[PATCH v3 00/11] Add SPL support for Qualcomm platforms, starting with sdm845

[PATCH v3 00/11] Add SPL support for Qualcomm platforms, starting with sdm845

[michael.srba]

[ context ]

Different generations of Qualcomm SoCs have differences in the boot
process. msm8916 (and similar) are quite straightforward:
[EL3]bootrom->sbl1->tz->[EL2]hyp->[EL1]aboot->linux (omitting non-AP
cores). msm8998, sdm845, kodiak and simiar are a bit more involved:
[EL3]bootrom->xbl_sec->[EL1]xbl_loader->[EL3]tz->[EL2]hyp->[EL1]uefi
->ABL->linux. Newer platforms like hamoa are even more involved.

Currently, u-boot proper can run in place of Linux, in place
of aboot, or in place of hyp. The option to run in place
of Linux is necessary because >99% of OEMs do not consider
the sale of a device to an end user a transfer of ownership,
that is, they sell the device with a hash of their public key
pre-burnt in the fuses.

[ end of context ]

U-Boot SPL, as it will be built using the defconfig added in this series,
replaces xbl_loader. If support for msm8916 or a similar platform
is added, it would replace sbl1. This will obviously only work on
the <1% of devices whose manufacturers consider the sale a transfer
of ownership, and of course most SBCs.

Unfortunately, starting with (iirc) msm8998, and getting progressively
worse, Qualcomm no longer consider a sale of their SoC a transfer
of ownership either. While it's possible to execute your code
in EL3 using either jtag or a patched devcfg, the former is impractical
while the latter is irrelevant for the purposes of running u-boot SPL
since the devcfg is parsed by trustzone. (this of course only applies
to the <1% of the devices where the OEM didn't lock the device down
prior to sale)

Given the above, this series uses an unintended feature in old builds
of xbl_sec which allows us to elevate to EL3. We also check if we
happen to already be running in EL3, in which case we proceed normally.
This can be the case e.g if JTAG was used to jump to u-boot SPL in EL3,
which may be the only option on e.g. kodiak. (Running in EL1 is not
really viable, because xbl_sec+xbl_loader are effectively sbl1 split
in half and replacing only one doesn't make much sense)

For now, only usb dfu is supported to load the next stage. Since we
don't support ram initialization, the next stage will need to run from
SRAM too, which is currently not supported. Additional patches will
be needed to make that work, at which point it will be possible
to use u-boot as a ufs/emmc programmer with zero proprietary code
in the boot chain (sans bootrom and part of xbl_sec, but the latter and
technically even the former could be skipped with JTAG)

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
Changes in v3:
- redo CONFIG_SPL_REMAKE_ELF_LDSCRIPT to use the existing SPL_REMAKE_ELF code
- clean up KConfig, move stuff to defconfig, change around some imply/selects
  after better understanding how they work, change TARGET handling and remove
  SPL_ prefix
- split out malloc size bugfix
- fix space indents in assembly code, fix missing isb
- unmagicify the linker script
- fix copy paste error with ret declaration
- slightly reword the rst, and hopefully fix all formatting issues
- improve help text for SPL_CLK_STUB
- add SPL_SPMI_MSM and use $(PHASE_) when deciding whether to compile spmi
  support
- improve help text for SPL_OF_LIVE
- add R-Bs for patches that received them and didn't see massive changes
  (hopefully my judgement is correct)
- Link to v2: https://patch.msgid.link/20260411-qcom_spl-v2-0-9609557cf562@seznam.cz

Changes in v2:
- fix spmi and of_live patches (missing help text, remove --, wording
  issues, drivers/spmi/Makefile), add bootstage_start()/bootstage_accum()
- fix conflict with upstream-added cmd_u-boot-spl-elf (and copy endianness
  handling), improve help text for SPL_REMAKE_ELF_LDSCRIPT
- split "mach-snapdragon: support building SPL" into smaller patches
- fix three SYS_MALLOC_LEN definitions; remove the conditional one, it was
  a leftover from related-but-separate effort to make u-boot proper work
  without dram
- s/#if CONFIG_SPL_TARGET_SDM845/#if defined(CONFIG_SPL_TARGET_SDM845)/
- fix "&rpmhcc: clock-controller" (probably accidental ctrl+z)
- change el3_ret_point to (el3_ret_point - _start); I'd swear when I was
  writing this I had to do it that way because for some bizzare reason
  el3_ret_point was relative and _start was absolute, but now I tested
  it again and they're both relative to the start of .text. (making _start
  0, but it's still cleaner this way)
- fix empty comment in el3_payload
- fix documentation style errors
- change KConfig as options as suggested (hardcode computed values, remove
  macro variables, move QCOM_SPL options under ARCH_SNAPDRAGON with
  SPL_BUILD conditionals; IMEM_START/END were dropped since they were
  a leftover from related-but-separate effort to make u-boot proper work
  without dram
- don't mess with SYS_SOC, it's clearly a bad idea; make the board .dtsi
  include sdm845-u-boot.dtsi
- split board.c and don't compile spl parts into u-boot proper and
  vice versa
- properly test clean build
- Link to v1: https://patch.msgid.link/20260404-qcom_spl-v1-0-9e6c2ac66587@seznam.cz

---
Michael Srba (11):
      Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
      of_live: support in SPL
      drivers: allow clk_stub and spmi in SPL
      mach-snapdragon: boot0.h: split out msm8916_boot0.h
      mach-snapdragon: add u-boot-spl-elf-sdm845.lds
      mach-snapdragon: Kconfig: fix duplicate SYS_MALLOC_LEN
      mach-snapdragon: Kconfig: changes / additions to support SPL
      mach-snapdragon: boot0.h: add sdm845_spl_boot0.h
      mach-snapdragon: add board_spl.c and split out common code
      qualcomm: add defconfig, env and docs for SPL on sdm845
      dts: add u-boot specific sdm845 .dtsi and a .dtsi for shift-axolotl

 Makefile                                           |  10 +-
 arch/arm/Kconfig                                   |  33 +-
 arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi      |   2 +
 arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +
 arch/arm/mach-snapdragon/Kconfig                   |  34 +-
 arch/arm/mach-snapdragon/Makefile                  |   8 +
 arch/arm/mach-snapdragon/board.c                   | 358 +--------------------
 arch/arm/mach-snapdragon/board_common.c            |  56 ++++
 arch/arm/mach-snapdragon/board_spl.c               |  35 ++
 arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 +---
 .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 ++++
 .../include/mach/sdm845_spl_boot0.h                | 121 +++++++
 arch/arm/mach-snapdragon/mem_map.c                 | 318 ++++++++++++++++++
 arch/arm/mach-snapdragon/qcom-priv.h               |   4 +-
 arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  44 +++
 board/qualcomm/sdm845_spl.env                      |   2 +
 common/spl/Kconfig                                 |  10 +
 common/spl/spl.c                                   |   9 +
 configs/sdm845_spl_defconfig                       | 138 ++++++++
 doc/board/qualcomm/index.rst                       |   1 +
 doc/board/qualcomm/spl.rst                         |  91 ++++++
 drivers/Makefile                                   |   2 +-
 drivers/clk/Kconfig                                |   7 +
 drivers/spmi/Kconfig                               |  13 +
 drivers/spmi/Makefile                              |   4 +-
 dts/Kconfig                                        |   8 +
 lib/Makefile                                       |   2 +-
 27 files changed, 1026 insertions(+), 415 deletions(-)
---
base-commit: 93f84ee022a8401421cdaab84fe7d106d83fdb4a
change-id: 20260403-qcom_spl-0826843ba41c

Best regards,
--  
Michael Srba <Michael.Srba@seznam.cz>

[PATCH v3 01/11] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Some platforms (e.g. least Qualcomm), use the ELF format in creative
ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script
specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path
as the default).

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 Makefile           | 10 ++++++++--
 common/spl/Kconfig | 10 ++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 8af18668b0f..50893d5689e 100644
--- a/Makefile
+++ b/Makefile
@@ -2004,16 +2004,22 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
 quiet_cmd_u-boot-spl-elf ?= LD      $@
 	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
 	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
-	-T u-boot-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
+	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
 	-Ttext=$(CONFIG_SPL_TEXT_BASE)
-spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
+spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
 	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
 	$(call if_changed,u-boot-spl-elf)
 
+SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
+
+spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
+	$(call if_changed_dep,cpp_lds)
+
 u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
 	$(call if_changed_dep,cpp_lds)
 
 PHONY += prepare0
+
 # MediaTek's ARM-based u-boot needs a header to contains its load address
 # which is parsed by the BootROM.
 # If the SPL build is enabled, the header will be added to the spl binary,
diff --git a/common/spl/Kconfig b/common/spl/Kconfig
index d1a85f50209..1d279a2bb05 100644
--- a/common/spl/Kconfig
+++ b/common/spl/Kconfig
@@ -247,6 +247,16 @@ config SPL_HANDOFF
 	  proper. Also SPL can receive information from TPL in the same place
 	  if that is enabled.
 
+config SPL_REMAKE_ELF_LDSCRIPT
+	string "Linker script for SPL ELF"
+	depends on SPL_REMAKE_ELF
+	default "arch/$(ARCH)/u-boot-spl-elf.lds"
+	help
+	  This allows specifying a linker script that will act on u-boot-spl.bin.
+	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
+	  including in the bootrom. For such platforms, you can change the default
+	  linker script to a platform-specific one.
+
 config SPL_LDSCRIPT
 	string "Linker script for the SPL stage"
 	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV

-- 
2.53.0

[PATCH v3 02/11] of_live: support in SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 common/spl/spl.c | 9 +++++++++
 dts/Kconfig      | 8 ++++++++
 lib/Makefile     | 2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/common/spl/spl.c b/common/spl/spl.c
index 8256fa97862..13559baf059 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -17,6 +17,7 @@
 #include <irq_func.h>
 #include <log.h>
 #include <mapmem.h>
+#include <of_live.h>
 #include <serial.h>
 #include <spl.h>
 #include <spl_load.h>
@@ -510,6 +511,14 @@ static int spl_common_init(bool setup_malloc)
 			return ret;
 		}
 	}
+	if (CONFIG_IS_ENABLED(OF_LIVE)) {
+		bootstage_start(BOOTSTAGE_ID_ACCUM_OF_LIVE, "of_live");
+		ret = of_live_build(gd->fdt_blob,
+				    (struct device_node **)gd_of_root_ptr());
+		bootstage_accum(BOOTSTAGE_ID_ACCUM_OF_LIVE);
+		if (ret)
+			return ret;
+	}
 	if (CONFIG_IS_ENABLED(DM)) {
 		bootstage_start(BOOTSTAGE_ID_ACCUM_DM_SPL,
 				xpl_phase() == PHASE_TPL ? "dm tpl" : "dm_spl");
diff --git a/dts/Kconfig b/dts/Kconfig
index af8d30b45ab..aeb1014253a 100644
--- a/dts/Kconfig
+++ b/dts/Kconfig
@@ -86,6 +86,14 @@ config OF_LIVE
 	  enables a live tree which is available after relocation,
 	  and can be adjusted as needed.
 
+config SPL_OF_LIVE
+	bool "Enable use of a live tree in SPL"
+	depends on SPL_DM && SPL_OF_CONTROL
+	help
+	  This option enables a live tree in SPL, allowing the sharing
+	  of OF fixup code between U-Boot proper and SPL.
+	  See also OF_LIVE.
+
 config OF_UPSTREAM
 	bool "Enable use of devicetree imported from Linux kernel release"
 	depends on !COMPILE_TEST
diff --git a/lib/Makefile b/lib/Makefile
index d0ffabc2b47..bbd540e9687 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -13,7 +13,6 @@ obj-$(CONFIG_FWU_MULTI_BANK_UPDATE) += fwu_updates/
 obj-$(CONFIG_LZMA) += lzma/
 obj-$(CONFIG_BZIP2) += bzip2/
 obj-$(CONFIG_FIT) += libfdt/
-obj-$(CONFIG_OF_LIVE) += of_live.o
 obj-$(CONFIG_CMD_DHRYSTONE) += dhry/
 obj-$(CONFIG_ARCH_AT91) += at91/
 obj-$(CONFIG_OPTEE_LIB) += optee/
@@ -55,6 +54,7 @@ obj-$(CONFIG_BITREVERSE) += bitrev.o
 obj-y += list_sort.o
 endif
 
+obj-$(CONFIG_$(PHASE_)OF_LIVE) += of_live.o
 obj-$(CONFIG_$(PHASE_)TPM) += tpm-common.o
 ifeq ($(CONFIG_$(PHASE_)TPM),y)
 obj-$(CONFIG_TPM) += tpm_api.o

-- 
2.53.0

[PATCH v3 03/11] drivers: allow clk_stub and spmi in SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Only Makefile and Kconfig changes necessary.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 drivers/Makefile      |  2 +-
 drivers/clk/Kconfig   |  7 +++++++
 drivers/spmi/Kconfig  | 13 +++++++++++++
 drivers/spmi/Makefile |  4 ++--
 4 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/Makefile b/drivers/Makefile
index 43d0ba33281..477718ce89a 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
 obj-$(CONFIG_$(PHASE_)RTC) += rtc/
 obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
 obj-$(CONFIG_$(PHASE_)SPI) += spi/
+obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
 obj-$(CONFIG_$(PHASE_)TIMER) += timer/
 obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
 obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
@@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
 obj-y += rtc/
 obj-y += scsi/
 obj-y += sound/
-obj-y += spmi/
 obj-y += watchdog/
 obj-$(CONFIG_QE) += qe/
 obj-$(CONFIG_U_QE) += qe/
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index c2da7b3938b..a50e0b89be7 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -114,6 +114,13 @@ config CLK_STUB
 	  Enable this to provide a stub clock driver for non-essential clock
 	  controllers.
 
+config SPL_CLK_STUB
+	bool "Stub clock driver"
+	depends on SPL_CLK
+	help
+	  Enable this to provide a stub clock driver in SPL for non-essential
+	  clock controllers
+
 config CLK_BCM6345
 	bool "Clock controller driver for BCM6345"
 	depends on CLK && ARCH_BMIPS
diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
index ab4878ebae4..ace4a3be75b 100644
--- a/drivers/spmi/Kconfig
+++ b/drivers/spmi/Kconfig
@@ -8,12 +8,25 @@ config SPMI
 	  SPMI (System Power Management Interface) bus is used
 	  to connect PMIC devices on various SoCs.
 
