Project import generated by Copybara.

GitOrigin-RevId: da399ed8900bcb58889fc7d0858e6ce8da0a2d1f
diff --git a/arch/arm/cpu/armv7/qca/common/smem.c b/arch/arm/cpu/armv7/qca/common/smem.c
index 192e7de..b282874 100644
--- a/arch/arm/cpu/armv7/qca/common/smem.c
+++ b/arch/arm/cpu/armv7/qca/common/smem.c
@@ -1176,7 +1176,8 @@
 }
 #endif
 
-int do_smeminfo(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+int __maybe_unused
+do_smeminfo(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	qca_smem_flash_info_t *sfi = &qca_smem_flash_info;
 	int i;
@@ -1244,8 +1245,10 @@
 	return 0;
 }
 
-U_BOOT_CMD(
-	smeminfo,    1,    1,    do_smeminfo,
-	"print SMEM FLASH information",
-	"\n    - print flash details gathered from SMEM\n"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	smeminfo,    1,    1,    do_smeminfo,
+// 	"print SMEM FLASH information",
+// 	"\n    - print flash details gathered from SMEM\n"
+// );
diff --git a/board/qca/arm/common/cmd_blowsecfuse.c b/board/qca/arm/common/cmd_blowsecfuse.c
index a6f987b..b12cd52 100644
--- a/board/qca/arm/common/cmd_blowsecfuse.c
+++ b/board/qca/arm/common/cmd_blowsecfuse.c
@@ -27,7 +27,7 @@
 #define FUSEPROV_SECDAT_LOCK_BLOWN	0xB
 #define TZ_BLOW_FUSE_SECDAT		0x20
 
-int do_fuseipq(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+int __maybe_unused do_fuseipq(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
 	int ret;
 	uint32_t fuse_status = 0;
@@ -64,6 +64,8 @@
 	return 0;
 }
 
-U_BOOT_CMD(fuseipq, 2, 0, do_fuseipq,
-		"fuse QFPROM registers from memory\n",
-		"fuseipq [address]  - Load fuse(s) and blows in the qfprom\n");
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(fuseipq, 2, 0, do_fuseipq,
+// 		"fuse QFPROM registers from memory\n",
+// 		"fuseipq [address]  - Load fuse(s) and blows in the qfprom\n");
diff --git a/board/qca/arm/common/cmd_bootqca.c b/board/qca/arm/common/cmd_bootqca.c
index af7514c..56813bb 100644
--- a/board/qca/arm/common/cmd_bootqca.c
+++ b/board/qca/arm/common/cmd_bootqca.c
@@ -1144,11 +1144,8 @@
 	ret = qca_scm_call(SCM_SVC_FUSE, QFPROM_IS_AUTHENTICATE_CMD, &buf, sizeof(char));
 
 	aquantia_phy_reset_init_done();
-	/*
-	|| if atf is enable in env ,do_boot_signedimg is skip.
-	|| Note: This features currently support in ipq50XX.
-	*/
-	if (ret == 0 && buf == 1 && !getenv("atf")) {
+
+	if (ret == 0 && buf == 1) {
                 printf("%s: boot signed image\n", __func__);
 		ret = do_boot_signedimg(cmdtp, flag, argc, argv);
 	} else if (ret == 0 || ret == -EOPNOTSUPP) {
diff --git a/board/qca/arm/common/cmd_exectzt.c b/board/qca/arm/common/cmd_exectzt.c
index ce6ead3..ddc4d9e 100644
--- a/board/qca/arm/common/cmd_exectzt.c
+++ b/board/qca/arm/common/cmd_exectzt.c
@@ -24,7 +24,7 @@
 	run_command(runcmd, 0);
 }
 
-int do_exectzt(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+int __maybe_unused do_exectzt(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
 	uint32_t address;
 
@@ -41,6 +41,8 @@
 	return 0;
 }
 
-U_BOOT_CMD(exectzt, 2, 0, do_exectzt,
-		"execute TZT\n",
-		"exectzt [address]  - Execute TZT\n");
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(exectzt, 2, 0, do_exectzt,
+// 		"execute TZT\n",
+// 		"exectzt [address]  - Execute TZT\n");
diff --git a/board/qca/arm/common/cmd_tzt.c b/board/qca/arm/common/cmd_tzt.c
index 18f4ed1..cb6a37d 100644
--- a/board/qca/arm/common/cmd_tzt.c
+++ b/board/qca/arm/common/cmd_tzt.c
@@ -111,7 +111,8 @@
 	return 0;
 }
 
-static int do_tzt(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+static __maybe_unused int
+do_tzt(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
 	char *cmd;
 	u32 img_addr;
@@ -167,7 +168,9 @@
 	return -1;
 }
 
-U_BOOT_CMD(tzt, 4, 0, do_tzt,
-	   "load and run tzt\n",
-	   "tzt load address size - To load tzt image\n"
-	   "tzt xpu - To run xpu config test\n");
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(tzt, 4, 0, do_tzt,
+// 	   "load and run tzt\n",
+// 	   "tzt load address size - To load tzt image\n"
+// 	   "tzt xpu - To run xpu config test\n");
diff --git a/common/cli_hush.c b/common/cli_hush.c
index 2fbfdbe..ddbb124 100644
--- a/common/cli_hush.c
+++ b/common/cli_hush.c
@@ -3644,8 +3644,8 @@
 }
 
 #ifdef __U_BOOT__
-static int do_showvar(cmd_tbl_t *cmdtp, int flag, int argc,
-		      char * const argv[])
+static __maybe_unused int
+do_showvar(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int i, k;
 	int rcode = 0;
@@ -3683,13 +3683,15 @@
 	return rcode;
 }
 
-U_BOOT_CMD(
-	showvar, CONFIG_SYS_MAXARGS, 1,	do_showvar,
-	"print local hushshell variables",
-	"\n    - print values of all hushshell variables\n"
-	"showvar name ...\n"
-	"    - print value of hushshell variable 'name'"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	showvar, CONFIG_SYS_MAXARGS, 1,	do_showvar,
+// 	"print local hushshell variables",
+// 	"\n    - print values of all hushshell variables\n"
+// 	"showvar name ...\n"
+// 	"    - print value of hushshell variable 'name'"
+// );
 
 #endif
 /****************************************************************************/
diff --git a/common/cmd_boot.c b/common/cmd_boot.c
index ad5fcdf..71b4399 100644
--- a/common/cmd_boot.c
+++ b/common/cmd_boot.c
@@ -22,7 +22,8 @@
 	return entry (argc, argv);
 }
 
-static int do_go(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_go(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong	addr, rc;
 	int     rcode = 0;
@@ -66,12 +67,14 @@
 
