qualcomm-linux · Ricardo Salveti (ricardosalveti) · Sep 11, 2026 · Aug 13, 2026 · Aug 13, 2026 · Aug 13, 2026
@@ -442,6 +442,14 @@ jobs:
                 type: default
                 dirname: ""
                 yamlfile: ""
+          - machine: iq-9075-evk-open-fw-spl
+            distro:
+                name: qcom-distro-kvm
+                yamlfile: ':ci/qcom-distro-kvm.yml'
+            kernel:
+                type: kernel-fit
+                dirname: "_kernel-fit"
+                yamlfile: ":ci/kernel-fit-image.yml"
           - machine: rb3gen2-core-kit
             distro:
                 name: nodistro

@@ -18,6 +18,9 @@ repos:
       fix-igt-pause:
         repo: meta-qcom
         path: patches/oe-core/0001-igt-gpu-tools-fix-build-on-non-x86-platforms.patch
+      uboot-sign-spl-bss-padding:
+        repo: meta-qcom
+        path: patches/oe-core/0003-uboot-sign-keep-the-SPL-BSS-padding-when-reassembling.patch
       revert-python3-pycairo:
         repo: meta-qcom
         path: patches/oe-core/0001-Revert-python3-pycairo-inherit-python3-dir-not-pytho.patch

@@ -0,0 +1,9 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/siemens/kas/master/kas/schema-kas.json
+
+header:
+  version: 14
+  includes:
+  - ci/base.yml
+  - ci/meta-arm.yml
+
+machine: iq-9075-evk-open-fw-spl
@@ -10,6 +10,10 @@ QCOM_CDT_FIRMWARE ?= ""
 PREFERRED_PROVIDER_virtual/qcom-capsule-firmware ?= ""
 QCOM_CAPSULE_FIRMWARE ?= "${PREFERRED_PROVIDER_virtual/qcom-capsule-firmware}"
 
+QCOM_UBOOT_SPL_FIT ?= "0"
+QCOM_UBOOT_SPL_IMAGE ?= "u-boot-spl-${UBOOT_CONFIG_DEFAULT}.mbn"
+QCOM_UBOOT_FIT_IMAGE ?= "u-boot-fitImage"
+
 QCOM_ESP_IMAGE ?= "${@bb.utils.contains("MACHINE_FEATURES", "efi", "esp-qcom-image", "", d)}"
 QCOM_ESP_FILE ?= "${@'${DEPLOY_DIR_IMAGE}/${QCOM_ESP_IMAGE}-${MACHINE}${IMAGE_NAME_SUFFIX}.vfat' if d.getVar('QCOM_ESP_IMAGE') else ''}"
 
@@ -130,7 +134,14 @@ create_qcomflash_pkg() {
         bootloader_provider='${PREFERRED_PROVIDER_virtual/bootloader}'
         case "$bootloader_provider" in
             u-boot*)
-                bootloader_bin="${DEPLOY_DIR_IMAGE}/u-boot-${UBOOT_CONFIG_DEFAULT}.mbn"
+                if [ "${QCOM_UBOOT_SPL_FIT}" = "1" ]; then
+                    bootloader_bin="${DEPLOY_DIR_IMAGE}/${QCOM_UBOOT_FIT_IMAGE}"
+                    if [ -f "${DEPLOY_DIR_IMAGE}/${QCOM_UBOOT_SPL_IMAGE}" ]; then
+                        install -m 0644 "${DEPLOY_DIR_IMAGE}/${QCOM_UBOOT_SPL_IMAGE}" tz.mbn
+                    fi
+                else
+                    bootloader_bin="${DEPLOY_DIR_IMAGE}/u-boot-${UBOOT_CONFIG_DEFAULT}.mbn"
+                fi
                 ;;
         esac
         if [ -f "${bootloader_bin}" ]; then