+config SPL_SPMI
+	bool "Enable SPMI bus support in SPL"
+	depends on SPL_DM
+	help
+	  Select this to enable SPMI bus support in SPL
+
 config SPMI_MSM
 	bool "Support Qualcomm SPMI bus"
 	depends on SPMI
 	---help---
 	  Support SPMI bus implementation found on Qualcomm Snapdragon SoCs.
 
+config SPL_SPMI_MSM
+	bool "Support Qualcomm SPMI bus"
+	depends on SPL_SPMI
+	help
+	  Support SPMI bus implementation found on Qualcomm Snapdragon SoCs
+	  in SPL.
+
 config SPMI_SANDBOX
 	bool "Support for Sandbox SPMI bus"
 	depends on SPMI
diff --git a/drivers/spmi/Makefile b/drivers/spmi/Makefile
index 1b3d57f36a9..8cb93c820e0 100644
--- a/drivers/spmi/Makefile
+++ b/drivers/spmi/Makefile
@@ -2,6 +2,6 @@
 #
 # (C) Copyright 2015 Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
 
-obj-$(CONFIG_SPMI)  += spmi-uclass.o
-obj-$(CONFIG_SPMI_MSM) += spmi-msm.o
+obj-$(CONFIG_$(PHASE_)SPMI)  += spmi-uclass.o
+obj-$(CONFIG_$(PHASE_)SPMI_MSM) += spmi-msm.o
 obj-$(CONFIG_SPMI_SANDBOX) += spmi-sandbox.o

-- 
2.53.0

[PATCH v3 04/11] mach-snapdragon: boot0.h: split out msm8916_boot0.h

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Prepare for supporting alternative boot0.h per-SoC by splitting out
the existing msm8916-specific code.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 arch/arm/mach-snapdragon/include/mach/boot0.h      | 57 ++--------------------
 .../mach-snapdragon/include/mach/msm8916_boot0.h   | 54 ++++++++++++++++++++
 2 files changed, 59 insertions(+), 52 deletions(-)

diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
index 953cccad790..44a764788de 100644
--- a/arch/arm/mach-snapdragon/include/mach/boot0.h
+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h
@@ -1,54 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0+ */
-/*
- * Workaround for "PSCI bug" on DragonBoard 410c
- * Copyright (C) 2021 Stephan Gerhold <stephan@gerhold.net>
- *
- * Syscall parameters taken from Qualcomm's LK fork (scm.h):
- * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
- *
- * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has
- * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall
- * that switches from 32-bit to 64-bit mode is executed at least once.
- *
- * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit
- * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if
- * U-Boot is installed to the "aboot" partition (replacing LK) the switch to
- * 64-bit mode never happens since U-Boot is already running in 64-bit mode.
- *
- * A workaround for this "PSCI bug" is to execute the TZ syscall when entering
- * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other
- * CPU cores in 64-bit mode as well.
- */
-#include <linux/arm-smccc.h>
-
-#define ARM_SMCCC_SIP32_FAST_CALL \
-	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
-
-	/*
-	 * U-Boot might be started in EL2 or EL3 with custom firmware.
-	 * In that case, we assume that the workaround is not necessary or is
-	 * handled already by the alternative firmware. Using the syscall in EL2
-	 * would demote U-Boot to EL1; in EL3 it would probably just crash.
-	 */
-	mrs	x0, CurrentEL
-	cmp	x0, #(1 << 2)	/* EL1 */
-	bne	reset
-
-	/* Prepare TZ syscall parameters */
-	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
-	movk	x0, #0x10f	/* SCM_SVC_MILESTONE_CMD_ID */
-	mov	x1, #0x12	/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */
-	adr	x2, el1_system_param
-	mov	x3, el1_system_param_end - el1_system_param
-
-	/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */
-	smc	#0
-
-	/* Something went wrong, perhaps PSCI is already in 64-bit mode? */
+#if defined(CONFIG_SPL_BUILD)
 	b	reset
-
-	.align	3
-el1_system_param:
-	.quad	0, 0, 0, 0, 0, 0, 0, 0, 0	/* el1_x0-x8 */
-	.quad	reset				/* el1_elr */
-el1_system_param_end:
+#else
+/* currently only db410c enables boot0.h in u-boot proper */
+#include "msm8916_boot0.h"
+#endif
diff --git a/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h
new file mode 100644
index 00000000000..953cccad790
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Workaround for "PSCI bug" on DragonBoard 410c
+ * Copyright (C) 2021 Stephan Gerhold <stephan@gerhold.net>
+ *
+ * Syscall parameters taken from Qualcomm's LK fork (scm.h):
+ * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
+ *
+ * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has
+ * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall
+ * that switches from 32-bit to 64-bit mode is executed at least once.
+ *
+ * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit
+ * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if
+ * U-Boot is installed to the "aboot" partition (replacing LK) the switch to
+ * 64-bit mode never happens since U-Boot is already running in 64-bit mode.
+ *
+ * A workaround for this "PSCI bug" is to execute the TZ syscall when entering
+ * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other
+ * CPU cores in 64-bit mode as well.
+ */
+#include <linux/arm-smccc.h>
+
+#define ARM_SMCCC_SIP32_FAST_CALL \
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
+
+	/*
+	 * U-Boot might be started in EL2 or EL3 with custom firmware.
+	 * In that case, we assume that the workaround is not necessary or is
+	 * handled already by the alternative firmware. Using the syscall in EL2
+	 * would demote U-Boot to EL1; in EL3 it would probably just crash.
+	 */
+	mrs	x0, CurrentEL
+	cmp	x0, #(1 << 2)	/* EL1 */
+	bne	reset
+
+	/* Prepare TZ syscall parameters */
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #0x10f	/* SCM_SVC_MILESTONE_CMD_ID */
+	mov	x1, #0x12	/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */
+	adr	x2, el1_system_param
+	mov	x3, el1_system_param_end - el1_system_param
+
+	/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */
+	smc	#0
+
+	/* Something went wrong, perhaps PSCI is already in 64-bit mode? */
+	b	reset
+
+	.align	3
+el1_system_param:
+	.quad	0, 0, 0, 0, 0, 0, 0, 0, 0	/* el1_x0-x8 */
+	.quad	reset				/* el1_elr */
+el1_system_param_end:

-- 
2.53.0

[PATCH v3 05/11] mach-snapdragon: add u-boot-spl-elf-sdm845.lds

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

This custom linker script is required to produce a bootable ELF
for the sdm845 SoC. An xbl_sec.elf must be provided, which will
be put in a section in the ELF as required by the boot rom.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds | 44 ++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
new file mode 100644
index 00000000000..3740209d499
--- /dev/null
+++ b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+
+/*
+ * The boot rom uses the segment type to identify the xbl_sec program header.
+ * See https://github.com/coreboot/coreboot/blob/643efabd2af9f7ac/util/qualcomm/mbn_tools.py#L143.
+ */
+#define PF_SEGMENT_TYPE_XBL_SEC 5
+
+/*
+ * The boot rom expects this to be equal to a seemingly magic value possibly specific
+ * to a particular xbl_sec.elf. If you're extracting your xbl_sec.elf from an xbl elf,
+ * you can just reuse the value; otherwise you can either compute it yourself or use
+ * coreboot's tool.
+ * See https://github.com/coreboot/coreboot/blob/643efabd2af9f7ac/util/qualcomm/createxbl.py#L638.
+ */
+#define XLB_SEC_SEGMENT_ADDR 0x0000000014699000
+
+
+TARGET("binary")
+INPUT("./xbl_sec.elf")
+
+OUTPUT_FORMAT("default")
+
+ENTRY(CONFIG_PLATFORM_ELFENTRY)
+PHDRS
+{
+	data PT_LOAD FLAGS(7);
+	xbl_sec PT_LOAD FLAGS(5 | (PF_SEGMENT_TYPE_XBL_SEC << 24));
+}
+SECTIONS
+{
+
+	. = XLB_SEC_SEGMENT_ADDR;
+	.xbl_sec : { // XBL_SEC nested ELF
+		. = .;
+		"./xbl_sec.elf"
+	} :xbl_sec
+
+	. = CONFIG_PLATFORM_ELFENTRY;
+
+	.data : {
+		*(.data*)
+	} :data
+}

-- 
2.53.0

[PATCH v3 06/11] mach-snapdragon: Kconfig: fix duplicate SYS_MALLOC_LEN

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/mach-snapdragon/Kconfig | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
index 976c0e35fce..f82cd0d3291 100644
--- a/arch/arm/mach-snapdragon/Kconfig
+++ b/arch/arm/mach-snapdragon/Kconfig
@@ -11,9 +11,6 @@ config SYS_VENDOR
 	  Based on this option board/<CONFIG_SYS_VENDOR>/<CONFIG_SYS_BOARD>
 	  will be used as the custom board directory.
 
-config SYS_MALLOC_LEN
-	default 0x10000000
-
 config SYS_MALLOC_F_LEN
 	default 0x2000
 

-- 
2.53.0

[PATCH v3 07/11] mach-snapdragon: Kconfig: changes / additions to support SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
This will select reasonable defaults and enable per-SoC linker
script (if required).

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/Kconfig                 | 33 ++++++++++++++++++++++++++++++++-
 arch/arm/mach-snapdragon/Kconfig | 31 ++++++++++++++++++++++++++++---
 2 files changed, 60 insertions(+), 4 deletions(-)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 03416c55265..a4308aea635 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1124,6 +1124,7 @@ config ARCH_SNAPDRAGON
 	bool "Qualcomm Snapdragon SoCs"
 	select ARM64
 	select DM
+	select DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC
 	select DM_GPIO
 	select DM_SERIAL
 	select DM_RESET
@@ -1138,9 +1139,39 @@ config ARCH_SNAPDRAGON
 	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select SYSRESET
-	select SYSRESET_PSCI
+	select SYSRESET_PSCI if !SPL
 	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
 	select MMU_PGPROT
+	select SUPPORT_SPL
+
+	select OF_LIVE if USB_DWC3_GENERIC
+	select SPL_OF_LIVE if SPL_USB_DWC3_GENERIC
+	select ARMV8_SPL_EXCEPTION_VECTORS if SPL
+	select ENABLE_ARM_SOC_BOOT0_HOOK if SPL
+	select SPL_DM if SPL
+	select SPL_DM_GPIO if SPL
+	select SPL_DM_PMIC if SPL
+	select SPL_DM_USB_GADGET if SPL
+	select SPL_ENV_SUPPORT if SPL
+	select SPL_EVENT if SPL_USB_DWC3_GENERIC
+	select SPL_GPIO if SPL
+	select SPL_HAS_BSS_LINKER_SECTION if SPL
+	select SPL_LIBCOMMON_SUPPORT if SPL
+	select SPL_LIBDISK_SUPPORT if SPL
+	select SPL_LIBGENERIC_SUPPORT if SPL
+	select SPL_OF_REAL if SPL
+	select SPL_OF_CONTROL if SPL
+	select SPL_PINCONF if SPL
+	select SPL_PINCTRL if SPL
+	select SPL_PINCTRL_FULL if SPL
+	select SPL_PINCTRL_GENERIC if SPL
+	select SPL_PINCONF_RECURSIVE if SPL
+	select SPL_PINMUX if SPL
+	select SPL_SPMI_MSM if SPL
+	select SPL_SPRINTF if SPL
+	select SPL_STRTO if SPL
+	select SPL_USB_GADGET if SPL
+	imply SPL_MMC if SPL
 	imply OF_UPSTREAM
 	imply CMD_DM
 	imply DM_USB_GADGET
diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
index f82cd0d3291..1fc8f51c952 100644
--- a/arch/arm/mach-snapdragon/Kconfig
+++ b/arch/arm/mach-snapdragon/Kconfig
@@ -17,9 +17,6 @@ config SYS_MALLOC_F_LEN
 config SPL_SYS_MALLOC_F
 	default y
 
-config SPL_SYS_MALLOC_F_LEN
-	default 0x2000
-
 config SYS_MALLOC_LEN
 	default 0x800000
 
@@ -42,4 +39,32 @@ config SYS_CONFIG_NAME
 	  Based on this option include/configs/<CONFIG_SYS_CONFIG_NAME>.h header
 	  will be used for board configuration.
 
