diff --git a/cmd/setexpr.c b/cmd/setexpr.c
index 4d671e7..233471f 100644
--- a/cmd/setexpr.c
+++ b/cmd/setexpr.c
@@ -215,7 +215,7 @@
 
 		if (res == 0) {
 			if (loop == 0) {
-				printf("%s: No match\n", data);
+				debug("%s: No match\n", data);
 				return 1;
 			} else {
 				break;
@@ -359,7 +359,7 @@
 	if (ret)
 		return 1;
 
-	printf("%s=%s\n", name, data);
+	debug("%s=%s\n", name, data);
 
 	return env_set(name, data);
 }
diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig
index 0f01471..98f0bc1 100644
--- a/configs/sandbox_defconfig
+++ b/configs/sandbox_defconfig
@@ -226,6 +226,7 @@
 CONFIG_SPI_FLASH_STMICRO=y
 CONFIG_SPI_FLASH_SST=y
 CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_NVMXIP_QSPI=y
 CONFIG_MULTIPLEXER=y
 CONFIG_MUX_MMIO=y
 CONFIG_NVME_PCI=y
diff --git a/drivers/mtd/nvmxip/nvmxip-uclass.c b/drivers/mtd/nvmxip/nvmxip-uclass.c
index 6d8eb17..9a316d1 100644
--- a/drivers/mtd/nvmxip/nvmxip-uclass.c
+++ b/drivers/mtd/nvmxip/nvmxip-uclass.c
@@ -22,27 +22,13 @@
 
 #define DEFAULT_LBA_SZ BIT(DEFAULT_LBA_SHIFT)
 
-/**
- * nvmxip_post_bind() - post binding treatments
- * @dev:	the NVMXIP device
- *
- * Create and probe a child block device.
- *
- * Return:
- *
- * 0 on success. Otherwise, failure
- */
-static int nvmxip_post_bind(struct udevice *udev)
+int nvmxip_probe(struct udevice *udev)
 {
 	int ret;
 	struct udevice *bdev = NULL;
 	char bdev_name[NVMXIP_BLKDEV_NAME_SZ + 1];
 	int devnum;
 
-#if CONFIG_IS_ENABLED(SANDBOX64)
-	sandbox_set_enable_memio(true);
-#endif
-
 	devnum = uclass_id_count(UCLASS_NVMXIP);
 	snprintf(bdev_name, NVMXIP_BLKDEV_NAME_SZ, "blk#%d", devnum);
 
@@ -67,6 +53,12 @@
 	return 0;
 }
 
+static int nvmxip_post_bind(struct udevice *udev)
+{
+	dev_or_flags(udev, DM_FLAG_PROBE_AFTER_BIND);
+	return 0;
+}
+
 UCLASS_DRIVER(nvmxip) = {
 	.name	   = "nvmxip",
 	.id	   = UCLASS_NVMXIP,
diff --git a/drivers/mtd/nvmxip/nvmxip.c b/drivers/mtd/nvmxip/nvmxip.c
index a359e3b..0bd98d6 100644
--- a/drivers/mtd/nvmxip/nvmxip.c
+++ b/drivers/mtd/nvmxip/nvmxip.c
@@ -16,23 +16,6 @@
 #include "nvmxip.h"
 
 /**
- * nvmxip_mmio_rawread() - read from the XIP flash
- * @address:	address of the data
- * @value:	pointer to where storing the value read
- *
- * Read raw data from the XIP flash.
- *
- * Return:
- *
- * Always return 0.
- */
-static int nvmxip_mmio_rawread(const phys_addr_t address, u64 *value)
-{
-	*value = readq(address);
-	return 0;
-}
-
-/**
  * nvmxip_blk_read() - block device read operation
  * @dev:	the block device
  * @blknr:	first block number to read from
@@ -49,15 +32,14 @@
 {
 	struct nvmxip_plat *plat = dev_get_plat(dev->parent);
 	struct blk_desc *desc = dev_get_uclass_plat(dev);
-	/* number of the u64 words to read */
-	u32 qwords = (blkcnt * desc->blksz) / sizeof(u64);
+	/* number of bytes to read */
+	u32 size = blkcnt * desc->blksz;
 	/* physical address of the first block to read */
 	phys_addr_t blkaddr = plat->phys_base + blknr * desc->blksz;
-	u64 *virt_blkaddr;
-	u64 *pdst = buffer;
+	void *virt_blkaddr;
 	uint qdata_idx;
 
