[PATCH v3 0/2] fastboot: mmc: fix bootloader offset

[PATCH v3 0/2] fastboot: mmc: fix bootloader offset

[Heiko Schocher]

Not for all SoCs the bootloader start at offset 0x0,
in a hardware partition of an emmc. So we need the possibility to
set the correct offset, where bootloader starts.

Example:

imx8qxp revision C0 emmc Partition layout

| eMMC block / partition | Offset     | Size  | Purpose                        |
| ---------------------- | ---------- | ----- | ------------------------------ |
| /dev/mmcblk0boot0      | 0x0        | 2MB   | imx-boot-container A           |
|                        | 0x00220000 | 128kB | secure boot signature rootfs A |
| /dev/mmcblk0boot1      | 0x0        | 2MB   | imx-boot-container B           |
|                        | 0x00200000 | 8kB   | U-Boot env 0                   |
|                        | 0x00202000 | 8kB   | U-Boot env 1                   |
|                        | 0x00220000 | 128kB | secure boot signature rootfs B |

imx8qxp rev B0 emmc Partition layout

| eMMC block / partition | Offset     | Size  | Purpose                        |
| ---------------------- | ---------- | ----- | ------------------------------ |
| /dev/mmcblk0boot0      | 0x00008000 | 2MB   | imx-boot-container A           |
|                        | 0x00220000 | 128kB | secure boot signature rootfs A |
| /dev/mmcblk0boot1      | 0x0        | 8kB   | U-Boot env 0                   |
|                        | 0x00002000 | 8kB   | U-Boot env 1                   |
|                        | 0x00008000 | 2MB   | imx-boot-container B           |

If we flash now the bootloader image flash.bin on a B0 revision with

uuu FB: flash bootloader flash.bin

we overwrite the environment and board does not boot at all, as offset
is wrong.

To prevent any API change in the above command we propose
the following implementation from this series:

We add a new weak function fb_mmc_get_boot_offset() in drivers/fastboot/fb_block.c
which returns 0 and call this function instead of passing 0 for
the offset where offset is used/passed.

In SoC specific code (currently for IMX8QXP only) we implement this function
that it returns on B0 SoCs the 32k offset and on other SoC revisions the
offset 0.

This is tested on B0 and C0 based boards from siemens.

This patch should have no effect for other SoCs.

Changes in v3:
reworked the logic as Peng suggested, so newer SoC
revisions will also start from offset 0x0

Changes in v2:
- added Reviewed-by from Mattijs
- Used the commit message as Peng suggested (with a small
  checkpatch fix:
  WARNING: 'writting' may be misspelled - perhaps 'writing'?
- rebased to mainline
  b99da05e153 - (tag: v2026.04-rc2, origin/master, origin/HEAD) Prepare v2026.04-rc2
- added Reviewed-by from Mattijs

Adrian Freihofer (2):
  fastboot: mmc: make boot partition offset configurable
  arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

 arch/arm/mach-imx/imx8/cpu.c | 21 +++++++++++++++++++++
 drivers/fastboot/fb_block.c  | 15 +++++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

-- 
2.20.1

base-commit: b99da05e1538b8fa153322da82917af2aa27e1d6

[PATCH v3 1/2] fastboot: mmc: make boot partition offset configurable

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

i.MX8QXP rev C.0 requires boot container stored at offset 0KB
for eMMC, while i.MX8QXP pre C.0 requires boot container stored
at offset 32KB for eMMC.

To use one U-Boot binary to support different chip revisions,
introduce fb_mmc_get_boot_offset() to allow override the default
offset when writing to eMMC boot partitions.

This enables support for devices with non-standard boot partition
layouts, such as those requiring an offset for correct bootloader
placement.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>
---

(no changes since v2)

Changes in v2:
- added Reviewed-by from Mattijs
- Used the commit message as Peng suggested (with a small
  checkpatch fix:
  WARNING: 'writting' may be misspelled - perhaps 'writing'?
- rebased to mainline
  b99da05e153 - (tag: v2026.04-rc2, origin/master, origin/HEAD) Prepare v2026.04-rc2

 drivers/fastboot/fb_block.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/fastboot/fb_block.c b/drivers/fastboot/fb_block.c
index 2a7e47992f8..51d1abb18c7 100644
--- a/drivers/fastboot/fb_block.c
+++ b/drivers/fastboot/fb_block.c
@@ -28,6 +28,11 @@
  */
 #define FASTBOOT_MAX_BLOCKS_WRITE 65536
 
+__weak lbaint_t fb_mmc_get_boot_offset(void)
+{
+	return 0;
+}
+
 struct fb_block_sparse {
 	struct blk_desc	*dev_desc;
 };
@@ -160,7 +165,8 @@ void fastboot_block_raw_erase_disk(struct blk_desc *dev_desc, const char *disk_n
 
 	debug("Start Erasing %s...\n", disk_name);
 
-	written = fb_block_write(dev_desc, 0, dev_desc->lba, NULL);
+	written = fb_block_write(dev_desc, fb_mmc_get_boot_offset(),
+				 dev_desc->lba, NULL);
 	if (written != dev_desc->lba) {
 		pr_err("Failed to erase %s\n", disk_name);
 		fastboot_response("FAIL", response, "Failed to erase %s", disk_name);
@@ -211,7 +217,8 @@ void fastboot_block_erase(const char *part_name, char *response)
 	if (fastboot_block_get_part_info(part_name, &dev_desc, &part_info, response) < 0)
 		return;
 