+config SPL_SHARES_INIT_SP_ADDR
+	default n
+
+config SPL_HAVE_INIT_STACK
+	default y
+
+choice
+	prompt "Qualcomm SoC select"
+	default TARGET_NONE if !SPL
+	help
+	  While U-Boot on Qualcomm platforms doesn't generally need compile-time
+	  adjustment based on the target SoC, there are a few exceptions to this.
+	  Currently this concerns boot0.h discrimination.
+
+config TARGET_NONE
+	bool "Generic build"
+	help
+	  Select this if you're not building SPL. U-Boot proper builds are currently
+	  generic across all SoCs.
+
+config TARGET_SDM845
+	bool "SPL targeting the sdm845 SoC"
+	help
+	  Select this if you are bulding u-boot SPL for sdm845.
+	  Currently this gates sdm845-specific boot0.h (only used in SPL).
+
+endchoice
+
 endif

-- 
2.53.0

[PATCH v3 08/11] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

On sdm845, running u-boot SPL in EL3 requires escalting by using
an unintentional feature in old builds of xbl_sec.elf. We do this
in boot0.h so the rest of U-Boot can stay blissfully unaware
of XBL_SEC. If we are already in EL3 for whatever reason, the
code is skipped.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 arch/arm/mach-snapdragon/include/mach/boot0.h      |   4 +
 .../include/mach/sdm845_spl_boot0.h                | 121 +++++++++++++++++++++
 2 files changed, 125 insertions(+)

diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
index 44a764788de..5ae2f6ca194 100644
--- a/arch/arm/mach-snapdragon/include/mach/boot0.h
+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: GPL-2.0+ */
 #if defined(CONFIG_SPL_BUILD)
+#if defined(CONFIG_TARGET_SDM845)
+#include "sdm845_spl_boot0.h"
+#else
 	b	reset
+#endif
 #else
 /* currently only db410c enables boot0.h in u-boot proper */
 #include "msm8916_boot0.h"
diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
new file mode 100644
index 00000000000..11fe229ef56
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
@@ -0,0 +1,121 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Workaround for non-qcom-signed code being entered in EL1 on sdm845
+ * Copyright (C) 2026 Michael Srba <Michael.Srba@seznam.cz>
+ *
+ * This code uses an unintentional ownership enhancing feature in older builds of XBL_SEC
+ * in order to elevate our privileges to EL3 as soon as possible after a system reset.
+ * This allows for a very close approximation of a clean state.
+ *
+ * Do note that you still need to own the device in the sense that you control the code that
+ * XBL_SEC jumps to in EL1, which is sadly not a level of ownership commonly afforded to you
+ * by the device manufacturer. On such devices, CVE-2021-30327 could help, but it's not documented
+ * and there is no PoC available utilizing it
+ *
+ */
+#include <linux/arm-smccc.h>
+
+#define SCM_SMC_FNID(s, c)	((((s) & 0xFF) << 8) | ((c) & 0xFF))
+
+#define ARM_SMCCC_SIP32_FAST_CALL \
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
+
+/* same as with qcom's TZ */
+#define QCOM_SCM_SVC_MEM_DUMP 0x03
+/* unlike the TZ counterpart, in XBL_SEC this simply unlocks the XPUs */
+#define QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS 0x10
+
+/*
+ * We put our payload in place of some SCM call, the important thing is that it's hopefully
+ * in a memory region that is not in cache.
+ *
+ * It would be cleaner to just put our code at the scm entry point in the vector table,
+ * however it seems that we can't force cache coherency from EL1 if EL3 doesn't have
+ * any reason to care about that.
+ */
+#define QCOM_SCM_SVC_DONOR 0x01
+#define QCOM_SCM_DONOR 0x16
+/* we replace the instructions at this address with a jump to the start of u-boot */
+/* NOTE: this address is specific to a particular XBL_SEC elf */
+#define XBL_SEC_DONOR_SCM_ADDR 0x146a0ce0
+
+/* gnu as doesn't implement these useful pseudoinstructions */
+.macro movq Xn, imm
+	movz    \Xn,  \imm & 0xFFFF
+	movk    \Xn, (\imm >> 16) & 0xFFFF, lsl 16
+	movk    \Xn, (\imm >> 32) & 0xFFFF, lsl 32
+	movk    \Xn, (\imm >> 48) & 0xFFFF, lsl 48
+.endm
+
+.macro movl Wn, imm
+	movz    \Wn,  \imm & 0xFFFF
+	movk    \Wn, (\imm >> 16) & 0xFFFF, lsl 16
+.endm
+
+/* copy 32 bits to an address from a label */
+.macro copy32 addr, text_base, addrofval, offset
+	movl	x0, \addr
+	add	x0, x0, \offset
+	movq	x1, \text_base
+	add	x1, x1, \addrofval
+	add	x1, x1, \offset
+	ldr	w2, [x1]
+	str	w2, [x0]
+	dc	cvau, x0 // flush cache to RAM straight away, we need to do it by address anyway
+.endm
+
+.macro copy_instructions addr, text_base, start_addr, num_bytes // num_bytes must be a multiple of 4
+	mov x3,	#0x0 // x0, x1 and w2 used by copy32
+1:
+	copy32	\addr, \text_base, \start_addr, x3
+	add	x3, x3, #0x4 // i+=4
+	cmp	x3, \num_bytes
+	blo	1b
+.endm
+
+	/*  If we're already in EL3 for some reason,  skip this whole thing */
+	mrs	x0, CurrentEL
+	cmp	x0, #(3 << 2)	/* EL3 */
+	beq	reset
+
+	/* disable the mmu */
+	mrs	x0, sctlr_el1
+	and     x0, x0, #~(1 << 0) // CTRL_M
+	msr	sctlr_el1, x0
+
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #SCM_SMC_FNID(QCOM_SCM_SVC_MEM_DUMP, QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS)
+	mov	x1, #0x0	/* no params */
+	mov	x6, #0x0
+
+	smc	#0 /* unlock XBL_SEC code area for writing (assuming old enough XBL_SEC build) */
+
+	/* this will also flush the writes from cache */
+	copy_instructions XBL_SEC_DONOR_SCM_ADDR, CONFIG_SPL_TEXT_BASE, el3_payload, #((el3_payload_end - el3_payload))
+
+	/* this probably doesn't affect EL3, but it doesn't hurt */
+	dsb	ish	/* block until cache is flushed */
+	ic	iallu	/* force re-fetch of our shiny new instructions */
+	dsb	ish	/* block until invalidation is finished */
+	isb	sy	/* unify here ? */
+
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #SCM_SMC_FNID(QCOM_SCM_SVC_DONOR, QCOM_SCM_DONOR)
+	mov	x1, #0x0	/* no params */
+	smc	#0	/* call the payload */
+
+el3_ret_point:
+	b	reset
+
+el3_payload:
+	/* disable the mmu for EL3 too */
+	mrs	x0, sctlr_el3
+	and     x0, x0, #~(1 << 0) // CTRL_M
+	msr	sctlr_el3, x0
+	isb
+
+	/* jump back to our code, but now in EL3 */
+	movl	x0, CONFIG_SPL_TEXT_BASE
+	add	x0, x0, (el3_ret_point - _start)
+	br	x0
+el3_payload_end:

-- 
2.53.0

[PATCH v3 09/11] mach-snapdragon: add board_spl.c and split out common code

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Code in board.c will now only be compiled into U-Boot proper,
and the new board_spl.c will only be built into SPL.
Code in board_common.c is common to both phases.

Also split out mem_map.c, which is currently common to both
phases since it seems to not cause issues in SPL. In the future
it should probably behave differenly in SPL, especially if dram
initialization is supported.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 arch/arm/mach-snapdragon/Makefile       |   8 +
 arch/arm/mach-snapdragon/board.c        | 358 +-------------------------------
 arch/arm/mach-snapdragon/board_common.c |  56 +++++
 arch/arm/mach-snapdragon/board_spl.c    |  35 ++++
 arch/arm/mach-snapdragon/mem_map.c      | 318 ++++++++++++++++++++++++++++
 arch/arm/mach-snapdragon/qcom-priv.h    |   4 +-
 6 files changed, 429 insertions(+), 350 deletions(-)

diff --git a/arch/arm/mach-snapdragon/Makefile b/arch/arm/mach-snapdragon/Makefile
index 343e825c6fd..4b265b746ce 100644
--- a/arch/arm/mach-snapdragon/Makefile
+++ b/arch/arm/mach-snapdragon/Makefile
@@ -2,6 +2,14 @@
 #
 # (C) Copyright 2015 Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
 
+obj-y += board_common.o
+obj-y += mem_map.o
+
+ifeq ($(CONFIG_SPL_BUILD),y)
+obj-y += board_spl.o
+else
 obj-y += board.o
 obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += capsule_update.o
+endif
+
 obj-$(CONFIG_OF_LIVE) += of_fixup.o
diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
index 5fb3240acc5..00e1aba675b 100644
--- a/arch/arm/mach-snapdragon/board.c
+++ b/arch/arm/mach-snapdragon/board.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
  * Common initialisation for Qualcomm Snapdragon boards.
+ * U-Boot proper only, see board_common.c for parts shared with SPL
  *
  * Copyright (c) 2024 Linaro Ltd.
  * Author: Casey Connolly <casey.connolly@linaro.org>
@@ -9,155 +10,21 @@
 #define LOG_CATEGORY LOGC_BOARD
 #define pr_fmt(fmt) "QCOM: " fmt
 
-#include <asm/armv8/mmu.h>
-#include <asm/gpio.h>
-#include <asm/io.h>
-#include <asm/psci.h>
-#include <asm/system.h>
-#include <dm/device.h>
-#include <dm/pinctrl.h>
-#include <dm/uclass-internal.h>
-#include <dm/read.h>
-#include <power/regulator.h>
+#include <dm/ofnode.h>
 #include <env.h>
 #include <fdt_support.h>
 #include <init.h>
 #include <linux/arm-smccc.h>
-#include <linux/bug.h>
+#include <linux/errno.h>
 #include <linux/psci.h>
 #include <linux/sizes.h>
 #include <lmb.h>
-#include <malloc.h>
-#include <fdt_support.h>
-#include <usb.h>
-#include <sort.h>
-#include <time.h>
 
 #include "qcom-priv.h"
 
-DECLARE_GLOBAL_DATA_PTR;
-
 enum qcom_boot_source qcom_boot_source __section(".data") = 0;
 
-static struct mm_region rbx_mem_map[CONFIG_NR_DRAM_BANKS + 2] = { { 0 } };
-
-struct mm_region *mem_map = rbx_mem_map;
-
-static struct {
-	phys_addr_t start;
-	phys_size_t size;
-} prevbl_ddr_banks[CONFIG_NR_DRAM_BANKS] __section(".data") = { 0 };
-
-int dram_init(void)
-{
-	/*
-	 * gd->ram_base / ram_size have been setup already
-	 * in qcom_parse_memory().
-	 */
-	return 0;
-}
-
-static int ddr_bank_cmp(const void *v1, const void *v2)
-{
-	const struct {
-		phys_addr_t start;
-		phys_size_t size;
-	} *res1 = v1, *res2 = v2;
-
-	if (!res1->size)
-		return 1;
-	if (!res2->size)
-		return -1;
-
-	return (res1->start >> 24) - (res2->start >> 24);
-}
-
-/* This has to be done post-relocation since gd->bd isn't preserved */
-static void qcom_configure_bi_dram(void)
-{
-	int i;
-
-	for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
-		gd->bd->bi_dram[i].start = prevbl_ddr_banks[i].start;
-		gd->bd->bi_dram[i].size = prevbl_ddr_banks[i].size;
-	}
-}
-
-int dram_init_banksize(void)
-{
-	qcom_configure_bi_dram();
-
-	return 0;
-}
-
-/**
- * The generic memory parsing code in U-Boot lacks a few things that we
- * need on Qualcomm:
- *
- * 1. It sets gd->ram_size and gd->ram_base to represent a single memory block
- * 2. setup_dest_addr() later relocates U-Boot to ram_base + ram_size, the end
- *    of that first memory block.
- *
- * This results in all memory beyond U-Boot being unusable in Linux when booting
- * with EFI.
- *
- * Since the ranges in the memory node may be out of order, the only way for us
- * to correctly determine the relocation address for U-Boot is to parse all
- * memory regions and find the highest valid address.
- *
- * We can't use fdtdec_setup_memory_banksize() since it stores the result in
- * gd->bd, which is not yet allocated.
- *
- * @fdt: FDT blob to parse /memory node from
- *
- * Return: 0 on success or -ENODATA if /memory node is missing or incomplete
- */
-static int qcom_parse_memory(const void *fdt)
-{
-	int offset;
-	const fdt64_t *memory;
-	int memsize;
-	phys_addr_t ram_end = 0;
-	int i, j, banks;
-
-	offset = fdt_path_offset(fdt, "/memory");
-	if (offset < 0)
-		return -ENODATA;
-
-	memory = fdt_getprop(fdt, offset, "reg", &memsize);
-	if (!memory)
-		return -ENODATA;
-
-	banks = min(memsize / (2 * sizeof(u64)), (ulong)CONFIG_NR_DRAM_BANKS);
-
-	if (memsize / sizeof(u64) > CONFIG_NR_DRAM_BANKS * 2)
-		log_err("Provided more than the max of %d memory banks\n", CONFIG_NR_DRAM_BANKS);
-
-	if (banks > CONFIG_NR_DRAM_BANKS)
-		log_err("Provided more memory banks than we can handle\n");
-
-	for (i = 0, j = 0; i < banks * 2; i += 2, j++) {
-		prevbl_ddr_banks[j].start = get_unaligned_be64(&memory[i]);
-		prevbl_ddr_banks[j].size = get_unaligned_be64(&memory[i + 1]);
-		if (!prevbl_ddr_banks[j].size) {
-			j--;
-			continue;
-		}
-		ram_end = max(ram_end, prevbl_ddr_banks[j].start + prevbl_ddr_banks[j].size);
-	}
-
-	if (!banks || !prevbl_ddr_banks[0].size)
-		return -ENODATA;
-
-	/* Sort our RAM banks -_- */
-	qsort(prevbl_ddr_banks, banks, sizeof(prevbl_ddr_banks[0]), ddr_bank_cmp);
-
-	gd->ram_base = prevbl_ddr_banks[0].start;
-	gd->ram_size = ram_end - gd->ram_base;
-
-	return 0;
-}
-
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI)
 static void show_psci_version(void)
 {
 	struct arm_smccc_res res;
@@ -199,6 +66,7 @@ static void qcom_psci_fixup(void *fdt)
 	if (ret)
 		log_err("Failed to delete /psci node: %d\n", ret);
 }
+#endif
 
 /* We support booting U-Boot with an internal DT when running as a first-stage bootloader
  * or for supporting quirky devices where it's easier to leave the downstream DT in place
@@ -258,49 +126,13 @@ int board_fdt_blob_setup(void **fdtp)
 		ret = 0;
 	}
 