-	if (!pdst)
+	if (!buffer)
 		return -EINVAL;
 
 	log_debug("[%s]: reading from blknr: %lu , blkcnt: %lu\n", dev->name, blknr, blkcnt);
@@ -66,12 +48,16 @@
 
 	/* assumption: the data is virtually contiguous */
 
-	for (qdata_idx = 0 ; qdata_idx < qwords ; qdata_idx++)
-		nvmxip_mmio_rawread((phys_addr_t)(virt_blkaddr + qdata_idx), pdst++);
-
+#if IS_ENABLED(CONFIG_PHYS_64BIT)
+	for (qdata_idx = 0 ; qdata_idx < size; qdata_idx += sizeof(u64))
+		*(u64 *)(buffer + qdata_idx) = readq(virt_blkaddr + qdata_idx);
+#else
+	for (qdata_idx = 0 ; qdata_idx < size; qdata_idx += sizeof(u32))
+		*(u32 *)(buffer + qdata_idx) = readl(virt_blkaddr + qdata_idx);
+#endif
 	log_debug("[%s]:     src[0]: 0x%llx , dst[0]: 0x%llx , src[-1]: 0x%llx , dst[-1]: 0x%llx\n",
 		  dev->name,
-		  *virt_blkaddr,
+		  *(u64 *)virt_blkaddr,
 		  *(u64 *)buffer,
 		  *(u64 *)((u8 *)virt_blkaddr + desc->blksz * blkcnt - sizeof(u64)),
 		  *(u64 *)((u8 *)buffer + desc->blksz * blkcnt - sizeof(u64)));
diff --git a/drivers/mtd/nvmxip/nvmxip_qspi.c b/drivers/mtd/nvmxip/nvmxip_qspi.c
index 7221fd1..4d74711 100644
--- a/drivers/mtd/nvmxip/nvmxip_qspi.c
+++ b/drivers/mtd/nvmxip/nvmxip_qspi.c
@@ -50,8 +50,8 @@
 		return -EINVAL;
 	}
 
-	log_debug("[%s]: XIP device base addr: 0x%llx , lba_shift: %d , lbas: %lu\n",
-		  dev->name, plat->phys_base, plat->lba_shift, plat->lba);
+	log_debug("[%s]: XIP device base addr: 0x%p , lba_shift: %d , lbas: %lu\n",
+		  dev->name, (void *)(uintptr_t)plat->phys_base, plat->lba_shift, plat->lba);
 
 	return 0;
 }
@@ -66,5 +66,6 @@
 	.id = UCLASS_NVMXIP,
 	.of_match = nvmxip_qspi_ids,
 	.of_to_plat = nvmxip_qspi_of_to_plat,
+	.probe = nvmxip_probe,
 	.plat_auto = sizeof(struct nvmxip_plat),
 };
diff --git a/drivers/pci/pcie_brcmstb.c b/drivers/pci/pcie_brcmstb.c
index 1de2802..cd45f0b 100644
--- a/drivers/pci/pcie_brcmstb.c
+++ b/drivers/pci/pcie_brcmstb.c
@@ -33,6 +33,9 @@
 #define PCIE_RC_CFG_PRIV1_ID_VAL3			0x043c
 #define  CFG_PRIV1_ID_VAL3_CLASS_CODE_MASK		0xffffff
 
+#define PCIE_RC_CFG_PRIV1_LINK_CAPABILITY			0x04dc
+#define  PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK	0xc00
+
 #define PCIE_RC_DL_MDIO_ADDR				0x1100
 #define PCIE_RC_DL_MDIO_WR_DATA				0x1104
 #define PCIE_RC_DL_MDIO_RD_DATA				0x1108
@@ -88,7 +91,6 @@
 	 PCIE_MISC_CPU_2_PCIE_MEM_WIN0_LIMIT_HI + ((win) * 8)
 
 #define PCIE_MISC_HARD_PCIE_HARD_DEBUG			0x4204
-#define  PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK	0x2
 #define  PCIE_HARD_DEBUG_SERDES_IDDQ_MASK		0x08000000
 
 #define PCIE_MSI_INTR2_CLR				0x4508
@@ -223,6 +225,10 @@
 		return 0;
 	}
 
+	/* An access to our HW w/o link-up will cause a CPU Abort */
+	if (!brcm_pcie_link_up(pcie))
+		return -EINVAL;
+
 	/* For devices, write to the config space index register */
 	idx = PCIE_ECAM_OFFSET(pci_bus, pci_dev, pci_func, 0);
 
@@ -505,6 +511,12 @@
 	clrbits_le32(pcie->base + PCIE_RGR1_SW_INIT_1,
 		     RGR1_SW_INIT_1_PERST_MASK);
 
