New mechanism to define SRAM/memory map with automatic bounds checking

This patch creates a new mechanism to define the static memory layout
(primarily in SRAM) for a given board, superseding the brittle mass of
Kconfigs that we were using before. The core part is a memlayout.ld file
in the mainboard directory (although boards are expected to just include
the SoC default in most cases), which is the primary linker script for
all stages (though not rmodules for now). It uses preprocessor macros
from <memlayout.h> to form a different valid linker script for all
stages while looking like a declarative, boilerplate-free map of memory
addresses to the programmer. Linker asserts will automatically guarantee
that the defined regions cannot overlap. Stages are defined with a
maximum size that will be enforced by the linker. The file serves to
both define and document the memory layout, so that the documentation
cannot go missing or out of date.

The mechanism is implemented for all boards in the ARM, ARM64 and MIPS
architectures, and should be extended onto all systems using SRAM in the
future. The CAR/XIP environment on x86 has very different requirements
and the layout is generally not as static, so it will stay like it is
and be unaffected by this patch (save for aligning some symbol names for
consistency and sharing the new common ramstage linker script include).

BUG=None
TEST=Booted normally and in recovery mode, checked suspend/resume and
the CBMEM console on Falco, Blaze (both normal and vboot2), Pinky and
Pit. Compiled Ryu, Storm and Urara, manually compared the disassemblies
with ToT and looked for red flags.

Change-Id: Ifd2276417f2036cbe9c056f17e42f051bcd20e81
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Original-Commit-Id: f1e2028e7ebceeb2d71ff366150a37564595e614
Original-Change-Id: I005506add4e8fcdb74db6d5e6cb2d4cb1bd3cda5
Original-Signed-off-by: Julius Werner <jwerner@chromium.org>
Original-Reviewed-on: https://chromium-review.googlesource.com/213370
Reviewed-on: http://review.coreboot.org/9283
Tested-by: build bot (Jenkins)
Reviewed-by: Stefan Tauner <stefan.tauner@gmx.at>
Reviewed-by: Aaron Durbin <adurbin@google.com>

40 files changed, 394 insertions, 546 deletions

diff --git a/src/soc/imgtec/pistachio/Kconfig b/src/soc/imgtec/pistachio/Kconfig
index 2e8b700007..70e5741cf1 100644
--- a/src/soc/imgtec/pistachio/Kconfig
+++ b/src/soc/imgtec/pistachio/Kconfig
@@ -35,10 +35,6 @@ config BOOTBLOCK_CPU_INIT
 	string
 	default "soc/imgtec/pistachio/bootblock.c"
 
-config BOOTBLOCK_BASE
-	hex
-	default 0x9b000000
-
 config CBFS_ROM_OFFSET
 	hex
 	default 0x4100
@@ -48,31 +44,4 @@ config CBFS_HEADER_ROM_OFFSET
 	hex
 	default 0x4000
 
-config ROMSTAGE_BASE
-	hex
-	default 0x9b004000
-	help
-	  The address where romstage is supposed to be loaded, right above the
-	  bootblock.
-
-config CBMEM_CONSOLE_PRERAM_BASE
-        hex "memory address of the CBMEM console buffer"
-        default 0x9b00f800
-	help
-	  Allocate 4KB to the pre-ram console buffer, we should be able to use
-	  GRAM eventually and have a much larger buffer.
-
-config BOOTBLOCK_STACK_BOTTOM
-	hex
-	default 0x9b00e000
-	help
-	  This allocates 6KB of stack space. One needs to verify that this is
-	  sufficient.
-
-config BOOTBLOCK_STACK_TOP
-	hex
-	default CBMEM_CONSOLE_PRERAM_BASE
-	help
-	  Bootblock stack starts immediately under the CBMEM console buffer,
-	  stack location might be changed by romstage.
 endif
diff --git a/src/soc/imgtec/pistachio/Makefile.inc b/src/soc/imgtec/pistachio/Makefile.inc
index b91bb1b59a..d052c8f435 100644
--- a/src/soc/imgtec/pistachio/Makefile.inc
+++ b/src/soc/imgtec/pistachio/Makefile.inc
@@ -51,5 +51,5 @@ $(objcbfs)/bootblock.raw: $(objcbfs)/bootblock.elf
 # Create a complete bootblock which will start up the system
 $(objcbfs)/bootblock.bin: $(objcbfs)/bootblock.raw $(BIMGTOOL)
 	@printf "    BIMGTOOL   $(subst $(obj)/,,$(@))\n"
-	$(BIMGTOOL) $< $@ $(CONFIG_BOOTBLOCK_BASE)
+	$(BIMGTOOL) $< $@ $(call loadaddr,bootblock)
 
diff --git a/src/soc/imgtec/pistachio/cbmem.c b/src/soc/imgtec/pistachio/cbmem.c
index 5fb6c0e7bd..373d4f853d 100644
--- a/src/soc/imgtec/pistachio/cbmem.c
+++ b/src/soc/imgtec/pistachio/cbmem.c
@@ -21,9 +21,10 @@
 
 #include <cbmem.h>
 #include <stdlib.h>
+#include <symbols.h>
 
 void *cbmem_top(void)
 {
 	uintptr_t top = MIN(CONFIG_DRAM_SIZE_MB, 256) << 20;
-	return (void *)(top + CONFIG_SYS_SDRAM_BASE);
+	return _dram + top;
 }
diff --git a/src/soc/imgtec/pistachio/memlayout.ld b/src/soc/imgtec/pistachio/memlayout.ld
new file mode 100644
index 0000000000..21c3d73d5f
--- /dev/null
+++ b/src/soc/imgtec/pistachio/memlayout.ld
@@ -0,0 +1,38 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+
+#include <arch/header.ld>
+
+/* TODO: This should be revised by someone who understands the SoC better. */
+
+SECTIONS
+{
+	CBFS_CACHE(0x0, 0) /* TODO: fix this, it was already broken before!!! */
+
+	DRAM_START(0x80000000)
+	RAMSTAGE(0x80000000, 128K)
+
+	/* TODO: Does this SoC use SRAM? Add SRAM_START() and SRAM_END(). */
+	BOOTBLOCK(0x9B000000, 16K)
+	ROMSTAGE(0x9B004000, 40K)
+	STACK(0x9B00E000, 6K)
+	PRERAM_CBMEM_CONSOLE(0x9B00F800, 3K)
+}
diff --git a/src/soc/nvidia/tegra124/Kconfig b/src/soc/nvidia/tegra124/Kconfig
index acc6e7e960..1680f4554c 100644
--- a/src/soc/nvidia/tegra124/Kconfig
+++ b/src/soc/nvidia/tegra124/Kconfig
@@ -22,34 +22,6 @@ config BOOTBLOCK_CPU_INIT
 	  bootblock must load microcode or copy data from ROM before
 	  searching for the bootblock.
 
-# ROM image layout.
-#
-# 0x00000 Combined bootblock and BCT blob
-# 0x18000 Master CBFS header.
-# 0x18080 Free for CBFS data.
-#
-# iRAM (256k) layout.
-# (Note: The BootROM uses the address range [0x4000_0000:0x4000_E000) itself,
-#  so the bootblock loading address must be placed after that. After the
-#  handoff that area may be reclaimed for other uses, e.g. CBFS cache.)
-#
-# 0x4000_0000 TTB (16K+32B). 32B is for L1 table of LPAE.
-# 0x4000_4020 CBFS mapping cache (96K-32B)
-# 0x4001_C000 Stack (16KB... don't reduce without comparing LZMA scratchpad!).
-# 0x4002_0000 Bootblock (max 48KB).
-# 0x4002_C000 ROM stage (max 80KB).
-# 0x4003_FFFF End of iRAM.
-#
-# if VBOOT2_VERIFY_FIRMWARE,
-# 0x4000_0000 TTB (16K+32B). 32B is for L1 table of LPAE.
-# 0x4000_4020 CBMEM console area (8K-32B)
-# 0x4000_6000 CBFS mapping cache (72K)
-# 0x4001_8000 vboot work buffer (16K)
-# 0x4001_C000 Stack (16KB... don't reduce without comparing LZMA scratchpad!).
-# 0x4002_0000 bootblock and romstage (max 70KB).
-# 0x4003_1000 verstage (max 60KB).
-# 0x4003_FFFF End of iRAM.
-
 config BOOTBLOCK_ROM_OFFSET
 	hex
 	default 0x0
@@ -62,65 +34,6 @@ config CBFS_ROM_OFFSET
 	hex "offset of CBFS data in ROM"
 	default 0x18080
 
