diff --git a/arch/arm/mach-imx/imx8ulp/soc.c b/arch/arm/mach-imx/imx8ulp/soc.c
index 5e7bf57..62c02a6 100644
--- a/arch/arm/mach-imx/imx8ulp/soc.c
+++ b/arch/arm/mach-imx/imx8ulp/soc.c
@@ -11,6 +11,10 @@
 #include <asm/mach-imx/boot_mode.h>
 #include <efi_loader.h>
 #include <spl.h>
+#include <asm/arch/s400_api.h>
+#include <asm/arch/mu_hal.h>
+#include <cpu_func.h>
+#include <asm/setup.h>
 
 DECLARE_GLOBAL_DATA_PTR;
 
@@ -340,9 +344,89 @@
 	setbits_le32(SIM1_BASE_ADDR + 0x8, (0x1 << 26));
 }
 
+static int release_xrdc(void)
+{
+	ulong s_mu_base = 0x27020000UL;
+	struct imx8ulp_s400_msg msg;
+	int ret;
+
+	msg.version = AHAB_VERSION;
+	msg.tag = AHAB_CMD_TAG;
+	msg.size = 2;
+	msg.command = AHAB_RELEASE_RDC_REQ_CID;
+	msg.data[0] = (0x78 << 8) | 0x2; /* A35 XRDC */
+
+	mu_hal_init(s_mu_base);
+	mu_hal_sendmsg(s_mu_base, 0, *((u32 *)&msg));
+	mu_hal_sendmsg(s_mu_base, 1, msg.data[0]);
+
+	ret = mu_hal_receivemsg(s_mu_base, 0, (u32 *)&msg);
+	if (!ret) {
+		ret = mu_hal_receivemsg(s_mu_base, 1, &msg.data[0]);
+		if (!ret)
+			return ret;
+
+		if ((msg.data[0] & 0xff) == 0)
+			return 0;
+		else
+			return -EIO;
+	}
+
+	return ret;
+}
+
+static void xrdc_mrc_region_set_access(int mrc_index, u32 addr, u32 access)
+{
+	ulong xrdc_base = 0x292f0000, off;
+	u32 mrgd[5];
+	u8 mrcfg, j, region_num;
+	u8 dsel;
+
+	mrcfg = readb(xrdc_base + 0x140 + mrc_index);
+	region_num = mrcfg & 0x1f;
+
+	for (j = 0; j < region_num; j++) {
+		off = 0x2000 + mrc_index * 0x200 + j * 0x20;
+
+		mrgd[0] = readl(xrdc_base + off);
+		mrgd[1] = readl(xrdc_base + off + 4);
+		mrgd[2] = readl(xrdc_base + off + 8);
+		mrgd[3] = readl(xrdc_base + off + 0xc);
+		mrgd[4] = readl(xrdc_base + off + 0x10);
+
+		debug("MRC [%u][%u]\n", mrc_index, j);
+		debug("0x%x, 0x%x, 0x%x, 0x%x, 0x%x\n",
+		      mrgd[0], mrgd[1], mrgd[2], mrgd[3], mrgd[4]);
+
+		/* hit */
+		if (addr >= mrgd[0] && addr <= mrgd[1]) {
+			/* find domain 7 DSEL */
+			dsel = (mrgd[2] >> 21) & 0x7;
+			if (dsel == 1) {
+				mrgd[4] &= ~0xFFF;
+				mrgd[4] |= (access & 0xFFF);
+			} else if (dsel == 2) {
+				mrgd[4] &= ~0xFFF0000;
+				mrgd[4] |= ((access & 0xFFF) << 16);
+			}
+
+			/* not handle other cases, since S400 only set ACCESS1 and 2 */
+			writel(mrgd[4], xrdc_base + off + 0x10);
+			return;
+		}
+	}
+}
+
 int arch_cpu_init(void)
 {
 	if (IS_ENABLED(CONFIG_SPL_BUILD)) {
+		/* Disable wdog */
+		init_wdog();
+
+		/* release xrdc, then allow A35 to write SRAM2 */
+		release_xrdc();
+		xrdc_mrc_region_set_access(2, CONFIG_SPL_TEXT_BASE, 0xE00);
+
 		clock_init();
 	} else {
 		/* reconfigure core0 reset vector to ROM */