[PATCH v3 0/4] Add Genio 510 and 700 BootROM download agents

[PATCH v3 0/4] Add Genio 510 and 700 BootROM download agents

[Carlo Caione]

Genio 510 and 700 need a way to provision blank eMMC and recover boards
with unusable boot firmware. Add RAM-based fastboot download agents that
can be loaded through the MediaTek BootROM download protocol without
relying on the installed bootloader.

Fastboot in U-Boot proper is preferred when the complete download agent
fits the platform's BootROM payload limit. It provides U-Boot's shell and
boot facilities as well as flashing. The SPL variant offers a smaller
executable payload when including BL31 and U-Boot proper would exceed
that limit. Both require an external DDR loader and run fastboot from
DRAM after DDR initialization.

The two paths start USB fastboot at different stages:

   Fastboot in SPL                   Fastboot in U-Boot proper
   ---------------                  -------------------------
   BootROM USB download             BootROM USB download
   (host -> SRAM)                   (host -> SRAM)
     |                                |
     v                                v
   DDR loader                       DDR loader
     | Initialize DRAM                | Initialize DRAM
     | Copy SPL to DRAM               | Copy SPL + FIT to DRAM
     v                                v
   SPL                              SPL
     | USB fastboot <-> host           | Load BL31 + U-Boot from RAM
     v                                v
   eMMC provisioning                BL31
                                      |
                                      v
                                    U-Boot proper
                                      | USB fastboot <-> host
                                      v
                                    eMMC provisioning

This series is based on upstream/next. Generic SPL fastboot V6, applied
to u-boot-dfu-next [1], remains a prerequisite.

[1] https://lore.kernel.org/all/179015047421.246261.8241758059641679018.b4-ty@kernel.org/

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
Changes in v3:
- Rebase onto current upstream/next.
- Separate the boot-device conditional cleanup from DA enablement.
- Use normal VBUS detection without changing the MTU3 driver.
- Apply the SPL agent's eMMC preparation to the U-Boot DA, including
  reset-pin enablement.
- Reduce the U-Boot DA heap from 144 MiB to 16 MiB for sparse flashing.
- Document that enabling the eMMC reset pin is permanent.
- Use wildcard MAINTAINERS entries and clarify signing and heap-size
  rationale.
- Link to v2: https://patch.msgid.link/20260923-ccaione-upstream-mt8390-da-v2-0-8f264678ac29@baylibre.com

Changes in v2:
- Rebase onto upstream/next, which now includes Genio SPL support.
- Align shared DA filenames with the mt8370 Genio naming.
- Use fixed USB peripheral mode instead of the private force-vbus DT
  property, with corresponding MTU3 driver support.
- Limit RAM boot to the U-Boot DA and use phase-specific MMC settings.
- Separate shared and per-agent configuration, and make DA and normal
  storage-image configurations mutually exclusive.
- Build the SPL DA entry only in SPL and simplify FIT key handling.
- Keep the SPL allocation limit large enough for sparse image writes.
- Select the eMMC user area when resuming boot with SPL fastboot continue.
- Explain the preferred U-Boot DA and the SPL alternative for tighter
  BootROM payload limits; clarify DT requirements and continue behavior.
- Link to v1: https://patch.msgid.link/20260914-ccaione-upstream-mt8390-da-v1-0-b76f9e30ac38@baylibre.com

To: GSS_MTK_Uboot_upstream <GSS_MTK_Uboot_upstream@mediatek.com>
To: u-boot@lists.u-boot-project.org
Cc: Tom Rini <trini@konsulko.com>
Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Cc: Ryder Lee <ryder.lee@mediatek.com>
Cc: Weijie Gao <weijie.gao@mediatek.com>
Cc: Chunfeng Yun <chunfeng.yun@mediatek.com>
Cc: Igor Belwon <igor.belwon@mentallysanemainliners.org>
Cc: David Lechner <dlechner@baylibre.com>
Cc: Julien Stephan <jstephan@baylibre.com>
Cc: Julien Masson <jmasson@baylibre.com>
Cc: Johan Jonker <jbx6244@gmail.com>
Cc: Macpaul Lin <macpaul.lin@mediatek.com>
Cc: Chris-QJ Chen <chris-qj.chen@mediatek.com>
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Cc: Bastien Curutchet <bastien.curutchet@bootlin.com>
Cc: Alexey Charkov <alchark@gmail.com>
Cc: Vitor Sato Eschholz <vsatoes@baylibre.com>
Cc: "Pablo Sun (孫毓翔)" <pablo.sun@mediatek.com>
Cc: Arnaud Ferraris <arnaud.ferraris@collabora.com>
Cc: Suhrid Subramaniam <Suhrid.Subramaniam@mediatek.com>
Cc: Marek Vasut <marek.vasut+usb@mailbox.org>
Cc: Carlo Caione <ccaione@baylibre.com>
Cc: Casey Connolly <casey.connolly@linaro.org>
Cc: Michael Srba <Michael.Srba@seznam.cz>

---
Carlo Caione (3):
      arm: mediatek: simplify SPL boot-device selection
      arm: mediatek: enable U-Boot fastboot DAs on Genio 510 and 700
      doc: board: mediatek: document Genio download agents

Julien Masson (1):
      arm: mediatek: enable SPL fastboot DAs on Genio 510 and 700

 arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi      |   6 +
 arch/arm/dts/mt8370-genio-da-u-boot.dtsi           |  64 ++++++++++
 arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi      |   6 +
 arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi       |  16 +++
 arch/arm/dts/mtk-genio-da-fit-binman-u-boot.dtsi   |  62 ++++++++++
 .../dts/mtk-genio-loader-spl-binman-u-boot.dtsi    |   2 +-
 arch/arm/mach-mediatek/Kconfig                     |  59 +++++++++
 arch/arm/mach-mediatek/Makefile                    |   5 +
 arch/arm/mach-mediatek/download_agent.c            |  83 +++++++++++++
 arch/arm/mach-mediatek/spl.c                       |  22 ++--
 board/mediatek/MAINTAINERS                         |  12 +-
 common/spl/Kconfig                                 |   2 +-
 configs/mt8370-genio-da-spl-fastboot.config        |  21 ++++
 configs/mt8370-genio-da-uboot-fastboot.config      |  29 +++++
 configs/mt8370-genio-da.config                     |  12 ++
 configs/mt8370_genio_510_evk_da_spl_defconfig      |   2 +
 configs/mt8370_genio_510_evk_da_uboot_defconfig    |   2 +
 configs/mt8390_genio_700_evk_da_spl_defconfig      |   2 +
 configs/mt8390_genio_700_evk_da_uboot_defconfig    |   2 +
 doc/board/mediatek/mt8188-genio-evk.rst            | 135 +++++++++++++++++++++
 20 files changed, 525 insertions(+), 19 deletions(-)
---
base-commit: ad2b0f0ef2a2a6bae1896e493e98734e37a3f1eb
change-id: 20260910-ccaione-upstream-mt8390-da-f2f8416ab2a8
prerequisite-message-id: 20260913-ccaione-upstream-spl-fastboot-v6-0-dd3ba81a7ed2@baylibre.com
prerequisite-patch-id: ebe0842a87ef1a27c9882d7c45823b37ef84e5a8
prerequisite-patch-id: 7df6bdcd4e7a655d86db0447593b2bf36050b049
prerequisite-patch-id: e98c322def69bb8ecec30dd41c05aa62040b1008
prerequisite-patch-id: 553ddc59d4de9ff9f1949875939979cbeab2eaac
prerequisite-patch-id: 8d8c1917bfcee87fecf6077a117c8a11cc402cdd

Best regards,
--  
Carlo Caione <ccaione@baylibre.com>

[PATCH v3 1/4] arm: mediatek: simplify SPL boot-device selection

[Carlo Caione]

Use phase-aware configuration checks to make boot-device selection
easier to extend while preserving the existing device priority.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 arch/arm/mach-mediatek/spl.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/arch/arm/mach-mediatek/spl.c b/arch/arm/mach-mediatek/spl.c
index 6f1ec052b95..125ebcd784f 100644
--- a/arch/arm/mach-mediatek/spl.c
+++ b/arch/arm/mach-mediatek/spl.c
@@ -33,15 +33,14 @@ void board_init_f(ulong dummy)
 
 u32 spl_boot_device(void)
 {
-#if defined(CONFIG_SPL_SPI)
-	return BOOT_DEVICE_SPI;
-#elif defined(CONFIG_SPL_MMC)
-	return BOOT_DEVICE_MMC1;
-#elif defined(CONFIG_SPL_NAND_SUPPORT)
-	return BOOT_DEVICE_NAND;
-#elif defined(CONFIG_SPL_NOR_SUPPORT)
-	return BOOT_DEVICE_NOR;
-#else
+	if (CONFIG_IS_ENABLED(SPI))
+		return BOOT_DEVICE_SPI;
+	if (CONFIG_IS_ENABLED(MMC))
+		return BOOT_DEVICE_MMC1;
+	if (CONFIG_IS_ENABLED(NAND_SUPPORT))
+		return BOOT_DEVICE_NAND;
+	if (CONFIG_IS_ENABLED(NOR_SUPPORT))
+		return BOOT_DEVICE_NOR;
+
 	return BOOT_DEVICE_NONE;
-#endif
 }

-- 
2.56.0

[PATCH v3 2/4] arm: mediatek: enable SPL fastboot DAs on Genio 510 and 700

[Carlo Caione]

From: Julien Masson <jmasson@baylibre.com>

Genio 510 and 700 need a way to provision blank eMMC and recover from
unusable boot firmware without relying on the installed bootloader. Add
a BootROM-loaded fastboot agent that also prepares the eMMC boot
settings so newly flashed firmware can boot.

U-Boot proper is preferred when the complete agent fits BootROM's SRAM
download area before DRAM initialization. Provide the SPL alternative
for tighter payload budgets, avoiding the space required by BL31 and
U-Boot proper. An external DDR loader is still required.

DA authentication belongs to the BootROM download flow, so provisioning
agents must not require the keys used to sign normal storage images.
Sparse flashing needs a 16 MiB heap to accommodate the writer's 8 MiB
buffer alongside fastboot state.

Signed-off-by: Julien Masson <jmasson@baylibre.com>
Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi      |  4 ++
 arch/arm/dts/mt8370-genio-da-u-boot.dtsi           | 61 +++++++++++++++++++
 arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi      |  4 ++
 arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi       | 16 +++++
 .../dts/mtk-genio-loader-spl-binman-u-boot.dtsi    |  2 +-
 arch/arm/mach-mediatek/Kconfig                     | 28 +++++++++
 arch/arm/mach-mediatek/Makefile                    |  3 +
 arch/arm/mach-mediatek/download_agent.c            | 69 ++++++++++++++++++++++
 board/mediatek/MAINTAINERS                         | 12 ++--
 common/spl/Kconfig                                 |  2 +-
 configs/mt8370-genio-da-spl-fastboot.config        | 21 +++++++
 configs/mt8370-genio-da.config                     | 12 ++++
 configs/mt8370_genio_510_evk_da_spl_defconfig      |  2 +
 configs/mt8390_genio_700_evk_da_spl_defconfig      |  2 +
 14 files changed, 229 insertions(+), 9 deletions(-)

diff --git a/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi b/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
index 10b9a142f37..2ee7fb1f40c 100644
--- a/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
+++ b/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
@@ -14,3 +14,7 @@
 #include "mtk-genio-mtk-boot-binman-u-boot.dtsi"
 #include "mtk-genio-bootloaders-binman-u-boot.dtsi"
 #endif
+
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT
+#include "mt8370-genio-da-u-boot.dtsi"
+#endif
diff --git a/arch/arm/dts/mt8370-genio-da-u-boot.dtsi b/arch/arm/dts/mt8370-genio-da-u-boot.dtsi
new file mode 100644
index 00000000000..9d0d057cfc9
--- /dev/null
+++ b/arch/arm/dts/mt8370-genio-da-u-boot.dtsi
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
+/*
+ * Copyright (c) 2026 BayLibre, SAS.
+ * Author: Carlo Caione <ccaione@baylibre.com>
+ */
+
+/*
+ * Download agents (DAs) run from RAM to provision or recover eMMC.
+ * Both variants expose USB0 as a peripheral and leave unused USB
+ * controllers disabled, independently of the normal boot USB setup.
+ */
+
+#include "mtk-genio-binman-u-boot.dtsi"
+#include "mtk-genio-da-binman-u-boot.dtsi"
+
+&ssusb0 {
+	dr_mode = "peripheral";
+};
+
+&ssusb1 {
+	status = "disabled";
+};
+
+&ssusb2 {
+	status = "disabled";
+};
+
+/* Only the SPL fastboot variant needs these USB dependencies in SPL. */
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT
+&pericfg_ao {
+	bootph-pre-ram;
+};
+
+&ssusb0 {
+	bootph-pre-ram;
+};
+
+&u3phy0 {
+	bootph-pre-ram;
+};
+
+&u2port0 {
+	bootph-pre-ram;
+};
+
+&usb_default_pins {
+	bootph-pre-ram;
+
+	pins-iddig {
+		bootph-pre-ram;
+	};
+
+	pins-valid {
+		bootph-pre-ram;
+	};
+
+	pins-vbus {
+		bootph-pre-ram;
+	};
+};
+#endif
diff --git a/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi b/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
index 6230b016ca0..4fedbda9b3f 100644
--- a/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
+++ b/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
@@ -14,3 +14,7 @@
 #include "mtk-genio-mtk-boot-binman-u-boot.dtsi"
 #include "mtk-genio-bootloaders-binman-u-boot.dtsi"
 #endif
+
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT
+#include "mt8370-genio-da-u-boot.dtsi"
+#endif
diff --git a/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
new file mode 100644
index 00000000000..fb6fadb492f
--- /dev/null
+++ b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
+/*
+ * Copyright (c) 2026 BayLibre, SAS.
+ * Author: Carlo Caione <ccaione@baylibre.com>
+ */
+
+&binman {
+	da: da {
+		filename = "da.bin";
+		pad-byte = <0>;
+
+/* DA authentication is handled by the BootROM download tooling. */
+#define MTK_GENIO_SPL_NO_FIT_KEYS
+#include "mtk-genio-loader-spl-binman-u-boot.dtsi"
+	};
+};
diff --git a/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi
index 2dd13d261a0..6c99d0926c4 100644
--- a/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi
+++ b/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi
@@ -12,7 +12,7 @@ ddr-loader {
 	size = <CONFIG_MTK_GENIO_DDR_LOADER_SIZE>;
 };
 
-#ifdef CONFIG_SPL_FIT_SIGNATURE
+#if defined(CONFIG_SPL_FIT_SIGNATURE) && !defined(MTK_GENIO_SPL_NO_FIT_KEYS)
 u-boot-spl {
 	type = "section";
 	size = <CONFIG_SPL_MAX_SIZE>;
diff --git a/arch/arm/mach-mediatek/Kconfig b/arch/arm/mach-mediatek/Kconfig
index e572cfe8571..eece6456e43 100644
--- a/arch/arm/mach-mediatek/Kconfig
+++ b/arch/arm/mach-mediatek/Kconfig
@@ -249,6 +249,34 @@ config MTK_GENIO_BL31_LOAD_ADDR
 
 endif
 
+config MTK_BROM_DOWNLOAD_AGENT
+	bool
+	depends on TARGET_MT8188 && SPL
+	select BINMAN
+	select MTK_GENIO_IMAGE_CONTRACT
+
+choice
+	prompt "MediaTek BootROM download agent"
+	optional
+	depends on TARGET_MT8188 && SPL && SUPPORT_EMMC_BOOT
+	depends on !MTK_GENIO_BOOT_IMAGES
+	help
+	  Select where to run fastboot after the BootROM downloads the agent
+	  into RAM. Leave this disabled for normal storage boot.
+	  Download agents cannot also build the normal storage-boot images.
+
+config MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT
+	bool "Run download-agent fastboot from SPL"
+	depends on SPL_FASTBOOT_FLASH_MMC
+	select MTK_BROM_DOWNLOAD_AGENT
+	select SPL_BOARD_INIT
+	help
+	  Build an SPL which enters USB fastboot after the MediaTek BootROM
+	  downloads it into RAM. The download agent also configures the eMMC
+	  boot partition so that a newly flashed board can boot normally.
+
+endchoice
+
 config MTK_TZ_MOVABLE
 	select ARCH_MISC_INIT
 	select OF_SYSTEM_SETUP
diff --git a/arch/arm/mach-mediatek/Makefile b/arch/arm/mach-mediatek/Makefile
index 35f748a70d6..0f0bd8fda01 100644
--- a/arch/arm/mach-mediatek/Makefile
+++ b/arch/arm/mach-mediatek/Makefile
@@ -4,6 +4,9 @@ obj-$(CONFIG_ARM64) += armv8-mem-map.o
 obj-y	+= cpu.o
 obj-$(CONFIG_MTK_TZ_MOVABLE)	+= tzcfg.o
 obj-$(CONFIG_XPL_BUILD)	+= spl.o
+ifdef CONFIG_XPL_BUILD
+obj-$(CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT)	+= download_agent.o
+endif
 
 obj-$(CONFIG_TARGET_MT7622) += mt7622/
 obj-$(CONFIG_TARGET_MT7623) += mt7623/
diff --git a/arch/arm/mach-mediatek/download_agent.c b/arch/arm/mach-mediatek/download_agent.c
new file mode 100644
index 00000000000..e73b6a6b161
--- /dev/null
+++ b/arch/arm/mach-mediatek/download_agent.c
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2026 BayLibre, SAS.
+ * Author: Julien Masson <jmasson@baylibre.com>
+ */
+
+#include <dm/uclass.h>
+#include <fastboot.h>
+#include <mmc.h>
+#include <stdio.h>
+#include <linux/errno.h>
+
+static int mtk_mmc_boot_prepare(void)
+{
+	struct udevice *dev;
+	struct mmc *mmc;
+	int ret;
+
+	/* No storage loader has run yet, so probe the device here. */
+	ret = uclass_get_device_by_seq(UCLASS_MMC,
+				       CONFIG_VAL(FASTBOOT_FLASH_MMC_DEV), &dev);
+	if (ret) {
+		printf("Cannot load MMC device: %d\n", ret);
+		return ret;
+	}
+
+	mmc = mmc_get_mmc_dev(dev);
+	if (!mmc)
+		return -ENODEV;
+
+	ret = mmc_init(mmc);
+	if (ret) {
+		printf("MMC init failed: %d\n", ret);
+		return ret;
+	}
+
+	/* Enable BOOT1 and boot acknowledgment for normal BootROM startup. */
+	ret = mmc_set_part_conf(mmc, 1, 1, 0);
+	if (ret)
+		printf("Cannot configure the eMMC boot partition: %d\n", ret);
+
+	/* Reset to x1 SDR, backward-compatible timing for each boot. */
+	ret = mmc_set_boot_bus_width(mmc, 0, 0, 0);
+	if (ret)
+		printf("Cannot configure the eMMC boot bus: %d\n", ret);
+
+	/* This permanently enables the reset pin; it cannot be undone. */
+	if (!mmc->ext_csd[EXT_CSD_RST_N_FUNCTION]) {
+		ret = mmc_set_rst_n_function(mmc, 1);
+		if (ret)
+			printf("Cannot enable the eMMC reset function: %d\n", ret);
+	}
+
+	return 0;
+}
+
+void spl_board_init(void)
+{
+	int ret;
+
+	ret = mtk_mmc_boot_prepare();
+	if (ret)
+		printf("MMC boot preparation failed: %d\n", ret);
+
+	puts("Waiting for fastboot commands...\n");
+	ret = fastboot_usb_run(0, NULL, 0);
+	if (ret)
+		printf("Fastboot failed: %d\n", ret);
+}
diff --git a/board/mediatek/MAINTAINERS b/board/mediatek/MAINTAINERS
index 20befdba0e2..696b87c1524 100644
--- a/board/mediatek/MAINTAINERS
+++ b/board/mediatek/MAINTAINERS
@@ -18,14 +18,12 @@ MT8188/MT8370/MT8390
 M:	Macpaul Lin <Macpaul.Lin@mediatek.com>
 M:	Julien Stephan <jstephan@baylibre.com>
 S:	Maintained
-F:	arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
-F:	arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
-F:	arch/arm/dts/mt8390-genio-common-u-boot.dtsi
-F:	arch/arm/dts/mtk-genio-*-binman-u-boot.dtsi
-F:	arch/arm/dts/mtk-genio-binman-u-boot.dtsi
+F:	arch/arm/dts/mt8370*
+F:	arch/arm/dts/mt8390*
+F:	arch/arm/dts/mtk-genio*
 F:	configs/mt8188.config
-F:	configs/mt8370_genio_510_evk_defconfig
-F:	configs/mt8390_genio_700_evk_defconfig
+F:	configs/mt8370*
+F:	configs/mt8390*
 F:	doc/board/mediatek/mt8188-genio-evk.rst
 
 MT8195/MT8395
diff --git a/common/spl/Kconfig b/common/spl/Kconfig
index 4930ecb0861..fb8bbbd2f5c 100644
--- a/common/spl/Kconfig
+++ b/common/spl/Kconfig
@@ -194,7 +194,7 @@ config SPL_SHOW_ERRORS
 config SPL_BINMAN_SYMBOLS
 	bool "Declare binman symbols in SPL"
 	depends on SPL_FRAMEWORK && BINMAN
-	default n if MTK_GENIO_BOOT_IMAGES
+	default n if MTK_GENIO_IMAGE_CONTRACT
 	default y
 	help
 	  This enables use of symbols in SPL which refer to other entries in
diff --git a/configs/mt8370-genio-da-spl-fastboot.config b/configs/mt8370-genio-da-spl-fastboot.config
new file mode 100644
index 00000000000..6ba12f7d282
--- /dev/null
+++ b/configs/mt8370-genio-da-spl-fastboot.config
@@ -0,0 +1,21 @@
+#include <configs/mt8370-genio-da.config>
+
+CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT=y
+# Sparse writes need an 8 MiB DMA buffer in addition to the fastboot state.
+CONFIG_SPL_SYS_MALLOC_SIZE=0x1000000
+# dlmalloc also caps individual SPL allocations at SYS_MALLOC_LEN.
+CONFIG_SYS_MALLOC_LEN=0x1000000
+# Resume from the user-area FIT after fastboot continue.
+CONFIG_SUPPORT_EMMC_BOOT_OVERRIDE_PART_CONFIG=y
+CONFIG_SYS_MMCSD_RAW_MODE_EMMC_BOOT_PARTITION=0
+CONFIG_SPL_MMC_WRITE=y
+CONFIG_SPL_PHY=y
+CONFIG_SPL_DM_USB_GADGET=y
+CONFIG_SPL_USB_GADGET=y
+CONFIG_SPL_USB_MTU3=y
+CONFIG_SPL_FASTBOOT=y
+CONFIG_SPL_FASTBOOT_REBOOT=y
+CONFIG_SPL_FASTBOOT_FLASH_MMC=y
+CONFIG_SPL_FASTBOOT_FLASH_MMC_DEV=0
+CONFIG_SPL_FASTBOOT_MMC_BOOT_SUPPORT=y
+CONFIG_SPL_FASTBOOT_MMC_USER_SUPPORT=y
diff --git a/configs/mt8370-genio-da.config b/configs/mt8370-genio-da.config
new file mode 100644
index 00000000000..46cb42b37ba
--- /dev/null
+++ b/configs/mt8370-genio-da.config
@@ -0,0 +1,12 @@
+# USB identity and transfer buffer shared by both download-agent modes.
+CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+CONFIG_USB=y
+CONFIG_DM_USB_GADGET=y
+CONFIG_USB_MTU3=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_VENDOR_NUM=0x0e8d
+CONFIG_USB_GADGET_PRODUCT_NUM=0x201c
+CONFIG_FASTBOOT_BUF_ADDR=0x65000000
+CONFIG_FASTBOOT_BUF_SIZE=0x15000000
diff --git a/configs/mt8370_genio_510_evk_da_spl_defconfig b/configs/mt8370_genio_510_evk_da_spl_defconfig
new file mode 100644
index 00000000000..bb537616b53
--- /dev/null
+++ b/configs/mt8370_genio_510_evk_da_spl_defconfig
@@ -0,0 +1,2 @@
+#include <configs/mt8370_genio_510_evk_defconfig>
+#include <configs/mt8370-genio-da-spl-fastboot.config>
diff --git a/configs/mt8390_genio_700_evk_da_spl_defconfig b/configs/mt8390_genio_700_evk_da_spl_defconfig
new file mode 100644
index 00000000000..7f1ba02c6e7
--- /dev/null
+++ b/configs/mt8390_genio_700_evk_da_spl_defconfig
@@ -0,0 +1,2 @@
+#include <configs/mt8390_genio_700_evk_defconfig>
+#include <configs/mt8370-genio-da-spl-fastboot.config>

-- 
2.56.0

[PATCH v3 3/4] arm: mediatek: enable U-Boot fastboot DAs on Genio 510 and 700

[Carlo Caione]

Prefer fastboot in U-Boot proper when the complete download agent fits
the BootROM SRAM limit. Its shell and boot commands support provisioning
and recovery beyond the SPL agent's flashing operations, without relying
on the installed firmware.

This variant requires BL31 and an external DDR loader.

Use the same eMMC boot preparation as the SPL agent so provisioning a
blank device does not depend on the chosen agent. Keep 16 MiB of heap for
sparse writes; the download buffer is reserved separately in DRAM.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi    |  2 +
 arch/arm/dts/mt8370-genio-da-u-boot.dtsi         |  3 ++
 arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi    |  2 +
 arch/arm/dts/mtk-genio-da-fit-binman-u-boot.dtsi | 62 ++++++++++++++++++++++++
 arch/arm/mach-mediatek/Kconfig                   | 31 ++++++++++++
 arch/arm/mach-mediatek/Makefile                  |  2 +
 arch/arm/mach-mediatek/download_agent.c          | 14 ++++++
 arch/arm/mach-mediatek/spl.c                     |  3 ++
 configs/mt8370-genio-da-uboot-fastboot.config    | 29 +++++++++++
 configs/mt8370_genio_510_evk_da_uboot_defconfig  |  2 +
 configs/mt8390_genio_700_evk_da_uboot_defconfig  |  2 +
 11 files changed, 152 insertions(+)

diff --git a/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi b/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
index 2ee7fb1f40c..f81ae1c82e2 100644
--- a/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
+++ b/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
@@ -16,5 +16,7 @@
 #endif
 
