From: Julien Masson <[email protected]>

Genio 510 and 700 need a provisioning and recovery path that remains
usable when eMMC is blank or its boot firmware is unusable. Add a RAM-
based fastboot download agent so boards can be flashed through the
MediaTek BootROM download protocol without a working on-device
bootloader.

Running the agent in SPL avoids a dependency on BL31 and U-Boot proper
during provisioning.

Signed-off-by: Julien Masson <[email protected]>
Signed-off-by: Carlo Caione <[email protected]>
---
 arch/arm/dts/mt8188-genio-da-u-boot.dtsi           | 55 ++++++++++++++++++
 arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi      |  4 ++
 arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi      |  4 ++
 arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi       | 16 ++++++
 .../dts/mtk-genio-loader-spl-binman-u-boot.dtsi    |  6 ++
 arch/arm/mach-mediatek/Kconfig                     | 26 +++++++++
 arch/arm/mach-mediatek/Makefile                    |  1 +
 arch/arm/mach-mediatek/spl_fastboot.c              | 65 ++++++++++++++++++++++
 board/mediatek/MAINTAINERS                         |  5 ++
 common/spl/Kconfig                                 |  2 +-
 configs/mt8188-genio-da-spl-fastboot.config        | 15 +++++
 configs/mt8188-genio-da.config                     | 19 +++++++
 configs/mt8370_genio_510_evk_da_spl_defconfig      |  2 +
 configs/mt8390_genio_700_evk_da_spl_defconfig      |  2 +
 14 files changed, 221 insertions(+), 1 deletion(-)

diff --git a/arch/arm/dts/mt8188-genio-da-u-boot.dtsi 
b/arch/arm/dts/mt8188-genio-da-u-boot.dtsi
new file mode 100644
index 00000000000..e9078f37157
--- /dev/null
+++ b/arch/arm/dts/mt8188-genio-da-u-boot.dtsi
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
+/*
+ * Copyright (c) 2026 BayLibre, SAS.
+ * Author: Carlo Caione <[email protected]>
+ */
+
+#include "mtk-genio-binman-u-boot.dtsi"
+#include "mtk-genio-da-binman-u-boot.dtsi"
+
+&ssusb0 {
+       dr_mode = "peripheral";
+       mediatek,force-vbus;
+};
+
+&ssusb1 {
+       status = "disabled";
+};
+
+&ssusb2 {
+       status = "disabled";
+};
+
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT
+&pericfg_ao {
+       bootph-pre-ram;
+};
+
+&ssusb0 {
+       bootph-pre-ram;
+};
+
+&u3phy0 {
+       bootph-pre-ram;
+};
+
+&u2port0 {
+       bootph-pre-ram;
+};
+
+&usb_default_pins {
+       bootph-pre-ram;
+
+       pins-iddig {
+               bootph-pre-ram;
+       };
+
+       pins-valid {
+               bootph-pre-ram;
+       };
+
+       pins-vbus {
+               bootph-pre-ram;
+       };
+};
+#endif
diff --git a/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi 
b/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
index 10b9a142f37..608987ca6d7 100644
--- a/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
+++ b/arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
@@ -14,3 +14,7 @@
 #include "mtk-genio-mtk-boot-binman-u-boot.dtsi"
 #include "mtk-genio-bootloaders-binman-u-boot.dtsi"
 #endif
+
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT
+#include "mt8188-genio-da-u-boot.dtsi"
+#endif
diff --git a/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi 
b/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
index 6230b016ca0..6c6c85e8767 100644
--- a/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
+++ b/arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
@@ -14,3 +14,7 @@
 #include "mtk-genio-mtk-boot-binman-u-boot.dtsi"
 #include "mtk-genio-bootloaders-binman-u-boot.dtsi"
 #endif
+
+#ifdef CONFIG_MTK_BROM_DOWNLOAD_AGENT
+#include "mt8188-genio-da-u-boot.dtsi"
+#endif
diff --git a/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi 
b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
new file mode 100644
index 00000000000..ad337bf1784
--- /dev/null
+++ b/arch/arm/dts/mtk-genio-da-binman-u-boot.dtsi
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: (GPL-2.0-only OR MIT)
+/*
+ * Copyright (c) 2026 BayLibre, SAS.
+ * Author: Carlo Caione <[email protected]>
+ */
+
+&binman {
+       da: da {
+               filename = "da.bin";
+               pad-byte = <0>;
+
+#define MTK_GENIO_SIMPLE_SPL
+#include "mtk-genio-loader-spl-binman-u-boot.dtsi"
+#undef MTK_GENIO_SIMPLE_SPL
+       };
+};
diff --git a/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi 
b/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi
index 2dd13d261a0..503ae06da34 100644
--- a/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi
+++ b/arch/arm/dts/mtk-genio-loader-spl-binman-u-boot.dtsi
@@ -12,6 +12,11 @@ ddr-loader {
        size = <CONFIG_MTK_GENIO_DDR_LOADER_SIZE>;
 };
 
