17 files changed, 501 insertions, 11 deletions
diff --git a/doc/board/coolpi/genbook_cm5_rk3588.rst b/doc/board/coolpi/genbook_cm5_rk3588.rst
new file mode 100644
index 00000000000..a02e561051a
--- /dev/null
+++ b/doc/board/coolpi/genbook_cm5_rk3588.rst
@@ -0,0 +1,68 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+GenBook
+=======
+Cool Pi GenBook is a laptop powered by RK3588, it works with a
+carrier board connect with CM5.
+
+Specification:
+* Rockchip RK3588
+* LPDDR5X 8/32 GB
+* eMMC 64 GB
+* SPI Nor 8 MB
+* HDMI Type A out x 1
+* USB 3.0 Host x 1
+* USB-C 3.0 with DisplayPort AltMode
+* PCIE M.2 E Key for RTL8852BE Wireless connection
+* PCIE M.2 M Key for NVME connection
+* eDP panel with 1920x1080
+
+Here is the step-by-step to compile and boot to U-Boot on GenBook.
+
+Get the TF-A and DDR init (TPL) binaries
+----------------------------------------
+
+.. prompt:: bash
+
+   > cd u-boot
+   > export ROCKCHIP_TPL=../rkbin/bin/rk35/rk3588_ddr_lp4_2112MHz_lp5_2400MHz_v1.17.bin
+   > export BL31=../rkbin/bin/rk35/rk3588_bl31_v1.46.elf
+   > make coolpi-genbook-cm5-rk3588_defconfig
+   > make CROSS_COMPILE=aarch64-linux-gnu-
+
+This will build ``u-boot-rockchip.bin`` for eMMC and ``u-boot-rockchip-spi.bin`` for SPI Nor.
+
+Write u-boot to eMMC or SPI Nor from a Linux system on the laptop
+-----------------------------------------------------------------
+
+Copy ``u-boot-rockchip.bin`` and ``u-boot-rockchip-spi.bin`` to the laptop.
+
+eMMC
+~~~~
+
+.. prompt:: bash
+
+   dd if=u-boot-rockchip.bin of=/dev/mmcblk0 bs=512 seek=64
+
+SPI Nor
+~~~~~~~
+
+.. prompt:: bash
+
+  dd if=u-boot-rockchip-spi.bin of=/dev/mtdblock0
+
+``upgrade_tool`` allows to flash the on-board SPI Nor via the USB TypeC interface
+with help of the Rockchip loader binary.
+
+To enter the USB flashing mode, connect the laptop and your HOST PC with a USB-C
+cable, reset the laptop with ``Loader Key`` pressed.
+On your PC, check with ``lsusb -d 2207:350b``).
+
+To flash U-Boot on the SPI Nor with ``upgrade_tool``:
+
+.. prompt:: bash
+
+  upgrade_tool db rk3588/MiniLoaderAll.bin
+  upgrade_tool ssd       // Input 5 for SPINOR download mode
+  upgrade_tool wl 0 u-boot-rockchip-spi.bin
+  upgrade_tool rd
diff --git a/doc/board/coolpi/index.rst b/doc/board/coolpi/index.rst
new file mode 100644
index 00000000000..9c9593fd6aa
--- /dev/null
+++ b/doc/board/coolpi/index.rst
@@ -0,0 +1,9 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Cool Pi
+=================
+
+.. toctree::
+   :maxdepth: 2
+
+   genbook_cm5_rk3588
diff --git a/doc/board/coreboot/coreboot.rst b/doc/board/coreboot/coreboot.rst
index a177265c16e..f52b24ff43d 100644
--- a/doc/board/coreboot/coreboot.rst
+++ b/doc/board/coreboot/coreboot.rst
@@ -182,3 +182,9 @@ CI runs tests using a pre-built coreboot image. This ensures that U-Boot can
 boot as a coreboot payload, based on a known-good build of coreboot.
 