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI)
 	qcom_psci_fixup(*fdtp);
+#endif
 
 	return ret;
 }
 
-/*
- * Some Qualcomm boards require GPIO configuration when switching USB modes.
- * Support setting this configuration via pinctrl state.
- */
-int board_usb_init(int index, enum usb_init_type init)
-{
-	struct udevice *usb;
-	int ret = 0;
-
-	/* USB device */
-	ret = uclass_find_device_by_seq(UCLASS_USB, index, &usb);
-	if (ret) {
-		printf("Cannot find USB device\n");
-		return ret;
-	}
-
-	ret = dev_read_stringlist_search(usb, "pinctrl-names",
-					 "device");
-	/* No "device" pinctrl state, so just bail */
-	if (ret < 0)
-		return 0;
-
-	/* Select "default" or "device" pinctrl */
-	switch (init) {
-	case USB_INIT_HOST:
-		pinctrl_select_state(usb, "default");
-		break;
-	case USB_INIT_DEVICE:
-		pinctrl_select_state(usb, "device");
-		break;
-	default:
-		debug("Unknown usb_init_type %d\n", init);
-		break;
-	}
-
-	return 0;
-}
-
 /*
  * Some boards still need board specific init code, they can implement that by
  * overriding this function.
@@ -313,7 +145,9 @@ void __weak qcom_board_init(void)
 
 int board_init(void)
 {
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)
 	show_psci_version();
+#endif
 	qcom_board_init();
 	return 0;
 }
@@ -575,177 +409,3 @@ int board_late_init(void)
 
 	return 0;
 }
-
-static void build_mem_map(void)
-{
-	int i, j;
-
-	/*
-	 * Ensure the peripheral block is sized to correctly cover the address range
-	 * up to the first memory bank.
-	 * Don't map the first page to ensure that we actually trigger an abort on a
-	 * null pointer access rather than just hanging.
-	 * FIXME: we should probably split this into more precise regions
-	 */
-	mem_map[0].phys = 0x1000;
-	mem_map[0].virt = mem_map[0].phys;
-	mem_map[0].size = gd->bd->bi_dram[0].start - mem_map[0].phys;
-	mem_map[0].attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
-			 PTE_BLOCK_NON_SHARE |
-			 PTE_BLOCK_PXN | PTE_BLOCK_UXN;
-
-	for (i = 1, j = 0; i < ARRAY_SIZE(rbx_mem_map) - 1 && gd->bd->bi_dram[j].size; i++, j++) {
-		mem_map[i].phys = gd->bd->bi_dram[j].start;
-		mem_map[i].virt = mem_map[i].phys;
-		mem_map[i].size = gd->bd->bi_dram[j].size;
-		mem_map[i].attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | \
-				   PTE_BLOCK_INNER_SHARE;
-	}
-
-	mem_map[i].phys = UINT64_MAX;
-	mem_map[i].size = 0;
-
-#ifdef DEBUG
-	debug("Configured memory map:\n");
-	for (i = 0; mem_map[i].size; i++)
-		debug("  0x%016llx - 0x%016llx: entry %d\n",
-		      mem_map[i].phys, mem_map[i].phys + mem_map[i].size, i);
-#endif
-}
-
-u64 get_page_table_size(void)
-{
-	return SZ_1M;
-}
-
-static int fdt_cmp_res(const void *v1, const void *v2)
-{
-	const struct fdt_resource *res1 = v1, *res2 = v2;
-
-	return res1->start - res2->start;
-}
-
-#define N_RESERVED_REGIONS 32
-
-/* Mark all no-map regions as PTE_TYPE_FAULT to prevent speculative access.
- * On some platforms this is enough to trigger a security violation and trap
- * to EL3.
- */
-static void carve_out_reserved_memory(void)
-{
-	static struct fdt_resource res[N_RESERVED_REGIONS] = { 0 };
-	int parent, rmem, count, i = 0;
-	phys_addr_t start;
-	size_t size;
-
-	/* Some reserved nodes must be carved out, as the cache-prefetcher may otherwise
-	 * attempt to access them, causing a security exception.
-	 */
-	parent = fdt_path_offset(gd->fdt_blob, "/reserved-memory");
-	if (parent <= 0) {
-		log_err("No reserved memory regions found\n");
-		return;
-	}
-
-	/* Collect the reserved memory regions */
-	fdt_for_each_subnode(rmem, gd->fdt_blob, parent) {
-		const fdt32_t *ptr;
-		int len;
-		if (!fdt_getprop(gd->fdt_blob, rmem, "no-map", NULL))
-			continue;
-
-		if (i == N_RESERVED_REGIONS) {
-			log_err("Too many reserved regions!\n");
-			break;
-		}
-
-		/* Read the address and size out from the reg property. Doing this "properly" with
-		 * fdt_get_resource() takes ~70ms on SDM845, but open-coding the happy path here
-		 * takes <1ms... Oh the woes of no dcache.
-		 */
-		ptr = fdt_getprop(gd->fdt_blob, rmem, "reg", &len);
-		if (ptr) {
-			/* Qualcomm devices use #address/size-cells = <2> but all reserved regions are within
-			 * the 32-bit address space. So we can cheat here for speed.
-			 */
-			res[i].start = fdt32_to_cpu(ptr[1]);
-			res[i].end = res[i].start + fdt32_to_cpu(ptr[3]);
-			i++;
-		}
-	}
-
-	/* Sort the reserved memory regions by address */
-	count = i;
-	qsort(res, count, sizeof(struct fdt_resource), fdt_cmp_res);
-
-	/* Now set the right attributes for them. Often a lot of the regions are tightly packed together
-	 * so we can optimise the number of calls to mmu_change_region_attr() by combining adjacent
-	 * regions.
-	 */
-	start = ALIGN_DOWN(res[0].start, SZ_2M);
-	size = ALIGN(res[0].end - start, SZ_2M);
-	for (i = 1; i <= count; i++) {
-		/* We ideally want to 2M align everything for more efficient pagetables, but we must avoid
-		 * overwriting reserved memory regions which shouldn't be mapped as FAULT (like those with
-		 * compatible properties).
-		 * If within 2M of the previous region, bump the size to include this region. Otherwise
-		 * start a new region.
-		 */
-		if (i == count || start + size < res[i].start - SZ_2M) {
-			debug("  0x%016llx - 0x%016llx: reserved\n",
-			      start, start + size);
-			mmu_change_region_attr(start, size, PTE_TYPE_FAULT);
-			/* If this is the final region then quit here before we index
-			 * out of bounds...
-			 */
-			if (i == count)
-				break;
-			start = ALIGN_DOWN(res[i].start, SZ_2M);
-			size = ALIGN(res[i].end - start, SZ_2M);
-		} else {
-			/* Bump size if this region is immediately after the previous one */
-			size = ALIGN(res[i].end - start, SZ_2M);
-		}
-	}
-}
-
-/* This function open-codes setup_all_pgtables() so that we can
- * insert additional mappings *before* turning on the MMU.
- */
-void enable_caches(void)
-{
-	u64 tlb_addr = gd->arch.tlb_addr;
-	u64 tlb_size = gd->arch.tlb_size;
-	u64 pt_size;
-	ulong carveout_start;
-
-	gd->arch.tlb_fillptr = tlb_addr;
-
-	build_mem_map();
-
-	icache_enable();
-
-	/* Create normal system page tables */
-	setup_pgtables();
-
-	pt_size = (uintptr_t)gd->arch.tlb_fillptr -
-		  (uintptr_t)gd->arch.tlb_addr;
-	debug("Primary pagetable size: %lluKiB\n", pt_size / 1024);
-
-	/* Create emergency page tables */
-	gd->arch.tlb_size -= pt_size;
-	gd->arch.tlb_addr = gd->arch.tlb_fillptr;
-	setup_pgtables();
-	gd->arch.tlb_emerg = gd->arch.tlb_addr;
-	gd->arch.tlb_addr = tlb_addr;
-	gd->arch.tlb_size = tlb_size;
-
-	/* We do the carveouts only for QCS404, for now. */
-	if (fdt_node_check_compatible(gd->fdt_blob, 0, "qcom,qcs404") == 0) {
-		carveout_start = get_timer(0);
-		/* Takes ~20-50ms on SDM845 */
-		carve_out_reserved_memory();
-		debug("carveout time: %lums\n", get_timer(carveout_start));
-	}
-	dcache_enable();
-}
diff --git a/arch/arm/mach-snapdragon/board_common.c b/arch/arm/mach-snapdragon/board_common.c
new file mode 100644
index 00000000000..f6daeb6edf4
--- /dev/null
+++ b/arch/arm/mach-snapdragon/board_common.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Common initialisation for Qualcomm Snapdragon boards.
+ *
+ * Copyright (c) 2024 Linaro Ltd.
+ * Author: Casey Connolly <casey.connolly@linaro.org>
+ */
+
+#define LOG_CATEGORY LOGC_BOARD
+#define pr_fmt(fmt) "QCOM: " fmt
+
+#include <dm/device.h>
+#include <dm/pinctrl.h>
+#include <dm/uclass-internal.h>
+#include <dm/read.h>
+#include <usb.h>
+
+#include "qcom-priv.h"
+
+/*
+ * Some Qualcomm boards require GPIO configuration when switching USB modes.
+ * Support setting this configuration via pinctrl state.
+ */
+int board_usb_init(int index, enum usb_init_type init)
+{
+	struct udevice *usb;
+	int ret = 0;
+
+	/* USB device */
+	ret = uclass_find_device_by_seq(UCLASS_USB, index, &usb);
+	if (ret) {
+		printf("Cannot find USB device\n");
+		return ret;
+	}
+
+	ret = dev_read_stringlist_search(usb, "pinctrl-names",
+					 "device");
+	/* No "device" pinctrl state, so just bail */
+	if (ret < 0)
+		return 0;
+
+	/* Select "default" or "device" pinctrl */
+	switch (init) {
+	case USB_INIT_HOST:
+		pinctrl_select_state(usb, "default");
+		break;
+	case USB_INIT_DEVICE:
+		pinctrl_select_state(usb, "device");
+		break;
+	default:
+		debug("Unknown usb_init_type %d\n", init);
+		break;
+	}
+
+	return 0;
+}
diff --git a/arch/arm/mach-snapdragon/board_spl.c b/arch/arm/mach-snapdragon/board_spl.c
new file mode 100644
index 00000000000..19260975063
--- /dev/null
+++ b/arch/arm/mach-snapdragon/board_spl.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Common SPL code for Qualcomm Snapdragon boards.
+ *
+ * Copyright (c) 2026 Michael Srba <Michael.Srba@seznam.cz>
+ */
+
+#include <hang.h>
+#include <spl.h>
+
+/* in SPL, we always use internal DT */
+int board_fdt_blob_setup(void **fdtp)
+{
+	return -EEXIST;
+}
+
+int board_init(void)
+{
+	return 0;
+}
+
+__weak void reset_cpu(void)
+{
+	/* This should currently not get called in non-error paths, so just hang */
+	printf("reset_cpu called, going to hang()\n");
+	hang();
+}
+
+u32 spl_boot_device(void)
+{
+	/* TODO: check boot reason to support UFS and sdcard */
+	u32 boot_device = BOOT_DEVICE_DFU;
+
+	return boot_device;
+}
diff --git a/arch/arm/mach-snapdragon/mem_map.c b/arch/arm/mach-snapdragon/mem_map.c
new file mode 100644
index 00000000000..70e3c1d1fcc
--- /dev/null
+++ b/arch/arm/mach-snapdragon/mem_map.c
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Common initialisation for Qualcomm Snapdragon boards.
+ *
+ * Copyright (c) 2024 Linaro Ltd.
+ * Author: Casey Connolly <casey.connolly@linaro.org>
