{"id":2219750,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2219750/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/patch/20260404-qcom_spl-v1-4-9e6c2ac66587@seznam.cz/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/1.1/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260404-qcom_spl-v1-4-9e6c2ac66587@seznam.cz>","date":"2026-04-03T23:18:19","name":"[4/5] mach-snapdragon: support building SPL","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"6a9dfeb5b994a610c37095075585092f5cbf5c25","submitter":{"id":77645,"url":"http://patchwork.ozlabs.org/api/1.1/people/77645/?format=json","name":"Michael Srba","email":"michael.srba@seznam.cz"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/uboot/patch/20260404-qcom_spl-v1-4-9e6c2ac66587@seznam.cz/mbox/","series":[{"id":498699,"url":"http://patchwork.ozlabs.org/api/1.1/series/498699/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=498699","date":"2026-04-03T23:18:18","name":"Add SPL support for Qualcomm platforms, starting with sdm845","version":1,"mbox":"http://patchwork.ozlabs.org/series/498699/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2219750/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2219750/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=seznam.cz header.i=@seznam.cz header.a=rsa-sha256\n header.s=szn1 header.b=jK9BnWTh;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=none dis=none) header.from=seznam.cz","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n secure) header.d=seznam.cz header.i=@seznam.cz header.b=\"jK9BnWTh\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=pass (p=none dis=none) header.from=seznam.cz","phobos.denx.de;\n spf=pass smtp.mailfrom=michael.srba@seznam.cz"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fnm3J0dJSz1yCs\n\tfor ; Sat, 04 Apr 2026 17:32:11 +1100 (AEDT)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id CCDF284197;\n\tSat, 4 Apr 2026 08:31:21 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id B7FB7807C0; Sat, 4 Apr 2026 01:19:38 +0200 (CEST)","from mxd-2-a16.seznam.cz (mxd-2-a16.seznam.cz\n [IPv6:2a02:598:64:8a00::1000:a16])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id D46EF840AA\n for ; Sat, 4 Apr 2026 01:19:34 +0200 (CEST)","from email.seznam.cz by smtpc-mxd-7644845457-sbn6w\n (smtpc-mxd-7644845457-sbn6w [2a02:598:64:8a00::1000:a16])\n id 004f70d55b4124bc01e6bc8b; Sat, 04 Apr 2026 01:18:49 +0200 (CEST)","from [127.0.0.1] (ip-111-27.static.ccinternet.cz [147.161.27.111])\n by smtpd-relay-789d8dfb5c-z7n27 (szn-email-smtpd/2.0.71) with ESMTPA\n id 0009c753-e3da-4000-be84-7dcd0d540e49;\n Sat, 04 Apr 2026 01:18:31 +0200"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,\n RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=seznam.cz; s=szn1;\n t=1775258329; bh=2soOWfVhmNy0W+FBpW/cEv8iddoZdqIIsCUljmn5tZM=;\n h=From:Date:Subject:MIME-Version:Content-Type:\n Content-Transfer-Encoding:Message-Id:To:Cc;\n b=jK9BnWThVG+OCjL0NYU1gpcni1H4zrhsE635XEAmIx+3cDXv2dDqdP1HkXYbEQXpG\n dkKvenK+YIXZaGzb6XaHWQaEpcHgNds+9gcr6WylzRMfqEXmQPtT2JGeMbMZNcQe4X\n MM7Tc5sgp07Hx8WBvYIzvYEvOxz9vj4ncKUpog207Myd0673iipQJJjfjh1MRvpKuF\n 3yOC1+TvutY9e22alBJOr4H9KORYiJj/kVv/Xk0kaDazcUWVJ4k7IBO1zGaYlDBpAH\n xVbWYGuuDoHbiC92SE4zKUaF5WwOLOkHalQpKX4cZCUVA9PV+mSifnwCH7p3J3eWoR\n GiGsUv83/zjDQ==","From":"michael.srba@seznam.cz","Date":"Sat, 04 Apr 2026 01:18:19 +0200","Subject":"[PATCH 4/5] mach-snapdragon: support building SPL","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"7bit","Message-Id":"<20260404-qcom_spl-v1-4-9e6c2ac66587@seznam.cz>","References":"<20260404-qcom_spl-v1-0-9e6c2ac66587@seznam.cz>","In-Reply-To":"<20260404-qcom_spl-v1-0-9e6c2ac66587@seznam.cz>","To":"u-boot@lists.denx.de, Sumit Garg ,\n u-boot-qcom@groups.io","Cc":"Tom Rini ,\n Ilias Apalodimas ,\n Simon Glass , Sughosh Ganu ,\n Anshul Dalal , Peng Fan ,\n Mattijs Korpershoek ,\n Quentin Schulz ,\n Heinrich Schuchardt , Andrew Davis ,\n Hrushikesh Salunke ,\n Dario Binacchi , Ye Li ,\n Andre Przywara ,\n Alif Zakuan Yuslaimi ,\n Leo Yu-Chi Liang ,\n Andrew Goodbody , Dhruva Gole ,\n Kaustabh Chakraborty ,\n Jerome Forissier ,\n Heiko Schocher ,\n Marek Vasut ,\n Lukasz Majewski ,\n Mateusz Kulikowski ,\n Dinesh Maniyam ,\n Neil Armstrong ,\n Patrice Chotard ,\n Patrick Delaunay ,\n Michal Simek , Yao Zi ,\n Peter Korsgaard ,\n Rayagonda Kokatanur ,\n Casey Connolly ,\n Tingting Meng ,\n Tien Fong Chee , Alice Guo ,\n George Chan ,\n Balaji Selvanathan ,\n Michael Srba ","X-Mailer":"b4 0.15.1","X-Mailman-Approved-At":"Sat, 04 Apr 2026 08:31:19 +0200","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"},"content":"From: Michael Srba \n\nInitially sdm845 support is added, and only usb boot\nis supported for the next stage.\n\nSigned-off-by: Michael Srba \n---\n arch/arm/Kconfig | 6 +-\n arch/arm/dts/sdm845-u-boot.dtsi | 16 +++\n arch/arm/mach-snapdragon/Kconfig | 98 +++++++++++++++-\n arch/arm/mach-snapdragon/board.c | 26 +++++\n arch/arm/mach-snapdragon/include/mach/boot0.h | 61 ++--------\n .../mach-snapdragon/include/mach/msm8916_boot0.h | 54 +++++++++\n .../include/mach/sdm845_spl_boot0.h | 120 +++++++++++++++++++\n arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds | 25 ++++\n board/qualcomm/sdm845_spl.env | 1 +\n configs/sdm845_spl_defconfig | 130 +++++++++++++++++++++\n doc/board/qualcomm/index.rst | 1 +\n doc/board/qualcomm/spl.rst | 70 +++++++++++\n 12 files changed, 554 insertions(+), 54 deletions(-)","diff":"diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig\nindex cd6a454fd60..5b45eabddda 100644\n--- a/arch/arm/Kconfig\n+++ b/arch/arm/Kconfig\n@@ -1135,9 +1135,13 @@ config ARCH_SNAPDRAGON\n \tselect SAVE_PREV_BL_FDT_ADDR if !ENABLE_ARM_SOC_BOOT0_HOOK\n \tselect LINUX_KERNEL_IMAGE_HEADER if !ENABLE_ARM_SOC_BOOT0_HOOK\n \tselect SYSRESET\n-\tselect SYSRESET_PSCI\n+\tselect SYSRESET_PSCI if !SPL\n \tselect ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR\n \tselect MMU_PGPROT\n+\timply DM_EVENT if USB_DWC3_GENERIC || SPL_USB_DWC3_GENERIC\n+\timply SPL_EVENT if SPL_USB_DWC3_GENERIC\n+\timply OF_LIVE if USB_DWC3_GENERIC\n+\timply SPL_OF_LIVE if SPL_USB_DWC3_GENERIC\n \timply OF_UPSTREAM\n \timply CMD_DM\n \timply DM_USB_GADGET\ndiff --git a/arch/arm/dts/sdm845-u-boot.dtsi b/arch/arm/dts/sdm845-u-boot.dtsi\nnew file mode 100644\nindex 00000000000..59abc5dbd66\n--- /dev/null\n+++ b/arch/arm/dts/sdm845-u-boot.dtsi\n@@ -0,0 +1,16 @@\n+// SPDX-License-Identifier: GPL-2.0\n+&gcc {\n+\tbootph-all;\n+};\n+\n+&usb_1_hsphy {\n+\tbootph-all;\n+};\n+\n+&usb_1_dwc3 {\n+\tbootph-all;\n+};\n+\n+&rpmhcc: clock-controller {\n+\tbootph-all;\n+};\ndiff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig\nindex 976c0e35fce..938e6ebd8bf 100644\n--- a/arch/arm/mach-snapdragon/Kconfig\n+++ b/arch/arm/mach-snapdragon/Kconfig\n@@ -1,6 +1,24 @@\n if ARCH_SNAPDRAGON\n \n+# SoC specific SRAM addresses\n+\n+# sdm845\n+SDM845_BOOT_IMEM_BASE := 0x14800000\n+SDM845_BOOT_IMEM_SIZE := 0x180000\n+# we may not be able to use the whole BOOT_IMEM depending on the whitelisted regions hardcoded in PBL\n+# (we could technically relocate ourselves after the fact)\n+SDM845_BOOT_IMEM_OFFSET := 0x3f000\n+SDM845_BOOT_IMEM_USABLE_SIZE := 0xc1000\n+# technically the below would work, except the memory from 0x14833000 to 0x1483F000 gets trashed\n+# between the ELF getting loaded and XBL_SEC jumping to our code\n+#SDM845_BOOT_IMEM_OFFSET := 0x16000\n+#SDM845_BOOT_IMEM_USABLE_SIZE := 0xea000\n+SDM845_OCIMEM_BASE := 0x14680000\n+SDM845_OCIMEM_SIZE := 0x00040000\n+SDM845_OCIMEM_END := $(shell, printf \"0x%x\\n\" \"$(dollar)(($(SDM845_OCIMEM_BASE) + $(SDM845_OCIMEM_SIZE) - 1))\")\n+\n config SYS_SOC\n+\tdefault \"sdm845\" if SPL_TARGET_SDM845\n \tdefault \"snapdragon\"\n \n config SYS_VENDOR\n@@ -11,8 +29,13 @@ config SYS_VENDOR\n \t Based on this option board//\n \t will be used as the custom board directory.