 /* -------------------------------------------------------------------- */
 
-U_BOOT_CMD(
-	go, CONFIG_SYS_MAXARGS, 1,	do_go,
-	"start application at address 'addr'",
-	"addr [arg ...]\n    - start application at address 'addr'\n"
-	"      passing 'arg' as arguments"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	go, CONFIG_SYS_MAXARGS, 1,	do_go,
+// 	"start application at address 'addr'",
+// 	"addr [arg ...]\n    - start application at address 'addr'\n"
+// 	"      passing 'arg' as arguments"
+// );
 
 #endif
 
diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c
index 48738ac..daa4a39 100644
--- a/common/cmd_bootm.c
+++ b/common/cmd_bootm.c
@@ -628,10 +628,12 @@
 	"";
 #endif
 
-U_BOOT_CMD(
-	bootz,	CONFIG_SYS_MAXARGS,	1,	do_bootz,
-	"boot Linux zImage image from memory", bootz_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	bootz,	CONFIG_SYS_MAXARGS,	1,	do_bootz,
+// 	"boot Linux zImage image from memory", bootz_help_text
+// );
 #endif	/* CONFIG_CMD_BOOTZ */
 
 #ifdef CONFIG_CMD_BOOTI
diff --git a/common/cmd_elf.c b/common/cmd_elf.c
index 86e694a..b70bcbb 100644
--- a/common/cmd_elf.c
+++ b/common/cmd_elf.c
@@ -154,7 +154,7 @@
 }
 
 /* Interpreter command to boot an arbitrary ELF image from memory */
-int do_bootelf(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+int __maybe_unused do_bootelf(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	unsigned long addr; /* Address of the ELF image */
 	unsigned long rc; /* Return value from user code */
@@ -210,7 +210,7 @@
  * be either an ELF image or a raw binary.  Will attempt to setup the
  * bootline and other parameters correctly.
  */
-int do_bootvx(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+int __maybe_unused do_bootvx(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	unsigned long addr; /* Address of image */
 	unsigned long bootaddr; /* Address to put the bootline */
@@ -392,16 +392,20 @@
 	return 1;
 }
 
-U_BOOT_CMD(
-	bootelf, 3, 0, do_bootelf,
-	"Boot from an ELF image in memory",
-	"[-p|-s] [address]\n"
-	"\t- load ELF image at [address] via program headers (-p)\n"
-	"\t  or via section headers (-s)"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	bootelf, 3, 0, do_bootelf,
+// 	"Boot from an ELF image in memory",
+// 	"[-p|-s] [address]\n"
+// 	"\t- load ELF image at [address] via program headers (-p)\n"
+// 	"\t  or via section headers (-s)"
+// );
 
-U_BOOT_CMD(
-	bootvx, 2, 0, do_bootvx,
-	"Boot vxWorks from an ELF image",
-	" [address] - load address of vxWorks ELF image."
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	bootvx, 2, 0, do_bootvx,
+// 	"Boot vxWorks from an ELF image",
+// 	" [address] - load address of vxWorks ELF image."
+// );
diff --git a/common/cmd_flash.c b/common/cmd_flash.c
index 85d18bb..16b7a94 100644
--- a/common/cmd_flash.c
+++ b/common/cmd_flash.c
@@ -305,7 +305,8 @@
 	return 0;
 }
 
-static int do_flerase(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_flerase(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 #ifndef CONFIG_SYS_NO_FLASH
 	flash_info_t *info = NULL;
@@ -438,7 +439,8 @@
 }
 #endif /* CONFIG_SYS_NO_FLASH */
 
-static int do_protect(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_protect(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int rcode = 0;
 #ifndef CONFIG_SYS_NO_FLASH
@@ -685,44 +687,48 @@
 	"flinfo N\n    - print information for FLASH memory bank # N"
 );
 
-U_BOOT_CMD(
-	erase,   3,   0,  do_flerase,
-	"erase FLASH memory",
-	"start end\n"
-	"    - erase FLASH from addr 'start' to addr 'end'\n"
-	"erase start +len\n"
-	"    - erase FLASH from addr 'start' to the end of sect "
-	"w/addr 'start'+'len'-1\n"
-	"erase N:SF[-SL]\n    - erase sectors SF-SL in FLASH bank # N\n"
-	"erase bank N\n    - erase FLASH bank # N\n"
-	TMP_ERASE
-	"erase all\n    - erase all FLASH banks"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	erase,   3,   0,  do_flerase,
+// 	"erase FLASH memory",
+// 	"start end\n"
+// 	"    - erase FLASH from addr 'start' to addr 'end'\n"
+// 	"erase start +len\n"
+// 	"    - erase FLASH from addr 'start' to the end of sect "
+// 	"w/addr 'start'+'len'-1\n"
+// 	"erase N:SF[-SL]\n    - erase sectors SF-SL in FLASH bank # N\n"
+// 	"erase bank N\n    - erase FLASH bank # N\n"
+// 	TMP_ERASE
+// 	"erase all\n    - erase all FLASH banks"
+// );
 
-U_BOOT_CMD(
-	protect,  4,  0,   do_protect,
-	"enable or disable FLASH write protection",
-	"on  start end\n"
-	"    - protect FLASH from addr 'start' to addr 'end'\n"
-	"protect on start +len\n"
-	"    - protect FLASH from addr 'start' to end of sect "
-	"w/addr 'start'+'len'-1\n"
-	"protect on  N:SF[-SL]\n"
-	"    - protect sectors SF-SL in FLASH bank # N\n"
-	"protect on  bank N\n    - protect FLASH bank # N\n"
-	TMP_PROT_ON
-	"protect on  all\n    - protect all FLASH banks\n"
-	"protect off start end\n"
-	"    - make FLASH from addr 'start' to addr 'end' writable\n"
-	"protect off start +len\n"
-	"    - make FLASH from addr 'start' to end of sect "
-	"w/addr 'start'+'len'-1 wrtable\n"
-	"protect off N:SF[-SL]\n"
-	"    - make sectors SF-SL writable in FLASH bank # N\n"
-	"protect off bank N\n    - make FLASH bank # N writable\n"
-	TMP_PROT_OFF
-	"protect off all\n    - make all FLASH banks writable"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	protect,  4,  0,   do_protect,
+// 	"enable or disable FLASH write protection",
+// 	"on  start end\n"
+// 	"    - protect FLASH from addr 'start' to addr 'end'\n"
+// 	"protect on start +len\n"
+// 	"    - protect FLASH from addr 'start' to end of sect "
+// 	"w/addr 'start'+'len'-1\n"
+// 	"protect on  N:SF[-SL]\n"
+// 	"    - protect sectors SF-SL in FLASH bank # N\n"
+// 	"protect on  bank N\n    - protect FLASH bank # N\n"
+// 	TMP_PROT_ON
+// 	"protect on  all\n    - protect all FLASH banks\n"
+// 	"protect off start end\n"
+// 	"    - make FLASH from addr 'start' to addr 'end' writable\n"
+// 	"protect off start +len\n"
+// 	"    - make FLASH from addr 'start' to end of sect "
+// 	"w/addr 'start'+'len'-1 wrtable\n"
+// 	"protect off N:SF[-SL]\n"
+// 	"    - make sectors SF-SL writable in FLASH bank # N\n"
+// 	"protect off bank N\n    - make FLASH bank # N writable\n"
+// 	TMP_PROT_OFF
+// 	"protect off all\n    - make all FLASH banks writable"
+// );
 