+ */
+
+#define LOG_CATEGORY LOGC_BOARD
+#define pr_fmt(fmt) "QCOM: " fmt
+
+#include <asm/armv8/mmu.h>
+#include <asm/global_data.h>
+#include <asm/system.h>
+#include <asm-generic/unaligned.h>
+#include <cpu_func.h>
+#include <fdt_support.h>
+#include <linux/errno.h>
+#include <linux/sizes.h>
+#include <sort.h>
+#include <time.h>
+
+#include "qcom-priv.h"
+
+DECLARE_GLOBAL_DATA_PTR;
+
+static struct mm_region rbx_mem_map[CONFIG_NR_DRAM_BANKS + 2] = { { 0 } };
+
+struct mm_region *mem_map = rbx_mem_map;
+
+static struct {
+	phys_addr_t start;
+	phys_size_t size;
+} prevbl_ddr_banks[CONFIG_NR_DRAM_BANKS] __section(".data") = { 0 };
+
+int dram_init(void)
+{
+	/*
+	 * gd->ram_base / ram_size have been setup already
+	 * in qcom_parse_memory().
+	 */
+	return 0;
+}
+
+static int ddr_bank_cmp(const void *v1, const void *v2)
+{
+	const struct {
+		phys_addr_t start;
+		phys_size_t size;
+	} *res1 = v1, *res2 = v2;
+
+	if (!res1->size)
+		return 1;
+	if (!res2->size)
+		return -1;
+
+	return (res1->start >> 24) - (res2->start >> 24);
+}
+
+/* This has to be done post-relocation since gd->bd isn't preserved */
+static void qcom_configure_bi_dram(void)
+{
+	int i;
+
+	for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
+		gd->bd->bi_dram[i].start = prevbl_ddr_banks[i].start;
+		gd->bd->bi_dram[i].size = prevbl_ddr_banks[i].size;
+	}
+}
+
+int dram_init_banksize(void)
+{
+	qcom_configure_bi_dram();
+
+	return 0;
+}
+
+/**
+ * The generic memory parsing code in U-Boot lacks a few things that we
+ * need on Qualcomm:
+ *
+ * 1. It sets gd->ram_size and gd->ram_base to represent a single memory block
+ * 2. setup_dest_addr() later relocates U-Boot to ram_base + ram_size, the end
+ *    of that first memory block.
+ *
+ * This results in all memory beyond U-Boot being unusable in Linux when booting
+ * with EFI.
+ *
+ * Since the ranges in the memory node may be out of order, the only way for us
+ * to correctly determine the relocation address for U-Boot is to parse all
+ * memory regions and find the highest valid address.
+ *
+ * We can't use fdtdec_setup_memory_banksize() since it stores the result in
+ * gd->bd, which is not yet allocated.
+ *
+ * @fdt: FDT blob to parse /memory node from
+ *
+ * Return: 0 on success or -ENODATA if /memory node is missing or incomplete
+ */
+int qcom_parse_memory(const void *fdt)
+{
+	int offset;
+	const fdt64_t *memory;
+	int memsize;
+	phys_addr_t ram_end = 0;
+	int i, j, banks;
+
+	offset = fdt_path_offset(fdt, "/memory");
+	if (offset < 0)
+		return -ENODATA;
+
+	memory = fdt_getprop(fdt, offset, "reg", &memsize);
+	if (!memory)
+		return -ENODATA;
+
+	banks = min(memsize / (2 * sizeof(u64)), (ulong)CONFIG_NR_DRAM_BANKS);
+
+	if (memsize / sizeof(u64) > CONFIG_NR_DRAM_BANKS * 2)
+		log_err("Provided more than the max of %d memory banks\n", CONFIG_NR_DRAM_BANKS);
+
+	if (banks > CONFIG_NR_DRAM_BANKS)
+		log_err("Provided more memory banks than we can handle\n");
+
+	for (i = 0, j = 0; i < banks * 2; i += 2, j++) {
+		prevbl_ddr_banks[j].start = get_unaligned_be64(&memory[i]);
+		prevbl_ddr_banks[j].size = get_unaligned_be64(&memory[i + 1]);
+		if (!prevbl_ddr_banks[j].size) {
+			j--;
+			continue;
+		}
+		ram_end = max(ram_end, prevbl_ddr_banks[j].start + prevbl_ddr_banks[j].size);
+	}
+
+	if (!banks || !prevbl_ddr_banks[0].size)
+		return -ENODATA;
+
+	/* Sort our RAM banks -_- */
+	qsort(prevbl_ddr_banks, banks, sizeof(prevbl_ddr_banks[0]), ddr_bank_cmp);
+
+	gd->ram_base = prevbl_ddr_banks[0].start;
+	gd->ram_size = ram_end - gd->ram_base;
+
+	return 0;
+}
+
+static void build_mem_map(void)
+{
+	int i, j;
+
+	/*
+	 * Ensure the peripheral block is sized to correctly cover the address range
+	 * up to the first memory bank.
+	 * Don't map the first page to ensure that we actually trigger an abort on a
+	 * null pointer access rather than just hanging.
+	 * FIXME: we should probably split this into more precise regions
+	 */
+	mem_map[0].phys = 0x1000;
+	mem_map[0].virt = mem_map[0].phys;
+	mem_map[0].size = gd->bd->bi_dram[0].start - mem_map[0].phys;
+	mem_map[0].attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+			 PTE_BLOCK_NON_SHARE |
+			 PTE_BLOCK_PXN | PTE_BLOCK_UXN;
+
+	for (i = 1, j = 0; i < ARRAY_SIZE(rbx_mem_map) - 1 && gd->bd->bi_dram[j].size; i++, j++) {
+		mem_map[i].phys = gd->bd->bi_dram[j].start;
+		mem_map[i].virt = mem_map[i].phys;
+		mem_map[i].size = gd->bd->bi_dram[j].size;
+		mem_map[i].attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | \
+				   PTE_BLOCK_INNER_SHARE;
+	}
+
+	mem_map[i].phys = UINT64_MAX;
+	mem_map[i].size = 0;
+
+#ifdef DEBUG
+	debug("Configured memory map:\n");
+	for (i = 0; mem_map[i].size; i++)
+		debug("  0x%016llx - 0x%016llx: entry %d\n",
+		      mem_map[i].phys, mem_map[i].phys + mem_map[i].size, i);
+#endif
+}
+
+u64 get_page_table_size(void)
+{
+	return SZ_1M;
+}
+
+static int fdt_cmp_res(const void *v1, const void *v2)
+{
+	const struct fdt_resource *res1 = v1, *res2 = v2;
+
+	return res1->start - res2->start;
+}
+
+#define N_RESERVED_REGIONS 32
+
+/* Mark all no-map regions as PTE_TYPE_FAULT to prevent speculative access.
+ * On some platforms this is enough to trigger a security violation and trap
+ * to EL3.
+ */
+static void carve_out_reserved_memory(void)
+{
+	static struct fdt_resource res[N_RESERVED_REGIONS] = { 0 };
+	int parent, rmem, count, i = 0;
+	phys_addr_t start;
+	size_t size;
+
+	/* Some reserved nodes must be carved out, as the cache-prefetcher may otherwise
+	 * attempt to access them, causing a security exception.
+	 */
+	parent = fdt_path_offset(gd->fdt_blob, "/reserved-memory");
+	if (parent <= 0) {
+		log_err("No reserved memory regions found\n");
+		return;
+	}
+
+	/* Collect the reserved memory regions */
+	fdt_for_each_subnode(rmem, gd->fdt_blob, parent) {
+		const fdt32_t *ptr;
+		int len;
+		if (!fdt_getprop(gd->fdt_blob, rmem, "no-map", NULL))
+			continue;
+
+		if (i == N_RESERVED_REGIONS) {
+			log_err("Too many reserved regions!\n");
+			break;
+		}
+
+		/* Read the address and size out from the reg property. Doing this "properly" with
+		 * fdt_get_resource() takes ~70ms on SDM845, but open-coding the happy path here
+		 * takes <1ms... Oh the woes of no dcache.
+		 */
+		ptr = fdt_getprop(gd->fdt_blob, rmem, "reg", &len);
+		if (ptr) {
+			/* Qualcomm devices use #address/size-cells = <2> but all reserved regions are within
+			 * the 32-bit address space. So we can cheat here for speed.
+			 */
+			res[i].start = fdt32_to_cpu(ptr[1]);
+			res[i].end = res[i].start + fdt32_to_cpu(ptr[3]);
+			i++;
+		}
+	}
+
+	/* Sort the reserved memory regions by address */
+	count = i;
+	qsort(res, count, sizeof(struct fdt_resource), fdt_cmp_res);
+
+	/* Now set the right attributes for them. Often a lot of the regions are tightly packed together
+	 * so we can optimise the number of calls to mmu_change_region_attr() by combining adjacent
+	 * regions.
+	 */
+	start = ALIGN_DOWN(res[0].start, SZ_2M);
+	size = ALIGN(res[0].end - start, SZ_2M);
+	for (i = 1; i <= count; i++) {
+		/* We ideally want to 2M align everything for more efficient pagetables, but we must avoid
+		 * overwriting reserved memory regions which shouldn't be mapped as FAULT (like those with
+		 * compatible properties).
+		 * If within 2M of the previous region, bump the size to include this region. Otherwise
+		 * start a new region.
+		 */
+		if (i == count || start + size < res[i].start - SZ_2M) {
+			debug("  0x%016llx - 0x%016llx: reserved\n",
+			      start, start + size);
+			mmu_change_region_attr(start, size, PTE_TYPE_FAULT);
+			/* If this is the final region then quit here before we index
+			 * out of bounds...
+			 */
+			if (i == count)
+				break;
+			start = ALIGN_DOWN(res[i].start, SZ_2M);
+			size = ALIGN(res[i].end - start, SZ_2M);
+		} else {
+			/* Bump size if this region is immediately after the previous one */
+			size = ALIGN(res[i].end - start, SZ_2M);
+		}
+	}
+}
+
+/* This function open-codes setup_all_pgtables() so that we can
+ * insert additional mappings *before* turning on the MMU.
+ */
+void enable_caches(void)
+{
+	u64 tlb_addr = gd->arch.tlb_addr;
+	u64 tlb_size = gd->arch.tlb_size;
+	u64 pt_size;
+	ulong carveout_start;
+
+	gd->arch.tlb_fillptr = tlb_addr;
+
+	build_mem_map();
+
+	icache_enable();
+
+	/* Create normal system page tables */
+	setup_pgtables();
+
+	pt_size = (uintptr_t)gd->arch.tlb_fillptr -
+		  (uintptr_t)gd->arch.tlb_addr;
+	debug("Primary pagetable size: %lluKiB\n", pt_size / 1024);
+
+	/* Create emergency page tables */
+	gd->arch.tlb_size -= pt_size;
+	gd->arch.tlb_addr = gd->arch.tlb_fillptr;
+	setup_pgtables();
+	gd->arch.tlb_emerg = gd->arch.tlb_addr;
+	gd->arch.tlb_addr = tlb_addr;
+	gd->arch.tlb_size = tlb_size;
+
+	/* We do the carveouts only for QCS404, for now. */
+	if (fdt_node_check_compatible(gd->fdt_blob, 0, "qcom,qcs404") == 0) {
+		carveout_start = get_timer(0);
+		/* Takes ~20-50ms on SDM845 */
+		carve_out_reserved_memory();
+		debug("carveout time: %lums\n", get_timer(carveout_start));
+	}
+	dcache_enable();
+}
diff --git a/arch/arm/mach-snapdragon/qcom-priv.h b/arch/arm/mach-snapdragon/qcom-priv.h
index b8bf574e8bb..b372465d125 100644
--- a/arch/arm/mach-snapdragon/qcom-priv.h
+++ b/arch/arm/mach-snapdragon/qcom-priv.h
@@ -20,7 +20,9 @@ extern enum qcom_boot_source qcom_boot_source;
 #if IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT)
 void qcom_configure_capsule_updates(void);
 #else
-void qcom_configure_capsule_updates(void) {}
+static inline void qcom_configure_capsule_updates(void) {}
 #endif /* EFI_HAVE_CAPSULE_SUPPORT */
 
