{"id":2222304,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2222304/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/patch/20260411-qcom_spl-v2-7-9609557cf562@seznam.cz/","project":{"id":18,"url":"http://patchwork.ozlabs.org/api/1.2/projects/18/?format=json","name":"U-Boot","link_name":"uboot","list_id":"u-boot.lists.denx.de","list_email":"u-boot@lists.denx.de","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260411-qcom_spl-v2-7-9609557cf562@seznam.cz>","list_archive_url":null,"date":"2026-04-11T00:00:12","name":"[v2,07/10] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"ed6c4183eb15f02019dba87b38974e95f31af3bc","submitter":{"id":77645,"url":"http://patchwork.ozlabs.org/api/1.2/people/77645/?format=json","name":"Michael Srba","email":"michael.srba@seznam.cz"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/uboot/patch/20260411-qcom_spl-v2-7-9609557cf562@seznam.cz/mbox/","series":[{"id":499535,"url":"http://patchwork.ozlabs.org/api/1.2/series/499535/?format=json","web_url":"http://patchwork.ozlabs.org/project/uboot/list/?series=499535","date":"2026-04-11T00:00:12","name":"Add SPL support for Qualcomm platforms, starting with sdm845","version":2,"mbox":"http://patchwork.ozlabs.org/series/499535/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2222304/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2222304/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=seznam.cz header.i=@seznam.cz header.a=rsa-sha256\n header.s=szn1 header.b=EIWVJInS;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)","phobos.denx.de;\n dmarc=pass (p=none dis=none) header.from=seznam.cz","phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de","phobos.denx.de;\n\tdkim=pass (2048-bit key;\n secure) header.d=seznam.cz header.i=@seznam.cz header.b=\"EIWVJInS\";\n\tdkim-atps=neutral","phobos.denx.de;\n dmarc=pass (p=none dis=none) header.from=seznam.cz","phobos.denx.de;\n spf=pass smtp.mailfrom=michael.srba@seznam.cz"],"Received":["from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4ft4bC6D5Cz1y2d\n\tfor ; Sat, 11 Apr 2026 17:11:19 +1000 (AEST)","from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id 228F38426C;\n\tSat, 11 Apr 2026 09:09:09 +0200 (CEST)","by phobos.denx.de (Postfix, from userid 109)\n id 792D684198; Sat, 11 Apr 2026 02:04:00 +0200 (CEST)","from mxd-2-a16.seznam.cz (mxd-2-a16.seznam.cz\n [IPv6:2a02:598:64:8a00::1000:a16])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id D0AC683DC9\n for ; Sat, 11 Apr 2026 02:03:57 +0200 (CEST)","from email.seznam.cz by smtpc-mxd-7644845457-sbn6w\n (smtpc-mxd-7644845457-sbn6w [2a02:598:64:8a00::1000:a16])\n id 3833eebb633dbad2399a22e5; Sat, 11 Apr 2026 02:03:17 +0200 (CEST)","from [127.0.0.1] (ip-111-27.static.ccinternet.cz [147.161.27.111])\n by smtpd-relay-6597cc8696-xddnz (szn-email-smtpd/2.0.72) with ESMTPA\n id 4aece207-b9b5-4b16-8581-b04eff31af3e;\n Sat, 11 Apr 2026 02:03:03 +0200"],"X-Spam-Checker-Version":"SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de","X-Spam-Level":"","X-Spam-Status":"No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,\n RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham\n autolearn_force=no version=3.4.2","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=seznam.cz; s=szn1;\n t=1775865797; bh=vVTEeJaDEDLgb20scJoILNdnbX8OzJkq8Zymvzp2gPc=;\n h=From:Date:Subject:MIME-Version:Content-Type:\n Content-Transfer-Encoding:Message-Id:To:Cc;\n b=EIWVJInSf5cES9B3IbxK4BLibesC7TFE4QuxdqEgAZB/wwQtw2O1M5QSu/FOQE/2m\n HB3qUaGl9QZ0+rBXMObcCzIH4KlnB/NQXTBm3XE6LJzwKlrdwAhnsMo/BhYkciez5i\n AvDfe/U/wfNYWUw4cx8oust04dj3+QXQXT4KEDaM9YD4WqGgZY43ndtetTSNHq1NGr\n YBI3y0tqfl67GrGSpKWEwS6LtO7e+oTTMoZD54DsUslDAu2AQ6gbbeZqhxvKHzsCcl\n