 #undef	TMP_ERASE
 #undef	TMP_PROT_ON
diff --git a/common/cmd_flashwrite.c b/common/cmd_flashwrite.c
index 0cf9e43..c7eeab3 100644
--- a/common/cmd_flashwrite.c
+++ b/common/cmd_flashwrite.c
@@ -176,8 +176,8 @@
 }
 #endif
 
-static int do_flash(cmd_tbl_t *cmdtp, int flag, int argc,
-char * const argv[])
+static __maybe_unused int
+do_flash(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int flash_cmd = 0;
 	uint32_t offset, part_size, adj_size;
@@ -383,15 +383,19 @@
 return ret;
 }
 
-U_BOOT_CMD(
-	flash,       4,      0,      do_flash,
-	"flash part_name \n"
-	"\tflash part_name load_addr file_size \n",
-	"flash the image at load_addr, given file_size in hex\n"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	flash,       4,      0,      do_flash,
+// 	"flash part_name \n"
+// 	"\tflash part_name load_addr file_size \n",
+// 	"flash the image at load_addr, given file_size in hex\n"
+// );
 
-U_BOOT_CMD(
-	flasherase,       4,      0,      do_flash,
-	"flerase part_name \n",
-	"erases on flash the given partition \n"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	flasherase,       4,      0,      do_flash,
+// 	"flerase part_name \n",
+// 	"erases on flash the given partition \n"
+// );
diff --git a/common/cmd_i2c.c b/common/cmd_i2c.c
index 552c875..46f5a29 100644
--- a/common/cmd_i2c.c
+++ b/common/cmd_i2c.c
@@ -134,7 +134,7 @@
 #ifdef CONFIG_DM_I2C
 static struct udevice *i2c_cur_bus;
 
-static int cmd_i2c_set_bus_num(unsigned int busnum)
+static __maybe_unused int cmd_i2c_set_bus_num(unsigned int busnum)
 {
 	struct udevice *bus;
 	int ret;
@@ -149,7 +149,7 @@
 	return 0;
 }
 
-static int i2c_get_cur_bus(struct udevice **busp)
+static __maybe_unused int i2c_get_cur_bus(struct udevice **busp)
 {
 	if (!i2c_cur_bus) {
 		puts("No I2C bus selected\n");
@@ -160,7 +160,7 @@
 	return 0;
 }
 
-static int i2c_get_cur_bus_chip(uint chip_addr, struct udevice **devp)
+static __maybe_unused int i2c_get_cur_bus_chip(uint chip_addr, struct udevice **devp)
 {
 	struct udevice *bus;
 	int ret;
@@ -239,7 +239,7 @@
  *
  * Returns the address length.
  */
-static uint get_alen(char *arg, int default_len)
+static __maybe_unused uint get_alen(char *arg, int default_len)
 {
 	int	j;
 	int	alen;
@@ -260,7 +260,7 @@
 	I2C_ERR_WRITE,
 };
 
-static int i2c_report_err(int ret, enum i2c_err_op op)
+static __maybe_unused int i2c_report_err(int ret, enum i2c_err_op op)
 {
 	printf("Error %s the chip: %d\n",
 	       op == I2C_ERR_READ ? "reading" : "writing", ret);
@@ -281,7 +281,8 @@
  * Syntax:
  *	i2c read {i2c_chip} {devaddr}{.0, .1, .2} {len} {memaddr}
  */
-static int do_i2c_read ( cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_read ( cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	uint	chip;
 	uint	devaddr, length;
@@ -334,7 +335,8 @@
 	return 0;
 }
 
-static int do_i2c_write(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_write(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	uint	chip;
 	uint	devaddr, length;
@@ -425,8 +427,8 @@
 }
 
 #ifdef CONFIG_DM_I2C
-static int do_i2c_flags(cmd_tbl_t *cmdtp, int flag, int argc,
-			char *const argv[])
+static __maybe_unused int
+do_i2c_flags(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
 	struct udevice *dev;
 	uint flags;
@@ -455,7 +457,8 @@
 	return 0;
 }
 
-static int do_i2c_olen(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+static __maybe_unused int
+do_i2c_olen(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
 	struct udevice *dev;
 	uint olen;
@@ -500,7 +503,8 @@
  * Syntax:
  *	i2c md {i2c_chip} {addr}{.0, .1, .2} {len}
  */
-static int do_i2c_md ( cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_md ( cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	uint	chip;
 	uint	addr, length;
@@ -619,7 +623,8 @@
  * Syntax:
  *	i2c mw {i2c_chip} {addr}{.0, .1, .2} {data} [{count}]
  */
-static int do_i2c_mw ( cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_mw ( cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	uint	chip;
 	ulong	addr;
@@ -705,7 +710,8 @@
  * Syntax:
  *	i2c crc32 {i2c_chip} {addr}{.0, .1, .2} {count}
  */
-static int do_i2c_crc (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_crc (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	uint	chip;
 	ulong	addr;
@@ -789,7 +795,7 @@
  *	i2c mm{.b, .w, .l} {i2c_chip} {addr}{.0, .1, .2}
  *	i2c nm{.b, .w, .l} {i2c_chip} {addr}{.0, .1, .2}
  */
-static int
+static __maybe_unused int
 mod_i2c_mem(cmd_tbl_t *cmdtp, int incrflag, int flag, int argc, char * const argv[])
 {
 	uint	chip;
@@ -938,7 +944,8 @@
  *
  * Returns zero (success) if one or more I2C devices was found
  */
-static int do_i2c_probe (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_probe (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int j;
 	int addr = -1;
@@ -1013,7 +1020,8 @@
  *	{length} - Number of bytes to read
  *	{delay}  - A DECIMAL number and defaults to 1000 uSec
  */
-static int do_i2c_loop(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_loop(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	uint	chip;
 	int alen;
@@ -1139,7 +1147,8 @@
  * Syntax:
  *	i2c sdram {i2c_chip}
  */
-static int do_sdram (cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_sdram (cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 	enum { unknown, EDO, SDRAM, DDR2 } type;
 
