[PATCH v3 00/11] imx8qxp: siemens: small board updates

[PATCH v3 00/11] imx8qxp: siemens: small board updates

[Heiko Schocher]

- small DTS fixes
- add wget and bootcounter command
- Environment changes
  - introduce protected Environment
  - a lot of fixes and tries to simplify environment
    as it has grown over the years.

Changes in v3:
Improve the commit message as Marek suggested.
Fix checkpatch warning
board/siemens/capricorn/capricorn_default.env:23: warning: line length of 266 exceeds 100 columns
as Max suggested
fixed long line length in environment file as Max suggested.

Changes in v2:
- rebased to mainline
  b99da05e153 - (tag: v2026.04-rc2, origin/master, origin/HEAD) Prepare v2026.04-rc2
- respell the commit message as Peng suggested
Added Reviewed-by from Peng
Added Reviewed-by from Peng
Added Reviewed-by from Peng
Added Reviewed-by from Peng
Added Reviewed-by from Peng
enhanced commit message
Added Reviewed-by from Peng
fixed typos in commit message and board code
Added Reviewed-by from Peng
Added Reviewed-by from Peng
Added Acked-by from Peng, fixed typo in commit message
Added small fixes in Environment from Adrian: It fixes a serious bug which
Adrian detect. It occurs when a broken firmware is applied as a downgrade.
The old bootloader ended up in an endless reboot boot loop. With this fix
also the old bootloader is able to reject the update and recover. Also
slightly reworked bootcmd.
Added Reviewed-by from Peng
Reworked writeable variable list, as we dropped patch
"env: add w flags for net config in explicit write mode"

Adrian Freihofer (3):
  siemens: capricorn: set max-frequency for usdhc1
  siemens: capricorn: rework bootcmd environment variables
  siemens: capricorn: protect environment

Heiko Schocher (3):
  capricorn: config: add bootcounter command
  siemens: capricorn: add logic to U-Boot to avoid zig-zag boot
  siemens: capricorn: always detect emmc device

Lukas Stockmann (3):
  arm: dts: capricorn: pinctrl_usdhc1 cleanup
  arm: dts: capricorn: remove pinctrl_usdhc2
  arm: dts: capricorn: move fec2 config

Walter Schweizer (2):
  imx8qxp_capricorn config: add wget command
  siemens: capricorn: fix fallback bootm call for fitImage

 arch/arm/dts/imx8-capricorn-cxg3.dts          |  44 ++++++++
 arch/arm/dts/imx8-capricorn.dtsi              |  60 +----------
 board/siemens/capricorn/Kconfig               |   2 +
 board/siemens/capricorn/board.c               |  56 ++++++----
 board/siemens/capricorn/capricorn_default.env | 100 ++++++++++++++----
 configs/imx8qxp_capricorn.config              |   3 +
 include/configs/capricorn-common.h            |  13 +++
 7 files changed, 180 insertions(+), 98 deletions(-)

-- 
2.20.1

base-commit: 093253c7fe00ee0bb1d63f565616c576f95b16ef

[PATCH v3 01/11] arm: dts: capricorn: pinctrl_usdhc1 cleanup

[Heiko Schocher]

From: Lukas Stockmann <lukas.stockmann@siemens.com>

gpio4.29 belongs to eth0 and not to emmc0 and is
handled by the mainboard dts and not here in the
cpu module dtsi.

Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>

---

(no changes since v2)

Changes in v2:
- rebased to mainline
  b99da05e153 - (tag: v2026.04-rc2, origin/master, origin/HEAD) Prepare v2026.04-rc2
- respell the commit message as Peng suggested

 arch/arm/dts/imx8-capricorn.dtsi | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index 3734a9d21f1..38d36fafbe0 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -63,7 +63,6 @@
 				SC_P_EMMC0_DATA7_CONN_EMMC0_DATA7	0x00000021
 				SC_P_EMMC0_STROBE_CONN_EMMC0_STROBE	0x06000041
 				SC_P_EMMC0_RESET_B_CONN_EMMC0_RESET_B	0x00000021
-				SC_P_ENET0_RGMII_TXC_LSIO_GPIO4_IO29	0x06000021
 			>;
 		};
 
-- 
2.20.1

Re: [PATCH v3 01/11] arm: dts: capricorn: pinctrl_usdhc1 cleanup

[Peng Fan]

On Tue, Feb 17, 2026 at 05:39:01PM +0100, Heiko Schocher wrote:
>From: Lukas Stockmann <lukas.stockmann@siemens.com>
>
>gpio4.29 belongs to eth0 and not to emmc0 and is
>handled by the mainboard dts and not here in the
>cpu module dtsi.
>
>Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
>Signed-off-by: Heiko Schocher <hs@nabladev.com>
>

Reviewed-by: Peng Fan <peng.fan@nxp.com>

[PATCH v3 02/11] siemens: capricorn: set max-frequency for usdhc1

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

This is required since

commit aebb523a2381 ("mmc: mmc-uclass: Use max-frequency from device tree with default handling")

and the related patches of the same series.

The error observed without this change is:
  Autobooting in 3 seconds, press "<Esc><Esc>" to stop
  EXT_CSD[179], PARTITION_CONFIG:
  BOOT_ACK: 0x0
  BOOT_PARTITION_ENABLE: 0x1 (boot0)
  PARTITION_ACCESS: 0x0 (user)
  Loading from eMMC ...fit

  U-Boot SPL 2026.01-4238dcfcbfe (Jan 09 2026 - 08:19:45 +0000)

For this example it's the following commands which does no longer work
for larger images:

  ext4load mmc 0:1 0x88000000 boot/fitImage

On latest master branch the problematic commit gets reverted with

commit c4f5b1d4b037 ("Revert "mmc: mmc-uclass: Use max-frequency from device tree with default handling"")

but for v2026.01 this fix is still required. Maybe it's anyway a good
idea to have this property set explicitly.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng

 arch/arm/dts/imx8-capricorn.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index 38d36fafbe0..fab7ef95166 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -125,6 +125,7 @@
 &usdhc1 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_usdhc1>;
+	max-frequency = <52000000>;
 	clock-frequency=<52000000>;
 	no-1-8-v;
 	bus-width = <8>;
-- 
2.20.1

[PATCH v3 03/11] arm: dts: capricorn: remove pinctrl_usdhc2

[Heiko Schocher]

From: Lukas Stockmann <lukas.stockmann@siemens.com>

usdhc2 is not used on the Capricorn board.

Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng

 arch/arm/dts/imx8-capricorn.dtsi | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index fab7ef95166..41f4b2f646b 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -66,20 +66,6 @@
 			>;
 		};
 
-		pinctrl_usdhc2: usdhc2grp {
-			fsl,pins = <
-				SC_P_ENET0_RGMII_RXC_CONN_USDHC1_CLK	0x06000041
-				SC_P_ENET0_RGMII_RX_CTL_CONN_USDHC1_CMD	0x00000021
-				SC_P_ENET0_RGMII_RXD0_CONN_USDHC1_DATA0	0x00000021
-				SC_P_ENET0_RGMII_RXD1_CONN_USDHC1_DATA1	0x00000021
-				SC_P_ENET0_RGMII_RXD2_CONN_USDHC1_DATA2	0x00000021
-				SC_P_ENET0_RGMII_RXD3_CONN_USDHC1_DATA3	0x00000021
-				SC_P_ENET0_RGMII_TXD2_CONN_USDHC1_CD_B	0x06000021
-				//SC_P_ENET0_RGMII_TXD2_LSIO_GPIO5_IO01	0x06000021
-				SC_P_ENET0_RGMII_TX_CTL_LSIO_GPIO4_IO30	0x06000021
-			>;
-		};
-
 		pinctrl_fec2: fec2grp {
 			fsl,pins = <
 				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB0_PAD	0x000014a0
-- 
2.20.1

[PATCH v3 04/11] arm: dts: capricorn: move fec2 config

[Heiko Schocher]

From: Lukas Stockmann <lukas.stockmann@siemens.com>

fec2 config does not belong to the Capricorn CPU module, move it to
the main board.

Signed-off-by: Lukas Stockmann <lukas.stockmann@siemens.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng

 arch/arm/dts/imx8-capricorn-cxg3.dts | 44 ++++++++++++++++++++++++++++
 arch/arm/dts/imx8-capricorn.dtsi     | 44 ----------------------------
 2 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/arch/arm/dts/imx8-capricorn-cxg3.dts b/arch/arm/dts/imx8-capricorn-cxg3.dts
index 2f8597579f3..b40410b2b6f 100644
--- a/arch/arm/dts/imx8-capricorn-cxg3.dts
+++ b/arch/arm/dts/imx8-capricorn-cxg3.dts
@@ -102,6 +102,26 @@
 	pinctrl-0 = <&pinctrl_gpio_keys>;
 
 	muxcgrp: imx8qxp-som {
+		pinctrl_fec2: fec2grp {
+			fsl,pins = <
+				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB0_PAD	0x000014a0
+				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB1_PAD	0x000014a0
+				SC_P_COMP_CTL_GPIO_1V8_3V3_GPIORHB_PAD		0x000514a0
+
+				SC_P_ENET0_MDC_CONN_ENET1_MDC			0x00000060
+				SC_P_ENET0_MDIO_CONN_ENET1_MDIO			0x00000060
+
+				SC_P_ESAI0_FSR_CONN_ENET1_RCLK50M_IN		0x00000060
+				SC_P_SPDIF0_RX_CONN_ENET1_RGMII_RXD0		0x00000060
+				SC_P_ESAI0_TX3_RX2_CONN_ENET1_RGMII_RXD1	0x00000060
+				SC_P_ESAI0_TX2_RX3_CONN_ENET1_RMII_RX_ER	0x00000060
+				SC_P_SPDIF0_TX_CONN_ENET1_RGMII_RX_CTL		0x00000060
+				SC_P_ESAI0_TX4_RX1_CONN_ENET1_RGMII_TXD0	0x00000060
+				SC_P_ESAI0_TX5_RX0_CONN_ENET1_RGMII_TXD1	0x00000060
+				SC_P_ESAI0_SCKR_CONN_ENET1_RGMII_TX_CTL		0x00000060
+			>;
+		};
+
 		pinctrl_gpio_leds: gpioledsgrp {
 			fsl,pins = <
 			SC_P_ESAI0_FST_LSIO_GPIO0_IO01		0x06000021
@@ -127,3 +147,27 @@
 		>;
 	};
 };
+
+&fec2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_fec2>;
+	phy-mode = "rmii";
+
+	phy-handle = <&ethphy1>;
+	fsl,magic-packet;
+	status = "okay";
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		ethphy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <0>;
+		};
+		ethphy1: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+		};
+	};
+};
diff --git a/arch/arm/dts/imx8-capricorn.dtsi b/arch/arm/dts/imx8-capricorn.dtsi
index 41f4b2f646b..f640daa775f 100644
--- a/arch/arm/dts/imx8-capricorn.dtsi
+++ b/arch/arm/dts/imx8-capricorn.dtsi
@@ -65,26 +65,6 @@
 				SC_P_EMMC0_RESET_B_CONN_EMMC0_RESET_B	0x00000021
 			>;
 		};
-
-		pinctrl_fec2: fec2grp {
-			fsl,pins = <
-				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB0_PAD	0x000014a0
-				SC_P_COMP_CTL_GPIO_1V8_3V3_ENET_ENETB1_PAD	0x000014a0
-				SC_P_COMP_CTL_GPIO_1V8_3V3_GPIORHB_PAD		0x000514a0
-
-				SC_P_ENET0_MDC_CONN_ENET1_MDC                   0x00000060
-				SC_P_ENET0_MDIO_CONN_ENET1_MDIO                 0x00000060
-
-				SC_P_ESAI0_FSR_CONN_ENET1_RCLK50M_IN            0x00000060
-				SC_P_SPDIF0_RX_CONN_ENET1_RGMII_RXD0            0x00000060
-				SC_P_ESAI0_TX3_RX2_CONN_ENET1_RGMII_RXD1        0x00000060
-				SC_P_ESAI0_TX2_RX3_CONN_ENET1_RMII_RX_ER        0x00000060
-				SC_P_SPDIF0_TX_CONN_ENET1_RGMII_RX_CTL          0x00000060
-				SC_P_ESAI0_TX4_RX1_CONN_ENET1_RGMII_TXD0        0x00000060
-				SC_P_ESAI0_TX5_RX0_CONN_ENET1_RGMII_TXD1        0x00000060
-				SC_P_ESAI0_SCKR_CONN_ENET1_RGMII_TX_CTL         0x00000060	/* ERST: Reset pin */
-			>;
-		};
 	};
 };
 
