1 /* 2 * Copyright (c) 2011 Sebastian Andrzej Siewior <bigeasy@linutronix.de> 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 #include <common.h> 8 #include <image.h> 9 #include <android_image.h> 10 #include <android_bootloader.h> 11 #include <malloc.h> 12 #include <mapmem.h> 13 #include <errno.h> 14 #include <boot_rkimg.h> 15 #include <crypto.h> 16 #include <sysmem.h> 17 #include <u-boot/sha1.h> 18 #ifdef CONFIG_RKIMG_BOOTLOADER 19 #include <asm/arch/resource_img.h> 20 #endif 21 #ifdef CONFIG_RK_AVB_LIBAVB_USER 22 #include <android_avb/avb_slot_verify.h> 23 #include <android_avb/avb_ops_user.h> 24 #include <android_avb/rk_avb_ops_user.h> 25 #endif 26 #include <optee_include/OpteeClientInterface.h> 27 28 DECLARE_GLOBAL_DATA_PTR; 29 30 #define ANDROID_IMAGE_DEFAULT_KERNEL_ADDR 0x10008000 31 #define ANDROID_ARG_FDT_FILENAME "rk-kernel.dtb" 32 #define ANDROID_Q_VER 10 33 #define ANDROID_PARTITION_VENDOR_BOOT "vendor_boot" 34 35 #define BLK_CNT(_num_bytes, _block_size) \ 36 ((_num_bytes + _block_size - 1) / _block_size) 37 38 static char andr_tmp_str[ANDR_BOOT_ARGS_SIZE + 1]; 39 static u32 android_kernel_comp_type = IH_COMP_NONE; 40 41 u32 android_image_major_version(void) 42 { 43 /* MSB 7-bits */ 44 return gd->bd->bi_andr_version >> 25; 45 } 46 47 u32 android_bcb_msg_sector_offset(void) 48 { 49 /* 50 * Rockchip platforms defines BCB message at the 16KB offset of 51 * misc partition while the Google defines it at 0x00 offset. 52 * 53 * From Android-Q, the 0x00 offset is mandary on Google VTS, so that 54 * this is a compatibility according to android image 'os_version'. 55 */ 56 #ifdef CONFIG_RKIMG_BOOTLOADER 57 return (android_image_major_version() >= ANDROID_Q_VER) ? 0x00 : 0x20; 58 #else 59 return 0x00; 60 #endif 61 } 62 63 static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr) 64 { 65 /* 66 * All the Android tools that generate a boot.img use this 67 * address as the default. 68 * 69 * Even though it doesn't really make a lot of sense, and it 70 * might be valid on some platforms, we treat that address as 71 * the default value for this field, and try to execute the 72 * kernel in place in such a case. 73 * 74 * Otherwise, we will return the actual value set by the user. 75 */ 76 if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR) 77 return (ulong)hdr + hdr->page_size; 78 79 #ifdef CONFIG_ARCH_ROCKCHIP 80 /* 81 * If kernel is compressed, kernel_addr is set as decompressed address 82 * after compressed being loaded to ram, so let's use it. 83 */ 84 if (android_kernel_comp_type != IH_COMP_NONE && 85 android_kernel_comp_type != IH_COMP_ZIMAGE) 86 return hdr->kernel_addr; 87 88 /* 89 * Compatble with rockchip legacy packing with kernel/ramdisk/second 90 * address base from 0x60000000(SDK versiont < 8.1), these are invalid 91 * address, so we calc it by real size. 92 */ 93 return (ulong)hdr + hdr->page_size; 94 #else 95 return hdr->kernel_addr; 96 #endif 97 98 } 99 100 void android_image_set_comp(struct andr_img_hdr *hdr, u32 comp) 101 { 102 android_kernel_comp_type = comp; 103 } 104 105 u32 android_image_get_comp(const struct andr_img_hdr *hdr) 106 { 107 return android_kernel_comp_type; 108 } 109 110 int android_image_parse_kernel_comp(const struct andr_img_hdr *hdr) 111 { 112 ulong kaddr = android_image_get_kernel_addr(hdr); 113 return bootm_parse_comp((const unsigned char *)kaddr); 114 } 115 116 /** 117 * android_image_get_kernel() - processes kernel part of Android boot images 118 * @hdr: Pointer to image header, which is at the start 119 * of the image. 120 * @verify: Checksum verification flag. Currently unimplemented. 121 * @os_data: Pointer to a ulong variable, will hold os data start 122 * address. 123 * @os_len: Pointer to a ulong variable, will hold os data length. 124 * 125 * This function returns the os image's start address and length. Also, 126 * it appends the kernel command line to the bootargs env variable. 127 * 128 * Return: Zero, os start address and length on success, 129 * otherwise on failure. 130 */ 131 int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify, 132 ulong *os_data, ulong *os_len) 133 { 134 u32 kernel_addr = android_image_get_kernel_addr(hdr); 135 const char *cmdline = hdr->header_version < 3 ? 