xref: /OK3568_Linux_fs/u-boot/common/image-android.c (revision 4882a59341e53eb6f0b4789bf948001014eff981)
1 /*
2  * Copyright (c) 2011 Sebastian Andrzej Siewior <bigeasy@linutronix.de>
3  *
4  * SPDX-License-Identifier:	GPL-2.0+
5  */
6 
7 #include <common.h>
8 #include <image.h>
9 #include <android_ab.h>
10 #include <android_bootloader.h>
11 #include <android_image.h>
12 #include <malloc.h>
13 #include <mapmem.h>
14 #include <errno.h>
15 #include <boot_rkimg.h>
16 #include <crypto.h>
17 #include <sysmem.h>
18 #include <mp_boot.h>
19 #include <u-boot/sha1.h>
20 #ifdef CONFIG_RKIMG_BOOTLOADER
21 #include <asm/arch/resource_img.h>
22 #endif
23 #ifdef CONFIG_RK_AVB_LIBAVB_USER
24 #include <android_avb/avb_slot_verify.h>
25 #include <android_avb/avb_ops_user.h>
26 #include <android_avb/rk_avb_ops_user.h>
27 #endif
28 #include <optee_include/OpteeClientInterface.h>
29 
30 DECLARE_GLOBAL_DATA_PTR;
31 
32 #define ANDROID_IMAGE_DEFAULT_KERNEL_ADDR	0x10008000
33 #define ANDROID_PARTITION_VENDOR_BOOT		"vendor_boot"
34 #define ANDROID_PARTITION_INIT_BOOT		"init_boot"
35 
36 #define BLK_CNT(_num_bytes, _block_size)	\
37 		((_num_bytes + _block_size - 1) / _block_size)
38 
39 static char andr_tmp_str[ANDR_BOOT_ARGS_SIZE + 1];
40 static u32 android_kernel_comp_type = IH_COMP_NONE;
41 
android_version_init(void)42 static int android_version_init(void)
43 {
44 	struct andr_img_hdr *hdr = NULL;
45 	struct blk_desc *desc;
46 	const char *part_name = PART_BOOT;
47 	disk_partition_t part;
48 	int os_version;
49 
50 	desc = rockchip_get_bootdev();
51 	if (!desc) {
52 		printf("No bootdev\n");
53 		return -1;
54 	}
55 
56 #ifdef CONFIG_ANDROID_AB
57 	part_name = ab_can_find_recovery_part() ? PART_RECOVERY : PART_BOOT;
58 #endif
59 	if (part_get_info_by_name(desc, part_name, &part) < 0)
60 		return -1;
61 
62 	hdr = populate_andr_img_hdr(desc, &part);
63 	if (!hdr)
64 		return -1;
65 
66 	os_version = hdr->os_version;
67 	if (os_version)
68 		printf("Android %u.%u, Build %u.%u, v%d\n",
69 		       (os_version >> 25) & 0x7f, (os_version >> 18) & 0x7F,
70 		       ((os_version >> 4) & 0x7f) + 2000, os_version & 0x0F,
71 		       hdr->header_version);
72 	free(hdr);
73 
74 	return (os_version >> 25) & 0x7f;
75 }
76 
android_bcb_msg_sector_offset(void)77 u32 android_bcb_msg_sector_offset(void)
78 {
79 	static int android_version = -1;	/* static */
80 
81 	/*
82 	 * get android os version:
83 	 *
84 	 * There are two types of misc.img:
85 	 *	Rockchip platforms defines BCB message at the 16KB offset of
86 	 *	misc.img except for the Android version >= 10. Because Google
87 	 *	defines it at 0x00 offset, and from Android-10 it becoms mandary
88 	 *	on Google VTS.
89 	 *
90 	 * So we must get android 'os_version' to identify which type we
91 	 * are using, then we could able to use rockchip_get_boot_mode()
92 	 * which reads BCB from misc.img.
93 	 */
94 #ifdef CONFIG_RKIMG_BOOTLOADER
95 	if (android_version < 0)
96 		android_version = android_version_init();
97 
98 	return (android_version >= 10) ? 0x00 : 0x20;
99 #else
100 	return 0x00;
101 #endif
102 }
103 
104 #ifdef CONFIG_ROCKCHIP_RESOURCE_IMAGE
android_image_init_resource(struct blk_desc * desc,disk_partition_t * out_part,ulong * out_blk_offset)105 int android_image_init_resource(struct blk_desc *desc,
106 				disk_partition_t *out_part,
107 				ulong *out_blk_offset)
108 {
109 	struct andr_img_hdr *hdr = NULL;
110 	const char *part_name = ANDROID_PARTITION_BOOT;
111 	disk_partition_t part;
112 	ulong offset;
113 	int ret = 0;
114 
115 	if (!desc)
116 		return -ENODEV;
117 
118 #ifndef CONFIG_ANDROID_AB
119 	if (rockchip_get_boot_mode() == BOOT_MODE_RECOVERY)
120 		part_name = ANDROID_PARTITION_RECOVERY;
121 #endif
122 	if (part_get_info_by_name(desc, part_name, &part) < 0)
123 		return -ENOENT;
124 
125 	hdr = populate_andr_img_hdr(desc, &part);
126 	if (!hdr)
127 		return -EINVAL;
128 
129 	if (hdr->header_version >= 2 && hdr->dtb_size)
130 		env_update("bootargs", "androidboot.dtb_idx=0");
131 
132 	if (hdr->header_version <= 2) {
133 		offset = hdr->page_size +
134 			ALIGN(hdr->kernel_size, hdr->page_size) +
135 			ALIGN(hdr->ramdisk_size, hdr->page_size);
136 		*out_part = part;
137 		*out_blk_offset = DIV_ROUND_UP(offset, desc->blksz);
138 	} else {
139 		ret = -EINVAL;
140 	}
141 	free(hdr);
142 
143 	return ret;
144 }
145 #endif
146 
android_image_get_kernel_addr(const struct andr_img_hdr * hdr)147 static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr)
148 {
149 	/*
150 	 * All the Android tools that generate a boot.img use this
151 	 * address as the default.
152 	 *
153 	 * Even though it doesn't really make a lot of sense, and it
154 	 * might be valid on some platforms, we treat that address as
155 	 * the default value for this field, and try to execute the
156 	 * kernel in place in such a case.
157 	 *
158 	 * Otherwise, we will return the actual value set by the user.
159 	 */
160 	if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR)
161 		return (ulong)hdr + hdr->page_size;
162 
163 #ifdef CONFIG_ARCH_ROCKCHIP
164 	/*
165 	 * If kernel is compressed, kernel_addr is set as decompressed address
166 	 * after compressed being loaded to ram, so let's use it.
167 	 */
168 	if (android_kernel_comp_type != IH_COMP_NONE &&
169 	    android_kernel_comp_type != IH_COMP_ZIMAGE)
170 		return hdr->kernel_addr;
171 
172 	/*
173 	 * Compatble with rockchip legacy packing with kernel/ramdisk/second
174 	 * address base from 0x60000000(SDK versiont < 8.1), these are invalid
175 	 * address, so we calc it by real size.
176 	 */
177 	return (ulong)hdr + hdr->page_size;
178 #else
179 	return hdr->kernel_addr;
180 #endif
181 
182 }
183 
android_image_set_comp(struct andr_img_hdr * hdr,u32 comp)184 void android_image_set_comp(struct andr_img_hdr *hdr, u32 comp)
185 {
186 	android_kernel_comp_type = comp;
187 }
188 
android_image_get_comp(const struct andr_img_hdr * hdr)189 u32 android_image_get_comp(const struct andr_img_hdr *hdr)
190 {
191 	return android_kernel_comp_type;
192 }
193 
android_image_parse_kernel_comp(const struct andr_img_hdr * hdr)194 int android_image_parse_kernel_comp(const struct andr_img_hdr *hdr)
195 {
196 	ulong kaddr = android_image_get_kernel_addr(hdr);
197 	return bootm_parse_comp((const unsigned char *)kaddr);
198 }
199 
200 /**
201  * android_image_get_kernel() - processes kernel part of Android boot images
202  * @hdr:	Pointer to image header, which is at the start
203  *			of the image.