@@ -146,27 +126,3 @@
 &fec1 {
 	status ="disabled";
 };
-
-&fec2 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&pinctrl_fec2>;
-	phy-mode = "rmii";
-
-	phy-handle = <&ethphy1>;
-	fsl,magic-packet;
-	status = "okay";
-
-	mdio {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		ethphy0: ethernet-phy@0 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <0>;
-		};
-		ethphy1: ethernet-phy@1 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <1>;
-		};
-	};
-};
-- 
2.20.1

[PATCH v3 05/11] imx8qxp_capricorn config: add wget command

[Heiko Schocher]

From: Walter Schweizer <walter.schweizer@siemens.com>

Enable the "wget" command to allow download using TCP / HTTP protocol.
This is faster than TFTP download.

Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
Reviewed-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

Changes in v3:
Improve the commit message as Marek suggested.

Changes in v2:
Added Reviewed-by from Peng

 configs/imx8qxp_capricorn.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index 62babf2626f..b5c9fdbc9b3 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -73,6 +73,7 @@ CONFIG_CMD_CPU=y
 # CONFIG_CMD_CRC32 is not set
 # CONFIG_CMD_BIND is not set
 CONFIG_CMD_WDT=y
+CONFIG_CMD_WGET=y
 CONFIG_CMD_CLK=y
 CONFIG_CMD_DM=y
 CONFIG_CMD_FUSE=y
-- 
2.20.1

[PATCH v3 06/11] capricorn: config: add bootcounter command

[Heiko Schocher]

Enable bootcount feature to count the boot times

Signed-off-by: Heiko Schocher <hs@nabladev.com>
Acked-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng
enhanced commit message

 configs/imx8qxp_capricorn.config | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index b5c9fdbc9b3..626634cb09c 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -74,6 +74,7 @@ CONFIG_CMD_CPU=y
 # CONFIG_CMD_BIND is not set
 CONFIG_CMD_WDT=y
 CONFIG_CMD_WGET=y
+CONFIG_CMD_BOOTCOUNT=y
 CONFIG_CMD_CLK=y
 CONFIG_CMD_DM=y
 CONFIG_CMD_FUSE=y
-- 
2.20.1

[PATCH v3 07/11] siemens: capricorn: add logic to U-Boot to avoid zig-zag boot

[Heiko Schocher]

add logic in board code for detecting the real boot
partition and set a local hush shell variable fallback
which can be used later in boot variables for detecting
a ROM bootloader fallback case.

We use the local hush shell variable, as we do not want
to save in any case the fallback variable in U-Boot
Environment, as the default Environment is maybe saved
in boards, which are downgraded to older U-Boot versions.

And than the board code does not run, and fallback never
gets the correct value.

Introduce also hush shell variable envvers to value "v2_"
so we can use them in Environment for running different
versions of variables between new and old U-Boot images.

Signed-off-by: Heiko Schocher <hs@nabladev.com>
Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng
fixed typos in commit message and board code

 board/siemens/capricorn/Kconfig |  2 ++
 board/siemens/capricorn/board.c | 43 +++++++++++++++++++++++++++------
 2 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/board/siemens/capricorn/Kconfig b/board/siemens/capricorn/Kconfig
index fe230971e97..d6d1aad75b2 100644
--- a/board/siemens/capricorn/Kconfig
+++ b/board/siemens/capricorn/Kconfig
@@ -1,5 +1,7 @@
 if TARGET_CAPRICORN
 
+config HUSH_INIT_VAR
+	def_bool y
 
 config SYS_BOARD
 	default "capricorn"
diff --git a/board/siemens/capricorn/board.c b/board/siemens/capricorn/board.c
index 390a7b0d841..34e7f2d1713 100644
--- a/board/siemens/capricorn/board.c
+++ b/board/siemens/capricorn/board.c
@@ -5,6 +5,7 @@
  * Copyright 2019 Siemens AG
  *
  */
+#include <cli_hush.h>
 #include <command.h>
 #include <dm.h>
 #include <env.h>
@@ -29,6 +30,7 @@
 #include "../common/board.h"
 #include "../common/eeprom.h"
 #include "../common/factoryset.h"
+#include <firmware/imx/sci/sci.h>
 
 #define GPIO_PAD_CTRL \
 		((SC_PAD_CONFIG_NORMAL << PADRING_CONFIG_SHIFT) | \
@@ -373,23 +375,48 @@ __weak int mmc_map_to_kernel_blk(int dev_no)
 
 void board_late_mmc_env_init(void)
 {
-	char cmd[32];
-	char mmcblk[32];
 	u32 dev_no = mmc_get_env_dev();
 
 	if (!check_mmc_autodetect())
 		return;
 
 	env_set_ulong("mmcdev", dev_no);
+}
+
+#if defined(CONFIG_HUSH_INIT_VAR)
+int hush_init_var(void)
+{
+	sc_misc_bt_t boot_type;
 