136 hdr->cmdline : hdr->total_cmdline; 137 /* 138 * Not all Android tools use the id field for signing the image with 139 * sha1 (or anything) so we don't check it. It is not obvious that the 140 * string is null terminated so we take care of this. 141 */ 142 strncpy(andr_tmp_str, hdr->name, ANDR_BOOT_NAME_SIZE); 143 andr_tmp_str[ANDR_BOOT_NAME_SIZE] = '\0'; 144 if (strlen(andr_tmp_str)) 145 printf("Android's image name: %s\n", andr_tmp_str); 146 147 printf("Kernel: 0x%08x - 0x%08x (%u KiB)\n", 148 kernel_addr, kernel_addr + hdr->kernel_size, 149 DIV_ROUND_UP(hdr->kernel_size, 1024)); 150 151 int len = 0; 152 if (cmdline) { 153 debug("Kernel command line: %s\n", cmdline); 154 len += strlen(cmdline); 155 } 156 157 char *bootargs = env_get("bootargs"); 158 if (bootargs) 159 len += strlen(bootargs); 160 161 char *newbootargs = malloc(len + 2); 162 if (!newbootargs) { 163 puts("Error: malloc in android_image_get_kernel failed!\n"); 164 return -ENOMEM; 165 } 166 *newbootargs = '\0'; 167 168 if (bootargs) { 169 strcpy(newbootargs, bootargs); 170 strcat(newbootargs, " "); 171 } 172 if (cmdline) 173 strcat(newbootargs, cmdline); 174 175 env_set("bootargs", newbootargs); 176 177 if (os_data) { 178 *os_data = (ulong)hdr; 179 *os_data += hdr->page_size; 180 } 181 if (os_len) 182 *os_len = hdr->kernel_size; 183 return 0; 184 } 185 186 int android_image_check_header(const struct andr_img_hdr *hdr) 187 { 188 return memcmp(ANDR_BOOT_MAGIC, hdr->magic, ANDR_BOOT_MAGIC_SIZE); 189 } 190 191 ulong android_image_get_end(const struct andr_img_hdr *hdr) 192 { 193 ulong end; 194 /* 195 * The header takes a full page, the remaining components are aligned 196 * on page boundary 197 */ 198 end = (ulong)hdr; 199 if (hdr->header_version < 3) { 200 end += hdr->page_size; 201 end += ALIGN(hdr->kernel_size, hdr->page_size); 202 end += ALIGN(hdr->ramdisk_size, hdr->page_size); 203 end += ALIGN(hdr->second_size, hdr->page_size); 204 if (hdr->header_version == 1) { 205 end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size); 206 } else if (hdr->header_version == 2) { 207 end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size); 208 end += ALIGN(hdr->dtb_size, hdr->page_size); 209 } 210 } else { 211 /* boot_img_hdr_v34 */ 212 end += hdr->page_size; 213 end += ALIGN(hdr->kernel_size, hdr->page_size); 214 end += ALIGN(hdr->ramdisk_size, hdr->page_size); 215 } 216 217 return end; 218 } 219 220 u32 android_image_get_ksize(const struct andr_img_hdr *hdr) 221 { 222 return hdr->kernel_size; 223 } 224 225 void android_image_set_kload(struct andr_img_hdr *hdr, u32 load_address) 226 { 227 hdr->kernel_addr = load_address; 228 } 229 230 ulong android_image_get_kload(const struct andr_img_hdr *hdr) 231 { 232 return android_image_get_kernel_addr(hdr); 233 } 234 235 int android_image_get_ramdisk(const struct andr_img_hdr *hdr, 236 ulong *rd_data, ulong *rd_len) 237 { 238 ulong ramdisk_addr_r; 239 ulong start, end; 240 241 if (!hdr->ramdisk_size) { 242 *rd_data = *rd_len = 0; 243 return -1; 244 } 245 246 /* Have been loaded by android_image_load_separate() on ramdisk_addr_r */ 247 ramdisk_addr_r = env_get_ulong("ramdisk_addr_r", 16, 0); 248 if (!ramdisk_addr_r) { 249 printf("No Found Ramdisk Load Address.\n"); 250 return -1; 251 } 252 253 *rd_data = ramdisk_addr_r; 254 *rd_len = hdr->ramdisk_size; 255 if (hdr->header_version >= 3) 256 *rd_len += hdr->vendor_ramdisk_size; 257 if (hdr->header_version >= 4) { 258 *rd_len += hdr->vendor_bootconfig_size + 259 ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE; 260 } 261 262 /* just for print msg */ 263 start = ramdisk_addr_r; 264 if (hdr->header_version >= 3) { 265 end = start + (ulong)hdr->vendor_ramdisk_size; 266 printf("v-ramdisk: 0x%08lx - 0x%08lx (%u KiB)\n", 267 start, end, DIV_ROUND_UP(hdr->vendor_ramdisk_size, 1024)); 268 start = end; 269 } 270 { 271 end = start + (ulong)hdr->ramdisk_size; 272 printf("ramdisk: 0x%08lx - 0x%08lx (%u KiB)\n", 273 start, end, DIV_ROUND_UP(hdr->ramdisk_size, 1024)); 274 start = end; 275 } 276 if (hdr->header_version >= 4) { 277 end = start + (ulong)hdr->vendor_bootconfig_size; 278 printf("bootconfig: 0x%08lx - 0x%08lx (%u KiB)\n", 279 start, end, DIV_ROUND_UP(hdr->vendor_bootconfig_size, 1024)); 280 start = end; 281 end = start + ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE; 282 printf("bootparams: 0x%08lx - 0x%08lx\n", start, end); 283 } 284 285 return 0; 286 } 287 288 int android_image_get_fdt(const struct andr_img_hdr *hdr, 289 ulong *rd_data) 290 { 291 ulong fdt_addr_r; 292 293 if (!hdr->second_size) { 294 *rd_data = 0; 295 return -1; 296 } 297 298 /* Have been loaded by android_image_load_separate() on fdt_addr_r */ 299 fdt_addr_r = env_get_ulong("fdt_addr_r", 16, 0); 300 if (!fdt_addr_r) { 301 printf("No Found FDT Load Address.