[PATCH v2 00/10] Add SPL support for Qualcomm platforms, starting with sdm845

[PATCH v2 00/10] Add SPL support for Qualcomm platforms, starting with sdm845

[michael.srba]

[ context ]

Different generations of Qualcomm SoCs have differences in the boot
process. msm8916 (and similar) are quite straightforward:
[EL3]bootrom->sbl1->tz->[EL2]hyp->[EL1]aboot->linux (omitting non-AP
cores). msm8998, sdm845, kodiak and simiar are a bit more involved:
[EL3]bootrom->xbl_sec->[EL1]xbl_loader->[EL3]tz->[EL2]hyp->[EL1]uefi
->ABL->linux. Newer platforms like hamoa are even more involved.

Currently, u-boot proper can run in place of Linux, in place
of aboot, or in place of hyp. The option to run in place
of Linux is necessary because >99% of OEMs do not consider
the sale of a device to an end user a transfer of ownership,
that is, they sell the device with a hash of their public key
pre-burnt in the fuses.

[ end of context ]

U-Boot SPL, as it will be built using the defconfig added in this series,
replaces xbl_loader. If support for msm8916 or a similar platform
is added, it would replace sbl1. This will obviously only work on
the <1% of devices whose manufacturers consider the sale a transfer
of ownership, and of course most SBCs.

Unfortunately, starting with (iirc) msm8998, and getting progressively
worse, Qualcomm no longer consider a sale of their SoC a transfer
of ownership either. While it's possible to execute your code
in EL3 using either jtag or a patched devcfg, the former is impractical
while the latter is irrelevant for the purposes of running u-boot SPL
since the devcfg is parsed by trustzone. (this of course only applies
to the <1% of the devices where the OEM didn't lock the device down
prior to sale)

Given the above, this series uses an unintended feature in old builds
of xbl_sec which allows us to elevate to EL3. We also check if we
happen to already be running in EL3, in which case we proceed normally.
This can be the case e.g if JTAG was used to jump to u-boot SPL in EL3,
which may be the only option on e.g. kodiak. (Running in EL1 is not
really viable, because xbl_sec+xbl_loader are effectively sbl1 split
in half and replacing only one doesn't make much sense)

For now, only usb dfu is supported to load the next stage. Since we
don't support ram initialization, the next stage will need to run from
SRAM too, which is currently not supported. Additional patches will
be needed to make that work, at which point it will be possible
to use u-boot as a ufs/emmc programmer with zero proprietary code
in the boot chain (sans bootrom and part of xbl_sec, but the latter and
technically even the former could be skipped with JTAG)

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
Changes in v2:
- fix spmi and of_live patches (missing help text, remove --, wording
  issues, drivers/spmi/Makefile), add bootstage_start()/bootstage_accum()
- fix conflict with upstream-added cmd_u-boot-spl-elf (and copy endianness
  handling), improve help text for SPL_REMAKE_ELF_LDSCRIPT
- split "mach-snapdragon: support building SPL" into smaller patches
- fix three SYS_MALLOC_LEN definitions; remove the conditional one, it was
  a leftover from related-but-separate effort to make u-boot proper work
  without dram
- s/#if CONFIG_SPL_TARGET_SDM845/#if defined(CONFIG_SPL_TARGET_SDM845)/
- fix "&rpmhcc: clock-controller" (probably accidental ctrl+z)
- change el3_ret_point to (el3_ret_point - _start); I'd swear when I was
  writing this I had to do it that way because for some bizzare reason
  el3_ret_point was relative and _start was absolute, but now I tested
  it again and they're both relative to the start of .text. (making _start
  0, but it's still cleaner this way)
- fix empty comment in el3_payload
- fix documentation style errors
- change KConfig as options as suggested (hardcode computed values, remove
  macro variables, move QCOM_SPL options under ARCH_SNAPDRAGON with
  SPL_BUILD conditionals; IMEM_START/END were dropped since they were
  a leftover from related-but-separate effort to make u-boot proper work
  without dram
- don't mess with SYS_SOC, it's clearly a bad idea; make the board .dtsi
  include sdm845-u-boot.dtsi
- split board.c and don't compile spl parts into u-boot proper and
  vice versa
- properly test clean build
- Link to v1: https://patch.msgid.link/20260404-qcom_spl-v1-0-9e6c2ac66587@seznam.cz

---
Michael Srba (10):
      Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
      of_live: support in SPL
      drivers: allow clk_stub and spmi in SPL
      mach-snapdragon: boot0.h: split out msm8916_boot0.h
      mach-snapdragon: add u-boot-spl-elf-sdm845.lds
      mach-snapdragon: Kconfig: changes / additions to support SPL
      mach-snapdragon: boot0.h: add sdm845_spl_boot0.h
      mach-snapdragon: add board-spl.c and split out common code
      qualcomm: add defconfig, env and docs for SPL on sdm845
      dts: add u-boot specific sdm845 .dtsi a .dtsi for shift-axolotl

 Makefile                                           |  28 ++
 arch/arm/Kconfig                                   |  31 +-
 arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi      |   2 +
 arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +
 arch/arm/mach-snapdragon/Kconfig                   |  44 ++-
 arch/arm/mach-snapdragon/Makefile                  |   8 +
 arch/arm/mach-snapdragon/board.c                   | 358 +--------------------
 arch/arm/mach-snapdragon/board_common.c            |  56 ++++
 arch/arm/mach-snapdragon/board_spl.c               |  35 ++
 arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 +---
 .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 ++++
 .../include/mach/sdm845_spl_boot0.h                | 120 +++++++
 arch/arm/mach-snapdragon/mem_map.c                 | 318 ++++++++++++++++++
 arch/arm/mach-snapdragon/qcom-priv.h               |   4 +-
 arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  25 ++
 board/qualcomm/sdm845_spl.env                      |   2 +
 common/spl/Kconfig                                 |   9 +
 common/spl/spl.c                                   |  11 +
 configs/sdm845_spl_defconfig                       | 131 ++++++++
 doc/board/qualcomm/index.rst                       |   1 +
 doc/board/qualcomm/spl.rst                         |  87 +++++
 drivers/Makefile                                   |   2 +-
 drivers/clk/Kconfig                                |   6 +
 drivers/spmi/Kconfig                               |   6 +
 drivers/spmi/Makefile                              |   2 +-
 dts/Kconfig                                        |   6 +
 lib/Makefile                                       |   2 +-
 27 files changed, 1013 insertions(+), 412 deletions(-)
---
base-commit: 93f84ee022a8401421cdaab84fe7d106d83fdb4a
change-id: 20260403-qcom_spl-0826843ba41c

Best regards,
--  
Michael Srba <Michael.Srba@seznam.cz>

[PATCH v2 01/10] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

On some platforms (at least Qualcomm), the bootrom expects an ELF file.
Since the contents of the ELF file are platform specific, add a config
option that allows specifying a linker script to use to produce the
ELF file.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 Makefile           | 28 ++++++++++++++++++++++++++++
 common/spl/Kconfig |  9 +++++++++
 2 files changed, 37 insertions(+)

diff --git a/Makefile b/Makefile
index 8af18668b0f..754ca4d67e2 100644
--- a/Makefile
+++ b/Makefile
@@ -1232,6 +1232,9 @@ INPUTS-$(CONFIG_SPL) += $(CONFIG_SPL_TARGET:"%"=%)
 endif
 INPUTS-$(CONFIG_REMAKE_ELF) += u-boot.elf
 INPUTS-$(CONFIG_SPL_REMAKE_ELF) += spl/u-boot-spl.elf
+ifneq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
+INPUTS-y += spl/u-boot-spl.elf
+endif
 INPUTS-$(CONFIG_EFI_APP) += u-boot-app.efi
 INPUTS-$(CONFIG_EFI_STUB) += u-boot-payload.efi
 
@@ -2001,6 +2004,8 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
 	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< u-boot-elf.o
 	$(call if_changed,u-boot-elf)
 
+ifeq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
+
 quiet_cmd_u-boot-spl-elf ?= LD      $@
 	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
 	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
@@ -2010,10 +2015,33 @@ spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
 	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
 	$(call if_changed,u-boot-spl-elf)
 
+endif
+
 u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
 	$(call if_changed_dep,cpp_lds)
 
 PHONY += prepare0
+
+ifeq ($(CONFIG_SPL),y)
+ifneq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
+
+SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
+
+spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
+	$(call if_changed_dep,cpp_lds)
+
+quiet_cmd_u-boot-spl-elf ?= LD      $@
+	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
+	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
+	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
+	-Ttext=$(CONFIG_SPL_TEXT_BASE) -z max-page-size=0x1000
+spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
+	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
+	$(call if_changed,u-boot-spl-elf)
+
+endif
+endif
+
 # MediaTek's ARM-based u-boot needs a header to contains its load address
 # which is parsed by the BootROM.
 # If the SPL build is enabled, the header will be added to the spl binary,
diff --git a/common/spl/Kconfig b/common/spl/Kconfig
index d1a85f50209..f8981cb4fe5 100644
--- a/common/spl/Kconfig
+++ b/common/spl/Kconfig
@@ -247,6 +247,15 @@ config SPL_HANDOFF
 	  proper. Also SPL can receive information from TPL in the same place
 	  if that is enabled.
 
+config SPL_REMAKE_ELF_LDSCRIPT
+	string "Linker script to run with u-boot-spl.bin as input"
+	depends on !SPL_REMAKE_ELF
+	help
+	  This allows specifying a linker script that will act on u-boot-spl.bin.
+	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
+	  including in the bootrom. Unlike SPL_REMAKE_ELF which uses a standard
+	  linker script, this allows specifying a platorm-specific one.
+
 config SPL_LDSCRIPT
 	string "Linker script for the SPL stage"
 	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV

-- 
2.53.0

Re: [PATCH v2 01/10] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
>
> On some platforms (at least Qualcomm), the bootrom expects an ELF file.
> Since the contents of the ELF file are platform specific, add a config
> option that allows specifying a linker script to use to produce the
> ELF file.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> Makefile           | 28 ++++++++++++++++++++++++++++
>  common/spl/Kconfig |  9 +++++++++
>  2 files changed, 37 insertions(+)

> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
> @@ -247,6 +247,15 @@ config SPL_HANDOFF
> +config SPL_REMAKE_ELF_LDSCRIPT
> +     string "Linker script to run with u-boot-spl.bin as input"
> +     depends on !SPL_REMAKE_ELF
> +     help
> +       This allows specifying a linker script that will act on u-boot-spl.bin.
> +       Some platforms (e.g Qualcomm) use the ELF format in creative ways,
> +       including in the bootrom. Unlike SPL_REMAKE_ELF which uses a standard
> +       linker script, this allows specifying a platorm-specific one.

Typo: platform-specific

> diff --git a/Makefile b/Makefile
> @@ -2010,10 +2015,33 @@ spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
> +quiet_cmd_u-boot-spl-elf ?= LD      $@
> +     cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
> +     $(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
> +     -T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> +     -Ttext=$(CONFIG_SPL_TEXT_BASE) -z max-page-size=0x1000

The -z max-page-size=0x1000 flag is only added to the new path. If
needed for correct ELF generation, perhaps add it to the existing
cmd_u-boot-spl-elf too? If it is Qualcomm-specific, please add a
comment explaining why.

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

Re: [PATCH v2 01/10] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3879 bytes --]

On Sat, Apr 11, 2026 at 02:00:06AM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> On some platforms (at least Qualcomm), the bootrom expects an ELF file.
> Since the contents of the ELF file are platform specific, add a config
> option that allows specifying a linker script to use to produce the
> ELF file.
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
>  Makefile           | 28 ++++++++++++++++++++++++++++
>  common/spl/Kconfig |  9 +++++++++
>  2 files changed, 37 insertions(+)
> 
> diff --git a/Makefile b/Makefile
> index 8af18668b0f..754ca4d67e2 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -1232,6 +1232,9 @@ INPUTS-$(CONFIG_SPL) += $(CONFIG_SPL_TARGET:"%"=%)
>  endif
>  INPUTS-$(CONFIG_REMAKE_ELF) += u-boot.elf
>  INPUTS-$(CONFIG_SPL_REMAKE_ELF) += spl/u-boot-spl.elf
> +ifneq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
> +INPUTS-y += spl/u-boot-spl.elf
> +endif
>  INPUTS-$(CONFIG_EFI_APP) += u-boot-app.efi
>  INPUTS-$(CONFIG_EFI_STUB) += u-boot-payload.efi
>  
> @@ -2001,6 +2004,8 @@ u-boot.elf: u-boot.bin u-boot-elf.lds FORCE
>  	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< u-boot-elf.o
>  	$(call if_changed,u-boot-elf)
>  
> +ifeq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
> +
>  quiet_cmd_u-boot-spl-elf ?= LD      $@
>  	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
>  	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
> @@ -2010,10 +2015,33 @@ spl/u-boot-spl.elf: spl/u-boot-spl.bin u-boot-elf.lds
>  	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
>  	$(call if_changed,u-boot-spl-elf)
>  
> +endif
> +
>  u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
>  	$(call if_changed_dep,cpp_lds)
>  
>  PHONY += prepare0
> +
> +ifeq ($(CONFIG_SPL),y)
> +ifneq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
> +
> +SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
> +
> +spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
> +	$(call if_changed_dep,cpp_lds)
> +
> +quiet_cmd_u-boot-spl-elf ?= LD      $@
> +	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
> +	$(if $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) \
> +	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> +	-Ttext=$(CONFIG_SPL_TEXT_BASE) -z max-page-size=0x1000
> +spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
> +	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
> +	$(call if_changed,u-boot-spl-elf)
> +
> +endif
> +endif
> +
>  # MediaTek's ARM-based u-boot needs a header to contains its load address
>  # which is parsed by the BootROM.
>  # If the SPL build is enabled, the header will be added to the spl binary,
> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
> index d1a85f50209..f8981cb4fe5 100644
> --- a/common/spl/Kconfig
> +++ b/common/spl/Kconfig
> @@ -247,6 +247,15 @@ config SPL_HANDOFF
>  	  proper. Also SPL can receive information from TPL in the same place
>  	  if that is enabled.
>  
> +config SPL_REMAKE_ELF_LDSCRIPT
> +	string "Linker script to run with u-boot-spl.bin as input"
> +	depends on !SPL_REMAKE_ELF
> +	help
> +	  This allows specifying a linker script that will act on u-boot-spl.bin.
> +	  Some platforms (e.g Qualcomm) use the ELF format in creative ways,
> +	  including in the bootrom. Unlike SPL_REMAKE_ELF which uses a standard
> +	  linker script, this allows specifying a platorm-specific one.

