U-Boot DFU Alternate Settings: Audit MMC Targets in Blocks Before Factory Use

A factory host selects a familiar DFU alternate name and the transfer
completes, yet the intended storage region was not the one exposed by
the device. A label is only the front of a target mapping. The backend,
device, layout type and units determine what the operation can
reach.

This article audits the MMC backend in upstream U-Boot v2025.01. It
does not provide a production flashing recipe. For a Buildroot product,
review the actual U-Boot build and board-generated dfu_alt_info.
Optional partition-offset behavior and other DFU backends need separate
source review. No DFU session or storage write was performed.

Inventory what the device
exposes

The DFU
documentation describes dfu_alt_info as the mapping used to define
alternates. It supports several backend and layout forms, including raw
MMC regions, partition-backed regions and filesystem files. The list
command exposes the configured alternate set without requiring a
firmware download.

Create an offline review table with the alternate index, advertised
name, backend, device identifier, layout type and intended product role.
Resolve the backing region before approving a host-side operation. A
name such as “bootloader” does not prove that its mapping matches the
current partition layout or board revision.

Compare the device-side list with the host-visible descriptors in a
controlled qualification session. Preserve both with the exact
bootloader artifact and configuration. An old screenshot of a similarly
named alternate is not enough when a board callback or environment
update can supply a different mapping for the current device.

Verify raw MMC units
in the implementation

The tagged
MMC backend interprets the raw form using lba_start and lba_size. It
records the device’s read block length as the block size. During a raw
operation, it converts the transfer offset into blocks and checks the
resulting block extent against the designated area.

That is the critical unit boundary. A raw start and size are not
simply a pair of byte counts to paste from an image-layout document.
Convert between the documented storage layout and the backend’s block
units explicitly, recording the block size used for that calculation.
Keep the original byte range and the resulting block range beside each
other in the audit.

The parser in this tag uses base-zero numeric conversion for the raw
arguments. Use unambiguous numeric notation in the versioned
configuration and verify the parsed result; do not rely on a bare number
that different surrounding tools may interpret differently. This is
especially important when a generated string passes through multiple
build or factory tools before reaching U-Boot.

An illustrative audit might take a byte-aligned region from a board
layout and compute its start block and block count. The arithmetic
should be checked independently before any device operation. If the byte
range is not aligned to the device’s required block size, stop and
resolve the layout rather than silently truncating a division.

Treat zero
size and hardware partitions deliberately

For raw MMC targets, the tagged parser gives a zero size special
whole-device behavior. Do not use zero as a harmless placeholder for an
unfilled limit. A generated configuration that accidentally leaves that
field at zero can expose a much broader target than its author
intended.

The raw form can also specify an eMMC hardware partition through
mmcpart. That namespace is distinct from the GPT or DOS partition index
used by a partition-layout form. Write the namespace explicitly in the
review record. A number alone cannot communicate whether it selects an
eMMC hardware area or a filesystem partition-table entry.

When auditing a partition-backed form, resolve the selected partition
against the actual target’s table. When auditing a filesystem form,
record the intended file and filesystem partition instead of pretending
it is the same raw-region contract. Avoid extending the raw-MMC
calculations in this article to NAND, SPI flash or a virtual backend
without reading their implementations.

Include layout
types that are not storage writes

The DFU documentation includes skip and script layouts. A script
target executes received commands rather than merely storing a
conventional firmware payload. That changes the review from a bounded
storage transfer to command execution with the bootloader’s available
capabilities.

List such targets prominently and justify whether the factory
workflow requires them. Do not let them inherit approval simply because
their alternate name looks like another firmware image. Similarly, a
virtual backend may implement board-specific behavior that cannot be
understood from its display name alone.

This audit is not a claim that DFU itself supplies authentication or
a complete security boundary. Product access controls, payload
validation and manufacturing authorization need their own evidence. A
range check can reduce one class of mistake while leaving the wrong, but
validly configured, target available.

Qualify the host-to-region
contract

Start with offline parsing and range comparison. Confirm that every
exposed target has an owner, intended artifact type and bounded
destination. Check for overlaps with protected product data and for
index or name changes between supported board revisions. Reject
unexplained whole-device or command-execution entries before a write
campaign.

Then use a recoverable qualification device and harmless test
artifacts under an approved procedure. Verify that the host selects the
expected alternate and that the observed destination matches the
reviewed region. Include a reordered alternate list to expose scripts
that accidentally rely on an obsolete index. Keep destructive boundary
experiments away from production units.

The final factory contract should identify the exact mapping, not
merely a successful USB transfer. When the name, parser, units and
physical destination are all tied to a versioned release, the host
command becomes auditable instead of relying on a label whose meaning
may have changed.