= DM_UC_FLAG_SEQ_ALIAS,
 	.per_device_auto	= sizeof(struct mmc_uclass_priv),
+	.pre_remove	= mmc_remove,
 };
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index 31a7236..47139e0 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -3040,9 +3040,9 @@
 	return err;
 }
 
-static void __maybe_unused mmc_cyclic_cd_poll(struct cyclic_info *c)
+static void mmc_cyclic_cd_poll(struct cyclic_info *c)
 {
-	struct mmc *m = CONFIG_IS_ENABLED(CYCLIC, (container_of(c, struct mmc, cyclic)), (NULL));
+	struct mmc *m = container_of(c, struct mmc, cyclic);
 
 	if (!m->has_init)
 		return;
@@ -3073,15 +3073,15 @@
 
 	if (!err)
 		err = mmc_complete_init(mmc);
-	if (err)
+	if (err) {
 		pr_info("%s: %d, time %lu\n", __func__, err, get_timer(start));
+		return err;
+	}
 
 	if (CONFIG_IS_ENABLED(CYCLIC, (!mmc->cyclic.func), (NULL))) {
 		/* Register cyclic function for card detect polling */
-		CONFIG_IS_ENABLED(CYCLIC, (cyclic_register(&mmc->cyclic,
-							   mmc_cyclic_cd_poll,
-							   100 * 1000,
-							   mmc->cfg->name)));
+		cyclic_register(&mmc->cyclic, mmc_cyclic_cd_poll, 100 * 1000,
+				mmc->cfg->name);
 	}
 
 	return err;
@@ -3092,7 +3092,7 @@
 	u32 caps_filtered;
 
 	if (CONFIG_IS_ENABLED(CYCLIC, (mmc->cyclic.func), (NULL)))
-		CONFIG_IS_ENABLED(CYCLIC, (cyclic_unregister(&mmc->cyclic)));
+		cyclic_unregister(&mmc->cyclic);
 
 	if (!CONFIG_IS_ENABLED(MMC_UHS_SUPPORT) &&
 	    !CONFIG_IS_ENABLED(MMC_HS200_SUPPORT) &&
diff --git a/drivers/mmc/mmc_boot.c b/drivers/mmc/mmc_boot.c
index 367c957..986e6c5 100644
--- a/drivers/mmc/mmc_boot.c
+++ b/drivers/mmc/mmc_boot.c
@@ -8,20 +8,107 @@
 #include <mmc.h>
 #include "mmc_private.h"
 
-/*
- * This function changes the size of boot partition and the size of rpmb
- * partition present on EMMC devices.
- *
- * Input Parameters:
- * struct *mmc: pointer for the mmc device strcuture
- * bootsize: size of boot partition
- * rpmbsize: size of rpmb partition
- *
- * Returns 0 on success.
- */
+static int mmc_resize_boot_micron(struct mmc *mmc, unsigned long bootsize,
+				  unsigned long rpmbsize)
+{
+	int err;
 
-int mmc_boot_partition_size_change(struct mmc *mmc, unsigned long bootsize,
-				unsigned long rpmbsize)
+	/* Micron eMMC doesn't support resizing RPMB partition */
+	(void)rpmbsize;
+
+	/* BOOT partition size is multiple of 128KB */
+	bootsize = (bootsize * 1024) / 128;
+
+	if (bootsize > 0xff)
+		bootsize = 0xff;
+
+	/* Set EXT_CSD[175] ERASE_GROUP_DEF to 0x01 */
+	err = mmc_switch(mmc, EXT_CSD_CMD_SET_NORMAL,
+			 EXT_CSD_ERASE_GROUP_DEF, 0x01);
+	if (err)
+		goto error;
+
+	/* Set EXT_CSD[127:125] for BOOT partition size, [125] is low byte */
+	err = mmc_switch(mmc, EXT_CSD_CMD_SET_NORMAL,
+			 EXT_CSD_BOOT_SIZE_MULT_MICRON, bootsize);
+	if (err)
+		goto error;
+
+	err = mmc_switch(mmc, EXT_CSD_CMD_SET_NORMAL,
+			 EXT_CSD_BOOT_SIZE_MULT_MICRON + 1, 0x00);
+	if (err)
+		goto error;
+
+	err = mmc_switch(mmc, EXT_CSD_CMD_SET_NORMAL,
+			 EXT_CSD_BOOT_SIZE_MULT_MICRON + 2, 0x00);
+	if (err)
+		goto error;
+
+	/* Set EXT_CSD[155] PARTITION_SETTING_COMPLETE to 0x01 */
+	err = mmc_switch(mmc, EXT_CSD_CMD_SET_NORMAL,
+			 EXT_CSD_PARTITION_SETTING, 0x01);
+	if (err)
+		goto error;
+
+	return 0;
+
+error:
+	debug("%s: Error = %d\n", __func__, err);
+	return err;
+}
+
+static int mmc_resize_boot_sandisk(struct mmc *mmc, unsigned long bootsize,
+				   unsigned long rpmbsize)
+{
+	int err;
+	struct mmc_cmd cmd;
+
+	/* BOOT/RPMB partition size is multiple of 128KB */
+	bootsize = (bootsize * 1024) / 128;
+	rpmbsize = (rpmbsize * 1024) / 128;
+
+	if (bootsize > 0xff)
+		bootsize = 0xff;
+
+	if (rpmbsize > 0xff)
+		rpmbsize = 0xff;
+
+	/* Send BOOT/RPMB resize op code */
+	cmd.cmdidx = MMC_CMD_RES_MAN;
+	cmd.resp_type = MMC_RSP_R1b;
+	cmd.cmdarg = MMC_CMD62_ARG_SANDISK;
+
+	err = mmc_send_cmd(mmc, &cmd, NULL);
+	if (err)
+		goto error;
+
+	/* Arg: BOOT partition size */
+	cmd.cmdidx = MMC_CMD_RES_MAN;
+	cmd.resp_type = MMC_RSP_R1b;
+	cmd.cmdarg = bootsize;
+
+	err = mmc_send_cmd(mmc, &cmd, NULL);
+	if (err)
+		goto error;
+
+	/* Arg: RPMB partition size */
+	cmd.cmdidx = MMC_CMD_RES_MAN;
+	cmd.resp_type = MMC_RSP_R1b;
+	cmd.cmdarg = rpmbsize;
+
+	err = mmc_send_cmd(mmc, &cmd, NULL);
+	if (err)
+		goto error;
+
+	return 0;
+
+error:
+	debug("%s: Error = %d\n", __func__, err);
+	return err;
+}
+
+static int mmc_resize_boot_samsung(struct mmc *mmc, unsigned long bootsize,
+				   unsigned long rpmbsize)
 {
 	int err;
 	struct mmc_cmd cmd;
@@ -32,10 +119,8 @@
 	cmd.cmdarg = MMC_CMD62_ARG1;
 
 	err = mmc_send_cmd(mmc, &cmd, NULL);
-	if (err) {
-		debug("mmc_boot_partition_size_change: Error1 = %d\n", err);
-		return err;
-	}
+	if (err)
+		goto error;
 