+	/*
+	 * Wait for 100ms after PERST# deassertion; see PCIe CEM specification
+	 * sections 2.2, PCIe r5.0, 6.6.1.
+	 */
+	mdelay(100);
+
 	/* Give the RC/EP time to wake up, before trying to configure RC.
 	 * Intermittently check status for link-up, up to a total of 100ms.
 	 */
@@ -562,12 +574,18 @@
 	clrsetbits_le32(base + PCIE_RC_CFG_VENDOR_SPECIFIC_REG1,
 			VENDOR_SPECIFIC_REG1_ENDIAN_MODE_BAR2_MASK,
 			VENDOR_SPECIFIC_REG1_LITTLE_ENDIAN);
+
 	/*
-	 * Refclk from RC should be gated with CLKREQ# input when ASPM L0s,L1
-	 * is enabled => setting the CLKREQ_DEBUG_ENABLE field to 1.
+	 * We used to enable the CLKREQ# input here, but a few PCIe cards don't
+	 * attach anything to the CLKREQ# line, so we shouldn't assume that
+	 * it's connected and working. The controller does allow detecting
+	 * whether the port on the other side of our link is/was driving this
+	 * signal, so we could check before we assume. But because this signal
+	 * is for power management, which doesn't make sense in a bootloader,
+	 * let's instead just unadvertise ASPM support.
 	 */
-	setbits_le32(base + PCIE_MISC_HARD_PCIE_HARD_DEBUG,
-		     PCIE_HARD_DEBUG_CLKREQ_DEBUG_ENABLE_MASK);
+	clrbits_le32(base + PCIE_RC_CFG_PRIV1_LINK_CAPABILITY,
+		     PCIE_RC_CFG_PRIV1_LINK_CAPABILITY_ASPM_SUPPORT_MASK);
 
 	return 0;
 }
diff --git a/drivers/serial/serial-uclass.c b/drivers/serial/serial-uclass.c
index 067fae2..e954f01 100644
--- a/drivers/serial/serial-uclass.c
+++ b/drivers/serial/serial-uclass.c
@@ -151,6 +151,7 @@
 #ifdef CONFIG_REQUIRE_SERIAL_CONSOLE
 	panic_str("No serial driver found");
 #endif
+	gd->cur_serial_dev = NULL;
 }
 #endif /* CONFIG_SERIAL_PRESENT */
 
diff --git a/include/nvmxip.h b/include/nvmxip.h
index f4ef377..726fffe 100644
--- a/include/nvmxip.h
+++ b/include/nvmxip.h
@@ -29,4 +29,16 @@
 	lbaint_t lba;
 };
 
+/**
+ * nvmxip_bind() - post binding treatments
+ * @dev:	the NVMXIP device
+ *
+ * Create and probe a child block device.
+ *
+ * Return:
+ *
+ * 0 on success. Otherwise, failure
+ */
+int nvmxip_probe(struct udevice *udev);
+
 #endif /* __DRIVER_NVMXIP_H__ */
diff --git a/lib/fwu_updates/fwu.c b/lib/fwu_updates/fwu.c
index 4d0c8b8..22bdc78 100644
--- a/lib/fwu_updates/fwu.c
+++ b/lib/fwu_updates/fwu.c
@@ -623,18 +623,18 @@
 	int ret;
 	u32 boot_idx, active_idx;
 
-	/* Don't have boot time checks on sandbox */
-	if (IS_ENABLED(CONFIG_SANDBOX)) {
-		boottime_check = 1;
-		return 0;
-	}
-
 	ret = uclass_first_device_err(UCLASS_FWU_MDATA, &g_dev);
 	if (ret) {
 		log_debug("Cannot find fwu device\n");
 		return ret;
 	}
 
+	/* Don't have boot time checks on sandbox */
+	if (IS_ENABLED(CONFIG_SANDBOX)) {
+		boottime_check = 1;
+		return 0;
+	}
+
 	ret = fwu_get_mdata(NULL);
 	if (ret) {
 		log_debug("Unable to read meta-data\n");
diff --git a/test/dm/fwu_mdata.c b/test/dm/fwu_mdata.c
index 8b5c83e..52018f6 100644
--- a/test/dm/fwu_mdata.c
+++ b/test/dm/fwu_mdata.c
@@ -93,6 +93,12 @@
 	struct udevice *dev;
 	struct fwu_mdata mdata = { 0 };
 
