Signed-off-by: Tom Rini <trini@konsulko.com>

The hashed-nodes property in a FIT signature node lists which FDT paths
are included in the signature hash. It is intended as a hint so should
not be used for verification.

Add a function to build the node list from scratch by iterating the
configuration's image references. Skip properties known not to be image
references. For each image, collect the path plus all hash and cipher
subnodes.

Use the new function in fit_config_check_sig() instead of reading
'hashed-nodes'.

Update the test_vboot kernel@ test case: fit_check_sign now catches the
attack at signature-verification time (the @-suffixed node is hashed
instead of the real one, causing a mismatch) rather than at
fit_check_format() time.

Update the docs to cover this. The FIT spec can be updated separately.

Signed-off-by: Simon Glass <simon.glass@canonical.com>
Closes: https://lore.kernel.org/u-boot/20260302220937.3682128-1-trini@konsulko.com/
Reported-by: Apple Security Engineering and Architecture (SEAR)
Tested-by: Tom Rini <trini@konsulko.com>

Siddharth Vadapalli <s-vadapalli@ti.com> says:

Since Linux device-tree has switched to 64-bit Address space for the
PCIe Controllers on TI SoCs, currently, U-Boot needs to support the
same. This series adds support for 64-bit addressing for PCIe along with
enabling Root-Complex mode of operation for AM69 and J784S4 SoCs.

Series has been tested on all platforms being affected by this series.
Test Logs:
1. AM642-EVM
https://gist.github.com/Siddharth-Vadapalli-at-TI/82512389f8396a51e4f167c7ebe4c2a3
2. AM69-SK
https://gist.github.com/Siddharth-Vadapalli-at-TI/b20b2811804ffc6e6c063564330c0a35
3. J7200-EVM
https://gist.github.com/Siddharth-Vadapalli-at-TI/c545da68bd28a5e036803bb60f32d8e9
4. J722S-EVM
https://gist.github.com/Siddharth-Vadapalli-at-TI/3dde05c4c7076076aa20ac47a6e2d176
5. J784S4-EVM
https://gist.github.com/Siddharth-Vadapalli-at-TI/a93c1b2cd5d90f494e885d1831d3d23e

Link: https://lore.kernel.org/r/20260227115841.333073-1-s-vadapalli@ti.com

The PCIe0 instance of PCIe on the J722S SoC uses the 4 GB Address Window
starting from 0x6_0000_0000 to map System Addresses to PCIe Bus Addresses.
Hence, enable CONFIG_SYS_PCI_64BIT.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Fixes: 79f3e77133bd ("Subtree merge tag 'v6.16-dts' of dts repo [1] into dts/upstream")

The PCIe1 instance of PCIe on the J7200 SoC uses the 4 GB Address Window
starting from 0x41_0000_0000 to map System Addresses to PCIe Bus Addresses.
Hence, enable CONFIG_SYS_PCI_64BIT.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Fixes: 79f3e77133bd ("Subtree merge tag 'v6.16-dts' of dts repo [1] into dts/upstream")

The PCIe0 instance of PCIe on the AM64x SoC uses the 4 GB Address Window
starting from 0x6_0000_0000 to map System Addresses to PCIe Bus Addresses.
Hence, enable CONFIG_SYS_PCI_64BIT.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Fixes: 79f3e77133bd ("Subtree merge tag 'v6.16-dts' of dts repo [1] into dts/upstream")

The PCIe Controllers on the J784S4 and AM69 SoCs support Root-Complex
mode of operation. PCIe0 instance of PCIe on both of the SoCs is brought
out on the Starter-Kit (AM69) and EVM (J784S4) boards. Hence, enable
the configs required for Root-Complex mode of operation.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Fixes: 79f3e77133bd ("Subtree merge tag 'v6.16-dts' of dts repo [1] into dts/upstream")

The PCIe Controllers on the J784S4 SoC support Root-Complex mode of
operation. Hence, enable it.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Fixes: 79f3e77133bd ("Subtree merge tag 'v6.16-dts' of dts repo [1] into dts/upstream")

The PCIe Controllers in the K3 SoCs have 4 GB Address Windows in the
64-bit address space to map System (CPU) Addresses to PCIe Bus Addresses.
The physical addresses for these Address Windows across PCIe instances
across SoCs is as follows:

+--------+----------------+----------------+----------------+----------------+
| SoC    | PCIe0          | PCIe1          | PCIe2          | PCIe3          |
+--------+----------------+----------------+----------------+----------------+
| AM64   | 0x6_0000_0000  | NA             | NA             | NA             |
| J722S  | 0x6_0000_0000  | NA             | NA             | NA             |
| AM68   | NA             | 0x41_0000_0000 | NA             | NA             |
| J7200  | NA             | 0x41_0000_0000 | NA             | NA             |
| J721S2 | NA             | 0x41_0000_0000 | NA             | NA             |
| J742S2 | 0x40_0000_0000 | 0x41_0000_0000 | NA             | NA             |
| AM69   | 0x40_0000_0000 | 0x41_0000_0000 | 0x42_0000_0000 | 0x43_0000_0000 |
| J721E  | 0x40_0000_0000 | 0x41_0000_0000 | 0x42_0000_0000 | 0x43_0000_0000 |
| J784S4 | 0x40_0000_0000 | 0x41_0000_0000 | 0x42_0000_0000 | 0x43_0000_0000 |
+--------+----------------+----------------+----------------+----------------+

Two regions for a 1:1 mapping from virtual addresses to physical addresses
catering to all of the above will be required, which are:
1. For AM64 and J722S SoCs
=> Start: 0x6_0000_0000 Size: 0x1_0000_0000
2. For AM68, AM69, J7200, J721E, J721S2, J742S2 and J784S4 SoCs
=> Start: 0x40_0000_0000 Size: 0x4_0000_0000

Since the 'Flash Peripherals' region from 0x5_0000_0000 to 0x8_7FFF_FFFF
includes the mapping for AM64 and J722S SoCs, only the second region
mentioned above needs to be added.

Hence, add the region to support 64-bit address space for PCIe.

Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Fixes: 79f3e77133bd ("Subtree merge tag 'v6.16-dts' of dts repo [1] into dts/upstream")

Tudor Ambarus will step down as SPI NOR reviewer.
I would like to take this role.

Signed-off-by: Takahiro Kuwano <Takahiro.Kuwano@infineon.com>
Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>