KHJlpLQrDRs+FH9+ZgqUBMwG4cwSHPJXysrImZmoUQrjvbxqvJ/bfYgQtyVSwUXh2i\n PQJz0bwmv851g==","From":"michael.srba@seznam.cz","Date":"Sat, 11 Apr 2026 02:00:12 +0200","Subject":"[PATCH v2 07/10] mach-snapdragon: boot0.h: add sdm845_spl_boot0.h","MIME-Version":"1.0","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"7bit","Message-Id":"<20260411-qcom_spl-v2-7-9609557cf562@seznam.cz>","References":"<20260411-qcom_spl-v2-0-9609557cf562@seznam.cz>","In-Reply-To":"<20260411-qcom_spl-v2-0-9609557cf562@seznam.cz>","To":"u-boot@lists.denx.de, Sumit Garg ,\n u-boot-qcom@groups.io","Cc":"Tom Rini ,\n Ilias Apalodimas ,\n Simon Glass , Sughosh Ganu ,\n Anshul Dalal , Peng Fan ,\n Mattijs Korpershoek ,\n Quentin Schulz ,\n Heinrich Schuchardt , Andrew Davis ,\n Hrushikesh Salunke ,\n Dario Binacchi , Ye Li ,\n Andre Przywara ,\n Alif Zakuan Yuslaimi ,\n Leo Yu-Chi Liang ,\n Andrew Goodbody , Dhruva Gole ,\n Kaustabh Chakraborty ,\n Jerome Forissier ,\n Heiko Schocher ,\n Marek Vasut ,\n Lukasz Majewski ,\n Mateusz Kulikowski ,\n Dinesh Maniyam ,\n Neil Armstrong ,\n Patrice Chotard ,\n Patrick Delaunay ,\n Michal Simek , Yao Zi ,\n Peter Korsgaard ,\n Rayagonda Kokatanur ,\n Casey Connolly ,\n Tingting Meng ,\n Tien Fong Chee , Alice Guo ,\n George Chan ,\n Balaji Selvanathan ,\n Alexey Charkov , Ronald Wahl ,\n Michael Srba ","X-Mailer":"b4 0.15.1","X-Mailman-Approved-At":"Sat, 11 Apr 2026 09:08:55 +0200","X-BeenThere":"u-boot@lists.denx.de","X-Mailman-Version":"2.1.39","Precedence":"list","List-Id":"U-Boot discussion ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"u-boot-bounces@lists.denx.de","Sender":"\"U-Boot\" ","X-Virus-Scanned":"clamav-milter 0.103.8 at phobos.denx.de","X-Virus-Status":"Clean"},"content":"From: Michael Srba \n\nOn sdm845, running u-boot SPL in EL3 requires escalting by using\nan unintentional feature in old builds of xbl_sec.elf. We do this\nin boot0.h so the rest of U-Boot can stay blissfully unaware\nof XBL_SEC. If we are already in EL3 for whatever reason, the\ncode is skipped.\n\nSigned-off-by: Michael Srba \n---\n arch/arm/mach-snapdragon/include/mach/boot0.h | 4 +\n .../include/mach/sdm845_spl_boot0.h | 120 +++++++++++++++++++++\n 2 files changed, 124 insertions(+)","diff":"diff --git a/arch/arm/mach-snapdragon/include/mach/boot0.h b/arch/arm/mach-snapdragon/include/mach/boot0.h\nindex 44a764788de..5d401051bd1 100644\n--- a/arch/arm/mach-snapdragon/include/mach/boot0.h\n+++ b/arch/arm/mach-snapdragon/include/mach/boot0.h\n@@ -1,6 +1,10 @@\n /* SPDX-License-Identifier: GPL-2.0+ */\n #if defined(CONFIG_SPL_BUILD)\n+#if defined(CONFIG_SPL_TARGET_SDM845)\n+#include \"sdm845_spl_boot0.h\"\n+#else\n \tb\treset\n+#endif\n #else\n /* currently only db410c enables boot0.h in u-boot proper */\n #include \"msm8916_boot0.h\"\ndiff --git a/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h\nnew file mode 100644\nindex 00000000000..a0136578756\n--- /dev/null\n+++ b/arch/arm/mach-snapdragon/include/mach/sdm845_spl_boot0.h\n@@ -0,0 +1,120 @@\n+/* SPDX-License-Identifier: GPL-2.0+ */\n+/*\n+ * Workaround for non-qcom-signed code being entered in EL1 on sdm845\n+ * Copyright (C) 2026 Michael Srba \n+ *\n+ * This code uses an unintentional ownership enhancing feature in older builds of XBL_SEC\n+ * in order to elevate our privileges to EL3 as soon as possible after a system reset.\n+ * This allows for a very close approximation of a clean state.