[PATCH v1 00/11] imx8qxp: siemens: small board updates

[PATCH v1 00/11] imx8qxp: siemens: small board updates

[Heiko Schocher]

- small DTS fixes
- add wget and bootcounter command
- Environment changes
  - introduce protected Environment
  - a lot of fixes and tries to simplify environment
    as it has grown over the years.

Some patches has changes in environment text file with
long lines, ignored the checkpatch warning for these
added commit note in the individual patches.


Adrian Freihofer (3):
  siemens: capricorn: set max-frequency for usdhc1
  siemens: capricorn: rework bootcmd environment variables
  siemens: capricorn: protect environment

Heiko Schocher (3):
  capricorn: config: add bootcounter command
  siemens: capricorn: add logic to U-Boot to avoid zig-zag boot
  siemens: capricorn: always detect emmc device

Lukas Stockmann (3):
  arm: dts: capricorn: pinctrl_usdhc1 cleanup
  arm: dts: capricorn: remove pinctrl_usdhc2
  arm: dts: capricorn: move fec2 config

Walter Schweizer (2):
  imx8qxp_capricorn config: add wget command
  siemens: capricorn: fix fallback bootm call for fitImage

 arch/arm/dts/imx8-capricorn-cxg3.dts          | 44 ++++++++++++++
 arch/arm/dts/imx8-capricorn.dtsi              | 60 +------------------
 board/siemens/capricorn/Kconfig               |  2 +
 board/siemens/capricorn/board.c               | 56 ++++++++++-------
 board/siemens/capricorn/capricorn_default.env | 16 ++---
 configs/imx8qxp_capricorn.config              |  3 +
 include/configs/capricorn-common.h            | 14 +++++
 7 files changed, 107 insertions(+), 88 deletions(-)

Azure build (series is in a bunch of siemens patches sending
now to mainline, this series is the last one):
https://dev.azure.com/hs0298/hs/_build/results?buildId=202&view=results

-- 
2.20.1

base-commit: 1c4f6220c5533fd67515f5bc07bc55e7eaf6f5da

[PATCH v1 01/11] arm: dts: capricorn: pinctrl_usdhc1 cleanup

[Heiko Schocher]

From: Lukas Stockmann <lukas.stockmann@siemens.com>

Remove gpio4.29, vselect, from usdhc1

Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 arch/arm/dts/imx8-capricorn.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index 3734a9d21f1..38d36fafbe0 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -63,7 +63,6 @@
 				SC_P_EMMC0_DATA7_CONN_EMMC0_DATA7	0x00000021
 				SC_P_EMMC0_STROBE_CONN_EMMC0_STROBE	0x06000041
 				SC_P_EMMC0_RESET_B_CONN_EMMC0_RESET_B	0x00000021
-				SC_P_ENET0_RGMII_TXC_LSIO_GPIO4_IO29	0x06000021
 			>;
 		};
 
-- 
2.20.1

Re: [PATCH v1 01/11] arm: dts: capricorn: pinctrl_usdhc1 cleanup

[Peng Fan]

Hi Heiko,

On Sat, Jan 24, 2026 at 06:54:42AM +0100, Heiko Schocher wrote:
>From: Lukas Stockmann <lukas.stockmann@siemens.com>
>
>Remove gpio4.29, vselect, from usdhc1

It would be better to explain a bit why remove it.
The board does not need 1.8v or not support or else.

Thanks,
Peng

[PATCH v1 02/11] siemens: capricorn: set max-frequency for usdhc1

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

This is required since

commit aebb523a2381 ("mmc: mmc-uclass: Use max-frequency from device tree with default handling")

and the related patches of the same series.

The error observed without this change is:
  Autobooting in 3 seconds, press "<Esc><Esc>" to stop
  EXT_CSD[179], PARTITION_CONFIG:
  BOOT_ACK: 0x0
  BOOT_PARTITION_ENABLE: 0x1 (boot0)
  PARTITION_ACCESS: 0x0 (user)
  Loading from eMMC ...fit

  U-Boot SPL 2026.01-4238dcfcbfe (Jan 09 2026 - 08:19:45 +0000)

For this example it's the following commands which does no longer work
for larger images:

  ext4load mmc 0:1 0x88000000 boot/fitImage

On latest master branch the problematic commit gets reverted with

commit c4f5b1d4b037 ("Revert "mmc: mmc-uclass: Use max-frequency from device tree with default handling"")

but for v2026.01 this fix is still required. Maybe it's anyway a good
idea to have this property set explicitly.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 arch/arm/dts/imx8-capricorn.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index 38d36fafbe0..fab7ef95166 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -125,6 +125,7 @@
 &usdhc1 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_usdhc1>;
+	max-frequency = <52000000>;
 	clock-frequency=<52000000>;
 	no-1-8-v;
 	bus-width = <8>;
-- 
2.20.1

Re: [PATCH v1 02/11] siemens: capricorn: set max-frequency for usdhc1

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:43AM +0100, Heiko Schocher wrote:
>From: Adrian Freihofer <adrian.freihofer@siemens.com>
>
>This is required since
>
>commit aebb523a2381 ("mmc: mmc-uclass: Use max-frequency from device tree with default handling")
>
>and the related patches of the same series.
>
>The error observed without this change is:
>  Autobooting in 3 seconds, press "<Esc><Esc>" to stop
>  EXT_CSD[179], PARTITION_CONFIG:
>  BOOT_ACK: 0x0
>  BOOT_PARTITION_ENABLE: 0x1 (boot0)
>  PARTITION_ACCESS: 0x0 (user)
>  Loading from eMMC ...fit
>
>  U-Boot SPL 2026.01-4238dcfcbfe (Jan 09 2026 - 08:19:45 +0000)
>
>For this example it's the following commands which does no longer work
>for larger images:
>
>  ext4load mmc 0:1 0x88000000 boot/fitImage
>
>On latest master branch the problematic commit gets reverted with
>
>commit c4f5b1d4b037 ("Revert "mmc: mmc-uclass: Use max-frequency from device tree with default handling"")
>
>but for v2026.01 this fix is still required. Maybe it's anyway a good
>idea to have this property set explicitly.
>
>Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 03/11] arm: dts: capricorn: remove pinctrl_usdhc2

[Heiko Schocher]

From: Lukas Stockmann <lukas.stockmann@siemens.com>

usdhc2 is not used on the Capricorn board.

Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 arch/arm/dts/imx8-capricorn.dtsi | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index fab7ef95166..41f4b2f646b 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -66,20 +66,6 @@
 			>;
 		};
 
-		pinctrl_usdhc2: usdhc2grp {
-			fsl,pins = <
-				SC_P_ENET0_RGMII_RXC_CONN_USDHC1_CLK	0x06000041
-				SC_P_ENET0_RGMII_RX_CTL_CONN_USDHC1_CMD	0x00000021
-				SC_P_ENET0_RGMII_RXD0_CONN_USDHC1_DATA0	0x00000021
-				SC_P_ENET0_RGMII_RXD1_CONN_USDHC1_DATA1	0x00000021
-				SC_P_ENET0_RGMII_RXD2_CONN_USDHC1_DATA2	0x00000021
-				SC_P_ENET0_RGMII_RXD3_CONN_USDHC1_DATA3	0x00000021
-				SC_P_ENET0_RGMII_TXD2_CONN_USDHC1_CD_B	0x06000021
-				//SC_P_ENET0_RGMII_TXD2_LSIO_GPIO5_IO01	0x06000021
-				SC_P_ENET0_RGMII_TX_CTL_LSIO_GPIO4_IO30	0x06000021
-			>;
-		};
-
 		pinctrl_fec2: fec2grp {
 			fsl,pins = <
 				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB0_PAD	0x000014a0
-- 
2.20.1

Re: [PATCH v1 03/11] arm: dts: capricorn: remove pinctrl_usdhc2

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:44AM +0100, Heiko Schocher wrote:
>From: Lukas Stockmann <lukas.stockmann@siemens.com>
>
>usdhc2 is not used on the Capricorn board.
>
>Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 04/11] arm: dts: capricorn: move fec2 config

[Heiko Schocher]

From: Lukas Stockmann <lukas.stockmann@siemens.com>

fec2 config does not belong to the Capricorn CPU module, move it to
the main board.

Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 arch/arm/dts/imx8-capricorn-cxg3.dts | 44 ++++++++++++++++++++++++++++
 arch/arm/dts/imx8-capricorn.dtsi     | 44 ----------------------------
 2 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/arch/arm/dts/imx8-capricorn-cxg3.dts b/arch/arm/dts/imx8-capricorn-cxg3.dts
index 2f8597579f3..b40410b2b6f 100644
--- a/arch/arm/dts/imx8-capricorn-cxg3.dts
+++ b/arch/arm/dts/imx8-capricorn-cxg3.dts
@@ -102,6 +102,26 @@
 	pinctrl-0 = <&pinctrl_gpio_keys>;
 
 	muxcgrp: imx8qxp-som {
+		pinctrl_fec2: fec2grp {
+			fsl,pins = <
+				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB0_PAD	0x000014a0
+				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB1_PAD	0x000014a0
+				SC_P_COMP_CTL_GPIO_1V8_3V3_GPIORHB_PAD		0x000514a0
+
+				SC_P_ENET0_MDC_CONN_ENET1_MDC			0x00000060
+				SC_P_ENET0_MDIO_CONN_ENET1_MDIO			0x00000060
+
+				SC_P_ESAI0_FSR_CONN_ENET1_RCLK50M_IN		0x00000060
+				SC_P_SPDIF0_RX_CONN_ENET1_RGMII_RXD0		0x00000060
+				SC_P_ESAI0_TX3_RX2_CONN_ENET1_RGMII_RXD1	0x00000060
+				SC_P_ESAI0_TX2_RX3_CONN_ENET1_RMII_RX_ER	0x00000060
+				SC_P_SPDIF0_TX_CONN_ENET1_RGMII_RX_CTL		0x00000060
+				SC_P_ESAI0_TX4_RX1_CONN_ENET1_RGMII_TXD0	0x00000060
+				SC_P_ESAI0_TX5_RX0_CONN_ENET1_RGMII_TXD1	0x00000060
+				SC_P_ESAI0_SCKR_CONN_ENET1_RGMII_TX_CTL		0x00000060
+			>;
+		};
+
 		pinctrl_gpio_leds: gpioledsgrp {
 			fsl,pins = <
 			SC_P_ESAI0_FST_LSIO_GPIO0_IO01		0x06000021
@@ -127,3 +147,27 @@
 		>;
 	};
 };
+
+&fec2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_fec2>;
+	phy-mode = "rmii";
+
+	phy-handle = <&ethphy1>;
+	fsl,magic-packet;
+	status = "okay";
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		ethphy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <0>;
+		};
+		ethphy1: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+		};
+	};
+};
diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index 41f4b2f646b..f640daa775f 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -65,26 +65,6 @@
 				SC_P_EMMC0_RESET_B_CONN_EMMC0_RESET_B	0x00000021
 			>;
 		};
-
-		pinctrl_fec2: fec2grp {
-			fsl,pins = <
-				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB0_PAD	0x000014a0
-				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB1_PAD	0x000014a0
-				SC_P_COMP_CTL_GPIO_1V8_3V3_GPIORHB_PAD		0x000514a0
-
-				SC_P_ENET0_MDC_CONN_ENET1_MDC                   0x00000060
-				SC_P_ENET0_MDIO_CONN_ENET1_MDIO                 0x00000060
-
-				SC_P_ESAI0_FSR_CONN_ENET1_RCLK50M_IN            0x00000060
-				SC_P_SPDIF0_RX_CONN_ENET1_RGMII_RXD0            0x00000060
-				SC_P_ESAI0_TX3_RX2_CONN_ENET1_RGMII_RXD1        0x00000060
-				SC_P_ESAI0_TX2_RX3_CONN_ENET1_RMII_RX_ER        0x00000060
-				SC_P_SPDIF0_TX_CONN_ENET1_RGMII_RX_CTL          0x00000060
-				SC_P_ESAI0_TX4_RX1_CONN_ENET1_RGMII_TXD0        0x00000060
-				SC_P_ESAI0_TX5_RX0_CONN_ENET1_RGMII_TXD1        0x00000060
-				SC_P_ESAI0_SCKR_CONN_ENET1_RGMII_TX_CTL         0x00000060	/* ERST: Reset pin */
-			>;
-		};
 	};
 };
 
@@ -146,27 +126,3 @@
 &fec1 {
 	status ="disabled";
 };
-
-&fec2 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&pinctrl_fec2>;
-	phy-mode = "rmii";
-
-	phy-handle = <&ethphy1>;
-	fsl,magic-packet;
-	status = "okay";
-
-	mdio {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		ethphy0: ethernet-phy@0 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <0>;
-		};
-		ethphy1: ethernet-phy@1 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <1>;
-		};
-	};
-};
-- 
2.20.1

Re: [PATCH v1 04/11] arm: dts: capricorn: move fec2 config

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:45AM +0100, Heiko Schocher wrote:
>From: Lukas Stockmann <lukas.stockmann@siemens.com>
>
>fec2 config does not belong to the Capricorn CPU module, move it to
>the main board.
>
>Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 05/11] imx8qxp_capricorn config: add wget command

[Heiko Schocher]

From: Walter Schweizer <walter.schweizer@siemens.com>

Faster than tftp.

Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 configs/imx8qxp_capricorn.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index 62babf2626f..b5c9fdbc9b3 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -73,6 +73,7 @@ CONFIG_CMD_CPU=y
 # CONFIG_CMD_CRC32 is not set
 # CONFIG_CMD_BIND is not set
 CONFIG_CMD_WDT=y
+CONFIG_CMD_WGET=y
 CONFIG_CMD_CLK=y
 CONFIG_CMD_DM=y
 CONFIG_CMD_FUSE=y
-- 
2.20.1

Re: [PATCH v1 05/11] imx8qxp_capricorn config: add wget command

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:46AM +0100, Heiko Schocher wrote:
>From: Walter Schweizer <walter.schweizer@siemens.com>
>
>Faster than tftp.
>
>Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 06/11] capricorn: config: add bootcounter command

[Heiko Schocher]

enable
CONFIG_CMD_BOOTCOUNT=y

Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 configs/imx8qxp_capricorn.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index b5c9fdbc9b3..626634cb09c 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -74,6 +74,7 @@ CONFIG_CMD_CPU=y
 # CONFIG_CMD_BIND is not set
 CONFIG_CMD_WDT=y
 CONFIG_CMD_WGET=y
+CONFIG_CMD_BOOTCOUNT=y
 CONFIG_CMD_CLK=y
 CONFIG_CMD_DM=y
 CONFIG_CMD_FUSE=y
-- 
2.20.1

Re: [PATCH v1 06/11] capricorn: config: add bootcounter command

[Peng Fan]

Hi Heiko,

On Sat, Jan 24, 2026 at 06:54:47AM +0100, Heiko Schocher wrote:
>enable
>CONFIG_CMD_BOOTCOUNT=y

If my understanding is correct,
Nitpick: Enable CMD_BOOTCOUNT to count the boot times

Acked-by: Peng Fan <peng.fan@nxp.com>

Thanks,
Peng
>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>
>---
>
> configs/imx8qxp_capricorn.config | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
>index b5c9fdbc9b3..626634cb09c 100644
>--- a/configs/imx8qxp_capricorn.config
>+++ b/configs/imx8qxp_capricorn.config
>@@ -74,6 +74,7 @@ CONFIG_CMD_CPU=y
> # CONFIG_CMD_BIND is not set
> CONFIG_CMD_WDT=y
> CONFIG_CMD_WGET=y
>+CONFIG_CMD_BOOTCOUNT=y
> CONFIG_CMD_CLK=y
> CONFIG_CMD_DM=y
> CONFIG_CMD_FUSE=y
>-- 
>2.20.1
>

Re: [PATCH v1 06/11] capricorn: config: add bootcounter command

[Heiko Schocher]

Hello Peng,

On 26.01.26 02:22, Peng Fan wrote:
> Hi Heiko,
> 
> On Sat, Jan 24, 2026 at 06:54:47AM +0100, Heiko Schocher wrote:
>> enable
>> CONFIG_CMD_BOOTCOUNT=y
> 
> If my understanding is correct,
> Nitpick: Enable CMD_BOOTCOUNT to count the boot times

Indeed. Change to

Enable bootcount feature to count the boot times

Thanks!

bye,
Heiko

> Acked-by: Peng Fan <peng.fan@nxp.com>
> 
> Thanks,
> Peng
>>
>> Signed-off-by: Heiko Schocher <hs@nabladev.com>
>> ---
>>
>> configs/imx8qxp_capricorn.config | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
>> index b5c9fdbc9b3..626634cb09c 100644
>> --- a/configs/imx8qxp_capricorn.config
>> +++ b/configs/imx8qxp_capricorn.config
>> @@ -74,6 +74,7 @@ CONFIG_CMD_CPU=y
>> # CONFIG_CMD_BIND is not set
>> CONFIG_CMD_WDT=y
>> CONFIG_CMD_WGET=y
>> +CONFIG_CMD_BOOTCOUNT=y
>> CONFIG_CMD_CLK=y
>> CONFIG_CMD_DM=y
>> CONFIG_CMD_FUSE=y
>> -- 
>> 2.20.1
>>

-- 
Nabla Software Engineering
HRB 40522 Augsburg
Phone: +49 821 45592596
E-Mail: office@nabladev.com
Geschäftsführer : Stefano Babic

[PATCH v1 07/11] siemens: capricorn: add logic to U-Boot to avoid zig-zag boot

[Heiko Schocher]

add logic in board code for detecting the real boot
partition and set a local hush shell variable fallback
which can be used later in boot variables for detecting
a ROMbootloader fallback case.

We use the local hush shell variable, as we do not want
to save in any case the fallback variable in U-Boot
Environment, as the default Environment is may saved
in boards, which are downgraded to older U-Boot versions.

And than the board code does not run, and fallback never
gets the correct value.

Introduce also hush shell variable envvers to value "v2_"
so we can use them in Environment for running different
versions of variables between new and old U-Boot images.