@@ -1619,7 +1628,7 @@
  *	i2c edid {i2c_chip}
  */
 #if defined(CONFIG_I2C_EDID)
-int do_edid(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+int __maybe_unused do_edid(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
 {
 	uint chip;
 	struct edid1_info edid;
@@ -1656,7 +1665,7 @@
 #endif /* CONFIG_I2C_EDID */
 
 #ifdef CONFIG_DM_I2C
-static void show_bus(struct udevice *bus)
+static __maybe_unused void show_bus(struct udevice *bus)
 {
 	struct udevice *dev;
 
@@ -1686,8 +1695,8 @@
  * Returns zero always.
  */
 #if defined(CONFIG_SYS_I2C) || defined(CONFIG_DM_I2C)
-static int do_i2c_show_bus(cmd_tbl_t *cmdtp, int flag, int argc,
-				char * const argv[])
+static __maybe_unused int
+do_i2c_show_bus(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	if (argc == 1) {
 		/* show all busses */
@@ -1773,8 +1782,8 @@
  */
 #if defined(CONFIG_SYS_I2C) || defined(CONFIG_I2C_MULTI_BUS) || \
 		defined(CONFIG_DM_I2C)
-static int do_i2c_bus_num(cmd_tbl_t *cmdtp, int flag, int argc,
-				char * const argv[])
+static __maybe_unused int
+do_i2c_bus_num(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int		ret = 0;
 	int	bus_no;
@@ -1823,7 +1832,8 @@
  * Returns zero on success, CMD_RET_USAGE in case of misuse and negative
  * on error.
  */
-static int do_i2c_bus_speed(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_bus_speed(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 	int speed, ret=0;
 
@@ -1865,7 +1875,8 @@
  * Returns zero on success, CMD_RET_USAGE in case of misuse and negative
  * on error.
  */
-static int do_i2c_mm(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_mm(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 	return mod_i2c_mem (cmdtp, 1, flag, argc, argv);
 }
@@ -1880,7 +1891,8 @@
  * Returns zero on success, CMD_RET_USAGE in case of misuse and negative
  * on error.
  */
-static int do_i2c_nm(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_nm(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 	return mod_i2c_mem (cmdtp, 0, flag, argc, argv);
 }
@@ -1894,7 +1906,8 @@
  *
  * Returns zero always.
  */
-static int do_i2c_reset(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_i2c_reset(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 #if defined(CONFIG_DM_I2C)
 	struct udevice *bus;
@@ -1964,7 +1977,7 @@
  * Returns zero on success, CMD_RET_USAGE in case of misuse and negative
  * on error.
  */
-static int do_i2c(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int do_i2c(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 	cmd_tbl_t *c;
 
@@ -2021,8 +2034,10 @@
 	"i2c speed [speed] - show or set I2C bus speed";
 #endif
 
-U_BOOT_CMD(
-	i2c, 7, 1, do_i2c,
-	"I2C sub-system",
-	i2c_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	i2c, 7, 1, do_i2c,
+// 	"I2C sub-system",
+// 	i2c_help_text
+// );
diff --git a/common/cmd_mem.c b/common/cmd_mem.c
index efa3929..6c6b8c9 100644
--- a/common/cmd_mem.c
+++ b/common/cmd_mem.c
@@ -50,7 +50,8 @@
  *	md{.b, .w, .l, .q} {addr} {len}
  */
 #define DISP_LINE_LEN	16
-static int do_mem_md(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mem_md(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong	addr, length;
 #if defined(CONFIG_HAS_DATAFLASH)
@@ -150,16 +151,19 @@
 	return (rc);
 }
 
-static int do_mem_mm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mem_mm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	return mod_mem (cmdtp, 1, flag, argc, argv);
 }
-static int do_mem_nm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mem_nm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	return mod_mem (cmdtp, 0, flag, argc, argv);
 }
 
-static int do_mem_mw(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mem_mw(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
 	u64 writeval;
@@ -275,7 +279,8 @@
 }
 #endif /* CONFIG_MX_CYCLIC */
 
-static int do_mem_cmp(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mem_cmp(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong	addr1, addr2, count, ngood, bytes;
 	int	size;
@@ -370,7 +375,8 @@
 	return rcode;
 }
 
-static int do_mem_cp(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mem_cp(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong	addr, dest, count, bytes;
 	int	size;
@@ -492,8 +498,8 @@
 	return 0;
 }
 
-static int do_mem_base(cmd_tbl_t *cmdtp, int flag, int argc,
-		       char * const argv[])
+static __maybe_unused int
+do_mem_base(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	if (argc > 1) {
 		/* Set new base address.
@@ -1241,67 +1247,79 @@
 #endif
 
 /**************************************************/
-U_BOOT_CMD(
-	md,	3,	1,	do_mem_md,
-	"memory display",
-#ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
-	"[.b, .w, .l, .q] address [# of objects]"
-#else
-	"[.b, .w, .l] address [# of objects]"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	md,	3,	1,	do_mem_md,
+// 	"memory display",
+// #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
+// 	"[.b, .w, .l, .q] address [# of objects]"
+// #else
+// 	"[.b, .w, .l] address [# of objects]"
+// #endif
+// );
 
 
-U_BOOT_CMD(
-	mm,	2,	1,	do_mem_mm,
-	"memory modify (auto-incrementing address)",
-#ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
-	"[.b, .w, .l, .q] address"
-#else
-	"[.b, .w, .l] address"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	mm,	2,	1,	do_mem_mm,
+// 	"memory modify (auto-incrementing address)",
+// #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
+// 	"[.b, .w, .l, .q] address"
+// #else
+// 	"[.b, .w, .l] address"
+// #endif
+// );
 
 
-U_BOOT_CMD(
-	nm,	2,	1,	do_mem_nm,
-	"memory modify (constant address)",
-#ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
-	"[.b, .w, .l, .q] address"
-#else
-	"[.b, .w, .l] address"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	nm,	2,	1,	do_mem_nm,
+// 	"memory modify (constant address)",
+// #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
+// 	"[.b, .w, .l, .q] address"
+// #else
+// 	"[.b, .w, .l] address"
+// #endif
+// );
 
-U_BOOT_CMD(
-	mw,	4,	1,	do_mem_mw,
-	"memory write (fill)",
-#ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
-	"[.b, .w, .l, .q] address value [count]"
-#else
-	"[.b, .w, .l] address value [count]"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	mw,	4,	1,	do_mem_mw,
+// 	"memory write (fill)",
+// #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
+// 	"[.b, .w, .l, .q] address value [count]"
+// #else
+// 	"[.b, .w, .l] address value [count]"
+// #endif
+// );
 