-	/* Set mmcblk env */
-	sprintf(mmcblk, "/dev/mmcblk%dp2 rootwait rw",
-		mmc_map_to_kernel_blk(dev_no));
-	env_set("mmcroot", mmcblk);
+	if (sc_misc_get_boot_type(-1, &boot_type) != 0) {
+		puts("boottype cannot be retrieved\n");
+		return 0;
+	}
+
+	/*
+	 * Set here explicitly a hush shell variable, so if a saveenv
+	 * happens, this variable is *not* saved in U-Boot environment.
+	 *
+	 * This is for devices which are already in the field essential,
+	 * as if such a device breaks, the cutsomer gets a new device
+	 * with a new U-Boot version (and so a new U-Boot environment).
+	 *
+	 * But the customer makes a downgrade to an older U-Boot version,
+	 * which does not have this code in, and runs now with a new
+	 * U-Boot Environment (yes, protected Environment is not enabled
+	 * there) and the old U-Boot must still work with the new U-Boot
+	 * Environment. So we cannot store this variable in U-Boot
+	 * Environment as a stored value will in this case never be over-
+	 * written.
+	 */
+	if (boot_type == 1) {
+		printf("boot-container fallback ocured\n");
+		set_local_var("fallback=1", 0);
+	}
 
-	sprintf(cmd, "mmc dev %d", dev_no);
-	run_command(cmd, 0);
+	return 0;
 }
+#endif
 
 #ifndef CONFIG_XPL_BUILD
 static int load_parameters_from_factoryset(void)
-- 
2.20.1

[PATCH v3 08/11] siemens: capricorn: always detect emmc device

[Heiko Schocher]

drop Environment variable mmcautodetect and the board logic
behind it, as we want always to autodetct the emmc device.

Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng

 board/siemens/capricorn/board.c               | 13 -------------
 board/siemens/capricorn/capricorn_default.env |  1 -
 2 files changed, 14 deletions(-)

diff --git a/board/siemens/capricorn/board.c b/board/siemens/capricorn/board.c
index 34e7f2d1713..ba6c96a409c 100644
--- a/board/siemens/capricorn/board.c
+++ b/board/siemens/capricorn/board.c
@@ -357,16 +357,6 @@ int board_mmc_get_env_dev(int devno)
 	return devno;
 }
 
-static int check_mmc_autodetect(void)
-{
-	char *autodetect_str = env_get("mmcautodetect");
-
-	if (autodetect_str && (strcmp(autodetect_str, "yes") == 0))
-		return 1;
-
-	return 0;
-}
-
 /* This should be defined for each board */
 __weak int mmc_map_to_kernel_blk(int dev_no)
 {
@@ -377,9 +367,6 @@ void board_late_mmc_env_init(void)
 {
 	u32 dev_no = mmc_get_env_dev();
 
-	if (!check_mmc_autodetect())
-		return;
-
 	env_set_ulong("mmcdev", dev_no);
 }
 
diff --git a/board/siemens/capricorn/capricorn_default.env b/board/siemens/capricorn/capricorn_default.env
index c8b5b3d7da3..ad88f7ed770 100644
--- a/board/siemens/capricorn/capricorn_default.env
+++ b/board/siemens/capricorn/capricorn_default.env
@@ -45,4 +45,3 @@ kboot=booti
 bootcmd_mfg=run mfgtool_args; if iminfo ${initrd_addr}; then if test ${tee} = yes; then bootm ${tee_addr} ${initrd_addr} ${fdt_addr}; else booti ${loadaddr} ${initrd_addr} ${fdt_addr}; fi; else echo "Run fastboot ..."; fastboot usb auto; fi;
 fastboot_bytes=124c00
 fastboot_dev=mmc
-mmcautodetect=yes
-- 
2.20.1

[PATCH v3 09/11] siemens: capricorn: fix fallback bootm call for fitImage

[Heiko Schocher]

From: Walter Schweizer <walter.schweizer@siemens.com>

When dtb_name is missing or a configuration is missing, try to
boot the default configuration in the image. The call to bootm needs
the correct loadaddr to succeed.

Fixes booting when factoryset is missing.

Signed-off-by: Walter Schweizer <walter.schweizer@siemens.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

Changes in v3:
Fix checkpatch warning
board/siemens/capricorn/capricorn_default.env:23: warning: line length of 266 exceeds 100 columns
as Max suggested

Changes in v2:
Added Reviewed-by from Peng

 board/siemens/capricorn/capricorn_default.env | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/board/siemens/capricorn/capricorn_default.env b/board/siemens/capricorn/capricorn_default.env
index ad88f7ed770..c150025c882 100644
--- a/board/siemens/capricorn/capricorn_default.env
+++ b/board/siemens/capricorn/capricorn_default.env
@@ -20,7 +20,14 @@ ip_method=none
 kernel_name=Image
 loadaddr=0x80400000
 mmc_boot=run set_bootargs;run check_upgrade; run set_partition;run set_bootargs_mmc;run mmc_load_bootfiles
-mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;if test -n ${A};then setenv bootargs ${bootargs} rootfs_sig=${sig_a};fi;if test -n ${B};then setenv bootargs ${bootargs} rootfs_sig=${sig_b};fi;bootm 0x88000000#conf-${dtb_name}.dtb;bootm
+mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;
+	if test -n ${A};then
+		setenv bootargs ${bootargs} rootfs_sig=${sig_a};
+	fi;
+	if test -n ${B};then
+		setenv bootargs ${bootargs} rootfs_sig=${sig_b};
+	fi;
+	bootm 0x88000000#conf-${dtb_name}.dtb;bootm 0x88000000
 mmc_boot_image=ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name}.dtb;if test $? -eq 1;then ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name_default}.dtb;fi; ext4load mmc 0:${mmc_part_nr} ${loadaddr} boot/${kernel_name}; booti ${loadaddr} - ${fdt_addr}
 mmc_load_bootfiles=echo -n Loading from eMMC ...; if test -e mmc 0:${mmc_part_nr} boot/fitImage; then echo fit; setenv fdt_high; setenv initrd_high; run mmc_boot_fit; else echo image; run mmc_boot_image; fi
 net_nfs=wdt dev scu-wdt; wdt stop; echo Booting from network ...; run set_bootargs_net; tftpboot ${loadaddr} ${bootdir}/${kernel_name}; printenv bootargs; if test ${kernel_name} = fitImage; then setenv fdt_high; setenv initrd_high; bootm ${loadaddr}#conf-${dtb_name}.dtb; else tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name}.dtb; if test $? -eq 1; then echo Loading default.dtb!; tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name_default}.dtb; fi; booti ${loadaddr} - ${fdt_addr}; fi
-- 
2.20.1

[PATCH v3 10/11] siemens: capricorn: rework bootcmd environment variables

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

Rework the boot state machine to a significantly simpler and more
robust implementation. The basic idea is to revert to the previous
partition whenever an issue is detected during the boot process.