Signed-off-by: Heiko Schocher <hs@nabladev.com>
Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
---

 board/siemens/capricorn/Kconfig |  2 ++
 board/siemens/capricorn/board.c | 43 +++++++++++++++++++++++++++------
 2 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/board/siemens/capricorn/Kconfig b/board/siemens/capricorn/Kconfig
index fe230971e97..d6d1aad75b2 100644
--- a/board/siemens/capricorn/Kconfig
+++ b/board/siemens/capricorn/Kconfig
@@ -1,5 +1,7 @@
 if TARGET_CAPRICORN
 
+config HUSH_INIT_VAR
+	def_bool y
 
 config SYS_BOARD
 	default "capricorn"
diff --git a/board/siemens/capricorn/board.c b/board/siemens/capricorn/board.c
index 390a7b0d841..d4f26b6ff7f 100644
--- a/board/siemens/capricorn/board.c
+++ b/board/siemens/capricorn/board.c
@@ -5,6 +5,7 @@
  * Copyright 2019 Siemens AG
  *
  */
+#include <cli_hush.h>
 #include <command.h>
 #include <dm.h>
 #include <env.h>
@@ -29,6 +30,7 @@
 #include "../common/board.h"
 #include "../common/eeprom.h"
 #include "../common/factoryset.h"
+#include <firmware/imx/sci/sci.h>
 
 #define GPIO_PAD_CTRL \
 		((SC_PAD_CONFIG_NORMAL << PADRING_CONFIG_SHIFT) | \
@@ -373,23 +375,48 @@ __weak int mmc_map_to_kernel_blk(int dev_no)
 
 void board_late_mmc_env_init(void)
 {
-	char cmd[32];
-	char mmcblk[32];
 	u32 dev_no = mmc_get_env_dev();
 
 	if (!check_mmc_autodetect())
 		return;
 
 	env_set_ulong("mmcdev", dev_no);
+}
+
+#if defined(CONFIG_HUSH_INIT_VAR)
+int hush_init_var(void)
+{
+	sc_misc_bt_t boot_type;
 
-	/* Set mmcblk env */
-	sprintf(mmcblk, "/dev/mmcblk%dp2 rootwait rw",
-		mmc_map_to_kernel_blk(dev_no));
-	env_set("mmcroot", mmcblk);
+	if (sc_misc_get_boot_type(-1, &boot_type) != 0) {
+		puts("boottype cannot be retrieved\n");
+		return 0;
+	}
+
+	/*
+	 * Set here explicitly a hush shell variable, so if a saveenv
+	 * happens, this variable is *not* saved in U-Boot environment.
+	 *
+	 * This is for devices which are already in the field essential,
+	 * as if such a device breaks, the cutsomer gets a new device
+	 * with a new U-Boot version (and so a new U-Boot environment).
+	 *
+	 * But the customer makes a downgrade to an older U-bootversion,
+	 * which does not have this code in, and runs now with a new
+	 * U-Boot Environment (yes, protected Environment is not enabled
+	 * there) and the old U-Boot must still work with the new U-Boot
+	 * Environment. So we cannot store this variable in U-Boot
+	 * Environment as a stored value will in this case never be over-
+	 * written.
+	 */
+	if (boot_type == 1) {
+		printf("boot-container fallback ocured\n");
+		set_local_var("fallback=1", 0);
+	}
 
-	sprintf(cmd, "mmc dev %d", dev_no);
-	run_command(cmd, 0);
+	return 0;
 }
+#endif
 
 #ifndef CONFIG_XPL_BUILD
 static int load_parameters_from_factoryset(void)
-- 
2.20.1

Re: [PATCH v1 07/11] siemens: capricorn: add logic to U-Boot to avoid zig-zag boot

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:48AM +0100, Heiko Schocher wrote:
>add logic in board code for detecting the real boot
>partition and set a local hush shell variable fallback
>which can be used later in boot variables for detecting
>a ROMbootloader fallback case.

Typo: ROM bootloader

>
>We use the local hush shell variable, as we do not want
>to save in any case the fallback variable in U-Boot
>Environment, as the default Environment is may saved

Typo: maybe

>in boards, which are downgraded to older U-Boot versions.
>
>And than the board code does not run, and fallback never
>gets the correct value.
>
>Introduce also hush shell variable envvers to value "v2_"
>so we can use them in Environment for running different
>versions of variables between new and old U-Boot images.
>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>
>Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
>---
>
> board/siemens/capricorn/Kconfig |  2 ++
> board/siemens/capricorn/board.c | 43 +++++++++++++++++++++++++++------
> 2 files changed, 37 insertions(+), 8 deletions(-)
>
>diff --git a/board/siemens/capricorn/Kconfig b/board/siemens/capricorn/Kconfig
>index fe230971e97..d6d1aad75b2 100644
>--- a/board/siemens/capricorn/Kconfig
>+++ b/board/siemens/capricorn/Kconfig
>@@ -1,5 +1,7 @@
> if TARGET_CAPRICORN
> 
>+config HUSH_INIT_VAR
>+	def_bool y
> 
> config SYS_BOARD
> 	default "capricorn"
>diff --git a/board/siemens/capricorn/board.c b/board/siemens/capricorn/board.c
>index 390a7b0d841..d4f26b6ff7f 100644
>--- a/board/siemens/capricorn/board.c
>+++ b/board/siemens/capricorn/board.c
>@@ -5,6 +5,7 @@
>  * Copyright 2019 Siemens AG
>  *
>  */
>+#include <cli_hush.h>
> #include <command.h>
> #include <dm.h>
> #include <env.h>
>@@ -29,6 +30,7 @@
> #include "../common/board.h"
> #include "../common/eeprom.h"
> #include "../common/factoryset.h"
>+#include <firmware/imx/sci/sci.h>
> 
> #define GPIO_PAD_CTRL \
> 		((SC_PAD_CONFIG_NORMAL << PADRING_CONFIG_SHIFT) | \
>@@ -373,23 +375,48 @@ __weak int mmc_map_to_kernel_blk(int dev_no)
> 
> void board_late_mmc_env_init(void)
> {
>-	char cmd[32];
>-	char mmcblk[32];
> 	u32 dev_no = mmc_get_env_dev();
> 
> 	if (!check_mmc_autodetect())
> 		return;
> 
> 	env_set_ulong("mmcdev", dev_no);
>+}
>+
>+#if defined(CONFIG_HUSH_INIT_VAR)
>+int hush_init_var(void)
>+{
>+	sc_misc_bt_t boot_type;
> 
>-	/* Set mmcblk env */
>-	sprintf(mmcblk, "/dev/mmcblk%dp2 rootwait rw",
>-		mmc_map_to_kernel_blk(dev_no));
>-	env_set("mmcroot", mmcblk);
>+	if (sc_misc_get_boot_type(-1, &boot_type) != 0) {
>+		puts("boottype cannot be retrieved\n");
>+		return 0;
>+	}
>+
>+	/*
>+	 * Set here explicitly a hush shell variable, so if a saveenv
>+	 * happens, this variable is *not* saved in U-Boot environment.
>+	 *
>+	 * This is for devices which are already in the field essential,
>+	 * as if such a device breaks, the cutsomer gets a new device
>+	 * with a new U-Boot version (and so a new U-Boot environment).
>+	 *
>+	 * But the customer makes a downgrade to an older U-bootversion,

Typo: U-Boot version.