204  * @verify:	Checksum verification flag. Currently unimplemented.
205  * @os_data:	Pointer to a ulong variable, will hold os data start
206  *			address.
207  * @os_len:	Pointer to a ulong variable, will hold os data length.
208  *
209  * This function returns the os image's start address and length. Also,
210  * it appends the kernel command line to the bootargs env variable.
211  *
212  * Return: Zero, os start address and length on success,
213  *		otherwise on failure.
214  */
android_image_get_kernel(const struct andr_img_hdr * hdr,int verify,ulong * os_data,ulong * os_len)215 int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify,
216 			     ulong *os_data, ulong *os_len)
217 {
218 	u32 kernel_addr = android_image_get_kernel_addr(hdr);
219 	const char *cmdline = hdr->header_version < 3 ?
220 			      hdr->cmdline : hdr->total_cmdline;
221 	/*
222 	 * Not all Android tools use the id field for signing the image with
223 	 * sha1 (or anything) so we don't check it. It is not obvious that the
224 	 * string is null terminated so we take care of this.
225 	 */
226 	strncpy(andr_tmp_str, hdr->name, ANDR_BOOT_NAME_SIZE);
227 	andr_tmp_str[ANDR_BOOT_NAME_SIZE] = '\0';
228 	if (strlen(andr_tmp_str))
229 		printf("Android's image name: %s\n", andr_tmp_str);
230 
231 	printf("Kernel: 0x%08x - 0x%08x (%u KiB)\n",
232 	       kernel_addr, kernel_addr + hdr->kernel_size,
233 	       DIV_ROUND_UP(hdr->kernel_size, 1024));
234 
235 	int len = 0;
236 	if (cmdline) {
237 		debug("Kernel command line: %s\n", cmdline);
238 		len += strlen(cmdline);
239 	}
240 
241 	char *bootargs = env_get("bootargs");
242 	if (bootargs)
243 		len += strlen(bootargs);
244 
245 	char *newbootargs = malloc(len + 2);
246 	if (!newbootargs) {
247 		puts("Error: malloc in android_image_get_kernel failed!\n");
248 		return -ENOMEM;
249 	}
250 	*newbootargs = '\0';
251 
252 	if (bootargs) {
253 		strcpy(newbootargs, bootargs);
254 		strcat(newbootargs, " ");
255 	}
256 	if (cmdline)
257 		strcat(newbootargs, cmdline);
258 
259 	env_set("bootargs", newbootargs);
260 
261 	if (os_data) {
262 		*os_data = (ulong)hdr;
263 		*os_data += hdr->page_size;
264 	}
265 	if (os_len)
266 		*os_len = hdr->kernel_size;
267 	return 0;
268 }
269 
android_image_check_header(const struct andr_img_hdr * hdr)270 int android_image_check_header(const struct andr_img_hdr *hdr)
271 {
272 	return memcmp(ANDR_BOOT_MAGIC, hdr->magic, ANDR_BOOT_MAGIC_SIZE);
273 }
274 
android_image_get_end(const struct andr_img_hdr * hdr)275 ulong android_image_get_end(const struct andr_img_hdr *hdr)
276 {
277 	ulong end;
278 	/*
279 	 * The header takes a full page, the remaining components are aligned
280 	 * on page boundary
281 	 */
282 	end = (ulong)hdr;
283 	if (hdr->header_version < 3) {
284 		end += hdr->page_size;
285 		end += ALIGN(hdr->kernel_size, hdr->page_size);
286 		end += ALIGN(hdr->ramdisk_size, hdr->page_size);
287 		end += ALIGN(hdr->second_size, hdr->page_size);
288 		if (hdr->header_version == 1) {
289 			end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
290 		} else if (hdr->header_version == 2) {
291 			end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
292 			end += ALIGN(hdr->dtb_size, hdr->page_size);
293 		}
294 	} else {
295 		/* boot_img_hdr_v34 */
296 		end += hdr->page_size;
297 		end += ALIGN(hdr->kernel_size, hdr->page_size);
298 		end += ALIGN(hdr->ramdisk_size, hdr->page_size);
299 	}
300 
301 	return end;
302 }
303 
android_image_get_ksize(const struct andr_img_hdr * hdr)304 u32 android_image_get_ksize(const struct andr_img_hdr *hdr)
305 {
306 	return hdr->kernel_size;
307 }
308 
android_image_set_kload(struct andr_img_hdr * hdr,u32 load_address)309 void android_image_set_kload(struct andr_img_hdr *hdr, u32 load_address)
310 {
311 	hdr->kernel_addr = load_address;
312 }
313 
android_image_get_kload(const struct andr_img_hdr * hdr)314 ulong android_image_get_kload(const struct andr_img_hdr *hdr)
315 {
316 	return android_image_get_kernel_addr(hdr);
317 }
318 
android_image_get_ramdisk(const struct andr_img_hdr * hdr,ulong * rd_data,ulong * rd_len)319 int android_image_get_ramdisk(const struct andr_img_hdr *hdr,
320 			      ulong *rd_data, ulong *rd_len)
321 {
322 	ulong ramdisk_addr_r;
323 	ulong start, end;
324 
325 	if (!hdr->ramdisk_size) {
326 		*rd_data = *rd_len = 0;
327 		return -1;
328 	}
329 
330 	/* Have been loaded by android_image_load_separate() on ramdisk_addr_r */
331 	ramdisk_addr_r = env_get_ulong("ramdisk_addr_r", 16, 0);
332 	if (!ramdisk_addr_r) {
333 		printf("No Found Ramdisk Load Address.\n");
334 		return -1;
335 	}
336 
337 	*rd_data = ramdisk_addr_r;
338 	*rd_len = hdr->ramdisk_size;
339 	if (hdr->header_version >= 3)
340 		*rd_len += hdr->vendor_ramdisk_size;
341 	if (hdr->header_version >= 4) {
342 		 *rd_len += hdr->vendor_bootconfig_size +
343 		  ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE;
344 	}
345 
346 	/* just for print msg */
347 	start = ramdisk_addr_r;
348 	if (hdr->header_version >= 3) {
349 		end = start + (ulong)hdr->vendor_ramdisk_size;
350 		printf("v-ramdisk:  0x%08lx - 0x%08lx (%u KiB)\n",
351 		       start, end, DIV_ROUND_UP(hdr->vendor_ramdisk_size, 1024));
352 		start = end;
353 	}
354 	{
355 		end = start + (ulong)hdr->ramdisk_size;
356 		printf("ramdisk:    0x%08lx - 0x%08lx (%u KiB)\n",
357 		       start, end, DIV_ROUND_UP(hdr->ramdisk_size, 1024));
358 		start = end;
359 	}
360 	if (hdr->header_version >= 4) {
361 		end = start + (ulong)hdr->vendor_bootconfig_size;
362 		printf("bootconfig: 0x%08lx - 0x%08lx (%u KiB)\n",
363 		       start, end, DIV_ROUND_UP(hdr->vendor_bootconfig_size, 1024));
364 		start = end;
365 		end = start + ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE;