-	fastboot_block_raw_erase(dev_desc, &part_info, part_name, 0, response);
+	fastboot_block_raw_erase(dev_desc, &part_info, part_name,
+				 fb_mmc_get_boot_offset(), response);
 }
 
 void fastboot_block_write_raw_disk(struct blk_desc *dev_desc, const char *disk_name,
@@ -224,7 +231,7 @@ void fastboot_block_write_raw_disk(struct blk_desc *dev_desc, const char *disk_n
 	blkcnt = ((download_bytes + (dev_desc->blksz - 1)) & ~(dev_desc->blksz - 1));
 	blkcnt = lldiv(blkcnt, dev_desc->blksz);
 
-	if (blkcnt > dev_desc->lba) {
+	if ((blkcnt + fb_mmc_get_boot_offset()) > dev_desc->lba) {
 		pr_err("too large for disk: '%s'\n", disk_name);
 		fastboot_fail("too large for disk", response);
 		return;
@@ -232,7 +239,7 @@ void fastboot_block_write_raw_disk(struct blk_desc *dev_desc, const char *disk_n
 
 	printf("Flashing Raw Image\n");
 
-	blks = fb_block_write(dev_desc, 0, blkcnt, buffer);
+	blks = fb_block_write(dev_desc, fb_mmc_get_boot_offset(), blkcnt, buffer);
 
 	if (blks != blkcnt) {
 		pr_err("failed writing to %s\n", disk_name);
-- 
2.20.1

[PATCH v3 2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

Add IMX8QXP SoCs specific implementation of fb_mmc_get_boot_offset()

This is needed as bootloader offset is different dependent on SoC
revision!

For revision B0 the bootloader starts at 32k offset. On offset
0x0 the bootloaders environment is stored.

On C0 revisions of the SoC bootloader image starts at offset 0x0

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

---

Changes in v3:
reworked the logic as Peng suggested, so newer SoC
revisions will also start from offset 0x0

Changes in v2:
- added Reviewed-by from Mattijs

 arch/arm/mach-imx/imx8/cpu.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/arch/arm/mach-imx/imx8/cpu.c b/arch/arm/mach-imx/imx8/cpu.c
index 0e112af661c..f4738e3fda8 100644
--- a/arch/arm/mach-imx/imx8/cpu.c
+++ b/arch/arm/mach-imx/imx8/cpu.c
@@ -899,3 +899,24 @@ bool m4_parts_booted(void)
 
 	return false;
 }
+
+#ifdef CONFIG_IMX8QXP
+#include <blk.h>
+
+/*
+ * On B0 revision SoCs the bootloader is on 32k offset
+ * and at offset 0x0 is the U-Boot Environment stored
+ *
+ * So we cannot flash bootloader images to offset 0x0
+ *
+ * On C0 revisions of the SoC bootloader image starts
+ * at offset 0x0 ...
+ */
+lbaint_t fb_mmc_get_boot_offset(void)
+{
+	if ((get_cpu_rev() & 0xF) < CHIP_REV_C)
+		return 0x40;
+
+	return 0;
+}
+#endif
-- 
2.20.1

Re: [PATCH v3 2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

[Mattijs Korpershoek]

On Tue, Feb 17, 2026 at 11:36, Heiko Schocher <hs@nabladev.com> wrote:

> From: Adrian Freihofer <adrian.freihofer@siemens.com>
>
> Add IMX8QXP SoCs specific implementation of fb_mmc_get_boot_offset()
>
> This is needed as bootloader offset is different dependent on SoC
> revision!
>
> For revision B0 the bootloader starts at 32k offset. On offset
> 0x0 the bootloaders environment is stored.
>
> On C0 revisions of the SoC bootloader image starts at offset 0x0
>
> Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
> Signed-off-by: Heiko Schocher <hs@nabladev.com>
> Reviewed-by: Mattijs Korpershoek <mkorpershoek@kernel.org>

Fabio, Peng, can one of you please Acked-by: so that I can take this
through my tree?

Alternatively, please let me know if you want to pick up the series instead.

>
> ---
>

Re: [PATCH v3 2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function

[Fabio Estevam]

Hi Mattijs,

On Tue, Feb 17, 2026 at 9:46 AM Mattijs Korpershoek
<mkorpershoek@kernel.org> wrote:

> Fabio, Peng, can one of you please Acked-by: so that I can take this
> through my tree?

Feel free to take the series through your tree:

Acked-by: Fabio Estevam <festevam@gmail.com>

Thanks

Re: [PATCH v3 0/2] fastboot: mmc: fix bootloader offset

[Mattijs Korpershoek]

Hi,

On Tue, 17 Feb 2026 11:36:02 +0100, Heiko Schocher wrote:
> Not for all SoCs the bootloader start at offset 0x0,
> in a hardware partition of an emmc. So we need the possibility to
> set the correct offset, where bootloader starts.
> 
> Example:
> 
> imx8qxp revision C0 emmc Partition layout
> 
> [...]

Thanks, Applied to https://source.denx.de/u-boot/custodians/u-boot-dfu (u-boot-dfu-next)

[1/2] fastboot: mmc: make boot partition offset configurable
      https://source.denx.de/u-boot/custodians/u-boot-dfu/-/commit/24526162338114a8ac6c51280fa672ee1ca72241
[2/2] arch: imx8qxp: Override weak fb_mmc_get_boot_offset function
      https://source.denx.de/u-boot/custodians/u-boot-dfu/-/commit/94b7c3b2622ae1e43aae0d92005ac8ca4dd9f134

--
Mattijs