-U_BOOT_CMD(
-	cp,	4,	1,	do_mem_cp,
-	"memory copy",
-#ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
-	"[.b, .w, .l, .q] source target count"
-#else
-	"[.b, .w, .l] source target count"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	cp,	4,	1,	do_mem_cp,
+// 	"memory copy",
+// #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
+// 	"[.b, .w, .l, .q] source target count"
+// #else
+// 	"[.b, .w, .l] source target count"
+// #endif
+// );
 
-U_BOOT_CMD(
-	cmp,	4,	1,	do_mem_cmp,
-	"memory compare",
-#ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
-	"[.b, .w, .l, .q] addr1 addr2 count"
-#else
-	"[.b, .w, .l] addr1 addr2 count"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	cmp,	4,	1,	do_mem_cmp,
+// 	"memory compare",
+// #ifdef CONFIG_SYS_SUPPORT_64BIT_DATA
+// 	"[.b, .w, .l, .q] addr1 addr2 count"
+// #else
+// 	"[.b, .w, .l] addr1 addr2 count"
+// #endif
+// );
 
 #ifdef CONFIG_CMD_CRC32
 
@@ -1342,12 +1360,14 @@
 }
 #endif
 
-U_BOOT_CMD(
-	base,	2,	1,	do_mem_base,
-	"print or set address offset",
-	"\n    - print address offset for memory commands\n"
-	"base off\n    - set address offset for memory commands to 'off'"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	base,	2,	1,	do_mem_base,
+// 	"print or set address offset",
+// 	"\n    - print address offset for memory commands\n"
+// 	"base off\n    - set address offset for memory commands to 'off'"
+// );
 
 U_BOOT_CMD(
 	loop,	3,	1,	do_mem_loop,
diff --git a/common/cmd_mii.c b/common/cmd_mii.c
index 40be279..02381c9 100644
--- a/common/cmd_mii.c
+++ b/common/cmd_mii.c
@@ -268,7 +268,8 @@
 }
 
 /* ---------------------------------------------------------------- */
-static int do_mii(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mii(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	char		op[2];
 	unsigned char	addrlo, addrhi, reglo, reghi;
@@ -457,16 +458,18 @@
 
 /***************************************************/
 
-U_BOOT_CMD(
-	mii, 6, 1, do_mii,
-	"MII utility commands",
-	"device                            - list available devices\n"
-	"mii device <devname>                  - set current device\n"
-	"mii info   <addr>                     - display MII PHY info\n"
-	"mii read   <addr> <reg>               - read  MII PHY <addr> register <reg>\n"
-	"mii write  <addr> <reg> <data>        - write MII PHY <addr> register <reg>\n"
-	"mii modify <addr> <reg> <data> <mask> - modify MII PHY <addr> register <reg>\n"
-	"                                        updating bits identified in <mask>\n"
-	"mii dump   <addr> <reg>               - pretty-print <addr> <reg> (0-5 only)\n"
-	"Addr and/or reg may be ranges, e.g. 2-7."
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	mii, 6, 1, do_mii,
+// 	"MII utility commands",
+// 	"device                            - list available devices\n"
+// 	"mii device <devname>                  - set current device\n"
+// 	"mii info   <addr>                     - display MII PHY info\n"
+// 	"mii read   <addr> <reg>               - read  MII PHY <addr> register <reg>\n"
+// 	"mii write  <addr> <reg> <data>        - write MII PHY <addr> register <reg>\n"
+// 	"mii modify <addr> <reg> <data> <mask> - modify MII PHY <addr> register <reg>\n"
+// 	"                                        updating bits identified in <mask>\n"
+// 	"mii dump   <addr> <reg>               - pretty-print <addr> <reg> (0-5 only)\n"
+// 	"Addr and/or reg may be ranges, e.g. 2-7."
+// );
diff --git a/common/cmd_mmc.c b/common/cmd_mmc.c
index 5111980..4a4d048 100644
--- a/common/cmd_mmc.c
+++ b/common/cmd_mmc.c
@@ -156,7 +156,8 @@
 		return NULL;
 	return mmc;
 }
-static int do_mmcinfo(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_mmcinfo(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	struct mmc *mmc;
 
@@ -906,10 +907,12 @@
 	);
 
 /* Old command kept for compatibility. Same as 'mmc info' */
-U_BOOT_CMD(
-	mmcinfo, 1, 0, do_mmcinfo,
-	"display MMC info",
-	"- display info of the current MMC device"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	mmcinfo, 1, 0, do_mmcinfo,
+// 	"display MMC info",
+// 	"- display info of the current MMC device"
+// );
 
 #endif /* !CONFIG_GENERIC_MMC */
diff --git a/common/cmd_mtdparts.c b/common/cmd_mtdparts.c
index ca7c9fc..40ad5f4 100644
--- a/common/cmd_mtdparts.c
+++ b/common/cmd_mtdparts.c
@@ -1914,7 +1914,8 @@
  * @param argv arguments list
  * @return 0 on success, 1 otherwise
  */
-static int do_chpart(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_chpart(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 /* command line only */
 	struct mtd_device *dev;
@@ -1952,8 +1953,8 @@
  * @param argv arguments list
  * @return 0 on success, 1 otherwise
  */
-static int do_mtdparts(cmd_tbl_t *cmdtp, int flag, int argc,
-		       char * const argv[])
+static __maybe_unused int
+do_mtdparts(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	if (argc == 2) {
 		if (strcmp(argv[1], "default") == 0) {
@@ -2070,12 +2071,14 @@
 }
 
 /***************************************************/
-U_BOOT_CMD(
-	chpart,	2,	0,	do_chpart,
-	"change active partition",
-	"part-id\n"
-	"    - change active partition (e.g. part-id = nand0,1)"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	chpart,	2,	0,	do_chpart,
+// 	"change active partition",
+// 	"part-id\n"
+// 	"    - change active partition (e.g. part-id = nand0,1)"
+// );
 
 #ifdef CONFIG_SYS_LONGHELP
 static char mtdparts_help_text[] =
@@ -2123,8 +2126,10 @@
 	"<ro-flag>  := when set to 'ro' makes partition read-only (not used, passed to kernel)";
 #endif
 
-U_BOOT_CMD(
-	mtdparts,	6,	0,	do_mtdparts,
-	"define flash/nand partitions", mtdparts_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	mtdparts,	6,	0,	do_mtdparts,
+// 	"define flash/nand partitions", mtdparts_help_text
+// );
 /***************************************************/
diff --git a/common/cmd_nand.c b/common/cmd_nand.c
index 517badc..043747c 100644
--- a/common/cmd_nand.c
+++ b/common/cmd_nand.c
@@ -365,7 +365,8 @@
 	}
 }
 
-static int do_nand(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_nand(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int i, ret = 0;
 	ulong addr;
@@ -813,10 +814,12 @@
 	"";
 #endif
 