 #ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT
+#define MTK_DA_DESCRIPTION "MediaTek Genio 510 download agent"
+#define MTK_DA_FIT_DESCRIPTION "MediaTek Genio 510 DA bootloaders"
 #include "mt8370-genio-da-u-boot.dtsi"
 #endif
diff --git a/arch/arm/dts/mt8370-genio-da-u-boot.dtsi b/arch/arm/dts/mt8370-genio-da-u-boot.dtsi
index 9d0d057cfc9..4ca46bbe2e2 100644
--- a/arch/arm/dts/mt8370-genio-da-u-boot.dtsi
+++ b/arch/arm/dts/mt8370-genio-da-u-boot.dtsi
@@ -12,6 +12,9 @@
 
 #include "mtk-genio-binman-u-boot.dtsi"
 #include "mtk-genio-da-binman-u-boot.dtsi"
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT
+#include "mtk-genio-da-fit-binman-u-boot.dtsi"
+#endif
 
 &ssusb0 {
 	dr_mode = "peripheral";
diff --git a/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi b/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
index 4fedbda9b3f..395241173a0 100644
--- a/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
+++ b/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
@@ -16,5 +16,7 @@
 #endif
 
 #ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT
+#define MTK_DA_DESCRIPTION "MediaTek Genio 700 download agent"
+#define MTK_DA_FIT_DESCRIPTION "MediaTek Genio 700 DA bootloaders"
 #include "mt8370-genio-da-u-boot.dtsi"
 #endif
diff --git a/arch/arm/dts/mtk-genio-da-fit-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-da-fit-binman-u-boot.dtsi
new file mode 100644
index 00000000000..a605ad2504a
--- /dev/null
+++ b/arch/arm/dts/mtk-genio-da-fit-binman-u-boot.dtsi
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
+/*
+ * Copyright (c) 2026 BayLibre, SAS.
+ * Author: Carlo Caione <ccaione@baylibre.com>
+ */
+
+&da {
+	fit {
+		description = MTK_DA_FIT_DESCRIPTION;
+		offset = <CONFIG_MTK_GENIO_DA_FIT_OFFSET>;
+		size = <CONFIG_MTK_GENIO_DA_FIT_MAX_SIZE>;
+		#address-cells = <1>;
+
+		images {
+			uboot {
+				description = "U-Boot fastboot download agent";
+				type = "firmware";
+				os = "u-boot";
+				arch = "arm64";
+				compression = "gzip";
+				compress = "gzip";
+				load = <CONFIG_TEXT_BASE>;
+				entry = <CONFIG_TEXT_BASE>;
+
+				u-boot {
+				};
+
+				hash {
+					algo = "sha256";
+				};
+			};
+
+			atf {
+				description = "ARM Trusted Firmware BL31";
+				type = "firmware";
+				os = "arm-trusted-firmware";
+				arch = "arm64";
+				compression = "gzip";
+				compress = "gzip";
+				load = <CONFIG_MTK_GENIO_BL31_LOAD_ADDR>;
+				entry = <CONFIG_MTK_GENIO_BL31_LOAD_ADDR>;
+
+				atf-bl31 {
+				};
+
+				hash {
+					algo = "sha256";
+				};
+			};
+		};
+
+		configurations {
+			default = "conf";
+
+			conf {
+				description = MTK_DA_DESCRIPTION;
+				firmware = "atf";
+				loadables = "uboot";
+			};
+		};
+	};
+};
diff --git a/arch/arm/mach-mediatek/Kconfig b/arch/arm/mach-mediatek/Kconfig
index eece6456e43..4febd700bff 100644
--- a/arch/arm/mach-mediatek/Kconfig
+++ b/arch/arm/mach-mediatek/Kconfig
@@ -275,8 +275,39 @@ config MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT
 	  downloads it into RAM. The download agent also configures the eMMC
 	  boot partition so that a newly flashed board can boot normally.
 
+config MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT
+	bool "Run download-agent fastboot from U-Boot"
+	depends on SPL_RAM_DEVICE
+	depends on USB_FUNCTION_FASTBOOT
+	depends on FASTBOOT_FLASH_MMC
+	select BOARD_LATE_INIT
+	select MTK_BROM_DOWNLOAD_AGENT
+	help
+	  Build a small SPL which loads BL31 and U-Boot from a FIT already
+	  copied to DRAM by the external DDR loader. U-Boot proper then
+	  prepares the eMMC boot settings and provides USB fastboot.
+
 endchoice
 
+if MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT
+
+config MTK_GENIO_DA_FIT_OFFSET
+	hex "Download-agent FIT offset"
+	default 0x70000 if TARGET_MT8188
+	help
+	  Offset of the directly parseable FIT in the BootROM-loaded download
+	  agent. This must match the external loader's DA_FIT_OFFSET value.
+
+config MTK_GENIO_DA_FIT_MAX_SIZE
+	hex "Maximum download-agent FIT size"
+	default 0x8f000 if TARGET_MT8188
+	help
+	  Fixed region reserved for the download-agent FIT and the maximum FIT
+	  size accepted by this image layout. This must match the external
+	  loader's DA_FIT_SIZE value while the loader copies the complete region.
+
+endif
+
 config MTK_TZ_MOVABLE
 	select ARCH_MISC_INIT
 	select OF_SYSTEM_SETUP
diff --git a/arch/arm/mach-mediatek/Makefile b/arch/arm/mach-mediatek/Makefile
index 0f0bd8fda01..d784af8bc05 100644
--- a/arch/arm/mach-mediatek/Makefile
+++ b/arch/arm/mach-mediatek/Makefile
@@ -6,6 +6,8 @@ obj-$(CONFIG_MTK_TZ_MOVABLE)	+= tzcfg.o
 obj-$(CONFIG_XPL_BUILD)	+= spl.o
 ifdef CONFIG_XPL_BUILD
 obj-$(CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT)	+= download_agent.o
+else
+obj-$(CONFIG_MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT)	+= download_agent.o
 endif
 
 obj-$(CONFIG_TARGET_MT7622) += mt7622/
diff --git a/arch/arm/mach-mediatek/download_agent.c b/arch/arm/mach-mediatek/download_agent.c
index e73b6a6b161..d0269b7a574 100644
--- a/arch/arm/mach-mediatek/download_agent.c
+++ b/arch/arm/mach-mediatek/download_agent.c
@@ -54,6 +54,7 @@ static int mtk_mmc_boot_prepare(void)
 	return 0;
 }
 
+#ifdef CONFIG_XPL_BUILD
 void spl_board_init(void)
 {
 	int ret;
@@ -67,3 +68,16 @@ void spl_board_init(void)
 	if (ret)
 		printf("Fastboot failed: %d\n", ret);
 }
+#else
+int board_late_init(void)
+{
+	int ret;
+
+	ret = mtk_mmc_boot_prepare();
+	if (ret)
+		printf("MMC boot preparation failed: %d\n", ret);
+
+	/* Keep fastboot available even if storage preparation failed. */
+	return 0;
+}
+#endif
diff --git a/arch/arm/mach-mediatek/spl.c b/arch/arm/mach-mediatek/spl.c
index 125ebcd784f..120a94c6598 100644
--- a/arch/arm/mach-mediatek/spl.c
+++ b/arch/arm/mach-mediatek/spl.c
@@ -33,6 +33,9 @@ void board_init_f(ulong dummy)
 
 u32 spl_boot_device(void)
 {
+	if (IS_ENABLED(CONFIG_MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT))
+		return BOOT_DEVICE_RAM;
+
 	if (CONFIG_IS_ENABLED(SPI))
 		return BOOT_DEVICE_SPI;
 	if (CONFIG_IS_ENABLED(MMC))
diff --git a/configs/mt8370-genio-da-uboot-fastboot.config b/configs/mt8370-genio-da-uboot-fastboot.config
new file mode 100644
index 00000000000..e22ec881a97
--- /dev/null
+++ b/configs/mt8370-genio-da-uboot-fastboot.config
@@ -0,0 +1,29 @@
+#include <configs/mt8370-genio-da.config>
+
+CONFIG_MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT=y
+# Sparse writes need an 8 MiB DMA buffer in addition to the fastboot state.
+CONFIG_SYS_MALLOC_LEN=0x1000000
+CONFIG_CMD_FASTBOOT=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_FLASH=y
+CONFIG_FASTBOOT_FLASH_MMC=y
+CONFIG_FASTBOOT_FLASH_MMC_DEV=0
+CONFIG_FASTBOOT_MMC_BOOT_SUPPORT=y
+CONFIG_FASTBOOT_MMC_USER_SUPPORT=y
+CONFIG_SPL_RAM_DEVICE=y
+CONFIG_SPL_LOAD_FIT_ADDRESS=0x41000000
+CONFIG_SPL_MAX_SIZE=0x25000
+CONFIG_SPL_CRC32=y
+CONFIG_SPL_GZIP=y
+# CONFIG_SPL_MMC is not set
+# CONFIG_SPL_LIBDISK_SUPPORT is not set
+# CONFIG_SPL_EFI_PARTITION is not set
+# CONFIG_SPL_SYS_MMCSD_RAW_MODE is not set
+CONFIG_BOOTDELAY=0
+CONFIG_USE_BOOTCOMMAND=y
+CONFIG_BOOTCOMMAND="fastboot usb 0"
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+# CONFIG_BOOTSTD_FULL is not set
+# CONFIG_CMD_BOOTFLOW is not set
+# CONFIG_EFI_LOADER is not set
diff --git a/configs/mt8370_genio_510_evk_da_uboot_defconfig b/configs/mt8370_genio_510_evk_da_uboot_defconfig
new file mode 100644
index 00000000000..c696e89c892
--- /dev/null
+++ b/configs/mt8370_genio_510_evk_da_uboot_defconfig
@@ -0,0 +1,2 @@
+#include <configs/mt8370_genio_510_evk_defconfig>
+#include <configs/mt8370-genio-da-uboot-fastboot.config>
diff --git a/configs/mt8390_genio_700_evk_da_uboot_defconfig b/configs/mt8390_genio_700_evk_da_uboot_defconfig
new file mode 100644
index 00000000000..102f61a3afc
--- /dev/null
+++ b/configs/mt8390_genio_700_evk_da_uboot_defconfig
@@ -0,0 +1,2 @@
+#include <configs/mt8390_genio_700_evk_defconfig>
+#include <configs/mt8370-genio-da-uboot-fastboot.config>

-- 
2.56.0

[PATCH v3 4/4] doc: board: mediatek: document Genio download agents

[Carlo Caione]

Download agents have different firmware and eMMC provisioning
requirements from normal storage boot. Document them so users can build
compatible images and understand which persistent eMMC settings each
agent changes.

Signed-off-by: Carlo Caione <ccaione@baylibre.com>
---
 doc/board/mediatek/mt8188-genio-evk.rst | 135 ++++++++++++++++++++++++++++++++
 1 file changed, 135 insertions(+)

diff --git a/doc/board/mediatek/mt8188-genio-evk.rst b/doc/board/mediatek/mt8188-genio-evk.rst
index e36e8faeb48..f8e9685fc87 100644
--- a/doc/board/mediatek/mt8188-genio-evk.rst
+++ b/doc/board/mediatek/mt8188-genio-evk.rst
@@ -279,3 +279,138 @@ Genio Tools uses the default bootstrap from the image directory. Keep
 ``bootloaders_b`` unchanged until the new images have been tested. Add
 ``--dry-run`` to check the selected files and partitions without accessing the
 board.
+
+BootROM download agents
+-----------------------
+
+A download agent (DA) runs from RAM and exposes eMMC through USB fastboot for
+provisioning or recovery. The BootROM downloads ``da.bin`` into SRAM; the
+external DDR loader initializes DRAM and enters SPL using the same execution
+contract as normal boot. The DA itself is not installed in an eMMC partition.
+
+Prefer fastboot in U-Boot proper when the complete DA fits the platform's
+BootROM download limit. It provides U-Boot's shell and boot facilities in
+addition to flashing. The complete image must fit in the SRAM download area
+before the DDR loader can initialize DRAM. Fastboot in SPL offers a smaller
+executable payload for configurations where including BL31 and U-Boot proper
+would exceed that limit. Both variants run fastboot from DRAM.
+
+Two mutually exclusive modes are available:
+
+* ``CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT`` runs fastboot directly in
+  SPL. This keeps the provisioning agent small and independent of BL31,
+  OP-TEE and U-Boot proper. It needs the matching external DDR loader.
+* ``CONFIG_MTK_BROM_DOWNLOAD_AGENT_UBOOT_FASTBOOT`` uses SPL to load BL31 and
+  U-Boot from a FIT in RAM. U-Boot then runs ``fastboot usb 0``. This mode needs
+  a matching BL31 built without an OP-TEE dependency, and a DDR loader which
+  implements the additional FIT copy described below. It provides
+  U-Boot's shell and boot facilities for provisioning flows which need
+  more than the SPL agent's flash and erase commands.
+
+The two paths start USB fastboot at different stages::
+
+   Fastboot in SPL                   Fastboot in U-Boot proper
+   ---------------                  -------------------------
+   BootROM USB download             BootROM USB download
+   (host -> SRAM)                   (host -> SRAM)
+     |                                |
+     v                                v
+   DDR loader                       DDR loader
+     | Initialize DRAM                | Initialize DRAM
+     | Copy SPL to DRAM               | Copy SPL + FIT to DRAM
+     v                                v
+   SPL                              SPL
+     | USB fastboot <-> host           | Load BL31 + U-Boot from RAM
+     v                                v
+   eMMC provisioning                BL31
+                                      |
+                                      v
+                                    U-Boot proper
+                                      | USB fastboot <-> host
+                                      v
+                                    eMMC provisioning
+
+Build download agents separately from normal boot images; do not enable
+``CONFIG_MTK_GENIO_BOOT_IMAGES`` in a DA configuration.
+
+For Genio 700, build the SPL fastboot mode with::
+
+   $ export CROSS_COMPILE=aarch64-linux-gnu-
+   $ make O=build-da-spl mt8390_genio_700_evk_da_spl_defconfig
+   $ make O=build-da-spl BINMAN_INDIRS=/path/to/firmware
+
+For fastboot in U-Boot proper::
+
+   $ make O=build-da-uboot mt8390_genio_700_evk_da_uboot_defconfig
+   $ make O=build-da-uboot BL31=/path/to/da-bl31.bin \
+         BINMAN_INDIRS=/path/to/firmware
+
+Use the corresponding ``mt8370_genio_510_evk_da_spl_defconfig`` or
+``mt8370_genio_510_evk_da_uboot_defconfig`` for Genio 510. Each build produces
+``da.bin`` and ``da.map`` in its output directory. Use board- and mode-matched
+firmware inputs; do not set ``TEE`` for these builds.
+
+Image and loader contract
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The default ``da.bin`` layouts are shown below. Offsets are relative to the
+start of the image, and region sizes include padding::
+
+   Fastboot in SPL                     Fastboot in U-Boot proper
+
+   0x00000 +----------------------+   0x00000 +----------------------+
+           | DDR loader           |           | DDR loader           |
+           | 300 KiB              |           | 300 KiB              |
+   0x4b000 +----------------------+   0x4b000 +----------------------+
+           | SPL + USB fastboot   |           | SPL                  |
+           | 700 KiB              |           | 148 KiB              |
+           |                      |   0x70000 +----------------------+
+           |                      |           | FIT: BL31 + U-Boot   |
+           |                      |           | 572 KiB              |
+   0xfa000 +----------------------+   0xff000 +----------------------+
+
+Both DA modes use the shared ``mtk-genio-*-binman-u-boot.dtsi`` templates and
+``CONFIG_MTK_GENIO_IMAGE_CONTRACT`` settings. The image starts with the DDR
+loader padded to ``CONFIG_MTK_GENIO_DDR_LOADER_SIZE``, followed by SPL padded
+to ``CONFIG_SPL_MAX_SIZE``. The loader copies that SPL region to
+``CONFIG_SPL_TEXT_BASE`` before entering it. SPL fastboot reserves a 16 MiB
+heap, including space for the sparse writer's 8 MiB buffer.
+
+The full-U-Boot DA appends a FIT at ``CONFIG_MTK_GENIO_DA_FIT_OFFSET``, in a
+fixed region of ``CONFIG_MTK_GENIO_DA_FIT_MAX_SIZE`` bytes. The external
+loader must copy this complete region to ``CONFIG_SPL_LOAD_FIT_ADDRESS``
+before entering SPL. Its ``DA_FIT_OFFSET`` and ``DA_FIT_SIZE`` must match the
+U-Boot settings. The FIT container is directly parseable; only its BL31 and
+U-Boot payloads are gzip-compressed. SPL decompresses them to
+``CONFIG_MTK_GENIO_BL31_LOAD_ADDR`` and ``CONFIG_TEXT_BASE`` respectively,
+then enters BL31, which starts U-Boot.
+
+The default padded images are 1000 KiB for the SPL DA and 1020 KiB for the
+U-Boot DA. The latter fits the Genio 700 BootROM download area. Selecting SPL
+alone does not remove the fixed padding; a tighter download budget also
+requires smaller reserved regions, with matching changes to the DDR loader.
+
+These fixed regions are part of the external loader ABI. Changing the image
+sizes or addresses requires corresponding loader changes. Binman rejects
+payloads which exceed their reserved regions. The generated DA is a raw
+payload for the platform download tooling; it has no eMMC BootROM wrapper.
+Its FIT hashes do not authenticate it. Platforms requiring authenticated
+DAs must use their external signing and BootROM download tooling.
+
+Using the download agent
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+Select the generated agent with ``genio-flash --bootstrap /path/to/da.bin``.
+``genio-flash`` reboots the board after flashing.
+
+For manual fastboot sessions, use ``fastboot reboot`` to start the installed
+boot chain. ``fastboot continue`` boots firmware from eMMC with the SPL DA,
+or returns to the command prompt with the U-Boot DA, without resetting.
+
+Use raw images for ``mmc0boot0`` and ``mmc0boot1``. Android sparse images are
+supported for GPT partitions and the eMMC user-area alias.
+
+Both agents prepare the eMMC boot partition and bus settings, so a newly
+flashed board can boot without additional host commands. They also
+permanently enable the hardware reset pin if its policy is still
+unconfigured.

-- 
2.56.0

Re: [PATCH v3 0/4] Add Genio 510 and 700 BootROM download agents

[Quentin Schulz]

Hi Carlo,

On 9/30/26 2:51 PM, Carlo Caione wrote:
> Genio 510 and 700 need a way to provision blank eMMC and recover boards
> with unusable boot firmware. Add RAM-based fastboot download agents that
> can be loaded through the MediaTek BootROM download protocol without
> relying on the installed bootloader.
> 
> Fastboot in U-Boot proper is preferred when the complete download agent
> fits the platform's BootROM payload limit. It provides U-Boot's shell and
> boot facilities as well as flashing. The SPL variant offers a smaller
> executable payload when including BL31 and U-Boot proper would exceed
> that limit. Both require an external DDR loader and run fastboot from
> DRAM after DDR initialization.
> 
> The two paths start USB fastboot at different stages:
> 
>     Fastboot in SPL                   Fastboot in U-Boot proper
>     ---------------                  -------------------------
>     BootROM USB download             BootROM USB download
>     (host -> SRAM)                   (host -> SRAM)
>       |                                |
>       v                                v
>     DDR loader                       DDR loader
>       | Initialize DRAM                | Initialize DRAM
>       | Copy SPL to DRAM               | Copy SPL + FIT to DRAM
>       v                                v
>     SPL                              SPL
>       | USB fastboot <-> host           | Load BL31 + U-Boot from RAM
>       v                                v
>     eMMC provisioning                BL31
>                                        |
>                                        v
>                                      U-Boot proper
>                                        | USB fastboot <-> host
>                                        v
>                                      eMMC provisioning
> 
> This series is based on upstream/next. Generic SPL fastboot V6, applied
> to u-boot-dfu-next [1], remains a prerequisite.
> 

Had a glance at this (am not really interested in Mediatek :) ), and the 
single question I would have is:

why have SPL_ in the middle of the Kconfig symbol?

Can't you just have

SPL_MTK_BROM_DOWNLOAD_AGENT_FASTBOOT for SPL
MTK_BROM_DOWNLOAD_AGENT_FASTBOOT for proper

so you can use CONFIG_IS_ENABLED(MTK_BROM_DOWNLOAD_AGENT_FASTBOOT)? You 
can always use IS_ENABLED(CONFIG_SPL_MTK_BROM_DOWNLOAD_AGENT_FASTBOOT) 
if you want to check the symbol for a specific stage.

Cheers,
Quentin

Re: [PATCH v3 0/4] Add Genio 510 and 700 BootROM download agents

[Carlo Caione]

On Wed, Sep 30, 2026 at 16:47:33 +0100, Quentin Schulz wrote:
> Hi Carlo,

Hi Quentin,
 
> Had a glance at this (am not really interested in Mediatek :) ), and the
> single question I would have is:
> 
> why have SPL_ in the middle of the Kconfig symbol?
> 
> Can't you just have
> 
> SPL_MTK_BROM_DOWNLOAD_AGENT_FASTBOOT for SPL
> MTK_BROM_DOWNLOAD_AGENT_FASTBOOT for proper
> 
> so you can use CONFIG_IS_ENABLED(MTK_BROM_DOWNLOAD_AGENT_FASTBOOT)? You can
> always use IS_ENABLED(CONFIG_SPL_MTK_BROM_DOWNLOAD_AGENT_FASTBOOT) if you
> want to check the symbol for a specific stage.

Well, not a bad idea at all :) I need to check there are no weird edge
cases but in theory it is a nice cleanup. Thanks for the suggestion (I
will still wait a bit for more reviews before pushing a new revision).

cheers and thanks,

--
Carlo Caione

Re: [PATCH v3 2/4] arm: mediatek: enable SPL fastboot DAs on Genio 510 and 700

[David Lechner]

On 9/30/26 7:51 AM, Carlo Caione wrote:
> From: Julien Masson <jmasson@baylibre.com>
> 
> Genio 510 and 700 need a way to provision blank eMMC and recover from
> unusable boot firmware without relying on the installed bootloader. Add
> a BootROM-loaded fastboot agent that also prepares the eMMC boot
> settings so newly flashed firmware can boot.
> 

...

> diff --git a/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
> new file mode 100644
> index 00000000000..fb6fadb492f
> --- /dev/null
> +++ b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
> @@ -0,0 +1,16 @@
> +// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
> +/*
> + * Copyright (c) 2026 BayLibre, SAS.
> + * Author: Carlo Caione <ccaione@baylibre.com>
> + */
> +
> +&binman {
> +	da: da {
> +		filename = "da.bin";
> +		pad-byte = <0>;
> +
> +/* DA authentication is handled by the BootROM download tooling. */
> +#define MTK_GENIO_SPL_NO_FIT_KEYS
> +#include "mtk-genio-loader-spl-binman-u-boot.dtsi"
> +	};
> +};

Since the download agent and MTK_GENIO_BOOT_IMAGES are mutually exclusive,
could the loader dtsi just check !defined(CONFIG_MTK_BROM_DOWNLOAD_AGENT)
instead of a private MTK_GENIO_SPL_NO_FIT_KEYS define?


> diff --git a/arch/arm/mach-mediatek/download_agent.c b/arch/arm/mach-mediatek/download_agent.c
> new file mode 100644
> index 00000000000..e73b6a6b161
> --- /dev/null
> +++ b/arch/arm/mach-mediatek/download_agent.c
> @@ -0,0 +1,69 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Copyright (c) 2026 BayLibre, SAS.
> + * Author: Julien Masson <jmasson@baylibre.com>
> + */
> +
> +#include <dm/uclass.h>
> +#include <fastboot.h>
> +#include <mmc.h>
> +#include <stdio.h>
> +#include <linux/errno.h>

Also spl.h for spl_board_init() and init.h for board_late_init().

Re: [PATCH v3 2/4] arm: mediatek: enable SPL fastboot DAs on Genio 510 and 700

[Carlo Caione]

On Mon, Oct 05, 2026 at 18:05:54 +0100, David Lechner wrote:
> On 9/30/26 7:51 AM, Carlo Caione wrote:
> > From: Julien Masson <jmasson@baylibre.com>
> > 
> > Genio 510 and 700 need a way to provision blank eMMC and recover from
> > unusable boot firmware without relying on the installed bootloader. Add
> > a BootROM-loaded fastboot agent that also prepares the eMMC boot
> > settings so newly flashed firmware can boot.
> > 
> 
> ...
> 
> > diff --git a/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
> > new file mode 100644
> > index 00000000000..fb6fadb492f
> > --- /dev/null
> > +++ b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
> > @@ -0,0 +1,16 @@
> > +// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
> > +/*
> > + * Copyright (c) 2026 BayLibre, SAS.
> > + * Author: Carlo Caione <ccaione@baylibre.com>
> > + */
> > +
> > +&binman {
> > +	da: da {
> > +		filename = "da.bin";
> > +		pad-byte = <0>;
> > +
> > +/* DA authentication is handled by the BootROM download tooling. */
> > +#define MTK_GENIO_SPL_NO_FIT_KEYS
> > +#include "mtk-genio-loader-spl-binman-u-boot.dtsi"
> > +	};
> > +};
> 
> Since the download agent and MTK_GENIO_BOOT_IMAGES are mutually exclusive,
> could the loader dtsi just check !defined(CONFIG_MTK_BROM_DOWNLOAD_AGENT)
> instead of a private MTK_GENIO_SPL_NO_FIT_KEYS define?

Good idea.

> > diff --git a/arch/arm/mach-mediatek/download_agent.c b/arch/arm/mach-mediatek/download_agent.c
> > new file mode 100644
> > index 00000000000..e73b6a6b161
> > --- /dev/null
> > +++ b/arch/arm/mach-mediatek/download_agent.c
> > @@ -0,0 +1,69 @@
> > +// SPDX-License-Identifier: GPL-2.0-only
> > +/*
> > + * Copyright (c) 2026 BayLibre, SAS.
> > + * Author: Julien Masson <jmasson@baylibre.com>
> > + */
> > +
> > +#include <dm/uclass.h>
> > +#include <fastboot.h>
> > +#include <mmc.h>
> > +#include <stdio.h>
> > +#include <linux/errno.h>
> 
> Also spl.h for spl_board_init() and init.h for board_late_init().

Ok.

I'm going to push a V4 right away because I'm adding one new commit on
top of this series for an important fix.

Cheers,

--
Carlo Caione