-config SYS_SDRAM_BASE
-	hex
-	default 0x80000000
-
-config BOOTBLOCK_BASE
-	hex
-	default 0x40020000
-
-# this has to be big enough to leave room big enough for the larger of the
-# bootblock and the romstage.
-config VERSTAGE_BASE
-	hex
-	default 0x40031000
-
-# with vboot2, romstage is loaded over to the bootblock space
-config ROMSTAGE_BASE
-	hex
-	default 0x40020000 if VBOOT2_VERIFY_FIRMWARE
-	default 0x4002c000
-
-config RAMSTAGE_BASE
-	hex
-	default 0x80200000
-
-config STACK_TOP
-	hex
-	default 0x40020000
-
-config STACK_BOTTOM
-	hex
-	default 0x4001c000
-
-# This is the ramstage thread stack, *not* the same as above! Currently unused.
-config STACK_SIZE
-	hex
-	default 0x800
-
-# TTB needs to be aligned to 16KB. Stick it in iRAM.
-config TTB_BUFFER
-	hex "memory address of the TTB buffer"
-	default 0x40000000
-
-config CBFS_CACHE_ADDRESS
-	hex "memory address to put CBFS cache data"
-	default 0x40004020
-
-config CBFS_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00012000 if VBOOT2_VERIFY_FIRMWARE
-	default 0x00016000
-
-config VBOOT_WORK_BUFFER_ADDRESS
-	hex "memory address of vboot work buffer"
-	default 0x40018000
-
-config VBOOT_WORK_BUFFER_SIZE
-	hex "size of vboot work buffer"
-	default 0x00004000
-
 config TEGRA124_MODEL_TD570D
 	bool "TD570D"
 
diff --git a/src/soc/nvidia/tegra124/Makefile.inc b/src/soc/nvidia/tegra124/Makefile.inc
index d32580e96b..6de142d4ce 100644
--- a/src/soc/nvidia/tegra124/Makefile.inc
+++ b/src/soc/nvidia/tegra124/Makefile.inc
@@ -103,6 +103,6 @@ $(objcbfs)/bootblock.bin: $(objcbfs)/bootblock.raw.bin $(BCT_BIN) $(CBOOTIMAGE)
 	echo "Version    = 1;" > $(BCT_WRAPPER)
 	echo "Redundancy = 1;" >> $(BCT_WRAPPER)
 	echo "Bctfile    = $(BCT_BIN);" >> $(BCT_WRAPPER)
-	echo "BootLoader = $<,$(CONFIG_BOOTBLOCK_BASE),$(CONFIG_BOOTBLOCK_BASE),Complete;" >> $(BCT_WRAPPER)
+	echo "BootLoader = $<,$(call loadaddr,bootblock),$(call loadaddr,bootblock),Complete;" >> $(BCT_WRAPPER)
 	@printf "    CBOOTIMAGE $(subst $(obj)/,,$(@))\n"
 	$(CBOOTIMAGE) $(BCT_WRAPPER) $@
diff --git a/src/soc/nvidia/tegra124/bootblock_asm.S b/src/soc/nvidia/tegra124/bootblock_asm.S
index e4d43029fe..1a30dda65e 100644
--- a/src/soc/nvidia/tegra124/bootblock_asm.S
+++ b/src/soc/nvidia/tegra124/bootblock_asm.S
@@ -44,10 +44,8 @@ ENTRY(_start)
 	 * Initialize the stack to a known value. This is used to check for
 	 * stack overflow later in the boot process.
 	 */
-	ldr	r0, .Stack
-	ldr	r1, .Stack_size
-	sub	r0, r0, r1
-	ldr	r1, .Stack
+	ldr	r0, =_stack
+	ldr	r1, =_estack
 	ldr	r2, =0xdeadbeef
 init_stack_loop:
 	str	r2, [r0]
@@ -57,7 +55,7 @@ init_stack_loop:
 
 /* Set stackpointer in internal RAM to call bootblock main() */
 call_bootblock:
-	ldr	sp, .Stack /* Set up stack pointer */
+	ldr	sp, =_estack /* Set up stack pointer */
 	ldr	r0,=0x00000000
 	 /*
 	  * The current design of cpu_info places the
@@ -75,15 +73,3 @@ call_bootblock:
 	 */
 	bl	main
 ENDPROC(_start)
-
-/* we do it this way because it's a 32-bit constant and
- * in some cases too far away to be loaded as just an offset
- * from IP
- */
-.align 2
-.Stack:
-	.word CONFIG_STACK_TOP
-.align 2
-/* create this size the same way we do in coreboot_ram.ld: top-bottom */
-.Stack_size:
-	.word CONFIG_STACK_TOP - CONFIG_STACK_BOTTOM
diff --git a/src/soc/nvidia/tegra124/cbfs.c b/src/soc/nvidia/tegra124/cbfs.c
index 4497d6aa27..d56050d04c 100644
--- a/src/soc/nvidia/tegra124/cbfs.c
+++ b/src/soc/nvidia/tegra124/cbfs.c
@@ -19,12 +19,12 @@
 
 
 #include <cbfs.h>  /* This driver serves as a CBFS media source. */
+#include <symbols.h>
 
 #include "spi.h"
 
 int init_default_cbfs_media(struct cbfs_media *media)
 {
 	return initialize_tegra_spi_cbfs_media(media,
-		(void*)CONFIG_CBFS_CACHE_ADDRESS,
-		CONFIG_CBFS_CACHE_SIZE);
+		_cbfs_cache, _cbfs_cache_size);
 }
diff --git a/src/soc/nvidia/tegra124/clock.c b/src/soc/nvidia/tegra124/clock.c
index fa332835b2..f5043af3cd 100644
--- a/src/soc/nvidia/tegra124/clock.c
+++ b/src/soc/nvidia/tegra124/clock.c
@@ -20,6 +20,7 @@
 #include <soc/addressmap.h>
 #include <soc/clock.h>
 #include <stdlib.h>
+#include <symbols.h>
 #include <arch/clock.h>
 #include "clk_rst.h"
 #include "flow.h"
@@ -485,7 +486,7 @@ void clock_cpu0_config(void *entry)
 {
 	void * const evp_cpu_reset = (uint8_t *)TEGRA_EVP_BASE + 0x100;
 
-	write32(CONFIG_STACK_TOP, &maincpu_stack_pointer);
+	write32((uintptr_t)_estack, &maincpu_stack_pointer);
 	write32((uintptr_t)entry, &maincpu_entry_point);
 	write32((uintptr_t)&maincpu_setup, evp_cpu_reset);
 
diff --git a/src/soc/nvidia/tegra124/memlayout.ld b/src/soc/nvidia/tegra124/memlayout.ld
new file mode 100644
index 0000000000..0d9e772d41
--- /dev/null
+++ b/src/soc/nvidia/tegra124/memlayout.ld
@@ -0,0 +1,48 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+#include <vendorcode/google/chromeos/memlayout.h>
+
+#include <arch/header.ld>
+
+/*
+ * Note: The BootROM uses the address range [0x4000_0000:0x4000_E000) itself,
+ * so the bootblock loading address must be placed after that. After the
+ * handoff that area may be reclaimed for other uses, e.g. CBFS cache.
+ */
+
+SECTIONS
+{
+	SRAM_START(0x40000000)
+	TTB(0x40000000, 16K + 32)
+	PRERAM_CBMEM_CONSOLE(0x40004020, 8K - 32)
+	PRERAM_CBFS_CACHE(0x40006000, 16K)
+	VBOOT2_WORK(0x4000A000, 16K)
+	STACK(0x4000E000, 8K)
+	BOOTBLOCK(0x40010000, 24K)
+	VERSTAGE(0x40016000, 72K)
+	ROMSTAGE(0x40028000, 96K)
+	SRAM_END(0x40040000)
+
+	DRAM_START(0x80000000)
+	POSTRAM_CBFS_CACHE(0x80100000, 1M)
+	RAMSTAGE(0x80200000, 128K)
+	DMA_COHERENT(0x90000000, 2M)
+}
diff --git a/src/soc/nvidia/tegra124/sdram.c b/src/soc/nvidia/tegra124/sdram.c
index f0797db652..82219b1da5 100644
--- a/src/soc/nvidia/tegra124/sdram.c
+++ b/src/soc/nvidia/tegra124/sdram.c
@@ -23,6 +23,7 @@
 #include <soc/addressmap.h>
 #include <soc/clock.h>
 #include <stdlib.h>
+#include <symbols.h>
 