+int qcom_parse_memory(const void *fdt);
+
 #endif /* __QCOM_PRIV_H__ */

-- 
2.53.0

[PATCH v3 10/11] qualcomm: add defconfig, env and docs for SPL on sdm845

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

The defconfig should in principle be board-agnostic. Environment
simply contains a dfu env specifying where to load u-boot proper
(TEXT_BASE - 64).

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 board/qualcomm/sdm845_spl.env |   2 +
 configs/sdm845_spl_defconfig  | 138 ++++++++++++++++++++++++++++++++++++++++++
 doc/board/qualcomm/index.rst  |   1 +
 doc/board/qualcomm/spl.rst    |  91 ++++++++++++++++++++++++++++
 4 files changed, 232 insertions(+)

diff --git a/board/qualcomm/sdm845_spl.env b/board/qualcomm/sdm845_spl.env
new file mode 100644
index 00000000000..2396d003b0c
--- /dev/null
+++ b/board/qualcomm/sdm845_spl.env
@@ -0,0 +1,2 @@
+# U-Boot proper text base - 64
+dfu_alt_info_ram=uboot.bin ram 0x1487FFC0 0x180000
diff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig
new file mode 100644
index 00000000000..04afe282a3a
--- /dev/null
+++ b/configs/sdm845_spl_defconfig
@@ -0,0 +1,138 @@
+CONFIG_ARM=y
+CONFIG_SKIP_LOWLEVEL_INIT=y
+CONFIG_COUNTER_FREQUENCY=19200000
+CONFIG_POSITION_INDEPENDENT=y
+# CONFIG_INIT_SP_RELATIVE is not set
+CONFIG_ARCH_SNAPDRAGON=y
+CONFIG_TEXT_BASE=0x14880000
+CONFIG_SYS_MALLOC_LEN=0x20000
+CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
+CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x146bffff
+CONFIG_SPL_SYS_MALLOC_F_LEN=0x20000
+CONFIG_SPL_SERIAL=y
+CONFIG_SPL_DRIVERS_MISC=y
+CONFIG_SPL_STACK=0x146bffff
+CONFIG_SPL_TEXT_BASE=0x1483f000
+CONFIG_SPL_BSS_START_ADDR=0x14680000
+CONFIG_SPL_BSS_MAX_SIZE=0x2000
+CONFIG_SYS_BOOTM_LEN=0x4000000
+CONFIG_SYS_LOAD_ADDR=0x0
+CONFIG_WATCHDOG_TIMEOUT_MSECS=60000
+CONFIG_TARGET_SDM845=y
+CONFIG_SPL=y
+CONFIG_SPL_PAYLOAD="u-boot.img"
+CONFIG_SKIP_RELOCATE=y
+# CONFIG_EFI_LOADER is not set
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_USE_PREBOOT=y
+CONFIG_CONSOLE_RECORD=y
+CONFIG_CONSOLE_RECORD_OUT_SIZE=0xA000
+CONFIG_CONSOLE_RECORD_OUT_SIZE_F=0xA000
+CONFIG_LOGLEVEL=9
+CONFIG_SYS_STDIO_DEREGISTER=y
+CONFIG_LOG_MAX_LEVEL=9
+CONFIG_SPL_LOG=y
+CONFIG_SPL_LOG_MAX_LEVEL=9
+# CONFIG_DISPLAY_CPUINFO is not set
+CONFIG_SPL_MAX_SIZE=0x7ffc0
+CONFIG_SPL_PAD_TO=0x0
+CONFIG_SPL_REMAKE_ELF_LDSCRIPT="arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds"
+CONFIG_SPL_DMA=y
+CONFIG_SPL_REMAKE_ELF=y
+CONFIG_SPL_DM_RESET=y
+CONFIG_SPL_POWER_DOMAIN=y
+CONFIG_BOOTM_NETBSD=y
+CONFIG_CMD_CLK=y
+CONFIG_CMD_DFU=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_UFS=y
+CONFIG_CMD_CAT=y
+CONFIG_CMD_RNG=y
+CONFIG_CMD_REGULATOR=y
+CONFIG_CMD_LOG=y
+CONFIG_OF_UPSTREAM_BUILD_VENDOR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="board/qualcomm/sdm845_spl.env"
+CONFIG_NET_RANDOM_ETHADDR=y
+# CONFIG_OFNODE_MULTI_TREE is not set
+CONFIG_BUTTON_QCOM_PMIC=y
+CONFIG_CLK=y
+CONFIG_SPL_CLK=y
+CONFIG_CLK_STUB=y
+CONFIG_SPL_CLK_STUB=y
+CONFIG_CLK_QCOM_SDM845=y
+CONFIG_DFU_MMC=y
+CONFIG_DFU_RAM=y
+CONFIG_DFU_SCSI=y
+CONFIG_SYS_DFU_DATA_BUF_SIZE=0x5000
+CONFIG_DMA=y
+CONFIG_DMA_CHANNELS=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_BUF_ADDR=0xdeadbeef
+CONFIG_MSM_GPIO=y
+CONFIG_QCOM_PMIC_GPIO=y
+CONFIG_DM_I2C=y
+CONFIG_SYS_I2C_QUP=y
+CONFIG_I2C_MUX=y
+CONFIG_IOMMU=y
+CONFIG_QCOM_HYP_SMMU=y
+CONFIG_MISC=y
+CONFIG_NVMEM=y
+CONFIG_I2C_EEPROM=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ADMA=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY=y
+CONFIG_SPL_PHY=y
+CONFIG_PHY_QCOM_QMP_UFS=y
+CONFIG_PHY_QCOM_QUSB2=y
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y
+CONFIG_PHY_QCOM_SNPS_EUSB2=y
+CONFIG_PHY_QCOM_USB_HS_28NM=y
+CONFIG_PHY_QCOM_USB_SS=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_QCOM_APQ8016=y
+CONFIG_PINCTRL_QCOM_APQ8096=y
+CONFIG_PINCTRL_QCOM_QCM2290=y
+CONFIG_PINCTRL_QCOM_QCS404=y
+CONFIG_PINCTRL_QCOM_SDM845=y
+CONFIG_PINCTRL_QCOM_SM6115=y
+CONFIG_PINCTRL_QCOM_SM8250=y
+CONFIG_PINCTRL_QCOM_SM8550=y
+CONFIG_PINCTRL_QCOM_SM8650=y
+CONFIG_PINCTRL_QCOM_X1E80100=y
+CONFIG_DM_PMIC=y
+CONFIG_PMIC_QCOM=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_QCOM_RPMH=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MSM=y
+CONFIG_SCSI=y
+CONFIG_MSM_SERIAL=y
+CONFIG_SOC_QCOM=y
+CONFIG_QCOM_COMMAND_DB=y
+CONFIG_QCOM_RPMH=y
+CONFIG_SPL_SPMI=y
+CONFIG_SPMI_MSM=y
+CONFIG_SYSINFO=y
+CONFIG_SYSINFO_SMBIOS=y
+CONFIG_SYSRESET_QCOM_PSHOLD=y
+CONFIG_USB=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_GENERIC=y
+CONFIG_SPL_USB_DWC3_GENERIC=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_VENDOR_NUM=0x0525
+CONFIG_USB_GADGET_PRODUCT_NUM=0xb4a4
+CONFIG_USB_ETHER=y
+CONFIG_USB_ETH_CDC=y
+CONFIG_SPL_DFU=y
+CONFIG_SPL_USB_SDP_SUPPORT=y
+CONFIG_UFS=y
+# CONFIG_SPL_USE_TINY_PRINTF is not set
+CONFIG_CIRCBUF=y
diff --git a/doc/board/qualcomm/index.rst b/doc/board/qualcomm/index.rst
index 3238a68e859..65e3e222f68 100644
--- a/doc/board/qualcomm/index.rst
+++ b/doc/board/qualcomm/index.rst
@@ -14,3 +14,4 @@ Qualcomm
    iq8
    phones
    rdp
+   spl
diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
new file mode 100644
index 00000000000..96f9cc6c0e8
--- /dev/null
+++ b/doc/board/qualcomm/spl.rst
@@ -0,0 +1,91 @@
+.. SPDX-License-Identifier: GPL-2.0+
+.. sectionauthor:: Michael Srba <Michael.Srba@seznam.cz>
+
+===================================
+Booting U-Boot SPL on Qualcomm SoCs
+===================================
+
+Overview
+--------
+The boot process on sdm845 (and some other Qualcomm SoCs) starts with the bootrom
+of the Application Processor, which executes XBL_SEC, which jumps to "OEM" code
+in EL1. Production devices are typically "fused", with a hash of the OEM's signing
+key burnt into one of the "QFUSE" banks on the SoC making it impossible to run
+custom bootloader code. As a result U-Boot SPL is only supported on unfused
+("secureboot off") devices. XBL_SEC is always signed by Qualcomm, and the fuses
+to disable turning off signature verification for it are always burnt at the
+factory, so replacing XBL_SEC is impossible without using JTAG. Of course JTAG
+is typically disabled on devices that have secure boot enabled, or at minimum
+greatly neutered.
+
+U-Boot SPL for Qualcomm platforms uses a custom linker script (per SoC) to build a bootable ELF.
+For sdm845 (and some other platforms) this has two sections, u-boot code and an embedded
+xbl_sec elf (signed by qualcomm). To boot on an unfused SoC, the elf additionally
+needs to have hash sections added, which can be accomplished with qtestsign.
+
+Currently, sdm845 is supported. You need a device with secure boot disabled
+(or with secure boot enabled if you enabled it yourself and have the private key,
+though for full security you'd also want to disable JTAG which will remove your ability
+to mess with the control flow in the bootrom (immutable) and in XBL_SEC (signed)).
+
+Building
+--------
+First, obtain an xbl_sec that includes the EL3 privilege escalation feature
+and place it at .output/xbl_sec.elf. You can extract it from an xbl elf.
+If you're unable to find one, you can also use JTAG/SWD to break at the SMC
+entry and use gdb to jump to the u-boot entry point in EL3.
+
+To build a bootable image, you need to use a defconfig specific to your SoC.
+This is because the ELF has to specify where in the address space to put u-boot SPL,
+and this may differ per SoC. There may be other SoC-dependent build time choices,
+though in principle those could be made at runtime.
+
+First run ``make sdm845_spl_defconfig``::
+
+	make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl sdm845_spl_defconfig
+
+Then compile u-boot and specify the dts for your board (technically nothing about the resulting
+SPL image should be board-specific, but there are no non-board-specific device trees in Linux)::
+
+	make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl
+
+Finally, use ``qtestsign`` to add the hash segments required by PBL::
+
+	qtestsign -v 5 -o .output/spl/u-boot-spl_signed.elf prog .output/spl/u-boot-spl.elf
+
+Running
+-------
+Currently, U-Boot SPL for qualcomm platforms expects to be booted via EDL::
+
+	edl.py --loader=$PWD/.output/spl/u-boot-spl_signed.elf
+
+SPL will then launch the DFU gadget and wait for you to upload u-boot proper::
+
+	dfu-util -RD .output/u-boot.img
+
+u-boot proper will then likely crash, since SPL currently doesn't init DRAM on qualcomm platforms
+and u-boot proper currently doesn't support running from SRAM. The latter should be an easy fix.
+
+Notes on memory map
+-------------------
+| There are various banks of SRAM on a Qualcomm SoC that we can use prior to DRAM init.
+| For example:
+| msm8916 - 512K L2-as-TCM (at ``0x08000000``), 16K OCIMEM (at ``0x08600000``)
+| msm8998 - 1M L2-as-TCM (at ``0x14000000``), 256K OCIMEM (at ``0x14680000``)
+| sdm845 - 1.5M BOOT_IMEM (at ``0x14800000``), 256K OCIMEM (at ``0x14680000``)
+
+There's also RPM code/data RAM and hexagon TCMs, but unless we want to boot dram-less Linux
+we can probably safely ignore those. On msm8916 they may come in handy though.
+
+sdm845 can also have 8M LLCC-as-TCM in theory, but this appears to be broken.
+L2-as-TCM is no longer present.
+
+Since a limited amount of not necessarily continuous SRAM is available, we need to manually
+specify where .text, .bss, the malloc pool and the stack go. The Kconfig contains reasonable
+defaults per SoC.
+
+On sdm845, we by default put U-Boot SPL in BOOT_IMEM, with .bss, malloc pool and the stack
+filling OCIMEM. We can also fit U-Boot proper in BOOT_IMEM, for dram-less DFU or peek/poke
+with a shell. To that end, we set ``CONFIG_TEXT_BASE`` at 512K into BOOT_IMEM, and set
+``CONFIG_SPL_MAX_SIZE`` to 512K - 64. We also configure dfu to load U-Boot proper
+to ``CONFIG_TEXT_BASE`` - 64. (64 bytes is the size of u-boot legacy header)

-- 
2.53.0

[PATCH v3 11/11] dts: add u-boot specific sdm845 .dtsi and a .dtsi for shift-axolotl

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

The board .dtsi just includes the SoC-specific .dtsi, which
adds bootph-all markings to upstream dts nodes which are
needed in SPL.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi |  2 ++
 arch/arm/dts/sdm845-u-boot.dtsi               | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
new file mode 100644
index 00000000000..d41210ab23a
--- /dev/null
+++ b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "sdm845-u-boot.dtsi"
diff --git a/arch/arm/dts/sdm845-u-boot.dtsi b/arch/arm/dts/sdm845-u-boot.dtsi
new file mode 100644
index 00000000000..b029264555b
--- /dev/null
+++ b/arch/arm/dts/sdm845-u-boot.dtsi
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0
+&gcc {
+	bootph-all;
+};
+
+&usb_1_hsphy {
+	bootph-all;
+};
+
+&usb_1_dwc3 {
+	bootph-all;
+};
+
+&rpmhcc {
+	bootph-all;
+};

-- 
2.53.0

Re: [PATCH v3 01/11] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3111 bytes --]

On Tue, Apr 21, 2026 at 09:43:44PM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Some platforms (e.g. least Qualcomm), use the ELF format in creative
> ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script
> specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path
> as the default).
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
>  Makefile           | 10 ++++++++--
>  common/spl/Kconfig | 10 ++++++++++
>  2 files changed, 18 insertions(+), 2 deletions(-)
> 
> diff --git a/Makefile b/Makefile
> index 8af18668b0f..50893d5689e 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -2004,16 +2004,22 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
>  quiet_cmd_u-boot-spl-elf ?= LD      $@
>  	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
>  	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
> -	-T u-boot-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> +	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
>  	-Ttext=$(CONFIG_SPL_TEXT_BASE)
> -spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
> +spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
>  	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
>  	$(call if_changed,u-boot-spl-elf)
>  
> +SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
> +
> +spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
> +	$(call if_changed_dep,cpp_lds)
> +
>  u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
>  	$(call if_changed_dep,cpp_lds)
>  
>  PHONY += prepare0
> +
>  # MediaTek's ARM-based u-boot needs a header to contains its load address
>  # which is parsed by the BootROM.
>  # If the SPL build is enabled, the header will be added to the spl binary,
> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
> index d1a85f50209..1d279a2bb05 100644
> --- a/common/spl/Kconfig
> +++ b/common/spl/Kconfig
> @@ -247,6 +247,16 @@ config SPL_HANDOFF
>  	  proper. Also SPL can receive information from TPL in the same place
>  	  if that is enabled.
>  
> +config SPL_REMAKE_ELF_LDSCRIPT
> +	string "Linker script for SPL ELF"
> +	depends on SPL_REMAKE_ELF
> +	default "arch/$(ARCH)/u-boot-spl-elf.lds"
> +	help
> +	  This allows specifying a linker script that will act on u-boot-spl.bin.
> +	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
> +	  including in the bootrom. For such platforms, you can change the default
> +	  linker script to a platform-specific one.
> +
>  config SPL_LDSCRIPT
>  	string "Linker script for the SPL stage"
>  	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV

Did what I said about cleaning up the remake elf Makefile logic itself
get lost somewhere? Sorry. To repeat, we should have a remake elf
function, make use of $(PHASE_) and have Kconfig entries for both
REMAKE_ELF_LDSCRIPT and SPL_REMAKE_ELF_SCRIPT (so we can use $(PHASE_)
again to get the right one. Thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v3 03/11] drivers: allow clk_stub and spmi in SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1292 bytes --]

On Tue, Apr 21, 2026 at 09:43:46PM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Only Makefile and Kconfig changes necessary.
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
>  drivers/Makefile      |  2 +-
>  drivers/clk/Kconfig   |  7 +++++++
>  drivers/spmi/Kconfig  | 13 +++++++++++++
>  drivers/spmi/Makefile |  4 ++--
>  4 files changed, 23 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/Makefile b/drivers/Makefile
> index 43d0ba33281..477718ce89a 100644
> --- a/drivers/Makefile
> +++ b/drivers/Makefile
> @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
>  obj-$(CONFIG_$(PHASE_)RTC) += rtc/
>  obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
>  obj-$(CONFIG_$(PHASE_)SPI) += spi/
> +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
>  obj-$(CONFIG_$(PHASE_)TIMER) += timer/
>  obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
>  obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
> @@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
>  obj-y += rtc/
>  obj-y += scsi/
>  obj-y += sound/
> -obj-y += spmi/
>  obj-y += watchdog/
>  obj-$(CONFIG_QE) += qe/
>  obj-$(CONFIG_U_QE) += qe/

Code-wise this is fine. But this reminds me, did you run this whole
series through CI? Thanks.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v3 03/11] drivers: allow clk_stub and spmi in SPL

[Michael Srba]

Hi,

On 4/21/26 22:46, Tom Rini wrote:
> On Tue, Apr 21, 2026 at 09:43:46PM +0200, michael.srba@seznam.cz wrote:
>
>> From: Michael Srba <Michael.Srba@seznam.cz>
>>
>> Only Makefile and Kconfig changes necessary.
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> ---
>>   drivers/Makefile      |  2 +-
>>   drivers/clk/Kconfig   |  7 +++++++
>>   drivers/spmi/Kconfig  | 13 +++++++++++++
>>   drivers/spmi/Makefile |  4 ++--
>>   4 files changed, 23 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/Makefile b/drivers/Makefile
>> index 43d0ba33281..477718ce89a 100644
>> --- a/drivers/Makefile
>> +++ b/drivers/Makefile
>> @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
>>   obj-$(CONFIG_$(PHASE_)RTC) += rtc/
>>   obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
>>   obj-$(CONFIG_$(PHASE_)SPI) += spi/
>> +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
>>   obj-$(CONFIG_$(PHASE_)TIMER) += timer/
>>   obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
>>   obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
>> @@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
>>   obj-y += rtc/
>>   obj-y += scsi/
>>   obj-y += sound/
>> -obj-y += spmi/
>>   obj-y += watchdog/
>>   obj-$(CONFIG_QE) += qe/
>>   obj-$(CONFIG_U_QE) += qe/
> Code-wise this is fine. But this reminds me, did you run this whole
> series through CI? Thanks.
I tried, but on gitlab.org it just didn't work at all, and locally it only ran partially
before running out of disk space. I tried making an account
on https://source.denx.de but the anti-spam measure is blocking me
and I'm waiting to see if that gets resolved (since it's not clear to me if
the unblocking is supposed to be automatic or not, and if it's manual
then just waiting is probably all I need to do) (fwiw not sure if that
instance allows random users to run the CI, the docs don't really
say *where* I'm supposed to run it, but I figured it was worth a try)

Before it ran out of space, it successfully built the documentation,
so I hoped that would be good enough (since I don't really see any
other way for me to run the CI at this time)

For what it's worth, checkpatch reports some issues with boot0.h, but
I strongly suspect that's because it assumes it's C code rather than
assembly.
>

Re: [PATCH v3 01/11] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Michael Srba]

Hi,

On 4/21/26 22:45, Tom Rini wrote:
> On Tue, Apr 21, 2026 at 09:43:44PM +0200, michael.srba@seznam.cz wrote:
>
>> From: Michael Srba <Michael.Srba@seznam.cz>
>>
>> Some platforms (e.g. least Qualcomm), use the ELF format in creative
>> ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script
>> specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path
>> as the default).
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> ---
>>   Makefile           | 10 ++++++++--
>>   common/spl/Kconfig | 10 ++++++++++
>>   2 files changed, 18 insertions(+), 2 deletions(-)
>>
>> diff --git a/Makefile b/Makefile
>> index 8af18668b0f..50893d5689e 100644
>> --- a/Makefile
>> +++ b/Makefile
>> @@ -2004,16 +2004,22 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
>>   quiet_cmd_u-boot-spl-elf ?= LD      $@
>>   	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
>>   	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
>> -	-T u-boot-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
>> +	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
>>   	-Ttext=$(CONFIG_SPL_TEXT_BASE)
>> -spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
>> +spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
>>   	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
>>   	$(call if_changed,u-boot-spl-elf)
>>   
>> +SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
>> +
>> +spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
>> +	$(call if_changed_dep,cpp_lds)
>> +
>>   u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
>>   	$(call if_changed_dep,cpp_lds)
>>   
>>   PHONY += prepare0
>> +
>>   # MediaTek's ARM-based u-boot needs a header to contains its load address
>>   # which is parsed by the BootROM.
>>   # If the SPL build is enabled, the header will be added to the spl binary,
>> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
>> index d1a85f50209..1d279a2bb05 100644
>> --- a/common/spl/Kconfig
>> +++ b/common/spl/Kconfig
>> @@ -247,6 +247,16 @@ config SPL_HANDOFF
>>   	  proper. Also SPL can receive information from TPL in the same place
>>   	  if that is enabled.
>>   
>> +config SPL_REMAKE_ELF_LDSCRIPT
>> +	string "Linker script for SPL ELF"
>> +	depends on SPL_REMAKE_ELF
>> +	default "arch/$(ARCH)/u-boot-spl-elf.lds"
>> +	help
>> +	  This allows specifying a linker script that will act on u-boot-spl.bin.
>> +	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
>> +	  including in the bootrom. For such platforms, you can change the default
>> +	  linker script to a platform-specific one.
>> +
>>   config SPL_LDSCRIPT
>>   	string "Linker script for the SPL stage"
>>   	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV
> Did what I said about cleaning up the remake elf Makefile logic itself
> get lost somewhere? Sorry. To repeat, we should have a remake elf
> function, make use of $(PHASE_) and have Kconfig entries for both
> REMAKE_ELF_LDSCRIPT and SPL_REMAKE_ELF_SCRIPT (so we can use $(PHASE_)
> again to get the right one. Thanks!
>
I guess I didn't quite get it, but now I understand.