This is starting to get a little odd. I think we need a pre-requisite
series to cleanup the remake elf logic, so that:
- The lds used is configured in Kconfig (and the default is the current
  one everyone else uses).
  - If we can have different ones for full U-Boot, or SPL
- The Makefile has a broken out the logic for doing the relink itself.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[PATCH v2 02/10] of_live: support in SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 common/spl/spl.c | 11 +++++++++++
 dts/Kconfig      |  6 ++++++
 lib/Makefile     |  2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/common/spl/spl.c b/common/spl/spl.c
index 8256fa97862..179694a38cd 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -17,6 +17,7 @@
 #include <irq_func.h>
 #include <log.h>
 #include <mapmem.h>
+#include <of_live.h>
 #include <serial.h>
 #include <spl.h>
 #include <spl_load.h>
@@ -510,6 +511,16 @@ static int spl_common_init(bool setup_malloc)
 			return ret;
 		}
 	}
+	if (CONFIG_IS_ENABLED(OF_LIVE)) {
+		int ret;
+
+		bootstage_start(BOOTSTAGE_ID_ACCUM_OF_LIVE, "of_live");
+		ret = of_live_build(gd->fdt_blob,
+				    (struct device_node **)gd_of_root_ptr());
+		bootstage_accum(BOOTSTAGE_ID_ACCUM_OF_LIVE);
+		if (ret)
+			return ret;
+	}
 	if (CONFIG_IS_ENABLED(DM)) {
 		bootstage_start(BOOTSTAGE_ID_ACCUM_DM_SPL,
 				xpl_phase() == PHASE_TPL ? "dm tpl" : "dm_spl");
diff --git a/dts/Kconfig b/dts/Kconfig
index af8d30b45ab..b30bc5db5d1 100644
--- a/dts/Kconfig
+++ b/dts/Kconfig
@@ -86,6 +86,12 @@ config OF_LIVE
 	  enables a live tree which is available after relocation,
 	  and can be adjusted as needed.
 
+config SPL_OF_LIVE
+	bool "Enable use of a live tree in SPL"
+	depends on SPL_DM && SPL_OF_CONTROL
+	help
+	  This option enables a live tree in SPL.
+
 config OF_UPSTREAM
 	bool "Enable use of devicetree imported from Linux kernel release"
 	depends on !COMPILE_TEST
diff --git a/lib/Makefile b/lib/Makefile
index d0ffabc2b47..bbd540e9687 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -13,7 +13,6 @@ obj-$(CONFIG_FWU_MULTI_BANK_UPDATE) += fwu_updates/
 obj-$(CONFIG_LZMA) += lzma/
 obj-$(CONFIG_BZIP2) += bzip2/
 obj-$(CONFIG_FIT) += libfdt/
-obj-$(CONFIG_OF_LIVE) += of_live.o
 obj-$(CONFIG_CMD_DHRYSTONE) += dhry/
 obj-$(CONFIG_ARCH_AT91) += at91/
 obj-$(CONFIG_OPTEE_LIB) += optee/
@@ -55,6 +54,7 @@ obj-$(CONFIG_BITREVERSE) += bitrev.o
 obj-y += list_sort.o
 endif
 
+obj-$(CONFIG_$(PHASE_)OF_LIVE) += of_live.o
 obj-$(CONFIG_$(PHASE_)TPM) += tpm-common.o
 ifeq ($(CONFIG_$(PHASE_)TPM),y)
 obj-$(CONFIG_TPM) += tpm_api.o

-- 
2.53.0

Re: [PATCH v2 02/10] of_live: support in SPL

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> of_live: support in SPL
>
> Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> common/spl/spl.c | 11 +++++++++++
>  dts/Kconfig      |  6 ++++++
>  lib/Makefile     |  2 +-
>  3 files changed, 18 insertions(+), 1 deletion(-)

> diff --git a/common/spl/spl.c b/common/spl/spl.c
> @@ -510,6 +511,16 @@ static int spl_common_init(bool setup_malloc)
> +     if (CONFIG_IS_ENABLED(OF_LIVE)) {
> +             int ret;

This shadows ret already declared at function scope. Please drop the
inner declaration.

> diff --git a/dts/Kconfig b/dts/Kconfig
> @@ -86,6 +86,12 @@ config OF_LIVE
> +config SPL_OF_LIVE
> +     bool "Enable use of a live tree in SPL"
> +     depends on SPL_DM && SPL_OF_CONTROL
> +     help
> +       This option enables a live tree in SPL.

The help text is sparse compared to OF_LIVE. Please can you explain
why one might enable this in SPL.

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

[PATCH v2 03/10] drivers: allow clk_stub and spmi in SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Only Makefile and Kconfig changes necessary.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 drivers/Makefile      | 2 +-
 drivers/clk/Kconfig   | 6 ++++++
 drivers/spmi/Kconfig  | 6 ++++++
 drivers/spmi/Makefile | 2 +-
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/Makefile b/drivers/Makefile
index 43d0ba33281..477718ce89a 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
 obj-$(CONFIG_$(PHASE_)RTC) += rtc/
 obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
 obj-$(CONFIG_$(PHASE_)SPI) += spi/
+obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
 obj-$(CONFIG_$(PHASE_)TIMER) += timer/
 obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
 obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
@@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
 obj-y += rtc/
 obj-y += scsi/
 obj-y += sound/
-obj-y += spmi/
 obj-y += watchdog/
 obj-$(CONFIG_QE) += qe/
 obj-$(CONFIG_U_QE) += qe/
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index c2da7b3938b..888ea08cead 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -114,6 +114,12 @@ config CLK_STUB
 	  Enable this to provide a stub clock driver for non-essential clock
 	  controllers.
 
+config SPL_CLK_STUB
+	bool "Stub clock driver"
+	depends on SPL_CLK
+	help
+	  Enable stub clock driver in SPL
+
 config CLK_BCM6345
 	bool "Clock controller driver for BCM6345"
 	depends on CLK && ARCH_BMIPS
diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
index ab4878ebae4..f3d91e0b754 100644
--- a/drivers/spmi/Kconfig
+++ b/drivers/spmi/Kconfig
@@ -8,6 +8,12 @@ config SPMI
 	  SPMI (System Power Management Interface) bus is used
 	  to connect PMIC devices on various SoCs.
 
+config SPL_SPMI
+	bool "Enable SPMI bus support in SPL"
+	depends on SPL_DM
+	help
+	  Select this to enable SPMI bus support in SPL
+
 config SPMI_MSM
 	bool "Support Qualcomm SPMI bus"
 	depends on SPMI
diff --git a/drivers/spmi/Makefile b/drivers/spmi/Makefile
index 1b3d57f36a9..a654884737e 100644
--- a/drivers/spmi/Makefile
+++ b/drivers/spmi/Makefile
@@ -2,6 +2,6 @@
 #
 # (C) Copyright 2015 Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
 
-obj-$(CONFIG_SPMI)  += spmi-uclass.o
+obj-$(CONFIG_$(PHASE_)SPMI)  += spmi-uclass.o
 obj-$(CONFIG_SPMI_MSM) += spmi-msm.o
 obj-$(CONFIG_SPMI_SANDBOX) += spmi-sandbox.o

-- 
2.53.0

Re: [PATCH v2 03/10] drivers: allow clk_stub and spmi in SPL

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> drivers: allow clk_stub and spmi in SPL
>
> Only Makefile and Kconfig changes necessary.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> drivers/Makefile      | 2 +-
>  drivers/clk/Kconfig   | 6 ++++++
>  drivers/spmi/Kconfig  | 6 ++++++
>  drivers/spmi/Makefile | 2 +-
>  4 files changed, 14 insertions(+), 2 deletions(-)

> diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
> @@ -114,6 +114,12 @@ config CLK_STUB
> +config SPL_CLK_STUB
> +     bool "Stub clock driver"
> +     depends on SPL_CLK
> +     help
> +       Enable stub clock driver in SPL

Please can you expand this to mention the use case, e.g. 'Enable this
to provide a stub clock driver in SPL for non-essential clock
controllers'

> diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
> @@ -8,6 +8,12 @@ config SPMI
> +config SPL_SPMI
> +     bool "Enable SPMI bus support in SPL"
> +     depends on SPL_DM
> +     help
> +       Select this to enable SPMI bus support in SPL

Just to check — should this also depend on SPMI? Since SPMI_MSM
depends on SPMI (not SPL_SPMI), you need SPMI enabled in U-Boot proper
to get the driver compiled. Currently ARCH_SNAPDRAGON selects SPMI so
it works, but the Kconfig relationship seems loose.

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

Re: [PATCH v2 03/10] drivers: allow clk_stub and spmi in SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 2343 bytes --]

On Sat, Apr 11, 2026 at 02:00:08AM +0200, michael.srba@seznam.cz wrote:
> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Only Makefile and Kconfig changes necessary.
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
>  drivers/Makefile      | 2 +-
>  drivers/clk/Kconfig   | 6 ++++++
>  drivers/spmi/Kconfig  | 6 ++++++
>  drivers/spmi/Makefile | 2 +-
>  4 files changed, 14 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/Makefile b/drivers/Makefile
> index 43d0ba33281..477718ce89a 100644
> --- a/drivers/Makefile
> +++ b/drivers/Makefile
> @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
>  obj-$(CONFIG_$(PHASE_)RTC) += rtc/
>  obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
>  obj-$(CONFIG_$(PHASE_)SPI) += spi/
> +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
>  obj-$(CONFIG_$(PHASE_)TIMER) += timer/
>  obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
>  obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
> @@ -106,7 +107,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
>  obj-y += rtc/
>  obj-y += scsi/
>  obj-y += sound/
> -obj-y += spmi/
>  obj-y += watchdog/
>  obj-$(CONFIG_QE) += qe/
>  obj-$(CONFIG_U_QE) += qe/
> diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
> index c2da7b3938b..888ea08cead 100644
> --- a/drivers/clk/Kconfig
> +++ b/drivers/clk/Kconfig
> @@ -114,6 +114,12 @@ config CLK_STUB
>  	  Enable this to provide a stub clock driver for non-essential clock
>  	  controllers.
>  
> +config SPL_CLK_STUB
> +	bool "Stub clock driver"
> +	depends on SPL_CLK
> +	help
> +	  Enable stub clock driver in SPL
> +
>  config CLK_BCM6345
>  	bool "Clock controller driver for BCM6345"
>  	depends on CLK && ARCH_BMIPS
> diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
> index ab4878ebae4..f3d91e0b754 100644
> --- a/drivers/spmi/Kconfig
> +++ b/drivers/spmi/Kconfig
> @@ -8,6 +8,12 @@ config SPMI
>  	  SPMI (System Power Management Interface) bus is used
>  	  to connect PMIC devices on various SoCs.
>  
> +config SPL_SPMI
> +	bool "Enable SPMI bus support in SPL"
> +	depends on SPL_DM
> +	help
> +	  Select this to enable SPMI bus support in SPL
> +
>  config SPMI_MSM
>  	bool "Support Qualcomm SPMI bus"
>  	depends on SPMI

You need to add SPL_SPMI_MSM here, and then update the Makefile to use
$(PHASE_) as well.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[PATCH v2 04/10] mach-snapdragon: boot0.h: split out msm8916_boot0.h

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Prepare for supporting alternative boot0.h per-SoC by splitting out
the existing msm8916-specific code.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/mach-snapdragon/include/mach/boot0.h      | 57 ++--------------------
 .../mach-snapdragon/include/mach/msm8916_boot0.h   | 54 ++++++++++++++++++++
 2 files changed, 59 insertions(+), 52 deletions(-)

diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
index 953cccad790..44a764788de 100644
--- a/arch/arm/mach-snapdragon/include/mach/boot0.h
+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h
@@ -1,54 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0+ */
-/*
- * Workaround for "PSCI bug" on DragonBoard 410c
- * Copyright (C) 2021 Stephan Gerhold <stephan@gerhold.net>
- *
- * Syscall parameters taken from Qualcomm's LK fork (scm.h):
- * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
- *
- * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has
- * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall
- * that switches from 32-bit to 64-bit mode is executed at least once.
- *
- * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit
- * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if
- * U-Boot is installed to the "aboot" partition (replacing LK) the switch to
- * 64-bit mode never happens since U-Boot is already running in 64-bit mode.
- *
- * A workaround for this "PSCI bug" is to execute the TZ syscall when entering
- * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other
- * CPU cores in 64-bit mode as well.
- */
-#include <linux/arm-smccc.h>
-
-#define ARM_SMCCC_SIP32_FAST_CALL \
-	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
-
-	/*
-	 * U-Boot might be started in EL2 or EL3 with custom firmware.
-	 * In that case, we assume that the workaround is not necessary or is
-	 * handled already by the alternative firmware. Using the syscall in EL2
-	 * would demote U-Boot to EL1; in EL3 it would probably just crash.
-	 */
-	mrs	x0, CurrentEL
-	cmp	x0, #(1 << 2)	/* EL1 */
-	bne	reset
-
-	/* Prepare TZ syscall parameters */
-	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
-	movk	x0, #0x10f	/* SCM_SVC_MILESTONE_CMD_ID */
-	mov	x1, #0x12	/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */
-	adr	x2, el1_system_param
-	mov	x3, el1_system_param_end - el1_system_param
-
-	/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */
-	smc	#0
-
-	/* Something went wrong, perhaps PSCI is already in 64-bit mode? */
+#if defined(CONFIG_SPL_BUILD)
 	b	reset
-
-	.align	3
-el1_system_param:
-	.quad	0, 0, 0, 0, 0, 0, 0, 0, 0	/* el1_x0-x8 */
-	.quad	reset				/* el1_elr */
-el1_system_param_end:
+#else
+/* currently only db410c enables boot0.h in u-boot proper */
+#include "msm8916_boot0.h"
+#endif
diff --git a/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h
new file mode 100644
index 00000000000..953cccad790
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Workaround for "PSCI bug" on DragonBoard 410c
+ * Copyright (C) 2021 Stephan Gerhold <stephan@gerhold.net>
+ *
+ * Syscall parameters taken from Qualcomm's LK fork (scm.h):
+ * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
+ *
+ * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has
+ * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall
+ * that switches from 32-bit to 64-bit mode is executed at least once.
+ *
+ * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit
+ * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if
+ * U-Boot is installed to the "aboot" partition (replacing LK) the switch to
+ * 64-bit mode never happens since U-Boot is already running in 64-bit mode.
+ *
+ * A workaround for this "PSCI bug" is to execute the TZ syscall when entering
+ * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other
+ * CPU cores in 64-bit mode as well.
+ */
+#include <linux/arm-smccc.h>
+
+#define ARM_SMCCC_SIP32_FAST_CALL \
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
+
+	/*
+	 * U-Boot might be started in EL2 or EL3 with custom firmware.
+	 * In that case, we assume that the workaround is not necessary or is
+	 * handled already by the alternative firmware. Using the syscall in EL2
+	 * would demote U-Boot to EL1; in EL3 it would probably just crash.
+	 */
+	mrs	x0, CurrentEL
+	cmp	x0, #(1 << 2)	/* EL1 */
+	bne	reset
+
+	/* Prepare TZ syscall parameters */
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #0x10f	/* SCM_SVC_MILESTONE_CMD_ID */
+	mov	x1, #0x12	/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */
+	adr	x2, el1_system_param
+	mov	x3, el1_system_param_end - el1_system_param
+
+	/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */
+	smc	#0
+
+	/* Something went wrong, perhaps PSCI is already in 64-bit mode? */
+	b	reset
+
+	.align	3
+el1_system_param:
+	.quad	0, 0, 0, 0, 0, 0, 0, 0, 0	/* el1_x0-x8 */
+	.quad	reset				/* el1_elr */
+el1_system_param_end:

-- 
2.53.0

Re: [PATCH v2 04/10] mach-snapdragon: boot0.h: split out msm8916_boot0.h

[Simon Glass]

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: boot0.h: split out msm8916_boot0.h
>
> Prepare for supporting alternative boot0.h per-SoC by splitting out
> the existing msm8916-specific code.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/mach-snapdragon/include/mach/boot0.h      | 57 ++--------------------
>  .../mach-snapdragon/include/mach/msm8916_boot0.h   | 54 ++++++++++++++++++++
>  2 files changed, 59 insertions(+), 52 deletions(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

[PATCH v2 05/10] mach-snapdragon: add u-boot-spl-elf-sdm845.lds

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

This custom linker script is required to produce a bootable ELF
for the sdm845 SoC. An xbl_sec.elf must be provided, which will
be put in a section in the ELF as required by the boot rom.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds | 25 ++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
new file mode 100644
index 00000000000..10912f416cc
--- /dev/null
+++ b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
@@ -0,0 +1,25 @@
+TARGET("binary")
+INPUT("./xbl_sec.elf")
+
+OUTPUT_FORMAT("default")
+
+ENTRY(CONFIG_PLATFORM_ELFENTRY)
+PHDRS
+{
+	data PT_LOAD FLAGS(7);
+	xbl_sec PT_LOAD FLAGS(5 | (0x5 << 24));
+}
+SECTIONS
+{
+	. = 0x0000000014699000;
+	.xbl_sec : { // XBL_SEC nested ELF
+		. = .;
+		"./xbl_sec.elf"
+	} :xbl_sec
+
+	. = CONFIG_PLATFORM_ELFENTRY;
+
+	.data : {
+		*(.data*)
+	} :data
+}

-- 
2.53.0

Re: [PATCH v2 05/10] mach-snapdragon: add u-boot-spl-elf-sdm845.lds

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: add u-boot-spl-elf-sdm845.lds
>
> This custom linker script is required to produce a bootable ELF
> for the sdm845 SoC. An xbl_sec.elf must be provided, which will
> be put in a section in the ELF as required by the boot rom.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds | 25 ++++++++++++++++++++++
>  1 file changed, 25 insertions(+)

> diff --git a/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
> new file mode 100644
> @@ -0,0 +1,25 @@
> +TARGET("binary")

Please can you add an SPDX licence header? Other linker scripts like
arch/arm/cpu/armv8/u-boot-spl.lds have one.

> @@ -0,0 +1,25 @@
> +     xbl_sec PT_LOAD FLAGS(5 | (0x5 << 24));

The FLAGS(5 | (0x5 << 24)) magic number could use a comment explaining
what the upper bits represent — presumably some Qualcomm-specific
segment flag?

> @@ -0,0 +1,25 @@
> +     . = 0x0000000014699000;

This address appears specific to a particular XBL_SEC build (cf.
XBL_SEC_DONOR_SCM_ADDR in patch 7). Please can you add a comment
documenting where this comes from and whether it applies to all sdm845
devices?

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

[PATCH v2 06/10] mach-snapdragon: Kconfig: changes / additions to support SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
This will select reasonable defaults and enable per-SoC linker
script (if required).

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/Kconfig                 | 31 +++++++++++++++++++++++++++-
 arch/arm/mach-snapdragon/Kconfig | 44 ++++++++++++++++++++++++++++++++++------
 2 files changed, 68 insertions(+), 7 deletions(-)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 03416c55265..8490e336516 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1138,9 +1138,38 @@ config ARCH_SNAPDRAGON
 	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select SYSRESET
-	select SYSRESET_PSCI
+	select SYSRESET_PSCI if !SPL
 	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
 	select MMU_PGPROT
+	select SUPPORT_SPL
+	select ARMV8_SPL_EXCEPTION_VECTORS if SPL
+	select ENABLE_ARM_SOC_BOOT0_HOOK if SPL
+	select SPL_DM if SPL
+	select SPL_DM_GPIO if SPL
+	select SPL_DM_PMIC if SPL
+	select SPL_DM_USB_GADGET if SPL
+	select SPL_ENV_SUPPORT if SPL
+	select SPL_GPIO if SPL
+	select SPL_HAS_BSS_LINKER_SECTION if SPL
+	select SPL_LIBCOMMON_SUPPORT if SPL
+	select SPL_LIBDISK_SUPPORT if SPL
+	select SPL_LIBGENERIC_SUPPORT if SPL
+	select SPL_MMC if SPL
+	select SPL_OF_REAL if SPL
+	select SPL_OF_CONTROL if SPL
+	select SPL_PINCONF if SPL
+	select SPL_PINCTRL if SPL
+	select SPL_PINCTRL_FULL if SPL
+	select SPL_PINCTRL_GENERIC if SPL
+	select SPL_PINCONF_RECURSIVE if SPL
+	select SPL_PINMUX if SPL
+	select SPL_SPRINTF if SPL
+	select SPL_STRTO if SPL
+	select SPL_USB_GADGET if SPL
+	imply DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC
+	imply SPL_EVENT if SPL_USB_DWC3_GENERIC
+	imply OF_LIVE if USB_DWC3_GENERIC
+	imply SPL_OF_LIVE if SPL_USB_DWC3_GENERIC
 	imply OF_UPSTREAM
 	imply CMD_DM
 	imply DM_USB_GADGET
diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
index 976c0e35fce..74d687ceee2 100644
--- a/arch/arm/mach-snapdragon/Kconfig
+++ b/arch/arm/mach-snapdragon/Kconfig
@@ -11,18 +11,12 @@ config SYS_VENDOR
 	  Based on this option board/<CONFIG_SYS_VENDOR>/<CONFIG_SYS_BOARD>
 	  will be used as the custom board directory.
 
-config SYS_MALLOC_LEN
-	default 0x10000000
-
 config SYS_MALLOC_F_LEN
 	default 0x2000
 
 config SPL_SYS_MALLOC_F
 	default y
 
-config SPL_SYS_MALLOC_F_LEN
-	default 0x2000
-
 config SYS_MALLOC_LEN
 	default 0x800000
 
@@ -45,4 +39,42 @@ config SYS_CONFIG_NAME
 	  Based on this option include/configs/<CONFIG_SYS_CONFIG_NAME>.h header
 	  will be used for board configuration.
 
+config SPL_SHARES_INIT_SP_ADDR
+	default n
+
+config SPL_HAVE_INIT_STACK
+	default y
+
+# SPL targets
+
+config SPL_TARGET_SDM845
+	bool "Set reasonable default values for running SPL in SRAM on sdm845 devices"
+
+# config options selected based on target
+
+config SPL_REMAKE_ELF_LDSCRIPT
+	default "arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds" if SPL_TARGET_SDM845
+
+# Modern Qualcomm platforms have two sets of SRAM memory easily available to us,
+# BOOT_IMEM and OCIMEM. See doc/board/qualcomm/spl.rst for more info.
+
+config SPL_BSS_START_ADDR
+	default 0x14680000 if SPL_TARGET_SDM845 # start of OCIMEM
+
+config SPL_BSS_MAX_SIZE
+	default 0x2000 if SPL_TARGET_SDM845 # leaves 0x1e000 for the stack in worst case
+
+# this starts at the end of .bss
+config SPL_SYS_MALLOC_F_LEN
+	default 0x20000 if SPL_TARGET_SDM845 # arbitrarily half of OCIMEM size
+
+config SPL_STACK
+	default 0x146bffff if SPL_TARGET_SDM845 # end of OCIMEM
+
+config SPL_TEXT_BASE
+	default 0x1483f000 if SPL_TARGET_SDM845 # start of largest continuous block of BOOT_IMEM in BROM whitelist
+
+config SPL_MAX_SIZE
+	default 0xc1000 if SPL_TARGET_SDM845 # size of largest continuous block of BOOT_IMEM in BROM whitelist
+
 endif

-- 
2.53.0

Re: [PATCH v2 06/10] mach-snapdragon: Kconfig: changes / additions to support SPL

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: Kconfig: changes / additions to support SPL
>
> An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
> This will select reasonable defaults and enable per-SoC linker
> script (if required).
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/Kconfig                 | 31 +++++++++++++++++++++++++++-
>  arch/arm/mach-snapdragon/Kconfig | 44 ++++++++++++++++++++++++++++++++++------
>  2 files changed, 68 insertions(+), 7 deletions(-)

> diff --git a/arch/arm/mach-snapdragon/Kconfig
> @@ -11,18 +11,12 @@ config SYS_VENDOR
> -config SYS_MALLOC_LEN
> -     default 0x10000000

You are removing a duplicate SYS_MALLOC_LEN definition (0x10000000 vs
0x800000). Please can you split this fix into a separate preparatory
patch, since it is a bug fix unrelated to adding SPL support?

> diff --git a/arch/arm/mach-snapdragon/Kconfig
> +config SPL_TARGET_SDM845
> +     bool "Set reasonable default values for running SPL in SRAM on sdm845 devices"

This is missing a help text. Please add one explaining what this
enables, perhaps referencing doc/board/qualcomm/spl.rst. Also, this
should probably have 'depends on SPL'

> diff --git a/arch/arm/Kconfig
> +     select SPL_MMC if SPL

Just to check - is SPL_MMC really needed for all Snapdragon SPL
builds? The defconfig and documentation suggest only USB DFU is
currently supported. If MMC is not actually used yet, maybe use imply
rather than select

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

Re: [PATCH v2 06/10] mach-snapdragon: Kconfig: changes / additions to support SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3496 bytes --]

On Sat, Apr 11, 2026 at 02:00:11AM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
> This will select reasonable defaults and enable per-SoC linker
> script (if required).
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
>  arch/arm/Kconfig                 | 31 +++++++++++++++++++++++++++-
>  arch/arm/mach-snapdragon/Kconfig | 44 ++++++++++++++++++++++++++++++++++------
>  2 files changed, 68 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
> index 03416c55265..8490e336516 100644
> --- a/arch/arm/Kconfig
> +++ b/arch/arm/Kconfig
> @@ -1138,9 +1138,38 @@ config ARCH_SNAPDRAGON
>  	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
>  	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
>  	select SYSRESET
> -	select SYSRESET_PSCI
> +	select SYSRESET_PSCI if !SPL
>  	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
>  	select MMU_PGPROT
> +	select SUPPORT_SPL
> +	select ARMV8_SPL_EXCEPTION_VECTORS if SPL
> +	select ENABLE_ARM_SOC_BOOT0_HOOK if SPL
> +	select SPL_DM if SPL
> +	select SPL_DM_GPIO if SPL
> +	select SPL_DM_PMIC if SPL
> +	select SPL_DM_USB_GADGET if SPL
> +	select SPL_ENV_SUPPORT if SPL
> +	select SPL_GPIO if SPL
> +	select SPL_HAS_BSS_LINKER_SECTION if SPL
> +	select SPL_LIBCOMMON_SUPPORT if SPL
> +	select SPL_LIBDISK_SUPPORT if SPL
> +	select SPL_LIBGENERIC_SUPPORT if SPL
> +	select SPL_MMC if SPL
> +	select SPL_OF_REAL if SPL
> +	select SPL_OF_CONTROL if SPL
> +	select SPL_PINCONF if SPL
> +	select SPL_PINCTRL if SPL
> +	select SPL_PINCTRL_FULL if SPL
> +	select SPL_PINCTRL_GENERIC if SPL
> +	select SPL_PINCONF_RECURSIVE if SPL
> +	select SPL_PINMUX if SPL
> +	select SPL_SPRINTF if SPL
> +	select SPL_STRTO if SPL
> +	select SPL_USB_GADGET if SPL
> +	imply DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC
> +	imply SPL_EVENT if SPL_USB_DWC3_GENERIC
> +	imply OF_LIVE if USB_DWC3_GENERIC
> +	imply SPL_OF_LIVE if SPL_USB_DWC3_GENERIC
>  	imply OF_UPSTREAM
>  	imply CMD_DM
>  	imply DM_USB_GADGET

This part looks good.

> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> index 976c0e35fce..74d687ceee2 100644
> --- a/arch/arm/mach-snapdragon/Kconfig
> +++ b/arch/arm/mach-snapdragon/Kconfig
> @@ -11,18 +11,12 @@ config SYS_VENDOR
>  	  Based on this option board/<CONFIG_SYS_VENDOR>/<CONFIG_SYS_BOARD>
>  	  will be used as the custom board directory.
>  
> -config SYS_MALLOC_LEN
> -	default 0x10000000
> -
>  config SYS_MALLOC_F_LEN
>  	default 0x2000
>  
>  config SPL_SYS_MALLOC_F
>  	default y
>  
> -config SPL_SYS_MALLOC_F_LEN
> -	default 0x2000
> -
>  config SYS_MALLOC_LEN
>  	default 0x800000
>  
> @@ -45,4 +39,42 @@ config SYS_CONFIG_NAME
>  	  Based on this option include/configs/<CONFIG_SYS_CONFIG_NAME>.h header
>  	  will be used for board configuration.
>  
> +config SPL_SHARES_INIT_SP_ADDR
> +	default n
> +
> +config SPL_HAVE_INIT_STACK
> +	default y
> +
> +# SPL targets
> +
> +config SPL_TARGET_SDM845
> +	bool "Set reasonable default values for running SPL in SRAM on sdm845 devices"

This namespace is confusing and so shouldn't be used. Does SDM845 get
used without SPL? We should probably follow the convention of adding a
new defconfig of <whatever board>_spl_defconfig, that enables the
options as needed.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v2 06/10] mach-snapdragon: Kconfig: changes / additions to support SPL

[Michael Srba]