@@ -30,6 +30,7 @@ KERNEL_DEVICETREE:append:pn-linux-qcom = " ${LINUX_QCOM_KERNEL_DEVICETREE}"
 KERNEL_DEVICETREE:append:pn-linux-qcom-next = " ${LINUX_QCOM_KERNEL_DEVICETREE}"
 KERNEL_DEVICETREE:append:pn-linux-qcom-rt = " ${LINUX_QCOM_KERNEL_DEVICETREE}"
 KERNEL_DEVICETREE:append:pn-linux-qcom-next-rt = " ${LINUX_QCOM_KERNEL_DEVICETREE}"
+KERNEL_DEVICETREE:append:pn-linux-yocto-fitimage = "${@' ' + (d.getVar('LINUX_QCOM_KERNEL_DEVICETREE') or '') if (d.getVar('PREFERRED_PROVIDER_virtual/kernel') or '').startswith('linux-qcom') else ''}"
 
 # Fastboot expects an ext4 image, which needs to be 4096 aligned
 IMAGE_FSTYPES ?= "ext4.gz"

@@ -15,3 +15,19 @@ MACHINE_ESSENTIAL_EXTRA_RRECOMMENDS += " \
 MACHINE_EXTRA_RRECOMMENDS += " \
     packagegroup-qcom-boot-additional \
 "
+
+# Memory layout needed by the SPL FIT boot flow.
+QCOM_UBOOT_SPL_ENTRY ?= "0x1c100000"
+UBOOT_FIT_ARM_TRUSTED_FIRMWARE_LOADADDRESS ?= "0x1c200000"
+UBOOT_FIT_ARM_TRUSTED_FIRMWARE_ENTRYPOINT ?= "0x1c200000"
+UBOOT_FIT_TEE_LOADADDRESS ?= "0x1c300000"
+UBOOT_FIT_TEE_ENTRYPOINT ?= "0x1c300000"
+UBOOT_FIT_UBOOT_LOADADDRESS ?= "0xaf400000"
+UBOOT_FIT_UBOOT_ENTRYPOINT ?= "0xaf400000"
+
+# Recipes providing BL31 and OP-TEE for the FIT.
+QCOM_UBOOT_SPL_FIT_ATF ?= "trusted-firmware-a-qcom-lemans-evk"
+QCOM_UBOOT_SPL_FIT_TEE ?= "optee-os-qcom-lemans"
+
+# Platform name for the SWIV annotation of the SPL ELF.
+QCOM_UBOOT_SPL_SWIV_PLATFORM ?= "lemans"
@@ -12,6 +12,7 @@ UBOOT_INITIAL_ENV = ""
 UBOOT_CONFIG[iq-615-evk] = "qcom_qcs615_defconfig"
 UBOOT_CONFIG[iq-8275-evk] = "qcom_qcs8300_defconfig"
 UBOOT_CONFIG[iq-9075-evk] = "qcom_lemans_defconfig"
+UBOOT_CONFIG[iq-9075-evk-spl] = "qcom_lemans_spl_defconfig"
 UBOOT_CONFIG[qcs9100-ride-sx] = "qcom_lemans_defconfig"
 UBOOT_CONFIG[qcs615-ride] = "qcom_qcs615_defconfig"
 UBOOT_CONFIG[qcs6490-rb3gen2] = "qcm6490_defconfig"
@@ -22,6 +23,7 @@ UBOOT_CONFIG[shikra-evk] = "qcom_shikra_defconfig"
 BOARD_MBN_HEADER[iq-615-evk] = "v6"
 BOARD_MBN_HEADER[iq-8275-evk] = "v6"
 BOARD_MBN_HEADER[iq-9075-evk] = "v6"
+BOARD_MBN_HEADER[iq-9075-evk-spl] = "v6"
 BOARD_MBN_HEADER[qcs9100-ride-sx] = "v6"
 BOARD_MBN_HEADER[qcs615-ride] = "v6"
 BOARD_MBN_HEADER[qcs6490-rb3gen2] = "v6"