Otherwise: 

Reviewed-by: Peng Fan <peng.fan@nxp.com>

Re: [PATCH v1 07/11] siemens: capricorn: add logic to U-Boot to avoid zig-zag boot

[Heiko Schocher]

Hello Peng,

On 26.01.26 02:29, Peng Fan wrote:
> On Sat, Jan 24, 2026 at 06:54:48AM +0100, Heiko Schocher wrote:
>> add logic in board code for detecting the real boot
>> partition and set a local hush shell variable fallback
>> which can be used later in boot variables for detecting
>> a ROMbootloader fallback case.
> 
> Typo: ROM bootloader

Fixed

> 
>>
>> We use the local hush shell variable, as we do not want
>> to save in any case the fallback variable in U-Boot
>> Environment, as the default Environment is may saved
> 
> Typo: maybe

Fixed

> 
>> in boards, which are downgraded to older U-Boot versions.
>>
>> And than the board code does not run, and fallback never
>> gets the correct value.
>>
>> Introduce also hush shell variable envvers to value "v2_"
>> so we can use them in Environment for running different
>> versions of variables between new and old U-Boot images.
>>
>> Signed-off-by: Heiko Schocher <hs@nabladev.com>
>> Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
>> ---
>>
>> board/siemens/capricorn/Kconfig |  2 ++
>> board/siemens/capricorn/board.c | 43 +++++++++++++++++++++++++++------
>> 2 files changed, 37 insertions(+), 8 deletions(-)
>>
>> diff --git a/board/siemens/capricorn/Kconfig b/board/siemens/capricorn/Kconfig
>> index fe230971e97..d6d1aad75b2 100644
>> --- a/board/siemens/capricorn/Kconfig
>> +++ b/board/siemens/capricorn/Kconfig
>> @@ -1,5 +1,7 @@
>> if TARGET_CAPRICORN
>>
>> +config HUSH_INIT_VAR
>> +	def_bool y
>>
>> config SYS_BOARD
>> 	default "capricorn"
>> diff --git a/board/siemens/capricorn/board.c b/board/siemens/capricorn/board.c
>> index 390a7b0d841..d4f26b6ff7f 100644
>> --- a/board/siemens/capricorn/board.c
>> +++ b/board/siemens/capricorn/board.c
>> @@ -5,6 +5,7 @@
>>   * Copyright 2019 Siemens AG
>>   *
>>   */
>> +#include <cli_hush.h>
>> #include <command.h>
>> #include <dm.h>
>> #include <env.h>
>> @@ -29,6 +30,7 @@
>> #include "../common/board.h"
>> #include "../common/eeprom.h"
>> #include "../common/factoryset.h"
>> +#include <firmware/imx/sci/sci.h>
>>
>> #define GPIO_PAD_CTRL \
>> 		((SC_PAD_CONFIG_NORMAL << PADRING_CONFIG_SHIFT) | \
>> @@ -373,23 +375,48 @@ __weak int mmc_map_to_kernel_blk(int dev_no)
>>
>> void board_late_mmc_env_init(void)
>> {
>> -	char cmd[32];
>> -	char mmcblk[32];
>> 	u32 dev_no = mmc_get_env_dev();
>>
>> 	if (!check_mmc_autodetect())
>> 		return;
>>
>> 	env_set_ulong("mmcdev", dev_no);
>> +}
>> +
>> +#if defined(CONFIG_HUSH_INIT_VAR)
>> +int hush_init_var(void)
>> +{
>> +	sc_misc_bt_t boot_type;
>>
>> -	/* Set mmcblk env */
>> -	sprintf(mmcblk, "/dev/mmcblk%dp2 rootwait rw",
>> -		mmc_map_to_kernel_blk(dev_no));
>> -	env_set("mmcroot", mmcblk);
>> +	if (sc_misc_get_boot_type(-1, &boot_type) != 0) {
>> +		puts("boottype cannot be retrieved\n");
>> +		return 0;
>> +	}
>> +
>> +	/*
>> +	 * Set here explicitly a hush shell variable, so if a saveenv
>> +	 * happens, this variable is *not* saved in U-Boot environment.
>> +	 *
>> +	 * This is for devices which are already in the field essential,
>> +	 * as if such a device breaks, the cutsomer gets a new device
>> +	 * with a new U-Boot version (and so a new U-Boot environment).
>> +	 *
>> +	 * But the customer makes a downgrade to an older U-bootversion,
> 
> Typo: U-Boot version.

Fixed.

> 
> 
> Otherwise:
> 
> Reviewed-by: Peng Fan <peng.fan@nxp.com>

Many thanks for your review of all the patches!

I worked in all your comments for the series, try to make a test which Benjamin
requested yesterday for patch:

"env: add w flags for net config in explicit write mode"
https://patchwork.ozlabs.org/project/uboot/patch/20260124054040.7597-1-hs@nabladev.com/

and wait for more comments before I resend v2.

Thanks!

bye,
Heiko
> 

-- 
Nabla Software Engineering
HRB 40522 Augsburg
Phone: +49 821 45592596
E-Mail: office@nabladev.com
Geschäftsführer : Stefano Babic

[PATCH v1 08/11] siemens: capricorn: always detect emmc device

[Heiko Schocher]

drop Environment variable mmcautodetect and the board logic
behind it, as we want always to autodetct the emmc device.

Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 board/siemens/capricorn/board.c               | 13 -------------
 board/siemens/capricorn/capricorn_default.env |  1 -
 2 files changed, 14 deletions(-)

diff --git a/board/siemens/capricorn/board.c b/board/siemens/capricorn/board.c
index d4f26b6ff7f..bce343714eb 100644
--- a/board/siemens/capricorn/board.c
+++ b/board/siemens/capricorn/board.c
@@ -357,16 +357,6 @@ int board_mmc_get_env_dev(int devno)
 	return devno;
 }
 
-static int check_mmc_autodetect(void)
-{
-	char *autodetect_str = env_get("mmcautodetect");
-
-	if (autodetect_str && (strcmp(autodetect_str, "yes") == 0))
-		return 1;
-
-	return 0;
-}
-
 /* This should be defined for each board */
 __weak int mmc_map_to_kernel_blk(int dev_no)
 {
@@ -377,9 +367,6 @@ void board_late_mmc_env_init(void)
 {
 	u32 dev_no = mmc_get_env_dev();
 
-	if (!check_mmc_autodetect())
-		return;
-
 	env_set_ulong("mmcdev", dev_no);
 }
 
diff --git a/board/siemens/capricorn/capricorn_default.env b/board/siemens/capricorn/capricorn_default.env
index c8b5b3d7da3..ad88f7ed770 100644
--- a/board/siemens/capricorn/capricorn_default.env
+++ b/board/siemens/capricorn/capricorn_default.env
@@ -45,4 +45,3 @@ kboot=booti
 bootcmd_mfg=run mfgtool_args; if iminfo ${initrd_addr}; then if test ${tee} = yes; then bootm ${tee_addr} ${initrd_addr} ${fdt_addr}; else booti ${loadaddr} ${initrd_addr} ${fdt_addr}; fi; else echo "Run fastboot ..."; fastboot usb auto; fi;
 fastboot_bytes=124c00
 fastboot_dev=mmc
-mmcautodetect=yes
-- 
2.20.1

Re: [PATCH v1 08/11] siemens: capricorn: always detect emmc device

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:49AM +0100, Heiko Schocher wrote:
>drop Environment variable mmcautodetect and the board logic
>behind it, as we want always to autodetct the emmc device.
>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>


Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 09/11] siemens: capricorn: fix fallback bootm call for fitImage

[Heiko Schocher]

From: Walter Schweizer <walter.schweizer@siemens.com>

When dtb_name is missing or a configuration is missing, try to
boot the default configuration in the image. The call to bootm needs
the correct loadaddr to succeed.

Fixes booting when factoryset is missing.

Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---
Ignore checkpatch warning:
WARNING: line length of 266 exceeds 100 columns

 board/siemens/capricorn/capricorn_default.env | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/board/siemens/capricorn/capricorn_default.env b/board/siemens/capricorn/capricorn_default.env
index ad88f7ed770..cf5bd09a4da 100644
--- a/board/siemens/capricorn/capricorn_default.env
+++ b/board/siemens/capricorn/capricorn_default.env
@@ -20,7 +20,7 @@ ip_method=none
 kernel_name=Image
 loadaddr=0x80400000
 mmc_boot=run set_bootargs;run check_upgrade; run set_partition;run set_bootargs_mmc;run mmc_load_bootfiles
-mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;if test -n ${A};then setenv bootargs ${bootargs} rootfs_sig=${sig_a};fi;if test -n ${B};then setenv bootargs ${bootargs} rootfs_sig=${sig_b};fi;bootm 0x88000000#conf-${dtb_name}.dtb;bootm
+mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;if test -n ${A};then setenv bootargs ${bootargs} rootfs_sig=${sig_a};fi;if test -n ${B};then setenv bootargs ${bootargs} rootfs_sig=${sig_b};fi;bootm 0x88000000#conf-${dtb_name}.dtb;bootm 0x88000000
 mmc_boot_image=ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name}.dtb;if test $? -eq 1;then ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name_default}.dtb;fi; ext4load mmc 0:${mmc_part_nr} ${loadaddr} boot/${kernel_name}; booti ${loadaddr} - ${fdt_addr}
 mmc_load_bootfiles=echo -n Loading from eMMC ...; if test -e mmc 0:${mmc_part_nr} boot/fitImage; then echo fit; setenv fdt_high; setenv initrd_high; run mmc_boot_fit; else echo image; run mmc_boot_image; fi
 net_nfs=wdt dev scu-wdt; wdt stop; echo Booting from network ...; run set_bootargs_net; tftpboot ${loadaddr} ${bootdir}/${kernel_name}; printenv bootargs; if test ${kernel_name} = fitImage; then setenv fdt_high; setenv initrd_high; bootm ${loadaddr}#conf-${dtb_name}.dtb; else tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name}.dtb; if test $? -eq 1; then echo Loading default.dtb!; tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name_default}.dtb; fi; booti ${loadaddr} - ${fdt_addr}; fi
-- 
2.20.1

Re: [PATCH v1 09/11] siemens: capricorn: fix fallback bootm call for fitImage

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:50AM +0100, Heiko Schocher wrote:
>From: Walter Schweizer <walter.schweizer@siemens.com>
>
>When dtb_name is missing or a configuration is missing, try to
>boot the default configuration in the image. The call to bootm needs
>the correct loadaddr to succeed.
>
>Fixes booting when factoryset is missing.
>
>Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 10/11] siemens: capricorn: rework bootcmd environment variables

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

Rework the boot state machine to a significantly simpler and more
robust implementation. The basic idea is to revert to the previous
partition whenever an issue is detected during the boot process.

- Broken SPL

  If one of the two SPLs does not boot, the ROM code of the i.MX8 SoC
  automatically starts the second SPL from the second boot partition.
  For example, if the system's active partition is A but the SPL from
  partition A is broken, the ROM code automatically uses the SPL/u-boot
  from partition B.
  Proceeding with this boot procedure would lead to booting the kernel/
  rootfs from partition A, which could potentially successfully boot
  the system and allow the user to apply the firmware update with the
  broken SPL again. This would lead to a non-bootable system because
  thesecond update would overwrite the last working bootloader.
  To prevent such situations, zigzag boots are detected and the system
  reverts to the previous partition rather than booting the kernel/rootfs
  from the currently active partition. Detecting zigzag boots is done
  via the new fallback variable.

  To make this state machine even more consistent, the partitionset_active
  variable is no longer used to determine the active partition during
  boot. Instead, the active partition is always read from the eMMC
  partconf registers.
  For backward compatibility, the partitionset_active variable is still
  updated whenever a partition switch occurs. However, u-boot no longer
  relies on this variable, as it could potentially be out of sync with
  the actual partition state, leading to situations where the ROM code
  of the i.MX8 SoC would be out of sync with u-boot.