 	/* Boot partition changing mode */
 	cmd.cmdidx = MMC_CMD_RES_MAN;
@@ -43,10 +128,9 @@
 	cmd.cmdarg = MMC_CMD62_ARG2;
 
 	err = mmc_send_cmd(mmc, &cmd, NULL);
-	if (err) {
-		debug("mmc_boot_partition_size_change: Error2 = %d\n", err);
-		return err;
-	}
+	if (err)
+		goto error;
+
 	/* boot partition size is multiple of 128KB */
 	bootsize = (bootsize * 1024) / 128;
 
@@ -56,10 +140,9 @@
 	cmd.cmdarg = bootsize;
 
 	err = mmc_send_cmd(mmc, &cmd, NULL);
-	if (err) {
-		debug("mmc_boot_partition_size_change: Error3 = %d\n", err);
-		return err;
-	}
+	if (err)
+		goto error;
+
 	/* RPMB partition size is multiple of 128KB */
 	rpmbsize = (rpmbsize * 1024) / 128;
 	/* Arg: RPMB partition size */
@@ -68,11 +151,43 @@
 	cmd.cmdarg = rpmbsize;
 
 	err = mmc_send_cmd(mmc, &cmd, NULL);
-	if (err) {
-		debug("mmc_boot_partition_size_change: Error4 = %d\n", err);
-		return err;
-	}
+	if (err)
+		goto error;
+
 	return 0;
+
+error:
+	debug("%s: Error = %d\n", __func__, err);
+	return err;
+}
+
+/*
+ * This function changes the size of BOOT partition and the size of RPMB
+ * partition present on eMMC devices.
+ *
+ * Input Parameters:
+ * struct *mmc: pointer for the mmc device strcuture
+ * bootsize: size of BOOT partition
+ * rpmbsize: size of RPMB partition
+ *
+ * Returns 0 on success.
+ */
+
+int mmc_boot_partition_size_change(struct mmc *mmc, unsigned long bootsize,
+				   unsigned long rpmbsize)
+{
+	switch (mmc->cid[0] >> 24) {
+	case CID_MANFID_MICRON:
+		return mmc_resize_boot_micron(mmc, bootsize, rpmbsize);
+	case CID_MANFID_SAMSUNG:
+		return mmc_resize_boot_samsung(mmc, bootsize, rpmbsize);
+	case CID_MANFID_SANDISK:
+		return mmc_resize_boot_sandisk(mmc, bootsize, rpmbsize);
+	default:
+		printf("Unsupported manufacturer id 0x%02x\n",
+		       mmc->cid[0] >> 24);
+		return -EPERM;
+	}
 }
 
 /*
diff --git a/drivers/mmc/mmc_write.c b/drivers/mmc/mmc_write.c
index c023d15..90fcf26 100644
--- a/drivers/mmc/mmc_write.c
+++ b/drivers/mmc/mmc_write.c
@@ -80,6 +80,8 @@
 	struct mmc *mmc = find_mmc_device(dev_num);
 	lbaint_t blk = 0, blk_r = 0;
 	int timeout_ms = 1000;
+	u32 grpcnt;
+
 
 	if (!mmc)
 		return -1;
@@ -123,6 +125,15 @@
 		} else {
 			blk_r = ((blkcnt - blk) > mmc->erase_grp_size) ?
 				mmc->erase_grp_size : (blkcnt - blk);
+
+			grpcnt = (blkcnt - blk) / mmc->erase_grp_size;
+			/* Max 2GB per spec */
+			if ((blkcnt - blk) > 0x400000)
+				blk_r = 0x400000;
+			else if (grpcnt)
+				blk_r = grpcnt * mmc->erase_grp_size;
+			else
+				blk_r = blkcnt - blk;
 		}
 		err = mmc_erase_t(mmc, start + blk, blk_r, erase_args);
 		if (err)
diff --git a/drivers/mmc/sdhci.c b/drivers/mmc/sdhci.c
index 4833b51..dc7f072 100644
--- a/drivers/mmc/sdhci.c
+++ b/drivers/mmc/sdhci.c
@@ -177,8 +177,10 @@
 	} while (!(stat & SDHCI_INT_DATA_END));
 
 #if (CONFIG_IS_ENABLED(MMC_SDHCI_SDMA) || CONFIG_IS_ENABLED(MMC_SDHCI_ADMA))
-	dma_unmap_single(host->start_addr, data->blocks * data->blocksize,
-			 mmc_get_dma_dir(data));
+	if (host->flags & USE_DMA) {
+		dma_unmap_single(host->start_addr, data->blocks * data->blocksize,
+				 mmc_get_dma_dir(data));
+	}
 #endif
 
 	return 0;
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 3e55654..7d022ce 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -28,6 +28,10 @@
 #define SCSI_MAX_BLK 0xFFFF
 #define SCSI_LBA48_READ	0xFFFFFFF
 
+#define SCSI_UNMAP_PARAM_RESERVED 0
+#define SCSI_UNMAP_PARAM_LEN 22
+#define SCSI_UNMAP_PARAM_DATA_LEN 16
+
 static void scsi_print_error(struct scsi_cmd *pccb)
 {
 	/* Dummy function that could print an error for debugging */
@@ -138,6 +142,51 @@
 	      pccb->cmd[7], pccb->cmd[8]);
 }
 
+static void scsi_setup_erase_ext(struct scsi_cmd *pccb, lbaint_t start,
+				 unsigned short blocks)
+{
+	u8 *param = tempbuff;
+	const u8 param_size = 24;
+
+	memset(param, 0, param_size);
+	param[0] = SCSI_UNMAP_PARAM_RESERVED;
+	param[1] = SCSI_UNMAP_PARAM_LEN;
+	param[2] = SCSI_UNMAP_PARAM_RESERVED;
+	param[3] = SCSI_UNMAP_PARAM_DATA_LEN;
+
+	param[8]  = 0x0;
+	param[9]  = 0x0;
+	param[10] = 0x0;
+	param[11] = 0x0;
+	param[12] = (start >> 24) & 0xff;
+	param[13] = (start >> 16) & 0xff;
+	param[14] = (start >> 8) & 0xff;
+	param[15] = (start) & 0xff;
+	param[16] = (blocks >> 24) & 0xff;
+	param[17] = (blocks >> 16) & 0xff;
+	param[18] = (blocks >> 8) & 0xff;
+	param[19] = (blocks) & 0xff;
+
+	memset(pccb->cmd, 0, sizeof(pccb->cmd));
+	pccb->cmd[0] = SCSI_UNMAP;
+	pccb->cmd[1] = 0;
+	pccb->cmd[6] = 0;
+	pccb->cmd[7] = 0;
+	pccb->cmd[8] = param_size;
+	pccb->cmd[9] = 0;
+	pccb->cmdlen = 10;
+
+	pccb->pdata = param;
+	pccb->datalen = param_size;
+	pccb->dma_dir = DMA_TO_DEVICE;
+
+	debug("%s: cmd: %02X %02X startblk %02X%02X%02X%02X blccnt %02X%02X\n",
+	      __func__,
+	      pccb->cmd[0], pccb->cmd[1],
+	      pccb->cmd[2], pccb->cmd[3], pccb->cmd[4], pccb->cmd[5],
+	      pccb->cmd[7], pccb->cmd[8]);
+}
+
 static ulong scsi_read(struct udevice *dev, lbaint_t blknr, lbaint_t blkcnt,
 		       void *buffer)
 {
@@ -268,6 +317,48 @@
 	return blkcnt;
 }
 