 To update the `coreboot.rom` file which is used, see ``tools/Dockerfile``
+
+Editing CMOS RAM settings
+-------------------------
+
+U-Boot supports creating a configuration editor to edit coreboot CMOS-RAM
+settings. See :ref:`cedit_cb_load`.
diff --git a/doc/board/emulation/qemu-riscv.rst b/doc/board/emulation/qemu-riscv.rst
index 8a5eb1eda56..8388e13d96d 100644
--- a/doc/board/emulation/qemu-riscv.rst
+++ b/doc/board/emulation/qemu-riscv.rst
@@ -171,3 +171,8 @@ The following settings provide a debug UART for the virt machine::
     CONFIG_DEBUG_UART_NS16550=y
     CONFIG_DEBUG_UART_BASE=0x10000000
     CONFIG_DEBUG_UART_CLOCK=3686400
+
+To provide a debug UART in main U-Boot the SBI DBCN extension can be used
+instead::
+
+    CONFIG_DEBUG_SBI_CONSOLE=y
diff --git a/doc/board/index.rst b/doc/board/index.rst
index ca5246e259c..b54c1748d57 100644
--- a/doc/board/index.rst
+++ b/doc/board/index.rst
@@ -23,6 +23,7 @@ Board-specific doc
    bsh/index
    cloos/index
    congatec/index
+   coolpi/index
    coreboot/index
    emcraft/index
    emulation/index
@@ -43,6 +44,7 @@ Board-specific doc
    phytec/index
    purism/index
    qualcomm/index
+   qnap/index
    renesas/index
    rockchip/index
    samsung/index
diff --git a/doc/board/qnap/index.rst b/doc/board/qnap/index.rst
new file mode 100644
index 00000000000..652ea11a056
--- /dev/null
+++ b/doc/board/qnap/index.rst
@@ -0,0 +1,9 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Qnap
+====
+
+.. toctree::
+   :maxdepth: 2
+
+   ts433.rst
diff --git a/doc/board/qnap/ts433.rst b/doc/board/qnap/ts433.rst
new file mode 100644
index 00000000000..1e1bfbb9190
--- /dev/null
+++ b/doc/board/qnap/ts433.rst
@@ -0,0 +1,91 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+U-Boot for Qnap TS433 Devices
+=================================
+
+This allows U-Boot to boot the Qnap TS433 NAS
+
+Preparing the serial
+--------------------
+
+Qnap devices run their serial console with a 115200 baudrate. As the
+binary DDR-init and maskrom-downloader expect a 1500000 rate, it is
+necessary to adapt the binaries if their output is needed.
+
+This can be done with a binary provided in the rkbin repository.
+First the ddrbin_param.txt in the rkbin repo needs to be modified:
+
+.. code-block:: bash
+
+    diff --git a/tools/ddrbin_param.txt b/tools/ddrbin_param.txt
+    index 0dfdd318..82ade7e7 100644
+    --- a/tools/ddrbin_param.txt
+    +++ b/tools/ddrbin_param.txt
+    @@ -11,7 +11,7 @@ lp5_freq=
+
+     uart id=
+     uart iomux=
+    -uart baudrate=
+    +uart baudrate=115200
+
+     sr_idle=
+     pd_idle=
+
+And after that the ddrbin_tool binary can be used to modify apply this
+modification and also a new maskrom downloader can be build:
+
+.. code-block:: bash
+
+    $ tools/ddrbin_tool rk3568 tools/ddrbin_param.txt bin/rk35/rk3568_ddr_1560MHz_v1.21.bin
+    $ tools/boot_merger RKBOOT/RK3568MINIALL.ini
+
+Building U-Boot
+---------------
+
+.. code-block:: bash
+
+    $ export CROSS_COMPILE=aarch64-linux-gnu-
+    $ export BL31=../rkbin/bin/rk35/rk3568_bl31_v1.34.elf
+    $ export ROCKCHIP_TPL=../rkbin/bin/rk35/rk3568_ddr_1056MHz_v1.13.bin
+    $ make qnap-ts433-rk3568_defconfig
+    $ make
+
+This will build ``u-boot-rockchip.bin`` which can be written to the
+on-board eMMC.
+
+Image installation
+------------------
+
+The Qnap thankfully provides an easily accessible serial header as well as
+a very user-friendly jumper-header to bring the device into maskrom mode.
+
+To access both, the drive trays need to be removed. Looking at the board,
+through the upper cutout of the metal frame the white 4-port serial-header
+can be seen next to a barcode sticker. It's pinout is as follows:
+
+.. code-block:: none
+
+   ,_  _.
+   |1234|  1=TX 2=VCC
+   `----'  3=RX 4=GND
+
+
+Directly below it, the mentioned 2-pin jumper header can be seen.
+
+To write your u-boot to the device, it needs to be powered off first. Then
+a jumper or suitable cable needs to be used to connect the two pins of the
+maskrom header. Turning on the device now will start it in maskrom mode.
+
+It is important that the jumper gets removed after that stop and before
+actually trying to write to the emmc.
+
+The front usb-port needs to be connected to the host with an USB-A-to-A
+cable to allow flashing.
+
+The flashing itself is done via rkdeveloptool, which can be found for
+example as package of that name in Debian-based distributions:
+
+.. code-block:: bash
+
+    $ rkdeveloptool db rk356x_spl_loader_v1.21.113.bin
+    $ rkdeveloptool wl 64 u-boot-rockchip.bin
diff --git a/doc/board/rockchip/rockchip.rst b/doc/board/rockchip/rockchip.rst
index 7b11a2e0a35..9bab86d2347 100644
--- a/doc/board/rockchip/rockchip.rst
+++ b/doc/board/rockchip/rockchip.rst
@@ -65,6 +65,7 @@ List of mainline supported Rockchip boards:
      - FriendlyElec NanoPi R2C (nanopi-r2c-rk3328)
      - FriendlyElec NanoPi R2C Plus (nanopi-r2c-plus-rk3328)
      - FriendlyElec NanoPi R2S (nanopi-r2s-rk3328)
+     - FriendlyElec NanoPi R2S Plus (nanopi-r2s-plus-rk3328)
      - Pine64 Rock64 (rock64-rk3328)
      - Radxa ROCK Pi E (rock-pi-e-rk3328)
      - Xunlong Orange Pi R1 Plus (orangepi-r1-plus-rk3328)
@@ -119,6 +120,7 @@ List of mainline supported Rockchip boards:
      - FriendlyElec NanoPi R5S (nanopi-r5s-rk3568)
      - Generic RK3566/RK3568 (generic-rk3568)
      - Hardkernel ODROID-M1 (odroid-m1-rk3568)
+     - QNAP TS-433 (qnap-ts433-rk3568)
      - Radxa E25 Carrier Board (radxa-e25-rk3568)
      - Radxa ROCK 3A (rock-3a-rk3568)
      - Radxa ROCK 3B (rock-3b-rk3568)
@@ -147,6 +149,7 @@ List of mainline supported Rockchip boards:
      - Xunlong Orange Pi 5 Plus (orangepi-5-plus-rk3588)
      - Yanyi Tech CoolPi 4 Model B (coolpi-4b-rk3588s)
      - Yanyi Tech CoolPi CM5 EVB (coolpi-cm5-evb-rk3588)
+     - Yanyi Tech CoolPi CM5 GenBook (coolpi-cm5-genbook-rk3588)
 
