[PATCH 0/5] Add SPL support for Qualcomm platforms, starting with sdm845

[PATCH 0/5] Add SPL support for Qualcomm platforms, starting with sdm845

[michael.srba]

[ context ]

Different generations of Qualcomm SoCs have differences in the boot
process. msm8916 (and similar) are quite straightforward:
[EL3]bootrom->sbl1->tz->[EL2]hyp->[EL1]aboot->linux (omitting non-AP
cores). msm8998, sdm845, kodiak and simiar are a bit more involved:
[EL3]bootrom->xbl_sec->[EL1]xbl_loader->[EL3]tz->[EL2]hyp->[EL1]uefi
->ABL->linux. Newer platforms like hamoa are even more involved.

Currently, u-boot proper can run in place of Linux, in place
of aboot, or in place of hyp. The option to run in place
of Linux is necessary because >99% of OEMs do not consider
the sale of a device to an end user a transfer of ownership,
that is, they sell the device with a hash of their public key
pre-burnt in the fuses.

[ end of context ]

U-Boot SPL, as it will be built using the defconfig added in this series,
replaces xbl_loader. If support for msm8916 or a similar platform
is added, it would replace sbl1. This will obviously only work on
the <1% of devices whose manufacturers consider the sale a transfer
of ownership, and of course most SBCs.

Unfortunately, starting with (iirc) msm8998, and getting progressively
worse, Qualcomm no longer consider a sale of their SoC a transfer
of ownership either. While it's possible to execute your code
in EL3 using either jtag or a patched devcfg, the former is impractical
while the latter is irrelevant for the purposes of running u-boot SPL
since the devcfg is parsed by trustzone. (this of course only applies
to the <1% of the devices where the OEM didn't lock the device down
prior to sale)

Given the above, this series uses an unintended feature in old builds
of xbl_sec which allows us to elevate to EL3. We also check if we
happen to already be running in EL3, in which case we proceed normally.
This can be the case e.g if JTAG was used to jump to u-boot SPL in EL3,
which may be the only option on e.g. kodiak. (Running in EL1 is not
really viable, because xbl_sec+xbl_loader are effectively sbl1 split
in half and replacing only one doesn't make much sense)

For now, only usb dfu is supported to load the next stage. Since we
don't support ram initialization, the next stage will need to run from
SRAM too, which is currently not supported. Additional patches will
be needed to make that work, at which point it will be possible
to use u-boot as a ufs/emmc programmer with zero proprietary code
in the boot chain (sans bootrom and part of xbl_sec, but the latter and
technically even the former could be skipped with JTAG)

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
Michael Srba (5):
      Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
      of_live: support in SPL
      drivers: allow clk_stub and spmi in SPL
      mach-snapdragon: support building SPL
      dts: add empty .dtsi for shift-axolotl

 Makefile                                           |  23 ++++
 arch/arm/Kconfig                                   |   6 +-
 arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi      |   4 +
 arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +++
 arch/arm/mach-snapdragon/Kconfig                   |  98 +++++++++++++++-
 arch/arm/mach-snapdragon/board.c                   |  26 +++++
 arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 ++--------
 .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 +++++++++
 .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++
 arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  25 ++++
 board/qualcomm/sdm845_spl.env                      |   1 +
 common/spl/Kconfig                                 |   6 +
 common/spl/spl.c                                   |  10 ++
 configs/sdm845_spl_defconfig                       | 130 +++++++++++++++++++++
 doc/board/qualcomm/index.rst                       |   1 +
 doc/board/qualcomm/spl.rst                         |  70 +++++++++++
 drivers/Makefile                                   |   2 +-
 drivers/clk/Kconfig                                |   6 +
 drivers/spmi/Kconfig                               |   6 +
 dts/Kconfig                                        |   5 +
 lib/Makefile                                       |   2 +-
 21 files changed, 616 insertions(+), 56 deletions(-)
---
base-commit: 4dc4080805fac1b1ed7606ce3bc8fb44a6d59d5e
change-id: 20260403-qcom_spl-0826843ba41c

Best regards,
--  
Michael Srba <Michael.Srba@seznam.cz>

[PATCH 1/5] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

On some platforms (at least Qualcomm), the bootrom expects an ELF file.
Since the contents of the ELF file are platform specific, add a config
option that allows specifying a linker script to use to produce the
ELF file.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 Makefile           | 23 +++++++++++++++++++++++
 common/spl/Kconfig |  6 ++++++
 2 files changed, 29 insertions(+)

diff --git a/Makefile b/Makefile
index f232d8b4ea2..85cd6137bca 100644
--- a/Makefile
+++ b/Makefile
@@ -1231,6 +1231,9 @@ ifneq ($(CONFIG_SPL_TARGET),)
 INPUTS-$(CONFIG_SPL) += $(CONFIG_SPL_TARGET:"%"=%)
 endif
 INPUTS-$(CONFIG_REMAKE_ELF) += u-boot.elf
+ifneq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
+INPUTS-y += spl/u-boot-spl.elf
+endif
 INPUTS-$(CONFIG_EFI_APP) += u-boot-app.efi
 INPUTS-$(CONFIG_EFI_STUB) += u-boot-payload.efi
 
@@ -2005,6 +2008,26 @@ u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
 	$(call if_changed_dep,cpp_lds)
 
 PHONY += prepare0
+
+ifeq ($(CONFIG_SPL),y)
+ifneq ($(CONFIG_SPL_REMAKE_ELF_LDSCRIPT),)
+
+SPL_REMAKE_ELF_LDSCRIPT := $(addprefix $(srctree)/,$(CONFIG_SPL_REMAKE_ELF_LDSCRIPT:"%"=%))
+
+spl/u-boot-spl-elf.lds: $(SPL_REMAKE_ELF_LDSCRIPT) FORCE
+	$(call if_changed_dep,cpp_lds)
+
+quiet_cmd_u-boot-spl-elf ?= LD      $@
+	cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
+	-T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
+	-Ttext=$(CONFIG_SPL_TEXT_BASE) -z max-page-size=0x1000
+spl/u-boot-spl.elf: spl/u-boot-spl.bin spl/u-boot-spl-elf.lds
+	$(Q)$(OBJCOPY) -I binary $(PLATFORM_ELFFLAGS) $< spl/u-boot-spl-elf.o
+	$(call if_changed,u-boot-spl-elf)
+
+endif
+endif
+
 # MediaTek's ARM-based u-boot needs a header to contains its load address
 # which is parsed by the BootROM.
 # If the SPL build is enabled, the header will be added to the spl binary,
diff --git a/common/spl/Kconfig b/common/spl/Kconfig
index 2998b7acb75..9eeb56cb68b 100644
--- a/common/spl/Kconfig
+++ b/common/spl/Kconfig
@@ -247,6 +247,12 @@ config SPL_HANDOFF
 	  proper. Also SPL can receive information from TPL in the same place
 	  if that is enabled.
 
+config SPL_REMAKE_ELF_LDSCRIPT
+	string "Linker script to run with u-boot-spl.bin as input"
+	help
+	  This allows specifying a linker script that will act on u-boot-spl.bin
+	  (see also REMAKE_ELF)
+
 config SPL_LDSCRIPT
 	string "Linker script for the SPL stage"
 	default "arch/arm/cpu/arm926ejs/sunxi/u-boot-spl.lds" if MACH_SUNIV

-- 
2.53.0

[PATCH 2/5] of_live: support in SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 common/spl/spl.c | 10 ++++++++++
 dts/Kconfig      |  5 +++++
 lib/Makefile     |  2 +-
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/common/spl/spl.c b/common/spl/spl.c
index fd915d9564b..84bd0f1ae20 100644
--- a/common/spl/spl.c
+++ b/common/spl/spl.c
@@ -17,6 +17,7 @@
 #include <irq_func.h>
 #include <log.h>
 #include <mapmem.h>
+#include <of_live.h>
 #include <serial.h>
 #include <spl.h>
 #include <spl_load.h>
@@ -510,6 +511,15 @@ static int spl_common_init(bool setup_malloc)
 			return ret;
 		}
 	}
+	if (CONFIG_IS_ENABLED(OF_LIVE)) {
+		ret = of_live_build(gd->fdt_blob,
+				    (struct device_node **)gd_of_root_ptr());
+		if (ret) {
+			debug("of_live_build() returned error %d\n", ret);
+			return ret;
+		}
+	}
+
 	if (CONFIG_IS_ENABLED(DM)) {
 		bootstage_start(BOOTSTAGE_ID_ACCUM_DM_SPL,
 				xpl_phase() == PHASE_TPL ? "dm tpl" : "dm_spl");
diff --git a/dts/Kconfig b/dts/Kconfig
index af8d30b45ab..f3472c9c0e8 100644
--- a/dts/Kconfig
+++ b/dts/Kconfig
@@ -86,6 +86,11 @@ config OF_LIVE
 	  enables a live tree which is available after relocation,
 	  and can be adjusted as needed.
 
+config SPL_OF_LIVE
+	bool "Enable use of a live tree in SPL"
+	depends on SPL_DM && SPL_OF_CONTROL
+
+
 config OF_UPSTREAM
 	bool "Enable use of devicetree imported from Linux kernel release"
 	depends on !COMPILE_TEST
diff --git a/lib/Makefile b/lib/Makefile
index 70667f3728c..fcceba9fef3 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -13,7 +13,6 @@ obj-$(CONFIG_FWU_MULTI_BANK_UPDATE) += fwu_updates/
 obj-$(CONFIG_LZMA) += lzma/
 obj-$(CONFIG_BZIP2) += bzip2/
 obj-$(CONFIG_FIT) += libfdt/
-obj-$(CONFIG_OF_LIVE) += of_live.o
 obj-$(CONFIG_CMD_DHRYSTONE) += dhry/
 obj-$(CONFIG_ARCH_AT91) += at91/
 obj-$(CONFIG_OPTEE_LIB) += optee/
@@ -55,6 +54,7 @@ obj-$(CONFIG_BITREVERSE) += bitrev.o
 obj-y += list_sort.o
 endif
 
+obj-$(CONFIG_$(PHASE_)OF_LIVE) += of_live.o
 obj-$(CONFIG_$(PHASE_)TPM) += tpm-common.o
 ifeq ($(CONFIG_$(PHASE_)TPM),y)
 obj-$(CONFIG_TPM) += tpm_api.o

-- 
2.53.0

[PATCH 3/5] drivers: allow clk_stub and spmi in SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Only Makefile and Kconfig changes necessary.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 drivers/Makefile     | 2 +-
 drivers/clk/Kconfig  | 6 ++++++
 drivers/spmi/Kconfig | 6 ++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/Makefile b/drivers/Makefile
index de993ae42ac..f76b38126e0 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)RAM) += ram/
 obj-$(CONFIG_$(PHASE_)RTC) += rtc/
 obj-$(CONFIG_$(PHASE_)SERIAL) += serial/
 obj-$(CONFIG_$(PHASE_)SPI) += spi/
+obj-$(CONFIG_$(PHASE_)SPMI) += spmi/
 obj-$(CONFIG_$(PHASE_)TIMER) += timer/
 obj-$(CONFIG_$(PHASE_)VIRTIO) += virtio/
 obj-$(CONFIG_$(PHASE_)DM_MAILBOX) += mailbox/
@@ -105,7 +106,6 @@ obj-$(CONFIG_DM_REBOOT_MODE) += reboot-mode/
 obj-y += rtc/
 obj-y += scsi/
 obj-y += sound/
-obj-y += spmi/
 obj-y += watchdog/
 obj-$(CONFIG_QE) += qe/
 obj-$(CONFIG_U_QE) += qe/
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index c88931c8ec4..fc2e152f975 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -114,6 +114,12 @@ config CLK_STUB
 	  Enable this to provide a stub clock driver for non-essential clock
 	  controllers.
 