 #include "emc.h"
 #include "mc.h"
@@ -643,5 +644,5 @@ int sdram_size_mb(void)
 
 uintptr_t sdram_max_addressable_mb(void)
 {
-	return MIN((CONFIG_SYS_SDRAM_BASE/MiB) + sdram_size_mb(), 4096);
+	return MIN(((uintptr_t)_dram/MiB) + sdram_size_mb(), 4096);
 }
diff --git a/src/soc/nvidia/tegra124/soc.c b/src/soc/nvidia/tegra124/soc.c
index 48e50bdc3f..5da41a9b04 100644
--- a/src/soc/nvidia/tegra124/soc.c
+++ b/src/soc/nvidia/tegra124/soc.c
@@ -26,6 +26,7 @@
 #include <soc/nvidia/tegra124/sdram.h>
 #include "chip.h"
 #include <soc/display.h>
+#include <symbols.h>
 #include <vendorcode/google/chromeos/chromeos.h>
 
 /* this sucks, but for now, fb size/location are hardcoded.
@@ -37,12 +38,12 @@ static void soc_enable(device_t dev)
 	u32 lcdbase = fb_base_mb();
 	unsigned long fb_size = FB_SIZE_MB;
 
-	ram_resource(dev, 0, CONFIG_SYS_SDRAM_BASE/KiB,
+	ram_resource(dev, 0, (uintptr_t)_dram/KiB,
 		(sdram_max_addressable_mb() - fb_size)*KiB -
-		CONFIG_SYS_SDRAM_BASE/KiB);
+		(uintptr_t)_dram/KiB);
 	mmio_resource(dev, 1, lcdbase*KiB, fb_size*KiB);
 
-	u32 sdram_end_mb = sdram_size_mb() + CONFIG_SYS_SDRAM_BASE/MiB;
+	u32 sdram_end_mb = sdram_size_mb() + (uintptr_t)_dram/MiB;
 
 	if (sdram_end_mb > sdram_max_addressable_mb())
 		ram_resource(dev, 2, sdram_max_addressable_mb()*KiB,
diff --git a/src/soc/nvidia/tegra124/verstage.c b/src/soc/nvidia/tegra124/verstage.c
index 60361a2afd..2e5ddf276c 100644
--- a/src/soc/nvidia/tegra124/verstage.c
+++ b/src/soc/nvidia/tegra124/verstage.c
@@ -22,6 +22,8 @@
 #include <console/console.h>
 #include <soc/nvidia/tegra124/cache.h>
 #include <soc/nvidia/tegra124/early_configs.h>
+#include <stdlib.h>
+#include <symbols.h>
 #include <vendorcode/google/chromeos/chromeos.h>
 
 static void enable_cache(void)
@@ -29,8 +31,9 @@ static void enable_cache(void)
 	mmu_init();
 	/* Whole space is uncached. */
 	mmu_config_range(0, 4096, DCACHE_OFF);
-	/* SRAM is cached. Round the size up to 2MB, the LPAE page size. */
-	mmu_config_range(0x40000000 >> 20, 1, DCACHE_WRITEBACK);
+	/* SRAM is cached. MMU code will round size up to page size. */
+	mmu_config_range((uintptr_t)_sram/MiB, div_round_up(_sram_size, MiB),
+			 DCACHE_WRITEBACK);
 	mmu_disable_range(0, 1);
 	dcache_mmu_enable();
 }
diff --git a/src/soc/nvidia/tegra132/Kconfig b/src/soc/nvidia/tegra132/Kconfig
index 24bf8649a0..c87698a8d2 100644
--- a/src/soc/nvidia/tegra132/Kconfig
+++ b/src/soc/nvidia/tegra132/Kconfig
@@ -43,50 +43,6 @@ config CBFS_ROM_OFFSET
 	hex "offset of CBFS data in ROM"
 	default 0x40080
 
-config BOOTBLOCK_BASE
-	hex
-	default 0x40020000
-
-config ROMSTAGE_BASE
-	hex
-	default 0x40025000
-
-config SYS_SDRAM_BASE
-	hex
-	default 0x80000000
-
-config RAMSTAGE_BASE
-	hex
-	default 0x80200000
-
-config BOOTBLOCK_STACK_TOP
-	hex
-	default 0x40020000
-
-config BOOTBLOCK_STACK_BOTTOM
-	hex
-	default 0x4001c000
-
-config ROMSTAGE_STACK_TOP
-	hex
-	default 0x40020000
-
-config ROMSTAGE_STACK_BOTTOM
-	hex
-	default 0x4001c000
-
-config CBFS_CACHE_ADDRESS
-	hex "memory address to put CBFS cache data"
-	default 0x40006000
-
-config CBFS_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00016000
-
-config CONSOLE_PRERAM_BUFFER_BASE
-	hex "memory address of the CBMEM console buffer"
-	default 0x40004020
-
 config MTS_DIRECTORY
 	string "Directory where MTS microcode files are located"
 	default "3rdparty/cpu/nvidia/tegra132/current/prod"
diff --git a/src/soc/nvidia/tegra132/Makefile.inc b/src/soc/nvidia/tegra132/Makefile.inc
index 10d4d4e5f0..81d08f54df 100644
--- a/src/soc/nvidia/tegra132/Makefile.inc
+++ b/src/soc/nvidia/tegra132/Makefile.inc
@@ -114,7 +114,7 @@ $(objcbfs)/bootblock.bin: $(objcbfs)/bootblock.raw.bin $(BCT_BIN) $(CBOOTIMAGE)
 	echo "Bctcopy    = 1;" >> $(BCT_WRAPPER)
 	echo "Bctfile    = $(BCT_BIN);" >> $(BCT_WRAPPER)
 	echo "MtsPreboot = $(PREBOOT_MTS_FILE),0x4000f000,0x4000f000,Complete;" >> $(BCT_WRAPPER)
-	echo "BootLoader = $<,$(CONFIG_BOOTBLOCK_BASE),$(CONFIG_BOOTBLOCK_BASE),Complete;" >> $(BCT_WRAPPER)
+	echo "BootLoader = $<,$(call loadaddr,bootblock),$(call loadaddr,bootblock),Complete;" >> $(BCT_WRAPPER)
 	@printf "    CBOOTIMAGE $(subst $(obj)/,,$(@))\n"
 	$(CBOOTIMAGE) $(CBOOTIMAGE_OPTS) $(BCT_WRAPPER) $@
 
diff --git a/src/soc/nvidia/tegra132/addressmap.c b/src/soc/nvidia/tegra132/addressmap.c
index a18e1b86dc..bd644d4c5c 100644
--- a/src/soc/nvidia/tegra132/addressmap.c
+++ b/src/soc/nvidia/tegra132/addressmap.c
@@ -23,6 +23,7 @@
 #include <console/console.h>
 #include <soc/addressmap.h>
 #include <soc/id.h>
+#include <symbols.h>
 #include "mc.h"
 #include "sdram.h"
 
@@ -105,7 +106,7 @@ static void memory_in_range(uintptr_t *base_mib, uintptr_t *end_mib,
 	uintptr_t end;
 	int i;
 
-	base = CONFIG_SYS_SDRAM_BASE / MiB;
+	base = (uintptr_t)_dram / MiB;
 	end = base + sdram_size_mb();
 
 	/* Requested limits out of range. */
diff --git a/src/soc/nvidia/tegra132/bootblock_asm.S b/src/soc/nvidia/tegra132/bootblock_asm.S
index 1b2fbb7709..bf63c02433 100644
--- a/src/soc/nvidia/tegra132/bootblock_asm.S
+++ b/src/soc/nvidia/tegra132/bootblock_asm.S
@@ -42,17 +42,5 @@ ENTRY(_start)
 	 */
 	msr	cpsr_cxf, #0xdf
 