+	/*
+	 * Trigger lib/fwu_updates/fwu.c fwu_boottime_checks()
+	 * to populate g_dev global pointer in that library.
+	 */
+	event_notify_null(EVT_MAIN_LOOP);
+
 	ut_assertok(uclass_first_device_err(UCLASS_FWU_MDATA, &dev));
 	ut_assertok(setup_blk_device(uts));
 	ut_assertok(populate_mmc_disk_image(uts));
@@ -112,6 +118,12 @@
 	struct udevice *dev;
 	struct fwu_mdata mdata = { 0 };
 
+	/*
+	 * Trigger lib/fwu_updates/fwu.c fwu_boottime_checks()
+	 * to populate g_dev global pointer in that library.
+	 */
+	event_notify_null(EVT_MAIN_LOOP);
+
 	ut_assertok(setup_blk_device(uts));
 	ut_assertok(populate_mmc_disk_image(uts));
 	ut_assertok(write_mmc_blk_device(uts));
diff --git a/test/dm/nvmxip.c b/test/dm/nvmxip.c
index 89bf481..f0ad47d 100644
--- a/test/dm/nvmxip.c
+++ b/test/dm/nvmxip.c
@@ -103,6 +103,8 @@
 	void *buffer = NULL;
 	unsigned long flashsz;
 
+	sandbox_set_enable_memio(true);
+
 	/* set the flash content first for both devices */
 	dm_nvmxip_flash_sanity(uts, 0, NULL);
 	dm_nvmxip_flash_sanity(uts, 1, NULL);
diff --git a/tools/image-host.c b/tools/image-host.c
index 4a24dee..ca49503 100644
--- a/tools/image-host.c
+++ b/tools/image-host.c
@@ -38,9 +38,9 @@
 
 	ret = fdt_setprop(fit, noffset, FIT_VALUE_PROP, value, value_len);
 	if (ret) {
-		printf("Can't set hash '%s' property for '%s' node(%s)\n",
-		       FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
-		       fdt_strerror(ret));
+		fprintf(stderr, "Can't set hash '%s' property for '%s' node(%s)\n",
+			FIT_VALUE_PROP, fit_get_name(fit, noffset, NULL),
+			fdt_strerror(ret));
 		return ret == -FDT_ERR_NOSPACE ? -ENOSPC : -EIO;
 	}
 
@@ -72,21 +72,23 @@
 	node_name = fit_get_name(fit, noffset, NULL);
 
 	if (fit_image_hash_get_algo(fit, noffset, &algo)) {
-		printf("Can't get hash algo property for '%s' hash node in '%s' image node\n",
-		       node_name, image_name);
+		fprintf(stderr,
+			"Can't get hash algo property for '%s' hash node in '%s' image node\n",
+			node_name, image_name);
 		return -ENOENT;
 	}
 
 	if (calculate_hash(data, size, algo, value, &value_len)) {
-		printf("Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
-		       algo, node_name, image_name);
+		fprintf(stderr,
+			"Unsupported hash algorithm (%s) for '%s' hash node in '%s' image node\n",
+			algo, node_name, image_name);
 		return -EPROTONOSUPPORT;
 	}
 
 	ret = fit_set_hash_value(fit, noffset, value, value_len);
 	if (ret) {
-		printf("Can't set hash value for '%s' hash node in '%s' image node\n",
-		       node_name, image_name);
+		fprintf(stderr, "Can't set hash value for '%s' hash node in '%s' image node\n",
+			node_name, image_name);
 		return ret;
 	}
 
@@ -170,8 +172,9 @@
 	node_name = fit_get_name(fit, noffset, NULL);
 	if (!algo_name) {
 		if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
-			printf("Can't get algo property for '%s' signature node in '%s' image node\n",
-			       node_name, image_name);
+			fprintf(stderr,
+				"Can't get algo property for '%s' signature node in '%s' image node\n",
+				node_name, image_name);
 			return -1;
 		}
 	}
@@ -191,8 +194,9 @@
 	info->require_keys = require_keys;
 	info->engine_id = engine_id;
 	if (!info->checksum || !info->crypto) {
-		printf("Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
-		       algo_name, node_name, image_name);
+		fprintf(stderr,
+			"Unsupported signature algorithm (%s) for '%s' signature node in '%s' image node\n",
+			algo_name, node_name, image_name);
 		return -1;
 	}
 
@@ -241,8 +245,8 @@
 	region.size = size;
 	ret = info.crypto->sign(&info, &region, 1, &value, &value_len);
 	if (ret) {
-		printf("Failed to sign '%s' signature node in '%s' image node: %d\n",
-		       node_name, image_name, ret);
+		fprintf(stderr, "Failed to sign '%s' signature node in '%s' image node: %d\n",
+			node_name, image_name, ret);
 