- Broken kernel, initramfs or rootfs

  If the upgrade_available variable is set, u-boot counts the number of
  consecutive boots via the bootcount variable. If the bootcount exceeds
  the bootlimit variable, u-boot starts the altbootcmd instead of the
  bootcmd. Previously, this logic was bypassed by assigning the regular
  bootcmd to altbootcmd. Now, the altbootcmd is used to revert to the
  previous partition when the bootlimit is exceeded.

The netdev variable is changed to eth0 by default. This is what the FEC
driver uses on Capricorn boards. For devices with switches and DSA
subsystems in use, the netdev should be set accordingly by additional
logic in the environment or u-boot code. This is not part of this commit.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---
Ignore checkpatch warning:
board/siemens/capricorn/capricorn_default.env:4: warning: line length of 118 exceeds 100 columns
board/siemens/capricorn/capricorn_default.env:37: warning: line length of 130 exceeds 100 columns
board/siemens/capricorn/capricorn_default.env:40: warning: line length of 321 exceeds 100 columns

 board/siemens/capricorn/capricorn_default.env | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/board/siemens/capricorn/capricorn_default.env b/board/siemens/capricorn/capricorn_default.env
index cf5bd09a4da..9d2eba0181f 100644
--- a/board/siemens/capricorn/capricorn_default.env
+++ b/board/siemens/capricorn/capricorn_default.env
@@ -1,10 +1,10 @@
-altbootcmd=run bootcmd
+altbootcmd=run toggle_partition
 baudrate=115200
 bootcmd=run flash_self;reset;
+bootcmd=if test -n "$fallback"; then echo "fallback: $fallback"; run toggle_partition ; else run flash_self; reset; fi
 bootdelay=3
 bootdir=targetdir/rootfs/boot
 bootlimit=3
-check_upgrade=if test ${upgrade_available} -eq 1; then echo  upgrade_available is set; if test ${bootcount} -gt ${bootlimit}; then setenv upgrade_available 0;echo toggle partition;run toggle_partition;fi;fi;
 cntr_addr=0x88000000
 cntr_file=os_cntr_signed.bin
 console=ttyLP2
@@ -19,13 +19,13 @@ initrd_high=0xffffffffffffffff
 ip_method=none
 kernel_name=Image
 loadaddr=0x80400000
-mmc_boot=run set_bootargs;run check_upgrade; run set_partition;run set_bootargs_mmc;run mmc_load_bootfiles
+mmc_boot=run set_bootargs; run set_partition;run set_bootargs_mmc;run mmc_load_bootfiles
 mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;if test -n ${A};then setenv bootargs ${bootargs} rootfs_sig=${sig_a};fi;if test -n ${B};then setenv bootargs ${bootargs} rootfs_sig=${sig_b};fi;bootm 0x88000000#conf-${dtb_name}.dtb;bootm 0x88000000
 mmc_boot_image=ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name}.dtb;if test $? -eq 1;then ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name_default}.dtb;fi; ext4load mmc 0:${mmc_part_nr} ${loadaddr} boot/${kernel_name}; booti ${loadaddr} - ${fdt_addr}
 mmc_load_bootfiles=echo -n Loading from eMMC ...; if test -e mmc 0:${mmc_part_nr} boot/fitImage; then echo fit; setenv fdt_high; setenv initrd_high; run mmc_boot_fit; else echo image; run mmc_boot_image; fi
 net_nfs=wdt dev scu-wdt; wdt stop; echo Booting from network ...; run set_bootargs_net; tftpboot ${loadaddr} ${bootdir}/${kernel_name}; printenv bootargs; if test ${kernel_name} = fitImage; then setenv fdt_high; setenv initrd_high; bootm ${loadaddr}#conf-${dtb_name}.dtb; else tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name}.dtb; if test $? -eq 1; then echo Loading default.dtb!; tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name_default}.dtb; fi; booti ${loadaddr} - ${fdt_addr}; fi
 net_unfs=setenv nfsopts vers=3,udp,rsize=4096,wsize=4096,nolock,port=3049,mountport=3048 rw; run net_nfs
-netdev=lan0
+netdev=eth0
 nfsopts=vers=3,udp,rsize=4096,wsize=4096,nolock rw
 partitionset_active=A
 rootfs_name=/dev/mmcblk0
@@ -34,9 +34,10 @@ script_file=u-boot-commands.img
 set_bootargs_mmc=setenv bootargs ${bootargs} root=${mmc_active_vol} ro rootdelay=1 rootwait rootfstype=ext4 ip=${ip_method}
 set_bootargs_net=run set_bootargs; if test ${kernel_name} = fitImage; then setenv loadaddr 0x88000000; fi; setenv bootargs ${bootargs} root=/dev/nfs nfsroot=${serverip}:${rootpath},${nfsopts} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off
 set_bootargs=setenv bootargs console=${console},${baudrate} target_env=${target_env} ${testargs} ${optargs}
-set_partition=setenv ${partitionset_active} true;if test -n ${A}; then setenv mmc_part_nr 1;fi;if test -n ${B}; then setenv mmc_part_nr 2;fi;setenv mmc_active_vol ${rootfs_name}p${mmc_part_nr}
+set_partition=mmc partconf 0 v_mmc_part_nr; setenv mmc_part_nr $v_mmc_part_nr; setenv mmc_active_vol ${rootfs_name}p$v_mmc_part_nr
 tftp_run_script=tftpboot ${kernel_loadaddr} ${serverip}:${script_file};if test $? -eq 0;then source ${kernel_loadaddr};fi
-toggle_partition=setenv ${partitionset_active} true; if test -n ${A}; then setenv partitionset_active B; mmc partconf 0 1 2 0; env delete A; fi; if test -n ${B}; then setenv partitionset_active A; mmc partconf 0 1 1 0; env delete B; fi;saveenv; reset
+toggle_partition_fin=bootcount reset; setenv upgrade_available 0; saveenv; reset
+toggle_partition=mmc partconf 0 v_mmc_part_nr; if test $v_mmc_part_nr -eq 1; then mmc partconf 0 1 2 0; setenv partitionset_active B; run toggle_partition_fin; elif test $v_mmc_part_nr -eq 2; then mmc partconf 0 1 1 0; setenv partitionset_active A; run toggle_partition_fin; else echo error mmc_part_nr $v_mmc_part_nr; fi
 upgrade_available=0
 emmc_dev=0
 sd_dev=1
-- 
2.20.1

Re: [PATCH v1 10/11] siemens: capricorn: rework bootcmd environment variables

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:51AM +0100, Heiko Schocher wrote:
>From: Adrian Freihofer <adrian.freihofer@siemens.com>
>
>Rework the boot state machine to a significantly simpler and more
>robust implementation. The basic idea is to revert to the previous
>partition whenever an issue is detected during the boot process.
>
>- Broken SPL
>
>  If one of the two SPLs does not boot, the ROM code of the i.MX8 SoC
>  automatically starts the second SPL from the second boot partition.
>  For example, if the system's active partition is A but the SPL from
>  partition A is broken, the ROM code automatically uses the SPL/u-boot
>  from partition B.
>  Proceeding with this boot procedure would lead to booting the kernel/
>  rootfs from partition A, which could potentially successfully boot
>  the system and allow the user to apply the firmware update with the
>  broken SPL again. This would lead to a non-bootable system because
>  thesecond update would overwrite the last working bootloader.