-	stack_init stack=.Stack size=.Stack_size seed=1 func=main
+	stack_init stack_top=_estack stack_bottom=_stack seed=1 func=main
 ENDPROC(_start)
-
-/* we do it this way because it's a 32-bit constant and
- * in some cases too far away to be loaded as just an offset
- * from IP
- */
-.align 2
-.Stack:
-	.word CONFIG_BOOTBLOCK_STACK_TOP
-.align 2
-/* create this size the same way we do in ramstage.ld: top-bottom */
-.Stack_size:
-	.word CONFIG_BOOTBLOCK_STACK_TOP - CONFIG_BOOTBLOCK_STACK_BOTTOM
diff --git a/src/soc/nvidia/tegra132/cbfs.c b/src/soc/nvidia/tegra132/cbfs.c
index 7b75f7c8c1..648d13663a 100644
--- a/src/soc/nvidia/tegra132/cbfs.c
+++ b/src/soc/nvidia/tegra132/cbfs.c
@@ -19,12 +19,12 @@
 
 
 #include <cbfs.h>  /* This driver serves as a CBFS media source. */
+#include <symbols.h>
 
 #include "spi.h"
 
 int init_default_cbfs_media(struct cbfs_media *media)
 {
 	return initialize_tegra_spi_cbfs_media(media,
-		(void*)CONFIG_CBFS_CACHE_ADDRESS,
-		CONFIG_CBFS_CACHE_SIZE);
+		_cbfs_cache, _cbfs_cache_size);
 }
diff --git a/src/soc/nvidia/tegra132/memlayout.ld b/src/soc/nvidia/tegra132/memlayout.ld
new file mode 100644
index 0000000000..63cf4f031c
--- /dev/null
+++ b/src/soc/nvidia/tegra132/memlayout.ld
@@ -0,0 +1,44 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+
+#include <arch/header.ld>
+
+/*
+ * Note: The BootROM uses the address range [0x4000_0000:0x4000_E000) itself,
+ * so the bootblock loading address must be placed after that. After the
+ * handoff that area may be reclaimed for other uses, e.g. CBFS cache.
+ * TODO: Did this change on Tegra132? What's the new valid range?
+ */
+
+SECTIONS
+{
+	SRAM_START(0x40000000)
+	/* 16K hole */
+	PRERAM_CBMEM_CONSOLE(0x40004000, 8K)
+	CBFS_CACHE(0x40006000, 88K)
+	STACK(0x4001C000, 16K)
+	BOOTBLOCK(0x40020000, 20K)
+	ROMSTAGE(0x40025000, 108K)
+	SRAM_END(0x40040000)
+
+	DRAM_START(0x80000000)
+	RAMSTAGE(0x80200000, 192K)
+}
diff --git a/src/soc/nvidia/tegra132/romstage_asm.S b/src/soc/nvidia/tegra132/romstage_asm.S
index ac3c93ebc1..d0b036cbd6 100644
--- a/src/soc/nvidia/tegra132/romstage_asm.S
+++ b/src/soc/nvidia/tegra132/romstage_asm.S
@@ -23,17 +23,5 @@
         .section ".text", "ax", %progbits
 
 ENTRY(main)
-	stack_init stack=.Stack size=.Stack_size seed=0 func=romstage
+	stack_init stack_top=_estack stack_bottom=_stack seed=0 func=romstage
 ENDPROC(main)
-
-/* we do it this way because it's a 32-bit constant and
- * in some cases too far away to be loaded as just an offset
- * from IP
- */
-.align 2
-.Stack:
-	.word CONFIG_ROMSTAGE_STACK_TOP
-.align 2
-.Stack_size:
-	.word CONFIG_ROMSTAGE_STACK_TOP - CONFIG_ROMSTAGE_STACK_BOTTOM
-
diff --git a/src/soc/nvidia/tegra132/stack.S b/src/soc/nvidia/tegra132/stack.S
index 6d3cd4e446..3b877e4be6 100644
--- a/src/soc/nvidia/tegra132/stack.S
+++ b/src/soc/nvidia/tegra132/stack.S
@@ -19,21 +19,19 @@
 
 /* Macro to initialize stack, perform seeding if required and finally call the
  * function provided
- * @stack : Stack address
- * @size  : Stack size
- * @seed  : Stack seeding required (1=yes/otherwise=no)
- * @func  : Function to call after initializing stack
+ * @stack_top    : First address above the stack
+ * @stack_bottom : Lowest address on the stack
+ * @seed         : Stack seeding required (1=yes/otherwise=no)
+ * @func         : Function to call after initializing stack
  */
-.macro stack_init stack, size, seed, func
+.macro stack_init stack_top, stack_bottom, seed, func
         /* Check if stack seeding is required */
 	mov	r0, #\seed
 	cmp     r0, #1
 	bne     call_func
 	/* Stack seeding */
-	ldr     r0, \stack
-	ldr	r1, \size
-	sub	r0, r0, r1
-	ldr	r1, \stack
+	ldr     r0, =\stack_bottom
+	ldr	r1, =\stack_top
 	ldr	r2, =0xdeadbeef
 init_stack_loop:
 	str	r2, [r0]
@@ -42,6 +40,6 @@ init_stack_loop:
 	bne	init_stack_loop
 
 call_func:
-	ldr	sp, \stack /* Set up stack pointer */
+	ldr	sp, =\stack_top /* Set up stack pointer */
 	bl	\func
 .endm
diff --git a/src/soc/qualcomm/ipq806x/Kconfig b/src/soc/qualcomm/ipq806x/Kconfig
index 013d86c380..092951d2d2 100644
--- a/src/soc/qualcomm/ipq806x/Kconfig
+++ b/src/soc/qualcomm/ipq806x/Kconfig
@@ -39,44 +39,4 @@ config SBL_BLOB
 	  ipq806x early initialization code, as supplied by the
 	  vendor.
 
-config BOOTBLOCK_BASE
-	hex "256K bytes left for TZBSP"
-	default 0x40600000
-
-config ROMSTAGE_BASE
-	hex
-	default 0x40620000
-
-config RAMSTAGE_BASE
-	hex
-	default 0x40640000
-
-config SYS_SDRAM_BASE
-	hex
-	default 0x40000000
-
-config CBMEM_CONSOLE_PRERAM_BASE
-	hex "memory address of the pre-RAM CBMEM console buffer"
-	default 0x40618000
-
-config STACK_TOP
-	hex
-	default 0x40600000
-
-config STACK_BOTTOM
-	hex
-	default 0x405fc000
-
-config CBFS_CACHE_ADDRESS
-	hex "memory address to put CBFS cache data"
-	default 0x405cc000
-
-config CBFS_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00030000
-
-config TTB_BUFFER
-	hex "memory address for page tables"
-	default 0x2a05c000
-
 endif
diff --git a/src/soc/qualcomm/ipq806x/Makefile.inc b/src/soc/qualcomm/ipq806x/Makefile.inc
index a7dabc6abd..5dfca4d7ad 100644
--- a/src/soc/qualcomm/ipq806x/Makefile.inc
+++ b/src/soc/qualcomm/ipq806x/Makefile.inc
@@ -51,7 +51,7 @@ $(objcbfs)/bootblock.raw: $(objcbfs)/bootblock.elf
 # Add MBN header to allow SBL3 to start coreboot bootblock
 $(objcbfs)/bootblock.mbn: $(objcbfs)/bootblock.raw
 	@printf "    ADD MBN    $(subst $(obj)/,,$(@))\n"
-	./util/ipqheader/ipqheader.py $(CONFIG_BOOTBLOCK_BASE) $< $@.tmp
+	./util/ipqheader/ipqheader.py $(call loadaddr,bootblock) $< $@.tmp
 	@mv $@.tmp $@
 
 # Create a complete bootblock which will start up the system
diff --git a/src/soc/qualcomm/ipq806x/cbmem.c b/src/soc/qualcomm/ipq806x/cbmem.c
index ecb02e47e8..fdf2605147 100644
--- a/src/soc/qualcomm/ipq806x/cbmem.c
+++ b/src/soc/qualcomm/ipq806x/cbmem.c
@@ -19,9 +19,9 @@
 