 		/* We allow keys to be missing */
 		if (ret == -ENOENT)
@@ -255,8 +259,9 @@
 	if (ret) {
 		if (ret == -FDT_ERR_NOSPACE)
 			return -ENOSPC;
-		printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
-		       node_name, image_name, fdt_strerror(ret));
+		fprintf(stderr,
+			"Can't write signature for '%s' signature node in '%s' conf node: %s\n",
+			node_name, image_name, fdt_strerror(ret));
 		return -1;
 	}
 	free(value);
@@ -272,8 +277,9 @@
 	if (keydest) {
 		ret = info.crypto->add_verify_data(&info, keydest);
 		if (ret < 0) {
-			printf("Failed to add verification data for '%s' signature node in '%s' image node\n",
-			       node_name, image_name);
+			fprintf(stderr,
+				"Failed to add verification data for '%s' signature node in '%s' image node\n",
+				node_name, image_name);
 			return ret;
 		}
 		/* Return the node that was written to */
@@ -293,37 +299,37 @@
 	/* Open file */
 	fd = open(filename, O_RDONLY | O_BINARY);
 	if (fd < 0) {
-		printf("Can't open file %s (err=%d => %s)\n",
-		       filename, errno, strerror(errno));
+		fprintf(stderr, "Can't open file %s (err=%d => %s)\n",
+			filename, errno, strerror(errno));
 		return -1;
 	}
 
 	/* Compute file size */
 	if (fstat(fd, &sbuf) < 0) {
-		printf("Can't fstat file %s (err=%d => %s)\n",
-		       filename, errno, strerror(errno));
+		fprintf(stderr, "Can't fstat file %s (err=%d => %s)\n",
+			filename, errno, strerror(errno));
 		goto err;
 	}
 
 	/* Check file size */
 	if (sbuf.st_size != expected_size) {
-		printf("File %s don't have the expected size (size=%lld, expected=%d)\n",
-		       filename, (long long)sbuf.st_size, expected_size);
+		fprintf(stderr, "File %s don't have the expected size (size=%lld, expected=%d)\n",
+			filename, (long long)sbuf.st_size, expected_size);
 		goto err;
 	}
 
 	/* Read data */
 	n = read(fd, data, sbuf.st_size);
 	if (n < 0) {
-		printf("Can't read file %s (err=%d => %s)\n",
-		       filename, errno, strerror(errno));
+		fprintf(stderr, "Can't read file %s (err=%d => %s)\n",
+			filename, errno, strerror(errno));
 		goto err;
 	}
 
 	/* Check that we have read all the file */
 	if (n != sbuf.st_size) {
-		printf("Can't read all file %s (read %zd bytes, expected %lld)\n",
-		       filename, n, (long long)sbuf.st_size);
+		fprintf(stderr, "Can't read all file %s (read %zd bytes, expected %lld)\n",
+			filename, n, (long long)sbuf.st_size);
 		goto err;
 	}
 
@@ -341,15 +347,15 @@
 	int i, ret;
 
 	if (!tmp) {
-		printf("%s: pointer data is NULL\n", __func__);
+		fprintf(stderr, "%s: pointer data is NULL\n", __func__);
 		ret = -1;
 		goto out;
 	}
 
 	ret = clock_gettime(CLOCK_MONOTONIC, &date);
 	if (ret) {
-		printf("%s: clock_gettime has failed (%s)\n", __func__,
-		       strerror(errno));
+		fprintf(stderr, "%s: clock_gettime has failed (%s)\n", __func__,
+			strerror(errno));
 		goto out;
 	}
 
@@ -374,8 +380,8 @@
 	int ret = -1;
 
 	if (fit_image_cipher_get_algo(fit, noffset, &algo_name)) {
-		printf("Can't get algo name for cipher in image '%s'\n",
-		       image_name);
+		fprintf(stderr, "Can't get algo name for cipher in image '%s'\n",
+			image_name);
 		goto out;
 	}
 
@@ -384,8 +390,8 @@
 	/* Read the key name */
 	info->keyname = fdt_getprop(fit, noffset, FIT_KEY_HINT, NULL);
 	if (!info->keyname) {
-		printf("Can't get key name for cipher in image '%s'\n",
-		       image_name);
+		fprintf(stderr, "Can't get key name for cipher in image '%s'\n",
+			image_name);
 		goto out;
 	}
 