+config SPL_CLK_STUB
+	bool "Stub clock driver"
+	depends on SPL_CLK
+	help
+	  Enablestub clock driver in SPL
+
 config CLK_BCM6345
 	bool "Clock controller driver for BCM6345"
 	depends on CLK && ARCH_BMIPS
diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
index ab4878ebae4..4c94f2e0ff4 100644
--- a/drivers/spmi/Kconfig
+++ b/drivers/spmi/Kconfig
@@ -8,6 +8,12 @@ config SPMI
 	  SPMI (System Power Management Interface) bus is used
 	  to connect PMIC devices on various SoCs.
 
+config SPL_SPMI
+	bool "Enable SPMI bus support in SPL"
+	depends on SPL_DM
+	---help---
+	  Select this to SPMI bus support in SPL
+
 config SPMI_MSM
 	bool "Support Qualcomm SPMI bus"
 	depends on SPMI

-- 
2.53.0

[PATCH 4/5] mach-snapdragon: support building SPL

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

Initially sdm845 support is added, and only usb boot
is supported for the next stage.

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/Kconfig                                   |   6 +-
 arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +++
 arch/arm/mach-snapdragon/Kconfig                   |  98 +++++++++++++++-
 arch/arm/mach-snapdragon/board.c                   |  26 +++++
 arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 ++--------
 .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 +++++++++
 .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++
 arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  25 ++++
 board/qualcomm/sdm845_spl.env                      |   1 +
 configs/sdm845_spl_defconfig                       | 130 +++++++++++++++++++++
 doc/board/qualcomm/index.rst                       |   1 +
 doc/board/qualcomm/spl.rst                         |  70 +++++++++++
 12 files changed, 554 insertions(+), 54 deletions(-)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index cd6a454fd60..5b45eabddda 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1135,9 +1135,13 @@ config ARCH_SNAPDRAGON
 	select SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK
 	select SYSRESET
-	select SYSRESET_PSCI
+	select SYSRESET_PSCI if !SPL
 	select ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
 	select MMU_PGPROT
+	imply DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC
+	imply SPL_EVENT if SPL_USB_DWC3_GENERIC
+	imply OF_LIVE if USB_DWC3_GENERIC
+	imply SPL_OF_LIVE if SPL_USB_DWC3_GENERIC
 	imply OF_UPSTREAM
 	imply CMD_DM
 	imply DM_USB_GADGET
diff --git a/arch/arm/dts/sdm845-u-boot.dtsi b/arch/arm/dts/sdm845-u-boot.dtsi
new file mode 100644
index 00000000000..59abc5dbd66
--- /dev/null
+++ b/arch/arm/dts/sdm845-u-boot.dtsi
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: GPL-2.0
+&gcc {
+	bootph-all;
+};
+
+&usb_1_hsphy {
+	bootph-all;
+};
+
+&usb_1_dwc3 {
+	bootph-all;
+};
+
+&rpmhcc: clock-controller {
+	bootph-all;
+};
diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
index 976c0e35fce..938e6ebd8bf 100644
--- a/arch/arm/mach-snapdragon/Kconfig
+++ b/arch/arm/mach-snapdragon/Kconfig
@@ -1,6 +1,24 @@
 if ARCH_SNAPDRAGON
 
+# SoC specific SRAM addresses
+
+# sdm845
+SDM845_BOOT_IMEM_BASE := 0x14800000
+SDM845_BOOT_IMEM_SIZE := 0x180000
+# we may not be able to use the whole BOOT_IMEM depending on the whitelisted regions hardcoded in PBL
+# (we could technically relocate ourselves after the fact)
+SDM845_BOOT_IMEM_OFFSET := 0x3f000
+SDM845_BOOT_IMEM_USABLE_SIZE := 0xc1000
+# technically the below would work, except the memory from 0x14833000 to 0x1483F000 gets trashed
+# between the ELF getting loaded and XBL_SEC jumping to our code
+#SDM845_BOOT_IMEM_OFFSET := 0x16000
+#SDM845_BOOT_IMEM_USABLE_SIZE := 0xea000
+SDM845_OCIMEM_BASE := 0x14680000
+SDM845_OCIMEM_SIZE := 0x00040000
+SDM845_OCIMEM_END  := $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_BASE) + $(SDM845_OCIMEM_SIZE) - 1))")
+
 config SYS_SOC
+	default "sdm845" if SPL_TARGET_SDM845
 	default "snapdragon"
 
 config SYS_VENDOR
@@ -11,8 +29,13 @@ config SYS_VENDOR
 	  Based on this option board/<CONFIG_SYS_VENDOR>/<CONFIG_SYS_BOARD>
 	  will be used as the custom board directory.
 
+# per-SoC dtsi isn't actually per SoC, to work around that we need to only build for one SoC
+config OF_UPSTREAM_BUILD_VENDOR
+	default n if SPL_TARGET_SDM845
+
 config SYS_MALLOC_LEN
 	default 0x10000000
+	default $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))") if SPL_TARGET_SDM845
 
 config SYS_MALLOC_F_LEN
 	default 0x2000
@@ -21,7 +44,7 @@ config SPL_SYS_MALLOC_F
 	default y
 
 config SPL_SYS_MALLOC_F_LEN
-	default 0x2000
+	default $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))") if SPL_TARGET_SDM845
 
 config SYS_MALLOC_LEN
 	default 0x800000
@@ -45,4 +68,77 @@ config SYS_CONFIG_NAME
 	  Based on this option include/configs/<CONFIG_SYS_CONFIG_NAME>.h header
 	  will be used for board configuration.
 
+config QCOM_SPL
+	bool "Enable SPL for Snapdragon SOCs"
+	select SUPPORT_SPL
+	select ARMV8_SPL_EXCEPTION_VECTORS
+	select ENABLE_ARM_SOC_BOOT0_HOOK
+	select SPL
+	select SPL_DM
+	select SPL_DM_GPIO
+	select SPL_DM_PMIC
+	select SPL_DM_USB_GADGET
+	select SPL_ENV_SUPPORT
+	select SPL_GPIO
+	select SPL_HAS_BSS_LINKER_SECTION
+	select SPL_LIBCOMMON_SUPPORT
+	select SPL_LIBDISK_SUPPORT
+	select SPL_LIBGENERIC_SUPPORT
+	select SPL_MMC
+	select SPL_OF_REAL
+	select SPL_OF_CONTROL
+	select SPL_PINCONF
+	select SPL_PINCTRL
+	select SPL_PINCTRL_FULL
+	select SPL_PINCTRL_GENERIC
+	select SPL_PINCONF_RECURSIVE
+	select SPL_PINMUX
+	select SPL_SPRINTF
+	select SPL_STRTO
+	select SPL_USB_GADGET
+
+config SPL_SHARES_INIT_SP_ADDR
+	default n
+
+config SPL_HAVE_INIT_STACK
+	default y
+
+# SPL targets
+
+config SPL_TARGET_SDM845
+	bool "Set reasonable default values for running SPL in SRAM on sdm845 devices"
+
+# config options selected based on target
+
+config SPL_REMAKE_ELF_LDSCRIPT
+	default "arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds" if SPL_TARGET_SDM845
+
+config SPL_BSS_START_ADDR
+	default $(SDM845_OCIMEM_BASE) if SPL_TARGET_SDM845
+
+# arbitrarily half of SDM845_OCIMEM_SIZE
+config SPL_BSS_MAX_SIZE
+	default $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))") if SPL_TARGET_SDM845
+
+config SYS_MALLOC_LEN
+	default 0x20000 if SPL_TARGET_SDM845
+
+config SPL_STACK
+	default $(SDM845_OCIMEM_END) if SPL_TARGET_SDM845
+
+config SPL_TEXT_BASE
+	default $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_BOOT_IMEM_BASE) + $(SDM845_BOOT_IMEM_OFFSET)))")  if SPL_TARGET_SDM845
+
+# these are used when running u-boot proper without DRAM initialized
+config MSM_OCIMEM_BASE
+	hex
+	default $(SDM845_OCIMEM_BASE) if SPL_TARGET_SDM845
+
+config MSM_OCIMEM_SIZE
+	hex
+	default $(SDM845_OCIMEM_SIZE) if SPL_TARGET_SDM845
+
+config SPL_MAX_SIZE
+	default $(SDM845_BOOT_IMEM_USABLE_SIZE) if SPL_TARGET_SDM845
+
 endif
diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
index 5fb3240acc5..0f980a954e4 100644
--- a/arch/arm/mach-snapdragon/board.c
+++ b/arch/arm/mach-snapdragon/board.c
@@ -33,6 +33,8 @@
 #include <sort.h>
 #include <time.h>
 
+#include <spl.h>
+
 #include "qcom-priv.h"
 
 DECLARE_GLOBAL_DATA_PTR;
@@ -223,6 +225,7 @@ int board_fdt_blob_setup(void **fdtp)
 		panic("Internal FDT is invalid and no external FDT was provided! (fdt=%#llx)\n",
 		      (phys_addr_t)external_fdt);
 
+#if !defined(CONFIG_SPL_BUILD)
 	/* Prefer memory information from internal DT if it's present */
 	if (internal_valid)
 		ret = qcom_parse_memory(internal_fdt);
@@ -239,6 +242,7 @@ int board_fdt_blob_setup(void **fdtp)
 
 	if (ret < 0)
 		panic("No valid memory ranges found!\n");
+#endif
 
 	/* If we have an external FDT, it can only have come from the Android bootloader. */
 	if (external_valid)
@@ -258,7 +262,9 @@ int board_fdt_blob_setup(void **fdtp)
 		ret = 0;
 	}
 
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)
 	qcom_psci_fixup(*fdtp);
+#endif
 
 	return ret;
 }
@@ -313,7 +319,9 @@ void __weak qcom_board_init(void)
 
