@@ -242,6 +242,23 @@ ifeq ($(ARCH),AARCH64)
     ifneq ($(filter 1,$(DISK_SDCARD) $(DISK_EMMC)),)
       DISK_DRIVER=usdhc
       OBJS+=hal/imx95_usdhc.o
+      # SCMI cold-init of uSDHC2 (clock+pinmux) when no prior stage did it.
+      ifeq ($(IMX95_SCMI_COLD_INIT),1)
+        CFLAGS+=-DIMX95_SCMI_COLD_INIT
+      endif
+    endif
+    # SCMI M7 power-on + TCM ECC scrub (U-Boot's power_on_m7 equivalent) for a
+    # Cortex-M7 that Linux launches later. Independent of the disk driver.
+    ifeq ($(IMX95_INIT_M7),1)
+      CFLAGS+=-DIMX95_INIT_M7
+    endif
+    # imx95_scmi.o carries the SCMI-over-MU client used by both of the above.
+    ifneq ($(filter 1,$(IMX95_SCMI_COLD_INIT) $(IMX95_INIT_M7)),)
+      OBJS+=hal/imx95_scmi.o
+    endif
+    # Verbose per-step trace of the SCMI cold-init and SD bring-up.
+    ifeq ($(IMX95_SCMI_DEBUG),1)
+      CFLAGS+=-DIMX95_SCMI_DEBUG
     endif
   endif
 
 
@@ -62,6 +62,12 @@ CROSS_COMPILE?=aarch64-none-elf-
 # Storage: carrier SD on uSDHC2 (hal/imx95_usdhc.c; i.MX uSDHC, not SDHCI).
 # Boot containers stay on eMMC.
 DISK_SDCARD?=1
+# Cold start: with no U-Boot ahead of wolfBoot the uSDHC2 clock and pinmux are
+# still owned by the System Manager and must be requested over SCMI.
+IMX95_SCMI_COLD_INIT?=1
+# Power the Cortex-M7 mix and scrub its TCM, as U-Boot's board init does, for
+# boards that launch an M7 image from Linux.
+IMX95_INIT_M7?=1
 # A/B slots by 0-based index into the parsed partition table.
 CFLAGS_EXTRA+=-DBOOT_PART_A=1 -DBOOT_PART_B=2
 CFLAGS_EXTRA+=-DDISK_BLOCK_SIZE=0x10000
 
@@ -9453,7 +9453,8 @@ Notes:
 - The FIT DTB gets `/chosen` bootargs, initrd properties and a `/memory` node from `hal_dts_fixup()`; deployment DTBs commonly ship without `/memory` (the bootloader is expected to add it) and the kernel hangs silently without one.
 - The EL2 exit is a fused asm routine (flush, DAIF mask, TLB invalidate, jump) that touches no memory after the D-cache goes off; set/way cleaning does not reach the A55 cluster's DSU system cache, so payload ranges are also cleaned by VA.
 - Use plain `earlycon` (DTB-derived); an explicit `earlycon=lpuart32,mmio32,<addr>` uses the wrong register layout on i.MX and silences all console output.
-- Storage requires the prior stage to have brought up uSDHC2 (clock/pinmux/card power are System Manager-owned via SCMI); a cold-boot SCMI client is follow-on work.
+- uSDHC2's clock, pinmux and card power are owned by the M33 System Manager, and its pad registers data-abort on direct access from BL33. `IMX95_SCMI_COLD_INIT=1` brings them up over SCMI (`hal/imx95_scmi.c`), which is what lets wolfBoot boot from SD on a cold power-on rather than only after a stage that already initialized the controller.
+- `IMX95_INIT_M7=1` powers the Cortex-M7 mix and scrubs its TCM for ECC, matching what U-Boot's board init does, for boards that launch an M7 image from Linux later.
 