Hi,

On 4/13/26 19:17, Tom Rini wrote:
> On Sat, Apr 11, 2026 at 02:00:11AM +0200, michael.srba@seznam.cz wrote:
>
>> From: Michael Srba <Michael.Srba@seznam.cz>
>>
>> An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
>> This will select reasonable defaults and enable per-SoC linker
>> script (if required).
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> ---
>>   arch/arm/Kconfig                 | 31 +++++++++++++++++++++++++++-
>>   arch/arm/mach-snapdragon/Kconfig | 44 ++++++++++++++++++++++++++++++++++------
>>   2 files changed, 68 insertions(+), 7 deletions(-)
>>
>> diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
>> index 03416c55265..8490e336516 100644
>> --- a/arch/arm/Kconfig
>> +++ b/arch/arm/Kconfig
>> @@ -1138,9 +1138,38 @@ config ARCH_SNAPDRAGON
>>   	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
>>   	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
>>   	select SYSRESET
>> -	select SYSRESET_PSCI
>> +	select SYSRESET_PSCI if !SPL
>>   	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
>>   	select MMU_PGPROT
>> +	select SUPPORT_SPL
>> +	select ARMV8_SPL_EXCEPTION_VECTORS if SPL
>> +	select ENABLE_ARM_SOC_BOOT0_HOOK if SPL
>> +	select SPL_DM if SPL
>> +	select SPL_DM_GPIO if SPL
>> +	select SPL_DM_PMIC if SPL
>> +	select SPL_DM_USB_GADGET if SPL
>> +	select SPL_ENV_SUPPORT if SPL
>> +	select SPL_GPIO if SPL
>> +	select SPL_HAS_BSS_LINKER_SECTION if SPL
>> +	select SPL_LIBCOMMON_SUPPORT if SPL
>> +	select SPL_LIBDISK_SUPPORT if SPL
>> +	select SPL_LIBGENERIC_SUPPORT if SPL
>> +	select SPL_MMC if SPL
>> +	select SPL_OF_REAL if SPL
>> +	select SPL_OF_CONTROL if SPL
>> +	select SPL_PINCONF if SPL
>> +	select SPL_PINCTRL if SPL
>> +	select SPL_PINCTRL_FULL if SPL
>> +	select SPL_PINCTRL_GENERIC if SPL
>> +	select SPL_PINCONF_RECURSIVE if SPL
>> +	select SPL_PINMUX if SPL
>> +	select SPL_SPRINTF if SPL
>> +	select SPL_STRTO if SPL
>> +	select SPL_USB_GADGET if SPL
>> +	imply DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC
>> +	imply SPL_EVENT if SPL_USB_DWC3_GENERIC
>> +	imply OF_LIVE if USB_DWC3_GENERIC
>> +	imply SPL_OF_LIVE if SPL_USB_DWC3_GENERIC
>>   	imply OF_UPSTREAM
>>   	imply CMD_DM
>>   	imply DM_USB_GADGET
> This part looks good.
>
>> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
>> index 976c0e35fce..74d687ceee2 100644
>> --- a/arch/arm/mach-snapdragon/Kconfig
>> +++ b/arch/arm/mach-snapdragon/Kconfig
>> @@ -11,18 +11,12 @@ config SYS_VENDOR
>>   	  Based on this option board/<CONFIG_SYS_VENDOR>/<CONFIG_SYS_BOARD>
>>   	  will be used as the custom board directory.
>>   
>> -config SYS_MALLOC_LEN
>> -	default 0x10000000
>> -
>>   config SYS_MALLOC_F_LEN
>>   	default 0x2000
>>   
>>   config SPL_SYS_MALLOC_F
>>   	default y
>>   
>> -config SPL_SYS_MALLOC_F_LEN
>> -	default 0x2000
>> -
>>   config SYS_MALLOC_LEN
>>   	default 0x800000
>>   
>> @@ -45,4 +39,42 @@ config SYS_CONFIG_NAME
>>   	  Based on this option include/configs/<CONFIG_SYS_CONFIG_NAME>.h header
>>   	  will be used for board configuration.
>>   
>> +config SPL_SHARES_INIT_SP_ADDR
>> +	default n
>> +
>> +config SPL_HAVE_INIT_STACK
>> +	default y
>> +
>> +# SPL targets
>> +
>> +config SPL_TARGET_SDM845
>> +	bool "Set reasonable default values for running SPL in SRAM on sdm845 devices"
> This namespace is confusing and so shouldn't be used. Does SDM845 get
> used without SPL? We should probably follow the convention of adding a
> new defconfig of <whatever board>_spl_defconfig, that enables the
> options as needed.
The rationale for this naming was that outside SPL, we don't currently
discriminate between SoCs at compile time (there is some discrimination
between legacy board support the and unified "board" which covers all
non-legacy boards no matter the SoC, but for non-legacy boards there
is just a single build of U-Boot proper, possibly with a board dtb
appended if used as the primary bootloader). I suppose the SPL_ prefix
may be confusing and isn't strictly necessary, and we may need a similar
target option for msm8916 in the future which wouldn't be used in SPL
but in u-boot proper, so it makes sense to get rid of the prefix.

The reason we need this config option at all (even if we move all
the Kconfig defaults that use it into the defconfig) is that the
boot0.h is shared among all of mach-snapdragon, and we need a way
to select which SoC-specific boot0.h we should include.
Now, it does look like SYS_SOC is intended for stuff like this,
however changing SYS_SOC from snapdragon seems to completely break
the unified board support which isn't really worth it.

Admittedly, it does seem that I somehow completely forgot to mention that
use of the config option in both the commit message and the Kconfig,
but it is effectively the only use it has left after moving everything
into the defconfig.

So, should I include an SoC selection menu similar to the board selection
menus in e.g mach-exynos, which would now solely be used by the ifdef
in boot0.h? Something like
```
choice
     prompt "Qualcomm SoC select"
     default TARGET_NONE if !SPL
     help
       While U-Boot on Qualcomm platforms doesn't generally need compile-time
       adjustment based on the target SoC, there are a few exceptions to this.
       Currently this concerns boot0.h discrimination.

config TARGET_NONE
     bool "Generic build"
     help
       Select this if you're not building SPL. U-Boot proper builds are currently
       generic across all SoCs.

config TARGET_SDM845
     bool "SPL targeting the sdm845 SoC"
     help
       Select this if you are bulding u-boot SPL for sdm845.
       Currently this gates sdm845-specific boot0.h (only used in SPL).

endchoice
```

... or do you have something else in mind? I'm not entirely sure if you're
suggesting to get rid of TARGET_SDM845 completely (which I really don't see
as possible at least without a lot of unnecessary pain) or just of it's
use for the defaults.

Regards,
Michael
>

Re: [PATCH v2 06/10] mach-snapdragon: Kconfig: changes / additions to support SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 6847 bytes --]

On Sat, Apr 18, 2026 at 03:01:22AM +0200, Michael Srba wrote:
> Hi,
> 
> On 4/13/26 19:17, Tom Rini wrote:
> > On Sat, Apr 11, 2026 at 02:00:11AM +0200, michael.srba@seznam.cz wrote:
> > 
> > > From: Michael Srba <Michael.Srba@seznam.cz>
> > > 
> > > An SoC to target has to be selected, e.g. SPL_TARGET_SDM845.
> > > This will select reasonable defaults and enable per-SoC linker
> > > script (if required).
> > > 
> > > Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> > > ---
> > >   arch/arm/Kconfig                 | 31 +++++++++++++++++++++++++++-
> > >   arch/arm/mach-snapdragon/Kconfig | 44 ++++++++++++++++++++++++++++++++++------
> > >   2 files changed, 68 insertions(+), 7 deletions(-)
> > > 
> > > diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
> > > index 03416c55265..8490e336516 100644
> > > --- a/arch/arm/Kconfig
> > > +++ b/arch/arm/Kconfig
> > > @@ -1138,9 +1138,38 @@ config ARCH_SNAPDRAGON
> > >   	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
> > >   	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
> > >   	select SYSRESET
> > > -	select SYSRESET_PSCI
> > > +	select SYSRESET_PSCI if !SPL
> > >   	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
> > >   	select MMU_PGPROT
> > > +	select SUPPORT_SPL
> > > +	select ARMV8_SPL_EXCEPTION_VECTORS if SPL
> > > +	select ENABLE_ARM_SOC_BOOT0_HOOK if SPL
> > > +	select SPL_DM if SPL
> > > +	select SPL_DM_GPIO if SPL
> > > +	select SPL_DM_PMIC if SPL
> > > +	select SPL_DM_USB_GADGET if SPL
> > > +	select SPL_ENV_SUPPORT if SPL
> > > +	select SPL_GPIO if SPL
> > > +	select SPL_HAS_BSS_LINKER_SECTION if SPL
> > > +	select SPL_LIBCOMMON_SUPPORT if SPL
> > > +	select SPL_LIBDISK_SUPPORT if SPL
> > > +	select SPL_LIBGENERIC_SUPPORT if SPL
> > > +	select SPL_MMC if SPL
> > > +	select SPL_OF_REAL if SPL
> > > +	select SPL_OF_CONTROL if SPL
> > > +	select SPL_PINCONF if SPL
> > > +	select SPL_PINCTRL if SPL
> > > +	select SPL_PINCTRL_FULL if SPL
> > > +	select SPL_PINCTRL_GENERIC if SPL
> > > +	select SPL_PINCONF_RECURSIVE if SPL
> > > +	select SPL_PINMUX if SPL
> > > +	select SPL_SPRINTF if SPL
> > > +	select SPL_STRTO if SPL
> > > +	select SPL_USB_GADGET if SPL
> > > +	imply DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC
> > > +	imply SPL_EVENT if SPL_USB_DWC3_GENERIC
> > > +	imply OF_LIVE if USB_DWC3_GENERIC
> > > +	imply SPL_OF_LIVE if SPL_USB_DWC3_GENERIC
> > >   	imply OF_UPSTREAM
> > >   	imply CMD_DM
> > >   	imply DM_USB_GADGET
> > This part looks good.
> > 
> > > diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> > > index 976c0e35fce..74d687ceee2 100644
> > > --- a/arch/arm/mach-snapdragon/Kconfig
> > > +++ b/arch/arm/mach-snapdragon/Kconfig
> > > @@ -11,18 +11,12 @@ config SYS_VENDOR
> > >   	  Based on this option board/<CONFIG_SYS_VENDOR>/<CONFIG_SYS_BOARD>
> > >   	  will be used as the custom board directory.
> > > -config SYS_MALLOC_LEN
> > > -	default 0x10000000
> > > -
> > >   config SYS_MALLOC_F_LEN
> > >   	default 0x2000
> > >   config SPL_SYS_MALLOC_F
> > >   	default y
> > > -config SPL_SYS_MALLOC_F_LEN
> > > -	default 0x2000
> > > -
> > >   config SYS_MALLOC_LEN
> > >   	default 0x800000
> > > @@ -45,4 +39,42 @@ config SYS_CONFIG_NAME
> > >   	  Based on this option include/configs/<CONFIG_SYS_CONFIG_NAME>.h header
> > >   	  will be used for board configuration.
> > > +config SPL_SHARES_INIT_SP_ADDR
> > > +	default n
> > > +
> > > +config SPL_HAVE_INIT_STACK
> > > +	default y
> > > +
> > > +# SPL targets
> > > +
> > > +config SPL_TARGET_SDM845
> > > +	bool "Set reasonable default values for running SPL in SRAM on sdm845 devices"
> > This namespace is confusing and so shouldn't be used. Does SDM845 get
> > used without SPL? We should probably follow the convention of adding a
> > new defconfig of <whatever board>_spl_defconfig, that enables the
> > options as needed.
> The rationale for this naming was that outside SPL, we don't currently
> discriminate between SoCs at compile time (there is some discrimination
> between legacy board support the and unified "board" which covers all
> non-legacy boards no matter the SoC, but for non-legacy boards there
> is just a single build of U-Boot proper, possibly with a board dtb
> appended if used as the primary bootloader). I suppose the SPL_ prefix
> may be confusing and isn't strictly necessary, and we may need a similar
> target option for msm8916 in the future which wouldn't be used in SPL
> but in u-boot proper, so it makes sense to get rid of the prefix.
> 
> The reason we need this config option at all (even if we move all
> the Kconfig defaults that use it into the defconfig) is that the
> boot0.h is shared among all of mach-snapdragon, and we need a way
> to select which SoC-specific boot0.h we should include.
> Now, it does look like SYS_SOC is intended for stuff like this,
> however changing SYS_SOC from snapdragon seems to completely break
> the unified board support which isn't really worth it.
> 
> Admittedly, it does seem that I somehow completely forgot to mention that
> use of the config option in both the commit message and the Kconfig,
> but it is effectively the only use it has left after moving everything
> into the defconfig.
> 
> So, should I include an SoC selection menu similar to the board selection
> menus in e.g mach-exynos, which would now solely be used by the ifdef
> in boot0.h? Something like
> ```
> choice
>     prompt "Qualcomm SoC select"
>     default TARGET_NONE if !SPL
>     help
>       While U-Boot on Qualcomm platforms doesn't generally need compile-time
>       adjustment based on the target SoC, there are a few exceptions to this.
>       Currently this concerns boot0.h discrimination.
> 
> config TARGET_NONE
>     bool "Generic build"
>     help
>       Select this if you're not building SPL. U-Boot proper builds are currently
>       generic across all SoCs.
> 
> config TARGET_SDM845
>     bool "SPL targeting the sdm845 SoC"
>     help
>       Select this if you are bulding u-boot SPL for sdm845.
>       Currently this gates sdm845-specific boot0.h (only used in SPL).
> 
> endchoice
> ```
> 
> ... or do you have something else in mind? I'm not entirely sure if you're
> suggesting to get rid of TARGET_SDM845 completely (which I really don't see
> as possible at least without a lot of unnecessary pain) or just of it's
> use for the defaults.

That's for explaining more. The SPL_xxx namespace is generally reserved
so that we can do things like:
obj-$(CONFIG_$(PHASE)FOO) += foo.o
in a Makefile, and have symbols for SPL_FOO, FOO (and TPL_FOO).