 int board_init(void)
 {
+#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)
 	show_psci_version();
+#endif
 	qcom_board_init();
 	return 0;
 }
@@ -749,3 +757,21 @@ void enable_caches(void)
 	}
 	dcache_enable();
 }
+
+/* for SPL */
+
+__weak void reset_cpu(void)
+{
+	/* TODO */
+	while (1) {
+		/* loop forever */
+	};
+}
+
+u32 spl_boot_device(void)
+{
+	/* TODO: check boot reason to support UFS and sdcard */
+	u32 boot_device = BOOT_DEVICE_DFU;
+
+	return boot_device;
+}
diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
index 953cccad790..d0020da4cd1 100644
--- a/arch/arm/mach-snapdragon/include/mach/boot0.h
+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h
@@ -1,54 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0+ */
-/*
- * Workaround for "PSCI bug" on DragonBoard 410c
- * Copyright (C) 2021 Stephan Gerhold <stephan@gerhold.net>
- *
- * Syscall parameters taken from Qualcomm's LK fork (scm.h):
- * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
- *
- * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has
- * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall
- * that switches from 32-bit to 64-bit mode is executed at least once.
- *
- * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit
- * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if
- * U-Boot is installed to the "aboot" partition (replacing LK) the switch to
- * 64-bit mode never happens since U-Boot is already running in 64-bit mode.
- *
- * A workaround for this "PSCI bug" is to execute the TZ syscall when entering
- * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other
- * CPU cores in 64-bit mode as well.
- */
-#include <linux/arm-smccc.h>
-
-#define ARM_SMCCC_SIP32_FAST_CALL \
-	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
-
-	/*
-	 * U-Boot might be started in EL2 or EL3 with custom firmware.
-	 * In that case, we assume that the workaround is not necessary or is
-	 * handled already by the alternative firmware. Using the syscall in EL2
-	 * would demote U-Boot to EL1; in EL3 it would probably just crash.
-	 */
-	mrs	x0, CurrentEL
-	cmp	x0, #(1 << 2)	/* EL1 */
-	bne	reset
-
-	/* Prepare TZ syscall parameters */
-	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
-	movk	x0, #0x10f	/* SCM_SVC_MILESTONE_CMD_ID */
-	mov	x1, #0x12	/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */
-	adr	x2, el1_system_param
-	mov	x3, el1_system_param_end - el1_system_param
-
-	/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */
-	smc	#0
-
-	/* Something went wrong, perhaps PSCI is already in 64-bit mode? */
+#if defined(CONFIG_SPL_BUILD)
+#if CONFIG_SPL_TARGET_SDM845
+#include "sdm845_spl_boot0.h"
+#else
 	b	reset
-
-	.align	3
-el1_system_param:
-	.quad	0, 0, 0, 0, 0, 0, 0, 0, 0	/* el1_x0-x8 */
-	.quad	reset				/* el1_elr */
-el1_system_param_end:
+#endif
+#else
+/* db410c */
+#include "msm8916_boot0.h"
+#endif
diff --git a/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h
new file mode 100644
index 00000000000..953cccad790
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h
@@ -0,0 +1,54 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Workaround for "PSCI bug" on DragonBoard 410c
+ * Copyright (C) 2021 Stephan Gerhold <stephan@gerhold.net>
+ *
+ * Syscall parameters taken from Qualcomm's LK fork (scm.h):
+ * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
+ *
+ * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has
+ * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall
+ * that switches from 32-bit to 64-bit mode is executed at least once.
+ *
+ * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit
+ * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if
+ * U-Boot is installed to the "aboot" partition (replacing LK) the switch to
+ * 64-bit mode never happens since U-Boot is already running in 64-bit mode.
+ *
+ * A workaround for this "PSCI bug" is to execute the TZ syscall when entering
+ * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other
+ * CPU cores in 64-bit mode as well.
+ */
+#include <linux/arm-smccc.h>
+
+#define ARM_SMCCC_SIP32_FAST_CALL \
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
+
+	/*
+	 * U-Boot might be started in EL2 or EL3 with custom firmware.
+	 * In that case, we assume that the workaround is not necessary or is
+	 * handled already by the alternative firmware. Using the syscall in EL2
+	 * would demote U-Boot to EL1; in EL3 it would probably just crash.
+	 */
+	mrs	x0, CurrentEL
+	cmp	x0, #(1 << 2)	/* EL1 */
+	bne	reset
+
+	/* Prepare TZ syscall parameters */
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #0x10f	/* SCM_SVC_MILESTONE_CMD_ID */
+	mov	x1, #0x12	/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */
+	adr	x2, el1_system_param
+	mov	x3, el1_system_param_end - el1_system_param
+
+	/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */
+	smc	#0
+
+	/* Something went wrong, perhaps PSCI is already in 64-bit mode? */
+	b	reset
+
+	.align	3
+el1_system_param:
+	.quad	0, 0, 0, 0, 0, 0, 0, 0, 0	/* el1_x0-x8 */
+	.quad	reset				/* el1_elr */
+el1_system_param_end:
diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
new file mode 100644
index 00000000000..5f9081c9aaf
--- /dev/null
+++ b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
@@ -0,0 +1,120 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Workaround for non-qcom-signed code being entered in EL1 on sdm845
+ * Copyright (C) 2026 Michael Srba <Michael.Srba@seznam.cz>
+ *
+ * This code uses an unintentional ownership enhancing feature in older builds of XBL_SEC
+ * in order to elevate our privileges to EL3 as soon as possible after a system reset.
+ * This allows for a very close approximation of a clean state.
+ *
+ * Do note that you still need to own the device in the sense that you control the code that
+ * XBL_SEC jumps to in EL1, which is sadly not a level of ownership commonly afforded to you
+ * by the device manufacturer. On such devices, CVE-2021-30327 could help, but it's not documented
+ * and there is no PoC available utilizing it
+ *
+ */
+#include <linux/arm-smccc.h>
+
+#define SCM_SMC_FNID(s, c)	((((s) & 0xFF) << 8) | ((c) & 0xFF))
+
+#define ARM_SMCCC_SIP32_FAST_CALL \
+	ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)
+
+/* same as with qcom's TZ */
+#define QCOM_SCM_SVC_MEM_DUMP 0x03
+/* unlike the TZ counterpart, in XBL_SEC this simply unlocks the XPUs */
+#define QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS 0x10
+
+/*
+ * We put our payload in place of some SCM call, the important thing is that it's hopefully
+ * in a memory region that is not in cache.
+ *
+ * It would be cleaner to just put our code at the scm entry point in the vector table,
+ * however it seems that we can't force cache coherency from EL1 if EL3 doesn't have
+ * any reason to care about that.
+ */
+#define QCOM_SCM_SVC_DONOR 0x01
+#define QCOM_SCM_DONOR 0x16
+/* we replace the instructions at this address with a jump to the start of u-boot */
+/* NOTE: this address is specific to a particular XBL_SEC elf */
+#define XBL_SEC_DONOR_SCM_ADDR 0x146a0ce0
+
+/* gnu as doesn't implement these useful pseudoinstructions */
+.macro movq Xn, imm
+    movz    \Xn,  \imm & 0xFFFF
+    movk    \Xn, (\imm >> 16) & 0xFFFF, lsl 16
+    movk    \Xn, (\imm >> 32) & 0xFFFF, lsl 32
+    movk    \Xn, (\imm >> 48) & 0xFFFF, lsl 48
+.endm
+
+.macro movl Wn, imm
+    movz    \Wn,  \imm & 0xFFFF
+    movk    \Wn, (\imm >> 16) & 0xFFFF, lsl 16
+.endm
+
+/* copy 32 bits to an address from a label */
+.macro copy32 addr, text_base, addrofval, offset
+	movl	x0, \addr
+	add	x0, x0, \offset
+	movq	x1, \text_base
+	add	x1, x1, \addrofval
+	add	x1, x1, \offset
+	ldr	w2, [x1]
+	str	w2, [x0]
+	dc	cvau, x0 // flush cache to RAM straight away, we need to do it by address anyway
+.endm
+
+.macro copy_instructions addr, text_base, start_addr, num_bytes // num_bytes must be a multiple of 4
+	mov x3,	#0x0 // x0, x1 and w2 used by copy32
+1:
+	copy32	\addr, \text_base, \start_addr, x3
+	add	x3, x3, #0x4 // i+=4
+	cmp	x3, \num_bytes
+	blo	1b
+.endm
+
+	/*  If we're already in EL3 for some reason,  skip this whole thing */
+	mrs	x0, CurrentEL
+	cmp	x0, #(3 << 2)	/* EL3 */
+	beq	reset
+
+	/* disable the mmu */
+	mrs	x0, sctlr_el1
+	and     x0, x0, #~(1 << 0) // CTRL_M
+	msr	sctlr_el1, x0
+
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #SCM_SMC_FNID(QCOM_SCM_SVC_MEM_DUMP, QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS)
+	mov	x1, #0x0	/* no params */
+	mov	x6, #0x0
+
+	smc	#0 /* unlock XBL_SEC code area for writing (assuming old enough XBL_SEC build) */
+
+	/* this will also flush the writes from cache */
+	copy_instructions XBL_SEC_DONOR_SCM_ADDR, CONFIG_SPL_TEXT_BASE, el3_payload, #((el3_payload_end - el3_payload))
+
+	/* this probably doesn't affect EL3, but it doesn't hurt */
+	dsb	ish	/* block until cache is flushed */
+	ic	iallu	/* force re-fetch of our shiny new instructions */
+	dsb	ish	/* block until invalidation is finished */
+	isb	sy	/* unify here ? */
+
+	mov	x0, #ARM_SMCCC_SIP32_FAST_CALL
+	movk	x0, #SCM_SMC_FNID(QCOM_SCM_SVC_DONOR, QCOM_SCM_DONOR)
+	mov	x1, #0x0	/* no params */
+	smc	#0	/* call the payload */
+
+el3_ret_point:
+	b	reset
+
+el3_payload:
+	/* disable the mmu for EL3 too */
+	mrs	x0, sctlr_el3
+	and     x0, x0, #~(1 << 0) // CTRL_M
+	msr	sctlr_el3, x0
+
+	/*  */
+	movl	x0, CONFIG_SPL_TEXT_BASE
+	add	x0, x0, el3_ret_point
+	br	x0
+el3_payload_end:
diff --git a/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
new file mode 100644
index 00000000000..10912f416cc
--- /dev/null
+++ b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds
@@ -0,0 +1,25 @@
+TARGET("binary")
+INPUT("./xbl_sec.elf")
+
+OUTPUT_FORMAT("default")
+
+ENTRY(CONFIG_PLATFORM_ELFENTRY)
+PHDRS
+{
+	data PT_LOAD FLAGS(7);
+	xbl_sec PT_LOAD FLAGS(5 | (0x5 << 24));
+}
+SECTIONS
+{
+	. = 0x0000000014699000;
+	.xbl_sec : { // XBL_SEC nested ELF
+		. = .;
+		"./xbl_sec.elf"
+	} :xbl_sec
+
+	. = CONFIG_PLATFORM_ELFENTRY;
+
+	.data : {
+		*(.data*)
+	} :data
+}
diff --git a/board/qualcomm/sdm845_spl.env b/board/qualcomm/sdm845_spl.env
new file mode 100644
index 00000000000..5f1583c75f0
--- /dev/null
+++ b/board/qualcomm/sdm845_spl.env
@@ -0,0 +1 @@
+dfu_alt_info_ram=uboot.bin ram 0x1487FFC0 0x180000
diff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig
new file mode 100644
index 00000000000..eacee34cad6
--- /dev/null
+++ b/configs/sdm845_spl_defconfig
@@ -0,0 +1,130 @@
+CONFIG_ARM=y
+CONFIG_SKIP_LOWLEVEL_INIT=y
+CONFIG_COUNTER_FREQUENCY=19200000
+CONFIG_POSITION_INDEPENDENT=y
+# CONFIG_INIT_SP_RELATIVE is not set
+CONFIG_ARCH_SNAPDRAGON=y
+CONFIG_TEXT_BASE=0x14880000
+CONFIG_SYS_MALLOC_LEN=0x20000
+CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y
+CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x146bffff
+CONFIG_SPL_SERIAL=y
+CONFIG_SPL_DRIVERS_MISC=y
+CONFIG_SYS_BOOTM_LEN=0x4000000
+CONFIG_SYS_LOAD_ADDR=0x0
+CONFIG_WATCHDOG_TIMEOUT_MSECS=60000
+CONFIG_QCOM_SPL=y
+CONFIG_SPL_TARGET_SDM845=y
+CONFIG_SPL_MAX_SIZE=0x0
+CONFIG_SPL_PAYLOAD="u-boot.img"
+CONFIG_BUILD_TARGET="u-boot-with-spl.elf"
+CONFIG_SKIP_RELOCATE=y
+# CONFIG_EFI_LOADER is not set
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_USE_PREBOOT=y
+CONFIG_CONSOLE_RECORD=y
+CONFIG_CONSOLE_RECORD_OUT_SIZE=0xA000
+CONFIG_CONSOLE_RECORD_OUT_SIZE_F=0xA000
+CONFIG_LOGLEVEL=9
+CONFIG_SYS_STDIO_DEREGISTER=y
+CONFIG_LOG_MAX_LEVEL=9
+CONFIG_SPL_LOG=y
+CONFIG_SPL_LOG_MAX_LEVEL=9
+# CONFIG_DISPLAY_CPUINFO is not set
+CONFIG_SPL_DMA=y
+CONFIG_SPL_DM_RESET=y
+CONFIG_SPL_POWER_DOMAIN=y
+CONFIG_BOOTM_NETBSD=y
+CONFIG_CMD_CLK=y
+CONFIG_CMD_DFU=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_UFS=y
+CONFIG_CMD_CAT=y
+CONFIG_CMD_RNG=y
+CONFIG_CMD_REGULATOR=y
+CONFIG_CMD_LOG=y
+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="board/qualcomm/sdm845_spl.env"
+CONFIG_NET_RANDOM_ETHADDR=y
+# CONFIG_OFNODE_MULTI_TREE is not set
+CONFIG_BUTTON_QCOM_PMIC=y
+CONFIG_CLK=y
+CONFIG_SPL_CLK=y
+CONFIG_CLK_STUB=y
+CONFIG_SPL_CLK_STUB=y
+CONFIG_CLK_QCOM_SDM845=y
+CONFIG_DFU_MMC=y
+CONFIG_DFU_RAM=y
+CONFIG_DFU_SCSI=y
+CONFIG_SYS_DFU_DATA_BUF_SIZE=0x5000
+CONFIG_DMA=y
+CONFIG_DMA_CHANNELS=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_BUF_ADDR=0xdeadbeef
+CONFIG_MSM_GPIO=y
+CONFIG_QCOM_PMIC_GPIO=y
+CONFIG_DM_I2C=y
+CONFIG_SYS_I2C_QUP=y
+CONFIG_I2C_MUX=y
+CONFIG_IOMMU=y
+CONFIG_QCOM_HYP_SMMU=y
+CONFIG_MISC=y
+CONFIG_NVMEM=y
+CONFIG_I2C_EEPROM=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_ADMA=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_DM_ETH_PHY=y
+CONFIG_PHY=y
+CONFIG_SPL_PHY=y
+CONFIG_PHY_QCOM_QMP_UFS=y
+CONFIG_PHY_QCOM_QUSB2=y
+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y
+CONFIG_PHY_QCOM_SNPS_EUSB2=y
+CONFIG_PHY_QCOM_USB_HS_28NM=y
+CONFIG_PHY_QCOM_USB_SS=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_QCOM_APQ8016=y
+CONFIG_PINCTRL_QCOM_APQ8096=y
+CONFIG_PINCTRL_QCOM_QCM2290=y
+CONFIG_PINCTRL_QCOM_QCS404=y
+CONFIG_PINCTRL_QCOM_SDM845=y
+CONFIG_PINCTRL_QCOM_SM6115=y
+CONFIG_PINCTRL_QCOM_SM8250=y
+CONFIG_PINCTRL_QCOM_SM8550=y
+CONFIG_PINCTRL_QCOM_SM8650=y
+CONFIG_PINCTRL_QCOM_X1E80100=y
+CONFIG_DM_PMIC=y
+CONFIG_PMIC_QCOM=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_QCOM_RPMH=y
+CONFIG_DM_RNG=y
+CONFIG_RNG_MSM=y
+CONFIG_SCSI=y
+CONFIG_MSM_SERIAL=y
+CONFIG_SOC_QCOM=y
+CONFIG_QCOM_COMMAND_DB=y
+CONFIG_QCOM_RPMH=y
+CONFIG_SPL_SPMI=y
+CONFIG_SPMI_MSM=y
+CONFIG_SYSINFO=y
+CONFIG_SYSINFO_SMBIOS=y
+CONFIG_SYSRESET_QCOM_PSHOLD=y
+CONFIG_USB=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_GENERIC=y
+CONFIG_SPL_USB_DWC3_GENERIC=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_VENDOR_NUM=0x0525
+CONFIG_USB_GADGET_PRODUCT_NUM=0xb4a4
+CONFIG_USB_ETHER=y
+CONFIG_USB_ETH_CDC=y
+CONFIG_SPL_DFU=y
+CONFIG_SPL_USB_SDP_SUPPORT=y
+CONFIG_UFS=y
+# CONFIG_SPL_USE_TINY_PRINTF is not set
+CONFIG_CIRCBUF=y
diff --git a/doc/board/qualcomm/index.rst b/doc/board/qualcomm/index.rst
index 3238a68e859..65e3e222f68 100644
--- a/doc/board/qualcomm/index.rst
+++ b/doc/board/qualcomm/index.rst
@@ -14,3 +14,4 @@ Qualcomm
    iq8
    phones
    rdp
+   spl
diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
new file mode 100644
index 00000000000..817c76b659e
--- /dev/null
+++ b/doc/board/qualcomm/spl.rst
@@ -0,0 +1,70 @@
+.. SPDX-License-Identifier: GPL-2.0+
+.. sectionauthor:: Michael Srba <Michael.Srba@seznam.cz>
+
+======================================
+Booting U-Boot SPL on Qualcomm SoCs
+======================================
+
+Overview
+----------
+The boot process on sdm845 (and some other Qualcomm SoCs) starts with the bootrom
+of the Application Processor, which executes XBL_SEC, which jumps to "OEM" code
+in EL1. Production device typically are "fused", with a hash of the OEM's signing
+key burnt into one of the "QFUSE" banks on the SoC making it impossible to run
+custom bootloader code. As a result U-Boot SPL is only supported on unfused
+("secureboot off") devices. XBL_SEC is always signed by qualcomm, and the fuses
+to disable turning off signature verification for it are always burnt at the
+factory, so replacing XBL_SEC is impossible without using JTAG. Of course JTAG
+is typically disabled on devices that have secure boot enabled, or at minimum
+greatly neutered.
+
+U-Boot SPL for Qualcomm platforms uses a custom linker script (per SoC) to build a bootable ELF.
+For sdm845 (and some other platforms) this has two sections, u-boot code and an embedded
+xbl_sec elf (signed by qualcomm). To boot on an unfused SoC, the elf additionally
+needs to have hash sections added, which can be accomplished with qtestsign.
+
+Currently, sdm845 is supported. You need a device with secure boot disabled
+(or with secure boot enabled if you enabled it yourself and have the private key,
+though for full security you'd also want to disable JTAG which will remove your ability
+to mess with the control flow in the bootrom (immutable) and in XBL_SEC (signed)).
+
+Building
+----------
+First, obtain an xbl_sec that includes the EL3 privilege escalation feature
+and place it at .output/xbl_sec.elf. You can extract it from an xbl elf.
+If you're unable to find one, you can also use JTAG/SWD to break at the SMC
+entry and use gdp to jump to the u-boot entry point in EL3.
+
+To build a bootable image, you need to use a defconfig specific to your SoC.
+This is because the ELF has to specify where in the address space to put u-boot SPL,
+and this may differ per SoC. There may be other SoC-dependent build time choices,
+though in principle those could be made at runtime.
+
+.. code-block:: shell
+   make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl sdm845_spl_defconfig
+
+Then compile u-boot and specify the dts for your board (technically nothing about the resulting
+SPL image should be board-specific, but there are no non-board-specific device trees in Linux)
+
+.. code-block:: shell
+   make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl
+
+Finally, use qtestsign to add the hash segments required by PBL
+
+.. code-block:: shell
+   qtestsign -v 5 -o .output/spl/u-boot-spl_signed.elf prog .output/spl/u-boot-spl.elf
+
+Running
+----------
+Currently, U-Boot SPL for qualcomm platforms expects to be booted via EDL:
+
+.. code-block:: shell
+   edl.py --loader=$PWD/.output/spl/u-boot-spl_signed.elf
+
+SPL will then launch the DFU gadget and wait for you to upload u-boot proper:
+
+.. code-block:: shell
+   dfu-util -RD .output/u-boot.img
+
+u-boot proper will then likely crash, since SPL currently doesn't init DRAM on qualcomm platforms
+and u-boot proper currently doesn't support running from SRAM. The latter should be an easy fix.