366 		printf("bootparams: 0x%08lx - 0x%08lx\n", start, end);
367 	}
368 
369 	return 0;
370 }
371 
android_image_get_fdt(const struct andr_img_hdr * hdr,ulong * rd_data)372 int android_image_get_fdt(const struct andr_img_hdr *hdr,
373 			      ulong *rd_data)
374 {
375 	ulong fdt_addr_r;
376 
377 	if (!hdr->second_size) {
378 		*rd_data = 0;
379 		return -1;
380 	}
381 
382 	/* Have been loaded by android_image_load_separate() on fdt_addr_r */
383 	fdt_addr_r = env_get_ulong("fdt_addr_r", 16, 0);
384 	if (!fdt_addr_r) {
385 		printf("No Found FDT Load Address.\n");
386 		return -1;
387 	}
388 
389 	*rd_data = fdt_addr_r;
390 
391 	debug("FDT load addr 0x%08x size %u KiB\n",
392 	      hdr->second_addr, DIV_ROUND_UP(hdr->second_size, 1024));
393 
394 	return 0;
395 }
396 
397 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
print_hash(const char * label,u8 * hash,int len)398 static void print_hash(const char *label, u8 *hash, int len)
399 {
400 	int i;
401 
402 	printf("%s:\n    0x", label ? : "Hash");
403 	for (i = 0; i < len; i++)
404 		printf("%02x", hash[i]);
405 	printf("\n");
406 }
407 #endif
408 
409 typedef enum {
410 	IMG_KERNEL,
411 	IMG_RAMDISK,	/* within boot.img or init_boot.img(Android-13 or later) */
412 	IMG_SECOND,
413 	IMG_RECOVERY_DTBO,
414 	IMG_RK_DTB,	/* within resource.img in second position */
415 	IMG_DTB,
416 	IMG_VENDOR_RAMDISK,
417 	IMG_BOOTCONFIG,
418 	IMG_MAX,
419 } img_t;
420 
421 #if defined(CONFIG_ANDROID_BOOT_IMAGE_HASH) && !defined(CONFIG_DM_CRYPTO)
422 static sha1_context sha1_ctx;
423 #endif
424 
image_load(img_t img,struct andr_img_hdr * hdr,ulong blkstart,void * ram_base,struct udevice * crypto)425 static int image_load(img_t img, struct andr_img_hdr *hdr,
426 		      ulong blkstart, void *ram_base,
427 		      struct udevice *crypto)
428 {
429 	struct blk_desc *desc = rockchip_get_bootdev();
430 	disk_partition_t part_vendor_boot;
431 	disk_partition_t part_init_boot;
432 	__maybe_unused u32 typesz;
433 	u32 andr_version = (hdr->os_version >> 25) & 0x7f;
434 	ulong pgsz = hdr->page_size;
435 	ulong blksz = desc->blksz;
436 	ulong blkcnt, blkoff;
437 	ulong memmove_dst = 0;
438 	ulong bsoffs = 0;
439 	ulong extra = 0;
440 	ulong length;
441 	void *buffer;
442 	void *tmp = NULL;
443 	int ret = 0;
444 
445 	switch (img) {
446 	case IMG_KERNEL:
447 		bsoffs = 0; /* include a page_size(image header) */
448 		length = hdr->kernel_size + pgsz;
449 		buffer = (void *)env_get_ulong("android_addr_r", 16, 0);
450 		blkcnt = DIV_ROUND_UP(hdr->kernel_size + pgsz, blksz);
451 		typesz = sizeof(hdr->kernel_size);
452 		if (!sysmem_alloc_base(MEM_KERNEL,
453 			(phys_addr_t)buffer, blkcnt * blksz))
454 			return -ENOMEM;
455 		break;
456 	case IMG_VENDOR_RAMDISK:
457 		if (hdr->vendor_boot_buf) {
458 			ram_base = hdr->vendor_boot_buf;
459 		} else {
460 			if (part_get_info_by_name(desc,
461 						  ANDROID_PARTITION_VENDOR_BOOT,
462 						  &part_vendor_boot) < 0) {
463 				printf("No vendor boot partition\n");
464 				return -ENOENT;
465 			}
466 			ram_base = 0;
467 		}
468 
469 		blkstart = part_vendor_boot.start;
470 		pgsz = hdr->vendor_page_size;
471 		bsoffs = ALIGN(VENDOR_BOOT_HDRv3_SIZE, pgsz);
472 		length = hdr->vendor_ramdisk_size;
473 		buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0);
474 		blkcnt = DIV_ROUND_UP(hdr->vendor_ramdisk_size, blksz);
475 		typesz = sizeof(hdr->vendor_ramdisk_size);
476 		/*
477 		 * Add extra memory for generic ramdisk space.
478 		 *
479 		 * In case of unaligned vendor ramdisk size, reserve
480 		 * 1 more blksz.
481 		 *
482 		 * Reserve 8KB for bootloader cmdline.
483 		 */
484 		if (hdr->header_version >= 3)
485 			extra += ALIGN(hdr->ramdisk_size, blksz) + blksz;
486 		if (hdr->header_version >= 4)
487 			extra += ALIGN(hdr->vendor_bootconfig_size, blksz) +
488 				 ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE;
489 		if (length && !sysmem_alloc_base(MEM_RAMDISK,
490 			(phys_addr_t)buffer, blkcnt * blksz + extra))
491 			return -ENOMEM;
492 		break;
493 	case IMG_RAMDISK:
494 		/* get ramdisk from init_boot.img ? */
495 		if (hdr->header_version >= 4 && andr_version >= 13) {
496 			if (hdr->init_boot_buf) {
497 				ram_base = hdr->init_boot_buf;
498 			} else {
499 				if (part_get_info_by_name(desc,
500 				    ANDROID_PARTITION_INIT_BOOT, &part_init_boot) < 0) {
501 					printf("No init boot partition\n");
502 					return -ENOENT;
503 				}
504 				blkstart = part_init_boot.start;
505 				ram_base = 0;
506 			}
507 			bsoffs = pgsz;
508 		} else {
509 			/* get ramdisk from generic boot.img */
510 			bsoffs = pgsz + ALIGN(hdr->kernel_size, pgsz);
511 		}
512 
513 		length = hdr->ramdisk_size;
514 		buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0);
515 		blkcnt = DIV_ROUND_UP(hdr->ramdisk_size, blksz);
516 		typesz = sizeof(hdr->ramdisk_size);
517 
518 		/*
519 		 * ramdisk_addr_r v012:
520 		 *	|----------------|
521 		 *	|    ramdisk     |
522 		 *	|----------------|
523 		 *
524 		 * ramdisk_addr_r v3 (Android-11 and later):
525 		 *	|----------------|---------|
526 		 *	| vendor-ramdisk | ramdisk |
527 		 *	|----------------|---------|
528 		 *
529 		 * ramdisk_addr_r v4 (Android-12 and later):
530 		 *	|----------------|---------|------------|------------|
531 		 *	| vendor-ramdisk | ramdisk | bootconfig | bootparams |
532 		 *	|----------------|---------|------------|------------|
533 		 *
534 		 * ramdisk_addr_r v4 + init_boot(Android-13 and later):
535 		 *	|----------------|----------------|------------|------------|
536 		 *	| vendor-ramdisk | (init_)ramdisk | bootconfig | bootparams |
537 		 *	|----------------|----------------|------------|------------|
538 		 */
539 		if (hdr->header_version >= 3) {
540 			buffer += hdr->vendor_ramdisk_size;