\n \n+# per-SoC dtsi isn't actually per SoC, to work around that we need to only build for one SoC\n+config OF_UPSTREAM_BUILD_VENDOR\n+\tdefault n if SPL_TARGET_SDM845\n+\n config SYS_MALLOC_LEN\n \tdefault 0x10000000\n+\tdefault $(shell, printf \"0x%x\\n\" \"$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))\") if SPL_TARGET_SDM845\n \n config SYS_MALLOC_F_LEN\n \tdefault 0x2000\n@@ -21,7 +44,7 @@ config SPL_SYS_MALLOC_F\n \tdefault y\n \n config SPL_SYS_MALLOC_F_LEN\n-\tdefault 0x2000\n+\tdefault $(shell, printf \"0x%x\\n\" \"$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))\") if SPL_TARGET_SDM845\n \n config SYS_MALLOC_LEN\n \tdefault 0x800000\n@@ -45,4 +68,77 @@ config SYS_CONFIG_NAME\n \t Based on this option include/configs/.h header\n \t will be used for board configuration.\n \n+config QCOM_SPL\n+\tbool \"Enable SPL for Snapdragon SOCs\"\n+\tselect SUPPORT_SPL\n+\tselect ARMV8_SPL_EXCEPTION_VECTORS\n+\tselect ENABLE_ARM_SOC_BOOT0_HOOK\n+\tselect SPL\n+\tselect SPL_DM\n+\tselect SPL_DM_GPIO\n+\tselect SPL_DM_PMIC\n+\tselect SPL_DM_USB_GADGET\n+\tselect SPL_ENV_SUPPORT\n+\tselect SPL_GPIO\n+\tselect SPL_HAS_BSS_LINKER_SECTION\n+\tselect SPL_LIBCOMMON_SUPPORT\n+\tselect SPL_LIBDISK_SUPPORT\n+\tselect SPL_LIBGENERIC_SUPPORT\n+\tselect SPL_MMC\n+\tselect SPL_OF_REAL\n+\tselect SPL_OF_CONTROL\n+\tselect SPL_PINCONF\n+\tselect SPL_PINCTRL\n+\tselect SPL_PINCTRL_FULL\n+\tselect SPL_PINCTRL_GENERIC\n+\tselect SPL_PINCONF_RECURSIVE\n+\tselect SPL_PINMUX\n+\tselect SPL_SPRINTF\n+\tselect SPL_STRTO\n+\tselect SPL_USB_GADGET\n+\n+config SPL_SHARES_INIT_SP_ADDR\n+\tdefault n\n+\n+config SPL_HAVE_INIT_STACK\n+\tdefault y\n+\n+# SPL targets\n+\n+config SPL_TARGET_SDM845\n+\tbool \"Set reasonable default values for running SPL in SRAM on sdm845 devices\"\n+\n+# config options selected based on target\n+\n+config SPL_REMAKE_ELF_LDSCRIPT\n+\tdefault \"arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds\" if SPL_TARGET_SDM845\n+\n+config SPL_BSS_START_ADDR\n+\tdefault $(SDM845_OCIMEM_BASE) if SPL_TARGET_SDM845\n+\n+# arbitrarily half of SDM845_OCIMEM_SIZE\n+config SPL_BSS_MAX_SIZE\n+\tdefault $(shell, printf \"0x%x\\n\" \"$(dollar)(($(SDM845_OCIMEM_SIZE) / 2))\") if SPL_TARGET_SDM845\n+\n+config SYS_MALLOC_LEN\n+\tdefault 0x20000 if SPL_TARGET_SDM845\n+\n+config SPL_STACK\n+\tdefault $(SDM845_OCIMEM_END) if SPL_TARGET_SDM845\n+\n+config SPL_TEXT_BASE\n+\tdefault $(shell, printf \"0x%x\\n\" \"$(dollar)(($(SDM845_BOOT_IMEM_BASE) + $(SDM845_BOOT_IMEM_OFFSET)))\") if SPL_TARGET_SDM845\n+\n+# these are used when running u-boot proper without DRAM initialized\n+config MSM_OCIMEM_BASE\n+\thex\n+\tdefault $(SDM845_OCIMEM_BASE) if SPL_TARGET_SDM845\n+\n+config MSM_OCIMEM_SIZE\n+\thex\n+\tdefault $(SDM845_OCIMEM_SIZE) if SPL_TARGET_SDM845\n+\n+config SPL_MAX_SIZE\n+\tdefault $(SDM845_BOOT_IMEM_USABLE_SIZE) if SPL_TARGET_SDM845\n+\n endif\ndiff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c\nindex 5fb3240acc5..0f980a954e4 100644\n--- a/arch/arm/mach-snapdragon/board.c\n+++ b/arch/arm/mach-snapdragon/board.c\n@@ -33,6 +33,8 @@\n #include \n #include \n \n+#include \n+\n #include \"qcom-priv.h\"\n \n DECLARE_GLOBAL_DATA_PTR;\n@@ -223,6 +225,7 @@ int board_fdt_blob_setup(void **fdtp)\n \t\tpanic(\"Internal FDT is invalid and no external FDT was provided! (fdt=%#llx)\\n\",\n \t\t (phys_addr_t)external_fdt);\n \n+#if !defined(CONFIG_SPL_BUILD)\n \t/* Prefer memory information from internal DT if it's present */\n \tif (internal_valid)\n \t\tret = qcom_parse_memory(internal_fdt);\n@@ -239,6 +242,7 @@ int board_fdt_blob_setup(void **fdtp)\n \n \tif (ret < 0)\n \t\tpanic(\"No valid memory ranges found!