+#ifdef MTK_GENIO_SIMPLE_SPL
+u-boot-spl {
+       size = <CONFIG_SPL_MAX_SIZE>;
+};
+#else
 #ifdef CONFIG_SPL_FIT_SIGNATURE
 u-boot-spl {
        type = "section";
@@ -31,3 +36,4 @@ u-boot-spl {
        size = <CONFIG_SPL_MAX_SIZE>;
 };
 #endif
+#endif
diff --git a/arch/arm/mach-mediatek/Kconfig b/arch/arm/mach-mediatek/Kconfig
index e572cfe8571..59489c0fe65 100644
--- a/arch/arm/mach-mediatek/Kconfig
+++ b/arch/arm/mach-mediatek/Kconfig
@@ -249,6 +249,32 @@ config MTK_GENIO_BL31_LOAD_ADDR
 
 endif
 
+config MTK_BROM_DOWNLOAD_AGENT
+       bool
+       depends on TARGET_MT8188 && SPL
+       select BINMAN
+       select MTK_GENIO_IMAGE_CONTRACT
+
+choice
+       prompt "MediaTek BootROM download agent"
+       optional
+       depends on TARGET_MT8188 && SPL && SUPPORT_EMMC_BOOT
+       help
+         Select where to run fastboot after the BootROM downloads the agent
+         into RAM. Leave this disabled for normal storage boot.
+
+config MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT
+       bool "Run download-agent fastboot from SPL"
+       depends on SPL_FASTBOOT_FLASH_MMC
+       select MTK_BROM_DOWNLOAD_AGENT
+       select SPL_BOARD_INIT
+       help
+         Build an SPL which enters USB fastboot after the MediaTek BootROM
+         downloads it into RAM. The download agent also configures the eMMC
+         boot partition so that a newly flashed board can boot normally.
+
+endchoice
+
 config MTK_TZ_MOVABLE
        select ARCH_MISC_INIT
        select OF_SYSTEM_SETUP
diff --git a/arch/arm/mach-mediatek/Makefile b/arch/arm/mach-mediatek/Makefile
index 35f748a70d6..42b83b82f77 100644
--- a/arch/arm/mach-mediatek/Makefile
+++ b/arch/arm/mach-mediatek/Makefile
@@ -4,6 +4,7 @@ obj-$(CONFIG_ARM64) += armv8-mem-map.o
 obj-y  += cpu.o
 obj-$(CONFIG_MTK_TZ_MOVABLE)   += tzcfg.o
 obj-$(CONFIG_XPL_BUILD)        += spl.o
+obj-$(CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT)     += spl_fastboot.o
 