@@ -403,7 +409,7 @@
 
 	info->cipher = image_get_cipher_algo(algo_name);
 	if (!info->cipher) {
-		printf("Can't get algo for cipher '%s'\n", image_name);
+		fprintf(stderr, "Can't get algo for cipher '%s'\n", image_name);
 		goto out;
 	}
 
@@ -412,7 +418,7 @@
 		 info->keydir, info->keyname, ".bin");
 	info->key = malloc(info->cipher->key_len);
 	if (!info->key) {
-		printf("Can't allocate memory for key\n");
+		fprintf(stderr, "Can't allocate memory for key\n");
 		ret = -1;
 		goto out;
 	}
@@ -423,7 +429,7 @@
 
 	info->iv = malloc(info->cipher->iv_len);
 	if (!info->iv) {
-		printf("Can't allocate memory for iv\n");
+		fprintf(stderr, "Can't allocate memory for iv\n");
 		ret = -1;
 		goto out;
 	}
@@ -457,7 +463,7 @@
 		goto out;
 	}
 	if (ret) {
-		printf("Can't replace data with ciphered data (err = %d)\n", ret);
+		fprintf(stderr, "Can't replace data with ciphered data (err = %d)\n", ret);
 		goto out;
 	}
 
@@ -468,7 +474,7 @@
 		goto out;
 	}
 	if (ret) {
-		printf("Can't add unciphered data size (err = %d)\n", ret);
+		fprintf(stderr, "Can't add unciphered data size (err = %d)\n", ret);
 		goto out;
 	}
 
@@ -508,8 +514,9 @@
 	if (keydest) {
 		ret = info.cipher->add_cipher_data(&info, keydest, fit, node_noffset);
 		if (ret) {
-			printf("Failed to add verification data for cipher '%s' in image '%s'\n",
-			       info.keyname, image_name);
+			fprintf(stderr,
+				"Failed to add verification data for cipher '%s' in image '%s'\n",
+				info.keyname, image_name);
 			goto out;
 		}
 	}
@@ -538,13 +545,13 @@
 	/* Get image name */
 	image_name = fit_get_name(fit, image_noffset, NULL);
 	if (!image_name) {
-		printf("Can't get image name\n");
+		fprintf(stderr, "Can't get image name\n");
 		return -1;
 	}
 
 	/* Get image data and data length */
 	if (fit_image_get_data(fit, image_noffset, &data, &size)) {
-		printf("Can't get image data/size\n");
+		fprintf(stderr, "Can't get image data/size\n");
 		return -1;
 	}
 
@@ -558,7 +565,7 @@
 	if (fdt_getprop(fit, image_noffset, "data-size-unciphered", &len))
 		return 0;
 	if (len != -FDT_ERR_NOTFOUND) {
-		printf("Failure testing for data-size-unciphered\n");
+		fprintf(stderr, "Failure testing for data-size-unciphered\n");
 		return -1;
 	}
 
@@ -568,7 +575,7 @@
 	if (cipher_node_offset == -FDT_ERR_NOTFOUND)
 		return 0;
 	if (cipher_node_offset < 0) {
-		printf("Failure getting cipher node\n");
+		fprintf(stderr, "Failure getting cipher node\n");
 		return -1;
 	}
 	if (!IMAGE_ENABLE_ENCRYPT || !keydir)
@@ -624,7 +631,7 @@
 
 	/* Get image data and data length */
 	if (fit_image_get_data(fit, image_noffset, &data, &size)) {
-		printf("Can't get image data/size\n");
+		fprintf(stderr, "Can't get image data/size\n");
 		return -1;
 	}
 
@@ -765,8 +772,9 @@
 	}
 
 	if (!hash_count) {
-		printf("Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
-		       conf_name, sig_name, iname);
+		fprintf(stderr,
+			"Failed to find any hash nodes in configuration '%s/%s' image '%s' - without these it is not possible to verify this image\n",
+			conf_name, sig_name, iname);
 		return -ENOMSG;
 	}
 
@@ -775,9 +783,10 @@
 				     FIT_CIPHER_NODENAME);
 	if (noffset != -FDT_ERR_NOTFOUND) {
 		if (noffset < 0) {
-			printf("Failed to get cipher node in configuration '%s/%s' image '%s': %s\n",
-			       conf_name, sig_name, iname,
-			       fdt_strerror(noffset));
+			fprintf(stderr,
+				"Failed to get cipher node in configuration '%s/%s' image '%s': %s\n",
+				conf_name, sig_name, iname,
+				fdt_strerror(noffset));
 			return -EIO;
 		}
 		ret = fdt_get_path(fit, noffset, path, sizeof(path));
@@ -790,13 +799,13 @@
 	return 0;
 
 err_mem:
-	printf("Out of memory processing configuration '%s/%s'\n", conf_name,
-	       sig_name);
+	fprintf(stderr, "Out of memory processing configuration '%s/%s'\n", conf_name,
+		sig_name);
 	return -ENOMEM;
 
 err_path:
-	printf("Failed to get path for image '%s' in configuration '%s/%s': %s\n",
-	       iname, conf_name, sig_name, fdt_strerror(ret));
+	fprintf(stderr, "Failed to get path for image '%s' in configuration '%s/%s': %s\n",
+		iname, conf_name, sig_name, fdt_strerror(ret));
 	return -ENOENT;
 }
 