+/*******************************************************************************
+ * scsi_erase
+ */
+static ulong scsi_erase(struct udevice *dev, lbaint_t blknr, lbaint_t blkcnt)
+{
+	struct blk_desc *block_dev = dev_get_uclass_plat(dev);
+	struct udevice *bdev = dev->parent;
+	struct scsi_plat *uc_plat = dev_get_uclass_plat(bdev);
+	lbaint_t start, blks, max_blks;
+	struct scsi_cmd *pccb = (struct scsi_cmd *)&tempccb;
+
+	/* Setup device */
+	pccb->target = block_dev->target;
+	pccb->lun = block_dev->lun;
+	start = blknr;
+	blks = blkcnt;
+	if (uc_plat->max_bytes_per_req)
+		max_blks = uc_plat->max_bytes_per_req / block_dev->blksz;
+	else
+		max_blks = SCSI_MAX_BLK;
+
+	debug("\n%s: dev %d startblk " LBAF ", blccnt " LBAF "\n",
+	      __func__, block_dev->devnum, start, blks);
+	do {
+		if (blks > max_blks) {
+			scsi_setup_erase_ext(pccb, start, max_blks);
+			start += max_blks;
+			blks -= max_blks;
+		} else {
+			scsi_setup_erase_ext(pccb, start, blks);
+			start += blks;
+			blks = 0;
+		}
+		if (scsi_exec(bdev, pccb)) {
+			scsi_print_error(pccb);
+			blkcnt -= blks;
+			break;
+		}
+	} while (blks != 0);
+	return blkcnt;
+}
+
 #if IS_ENABLED(CONFIG_BOUNCE_BUFFER)
 static int scsi_buffer_aligned(struct udevice *dev, struct bounce_buffer *state)
 {
@@ -615,6 +706,7 @@
 static const struct blk_ops scsi_blk_ops = {
 	.read	= scsi_read,
 	.write	= scsi_write,
+	.erase  = scsi_erase,
 #if IS_ENABLED(CONFIG_BOUNCE_BUFFER)
 	.buffer_aligned	= scsi_buffer_aligned,
 #endif	/* CONFIG_BOUNCE_BUFFER */
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 024b1ad..d597879 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -28,6 +28,8 @@
 extern char __efi_helloworld_end[];
 extern char __efi_var_file_begin[];
 extern char __efi_var_file_end[];
+extern char __efi_capsule_sig_begin[];
+extern char __efi_capsule_sig_end[];
 
 /* Private data used by of-platdata devices/uclasses */
 extern char __priv_data_start[], __priv_data_end[];
diff --git a/include/efi_loader.h b/include/efi_loader.h
index 5f76978..144b749 100644
--- a/include/efi_loader.h
+++ b/include/efi_loader.h
@@ -600,7 +600,7 @@
 /* Execute loaded UEFI image */
 efi_status_t do_bootefi_exec(efi_handle_t handle, void *load_options);
 /* Run loaded UEFI image with given fdt */
-efi_status_t efi_binary_run(void *image, size_t size, void *fdt);
+efi_status_t efi_binary_run(void *image, size_t size, void *fdt, void *initrd, size_t initrd_sz);
 
 /**
  * efi_bootflow_run() - Run a bootflow containing an EFI application
@@ -667,7 +667,7 @@
 			       struct efi_service_binding_protocol *http_service_binding);
 /* Called by bootefi to make the watchdog available */
 efi_status_t efi_watchdog_register(void);
-efi_status_t efi_initrd_register(void);
+efi_status_t efi_initrd_register(struct efi_device_path *dp_initrd);
 efi_status_t efi_initrd_deregister(void);
 /* Called by bootefi to make SMBIOS tables available */
 /**
diff --git a/include/mmc.h b/include/mmc.h
index 81bccb4..52cacfd 100644
--- a/include/mmc.h
+++ b/include/mmc.h
@@ -79,6 +79,10 @@
 #define IS_SD(x)	((x)->version & SD_VERSION_SD)
 #define IS_MMC(x)	((x)->version & MMC_VERSION_MMC)
 
+#define CID_MANFID_MICRON       0x13
+#define CID_MANFID_SAMSUNG      0x15
+#define CID_MANFID_SANDISK      0x45
+
 #define MMC_DATA_READ		1
 #define MMC_DATA_WRITE		2
 
@@ -112,6 +116,7 @@
 
 #define MMC_CMD62_ARG1			0xefac62ec
 #define MMC_CMD62_ARG2			0xcbaea7
+#define MMC_CMD62_ARG_SANDISK		0x254ddec4
 
 #define SD_CMD_SEND_RELATIVE_ADDR	3
 #define SD_CMD_SWITCH_FUNC		6
@@ -205,6 +210,7 @@
 /*
  * EXT_CSD fields
  */
+#define EXT_CSD_BOOT_SIZE_MULT_MICRON	125	/* R/W, vendor specific field */
 #define EXT_CSD_ENH_START_ADDR		136	/* R/W */
 #define EXT_CSD_ENH_SIZE_MULT		140	/* R/W */
 #define EXT_CSD_GP_SIZE_MULT		143	/* R/W */
@@ -759,7 +765,11 @@
 
 	enum bus_mode user_speed_mode; /* input speed mode from user */
 
-	CONFIG_IS_ENABLED(CYCLIC, (struct cyclic_info cyclic));
+	/*
+	 * If CONFIG_CYCLIC is not set, struct cyclic_info is
+	 * zero-size structure and does not add any space here.
+	 */
+	struct cyclic_info cyclic;
 };
 
 #if CONFIG_IS_ENABLED(DM_MMC)
diff --git a/include/scsi.h b/include/scsi.h
index b18ae37..ab53b47 100644
--- a/include/scsi.h
+++ b/include/scsi.h
@@ -9,6 +9,7 @@
 #include <asm/cache.h>
 #include <bouncebuf.h>
 #include <linux/dma-direction.h>
+#include <part.h>
 
 struct udevice;
 
@@ -181,6 +182,7 @@
 #define SCSI_WRT_VERIFY	0x2E		/* Write and Verify (O) */
 #define SCSI_WRITE_LONG	0x3F		/* Write Long (O) */
 #define SCSI_WRITE_SAME	0x41		/* Write Same (O) */
+#define SCSI_UNMAP	0x42		/* Write 10-Byte (MANDATORY) */
 