So I think your suggestion here is fine, pending feedback from the
snapdragon maintainers.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[PATCH v2 07/10] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

On sdm845, running u-boot SPL in EL3 requires escalting by using
an unintentional feature in old builds of xbl_sec.elf. We do this
in boot0.h so the rest of U-Boot can stay blissfully unaware
of XBL_SEC. If we are already in EL3 for whatever reason, the
code is skipped.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/mach-snapdragon/include/mach/boot0.h      |   4 +
 .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++++
 2 files changed, 124 insertions(+)

diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
index 44a764788de..5d401051bd1 100644
--- a/arch/arm/mach-snapdragon/include/mach/boot0.h
+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h
@@ -1,6 +1,10 @@
 /* SPDX-License-Identifier: GPL-2.0+ */
 #if defined(CONFIG_SPL_BUILD)
+#if defined(CONFIG_SPL_TARGET_SDM845)
+#include "sdm845_spl_boot0.h"
+#else
 	b	reset
+#endif
 #else
 /* currently only db410c enables boot0.h in u-boot proper */
 #include "msm8916_boot0.h"
diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
new file mode 100644
index 00000000000..a0136578756
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
@@ -0,0 +1,120 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Workaround for non-qcom-signed code being entered in EL1 on sdm845
+ * Copyright (C) 2026 Michael Srba <Michael.Srba@seznam.cz>
+ *
+ * This code uses an unintentional ownership enhancing feature in older builds of XBL_SEC
+ * in order to elevate our privileges to EL3 as soon as possible after a system reset.
+ * This allows for a very close approximation of a clean state.
+ *
+ * Do note that you still need to own the device in the sense that you control the code that
+ * XBL_SEC jumps to in EL1, which is sadly not a level of ownership commonly afforded to you
+ * by the device manufacturer. On such devices, CVE-2021-30327 could help, but it's not documented
+ * and there is no PoC available utilizing it
+ *
+ */
+#include <linux/arm-smccc.h>
+
+#define SCM_SMC_FNID(s, c)	((((s) & 0xFF) << 8) | ((c) & 0xFF))
+
+#define ARM_SMCCC_SIP32_FAST_CALL \
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
+
+/* same as with qcom's TZ */
+#define QCOM_SCM_SVC_MEM_DUMP 0x03
+/* unlike the TZ counterpart, in XBL_SEC this simply unlocks the XPUs */
+#define QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS 0x10
+
+/*
+ * We put our payload in place of some SCM call, the important thing is that it's hopefully
+ * in a memory region that is not in cache.
+ *
+ * It would be cleaner to just put our code at the scm entry point in the vector table,
+ * however it seems that we can't force cache coherency from EL1 if EL3 doesn't have
+ * any reason to care about that.
+ */
+#define QCOM_SCM_SVC_DONOR 0x01
+#define QCOM_SCM_DONOR 0x16
+/* we replace the instructions at this address with a jump to the start of u-boot */
+/* NOTE: this address is specific to a particular XBL_SEC elf */
+#define XBL_SEC_DONOR_SCM_ADDR 0x146a0ce0
+
+/* gnu as doesn't implement these useful pseudoinstructions */
+.macro movq Xn, imm
+    movz    \Xn,  \imm & 0xFFFF
+    movk    \Xn, (\imm >> 16) & 0xFFFF, lsl 16
+    movk    \Xn, (\imm >> 32) & 0xFFFF, lsl 32
+    movk    \Xn, (\imm >> 48) & 0xFFFF, lsl 48
+.endm
+
+.macro movl Wn, imm
+    movz    \Wn,  \imm & 0xFFFF
+    movk    \Wn, (\imm >> 16) & 0xFFFF, lsl 16
+.endm
+
+/* copy 32 bits to an address from a label */
+.macro copy32 addr, text_base, addrofval, offset
+	movl	x0, \addr
+	add	x0, x0, \offset
+	movq	x1, \text_base
+	add	x1, x1, \addrofval
+	add	x1, x1, \offset
+	ldr	w2, [x1]
+	str	w2, [x0]
+	dc	cvau, x0 // flush cache to RAM straight away, we need to do it by address anyway
+.endm
+
+.macro copy_instructions addr, text_base, start_addr, num_bytes // num_bytes must be a multiple of 4
+	mov x3,	#0x0 // x0, x1 and w2 used by copy32
+1:
+	copy32	\addr, \text_base, \start_addr, x3
+	add	x3, x3, #0x4 // i+=4
+	cmp	x3, \num_bytes
+	blo	1b
+.endm
+
+	/*  If we're already in EL3 for some reason,  skip this whole thing */
+	mrs	x0, CurrentEL
+	cmp	x0, #(3 << 2)	/* EL3 */
+	beq	reset
+
+	/* disable the mmu */
+	mrs	x0, sctlr_el1
+	and     x0, x0, #~(1 << 0) // CTRL_M
+	msr	sctlr_el1, x0
+
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #SCM_SMC_FNID(QCOM_SCM_SVC_MEM_DUMP, QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS)
+	mov	x1, #0x0	/* no params */
+	mov	x6, #0x0
+
+	smc	#0 /* unlock XBL_SEC code area for writing (assuming old enough XBL_SEC build) */
+
+	/* this will also flush the writes from cache */
+	copy_instructions XBL_SEC_DONOR_SCM_ADDR, CONFIG_SPL_TEXT_BASE, el3_payload, #((el3_payload_end - el3_payload))
+
+	/* this probably doesn't affect EL3, but it doesn't hurt */
+	dsb	ish	/* block until cache is flushed */
+	ic	iallu	/* force re-fetch of our shiny new instructions */
+	dsb	ish	/* block until invalidation is finished */
+	isb	sy	/* unify here ? */
+
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #SCM_SMC_FNID(QCOM_SCM_SVC_DONOR, QCOM_SCM_DONOR)
+	mov	x1, #0x0	/* no params */
+	smc	#0	/* call the payload */
+
+el3_ret_point:
+	b	reset
+
+el3_payload:
+	/* disable the mmu for EL3 too */
+	mrs	x0, sctlr_el3
+	and     x0, x0, #~(1 << 0) // CTRL_M
+	msr	sctlr_el3, x0
+
+	/* jump back to our code, but now in EL3 */
+	movl	x0, CONFIG_SPL_TEXT_BASE
+	add	x0, x0, (el3_ret_point - _start)
+	br	x0
+el3_payload_end:

-- 
2.53.0

Re: [PATCH v2 07/10] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: boot0.h: add sdm845_spl_boot0.h
>
> On sdm845, running u-boot SPL in EL3 requires escalting by using
> an unintentional feature in old builds of xbl_sec.elf. We do this
> in boot0.h so the rest of U-Boot can stay blissfully unaware
> of XBL_SEC. If we are already in EL3 for whatever reason, the
> code is skipped.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/mach-snapdragon/include/mach/boot0.h      |   4 +
>  .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++++
>  2 files changed, 124 insertions(+)

> diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
> @@ -0,0 +1,120 @@
> +.macro movl Wn, imm
> +    movz    \Xn,  \imm & 0xFFFF
> +    movk    \Xn, (\imm >> 16) & 0xFFFF, lsl 16
> +.endm

The macro parameter is named Wn but the body references \Xn - does
this actually build?

> @@ -0,0 +1,120 @@
> +.macro movq Xn, imm
> +    movz    \Xn,  \imm & 0xFFFF

Similar issue to above - also please use tabs to indent.

> @@ -0,0 +1,120 @@
> +el3_payload:
> +     /* disable the mmu for EL3 too */
> +     mrs     x0, sctlr_el3
> +     and     x0, x0, #~(1 << 0) // CTRL_M
> +     msr     sctlr_el3, x0
> +
> +     /* jump back to our code, but now in EL3 */
> +     movl    x0, CONFIG_SPL_TEXT_BASE
> +     add     x0, x0, (el3_ret_point - _start)
> +     br      x0
> +el3_payload_end:

After disabling the MMU in EL3 shouldn't you have an ISB before the branch?

Regards,
Simon

Re: [PATCH v2 07/10] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h

[Michael Srba]

Hi,

On 4/11/26 17:40, Simon Glass wrote:
> Hi Michael,
>
> On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
>> mach-snapdragon: boot0.h: add sdm845_spl_boot0.h
>>
>> On sdm845, running u-boot SPL in EL3 requires escalting by using
>> an unintentional feature in old builds of xbl_sec.elf. We do this
>> in boot0.h so the rest of U-Boot can stay blissfully unaware
>> of XBL_SEC. If we are already in EL3 for whatever reason, the
>> code is skipped.
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>>
>> arch/arm/mach-snapdragon/include/mach/boot0.h      |   4 +
>>   .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++++
>>   2 files changed, 124 insertions(+)
>> diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
>> @@ -0,0 +1,120 @@
>> +.macro movl Wn, imm
>> +    movz    \Xn,  \imm & 0xFFFF
>> +    movk    \Xn, (\imm >> 16) & 0xFFFF, lsl 16
>> +.endm
> The macro parameter is named Wn but the body references \Xn - does
> this actually build?
I'm not sure why it displays like that for you, both for me locally and on
https://lore.kernel.org/all/20260411-qcom_spl-v2-7-9609557cf562@seznam.cz/
it displays correctly...
>> @@ -0,0 +1,120 @@
>> +.macro movq Xn, imm
>> +    movz    \Xn,  \imm & 0xFFFF
> Similar issue to above - also please use tabs to indent.
>
>> @@ -0,0 +1,120 @@
>> +el3_payload:
>> +     /* disable the mmu for EL3 too */
>> +     mrs     x0, sctlr_el3
>> +     and     x0, x0, #~(1 << 0) // CTRL_M
>> +     msr     sctlr_el3, x0
>> +
>> +     /* jump back to our code, but now in EL3 */
>> +     movl    x0, CONFIG_SPL_TEXT_BASE
>> +     add     x0, x0, (el3_ret_point - _start)
>> +     br      x0
>> +el3_payload_end:
> After disabling the MMU in EL3 shouldn't you have an ISB before the branch?
>
> Regards,
> Simon

Re: [PATCH v2 07/10] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h

[Simon Glass]

Hi Michael,

On Fri, 17 Apr 2026 at 07:15, Michael Srba <Michael.Srba@seznam.cz> wrote:
>
> Hi,
>
> On 4/11/26 17:40, Simon Glass wrote:
> > Hi Michael,
> >
> > On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> >> mach-snapdragon: boot0.h: add sdm845_spl_boot0.h
> >>
> >> On sdm845, running u-boot SPL in EL3 requires escalting by using
> >> an unintentional feature in old builds of xbl_sec.elf. We do this
> >> in boot0.h so the rest of U-Boot can stay blissfully unaware
> >> of XBL_SEC. If we are already in EL3 for whatever reason, the
> >> code is skipped.
> >>
> >> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> >>
> >> arch/arm/mach-snapdragon/include/mach/boot0.h      |   4 +
> >>   .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++++
> >>   2 files changed, 124 insertions(+)
> >> diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
> >> @@ -0,0 +1,120 @@
> >> +.macro movl Wn, imm
> >> +    movz    \Xn,  \imm & 0xFFFF
> >> +    movk    \Xn, (\imm >> 16) & 0xFFFF, lsl 16
> >> +.endm
> > The macro parameter is named Wn but the body references \Xn - does
> > this actually build?
> I'm not sure why it displays like that for you, both for me locally and on
> https://lore.kernel.org/all/20260411-qcom_spl-v2-7-9609557cf562@seznam.cz/
> it displays correctly...

Yes I see it, thanks.

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

[PATCH v2 08/10] mach-snapdragon: add board-spl.c and split out common code

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Code in board.c will now only be compiled into U-Boot proper,
and the new board_spl.c will only be built into SPL.
Code in board_common.c is common to both phases.

Also split out mem_map.c, which is currently common to both
phases since it seems to not cause issues in SPL. In the future
it should probably behave differenly in SPL, especially if dram
initialization is supported.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/mach-snapdragon/Makefile       |   8 +
 arch/arm/mach-snapdragon/board.c        | 358 +-------------------------------
 arch/arm/mach-snapdragon/board_common.c |  56 +++++
 arch/arm/mach-snapdragon/board_spl.c    |  35 ++++
 arch/arm/mach-snapdragon/mem_map.c      | 318 ++++++++++++++++++++++++++++
 arch/arm/mach-snapdragon/qcom-priv.h    |   4 +-
 6 files changed, 429 insertions(+), 350 deletions(-)

diff --git a/arch/arm/mach-snapdragon/Makefile b/arch/arm/mach-snapdragon/Makefile
index 343e825c6fd..4b265b746ce 100644
--- a/arch/arm/mach-snapdragon/Makefile
+++ b/arch/arm/mach-snapdragon/Makefile
@@ -2,6 +2,14 @@
 #
 # (C) Copyright 2015 Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
 
+obj-y += board_common.o
+obj-y += mem_map.o
+
+ifeq ($(CONFIG_SPL_BUILD),y)
+obj-y += board_spl.o
+else
 obj-y += board.o
 obj-$(CONFIG_EFI_HAVE_CAPSULE_SUPPORT) += capsule_update.o
+endif
+
 obj-$(CONFIG_OF_LIVE) += of_fixup.o
diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
index 5fb3240acc5..00e1aba675b 100644
--- a/arch/arm/mach-snapdragon/board.c
+++ b/arch/arm/mach-snapdragon/board.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
  * Common initialisation for Qualcomm Snapdragon boards.
+ * U-Boot proper only, see board_common.c for parts shared with SPL
  *
  * Copyright (c) 2024 Linaro Ltd.
  * Author: Casey Connolly <casey.connolly@linaro.org>
@@ -9,155 +10,21 @@
 #define LOG_CATEGORY LOGC_BOARD
 #define pr_fmt(fmt) "QCOM: " fmt
 
-#include <asm/armv8/mmu.h>
-#include <asm/gpio.h>
-#include <asm/io.h>
-#include <asm/psci.h>
-#include <asm/system.h>
-#include <dm/device.h>
-#include <dm/pinctrl.h>
-#include <dm/uclass-internal.h>
-#include <dm/read.h>
-#include <power/regulator.h>
+#include <dm/ofnode.h>
 #include <env.h>
 #include <fdt_support.h>
 #include <init.h>
 #include <linux/arm-smccc.h>
-#include <linux/bug.h>
+#include <linux/errno.h>
 #include <linux/psci.h>
 #include <linux/sizes.h>
 #include <lmb.h>
-#include <malloc.h>
-#include <fdt_support.h>
-#include <usb.h>
-#include <sort.h>
-#include <time.h>
 
 #include "qcom-priv.h"
 
-DECLARE_GLOBAL_DATA_PTR;
-
 enum qcom_boot_source qcom_boot_source __section(".data") = 0;
 