-U_BOOT_CMD(
-	nand, CONFIG_SYS_MAXARGS, 1, do_nand,
-	"NAND sub-system", nand_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	nand, CONFIG_SYS_MAXARGS, 1, do_nand,
+// 	"NAND sub-system", nand_help_text
+// );
 
 static int nand_load_image(cmd_tbl_t *cmdtp, nand_info_t *nand,
 			   ulong offset, ulong addr, char *cmd)
@@ -906,8 +909,8 @@
 	return bootm_maybe_autostart(cmdtp, cmd);
 }
 
-static int do_nandboot(cmd_tbl_t *cmdtp, int flag, int argc,
-		       char * const argv[])
+static __maybe_unused int
+do_nandboot(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	char *boot_device = NULL;
 	int idx;
@@ -984,7 +987,9 @@
 	return nand_load_image(cmdtp, &nand_info[idx], offset, addr, argv[0]);
 }
 
-U_BOOT_CMD(nboot, 4, 1, do_nandboot,
-	"boot from NAND device",
-	"[partition] | [[[loadAddr] dev] offset]"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(nboot, 4, 1, do_nandboot,
+// 	"boot from NAND device",
+// 	"[partition] | [[[loadAddr] dev] offset]"
+// );
diff --git a/common/cmd_net.c b/common/cmd_net.c
index b2f3c7b..447b6b6 100644
--- a/common/cmd_net.c
+++ b/common/cmd_net.c
@@ -14,18 +14,20 @@
 
 static int netboot_common(enum proto_t, cmd_tbl_t *, int, char * const []);
 
-static int do_bootp(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int do_bootp(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	return netboot_common(BOOTP, cmdtp, argc, argv);
 }
 
-U_BOOT_CMD(
-	bootp,	3,	1,	do_bootp,
-	"boot image via network using BOOTP/TFTP protocol",
-	"[loadAddress] [[hostIPaddr:]bootfilename]"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	bootp,	3,	1,	do_bootp,
+// 	"boot image via network using BOOTP/TFTP protocol",
+// 	"[loadAddress] [[hostIPaddr:]bootfilename]"
+// );
 
-int do_tftpb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+int __maybe_unused do_tftpb(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int ret;
 
@@ -35,23 +37,27 @@
 	return ret;
 }
 
-U_BOOT_CMD(
-	tftpboot,	3,	1,	do_tftpb,
-	"boot image via network using TFTP protocol",
-	"[loadAddress] [[hostIPaddr:]bootfilename]"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	tftpboot,	3,	1,	do_tftpb,
+// 	"boot image via network using TFTP protocol",
+// 	"[loadAddress] [[hostIPaddr:]bootfilename]"
+// );
 
 #ifdef CONFIG_CMD_TFTPPUT
-int do_tftpput(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+int __maybe_unused do_tftpput(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	return netboot_common(TFTPPUT, cmdtp, argc, argv);
 }
 
-U_BOOT_CMD(
-	tftpput,	4,	1,	do_tftpput,
-	"TFTP put command, for uploading files to a server",
-	"Address Size [[hostIPaddr:]filename]"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	tftpput,	4,	1,	do_tftpput,
+// 	"TFTP put command, for uploading files to a server",
+// 	"Address Size [[hostIPaddr:]filename]"
+// );
 #endif
 
 #ifdef CONFIG_CMD_TFTPSRV
diff --git a/common/cmd_nvedit.c b/common/cmd_nvedit.c
index 3c5a784..dd66c98 100644
--- a/common/cmd_nvedit.c
+++ b/common/cmd_nvedit.c
@@ -1173,7 +1173,8 @@
 }
 #endif
 
-static int do_env(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_env(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	cmd_tbl_t *cp;
 
@@ -1235,33 +1236,39 @@
 	"env set [-f] name [arg ...]\n";
 #endif
 
-U_BOOT_CMD(
-	env, CONFIG_SYS_MAXARGS, 1, do_env,
-	"environment handling commands", env_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	env, CONFIG_SYS_MAXARGS, 1, do_env,
+// 	"environment handling commands", env_help_text
+// );
 
 /*
  * Old command line interface, kept for compatibility
  */
 
 #if defined(CONFIG_CMD_EDITENV)
-U_BOOT_CMD_COMPLETE(
-	editenv, 2, 0,	do_env_edit,
-	"edit environment variable",
-	"name\n"
-	"    - edit environment variable 'name'",
-	var_complete
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD_COMPLETE(
+// 	editenv, 2, 0,	do_env_edit,
+// 	"edit environment variable",
+// 	"name\n"
+// 	"    - edit environment variable 'name'",
+// 	var_complete
+// );
 #endif
 
-U_BOOT_CMD_COMPLETE(
-	printenv, CONFIG_SYS_MAXARGS, 1,	do_env_print,
-	"print environment variables",
-	"[-a]\n    - print [all] values of all environment variables\n"
-	"printenv name ...\n"
-	"    - print value of environment variable 'name'",
-	var_complete
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD_COMPLETE(
+// 	printenv, CONFIG_SYS_MAXARGS, 1,	do_env_print,
+// 	"print environment variables",
+// 	"[-a]\n    - print [all] values of all environment variables\n"
+// 	"printenv name ...\n"
+// 	"    - print value of environment variable 'name'",
+// 	var_complete
+// );
 
 #ifdef CONFIG_CMD_GREPENV
 U_BOOT_CMD_COMPLETE(
@@ -1303,12 +1310,14 @@
 #endif
 
 #if defined(CONFIG_CMD_RUN)
-U_BOOT_CMD_COMPLETE(
-	run,	CONFIG_SYS_MAXARGS,	1,	do_run,
-	"run commands in an environment variable",
-	"var [...]\n"
-	"    - run the commands in the environment variable(s) 'var'",
-	var_complete
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD_COMPLETE(
+// 	run,	CONFIG_SYS_MAXARGS,	1,	do_run,
+// 	"run commands in an environment variable",
+// 	"var [...]\n"
+// 	"    - run the commands in the environment variable(s) 'var'",
+// 	var_complete
+// );
 #endif
 #endif /* CONFIG_SPL_BUILD */
diff --git a/common/cmd_part.c b/common/cmd_part.c
index 5599509..5ade504 100644
--- a/common/cmd_part.c
+++ b/common/cmd_part.c
@@ -180,7 +180,8 @@
 	return 0;
 }
 
-static int do_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_part(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	if (argc < 2)
 		return CMD_RET_USAGE;
@@ -197,20 +198,22 @@
 	return CMD_RET_USAGE;
 }
 