\n"); 302 return -1; 303 } 304 305 *rd_data = fdt_addr_r; 306 307 debug("FDT load addr 0x%08x size %u KiB\n", 308 hdr->second_addr, DIV_ROUND_UP(hdr->second_size, 1024)); 309 310 return 0; 311 } 312 313 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH 314 static void print_hash(const char *label, u8 *hash, int len) 315 { 316 int i; 317 318 printf("%s:\n 0x", label ? : "Hash"); 319 for (i = 0; i < len; i++) 320 printf("%02x", hash[i]); 321 printf("\n"); 322 } 323 #endif 324 325 typedef enum { 326 IMG_KERNEL, 327 IMG_RAMDISK, 328 IMG_SECOND, 329 IMG_RECOVERY_DTBO, 330 IMG_RK_DTB, /* within resource.img in second position */ 331 IMG_DTB, 332 IMG_VENDOR_RAMDISK, 333 IMG_BOOTCONFIG, 334 IMG_MAX, 335 } img_t; 336 337 #if defined(CONFIG_ANDROID_BOOT_IMAGE_HASH) && !defined(CONFIG_DM_CRYPTO) 338 static sha1_context sha1_ctx; 339 #endif 340 341 static int image_load(img_t img, struct andr_img_hdr *hdr, 342 ulong blkstart, void *ram_base, 343 struct udevice *crypto) 344 { 345 struct blk_desc *desc = rockchip_get_bootdev(); 346 disk_partition_t part_vendor_boot; 347 __maybe_unused u32 typesz; 348 ulong pgsz = hdr->page_size; 349 ulong blksz = desc->blksz; 350 ulong blkcnt, blkoff; 351 ulong memmove_dst = 0; 352 ulong bsoffs = 0; 353 ulong extra = 0; 354 ulong length; 355 void *buffer; 356 int ret = 0; 357 358 switch (img) { 359 case IMG_KERNEL: 360 bsoffs = 0; /* include a page_size(image header) */ 361 length = hdr->kernel_size + pgsz; 362 buffer = (void *)env_get_ulong("android_addr_r", 16, 0); 363 blkcnt = DIV_ROUND_UP(hdr->kernel_size + pgsz, blksz); 364 typesz = sizeof(hdr->kernel_size); 365 if (!sysmem_alloc_base(MEM_KERNEL, 366 (phys_addr_t)buffer, blkcnt * blksz)) 367 return -ENOMEM; 368 break; 369 case IMG_VENDOR_RAMDISK: 370 if (part_get_info_by_name(desc, 371 ANDROID_PARTITION_VENDOR_BOOT, 372 &part_vendor_boot) < 0) { 373 printf("No vendor boot partition\n"); 374 return -ENOENT; 375 } 376 /* Always load vendor boot from storage: avb full load boot/recovery */ 377 blkstart = part_vendor_boot.start; 378 pgsz = hdr->vendor_page_size; 379 ram_base = 0; 380 381 bsoffs = ALIGN(VENDOR_BOOT_HDRv3_SIZE, pgsz); 382 length = hdr->vendor_ramdisk_size; 383 buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0); 384 blkcnt = DIV_ROUND_UP(hdr->vendor_ramdisk_size, blksz); 385 typesz = sizeof(hdr->vendor_ramdisk_size); 386 /* 387 * Add extra memory for generic ramdisk space. 388 * 389 * In case of unaligned vendor ramdisk size, reserve 390 * 1 more blksz. 391 * 392 * Reserve 8KB for bootloader cmdline. 393 */ 394 if (hdr->header_version >= 3) 395 extra += ALIGN(hdr->ramdisk_size, blksz) + blksz; 396 if (hdr->header_version >= 4) 397 extra += ALIGN(hdr->vendor_bootconfig_size, blksz) + 398 ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE; 399 if (length && !sysmem_alloc_base(MEM_RAMDISK, 400 (phys_addr_t)buffer, blkcnt * blksz + extra)) 401 return -ENOMEM; 402 break; 403 case IMG_RAMDISK: 404 bsoffs = pgsz + ALIGN(hdr->kernel_size, pgsz); 405 length = hdr->ramdisk_size; 406 buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0); 407 blkcnt = DIV_ROUND_UP(hdr->ramdisk_size, blksz); 408 typesz = sizeof(hdr->ramdisk_size); 409 410 /* 411 * ramdisk_addr_r v012: 412 * |----------------| 413 * | ramdisk | 414 * |----------------| 415 * 416 * ramdisk_addr_r v3: 417 * |----------------|---------| 418 * | vendor-ramdisk | ramdisk | 419 * |----------------|---------| 420 * 421 * ramdisk_addr_r v4: 422 * |----------------|---------|------------|------------| 423 * | vendor-ramdisk | ramdisk | bootconfig | bootparams | 424 * |----------------|---------|------------|------------| 425 */ 426 if (hdr->header_version >= 3) { 427 buffer += hdr->vendor_ramdisk_size; 428 if (!IS_ALIGNED((ulong)buffer, blksz)) { 429 memmove_dst = (ulong)buffer; 430 buffer = (void *)ALIGN(memmove_dst, blksz); 431 } 432 } 433 /* sysmem has been alloced by vendor ramdisk */ 434 if (hdr->header_version < 3) { 435 if (length && !sysmem_alloc_base(MEM_RAMDISK, 436 (phys_addr_t)buffer, blkcnt * blksz)) 437 return -ENOMEM; 438 } 439 break; 440 case IMG_BOOTCONFIG: 441 if (hdr->header_version < 4) 442 return 0; 443 if (part_get_info_by_name(desc, 444 ANDROID_PARTITION_VENDOR_BOOT, 445 &part_vendor_boot) < 0) { 446 printf("No vendor boot partition\n"); 447 return -ENOENT; 448 } 449 450 blkstart = part_vendor_boot.start; 451 pgsz = hdr->vendor_page_size; 452 ram_base = 0; 453 454 bsoffs = ALIGN(VENDOR_BOOT_HDRv4_SIZE, pgsz) + 455 ALIGN(hdr->vendor_ramdisk_size, pgsz) + 456 ALIGN(hdr->dtb_size, pgsz) + 457 ALIGN(hdr->vendor_ramdisk_table_size, pgsz); 458 length = hdr->vendor_bootconfig_size; 459 buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0); 460 blkcnt = DIV_ROUND_UP(hdr->vendor_bootconfig_size, blksz); 461 typesz = sizeof(hdr->vendor_bootconfig_size); 462 463 buffer += hdr->vendor_ramdisk_size + hdr->ramdisk_size; 464 if (!IS_ALIGNED((ulong)buffer, blksz)) { 465 memmove_dst = (ulong)buffer; 466 buffer = (void *)ALIGN(memmove_dst, blksz); 467 } 468 break; 469 case IMG_SECOND: 470 bsoffs = pgsz + 471 ALIGN(hdr->kernel_size, pgsz) + 472 ALIGN(hdr->ramdisk_size, pgsz); 473 length = hdr->second_size; 474 blkcnt = DIV_ROUND_UP(hdr->second_size, blksz); 475 buffer = malloc(blkcnt * blksz); 476 typesz = sizeof(hdr->second_size); 477 break; 478 case IMG_RECOVERY_DTBO: 479 bsoffs = pgsz + 480 ALIGN(hdr->kernel_size, pgsz) + 481 ALIGN(hdr->ramdisk_size, pgsz) + 482 ALIGN(hdr->second_size, pgsz); 483 length = hdr->recovery_dtbo_size; 484 blkcnt = DIV_ROUND_UP(hdr->recovery_dtbo_size, blksz); 485 buffer = malloc(blkcnt * blksz); 486 typesz = sizeof(hdr->recovery_dtbo_size); 487 break; 488 case IMG_DTB: 489 bsoffs = pgsz + 490 ALIGN(hdr->kernel_size, pgsz) + 491 ALIGN(hdr->ramdisk_size, pgsz) + 492 ALIGN(hdr->second_size, pgsz) + 493 ALIGN(hdr->recovery_dtbo_size, pgsz); 494 length = hdr->dtb_size; 495 blkcnt = DIV_ROUND_UP(hdr->dtb_size, blksz); 496 buffer = malloc(blkcnt * blksz); 497 typesz = sizeof(hdr->dtb_size); 498 break; 499 case IMG_RK_DTB: 500 #ifdef CONFIG_RKIMG_BOOTLOADER 501 /* No going further, it handles DTBO, HW-ID, etc */ 502 buffer = (void *)env_get_ulong("fdt_addr_r", 16, 0); 503 if (gd->fdt_blob != (void *)buffer) 504 ret = rockchip_read_dtb_file(buffer); 505 #endif 506 return ret < 0 ? ret : 0; 507 default: 508 return -EINVAL; 509 } 510 511 if (!buffer) { 512 printf("No memory for image(%d)\n", img); 513 return -ENOMEM; 514 } 515 516 if (!blksz || !length) 517 goto crypto_calc; 518 519 /* load */ 520 if (ram_base) { 521 memcpy(buffer, (char *)((ulong)ram_base + bsoffs), length); 522 } else { 523 blkoff = DIV_ROUND_UP(bsoffs, blksz); 524 ret = blk_dread(desc, blkstart + blkoff, blkcnt, buffer); 525 if (ret != blkcnt) { 526 printf("Failed to read img(%d), ret=%d\n", img, ret); 527 return -EIO; 528 } 529 } 530 531 if (memmove_dst) 532 memmove((char *)memmove_dst, buffer, length); 533 534 crypto_calc: 535 if (img == IMG_KERNEL) { 536 buffer += pgsz; 537 length -= pgsz; 538 } 539 540 /* sha1 */ 541 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH 542 #ifdef CONFIG_DM_CRYPTO 543 crypto_sha_update(crypto, (u32 *)buffer, length); 544 crypto_sha_update(crypto, (u32 *)&length, typesz); 545 #else 546 sha1_update(&sha1_ctx, (void *)buffer, length); 547 sha1_update(&sha1_ctx, (void *)&length, typesz); 548 #endif 549 #endif 550 551 return 0; 552 } 553 554 static int images_load_verify(struct andr_img_hdr *hdr, ulong part_start, 555 void *ram_base, struct udevice *crypto) 556 { 557 /* load, never change order ! */ 558 if (image_load(IMG_KERNEL, hdr, part_start, ram_base, crypto)) 559 return -1; 560 if (image_load(IMG_RAMDISK, hdr, part_start, ram_base, crypto)) 561 return -1; 562 if (image_load(IMG_SECOND, hdr, part_start, ram_base, crypto)) 563 return -1; 564 if (hdr->header_version > 0) { 565 if (image_load(IMG_RECOVERY_DTBO, hdr, part_start, 566 ram_base, crypto)) 567 return -1; 568 } 569 if (hdr->header_version > 1) { 570 if (image_load(IMG_DTB, hdr, part_start, ram_base, crypto)) 571 return -1; 572 } 573 574 return 0; 575 } 576 577 /* 578 * @ram_base: !NULL means require memcpy for an exist full android image. 579 */ 580 static int android_image_separate(struct andr_img_hdr *hdr, 581 const disk_partition_t *part, 582 void *load_address, 583 void *ram_base) 584 { 585 ulong bstart; 586 int ret; 587 588 if (android_image_check_header(hdr)) { 589 printf("Bad android image header\n"); 590 return -EINVAL; 591 } 592 593 /* set for image_load(IMG_KERNEL, ...) */ 594 env_set_hex("android_addr_r", (ulong)load_address); 595 bstart = part ? part->start : 0; 596 597 /* 598 * 1. Load images to their individual target ram position 599 * in order to disable fdt/ramdisk relocation. 600 */ 601 602 /* load rk-kernel.dtb alone */ 603 if (image_load(IMG_RK_DTB, hdr, bstart, ram_base, NULL)) 604 return -1; 605 606 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH 607 if (hdr->header_version < 3) { 608 struct udevice *dev = NULL; 609 uchar hash[20]; 610 #ifdef CONFIG_DM_CRYPTO 611 sha_context ctx; 612 613 ctx.length = 0; 614 ctx.algo = CRYPTO_SHA1; 615 dev = crypto_get_device(ctx.algo); 616 if (!dev) { 617 printf("Can't find crypto device for SHA1\n"); 618 return -ENODEV; 619 } 620 621 /* v1 & v2: requires total length before sha init */ 622 ctx.length += hdr->kernel_size + sizeof(hdr->kernel_size) + 623 hdr->ramdisk_size + sizeof(hdr->ramdisk_size) + 624 hdr->second_size + sizeof(hdr->second_size); 625 if (hdr->header_version > 0) 626 ctx.length += hdr->recovery_dtbo_size + 627 sizeof(hdr->recovery_dtbo_size); 628 if (hdr->header_version > 1) 629 ctx.length += hdr->dtb_size + sizeof(hdr->dtb_size); 630 crypto_sha_init(dev, &ctx); 631 #else 632 sha1_starts(&sha1_ctx); 633 #endif 634 ret = images_load_verify(hdr, bstart, ram_base, dev); 635 if (ret) 636 return ret; 637 638 #ifdef CONFIG_DM_CRYPTO 639 crypto_sha_final(dev, &ctx, hash); 640 #else 641 sha1_finish(&sha1_ctx, hash); 642 #endif 643 if (memcmp(hash, hdr->id, 20)) { 644 print_hash("Hash from header", (u8 *)hdr->id, 20); 645 print_hash("Hash real", (u8 *)hash, 20); 646 return -EBADFD; 647 } else { 648 printf("ANDROID: Hash OK\n"); 649 } 650 } else 651 #endif 652 { 653 ret = images_load_verify(hdr, bstart, ram_base, NULL); 654 if (ret) 655 return ret; 656 } 657 658 /* 2. Disable fdt/ramdisk relocation, it saves boot time */ 659 env_set("bootm-no-reloc", "y"); 660 661 return 0; 662 } 663 664 static int android_image_separate_v34(struct andr_img_hdr *hdr, 665 const disk_partition_t *part, 666 void *load_address, void *ram_base) 667 { 668 ulong bstart; 669 670 if (android_image_check_header(hdr)) { 671 printf("Bad android image header\n"); 672 return -EINVAL; 673 } 674 675 /* set for image_load(IMG_KERNEL, ...) */ 676 env_set_hex("android_addr_r", (ulong)load_address); 677 bstart = part ? part->start : 0; 678 679 /* 680 * 1. Load images to their individual target ram position 681 * in order to disable fdt/ramdisk relocation. 682 */ 683 if (image_load(IMG_RK_DTB, hdr, bstart, ram_base, NULL)) 684 return -1; 685 if (image_load(IMG_KERNEL, hdr, bstart, ram_base, NULL)) 686 return -1; 687 if (image_load(IMG_VENDOR_RAMDISK, hdr, bstart, ram_base, NULL)) 688 return -1; 689 if (image_load(IMG_RAMDISK, hdr, bstart, ram_base, NULL)) 690 return -1; 691 if (image_load(IMG_BOOTCONFIG, hdr, bstart, ram_base, NULL)) 692 return -1; 693 /* 694 * Copy the populated hdr to load address after image_load(IMG_KERNEL) 695 * 696 * The image_load(IMG_KERNEL) only reads boot_img_hdr_v34 while 697 * vendor_boot_img_hdr_v34 is not included, so fix it here. 698 */ 699 memcpy((char *)load_address, hdr, hdr->page_size); 700 701 /* 2. Disable fdt/ramdisk relocation, it saves boot time */ 702 env_set("bootm-no-reloc", "y"); 703 704 return 0; 705 } 706 707 static ulong android_image_get_comp_addr(struct andr_img_hdr *hdr, int comp) 708 { 709 ulong kernel_addr_c; 710 ulong load_addr = 0; 711 712 kernel_addr_c = env_get_ulong("kernel_addr_c", 16, 0); 713 714 #ifdef CONFIG_ARM64 715 /* 716 * On 64-bit kernel, assuming use IMAGE by default. 717 * 718 * kernel_addr_c is for LZ4-IMAGE but maybe not defined. 719 * kernel_addr_r is for IMAGE. 720 */ 721 if (comp != IH_COMP_NONE) { 722 ulong comp_addr; 723 724 if (kernel_addr_c) { 725 comp_addr = kernel_addr_c; 726 } else { 727 printf("Warn: No \"kernel_addr_c\"\n"); 728 comp_addr = CONFIG_SYS_SDRAM_BASE + 0x2000000;/* 32M */ 729 env_set_hex("kernel_addr_c", comp_addr); 730 } 731 732 load_addr = comp_addr - hdr->page_size; 733 } 734 #else 735 /* 736 * On 32-bit kernel: 737 * 738 * The input load_addr is from env value: "kernel_addr_r", it has 739 * different role depends on whether kernel_addr_c is defined: 740 * 741 * - kernel_addr_r is for lz4/zImage if kernel_addr_c if [not] defined. 742 * - kernel_addr_r is for IMAGE if kernel_addr_c is defined. 743 */ 744 if (comp == IH_COMP_NONE) { 745 if (kernel_addr_c) { 746 /* input load_addr is for Image, nothing to do */ 747 } else { 748 /* input load_addr is for lz4/zImage, set default addr for Image */ 749 load_addr = CONFIG_SYS_SDRAM_BASE + 0x8000; 750 env_set_hex("kernel_addr_r", load_addr); 751 752 load_addr -= hdr->page_size; 753 } 754 } else { 755 if (kernel_addr_c) { 756 /* input load_addr is for Image, so use another for lz4/zImage */ 757 load_addr = kernel_addr_c - hdr->page_size; 758 } else { 759 /* input load_addr is for lz4/zImage, nothing to do */ 760 } 761 } 762 #endif 763 764 return load_addr; 765 } 766 767 void android_image_set_decomp(struct andr_img_hdr *hdr, int comp) 768 { 769 ulong kernel_addr_r; 770 771 env_set_ulong("os_comp", comp); 772 773 /* zImage handles decompress itself */ 774 if (comp != IH_COMP_NONE && comp != IH_COMP_ZIMAGE) { 775 kernel_addr_r = env_get_ulong("kernel_addr_r", 16, 0x02080000); 776 android_image_set_kload(hdr, kernel_addr_r); 777 android_image_set_comp(hdr, comp); 778 } else { 779 android_image_set_comp(hdr, IH_COMP_NONE); 780 } 781 } 782 783 static int android_image_load_separate(struct andr_img_hdr *hdr, 784 const disk_partition_t *part, 785 void *load_addr) 786 { 787 if (hdr->header_version < 3) 788 return android_image_separate(hdr, part, load_addr, NULL); 789 else 790 return android_image_separate_v34(hdr, part, load_addr, NULL); 791 } 792 793 int android_image_memcpy_separate(struct andr_img_hdr *hdr, ulong *load_addr) 794 { 795 ulong comp_addr; 796 int comp; 797 798 comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size); 799 comp_addr = android_image_get_comp_addr(hdr, comp); 800 801 /* non-compressed image: already in-place */ 802 if ((ulong)hdr == *load_addr) 803 return 0; 804 805 /* compressed image */ 806 if (comp_addr) { 807 *load_addr = comp_addr; 808 if ((ulong)hdr == comp_addr) /* already in-place */ 809 return 0; 810 } 811 812 /* 813 * The most possible reason to arrive here is: 814 * 815 * VBoot=1 and AVB load full partition to a temp memory buffer, now we 816 * separate(memcpy) subimages from boot.img to where they should be. 817 */ 818 if (hdr->header_version < 3) { 819 if (android_image_separate(hdr, NULL, (void *)(*load_addr), hdr)) 820 return -1; 821 } else { 822 if (android_image_separate_v34(hdr, NULL, (void *)(*load_addr), hdr)) 823 return -1; 824 } 825 826 android_image_set_decomp((void *)(*load_addr), comp); 827 828 return 0; 829 } 830 831 long android_image_load(struct blk_desc *dev_desc, 832 const disk_partition_t *part_info, 833 unsigned long load_address, 834 unsigned long max_size) { 835 struct andr_img_hdr *hdr; 836 ulong comp_addr; 837 int comp, ret; 838 int blk_off; 839 840 if (max_size < part_info->blksz) 841 return -1; 842 843 hdr = populate_andr_img_hdr(dev_desc, (disk_partition_t *)part_info); 844 if (!hdr) { 845 printf("No valid android hdr\n"); 846 return -1; 847 } 848 849 /* 850 * create the layout: 851 * 852 * |<- page_size ->|1-blk | 853 * |-----|---------|------|-----| 854 * | hdr | ... | kernel | 855 * |-----|----- ---|------------| 856 * 857 * Alloc page_size and 1 more blk for reading kernel image to 858 * get it's compression type, then fill the android hdr what 859 * we have populated before. 860 * 861 * Why? see: android_image_get_kernel_addr(). 862 */ 863 blk_off = BLK_CNT(hdr->page_size, dev_desc->blksz); 864 hdr = (struct andr_img_hdr *) 865 realloc(hdr, (blk_off + 1) * dev_desc->blksz); 866 if (!hdr) 867 return -1; 868 869 if (blk_dread(dev_desc, part_info->start + blk_off, 1, 870 (char *)hdr + hdr->page_size) != 1) { 871 free(hdr); 872 return -1; 873 } 874 875 /* Changed to compressed address ? */ 876 comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size); 877 comp_addr = android_image_get_comp_addr(hdr, comp); 878 if (comp_addr) 879 load_address = comp_addr; 880 else 881 load_address -= hdr->page_size; 882 883 ret = android_image_load_separate(hdr, part_info, (void *)load_address); 884 if (ret) { 885 printf("Failed to load android image\n"); 886 goto fail; 887 } 888 android_image_set_decomp((void *)load_address, comp); 889 890 debug("Loading Android Image to 0x%08lx\n", load_address); 891 892 free(hdr); 893 return load_address; 894 895 fail: 896 free(hdr); 897 return -1; 898 } 899 900 static struct andr_img_hdr * 901 extract_boot_image_v012_header(struct blk_desc *dev_desc, 902 const disk_partition_t *boot_img) 903 { 904 struct andr_img_hdr *hdr; 905 long blk_cnt, blks_read; 906 907 blk_cnt = BLK_CNT(sizeof(struct andr_img_hdr), dev_desc->blksz); 908 hdr = (struct andr_img_hdr *)malloc(blk_cnt * dev_desc->blksz); 909 910 if (!blk_cnt || !hdr) 911 return NULL; 912 913 blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, hdr); 914 if (blks_read != blk_cnt) { 915 debug("boot img header blk cnt is %ld and blks read is %ld\n", 916 blk_cnt, blks_read); 917 return NULL; 918 } 919 920 if (android_image_check_header((void *)hdr)) { 921 printf("boot header magic is invalid.\n"); 922 return NULL; 923 } 924 925 if (hdr->page_size < sizeof(*hdr)) { 926 printf("android hdr is over size\n"); 927 return NULL; 928 } 929 930 return hdr; 931 } 932 933 static struct boot_img_hdr_v34 * 934 extract_boot_image_v34_header(struct blk_desc *dev_desc, 935 const disk_partition_t *boot_img) 936 { 937 struct boot_img_hdr_v34 *boot_hdr; 938 long blk_cnt, blks_read; 939 940 blk_cnt = BLK_CNT(sizeof(struct boot_img_hdr_v34), dev_desc->blksz); 941 boot_hdr = (struct boot_img_hdr_v34 *)malloc(blk_cnt * dev_desc->blksz); 942 943 if (!blk_cnt || !boot_hdr) 944 return NULL; 945 946 blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, boot_hdr); 947 if (blks_read != blk_cnt) { 948 debug("boot img header blk cnt is %ld and blks read is %ld\n", 949 blk_cnt, blks_read); 950 return NULL; 951 } 952 953 if (android_image_check_header((void *)boot_hdr)) { 954 printf("boot header magic is invalid.\n"); 955 return NULL; 956 } 957 958 if (boot_hdr->header_version < 3) { 959 printf("boot header %d, is not >= v3.\n", 960 boot_hdr->header_version); 961 return NULL; 962 } 963 964 return boot_hdr; 965 } 966 967 static struct vendor_boot_img_hdr_v34 * 968 extract_vendor_boot_image_v34_header(struct blk_desc *dev_desc, 969 const disk_partition_t *part_vendor_boot) 970 { 971 struct vendor_boot_img_hdr_v34 *vboot_hdr; 972 long blk_cnt, blks_read; 973 974 blk_cnt = BLK_CNT(sizeof(struct vendor_boot_img_hdr_v34), 975 part_vendor_boot->blksz); 976 vboot_hdr = (struct vendor_boot_img_hdr_v34 *) 977 malloc(blk_cnt * part_vendor_boot->blksz); 978 979 if (!blk_cnt || !vboot_hdr) 980 return NULL; 981 982 blks_read = blk_dread(dev_desc, part_vendor_boot->start, 983 blk_cnt, vboot_hdr); 984 if (blks_read != blk_cnt) { 985 debug("vboot img header blk cnt is %ld and blks read is %ld\n", 986 blk_cnt, blks_read); 987 return NULL; 988 } 989 990 if (strncmp(VENDOR_BOOT_MAGIC, (void *)vboot_hdr->magic, 991 VENDOR_BOOT_MAGIC_SIZE)) { 992 printf("vendor boot header is invalid.\n"); 993 return NULL; 994 } 995 996 if (vboot_hdr->header_version < 3) { 997 printf("vendor boot header %d, is not >= v3.\n", 998 vboot_hdr->header_version); 999 return NULL; 1000 } 1001 1002 return vboot_hdr; 1003 } 1004 1005 static int populate_boot_info(const struct boot_img_hdr_v34 *boot_hdr, 1006 const struct vendor_boot_img_hdr_v34 *vendor_hdr, 1007 struct andr_img_hdr *hdr) 1008 { 1009 memset(hdr->magic, 0, ANDR_BOOT_MAGIC_SIZE); 1010 memcpy(hdr->magic, boot_hdr->magic, ANDR_BOOT_MAGIC_SIZE); 1011 1012 hdr->kernel_size = boot_hdr->kernel_size; 1013 /* don't use vendor_hdr->kernel_addr, we prefer "hdr + hdr->page_size" */ 1014 hdr->kernel_addr = ANDROID_IMAGE_DEFAULT_KERNEL_ADDR; 1015 /* generic ramdisk: immediately following the vendor ramdisk */ 1016 hdr->boot_ramdisk_size = boot_hdr->ramdisk_size; 1017 hdr->ramdisk_size = boot_hdr->ramdisk_size; 1018 1019 /* actually, useless */ 1020 hdr->ramdisk_addr = env_get_ulong("ramdisk_addr_r", 16, 0); 1021 1022 /* removed in v3 */ 1023 hdr->second_size = 0; 1024 hdr->second_addr = 0; 1025 1026 hdr->tags_addr = vendor_hdr->tags_addr; 1027 1028 /* fixed in v3 */ 1029 hdr->page_size = 4096; 1030 hdr->header_version = boot_hdr->header_version; 1031 hdr->os_version = boot_hdr->os_version; 1032 1033 memset(hdr->name, 0, ANDR_BOOT_NAME_SIZE); 1034 strncpy(hdr->name, (const char *)vendor_hdr->name, ANDR_BOOT_NAME_SIZE); 1035 1036 /* removed in v3 */ 1037 memset(hdr->cmdline, 0, ANDR_BOOT_ARGS_SIZE); 1038 memset(hdr->id, 0, 32); 1039 memset(hdr->extra_cmdline, 0, ANDR_BOOT_EXTRA_ARGS_SIZE); 1040 hdr->recovery_dtbo_size = 0; 1041 hdr->recovery_dtbo_offset = 0; 1042 1043 hdr->header_size = boot_hdr->header_size; 1044 hdr->dtb_size = vendor_hdr->dtb_size; 1045 hdr->dtb_addr = vendor_hdr->dtb_addr; 1046 1047 /* boot_img_hdr_v34 fields */ 1048 hdr->vendor_ramdisk_size = vendor_hdr->vendor_ramdisk_size; 1049 hdr->vendor_page_size = vendor_hdr->page_size; 1050 hdr->vendor_header_version = vendor_hdr->header_version; 1051 hdr->vendor_header_size = vendor_hdr->header_size; 1052 1053 hdr->total_cmdline = calloc(1, TOTAL_BOOT_ARGS_SIZE); 1054 if (!hdr->total_cmdline) 1055 return -ENOMEM; 1056 strncpy(hdr->total_cmdline, (const char *)boot_hdr->cmdline, 1057 sizeof(boot_hdr->cmdline)); 1058 strncat(hdr->total_cmdline, " ", 1); 1059 strncat(hdr->total_cmdline, (const char *)vendor_hdr->cmdline, 1060 sizeof(vendor_hdr->cmdline)); 1061 1062 /* new for header v4 */ 1063 if (vendor_hdr->header_version > 3) { 1064 hdr->vendor_ramdisk_table_size = 1065 vendor_hdr->vendor_ramdisk_table_size; 1066 hdr->vendor_ramdisk_table_entry_num = 1067 vendor_hdr->vendor_ramdisk_table_entry_num; 1068 hdr->vendor_ramdisk_table_entry_size = 1069 vendor_hdr->vendor_ramdisk_table_entry_size; 1070 /* 1071 * If we place additional "androidboot.xxx" parameters after 1072 * bootconfig, this field value should be increased, 1073 * but not over than ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE. 1074 */ 1075 hdr->vendor_bootconfig_size = 1076 vendor_hdr->vendor_bootconfig_size; 1077 } else { 1078 hdr->vendor_ramdisk_table_size = 0; 1079 hdr->vendor_ramdisk_table_entry_num = 0; 1080 hdr->vendor_ramdisk_table_entry_size = 0; 1081 hdr->vendor_bootconfig_size = 0; 1082 } 1083 1084 if (hdr->page_size < sizeof(*hdr)) { 1085 printf("android hdr is over size\n"); 1086 return -EINVAL; 1087 } 1088 1089 return 0; 1090 } 1091 1092 /* 1093 * The possible cases of boot.img + recovery.img: 1094 * 1095 * [N]: 0, 1, 2 1096 * [M]: 0, 1, 2, 3, 4 1097 * 1098 * |--------------------|---------------------| 1099 * | boot.img | recovery.img | 1100 * |--------------------|---------------------| 1101 * | boot_img_hdr_v[N] | boot_img_hdr_v[N] | <= if A/B is not required 1102 * |--------------------|---------------------| 1103 * | boot_img_hdr_v34 | boot_img_hdr_v2 | <= if A/B is not required 1104 * |------------------------------------------| 1105 * | boot_img_hdr_v[M], no recovery.img | <= if A/B is required 1106 * |------------------------------------------| 1107 */ 1108 struct andr_img_hdr *populate_andr_img_hdr(struct blk_desc *dev_desc, 1109 disk_partition_t *part_boot) 1110 { 1111 disk_partition_t part_vendor_boot; 1112 struct vendor_boot_img_hdr_v34 *vboot_hdr; 1113 struct boot_img_hdr_v34 *boot_hdr; 1114 struct andr_img_hdr *andr_hdr; 1115 int header_version; 1116 1117 if (!dev_desc || !part_boot) 1118 return NULL; 1119 1120 andr_hdr = (struct andr_img_hdr *)malloc(1 * dev_desc->blksz); 1121 if (!andr_hdr) 1122 return NULL; 1123 1124 if (blk_dread(dev_desc, part_boot->start, 1, andr_hdr) != 1) { 1125 free(andr_hdr); 1126 return NULL; 1127 } 1128 1129 if (android_image_check_header(andr_hdr)) { 1130 free(andr_hdr); 1131 return NULL; 1132 } 1133 1134 header_version = andr_hdr->header_version; 1135 free(andr_hdr); 1136 1137 if (header_version < 3) { 1138 return extract_boot_image_v012_header(dev_desc, part_boot); 1139 } else { 1140 if (part_get_info_by_name(dev_desc, 1141 ANDROID_PARTITION_VENDOR_BOOT, 1142 &part_vendor_boot) < 0) { 1143 printf("No vendor boot partition\n"); 1144 return NULL; 1145 } 1146 boot_hdr = extract_boot_image_v34_header(dev_desc, part_boot); 1147 vboot_hdr = extract_vendor_boot_image_v34_header(dev_desc, 1148 &part_vendor_boot); 1149 if (!boot_hdr || !vboot_hdr) 1150 goto image_load_exit; 1151 1152 andr_hdr = (struct andr_img_hdr *) 1153 malloc(sizeof(struct andr_img_hdr)); 1154 if (!andr_hdr) { 1155 printf("No memory for andr hdr\n"); 1156 goto image_load_exit; 1157 } 1158 1159 if (populate_boot_info(boot_hdr, vboot_hdr, andr_hdr)) { 1160 printf("populate boot info failed\n"); 1161 goto image_load_exit; 1162 } 1163 1164 free(boot_hdr); 1165 free(vboot_hdr); 1166 1167 return andr_hdr; 1168 1169 image_load_exit: 1170 free(boot_hdr); 1171 free(vboot_hdr); 1172 1173 return NULL; 1174 } 1175 1176 return NULL; 1177 } 1178 1179 #if !defined(CONFIG_SPL_BUILD) 1180 /** 1181 * android_print_contents - prints out the contents of the Android format image 1182 * @hdr: pointer to the Android format image header 1183 * 1184 * android_print_contents() formats a multi line Android image contents 1185 * description. 1186 * The routine prints out Android image properties 1187 * 1188 * returns: 1189 * no returned results 1190 */ 1191 void android_print_contents(const struct andr_img_hdr *hdr) 1192 { 1193 const char * const p = IMAGE_INDENT_STRING; 1194 /* os_version = ver << 11 | lvl */ 1195 u32 os_ver = hdr->os_version >> 11; 1196 u32 os_lvl = hdr->os_version & ((1U << 11) - 1); 1197 u32 header_version = hdr->header_version; 1198 1199 printf("%skernel size: %x\n", p, hdr->kernel_size); 1200 printf("%skernel address: %x\n", p, hdr->kernel_addr); 1201 printf("%sramdisk size: %x\n", p, hdr->ramdisk_size); 1202 printf("%sramdisk address: %x\n", p, hdr->ramdisk_addr); 1203 printf("%ssecond size: %x\n", p, hdr->second_size); 1204 printf("%ssecond address: %x\n", p, hdr->second_addr); 1205 printf("%stags address: %x\n", p, hdr->tags_addr); 1206 printf("%spage size: %x\n", p, hdr->page_size); 1207 printf("%sheader_version: %x\n", p, header_version); 1208 /* ver = A << 14 | B << 7 | C (7 bits for each of A, B, C) 1209 * lvl = ((Y - 2000) & 127) << 4 | M (7 bits for Y, 4 bits for M) */ 1210 printf("%sos_version: %x (ver: %u.%u.%u, level: %u.%u)\n", 1211 p, hdr->os_version, 1212 (os_ver >> 7) & 0x7F, (os_ver >> 14) & 0x7F, os_ver & 0x7F, 1213 (os_lvl >> 4) + 2000, os_lvl & 0x0F); 1214 printf("%sname: %s\n", p, hdr->name); 1215 printf("%scmdline: %s\n", p, hdr->cmdline); 1216 1217 if (header_version == 1 || header_version == 2) { 1218 printf("%srecovery dtbo size: %x\n", p, hdr->recovery_dtbo_size); 1219 printf("%srecovery dtbo offset: %llx\n", p, hdr->recovery_dtbo_offset); 1220 printf("%sheader size: %x\n", p, hdr->header_size); 1221 } 1222 1223 if (header_version == 2 || header_version == 3) { 1224 printf("%sdtb size: %x\n", p, hdr->dtb_size); 1225 printf("%sdtb addr: %llx\n", p, hdr->dtb_addr); 1226 } 1227 1228 if (header_version >= 3) { 1229 printf("%scmdline: %s\n", p, hdr->total_cmdline); 1230 printf("%svendor ramdisk size: %x\n", p, hdr->vendor_ramdisk_size); 1231 printf("%svendor page size: %x\n", p, hdr->vendor_page_size); 1232 printf("%svendor header version: %d\n", p, hdr->vendor_header_version); 1233 printf("%svendor header size: %x\n", p, hdr->vendor_header_size); 1234 } 1235 1236 if (header_version >= 4) { 1237 printf("%svendor ramdisk table size: %x\n", 1238 p, hdr->vendor_ramdisk_table_size); 1239 printf("%svendor ramdisk table entry num: %x\n", 1240 p, hdr->vendor_ramdisk_table_entry_num); 1241 printf("%svendor ramdisk table entry size: %x\n", 1242 p, hdr->vendor_ramdisk_table_entry_size); 1243 printf("%svendor bootconfig size: %d\n", 1244 p, hdr->vendor_bootconfig_size); 1245 } 1246 } 1247 #endif 1248