 #include <cbmem.h>
 #include <stddef.h>
+#include <symbols.h>
 
 void *cbmem_top(void)
 {
-	return (void *)((uintptr_t)CONFIG_SYS_SDRAM_BASE +
-					(CONFIG_DRAM_SIZE_MB << 20));
+	return (void *)((uintptr_t)_dram + CONFIG_DRAM_SIZE_MB*MiB);
 }
diff --git a/src/soc/qualcomm/ipq806x/memlayout.ld b/src/soc/qualcomm/ipq806x/memlayout.ld
new file mode 100644
index 0000000000..30596031ec
--- /dev/null
+++ b/src/soc/qualcomm/ipq806x/memlayout.ld
@@ -0,0 +1,40 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+
+#include <arch/header.ld>
+
+/* TODO: This should be revised by someone who understands the SoC better. */
+
+SECTIONS
+{
+	/* TODO: add SRAM_START(), SRAM_END() and REGION(reserved_sbl) */
+	TTB(0x2A05C000, 48K)
+
+	DRAM_START(0x40000000)
+	CBFS_CACHE(0x405CC000, 192K)
+	STACK(0x405FC000, 16K)
+	/* TODO: "256K bytes left for TZBSP"... what does that mean? */
+	BOOTBLOCK(0x40600000, 32K)
+	PRERAM_CBMEM_CONSOLE(0x40618000, 8K)
+	ROMSTAGE(0x40620000, 128K)
+	RAMSTAGE(0x40640000, 128K)
+	DMA_COHERENT(0x5A000000, 2M)
+}
diff --git a/src/soc/qualcomm/ipq806x/soc.c b/src/soc/qualcomm/ipq806x/soc.c
index 6421ccdadd..1d63cacf60 100644
--- a/src/soc/qualcomm/ipq806x/soc.c
+++ b/src/soc/qualcomm/ipq806x/soc.c
@@ -21,16 +21,15 @@
 
 #include <console/console.h>
 #include <device/device.h>
-
+#include <symbols.h>
 
 #define RESERVED_SIZE_KB	(0x01500000 / KiB)
 
 static void soc_read_resources(device_t dev)
 {
 	/* Reserve bottom 0x150_0000 bytes for NSS, SMEM, etc. */
-	reserved_ram_resource(dev, 0,
-			CONFIG_SYS_SDRAM_BASE/KiB, RESERVED_SIZE_KB);
-	ram_resource(dev, 0, CONFIG_SYS_SDRAM_BASE/KiB + RESERVED_SIZE_KB,
+	reserved_ram_resource(dev, 0, (uintptr_t)_dram / KiB, RESERVED_SIZE_KB);
+	ram_resource(dev, 0, (uintptr_t)_dram / KiB + RESERVED_SIZE_KB,
 		     (CONFIG_DRAM_SIZE_MB * KiB) - RESERVED_SIZE_KB);
 }
 
diff --git a/src/soc/rockchip/rk3288/Kconfig b/src/soc/rockchip/rk3288/Kconfig
index 05876f4f0b..0865fe8f54 100644
--- a/src/soc/rockchip/rk3288/Kconfig
+++ b/src/soc/rockchip/rk3288/Kconfig
@@ -41,51 +41,6 @@ config BOOTBLOCK_CPU_INIT
 # 0x00000 Combined bootblock and ID Block
 # 0x08000 Master CBFS header.
 # 0x18000 Free for CBFS data.
-#
-# iRAM (96k) layout.
-# (Note: The BootROM will jump to 0xff704004 after loading bootblock,
-#  so the bootblock loading address must be at 0xff704004.)
-#
-# 0xFF70_0000 TTB (16KB).
-# 0xFF70_4004 Bootblock (max 16KB-4B).
-# 0xFF70_8000 verstage then romstage (max 40KB).
-# 0xFF71_2000 STACK (4KB).
-# 0xFF71_3000 CBFS mapping cache (4K)
-# 0xFF71_4000 vboot work buffer (16K)
-# 0xFF71_7FFF End of iRAM.
-
-config SYS_SRAM_BASE
-	hex "SRAM base address"
-	default 0xFF700000
-
-config SYS_SDRAM_BASE
-	hex "SDRAM base address"
-	default 0x00000000
-
-config STACK_TOP
-	hex "STACK TOP"
-	default 0xff713000
-
-config STACK_BOTTOM
-	hex "STACK BOTTOM"
-	default 0xff712000
-
-config BOOTBLOCK_BASE
-	hex
-	default 0xff704004
-
-# with vboot2, romstage is loaded over the verstage space
-config VERSTAGE_BASE
-	hex
-	default 0xff708000
-
-config ROMSTAGE_BASE
-	hex "ROM STAGE BASE"
-	default 0xff708000
-
-config RAMSTAGE_BASE
-	hex "RAMSTAGE BASE"
-	default 0x00200000
 
 config BOOTBLOCK_ROM_OFFSET
 	hex
@@ -99,32 +54,4 @@ config CBFS_ROM_OFFSET
 	hex
 	default 0x0018000
 
-config CBFS_SRAM_CACHE_ADDRESS
-	hex "sram memory address to put CBFS cache data"
-	default 0xff713000
-
-config CBFS_SRAM_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00001000
-
-config VBOOT_WORK_BUFFER_ADDRESS
-	hex "memory address of vboot work buffer"
-	default 0xff714000
-
-config VBOOT_WORK_BUFFER_SIZE
-	hex "size of vboot work buffer"
-	default 0x00004000
-
-config CBFS_DRAM_CACHE_ADDRESS
-	hex "dram memory address to put CBFS cache data"
-	default 0x01000000
-
-config CBFS_DRAM_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00100000
-
-config TTB_BUFFER
-	hex "memory address of the TTB buffer"
-	default 0xff700000
-
 endif
diff --git a/src/soc/rockchip/rk3288/media.c b/src/soc/rockchip/rk3288/media.c
index 2b023e15df..f2471f9b5a 100644
--- a/src/soc/rockchip/rk3288/media.c
+++ b/src/soc/rockchip/rk3288/media.c
@@ -18,19 +18,12 @@
  */
 
 #include <cbfs.h>
-#include <string.h>
-#include <console/console.h>
-#include "soc/rockchip/rk3288/spi.h"
+#include <symbols.h>
+
+#include "spi.h"
 
 int init_default_cbfs_media(struct cbfs_media *media)
 {
-#if defined(__PRE_RAM__) && !defined(__ROMSTAGE__)
-	return initialize_rockchip_spi_cbfs_media(media,
-		(void *)CONFIG_CBFS_SRAM_CACHE_ADDRESS,
-		CONFIG_CBFS_SRAM_CACHE_SIZE);
-#else
 	return initialize_rockchip_spi_cbfs_media(media,
-		(void *)CONFIG_CBFS_DRAM_CACHE_ADDRESS,
-		CONFIG_CBFS_DRAM_CACHE_SIZE);
-#endif
+		_cbfs_cache, _cbfs_cache_size);
 }
diff --git a/src/soc/rockchip/rk3288/memlayout.ld b/src/soc/rockchip/rk3288/memlayout.ld
new file mode 100644
index 0000000000..6faec63ba5
--- /dev/null
+++ b/src/soc/rockchip/rk3288/memlayout.ld
@@ -0,0 +1,48 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+#include <vendorcode/google/chromeos/memlayout.h>
+
+#include <arch/header.ld>
+
+/* Note: The BootROM will jump to 0xFF704004 after loading bootblock,
+ * so the bootblock loading address must be at 0xFF704004.
+ */
+SECTIONS
+{
+	DRAM_START(0x00000000)
+	RAMSTAGE(0x00200000, 128K)
+	POSTRAM_CBFS_CACHE(0x01000000, 1M)
+	DMA_COHERENT(0x10000000, 2M)
+
+	SRAM_START(0xFF700000)
+	TTB(0xFF700000, 16K)
+	BOOTBLOCK(0xFF704004, 16K - 4)
+	VBOOT2_WORK(0xFF708000, 16K)
+	OVERLAP_VERSTAGE_ROMSTAGE(0xFF70C000, 40K)
+	PRERAM_CBFS_CACHE(0xFF716000, 4K)
+	STACK(0xFF717000, 4K)
+	SRAM_END(0xFF718000)
+
+	/* 4K of special SRAM in PMU power domain. Careful: only supports 32-bit
+	 * wide write accesses! Only use with MMU and writeback mapping. */
+	SYMBOL(pmu_sram, 0xFF720000)
+	SYMBOL(epmu_sram, 0xFF721000)
+}
diff --git a/src/soc/rockchip/rk3288/soc.h b/src/soc/rockchip/rk3288/soc.h
index 3121fd872d..00f35b2f3c 100644
--- a/src/soc/rockchip/rk3288/soc.h
+++ b/src/soc/rockchip/rk3288/soc.h
@@ -21,13 +21,14 @@
 #define __SOC_ROCKCHIP_RK3288_CPU_H__
 