-static struct mm_region rbx_mem_map[CONFIG_NR_DRAM_BANKS + 2] = { { 0 } };
-
-struct mm_region *mem_map = rbx_mem_map;
-
-static struct {
-	phys_addr_t start;
-	phys_size_t size;
-} prevbl_ddr_banks[CONFIG_NR_DRAM_BANKS] __section(".data") = { 0 };
-
-int dram_init(void)
-{
-	/*
-	 * gd->ram_base / ram_size have been setup already
-	 * in qcom_parse_memory().
-	 */
-	return 0;
-}
-
-static int ddr_bank_cmp(const void *v1, const void *v2)
-{
-	const struct {
-		phys_addr_t start;
-		phys_size_t size;
-	} *res1 = v1, *res2 = v2;
-
-	if (!res1->size)
-		return 1;
-	if (!res2->size)
-		return -1;
-
-	return (res1->start >> 24) - (res2->start >> 24);
-}
-
-/* This has to be done post-relocation since gd->bd isn't preserved */
-static void qcom_configure_bi_dram(void)
-{
-	int i;
-
-	for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
-		gd->bd->bi_dram[i].start = prevbl_ddr_banks[i].start;
-		gd->bd->bi_dram[i].size = prevbl_ddr_banks[i].size;
-	}
-}
-
-int dram_init_banksize(void)
-{
-	qcom_configure_bi_dram();
-
-	return 0;
-}
-
-/**
- * The generic memory parsing code in U-Boot lacks a few things that we
- * need on Qualcomm:
- *
- * 1. It sets gd->ram_size and gd->ram_base to represent a single memory block
- * 2. setup_dest_addr() later relocates U-Boot to ram_base + ram_size, the end
- *    of that first memory block.
- *
- * This results in all memory beyond U-Boot being unusable in Linux when booting
- * with EFI.
- *
- * Since the ranges in the memory node may be out of order, the only way for us
- * to correctly determine the relocation address for U-Boot is to parse all
- * memory regions and find the highest valid address.
- *
- * We can't use fdtdec_setup_memory_banksize() since it stores the result in
- * gd->bd, which is not yet allocated.
- *
- * @fdt: FDT blob to parse /memory node from
- *
- * Return: 0 on success or -ENODATA if /memory node is missing or incomplete
- */
-static int qcom_parse_memory(const void *fdt)
-{
-	int offset;
-	const fdt64_t *memory;
-	int memsize;
-	phys_addr_t ram_end = 0;
-	int i, j, banks;
-
-	offset = fdt_path_offset(fdt, "/memory");
-	if (offset < 0)
-		return -ENODATA;
-
-	memory = fdt_getprop(fdt, offset, "reg", &memsize);
-	if (!memory)
-		return -ENODATA;
-
-	banks = min(memsize / (2 * sizeof(u64)), (ulong)CONFIG_NR_DRAM_BANKS);
-
-	if (memsize / sizeof(u64) > CONFIG_NR_DRAM_BANKS * 2)
-		log_err("Provided more than the max of %d memory banks\n", CONFIG_NR_DRAM_BANKS);
-
-	if (banks > CONFIG_NR_DRAM_BANKS)
-		log_err("Provided more memory banks than we can handle\n");
-
-	for (i = 0, j = 0; i < banks * 2; i += 2, j++) {
-		prevbl_ddr_banks[j].start = get_unaligned_be64(&memory[i]);
-		prevbl_ddr_banks[j].size = get_unaligned_be64(&memory[i + 1]);
-		if (!prevbl_ddr_banks[j].size) {
-			j--;
-			continue;
-		}
-		ram_end = max(ram_end, prevbl_ddr_banks[j].start + prevbl_ddr_banks[j].size);
-	}
-
-	if (!banks || !prevbl_ddr_banks[0].size)
-		return -ENODATA;
-
-	/* Sort our RAM banks -_- */
-	qsort(prevbl_ddr_banks, banks, sizeof(prevbl_ddr_banks[0]), ddr_bank_cmp);
-
-	gd->ram_base = prevbl_ddr_banks[0].start;
-	gd->ram_size = ram_end - gd->ram_base;
-
-	return 0;
-}
-
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI)
 static void show_psci_version(void)
 {
 	struct arm_smccc_res res;
@@ -199,6 +66,7 @@ static void qcom_psci_fixup(void *fdt)
 	if (ret)
 		log_err("Failed to delete /psci node: %d\n", ret);
 }
+#endif
 
 /* We support booting U-Boot with an internal DT when running as a first-stage bootloader
  * or for supporting quirky devices where it's easier to leave the downstream DT in place
@@ -258,49 +126,13 @@ int board_fdt_blob_setup(void **fdtp)
 		ret = 0;
 	}
 
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI)
 	qcom_psci_fixup(*fdtp);
+#endif
 
 	return ret;
 }
 
-/*
- * Some Qualcomm boards require GPIO configuration when switching USB modes.
- * Support setting this configuration via pinctrl state.
- */
-int board_usb_init(int index, enum usb_init_type init)
-{
-	struct udevice *usb;
-	int ret = 0;
-
-	/* USB device */
-	ret = uclass_find_device_by_seq(UCLASS_USB, index, &usb);
-	if (ret) {
-		printf("Cannot find USB device\n");
-		return ret;
-	}
-
-	ret = dev_read_stringlist_search(usb, "pinctrl-names",
-					 "device");
-	/* No "device" pinctrl state, so just bail */
-	if (ret < 0)
-		return 0;
-
-	/* Select "default" or "device" pinctrl */
-	switch (init) {
-	case USB_INIT_HOST:
-		pinctrl_select_state(usb, "default");
-		break;
-	case USB_INIT_DEVICE:
-		pinctrl_select_state(usb, "device");
-		break;
-	default:
-		debug("Unknown usb_init_type %d\n", init);
-		break;
-	}
-
-	return 0;
-}
-
 /*
  * Some boards still need board specific init code, they can implement that by
  * overriding this function.
@@ -313,7 +145,9 @@ void __weak qcom_board_init(void)
 
 int board_init(void)
 {
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)
 	show_psci_version();
+#endif
 	qcom_board_init();
 	return 0;
 }
@@ -575,177 +409,3 @@ int board_late_init(void)
 