Re: [PATCH v3 03/11] drivers: allow clk_stub and spmi in SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 2647 bytes --]

On Tue, Apr 21, 2026 at 11:05:58PM +0200, Michael Srba wrote:
> Hi,
> 
> On 4/21/26 22:46, Tom Rini wrote:
> > On Tue, Apr 21, 2026 at 09:43:46PM +0200, michael.srba@seznam.cz wrote:
> > 
> > > From: Michael Srba <Michael.Srba@seznam.cz>
> > > 
> > > Only Makefile and Kconfig changes necessary.
> > > 
> > > Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> > > ---
> > >   drivers/Makefile      |  2 +-
> > >   drivers/clk/Kconfig   |  7 +++++++
> > >   drivers/spmi/Kconfig  | 13 +++++++++++++
> > >   drivers/spmi/Makefile |  4 ++--
> > >   4 files changed, 23 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/drivers/Makefile b/drivers/Makefile
> > > index 43d0ba33281..477718ce89a 100644
> > > --- a/drivers/Makefile
> > > +++ b/drivers/Makefile
> > > @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
> > >   obj-$(CONFIG_$(PHASE_)RTC) += rtc/
> > >   obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
> > >   obj-$(CONFIG_$(PHASE_)SPI) += spi/
> > > +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
> > >   obj-$(CONFIG_$(PHASE_)TIMER) += timer/
> > >   obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
> > >   obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
> > > @@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
> > >   obj-y += rtc/
> > >   obj-y += scsi/
> > >   obj-y += sound/
> > > -obj-y += spmi/
> > >   obj-y += watchdog/
> > >   obj-$(CONFIG_QE) += qe/
> > >   obj-$(CONFIG_U_QE) += qe/
> > Code-wise this is fine. But this reminds me, did you run this whole
> > series through CI? Thanks.
> I tried, but on gitlab.org it just didn't work at all, and locally it only ran partially
> before running out of disk space. I tried making an account
> on https://source.denx.de but the anti-spam measure is blocking me
> and I'm waiting to see if that gets resolved (since it's not clear to me if
> the unblocking is supposed to be automatic or not, and if it's manual
> then just waiting is probably all I need to do) (fwiw not sure if that
> instance allows random users to run the CI, the docs don't really
> say *where* I'm supposed to run it, but I figured it was worth a try)

The thing with source.denx.de is that then you also need (manually) a
contributor tree, for CI (and user accounts are more for bug filing). We
have how to run CI via Azure documented here:
https://docs.u-boot.org/en/latest/develop/ci_testing.html

And my concern is changing "always traverse this directory" to "traverse
once CONFIG_SPMI is set" shouldn't cause a problem. But sometimes
there's platforms with unexpected (and invalid needing to be fixed)
configurations out there.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v3 06/11] mach-snapdragon: Kconfig: fix duplicate SYS_MALLOC_LEN

[Simon Glass]

On 2026-04-21T19:43:46, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: Kconfig: fix duplicate SYS_MALLOC_LEN
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/mach-snapdragon/Kconfig | 3 ---
>  1 file changed, 3 deletions(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

Re: [PATCH v3 07/11] mach-snapdragon: Kconfig: changes / additions to support SPL

[Simon Glass]

Hi Michael,

On 2026-04-21T19:43:46, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: Kconfig: changes / additions to support SPL
>
> An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
> This will select reasonable defaults and enable per-SoC linker
> script (if required).
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/Kconfig                 | 33 ++++++++++++++++++++++++++++++++-
>  arch/arm/mach-snapdragon/Kconfig | 31 ++++++++++++++++++++++++++++---
>  2 files changed, 60 insertions(+), 4 deletions(-)

> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> @@ -42,4 +39,32 @@ config SYS_CONFIG_NAME
> +config TARGET_SDM845
> +     bool "SPL targeting the sdm845 SoC"
> +     help
> +       Select this if you are bulding u-boot SPL for sdm845.

Typo: 'bulding' should be 'building'.

> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> @@ -42,4 +39,32 @@ config SYS_CONFIG_NAME
> +choice
> +     prompt "Qualcomm SoC select"
> +     default TARGET_NONE if !SPL
> +     help
> +       While U-Boot on Qualcomm platforms doesn't generally need compile-time
> +       adjustment based on the target SoC, there are a few exceptions to this.
> +       Currently this concerns boot0.h discrimination.
> +
> +config TARGET_NONE
> +     bool "Generic build"

The commit message says 'e.g. SPL_TARGET_SDM845' but the actual config
symbol is TARGET_SDM845. Please fix the commit message.

> diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
> @@ -1124,6 +1124,7 @@ config ARCH_SNAPDRAGON
> +     select SPL_SPMI_MSM if SPL

SPL_SPMI_MSM depends on SPL_SPMI (from patch 3), but SPL_SPMI is not
selected here. It might be cleaner to also explicitly select SPL_SPMI
if SPL

Regards,
Simon

Re: [PATCH v3 10/11] qualcomm: add defconfig, env and docs for SPL on sdm845

[Simon Glass]

Hi Michael,

On 2026-04-21T19:43:46, Michael Srba <michael.srba@seznam.cz> wrote:
> qualcomm: add defconfig, env and docs for SPL on sdm845
>
> The defconfig should in principle be board-agnostic. Environment
> simply contains a dfu env specifying where to load u-boot proper
> (TEXT_BASE - 64).
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> board/qualcomm/sdm845_spl.env |   2 +
>  configs/sdm845_spl_defconfig  | 138 ++++++++++++++++++++++++++++++++++++++++++
>  doc/board/qualcomm/index.rst  |   1 +
>  doc/board/qualcomm/spl.rst    |  91 ++++++++++++++++++++++++++++
>  4 files changed, 232 insertions(+), 4 deletions(-)

> diff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig
> @@ -0,0 +1,138 @@
> +CONFIG_BOOTM_NETBSD=y

> diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
> @@ -0,0 +1,91 @@
> +xbl_sec elf (signed by qualcomm). To boot on an unfused SoC, the elf additionally

Please capitalise 'Qualcomm' (also elsewhere in this patch)

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

Re: [PATCH v3 01/11] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 4341 bytes --]

On Fri, Apr 24, 2026 at 02:14:42AM +0200, Michael Srba wrote:
> Hi,
> 
> On 4/21/26 22:45, Tom Rini wrote:
> > On Tue, Apr 21, 2026 at 09:43:44PM +0200, michael.srba@seznam.cz wrote:
> > 
> > > From: Michael Srba <Michael.Srba@seznam.cz>
> > > 
> > > Some platforms (e.g. least Qualcomm), use the ELF format in creative
> > > ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script
> > > specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path
> > > as the default).
> > > 
> > > Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> > > ---
> > >   Makefile           | 10 ++++++++--
> > >   common/spl/Kconfig | 10 ++++++++++
> > >   2 files changed, 18 insertions(+), 2 deletions(-)
> > > 
> > > diff --git a/Makefile b/Makefile
> > > index 8af18668b0f..50893d5689e 100644
> > > --- a/Makefile
> > > +++ b/Makefile
> > > @@ -2004,16 +2004,22 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
> > >   quiet_cmd_u-boot-spl-elf ?= LD      $@
> > >   	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
> > >   	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
> > > -	-T u-boot-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> > > +	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> > >   	-Ttext=$(CONFIG_SPL_TEXT_BASE)
> > > -spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
> > > +spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
> > >   	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
> > >   	$(call if_changed,u-boot-spl-elf)
> > > +SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
> > > +
> > > +spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
> > > +	$(call if_changed_dep,cpp_lds)
> > > +
> > >   u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
> > >   	$(call if_changed_dep,cpp_lds)
> > >   PHONY += prepare0
> > > +
> > >   # MediaTek's ARM-based u-boot needs a header to contains its load address
> > >   # which is parsed by the BootROM.
> > >   # If the SPL build is enabled, the header will be added to the spl binary,
> > > diff --git a/common/spl/Kconfig b/common/spl/Kconfig
> > > index d1a85f50209..1d279a2bb05 100644
> > > --- a/common/spl/Kconfig
> > > +++ b/common/spl/Kconfig
> > > @@ -247,6 +247,16 @@ config SPL_HANDOFF
> > >   	  proper. Also SPL can receive information from TPL in the same place
> > >   	  if that is enabled.
> > > +config SPL_REMAKE_ELF_LDSCRIPT
> > > +	string "Linker script for SPL ELF"
> > > +	depends on SPL_REMAKE_ELF
> > > +	default "arch/$(ARCH)/u-boot-spl-elf.lds"
> > > +	help
> > > +	  This allows specifying a linker script that will act on u-boot-spl.bin.
> > > +	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
> > > +	  including in the bootrom. For such platforms, you can change the default
> > > +	  linker script to a platform-specific one.
> > > +
> > >   config SPL_LDSCRIPT
> > >   	string "Linker script for the SPL stage"
> > >   	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV
> > Did what I said about cleaning up the remake elf Makefile logic itself
> > get lost somewhere? Sorry. To repeat, we should have a remake elf
> > function, make use of $(PHASE_) and have Kconfig entries for both
> > REMAKE_ELF_LDSCRIPT and SPL_REMAKE_ELF_SCRIPT (so we can use $(PHASE_)
> > again to get the right one. Thanks!
> > 
> Trying to figure this out, I feel like I must be missing something...
> It seems like $(PHASE_) is never going to be anything other than an empty
> string inside the main Makefile?
> While `libs-$(CONFIG_$(PHASE_)ALTERA_SDRAM) += drivers/ddr/altera/` would
> make me think otherwise, most of the contents of the toplevel Makefile
> strongly suggest that it's only ever executed once, rather than one time
> for each of u-boot proper, spl, tpl, vpl. I have tried to use $(PHASE_)
> anyway, but it really doesn't seem to work. Could you explain more
> specifically how I should do this?

I had thought this would work, yes. Does this mean the other cases of
$(PHASE_) in the top-level Makefile also aren't working? And, is there
some other Makefile where $(PHASE_) does indeed work, that we could move
this particular logic to?

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v3 01/11] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Michael Srba]

Hi,

On 4/24/26 18:19, Tom Rini wrote:
> On Fri, Apr 24, 2026 at 02:14:42AM +0200, Michael Srba wrote:
>> Hi,
>>
>> On 4/21/26 22:45, Tom Rini wrote:
>>> On Tue, Apr 21, 2026 at 09:43:44PM +0200, michael.srba@seznam.cz wrote:
>>>
>>>> From: Michael Srba <Michael.Srba@seznam.cz>
>>>>
>>>> Some platforms (e.g. least Qualcomm), use the ELF format in creative
>>>> ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script
>>>> specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path
>>>> as the default).
>>>>
>>>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>>>> ---
>>>>    Makefile           | 10 ++++++++--
>>>>    common/spl/Kconfig | 10 ++++++++++
>>>>    2 files changed, 18 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/Makefile b/Makefile
>>>> index 8af18668b0f..50893d5689e 100644
>>>> --- a/Makefile
>>>> +++ b/Makefile
>>>> @@ -2004,16 +2004,22 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
>>>>    quiet_cmd_u-boot-spl-elf ?= LD      $@
>>>>    	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
>>>>    	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
>>>> -	-T u-boot-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
>>>> +	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
>>>>    	-Ttext=$(CONFIG_SPL_TEXT_BASE)
>>>> -spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
>>>> +spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
>>>>    	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
>>>>    	$(call if_changed,u-boot-spl-elf)
>>>> +SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
>>>> +
>>>> +spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
>>>> +	$(call if_changed_dep,cpp_lds)
>>>> +
>>>>    u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
>>>>    	$(call if_changed_dep,cpp_lds)
>>>>    PHONY += prepare0
>>>> +
>>>>    # MediaTek's ARM-based u-boot needs a header to contains its load address
>>>>    # which is parsed by the BootROM.
>>>>    # If the SPL build is enabled, the header will be added to the spl binary,
>>>> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
>>>> index d1a85f50209..1d279a2bb05 100644
>>>> --- a/common/spl/Kconfig
>>>> +++ b/common/spl/Kconfig
>>>> @@ -247,6 +247,16 @@ config SPL_HANDOFF
>>>>    	  proper. Also SPL can receive information from TPL in the same place
>>>>    	  if that is enabled.
>>>> +config SPL_REMAKE_ELF_LDSCRIPT
>>>> +	string "Linker script for SPL ELF"
>>>> +	depends on SPL_REMAKE_ELF
>>>> +	default "arch/$(ARCH)/u-boot-spl-elf.lds"
>>>> +	help
>>>> +	  This allows specifying a linker script that will act on u-boot-spl.bin.
>>>> +	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
>>>> +	  including in the bootrom. For such platforms, you can change the default
>>>> +	  linker script to a platform-specific one.
>>>> +
>>>>    config SPL_LDSCRIPT
>>>>    	string "Linker script for the SPL stage"
>>>>    	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV
>>> Did what I said about cleaning up the remake elf Makefile logic itself
>>> get lost somewhere? Sorry. To repeat, we should have a remake elf
>>> function, make use of $(PHASE_) and have Kconfig entries for both
>>> REMAKE_ELF_LDSCRIPT and SPL_REMAKE_ELF_SCRIPT (so we can use $(PHASE_)
>>> again to get the right one. Thanks!
>>>
>> Trying to figure this out, I feel like I must be missing something...
>> It seems like $(PHASE_) is never going to be anything other than an empty
>> string inside the main Makefile?
>> While `libs-$(CONFIG_$(PHASE_)ALTERA_SDRAM) += drivers/ddr/altera/` would
>> make me think otherwise, most of the contents of the toplevel Makefile
>> strongly suggest that it's only ever executed once, rather than one time
>> for each of u-boot proper, spl, tpl, vpl. I have tried to use $(PHASE_)
>> anyway, but it really doesn't seem to work. Could you explain more
>> specifically how I should do this?
> I had thought this would work, yes. Does this mean the other cases of
> $(PHASE_) in the top-level Makefile also aren't working? And, is there
> some other Makefile where $(PHASE_) does indeed work, that we could move
> this particular logic to?
>
Yes, I'm pretty sure the other cases are also not working.
I don't see a way to do this "properly" with the current Makefile setup,
but obviously I don't know that much about it.
I think the cleanest way would be add a new Makefile, maybe
Makefile.foreachphase in scripts/ (or some shorter name), and have
the toplevel makefile do include magic to include it multiple times
with $(PHASE_) set (and probably stuff like $(phase) and/or $(BIN) too,
those currently don't exist at all but would be handy for obvious reasons).