 ## TI C2000 C28x (LAUNCHXL-F28P55X)
 
 
@@ -40,6 +40,11 @@
 #include "printf.h"
 #include "hal/imx95_a55.h"
 
+#ifdef IMX95_INIT_M7
+/* SCMI M7 power-domain on + TCM ECC scrub (hal/imx95_scmi.c). */
+extern int imx95_m7_tcm_init(void);
+#endif
+
 /* x0 at entry (captured by the .boot stub); .data so BSS clear spares it. */
 volatile uint64_t boot_handoff_x0 = 0xFFFFFFFFFFFFFFFFULL;
 
@@ -275,6 +280,12 @@ void hal_init(void)
         wolfBoot_printf("imx95: refusing to boot with an unsafe load window\n");
         wolfBoot_panic();
     }
+#ifdef IMX95_INIT_M7
+    /* U-Boot powers up the M7 mix and scrubs its TCM (ECC) at board init; as
+     * its BL33 replacement wolfBoot must too. Non-fatal: the A55 boot proceeds
+     * even if the M7 bring-up fails. */
+    (void)imx95_m7_tcm_init();
+#endif
 }
 
 /* src/boot_aarch64_start.S: clean+invalidate by VA. */
@@ -329,6 +340,14 @@ void* hal_get_update_address(void)
 
 #if defined(__WOLFBOOT) && defined(LINUX_BOOTARGS)
 #include "fdt.h"
+
+/* Primary ethernet (end0) MAC written into the DTB. Default is the Toradex
+ * SMARC iMX95 module's address (OUI 00:14:2d; low bytes are the module serial),
+ * read from its config block. Override with -DIMX95_ETH0_MAC={...} per board. */
+#ifndef IMX95_ETH0_MAC
+#define IMX95_ETH0_MAC { 0x00, 0x14, 0x2d, 0x88, 0x8d, 0x20 }
+#endif
+
 /* Fix up /chosen and /memory on the (already verified) FIT DTB. */
 int hal_dts_fixup(void* dts_addr, uint32_t capacity)
 {
@@ -385,6 +404,25 @@ int hal_dts_fixup(void* dts_addr, uint32_t capacity)
         return off;
     }
 
+    /* Ethernet MAC: the ENETC ports are PCIe-enumerated and carry no
+     * local-mac-address in the OS DTB (U-Boot normally programs it from the
+     * Toradex config block), so Linux would pick a random MAC each boot and the
+     * DHCP address would float. Set the primary port (ethernet0 = end0) to the
+     * module's address. Non-fatal: networking is not boot-critical. */
+    {
+        static const uint8_t eth0_mac[6] = IMX95_ETH0_MAC;
+        off = fdt_path_offset(&ctx, "/soc/pcie@4ca00000/ethernet@0,0");
+        if (off >= 0) {
+            ret = fdt_setprop(&ctx, off, "local-mac-address", eth0_mac,
+                              sizeof(eth0_mac));
+            if (ret != 0)
+                wolfBoot_printf("FDT: eth0 MAC fixup failed (%d)\n", ret);
+        }
+        else {
+            wolfBoot_printf("FDT: eth0 node not found (%d)\n", off);
+        }
+    }
+
     /* Last DTB write before the jump, after hal_prepare_boot()'s flush;
      * set/way cleaning in do_boot misses the DSU system cache, so clean
      * the blob by VA here or the kernel can read stale /chosen edits. */
 