- Broken SPL

  If one of the two SPLs does not boot, the ROM code of the i.MX8 SoC
  automatically starts the second SPL from the second boot partition.
  For example, if the system's active partition is A but the SPL from
  partition A is broken, the ROM code automatically uses the SPL/u-boot
  from partition B.
  Proceeding with this boot procedure would lead to booting the kernel/
  rootfs from partition A, which could potentially successfully boot
  the system and allow the user to apply the firmware update with the
  broken SPL again. This would lead to a non-bootable system because
  the second update would overwrite the last working bootloader.
  To prevent such situations, zigzag boots are detected and the system
  reverts to the previous partition rather than booting the kernel/rootfs
  from the currently active partition. Detecting zigzag boots is done
  via the new fallback variable.

  To make this state machine even more consistent, the partitionset_active
  variable is no longer used to determine the active partition during
  boot. Instead, the active partition is always read from the eMMC
  partconf registers.
  For backward compatibility, the partitionset_active variable is still
  updated whenever a partition switch occurs. However, u-boot no longer
  relies on this variable, as it could potentially be out of sync with
  the actual partition state, leading to situations where the ROM code
  of the i.MX8 SoC would be out of sync with u-boot.

- Broken kernel, initramfs or rootfs

  If the upgrade_available variable is set, u-boot counts the number of
  consecutive boots via the bootcount variable. If the bootcount exceeds
  the bootlimit variable, u-boot starts the altbootcmd instead of the
  bootcmd. Previously, this logic was bypassed by assigning the regular
  bootcmd to altbootcmd. Now, the altbootcmd is used to revert to the
  previous partition when the bootlimit is exceeded.

The netdev variable is changed to eth0 by default. This is what the FEC
driver uses on Capricorn boards. For devices with switches and DSA
subsystems in use, the netdev should be set accordingly by additional
logic in the environment or u-boot code. This is not part of this commit.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

Changes in v3:
fixed long line length in environment file as Max suggested.

Changes in v2:
Added Acked-by from Peng, fixed typo in commit message
Added small fixes in Environment from Adrian: It fixes a serious bug which
Adrian detect. It occurs when a broken firmware is applied as a downgrade.
The old bootloader ended up in an endless reboot boot loop. With this fix
also the old bootloader is able to reject the update and recover. Also
slightly reworked bootcmd.

 board/siemens/capricorn/capricorn_default.env | 90 +++++++++++++++----
 1 file changed, 74 insertions(+), 16 deletions(-)

