[PATCH v2 0/2] fastboot: mmc: fix bootloader offset

[PATCH v2 0/2] fastboot: mmc: fix bootloader offset

[Heiko Schocher]

Not for all SoCs the bootloader start at offset 0x0,
in a hardware partition of an emmc. So we need the possibility to
set the correct offset, where bootloader starts.

Example:

imx8qxp revision C0 emmc Partition layout

| eMMC block / partition | Offset     | Size  | Purpose                        |
| ---------------------- | ---------- | ----- | ------------------------------ |
| /dev/mmcblk0boot0      | 0x0        | 2MB   | imx-boot-container A           |
|                        | 0x00220000 | 128kB | secure boot signature rootfs A |
| /dev/mmcblk0boot1      | 0x0        | 2MB   | imx-boot-container B           |
|                        | 0x00200000 | 8kB   | U-Boot env 0                   |
|                        | 0x00202000 | 8kB   | U-Boot env 1                   |
|                        | 0x00220000 | 128kB | secure boot signature rootfs B |

imx8qxp rev B0 emmc Partition layout

| eMMC block / partition | Offset     | Size  | Purpose                        |
| ---------------------- | ---------- | ----- | ------------------------------ |
| /dev/mmcblk0boot0      | 0x00008000 | 2MB   | imx-boot-container A           |
|                        | 0x00220000 | 128kB | secure boot signature rootfs A |
| /dev/mmcblk0boot1      | 0x0        | 8kB   | U-Boot env 0                   |
|                        | 0x00002000 | 8kB   | U-Boot env 1                   |
|                        | 0x00008000 | 2MB   | imx-boot-container B           |

If we flash now the bootloader image flash.bin on a B0 revision with

uuu FB: flash bootloader flash.bin

we overwrite the environment and board does not boot at all, as offset
is wrong.

To prevent any API change in the above command we propose
the following implementation from this series:

We add a new weak function fb_mmc_get_boot_offset() in drivers/fastboot/fb_block.c
which returns 0 and call this function instead of passing 0 for
the offset where offset is used/passed.

In SoC specific code (currently for IMX8QXP only) we implement this function
that it returns on B0 SoCs the 32k offset and on other SoC revisions the
offset 0.

This is tested on B0 and C0 based boards from siemens.

This patch should have no effect for other SoCs.

Changes in v2:
- added Reviewed-by from Mattijs
- Used the commit message as Peng suggested (with a small
  checkpatch fix:
  WARNING: 'writting' may be misspelled - perhaps 'writing'?
- rebased to mainline
  b99da05e153 - (tag: v2026.04-rc2, origin/master, origin/HEAD) Prepare v2026.04-rc2
- added Reviewed-by from Mattijs

Adrian Freihofer (2):
  fastboot: mmc: make boot partition offset configurable
  arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

 arch/arm/mach-imx/imx8/cpu.c | 21 +++++++++++++++++++++
 drivers/fastboot/fb_block.c  | 15 +++++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

-- 
2.20.1

base-commit: b99da05e1538b8fa153322da82917af2aa27e1d6

[PATCH v2 1/2] fastboot: mmc: make boot partition offset configurable

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

i.MX8QXP rev C.0 requires boot container stored at offset 0KB
for eMMC, while i.MX8QXP pre C.0 requires boot container stored
at offset 32KB for eMMC.

To use one U-Boot binary to support different chip revisions,
introduce fb_mmc_get_boot_offset() to allow override the default
offset when writing to eMMC boot partitions.

This enables support for devices with non-standard boot partition
layouts, such as those requiring an offset for correct bootloader
placement.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
---

Changes in v2:
- added Reviewed-by from Mattijs
- Used the commit message as Peng suggested (with a small
  checkpatch fix:
  WARNING: 'writting' may be misspelled - perhaps 'writing'?
- rebased to mainline
  b99da05e153 - (tag: v2026.04-rc2, origin/master, origin/HEAD) Prepare v2026.04-rc2

 drivers/fastboot/fb_block.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/fastboot/fb_block.c b/drivers/fastboot/fb_block.c
index 2a7e47992f8..51d1abb18c7 100644
--- a/drivers/fastboot/fb_block.c
+++ b/drivers/fastboot/fb_block.c
@@ -28,6 +28,11 @@
  */
 #define FASTBOOT_MAX_BLOCKS_WRITE 65536
 
+__weak lbaint_t fb_mmc_get_boot_offset(void)
+{
+	return 0;
+}
+
 struct fb_block_sparse {
 	struct blk_desc	*dev_desc;
 };
@@ -160,7 +165,8 @@ void fastboot_block_raw_erase_disk(struct blk_desc *dev_desc, const char *disk_n
 
 	debug("Start Erasing %s...\n", disk_name);
 
-	written = fb_block_write(dev_desc, 0, dev_desc->lba, NULL);
+	written = fb_block_write(dev_desc, fb_mmc_get_boot_offset(),
+				 dev_desc->lba, NULL);
 	if (written != dev_desc->lba) {
 		pr_err("Failed to erase %s\n", disk_name);
 		fastboot_response("FAIL", response, "Failed to erase %s", disk_name);
@@ -211,7 +217,8 @@ void fastboot_block_erase(const char *part_name, char *response)
 	if (fastboot_block_get_part_info(part_name, &dev_desc, &part_info, response) < 0)
 		return;
 
-	fastboot_block_raw_erase(dev_desc, &part_info, part_name, 0, response);
+	fastboot_block_raw_erase(dev_desc, &part_info, part_name,
+				 fb_mmc_get_boot_offset(), response);
 }
 
 void fastboot_block_write_raw_disk(struct blk_desc *dev_desc, const char *disk_name,
@@ -224,7 +231,7 @@ void fastboot_block_write_raw_disk(struct blk_desc *dev_desc, const char *disk_n
 	blkcnt = ((download_bytes + (dev_desc->blksz - 1)) & ~(dev_desc->blksz - 1));
 	blkcnt = lldiv(blkcnt, dev_desc->blksz);
 
-	if (blkcnt > dev_desc->lba) {
+	if ((blkcnt + fb_mmc_get_boot_offset()) > dev_desc->lba) {
 		pr_err("too large for disk: '%s'\n", disk_name);
 		fastboot_fail("too large for disk", response);
 		return;
@@ -232,7 +239,7 @@ void fastboot_block_write_raw_disk(struct blk_desc *dev_desc, const char *disk_n
 
 	printf("Flashing Raw Image\n");
 
-	blks = fb_block_write(dev_desc, 0, blkcnt, buffer);
+	blks = fb_block_write(dev_desc, fb_mmc_get_boot_offset(), blkcnt, buffer);
 
 	if (blks != blkcnt) {
 		pr_err("failed writing to %s\n", disk_name);
-- 
2.20.1

[PATCH v2 2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

Add IMX8QXP SoCs specific implementation of fb_mmc_get_boot_offset()

This is needed as bootloader offset is different dependent on SoC
revision!

For revision B0 the bootloader starts at 32k offset. On offset
0x0 the bootloaders environment is stored.

On C0 revisions of the SoC bootloader image starts at offset 0x0

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

---

Changes in v2:
- added Reviewed-by from Mattijs

 arch/arm/mach-imx/imx8/cpu.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/arch/arm/mach-imx/imx8/cpu.c b/arch/arm/mach-imx/imx8/cpu.c
index 0e112af661c..27c431881b0 100644
--- a/arch/arm/mach-imx/imx8/cpu.c
+++ b/arch/arm/mach-imx/imx8/cpu.c
@@ -899,3 +899,24 @@ bool m4_parts_booted(void)
 
 	return false;
 }
+
+#ifdef CONFIG_IMX8QXP
+#include <blk.h>
+
+/*
+ * On B0 revision SoCs the bootloader is on 32k offset
+ * and at offset 0x0 is the U-Boot Environment stored
+ *
+ * So we cannot flash bootloader images to offset 0x0
+ *
+ * On C0 revisions of the SoC bootloader image starts
+ * at offset 0x0 ...
+ */
+lbaint_t fb_mmc_get_boot_offset(void)
+{
+	if ((get_cpu_rev() & 0xF) == CHIP_REV_C)
+		return 0;
+
+	return 0x40;
+}
+#endif
-- 
2.20.1

Re: [PATCH v2 2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

[Mattijs Korpershoek]

Hi Heiko,

On Tue, Feb 10, 2026 at 06:43, Heiko Schocher <hs@nabladev.com> wrote:

> From: Adrian Freihofer <adrian.freihofer@siemens.com>
>
> Add IMX8QXP SoCs specific implementation of fb_mmc_get_boot_offset()
>
> This is needed as bootloader offset is different dependent on SoC
> revision!
>
> For revision B0 the bootloader starts at 32k offset. On offset
> 0x0 the bootloaders environment is stored.
>
> On C0 revisions of the SoC bootloader image starts at offset 0x0
>
> Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
> Signed-off-by: Heiko Schocher <hs@nabladev.com>
> Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

Peng did provide some review feedback here:
https://lore.kernel.org/all/aXbHDnU+SpgnEt+Q@shlinux89/

I have not seen a response to that. Could you please respond there why
you did not apply his suggestion?

>
> ---
>
> Changes in v2:
> - added Reviewed-by from Mattijs
>
>  arch/arm/mach-imx/imx8/cpu.c | 21 +++++++++++++++++++++
>  1 file changed, 21 insertions(+)
>
> diff --git a/arch/arm/mach-imx/imx8/cpu.c b/arch/arm/mach-imx/imx8/cpu.c
> index 0e112af661c..27c431881b0 100644
> --- a/arch/arm/mach-imx/imx8/cpu.c
> +++ b/arch/arm/mach-imx/imx8/cpu.c
> @@ -899,3 +899,24 @@ bool m4_parts_booted(void)
>  
>  	return false;
>  }
> +
> +#ifdef CONFIG_IMX8QXP
> +#include <blk.h>
> +
> +/*
> + * On B0 revision SoCs the bootloader is on 32k offset
> + * and at offset 0x0 is the U-Boot Environment stored
> + *
> + * So we cannot flash bootloader images to offset 0x0
> + *
> + * On C0 revisions of the SoC bootloader image starts
> + * at offset 0x0 ...
> + */
> +lbaint_t fb_mmc_get_boot_offset(void)
> +{
> +	if ((get_cpu_rev() & 0xF) == CHIP_REV_C)
> +		return 0;
> +
> +	return 0x40;
> +}
> +#endif
> -- 
> 2.20.1

Re: [PATCH v2 2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

[Heiko Schocher]

Hello Matjis,

On 17.02.26 10:55, Mattijs Korpershoek wrote:
> Hi Heiko,
> 
> On Tue, Feb 10, 2026 at 06:43, Heiko Schocher <hs@nabladev.com> wrote:
> 
>> From: Adrian Freihofer <adrian.freihofer@siemens.com>
>>
>> Add IMX8QXP SoCs specific implementation of fb_mmc_get_boot_offset()
>>
>> This is needed as bootloader offset is different dependent on SoC
>> revision!
>>
>> For revision B0 the bootloader starts at 32k offset. On offset
>> 0x0 the bootloaders environment is stored.
>>
>> On C0 revisions of the SoC bootloader image starts at offset 0x0
>>
>> Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
>> Signed-off-by: Heiko Schocher <hs@nabladev.com>
>> Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
> 
> Peng did provide some review feedback here:
> https://lore.kernel.org/all/aXbHDnU+SpgnEt+Q@shlinux89/
> 
> I have not seen a response to that. Could you please respond there why
> you did not apply his suggestion?

Seems I missed that email :-(

Yep, that seems a better approach, I will change and send a v3!

Thanks!

bye,
Heiko
> 
>>
>> ---
>>
>> Changes in v2:
>> - added Reviewed-by from Mattijs
>>
>>   arch/arm/mach-imx/imx8/cpu.c | 21 +++++++++++++++++++++
>>   1 file changed, 21 insertions(+)
>>
>> diff --git a/arch/arm/mach-imx/imx8/cpu.c b/arch/arm/mach-imx/imx8/cpu.c
>> index 0e112af661c..27c431881b0 100644
>> --- a/arch/arm/mach-imx/imx8/cpu.c
>> +++ b/arch/arm/mach-imx/imx8/cpu.c
>> @@ -899,3 +899,24 @@ bool m4_parts_booted(void)
>>   
>>   	return false;
>>   }
>> +
>> +#ifdef CONFIG_IMX8QXP
>> +#include <blk.h>
>> +
>> +/*
>> + * On B0 revision SoCs the bootloader is on 32k offset
>> + * and at offset 0x0 is the U-Boot Environment stored
>> + *
>> + * So we cannot flash bootloader images to offset 0x0
>> + *
>> + * On C0 revisions of the SoC bootloader image starts
>> + * at offset 0x0 ...
>> + */
>> +lbaint_t fb_mmc_get_boot_offset(void)
>> +{
>> +	if ((get_cpu_rev() & 0xF) == CHIP_REV_C)
>> +		return 0;
>> +
>> +	return 0x40;
>> +}
>> +#endif
>> -- 
>> 2.20.1

-- 
Nabla Software Engineering
HRB 40522 Augsburg
Phone: +49 821 45592596
E-Mail: office@nabladev.com
Geschäftsführer : Stefano Babic