\\n\");\n+#endif\n \n \t/* If we have an external FDT, it can only have come from the Android bootloader. */\n \tif (external_valid)\n@@ -258,7 +262,9 @@ int board_fdt_blob_setup(void **fdtp)\n \t\tret = 0;\n \t}\n \n+#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)\n \tqcom_psci_fixup(*fdtp);\n+#endif\n \n \treturn ret;\n }\n@@ -313,7 +319,9 @@ void __weak qcom_board_init(void)\n \n int board_init(void)\n {\n+#if CONFIG_IS_ENABLED(SYSRESET_PSCI) && !defined(CONFIG_SPL_BUILD)\n \tshow_psci_version();\n+#endif\n \tqcom_board_init();\n \treturn 0;\n }\n@@ -749,3 +757,21 @@ void enable_caches(void)\n \t}\n \tdcache_enable();\n }\n+\n+/* for SPL */\n+\n+__weak void reset_cpu(void)\n+{\n+\t/* TODO */\n+\twhile (1) {\n+\t\t/* loop forever */\n+\t};\n+}\n+\n+u32 spl_boot_device(void)\n+{\n+\t/* TODO: check boot reason to support UFS and sdcard */\n+\tu32 boot_device = BOOT_DEVICE_DFU;\n+\n+\treturn boot_device;\n+}\ndiff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h\nindex 953cccad790..d0020da4cd1 100644\n--- a/arch/arm/mach-snapdragon/include/mach/boot0.h\n+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h\n@@ -1,54 +1,11 @@\n /* SPDX-License-Identifier: GPL-2.0+ */\n-/*\n- * Workaround for \"PSCI bug\" on DragonBoard 410c\n- * Copyright (C) 2021 Stephan Gerhold \n- *\n- * Syscall parameters taken from Qualcomm's LK fork (scm.h):\n- * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.\n- *\n- * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has\n- * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall\n- * that switches from 32-bit to 64-bit mode is executed at least once.\n- *\n- * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit\n- * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if\n- * U-Boot is installed to the \"aboot\" partition (replacing LK) the switch to\n- * 64-bit mode never happens since U-Boot is already running in 64-bit mode.\n- *\n- * A workaround for this \"PSCI bug\" is to execute the TZ syscall when entering\n- * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other\n- * CPU cores in 64-bit mode as well.\n- */\n-#include \n-\n-#define ARM_SMCCC_SIP32_FAST_CALL \\\n-\tARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)\n-\n-\t/*\n-\t * U-Boot might be started in EL2 or EL3 with custom firmware.\n-\t * In that case, we assume that the workaround is not necessary or is\n-\t * handled already by the alternative firmware. Using the syscall in EL2\n-\t * would demote U-Boot to EL1; in EL3 it would probably just crash.\n-\t */\n-\tmrs\tx0, CurrentEL\n-\tcmp\tx0, #(1 << 2)\t/* EL1 */\n-\tbne\treset\n-\n-\t/* Prepare TZ syscall parameters */\n-\tmov\tx0, #ARM_SMCCC_SIP32_FAST_CALL\n-\tmovk\tx0, #0x10f\t/* SCM_SVC_MILESTONE_CMD_ID */\n-\tmov\tx1, #0x12\t/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */\n-\tadr\tx2, el1_system_param\n-\tmov\tx3, el1_system_param_end - el1_system_param\n-\n-\t/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */\n-\tsmc\t#0\n-\n-\t/* Something went wrong, perhaps PSCI is already in 64-bit mode? */\n+#if defined(CONFIG_SPL_BUILD)\n+#if CONFIG_SPL_TARGET_SDM845\n+#include \"sdm845_spl_boot0.h\"\n+#else\n \tb\treset\n-\n-\t.align\t3\n-el1_system_param:\n-\t.quad\t0, 0, 0, 0, 0, 0, 0, 0, 0\t/* el1_x0-x8 */\n-\t.quad\treset\t\t\t\t/* el1_elr */\n-el1_system_param_end:\n+#endif\n+#else\n+/* db410c */\n+#include \"msm8916_boot0.h\"\n+#endif\ndiff --git a/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h\nnew file mode 100644\nindex 00000000000..953cccad790\n--- /dev/null\n+++ b/arch/arm/mach-snapdragon/include/mach/msm8916_boot0.h\n@@ -0,0 +1,54 @@\n+/* SPDX-License-Identifier: GPL-2.0+ */\n+/*\n+ * Workaround for \"PSCI bug\" on DragonBoard 410c\n+ * Copyright (C) 2021 Stephan Gerhold \n+ *\n+ * Syscall parameters taken from Qualcomm's LK fork (scm.h):\n+ * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.\n+ *\n+ * The PSCI implementation in the TrustZone/tz firmware on DragonBoard 410c has\n+ * a bug that starts all other CPU cores in 32-bit mode unless the TZ syscall\n+ * that switches from 32-bit to 64-bit mode is executed at least once.\n+ *\n+ * Normally this happens inside Qualcomm's LK bootloader which runs in 32-bit\n+ * mode and uses the TZ syscall to boot a kernel in 64-bit mode. However, if\n+ * U-Boot is installed to the \"aboot\" partition (replacing LK) the switch to\n+ * 64-bit mode never happens since U-Boot is already running in 64-bit mode.\n+ *\n+ * A workaround for this \"PSCI bug\" is to execute the TZ syscall when entering\n+ * U-Boot. That way PSCI is made aware of the 64-bit switch and starts all other\n+ * CPU cores in 64-bit mode as well.\n+ */\n+#include \n+\n+#define ARM_SMCCC_SIP32_FAST_CALL \\\n+\tARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)\n+\n+\t/*\n+\t * U-Boot might be started in EL2 or EL3 with custom firmware.\n+\t * In that case, we assume that the workaround is not necessary or is\n+\t * handled already by the alternative firmware. Using the syscall in EL2\n+\t * would demote U-Boot to EL1; in EL3 it would probably just crash.\n+\t */\n+\tmrs\tx0, CurrentEL\n+\tcmp\tx0, #(1 << 2)\t/* EL1 */\n+\tbne\treset\n+\n+\t/* Prepare TZ syscall parameters */\n+\tmov\tx0, #ARM_SMCCC_SIP32_FAST_CALL\n+\tmovk\tx0, #0x10f\t/* SCM_SVC_MILESTONE_CMD_ID */\n+\tmov\tx1, #0x12\t/* MAKE_SCM_ARGS(0x2, SMC_PARAM_TYPE_BUFFER_READ) */\n+\tadr\tx2, el1_system_param\n+\tmov\tx3, el1_system_param_end - el1_system_param\n+\n+\t/* Switch PSCI to 64-bit mode. Resets CPU and returns at el1_elr */\n+\tsmc\t#0\n+\n+\t/* Something went wrong, perhaps PSCI is already in 64-bit mode? */\n+\tb\treset\n+\n+\t.align\t3\n+el1_system_param:\n+\t.quad\t0, 0, 0, 0, 0, 0, 0, 0, 0\t/* el1_x0-x8 */\n+\t.quad\treset\t\t\t\t/* el1_elr */\n+el1_system_param_end:\ndiff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h\nnew file mode 100644\nindex 00000000000..5f9081c9aaf\n--- /dev/null\n+++ b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h\n@@ -0,0 +1,120 @@\n+/* SPDX-License-Identifier: GPL-2.0+ */\n+/*\n+ * Workaround for non-qcom-signed code being entered in EL1 on sdm845\n+ * Copyright (C) 2026 Michael Srba \n+ *\n+ * This code uses an unintentional ownership enhancing feature in older builds of XBL_SEC\n+ * in order to elevate our privileges to EL3 as soon as possible after a system reset.\n+ * This allows for a very close approximation of a clean state.\n+ *\n+ * Do note that you still need to own the device in the sense that you control the code that\n+ * XBL_SEC jumps to in EL1, which is sadly not a level of ownership commonly afforded to you\n+ * by the device manufacturer. On such devices, CVE-2021-30327 could help, but it's not documented\n+ * and there is no PoC available utilizing it\n+ *\n+ */\n+#include \n+\n+#define SCM_SMC_FNID(s, c)\t((((s) & 0xFF) << 8) | ((c) & 0xFF))\n+\n+#define ARM_SMCCC_SIP32_FAST_CALL \\\n+\tARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)\n+\n+/* same as with qcom's TZ */\n+#define QCOM_SCM_SVC_MEM_DUMP 0x03\n+/* unlike the TZ counterpart, in XBL_SEC this simply unlocks the XPUs */\n+#define QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS 0x10\n+\n+/*\n+ * We put our payload in place of some SCM call, the important thing is that it's hopefully\n+ * in a memory region that is not in cache.\n+ *\n+ * It would be cleaner to just put our code at the scm entry point in the vector table,\n+ * however it seems that we can't force cache coherency from EL1 if EL3 doesn't have\n+ * any reason to care about that.\n+ */\n+#define QCOM_SCM_SVC_DONOR 0x01\n+#define QCOM_SCM_DONOR 0x16\n+/* we replace the instructions at this address with a jump to the start of u-boot */\n+/* NOTE: this address is specific to a particular XBL_SEC elf */\n+#define XBL_SEC_DONOR_SCM_ADDR 0x146a0ce0\n+\n+/* gnu as doesn't implement these useful pseudoinstructions */\n+.macro movq Xn, imm\n+ movz \\Xn, \\imm & 0xFFFF\n+ movk \\Xn, (\\imm >> 16) & 0xFFFF, lsl 16\n+ movk \\Xn, (\\imm >> 32) & 0xFFFF, lsl 32\n+ movk \\Xn, (\\imm >> 48) & 0xFFFF, lsl 48\n+.endm\n+\n+.macro movl Wn, imm\n+ movz \\Wn, \\imm & 0xFFFF\n+ movk \\Wn, (\\imm >> 16) & 0xFFFF, lsl 16\n+.endm\n+\n+/* copy 32 bits to an address from a label */\n+.macro copy32 addr, text_base, addrofval, offset\n+\tmovl\tx0, \\addr\n+\tadd\tx0, x0, \\offset\n+\tmovq\tx1, \\text_base\n+\tadd\tx1, x1, \\addrofval\n+\tadd\tx1, x1, \\offset\n+\tldr\tw2, [x1]\n+\tstr\tw2, [x0]\n+\tdc\tcvau, x0 // flush cache to RAM straight away, we need to do it by address anyway\n+.endm\n+\n+.macro copy_instructions addr, text_base, start_addr, num_bytes // num_bytes must be a multiple of 4\n+\tmov x3,\t#0x0 // x0, x1 and w2 used by copy32\n+1:\n+\tcopy32\t\\addr, \\text_base, \\start_addr, x3\n+\tadd\tx3, x3, #0x4 // i+=4\n+\tcmp\tx3, \\num_bytes\n+\tblo\t1b\n+.endm\n+\n+\t/* If we're already in EL3 for some reason, skip this whole thing */\n+\tmrs\tx0, CurrentEL\n+\tcmp\tx0, #(3 << 2)\t/* EL3 */\n+\tbeq\treset\n+\n+\t/* disable the mmu */\n+\tmrs\tx0, sctlr_el1\n+\tand x0, x0, #~(1 << 0) // CTRL_M\n+\tmsr\tsctlr_el1, x0\n+\n+\tmov\tx0, #ARM_SMCCC_SIP32_FAST_CALL\n+\tmovk\tx0, #SCM_SMC_FNID(QCOM_SCM_SVC_MEM_DUMP, QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS)\n+\tmov\tx1, #0x0\t/* no params */\n+\tmov\tx6, #0x0\n+\n+\tsmc\t#0 /* unlock XBL_SEC code area for writing (assuming old enough XBL_SEC build) */\n+\n+\t/* this will also flush the writes from cache */\n+\tcopy_instructions XBL_SEC_DONOR_SCM_ADDR, CONFIG_SPL_TEXT_BASE, el3_payload, #((el3_payload_end - el3_payload))\n+\n+\t/* this probably doesn't affect EL3, but it doesn't hurt */\n+\tdsb\tish\t/* block until cache is flushed */\n+\tic\tiallu\t/* force re-fetch of our shiny new instructions */\n+\tdsb\tish\t/* block until invalidation is finished */\n+\tisb\tsy\t/* unify here ? */\n+\n+\tmov\tx0, #ARM_SMCCC_SIP32_FAST_CALL\n+\tmovk\tx0, #SCM_SMC_FNID(QCOM_SCM_SVC_DONOR, QCOM_SCM_DONOR)\n+\tmov\tx1, #0x0\t/* no params */\n+\tsmc\t#0\t/* call the payload */\n+\n+el3_ret_point:\n+\tb\treset\n+\n+el3_payload:\n+\t/* disable the mmu for EL3 too */\n+\tmrs\tx0, sctlr_el3\n+\tand x0, x0, #~(1 << 0) // CTRL_M\n+\tmsr\tsctlr_el3, x0\n+\n+\t/* */\n+\tmovl\tx0, CONFIG_SPL_TEXT_BASE\n+\tadd\tx0, x0, el3_ret_point\n+\tbr\tx0\n+el3_payload_end:\ndiff --git a/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds\nnew file mode 100644\nindex 00000000000..10912f416cc\n--- /dev/null\n+++ b/arch/arm/mach-snapdragon/u-boot-spl-elf-sdm845.lds\n@@ -0,0 +1,25 @@\n+TARGET(\"binary\")\n+INPUT(\"./xbl_sec.elf\")\n+\n+OUTPUT_FORMAT(\"default\")\n+\n+ENTRY(CONFIG_PLATFORM_ELFENTRY)\n+PHDRS\n+{\n+\tdata PT_LOAD FLAGS(7);\n+\txbl_sec PT_LOAD FLAGS(5 | (0x5 << 24));\n+}\n+SECTIONS\n+{\n+\t. = 0x0000000014699000;\n+\t.xbl_sec : { // XBL_SEC nested ELF\n+\t\t. = .;\n+\t\t\"./xbl_sec.elf\"\n+\t} :xbl_sec\n+\n+\t. = CONFIG_PLATFORM_ELFENTRY;\n+\n+\t.data : {\n+\t\t*(.data*)\n+\t} :data\n+}\ndiff --git a/board/qualcomm/sdm845_spl.env b/board/qualcomm/sdm845_spl.env\nnew file mode 100644\nindex 00000000000..5f1583c75f0\n--- /dev/null\n+++ b/board/qualcomm/sdm845_spl.env\n@@ -0,0 +1 @@\n+dfu_alt_info_ram=uboot.bin ram 0x1487FFC0 0x180000\ndiff --git a/configs/sdm845_spl_defconfig b/configs/sdm845_spl_defconfig\nnew file mode 100644\nindex 00000000000..eacee34cad6\n--- /dev/null\n+++ b/configs/sdm845_spl_defconfig\n@@ -0,0 +1,130 @@\n+CONFIG_ARM=y\n+CONFIG_SKIP_LOWLEVEL_INIT=y\n+CONFIG_COUNTER_FREQUENCY=19200000\n+CONFIG_POSITION_INDEPENDENT=y\n+# CONFIG_INIT_SP_RELATIVE is not set\n+CONFIG_ARCH_SNAPDRAGON=y\n+CONFIG_TEXT_BASE=0x14880000\n+CONFIG_SYS_MALLOC_LEN=0x20000\n+CONFIG_HAS_CUSTOM_SYS_INIT_SP_ADDR=y\n+CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x146bffff\n+CONFIG_SPL_SERIAL=y\n+CONFIG_SPL_DRIVERS_MISC=y\n+CONFIG_SYS_BOOTM_LEN=0x4000000\n+CONFIG_SYS_LOAD_ADDR=0x0\n+CONFIG_WATCHDOG_TIMEOUT_MSECS=60000\n+CONFIG_QCOM_SPL=y\n+CONFIG_SPL_TARGET_SDM845=y\n+CONFIG_SPL_MAX_SIZE=0x0\n+CONFIG_SPL_PAYLOAD=\"u-boot.img\"\n+CONFIG_BUILD_TARGET=\"u-boot-with-spl.elf\"\n+CONFIG_SKIP_RELOCATE=y\n+# CONFIG_EFI_LOADER is not set\n+CONFIG_OF_BOARD_SETUP=y\n+CONFIG_USE_PREBOOT=y\n+CONFIG_CONSOLE_RECORD=y\n+CONFIG_CONSOLE_RECORD_OUT_SIZE=0xA000\n+CONFIG_CONSOLE_RECORD_OUT_SIZE_F=0xA000\n+CONFIG_LOGLEVEL=9\n+CONFIG_SYS_STDIO_DEREGISTER=y\n+CONFIG_LOG_MAX_LEVEL=9\n+CONFIG_SPL_LOG=y\n+CONFIG_SPL_LOG_MAX_LEVEL=9\n+# CONFIG_DISPLAY_CPUINFO is not set\n+CONFIG_SPL_DMA=y\n+CONFIG_SPL_DM_RESET=y\n+CONFIG_SPL_POWER_DOMAIN=y\n+CONFIG_BOOTM_NETBSD=y\n+CONFIG_CMD_CLK=y\n+CONFIG_CMD_DFU=y\n+CONFIG_CMD_GPIO=y\n+CONFIG_CMD_I2C=y\n+CONFIG_CMD_MMC=y\n+CONFIG_CMD_UFS=y\n+CONFIG_CMD_CAT=y\n+CONFIG_CMD_RNG=y\n+CONFIG_CMD_REGULATOR=y\n+CONFIG_CMD_LOG=y\n+CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y\n+CONFIG_ENV_DEFAULT_ENV_TEXT_FILE=\"board/qualcomm/sdm845_spl.env\"\n+CONFIG_NET_RANDOM_ETHADDR=y\n+# CONFIG_OFNODE_MULTI_TREE is not set\n+CONFIG_BUTTON_QCOM_PMIC=y\n+CONFIG_CLK=y\n+CONFIG_SPL_CLK=y\n+CONFIG_CLK_STUB=y\n+CONFIG_SPL_CLK_STUB=y\n+CONFIG_CLK_QCOM_SDM845=y\n+CONFIG_DFU_MMC=y\n+CONFIG_DFU_RAM=y\n+CONFIG_DFU_SCSI=y\n+CONFIG_SYS_DFU_DATA_BUF_SIZE=0x5000\n+CONFIG_DMA=y\n+CONFIG_DMA_CHANNELS=y\n+CONFIG_USB_FUNCTION_FASTBOOT=y\n+CONFIG_FASTBOOT_BUF_ADDR=0xdeadbeef\n+CONFIG_MSM_GPIO=y\n+CONFIG_QCOM_PMIC_GPIO=y\n+CONFIG_DM_I2C=y\n+CONFIG_SYS_I2C_QUP=y\n+CONFIG_I2C_MUX=y\n+CONFIG_IOMMU=y\n+CONFIG_QCOM_HYP_SMMU=y\n+CONFIG_MISC=y\n+CONFIG_NVMEM=y\n+CONFIG_I2C_EEPROM=y\n+CONFIG_MMC_SDHCI=y\n+CONFIG_MMC_SDHCI_ADMA=y\n+CONFIG_MMC_SDHCI_MSM=y\n+CONFIG_DM_ETH_PHY=y\n+CONFIG_PHY=y\n+CONFIG_SPL_PHY=y\n+CONFIG_PHY_QCOM_QMP_UFS=y\n+CONFIG_PHY_QCOM_QUSB2=y\n+CONFIG_PHY_QCOM_USB_SNPS_FEMTO_V2=y\n+CONFIG_PHY_QCOM_SNPS_EUSB2=y\n+CONFIG_PHY_QCOM_USB_HS_28NM=y\n+CONFIG_PHY_QCOM_USB_SS=y\n+CONFIG_PINCTRL=y\n+CONFIG_PINCONF=y\n+CONFIG_PINCTRL_QCOM_APQ8016=y\n+CONFIG_PINCTRL_QCOM_APQ8096=y\n+CONFIG_PINCTRL_QCOM_QCM2290=y\n+CONFIG_PINCTRL_QCOM_QCS404=y\n+CONFIG_PINCTRL_QCOM_SDM845=y\n+CONFIG_PINCTRL_QCOM_SM6115=y\n+CONFIG_PINCTRL_QCOM_SM8250=y\n+CONFIG_PINCTRL_QCOM_SM8550=y\n+CONFIG_PINCTRL_QCOM_SM8650=y\n+CONFIG_PINCTRL_QCOM_X1E80100=y\n+CONFIG_DM_PMIC=y\n+CONFIG_PMIC_QCOM=y\n+CONFIG_DM_REGULATOR=y\n+CONFIG_DM_REGULATOR_FIXED=y\n+CONFIG_DM_REGULATOR_QCOM_RPMH=y\n+CONFIG_DM_RNG=y\n+CONFIG_RNG_MSM=y\n+CONFIG_SCSI=y\n+CONFIG_MSM_SERIAL=y\n+CONFIG_SOC_QCOM=y\n+CONFIG_QCOM_COMMAND_DB=y\n+CONFIG_QCOM_RPMH=y\n+CONFIG_SPL_SPMI=y\n+CONFIG_SPMI_MSM=y\n+CONFIG_SYSINFO=y\n+CONFIG_SYSINFO_SMBIOS=y\n+CONFIG_SYSRESET_QCOM_PSHOLD=y\n+CONFIG_USB=y\n+CONFIG_USB_DWC3=y\n+CONFIG_USB_DWC3_GENERIC=y\n+CONFIG_SPL_USB_DWC3_GENERIC=y\n+CONFIG_USB_GADGET=y\n+CONFIG_USB_GADGET_VENDOR_NUM=0x0525\n+CONFIG_USB_GADGET_PRODUCT_NUM=0xb4a4\n+CONFIG_USB_ETHER=y\n+CONFIG_USB_ETH_CDC=y\n+CONFIG_SPL_DFU=y\n+CONFIG_SPL_USB_SDP_SUPPORT=y\n+CONFIG_UFS=y\n+# CONFIG_SPL_USE_TINY_PRINTF is not set\n+CONFIG_CIRCBUF=y\ndiff --git a/doc/board/qualcomm/index.rst b/doc/board/qualcomm/index.rst\nindex 3238a68e859..65e3e222f68 100644\n--- a/doc/board/qualcomm/index.rst\n+++ b/doc/board/qualcomm/index.rst\n@@ -14,3 +14,4 @@ Qualcomm\n iq8\n phones\n rdp\n+ spl\ndiff --git a/doc/board/qualcomm/spl.rst b/doc/board/qualcomm/spl.rst\nnew file mode 100644\nindex 00000000000..817c76b659e\n--- /dev/null\n+++ b/doc/board/qualcomm/spl.rst\n@@ -0,0 +1,70 @@\n+.. SPDX-License-Identifier: GPL-2.0+\n+.. sectionauthor:: Michael Srba \n+\n+======================================\n+Booting U-Boot SPL on Qualcomm SoCs\n+======================================\n+\n+Overview\n+----------\n+The boot process on sdm845 (and some other Qualcomm SoCs) starts with the bootrom\n+of the Application Processor, which executes XBL_SEC, which jumps to \"OEM\" code\n+in EL1. Production device typically are \"fused\", with a hash of the OEM's signing\n+key burnt into one of the \"QFUSE\" banks on the SoC making it impossible to run\n+custom bootloader code. As a result U-Boot SPL is only supported on unfused\n+(\"secureboot off\") devices. XBL_SEC is always signed by qualcomm, and the fuses\n+to disable turning off signature verification for it are always burnt at the\n+factory, so replacing XBL_SEC is impossible without using JTAG. Of course JTAG\n+is typically disabled on devices that have secure boot enabled, or at minimum\n+greatly neutered.\n+\n+U-Boot SPL for Qualcomm platforms uses a custom linker script (per SoC) to build a bootable ELF.\n+For sdm845 (and some other platforms) this has two sections, u-boot code and an embedded\n+xbl_sec elf (signed by qualcomm). To boot on an unfused SoC, the elf additionally\n+needs to have hash sections added, which can be accomplished with qtestsign.\n+\n+Currently, sdm845 is supported. You need a device with secure boot disabled\n+(or with secure boot enabled if you enabled it yourself and have the private key,\n+though for full security you'd also want to disable JTAG which will remove your ability\n+to mess with the control flow in the bootrom (immutable) and in XBL_SEC (signed)).\n+\n+Building\n+----------\n+First, obtain an xbl_sec that includes the EL3 privilege escalation feature\n+and place it at .output/xbl_sec.elf. You can extract it from an xbl elf.\n+If you're unable to find one, you can also use JTAG/SWD to break at the SMC\n+entry and use gdp to jump to the u-boot entry point in EL3.\n+\n+To build a bootable image, you need to use a defconfig specific to your SoC.\n+This is because the ELF has to specify where in the address space to put u-boot SPL,\n+and this may differ per SoC. There may be other SoC-dependent build time choices,\n+though in principle those could be made at runtime.\n+\n+.. code-block:: shell\n+ make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl sdm845_spl_defconfig\n+\n+Then compile u-boot and specify the dts for your board (technically nothing about the resulting\n+SPL image should be board-specific, but there are no non-board-specific device trees in Linux)\n+\n+.. code-block:: shell\n+ make CROSS_COMPILE=aarch64-suse-linux- O=.output DEVICE_TREE=qcom/sdm845-shift-axolotl\n+\n+Finally, use qtestsign to add the hash segments required by PBL\n+\n+.. code-block:: shell\n+ qtestsign -v 5 -o .output/spl/u-boot-spl_signed.elf prog .output/spl/u-boot-spl.elf\n+\n+Running\n+----------\n+Currently, U-Boot SPL for qualcomm platforms expects to be booted via EDL:\n+\n+.. code-block:: shell\n+ edl.py --loader=$PWD/.output/spl/u-boot-spl_signed.elf\n+\n+SPL will then launch the DFU gadget and wait for you to upload u-boot proper:\n+\n+.. code-block:: shell\n+ dfu-util -RD .output/u-boot.img\n+\n+u-boot proper will then likely crash, since SPL currently doesn't init DRAM on qualcomm platforms\n+and u-boot proper currently doesn't support running from SRAM. The latter should be an easy fix.\n","prefixes":["4/5"]}