In any case I would prefer if the current iteration could just go through
for now, since this looks like a non-trivial change that would better
be done by someone who spent more than two days trying to understand the
Makefile system.

Re: [PATCH v3 01/11] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 5694 bytes --]

On Fri, Apr 24, 2026 at 07:05:03PM +0200, Michael Srba wrote:
> Hi,
> 
> On 4/24/26 18:19, Tom Rini wrote:
> > On Fri, Apr 24, 2026 at 02:14:42AM +0200, Michael Srba wrote:
> > > Hi,
> > > 
> > > On 4/21/26 22:45, Tom Rini wrote:
> > > > On Tue, Apr 21, 2026 at 09:43:44PM +0200, michael.srba@seznam.cz wrote:
> > > > 
> > > > > From: Michael Srba <Michael.Srba@seznam.cz>
> > > > > 
> > > > > Some platforms (e.g. least Qualcomm), use the ELF format in creative
> > > > > ways, including in the bootrom. Make SPL_REMAKE_ELF use a linker script
> > > > > specified in SPL_REMAKE_ELF_LDSCRIPT (with the previously hardcoded path
> > > > > as the default).
> > > > > 
> > > > > Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> > > > > ---
> > > > >    Makefile           | 10 ++++++++--
> > > > >    common/spl/Kconfig | 10 ++++++++++
> > > > >    2 files changed, 18 insertions(+), 2 deletions(-)
> > > > > 
> > > > > diff --git a/Makefile b/Makefile
> > > > > index 8af18668b0f..50893d5689e 100644
> > > > > --- a/Makefile
> > > > > +++ b/Makefile
> > > > > @@ -2004,16 +2004,22 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
> > > > >    quiet_cmd_u-boot-spl-elf ?= LD      $@
> > > > >    	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
> > > > >    	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
> > > > > -	-T u-boot-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> > > > > +	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> > > > >    	-Ttext=$(CONFIG_SPL_TEXT_BASE)
> > > > > -spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
> > > > > +spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
> > > > >    	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
> > > > >    	$(call if_changed,u-boot-spl-elf)
> > > > > +SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
> > > > > +
> > > > > +spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
> > > > > +	$(call if_changed_dep,cpp_lds)
> > > > > +
> > > > >    u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
> > > > >    	$(call if_changed_dep,cpp_lds)
> > > > >    PHONY += prepare0
> > > > > +
> > > > >    # MediaTek's ARM-based u-boot needs a header to contains its load address
> > > > >    # which is parsed by the BootROM.
> > > > >    # If the SPL build is enabled, the header will be added to the spl binary,
> > > > > diff --git a/common/spl/Kconfig b/common/spl/Kconfig
> > > > > index d1a85f50209..1d279a2bb05 100644
> > > > > --- a/common/spl/Kconfig
> > > > > +++ b/common/spl/Kconfig
> > > > > @@ -247,6 +247,16 @@ config SPL_HANDOFF
> > > > >    	  proper. Also SPL can receive information from TPL in the same place
> > > > >    	  if that is enabled.
> > > > > +config SPL_REMAKE_ELF_LDSCRIPT
> > > > > +	string "Linker script for SPL ELF"
> > > > > +	depends on SPL_REMAKE_ELF
> > > > > +	default "arch/$(ARCH)/u-boot-spl-elf.lds"
> > > > > +	help
> > > > > +	  This allows specifying a linker script that will act on u-boot-spl.bin.
> > > > > +	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
> > > > > +	  including in the bootrom. For such platforms, you can change the default
> > > > > +	  linker script to a platform-specific one.
> > > > > +
> > > > >    config SPL_LDSCRIPT
> > > > >    	string "Linker script for the SPL stage"
> > > > >    	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV
> > > > Did what I said about cleaning up the remake elf Makefile logic itself
> > > > get lost somewhere? Sorry. To repeat, we should have a remake elf
> > > > function, make use of $(PHASE_) and have Kconfig entries for both
> > > > REMAKE_ELF_LDSCRIPT and SPL_REMAKE_ELF_SCRIPT (so we can use $(PHASE_)
> > > > again to get the right one. Thanks!
> > > > 
> > > Trying to figure this out, I feel like I must be missing something...
> > > It seems like $(PHASE_) is never going to be anything other than an empty
> > > string inside the main Makefile?
> > > While `libs-$(CONFIG_$(PHASE_)ALTERA_SDRAM) += drivers/ddr/altera/` would
> > > make me think otherwise, most of the contents of the toplevel Makefile
> > > strongly suggest that it's only ever executed once, rather than one time
> > > for each of u-boot proper, spl, tpl, vpl. I have tried to use $(PHASE_)
> > > anyway, but it really doesn't seem to work. Could you explain more
> > > specifically how I should do this?
> > I had thought this would work, yes. Does this mean the other cases of
> > $(PHASE_) in the top-level Makefile also aren't working? And, is there
> > some other Makefile where $(PHASE_) does indeed work, that we could move
> > this particular logic to?
> > 
> Yes, I'm pretty sure the other cases are also not working.
> I don't see a way to do this "properly" with the current Makefile setup,
> but obviously I don't know that much about it.
> I think the cleanest way would be add a new Makefile, maybe
> Makefile.foreachphase in scripts/ (or some shorter name), and have
> the toplevel makefile do include magic to include it multiple times
> with $(PHASE_) set (and probably stuff like $(phase) and/or $(BIN) too,
> those currently don't exist at all but would be handy for obvious reasons).
> 
> In any case I would prefer if the current iteration could just go through
> for now, since this looks like a non-trivial change that would better
> be done by someone who spent more than two days trying to understand the
> Makefile system.

Yes, thanks for looking in to this more. We can do this as a future
clean-up.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v3 03/11] drivers: allow clk_stub and spmi in SPL

[Michael Srba]

Hi,

On 4/21/26 23:10, Tom Rini wrote:
> On Tue, Apr 21, 2026 at 11:05:58PM +0200, Michael Srba wrote:
>> Hi,
>>
>> On 4/21/26 22:46, Tom Rini wrote:
>>> On Tue, Apr 21, 2026 at 09:43:46PM +0200, michael.srba@seznam.cz wrote:
>>>
>>>> From: Michael Srba <Michael.Srba@seznam.cz>
>>>>
>>>> Only Makefile and Kconfig changes necessary.
>>>>
>>>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>>>> ---
>>>>    drivers/Makefile      |  2 +-
>>>>    drivers/clk/Kconfig   |  7 +++++++
>>>>    drivers/spmi/Kconfig  | 13 +++++++++++++
>>>>    drivers/spmi/Makefile |  4 ++--
>>>>    4 files changed, 23 insertions(+), 3 deletions(-)
>>>>
>>>> diff --git a/drivers/Makefile b/drivers/Makefile
>>>> index 43d0ba33281..477718ce89a 100644
>>>> --- a/drivers/Makefile
>>>> +++ b/drivers/Makefile
>>>> @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
>>>>    obj-$(CONFIG_$(PHASE_)RTC) += rtc/
>>>>    obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
>>>>    obj-$(CONFIG_$(PHASE_)SPI) += spi/
>>>> +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
>>>>    obj-$(CONFIG_$(PHASE_)TIMER) += timer/
>>>>    obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
>>>>    obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
>>>> @@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
>>>>    obj-y += rtc/
>>>>    obj-y += scsi/
>>>>    obj-y += sound/
>>>> -obj-y += spmi/
>>>>    obj-y += watchdog/
>>>>    obj-$(CONFIG_QE) += qe/
>>>>    obj-$(CONFIG_U_QE) += qe/
>>> Code-wise this is fine. But this reminds me, did you run this whole
>>> series through CI? Thanks.
>> I tried, but on gitlab.org it just didn't work at all, and locally it only ran partially
>> before running out of disk space. I tried making an account
>> on https://source.denx.de but the anti-spam measure is blocking me
>> and I'm waiting to see if that gets resolved (since it's not clear to me if
>> the unblocking is supposed to be automatic or not, and if it's manual
>> then just waiting is probably all I need to do) (fwiw not sure if that
>> instance allows random users to run the CI, the docs don't really
>> say *where* I'm supposed to run it, but I figured it was worth a try)
> The thing with source.denx.de is that then you also need (manually) a
> contributor tree, for CI (and user accounts are more for bug filing). We
> have how to run CI via Azure documented here:
> https://docs.u-boot.org/en/latest/develop/ci_testing.html
>
> And my concern is changing "always traverse this directory" to "traverse
> once CONFIG_SPMI is set" shouldn't cause a problem. But sometimes
> there's platforms with unexpected (and invalid needing to be fixed)
> configurations out there.
>
I figured out the github workflow, quite straightforward in the end. There is only
one failing check, missing MAINTAINERS entry for the defconfig. Should I add
an entry in the same commit and put it under `u-boot-qcom@groups.io`?

Re: [PATCH v3 03/11] drivers: allow clk_stub and spmi in SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3303 bytes --]

On Sat, Apr 25, 2026 at 12:46:03AM +0200, Michael Srba wrote:
> Hi,
> 
> On 4/21/26 23:10, Tom Rini wrote:
> > On Tue, Apr 21, 2026 at 11:05:58PM +0200, Michael Srba wrote:
> > > Hi,
> > > 
> > > On 4/21/26 22:46, Tom Rini wrote:
> > > > On Tue, Apr 21, 2026 at 09:43:46PM +0200, michael.srba@seznam.cz wrote:
> > > > 
> > > > > From: Michael Srba <Michael.Srba@seznam.cz>
> > > > > 
> > > > > Only Makefile and Kconfig changes necessary.
> > > > > 
> > > > > Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> > > > > ---
> > > > >    drivers/Makefile      |  2 +-
> > > > >    drivers/clk/Kconfig   |  7 +++++++
> > > > >    drivers/spmi/Kconfig  | 13 +++++++++++++
> > > > >    drivers/spmi/Makefile |  4 ++--
> > > > >    4 files changed, 23 insertions(+), 3 deletions(-)
> > > > > 
> > > > > diff --git a/drivers/Makefile b/drivers/Makefile
> > > > > index 43d0ba33281..477718ce89a 100644
> > > > > --- a/drivers/Makefile
> > > > > +++ b/drivers/Makefile
> > > > > @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
> > > > >    obj-$(CONFIG_$(PHASE_)RTC) += rtc/
> > > > >    obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
> > > > >    obj-$(CONFIG_$(PHASE_)SPI) += spi/
> > > > > +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
> > > > >    obj-$(CONFIG_$(PHASE_)TIMER) += timer/
> > > > >    obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
> > > > >    obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
> > > > > @@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
> > > > >    obj-y += rtc/
> > > > >    obj-y += scsi/
> > > > >    obj-y += sound/
> > > > > -obj-y += spmi/
> > > > >    obj-y += watchdog/
> > > > >    obj-$(CONFIG_QE) += qe/
> > > > >    obj-$(CONFIG_U_QE) += qe/
> > > > Code-wise this is fine. But this reminds me, did you run this whole
> > > > series through CI? Thanks.
> > > I tried, but on gitlab.org it just didn't work at all, and locally it only ran partially
> > > before running out of disk space. I tried making an account
> > > on https://source.denx.de but the anti-spam measure is blocking me
> > > and I'm waiting to see if that gets resolved (since it's not clear to me if
> > > the unblocking is supposed to be automatic or not, and if it's manual
> > > then just waiting is probably all I need to do) (fwiw not sure if that
> > > instance allows random users to run the CI, the docs don't really
> > > say *where* I'm supposed to run it, but I figured it was worth a try)
> > The thing with source.denx.de is that then you also need (manually) a
> > contributor tree, for CI (and user accounts are more for bug filing). We
> > have how to run CI via Azure documented here:
> > https://docs.u-boot.org/en/latest/develop/ci_testing.html
> > 
> > And my concern is changing "always traverse this directory" to "traverse
> > once CONFIG_SPMI is set" shouldn't cause a problem. But sometimes
> > there's platforms with unexpected (and invalid needing to be fixed)
> > configurations out there.
> > 
> I figured out the github workflow, quite straightforward in the end. There is only
> one failing check, missing MAINTAINERS entry for the defconfig. Should I add
> an entry in the same commit and put it under `u-boot-qcom@groups.io`?

If that's who is going to maintain it, yes, thanks :)

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]