 /**
  * enum scsi_cmd_phase - current phase of the SCSI protocol
diff --git a/lib/Kconfig b/lib/Kconfig
index 1795446..ac34ec4 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -317,6 +317,7 @@
 config GENERATE_ACPI_TABLE
 	bool "Generate an ACPI (Advanced Configuration and Power Interface) table"
 	depends on ACPI
+	select BLOBLIST
 	select QFW if QEMU
 	help
 	  The Advanced Configuration and Power Interface (ACPI) specification
diff --git a/lib/efi_loader/Kconfig b/lib/efi_loader/Kconfig
index 6130af1..7f02a83 100644
--- a/lib/efi_loader/Kconfig
+++ b/lib/efi_loader/Kconfig
@@ -305,7 +305,6 @@
 	depends on EFI_CAPSULE_FIRMWARE_MANAGEMENT
 	select UPDATE_FIT
 	select DFU
-	select SET_DFU_ALT_INFO
 	select EFI_CAPSULE_FIRMWARE
 	help
 	  Select this option if you want to enable firmware management protocol
@@ -317,7 +316,6 @@
 	depends on SANDBOX || (!SANDBOX && !EFI_CAPSULE_FIRMWARE_FIT)
 	select DFU_WRITE_ALT
 	select DFU
-	select SET_DFU_ALT_INFO
 	select EFI_CAPSULE_FIRMWARE
 	help
 	  Select this option if you want to enable firmware management protocol
diff --git a/lib/efi_loader/Makefile b/lib/efi_loader/Makefile
index 2a0b417..dc29121 100644
--- a/lib/efi_loader/Makefile
+++ b/lib/efi_loader/Makefile
@@ -29,6 +29,7 @@
 obj-y += efi_helper.o
 obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += efi_capsule.o
 obj-$(CONFIG_EFI_CAPSULE_FIRMWARE) += efi_firmware.o
+obj-$(CONFIG_EFI_CAPSULE_AUTHENTICATE) += efi_capsule_key.o
 obj-y += efi_console.o
 obj-y += efi_device_path.o
 obj-$(CONFIG_EFI_DEVICE_PATH_TO_TEXT) += efi_device_path_to_text.o
@@ -73,6 +74,23 @@
 EFI_VAR_SEED_FILE := $(subst $\",,$(CONFIG_EFI_VAR_SEED_FILE))
 $(obj)/efi_var_seed.o: $(srctree)/$(EFI_VAR_SEED_FILE)
 
+ifeq ($(CONFIG_EFI_CAPSULE_AUTHENTICATE),y)
+capsule_crt_path=($(subst $(quote),,$(CONFIG_EFI_CAPSULE_CRT_FILE)))
+capsule_crt_full=$(srctree)/$(subst $(quote),,$(CONFIG_EFI_CAPSULE_CRT_FILE))
+quiet_cmd_capsule_esl_gen = CAPSULE_ESL_GEN $@
+cmd_capsule_esl_gen = cert-to-efi-sig-list $(capsule_crt_full) $@
+$(srctree)/capsule_esl_file: FORCE
+	@if [ ! -e "$(capsule_crt_full)" ]; then \
+		echo "ERROR: path $(capsule_crt_full) is invalid." >&2; \
+		echo "EFI CONFIG_EFI_CAPSULE_CRT_FILE must be specified when CONFIG_EFI_CAPSULE_AUTHENTICATE is enabled." >&2; \
+		exit 1; \
+	fi
+	$(call cmd,capsule_esl_gen)
+
+$(obj)/efi_capsule.o: $(srctree)/capsule_esl_file FORCE
+asflags-y += -DCAPSULE_ESL_PATH=\"$(srctree)/capsule_esl_file\"
+endif
+
 # Set the C flags to add and remove for each app
 $(foreach f,$(apps-y),\
 	$(eval CFLAGS_$(f).o := $(CFLAGS_EFI) -Os -ffreestanding)\
diff --git a/lib/efi_loader/capsule_esl.dtsi.in b/lib/efi_loader/capsule_esl.dtsi.in
deleted file mode 100644
index bc7db83..0000000
--- a/lib/efi_loader/capsule_esl.dtsi.in
+++ /dev/null
@@ -1,11 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0+
-/*
- * Devicetree file with the public key EFI Signature List(ESL)
- * node. This file is used to generate the dtsi file to be
- * included into the DTB.
- */
-/ {
-	signature {
-		capsule-key = /incbin/("ESL_BIN_FILE");
-	};
-};
diff --git a/lib/efi_loader/efi_acpi.c b/lib/efi_loader/efi_acpi.c
index 4422b31..046986a 100644
--- a/lib/efi_loader/efi_acpi.c
+++ b/lib/efi_loader/efi_acpi.c
@@ -7,6 +7,7 @@
 
 #define LOG_CATEGORY LOGC_EFI
 
+#include <bloblist.h>
 #include <efi_loader.h>
 #include <log.h>
 #include <mapmem.h>
@@ -34,25 +35,38 @@
 	 * add_u_boot_and_runtime(). At some point that function could create a
 	 * more detailed map.
 	 */
-	if (IS_ENABLED(CONFIG_BLOBLIST_TABLES))
-		return EFI_SUCCESS;
+	if (IS_ENABLED(CONFIG_BLOBLIST_TABLES)) {
+		int size;
+		void *tab = bloblist_get_blob(BLOBLISTT_ACPI_TABLES, &size);
 
-	/* Mark space used for tables */
-	start = ALIGN_DOWN(gd->arch.table_start, EFI_PAGE_MASK);
-	end = ALIGN(gd->arch.table_end, EFI_PAGE_MASK);
-	ret = efi_add_memory_map(start, end - start, EFI_ACPI_RECLAIM_MEMORY);
-	if (ret != EFI_SUCCESS)
-		return ret;
-	if (gd->arch.table_start_high) {
-		start = ALIGN_DOWN(gd->arch.table_start_high, EFI_PAGE_MASK);
-		end = ALIGN(gd->arch.table_end_high, EFI_PAGE_MASK);
+		if (!tab)
+			return EFI_NOT_FOUND;
+		addr = map_to_sysmem(tab);
+
+		ret = efi_add_memory_map(addr, size,
+					 EFI_ACPI_RECLAIM_MEMORY);
+		if (ret != EFI_SUCCESS)
+			return ret;
+	} else {
+		/* Mark space used for tables */
+		start = ALIGN_DOWN(gd->arch.table_start, EFI_PAGE_MASK);
+		end = ALIGN(gd->arch.table_end, EFI_PAGE_MASK);
 		ret = efi_add_memory_map(start, end - start,
 					 EFI_ACPI_RECLAIM_MEMORY);
 		if (ret != EFI_SUCCESS)
 			return ret;
-	}
+		if (gd->arch.table_start_high) {
+			start = ALIGN_DOWN(gd->arch.table_start_high,
+					   EFI_PAGE_MASK);
+			end = ALIGN(gd->arch.table_end_high, EFI_PAGE_MASK);
+			ret = efi_add_memory_map(start, end - start,
+						 EFI_ACPI_RECLAIM_MEMORY);
+			if (ret != EFI_SUCCESS)
+				return ret;
+		}
 