541 			if (!IS_ALIGNED((ulong)buffer, blksz)) {
542 				memmove_dst = (ulong)buffer;
543 				buffer = (void *)ALIGN(memmove_dst, blksz);
544 			}
545 		}
546 		/* sysmem has been alloced by vendor ramdisk */
547 		if (hdr->header_version < 3) {
548 			if (length && !sysmem_alloc_base(MEM_RAMDISK,
549 				(phys_addr_t)buffer, blkcnt * blksz))
550 				return -ENOMEM;
551 		}
552 		break;
553 	case IMG_BOOTCONFIG:
554 		if (hdr->header_version < 4)
555 			return 0;
556 
557 		if (hdr->vendor_boot_buf) {
558 			ram_base = hdr->vendor_boot_buf;
559 		} else {
560 			if (part_get_info_by_name(desc,
561 						  ANDROID_PARTITION_VENDOR_BOOT,
562 						  &part_vendor_boot) < 0) {
563 				printf("No vendor boot partition\n");
564 				return -ENOENT;
565 			}
566 			ram_base = 0;
567 		}
568 		blkstart = part_vendor_boot.start;
569 		pgsz = hdr->vendor_page_size;
570 		bsoffs = ALIGN(VENDOR_BOOT_HDRv4_SIZE, pgsz) +
571 			 ALIGN(hdr->vendor_ramdisk_size, pgsz) +
572 			 ALIGN(hdr->dtb_size, pgsz) +
573 			 ALIGN(hdr->vendor_ramdisk_table_size, pgsz);
574 		length = hdr->vendor_bootconfig_size;
575 		buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0);
576 		blkcnt = DIV_ROUND_UP(hdr->vendor_bootconfig_size, blksz);
577 		typesz = sizeof(hdr->vendor_bootconfig_size);
578 
579 		buffer += hdr->vendor_ramdisk_size + hdr->ramdisk_size;
580 		if (!IS_ALIGNED((ulong)buffer, blksz)) {
581 			memmove_dst = (ulong)buffer;
582 			buffer = (void *)ALIGN(memmove_dst, blksz);
583 		}
584 		break;
585 	case IMG_SECOND:
586 		bsoffs = pgsz +
587 			 ALIGN(hdr->kernel_size, pgsz) +
588 			 ALIGN(hdr->ramdisk_size, pgsz);
589 		length = hdr->second_size;
590 		blkcnt = DIV_ROUND_UP(hdr->second_size, blksz);
591 		buffer = tmp = malloc(blkcnt * blksz);
592 		typesz = sizeof(hdr->second_size);
593 		break;
594 	case IMG_RECOVERY_DTBO:
595 		bsoffs = pgsz +
596 			 ALIGN(hdr->kernel_size, pgsz) +
597 			 ALIGN(hdr->ramdisk_size, pgsz) +
598 			 ALIGN(hdr->second_size, pgsz);
599 		length = hdr->recovery_dtbo_size;
600 		blkcnt = DIV_ROUND_UP(hdr->recovery_dtbo_size, blksz);
601 		buffer = tmp = malloc(blkcnt * blksz);
602 		typesz = sizeof(hdr->recovery_dtbo_size);
603 		break;
604 	case IMG_DTB:
605 		bsoffs = pgsz +
606 			 ALIGN(hdr->kernel_size, pgsz) +
607 			 ALIGN(hdr->ramdisk_size, pgsz) +
608 			 ALIGN(hdr->second_size, pgsz) +
609 			 ALIGN(hdr->recovery_dtbo_size, pgsz);
610 		length = hdr->dtb_size;
611 		blkcnt = DIV_ROUND_UP(hdr->dtb_size, blksz);
612 		buffer = tmp = malloc(blkcnt * blksz);
613 		typesz = sizeof(hdr->dtb_size);
614 		break;
615 	case IMG_RK_DTB:
616 #ifdef CONFIG_RKIMG_BOOTLOADER
617 		/* No going further, it handles DTBO, HW-ID, etc */
618 		buffer = (void *)env_get_ulong("fdt_addr_r", 16, 0);
619 		if (gd->fdt_blob != (void *)buffer)
620 			ret = rockchip_read_dtb_file(buffer);
621 #endif
622 		return ret < 0 ? ret : 0;
623 	default:
624 		return -EINVAL;
625 	}
626 
627 	if (!buffer) {
628 		printf("No memory for image(%d)\n", img);
629 		return -ENOMEM;
630 	}
631 
632 	if (!blksz || !length)
633 		goto crypto_calc;
634 
635 	/* load */
636 	if (ram_base) {
637 		memcpy(buffer, (char *)((ulong)ram_base + bsoffs), length);
638 	} else {
639 		blkoff = DIV_ROUND_UP(bsoffs, blksz);
640 		ret = blk_dread(desc, blkstart + blkoff, blkcnt, buffer);
641 		if (ret != blkcnt) {
642 			printf("Failed to read img(%d), ret=%d\n", img, ret);
643 			return -EIO;
644 		}
645 	}
646 
647 	if (memmove_dst)
648 		memmove((char *)memmove_dst, buffer, length);
649 
650 crypto_calc:
651 	if (img == IMG_KERNEL) {
652 		buffer += pgsz;
653 		length -= pgsz;
654 	}
655 
656 	/* sha1 */
657 	if (hdr->header_version < 3) {
658 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
659 #ifdef CONFIG_DM_CRYPTO
660 		if (crypto) {
661 			crypto_sha_update(crypto, (u32 *)buffer, length);
662 			crypto_sha_update(crypto, (u32 *)&length, typesz);
663 		}
664 #else
665 		sha1_update(&sha1_ctx, (void *)buffer, length);
666 		sha1_update(&sha1_ctx, (void *)&length, typesz);
667 #endif
668 #endif
669 	}
670 
671 	if (tmp)
672 		free(tmp);
673 
674 	return 0;
675 }
676 
images_load_verify(struct andr_img_hdr * hdr,ulong part_start,void * ram_base,struct udevice * crypto)677 static int images_load_verify(struct andr_img_hdr *hdr, ulong part_start,
678 			      void *ram_base, struct udevice *crypto)
679 {
680 	/* load, never change order ! */
681 	if (image_load(IMG_KERNEL, hdr, part_start, ram_base, crypto))
682 		return -1;
683 	if (image_load(IMG_RAMDISK, hdr, part_start, ram_base, crypto))
684 		return -1;
685 	if (image_load(IMG_SECOND, hdr, part_start, ram_base, crypto))
686 		return -1;
687 	if (hdr->header_version > 0) {
688 		if (image_load(IMG_RECOVERY_DTBO, hdr, part_start,
689 			       ram_base, crypto))
690 			return -1;
691 	}
692 	if (hdr->header_version > 1) {
693 		if (image_load(IMG_DTB, hdr, part_start, ram_base, crypto))
694 			return -1;
695 	}
696 
697 	return 0;
698 }
699 
700 /*
701  * @ram_base: !NULL means require memcpy for an exist full android image.
702  */
android_image_separate(struct andr_img_hdr * hdr,const disk_partition_t * part,void * load_address,void * ram_base)703 static int android_image_separate(struct andr_img_hdr *hdr,
704 				  const disk_partition_t *part,
705 				  void *load_address,
706 				  void *ram_base)
707 {
708 	ulong bstart;
709 	int ret;
710 
711 	if (android_image_check_header(hdr)) {
712 		printf("Bad android image header\n");
713 		return -EINVAL;
714 	}
715 
716 	/* set for image_load(IMG_KERNEL, ...) */
717 	env_set_hex("android_addr_r", (ulong)load_address);
718 	bstart = part ? part->start : 0;
719 
720 	/*
721 	 * 1. Load images to their individual target ram position
722 	 *    in order to disable fdt/ramdisk relocation.
723 	 */
724 
725 	/* load rk-kernel.dtb alone */
726 	if (image_load(IMG_RK_DTB, hdr, bstart, ram_base, NULL))
727 		return -1;
728 
729 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
730 	int verify = 1;
731 
732 #ifdef CONFIG_MP_BOOT
733 	verify = mpb_post(3);
734 #endif
735 	if (hdr->header_version < 3 && verify) {
736 		struct udevice *dev = NULL;
737 		uchar hash[20];
738 #ifdef CONFIG_DM_CRYPTO
739 		sha_context ctx;
740 
741 		ctx.length = 0;
742 		ctx.algo = CRYPTO_SHA1;
743 		dev = crypto_get_device(ctx.algo);
744 		if (!dev) {
745 			printf("Can't find crypto device for SHA1\n");
746 			return -ENODEV;
747 		}
748 
749 		/* v1 & v2: requires total length before sha init */
750 		ctx.length += hdr->kernel_size + sizeof(hdr->kernel_size) +
751 			      hdr->ramdisk_size + sizeof(hdr->ramdisk_size) +
752 			      hdr->second_size + sizeof(hdr->second_size);
753 		if (hdr->header_version > 0)
754 			ctx.length += hdr->recovery_dtbo_size +
755 						sizeof(hdr->recovery_dtbo_size);
756 		if (hdr->header_version > 1)
757 			ctx.length += hdr->dtb_size + sizeof(hdr->dtb_size);
758 		crypto_sha_init(dev, &ctx);
759 #else
760 		sha1_starts(&sha1_ctx);
761 #endif
762 		ret = images_load_verify(hdr, bstart, ram_base, dev);
763 		if (ret)
764 			return ret;
765 
766 #ifdef CONFIG_DM_CRYPTO
767 		crypto_sha_final(dev, &ctx, hash);
768 #else
769 		sha1_finish(&sha1_ctx, hash);
770 #endif
771 		if (memcmp(hash, hdr->id, 20)) {
772 			print_hash("Hash from header", (u8 *)hdr->id, 20);
773 			print_hash("Hash real", (u8 *)hash, 20);
774 			return -EBADFD;
775 		} else {
776 			printf("ANDROID: Hash OK\n");
777 		}
778 	} else
779 #endif
780 	{
781 		ret = images_load_verify(hdr, bstart, ram_base, NULL);
782 		if (ret)
783 			return ret;
784 	}
785 
786 	/* 2. Disable fdt/ramdisk relocation, it saves boot time */
787 	env_set("bootm-no-reloc", "y");
788 
789 	return 0;
790 }
791 
android_image_separate_v34(struct andr_img_hdr * hdr,const disk_partition_t * part,void * load_address,void * ram_base)792 static int android_image_separate_v34(struct andr_img_hdr *hdr,
793 				      const disk_partition_t *part,
794 				      void *load_address, void *ram_base)
795 {
796 	ulong bstart;
797 
798 	if (android_image_check_header(hdr)) {
799 		printf("Bad android image header\n");
800 		return -EINVAL;
801 	}
802 
803 	/* set for image_load(IMG_KERNEL, ...) */
804 	env_set_hex("android_addr_r", (ulong)load_address);
805 	bstart = part ? part->start : 0;
806 
807 	/*
808 	 * 1. Load images to their individual target ram position
809 	 *    in order to disable fdt/ramdisk relocation.
810 	 */
811 	if (image_load(IMG_RK_DTB,  hdr, bstart, ram_base, NULL))
812 		return -1;
813 	if (image_load(IMG_KERNEL,  hdr, bstart, ram_base, NULL))
814 		return -1;
815 	if (image_load(IMG_VENDOR_RAMDISK, hdr, bstart, ram_base, NULL))
816 		return -1;
817 	if (image_load(IMG_RAMDISK, hdr, bstart, ram_base, NULL))
818 		return -1;
819 	if (image_load(IMG_BOOTCONFIG, hdr, bstart, ram_base, NULL))
820 		return -1;
821 	/*
822 	 * Copy the populated hdr to load address after image_load(IMG_KERNEL)
823 	 *
824 	 * The image_load(IMG_KERNEL) only reads boot_img_hdr_v34 while
825 	 * vendor_boot_img_hdr_v34 is not included, so fix it here.
826 	 */
827 	memcpy((char *)load_address, hdr, hdr->page_size);
828 
829 	/* 2. Disable fdt/ramdisk relocation, it saves boot time */
830 	env_set("bootm-no-reloc", "y");
831 
832 	return 0;
833 }
834 
android_image_get_comp_addr(struct andr_img_hdr * hdr,int comp)835 static ulong android_image_get_comp_addr(struct andr_img_hdr *hdr, int comp)
836 {
837 	ulong kernel_addr_c;
838 	ulong load_addr = 0;
839 
840 	kernel_addr_c = env_get_ulong("kernel_addr_c", 16, 0);
841 
842 #ifdef CONFIG_ARM64
843 	/*
844 	 * On 64-bit kernel, assuming use IMAGE by default.
845 	 *
846 	 * kernel_addr_c is for LZ4-IMAGE but maybe not defined.
847 	 * kernel_addr_r is for IMAGE.
848 	 */
849 	if (comp != IH_COMP_NONE) {
850 		ulong comp_addr;
851 
852 		if (kernel_addr_c) {
853 			comp_addr = kernel_addr_c;
854 		} else {
855 			printf("Warn: No \"kernel_addr_c\"\n");
856 			comp_addr = CONFIG_SYS_SDRAM_BASE + 0x2000000;/* 32M */
857 			env_set_hex("kernel_addr_c", comp_addr);
858 		}
859 
860 		load_addr = comp_addr - hdr->page_size;
861 	}
862 #else
863 	/*
864 	 * On 32-bit kernel:
865 	 *
866 	 * The input load_addr is from env value: "kernel_addr_r", it has
867 	 * different role depends on whether kernel_addr_c is defined:
868 	 *
869 	 * - kernel_addr_r is for lz4/zImage if kernel_addr_c if [not] defined.
870 	 * - kernel_addr_r is for IMAGE if kernel_addr_c is defined.
871 	 */
872 	if (comp == IH_COMP_NONE) {
873 		if (kernel_addr_c) {
874 			/* input load_addr is for Image, nothing to do */
875 		} else {
876 			/* input load_addr is for lz4/zImage, set default addr for Image */
877 			load_addr = CONFIG_SYS_SDRAM_BASE + 0x8000;
878 			env_set_hex("kernel_addr_r", load_addr);
879 
880 			load_addr -= hdr->page_size;
881 		}
882 	} else {
883 		if (kernel_addr_c) {
884 			/* input load_addr is for Image, so use another for lz4/zImage */
885 			load_addr = kernel_addr_c - hdr->page_size;
886 		} else {
887 			/* input load_addr is for lz4/zImage, nothing to do */
888 		}
889 	}
890 #endif
891 
892 	return load_addr;
893 }
894 
android_image_set_decomp(struct andr_img_hdr * hdr,int comp)895 void android_image_set_decomp(struct andr_img_hdr *hdr, int comp)
896 {
897 	ulong kernel_addr_r;
898 
899 	env_set_ulong("os_comp", comp);
900 
901 	/* zImage handles decompress itself */
902 	if (comp != IH_COMP_NONE && comp != IH_COMP_ZIMAGE) {
903 		kernel_addr_r = env_get_ulong("kernel_addr_r", 16, 0x02080000);
904 		android_image_set_kload(hdr, kernel_addr_r);
905 		android_image_set_comp(hdr, comp);
906 	} else {
907 		android_image_set_comp(hdr, IH_COMP_NONE);
908 	}
909 }
910 
android_image_load_separate(struct andr_img_hdr * hdr,const disk_partition_t * part,void * load_addr)911 static int android_image_load_separate(struct andr_img_hdr *hdr,
912 				       const disk_partition_t *part,
913 				       void *load_addr)
914 {
915 	if (hdr->header_version < 3)
916 		return android_image_separate(hdr, part, load_addr, NULL);
917 	else
918 		return android_image_separate_v34(hdr, part, load_addr, NULL);
919 }
920 
android_image_memcpy_separate(struct andr_img_hdr * hdr,ulong * load_addr)921 int android_image_memcpy_separate(struct andr_img_hdr *hdr, ulong *load_addr)
922 {
923 	ulong comp_addr;
924 	int comp;
925 
926 	comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size);
927 	comp_addr = android_image_get_comp_addr(hdr, comp);
928 
929 	/* non-compressed image: already in-place */
930 	if ((ulong)hdr == *load_addr)
931 		return 0;
932 
933 	/* compressed image */
934 	if (comp_addr) {
935 		*load_addr = comp_addr;
936 		if ((ulong)hdr == comp_addr)	/* already in-place */
937 			return 0;
938 	}
939 
940 	/*
941 	 * The most possible reason to arrive here is:
942 	 *
943 	 * VBoot=1 and AVB load full partition to a temp memory buffer, now we
944 	 * separate(memcpy) subimages from boot.img to where they should be.