 	return 0;
 }
-
-static void build_mem_map(void)
-{
-	int i, j;
-
-	/*
-	 * Ensure the peripheral block is sized to correctly cover the address range
-	 * up to the first memory bank.
-	 * Don't map the first page to ensure that we actually trigger an abort on a
-	 * null pointer access rather than just hanging.
-	 * FIXME: we should probably split this into more precise regions
-	 */
-	mem_map[0].phys = 0x1000;
-	mem_map[0].virt = mem_map[0].phys;
-	mem_map[0].size = gd->bd->bi_dram[0].start - mem_map[0].phys;
-	mem_map[0].attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
-			 PTE_BLOCK_NON_SHARE |
-			 PTE_BLOCK_PXN | PTE_BLOCK_UXN;
-
-	for (i = 1, j = 0; i < ARRAY_SIZE(rbx_mem_map) - 1 && gd->bd->bi_dram[j].size; i++, j++) {
-		mem_map[i].phys = gd->bd->bi_dram[j].start;
-		mem_map[i].virt = mem_map[i].phys;
-		mem_map[i].size = gd->bd->bi_dram[j].size;
-		mem_map[i].attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | \
-				   PTE_BLOCK_INNER_SHARE;
-	}
-
-	mem_map[i].phys = UINT64_MAX;
-	mem_map[i].size = 0;
-
-#ifdef DEBUG
-	debug("Configured memory map:\n");
-	for (i = 0; mem_map[i].size; i++)
-		debug("  0x%016llx - 0x%016llx: entry %d\n",
-		      mem_map[i].phys, mem_map[i].phys + mem_map[i].size, i);
-#endif
-}
-
-u64 get_page_table_size(void)
-{
-	return SZ_1M;
-}
-
-static int fdt_cmp_res(const void *v1, const void *v2)
-{
-	const struct fdt_resource *res1 = v1, *res2 = v2;
-
-	return res1->start - res2->start;
-}
-
-#define N_RESERVED_REGIONS 32
-
-/* Mark all no-map regions as PTE_TYPE_FAULT to prevent speculative access.
- * On some platforms this is enough to trigger a security violation and trap
- * to EL3.
- */
-static void carve_out_reserved_memory(void)
-{
-	static struct fdt_resource res[N_RESERVED_REGIONS] = { 0 };
-	int parent, rmem, count, i = 0;
-	phys_addr_t start;
-	size_t size;
-
-	/* Some reserved nodes must be carved out, as the cache-prefetcher may otherwise
-	 * attempt to access them, causing a security exception.
-	 */
-	parent = fdt_path_offset(gd->fdt_blob, "/reserved-memory");
-	if (parent <= 0) {
-		log_err("No reserved memory regions found\n");
-		return;
-	}
-
-	/* Collect the reserved memory regions */
-	fdt_for_each_subnode(rmem, gd->fdt_blob, parent) {
-		const fdt32_t *ptr;
-		int len;
-		if (!fdt_getprop(gd->fdt_blob, rmem, "no-map", NULL))
-			continue;
-
-		if (i == N_RESERVED_REGIONS) {
-			log_err("Too many reserved regions!\n");
-			break;
-		}
-
-		/* Read the address and size out from the reg property. Doing this "properly" with
-		 * fdt_get_resource() takes ~70ms on SDM845, but open-coding the happy path here
-		 * takes <1ms... Oh the woes of no dcache.
-		 */
-		ptr = fdt_getprop(gd->fdt_blob, rmem, "reg", &len);
-		if (ptr) {
-			/* Qualcomm devices use #address/size-cells = <2> but all reserved regions are within
-			 * the 32-bit address space. So we can cheat here for speed.
-			 */
-			res[i].start = fdt32_to_cpu(ptr[1]);
-			res[i].end = res[i].start + fdt32_to_cpu(ptr[3]);
-			i++;
-		}
-	}
-
-	/* Sort the reserved memory regions by address */
-	count = i;
-	qsort(res, count, sizeof(struct fdt_resource), fdt_cmp_res);
-
-	/* Now set the right attributes for them. Often a lot of the regions are tightly packed together
-	 * so we can optimise the number of calls to mmu_change_region_attr() by combining adjacent
-	 * regions.
-	 */
-	start = ALIGN_DOWN(res[0].start, SZ_2M);
-	size = ALIGN(res[0].end - start, SZ_2M);
-	for (i = 1; i <= count; i++) {
-		/* We ideally want to 2M align everything for more efficient pagetables, but we must avoid
-		 * overwriting reserved memory regions which shouldn't be mapped as FAULT (like those with
-		 * compatible properties).
-		 * If within 2M of the previous region, bump the size to include this region. Otherwise
-		 * start a new region.
-		 */
-		if (i == count || start + size < res[i].start - SZ_2M) {
-			debug("  0x%016llx - 0x%016llx: reserved\n",
-			      start, start + size);
-			mmu_change_region_attr(start, size, PTE_TYPE_FAULT);
-			/* If this is the final region then quit here before we index
-			 * out of bounds...
-			 */
-			if (i == count)
-				break;
-			start = ALIGN_DOWN(res[i].start, SZ_2M);
-			size = ALIGN(res[i].end - start, SZ_2M);
-		} else {
-			/* Bump size if this region is immediately after the previous one */
-			size = ALIGN(res[i].end - start, SZ_2M);
-		}
-	}
-}
-
-/* This function open-codes setup_all_pgtables() so that we can
- * insert additional mappings *before* turning on the MMU.
- */
-void enable_caches(void)
-{
-	u64 tlb_addr = gd->arch.tlb_addr;
-	u64 tlb_size = gd->arch.tlb_size;
-	u64 pt_size;
-	ulong carveout_start;
-
-	gd->arch.tlb_fillptr = tlb_addr;
-
-	build_mem_map();
-
-	icache_enable();
-
-	/* Create normal system page tables */
-	setup_pgtables();
-
-	pt_size = (uintptr_t)gd->arch.tlb_fillptr -
-		  (uintptr_t)gd->arch.tlb_addr;
-	debug("Primary pagetable size: %lluKiB\n", pt_size / 1024);
-
-	/* Create emergency page tables */
-	gd->arch.tlb_size -= pt_size;
-	gd->arch.tlb_addr = gd->arch.tlb_fillptr;
-	setup_pgtables();
-	gd->arch.tlb_emerg = gd->arch.tlb_addr;
-	gd->arch.tlb_addr = tlb_addr;
-	gd->arch.tlb_size = tlb_size;
-
-	/* We do the carveouts only for QCS404, for now. */
-	if (fdt_node_check_compatible(gd->fdt_blob, 0, "qcom,qcs404") == 0) {
-		carveout_start = get_timer(0);
-		/* Takes ~20-50ms on SDM845 */
-		carve_out_reserved_memory();
-		debug("carveout time: %lums\n", get_timer(carveout_start));
-	}
-	dcache_enable();
-}
diff --git a/arch/arm/mach-snapdragon/board_common.c b/arch/arm/mach-snapdragon/board_common.c
new file mode 100644
index 00000000000..f6daeb6edf4
--- /dev/null
+++ b/arch/arm/mach-snapdragon/board_common.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Common initialisation for Qualcomm Snapdragon boards.
+ *
+ * Copyright (c) 2024 Linaro Ltd.
+ * Author: Casey Connolly <casey.connolly@linaro.org>
+ */
+
+#define LOG_CATEGORY LOGC_BOARD
+#define pr_fmt(fmt) "QCOM: " fmt
+
+#include <dm/device.h>
+#include <dm/pinctrl.h>
+#include <dm/uclass-internal.h>
+#include <dm/read.h>
+#include <usb.h>
+
+#include "qcom-priv.h"
+
+/*
+ * Some Qualcomm boards require GPIO configuration when switching USB modes.
+ * Support setting this configuration via pinctrl state.
+ */
+int board_usb_init(int index, enum usb_init_type init)
+{
+	struct udevice *usb;
+	int ret = 0;
+
+	/* USB device */
+	ret = uclass_find_device_by_seq(UCLASS_USB, index, &usb);
+	if (ret) {
+		printf("Cannot find USB device\n");
+		return ret;
+	}
+
+	ret = dev_read_stringlist_search(usb, "pinctrl-names",
+					 "device");
+	/* No "device" pinctrl state, so just bail */
+	if (ret < 0)
+		return 0;
+
+	/* Select "default" or "device" pinctrl */
+	switch (init) {
+	case USB_INIT_HOST:
+		pinctrl_select_state(usb, "default");
+		break;
+	case USB_INIT_DEVICE:
+		pinctrl_select_state(usb, "device");
+		break;
+	default:
+		debug("Unknown usb_init_type %d\n", init);
+		break;
+	}
+
+	return 0;
+}
diff --git a/arch/arm/mach-snapdragon/board_spl.c b/arch/arm/mach-snapdragon/board_spl.c
new file mode 100644
index 00000000000..19260975063
--- /dev/null
+++ b/arch/arm/mach-snapdragon/board_spl.c
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Common SPL code for Qualcomm Snapdragon boards.
+ *
+ * Copyright (c) 2026 Michael Srba <Michael.Srba@seznam.cz>
+ */
+
+#include <hang.h>
+#include <spl.h>
+
+/* in SPL, we always use internal DT */
+int board_fdt_blob_setup(void **fdtp)
+{
+	return -EEXIST;
+}
+
+int board_init(void)
+{
+	return 0;
+}
+
+__weak void reset_cpu(void)
+{
+	/* This should currently not get called in non-error paths, so just hang */
+	printf("reset_cpu called, going to hang()\n");
+	hang();
+}
+
+u32 spl_boot_device(void)
+{
+	/* TODO: check boot reason to support UFS and sdcard */
+	u32 boot_device = BOOT_DEVICE_DFU;
+
+	return boot_device;
+}
diff --git a/arch/arm/mach-snapdragon/mem_map.c b/arch/arm/mach-snapdragon/mem_map.c
new file mode 100644
index 00000000000..70e3c1d1fcc
--- /dev/null
+++ b/arch/arm/mach-snapdragon/mem_map.c
@@ -0,0 +1,318 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Common initialisation for Qualcomm Snapdragon boards.
+ *
+ * Copyright (c) 2024 Linaro Ltd.
+ * Author: Casey Connolly <casey.connolly@linaro.org>
+ */
+
+#define LOG_CATEGORY LOGC_BOARD
+#define pr_fmt(fmt) "QCOM: " fmt
+
+#include <asm/armv8/mmu.h>
+#include <asm/global_data.h>
+#include <asm/system.h>
+#include <asm-generic/unaligned.h>
+#include <cpu_func.h>
+#include <fdt_support.h>
+#include <linux/errno.h>
+#include <linux/sizes.h>
+#include <sort.h>
+#include <time.h>
+
+#include "qcom-priv.h"
+
+DECLARE_GLOBAL_DATA_PTR;
+
+static struct mm_region rbx_mem_map[CONFIG_NR_DRAM_BANKS + 2] = { { 0 } };
+
+struct mm_region *mem_map = rbx_mem_map;
+
+static struct {
+	phys_addr_t start;
+	phys_size_t size;
+} prevbl_ddr_banks[CONFIG_NR_DRAM_BANKS] __section(".data") = { 0 };
+
+int dram_init(void)
+{
+	/*
+	 * gd->ram_base / ram_size have been setup already
+	 * in qcom_parse_memory().
+	 */
+	return 0;
+}
+
+static int ddr_bank_cmp(const void *v1, const void *v2)
+{
+	const struct {
+		phys_addr_t start;
+		phys_size_t size;
+	} *res1 = v1, *res2 = v2;
+
+	if (!res1->size)
+		return 1;
+	if (!res2->size)
+		return -1;
+
+	return (res1->start >> 24) - (res2->start >> 24);
+}
+
+/* This has to be done post-relocation since gd->bd isn't preserved */
+static void qcom_configure_bi_dram(void)
+{
+	int i;
+
+	for (i = 0; i < CONFIG_NR_DRAM_BANKS; i++) {
+		gd->bd->bi_dram[i].start = prevbl_ddr_banks[i].start;
+		gd->bd->bi_dram[i].size = prevbl_ddr_banks[i].size;
+	}
+}
+
+int dram_init_banksize(void)
+{
+	qcom_configure_bi_dram();
+
+	return 0;
+}
+
+/**
+ * The generic memory parsing code in U-Boot lacks a few things that we
+ * need on Qualcomm:
+ *
+ * 1. It sets gd->ram_size and gd->ram_base to represent a single memory block
+ * 2. setup_dest_addr() later relocates U-Boot to ram_base + ram_size, the end
+ *    of that first memory block.
+ *
+ * This results in all memory beyond U-Boot being unusable in Linux when booting
+ * with EFI.
+ *
+ * Since the ranges in the memory node may be out of order, the only way for us
+ * to correctly determine the relocation address for U-Boot is to parse all
+ * memory regions and find the highest valid address.
+ *
+ * We can't use fdtdec_setup_memory_banksize() since it stores the result in
+ * gd->bd, which is not yet allocated.
+ *
+ * @fdt: FDT blob to parse /memory node from
+ *
+ * Return: 0 on success or -ENODATA if /memory node is missing or incomplete
+ */
+int qcom_parse_memory(const void *fdt)
+{
+	int offset;
+	const fdt64_t *memory;
+	int memsize;
+	phys_addr_t ram_end = 0;
+	int i, j, banks;
+
+	offset = fdt_path_offset(fdt, "/memory");
+	if (offset < 0)
+		return -ENODATA;
+
+	memory = fdt_getprop(fdt, offset, "reg", &memsize);
+	if (!memory)
+		return -ENODATA;
+
+	banks = min(memsize / (2 * sizeof(u64)), (ulong)CONFIG_NR_DRAM_BANKS);
+
+	if (memsize / sizeof(u64) > CONFIG_NR_DRAM_BANKS * 2)
+		log_err("Provided more than the max of %d memory banks\n", CONFIG_NR_DRAM_BANKS);
+
+	if (banks > CONFIG_NR_DRAM_BANKS)
+		log_err("Provided more memory banks than we can handle\n");
+
+	for (i = 0, j = 0; i < banks * 2; i += 2, j++) {
+		prevbl_ddr_banks[j].start = get_unaligned_be64(&memory[i]);
+		prevbl_ddr_banks[j].size = get_unaligned_be64(&memory[i + 1]);
+		if (!prevbl_ddr_banks[j].size) {
+			j--;
+			continue;
+		}
+		ram_end = max(ram_end, prevbl_ddr_banks[j].start + prevbl_ddr_banks[j].size);
+	}
+
+	if (!banks || !prevbl_ddr_banks[0].size)
+		return -ENODATA;
+
+	/* Sort our RAM banks -_- */
+	qsort(prevbl_ddr_banks, banks, sizeof(prevbl_ddr_banks[0]), ddr_bank_cmp);
+
+	gd->ram_base = prevbl_ddr_banks[0].start;
+	gd->ram_size = ram_end - gd->ram_base;
+
+	return 0;
+}
+
+static void build_mem_map(void)
+{
+	int i, j;
+
+	/*
+	 * Ensure the peripheral block is sized to correctly cover the address range
+	 * up to the first memory bank.
+	 * Don't map the first page to ensure that we actually trigger an abort on a
+	 * null pointer access rather than just hanging.
+	 * FIXME: we should probably split this into more precise regions
+	 */
+	mem_map[0].phys = 0x1000;
+	mem_map[0].virt = mem_map[0].phys;
+	mem_map[0].size = gd->bd->bi_dram[0].start - mem_map[0].phys;
+	mem_map[0].attrs = PTE_BLOCK_MEMTYPE(MT_DEVICE_NGNRNE) |
+			 PTE_BLOCK_NON_SHARE |
+			 PTE_BLOCK_PXN | PTE_BLOCK_UXN;
+
+	for (i = 1, j = 0; i < ARRAY_SIZE(rbx_mem_map) - 1 && gd->bd->bi_dram[j].size; i++, j++) {
+		mem_map[i].phys = gd->bd->bi_dram[j].start;
+		mem_map[i].virt = mem_map[i].phys;
+		mem_map[i].size = gd->bd->bi_dram[j].size;
+		mem_map[i].attrs = PTE_BLOCK_MEMTYPE(MT_NORMAL) | \
+				   PTE_BLOCK_INNER_SHARE;
+	}
+
+	mem_map[i].phys = UINT64_MAX;
+	mem_map[i].size = 0;
+
+#ifdef DEBUG
+	debug("Configured memory map:\n");
+	for (i = 0; mem_map[i].size; i++)
+		debug("  0x%016llx - 0x%016llx: entry %d\n",
+		      mem_map[i].phys, mem_map[i].phys + mem_map[i].size, i);
+#endif
+}
+
+u64 get_page_table_size(void)
+{
+	return SZ_1M;
+}
+
+static int fdt_cmp_res(const void *v1, const void *v2)
+{
+	const struct fdt_resource *res1 = v1, *res2 = v2;
+
+	return res1->start - res2->start;
+}
+
+#define N_RESERVED_REGIONS 32
+
+/* Mark all no-map regions as PTE_TYPE_FAULT to prevent speculative access.
+ * On some platforms this is enough to trigger a security violation and trap
+ * to EL3.
+ */
+static void carve_out_reserved_memory(void)
+{
+	static struct fdt_resource res[N_RESERVED_REGIONS] = { 0 };
+	int parent, rmem, count, i = 0;
+	phys_addr_t start;
+	size_t size;
+
+	/* Some reserved nodes must be carved out, as the cache-prefetcher may otherwise
+	 * attempt to access them, causing a security exception.
+	 */
+	parent = fdt_path_offset(gd->fdt_blob, "/reserved-memory");
+	if (parent <= 0) {
+		log_err("No reserved memory regions found\n");
+		return;
+	}
+
+	/* Collect the reserved memory regions */
+	fdt_for_each_subnode(rmem, gd->fdt_blob, parent) {
+		const fdt32_t *ptr;
+		int len;
+		if (!fdt_getprop(gd->fdt_blob, rmem, "no-map", NULL))
+			continue;
+
+		if (i == N_RESERVED_REGIONS) {
+			log_err("Too many reserved regions!\n");
+			break;
+		}
+
+		/* Read the address and size out from the reg property. Doing this "properly" with
+		 * fdt_get_resource() takes ~70ms on SDM845, but open-coding the happy path here
+		 * takes <1ms... Oh the woes of no dcache.
+		 */
+		ptr = fdt_getprop(gd->fdt_blob, rmem, "reg", &len);
+		if (ptr) {
+			/* Qualcomm devices use #address/size-cells = <2> but all reserved regions are within
+			 * the 32-bit address space. So we can cheat here for speed.
+			 */
+			res[i].start = fdt32_to_cpu(ptr[1]);
+			res[i].end = res[i].start + fdt32_to_cpu(ptr[3]);
+			i++;
+		}
+	}
+
+	/* Sort the reserved memory regions by address */
+	count = i;
+	qsort(res, count, sizeof(struct fdt_resource), fdt_cmp_res);
+
+	/* Now set the right attributes for them. Often a lot of the regions are tightly packed together
+	 * so we can optimise the number of calls to mmu_change_region_attr() by combining adjacent
+	 * regions.
+	 */
+	start = ALIGN_DOWN(res[0].start, SZ_2M);
+	size = ALIGN(res[0].end - start, SZ_2M);
+	for (i = 1; i <= count; i++) {
+		/* We ideally want to 2M align everything for more efficient pagetables, but we must avoid
+		 * overwriting reserved memory regions which shouldn't be mapped as FAULT (like those with
+		 * compatible properties).
+		 * If within 2M of the previous region, bump the size to include this region. Otherwise
+		 * start a new region.
+		 */
+		if (i == count || start + size < res[i].start - SZ_2M) {
+			debug("  0x%016llx - 0x%016llx: reserved\n",
+			      start, start + size);
+			mmu_change_region_attr(start, size, PTE_TYPE_FAULT);
+			/* If this is the final region then quit here before we index
+			 * out of bounds...
+			 */
+			if (i == count)
+				break;
+			start = ALIGN_DOWN(res[i].start, SZ_2M);
+			size = ALIGN(res[i].end - start, SZ_2M);
+		} else {
+			/* Bump size if this region is immediately after the previous one */
+			size = ALIGN(res[i].end - start, SZ_2M);
+		}
+	}
+}
+
+/* This function open-codes setup_all_pgtables() so that we can
+ * insert additional mappings *before* turning on the MMU.
+ */
+void enable_caches(void)
+{
+	u64 tlb_addr = gd->arch.tlb_addr;
+	u64 tlb_size = gd->arch.tlb_size;
+	u64 pt_size;
+	ulong carveout_start;
+
+	gd->arch.tlb_fillptr = tlb_addr;
+
+	build_mem_map();
+
+	icache_enable();
+
+	/* Create normal system page tables */
+	setup_pgtables();
+
+	pt_size = (uintptr_t)gd->arch.tlb_fillptr -
+		  (uintptr_t)gd->arch.tlb_addr;
+	debug("Primary pagetable size: %lluKiB\n", pt_size / 1024);
+
+	/* Create emergency page tables */
+	gd->arch.tlb_size -= pt_size;
+	gd->arch.tlb_addr = gd->arch.tlb_fillptr;
+	setup_pgtables();
+	gd->arch.tlb_emerg = gd->arch.tlb_addr;
+	gd->arch.tlb_addr = tlb_addr;
+	gd->arch.tlb_size = tlb_size;
+
+	/* We do the carveouts only for QCS404, for now. */
+	if (fdt_node_check_compatible(gd->fdt_blob, 0, "qcom,qcs404") == 0) {
+		carveout_start = get_timer(0);
+		/* Takes ~20-50ms on SDM845 */
+		carve_out_reserved_memory();
+		debug("carveout time: %lums\n", get_timer(carveout_start));
+	}
+	dcache_enable();
+}
diff --git a/arch/arm/mach-snapdragon/qcom-priv.h b/arch/arm/mach-snapdragon/qcom-priv.h
index b8bf574e8bb..b372465d125 100644
--- a/arch/arm/mach-snapdragon/qcom-priv.h
+++ b/arch/arm/mach-snapdragon/qcom-priv.h
@@ -20,7 +20,9 @@ extern enum qcom_boot_source qcom_boot_source;
 #if IS_ENABLED(CONFIG_EFI_HAVE_CAPSULE_SUPPORT)
 void qcom_configure_capsule_updates(void);
 #else
-void qcom_configure_capsule_updates(void) {}
+static inline void qcom_configure_capsule_updates(void) {}
 #endif /* EFI_HAVE_CAPSULE_SUPPORT */
 
+int qcom_parse_memory(const void *fdt);
+
 #endif /* __QCOM_PRIV_H__ */

-- 
2.53.0

Re: [PATCH v2 08/10] mach-snapdragon: add board-spl.c and split out common code

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: add board-spl.c and split out common code
>
> Code in board.c will now only be compiled into U-Boot proper,
> and the new board_spl.c will only be built into SPL.
> Code in board_common.c is common to both phases.
>
> Also split out mem_map.c, which is currently common to both
> phases since it seems to not cause issues in SPL. In the future
> it should probably behave differenly in SPL, especially if dram
> initialization is supported.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> arch/arm/mach-snapdragon/Makefile       |   8 +
>  arch/arm/mach-snapdragon/board.c        | 358 +-------------------------------
>  arch/arm/mach-snapdragon/board_common.c |  56 +++++
>  arch/arm/mach-snapdragon/board_spl.c    |  35 ++++
>  arch/arm/mach-snapdragon/mem_map.c      | 318 ++++++++++++++++++++++++++++
>  arch/arm/mach-snapdragon/qcom-priv.h    |   4 +-
>  6 files changed, 429 insertions(+), 350 deletions(-)

The commit subject says board-spl.c but should say board_spl.c

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

[PATCH v2 09/10] qualcomm: add defconfig, env and docs for SPL on sdm845

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

The defconfig should in principle be board-agnostic. Environment
simply contains a dfu env specifying where to load u-boot proper
(TEXT_BASE - 64).