-	addr = gd_acpi_start();
+		addr = gd_acpi_start();
+	}
 	log_debug("EFI using ACPI tables at %lx\n", addr);
 
 	/* And expose them to our EFI payload */
diff --git a/lib/efi_loader/efi_bootbin.c b/lib/efi_loader/efi_bootbin.c
index deafb2c..d0f7da3 100644
--- a/lib/efi_loader/efi_bootbin.c
+++ b/lib/efi_loader/efi_bootbin.c
@@ -204,6 +204,8 @@
  * @image:	memory address of the UEFI image
  * @size:	size of the UEFI image
  * @fdt:	device-tree
+ * @initrd:	initrd
+ * @initrd_sz:	initrd size
  * @dp_dev:	EFI device-path
  * @dp_img:	EFI image-path
  *
@@ -213,10 +215,12 @@
  * Return:	status code
  */
 static efi_status_t efi_binary_run_dp(void *image, size_t size, void *fdt,
+				      void *initrd, size_t initd_sz,
 				      struct efi_device_path *dp_dev,
 				      struct efi_device_path *dp_img)
 {
 	efi_status_t ret;
+	struct efi_device_path *dp_initrd;
 
 	/* Initialize EFI drivers */
 	ret = efi_init_obj_list();
@@ -230,6 +234,14 @@
 	if (ret != EFI_SUCCESS)
 		return ret;
 
+	dp_initrd = efi_dp_from_mem(EFI_LOADER_DATA, (uintptr_t)initrd, initd_sz);
+	if (!dp_initrd)
+		return EFI_OUT_OF_RESOURCES;
+
+	ret = efi_initrd_register(dp_initrd);
+	if (ret != EFI_SUCCESS)
+		return ret;
+
 	return efi_run_image(image, size, dp_dev, dp_img);
 }
 
@@ -239,13 +251,15 @@
  * @image:	memory address of the UEFI image
  * @size:	size of the UEFI image
  * @fdt:	device-tree
+ * @initrd:	initrd
+ * @initrd_sz:	initrd size
  *
  * Execute an EFI binary image loaded at @image.
  * @size may be zero if the binary is loaded with U-Boot load command.
  *
  * Return:	status code
  */
-efi_status_t efi_binary_run(void *image, size_t size, void *fdt)
+efi_status_t efi_binary_run(void *image, size_t size, void *fdt, void *initrd, size_t initrd_sz)
 {
 	efi_handle_t mem_handle = NULL;
 	struct efi_device_path *file_path = NULL;
@@ -269,11 +283,14 @@
 							       file_path, NULL);
 		if (ret != EFI_SUCCESS)
 			goto out;
+
+		bootefi_device_path = file_path;
+		bootefi_image_path = NULL;
 	} else {
 		log_debug("Loaded from disk\n");
 	}
 
-	ret = efi_binary_run_dp(image, size, fdt, bootefi_device_path,
+	ret = efi_binary_run_dp(image, size, fdt, initrd, initrd_sz, bootefi_device_path,
 				bootefi_image_path);
 out:
 	if (mem_handle) {
@@ -355,7 +372,7 @@
 		log_debug("Booting with external fdt\n");
 		fdt = map_sysmem(bflow->fdt_addr, 0);
 	}
-	ret = efi_binary_run_dp(bflow->buf, bflow->size, fdt, device, image);
+	ret = efi_binary_run_dp(bflow->buf, bflow->size, fdt, NULL, 0, device, image);
 
 	return ret;
 }
diff --git a/lib/efi_loader/efi_bootmgr.c b/lib/efi_loader/efi_bootmgr.c
index f9534ef..c0df5cb 100644
--- a/lib/efi_loader/efi_bootmgr.c
+++ b/lib/efi_loader/efi_bootmgr.c
@@ -685,12 +685,12 @@
 
 	/* try to register load file2 for initrd's */
 	if (IS_ENABLED(CONFIG_EFI_LOAD_FILE2_INITRD)) {
-		ret = efi_initrd_register();
+		ret = efi_initrd_register(NULL);
 		if (ret != EFI_SUCCESS)
 			goto error;
 	}
 
-	log_info("Booting: %ls\n", lo.label);
+	log_info("Booting: Label: %ls Device path: %pD\n", lo.label, lo.file_path);
 
 	/* Ignore the optional data in auto-generated boot options */
 	if (size >= sizeof(efi_guid_t) &&
diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c
index f8a4a7c..1aa52ac 100644
--- a/lib/efi_loader/efi_capsule.c
+++ b/lib/efi_loader/efi_capsule.c
@@ -22,6 +22,7 @@
 #include <asm/global_data.h>
 #include <u-boot/uuid.h>
 
+#include <asm/sections.h>
 #include <crypto/pkcs7.h>
 #include <crypto/pkcs7_parser.h>
 #include <linux/err.h>
@@ -284,33 +285,12 @@
 }
 
 #if defined(CONFIG_EFI_CAPSULE_AUTHENTICATE)
-int efi_get_public_key_data(void **pkey, efi_uintn_t *pkey_len)
+static int efi_get_public_key_data(const void **pkey, efi_uintn_t *pkey_len)
 {
-	const void *fdt_blob = gd->fdt_blob;
-	const void *blob;
-	const char *cnode_name = "capsule-key";
-	const char *snode_name = "signature";
-	int sig_node;
-	int len;
+	const void *blob = __efi_capsule_sig_begin;
+	const int len = __efi_capsule_sig_end - __efi_capsule_sig_begin;
 
-	sig_node = fdt_subnode_offset(fdt_blob, 0, snode_name);
-	if (sig_node < 0) {
-		log_err("Unable to get signature node offset\n");
-
-		return -FDT_ERR_NOTFOUND;
-	}
-
-	blob = fdt_getprop(fdt_blob, sig_node, cnode_name, &len);
-
-	if (!blob || len < 0) {
-		log_err("Unable to get capsule-key value\n");
-		*pkey = NULL;
-		*pkey_len = 0;
-
-		return -FDT_ERR_NOTFOUND;
-	}
-
-	*pkey = (void *)blob;
+	*pkey = blob;
 	*pkey_len = len;
 
 	return 0;
@@ -321,7 +301,8 @@
 {
 	u8 *buf;
 	int ret;
-	void *fdt_pkey, *pkey;
+	void *pkey;
+	const void *stored_pkey;
 	efi_uintn_t pkey_len;
 	uint64_t monotonic_count;
 	struct efi_signature_store *truststore;
@@ -373,7 +354,7 @@
 		goto out;
 	}
 
-	ret = efi_get_public_key_data(&fdt_pkey, &pkey_len);
+	ret = efi_get_public_key_data(&stored_pkey, &pkey_len);
 	if (ret < 0)
 		goto out;
 
@@ -381,7 +362,7 @@
 	if (!pkey)
 		goto out;
 