 obj-$(CONFIG_TARGET_MT7622) += mt7622/
 obj-$(CONFIG_TARGET_MT7623) += mt7623/
diff --git a/arch/arm/mach-mediatek/spl_fastboot.c 
b/arch/arm/mach-mediatek/spl_fastboot.c
new file mode 100644
index 00000000000..0ba76d47dfb
--- /dev/null
+++ b/arch/arm/mach-mediatek/spl_fastboot.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024 BayLibre, SAS.
+ * Author: Julien Masson <[email protected]>
+ */
+
+#include <dm/uclass.h>
+#include <fastboot.h>
+#include <mmc.h>
+
+static int mtk_mmc_boot_prepare(void)
+{
+       struct udevice *dev;
+       struct mmc *mmc;
+       int ret;
+
+       ret = uclass_get_device_by_seq(UCLASS_MMC,
+                                      CONFIG_FASTBOOT_FLASH_MMC_DEV, &dev);
+       if (ret) {
+               printf("Cannot load MMC device: %d\n", ret);
+               return ret;
+       }
+
+       mmc = mmc_get_mmc_dev(dev);
+       if (!mmc)
+               return -ENODEV;
+
+       ret = mmc_init(mmc);
+       if (ret) {
+               printf("MMC init failed: %d\n", ret);
+               return ret;
+       }
+
+       /* Enable BOOT1 and boot acknowledgment for normal BootROM startup. */
+       ret = mmc_set_part_conf(mmc, 1, 1, 0);
+       if (ret)
+               printf("Cannot configure the eMMC boot partition: %d\n", ret);
+
+       /* Reset to x1 SDR, backward-compatible timing for each boot. */
+       ret = mmc_set_boot_bus_width(mmc, 0, 0, 0);
+       if (ret)
+               printf("Cannot configure the eMMC boot bus: %d\n", ret);
+
+       if (!mmc->ext_csd[EXT_CSD_RST_N_FUNCTION]) {
+               ret = mmc_set_rst_n_function(mmc, 1);
+               if (ret)
+                       printf("Cannot enable the eMMC reset function: %d\n", 
ret);
+       }
+
+       return 0;
+}
+
+void spl_board_init(void)
+{
+       int ret;
+
+       ret = mtk_mmc_boot_prepare();
+       if (ret)
+               printf("MMC boot preparation failed: %d\n", ret);
+
+       puts("Waiting for fastboot commands...\n");
+       ret = fastboot_usb_run(CONFIG_FASTBOOT_USB_DEV, NULL, 0);
+       if (ret)
+               printf("Fastboot failed: %d\n", ret);
+}
diff --git a/board/mediatek/MAINTAINERS b/board/mediatek/MAINTAINERS
index 5b0d79320bd..27aeb4dff07 100644
--- a/board/mediatek/MAINTAINERS
+++ b/board/mediatek/MAINTAINERS
@@ -21,14 +21,19 @@ MT8188/MT8370/MT8390
 M:     Macpaul Lin <[email protected]>
 M:     Julien Stephan <[email protected]>
 S:     Maintained
+F:     arch/arm/dts/mt8188-genio-da-u-boot.dtsi
 F:     arch/arm/dts/mt8188-u-boot.dtsi
 F:     arch/arm/dts/mt8370-genio-510-evk-u-boot.dtsi
 F:     arch/arm/dts/mt8390-genio-700-evk-u-boot.dtsi
 F:     arch/arm/dts/mt8390-genio-common-u-boot.dtsi
 F:     arch/arm/dts/mtk-genio-*-binman-u-boot.dtsi
 F:     arch/arm/dts/mtk-genio-binman-u-boot.dtsi
+F:     configs/mt8188-genio-da-spl-fastboot.config
+F:     configs/mt8188-genio-da.config
 F:     configs/mt8188.config
+F:     configs/mt8370_genio_510_evk_da_spl_defconfig
 F:     configs/mt8370_genio_510_evk_defconfig
+F:     configs/mt8390_genio_700_evk_da_spl_defconfig
 F:     configs/mt8390_genio_700_evk_defconfig
 F:     doc/board/mediatek/mt8188-genio-evk.rst
 