diff --git a/board/siemens/capricorn/capricorn_default.env b/board/siemens/capricorn/capricorn_default.env
index c150025c882..10d612b04fe 100644
--- a/board/siemens/capricorn/capricorn_default.env
+++ b/board/siemens/capricorn/capricorn_default.env
@@ -1,17 +1,23 @@
-altbootcmd=run bootcmd
+terminate_upgrade=bootcount reset; setenv upgrade_available 0
+altbootcmd=run terminate_upgrade; run toggle_partition
 baudrate=115200
 bootcmd=run flash_self;reset;
 bootdelay=3
 bootdir=targetdir/rootfs/boot
 bootlimit=3
-check_upgrade=if test ${upgrade_available} -eq 1; then echo  upgrade_available is set; if test ${bootcount} -gt ${bootlimit}; then setenv upgrade_available 0;echo toggle partition;run toggle_partition;fi;fi;
 cntr_addr=0x88000000
 cntr_file=os_cntr_signed.bin
 console=ttyLP2
 dtb_name_default=default
 ethprime=eth1
 fdt_addr=0x83000000
-flash_self=run mmc_boot
+flash_self=if test -n "$fallback";then
+		echo "fallback: $fallback";
+		run terminate_upgrade;
+		run toggle_partition;
+	else
+		run mmc_boot;
+	fi
 flash_self_test=setenv testargs test loglevel=3 systemd.unit=test.target; run mmc_boot
 hostname=capricorn
 initrd_addr=0x83100000
@@ -19,7 +25,7 @@ initrd_high=0xffffffffffffffff
 ip_method=none
 kernel_name=Image
 loadaddr=0x80400000
-mmc_boot=run set_bootargs;run check_upgrade; run set_partition;run set_bootargs_mmc;run mmc_load_bootfiles
+mmc_boot=run set_bootargs; run set_partition;run set_bootargs_mmc;run mmc_load_bootfiles
 mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;
 	if test -n ${A};then
 		setenv bootargs ${bootargs} rootfs_sig=${sig_a};
@@ -28,27 +34,79 @@ mmc_boot_fit=ext4load mmc 0:${mmc_part_nr} 0x88000000 boot/fitImage;
 		setenv bootargs ${bootargs} rootfs_sig=${sig_b};
 	fi;
 	bootm 0x88000000#conf-${dtb_name}.dtb;bootm 0x88000000
-mmc_boot_image=ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name}.dtb;if test $? -eq 1;then ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name_default}.dtb;fi; ext4load mmc 0:${mmc_part_nr} ${loadaddr} boot/${kernel_name}; booti ${loadaddr} - ${fdt_addr}
-mmc_load_bootfiles=echo -n Loading from eMMC ...; if test -e mmc 0:${mmc_part_nr} boot/fitImage; then echo fit; setenv fdt_high; setenv initrd_high; run mmc_boot_fit; else echo image; run mmc_boot_image; fi
-net_nfs=wdt dev scu-wdt; wdt stop; echo Booting from network ...; run set_bootargs_net; tftpboot ${loadaddr} ${bootdir}/${kernel_name}; printenv bootargs; if test ${kernel_name} = fitImage; then setenv fdt_high; setenv initrd_high; bootm ${loadaddr}#conf-${dtb_name}.dtb; else tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name}.dtb; if test $? -eq 1; then echo Loading default.dtb!; tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name_default}.dtb; fi; booti ${loadaddr} - ${fdt_addr}; fi
-net_unfs=setenv nfsopts vers=3,udp,rsize=4096,wsize=4096,nolock,port=3049,mountport=3048 rw; run net_nfs
-netdev=lan0
+mmc_boot_image=ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name}.dtb;
+	if test $? -eq 1;then
+		ext4load mmc 0:${mmc_part_nr} ${fdt_addr} boot/${dtb_name_default}.dtb;
+	fi;
+	ext4load mmc 0:${mmc_part_nr} ${loadaddr} boot/${kernel_name};
+	booti ${loadaddr} - ${fdt_addr}
+mmc_load_bootfiles=echo -n Loading from eMMC ...;
+	if test -e mmc 0:${mmc_part_nr} boot/fitImage; then
+		echo fit; setenv fdt_high; setenv initrd_high; run mmc_boot_fit;
+	else
+		echo image; run mmc_boot_image;
+	fi
+net_nfs=wdt dev scu-wdt; wdt stop; echo Booting from network ...;
+	run set_bootargs_net; tftpboot ${loadaddr} ${bootdir}/${kernel_name};
+	printenv bootargs;
+	if test ${kernel_name} = fitImage; then
+		setenv fdt_high; setenv initrd_high;
+		bootm ${loadaddr}#conf-${dtb_name}.dtb;
+	else
+		tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name}.dtb;
+		if test $? -eq 1; then
+			echo Loading default.dtb!;
+			tftpboot ${fdt_addr} ${serverip}:${bootdir}/${dtb_name_default}.dtb;
+		fi;
+		booti ${loadaddr} - ${fdt_addr};
+	fi
+net_unfs=setenv nfsopts vers=3,udp,rsize=4096,wsize=4096,nolock,port=3049,mountport=3048 rw;
+	run net_nfs
+netdev=eth0
 nfsopts=vers=3,udp,rsize=4096,wsize=4096,nolock rw
 partitionset_active=A
 rootfs_name=/dev/mmcblk0
 rootpath=/home/projects/targetdir/rootfs
 script_file=u-boot-commands.img
-set_bootargs_mmc=setenv bootargs ${bootargs} root=${mmc_active_vol} ro rootdelay=1 rootwait rootfstype=ext4 ip=${ip_method}
-set_bootargs_net=run set_bootargs; if test ${kernel_name} = fitImage; then setenv loadaddr 0x88000000; fi; setenv bootargs ${bootargs} root=/dev/nfs nfsroot=${serverip}:${rootpath},${nfsopts} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off
-set_bootargs=setenv bootargs console=${console},${baudrate} target_env=${target_env} ${testargs} ${optargs}
-set_partition=setenv ${partitionset_active} true;if test -n ${A}; then setenv mmc_part_nr 1;fi;if test -n ${B}; then setenv mmc_part_nr 2;fi;setenv mmc_active_vol ${rootfs_name}p${mmc_part_nr}
-tftp_run_script=tftpboot ${kernel_loadaddr} ${serverip}:${script_file};if test $? -eq 0;then source ${kernel_loadaddr};fi
-toggle_partition=setenv ${partitionset_active} true; if test -n ${A}; then setenv partitionset_active B; mmc partconf 0 1 2 0; env delete A; fi; if test -n ${B}; then setenv partitionset_active A; mmc partconf 0 1 1 0; env delete B; fi;saveenv; reset
+set_bootargs_mmc=setenv bootargs ${bootargs} root=${mmc_active_vol} ro rootdelay=1
+	rootwait rootfstype=ext4 ip=${ip_method}
+set_bootargs_net=run set_bootargs;
+	if test ${kernel_name} = fitImage; then
+		setenv loadaddr 0x88000000;
+	fi;
+	setenv bootargs ${bootargs} root=/dev/nfs nfsroot=${serverip}:${rootpath},${nfsopts}
+		ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off
+set_bootargs=setenv bootargs console=${console},${baudrate} target_env=${target_env} ${testargs}
+	${optargs}
+set_partition=mmc partconf 0 v_mmc_part_nr; setenv mmc_part_nr $v_mmc_part_nr;
+	setenv mmc_active_vol ${rootfs_name}p$v_mmc_part_nr
+tftp_run_script=tftpboot ${kernel_loadaddr} ${serverip}:${script_file};
+	if test $? -eq 0;then
+		source ${kernel_loadaddr};
+	fi
+toggle_partition=mmc partconf 0 v_mmc_part_nr;
+	if test $v_mmc_part_nr -eq 1;then
+		mmc partconf 0 1 2 0; setenv partitionset_active B;
+	elif test $v_mmc_part_nr -eq 2;then
+		mmc partconf 0 1 1 0; setenv partitionset_active A;
+	else
+		echo error mmc_part_nr $v_mmc_part_nr;
+	fi;
+	saveenv;reset
 upgrade_available=0
 emmc_dev=0
 sd_dev=1
 mfgtool_args=setenv bootargs console=${console},${baudrate} rdinit=/linuxrc clk_ignore_unused
 kboot=booti
-bootcmd_mfg=run mfgtool_args; if iminfo ${initrd_addr}; then if test ${tee} = yes; then bootm ${tee_addr} ${initrd_addr} ${fdt_addr}; else booti ${loadaddr} ${initrd_addr} ${fdt_addr}; fi; else echo "Run fastboot ..."; fastboot usb auto; fi;
+bootcmd_mfg=run mfgtool_args;
+	if iminfo ${initrd_addr}; then
+		if test ${tee} = yes; then
+			bootm ${tee_addr} ${initrd_addr} ${fdt_addr};
+		else
+			booti ${loadaddr} ${initrd_addr} ${fdt_addr};
+		fi;
+	else
+		echo "Run fastboot ..."; fastboot usb auto;
+	fi;
 fastboot_bytes=124c00
 fastboot_dev=mmc
-- 
2.20.1

[PATCH v3 11/11] siemens: capricorn: protect environment

[Heiko Schocher]

From: Adrian Freihofer <adrian.freihofer@siemens.com>

With ENV_WRITEABLE_LIST only specific environment variables lisetd in
CFG_ENV_FLAGS_LIST_STATIC are read from the u-boot environment storage.
All other environment variables are set to default values and are not
written back to the storage.