945 	 */
946 	if (hdr->header_version < 3) {
947 		if (android_image_separate(hdr, NULL, (void *)(*load_addr), hdr))
948 			return -1;
949 	} else {
950 		if (android_image_separate_v34(hdr, NULL, (void *)(*load_addr), hdr))
951 			return -1;
952 	}
953 
954 	android_image_set_decomp((void *)(*load_addr), comp);
955 
956 	return 0;
957 }
958 
android_image_load(struct blk_desc * dev_desc,const disk_partition_t * part_info,unsigned long load_address,unsigned long max_size)959 long android_image_load(struct blk_desc *dev_desc,
960 			const disk_partition_t *part_info,
961 			unsigned long load_address,
962 			unsigned long max_size) {
963 	struct andr_img_hdr *hdr;
964 	ulong comp_addr;
965 	int comp, ret;
966 	int blk_off;
967 
968 	if (max_size < part_info->blksz)
969 		return -1;
970 
971 	hdr = populate_andr_img_hdr(dev_desc, (disk_partition_t *)part_info);
972 	if (!hdr) {
973 		printf("No valid android hdr\n");
974 		return -1;
975 	}
976 
977 	/*
978 	 * create the layout:
979 	 *
980 	 * |<- page_size ->|1-blk |
981 	 * |-----|---------|------|-----|
982 	 * | hdr |   ...   |   kernel   |
983 	 * |-----|----- ---|------------|
984 	 *
985 	 * Alloc page_size and 1 more blk for reading kernel image to
986 	 * get it's compression type, then fill the android hdr what
987 	 * we have populated before.
988 	 *
989 	 * Why? see: android_image_get_kernel_addr().
990 	 */
991 	blk_off = BLK_CNT(hdr->page_size, dev_desc->blksz);
992 	hdr = (struct andr_img_hdr *)
993 			realloc(hdr, (blk_off + 1) * dev_desc->blksz);
994 	if (!hdr)
995 		return -1;
996 
997 	if (blk_dread(dev_desc, part_info->start + blk_off, 1,
998 		      (char *)hdr + hdr->page_size) != 1) {
999 		free(hdr);
1000 		return -1;
1001 	}
1002 
1003 	/* Changed to compressed address ? */
1004 	comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size);
1005 	comp_addr = android_image_get_comp_addr(hdr, comp);
1006 	if (comp_addr)
1007 		load_address = comp_addr;
1008 	else
1009 		load_address -= hdr->page_size;
1010 
1011 	ret = android_image_load_separate(hdr, part_info, (void *)load_address);
1012 	if (ret) {
1013 		printf("Failed to load android image\n");
1014 		goto fail;
1015 	}
1016 	android_image_set_decomp((void *)load_address, comp);
1017 
1018 	debug("Loading Android Image to 0x%08lx\n", load_address);
1019 
1020 	free(hdr);
1021 	return load_address;
1022 
1023 fail:
1024 	free(hdr);
1025 	return -1;
1026 }
1027 
1028 static struct andr_img_hdr *
extract_boot_image_v012_header(struct blk_desc * dev_desc,const disk_partition_t * boot_img)1029 extract_boot_image_v012_header(struct blk_desc *dev_desc,
1030 			       const disk_partition_t *boot_img)
1031 {
1032 	struct andr_img_hdr *hdr;
1033 	long blk_cnt, blks_read;
1034 
1035 	blk_cnt = BLK_CNT(sizeof(struct andr_img_hdr), dev_desc->blksz);
1036 	hdr = (struct andr_img_hdr *)malloc(blk_cnt * dev_desc->blksz);
1037 
1038 	if (!blk_cnt || !hdr)
1039 		return NULL;
1040 
1041 	blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, hdr);
1042 	if (blks_read != blk_cnt) {
1043 		debug("boot img header blk cnt is %ld and blks read is %ld\n",
1044 		      blk_cnt, blks_read);
1045 		return NULL;
1046 	}
1047 
1048 	if (android_image_check_header((void *)hdr)) {
1049 		printf("boot header magic is invalid.\n");
1050 		return NULL;
1051 	}
1052 
1053 	if (hdr->page_size < sizeof(*hdr)) {
1054 		printf("android hdr is over size\n");
1055 		return NULL;
1056 	}
1057 
1058 	return hdr;
1059 }
1060 
1061 static struct boot_img_hdr_v34 *
extract_boot_image_v34_header(struct blk_desc * dev_desc,const disk_partition_t * boot_img)1062 extract_boot_image_v34_header(struct blk_desc *dev_desc,
1063 			      const disk_partition_t *boot_img)
1064 {
1065 	struct boot_img_hdr_v34 *boot_hdr;
1066 	disk_partition_t part;
1067 	long blk_cnt, blks_read;
1068 
1069 	blk_cnt = BLK_CNT(sizeof(struct boot_img_hdr_v34), dev_desc->blksz);
1070 	boot_hdr = (struct boot_img_hdr_v34 *)malloc(blk_cnt * dev_desc->blksz);
1071 
1072 	if (!blk_cnt || !boot_hdr)
1073 		return NULL;
1074 
1075 	blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, boot_hdr);
1076 	if (blks_read != blk_cnt) {
1077 		debug("boot img header blk cnt is %ld and blks read is %ld\n",
1078 		      blk_cnt, blks_read);
1079 		return NULL;
1080 	}
1081 
1082 	if (android_image_check_header((void *)boot_hdr)) {
1083 		printf("boot header magic is invalid.\n");
1084 		return NULL;
1085 	}
1086 
1087 	if (boot_hdr->header_version < 3) {
1088 		printf("boot header %d, is not >= v3.\n",
1089 		       boot_hdr->header_version);
1090 		return NULL;
1091 	}
1092 
1093 	/* Start from android-13 GKI, it doesn't assign 'os_version' */
1094 	if (boot_hdr->header_version >= 4 && boot_hdr->os_version == 0) {
1095 		if (part_get_info_by_name(dev_desc,
1096 				ANDROID_PARTITION_INIT_BOOT, &part) > 0)
1097 			boot_hdr->os_version = 13 << 25;
1098 	}
1099 
1100 	return boot_hdr;
1101 }
1102 
1103 static struct vendor_boot_img_hdr_v34 *
extract_vendor_boot_image_v34_header(struct blk_desc * dev_desc,const disk_partition_t * part_vendor_boot)1104 extract_vendor_boot_image_v34_header(struct blk_desc *dev_desc,
1105 				     const disk_partition_t *part_vendor_boot)
1106 {
1107 	struct vendor_boot_img_hdr_v34 *vboot_hdr;
1108 	long blk_cnt, blks_read;
1109 
1110 	blk_cnt = BLK_CNT(sizeof(struct vendor_boot_img_hdr_v34),
1111 				part_vendor_boot->blksz);
1112 	vboot_hdr = (struct vendor_boot_img_hdr_v34 *)
1113 				malloc(blk_cnt * part_vendor_boot->blksz);
1114 
1115 	if (!blk_cnt || !vboot_hdr)
1116 		return NULL;
1117 
1118 	blks_read = blk_dread(dev_desc, part_vendor_boot->start,
1119 			      blk_cnt, vboot_hdr);
1120 	if (blks_read != blk_cnt) {
1121 		debug("vboot img header blk cnt is %ld and blks read is %ld\n",
1122 		      blk_cnt, blks_read);
1123 		return NULL;
1124 	}
1125 
1126 	if (strncmp(VENDOR_BOOT_MAGIC, (void *)vboot_hdr->magic,
1127 		    VENDOR_BOOT_MAGIC_SIZE)) {
1128 		printf("vendor boot header is invalid.\n");
1129 		return NULL;
1130 	}
1131 
1132 	if (vboot_hdr->header_version < 3) {
1133 		printf("vendor boot header %d, is not >= v3.\n",
1134 		       vboot_hdr->header_version);
1135 		return NULL;
1136 	}
1137 
1138 	return vboot_hdr;
1139 }
1140 
populate_boot_info(const struct boot_img_hdr_v34 * boot_hdr,const struct vendor_boot_img_hdr_v34 * vendor_boot_hdr,const struct boot_img_hdr_v34 * init_boot_hdr,struct andr_img_hdr * hdr,bool save_hdr)1141 int populate_boot_info(const struct boot_img_hdr_v34 *boot_hdr,
1142 		       const struct vendor_boot_img_hdr_v34 *vendor_boot_hdr,
1143 		       const struct boot_img_hdr_v34 *init_boot_hdr,
1144 		       struct andr_img_hdr *hdr, bool save_hdr)
1145 {
1146 	memset(hdr->magic, 0, ANDR_BOOT_MAGIC_SIZE);
1147 	memcpy(hdr->magic, boot_hdr->magic, ANDR_BOOT_MAGIC_SIZE);
1148 
1149 	hdr->kernel_size = boot_hdr->kernel_size;
1150 	/* don't use vendor_boot_hdr->kernel_addr, we prefer "hdr + hdr->page_size" */
1151 	hdr->kernel_addr = ANDROID_IMAGE_DEFAULT_KERNEL_ADDR;
1152 
1153 	/*
1154 	 * generic ramdisk: immediately following the vendor ramdisk.
1155 	 * It can be from init_boot.img or boot.img.
1156 	 */
1157 	if (init_boot_hdr)
1158 		hdr->ramdisk_size = init_boot_hdr->ramdisk_size;
1159 	else
1160 		hdr->ramdisk_size = boot_hdr->ramdisk_size;
1161 
1162 	/* actually, useless */
1163 	hdr->ramdisk_addr = env_get_ulong("ramdisk_addr_r", 16, 0);
1164 
1165 	/* removed in v3 */
1166 	hdr->second_size = 0;
1167 	hdr->second_addr = 0;
1168 
1169 	hdr->tags_addr = vendor_boot_hdr->tags_addr;
1170 
1171 	/* fixed in v3 */
1172 	hdr->page_size = 4096;
1173 	hdr->header_version = boot_hdr->header_version;
1174 	hdr->os_version = boot_hdr->os_version;
1175 
1176 	memset(hdr->name, 0, ANDR_BOOT_NAME_SIZE);
1177 	strncpy(hdr->name, (const char *)vendor_boot_hdr->name, ANDR_BOOT_NAME_SIZE);
1178 
1179 	/* removed in v3 */
1180 	memset(hdr->cmdline, 0, ANDR_BOOT_ARGS_SIZE);
1181 	memset(hdr->id, 0, 32);
1182 	memset(hdr->extra_cmdline, 0, ANDR_BOOT_EXTRA_ARGS_SIZE);
1183 	hdr->recovery_dtbo_size = 0;
1184 	hdr->recovery_dtbo_offset = 0;
1185 
1186 	hdr->header_size = boot_hdr->header_size;
1187 	hdr->dtb_size = vendor_boot_hdr->dtb_size;
1188 	hdr->dtb_addr = vendor_boot_hdr->dtb_addr;
1189 
1190 	/* boot_img_hdr_v34 fields */
1191 	hdr->vendor_ramdisk_size = vendor_boot_hdr->vendor_ramdisk_size;
1192 	hdr->vendor_page_size = vendor_boot_hdr->page_size;
1193 	hdr->vendor_header_version = vendor_boot_hdr->header_version;
1194 	hdr->vendor_header_size = vendor_boot_hdr->header_size;
1195 
1196 	hdr->total_cmdline = calloc(1, TOTAL_BOOT_ARGS_SIZE);
1197 	if (!hdr->total_cmdline)
1198 		return -ENOMEM;
1199 	strncpy(hdr->total_cmdline, (const char *)boot_hdr->cmdline,
1200 		sizeof(boot_hdr->cmdline));
1201 	strncat(hdr->total_cmdline, " ", 1);
1202 	strncat(hdr->total_cmdline, (const char *)vendor_boot_hdr->cmdline,
1203 		sizeof(vendor_boot_hdr->cmdline));
1204 
1205 	/* new for header v4 */
1206 	if (vendor_boot_hdr->header_version >= 4) {
1207 		hdr->vendor_ramdisk_table_size =
1208 				vendor_boot_hdr->vendor_ramdisk_table_size;
1209 		hdr->vendor_ramdisk_table_entry_num =
1210 				vendor_boot_hdr->vendor_ramdisk_table_entry_num;
1211 		hdr->vendor_ramdisk_table_entry_size =
1212 				vendor_boot_hdr->vendor_ramdisk_table_entry_size;
1213 		/*
1214 		 * If we place additional "androidboot.xxx" parameters after
1215 		 * bootconfig, this field value should be increased,
1216 		 * but not over than ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE.
1217 		 */
1218 		hdr->vendor_bootconfig_size =
1219 				vendor_boot_hdr->vendor_bootconfig_size;
1220 	} else {
1221 		hdr->vendor_ramdisk_table_size = 0;
1222 		hdr->vendor_ramdisk_table_entry_num = 0;
1223 		hdr->vendor_ramdisk_table_entry_size = 0;
1224 		hdr->vendor_bootconfig_size = 0;
1225 	}
1226 
1227 	hdr->init_boot_buf = save_hdr ? (void *)init_boot_hdr : 0;
1228 	hdr->vendor_boot_buf = save_hdr ? (void *)vendor_boot_hdr : 0;
1229 
1230 	if (hdr->page_size < sizeof(*hdr)) {
1231 		printf("android hdr is over size\n");
1232 		return -EINVAL;
1233 	}
1234 
1235 	return 0;
1236 }
1237 
1238 /*
1239  * The possible cases of boot.img + recovery.img:
1240  *
1241  * [N]: 0, 1, 2
1242  * [M]: 0, 1, 2, 3, 4
1243  *
1244  * |--------------------|---------------------|
1245  * |   boot.img         |    recovery.img     |
1246  * |--------------------|---------------------|
1247  * | boot_img_hdr_v[N]  |  boot_img_hdr_v[N]  | <= if A/B is not required
1248  * |--------------------|---------------------|
1249  * | boot_img_hdr_v34   |  boot_img_hdr_v2    | <= if A/B is not required
1250  * |------------------------------------------|
1251  * | boot_img_hdr_v[M], no recovery.img       | <= if A/B is required
1252  * |------------------------------------------|
1253  */
populate_andr_img_hdr(struct blk_desc * dev_desc,disk_partition_t * part_boot)1254 struct andr_img_hdr *populate_andr_img_hdr(struct blk_desc *dev_desc,
1255 					   disk_partition_t *part_boot)
1256 {
1257 	disk_partition_t part_vendor_boot;
1258 	disk_partition_t part_init_boot;
1259 	struct vendor_boot_img_hdr_v34 *vboot_hdr = NULL;
1260 	struct boot_img_hdr_v34 *iboot_hdr = NULL;
1261 	struct boot_img_hdr_v34 *boot_hdr = NULL;
1262 	struct andr_img_hdr *andr_hdr = NULL;
1263 	int header_version;
1264 	int andr_version;
1265 
1266 	if (!dev_desc || !part_boot)
1267 		return NULL;
1268 
1269 	andr_hdr = (struct andr_img_hdr *)malloc(1 * dev_desc->blksz);
1270 	if (!andr_hdr)
1271 		return NULL;
1272 
1273 	if (blk_dread(dev_desc, part_boot->start, 1, andr_hdr) != 1) {
1274 		free(andr_hdr);
1275 		return NULL;
1276 	}
1277 
1278 	if (android_image_check_header(andr_hdr)) {
1279 		free(andr_hdr);
1280 		return NULL;
1281 	}
1282 
1283 	header_version = andr_hdr->header_version;
1284 	free(andr_hdr);
1285 	andr_hdr = NULL;
1286 
1287 	if (header_version < 3) {
1288 		return extract_boot_image_v012_header(dev_desc, part_boot);
1289 	} else {
1290 		if (part_get_info_by_name(dev_desc,
1291 					  ANDROID_PARTITION_VENDOR_BOOT,
1292 					  &part_vendor_boot) < 0) {
1293 			printf("No vendor boot partition\n");
1294 			return NULL;
1295 		}
1296 		boot_hdr = extract_boot_image_v34_header(dev_desc, part_boot);
1297 		vboot_hdr = extract_vendor_boot_image_v34_header(dev_desc,
1298 							&part_vendor_boot);
1299 		if (!boot_hdr || !vboot_hdr)
1300 			goto image_load_exit;
1301 
1302 		andr_version = (boot_hdr->os_version >> 25) & 0x7f;
1303 		if (header_version >= 4 && andr_version >= 13) {
1304 			if (part_get_info_by_name(dev_desc,
1305 						  ANDROID_PARTITION_INIT_BOOT,
1306 						  &part_init_boot) < 0) {
1307 				printf("No init boot partition\n");
1308 				return NULL;
1309 			}
1310 			iboot_hdr = extract_boot_image_v34_header(dev_desc, &part_init_boot);
1311 			if (!iboot_hdr)
1312 				goto image_load_exit;
1313 			if (!iboot_hdr->ramdisk_size) {
1314 				printf("No ramdisk in init boot partition\n");
1315 				goto image_load_exit;
1316 			}
1317 		}
1318 
1319 		andr_hdr = (struct andr_img_hdr *)
1320 				malloc(sizeof(struct andr_img_hdr));
1321 		if (!andr_hdr) {
1322 			printf("No memory for andr hdr\n");
1323 			goto image_load_exit;
1324 		}
1325 
1326 		if (populate_boot_info(boot_hdr, vboot_hdr,
1327 				       iboot_hdr, andr_hdr, false)) {
1328 			printf("populate boot info failed\n");
1329 			goto image_load_exit;
1330 		}
1331 
1332 image_load_exit:
1333 		if (boot_hdr)
1334 			free(boot_hdr);
1335 		if (iboot_hdr)
1336 			free(iboot_hdr);
1337 		if (vboot_hdr)
1338 			free(vboot_hdr);
1339 
1340 		return andr_hdr;
1341 	}
1342 
1343 	return NULL;
1344 }
1345 
1346 #if !defined(CONFIG_SPL_BUILD)
1347 /**
1348  * android_print_contents - prints out the contents of the Android format image
1349  * @hdr: pointer to the Android format image header
1350  *
1351  * android_print_contents() formats a multi line Android image contents
1352  * description.
1353  * The routine prints out Android image properties
1354  *
1355  * returns:
1356  *     no returned results
1357  */
android_print_contents(const struct andr_img_hdr * hdr)1358 void android_print_contents(const struct andr_img_hdr *hdr)
1359 {
1360 	const char * const p = IMAGE_INDENT_STRING;
1361 	/* os_version = ver << 11 | lvl */
1362 	u32 os_ver = hdr->os_version >> 11;
1363 	u32 os_lvl = hdr->os_version & ((1U << 11) - 1);
1364 	u32 header_version = hdr->header_version;
1365 
1366 	printf("%skernel size:      %x\n", p, hdr->kernel_size);
1367 	printf("%skernel address:   %x\n", p, hdr->kernel_addr);
1368 	printf("%sramdisk size:     %x\n", p, hdr->ramdisk_size);
1369 	printf("%sramdisk address: %x\n", p, hdr->ramdisk_addr);
1370 	printf("%ssecond size:      %x\n", p, hdr->second_size);
1371 	printf("%ssecond address:   %x\n", p, hdr->second_addr);
1372 	printf("%stags address:     %x\n", p, hdr->tags_addr);
1373 	printf("%spage size:        %x\n", p, hdr->page_size);
1374 	printf("%sheader_version:   %x\n", p, header_version);
1375 	/* ver = A << 14 | B << 7 | C         (7 bits for each of A, B, C)
1376 	 * lvl = ((Y - 2000) & 127) << 4 | M  (7 bits for Y, 4 bits for M) */
1377 	printf("%sos_version:       %x (ver: %u.%u.%u, level: %u.%u)\n",
1378 	       p, hdr->os_version,
1379 	       (os_ver >> 7) & 0x7F, (os_ver >> 14) & 0x7F, os_ver & 0x7F,
1380 	       (os_lvl >> 4) + 2000, os_lvl & 0x0F);
1381 	printf("%sname:             %s\n", p, hdr->name);
1382 	printf("%scmdline:          %s\n", p, hdr->cmdline);
1383 
1384 	if (header_version == 1 || header_version == 2) {
1385 		printf("%srecovery dtbo size:    %x\n", p, hdr->recovery_dtbo_size);
1386 		printf("%srecovery dtbo offset:  %llx\n", p, hdr->recovery_dtbo_offset);
1387 		printf("%sheader size:           %x\n", p, hdr->header_size);
1388 	}
1389 
1390 	if (header_version == 2 || header_version == 3) {
1391 		printf("%sdtb size:              %x\n", p, hdr->dtb_size);
1392 		printf("%sdtb addr:              %llx\n", p, hdr->dtb_addr);
1393 	}
1394 
1395 	if (header_version >= 3) {
1396 		printf("%scmdline:               %s\n", p, hdr->total_cmdline);
1397 		printf("%svendor ramdisk size:   %x\n", p, hdr->vendor_ramdisk_size);
1398 		printf("%svendor page size:      %x\n", p, hdr->vendor_page_size);
1399 		printf("%svendor header version: %d\n", p, hdr->vendor_header_version);
1400 		printf("%svendor header size:    %x\n", p, hdr->vendor_header_size);
1401 	}
1402 
1403 	if (header_version >= 4) {
1404 		printf("%svendor ramdisk table size:        %x\n",
1405 		       p, hdr->vendor_ramdisk_table_size);
1406 		printf("%svendor ramdisk table entry num:   %x\n",
1407 		       p, hdr->vendor_ramdisk_table_entry_num);
1408 		printf("%svendor ramdisk table entry size:  %x\n",
1409 		       p, hdr->vendor_ramdisk_table_entry_size);
1410 		printf("%svendor bootconfig size:           %d\n",
1411 		       p, hdr->vendor_bootconfig_size);
1412 	}
1413 }
1414 #endif
1415