-	memcpy(pkey, fdt_pkey, pkey_len);
+	memcpy(pkey, stored_pkey, pkey_len);
 	truststore = efi_build_signature_store(pkey, pkey_len);
 	if (!truststore)
 		goto out;
diff --git a/lib/efi_loader/efi_capsule_key.S b/lib/efi_loader/efi_capsule_key.S
new file mode 100644
index 0000000..80cefbe
--- /dev/null
+++ b/lib/efi_loader/efi_capsule_key.S
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * .esl cert for capsule authentication
+ *
+ * Copyright (c) 2021, Ilias Apalodimas <ilias.apalodimas@linaro.org>
+ */
+
+#include <config.h>
+
+.section .rodata.capsule_key.init,"a"
+.balign 16
+.global __efi_capsule_sig_begin
+__efi_capsule_sig_begin:
+.incbin CAPSULE_ESL_PATH
+__efi_capsule_sig_end:
+.global __efi_capsule_sig_end
+.balign 16
diff --git a/lib/efi_loader/efi_dt_fixup.c b/lib/efi_loader/efi_dt_fixup.c
index 26928cf..544e1aa 100644
--- a/lib/efi_loader/efi_dt_fixup.c
+++ b/lib/efi_loader/efi_dt_fixup.c
@@ -168,7 +168,7 @@
 		/* Check size */
 		required_size = fdt_off_dt_strings(dtb) +
 				fdt_size_dt_strings(dtb) +
-				0x3000;
+				CONFIG_SYS_FDT_PAD;
 		total_size = fdt_totalsize(dtb);
 		if (required_size < total_size)
 			required_size = total_size;
diff --git a/lib/efi_loader/efi_firmware.c b/lib/efi_loader/efi_firmware.c
index 5a754c9..d44dc09 100644
--- a/lib/efi_loader/efi_firmware.c
+++ b/lib/efi_loader/efi_firmware.c
@@ -56,11 +56,6 @@
 	u32 last_attempt_status; /* not used */
 };
 
-__weak void set_dfu_alt_info(char *interface, char *devstr)
-{
-	env_set("dfu_alt_info", update_info.dfu_string);
-}
-
 /**
  * efi_firmware_get_image_type_id - get image_type_id
  * @image_index:	image index
@@ -649,8 +644,10 @@
 	efi_status_t (*progress)(efi_uintn_t completion),
 	u16 **abort_reason)
 {
+	int ret;
 	efi_status_t status;
 	struct fmp_state state = { 0 };
+	char *orig_dfu_env;
 
 	EFI_ENTRY("%p %d %p %zu %p %p %p\n", this, image_index, image,
 		  image_size, vendor_code, progress, abort_reason);
@@ -663,7 +660,28 @@
 	if (status != EFI_SUCCESS)
 		return EFI_EXIT(status);
 
+	orig_dfu_env = env_get("dfu_alt_info");
+	if (orig_dfu_env) {
+		orig_dfu_env = strdup(orig_dfu_env);
+		if (!orig_dfu_env) {
+			log_err("strdup() failed!\n");
+			return EFI_EXIT(EFI_OUT_OF_RESOURCES);
+		}
+	}
+	if (env_set("dfu_alt_info", update_info.dfu_string)) {
+		log_err("Unable to set env variable \"dfu_alt_info\"!\n");
+		free(orig_dfu_env);
+		return EFI_EXIT(EFI_DEVICE_ERROR);
+	}
+
+	ret = fit_update(image);
+
-	if (fit_update(image))
+	if (env_set("dfu_alt_info", orig_dfu_env))
+		log_warning("Unable to restore env variable \"dfu_alt_info\".  Further DFU operations may fail!\n");
+
+	free(orig_dfu_env);
+
+	if (ret)
 		return EFI_EXIT(EFI_DEVICE_ERROR);
 
 	efi_firmware_set_fmp_state_var(&state, image_index);
@@ -717,6 +735,7 @@
 	u8 dfu_alt_num;
 	efi_status_t status;
 	struct fmp_state state = { 0 };
+	char *orig_dfu_env;
 
 	EFI_ENTRY("%p %d %p %zu %p %p %p\n", this, image_index, image,
 		  image_size, vendor_code, progress, abort_reason);
@@ -746,9 +765,30 @@
 			return EFI_EXIT(EFI_DEVICE_ERROR);
 		}
 	}
+
+	orig_dfu_env = env_get("dfu_alt_info");
+	if (orig_dfu_env) {
+		orig_dfu_env = strdup(orig_dfu_env);
+		if (!orig_dfu_env) {
+			log_err("strdup() failed!\n");
+			return EFI_EXIT(EFI_OUT_OF_RESOURCES);
+		}
+	}
+	if (env_set("dfu_alt_info", update_info.dfu_string)) {
+		log_err("Unable to set env variable \"dfu_alt_info\"!\n");
+		free(orig_dfu_env);
+		return EFI_EXIT(EFI_DEVICE_ERROR);
+	}
+
+	ret = dfu_write_by_alt(dfu_alt_num, (void *)image, image_size,
+			       NULL, NULL);
+
+	if (env_set("dfu_alt_info", orig_dfu_env))
+		log_warning("Unable to restore env variable \"dfu_alt_info\".  Further DFU operations may fail!\n");
+
+	free(orig_dfu_env);
 
-	if (dfu_write_by_alt(dfu_alt_num, (void *)image, image_size,
-			     NULL, NULL))
+	if (ret)
 		return EFI_EXIT(EFI_DEVICE_ERROR);
 
 	efi_firmware_set_fmp_state_var(&state, image_index);
diff --git a/lib/efi_loader/efi_helper.c b/lib/efi_loader/efi_helper.c
index 8c32059..3936139 100644
--- a/lib/efi_loader/efi_helper.c
+++ b/lib/efi_loader/efi_helper.c
@@ -485,7 +485,7 @@
 	 * needs to be expanded later.
 	 */
 	fdt = *fdtp;
-	fdt_pages = efi_size_in_pages(fdt_totalsize(fdt) + 0x3000);
+	fdt_pages = efi_size_in_pages(fdt_totalsize(fdt) + CONFIG_SYS_FDT_PAD);
 	fdt_size = fdt_pages << EFI_PAGE_SHIFT;
 
 	ret = efi_allocate_pages(EFI_ALLOCATE_ANY_PAGES,
diff --git a/lib/efi_loader/efi_hii.c b/lib/efi_loader/efi_hii.c
index 4423597..330d7c5 100644
--- a/lib/efi_loader/efi_hii.c
+++ b/lib/efi_loader/efi_hii.c
@@ -343,6 +343,9 @@
 	struct efi_hii_packagelist *hii;
 
 	hii = malloc(sizeof(*hii));
+	if (!hii)
+		return NULL;
+
 	list_add_tail(&hii->link, &efi_package_lists);
 	hii->max_string_id = 0;
 	INIT_LIST_HEAD(&hii->string_tables);
diff --git a/lib/efi_loader/efi_load_initrd.c b/lib/efi_loader/efi_load_initrd.c
index fb8cc7b..b5d5894 100644
--- a/lib/efi_loader/efi_load_initrd.c
+++ b/lib/efi_loader/efi_load_initrd.c
@@ -42,6 +42,7 @@
 };
 
 static efi_handle_t efi_initrd_handle;
+static struct efi_device_path *efi_initrd_dp;
 