-U_BOOT_CMD(
-	part,	CONFIG_SYS_MAXARGS,	1,	do_part,
-	"disk partition related commands",
-	"uuid <interface> <dev>:<part>\n"
-	"    - print partition UUID\n"
-	"part uuid <interface> <dev>:<part> <varname>\n"
-	"    - set environment variable to partition UUID\n"
-	"part list <interface> <dev>\n"
-	"    - print a device's partition table\n"
-	"part list <interface> <dev> [flags] <varname>\n"
-	"    - set environment variable to the list of partitions\n"
-	"      flags can be -bootable (list only bootable partitions)\n"
-	"part start <interface> <dev> <part> <varname>\n"
-	"    - set environment variable to the start of the partition (in blocks)\n"
-	"part size <interface> <dev> <part> <varname>\n"
-	"    - set environment variable to the size of the partition (in blocks)"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	part,	CONFIG_SYS_MAXARGS,	1,	do_part,
+// 	"disk partition related commands",
+// 	"uuid <interface> <dev>:<part>\n"
+// 	"    - print partition UUID\n"
+// 	"part uuid <interface> <dev>:<part> <varname>\n"
+// 	"    - set environment variable to partition UUID\n"
+// 	"part list <interface> <dev>\n"
+// 	"    - print a device's partition table\n"
+// 	"part list <interface> <dev> [flags] <varname>\n"
+// 	"    - set environment variable to the list of partitions\n"
+// 	"      flags can be -bootable (list only bootable partitions)\n"
+// 	"part start <interface> <dev> <part> <varname>\n"
+// 	"    - set environment variable to the start of the partition (in blocks)\n"
+// 	"part size <interface> <dev> <part> <varname>\n"
+// 	"    - set environment variable to the size of the partition (in blocks)"
+// );
diff --git a/common/cmd_setexpr.c b/common/cmd_setexpr.c
index e7194fc..a82445f 100644
--- a/common/cmd_setexpr.c
+++ b/common/cmd_setexpr.c
@@ -290,7 +290,8 @@
 }
 #endif
 
-static int do_setexpr(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_setexpr(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong a, b;
 	ulong value;
@@ -375,24 +376,26 @@
 	return 0;
 }
 
-U_BOOT_CMD(
-	setexpr, 6, 0, do_setexpr,
-	"set environment variable as the result of eval expression",
-	"[.b, .w, .l] name [*]value1 <op> [*]value2\n"
-	"    - set environment variable 'name' to the result of the evaluated\n"
-	"      expression specified by <op>.  <op> can be &, |, ^, +, -, *, /, %\n"
-	"      size argument is only meaningful if value1 and/or value2 are\n"
-	"      memory addresses (*)\n"
-	"setexpr[.b, .w, .l] name [*]value\n"
-	"    - load a value into a variable"
-#ifdef CONFIG_REGEX
-	"\n"
-	"setexpr name gsub r s [t]\n"
-	"    - For each substring matching the regular expression <r> in the\n"
-	"      string <t>, substitute the string <s>.  The result is\n"
-	"      assigned to <name>.  If <t> is not supplied, use the old\n"
-	"      value of <name>\n"
-	"setexpr name sub r s [t]\n"
-	"    - Just like gsub(), but replace only the first matching substring"
-#endif
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	setexpr, 6, 0, do_setexpr,
+// 	"set environment variable as the result of eval expression",
+// 	"[.b, .w, .l] name [*]value1 <op> [*]value2\n"
+// 	"    - set environment variable 'name' to the result of the evaluated\n"
+// 	"      expression specified by <op>.  <op> can be &, |, ^, +, -, *, /, %\n"
+// 	"      size argument is only meaningful if value1 and/or value2 are\n"
+// 	"      memory addresses (*)\n"
+// 	"setexpr[.b, .w, .l] name [*]value\n"
+// 	"    - load a value into a variable"
+// #ifdef CONFIG_REGEX
+// 	"\n"
+// 	"setexpr name gsub r s [t]\n"
+// 	"    - For each substring matching the regular expression <r> in the\n"
+// 	"      string <t>, substitute the string <s>.  The result is\n"
+// 	"      assigned to <name>.  If <t> is not supplied, use the old\n"
+// 	"      value of <name>\n"
+// 	"setexpr name sub r s [t]\n"
+// 	"    - Just like gsub(), but replace only the first matching substring"
+// #endif
+// );
diff --git a/common/cmd_sf.c b/common/cmd_sf.c
index 14fae9c..aa69aa3 100644
--- a/common/cmd_sf.c
+++ b/common/cmd_sf.c
@@ -569,7 +569,8 @@
 }
 #endif /* CONFIG_CMD_SF_TEST */
 
-static int do_spi_flash(cmd_tbl_t *cmdtp, int flag, int argc,
+static __maybe_unused int
+do_spi_flash(cmd_tbl_t *cmdtp, int flag, int argc,
 			char * const argv[])
 {
 	const char *cmd;
@@ -625,26 +626,28 @@
 #define SF_TEST_HELP
 #endif
 
-U_BOOT_CMD(
-	sf,	5,	1,	do_spi_flash,
-	"SPI flash sub-system",
-	"probe [[bus:]cs] [hz] [mode]	- init flash device on given SPI bus\n"
-	"				  and chip select\n"
-	"sf read addr offset|partition len	- read `len' bytes starting at\n"
-	"				          `offset' or from start of mtd\n"
-	"					  `partition'to memory at `addr'\n"
-	"sf write addr offset|partition len	- write `len' bytes from memory\n"
-	"				          at `addr' to flash at `offset'\n"
-	"					  or to start of mtd `partition'\n"
-	"sf erase offset|partition [+]len	- erase `len' bytes from `offset'\n"
-	"					  or from start of mtd `partition'\n"
-	"					 `+len' round up `len' to block size\n"
-	"sf update addr offset|partition len	- erase and write `len' bytes from memory\n"
-	"					  at `addr' to flash at `offset'\n"
-	"					  or to start of mtd `partition'\n"
-	"sf protect lock/unlock sector len	- protect/unprotect 'len' bytes starting\n"
-	"					  at address 'sector'\n"
-	"sf bulkerase				- Erase entire flash chip\n"
-	"						(Not supported on all devices)\n"
-	SF_TEST_HELP
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	sf,	5,	1,	do_spi_flash,
+// 	"SPI flash sub-system",
+// 	"probe [[bus:]cs] [hz] [mode]	- init flash device on given SPI bus\n"
+// 	"				  and chip select\n"
+// 	"sf read addr offset|partition len	- read `len' bytes starting at\n"
+// 	"				          `offset' or from start of mtd\n"
+// 	"					  `partition'to memory at `addr'\n"
+// 	"sf write addr offset|partition len	- write `len' bytes from memory\n"
+// 	"				          at `addr' to flash at `offset'\n"
+// 	"					  or to start of mtd `partition'\n"
+// 	"sf erase offset|partition [+]len	- erase `len' bytes from `offset'\n"
+// 	"					  or from start of mtd `partition'\n"
+// 	"					 `+len' round up `len' to block size\n"
+// 	"sf update addr offset|partition len	- erase and write `len' bytes from memory\n"
+// 	"					  at `addr' to flash at `offset'\n"
+// 	"					  or to start of mtd `partition'\n"
+// 	"sf protect lock/unlock sector len	- protect/unprotect 'len' bytes starting\n"
+// 	"					  at address 'sector'\n"
+// 	"sf bulkerase				- Erase entire flash chip\n"
+// 	"						(Not supported on all devices)\n"
+// 	SF_TEST_HELP
+// );
diff --git a/common/cmd_source.c b/common/cmd_source.c
index db7ab7e..daaca4b 100644
--- a/common/cmd_source.c
+++ b/common/cmd_source.c
@@ -143,7 +143,8 @@
 