diff --git a/common/spl/Kconfig b/common/spl/Kconfig
index f9b453df766..77da2f4c8aa 100644
--- a/common/spl/Kconfig
+++ b/common/spl/Kconfig
@@ -194,7 +194,7 @@ config SPL_SHOW_ERRORS
 config SPL_BINMAN_SYMBOLS
        bool "Declare binman symbols in SPL"
        depends on SPL_FRAMEWORK && BINMAN
-       default n if MTK_GENIO_BOOT_IMAGES
+       default n if MTK_GENIO_IMAGE_CONTRACT
        default y
        help
          This enables use of symbols in SPL which refer to other entries in
diff --git a/configs/mt8188-genio-da-spl-fastboot.config 
b/configs/mt8188-genio-da-spl-fastboot.config
new file mode 100644
index 00000000000..01b35f1144e
--- /dev/null
+++ b/configs/mt8188-genio-da-spl-fastboot.config
@@ -0,0 +1,15 @@
+#include <configs/mt8188-genio-da.config>
+
+CONFIG_MTK_BROM_DOWNLOAD_AGENT_SPL_FASTBOOT=y
+# Sparse writes need an 8 MiB DMA buffer in addition to the fastboot state.
+CONFIG_SPL_SYS_MALLOC_SIZE=0x1000000
+CONFIG_SPL_MMC_WRITE=y
+CONFIG_SPL_PHY=y
+CONFIG_SPL_DM_USB_GADGET=y
+CONFIG_SPL_USB_GADGET=y
+CONFIG_SPL_USB_MTU3=y
+CONFIG_SPL_FASTBOOT=y
+CONFIG_SPL_FASTBOOT_REBOOT=y
+CONFIG_SPL_FASTBOOT_FLASH_MMC=y
+CONFIG_SPL_FASTBOOT_MMC_BOOT_SUPPORT=y
+CONFIG_SPL_FASTBOOT_MMC_USER_SUPPORT=y
diff --git a/configs/mt8188-genio-da.config b/configs/mt8188-genio-da.config
new file mode 100644
index 00000000000..d47bce044a7
--- /dev/null
+++ b/configs/mt8188-genio-da.config
@@ -0,0 +1,19 @@
+CONFIG_SYS_MALLOC_LEN=0x9000000
+CONFIG_SUPPORT_EMMC_BOOT=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+CONFIG_USB=y
+CONFIG_DM_USB_GADGET=y
+CONFIG_USB_MTU3=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_VENDOR_NUM=0x0e8d
+CONFIG_USB_GADGET_PRODUCT_NUM=0x201c
+CONFIG_CMD_FASTBOOT=y
+CONFIG_USB_FUNCTION_FASTBOOT=y
+CONFIG_FASTBOOT_BUF_ADDR=0x65000000
+CONFIG_FASTBOOT_BUF_SIZE=0x15000000
+CONFIG_FASTBOOT_FLASH=y
+CONFIG_FASTBOOT_FLASH_MMC=y
+CONFIG_FASTBOOT_FLASH_MMC_DEV=0
+CONFIG_FASTBOOT_MMC_BOOT_SUPPORT=y
+CONFIG_FASTBOOT_MMC_USER_SUPPORT=y
diff --git a/configs/mt8370_genio_510_evk_da_spl_defconfig 
b/configs/mt8370_genio_510_evk_da_spl_defconfig
new file mode 100644
index 00000000000..42ca29dfe1c
--- /dev/null
+++ b/configs/mt8370_genio_510_evk_da_spl_defconfig
@@ -0,0 +1,2 @@
+#include <configs/mt8370_genio_510_evk_defconfig>
+#include <configs/mt8188-genio-da-spl-fastboot.config>
diff --git a/configs/mt8390_genio_700_evk_da_spl_defconfig 
b/configs/mt8390_genio_700_evk_da_spl_defconfig
new file mode 100644
index 00000000000..ca58b131ed6
--- /dev/null
+++ b/configs/mt8390_genio_700_evk_da_spl_defconfig
@@ -0,0 +1,2 @@
+#include <configs/mt8390_genio_700_evk_defconfig>
+#include <configs/mt8188-genio-da-spl-fastboot.config>

-- 
2.55.0

Reply via email to