-- 
2.53.0

[PATCH 5/5] dts: add empty .dtsi for shift-axolotl

[michael.srba]

From: Michael Srba <Michael.Srba@seznam.cz>

This is necessary to select shift-axolotl as a target, in practice
the upstream dts will be used

Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
---
 arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
new file mode 100644
index 00000000000..89a2071fed4
--- /dev/null
+++ b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/* When there is no previous bootloader, the memory node won't get filled in.
+ */

-- 
2.53.0

Re: [PATCH 2/5] of_live: support in SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 739 bytes --]

On Sat, Apr 04, 2026 at 01:18:17AM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
[snip]
> diff --git a/dts/Kconfig b/dts/Kconfig
> index af8d30b45ab..f3472c9c0e8 100644
> --- a/dts/Kconfig
> +++ b/dts/Kconfig
> @@ -86,6 +86,11 @@ config OF_LIVE
>  	  enables a live tree which is available after relocation,
>  	  and can be adjusted as needed.
>  
> +config SPL_OF_LIVE
> +	bool "Enable use of a live tree in SPL"
> +	depends on SPL_DM && SPL_OF_CONTROL
> +
> +

Extra blank space, and we should have a minimal "help" entry here,
thanks.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 3/5] drivers: allow clk_stub and spmi in SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 786 bytes --]

On Sat, Apr 04, 2026 at 01:18:18AM +0200, michael.srba@seznam.cz wrote:
> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Only Makefile and Kconfig changes necessary.
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
[snip]
> diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
> index ab4878ebae4..4c94f2e0ff4 100644
> --- a/drivers/spmi/Kconfig
> +++ b/drivers/spmi/Kconfig
> @@ -8,6 +8,12 @@ config SPMI
>  	  SPMI (System Power Management Interface) bus is used
>  	  to connect PMIC devices on various SoCs.
>  
> +config SPL_SPMI
> +	bool "Enable SPMI bus support in SPL"
> +	depends on SPL_DM
> +	---help---
> +	  Select this to SPMI bus support in SPL
> +

We should avoid adding more "---help---" lines, just use "help" please.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 4/5] mach-snapdragon: support building SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3329 bytes --]

On Sat, Apr 04, 2026 at 01:18:19AM +0200, michael.srba@seznam.cz wrote:

> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Initially sdm845 support is added, and only usb boot
> is supported for the next stage.
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
[snip]
> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> index 976c0e35fce..938e6ebd8bf 100644
> --- a/arch/arm/mach-snapdragon/Kconfig
> +++ b/arch/arm/mach-snapdragon/Kconfig
> @@ -1,6 +1,24 @@
>  if ARCH_SNAPDRAGON
>  
> +# SoC specific SRAM addresses
> +
> +# sdm845
> +SDM845_BOOT_IMEM_BASE := 0x14800000
> +SDM845_BOOT_IMEM_SIZE := 0x180000
> +# we may not be able to use the whole BOOT_IMEM depending on the whitelisted regions hardcoded in PBL
> +# (we could technically relocate ourselves after the fact)
> +SDM845_BOOT_IMEM_OFFSET := 0x3f000
> +SDM845_BOOT_IMEM_USABLE_SIZE := 0xc1000
> +# technically the below would work, except the memory from 0x14833000 to 0x1483F000 gets trashed
> +# between the ELF getting loaded and XBL_SEC jumping to our code
> +#SDM845_BOOT_IMEM_OFFSET := 0x16000
> +#SDM845_BOOT_IMEM_USABLE_SIZE := 0xea000
> +SDM845_OCIMEM_BASE := 0x14680000
> +SDM845_OCIMEM_SIZE := 0x00040000
> +SDM845_OCIMEM_END  := $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_BASE) + $(SDM845_OCIMEM_SIZE) - 1))")

I didn't know Kconfig even allowed this. And I *really* don't like it,
and I think it's going in the wrong direction with respect to being able
to configure a system. If these are configurable, then they need to be
"hex" type "config" options, and then used later on. Otherwise they
should just be the evaluated value as "default ... if ..." later on,
instead.

[snip]
> +config QCOM_SPL
> +	bool "Enable SPL for Snapdragon SOCs"
> +	select SUPPORT_SPL
> +	select ARMV8_SPL_EXCEPTION_VECTORS
> +	select ENABLE_ARM_SOC_BOOT0_HOOK
> +	select SPL
> +	select SPL_DM
> +	select SPL_DM_GPIO
> +	select SPL_DM_PMIC
> +	select SPL_DM_USB_GADGET
> +	select SPL_ENV_SUPPORT
> +	select SPL_GPIO
> +	select SPL_HAS_BSS_LINKER_SECTION
> +	select SPL_LIBCOMMON_SUPPORT
> +	select SPL_LIBDISK_SUPPORT
> +	select SPL_LIBGENERIC_SUPPORT
> +	select SPL_MMC
> +	select SPL_OF_REAL
> +	select SPL_OF_CONTROL
> +	select SPL_PINCONF
> +	select SPL_PINCTRL
> +	select SPL_PINCTRL_FULL
> +	select SPL_PINCTRL_GENERIC
> +	select SPL_PINCONF_RECURSIVE
> +	select SPL_PINMUX
> +	select SPL_SPRINTF
> +	select SPL_STRTO
> +	select SPL_USB_GADGET

This should be in the appropriate defconfig, or a config fragment if
re-used a lot. Or mirroring other platforms, as part of the stanza for
TARGET_... (or ARCH_...) as needed.