@@ -0,0 +1,32 @@
+# Copyright (c) 2026 Qualcomm Innovation Center, Inc. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+#
+# SPL FIT boot flow: the Qualcomm XBL loads the signed U-Boot SPL from tz_a,
+# and the SPL loads a FIT holding BL31, OP-TEE and U-Boot proper from uefi_a
+# and jumps to BL31. A machine opts in by requiring this file and selecting a
+# ${UBOOT_CONFIG} whose defconfig has CONFIG_SPL=y. Load addresses and the
+# other SoC specific inputs come from the SoC configuration.
+
+# Marker the u-boot-qcom and trusted-firmware-a-qcom recipes branch on.
+QCOM_UBOOT_SPL_FIT = "1"
+
+# Assemble the FIT from BL31 and OP-TEE, staged by the u-boot recipe, and
+# U-Boot proper. Signing it is off by default (SPL_SIGN_ENABLE), as the boot
+# images are already authenticated by the Qualcomm chain; setting it to "1"
+# also builds an SPL that enforces the signatures, see spl-fit-signature.cfg.
+UBOOT_FITIMAGE_ENABLE = "1"
+UBOOT_FIT_ARM_TRUSTED_FIRMWARE = "1"
+UBOOT_FIT_TEE = "1"
+
+# BL31 boots first, and board_fit_config_name_match() in the qcom SPL selects
+# the configuration by this description.
+UBOOT_FIT_CONF_FIRMWARE = "atf"
+UBOOT_FIT_CONF_DESC = "post-ddr"
+
+# The XBL takes the SPL path only with this XBLConfig variant, which the boot
+# firmware ships next to the stock one.
+QCOM_XBL_CONFIG = "xbl_config_spl.elf"
+
+# Wrapped into an ELF and signed as the tz.mbn boot image by the recipe.
+SPL_BINARY = "spl/u-boot-spl.bin"
@@ -0,0 +1,13 @@
+#@TYPE: Machine
+#@NAME: Qualcomm IQ-9075 Evaluation Kit (EVK) with open boot firmware and U-Boot SPL
+#@DESCRIPTION: Machine configuration for Qualcomm IQ-9075 Evaluation Kit (EVK)
+#              booting through a U-Boot SPL instead of the TF-A BL2/FIP loader
+
+require conf/machine/iq-9075-evk-open-fw.conf
+
+# Build U-Boot with an SPL and enable the flow that packs BL31 and OP-TEE into
+# the FIT the SPL loads.
+UBOOT_CONFIG = "iq-9075-evk-spl"
+require conf/machine/include/qcom-uboot-spl-fit.inc
+
+QCOM_FIT_BOOT_CONF ?= "#conf-lemans-evk.dtb#conf-lemans-el2.dtbo"
@@ -1,6 +1,11 @@
 require recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc
 
-DEPENDS += "qtestsign-native u-boot-qcom"
+DEPENDS += "qtestsign-native"
+
+# u-boot-qcom is only needed to pull u-boot.bin into the FIP. The SPL FIT flow
+# builds no FIP, and u-boot-qcom depends on this recipe for bl31.bin, so keeping
+# the dependency both ways would make bitbake reject the task graph.
+DEPENDS += "${@bb.utils.contains('QCOM_UBOOT_SPL_FIT', '1', '', 'u-boot-qcom', d)}"
 
 PV = "2.15.0-qcom+git"
 
@@ -18,17 +23,22 @@ python () {
         bb.fatal('FIP_ELF_ADDR must be set by the device recipe')
 }
 
-TFA_BUILD_TARGET = "bl2 bl31 fip"
+TFA_BUILD_TARGET = "${@bb.utils.contains('QCOM_UBOOT_SPL_FIT', '1', 'bl31', 'bl2 bl31 fip', d)}"
 TFA_SPD = "opteed"
 
 EXTRA_OEMAKE:append = " \
     BL32=${RECIPE_SYSROOT}/${nonarch_base_libdir}/firmware/tee-raw.bin \
     BL33=${DEPLOY_DIR_IMAGE}/u-boot.bin \
    "
 
-do_compile[depends] += " u-boot-qcom:do_deploy"
+do_compile[depends] += "${@bb.utils.contains('QCOM_UBOOT_SPL_FIT', '1', '', 'u-boot-qcom:do_deploy', d)}"
 
 do_install:append() {
+    # Nothing to wrap and sign without a FIP.
+    if [ "${QCOM_UBOOT_SPL_FIT}" = "1" ]; then
+        return
+    fi
+
     export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1
 