 * rv1108
      - Rockchip Evb-rv1108 (evb-rv1108)
diff --git a/doc/conf.py b/doc/conf.py
index ced3a6723fc..c50daf874a5 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -560,13 +560,9 @@ epub_exclude_files = ['search.html']
 # Grouping the document tree into PDF files. List of tuples
 # (source start file, target name, title, author, options).
 #
-# See the Sphinx chapter of https://ralsina.me/static/manual.pdf
-#
-# FIXME: Do not add the index file here; the result will be too big. Adding
-# multiple PDF files here actually tries to get the cross-referencing right
-# *between* PDF files.
+# See https://rst2pdf.org/static/manual.html#sphinx
 pdf_documents = [
-    ('uboot-documentation', u'U-Boot', u'U-Boot', u'J. Random Bozo'),
+    ('index', u'U-Boot', u'Das U-Boot', u'The U-Boot development community'),
 ]
 
 # kernel-doc extension configuration for running Sphinx directly (e.g. by Read
diff --git a/doc/develop/cedit.rst b/doc/develop/cedit.rst
index 310be889240..1ac55ab1219 100644
--- a/doc/develop/cedit.rst
+++ b/doc/develop/cedit.rst
@@ -172,4 +172,4 @@ Cedit provides several options for persistent settings:
 
 For now, reading and writing settings is not automatic. See the
 :doc:`../usage/cmd/cedit` for how to do this on the command line or in a
-script.
+script. For x86 devices, see :ref:`cedit_cb_load`.
diff --git a/doc/develop/devicetree/control.rst b/doc/develop/devicetree/control.rst
index 211f7e4909c..0233945f8b6 100644
--- a/doc/develop/devicetree/control.rst
+++ b/doc/develop/devicetree/control.rst
@@ -89,7 +89,7 @@ Failing that, you could write one from scratch yourself!
 Resyncing with devicetree-rebasing
 ----------------------------------
 
-The `devicetree-rebasing repository`_ maintains a fork cum mirror copy of
+The `devicetree-rebasing repository`_ maintains a mirror copy of
 devicetree files along with the bindings synced at every Linux kernel major
 release or intermediate release candidates. The U-Boot maintainers regularly
 sync the `dts/upstream/` subtree from the devicetree-rebasing repo whenever
diff --git a/doc/develop/release_cycle.rst b/doc/develop/release_cycle.rst
index faec644249e..1548d2634ff 100644
--- a/doc/develop/release_cycle.rst
+++ b/doc/develop/release_cycle.rst
@@ -51,11 +51,11 @@ Examples::
 Current Status
 --------------
 
-* U-Boot v2025.01-rc1 was released on Mon 28 October 2024.
+* U-Boot v2024.10 was released on Mon 07 October 2024.
 
 * The Merge Window for the next release (v2025.01) is **closed**.
 
-* The next branch is now **closed**.
+* The next branch is now **open**.
 
 * Release "v2025.01" is scheduled for 06 January 2025.
 
@@ -69,7 +69,7 @@ For the next scheduled release, release candidates were made on::
 
 * U-Boot v2025.01-rc1 was released on Mon 28 October 2024.
 
-.. * U-Boot v2025.01-rc2 was released on Mon 11 November 2024.
+* U-Boot v2025.01-rc2 was released on Mon 11 November 2024.
 
 .. * U-Boot v2025.01-rc3 was released on Mon 25 November 2024.
 
diff --git a/doc/usage/cmd/cbcmos.rst b/doc/usage/cmd/cbcmos.rst
new file mode 100644
index 00000000000..9395cf1cbd7
--- /dev/null
+++ b/doc/usage/cmd/cbcmos.rst
@@ -0,0 +1,45 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+cbcmos
+======
+
+Synopis
+-------
+
+::
+
+    cbcmos check [<dev>]
+    cbcmos update [<dev>]
+
+
+Description
+-----------
+
+This checks or updates the CMOS-RAM checksum value against the CMOS-RAM
+contents. It is used with coreboot, which provides information about where to
+find the checksum and what part of the CMOS RAM it covers.
+
+If `<dev>` is provided then the named real-time clock (RTC) device is used.
+Otherwise the default RTC is used.
+
+Example
+-------
+
+This shows checking and updating a checksum across bytes 38 and 39 of the
+CMOS RAM::
+
+    => rtc read 38 2
+    00000038: 71 00                                            q.
+    => cbc check
+    => rtc write 38 66
+    => rtc read 38 2
+    00000038: 66 00                                            f.
+    => cbc check
+    Checksum 7100 error: calculated 6600
+    => cbc update
+    Checksum 6600 written
+    => cbc check
+    =>
+
+See also :ref:`cedit_cb_load` which shows an example that includes the
+configuration editor.
diff --git a/doc/usage/cmd/cbsysinfo.rst b/doc/usage/cmd/cbsysinfo.rst
index 80d8ba1b662..28f61d9c63e 100644
--- a/doc/usage/cmd/cbsysinfo.rst
+++ b/doc/usage/cmd/cbsysinfo.rst
@@ -23,3 +23,102 @@ Example
 ::
 
     => cbsysinfo
+    Coreboot table at 500, size 5c4, records 1d (dec 29), decoded to 000000007dce4520, forwarded to 000000007ff9a000
+
+    CPU KHz     : 0
+    Serial I/O port: 00000000
+       base        : 00000000
+       pointer     : 000000007ff9a370
+       type        : 1
+       base        : 000003f8
+       baud        : 0d115200
+       regwidth    : 1
+       input_hz    : 0d1843200
+       PCI addr    : 00000010
+    Mem ranges  : 7
+              id: type               ||   base        ||   size
+               0: 10:table    0000000000000000 0000000000001000
+               1: 01:ram      0000000000001000 000000000009f000
+               2: 02:reserved 00000000000a0000 0000000000060000
+               3: 01:ram      0000000000100000 000000007fe6d000
+               4: 10:table    000000007ff6d000 0000000000093000
+               5: 02:reserved 00000000fec00000 0000000000001000
+               6: 02:reserved 00000000ff800000 0000000000800000
+    option_table: 000000007ff9a018
+     Bit  Len  Cfg  ID  Name
+       0  180    r   0  reserved_memory
+     180    1    e   4  boot_option            0:Fallback 1:Normal
+     184    4    h   0  reboot_counter
+     190    8    r   0  reserved_century
+     1b8    8    r   0  reserved_ibm_ps2_century
+     1c0    1    e   1  power_on_after_fail    0:Disable 1:Enable
+     1c4    4    e   6  debug_level            5:Notice 6:Info 7:Debug 8:Spew
+     1d0   80    r   0  vbnv
+     3f0   10    h   0  check_sum
+    CMOS start  : 1c0
+       CMOS end    : 1cf
+       CMOS csum loc: 3f0
+    VBNV start  : ffffffff
+    VBNV size   : ffffffff
+    CB version  : 4.21-5-g7e6eae9679e3-dirty
+       Extra       :
+       Build       : Thu Sep 07 14:52:41 UTC 2023
+       Time        : 14:52:41
+    Framebuffer : 000000007ff9a410
+       Phys addr   :         fd000000
+       X res       : 0d800
+       X res       : 0d600
+       Bytes / line: c80
+       Bpp         : 0d32
+       pos/size      red 16/8, green 8/8, blue 0/8, reserved 24/8
+    GPIOs       : 0
+              id: port     polarity val name
+    MACs        : 0d10
+               0: 12:00:00:00:28:00
+               1: 00:00:00:fd:00:00
+               2: 20:03:00:00:58:02
+               3: 80:0c:00:00:20:10
+               4: 08:00:08:18:08:00
+               5: 16:00:00:00:10:00
+               6: 00:d0:fd:7f:00:00
+               7: 17:00:00:00:10:00
+               8: 00:e0:fd:7f:00:00
+               9: 37:00:00:00:10:00
+    Multiboot tab: 0000000000000000
+    CB header   : 000000007ff9a000
+    CB mainboard: 000000007ff9a344
+       vendor      : 0: Emulation
+       part_number : 10: QEMU x86 i440fx/piix4
+    vboot handoff: 0000000000000000
+       size        : 0
+       vdat addr   : 0000000000000000
+       size        : 0
+    SMBIOS      :         7ff6d000
+       size        : 8000
+    ROM MTRR    : 0
+    Tstamp table: 000000007ffdd000
+    CBmem cons  : 000000007ffde000
+    Size        : 1fff8
+    Cursor      : 3332
+    MRC cache   : 0000000000000000
+    ACPI GNVS   : 0000000000000000
+    Board ID    : ffffffff
+    RAM code    : ffffffff
+    WiFi calib  : 0000000000000000
+    Ramoops buff:                0
+       size        : 0
+    SF size     : 0
+    SF sector   : 0
+    SF erase cmd: 0
+    FMAP offset :                0
+    CBFS offset :              200
+    CBFS size   :           3ffe00
+    Boot media size:           400000
+    MTC start   :                0
+    MTC size    : 0
+    Chrome OS VPD: 0000000000000000
+    RSDP        : 000000007ff75000
+    Unimpl.     : 10 37 40
+    =>
+
+Note that "Unimpl." shows tags which U-Boot does not currently implement.
diff --git a/doc/usage/cmd/cedit.rst b/doc/usage/cmd/cedit.rst
index f29f1b3f388..e54ea204b9f 100644
--- a/doc/usage/cmd/cedit.rst
+++ b/doc/usage/cmd/cedit.rst
@@ -18,6 +18,7 @@ Synopsis
     cedit write_env [-v]
     cedit read_env [-v]
     cedit write_cmos [-v] [dev]
+    cedit cb_load
 
 Description
 -----------
@@ -92,6 +93,13 @@ updated.
 Normally the first RTC device is used to hold the data. You can specify a
 different device by name using the `dev` parameter.
 
+.. _cedit_cb_load:
+
+cedit cb_load
+~~~~~~~~~~~~~
+
+This is supported only on x86 devices booted from coreboot. It creates a new
+configuration editor which can be used to edit CMOS settings.
 
 Example
 -------
@@ -158,3 +166,71 @@ Here is an example with the device specified::
 
     => cedit write_cmos rtc@43
     =>
+
+This example shows editing coreboot CMOS-RAM settings. A script could be used
+to automate this::
+
+    => cbsysinfo
+    Coreboot table at 500, size 5c4, records 1d (dec 29), decoded to 000000007dce3f40, forwarded to 000000007ff9a000
+
+    CPU KHz     : 0
+    Serial I/O port: 00000000
+       base        : 00000000
+       pointer     : 000000007ff9a370
+       type        : 1
+       base        : 000003f8
+       baud        : 0d115200
+       regwidth    : 1
+       input_hz    : 0d1843200
+       PCI addr    : 00000010
+    Mem ranges  : 7
+              id: type               ||   base        ||   size
+               0: 10:table    0000000000000000 0000000000001000
+               1: 01:ram      0000000000001000 000000000009f000
+               2: 02:reserved 00000000000a0000 0000000000060000
+               3: 01:ram      0000000000100000 000000007fe6d000
+               4: 10:table    000000007ff6d000 0000000000093000
+               5: 02:reserved 00000000fec00000 0000000000001000
+               6: 02:reserved 00000000ff800000 0000000000800000
+    option_table: 000000007ff9a018
+     Bit  Len  Cfg  ID  Name
+       0  180    r   0  reserved_memory
+     180    1    e   4  boot_option            0:Fallback 1:Normal
+     184    4    h   0  reboot_counter
+     190    8    r   0  reserved_century
+     1b8    8    r   0  reserved_ibm_ps2_century
+     1c0    1    e   1  power_on_after_fail    0:Disable 1:Enable
+     1c4    4    e   6  debug_level            5:Notice 6:Info 7:Debug 8:Spew
+     1d0   80    r   0  vbnv
+     3f0   10    h   0  check_sum
+    CMOS start  : 1c0
+       CMOS end    : 1cf
+       CMOS csum loc: 3f0
+    VBNV start  : ffffffff
+    VBNV size   : ffffffff
+    ...
+    Unimpl.     : 10 37 40
+
+Check that the CMOS RAM checksum is correct, then create a configuration editor
+and load the settings from CMOS RAM::
+
+    => cbcmos check
+    => cedit cb
+    => cedit read_cmos
+
+Now run the cedit. In this case the user selected 'save' so `cedit run` returns
+success::
+
+    => if cedit run; then cedit write_cmos -v; fi
+    Write 2 bytes from offset 30 to 38
+    => echo $?
+    0
+
+Update the checksum in CMOS RAM::
+
+    => cbcmos check
+    Checksum 6100 error: calculated 7100
+    => cbcmos update
+    Checksum 7100 written
+    => cbcmos check
+    =>
diff --git a/doc/usage/cmd/sb.rst b/doc/usage/cmd/sb.rst
new file mode 100644
index 00000000000..37431aff7c8
--- /dev/null
+++ b/doc/usage/cmd/sb.rst
@@ -0,0 +1,79 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+.. index::
+   single: sbi (command)
+
+sbi command
+===========
+
+Synopsis
+--------
+
+::
+
+    sb handoff
+    sb map
+    sb state
+
+Description
+-----------
+
+The *sb* command is used to display information about sandbox's internal
+operation. See :doc:`/arch/sandbox/index` for more information.
+
+sb handoff
+~~~~~~~~~~
+
+This shows information about any handoff information received from SPL. If
+U-Boot is started from an SPL build, it shows a valid magic number.
+
+sb map
+~~~~~~
+
+This shows any mappings between sandbox's emulated RAM and the underlying host
+address-space.
+
+Fields shown are:
+
+Addr
+    Address in emulated RAM
+
+Mapping
+    Equivalent address in the host address-space. While sandbox requests address
+    ``0x10000000`` from the OS, this is not always available.
+
+Refcnt
+    Shows the number of references to this mapping.
+
+sb state
+~~~~~~~~
+
+This shows basic information about the sandbox state, currently just the
+command-line with which sandbox was started.
+
+Example
+-------
+
+This shows checking for the presence of SPL-handoff information. For this to
+work, ``u-boot-spl`` must be run, with build that enables ``CONFIG_SPL``, such
+as ``sandbox_spl``::
+
+    => sb handoff
+    SPL handoff magic 14f93c7b
+
+This shows output from the *sb map* subcommand, with a single mapping::
+
+    Sandbox memory-mapping
+        Addr           Mapping  Refcnt
+    ff000000  000056185b46d6d0       2
+
+This shows output from the *sb state* subcommand::
+
+    => sb state
+    Arguments:
+    /tmp/b/sandbox/u-boot -D
+
+Configuration
+-------------
+
+The *sb handoff* command is only supported if CONFIG_HANDOFF is enabled.
diff --git a/doc/usage/index.rst b/doc/usage/index.rst
index db71711c393..cb7a23f1170 100644
--- a/doc/usage/index.rst
+++ b/doc/usage/index.rst
@@ -43,6 +43,7 @@ Shell commands
    cmd/bootz
    cmd/button
    cmd/cat
+   cmd/cbcmos
    cmd/cbsysinfo
    cmd/cedit
    cmd/cli
@@ -103,6 +104,7 @@ Shell commands
    cmd/reset
    cmd/rng
    cmd/saves
+   cmd/sb
    cmd/sbi
    cmd/scmi
    cmd/scp03