@@ -0,0 +1,267 @@
+/* imx95_scmi.c
+ *
+ * Minimal SCMI-over-MU client for the NXP i.MX95 Cortex-A55 (BL33).
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* With no U-Boot ahead of wolfBoot, clocks, pinmux and power domains are still
+ * owned by the M33 System Manager and must be requested over SCMI; the pad
+ * registers data-abort on direct access from BL33. This is the smallest client
+ * that does it: SMT transport over MU2, then clock, pinctrl and power calls.
+ * Cross-checked against U-Boot drivers/firmware/scmi, clk/clk_scmi.c and
+ * pinctrl/pinctrl-scmi.c. */
+
+#include <stdint.h>
+#include "printf.h"
+#include "hal/imx95_a55.h"
+
+#if defined(IMX95_SCMI_COLD_INIT) || defined(IMX95_INIT_M7)
+
+#define MU2_BASE        0x445B0000UL
+#define MU2_GCR         (MU2_BASE + 0x114)   /* set BIT0: ring A2P doorbell */
+#define MU2_GSR         (MU2_BASE + 0x118)   /* BIT0: GIR0 ack (write 1 to clr) */
+#define SCMI_SHMEM      0x445B1000UL         /* scmi_buf0, 1 KiB */
+
+/* SMT header offsets within the shared buffer */
+#define SMT_CHAN_STATUS 0x04
+#define SMT_FLAGS       0x10
+#define SMT_LENGTH      0x14
+#define SMT_MSG_HEADER  0x18
+#define SMT_PAYLOAD     0x1C
+#define CHAN_FREE       0x1UL
+
+#define SCMI_PROTO_CLOCK    0x14
+#define SCMI_PROTO_PINCTRL  0x19
+#define SCMI_PROTO_POWER    0x11
+#define CLOCK_CONFIG_SET    0x7
+#define PINCTRL_CONFIG_SET  0x6
+#define PWD_STATE_SET       0x4
+#define PINCTRL_TYPE_MUX    192
+#define PINCTRL_TYPE_CONFIG 193
+
+/* Power domain id for the M7 mix (dt-bindings/power/fsl,imx95-power.h). */
+#define IMX95_PD_M7         17
+
+/* Pad ALT mode passed as the SCMI MUX value: 0 = uSDHC2 function, 5 = GPIO3. */
+#define PAD_ALT_USDHC2      0
+#define PAD_ALT_GPIO        5
+
+#define IMX95_CLK_USDHC2    159   /* IMX95_CCM_NUM_CLK_SRC(41) + 118 */
+
+#define SCMI_TIMEOUT        2000000
+
+/* Build with -DIMX95_SCMI_DEBUG for a per-step trace of the cold-init. */
+#ifdef IMX95_SCMI_DEBUG
+#define SCMI_DBG(...) wolfBoot_printf(__VA_ARGS__)
+#else
+#define SCMI_DBG(...) do { } while (0)
+#endif
+
+static inline uint32_t rd(uintptr_t a) { return *(volatile uint32_t*)a; }
+static inline void wr(uintptr_t a, uint32_t v) { *(volatile uint32_t*)a = v; }
+
+/* One synchronous SCMI command. payload[] holds nwords input words; on return
+ * it holds the response words (word 0 = SCMI status). Returns 0 on success. */
+static int scmi_cmd(uint32_t proto, uint32_t msg_id,
+                    uint32_t* payload, uint32_t nwords)
+{
+    uintptr_t sh = SCMI_SHMEM;
+    uint32_t n, i;
+
+    /* Wait for the channel to be free. */
+    for (n = 0; n < SCMI_TIMEOUT; n++) {
+        if (rd(sh + SMT_CHAN_STATUS) & CHAN_FREE)
+            break;
+    }
+    if (n == SCMI_TIMEOUT)
+        return -1;
+
+    wr(sh + SMT_FLAGS, 0);                       /* poll, no interrupt */
+    wr(sh + SMT_LENGTH, 4 + nwords * 4);         /* header word + payload */
+    wr(sh + SMT_MSG_HEADER, (proto << 10) | (msg_id & 0xFF));
+    for (i = 0; i < nwords; i++)
+        wr(sh + SMT_PAYLOAD + i * 4, payload[i]);
+
+    /* Hand the channel to the SM and ring the doorbell. */