     ${OBJCOPY} -I binary -B aarch64 -O elf64-littleaarch64 ${D}${FIRMWARE_DIR}/fip.bin ${D}${FIRMWARE_DIR}/fip.o

@@ -0,0 +1,67 @@
+From f77a45eda09e5326b1ba564fe348d82a06219120 Mon Sep 17 00:00:00 2001
+From: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
+Date: Thu, 13 Aug 2026 02:38:23 +0000
+Subject: [PATCH] uboot-sign: keep the SPL BSS padding when reassembling the
+ SPL binary
+
+concat_spl_dtb() rebuilds the SPL as a plain concatenation of the nodtb
+image and the signed device tree. U-Boot only assembles it that way with
+SPL_SEPARATE_BSS; otherwise BSS is part of the image and it pads between
+the two, so that clearing BSS cannot overwrite the appended device tree.
+Platforms loading the SPL as one contiguous image, such as Qualcomm SoCs,
+need that layout: without the padding the device tree ends up inside BSS
+and spl_early_init() finds none, before the console is up.
+
+Reassemble at the offset U-Boot used, taken from its own image as
+SPL_WITH_DTB_BINARY, and fall back to the current behaviour when it did
+not pad.
+
+AI-Generated: Uses Claude Code
+
+Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
+Upstream-Status: Submitted [https://lists.openembedded.org/g/openembedded-core/message/245194]
+---
+ meta/classes-recipe/uboot-sign.bbclass | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/meta/classes-recipe/uboot-sign.bbclass b/meta/classes-recipe/uboot-sign.bbclass
+index 4da5d4c9f1..0e44f12d0e 100644
+--- a/meta/classes-recipe/uboot-sign.bbclass
++++ b/meta/classes-recipe/uboot-sign.bbclass
+@@ -58,6 +58,8 @@ SPL_DTB_SYMLINK ?= "u-boot-spl-${MACHINE}.dtb"
+ SPL_NODTB_IMAGE ?= "u-boot-spl-nodtb-${MACHINE}-${PV}-${PR}.bin"
+ SPL_NODTB_BINARY ?= "u-boot-spl-nodtb.bin"
+ SPL_NODTB_SYMLINK ?= "u-boot-spl-nodtb-${MACHINE}.bin"
++# The SPL image as assembled by U-Boot, before signing.
++SPL_WITH_DTB_BINARY ?= "u-boot-spl-dtb.bin"
+
+ # U-Boot fitImage description
+ UBOOT_FIT_DESC ?= "U-Boot fitImage for ${DISTRO_NAME}/${PV}/${MACHINE}"
+@@ -250,7 +252,23 @@ deploy_dtb() {
+
+ concat_spl_dtb() {
+ 	if [ -e "${SPL_DIR}/${SPL_NODTB_BINARY}" ] && [ -e "${SPL_DIR}/${SPL_DTB_BINARY}" ] ; then
+-		cat ${SPL_DIR}/${SPL_NODTB_BINARY} ${SPL_DIR}/${SPL_DTB_SIGNED} > "${SPL_BINARY}"
++		# U-Boot pads behind BSS before appending the device tree
++		# ($(SPL_BIN)-pad.bin in scripts/Makefile.xpl); keep that offset.
++		nodtb_size=$(stat -Lc %s ${SPL_DIR}/${SPL_NODTB_BINARY})
++		dtb_offset=${nodtb_size}
++
++		if [ -e "${SPL_DIR}/${SPL_WITH_DTB_BINARY}" ]; then
++			image_size=$(stat -Lc %s ${SPL_DIR}/${SPL_WITH_DTB_BINARY})
++			dtb_size=$(stat -Lc %s ${SPL_DIR}/${SPL_DTB_BINARY})
++			offset=$(expr ${image_size} - ${dtb_size})
++			if [ ${offset} -gt ${nodtb_size} ]; then
++				dtb_offset=${offset}
++			fi
++		fi
++
++		cp ${SPL_DIR}/${SPL_NODTB_BINARY} "${SPL_BINARY}"
++		truncate -s ${dtb_offset} "${SPL_BINARY}"
++		cat ${SPL_DIR}/${SPL_DTB_SIGNED} >> "${SPL_BINARY}"
+ 	else
+ 		bbwarn "Failure while adding public key to spl binary. Verified U-Boot boot won't be available."
+ 	fi
+-- 
+2.43.0
+
@@ -62,6 +62,7 @@ RRECOMMENDS:${PN}-qcom-generic += " \
     kernel-module-qcom-battmgr \
     kernel-module-qcom-camss \
     kernel-module-qcom-iris \
+    kernel-module-qcom-pas-tee \
     kernel-module-qcom-pd-mapper \
     kernel-module-qcom-pmic-tcpm \
     kernel-module-qcom-pon \