 /**************************************************/
 #if defined(CONFIG_CMD_SOURCE)
-static int do_source(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_source(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong addr;
 	int rcode;
@@ -181,8 +182,10 @@
 	"";
 #endif
 
-U_BOOT_CMD(
-	source, 2, 0,	do_source,
-	"run script from memory", source_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	source, 2, 0,	do_source,
+// 	"run script from memory", source_help_text
+// );
 #endif
diff --git a/common/cmd_ubi.c b/common/cmd_ubi.c
index 394a169..f870632 100644
--- a/common/cmd_ubi.c
+++ b/common/cmd_ubi.c
@@ -520,7 +520,8 @@
 	return 0;
 }
 
-static int do_ubi(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_ubi(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	int64_t size = 0;
 	ulong addr = 0;
@@ -675,28 +676,30 @@
 	return 1;
 }
 
-U_BOOT_CMD(
-	ubi, 6, 1, do_ubi,
-	"ubi commands",
-	"part [part] [offset]\n"
-		" - Show or set current partition (with optional VID"
-		" header offset)\n"
-	"ubi info [l[ayout]]"
-		" - Display volume and ubi layout information\n"
-	"ubi check volumename"
-		" - check if volumename exists\n"
-	"ubi create[vol] volume [size] [type]"
-		" - create volume name with size\n"
-	"ubi write[vol] address volume size"
-		" - Write volume from address with size\n"
-	"ubi write.part address volume size [fullsize]\n"
-		" - Write part of a volume from address\n"
-	"ubi read[vol] address volume [size]"
-		" - Read volume to address with size\n"
-	"ubi remove[vol] volume"
-		" - Remove volume\n"
-	"[Legends]\n"
-	" volume: character name\n"
-	" size: specified in bytes\n"
-	" type: s[tatic] or d[ynamic] (default=dynamic)"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	ubi, 6, 1, do_ubi,
+// 	"ubi commands",
+// 	"part [part] [offset]\n"
+// 		" - Show or set current partition (with optional VID"
+// 		" header offset)\n"
+// 	"ubi info [l[ayout]]"
+// 		" - Display volume and ubi layout information\n"
+// 	"ubi check volumename"
+// 		" - check if volumename exists\n"
+// 	"ubi create[vol] volume [size] [type]"
+// 		" - create volume name with size\n"
+// 	"ubi write[vol] address volume size"
+// 		" - Write volume from address with size\n"
+// 	"ubi write.part address volume size [fullsize]\n"
+// 		" - Write part of a volume from address\n"
+// 	"ubi read[vol] address volume [size]"
+// 		" - Read volume to address with size\n"
+// 	"ubi remove[vol] volume"
+// 		" - Remove volume\n"
+// 	"[Legends]\n"
+// 	" volume: character name\n"
+// 	" size: specified in bytes\n"
+// 	" type: s[tatic] or d[ynamic] (default=dynamic)"
+// );
diff --git a/common/cmd_ximg.c b/common/cmd_ximg.c
index a62c0d7..40e6b00 100644
--- a/common/cmd_ximg.c
+++ b/common/cmd_ximg.c
@@ -28,7 +28,7 @@
 #define CONFIG_SYS_XIMG_LEN	0x800000
 #endif
 
-static int
+static __maybe_unused int
 do_imgextract(cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[])
 {
 	ulong		addr = load_addr;
@@ -268,7 +268,9 @@
 	"";
 #endif
 
-U_BOOT_CMD(
-	imxtract, 4, 1, do_imgextract,
-	"extract a part of a multi-image", imgextract_help_text
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	imxtract, 4, 1, do_imgextract,
+// 	"extract a part of a multi-image", imgextract_help_text
+// );
diff --git a/drivers/net/ipq5018/athrs17_phy.c b/drivers/net/ipq5018/athrs17_phy.c
index dbc514f..c1d59ab 100644
--- a/drivers/net/ipq5018/athrs17_phy.c
+++ b/drivers/net/ipq5018/athrs17_phy.c
@@ -295,11 +295,14 @@
 
 	return 0;
 };
-U_BOOT_CMD(
-	ar8xxx_dump,    1,    1,    do_ar8xxx_dump,
-	"Dump ar8xxx registers",
-	"\n    - print all ar8xxx registers\n"
-);
+
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	ar8xxx_dump,    1,    1,    do_ar8xxx_dump,
+// 	"Dump ar8xxx registers",
+// 	"\n    - print all ar8xxx registers\n"
+// );
 
 /*********************************************************************
  *
diff --git a/test/dm/cmd_dm.c b/test/dm/cmd_dm.c
index a3c5971..d2b0cd1 100644
--- a/test/dm/cmd_dm.c
+++ b/test/dm/cmd_dm.c
@@ -57,7 +57,8 @@
 	}
 }
 
-static int do_dm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+static __maybe_unused int
+do_dm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 {
 	cmd_tbl_t *test_cmd;
 	int ret;
@@ -80,10 +81,12 @@
 	return cmd_process_error(test_cmd, ret);
 }
 
-U_BOOT_CMD(
-	dm,	3,	1,	do_dm,
-	"Driver model low level access",
-	"tree         Dump driver model tree ('*' = activated)\n"
-	"dm uclass        Dump list of instances for each uclass\n"
-	"dm devres        Dump list of device resources for each device"
-);
+/* Uncomment only for developing to avoid bypassing secure boot.
+   See b/355108471 for details */
+// U_BOOT_CMD(
+// 	dm,	3,	1,	do_dm,
+// 	"Driver model low level access",
+// 	"tree         Dump driver model tree ('*' = activated)\n"
+// 	"dm uclass        Dump list of instances for each uclass\n"
+// 	"dm devres        Dump list of device resources for each device"
+// );