@@ -857,8 +866,9 @@
 								     iname, index);
 
 			if (image_noffset < 0) {
-				printf("Failed to find image '%s' in  configuration '%s/%s'\n",
-				       iname, conf_name, sig_name);
+				fprintf(stderr,
+					"Failed to find image '%s' in  configuration '%s/%s'\n",
+					iname, conf_name, sig_name);
 				if (allow_missing)
 					continue;
 
@@ -875,16 +885,16 @@
 	}
 
 	if (!image_count) {
-		printf("Failed to find any images for configuration '%s/%s'\n",
-		       conf_name, sig_name);
+		fprintf(stderr, "Failed to find any images for configuration '%s/%s'\n",
+			conf_name, sig_name);
 		return -ENOMSG;
 	}
 
 	return 0;
 
 err_mem:
-	printf("Out of memory processing configuration '%s/%s'\n", conf_name,
-	       sig_name);
+	fprintf(stderr, "Out of memory processing configuration '%s/%s'\n", conf_name,
+		sig_name);
 	return -ENOMEM;
 }
 
@@ -946,21 +956,21 @@
 			fdt_regions, ARRAY_SIZE(fdt_regions),
 			path, sizeof(path), 1);
 	if (count < 0) {
-		printf("Failed to hash configuration '%s/%s': %s\n", conf_name,
-		       sig_name, fdt_strerror(ret));
+		fprintf(stderr, "Failed to hash configuration '%s/%s': %s\n", conf_name,
+			sig_name, fdt_strerror(ret));
 		return -EIO;
 	}
 	if (count == 0) {
-		printf("No data to hash for configuration '%s/%s': %s\n",
-		       conf_name, sig_name, fdt_strerror(ret));
+		fprintf(stderr, "No data to hash for configuration '%s/%s': %s\n",
+			conf_name, sig_name, fdt_strerror(ret));
 		return -EINVAL;
 	}
 
 	/* Build our list of data blocks */
 	region = fit_region_make_list(fit, fdt_regions, count, NULL);
 	if (!region) {
-		printf("Out of memory hashing configuration '%s/%s'\n",
-		       conf_name, sig_name);
+		fprintf(stderr, "Out of memory hashing configuration '%s/%s'\n",
+			conf_name, sig_name);
 		return -ENOMEM;
 	}
 
@@ -972,8 +982,8 @@
 	}
 	region_prop = malloc(len);
 	if (!region_prop) {
-		printf("Out of memory setting up regions for configuration '%s/%s'\n",
-		       conf_name, sig_name);
+		fprintf(stderr, "Out of memory setting up regions for configuration '%s/%s'\n",
+			conf_name, sig_name);
 		return -ENOMEM;
 	}
 	for (i = len = 0; i < node_inc.count;
@@ -1038,8 +1048,8 @@
 				&value_len);
 	free(region);
 	if (ret) {
-		printf("Failed to sign '%s' signature node in '%s' conf node\n",
-		       node_name, conf_name);
+		fprintf(stderr, "Failed to sign '%s' signature node in '%s' conf node\n",
+			node_name, conf_name);
 