 #include <arch/io.h>
+#include <symbols.h>
 
 #define RK_CLRSETBITS(clr, set) ((((clr) | (set)) << 16) | set)
 #define RK_SETBITS(set) RK_CLRSETBITS(0, set)
 #define RK_CLRBITS(clr) RK_CLRSETBITS(clr, 0)
 
 #define FB_SIZE_KB  4096
-#define RAM_BASE_KB (CONFIG_SYS_SDRAM_BASE >> 10)
+#define RAM_BASE_KB ((uintptr_t)_dram >> 10)
 #define RAM_SIZE_KB (CONFIG_DRAM_SIZE_MB << 10UL)
 
 static inline u32 get_fb_base_kb(void)
diff --git a/src/soc/samsung/exynos5250/Kconfig b/src/soc/samsung/exynos5250/Kconfig
index 3c7d6c4e77..4126ec1e59 100644
--- a/src/soc/samsung/exynos5250/Kconfig
+++ b/src/soc/samsung/exynos5250/Kconfig
@@ -32,59 +32,4 @@ config CBFS_ROM_OFFSET
 	hex "offset of CBFS data in ROM"
 	default 0x0A080
 
-config SYS_SDRAM_BASE
-	hex
-	default 0x40000000
-
-# Example SRAM/iRAM map for Exynos5250 platform:
-#
-# 0x0202_0000: vendor-provided BL1
-# 0x0202_3400: bootblock, assume up to 32KB in size
-# 0x0203_0000: romstage, assume up to 128KB in size.
-# 0x0207_8000: stack pointer
-
-config BOOTBLOCK_BASE
-	hex
-	default 0x02023400
-
-config ROMSTAGE_BASE
-	hex
-	default 0x02030000
-
-config RAMSTAGE_BASE
-	hex
-	default SYS_SDRAM_BASE
-
-# Stack may reside in either IRAM or DRAM. We will define it to live
-# at the top of IRAM for now.
-#
-# Stack grows downward, push operation stores register contents in
-# consecutive memory locations ending just below SP
-config STACK_TOP
-	hex
-	default 0x02078000
-
-config STACK_BOTTOM
-	hex
-	default 0x02074000
-
-config STACK_SIZE
-	hex
-	default 0x4000
-
-# TODO We may probably move this to board-specific implementation files instead
-# of KConfig values.
-config CBFS_CACHE_ADDRESS
-	hex "memory address to put CBFS cache data"
-	default 0x0205c000
-
-config CBFS_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00018000
-
-# TTB needs to be aligned to 16KB.
-config TTB_BUFFER
-	hex "memory address of the TTB buffer"
-	default 0x02058000
-
 endif
diff --git a/src/soc/samsung/exynos5250/alternate_cbfs.c b/src/soc/samsung/exynos5250/alternate_cbfs.c
index 10b33f0c2b..e46221cd2d 100644
--- a/src/soc/samsung/exynos5250/alternate_cbfs.c
+++ b/src/soc/samsung/exynos5250/alternate_cbfs.c
@@ -22,6 +22,7 @@
 #include <cbfs.h>  /* This driver serves as a CBFS media source. */
 #include <stdlib.h>
 #include <string.h>
+#include <symbols.h>
 #include <console/console.h>
 #include "alternate_cbfs.h"
 #include "power.h"
@@ -33,14 +34,14 @@
  * by the IROM / BL1, so this code has nothing to do with them.
  *
  * The third transfer is a valid CBFS image that contains only the romstage,
- * and must be small enough to fit into alternate_cbfs_size[__BOOT_BLOCK__] in
+ * and must be small enough to fit into the PRE_RAM CBFS cache in
  * IRAM. It is loaded when this function gets called in the boot block, and
  * the normal CBFS code extracts the romstage from it.
  *
  * The fourth transfer is also a CBFS image, but can be of arbitrary size and
  * should contain all available stages/payloads/etc. It is loaded when this
  * function is called a second time at the end of the romstage, and copied to
- * alternate_cbfs_buffer[!__BOOT_BLOCK__] in DRAM. It will reside there for the
+ * the romstage/ramstage CBFS cache in DRAM. It will reside there for the
  * rest of the firmware's lifetime and all subsequent stages (which will not
  * have __PRE_RAM__ defined) can just directly reference it there.
  */
@@ -60,12 +61,12 @@ static int usb_cbfs_open(struct cbfs_media *media)
 
 	/*
 	 * We need to trust the host/irom to copy the image to our
-	 * alternate_cbfs_buffer address... there is no way to control or even
+	 * _cbfs_cache address... there is no way to control or even
 	 * check the transfer size or target address from our side.
 	 */
 
 	printk(BIOS_DEBUG, "USB A-A transfer successful, CBFS image should now"
-		" be at %p\n", alternate_cbfs_buffer);
+		" be at %p\n", _cbfs_cache);
 	first_run = 0;
 #endif
 	return 0;
@@ -86,11 +87,11 @@ static int sdmmc_cbfs_open(struct cbfs_media *media)
 	 * In the bootblock, we just copy the small part that fits in the buffer
 	 * and hope that it's enough (since the romstage is currently always the
 	 * first component in the image, this should work out). In the romstage,
-	 * we copy until our buffer is full (currently 12M) to avoid the pain of
+	 * we copy until our cache is full (currently 12M) to avoid the pain of
 	 * figuring out the true image size from in here. Since this is mainly a
 	 * developer/debug boot mode, those shortcomings should be bearable.
 	 */
-	const u32 count = alternate_cbfs_size / 512;
+	const u32 count = _cbfs_cache_size / 512;
 	static int first_run = 1;
 	int (*irom_load_sdmmc)(u32 start, u32 count, void *dst) =
 		*irom_sdmmc_read_blocks_ptr;
@@ -98,13 +99,13 @@ static int sdmmc_cbfs_open(struct cbfs_media *media)
 	if (!first_run)
 		return 0;
 
-	if (!irom_load_sdmmc(1, count, alternate_cbfs_buffer)) {
+	if (!irom_load_sdmmc(1, count, _cbfs_cache)) {
 		printk(BIOS_EMERG, "Unable to load CBFS image from SDMMC!\n");
 		return -1;
 	}
 
 	printk(BIOS_DEBUG, "SDMMC read successful, CBFS image should now be"
-		" at %p\n", alternate_cbfs_buffer);
+		" at %p\n", _cbfs_cache);
 	first_run = 0;
 #endif
 	return 0;
@@ -115,16 +116,16 @@ static int alternate_cbfs_close(struct cbfs_media *media) { return 0; }
 static size_t alternate_cbfs_read(struct cbfs_media *media, void *dest,
 				  size_t offset, size_t count)
 {
-	ASSERT(offset + count < alternate_cbfs_size);
-	memcpy(dest, alternate_cbfs_buffer + offset, count);
+	ASSERT(offset + count < _cbfs_cache_size);
+	memcpy(dest, _cbfs_cache + offset, count);
 	return count;
 }
 
 static void *alternate_cbfs_map(struct cbfs_media *media, size_t offset,
 				   size_t count)
 {
-	ASSERT(offset + count < alternate_cbfs_size);
-	return alternate_cbfs_buffer + offset;
+	ASSERT(offset + count < _cbfs_cache_size);
+	return _cbfs_cache + offset;
 }
 
 static void *alternate_cbfs_unmap(struct cbfs_media *media,
@@ -166,8 +167,7 @@ int init_default_cbfs_media(struct cbfs_media *media)
 		return initialize_exynos_sdmmc_cbfs_media(media);
 	case OM_STAT_SPI:
 		return initialize_exynos_spi_cbfs_media(media,
-			(void*)CONFIG_CBFS_CACHE_ADDRESS,
-			CONFIG_CBFS_CACHE_SIZE);
+			_cbfs_cache, _cbfs_cache_size);
 	default:
 		printk(BIOS_EMERG, "Exynos OM_STAT value 0x%x not supported!\n",
 			exynos_power->om_stat);
diff --git a/src/soc/samsung/exynos5250/alternate_cbfs.h b/src/soc/samsung/exynos5250/alternate_cbfs.h
index a064b62e88..fe1af46d72 100644
--- a/src/soc/samsung/exynos5250/alternate_cbfs.h
+++ b/src/soc/samsung/exynos5250/alternate_cbfs.h
@@ -36,16 +36,4 @@ static u32 * const iram_secondary_base = (u32 *)0x02020018;
 #define OM_STAT_SPI  0x14
 #define OM_STAT_MASK 0x7f
 