@@ -0,0 +1,3 @@
+CONFIG_SPL_FIT_SIGNATURE=y
+CONFIG_RSA=y
+CONFIG_SPL_RSA=y
@@ -2,3 +2,4 @@
 # source TrustZone stack on Qcom platforms
 CONFIG_TEE=y
 CONFIG_OPTEE=y
+CONFIG_OPTEE_LIB=y
@@ -3,6 +3,13 @@ require recipes-bsp/u-boot/u-boot.inc
 
 DEPENDS += "bc-native dtc-native gnutls-native python3-pyelftools-native qtestsign-native xxd-native"
 
+QCOM_UBOOT_SPL_FIT ?= "0"
+QCOM_UBOOT_SPL_FIT_ATF ?= ""
+QCOM_UBOOT_SPL_FIT_TEE ?= ""
+
+# BL31 and OP-TEE go into the FIT, swiv annotates the SPL before signing.
+DEPENDS += "${@bb.utils.contains('QCOM_UBOOT_SPL_FIT', '1', '${QCOM_UBOOT_SPL_FIT_ATF} ${QCOM_UBOOT_SPL_FIT_TEE} swiv-build-utility-native', '', d)}"
+
 COMPATIBLE_MACHINE:aarch64 = "(qcom)"
 
 PV = "2026.07+2026.10-rc1+git"
@@ -17,6 +24,7 @@ SRC_URI += " \
     file://efi-rt-volatile-store.cfg \
     ${@bb.utils.contains('MACHINE_FEATURES', 'optee', 'file://tfa-optee.cfg', '', d)} \
     ${@bb.utils.contains('MACHINE_FEATURES', 'kvm', 'file://gunyah-exit.cfg', '', d)} \
+    ${@bb.utils.contains('SPL_SIGN_ENABLE', '1', 'file://spl-fit-signature.cfg', '', d)} \
 "
 
 python __anonymous() {
@@ -36,14 +44,59 @@ python __anonymous() {
 uboot_compile_config:append() {
     config_mbn_header=$(uboot_config_get_indexed_value "${BOARD_MBN_HEADER}" $i)
 
-    if [ -n "${config_mbn_header}" ]; then
+    if [ "${QCOM_UBOOT_SPL_FIT}" = "1" ]; then
+        # Where uboot-sign's /incbin/ defaults expect them.
+        install -m 0644 ${RECIPE_SYSROOT}/firmware/${QCOM_UBOOT_SPL_FIT_ATF}/bl31.bin ${B}/${builddir}/bl31.bin
+        install -m 0644 ${RECIPE_SYSROOT}${nonarch_base_libdir}/firmware/tee-raw.bin ${B}/${builddir}/tee-raw.bin
+    elif [ -n "${config_mbn_header}" ]; then
         export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1
         qtestsign -${config_mbn_header} aboot -o ${B}/${builddir}/u-boot.mbn ${B}/${builddir}/u-boot.elf
     fi
 }
 