[snip]
> diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
> new file mode 100644
> index 00000000000..817c76b659e
> --- /dev/null
> +++ b/doc/board/qualcomm/spl.rst
> @@ -0,0 +1,70 @@
> +.. SPDX-License-Identifier: GPL-2.0+
> +.. sectionauthor:: Michael Srba <Michael.Srba@seznam.cz>
> +
> +======================================
> +Booting U-Boot SPL on Qualcomm SoCs
> +======================================
> +
> +Overview
> +----------

These are style errors that will trip up CI when it builds the docs.
Please run "make htmldocs KDOC_WERROR=1" for v2, thanks.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 4/5] mach-snapdragon: support building SPL

[Simon Glass]

Hi Michael,

On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
> mach-snapdragon: support building SPL
>
> Initially sdm845 support is added, and only usb boot
> is supported for the next stage.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
>  arch/arm/Kconfig                                   |   6 +-
>  arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +++
>  arch/arm/mach-snapdragon/Kconfig                   |  98 +++++++++++++++-
>  arch/arm/mach-snapdragon/board.c                   |  26 +++++
>  arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 ++--------
>  .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 +++++++++
>  .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++
>  arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  25 ++++
>  board/qualcomm/sdm845_spl.env                      |   1 +
>  configs/sdm845_spl_defconfig                       | 130 +++++++++++++++++++++
>  doc/board/qualcomm/index.rst                       |   1 +
>  doc/board/qualcomm/spl.rst                         |  70 +++++++++++
>  12 files changed, 554 insertions(+), 54 deletions(-)

Please can you split this? E.g.

- boot0.h refactoring and msm8916 header extraction
- sdm845-specific boot0.h with the EL3 escalation code
- Kconfig additions for QCOM_SPL and SPL_TARGET_SDM845
- board.c SPL support functions
- defconfig and documentation

> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> @@ -1,6 +1,24 @@
> +config SYS_MALLOC_LEN
> +     default 0x10000000
> +     default $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))") if SPL_TARGET_SDM845

There are three definitions of SYS_MALLOC_LEN in this file. Only the
first matching default takes effect, so the conditional default for
SPL_TARGET_SDM845 will never be used. Please can you reorder these so
the conditional default comes first, or consolidate them.

> diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h
> @@ -1,54 +1,11 @@
> +#if defined(CONFIG_SPL_BUILD)
> +#if CONFIG_SPL_TARGET_SDM845

Please can you use defined(CONFIG_SPL_TARGET_SDM845) here for
consistency with the line above and to avoid relying on the value of
an undefined symbol.

> diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
> @@ -0,0 +1,120 @@
> +     movl    x0, CONFIG_SPL_TEXT_BASE
> +     add     x0, x0, el3_ret_point
> +     br      x0

The el3_ret_point label is an absolute address, but you are adding it
to CONFIG_SPL_TEXT_BASE. Don't you want the offset of el3_ret_point
relative to some base, e.g. (el3_ret_point - _start) ? If not, please
can you add a comment?

> diff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h
> +     /*  */
> +     movl    x0, CONFIG_SPL_TEXT_BASE

Empty comment looks like a leftover - please remove or fill in.

> diff --git a/arch/arm/dts/sdm845-u-boot.dtsi b/arch/arm/dts/sdm845-u-boot.dtsi
> +&rpmhcc: clock-controller {
> +     bootph-all;
> +};

This syntax is incorrect - you cannot redefine a label when
referencing a node. Try:

&rpmhcc {
  bootph-all;
};

> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
> @@ -749,3 +757,21 @@ void enable_caches(void)
> +__weak void reset_cpu(void)
> +{
> +     /* TODO */
> +     while (1) {
> +             /* loop forever */
> +     };
> +}

This function is not guarded by CONFIG_SPL_BUILD, so it will be
compiled for U-Boot proper as well. Since the defconfig enables
CONFIG_SYSRESET_QCOM_PSHOLD, there could be multiple reset_cpu()
implementations. Please can you wrap this in #ifdef CONFIG_SPL_BUILD
or move it to a separate SPL-specific file.

> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
> @@ -757,3 +757,21 @@ void enable_caches(void)
> +u32 spl_boot_device(void)
> +{
> +     /* TODO: check boot reason to support UFS and sdcard */
> +     u32 boot_device = BOOT_DEVICE_DFU;
> +
> +     return boot_device;
> +}

Same here - please guard with #ifdef CONFIG_SPL_BUILD

Regards,
Simon

Re: [0/5] Add SPL support for Qualcomm platforms, starting with sdm845

[Simon Glass]

Hi Michael,

On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
> U-Boot SPL, as it will be built using the defconfig added in this series,
> replaces xbl_loader.

Please can you clarify what happens on devices where XBL_SEC does not
have this vulnerability? The code checks for EL3 and skips to reset,
but if the SMC call to unlock secure regions fails, does the code
handle this gracefully or crash?

Regards,
Simon

Re: [PATCH 1/5] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Simon Glass]

Hi Michael,

On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
> Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
>
> On some platforms (at least Qualcomm), the bootrom expects an ELF file.
> Since the contents of the ELF file are platform specific, add a config
> option that allows specifying a linker script to use to produce the
> ELF file.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>

> diff --git a/Makefile b/Makefile
> @@ -2014,6 +2017,26 @@ u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
> +quiet_cmd_u-boot-spl-elf ?= LD      $@
> +     cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
> +     -T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
> +     -Ttext=$(CONFIG_SPL_TEXT_BASE) -z max-page-size=0x1000

The existing cmd_u-boot-spl-elf includes $(if
$(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) for endianness. Please can you add
the same here for consistency.

Since this redefines cmd_u-boot-spl-elf using ?=, the earlier
definition takes precedence if both SPL_REMAKE_ELF and
SPL_REMAKE_ELF_LDSCRIPT are enabled. This is probably fine since
enabling both does not make sense, but maybe add 'depends on
!SPL_REMAKE_ELF' or a note in the Kconfig help text.

> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
> @@ -247,6 +247,12 @@ config SPL_HANDOFF
> +config SPL_REMAKE_ELF_LDSCRIPT
> +     string "Linker script to run with u-boot-spl.bin as input"
> +     help
> +       This allows specifying a linker script that will act on u-boot-spl.bin
> +       (see also REMAKE_ELF)

Can you explain when you would need a custom linker script rather than
just using SPL_REMAKE_ELF ?. Something like:

Some platforms (e.g. Qualcomm) require the bootrom to load a custom
ELF format. Unlike SPL_REMAKE_ELF which uses a standard linker script,
this allows a platform-specific one.

Regards,
Simon

Re: [PATCH 2/5] of_live: support in SPL

[Simon Glass]

Hi Michael,

On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
> of_live: support in SPL
>
> Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>

> diff --git a/dts/Kconfig b/dts/Kconfig
> @@ -86,6 +86,11 @@ config OF_LIVE
> +config SPL_OF_LIVE
> +     bool "Enable use of a live tree in SPL"
> +     depends on SPL_DM && SPL_OF_CONTROL
> +
> +

Please can you add help text here? The main OF_LIVE option has a
helpful explanation. Also there should only be one blank line after
the entry.

> diff --git a/common/spl/spl.c b/common/spl/spl.c
> @@ -510,6 +511,15 @@ static int spl_common_init(bool setup_malloc)
> +     if (CONFIG_IS_ENABLED(OF_LIVE)) {
> +             ret = of_live_build(gd->fdt_blob,
> +                                 (struct device_node **)gd_of_root_ptr());
> +             if (ret) {
> +                     debug("of_live_build() returned error %d\n", ret);
> +                     return ret;
> +             }
> +     }

The U-Boot proper code in initr_of_live() wraps of_live_build() with
bootstage_start()/bootstage_accum() using BOOTSTAGE_ID_ACCUM_OF_LIVE.
Please can you do the same here for consistency and SPL boot-time
tracking.

Regards,
Simon

Re: [PATCH 3/5] drivers: allow clk_stub and spmi in SPL

[Simon Glass]

Hi Michael,

On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
> drivers: allow clk_stub and spmi in SPL
>
> Only Makefile and Kconfig changes necessary.
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>

> diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
> @@ -114,6 +114,12 @@ config CLK_STUB
> +config SPL_CLK_STUB
> +     bool "Stub clock driver"
> +     depends on SPL_CLK
> +     help
> +       Enablestub clock driver in SPL

Enable stub

> diff --git a/drivers/spmi/Kconfig b/drivers/spmi/Kconfig
> @@ -8,6 +8,12 @@ config SPMI
> +config SPL_SPMI
> +     bool "Enable SPMI bus support in SPL"
> +     depends on SPL_DM
> +     ---help---
> +       Select this to SPMI bus support in SPL

Missing word: Select this to enable SPMI bus support in SPL

> diff --git a/drivers/Makefile b/drivers/Makefile
> @@ -35,6 +35,7 @@ obj-$(CONFIG_$(PHASE_)SPI) += spi/
> +obj-$(CONFIG_$(PHASE_)SPMI) += spmi/

This alone is not enough since drivers/spmi/Makefile still uses
CONFIG_SPMI, not CONFIG_$(PHASE_)SPMI. During an SPL build with
CONFIG_SPL_SPMI=y, the directory will be entered but spmi-uclass.o
will not be built. Please can you update drivers/spmi/Makefile to use
the PHASE_ pattern, similar to drivers/clk/Makefile.

Regards,
Simon

Re: [PATCH 5/5] dts: add empty .dtsi for shift-axolotl

[Simon Glass]

Hi Michael,

On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
> dts: add empty .dtsi for shift-axolotl
>
> This is necessary to select shift-axolotl as a target, in practice
> the upstream dts will be used
>
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>

> diff --git a/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
> +// SPDX-License-Identifier: GPL-2.0
> +
> +/* When there is no previous bootloader, the memory node won't get filled in.
> + */

The build system uses the first matching -u-boot.dtsi file. Since this
board-specific file exists, it takes priority over sdm845-u-boot.dtsi,
which adds bootph-all properties to gcc, usb_1_hsphy, usb_1_dwc3, and
rpmhcc needed for USB DFU in SPL.

Please can you add:

    #include "sdm845-u-boot.dtsi"

This is the standard pattern - e.g. meson-gxbb-p200-u-boot.dtsi which
includes meson-gxbb-u-boot.dtsi.

The commit message says the file is 'empty' but it contains a comment
about memory. If that comment is relevant, perhaps clarify what it
means for this board. Otherwise I suggest removing it until there is
actual content.

Regards,
Simon

Re: [PATCH 1/5] Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature

[Michael Srba]

On 4/6/26 17:50, Simon Glass wrote:
> Hi Michael,
>
> On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
>> Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
>>
>> On some platforms (at least Qualcomm), the bootrom expects an ELF file.
>> Since the contents of the ELF file are platform specific, add a config
>> option that allows specifying a linker script to use to produce the
>> ELF file.
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> diff --git a/Makefile b/Makefile
>> @@ -2014,6 +2017,26 @@ u-boot-elf.lds: arch/u-boot-elf.lds prepare FORCE
>> +quiet_cmd_u-boot-spl-elf ?= LD      $@
>> +     cmd_u-boot-spl-elf ?= $(LD) spl/u-boot-spl-elf.o -o $@ \
>> +     -T spl/u-boot-spl-elf.lds --defsym=$(CONFIG_PLATFORM_ELFENTRY)=$(CONFIG_SPL_TEXT_BASE) \
>> +     -Ttext=$(CONFIG_SPL_TEXT_BASE) -z max-page-size=0x1000
> The existing cmd_u-boot-spl-elf includes $(if
> $(CONFIG_SYS_BIG_ENDIAN),-EB,-EL) for endianness. Please can you add
> the same here for consistency.
>
> Since this redefines cmd_u-boot-spl-elf using ?=, the earlier
> definition takes precedence if both SPL_REMAKE_ELF and
> SPL_REMAKE_ELF_LDSCRIPT are enabled. This is probably fine since
> enabling both does not make sense, but maybe add 'depends on
> !SPL_REMAKE_ELF' or a note in the Kconfig help text.
Hi,
slowly going through the reviews, I think when I originally worked on this
u-boot didn't support remaking SPL into an ELF at all. I completely missed
this change when rebasing (or didn't miss it, made a mental note, and
completely forgot... hard to say at this point).

I could certainly just
add a conditional, though there's probably cleaner ways to do this where
only the linker script is conditional (not sure what to do about the page
size, would need to test to double check if it's even actually necessary).

Actually, making the linker script path default to the standard one would be
the cleanest option by some measures, but since you didn't suggest it
I assume that's not your preferred solution?

>
>> diff --git a/common/spl/Kconfig b/common/spl/Kconfig
>> @@ -247,6 +247,12 @@ config SPL_HANDOFF
>> +config SPL_REMAKE_ELF_LDSCRIPT
>> +     string "Linker script to run with u-boot-spl.bin as input"
>> +     help
>> +       This allows specifying a linker script that will act on u-boot-spl.bin
>> +       (see also REMAKE_ELF)
> Can you explain when you would need a custom linker script rather than
> just using SPL_REMAKE_ELF ?. Something like:
>
> Some platforms (e.g. Qualcomm) require the bootrom to load a custom
> ELF format. Unlike SPL_REMAKE_ELF which uses a standard linker script,
> this allows a platform-specific one.
Can do
> Regards,
> Simon

Re: [PATCH 5/5] dts: add empty .dtsi for shift-axolotl

[Michael Srba]

Hi,

On 4/6/26 17:53, Simon Glass wrote:
> Hi Michael,
>
> On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
>> dts: add empty .dtsi for shift-axolotl
>>
>> This is necessary to select shift-axolotl as a target, in practice
>> the upstream dts will be used
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> diff --git a/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi b/arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi
>> +// SPDX-License-Identifier: GPL-2.0
>> +
>> +/* When there is no previous bootloader, the memory node won't get filled in.
>> + */
> The build system uses the first matching -u-boot.dtsi file. Since this
> board-specific file exists, it takes priority over sdm845-u-boot.dtsi,
> which adds bootph-all properties to gcc, usb_1_hsphy, usb_1_dwc3, and
> rpmhcc needed for USB DFU in SPL.
>
> Please can you add:
>
>      #include "sdm845-u-boot.dtsi"
>
> This is the standard pattern - e.g. meson-gxbb-p200-u-boot.dtsi which
> includes meson-gxbb-u-boot.dtsi.
I just realized my (compile) testing was flawed and used existing artifacts,
fixing that and doing a proper clean build alerted me to the fact that
messing with CONFIG_SYS_SOC is a terrible idea that leads to pain and
suffering, so I will absolutely be simply using an include instead in v2.
> The commit message says the file is 'empty' but it contains a comment
> about memory. If that comment is relevant, perhaps clarify what it
> means for this board. Otherwise I suggest removing it until there is
> actual content.
That's definitely a copy paste error, I was copying the SPDX header since a fully
empty file was still triggering license error and must've slipped. will fix.
> Regards,
> Simon

Re: [PATCH 2/5] of_live: support in SPL

[Michael Srba]

On 4/6/26 17:51, Simon Glass wrote:
> Hi Michael,
>
> On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
>> of_live: support in SPL
>>
>> Add CONFIG_SPL_OF_LIVE and if set, initialize of_live in spl.c
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> diff --git a/dts/Kconfig b/dts/Kconfig
>> @@ -86,6 +86,11 @@ config OF_LIVE
>> +config SPL_OF_LIVE
>> +     bool "Enable use of a live tree in SPL"
>> +     depends on SPL_DM && SPL_OF_CONTROL
>> +
>> +
> Please can you add help text here? The main OF_LIVE option has a
> helpful explanation. Also there should only be one blank line after
> the entry.
>
It seems some SPL options just refer to the full option and some copy
the explanation, my worry with the latter is that it will most definitely not
stay in sync, but I'm happy to go with either approach.
>> diff --git a/common/spl/spl.c b/common/spl/spl.c
>> @@ -510,6 +511,15 @@ static int spl_common_init(bool setup_malloc)
>> +     if (CONFIG_IS_ENABLED(OF_LIVE)) {
>> +             ret = of_live_build(gd->fdt_blob,
>> +                                 (struct device_node **)gd_of_root_ptr());
>> +             if (ret) {
>> +                     debug("of_live_build() returned error %d\n", ret);
>> +                     return ret;
>> +             }
>> +     }
> The U-Boot proper code in initr_of_live() wraps of_live_build() with
> bootstage_start()/bootstage_accum() using BOOTSTAGE_ID_ACCUM_OF_LIVE.
> Please can you do the same here for consistency and SPL boot-time
> tracking.
I wasn't sure if SPL supported that, probably should've tried harder to check.
will fix.
> Regards,
> Simon

Re: [0/5] Add SPL support for Qualcomm platforms, starting with sdm845

[Michael Srba]

On 4/6/26 17:48, Simon Glass wrote:
> Hi Michael,
>
> On 2026-04-03T23:18:18, Michael Srba <michael.srba@seznam.cz> wrote:
>> U-Boot SPL, as it will be built using the defconfig added in this series,
>> replaces xbl_loader.
> Please can you clarify what happens on devices where XBL_SEC does not
> have this vulnerability? The code checks for EL3 and skips to reset,
> but if the SMC call to unlock secure regions fails, does the code
> handle this gracefully or crash?
The XBL_SEC ELF must be included as part of the u-boot ELF (this is what
the linker script does, yes it's cursed), so only a vulnerable one would
ever be included at build time (or if not, JTAG will be used to alter
the code flow).
Ideally a single fixed version would be included with u-boot as
an ambiguous bag of bytes that you are forced to put in your ELF to have
your actual code boot, but even if you could convince a judge that under
EU law that exempts you from copyright, under the US law you're presumably
screwed and in any case not getting sued is preferred.

In case the documentation is not clear enough on this, you absolutely
need to BYO an xbl_sec.elf (because I doubt u-boot wants to carry it,
and even if it does I'd rather not share "firmware" (using the definition
of "stuff that comes on your device and nobody ever wrote down a license
for, or just never gave it to you but that's actually not likely")).

For now unless you can find a vulnerable XBL_SEC you'll need to use
whatever you can get (e.g dumping one from existing xbl.elf on your device)
and use EUD or plain JTAG to jump to `start` from EL3.

I think it should be legal for an OEM to intentionally ship an old version
of XBL_SEC, but as for making it easily available for download that
depends on if Qualcomm distributes it to *them* with any sort
of license other than implicit  "obviously we won't sue you for using it
exactly the way we expect you to use it", and I kinda doubt they do.

To be absolutely clear, to my understanding there would be absolutely
no security detriments to qcom's precious (sadly legal) security model
if they just publicly released a stub xbl_sec that doesn't drop to EL1
before jumping to our code to linux-firmware, since the whole xbl.elf
is still signed by the OEM on the 99% of devices that put security over
freedom, but since they made the version of that which they did for google
explicitly check that it's running on an SoC fused from the factory
as intended-for-cros, I don't think they are going to do that.
Maybe it's a product segmentation thing, "how much extra can we charge
the few rare OEMs who don't want to use our super great stock bootloader".
(I don't think the idea of an end user having a say ever slips their mind)
> Regards,
> Simon

Re: [PATCH 0/5] Add SPL support for Qualcomm platforms, starting with sdm845

[Sumit Garg]

Hi Michael,

On Sat, Apr 04, 2026 at 01:18:15AM +0200, michael.srba@seznam.cz wrote:
> [ context ]
> 
> Different generations of Qualcomm SoCs have differences in the boot
> process. msm8916 (and similar) are quite straightforward:
> [EL3]bootrom->sbl1->tz->[EL2]hyp->[EL1]aboot->linux (omitting non-AP
> cores). msm8998, sdm845, kodiak and simiar are a bit more involved:
> [EL3]bootrom->xbl_sec->[EL1]xbl_loader->[EL3]tz->[EL2]hyp->[EL1]uefi
> ->ABL->linux. Newer platforms like hamoa are even more involved.
> 

Just as a heads up, we are trying to open up the boot stack/EL3 on
Qcom platforms such that a developer/OEM can run OEM only signed TF-A/
OP-TEE stack on IoT targets. However, as you can expect it will take
time but we already had some success..

> Currently, u-boot proper can run in place of Linux, in place
> of aboot, or in place of hyp. The option to run in place
> of Linux is necessary because >99% of OEMs do not consider
> the sale of a device to an end user a transfer of ownership,
> that is, they sell the device with a hash of their public key
> pre-burnt in the fuses.
> 
> [ end of context ]
> 
> U-Boot SPL, as it will be built using the defconfig added in this series,
> replaces xbl_loader. If support for msm8916 or a similar platform
> is added, it would replace sbl1. This will obviously only work on
> the <1% of devices whose manufacturers consider the sale a transfer
> of ownership, and of course most SBCs.
> 
> Unfortunately, starting with (iirc) msm8998, and getting progressively
> worse, Qualcomm no longer consider a sale of their SoC a transfer
> of ownership either. While it's possible to execute your code
> in EL3 using either jtag or a patched devcfg, the former is impractical
> while the latter is irrelevant for the purposes of running u-boot SPL
> since the devcfg is parsed by trustzone. (this of course only applies
> to the <1% of the devices where the OEM didn't lock the device down
> prior to sale)

Good to see your U-Boot SPL efforts as a replacement of XBL loader.

> 
> Given the above, this series uses an unintended feature in old builds
> of xbl_sec which allows us to elevate to EL3. We also check if we
> happen to already be running in EL3, in which case we proceed normally.
> This can be the case e.g if JTAG was used to jump to u-boot SPL in EL3,
> which may be the only option on e.g. kodiak. (Running in EL1 is not
> really viable, because xbl_sec+xbl_loader are effectively sbl1 split
> in half and replacing only one doesn't make much sense)

To begin with Kodiak/RB3Gen2, you can download XBL_SEC image using links
from meta-qcom recipe here [1] (firmware v00116.0 onwards) to execute
qtestsign'ed code to run at EL3. If you are interested in TF-A/OP-TEE
stack then that's available here for Kodiak too [2] [3] although you can
execute U-Boot proper in EL3 too.

[1] https://github.com/qualcomm-linux/meta-qcom/pull/1627
[2] https://github.com/qualcomm-linux/trusted-firmware-a
[3] https://github.com/qualcomm-linux/optee_os

> 
> For now, only usb dfu is supported to load the next stage. Since we
> don't support ram initialization, the next stage will need to run from
> SRAM too, which is currently not supported.

Sadly DRAM init sequence isn't something that's available as an open
source driver but you can expect QcLib blobs for DRAM init in U-Boot SPL
just like what's already available with the coreboot project here [4].

[4] https://github.com/coreboot/qc_blobs/tree/main/sc7280/boot

-Sumit

> Additional patches will
> be needed to make that work, at which point it will be possible
> to use u-boot as a ufs/emmc programmer with zero proprietary code
> in the boot chain (sans bootrom and part of xbl_sec, but the latter and
> technically even the former could be skipped with JTAG)
> 
> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> ---
> Michael Srba (5):
>       Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
>       of_live: support in SPL
>       drivers: allow clk_stub and spmi in SPL
>       mach-snapdragon: support building SPL
>       dts: add empty .dtsi for shift-axolotl
> 
>  Makefile                                           |  23 ++++
>  arch/arm/Kconfig                                   |   6 +-
>  arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi      |   4 +
>  arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +++
>  arch/arm/mach-snapdragon/Kconfig                   |  98 +++++++++++++++-
>  arch/arm/mach-snapdragon/board.c                   |  26 +++++
>  arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 ++--------
>  .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 +++++++++
>  .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++
>  arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  25 ++++
>  board/qualcomm/sdm845_spl.env                      |   1 +
>  common/spl/Kconfig                                 |   6 +
>  common/spl/spl.c                                   |  10 ++
>  configs/sdm845_spl_defconfig                       | 130 +++++++++++++++++++++
>  doc/board/qualcomm/index.rst                       |   1 +
>  doc/board/qualcomm/spl.rst                         |  70 +++++++++++
>  drivers/Makefile                                   |   2 +-
>  drivers/clk/Kconfig                                |   6 +
>  drivers/spmi/Kconfig                               |   6 +
>  dts/Kconfig                                        |   5 +
>  lib/Makefile                                       |   2 +-
>  21 files changed, 616 insertions(+), 56 deletions(-)
> ---
> base-commit: 4dc4080805fac1b1ed7606ce3bc8fb44a6d59d5e
> change-id: 20260403-qcom_spl-0826843ba41c
> 
> Best regards,
> --  
> Michael Srba <Michael.Srba@seznam.cz>
> 

Re: [PATCH 4/5] mach-snapdragon: support building SPL

[Casey Connolly]

Hi Michael,

On 04/04/2026 01:18, michael.srba@seznam.cz wrote:
> From: Michael Srba <Michael.Srba@seznam.cz>
> 
> Initially sdm845 support is added, and only usb boot
> is supported for the next stage.
> 

[snip]

> diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
> index 5fb3240acc5..0f980a954e4 100644
> --- a/arch/arm/mach-snapdragon/board.c
> +++ b/arch/arm/mach-snapdragon/board.c
> @@ -33,6 +33,8 @@
>  #include <sort.h>
>  #include <time.h>
>  
> +#include <spl.h>

I think it would be preferable to split out the SPL specific parts,
particularly since a lot of the functions here won't be called in SPL,
and even if they are the context is quite different. Like if
board_fdt_blob_setup() is called in SPL I would still suggest having a
separate version of it since the logic surely would be different.

Could you put any common code you do need in SPL into common.c and add a
new spl.c with the spl-specific parts?

> +
>  #include "qcom-priv.h"
>  
>  DECLARE_GLOBAL_DATA_PTR;
> @@ -223,6 +225,7 @@ int board_fdt_blob_setup(void **fdtp)
>  		panic("Internal FDT is invalid and no external FDT was provided! (fdt=%#llx)\n",
>  		      (phys_addr_t)external_fdt);
>  
> +#if !defined(CONFIG_SPL_BUILD)
>  	/* Prefer memory information from internal DT if it's present */
>  	if (internal_valid)
>  		ret = qcom_parse_memory(internal_fdt);
> @@ -239,6 +242,7 @@ int board_fdt_blob_setup(void **fdtp)
>  
>  	if (ret < 0)
>  		panic("No valid memory ranges found!\n");
> +#endif
>  
>  	/* If we have an external FDT, it can only have come from the Android bootloader. */
>  	if (external_valid)
> @@ -258,7 +262,9 @@ int board_fdt_blob_setup(void **fdtp)
>  		ret = 0;
>  	}
>  
> +#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)
>  	qcom_psci_fixup(*fdtp);
> +#endif
>  
>  	return ret;
>  }
> @@ -313,7 +319,9 @@ void __weak qcom_board_init(void)
>  
>  int board_init(void)
>  {
> +#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)
>  	show_psci_version();
> +#endif
>  	qcom_board_init();
>  	return 0;
>  }
> @@ -749,3 +757,21 @@ void enable_caches(void)
>  	}
>  	dcache_enable();
>  }
> +
> +/* for SPL */
> +
> +__weak void reset_cpu(void)
> +{
> +	/* TODO */

Could you puts() something here to indicate that the board will hang?

Thanks,

-- 
// Casey (she/her)

Re: [PATCH 4/5] mach-snapdragon: support building SPL

[Michael Srba]

On 4/6/26 16:27, Tom Rini wrote:
> On Sat, Apr 04, 2026 at 01:18:19AM +0200, michael.srba@seznam.cz wrote:
>
>> From: Michael Srba <Michael.Srba@seznam.cz>
>>
>> Initially sdm845 support is added, and only usb boot
>> is supported for the next stage.
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> [snip]
>> diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
>> index 976c0e35fce..938e6ebd8bf 100644
>> --- a/arch/arm/mach-snapdragon/Kconfig
>> +++ b/arch/arm/mach-snapdragon/Kconfig
>> @@ -1,6 +1,24 @@
>>   if ARCH_SNAPDRAGON
>>   
>> +# SoC specific SRAM addresses
>> +
>> +# sdm845
>> +SDM845_BOOT_IMEM_BASE := 0x14800000
>> +SDM845_BOOT_IMEM_SIZE := 0x180000
>> +# we may not be able to use the whole BOOT_IMEM depending on the whitelisted regions hardcoded in PBL
>> +# (we could technically relocate ourselves after the fact)
>> +SDM845_BOOT_IMEM_OFFSET := 0x3f000
>> +SDM845_BOOT_IMEM_USABLE_SIZE := 0xc1000
>> +# technically the below would work, except the memory from 0x14833000 to 0x1483F000 gets trashed
>> +# between the ELF getting loaded and XBL_SEC jumping to our code
>> +#SDM845_BOOT_IMEM_OFFSET := 0x16000
>> +#SDM845_BOOT_IMEM_USABLE_SIZE := 0xea000
>> +SDM845_OCIMEM_BASE := 0x14680000
>> +SDM845_OCIMEM_SIZE := 0x00040000
>> +SDM845_OCIMEM_END  := $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_BASE) + $(SDM845_OCIMEM_SIZE) - 1))")
> I didn't know Kconfig even allowed this. And I *really* don't like it,
> and I think it's going in the wrong direction with respect to being able
> to configure a system. If these are configurable, then they need to be
> "hex" type "config" options, and then used later on. Otherwise they
> should just be the evaluated value as "default ... if ..." later on,
> instead.
This is per-SoC hardware info. The SRAM is physically located at that
address with that size. The offset/usable size are further restrictions
imposed by the bootrom, which are relevant for placing the text section
(the bootrom will copy the ELF segment precisely where the ELF segment
says it wants to live, as long as that's in a whitelisted region).

I really don't like the idea of just hardcoding hex values with either
no explanation of where they come from, or with a comment that may or
may not reflect the reality since there's no mechanism that would enforce
that the value was actually computed according to the comment.
(also the amount and complexity of such comments would be higher since
comments can't reference nonexistent intermediate variables)

What I wanted to do here was more along the lines of:
```
config QCOM_BOOT_IMEM_BASE
     default 0x14800000 if SPL_TARGET_SDM845

config QCOM_BOOT_IMEM_SIZE
     default 0x180000 if SPL_TARGET_SDM845

config QCOM_BOOT_IMEM_OFFSET
     default 0x3f000 if SPL_TARGET_SDM845

config QCOM_BOOT_IMEM_USABLE_SIZE
     default 0xc1000 if SPL_TARGET_SDM845
```
and then
```
config SPL_STACK
     default SDM845_OCIMEM_START + SDM845_OCIMEM_SIZE

config SPL_TEXT_BASE
     default QCOM_BOOT_IMEM_BASE + QCOM_BOOT_IMEM_OFFSET

config SPL_SYS_MALLOC_F_LEN
     QCOM_BOOT_IMEM_SIZE / 2
```

The problem with the above is that Kconfig absolutely doesn't support
doing that. The only way to do arithmetics is to use the preprocessor
("macro language"), and the preprocessor obviously doesn't have access
to the values of symbols, only to preprocessor variables.

The current form is the only solution I could come up with that avoids
hardcoding hex values, and from reading kconfig docs and sources I think
it's also the only solution possible short of patching kconfig to support
arithmetics.

If you consider this more ugly than magic hex values (which afaict is
the only other option, other than patching kconfig of course),
I can obviously do that, although it does make me very sad, and I'd prefer
if we can find a solution that avoids hardcoding. What do you think?
> [snip]
>> +config QCOM_SPL
>> +	bool "Enable SPL for Snapdragon SOCs"
>> +	select SUPPORT_SPL
>> +	select ARMV8_SPL_EXCEPTION_VECTORS
>> +	select ENABLE_ARM_SOC_BOOT0_HOOK
>> +	select SPL
>> +	select SPL_DM
>> +	select SPL_DM_GPIO
>> +	select SPL_DM_PMIC
>> +	select SPL_DM_USB_GADGET
>> +	select SPL_ENV_SUPPORT
>> +	select SPL_GPIO
>> +	select SPL_HAS_BSS_LINKER_SECTION
>> +	select SPL_LIBCOMMON_SUPPORT
>> +	select SPL_LIBDISK_SUPPORT
>> +	select SPL_LIBGENERIC_SUPPORT
>> +	select SPL_MMC
>> +	select SPL_OF_REAL
>> +	select SPL_OF_CONTROL
>> +	select SPL_PINCONF
>> +	select SPL_PINCTRL
>> +	select SPL_PINCTRL_FULL
>> +	select SPL_PINCTRL_GENERIC
>> +	select SPL_PINCONF_RECURSIVE
>> +	select SPL_PINMUX
>> +	select SPL_SPRINTF
>> +	select SPL_STRTO
>> +	select SPL_USB_GADGET
> This should be in the appropriate defconfig, or a config fragment if
> re-used a lot. Or mirroring other platforms, as part of the stanza for
> TARGET_... (or ARCH_...) as needed.
>
> [snip]
>> diff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst
>> new file mode 100644
>> index 00000000000..817c76b659e
>> --- /dev/null
>> +++ b/doc/board/qualcomm/spl.rst
>> @@ -0,0 +1,70 @@
>> +.. SPDX-License-Identifier: GPL-2.0+
>> +.. sectionauthor:: Michael Srba <Michael.Srba@seznam.cz>
>> +
>> +======================================
>> +Booting U-Boot SPL on Qualcomm SoCs
>> +======================================
>> +
>> +Overview
>> +----------
> These are style errors that will trip up CI when it builds the docs.
> Please run "make htmldocs KDOC_WERROR=1" for v2, thanks.
>

Re: [PATCH 4/5] mach-snapdragon: support building SPL

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 4613 bytes --]

On Wed, Apr 08, 2026 at 07:03:37PM +0200, Michael Srba wrote:
> 
> 
> On 4/6/26 16:27, Tom Rini wrote:
> > On Sat, Apr 04, 2026 at 01:18:19AM +0200, michael.srba@seznam.cz wrote:
> > 
> > > From: Michael Srba <Michael.Srba@seznam.cz>
> > > 
> > > Initially sdm845 support is added, and only usb boot
> > > is supported for the next stage.
> > > 
> > > Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
> > [snip]
> > > diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig
> > > index 976c0e35fce..938e6ebd8bf 100644
> > > --- a/arch/arm/mach-snapdragon/Kconfig
> > > +++ b/arch/arm/mach-snapdragon/Kconfig
> > > @@ -1,6 +1,24 @@
> > >   if ARCH_SNAPDRAGON
> > > +# SoC specific SRAM addresses
> > > +
> > > +# sdm845
> > > +SDM845_BOOT_IMEM_BASE := 0x14800000
> > > +SDM845_BOOT_IMEM_SIZE := 0x180000
> > > +# we may not be able to use the whole BOOT_IMEM depending on the whitelisted regions hardcoded in PBL
> > > +# (we could technically relocate ourselves after the fact)
> > > +SDM845_BOOT_IMEM_OFFSET := 0x3f000
> > > +SDM845_BOOT_IMEM_USABLE_SIZE := 0xc1000
> > > +# technically the below would work, except the memory from 0x14833000 to 0x1483F000 gets trashed
> > > +# between the ELF getting loaded and XBL_SEC jumping to our code
> > > +#SDM845_BOOT_IMEM_OFFSET := 0x16000
> > > +#SDM845_BOOT_IMEM_USABLE_SIZE := 0xea000
> > > +SDM845_OCIMEM_BASE := 0x14680000
> > > +SDM845_OCIMEM_SIZE := 0x00040000
> > > +SDM845_OCIMEM_END  := $(shell, printf "0x%x\n" "$(dollar)(($(SDM845_OCIMEM_BASE) + $(SDM845_OCIMEM_SIZE) - 1))")
> > I didn't know Kconfig even allowed this. And I *really* don't like it,
> > and I think it's going in the wrong direction with respect to being able
> > to configure a system. If these are configurable, then they need to be
> > "hex" type "config" options, and then used later on. Otherwise they
> > should just be the evaluated value as "default ... if ..." later on,
> > instead.
> This is per-SoC hardware info. The SRAM is physically located at that
> address with that size. The offset/usable size are further restrictions
> imposed by the bootrom, which are relevant for placing the text section
> (the bootrom will copy the ELF segment precisely where the ELF segment
> says it wants to live, as long as that's in a whitelisted region).
> 
> I really don't like the idea of just hardcoding hex values with either
> no explanation of where they come from, or with a comment that may or
> may not reflect the reality since there's no mechanism that would enforce
> that the value was actually computed according to the comment.
> (also the amount and complexity of such comments would be higher since
> comments can't reference nonexistent intermediate variables)
> 
> What I wanted to do here was more along the lines of:
> ```
> config QCOM_BOOT_IMEM_BASE
>     default 0x14800000 if SPL_TARGET_SDM845
> 
> config QCOM_BOOT_IMEM_SIZE
>     default 0x180000 if SPL_TARGET_SDM845
> 
> config QCOM_BOOT_IMEM_OFFSET
>     default 0x3f000 if SPL_TARGET_SDM845
> 
> config QCOM_BOOT_IMEM_USABLE_SIZE
>     default 0xc1000 if SPL_TARGET_SDM845
> ```
> and then
> ```
> config SPL_STACK
>     default SDM845_OCIMEM_START + SDM845_OCIMEM_SIZE
> 
> config SPL_TEXT_BASE
>     default QCOM_BOOT_IMEM_BASE + QCOM_BOOT_IMEM_OFFSET
> 
> config SPL_SYS_MALLOC_F_LEN
>     QCOM_BOOT_IMEM_SIZE / 2
> ```
> 
> The problem with the above is that Kconfig absolutely doesn't support
> doing that. The only way to do arithmetics is to use the preprocessor
> ("macro language"), and the preprocessor obviously doesn't have access
> to the values of symbols, only to preprocessor variables.
> 
> The current form is the only solution I could come up with that avoids
> hardcoding hex values, and from reading kconfig docs and sources I think
> it's also the only solution possible short of patching kconfig to support
> arithmetics.
> 
> If you consider this more ugly than magic hex values (which afaict is
> the only other option, other than patching kconfig of course),
> I can obviously do that, although it does make me very sad, and I'd prefer
> if we can find a solution that avoids hardcoding. What do you think?

Yeah, I'd rather go with "magic" hex values in appropriate headers, and
should probably be in the CFG_SYS namespace (so CFG_SYS_QCOM_... ) for
things that aren't "how do we work out SPL_SYS_MALLOC_F_LEN" which will
just be (matching everyone else really) just the hex value, and
explained in the board doc where things come from.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [PATCH 0/5] Add SPL support for Qualcomm platforms, starting with sdm845

[Michael Srba]

Hi,

On 4/7/26 10:12, Sumit Garg wrote:
> Hi Michael,
>
> On Sat, Apr 04, 2026 at 01:18:15AM +0200, michael.srba@seznam.cz wrote:
>> [ context ]
>>
>> Different generations of Qualcomm SoCs have differences in the boot
>> process. msm8916 (and similar) are quite straightforward:
>> [EL3]bootrom->sbl1->tz->[EL2]hyp->[EL1]aboot->linux (omitting non-AP
>> cores). msm8998, sdm845, kodiak and simiar are a bit more involved:
>> [EL3]bootrom->xbl_sec->[EL1]xbl_loader->[EL3]tz->[EL2]hyp->[EL1]uefi
>> ->ABL->linux. Newer platforms like hamoa are even more involved.
>>
> Just as a heads up, we are trying to open up the boot stack/EL3 on
> Qcom platforms such that a developer/OEM can run OEM only signed TF-A/
> OP-TEE stack on IoT targets. However, as you can expect it will take
> time but we already had some success..
>
>> Currently, u-boot proper can run in place of Linux, in place
>> of aboot, or in place of hyp. The option to run in place
>> of Linux is necessary because >99% of OEMs do not consider
>> the sale of a device to an end user a transfer of ownership,
>> that is, they sell the device with a hash of their public key
>> pre-burnt in the fuses.
>>
>> [ end of context ]
>>
>> U-Boot SPL, as it will be built using the defconfig added in this series,
>> replaces xbl_loader. If support for msm8916 or a similar platform
>> is added, it would replace sbl1. This will obviously only work on
>> the <1% of devices whose manufacturers consider the sale a transfer
>> of ownership, and of course most SBCs.
>>
>> Unfortunately, starting with (iirc) msm8998, and getting progressively
>> worse, Qualcomm no longer consider a sale of their SoC a transfer
>> of ownership either. While it's possible to execute your code
>> in EL3 using either jtag or a patched devcfg, the former is impractical
>> while the latter is irrelevant for the purposes of running u-boot SPL
>> since the devcfg is parsed by trustzone. (this of course only applies
>> to the <1% of the devices where the OEM didn't lock the device down
>> prior to sale)
> Good to see your U-Boot SPL efforts as a replacement of XBL loader.
>
>> Given the above, this series uses an unintended feature in old builds
>> of xbl_sec which allows us to elevate to EL3. We also check if we
>> happen to already be running in EL3, in which case we proceed normally.
>> This can be the case e.g if JTAG was used to jump to u-boot SPL in EL3,
>> which may be the only option on e.g. kodiak. (Running in EL1 is not
>> really viable, because xbl_sec+xbl_loader are effectively sbl1 split
>> in half and replacing only one doesn't make much sense)
> To begin with Kodiak/RB3Gen2, you can download XBL_SEC image using links
> from meta-qcom recipe here [1] (firmware v00116.0 onwards) to execute
> qtestsign'ed code to run at EL3. If you are interested in TF-A/OP-TEE
> stack then that's available here for Kodiak too [2] [3] although you can
> execute U-Boot proper in EL3 too.
>
> [1] https://github.com/qualcomm-linux/meta-qcom/pull/1627
> [2] https://github.com/qualcomm-linux/trusted-firmware-a
> [3] https://github.com/qualcomm-linux/optee_os
I was aware of this effort, however this doesn't seem to be intended
to jump to sbl1/xbl_loader replacement in EL3, just jump to non-qcom-signed
trustzone. I didn't explore if it's possible to simply immediately jump
to EL3 without doing the intended xbl_loader/xbl_sec back and forth
(which I really see no reason of supporting in u-boot SPL), but I suppose
if the xbl_sec is willing to immediately jump to whatever the boot0.h
assembly would tell it is trustzone, but would in fact be the rest
of u-boot SPL, it would be usable.

 From a cleanliness standpoint it would obviously make more sense to simply
release the cros variant but without the impossible-to-satisfy fuse check,
but bloat that never gets executed doesn't bother me as much as bloat which
does.

As for older platforms like sdm845, it would be nice if you could simply
publicly release whatever the oldest xbl_sec builds in your archive are.
These are (to my understanding) already available to OEMs, but I doubt
they're explictly allowed to share them, so you sharing them directly
would be logistically much more straightforward than any other
unambiguously legal approach.
>> For now, only usb dfu is supported to load the next stage. Since we
>> don't support ram initialization, the next stage will need to run from
>> SRAM too, which is currently not supported.
> Sadly DRAM init sequence isn't something that's available as an open
> source driver but you can expect QcLib blobs for DRAM init in U-Boot SPL
> just like what's already available with the coreboot project here [4].
>
> [4] https://github.com/coreboot/qc_blobs/tree/main/sc7280/boot
The problem with those blobs (well, QcLib specficically) is that it's very
much not just DRAM init, but an ugly mess of (afaict) whatever Qcom's
lawyers didn't feel like greenlighting for proper open source integration
into the upstream project. I also seem to recall statistics of the blob
being 9:1 in size compared to the entire rest of the coreboot binary,
which is really hard to swallow.

Would it be possible to have two separate blobs, one with *just* DRAM init
(and training? though that's hidden well enough in the aux core that it
would be hard to argue that the AP part can't be open)
and one with whatever else you don't feel like fighting the lawers over,
so that the parts that are not literally dram init can be skipped
(in case of stuff like XPU setup, which is not really *necessary* for
a working system). I'm not sure if there's parts that can't even
in principle be skipped, but if there are it would certainly be worthwhile
trying to convince the lawyers to let *those* be open and properly
integrated into u-boot, and in any case they would probably be very
few and reasonably easy for someone to reimplement and make the only
non-optional blob be the dram init one (as is the case for other platforms,
e.g Rockchip)

Obviously for the second blob to be optional (or have any hope to become
optional), it would have to not be a depedency for the DRAM init blob.

Since training is also technically optional, I wonder if a third blob
for that would make sense, but that's probably not necessary.

Failing all this, an alternative option would be to license the blob
under something like MIT, so that someone can carve up the binary, remove
unwanted parts, and share the result, without having to worry about
legal action.
> -Sumit
>
>> Additional patches will
>> be needed to make that work, at which point it will be possible
>> to use u-boot as a ufs/emmc programmer with zero proprietary code
>> in the boot chain (sans bootrom and part of xbl_sec, but the latter and
>> technically even the former could be skipped with JTAG)
>>
>> Signed-off-by: Michael Srba <Michael.Srba@seznam.cz>
>> ---
>> Michael Srba (5):
>>        Makefile: add SPL_REMAKE_ELF_LDSCRIPT feature
>>        of_live: support in SPL
>>        drivers: allow clk_stub and spmi in SPL
>>        mach-snapdragon: support building SPL
>>        dts: add empty .dtsi for shift-axolotl
>>
>>   Makefile                                           |  23 ++++
>>   arch/arm/Kconfig                                   |   6 +-
>>   arch/arm/dts/sdm845-shift-axolotl-u-boot.dtsi      |   4 +
>>   arch/arm/dts/sdm845-u-boot.dtsi                    |  16 +++
>>   arch/arm/mach-snapdragon/Kconfig                   |  98 +++++++++++++++-
>>   arch/arm/mach-snapdragon/board.c                   |  26 +++++
>>   arch/arm/mach-snapdragon/include/mach/boot0.h      |  61 ++--------
>>   .../mach-snapdragon/include/mach/msm8916_boot0.h   |  54 +++++++++
>>   .../include/mach/sdm845_spl_boot0.h                | 120 +++++++++++++++++++
>>   arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds |  25 ++++
>>   board/qualcomm/sdm845_spl.env                      |   1 +
>>   common/spl/Kconfig                                 |   6 +
>>   common/spl/spl.c                                   |  10 ++
>>   configs/sdm845_spl_defconfig                       | 130 +++++++++++++++++++++
>>   doc/board/qualcomm/index.rst                       |   1 +
>>   doc/board/qualcomm/spl.rst                         |  70 +++++++++++
>>   drivers/Makefile                                   |   2 +-
>>   drivers/clk/Kconfig                                |   6 +
>>   drivers/spmi/Kconfig                               |   6 +
>>   dts/Kconfig                                        |   5 +
>>   lib/Makefile                                       |   2 +-
>>   21 files changed, 616 insertions(+), 56 deletions(-)
>> ---
>> base-commit: 4dc4080805fac1b1ed7606ce3bc8fb44a6d59d5e
>> change-id: 20260403-qcom_spl-0826843ba41c
>>
>> Best regards,
>> --
>> Michael Srba <Michael.Srba@seznam.cz>
>>