 		/* We allow keys to be missing */
 		if (ret == -ENOENT)
@@ -1053,8 +1063,9 @@
 	if (ret) {
 		if (ret == -FDT_ERR_NOSPACE)
 			return -ENOSPC;
-		printf("Can't write signature for '%s' signature node in '%s' conf node: %s\n",
-		       node_name, conf_name, fdt_strerror(ret));
+		fprintf(stderr,
+			"Can't write signature for '%s' signature node in '%s' conf node: %s\n",
+			node_name, conf_name, fdt_strerror(ret));
 		return -1;
 	}
 	free(value);
@@ -1067,8 +1078,9 @@
 	if (keydest) {
 		ret = info.crypto->add_verify_data(&info, keydest);
 		if (ret < 0) {
-			printf("Failed to add verification data for '%s' signature node in '%s' configuration node\n",
-			       node_name, conf_name);
+			fprintf(stderr,
+				"Failed to add verification data for '%s' signature node in '%s' configuration node\n",
+				node_name, conf_name);
 		}
 		return ret;
 	}
@@ -1148,7 +1160,7 @@
 	/* Read the certificate */
 	cert = NULL;
 	if (!PEM_read_X509(f, &cert, NULL, NULL)) {
-		printf("Couldn't read certificate");
+		fprintf(stderr, "Couldn't read certificate");
 		ret = -EINVAL;
 		goto err_cert;
 	}
@@ -1156,7 +1168,7 @@
 	/* Get the public key from the certificate. */
 	key = X509_get_pubkey(cert);
 	if (!key) {
-		printf("Couldn't read public key\n");
+		fprintf(stderr, "Couldn't read public key\n");
 		ret = -EINVAL;
 		goto err_pubkey;
 	}
@@ -1164,7 +1176,7 @@
 	/* Get DER form */
 	ret = i2d_PublicKey(key, pubkey);
 	if (ret < 0) {
-		printf("Couldn't get DER form\n");
+		fprintf(stderr, "Couldn't get DER form\n");
 		ret = -EINVAL;
 		goto err_pubkey;
 	}
@@ -1203,11 +1215,11 @@
 	/* Check that all mandatory properties are present */
 	if (!algo_name || !key_name) {
 		if (!algo_name)
-			printf("The property algo-name is missing in the node %s\n",
-			       IMAGE_PRE_LOAD_PATH);
+			fprintf(stderr, "The property algo-name is missing in the node %s\n",
+				IMAGE_PRE_LOAD_PATH);
 		if (!key_name)
-			printf("The property key-name is missing in the node %s\n",
-			       IMAGE_PRE_LOAD_PATH);
+			fprintf(stderr, "The property key-name is missing in the node %s\n",
+				IMAGE_PRE_LOAD_PATH);
 		ret = -EINVAL;
 		goto out;
 	}
@@ -1221,8 +1233,8 @@
 	ret = fdt_setprop(keydest, pre_load_noffset, "public-key",
 			  pubkey, pubkey_len);
 	if (ret)
-		printf("Can't set public-key in node %s (ret = %d)\n",
-		       IMAGE_PRE_LOAD_PATH, ret);
+		fprintf(stderr, "Can't set public-key in node %s (ret = %d)\n",
+			IMAGE_PRE_LOAD_PATH, ret);
 
  out:
 	return ret;
@@ -1239,8 +1251,8 @@
 	/* Find images parent node offset */
 	images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
 	if (images_noffset < 0) {
-		printf("Can't find images parent node '%s' (%s)\n",
-		       FIT_IMAGES_PATH, fdt_strerror(images_noffset));
+		fprintf(stderr, "Can't find images parent node '%s' (%s)\n",
+			FIT_IMAGES_PATH, fdt_strerror(images_noffset));
 		return images_noffset;
 	}
 
@@ -1276,8 +1288,8 @@
 	/* Find images parent node offset */
 	images_noffset = fdt_path_offset(fit, FIT_IMAGES_PATH);
 	if (images_noffset < 0) {
-		printf("Can't find images parent node '%s' (%s)\n",
-		       FIT_IMAGES_PATH, fdt_strerror(images_noffset));
+		fprintf(stderr, "Can't find images parent node '%s' (%s)\n",
+			FIT_IMAGES_PATH, fdt_strerror(images_noffset));
 		return images_noffset;
 	}
 
@@ -1293,9 +1305,9 @@
 				fit, noffset, comment, require_keys, engine_id,
 				cmdname, algo_name);
 		if (ret) {
-			printf("Can't add verification data for node '%s' (%s)\n",
-			       fdt_get_name(fit, noffset, NULL),
-			       fdt_strerror(ret));
+			fprintf(stderr, "Can't add verification data for node '%s' (%s)\n",
+				fdt_get_name(fit, noffset, NULL),
+				fdt_strerror(ret));
 			return ret;
 		}
 	}
@@ -1307,8 +1319,8 @@
 	/* Find configurations parent node offset */
 	confs_noffset = fdt_path_offset(fit, FIT_CONFS_PATH);
 	if (confs_noffset < 0) {
-		printf("Can't find images parent node '%s' (%s)\n",
-		       FIT_CONFS_PATH, fdt_strerror(confs_noffset));
+		fprintf(stderr, "Can't find images parent node '%s' (%s)\n",
+			FIT_CONFS_PATH, fdt_strerror(confs_noffset));
 		return -ENOENT;
 	}