-#if defined(__PRE_RAM__) && !defined(__ROMSTAGE__)
-	/* A small space in IRAM to hold the romstage-only image */
-	static void * const alternate_cbfs_buffer =
-			(void *)CONFIG_CBFS_CACHE_ADDRESS;
-	static size_t const alternate_cbfs_size = CONFIG_CBFS_CACHE_SIZE;
-#else
-	/* Just put this anywhere in RAM that's far enough from anything else */
-	/* TODO: Find a better way to "reserve" this region? */
-	static void * const alternate_cbfs_buffer = (void *)0x77400000;
-	static size_t const alternate_cbfs_size = 0xc00000;
-#endif
-
 #endif
diff --git a/src/soc/samsung/exynos5250/cpu.h b/src/soc/samsung/exynos5250/cpu.h
index 10f9ef4d21..c9c5832359 100644
--- a/src/soc/samsung/exynos5250/cpu.h
+++ b/src/soc/samsung/exynos5250/cpu.h
@@ -21,6 +21,7 @@
 #define CPU_SAMSUNG_EXYNOS5250_CPU_H
 
 #include <arch/io.h>
+#include <symbols.h>
 
 /* Base address registers */
 #define EXYNOS5_GPIO_PART6_BASE		0x03860000	/* Z<6:0> */
@@ -76,7 +77,7 @@ extern struct tmu_info exynos5250_tmu_info;
 
 /* TODO clean up defines. */
 #define FB_SIZE_KB  4096
-#define RAM_BASE_KB (CONFIG_SYS_SDRAM_BASE >> 10)
+#define RAM_BASE_KB ((uintptr_t)_dram/KiB)
 #define RAM_SIZE_KB (CONFIG_DRAM_SIZE_MB << 10UL)
 
 static inline u32 get_fb_base_kb(void)
diff --git a/src/soc/samsung/exynos5250/memlayout.ld b/src/soc/samsung/exynos5250/memlayout.ld
new file mode 100644
index 0000000000..010bb7b64d
--- /dev/null
+++ b/src/soc/samsung/exynos5250/memlayout.ld
@@ -0,0 +1,46 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+
+#include <arch/header.ld>
+
+/*
+ * Note: The BootROM loads the 8K BL1 at [0x2020000:0x2022000), so the bootblock
+ * must be placed after that. After the handoff, the space can be reclaimed.
+ */
+
+SECTIONS
+{
+	SRAM_START(0x2020000)
+	/* 13K hole, includes BL1 */
+	BOOTBLOCK(0x2023400, 32K)
+	/* 19K hole */
+	ROMSTAGE(0x2030000, 128K)
+	/* 32K hole */
+	TTB(0x2058000, 16K)
+	PRERAM_CBFS_CACHE(0x205C000, 96K)
+	STACK(0x2074000, 16K)
+	SRAM_END(0x2078000)
+
+	DRAM_START(0x40000000)
+	RAMSTAGE(0x40000000, 128K)
+	POSTRAM_CBFS_CACHE(0x41000000, 8M)
+	DMA_COHERENT(0x77300000, 1M)
+}
diff --git a/src/soc/samsung/exynos5420/Kconfig b/src/soc/samsung/exynos5420/Kconfig
index bd2bf135e0..ed9d2f8a84 100644
--- a/src/soc/samsung/exynos5420/Kconfig
+++ b/src/soc/samsung/exynos5420/Kconfig
@@ -33,78 +33,4 @@ config CBFS_ROM_OFFSET
 	hex "offset of CBFS data in ROM"
 	default 0x0A000
 
-config SYS_SDRAM_BASE
-	hex
-	default 0x20000000
-
-# Example SRAM/iRAM map for Exynos5420 platform:
-#
-# 0x0202_0000: vendor-provided BL1
-# 0x0202_4400: variable length bootblock checksum header.
-# 0x0202_4410: bootblock, assume up to 32KB in size
-# 0x0203_0000: romstage, assume up to 128KB in size.
-# 0x0205_8000: TTB buffer.
-# 0x0205_c000: cache for CBFS data.
-# 0x0206_f000: stack bottom
-# 0x0207_3000: stack pointer
-# 0x0207_3000: shared (with kernel) page for cpu & secondary core states.
-#              the shared data is currently only <0x50 bytes so we can share
-#              this page with stack.
-
-config BOOTBLOCK_BASE
-	hex
-	default 0x02024410
-
-config ROMSTAGE_BASE
-	hex
-	default 0x02030000
-
-config RAMSTAGE_BASE
-	hex
-	default SYS_SDRAM_BASE
-
-# Stack may reside in either IRAM or DRAM. We will define it to live
-# at the top of IRAM for now.
-#
-# Stack grows downward, push operation stores register contents in
-# consecutive memory locations ending just below SP.
-# The setup in the exynos 5420 is a new one for coreboot. We have got
-# the bootblock, romstage, and ramstage sharing the same stack space.
-# The SRAM is always there and having a known-good stack memory
-# makes for a more reliable setup.
-# Thus, in this case:
-# STACK_TOP: highest stack address in SRAM
-# STACK_BOTTOM: lowest stack address in SRAM
-# STACK_SIZE: as in standard coreboot usage, size of thread stacks in ramstage
-# ROMSTAGE_STACK_SIZE: size of the single stack in romstage
-
-config STACK_TOP
-	hex
-	default 0x02073000
-
-config STACK_BOTTOM
-	hex
-	default 0x0206f000
-
-# STACK_SIZE is for the ramstage core and thread stacks.
-# It must be a power of 2, to make the cpu_info computation work,
-# and cpu_info needs to work to make SMP startup and threads work.
-config STACK_SIZE
-	hex
-	default 0x0800
-
-# TODO We may probably move this to board-specific implementation files instead
-# of KConfig values.
-config CBFS_CACHE_ADDRESS
-	hex "memory address to put CBFS cache data"
-	default 0x0205c000
-
-config CBFS_CACHE_SIZE
-	hex "size of CBFS cache data"
-	default 0x00013000
-
-config TTB_BUFFER
-	hex "memory address of the TTB buffer"
-	default 0x02058000
-
 endif
diff --git a/src/soc/samsung/exynos5420/alternate_cbfs.c b/src/soc/samsung/exynos5420/alternate_cbfs.c
index d19098b948..7fc0e6d6fb 100644
--- a/src/soc/samsung/exynos5420/alternate_cbfs.c
+++ b/src/soc/samsung/exynos5420/alternate_cbfs.c
@@ -22,6 +22,7 @@
 #include <cbfs.h>  /* This driver serves as a CBFS media source. */
 #include <stdlib.h>
 #include <string.h>
+#include <symbols.h>
 #include <arch/cache.h>
 #include <console/console.h>
 #include "alternate_cbfs.h"
@@ -34,14 +35,14 @@
  * by the IROM / BL1, so this code has nothing to do with them.
  *
  * The third transfer is a valid CBFS image that contains only the romstage,
- * and must be small enough to fit into alternate_cbfs_size[__BOOT_BLOCK__] in
+ * and must be small enough to fit into the PRE_RAM CBFS cache in
  * IRAM. It is loaded when this function gets called in the boot block, and
  * the normal CBFS code extracts the romstage from it.
  *
  * The fourth transfer is also a CBFS image, but can be of arbitrary size and
  * should contain all available stages/payloads/etc. It is loaded when this
  * function is called a second time at the end of the romstage, and copied to
- * alternate_cbfs_buffer[!__BOOT_BLOCK__] in DRAM. It will reside there for the
+ * the romstage/ramstage CBFS cache in DRAM. It will reside there for the
  * rest of the firmware's lifetime and all subsequent stages (which will not
  * have __PRE_RAM__ defined) can just directly reference it there.
  */
@@ -64,12 +65,12 @@ static int usb_cbfs_open(struct cbfs_media *media)
 