The u-boot environment usually stays for the lifetime of the product.
There is no A/B copy mechanism as for the firmware itself. That means
that incompatible changes to environment variables in future u-boot
versions may lead to serious issues if the old environment is used with
a new u-boot version or vice versa.

Having this protection in place ensures that only a limited set of
environment variables are persisted across u-boot versions. All the
macros not listed in CFG_ENV_FLAGS_LIST_STATIC are now part of the
u-boot binary which is redundant and immutable. This guarantees that
the u-boot version and the default values of these environment variables
are always in sync and cannot be changed at runtime.

ustate and rastate are not relevant for u-boot itself. ustate is used
by swupdate which persists the transaction state in the environment.
rastate is a similar variable used by another user space application.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng
Reworked writeable variable list, as we dropped patch
"env: add w flags for net config in explicit write mode"

 configs/imx8qxp_capricorn.config   |  1 +
 include/configs/capricorn-common.h | 13 +++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index 626634cb09c..2bae5b1a862 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -12,6 +12,7 @@ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80200000
 CONFIG_ENV_SIZE=0x2000
 CONFIG_ENV_REDUNDANT=y
 CONFIG_ENV_MMC_EMMC_HW_PARTITION=2
+CONFIG_ENV_WRITEABLE_LIST=y
 
 CONFIG_DM_GPIO=y
 CONFIG_AHAB_BOOT=y
diff --git a/include/configs/capricorn-common.h b/include/configs/capricorn-common.h
index 7120a44d186..ee13d2ab950 100644
--- a/include/configs/capricorn-common.h
+++ b/include/configs/capricorn-common.h
@@ -38,6 +38,19 @@
 #define CFG_EXTRA_ENV_SETTINGS \
 	AHAB_ENV
 
+#ifdef CONFIG_ENV_WRITEABLE_LIST
+#define CFG_ENV_FLAGS_LIST_STATIC \
+	"bootcount:dw," \
+	"bootdelay:sw," \
+	"bootlimit:dw," \
+	"partitionset_active:sw," \
+	"rastate:dw," \
+	"sig_a:sw,sig_b:sw," \
+	"target_env:sw," \
+	"upgrade_available:dw," \
+	"ustate:dw"
+#endif
+
 /* Default location for tftp and bootm */
 
 /* On CCP board, USDHC1 is for eMMC */
-- 
2.20.1

RE: [PATCH v3 11/11] siemens: capricorn: protect environment

[Schweizer, Walter]

Hello Heiko

Recently we discovered that we need to add "bootcmd:sw" to the CFG_ENV_FLAGS_LIST_STATIC list.

Best Regards
Walter

-----Original Message-----
From: Heiko Schocher <hs@nabladev.com> 
Sent: Tuesday, February 17, 2026 5:39 PM
To: U-Boot Mailing List <u-boot@lists.denx.de>
Cc: Fabio Estevam <festevam@gmail.com>; Peng Fan <peng.fan@oss.nxp.com>; Freihofer, Adrian (SI B PRO TI EAC CCP) <adrian.freihofer@siemens.com>; Heiko Schocher <hs@nabladev.com>; Peng Fan <peng.fan@nxp.com>; Sverdlin, Alexander (SI B PRO TI EAC CCP) <alexander.sverdlin@siemens.com>; Marek Vasut <marek.vasut+renesas@mailbox.org>; Simon Glass <sjg@chromium.org>; Tom Rini <trini@konsulko.com>; Schweizer, Walter (SI B PRO TI EAC CCP) <walter.schweizer@siemens.com>
Subject: [PATCH v3 11/11] siemens: capricorn: protect environment

From: Adrian Freihofer <adrian.freihofer@siemens.com>

With ENV_WRITEABLE_LIST only specific environment variables lisetd in CFG_ENV_FLAGS_LIST_STATIC are read from the u-boot environment storage.
All other environment variables are set to default values and are not written back to the storage.

The u-boot environment usually stays for the lifetime of the product.
There is no A/B copy mechanism as for the firmware itself. That means that incompatible changes to environment variables in future u-boot versions may lead to serious issues if the old environment is used with a new u-boot version or vice versa.

Having this protection in place ensures that only a limited set of environment variables are persisted across u-boot versions. All the macros not listed in CFG_ENV_FLAGS_LIST_STATIC are now part of the u-boot binary which is redundant and immutable. This guarantees that the u-boot version and the default values of these environment variables are always in sync and cannot be changed at runtime.

ustate and rastate are not relevant for u-boot itself. ustate is used by swupdate which persists the transaction state in the environment.
rastate is a similar variable used by another user space application.

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Heiko Schocher <hs@nabladev.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>

---

(no changes since v2)

Changes in v2:
Added Reviewed-by from Peng
Reworked writeable variable list, as we dropped patch
"env: add w flags for net config in explicit write mode"

 configs/imx8qxp_capricorn.config   |  1 +
 include/configs/capricorn-common.h | 13 +++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/configs/imx8qxp_capricorn.config b/configs/imx8qxp_capricorn.config
index 626634cb09c..2bae5b1a862 100644
--- a/configs/imx8qxp_capricorn.config
+++ b/configs/imx8qxp_capricorn.config
@@ -12,6 +12,7 @@ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80200000
 CONFIG_ENV_SIZE=0x2000
 CONFIG_ENV_REDUNDANT=y
 CONFIG_ENV_MMC_EMMC_HW_PARTITION=2
+CONFIG_ENV_WRITEABLE_LIST=y
 
 CONFIG_DM_GPIO=y
 CONFIG_AHAB_BOOT=y
diff --git a/include/configs/capricorn-common.h b/include/configs/capricorn-common.h
index 7120a44d186..ee13d2ab950 100644
--- a/include/configs/capricorn-common.h
+++ b/include/configs/capricorn-common.h
@@ -38,6 +38,19 @@
 #define CFG_EXTRA_ENV_SETTINGS \
 	AHAB_ENV
 
+#ifdef CONFIG_ENV_WRITEABLE_LIST
+#define CFG_ENV_FLAGS_LIST_STATIC \
+	"bootcount:dw," \
+	"bootdelay:sw," \
+	"bootlimit:dw," \
+	"partitionset_active:sw," \
+	"rastate:dw," \
+	"sig_a:sw,sig_b:sw," \
+	"target_env:sw," \
+	"upgrade_available:dw," \
+	"ustate:dw"
+#endif
+
 /* Default location for tftp and bootm */
 
 /* On CCP board, USDHC1 is for eMMC */
--
2.20.1

Re: [PATCH v3 11/11] siemens: capricorn: protect environment

[Schweizer, Walter]

Hello Heiko

Sorry for the noise, please ignore this comment - it is just for internal
development use.

Best Regards
Walter

On Wed, 2026-02-18 at 17:19 +0000, Schweizer, Walter (SI B PRO TI EAC CCP)
wrote:
> Hello Heiko
> 
> Recently we discovered that we need to add "bootcmd:sw" to the
> CFG_ENV_FLAGS_LIST_STATIC list.
> 
> Best Regards
> Walter
> 
> -----Original Message-----
> From: Heiko Schocher <hs@nabladev.com> 
> Sent: Tuesday, February 17, 2026 5:39 PM
> To: U-Boot Mailing List <u-boot@lists.denx.de>
> Cc: Fabio Estevam <festevam@gmail.com>; Peng Fan <peng.fan@oss.nxp.com>;
> Freihofer, Adrian (SI B PRO TI EAC CCP) <adrian.freihofer@siemens.com>; Heiko
> Schocher <hs@nabladev.com>; Peng Fan <peng.fan@nxp.com>; Sverdlin, Alexander
> (SI B PRO TI EAC CCP) <alexander.sverdlin@siemens.com>; Marek Vasut
> <marek.vasut+renesas@mailbox.org>; Simon Glass <sjg@chromium.org>; Tom Rini
> <trini@konsulko.com>; Schweizer, Walter (SI B PRO TI EAC CCP)
> <walter.schweizer@siemens.com>
> Subject: [PATCH v3 11/11] siemens: capricorn: protect environment
> 
> From: Adrian Freihofer <adrian.freihofer@siemens.com>
> 
> With ENV_WRITEABLE_LIST only specific environment variables lisetd in
> CFG_ENV_FLAGS_LIST_STATIC are read from the u-boot environment storage.
> All other environment variables are set to default values and are not written
> back to the storage.
> 
> The u-boot environment usually stays for the lifetime of the product.
> There is no A/B copy mechanism as for the firmware itself. That means that
> incompatible changes to environment variables in future u-boot versions may
> lead to serious issues if the old environment is used with a new u-boot
> version or vice versa.
> 
> Having this protection in place ensures that only a limited set of environment
> variables are persisted across u-boot versions. All the macros not listed in
> CFG_ENV_FLAGS_LIST_STATIC are now part of the u-boot binary which is redundant
> and immutable. This guarantees that the u-boot version and the default values
> of these environment variables are always in sync and cannot be changed at
> runtime.
> 
> ustate and rastate are not relevant for u-boot itself. ustate is used by
> swupdate which persists the transaction state in the environment.
> rastate is a similar variable used by another user space application.
> 
> Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
> Signed-off-by: Heiko Schocher <hs@nabladev.com>
> Reviewed-by: Peng Fan <peng.fan@nxp.com>
> 
> ---
> 
> (no changes since v2)
> 
> Changes in v2:
> Added Reviewed-by from Peng
> Reworked writeable variable list, as we dropped patch
> "env: add w flags for net config in explicit write mode"
> 
>  configs/imx8qxp_capricorn.config   |  1 +
>  include/configs/capricorn-common.h | 13 +++++++++++++
>  2 files changed, 14 insertions(+)
> 
> diff --git a/configs/imx8qxp_capricorn.config
> b/configs/imx8qxp_capricorn.config
> index 626634cb09c..2bae5b1a862 100644
> --- a/configs/imx8qxp_capricorn.config
> +++ b/configs/imx8qxp_capricorn.config
> @@ -12,6 +12,7 @@ CONFIG_CUSTOM_SYS_INIT_SP_ADDR=0x80200000
>  CONFIG_ENV_SIZE=0x2000
>  CONFIG_ENV_REDUNDANT=y
>  CONFIG_ENV_MMC_EMMC_HW_PARTITION=2
> +CONFIG_ENV_WRITEABLE_LIST=y
>  
>  CONFIG_DM_GPIO=y
>  CONFIG_AHAB_BOOT=y
> diff --git a/include/configs/capricorn-common.h b/include/configs/capricorn-
> common.h
> index 7120a44d186..ee13d2ab950 100644
> --- a/include/configs/capricorn-common.h
> +++ b/include/configs/capricorn-common.h
> @@ -38,6 +38,19 @@
>  #define CFG_EXTRA_ENV_SETTINGS \
>         AHAB_ENV
>  
> +#ifdef CONFIG_ENV_WRITEABLE_LIST
> +#define CFG_ENV_FLAGS_LIST_STATIC \
> +       "bootcount:dw," \
> +       "bootdelay:sw," \
> +       "bootlimit:dw," \
> +       "partitionset_active:sw," \
> +       "rastate:dw," \
> +       "sig_a:sw,sig_b:sw," \
> +       "target_env:sw," \
> +       "upgrade_available:dw," \
> +       "ustate:dw"
> +#endif
> +
>  /* Default location for tftp and bootm */
>  
>  /* On CCP board, USDHC1 is for eMMC */
> --
> 2.20.1
> 

-- 
Walter Schweizer
Siemens AG
www.siemens.com