\n+ *\n+ * Do note that you still need to own the device in the sense that you control the code that\n+ * XBL_SEC jumps to in EL1, which is sadly not a level of ownership commonly afforded to you\n+ * by the device manufacturer. On such devices, CVE-2021-30327 could help, but it's not documented\n+ * and there is no PoC available utilizing it\n+ *\n+ */\n+#include \n+\n+#define SCM_SMC_FNID(s, c)\t((((s) & 0xFF) << 8) | ((c) & 0xFF))\n+\n+#define ARM_SMCCC_SIP32_FAST_CALL \\\n+\tARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, ARM_SMCCC_OWNER_SIP, 0)\n+\n+/* same as with qcom's TZ */\n+#define QCOM_SCM_SVC_MEM_DUMP 0x03\n+/* unlike the TZ counterpart, in XBL_SEC this simply unlocks the XPUs */\n+#define QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS 0x10\n+\n+/*\n+ * We put our payload in place of some SCM call, the important thing is that it's hopefully\n+ * in a memory region that is not in cache.\n+ *\n+ * It would be cleaner to just put our code at the scm entry point in the vector table,\n+ * however it seems that we can't force cache coherency from EL1 if EL3 doesn't have\n+ * any reason to care about that.\n+ */\n+#define QCOM_SCM_SVC_DONOR 0x01\n+#define QCOM_SCM_DONOR 0x16\n+/* we replace the instructions at this address with a jump to the start of u-boot */\n+/* NOTE: this address is specific to a particular XBL_SEC elf */\n+#define XBL_SEC_DONOR_SCM_ADDR 0x146a0ce0\n+\n+/* gnu as doesn't implement these useful pseudoinstructions */\n+.macro movq Xn, imm\n+ movz \\Xn, \\imm & 0xFFFF\n+ movk \\Xn, (\\imm >> 16) & 0xFFFF, lsl 16\n+ movk \\Xn, (\\imm >> 32) & 0xFFFF, lsl 32\n+ movk \\Xn, (\\imm >> 48) & 0xFFFF, lsl 48\n+.endm\n+\n+.macro movl Wn, imm\n+ movz \\Wn, \\imm & 0xFFFF\n+ movk \\Wn, (\\imm >> 16) & 0xFFFF, lsl 16\n+.endm\n+\n+/* copy 32 bits to an address from a label */\n+.macro copy32 addr, text_base, addrofval, offset\n+\tmovl\tx0, \\addr\n+\tadd\tx0, x0, \\offset\n+\tmovq\tx1, \\text_base\n+\tadd\tx1, x1, \\addrofval\n+\tadd\tx1, x1, \\offset\n+\tldr\tw2, [x1]\n+\tstr\tw2, [x0]\n+\tdc\tcvau, x0 // flush cache to RAM straight away, we need to do it by address anyway\n+.endm\n+\n+.macro copy_instructions addr, text_base, start_addr, num_bytes // num_bytes must be a multiple of 4\n+\tmov x3,\t#0x0 // x0, x1 and w2 used by copy32\n+1:\n+\tcopy32\t\\addr, \\text_base, \\start_addr, x3\n+\tadd\tx3, x3, #0x4 // i+=4\n+\tcmp\tx3, \\num_bytes\n+\tblo\t1b\n+.endm\n+\n+\t/* If we're already in EL3 for some reason, skip this whole thing */\n+\tmrs\tx0, CurrentEL\n+\tcmp\tx0, #(3 << 2)\t/* EL3 */\n+\tbeq\treset\n+\n+\t/* disable the mmu */\n+\tmrs\tx0, sctlr_el1\n+\tand x0, x0, #~(1 << 0) // CTRL_M\n+\tmsr\tsctlr_el1, x0\n+\n+\tmov\tx0, #ARM_SMCCC_SIP32_FAST_CALL\n+\tmovk\tx0, #SCM_SMC_FNID(QCOM_SCM_SVC_MEM_DUMP, QCOM_SCM_MEM_DUMP_UNLOCK_SECURE_REGIONS)\n+\tmov\tx1, #0x0\t/* no params */\n+\tmov\tx6, #0x0\n+\n+\tsmc\t#0 /* unlock XBL_SEC code area for writing (assuming old enough XBL_SEC build) */\n+\n+\t/* this will also flush the writes from cache */\n+\tcopy_instructions XBL_SEC_DONOR_SCM_ADDR, CONFIG_SPL_TEXT_BASE, el3_payload, #((el3_payload_end - el3_payload))\n+\n+\t/* this probably doesn't affect EL3, but it doesn't hurt */\n+\tdsb\tish\t/* block until cache is flushed */\n+\tic\tiallu\t/* force re-fetch of our shiny new instructions */\n+\tdsb\tish\t/* block until invalidation is finished */\n+\tisb\tsy\t/* unify here ? */\n+\n+\tmov\tx0, #ARM_SMCCC_SIP32_FAST_CALL\n+\tmovk\tx0, #SCM_SMC_FNID(QCOM_SCM_SVC_DONOR, QCOM_SCM_DONOR)\n+\tmov\tx1, #0x0\t/* no params */\n+\tsmc\t#0\t/* call the payload */\n+\n+el3_ret_point:\n+\tb\treset\n+\n+el3_payload:\n+\t/* disable the mmu for EL3 too */\n+\tmrs\tx0, sctlr_el3\n+\tand x0, x0, #~(1 << 0) // CTRL_M\n+\tmsr\tsctlr_el3, x0\n+\n+\t/* jump back to our code, but now in EL3 */\n+\tmovl\tx0, CONFIG_SPL_TEXT_BASE\n+\tadd\tx0, x0, (el3_ret_point - _start)\n+\tbr\tx0\n+el3_payload_end:\n","prefixes":["v2","07/10"]}