+    wr(sh + SMT_CHAN_STATUS, rd(sh + SMT_CHAN_STATUS) & ~CHAN_FREE);
+    wr(MU2_GCR, rd(MU2_GCR) | 0x1);
+
+    /* The SM sets FREE again when the response is in place. */
+    for (n = 0; n < SCMI_TIMEOUT; n++) {
+        if (rd(sh + SMT_CHAN_STATUS) & CHAN_FREE)
+            break;
+    }
+    if (n == SCMI_TIMEOUT)
+        return -2;
+    wr(MU2_GSR, 0x1);                            /* clear GIR0 ack */
+
+    for (i = 0; i < nwords; i++)
+        payload[i] = rd(sh + SMT_PAYLOAD + i * 4);
+    return (int)payload[0];                      /* SCMI status, 0 = OK */
+}
+
+#if defined(DISK_SDCARD) && defined(IMX95_SCMI_COLD_INIT)
+static int scmi_clock_enable(uint32_t clock_id)
+{
+    uint32_t p[3];
+    p[0] = clock_id;
+    p[1] = 1;    /* attributes: enable */
+    p[2] = 0;    /* oem_config_val */
+    return scmi_cmd(SCMI_PROTO_CLOCK, CLOCK_CONFIG_SET, p, 3);
+}
+
+/* One pad: MUX(=mux) + CONFIG(=conf). identifier is the mux register offset/4
+ * (the SM's pin numbering); function_id 0xFFFFFFFF, attributes = ncfgs<<2. */
+static int scmi_pin_config(uint32_t mux_ofs, uint32_t mux, uint32_t conf)
+{
+    uint32_t p[7];
+    p[0] = mux_ofs / 4;      /* identifier */
+    p[1] = 0xFFFFFFFF;       /* function_id */
+    p[2] = (uint32_t)(2 << 2); /* attributes: 2 configs */
+    p[3] = PINCTRL_TYPE_MUX;    p[4] = mux;
+    p[5] = PINCTRL_TYPE_CONFIG; p[6] = conf;
+    return scmi_cmd(SCMI_PROTO_PINCTRL, PINCTRL_CONFIG_SET, p, 7);
+}
+
+/* Three uSDHC2 signals are carrier GPIOs on the SMARC, not controller pins:
+ * their pads must first be SCMI-muxed to GPIO3 (ALT5), then driven by direct
+ * RGPIO3 MMIO (which is permitted from BL33). Bits from the SMARC DTS:
+ *   GPIO3.0  SD2_CD_B   card detect     (input, active low)
+ *   GPIO3.7  SD2_RESET_B SDIO_PWR_EN    (output high = card power on)
+ *   GPIO3.19 SD2_VSELECT PMIC_SD2_VSEL  (output low = 3.3V, high = 1.8V) */
+#define RGPIO3_BASE  0x43820000UL
+#define RGPIO3_PDOR  (RGPIO3_BASE + 0x40)
+#define RGPIO3_PDDR  (RGPIO3_BASE + 0x54)
+#define GPIO3_CD     0U
+#define GPIO3_PWR    7U
+#define GPIO3_VSEL   19U
+
+static void delay_loops(uint32_t loops)
+{
+    volatile uint32_t d = loops;
+    while (d-- > 0U) { }
+}
+
+int imx95_usdhc2_cold_init(void)
+{
+    /* All nine uSDHC2 pads: {mux register offset, ALT mode, pad conf}. The six
+     * data/clk/cmd pins take the uSDHC2 function (ALT0); the three carrier GPIO
+     * signals take GPIO3 (ALT5). Values are the SMARC usdhc2/cd/pwr-en/vsel
+     * pinctrl groups. */
+    static const uint32_t pads[9][3] = {
+        { 0x1A4, PAD_ALT_USDHC2, 0x158e }, /* SD2_CLK   */
+        { 0x1A8, PAD_ALT_USDHC2, 0x138e }, /* SD2_CMD   */
+        { 0x1AC, PAD_ALT_USDHC2, 0x138e }, /* SD2_DATA0 */
+        { 0x1B0, PAD_ALT_USDHC2, 0x138e }, /* SD2_DATA1 */
+        { 0x1B4, PAD_ALT_USDHC2, 0x138e }, /* SD2_DATA2 */
+        { 0x1B8, PAD_ALT_USDHC2, 0x138e }, /* SD2_DATA3 */
+        { 0x1A0, PAD_ALT_GPIO,   0x1100 }, /* SD2_CD_B    -> GPIO3.0  */
+        { 0x1BC, PAD_ALT_GPIO,   0x011e }, /* SD2_RESET_B -> GPIO3.7  */