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 board/qualcomm/sdm845_spl.env |   2 +
 configs/sdm845_spl_defconfig  | 131 ++++++++++++++++++++++++++++++++++++++++++
 doc/board/qualcomm/index.rst  |   1 +
 doc/board/qualcomm/spl.rst    |  87 ++++++++++++++++++++++++++++
 4 files changed, 221 insertions(+)

diff --git a/board/qualcomm/sdm845_spl.env b/board/qualcomm/sdm845_spl.env
new file mode 100644
index 00000000000..2396d003b0c
--- /dev/null
+++ b/board/qualcomm/sdm845_spl.env
@@ -0,0 +1,2 @@
+# U-Boot proper text base - 64
+dfu_alt_info_ram=uboot.bin ram 0x1487FFC0 0x180000
diff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig
new file mode 100644
index 00000000000..16fec80500f
--- /dev/null
+++ b/configs/sdm845_spl_defconfig
@@ -0,0 +1,131 @@
+CONFIG_ARM=y
+CONFIG_SKIP_LOWLEVEL_INIT=y
+CONFIG_COUNTER_FREQUENCY=19200000
+CONFIG_POSITION_INDEPENDENT=y
+# CONFIG_INIT_SP_RELATIVE is not set
+CONFIG_ARCH_SNAPDRAGON=y
+CONFIG_TEXT_BASE=0x14880000
+CONFIG_SYS_MALLOC_LEN=0x20000
+CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
+CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x146bffff
+CONFIG_SPL_SERIAL=y
+CONFIG_SPL_DRIVERS_MISC=y
+CONFIG_SPL_BSS_MAX_SIZE=0x20000
+CONFIG_SYS_BOOTM_LEN=0x4000000
+CONFIG_SYS_LOAD_ADDR=0x0
+CONFIG_WATCHDOG_TIMEOUT_MSECS=60000
+CONFIG_SPL_TARGET_SDM845=y
+CONFIG_SPL_MAX_SIZE=0x0
+CONFIG_SPL=y
+CONFIG_SPL_PAYLOAD="u-boot.img"
+CONFIG_SKIP_RELOCATE=y
+# CONFIG_EFI_LOADER is not set
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_USE_PREBOOT=y
+CONFIG_CONSOLE_RECORD=y
+CONFIG_CONSOLE_RECORD_OUT_SIZE=0xA000
+CONFIG_CONSOLE_RECORD_OUT_SIZE_F=0xA000
+CONFIG_LOGLEVEL=9
+CONFIG_SYS_STDIO_DEREGISTER=y
+CONFIG_LOG_MAX_LEVEL=9
+CONFIG_SPL_LOG=y
+CONFIG_SPL_LOG_MAX_LEVEL=9
+# CONFIG_DISPLAY_CPUINFO is not set
+CONFIG_SPL_DMA=y
+CONFIG_SPL_DM_RESET=y
+CONFIG_SPL_POWER_DOMAIN=y
+CONFIG_BOOTM_NETBSD=y
+CONFIG_CMD_CLK=y
+CONFIG_CMD_DFU=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_UFS=y
+CONFIG_CMD_CAT=y
+CONFIG_CMD_RNG=y
+CONFIG_CMD_REGULATOR=y
+CONFIG_CMD_LOG=y
+CONFIG_OF_UPSTREAM_BUILD_VENDOR=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="board/qualcomm/sdm845_spl.env"
+CONFIG_NET_RANDOM_ETHADDR=y
+# CONFIG_OFNODE_MULTI_TREE is not set
+CONFIG_BUTTON_QCOM_PMIC=y
+CONFIG_CLK=y
+CONFIG_SPL_CLK=y
+CONFIG_CLK_STUB=y
+CONFIG_SPL_CLK_STUB=y
+CONFIG_CLK_QCOM_SDM845=y
+CONFIG_DFU_MMC=y
+CONFIG_DFU_RAM=y
+CONFIG_DFU_SCSI=y
+CONFIG_SYS_DFU_DATA_BUF_SIZE=0x5000
+CONFIG_DMA=y
+CONFIG_DMA_CHANNELS=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_BUF_ADDR=0xdeadbeef
+CONFIG_MSM_GPIO=y
+CONFIG_QCOM_PMIC_GPIO=y
+CONFIG_DM_I2C=y
+CONFIG_SYS_I2C_QUP=y
+CONFIG_I2C_MUX=y
+CONFIG_IOMMU=y
+CONFIG_QCOM_HYP_SMMU=y
+CONFIG_MISC=y
+CONFIG_NVMEM=y
+CONFIG_I2C_EEPROM=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ADMA=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY=y
+CONFIG_SPL_PHY=y
+CONFIG_PHY_QCOM_QMP_UFS=y
+CONFIG_PHY_QCOM_QUSB2=y
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y
+CONFIG_PHY_QCOM_SNPS_EUSB2=y
+CONFIG_PHY_QCOM_USB_HS_28NM=y
+CONFIG_PHY_QCOM_USB_SS=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_QCOM_APQ8016=y
+CONFIG_PINCTRL_QCOM_APQ8096=y
+CONFIG_PINCTRL_QCOM_QCM2290=y
+CONFIG_PINCTRL_QCOM_QCS404=y
+CONFIG_PINCTRL_QCOM_SDM845=y
+CONFIG_PINCTRL_QCOM_SM6115=y
+CONFIG_PINCTRL_QCOM_SM8250=y
+CONFIG_PINCTRL_QCOM_SM8550=y
+CONFIG_PINCTRL_QCOM_SM8650=y
+CONFIG_PINCTRL_QCOM_X1E80100=y
+CONFIG_DM_PMIC=y
+CONFIG_PMIC_QCOM=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_QCOM_RPMH=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MSM=y
+CONFIG_SCSI=y
+CONFIG_MSM_SERIAL=y
+CONFIG_SOC_QCOM=y
+CONFIG_QCOM_COMMAND_DB=y
+CONFIG_QCOM_RPMH=y
+CONFIG_SPL_SPMI=y
+CONFIG_SPMI_MSM=y
+CONFIG_SYSINFO=y
+CONFIG_SYSINFO_SMBIOS=y
+CONFIG_SYSRESET_QCOM_PSHOLD=y
+CONFIG_USB=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_GENERIC=y
+CONFIG_SPL_USB_DWC3_GENERIC=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_VENDOR_NUM=0x0525
+CONFIG_USB_GADGET_PRODUCT_NUM=0xb4a4
+CONFIG_USB_ETHER=y
+CONFIG_USB_ETH_CDC=y
+CONFIG_SPL_DFU=y
+CONFIG_SPL_USB_SDP_SUPPORT=y
+CONFIG_UFS=y
+# CONFIG_SPL_USE_TINY_PRINTF is not set
+CONFIG_CIRCBUF=y
diff --git a/doc/board/qualcomm/index.rst b/doc/board/qualcomm/index.rst
index 3238a68e859..65e3e222f68 100644
--- a/doc/board/qualcomm/index.rst
+++ b/doc/board/qualcomm/index.rst
@@ -14,3 +14,4 @@ Qualcomm
    iq8
    phones
    rdp
+   spl
diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
new file mode 100644
index 00000000000..a990cc907c1
--- /dev/null
+++ b/doc/board/qualcomm/spl.rst
@@ -0,0 +1,87 @@
+.. SPDX-License-Identifier: GPL-2.0+
+.. sectionauthor:: Michael Srba <Michael.Srba@seznam.cz>
+
+======================================
+Booting U-Boot SPL on Qualcomm SoCs
+======================================
+
+Overview
+--------
+The boot process on sdm845 (and some other Qualcomm SoCs) starts with the bootrom
+of the Application Processor, which executes XBL_SEC, which jumps to "OEM" code
+in EL1. Production device typically are "fused", with a hash of the OEM's signing
+key burnt into one of the "QFUSE" banks on the SoC making it impossible to run
+custom bootloader code. As a result U-Boot SPL is only supported on unfused
+("secureboot off") devices. XBL_SEC is always signed by qualcomm, and the fuses
+to disable turning off signature verification for it are always burnt at the
+factory, so replacing XBL_SEC is impossible without using JTAG. Of course JTAG
+is typically disabled on devices that have secure boot enabled, or at minimum
+greatly neutered.
+
+U-Boot SPL for Qualcomm platforms uses a custom linker script (per SoC) to build a bootable ELF.
+For sdm845 (and some other platforms) this has two sections, u-boot code and an embedded
+xbl_sec elf (signed by qualcomm). To boot on an unfused SoC, the elf additionally
+needs to have hash sections added, which can be accomplished with qtestsign.
+
+Currently, sdm845 is supported. You need a device with secure boot disabled
+(or with secure boot enabled if you enabled it yourself and have the private key,
+though for full security you'd also want to disable JTAG which will remove your ability
+to mess with the control flow in the bootrom (immutable) and in XBL_SEC (signed)).
+
+Building
+--------
+First, obtain an xbl_sec that includes the EL3 privilege escalation feature
+and place it at .output/xbl_sec.elf. You can extract it from an xbl elf.
+If you're unable to find one, you can also use JTAG/SWD to break at the SMC
+entry and use gdp to jump to the u-boot entry point in EL3.
+
+To build a bootable image, you need to use a defconfig specific to your SoC.
+This is because the ELF has to specify where in the address space to put u-boot SPL,
+and this may differ per SoC. There may be other SoC-dependent build time choices,
+though in principle those could be made at runtime.
+
+``make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl sdm845_spl_defconfig``
+
+Then compile u-boot and specify the dts for your board (technically nothing about the resulting
+SPL image should be board-specific, but there are no non-board-specific device trees in Linux)
+
+``make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl``
+
+Finally, use ``qtestsign`` to add the hash segments required by PBL
+
+``qtestsign -v 5 -o .output/spl/u-boot-spl_signed.elf prog .output/spl/u-boot-spl.elf``
+
+Running
+-------
+Currently, U-Boot SPL for qualcomm platforms expects to be booted via EDL:
+
+``edl.py --loader=$PWD/.output/spl/u-boot-spl_signed.elf``
+
+SPL will then launch the DFU gadget and wait for you to upload u-boot proper:
+
+``dfu-util -RD .output/u-boot.img``
+
+u-boot proper will then likely crash, since SPL currently doesn't init DRAM on qualcomm platforms
+and u-boot proper currently doesn't support running from SRAM. The latter should be an easy fix.
+
+Notes on memory map
+-------------------
+There are various banks of SRAM on a Qualcomm SoC that we can use prior to DRAM init.
+For example:
+msm8916 - 512K L2-as-TCM (at 0x08000000), 16K OCIMEM (at 0x08600000)
+msm8998 - 1M L2-as-TCM (at 0x14000000), 256K OCIMEM (at 0x14680000)
+sdm845 - 1.5M BOOT_IMEM (0x14800000), 256K OCIMEM (at 0x14680000)
+
+There's also RPM code/data RAM and hexagon TCMs, but unless we want to boot dram-less Linux
+we can probably safely ignore those. On msm8916 they may come in handy though.
+
+sdm845 can also have 8M LLCC-as-TCM in theory, but this appears to be broken.
+L2-as-TCM is no longer present.
+
+Since a limited amount of not necessarily continuous SRAM is available, we need to manually
+specify where .text, .bss, the malloc pool and the stack go. The Kconfig contains reasonable
+defaults per SoC.
+
+On sdm845, we by default put U-Boot SPL in BOOT_IMEM, with .bss, malloc pool and the stack
+filling OCIMEM. We can also fit U-Boot proper in BOOT_IMEM, for dram-less DFU or peek/poke
+with a shell.

-- 
2.53.0

Re: [PATCH v2 09/10] qualcomm: add defconfig, env and docs for SPL on sdm845

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> qualcomm: add defconfig, env and docs for SPL on sdm845
>
> The defconfig should in principle be board-agnostic. Environment
> simply contains a dfu env specifying where to load u-boot proper
> (TEXT_BASE - 64).
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>
> board/qualcomm/sdm845_spl.env |   2 +
>  configs/sdm845_spl_defconfig  | 131 ++++++++++++++++++++++++++++++++++++++++++
>  doc/board/qualcomm/index.rst  |   1 +
>  doc/board/qualcomm/spl.rst    |  87 ++++++++++++++++++++++++++++
>  4 files changed, 221 insertions(+)

> diff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig
> +CONFIG_SPL_TARGET_SDM845=y
> +CONFIG_SPL_MAX_SIZE=0x0

Setting SPL_MAX_SIZE to 0x0 disables size checking entirely. Is that intended?

> diff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig
> +CONFIG_SPL_BSS_MAX_SIZE=0x20000

This conflicts with the Kconfig default of 0x2000 for
SPL_TARGET_SDM845. If 0x20000 is intentional, please can you also
update the Kconfig default, since the comment there says 'leaves
0x1e000 for the stack in worst case' which would no longer be true.

> diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
> +If you're unable to find one, you can also use JTAG/SWD to break at the SMC
> +entry and use gdp to jump to the u-boot entry point in EL3.

gdb

> diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
> +`make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl sdm845_spl_defconfig
> +
> +Then compile u-boot and specify the dts for your board

Please can you use :: and indented code blocks for commands, matching
the style in board.rst and dragonboard410c.rst.

Regards,
Simon

Re: [PATCH v2 09/10] qualcomm: add defconfig, env and docs for SPL on sdm845

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 635 bytes --]

On Sat, Apr 11, 2026 at 02:00:14AM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> The defconfig should in principle be board-agnostic. Environment
> simply contains a dfu env specifying where to load u-boot proper
> (TEXT_BASE - 64).
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
[snip]
> +======================================
> +Booting U-Boot SPL on Qualcomm SoCs
> +======================================

That's a doc error (too many =), please put the next iteration through
CI: https://docs.u-boot.org/en/latest/develop/ci_testing.html
Thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[PATCH v2 10/10] dts: add u-boot specific sdm845 .dtsi a .dtsi for shift-axolotl

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

The board .dtsi just includes the SoC-specific .dtsi, which
adds bootph-all markings to upstream dts nodes which are
needed in SPL.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi |  2 ++
 arch/arm/dts/sdm845-u-boot.dtsi               | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
new file mode 100644
index 00000000000..d41210ab23a
--- /dev/null
+++ b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
@@ -0,0 +1,2 @@
+// SPDX-License-Identifier: GPL-2.0
+#include "sdm845-u-boot.dtsi"
diff --git a/arch/arm/dts/sdm845-u-boot.dtsi b/arch/arm/dts/sdm845-u-boot.dtsi
new file mode 100644
index 00000000000..b029264555b
--- /dev/null
+++ b/arch/arm/dts/sdm845-u-boot.dtsi
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0
+&gcc {
+	bootph-all;
+};
+
+&usb_1_hsphy {
+	bootph-all;
+};
+
+&usb_1_dwc3 {
+	bootph-all;
+};
+
+&rpmhcc {
+	bootph-all;
+};

-- 
2.53.0

Re: [PATCH v2 10/10] dts: add u-boot specific sdm845 .dtsi a .dtsi for shift-axolotl

[Simon Glass]

Hi Michael,

On 2026-04-11T00:00:12, Michael Srba <michael.srba@seznam.cz> wrote:
> dts: add u-boot specific sdm845 .dtsi a .dtsi for shift-axolotl
>
> The board .dtsi just includes the SoC-specific .dtsi, which
> adds bootph-all markings to upstream dts nodes which are
> needed in SPL.
>
> Signed-off-by: Michael Srba <Michael.Srba@Seznam.cz>
>
> arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi |  2 ++
>  arch/arm/dts/sdm845-u-boot.dtsi               | 16 ++++++++++++++++
>  2 files changed, 18 insertions(+)

> diff --git a/arch/arm/dts/sdm845-u-boot.dtsi b/arch/arm/dts/sdm845-u-boot.dtsi
> @@ -0,0 +1,16 @@
> +&usb_1_dwc3 {
> +     bootph-all;
> +};

This relies on propagation to parents but should be OK.

The commit subject is missing the word 'and'

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon