[PATCH v9 0/8] arm: snapdragon: Add snagboot support for Lemans-EVK

[PATCH v9 0/8] arm: snapdragon: Add snagboot support for Lemans-EVK

[Balaji Selvanathan]

This series adds support for running U-Boot in snagboot mode on
Qualcomm Snapdragon platforms, targeting the Lemans-EVK board.

Snagboot is an open-source, scriptable flashing framework that provides
an alternative to the proprietary Firehose protocol for device
provisioning. Like the traditional EDL+Firehose flow, Snagboot uses the
Qualcomm boot ROM EDL mode and Sahara protocol to download
and execute bootloaders. However, instead of using the proprietary
Firehose programmer, Snagboot loads U-Boot into DDR and uses the
standard fastboot protocol for device flashing.

The framework consists of three modular components: snagrecover
(downloads XBL/QCLib to initialize DDR and load U-Boot into RAM),
snagflash (communicates with U-Boot over USB using fastboot to flash
system images), and snagfactory (orchestrates parallel factory
flashing tasks).

In the snagboot execution flow, ROM code in EDL mode loads
snagrecover, which downloads XBL to internal memory. XBL executes
and initializes DDR, then snagrecover downloads U-Boot into DDR and
transfers control to it. At this point, XBL has left the MMU enabled
with its own page tables and has not initialized PSCI firmware or
populated the Command DB. U-Boot must handle this non-standard boot
environment to enter fastboot mode for device flashing.

Support for Qualcomm Lemans-EVK SOC in Snagboot is available in
https://github.com/bootlin/snagboot

When U-Boot executes in Snagboot flow, it has to deal with missing
platform services such as TrustZone (TZ), Hypervisor and AOP (which
populates CMD DB data).

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v9:
- Drop the assumption that snagboot mode needs IOMMU disabled:
  QCOM_SNAGBOOT_MODE no longer depends on !IOMMU and
  qcom-snagboot.config no longer sets CONFIG_IOMMU=n
- Link to v8: https://lore.kernel.org/r/20261014-snagboot-v8-0-7caef86562b7@oss.qualcomm.com

Changes in v8:
- Make changes in documentation
- Link to v7: https://lore.kernel.org/r/20261013-snagboot-v7-0-fc296a32836a@oss.qualcomm.com

Changes in v7:
- Rebased on top of latest main branch
- Link to v6: https://lore.kernel.org/r/20260803-snagboot-v6-0-e8bf7a6fc0a4@oss.qualcomm.com

Changes in v6:
- Forget to send summary in v5 cover letter, no other changes
  in v6
- Link to v5: https://marc.info/?l=u-boot&m=178577208345353&w=2

Changes in v5:
- Make QCOM_BOOT0_SNAGBOOT_MODE as hidden config dependent on
  QCOM_SNAGBOOT_MODE
- Disable C (Dcache) bit of SCTLR_EL3 register during MMU disable
- Remove now unused QCOM_COMMAND_DB_OPTIONAL Kconfig definition
- Disable unnecessar I2C configs (for Snagboot) in Qcom Snagboot
  config fragment
- Add build steps for compiling U-Boot for Snagboot mode in
  Qcom Snagboot doc
- Link to v4: https://lore.kernel.org/u-boot/20260619-snagboot-v4-0-385497442db2@oss.qualcomm.com/

Changes in v4:
- Renamed QCOM_SNAGBOOT_SUPPORT to QCOM_SNAGBOOT_MODE
- Make SYSRESET_PSCI dependent on QCOM_SNAGBOOT_MODE
- Place Snagboot related configs in seperate config fragment
  called configs/qcom-snagboot.config
- Include above config fragment in
  configs/qcom_lemans_snagboot_defconfig
- Removed Lemans EVK override dtsi: arch/arm/dts/lemans-evk-u-boot.dtsi
- Removed QCOM_COMMAND_DB_OPTIONAL as now we use
  CONFIG_QCOM_SNAGBOOT_MODE
- Added documentation on U-Boot for Snagboot
- Link to v3: https://lore.kernel.org/u-boot/20260616-sngboot-v3-0-6fb0dee8125c@oss.qualcomm.com/

Changes in v3:
- Brought the MMU disable logic under CONFIG_QCOM_SNAGBOOT_SUPPORT
  ifdef condition
- Moved the MMU disable codes to a new seperate file
- Used "if (IS_ENABLED(CONFIG_QCOM_COMMAND_DB_OPTIONAL))" instead
  of #ifdef
- Removed enabling QCOM_COMMAND_DB_OPTIONAL, ENABLE_ARM_SOC_BOOT0_HOOK
  and SKIP_RELOCATE as they are now automatically enabled by
  QCOM_SNAGBOOT_SUPPORT selection
- Removed updating MAINTAINERS as the defconfig file is picked up by
  the "N: qcom" line
- Link to v2: https://lore.kernel.org/u-boot/20260608-snagboot-v2-0-036bb0343bf7@oss.qualcomm.com/

Changes in v2:
- Changed SYSRESET_PSCI from 'select' to 'imply'
- Guard show_psci_version() and qcom_psci_fixup() with CONFIG_ARM_SMCCC
- Disables the MMU and invalidates TLBs at the earliest entry point
- Add qcom_lemans_snagboot_defconfig for Lemans-EVK
- Link to v1: https://lore.kernel.org/u-boot/20260409-cmddb-v1-1-b10549b34133@oss.qualcomm.com/

---
Balaji Selvanathan (8):
      arm: snapdragon: Make SYSRESET_PSCI optional
      arm: snapdragon: Guard PSCI functions with CONFIG_ARM_SMCCC
      arm: snapdragon: Disable MMU early before U-Boot reset vector
      arm: snapdragon: Add CONFIG_QCOM_SNAGBOOT_MODE option
      soc: qcom: cmd-db: Allow boot without CMD DB data
      arch: arm: dts: remove Lemans EVK override DTS
      configs: add qcom_lemans_snagboot_defconfig for Lemans-EVK
      doc: qualcomm: Add snagboot mode documentation

 arch/arm/Kconfig                                   |  2 +-
 arch/arm/dts/lemans-evk-u-boot.dtsi                | 19 -----
 arch/arm/mach-snapdragon/Kconfig                   | 19 +++++
 arch/arm/mach-snapdragon/board.c                   |  6 ++
 arch/arm/mach-snapdragon/include/mach/boot0.h      |  2 +
 .../mach-snapdragon/include/mach/snagboot_boot0.h  | 27 ++++++++
 configs/qcom-snagboot.config                       | 45 ++++++++++++
 configs/qcom_lemans_snagboot_defconfig             | 18 +++++
 doc/board/qualcomm/index.rst                       |  1 +
 doc/board/qualcomm/snagboot.rst                    | 80 ++++++++++++++++++++++
 drivers/soc/qcom/cmd-db.c                          | 15 +++-
 11 files changed, 212 insertions(+), 22 deletions(-)
---
base-commit: fed92546960a92177d67c0b8d7b22385f50fed29
change-id: 20260731-snagboot-4e9f66f0252d

Best regards,
-- 
Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

[PATCH v9 1/8] arm: snapdragon: Make SYSRESET_PSCI optional

[Balaji Selvanathan]

In snagboot mode, there is no PSCI firmware and U-Boot will crash if it
attempts to make PSCI calls so disable it in this case.

Reviewed-by: Varadarajan Narayanan <varadarajan.narayanan@oss.qualcomm.com>
Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v7:
- Make id dependent on both !QCOM_SNAGBOOT_MODE && !SPL

Changes in v5:
- No changes

Changes in v4:
- Make SYSRESET_PSCI dependent on QCOM_SNAGBOOT_MODE

Changes in v3:
- No changes

Changes in v2:
- Newly introduced in v2
---
 arch/arm/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 3e9f3b51031..b438f0b9c14 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1150,7 +1150,7 @@ config ARCH_SNAPDRAGON
 	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select SYSRESET
-	select SYSRESET_PSCI if !SPL
+	select SYSRESET_PSCI if !QCOM_SNAGBOOT_MODE && !SPL
 	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
 	select MMU_PGPROT
 	select SUPPORT_SPL

-- 
2.34.1

[PATCH v9 2/8] arm: snapdragon: Guard PSCI functions with CONFIG_ARM_SMCCC

[Balaji Selvanathan]

In snagboot mode, U-Boot is loaded directly by XBL without PSCI
firmware support. The functions show_psci_version() and
qcom_psci_fixup() call arm_smccc_smc() which is unavailable when
CONFIG_ARM_SMCCC is disabled, causing build failures.

Hence, added CONFIG_ARM_SMCCC guards to both functions.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v7:
- No changes

Changes in v5:
- No changes

Changes in v4:
- No changes

Changes in v3:
- Added CONFIG_ARM_SMCCC guards

Changes in v2:
- Newly introduced in v2
---
 arch/arm/mach-snapdragon/board.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
index 87adb100edd..daee2ed4fa0 100644
--- a/arch/arm/mach-snapdragon/board.c
+++ b/arch/arm/mach-snapdragon/board.c
@@ -35,6 +35,9 @@ static void show_psci_version(void)
 {
 	struct arm_smccc_res res;
 
+	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
+		return;
+
 	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
 
 	/* Some older SoCs like MSM8916 don't always support PSCI */
@@ -58,6 +61,9 @@ static void qcom_psci_fixup(void *fdt)
 	int offset, ret;
 	struct arm_smccc_res res;
 
+	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
+		return;
+
 	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
 
 	if ((int)res.a0 != PSCI_RET_NOT_SUPPORTED)

-- 
2.34.1

[PATCH v9 3/8] arm: snapdragon: Disable MMU early before U-Boot reset vector

[Balaji Selvanathan]

When U-Boot is loaded by XBL in Snagboot mode, XBL leaves the MMU
enabled with its own page tables. This causes stale TLB entries and
incorrect memory mappings when U-Boot initializes its own MMU.

Disable the MMU and invalidate TLBs before branching to the
reset vector. This ensures a clean MMU state for U-Boot initialization
in Snagboot mode.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v7:
- No changes

Changes iv v5:
- Clear C bit (Dcache enable) also during MMU disable

Changes iv v4:
- Remove handling for EL1 or EL2 entry as for Snagboot we would
  only enter U-Boot in EL3 from previous bootloader

Changes in v3:
- Brought the MMU disable logic under CONFIG_QCOM_SNAGBOOT_SUPPORT
  ifdef condition
- Moved the MMU disable codes to a new seperate file

Changes in v2:
- Newly introduced in v2
---
 arch/arm/mach-snapdragon/include/mach/boot0.h      |  2 ++
 .../mach-snapdragon/include/mach/snagboot_boot0.h  | 27 ++++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
index b71aab37f44..ecef094629b 100644
--- a/arch/arm/mach-snapdragon/include/mach/boot0.h
+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h
@@ -8,6 +8,8 @@
 #else
 #if defined(CONFIG_BOOT0_MSM8916_PSCI_WORKAROUND)
 #include "msm8916_boot0.h"
+#elif defined(CONFIG_QCOM_BOOT0_SNAGBOOT_MODE)
+#include "snagboot_boot0.h"
 #else
 	b	reset
 #endif
diff --git a/arch/arm/mach-snapdragon/include/mach/snagboot_boot0.h b/arch/arm/mach-snapdragon/include/mach/snagboot_boot0.h
new file mode 100644
index 00000000000..f82ee87c9b9
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/snagboot_boot0.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Early MMU Disable for Snagboot Mode
+ *
+ * Disable MMU at the earliest possible point for EL3 entry.
+ * Snagboot mode always enters U-Boot at EL3.
+ *
+ * After disabling MMU, invalidate TLB to clear any stale entries that might
+ * cause issues when MMU is re-enabled later.
+ */
+
+	mrs	x0, CurrentEL
+	cmp	x0, #(3 << 2)	/* Verify EL3 entry */
+	b.ne	reset		/* Unexpected: not at EL3 */
+
+	/* Disable MMU at EL3 */
+	mrs	x0, sctlr_el3
+	bic	x0, x0, #1	/* Clear M bit (MMU enable) */
+	bic	x0, x0, #(1 << 2)   /* Clear C bit (Dcache enable) */
+	bic	x0, x0, #(1 << 19)  /* Clear WXN bit (Write XOR Execute) */
+	msr	sctlr_el3, x0
+	isb
+	/* Invalidate entire TLB for all ELs */
+	tlbi	alle3
+	dsb	sy
+	isb
+	b	reset
\ No newline at end of file

-- 
2.34.1

[PATCH v9 4/8] arm: snapdragon: Add CONFIG_QCOM_SNAGBOOT_MODE option

[Balaji Selvanathan]

Add CONFIG_QCOM_SNAGBOOT_MODE to enable snagboot mode on Qualcomm
platforms. This config automatically selects the required dependencies.
Express the platform-specific requirements and configs that must be
selected and disabled in snagboot mode.

Add QCOM_BOOT0_SNAGBOOT_MODE as a hidden boot0.h config, selected
automatically by QCOM_SNAGBOOT_MODE. This boot0.h config is for
disabling MMU at the start of U-Boot execution.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v9:
- Remove depends on !IOMMU from QCOM_SNAGBOOT_MODE

Changes in v7:
- No changes

Changes in v5:
- Made QCOM_BOOT0_SNAGBOOT_MODE dependent on QCOM_SNAGBOOT_MODE so
  it is not exposed to users
- Add dependencies for QCOM_SNAGBOOT_MODE explicitly as "depends"

Changes in v4:
- Renamed QCOM_SNAGBOOT_SUPPORT to QCOM_SNAGBOOT_MODE
- Added QCOM_BOOT0_SNAGBOOT_MODE for boot0.h which gets selected by
  QCOM_SNAGBOOT_MODE
- Document the platform-specific requirements and configs that must be
  disabled in snagboot mode.

Changes in v3:
- Newly introduced in v3
---
 arch/arm/mach-snapdragon/Kconfig | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
index ddded0029ef..db770ad6edc 100644
--- a/arch/arm/mach-snapdragon/Kconfig
+++ b/arch/arm/mach-snapdragon/Kconfig
@@ -82,4 +82,23 @@ config BOOT0_SDM845_WORKAROUND
 
 endchoice
 
+config QCOM_BOOT0_SNAGBOOT_MODE
+	bool
+	depends on QCOM_SNAGBOOT_MODE
+
+config QCOM_SNAGBOOT_MODE
+	bool "Build U-Boot for Snagboot mode loading"
+	select QCOM_BOOT0_SNAGBOOT_MODE
+	select ENABLE_ARM_SOC_BOOT0_HOOK
+	select SKIP_RELOCATE
+	select ENV_IS_NOWHERE
+	depends on !ENV_IS_IN_SCSI
+	depends on !PSCI_RESET
+	depends on !SAVE_PREV_BL_INITRAMFS_START_ADDR
+	depends on COUNTER_FREQUENCY != 0
+	depends on TEXT_BASE != 0
+	help
+	  Build U-Boot to be loaded in Snagboot mode on Qualcomm platforms
+	  for device/factory provisioning using fastboot.
+
 endif

-- 
2.34.1

[PATCH v9 5/8] soc: qcom: cmd-db: Allow boot without CMD DB data

[Balaji Selvanathan]

In snagboot mode, XBL loads U-Boot directly without populating CMD DB.
The cmd-db driver fails to bind when CMD DB magic is invalid, blocking
boot even when CMD DB is not strictly required.

Use QCOM_SNAGBOOT_MODE config to allow the driver to bind
successfully when CMD DB data is absent. When QCOM_SNAGBOOT_MODE is
enabled and CMD DB data is present, we log a warning.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v7:
- No changes

Changes in v5:
- Remove QCOM_COMMAND_DB_OPTIONAL definition from Kconfig as its now
  not used

Changes in v4:
- Removed QCOM_COMMAND_DB_OPTIONAL as now we use
  CONFIG_QCOM_SNAGBOOT_MODE
- Drop these warnings if snagboot mode is enabled since that's the
  expected case
- Log a warning if snagboot is enabled and we do have a valid cmd-db,
  since that isn't an expected usecase

 Changes in v3:
- Used "if (IS_ENABLED(CONFIG_QCOM_COMMAND_DB_OPTIONAL))" instead
  of #ifdef

Changes in v2:
- No changes
---
 drivers/soc/qcom/cmd-db.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/qcom/cmd-db.c b/drivers/soc/qcom/cmd-db.c
index d0a6047b8a6..c94a90a2903 100644
--- a/drivers/soc/qcom/cmd-db.c
+++ b/drivers/soc/qcom/cmd-db.c
@@ -252,8 +252,19 @@ static int cmd_db_bind(struct udevice *dev)
 
 	cmd_db_header = base;
 	if (!cmd_db_magic_matches(cmd_db_header)) {
-		log_err("%s: Invalid Command DB Magic\n", __func__);
-		return -EINVAL;
+		if (IS_ENABLED(CONFIG_QCOM_SNAGBOOT_MODE)) {
+			/* Missing CMD DB is expected in snagboot mode */
+			cmd_db_header = NULL;
+			return 0;
+		} else {
+			log_err("%s: Invalid Command DB Magic\n", __func__);
+			return -EINVAL;
+		}
+	}
+
+	if (IS_ENABLED(CONFIG_QCOM_SNAGBOOT_MODE)) {
+		log_warning("%s: CMD DB found in snagboot mode - this is unexpected\n",
+			    __func__);
 	}
 
 	return 0;

-- 
2.34.1

[PATCH v9 6/8] arch: arm: dts: remove Lemans EVK override DTS

[Balaji Selvanathan]

Remove Lemans EVK override dtsi: arch/arm/dts/lemans-evk-u-boot.dtsi
provided the following SMEM modernize series is picked:
https://lore.kernel.org/u-boot/20260618-b4-modernise-smem-v3-0-472391477988@linaro.org/

Memory node is not required as we can read the memory info from SMEM.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v7:
- No changes

Changes in v5:
- No changes

Changes in v4:
- Newly added in v4
---
 arch/arm/dts/lemans-evk-u-boot.dtsi | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/arch/arm/dts/lemans-evk-u-boot.dtsi b/arch/arm/dts/lemans-evk-u-boot.dtsi
deleted file mode 100644
index cdd3d32f61a..00000000000
--- a/arch/arm/dts/lemans-evk-u-boot.dtsi
+++ /dev/null
@@ -1,19 +0,0 @@
-// SPDX-License-Identifier: BSD-3-Clause
-/*
- * Copyright (c) 2026, Qualcomm Innovation Center, Inc. All rights reserved.
- */
-
-/ {
-	/* Will be removed when bootloader updates later */
-	memory@80000000 {
-		device_type = "memory";
-		reg = <0x0 0x80000000 0x0 0x3ee00000>,
-		      <0x0 0xc0000000 0x0 0x0fd00000>,
-		      <0xD 0x00000000 0x2 0x54100000>,
-		      <0xA 0x80000000 0x1 0x80000000>,
-		      <0x9 0x00000000 0x1 0x80000000>,
-		      <0x1 0x00000000 0x3 0x00000000>,
-		      <0x0 0xd0000000 0x0 0x01900000>,
-		      <0x0 0xd3500000 0x0 0x2cb00000>;
-	};
-};

-- 
2.34.1

[PATCH v9 7/8] configs: add qcom_lemans_snagboot_defconfig for Lemans-EVK

[Balaji Selvanathan]

Add defconfig for booting U-Boot in Snagboot mode on Lemans-EVK. In
this mode, XBL loads U-Boot and directly jumps to it. U-Boot then
enters fastboot over USB for device provisioning.

Create a reusable config fragment at configs/qcom-snagboot.config
with common snagboot settings. Platform-specific defconfigs should
include this fragment along with their own settings.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v9:
- Do not disable CONFIG_IOMMU in qcom-snagboot.config

Changes in v7:
- No changes

Changes in v5:
- Disable I2C configs as its not required in Snagboot mode

Changes in v4:
- Use CONFIG_ENV_IS_NOWHERE
- Place Snagboot related configs in seperate config fragment
  called configs/qcom-snagboot.config
- Include above config fragment in
  configs/qcom_lemans_snagboot_defconfig

Changes in v3:
- Removed enabling QCOM_COMMAND_DB_OPTIONAL, ENABLE_ARM_SOC_BOOT0_HOOK
  and SKIP_RELOCATE as they are now automatically enabled by
  QCOM_SNAGBOOT_SUPPORT selection

Changes in v2:
- Newly introduced in v2
---
 configs/qcom-snagboot.config           | 45 ++++++++++++++++++++++++++++++++++
 configs/qcom_lemans_snagboot_defconfig | 18 ++++++++++++++
 2 files changed, 63 insertions(+)

diff --git a/configs/qcom-snagboot.config b/configs/qcom-snagboot.config
new file mode 100644
index 00000000000..cb395f2a867
--- /dev/null
+++ b/configs/qcom-snagboot.config
@@ -0,0 +1,45 @@
+# Common configuration fragment for Qualcomm snagboot mode
+# Include this in platform-specific snagboot defconfigs
+
+CONFIG_QCOM_SNAGBOOT_MODE=y
+
+# Disable configs that conflict with snagboot mode
+# CONFIG_PSCI_RESET is not set
+# CONFIG_SAVE_PREV_BL_INITRAMFS_START_ADDR is not set
+# CONFIG_REBOOT_MODE_ENV_UPDATE is not set
+
+# PSCI firmware is not available in snagboot mode, so nothing implements
+# poweroff (neither SYSRESET_PSCI nor SYSRESET_CMD_POWEROFF are selected)
+# CONFIG_CMD_POWEROFF is not set
+
+# I2C peripherals aren't accessible in snagboot mode (no Command DB / RPMh
+# power-domain data from XBL), so probing them only produces noisy errors.
+# CONFIG_DM_I2C is not set
+# CONFIG_CMD_I2C is not set
+# CONFIG_SYS_I2C_QUP is not set
+# CONFIG_SYS_I2C_GENI is not set
+# CONFIG_I2C_MUX is not set
+# CONFIG_I2C_EEPROM is not set
+
+# Use default environment instead of loading from storage
+# This ensures snagboot mode works even with corrupted environment
+# CONFIG_ENV_IS_IN_SCSI is not set
+# CONFIG_ENV_IS_IN_MMC is not set
+# CONFIG_ENV_IS_IN_FLASH is not set
+# CONFIG_ENV_IS_IN_NAND is not set
+CONFIG_ENV_IS_NOWHERE=y
+
+# Disable default env file to use CONFIG_BOOTCOMMAND instead
+# CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE is not set
+
+# Auto-enter fastboot mode for snagboot
+CONFIG_USE_BOOTCOMMAND=y
+CONFIG_BOOTCOMMAND="fastboot -l $fastboot_addr_r usb 0"
+CONFIG_BOOTDELAY=0
+
+# Fastboot configuration for partition flashing
+CONFIG_FASTBOOT_FLASH_BLOCK=y
+CONFIG_FASTBOOT_FLASH_BLOCK_INTERFACE_NAME="scsi"
+CONFIG_FASTBOOT_FLASH_BLOCK_DEVICE_ID=4
+CONFIG_FASTBOOT_GPT_NAME="gpt"
+CONFIG_FASTBOOT_MBR_NAME="mbr"
diff --git a/configs/qcom_lemans_snagboot_defconfig b/configs/qcom_lemans_snagboot_defconfig
new file mode 100644
index 00000000000..d6906c1e501
--- /dev/null
+++ b/configs/qcom_lemans_snagboot_defconfig
@@ -0,0 +1,18 @@
+# Configuration for building U-Boot for snagboot/recovery mode
+# on Lemans-EVK dev boards.
+#
+# For normal production boot, use qcom_lemans_defconfig instead.
+
+#include "qcom_defconfig"
+#include "qcom-snagboot.config"
+
+# Platform-specific settings for Lemans-EVK
+
+# Address where U-Boot will be loaded
+CONFIG_TEXT_BASE=0x1c100000
+CONFIG_REMAKE_ELF=y
+CONFIG_FASTBOOT_BUF_ADDR=0xdb300000
+CONFIG_DEFAULT_DEVICE_TREE="qcom/lemans-evk"
+
+# Timer frequency for Lemans platform
+CONFIG_COUNTER_FREQUENCY=19200000
\ No newline at end of file

-- 
2.34.1

[PATCH v9 8/8] doc: qualcomm: Add snagboot mode documentation

[Balaji Selvanathan]

Document how to build and sign U-Boot for snagboot mode on Qualcomm
platforms, using Lemans-EVK as the example, and how to add a snagboot
defconfig for another board using the qcom-snagboot.config fragment.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Changes in v8:
- Point to the upstream Snagboot docs instead of describing the tool
- Drop the "Why Snagboot?", architecture and EDL+Firehose comparison
  sections
- Move the build and signing steps ahead of board enablement
- Drop the list of Kconfig options selected/forbidden by
  QCOM_SNAGBOOT_MODE and the Lemans-EVK example section
- Replace the signing prerequisites list with commands to fetch
  swiv_build_utility.py and qtestsign
- Drop the "Expected result" and "Output" blocks

Changes in v7:
- Rebased on top of latest file

Changes in v5:
- Added build steps for U-Boot in Snagboot mode

Changes in v4:
- Newly added in v4
---
 doc/board/qualcomm/index.rst    |  1 +
 doc/board/qualcomm/snagboot.rst | 80 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 81 insertions(+)

diff --git a/doc/board/qualcomm/index.rst b/doc/board/qualcomm/index.rst
index 56b8d894c2a..b8bc37bb384 100644
--- a/doc/board/qualcomm/index.rst
+++ b/doc/board/qualcomm/index.rst
@@ -17,3 +17,4 @@ Qualcomm
    rdp
    signing
    spl
+   snagboot
diff --git a/doc/board/qualcomm/snagboot.rst b/doc/board/qualcomm/snagboot.rst
new file mode 100644
index 00000000000..716d88b2ba2
--- /dev/null
+++ b/doc/board/qualcomm/snagboot.rst
@@ -0,0 +1,80 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Snagboot Mode for Qualcomm Platforms
+=====================================
+
+`Snagboot`_ is a recovery and reflashing tool that can download a
+bootloader to a device in its boot ROM recovery mode and then flash
+images to it. On Qualcomm SoCs, snagrecover uses the Sahara protocol in
+EDL mode to load XBL, which initializes DDR, and then loads U-Boot into
+DDR. U-Boot enters fastboot mode and snagflash uses fastboot to flash
+the system images. See the `Snagboot documentation`_ for how to use
+the host tools.
+
+U-Boot built in snagboot mode runs directly from the address XBL loads
+it to. It must cope with the MMU left enabled by XBL, and it cannot
+rely on PSCI firmware or Command DB being set up.
+
+Currently supported platforms:
+
+* Lemans-EVK (``qcom_lemans_snagboot_defconfig``)
+
+.. _Snagboot: https://github.com/bootlin/snagboot
+.. _Snagboot documentation: https://github.com/bootlin/snagboot/tree/main/docs
+
+Building
+--------
+
+First, setup ``CROSS_COMPILE`` for aarch64. Then, configure and build U-Boot for
+the Lemans EVK platform::
+
+    $ export CROSS_COMPILE=<aarch64 toolchain prefix>
+    $ make O=.output qcom_lemans_snagboot_defconfig
+    $ make -j8 O=.output
+
+Additional tooling
+^^^^^^^^^^^^^^^^^^
+
+In order to generate a working image, ``swiv_build_utility.py`` and
+``qtestsign`` are needed::
+
+    $ git clone https://github.com/qualcomm-linux/boot-firmware-ci
+    $ export SWIV_BUILD="$PWD/boot-firmware-ci/tools/swiv_build_utility.py"
+    $ git clone https://github.com/msm8916-mainline/qtestsign
+    $ export QTESTSIGN="$PWD/qtestsign/qtestsign.py"
+
+``qtestsign`` requires Python 3.7+ and the ``cryptography`` module, which
+can be installed with ``pip install ./qtestsign``.
+
+Signing
+^^^^^^^
+
+Add the SWIV segment required for TZ-based signing::
+
+    $ python3 "$SWIV_BUILD" .output/u-boot-swiv.elf .output/u-boot.elf lemans
+
+Then sign the resulting ELF with test keys::
+
+    $ python3 "$QTESTSIGN" -v 6 -o .output/u-boot.mbn tz .output/u-boot-swiv.elf
+
+This generates the final ``.output/u-boot.mbn`` binary, that can then be
+used with snagboot.
+
+Board Enablement
+----------------
+
+Common snagboot settings live in the ``configs/qcom-snagboot.config``
+fragment. A platform-specific snagboot defconfig includes it on top of
+``qcom_defconfig`` and sets the platform values::
+
+    #include "qcom_defconfig"
+    #include "qcom-snagboot.config"
+
+    # Address where XBL loads U-Boot
+    CONFIG_TEXT_BASE=0x1c100000
+    CONFIG_REMAKE_ELF=y
+    CONFIG_FASTBOOT_BUF_ADDR=0xdb300000
+    CONFIG_DEFAULT_DEVICE_TREE="qcom/<your-board>"
+
+    # Timer frequency for your platform
+    CONFIG_COUNTER_FREQUENCY=19200000

-- 
2.34.1

Re: [PATCH v9 2/8] arm: snapdragon: Guard PSCI functions with CONFIG_ARM_SMCCC

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1791 bytes --]

On Wed, Oct 21, 2026 at 09:48:21PM +0530, Balaji Selvanathan wrote:

> In snagboot mode, U-Boot is loaded directly by XBL without PSCI
> firmware support. The functions show_psci_version() and
> qcom_psci_fixup() call arm_smccc_smc() which is unavailable when
> CONFIG_ARM_SMCCC is disabled, causing build failures.
> 
> Hence, added CONFIG_ARM_SMCCC guards to both functions.
> 
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> ---
> Changes in v7:
> - No changes
> 
> Changes in v5:
> - No changes
> 
> Changes in v4:
> - No changes
> 
> Changes in v3:
> - Added CONFIG_ARM_SMCCC guards
> 
> Changes in v2:
> - Newly introduced in v2
> ---
>  arch/arm/mach-snapdragon/board.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
> index 87adb100edd..daee2ed4fa0 100644
> --- a/arch/arm/mach-snapdragon/board.c
> +++ b/arch/arm/mach-snapdragon/board.c
> @@ -35,6 +35,9 @@ static void show_psci_version(void)
>  {
>  	struct arm_smccc_res res;
>  
> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
> +		return;
> +
>  	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>  
>  	/* Some older SoCs like MSM8916 don't always support PSCI */
> @@ -58,6 +61,9 @@ static void qcom_psci_fixup(void *fdt)
>  	int offset, ret;
>  	struct arm_smccc_res res;
>  
> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
> +		return;
> +
>  	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>  
>  	if ((int)res.a0 != PSCI_RET_NOT_SUPPORTED)
> 

Do we even need this, patch 1 of the series disables SYSRESET_PSCI when
you're doing this special snagboot mode so we shouldn't be calling
show_psci_version at all.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 0/8] arm: snapdragon: Add snagboot support for Lemans-EVK

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1877 bytes --]

On Wed, Oct 21, 2026 at 09:48:19PM +0530, Balaji Selvanathan wrote:

> This series adds support for running U-Boot in snagboot mode on
> Qualcomm Snapdragon platforms, targeting the Lemans-EVK board.
> 
> Snagboot is an open-source, scriptable flashing framework that provides
> an alternative to the proprietary Firehose protocol for device
> provisioning. Like the traditional EDL+Firehose flow, Snagboot uses the
> Qualcomm boot ROM EDL mode and Sahara protocol to download
> and execute bootloaders. However, instead of using the proprietary
> Firehose programmer, Snagboot loads U-Boot into DDR and uses the
> standard fastboot protocol for device flashing.

You're implying that snagboot is qualcomm-specific and it's very much
not.

> The framework consists of three modular components: snagrecover
> (downloads XBL/QCLib to initialize DDR and load U-Boot into RAM),
> snagflash (communicates with U-Boot over USB using fastboot to flash
> system images), and snagfactory (orchestrates parallel factory
> flashing tasks).
> 
> In the snagboot execution flow, ROM code in EDL mode loads
> snagrecover, which downloads XBL to internal memory. XBL executes
> and initializes DDR, then snagrecover downloads U-Boot into DDR and
> transfers control to it. At this point, XBL has left the MMU enabled
> with its own page tables and has not initialized PSCI firmware or
> populated the Command DB. U-Boot must handle this non-standard boot
> environment to enter fastboot mode for device flashing.

These two paragraphs, and the introduction, should be condensed and
concise and point to the snagboot docs and also the docs being added in
this patch.

> Support for Qualcomm Lemans-EVK SOC in Snagboot is available in
> https://github.com/bootlin/snagboot

I looked a little, and I didn't see it, but I guess I just missed it?

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 4/8] arm: snapdragon: Add CONFIG_QCOM_SNAGBOOT_MODE option

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 2503 bytes --]

On Wed, Oct 21, 2026 at 09:48:23PM +0530, Balaji Selvanathan wrote:
> Add CONFIG_QCOM_SNAGBOOT_MODE to enable snagboot mode on Qualcomm
> platforms. This config automatically selects the required dependencies.
> Express the platform-specific requirements and configs that must be
> selected and disabled in snagboot mode.
> 
> Add QCOM_BOOT0_SNAGBOOT_MODE as a hidden boot0.h config, selected
> automatically by QCOM_SNAGBOOT_MODE. This boot0.h config is for
> disabling MMU at the start of U-Boot execution.
> 
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> ---
> Changes in v9:
> - Remove depends on !IOMMU from QCOM_SNAGBOOT_MODE
> 
> Changes in v7:
> - No changes
> 
> Changes in v5:
> - Made QCOM_BOOT0_SNAGBOOT_MODE dependent on QCOM_SNAGBOOT_MODE so
>   it is not exposed to users
> - Add dependencies for QCOM_SNAGBOOT_MODE explicitly as "depends"
> 
> Changes in v4:
> - Renamed QCOM_SNAGBOOT_SUPPORT to QCOM_SNAGBOOT_MODE
> - Added QCOM_BOOT0_SNAGBOOT_MODE for boot0.h which gets selected by
>   QCOM_SNAGBOOT_MODE
> - Document the platform-specific requirements and configs that must be
>   disabled in snagboot mode.
> 
> Changes in v3:
> - Newly introduced in v3
> ---
>  arch/arm/mach-snapdragon/Kconfig | 19 +++++++++++++++++++
>  1 file changed, 19 insertions(+)
> 
> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> index ddded0029ef..db770ad6edc 100644
> --- a/arch/arm/mach-snapdragon/Kconfig
> +++ b/arch/arm/mach-snapdragon/Kconfig
> @@ -82,4 +82,23 @@ config BOOT0_SDM845_WORKAROUND
>  
>  endchoice
>  
> +config QCOM_BOOT0_SNAGBOOT_MODE
> +	bool
> +	depends on QCOM_SNAGBOOT_MODE
> +
> +config QCOM_SNAGBOOT_MODE
> +	bool "Build U-Boot for Snagboot mode loading"
> +	select QCOM_BOOT0_SNAGBOOT_MODE
> +	select ENABLE_ARM_SOC_BOOT0_HOOK
> +	select SKIP_RELOCATE
> +	select ENV_IS_NOWHERE
> +	depends on !ENV_IS_IN_SCSI

You probably want to look at testing ENV_IS_DEFAULT

> +	depends on !PSCI_RESET

You earlier change PSCI_RESET so this is redundant?

> +	depends on !SAVE_PREV_BL_INITRAMFS_START_ADDR

Why?

> +	depends on COUNTER_FREQUENCY != 0

You probably need to be setting a default then for the snagboot case as
I assume this is currently 0.

> +	depends on TEXT_BASE != 0

You probably meant !POSITION_INDEPENDENT, and need to set a default.
This doesn't work since TEXT_BASE is a hex and 0x0 != 0 is true in
Kconfig.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 5/8] soc: qcom: cmd-db: Allow boot without CMD DB data

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 592 bytes --]

On Wed, Oct 21, 2026 at 09:48:24PM +0530, Balaji Selvanathan wrote:

> In snagboot mode, XBL loads U-Boot directly without populating CMD DB.
> The cmd-db driver fails to bind when CMD DB magic is invalid, blocking
> boot even when CMD DB is not strictly required.
> 
> Use QCOM_SNAGBOOT_MODE config to allow the driver to bind
> successfully when CMD DB data is absent. When QCOM_SNAGBOOT_MODE is
> enabled and CMD DB data is present, we log a warning.
> 
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

Can we just not build this driver?

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 6/8] arch: arm: dts: remove Lemans EVK override DTS

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 586 bytes --]

On Wed, Oct 21, 2026 at 09:48:25PM +0530, Balaji Selvanathan wrote:

> Remove Lemans EVK override dtsi: arch/arm/dts/lemans-evk-u-boot.dtsi
> provided the following SMEM modernize series is picked:
> https://lore.kernel.org/u-boot/20260618-b4-modernise-smem-v3-0-472391477988@linaro.org/
> 
> Memory node is not required as we can read the memory info from SMEM.
> 
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

The series should say it depends on the other series. That other series
should probably be deleting this file, too, yes?

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 8/8] doc: qualcomm: Add snagboot mode documentation

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 860 bytes --]

On Wed, Oct 21, 2026 at 09:48:27PM +0530, Balaji Selvanathan wrote:

> Document how to build and sign U-Boot for snagboot mode on Qualcomm
> platforms, using Lemans-EVK as the example, and how to add a snagboot
> defconfig for another board using the qcom-snagboot.config fragment.
> 
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
[snip]
> diff --git a/doc/board/qualcomm/snagboot.rst b/doc/board/qualcomm/snagboot.rst
> new file mode 100644
> index 00000000000..716d88b2ba2
> --- /dev/null
> +++ b/doc/board/qualcomm/snagboot.rst
> @@ -0,0 +1,80 @@
> +.. SPDX-License-Identifier: GPL-2.0+
> +
> +Snagboot Mode for Qualcomm Platforms
> +=====================================

The second line is too long, which means you didn't run this through CI
or build docs with warnings-as-errors, as CI does.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 0/8] arm: snapdragon: Add snagboot support for Lemans-EVK

[Balaji Selvanathan]

Hi Tom,

Thanks for the feedbacks.

On 10/21/2026 11:10 PM, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:19PM +0530, Balaji Selvanathan wrote:
>
>> This series adds support for running U-Boot in snagboot mode on
>> Qualcomm Snapdragon platforms, targeting the Lemans-EVK board.
>>
>> Snagboot is an open-source, scriptable flashing framework that provides
>> an alternative to the proprietary Firehose protocol for device
>> provisioning. Like the traditional EDL+Firehose flow, Snagboot uses the
>> Qualcomm boot ROM EDL mode and Sahara protocol to download
>> and execute bootloaders. However, instead of using the proprietary
>> Firehose programmer, Snagboot loads U-Boot into DDR and uses the
>> standard fastboot protocol for device flashing.
> You're implying that snagboot is qualcomm-specific and it's very much
> not.

I didnt mean it to say Snagboot is qualcomm-specific; Reworded the 
commit message in v10 to make this clear.

v10 link: 
https://lore.kernel.org/u-boot/20261101-snagboot-v10-0-e73d5cfedb8a@oss.qualcomm.com/

>
>> The framework consists of three modular components: snagrecover
>> (downloads XBL/QCLib to initialize DDR and load U-Boot into RAM),
>> snagflash (communicates with U-Boot over USB using fastboot to flash
>> system images), and snagfactory (orchestrates parallel factory
>> flashing tasks).
>>
>> In the snagboot execution flow, ROM code in EDL mode loads
>> snagrecover, which downloads XBL to internal memory. XBL executes
>> and initializes DDR, then snagrecover downloads U-Boot into DDR and
>> transfers control to it. At this point, XBL has left the MMU enabled
>> with its own page tables and has not initialized PSCI firmware or
>> populated the Command DB. U-Boot must handle this non-standard boot
>> environment to enter fastboot mode for device flashing.
> These two paragraphs, and the introduction, should be condensed and
> concise and point to the snagboot docs and also the docs being added in
> this patch.
Addressed this.
>
>> Support for Qualcomm Lemans-EVK SOC in Snagboot is available in
>> https://github.com/bootlin/snagboot
> I looked a little, and I didn't see it, but I guess I just missed it?

Please find the Qualcomm support in Snagboot in 
https://github.com/bootlin/snagboot/pull/94 (which got merged).

Regards,

Balaji

>

Re: [PATCH v9 2/8] arm: snapdragon: Guard PSCI functions with CONFIG_ARM_SMCCC

[Balaji Selvanathan]

Hi Tom,

On 10/21/2026 11:05 PM, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:21PM +0530, Balaji Selvanathan wrote:
>
>> In snagboot mode, U-Boot is loaded directly by XBL without PSCI
>> firmware support. The functions show_psci_version() and
>> qcom_psci_fixup() call arm_smccc_smc() which is unavailable when
>> CONFIG_ARM_SMCCC is disabled, causing build failures.
>>
>> Hence, added CONFIG_ARM_SMCCC guards to both functions.
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
>> ---
>> Changes in v7:
>> - No changes
>>
>> Changes in v5:
>> - No changes
>>
>> Changes in v4:
>> - No changes
>>
>> Changes in v3:
>> - Added CONFIG_ARM_SMCCC guards
>>
>> Changes in v2:
>> - Newly introduced in v2
>> ---
>>   arch/arm/mach-snapdragon/board.c | 6 ++++++
>>   1 file changed, 6 insertions(+)
>>
>> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
>> index 87adb100edd..daee2ed4fa0 100644
>> --- a/arch/arm/mach-snapdragon/board.c
>> +++ b/arch/arm/mach-snapdragon/board.c
>> @@ -35,6 +35,9 @@ static void show_psci_version(void)
>>   {
>>   	struct arm_smccc_res res;
>>   
>> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
>> +		return;
>> +
>>   	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>>   
>>   	/* Some older SoCs like MSM8916 don't always support PSCI */
>> @@ -58,6 +61,9 @@ static void qcom_psci_fixup(void *fdt)
>>   	int offset, ret;
>>   	struct arm_smccc_res res;
>>   
>> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
>> +		return;
>> +
>>   	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>>   
>>   	if ((int)res.a0 != PSCI_RET_NOT_SUPPORTED)
>>
> Do we even need this, patch 1 of the series disables SYSRESET_PSCI when
> you're doing this special snagboot mode so we shouldn't be calling
> show_psci_version at all.

Actually its not needed, so removed this patch in v10: 
https://lore.kernel.org/u-boot/20261101-snagboot-v10-0-e73d5cfedb8a@oss.qualcomm.com/

Regards,

Balaji

>

Re: [PATCH v9 4/8] arm: snapdragon: Add CONFIG_QCOM_SNAGBOOT_MODE option

[Balaji Selvanathan]

Hi Tom,

On 10/21/2026 11:17 PM, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:23PM +0530, Balaji Selvanathan wrote:
>> Add CONFIG_QCOM_SNAGBOOT_MODE to enable snagboot mode on Qualcomm
>> platforms. This config automatically selects the required dependencies.
>> Express the platform-specific requirements and configs that must be
>> selected and disabled in snagboot mode.
>>
>> Add QCOM_BOOT0_SNAGBOOT_MODE as a hidden boot0.h config, selected
>> automatically by QCOM_SNAGBOOT_MODE. This boot0.h config is for
>> disabling MMU at the start of U-Boot execution.
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
>> ---
>> Changes in v9:
>> - Remove depends on !IOMMU from QCOM_SNAGBOOT_MODE
>>
>> Changes in v7:
>> - No changes
>>
>> Changes in v5:
>> - Made QCOM_BOOT0_SNAGBOOT_MODE dependent on QCOM_SNAGBOOT_MODE so
>>    it is not exposed to users
>> - Add dependencies for QCOM_SNAGBOOT_MODE explicitly as "depends"
>>
>> Changes in v4:
>> - Renamed QCOM_SNAGBOOT_SUPPORT to QCOM_SNAGBOOT_MODE
>> - Added QCOM_BOOT0_SNAGBOOT_MODE for boot0.h which gets selected by
>>    QCOM_SNAGBOOT_MODE
>> - Document the platform-specific requirements and configs that must be
>>    disabled in snagboot mode.
>>
>> Changes in v3:
>> - Newly introduced in v3
>> ---
>>   arch/arm/mach-snapdragon/Kconfig | 19 +++++++++++++++++++
>>   1 file changed, 19 insertions(+)
>>
>> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
>> index ddded0029ef..db770ad6edc 100644
>> --- a/arch/arm/mach-snapdragon/Kconfig
>> +++ b/arch/arm/mach-snapdragon/Kconfig
>> @@ -82,4 +82,23 @@ config BOOT0_SDM845_WORKAROUND
>>   
>>   endchoice
>>   
>> +config QCOM_BOOT0_SNAGBOOT_MODE
>> +	bool
>> +	depends on QCOM_SNAGBOOT_MODE
>> +
>> +config QCOM_SNAGBOOT_MODE
>> +	bool "Build U-Boot for Snagboot mode loading"
>> +	select QCOM_BOOT0_SNAGBOOT_MODE
>> +	select ENABLE_ARM_SOC_BOOT0_HOOK
>> +	select SKIP_RELOCATE
>> +	select ENV_IS_NOWHERE
>> +	depends on !ENV_IS_IN_SCSI
> You probably want to look at testing ENV_IS_DEFAULT
Done. v10 depends on ENV_IS_DEFAULT, and drops the select ENV_IS_NOWHERE 
and the !ENV_IS_IN_SCSI depends.
>
>> +	depends on !PSCI_RESET
> You earlier change PSCI_RESET so this is redundant?
  Not quite. Patch 1 only changes SYSRESET_PSCI, and PSCI_RESET is a 
separate symbol (default y). I've dropped the depends on !PSCI_RESET 
anyway, and qcom-snagboot.config now unsets it instead.
>
>> +	depends on !SAVE_PREV_BL_INITRAMFS_START_ADDR
> Why?
save_prev_bl_data() treats the entry x0 value as a pointer to an FDT. In 
snagboot mode U-Boot is loaded by XBL, so x0 isn't an FDT and hence 
shouldnt be processed by U-Boot. v10 drops the depends on as it is not 
necessary and unsets it in qcom-snagboot.config.
>
>> +	depends on COUNTER_FREQUENCY != 0
> You probably need to be setting a default then for the snagboot case as
> I assume this is currently 0.
Dropped the depends on COUNTER_FREQUENCY != 0 as it is not necessary. 
The Lemans snagboot defconfig sets CONFIG_COUNTER_FREQUENCY=19200000.
>
>> +	depends on TEXT_BASE != 0
> You probably meant !POSITION_INDEPENDENT, and need to set a default.
> This doesn't work since TEXT_BASE is a hex and 0x0 != 0 is true in
> Kconfig.

Dropped the TEXT_BASE check. It is not necessary. The snagboot defconfig 
sets TEXT_BASE explicitly (0x1c100000 for Lemans).

Regards,

Balaji

>

Re: [PATCH v9 5/8] soc: qcom: cmd-db: Allow boot without CMD DB data

[Balaji Selvanathan]

Hi Tom,

On 10/21/2026 11:18 PM, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:24PM +0530, Balaji Selvanathan wrote:
>
>> In snagboot mode, XBL loads U-Boot directly without populating CMD DB.
>> The cmd-db driver fails to bind when CMD DB magic is invalid, blocking
>> boot even when CMD DB is not strictly required.
>>
>> Use QCOM_SNAGBOOT_MODE config to allow the driver to bind
>> successfully when CMD DB data is absent. When QCOM_SNAGBOOT_MODE is
>> enabled and CMD DB data is present, we log a warning.
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> Can we just not build this driver?

Actually I thought of that initially, but QCOM_RPMH depended on 
QCOM_COMMAND_DB so when i disabled QCOM_COMMAND_DB, rpmhcc node was not 
bound and that in turn caused issue in UFS probe.

Upon rethinking, we can remove the dependency of QCOM_RPMH 
on QCOM_COMMAND_DB as this is not always true, for eg, in Snagboot mode 
Cmd db data is not available. So removed the dependency and added stubs 
for some cmd db APIs (to make builds pass) in v10: 
https://lore.kernel.org/u-boot/20261101-snagboot-v10-0-e73d5cfedb8a@oss.qualcomm.com/

Regards,

Balaji

>

Re: [PATCH v9 6/8] arch: arm: dts: remove Lemans EVK override DTS

[Balaji Selvanathan]

Hi Tom,

On 10/21/2026 11:18 PM, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:25PM +0530, Balaji Selvanathan wrote:
>
>> Remove Lemans EVK override dtsi: arch/arm/dts/lemans-evk-u-boot.dtsi
>> provided the following SMEM modernize series is picked:
>> https://lore.kernel.org/u-boot/20260618-b4-modernise-smem-v3-0-472391477988@linaro.org/
>>
>> Memory node is not required as we can read the memory info from SMEM.
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> The series should say it depends on the other series. That other series
> should probably be deleting this file, too, yes?

That SMEM series (that got merged in main) didnt delete this file. Hence 
deleting it here.

Regards,

Balaji

>

Re: [PATCH v9 8/8] doc: qualcomm: Add snagboot mode documentation

[Balaji Selvanathan]

Hi Tom,

On 10/21/2026 11:22 PM, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:27PM +0530, Balaji Selvanathan wrote:
>
>> Document how to build and sign U-Boot for snagboot mode on Qualcomm
>> platforms, using Lemans-EVK as the example, and how to add a snagboot
>> defconfig for another board using the qcom-snagboot.config fragment.
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> [snip]
>> diff --git a/doc/board/qualcomm/snagboot.rst b/doc/board/qualcomm/snagboot.rst
>> new file mode 100644
>> index 00000000000..716d88b2ba2
>> --- /dev/null
>> +++ b/doc/board/qualcomm/snagboot.rst
>> @@ -0,0 +1,80 @@
>> +.. SPDX-License-Identifier: GPL-2.0+
>> +
>> +Snagboot Mode for Qualcomm Platforms
>> +=====================================
> The second line is too long, which means you didn't run this through CI
> or build docs with warnings-as-errors, as CI does.

Corrected this.

Regards,

Balaji

>

Re: [PATCH v9 8/8] doc: qualcomm: Add snagboot mode documentation

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1144 bytes --]

On Sun, Nov 01, 2026 at 04:10:44PM +0530, Balaji Selvanathan wrote:
> Hi Tom,
> 
> On 10/21/2026 11:22 PM, Tom Rini wrote:
> > On Wed, Oct 21, 2026 at 09:48:27PM +0530, Balaji Selvanathan wrote:
> > 
> > > Document how to build and sign U-Boot for snagboot mode on Qualcomm
> > > platforms, using Lemans-EVK as the example, and how to add a snagboot
> > > defconfig for another board using the qcom-snagboot.config fragment.
> > > 
> > > Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> > [snip]
> > > diff --git a/doc/board/qualcomm/snagboot.rst b/doc/board/qualcomm/snagboot.rst
> > > new file mode 100644
> > > index 00000000000..716d88b2ba2
> > > --- /dev/null
> > > +++ b/doc/board/qualcomm/snagboot.rst
> > > @@ -0,0 +1,80 @@
> > > +.. SPDX-License-Identifier: GPL-2.0+
> > > +
> > > +Snagboot Mode for Qualcomm Platforms
> > > +=====================================
> > The second line is too long, which means you didn't run this through CI
> > or build docs with warnings-as-errors, as CI does.
> 
> Corrected this.

I hope this means you put the whole tree through CI.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH v9 8/8] doc: qualcomm: Add snagboot mode documentation

[Balaji Selvanathan]

Hi Tom,

On 11/2/2026 10:11 PM, Tom Rini wrote:
> On Sun, Nov 01, 2026 at 04:10:44PM +0530, Balaji Selvanathan wrote:
>> Hi Tom,
>>
>> On 10/21/2026 11:22 PM, Tom Rini wrote:
>>> On Wed, Oct 21, 2026 at 09:48:27PM +0530, Balaji Selvanathan wrote:
>>>
>>>> Document how to build and sign U-Boot for snagboot mode on Qualcomm
>>>> platforms, using Lemans-EVK as the example, and how to add a snagboot
>>>> defconfig for another board using the qcom-snagboot.config fragment.
>>>>
>>>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
>>> [snip]
>>>> diff --git a/doc/board/qualcomm/snagboot.rst b/doc/board/qualcomm/snagboot.rst
>>>> new file mode 100644
>>>> index 00000000000..716d88b2ba2
>>>> --- /dev/null
>>>> +++ b/doc/board/qualcomm/snagboot.rst
>>>> @@ -0,0 +1,80 @@
>>>> +.. SPDX-License-Identifier: GPL-2.0+
>>>> +
>>>> +Snagboot Mode for Qualcomm Platforms
>>>> +=====================================
>>> The second line is too long, which means you didn't run this through CI
>>> or build docs with warnings-as-errors, as CI does.
>> Corrected this.
> I hope this means you put the whole tree through CI.

Yes, This is the CI link: https://github.com/u-boot/u-boot/pull/1069/checks

Regards,

Balaji

>

Re: [PATCH v9 2/8] arm: snapdragon: Guard PSCI functions with CONFIG_ARM_SMCCC

[Casey Connolly]

On 21/10/2026 19:35, Tom Rini wrote:
> On Wed, Oct 21, 2026 at 09:48:21PM +0530, Balaji Selvanathan wrote:
> 
>> In snagboot mode, U-Boot is loaded directly by XBL without PSCI
>> firmware support. The functions show_psci_version() and
>> qcom_psci_fixup() call arm_smccc_smc() which is unavailable when
>> CONFIG_ARM_SMCCC is disabled, causing build failures.
>>
>> Hence, added CONFIG_ARM_SMCCC guards to both functions.
>>
>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
>> ---
>> Changes in v7:
>> - No changes
>>
>> Changes in v5:
>> - No changes
>>
>> Changes in v4:
>> - No changes
>>
>> Changes in v3:
>> - Added CONFIG_ARM_SMCCC guards
>>
>> Changes in v2:
>> - Newly introduced in v2
>> ---
>>  arch/arm/mach-snapdragon/board.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
>> index 87adb100edd..daee2ed4fa0 100644
>> --- a/arch/arm/mach-snapdragon/board.c
>> +++ b/arch/arm/mach-snapdragon/board.c
>> @@ -35,6 +35,9 @@ static void show_psci_version(void)
>>  {
>>  	struct arm_smccc_res res;
>>  
>> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
>> +		return;
>> +
>>  	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>>  
>>  	/* Some older SoCs like MSM8916 don't always support PSCI */
>> @@ -58,6 +61,9 @@ static void qcom_psci_fixup(void *fdt)
>>  	int offset, ret;
>>  	struct arm_smccc_res res;
>>  
>> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
>> +		return;
>> +
>>  	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>>  
>>  	if ((int)res.a0 != PSCI_RET_NOT_SUPPORTED)
>>
> 
> Do we even need this, patch 1 of the series disables SYSRESET_PSCI when
> you're doing this special snagboot mode so we shouldn't be calling
> show_psci_version at all.

Somehow this show_psci_version() function has managed to stick around
mach-snapdragon since before I took over, I'm not sure why it's here, it
can certainly be dropped.

The second hunk unfortunately seems necessary still.>

-- 
// Casey (she/her)

Re: [PATCH v9 2/8] arm: snapdragon: Guard PSCI functions with CONFIG_ARM_SMCCC

[Balaji Selvanathan]

Hi Casey,

On 11/6/2026 10:15 PM, Casey Connolly wrote:
>
> On 21/10/2026 19:35, Tom Rini wrote:
>> On Wed, Oct 21, 2026 at 09:48:21PM +0530, Balaji Selvanathan wrote:
>>
>>> In snagboot mode, U-Boot is loaded directly by XBL without PSCI
>>> firmware support. The functions show_psci_version() and
>>> qcom_psci_fixup() call arm_smccc_smc() which is unavailable when
>>> CONFIG_ARM_SMCCC is disabled, causing build failures.
>>>
>>> Hence, added CONFIG_ARM_SMCCC guards to both functions.
>>>
>>> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
>>> ---
>>> Changes in v7:
>>> - No changes
>>>
>>> Changes in v5:
>>> - No changes
>>>
>>> Changes in v4:
>>> - No changes
>>>
>>> Changes in v3:
>>> - Added CONFIG_ARM_SMCCC guards
>>>
>>> Changes in v2:
>>> - Newly introduced in v2
>>> ---
>>>   arch/arm/mach-snapdragon/board.c | 6 ++++++
>>>   1 file changed, 6 insertions(+)
>>>
>>> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
>>> index 87adb100edd..daee2ed4fa0 100644
>>> --- a/arch/arm/mach-snapdragon/board.c
>>> +++ b/arch/arm/mach-snapdragon/board.c
>>> @@ -35,6 +35,9 @@ static void show_psci_version(void)
>>>   {
>>>   	struct arm_smccc_res res;
>>>   
>>> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
>>> +		return;
>>> +
>>>   	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>>>   
>>>   	/* Some older SoCs like MSM8916 don't always support PSCI */
>>> @@ -58,6 +61,9 @@ static void qcom_psci_fixup(void *fdt)
>>>   	int offset, ret;
>>>   	struct arm_smccc_res res;
>>>   
>>> +	if (!IS_ENABLED(CONFIG_ARM_SMCCC))
>>> +		return;
>>> +
>>>   	arm_smccc_smc(ARM_PSCI_0_2_FN_PSCI_VERSION, 0, 0, 0, 0, 0, 0, 0, &res);
>>>   
>>>   	if ((int)res.a0 != PSCI_RET_NOT_SUPPORTED)
>>>
>> Do we even need this, patch 1 of the series disables SYSRESET_PSCI when
>> you're doing this special snagboot mode so we shouldn't be calling
>> show_psci_version at all.
> Somehow this show_psci_version() function has managed to stick around
> mach-snapdragon since before I took over, I'm not sure why it's here, it
> can certainly be dropped.
>
> The second hunk unfortunately seems necessary still.>

We moved to v10 for this series: 
https://lore.kernel.org/u-boot/20261101-snagboot-v10-0-e73d5cfedb8a@oss.qualcomm.com/

In v10, this patch is removed as SYSRESET_PSCI is disabled if 
QCOM_SNAGBOOT_MODE is enabled (in patch1), so psci functions will not 
execute.

Thanks,

Balaji

>