 /**
  * get_initrd_fp() - Get initrd device path from a FilePathList device path
@@ -73,6 +74,41 @@
 }
 
 /**
+ * efi_initrd_from_mem() - load initial RAM disk from memory
+ *
+ * This function copies the initrd from the memory mapped device
+ * path pointed to by efi_initrd_dp
+ *
+ * @buffer_size:		size of allocated buffer
+ * @buffer:			buffer to load the file
+ *
+ * Return:			status code
+ */
+static efi_status_t efi_initrd_from_mem(efi_uintn_t *buffer_size, void *buffer)
+{
+	efi_status_t ret = EFI_NOT_FOUND;
+	efi_uintn_t bs;
+	struct efi_device_path_memory *mdp;
+
+	mdp = (struct efi_device_path_memory *)efi_initrd_dp;
+	if (!mdp)
+		return ret;
+
+	bs = mdp->end_address - mdp->start_address;
+
+	if (!buffer || *buffer_size < bs) {
+		ret = EFI_BUFFER_TOO_SMALL;
+		*buffer_size = bs;
+	} else {
+		memcpy(buffer, (void *)(uintptr_t)mdp->start_address, bs);
+		*buffer_size = bs;
+		ret = EFI_SUCCESS;
+	}
+
+	return ret;
+}
+
+/**
  * efi_load_file2_initrd() - load initial RAM disk
  *
  * This function implements the LoadFile service of the EFI_LOAD_FILE2_PROTOCOL
@@ -118,6 +154,9 @@
 		goto out;
 	}
 
+	if (efi_initrd_dp)
+		return EFI_EXIT(efi_initrd_from_mem(buffer_size, buffer));
+
 	ret = get_initrd_fp(&initrd_fp);
 	if (ret != EFI_SUCCESS)
 		goto out;
@@ -209,6 +248,9 @@
 							 NULL);
 	efi_initrd_handle = NULL;
 
+	efi_free_pool(efi_initrd_dp);
+	efi_initrd_dp = NULL;
+
 	return ret;
 }
 
@@ -234,24 +276,31 @@
  * This function creates a new handle and installs a Linux specific vendor
  * device path and an EFI_LOAD_FILE2_PROTOCOL. Linux uses the device path
  * to identify the handle and then calls the LoadFile service of the
- * EFI_LOAD_FILE2_PROTOCOL to read the initial RAM disk.
+ * EFI_LOAD_FILE2_PROTOCOL to read the initial RAM disk. If dp_initrd is
+ * not provided, the initrd will be taken from the BootCurrent variable
+ *
+ * @dp_initrd:	optional device path containing an initrd
  *
  * Return:	status code
  */
-efi_status_t efi_initrd_register(void)
+efi_status_t efi_initrd_register(struct efi_device_path *dp_initrd)
 {
 	efi_status_t ret;
 	struct efi_event *event;
 
-	/*
-	 * Allow the user to continue if Boot#### file path is not set for
-	 * an initrd
-	 */
-	ret = check_initrd();
-	if (ret == EFI_INVALID_PARAMETER)
-		return EFI_SUCCESS;
-	if (ret != EFI_SUCCESS)
-		return ret;
+	if (dp_initrd) {
+		efi_initrd_dp = dp_initrd;
+	} else {
+		/*
+		* Allow the user to continue if Boot#### file path is not set for
+		* an initrd
+		*/
+		ret = check_initrd();
+		if (ret == EFI_INVALID_PARAMETER)
+			return EFI_SUCCESS;
+		if (ret != EFI_SUCCESS)
+			return ret;
+	}
 
 	ret = efi_install_multiple_protocol_interfaces(&efi_initrd_handle,
 						       /* initramfs */
diff --git a/lib/efi_selftest/efi_selftest_hii.c b/lib/efi_selftest/efi_selftest_hii.c
index c363df4..228dc29 100644
--- a/lib/efi_selftest/efi_selftest_hii.c
+++ b/lib/efi_selftest/efi_selftest_hii.c
@@ -609,14 +609,12 @@
 	result = EFI_ST_SUCCESS;
 
 out:
-	if (handle) {
-		ret = hii_database_protocol->remove_package_list(
-				hii_database_protocol, handle);
-		if (ret != EFI_SUCCESS) {
-			efi_st_error("remove_package_list returned %u\n",
-				     (unsigned int)ret);
-			return EFI_ST_FAILURE;
-		}
+	ret = hii_database_protocol->remove_package_list(
+			hii_database_protocol, handle);
+	if (ret != EFI_SUCCESS) {
+		efi_st_error("remove_package_list returned %u\n",
+			     (unsigned int)ret);
+		return EFI_ST_FAILURE;
 	}
 
 	return result;
@@ -711,14 +709,12 @@
 	result = EFI_ST_SUCCESS;
 
 out:
-	if (handle) {
-		ret = hii_database_protocol->remove_package_list(
-				hii_database_protocol, handle);
-		if (ret != EFI_SUCCESS) {
-			efi_st_error("remove_package_list returned %u\n",
-				     (unsigned int)ret);
-			return EFI_ST_FAILURE;
-		}
+	ret = hii_database_protocol->remove_package_list(
+			hii_database_protocol, handle);
+	if (ret != EFI_SUCCESS) {
+		efi_st_error("remove_package_list returned %u\n",
+			     (unsigned int)ret);
+		return EFI_ST_FAILURE;
 	}
 
 	return result;
@@ -792,14 +788,12 @@
 	result = EFI_ST_SUCCESS;
 
 out:
-	if (handle) {
-		ret = hii_database_protocol->remove_package_list(
-				hii_database_protocol, handle);
-		if (ret != EFI_SUCCESS) {
-			efi_st_error("remove_package_list returned %u\n",
-				     (unsigned int)ret);
-			return EFI_ST_FAILURE;
-		}
+	ret = hii_database_protocol->remove_package_list(
+			hii_database_protocol, handle);
+	if (ret != EFI_SUCCESS) {
+		efi_st_error("remove_package_list returned %u\n",
+			     (unsigned int)ret);
+		return EFI_ST_FAILURE;
 	}
 
 	return result;
@@ -851,14 +845,12 @@
 	result = EFI_ST_SUCCESS;
 
 out:
-	if (handle) {
-		ret = hii_database_protocol->remove_package_list(
-				hii_database_protocol, handle);
-		if (ret != EFI_SUCCESS) {
-			efi_st_error("remove_package_list returned %u\n",
-				     (unsigned int)ret);
-			return EFI_ST_FAILURE;
-		}
+	ret = hii_database_protocol->remove_package_list(
+			hii_database_protocol, handle);
+	if (ret != EFI_SUCCESS) {
+		efi_st_error("remove_package_list returned %u\n",
+			     (unsigned int)ret);
+		return EFI_ST_FAILURE;
 	}
 
 	return result;
@@ -918,14 +910,12 @@
 	result = EFI_ST_SUCCESS;
 
 out:
-	if (handle) {
-		ret = hii_database_protocol->remove_package_list(
-				hii_database_protocol, handle);
-		if (ret != EFI_SUCCESS) {
-			efi_st_error("remove_package_list returned %u\n",
-				     (unsigned int)ret);
-			return EFI_ST_FAILURE;
-		}
+	ret = hii_database_protocol->remove_package_list(
+			hii_database_protocol, handle);
+	if (ret != EFI_SUCCESS) {
+		efi_st_error("remove_package_list returned %u\n",
+			     (unsigned int)ret);
+		return EFI_ST_FAILURE;
 	}
 
 	return result;
@@ -991,14 +981,12 @@
 	result = EFI_ST_SUCCESS;
 
 out:
-	if (handle) {
-		ret = hii_database_protocol->remove_package_list(
-				hii_database_protocol, handle);
-		if (ret != EFI_SUCCESS) {
-			efi_st_error("remove_package_list returned %u\n",
-				     (unsigned int)ret);
-			return EFI_ST_FAILURE;
-		}
+	ret = hii_database_protocol->remove_package_list(
+			hii_database_protocol, handle);
+	if (ret != EFI_SUCCESS) {
+		efi_st_error("remove_package_list returned %u\n",
+			     (unsigned int)ret);
+		return EFI_ST_FAILURE;
 	}
 
 	return result;
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 275c308..83fd5ff 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -377,35 +377,8 @@
 		; \
 	sed "s:$(pre-tmp):$(<):" $(depfile).pre.tmp $(depfile).dtc.tmp > $(depfile)
 
-capsule_esl_input_file=$(srctree)/lib/efi_loader/capsule_esl.dtsi.in
-capsule_crt_file=$(subst $(quote),,$(CONFIG_EFI_CAPSULE_CRT_FILE))
-capsule_esl_dtsi=.capsule_esl.dtsi
-
-quiet_cmd_capsule_esl_gen = CAPSULE_ESL_GEN $@
-cmd_capsule_esl_gen = cert-to-efi-sig-list $< $@
-
-$(obj)/capsule_esl_file: $(capsule_crt_file) FORCE
-ifeq ($(CONFIG_EFI_CAPSULE_CRT_FILE),"")
-	$(error "CONFIG_EFI_CAPSULE_CRT_FILE is empty, EFI capsule authentication \
-	public key must be specified when CONFIG_EFI_CAPSULE_AUTHENTICATE is enabled")
-else
-	$(call cmd,capsule_esl_gen)
-endif
-
-quiet_cmd_capsule_dtsi_gen = CAPSULE_DTSI_GEN $@
-cmd_capsule_dtsi_gen = \
-	$(shell sed "s:ESL_BIN_FILE:$(abspath $<):" $(capsule_esl_input_file) > $@)
-
-$(obj)/$(capsule_esl_dtsi): $(obj)/capsule_esl_file FORCE
-	$(call cmd,capsule_dtsi_gen)
-
 dtsi_include_list_deps := $(addprefix $(u_boot_dtsi_loc),$(subst $(quote),,$(dtsi_include_list)))
 
-ifdef CONFIG_EFI_CAPSULE_AUTHENTICATE
-dtsi_include_list += $(capsule_esl_dtsi)
-dtsi_include_list_deps += $(obj)/$(capsule_esl_dtsi)
-endif
-
 ifneq ($(CHECK_DTBS),)
 DT_CHECKER ?= dt-validate
 DT_CHECKER_FLAGS ?= $(if $(DT_SCHEMA_FILES),-l $(DT_SCHEMA_FILES),-m)
diff --git a/tools/Makefile b/tools/Makefile
index d0e4d2d..97ce1db 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -63,8 +63,7 @@
 hostprogs-y += mkenvimage
 mkenvimage-objs := mkenvimage.o os_support.o generated/lib/crc32.o
 
-hostprogs-y += dumpimage mkimage
-hostprogs-$(CONFIG_TOOLS_LIBCRYPTO) += fit_info fit_check_sign
+hostprogs-y += dumpimage mkimage fit_info fit_check_sign
 hostprogs-$(CONFIG_TOOLS_LIBCRYPTO) += fdt_add_pubkey
 hostprogs-$(CONFIG_TOOLS_LIBCRYPTO) += preload_check_sign
 
diff --git a/tools/buildman/buildman.rst b/tools/buildman/buildman.rst
index 924564b..07ecc5c 100644
--- a/tools/buildman/buildman.rst
+++ b/tools/buildman/buildman.rst
@@ -247,7 +247,7 @@
    section is ignored. If more than one line is provided, only the last one
    is taken.
 
-#. Make sure you have the require Python pre-requisites
+#. Make sure you have the required Python pre-requisites
 
    Buildman uses multiprocessing, Queue, shutil, StringIO, ConfigParser and
    urllib2. These should normally be available, but if you get an error like
diff --git a/tools/fit_check_sign.c b/tools/fit_check_sign.c
index 3d1d33f..32d0fdb 100644
--- a/tools/fit_check_sign.c
+++ b/tools/fit_check_sign.c
@@ -45,7 +45,7 @@
 	char *config_name = NULL;
 	char cmdname[256];
 	int ret;
-	void *key_blob;
+	void *key_blob = NULL;
 	int c;
 
 	strncpy(cmdname, *argv, sizeof(cmdname) - 1);
@@ -70,18 +70,15 @@
 		fprintf(stderr, "%s: Missing fdt file\n", *argv);
 		usage(*argv);
 	}
-	if (!keyfile) {
-		fprintf(stderr, "%s: Missing key file\n", *argv);
-		usage(*argv);
-	}
 
 	ffd = mmap_fdt(cmdname, fdtfile, 0, &fit_blob, &fsbuf, false, true);
 	if (ffd < 0)
 		return EXIT_FAILURE;
-	kfd = mmap_fdt(cmdname, keyfile, 0, &key_blob, &ksbuf, false, true);
-	if (kfd < 0)
-		return EXIT_FAILURE;
-
+	if (keyfile) {
+		kfd = mmap_fdt(cmdname, keyfile, 0, &key_blob, &ksbuf, false, true);
+		if (kfd < 0)
+			return EXIT_FAILURE;
+	}
 	image_set_host_blob(key_blob);
 	ret = fit_check_sign(fit_blob, key_blob, config_name);
 	if (!ret) {
@@ -93,7 +90,9 @@
 	}
 
 	(void) munmap((void *)fit_blob, fsbuf.st_size);
-	(void) munmap((void *)key_blob, ksbuf.st_size);
+
+	if (key_blob)
+		(void)munmap((void *)key_blob, ksbuf.st_size);
 
 	close(ffd);
 	close(kfd);