+# Wrap the SPL into an ELF, annotate it with a SWIV segment and sign it as the TZ
+# image, after do_uboot_assemble_fitimage so that a signed FIT has its key in the
+# SPL device tree. Reuses the linker script U-Boot generates for
+# CONFIG_SPL_REMAKE_ELF, as its own ELF predates that device tree swap.
+do_uboot_sign_spl() {
+    [ "${QCOM_UBOOT_SPL_FIT}" = "1" ] || return 0
+
+    export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1
+
+    unset i
+    for config in ${UBOOT_MACHINE}; do
+        i=$(expr ${i:-0} + 1)
+        j=0
+        for type in ${UBOOT_CONFIG}; do
+            j=$(expr $j + 1)
+            [ $j -eq $i ] || continue
+
+            builddir="${config}-${type}"
+            mbn_header=$(uboot_config_get_indexed_value "${BOARD_MBN_HEADER}" $i)
+            [ -n "${mbn_header}" ] || mbn_header="v6"
+
+            cd ${B}/${builddir}
+            ${OBJCOPY} -I binary -B aarch64 -O elf64-littleaarch64 ${SPL_BINARY} u-boot-spl.o
+            ${LD} u-boot-spl.o -o u-boot-spl-unsigned.elf -EL \
+                -T u-boot-elf.lds \
+                --defsym=_start=${QCOM_UBOOT_SPL_ENTRY} -Ttext=${QCOM_UBOOT_SPL_ENTRY}
+            rm -f u-boot-spl.o
+            swiv_build_utility u-boot-spl-swiv.elf u-boot-spl-unsigned.elf \
+                ${QCOM_UBOOT_SPL_SWIV_PLATFORM}
+            qtestsign -${mbn_header} tz -o u-boot-spl.mbn u-boot-spl-swiv.elf
+            rm -f u-boot-spl-unsigned.elf u-boot-spl-swiv.elf
+        done
+        unset j
+    done
+}
+addtask uboot_sign_spl after do_uboot_assemble_fitimage before do_install do_deploy
+
 uboot_deploy_config:append() {
-    if [ -f ${B}/${builddir}/u-boot.mbn ]; then
+    if [ "${QCOM_UBOOT_SPL_FIT}" = "1" ]; then
+        if [ -f ${B}/${builddir}/u-boot-spl.mbn ]; then
+            install -m 0644 ${B}/${builddir}/u-boot-spl.mbn ${DEPLOYDIR}/u-boot-spl-${type}.mbn
+        fi
+    elif [ -f ${B}/${builddir}/u-boot.mbn ]; then
         install -m 0644 ${B}/${builddir}/u-boot.mbn ${DEPLOYDIR}/u-boot-${type}.mbn
     fi
 }
@@ -19,8 +19,13 @@ S = "${UNPACKDIR}"
 KERNEL_CMDLINE_EXTRA ?= ""
 QCOM_FIT_KERNEL_CMDLINE = "root=${QCOM_BOOTIMG_ROOTFS} rw rootwait console=${KERNEL_CONSOLE} ${KERNEL_CMDLINE_EXTRA}"
 
+# Configurations bootm selects, as "#<config>[#<overlay-config>...]". Empty boots
+# the default configuration of the FIT.
+QCOM_FIT_BOOT_CONF ?= ""
+
 do_compile() {
-    sed -e "s|@KERNEL_CMDLINE@|${QCOM_FIT_KERNEL_CMDLINE}|g" boot.cmd.in > boot.cmd
+    sed -e "s|@KERNEL_CMDLINE@|${QCOM_FIT_KERNEL_CMDLINE}|g" \
+        -e "s|@FIT_CONF@|${QCOM_FIT_BOOT_CONF}|g" boot.cmd.in > boot.cmd
     mkimage -A ${UBOOT_ARCH} -T script -C none -n "Boot script" -d boot.cmd boot.scr
 }
 do_install[noexec] = "1"

@@ -8,4 +8,4 @@ setenv fdt_high 0x1ffffffff
 
 setenv bootargs "@KERNEL_CMDLINE@"
 load ${devtype} ${devnum}:${distro_bootpart} ${kernel_addr_r} /fitImage
-bootm ${kernel_addr_r}
+bootm ${kernel_addr_r}@FIT_CONF@