Nit: the second

>  To prevent such situations, zigzag boots are detected and the system
>  reverts to the previous partition rather than booting the kernel/rootfs
>  from the currently active partition. Detecting zigzag boots is done
>  via the new fallback variable.
>
>  To make this state machine even more consistent, the partitionset_active
>  variable is no longer used to determine the active partition during
>  boot. Instead, the active partition is always read from the eMMC
>  partconf registers.
>  For backward compatibility, the partitionset_active variable is still
>  updated whenever a partition switch occurs. However, u-boot no longer
>  relies on this variable, as it could potentially be out of sync with
>  the actual partition state, leading to situations where the ROM code
>  of the i.MX8 SoC would be out of sync with u-boot.
>
>- Broken kernel, initramfs or rootfs
>
>  If the upgrade_available variable is set, u-boot counts the number of
>  consecutive boots via the bootcount variable. If the bootcount exceeds
>  the bootlimit variable, u-boot starts the altbootcmd instead of the
>  bootcmd. Previously, this logic was bypassed by assigning the regular
>  bootcmd to altbootcmd. Now, the altbootcmd is used to revert to the
>  previous partition when the bootlimit is exceeded.
>
>The netdev variable is changed to eth0 by default. This is what the FEC
>driver uses on Capricorn boards. For devices with switches and DSA
>subsystems in use, the netdev should be set accordingly by additional
>logic in the environment or u-boot code. This is not part of this commit.
>
>Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>


Acked-by: Peng Fan <peng.fan@nxp.com>

[PATCH v1 11/11] siemens: capricorn: protect environment

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

With ENV_WRITEABLE_LIST only specific environment variables lisetd in
CFG_ENV_FLAGS_LIST_STATIC are read from the u-boot environment storage.
All other environment variables are set to default values and are not
written back to the storage.

The u-boot environment usually stays for the lifetime of the product.
There is no A/B copy mechanism as for the firmware itself. That means
that incompatible changes to environment variables in future u-boot
versions may lead to serious issues if the old environment is used with
a new u-boot version or vice versa.

Having this protection in place ensures that only a limited set of
environment variables are persisted across u-boot versions. All the
macros not listed in CFG_ENV_FLAGS_LIST_STATIC are now part of the
u-boot binary which is redundant and immutable. This guarantees that
the u-boot version and the default values of these environment variables
are always in sync and cannot be changed at runtime.

ustate and rastate are not relevant for u-boot itself. ustate is used
by swupdate which persists the transaction state in the environment.
rastate is a similar variable used by another user space application.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
---

 configs/imx8qxp_capricorn.config   |  1 +
 include/configs/capricorn-common.h | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index 626634cb09c..2bae5b1a862 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -12,6 +12,7 @@ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80200000
 CONFIG_ENV_SIZE=0x2000
 CONFIG_ENV_REDUNDANT=y
 CONFIG_ENV_MMC_EMMC_HW_PARTITION=2
+CONFIG_ENV_WRITEABLE_LIST=y
 
 CONFIG_DM_GPIO=y
 CONFIG_AHAB_BOOT=y
diff --git a/include/configs/capricorn-common.h b/include/configs/capricorn-common.h
index 7120a44d186..bbacea09aed 100644
--- a/include/configs/capricorn-common.h
+++ b/include/configs/capricorn-common.h
@@ -38,6 +38,20 @@
 #define CFG_EXTRA_ENV_SETTINGS \
 	AHAB_ENV
 
+#ifdef CONFIG_ENV_WRITEABLE_LIST
+#define CFG_ENV_FLAGS_LIST_STATIC \
+	"bootcount:dw," \
+	"bootdelay:sw," \
+	"bootlimit:dw," \
+	"ip_method:sw," \
+	"partitionset_active:sw," \
+	"rastate:dw," \
+	"sig_a:sw,sig_b:sw," \
+	"target_env:sw," \
+	"upgrade_available:dw," \
+	"ustate:dw"
+#endif
+
 /* Default location for tftp and bootm */
 
 /* On CCP board, USDHC1 is for eMMC */
-- 
2.20.1

Re: [PATCH v1 11/11] siemens: capricorn: protect environment

[Peng Fan]

On Sat, Jan 24, 2026 at 06:54:52AM +0100, Heiko Schocher wrote:
>From: Adrian Freihofer <adrian.freihofer@siemens.com>
>
>With ENV_WRITEABLE_LIST only specific environment variables lisetd in
>CFG_ENV_FLAGS_LIST_STATIC are read from the u-boot environment storage.
>All other environment variables are set to default values and are not
>written back to the storage.
>
>The u-boot environment usually stays for the lifetime of the product.
>There is no A/B copy mechanism as for the firmware itself. That means
>that incompatible changes to environment variables in future u-boot
>versions may lead to serious issues if the old environment is used with
>a new u-boot version or vice versa.
>
>Having this protection in place ensures that only a limited set of
>environment variables are persisted across u-boot versions. All the
>macros not listed in CFG_ENV_FLAGS_LIST_STATIC are now part of the
>u-boot binary which is redundant and immutable. This guarantees that
>the u-boot version and the default values of these environment variables
>are always in sync and cannot be changed at runtime.
>
>ustate and rastate are not relevant for u-boot itself. ustate is used
>by swupdate which persists the transaction state in the environment.
>rastate is a similar variable used by another user space application.
>
>Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>

Reviewed-by: Peng Fan <peng.fan@nxp.com>