+        { 0x154, PAD_ALT_GPIO,   0x0004 }, /* SD2_VSELECT -> GPIO3.19 */
+    };
+    int i, ret;
+    uint32_t pddr, pdor;
+
+    ret = scmi_clock_enable(IMX95_CLK_USDHC2);
+    SCMI_DBG("scmi: clock enable(%d) -> %d\n", IMX95_CLK_USDHC2, ret);
+    if (ret != 0) {
+        wolfBoot_printf("scmi: uSDHC2 clock enable failed (%d)\n", ret);
+        return ret;
+    }
+
+    for (i = 0; i < 9; i++) {
+        ret = scmi_pin_config(pads[i][0], pads[i][1], pads[i][2]);
+        SCMI_DBG("scmi: pad 0x%x mux %d -> %d\n",
+            (unsigned)pads[i][0], (int)pads[i][1], ret);
+        if (ret != 0) {
+            wolfBoot_printf("scmi: pad 0x%x config failed (%d)\n",
+                (unsigned)pads[i][0], ret);
+            return ret;
+        }
+    }
+
+    /* Card detect as input; voltage-select and power-enable as outputs. */
+    pddr = rd(RGPIO3_PDDR);
+    pddr &= ~(1U << GPIO3_CD);
+    pddr |= (1U << GPIO3_VSEL) | (1U << GPIO3_PWR);
+    wr(RGPIO3_PDDR, pddr);
+
+    /* Select 3.3V I/O (VSEL low) before powering the card. */
+    pdor = rd(RGPIO3_PDOR);
+    pdor &= ~(1U << GPIO3_VSEL);
+    wr(RGPIO3_PDOR, pdor);
+
+    /* Power on, then wait past the regulator startup delay (DTS
+     * startup-delay-us 20000). Caches are off here, so the loop count is
+     * deliberately generous. */
+    pdor |= (1U << GPIO3_PWR);
+    wr(RGPIO3_PDOR, pdor);
+    delay_loops(40000000U);
+
+    SCMI_DBG("scmi: GPIO3 PDDR=0x%x PDOR=0x%x\n",
+        (unsigned)rd(RGPIO3_PDDR), (unsigned)rd(RGPIO3_PDOR));
+    wolfBoot_printf("scmi: uSDHC2 clock+pinmux+power up\n");
+    return 0;
+}
+#endif /* DISK_SDCARD && IMX95_SCMI_COLD_INIT */
+
+#ifdef IMX95_INIT_M7
+/* Cortex-M7 TCM system-view bases and size (256 KiB each at TCM_SIZE=000b). */
+#define IMX95_M7_ITCM_SYS   0x203C0000UL
+#define IMX95_M7_DTCM_SYS   0x20400000UL
+#define IMX95_M7_TCM_BYTES  0x40000UL
+
+/* Match U-Boot's power_on_m7(): power up the M7 mix over SCMI, then scrub its
+ * TCM so that never-written words carry valid ECC. U-Boot does this at board
+ * init, so wolfBoot must too when it replaces U-Boot as BL33 on a board whose
+ * Cortex-M7 is launched later by Linux remoteproc. */
+int imx95_m7_tcm_init(void)
+{
+    uint32_t p[3];
+    volatile uint32_t *w;
+    uint32_t i, words;
+    int ret;
+
+    /* SCMI power domain: STATE_SET {flags=0, domain_id=M7, pstate=0=on}. */
+    p[0] = 0;
+    p[1] = IMX95_PD_M7;
+    p[2] = 0;
+    ret = scmi_cmd(SCMI_PROTO_POWER, PWD_STATE_SET, p, 3);
+    SCMI_DBG("scmi: M7 power-on -> %d\n", ret);
+    if (ret != 0) {
+        wolfBoot_printf("scmi: M7 power domain on failed (%d)\n", ret);
+        return ret;
+    }
+
+    /* Scrub ITCM + DTCM to initialize ECC (word writes; MMU is off). */
+    words = (uint32_t)(IMX95_M7_TCM_BYTES / 4U);
+    w = (volatile uint32_t *)IMX95_M7_ITCM_SYS;
+    for (i = 0; i < words; i++)
+        w[i] = 0U;
+    w = (volatile uint32_t *)IMX95_M7_DTCM_SYS;
+    for (i = 0; i < words; i++)
+        w[i] = 0U;
+
+    wolfBoot_printf("scmi: M7 powered, TCM ECC initialized\n");
+    return 0;
+}
+#endif /* IMX95_INIT_M7 */
+
+#endif /* IMX95_SCMI_COLD_INIT || IMX95_INIT_M7 */