 	/*
 	 * We need to trust the host/irom to copy the image to our
-	 * alternate_cbfs_buffer address... there is no way to control or even
+	 * _cbfs_cache address... there is no way to control or even
 	 * check the transfer size or target address from our side.
 	 */
 
 	printk(BIOS_DEBUG, "USB A-A transfer successful, CBFS image should now"
-		" be at %p\n", alternate_cbfs_buffer);
+		" be at %p\n", _cbfs_cache);
 	first_run = 0;
 #endif
 	return 0;
@@ -90,11 +91,11 @@ static int sdmmc_cbfs_open(struct cbfs_media *media)
 	 * In the bootblock, we just copy the small part that fits in the buffer
 	 * and hope that it's enough (since the romstage is currently always the
 	 * first component in the image, this should work out). In the romstage,
-	 * we copy until our buffer is full (currently 12M) to avoid the pain of
+	 * we copy until our cache is full (currently 12M) to avoid the pain of
 	 * figuring out the true image size from in here. Since this is mainly a
 	 * developer/debug boot mode, those shortcomings should be bearable.
 	 */
-	const u32 count = alternate_cbfs_size / 512;
+	const u32 count = _cbfs_cache_size / 512;
 	static int first_run = 1;
 	int (*irom_load_sdmmc)(u32 start, u32 count, void *dst) =
 		*irom_sdmmc_read_blocks_ptr;
@@ -103,7 +104,7 @@ static int sdmmc_cbfs_open(struct cbfs_media *media)
 		return 0;
 
 	dcache_mmu_disable();
-	if (!irom_load_sdmmc(1, count, alternate_cbfs_buffer)) {
+	if (!irom_load_sdmmc(1, count, _cbfs_cache)) {
 		dcache_mmu_enable();
 		printk(BIOS_EMERG, "Unable to load CBFS image from SDMMC!\n");
 		return -1;
@@ -111,7 +112,7 @@ static int sdmmc_cbfs_open(struct cbfs_media *media)
 	dcache_mmu_enable();
 
 	printk(BIOS_DEBUG, "SDMMC read successful, CBFS image should now be"
-		" at %p\n", alternate_cbfs_buffer);
+		" at %p\n", _cbfs_cache);
 	first_run = 0;
 #endif
 	return 0;
@@ -122,16 +123,16 @@ static int alternate_cbfs_close(struct cbfs_media *media) { return 0; }
 static size_t alternate_cbfs_read(struct cbfs_media *media, void *dest,
 				  size_t offset, size_t count)
 {
-	ASSERT(offset + count < alternate_cbfs_size);
-	memcpy(dest, alternate_cbfs_buffer + offset, count);
+	ASSERT(offset + count < _cbfs_cache_size);
+	memcpy(dest, _cbfs_cache + offset, count);
 	return count;
 }
 
 static void *alternate_cbfs_map(struct cbfs_media *media, size_t offset,
 				   size_t count)
 {
-	ASSERT(offset + count < alternate_cbfs_size);
-	return alternate_cbfs_buffer + offset;
+	ASSERT(offset + count < _cbfs_cache_size);
+	return _cbfs_cache + offset;
 }
 
 static void *alternate_cbfs_unmap(struct cbfs_media *media,
@@ -173,8 +174,7 @@ int init_default_cbfs_media(struct cbfs_media *media)
 		return initialize_exynos_sdmmc_cbfs_media(media);
 	case OM_STAT_SPI:
 		return initialize_exynos_spi_cbfs_media(media,
-			(void*)CONFIG_CBFS_CACHE_ADDRESS,
-			CONFIG_CBFS_CACHE_SIZE);
+			_cbfs_cache, _cbfs_cache_size);
 	default:
 		printk(BIOS_EMERG, "Exynos OM_STAT value 0x%x not supported!\n",
 			exynos_power->om_stat);
diff --git a/src/soc/samsung/exynos5420/alternate_cbfs.h b/src/soc/samsung/exynos5420/alternate_cbfs.h
index 8122a25e8c..4df61d53f2 100644
--- a/src/soc/samsung/exynos5420/alternate_cbfs.h
+++ b/src/soc/samsung/exynos5420/alternate_cbfs.h
@@ -36,16 +36,4 @@ static u32 * const iram_secondary_base = (u32 *)0x02020018;
 #define OM_STAT_SPI  0x14
 #define OM_STAT_MASK 0x7f
 
-#if defined(__PRE_RAM__) && !defined(__ROMSTAGE__)
-	/* A small space in IRAM to hold the romstage-only image */
-	static void * const alternate_cbfs_buffer =
-			(void *)CONFIG_CBFS_CACHE_ADDRESS;
-	static size_t const alternate_cbfs_size = CONFIG_CBFS_CACHE_SIZE;
-#else
-	/* Just put this anywhere in RAM that's far enough from anything else */
-	/* TODO: Find a better way to "reserve" this region? */
-	static void * const alternate_cbfs_buffer = (void *)0x77400000;
-	static size_t const alternate_cbfs_size = 0xc00000;
-#endif
-
 #endif /* CPU_SAMSUNG_EXYNOS5420_ALTERNATE_CBFS_H */
diff --git a/src/soc/samsung/exynos5420/cpu.h b/src/soc/samsung/exynos5420/cpu.h
index 5b5c731bf0..bea7f1e1e2 100644
--- a/src/soc/samsung/exynos5420/cpu.h
+++ b/src/soc/samsung/exynos5420/cpu.h
@@ -21,6 +21,7 @@
 #define CPU_SAMSUNG_EXYNOS5420_CPU_H
 
 #include <arch/io.h>
+#include <symbols.h>
 
 #define EXYNOS5_SRAM_BASE		0x02020000
 
@@ -84,7 +85,7 @@ extern struct tmu_info exynos5420_tmu_info;
 
 /* TODO clean up defines. */
 #define FB_SIZE_KB  4096
-#define RAM_BASE_KB (CONFIG_SYS_SDRAM_BASE >> 10)
+#define RAM_BASE_KB ((uintptr_t)_dram/KiB)
 #define RAM_SIZE_KB (CONFIG_DRAM_SIZE_MB << 10UL)
 
 static inline u32 get_fb_base_kb(void)
diff --git a/src/soc/samsung/exynos5420/memlayout.ld b/src/soc/samsung/exynos5420/memlayout.ld
new file mode 100644
index 0000000000..3259ff907b
--- /dev/null
+++ b/src/soc/samsung/exynos5420/memlayout.ld
@@ -0,0 +1,49 @@
+/*
+ * This file is part of the coreboot project.
+ *
+ * Copyright 2014 Google Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; version 2 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
+ */
+
+#include <memlayout.h>
+
+#include <arch/header.ld>
+
+/*
+ * Note: The BootROM loads the 8K BL1 at [0x2020000:0x2022000), so the bootblock
+ * must be placed after that. After the handoff, the space can be reclaimed.
+ */
+
+SECTIONS
+{
+	SRAM_START(0x2020000)
+	/* 17K hole, includes BL1 */
+	/* Bootblock is preceeded by 16 byte variable length BL2 checksum. */
+	BOOTBLOCK(0x2024410, 32K - 16)
+	/* 15K hole */
+	ROMSTAGE(0x2030000, 128K)
+	/* 32K hole */
+	TTB(0x2058000, 16K)
+	PRERAM_CBFS_CACHE(0x205C000, 76K)
+	STACK(0x206F000, 16K)
+	/* 1K hole for weird kernel-shared CPU/SMP state structure that doesn't
+	 * seem to be implemented right now? */
+	SRAM_END(0x2074000)
+
+	DRAM_START(0x20000000)
+	RAMSTAGE(0x20000000, 128K)
+	POSTRAM_CBFS_CACHE(0x21000000, 8M)
+	DMA_COHERENT(0x77300000, 1M)
+}