1 /* 2 * Copyright (c) 2011 Sebastian Andrzej Siewior <bigeasy@linutronix.de> 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 #include <common.h> 8 #include <image.h> 9 #include <android_image.h> 10 #include <android_bootloader.h> 11 #include <malloc.h> 12 #include <mapmem.h> 13 #include <errno.h> 14 #include <boot_rkimg.h> 15 #include <crypto.h> 16 #include <sysmem.h> 17 #include <u-boot/sha1.h> 18 #ifdef CONFIG_RKIMG_BOOTLOADER 19 #include <asm/arch/resource_img.h> 20 #endif 21 #ifdef CONFIG_RK_AVB_LIBAVB_USER 22 #include <android_avb/avb_slot_verify.h> 23 #include <android_avb/avb_ops_user.h> 24 #include <android_avb/rk_avb_ops_user.h> 25 #endif 26 #include <optee_include/OpteeClientInterface.h> 27 28 DECLARE_GLOBAL_DATA_PTR; 29 30 #define ANDROID_IMAGE_DEFAULT_KERNEL_ADDR 0x10008000 31 #define ANDROID_Q_VER 10 32 #define ANDROID_PARTITION_VENDOR_BOOT "vendor_boot" 33 34 #define BLK_CNT(_num_bytes, _block_size) \ 35 ((_num_bytes + _block_size - 1) / _block_size) 36 37 static char andr_tmp_str[ANDR_BOOT_ARGS_SIZE + 1]; 38 static u32 android_kernel_comp_type = IH_COMP_NONE; 39 40 u32 android_image_major_version(void) 41 { 42 /* MSB 7-bits */ 43 return gd->bd->bi_andr_version >> 25; 44 } 45 46 u32 android_bcb_msg_sector_offset(void) 47 { 48 /* 49 * Rockchip platforms defines BCB message at the 16KB offset of 50 * misc partition while the Google defines it at 0x00 offset. 51 * 52 * From Android-Q, the 0x00 offset is mandary on Google VTS, so that 53 * this is a compatibility according to android image 'os_version'. 54 */ 55 #ifdef CONFIG_RKIMG_BOOTLOADER 56 return (android_image_major_version() >= ANDROID_Q_VER) ? 0x00 : 0x20; 57 #else 58 return 0x00; 59 #endif 60 } 61 62 static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr) 63 { 64 /* 65 * All the Android tools that generate a boot.img use this 66 * address as the default. 67 * 68 * Even though it doesn't really make a lot of sense, and it 69 * might be valid on some platforms, we treat that address as 70 * the default value for this field, and try to execute the 71 * kernel in place in such a case. 72 * 73 * Otherwise, we will return the actual value set by the user. 74 */ 75 if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR) 76 return (ulong)hdr + hdr->page_size; 77 78 #ifdef CONFIG_ARCH_ROCKCHIP 79 /* 80 * If kernel is compressed, kernel_addr is set as decompressed address 81 * after compressed being loaded to ram, so let's use it. 82 */ 83 if (android_kernel_comp_type != IH_COMP_NONE && 84 android_kernel_comp_type != IH_COMP_ZIMAGE) 85 return hdr->kernel_addr; 86 87 /* 88 * Compatble with rockchip legacy packing with kernel/ramdisk/second 89 * address base from 0x60000000(SDK versiont < 8.1), these are invalid 90 * address, so we calc it by real size. 91 */ 92 return (ulong)hdr + hdr->page_size; 93 #else 94 return hdr->kernel_addr; 95 #endif 96 97 } 98 99 void android_image_set_comp(struct andr_img_hdr *hdr, u32 comp) 100 { 101 android_kernel_comp_type = comp; 102 } 103 104 u32 android_image_get_comp(const struct andr_img_hdr *hdr) 105 { 106 return android_kernel_comp_type; 107 } 108 109 int android_image_parse_kernel_comp(const struct andr_img_hdr *hdr) 110 { 111 ulong kaddr = android_image_get_kernel_addr(hdr); 112 return bootm_parse_comp((const unsigned char *)kaddr); 113 } 114 115 /** 116 * android_image_get_kernel() - processes kernel part of Android boot images 117 * @hdr: Pointer to image header, which is at the start 118 * of the image. 119 * @verify: Checksum verification flag. Currently unimplemented. 120 * @os_data: Pointer to a ulong variable, will hold os data start 121 * address. 122 * @os_len: Pointer to a ulong variable, will hold os data length. 123 * 124 * This function returns the os image's start address and length. Also, 125 * it appends the kernel command line to the bootargs env variable. 126 * 127 * Return: Zero, os start address and length on success, 128 * otherwise on failure. 129 */ 130 int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify, 131 ulong *os_data, ulong *os_len) 132 { 133 u32 kernel_addr = android_image_get_kernel_addr(hdr); 134 const char *cmdline = hdr->header_version < 3 ? 135 hdr->cmdline : hdr->total_cmdline; 136 /* 137 * Not all Android tools use the id field for signing the image with 138 * sha1 (or anything) so we don't check it. It is not obvious that the 139 * string is null terminated so we take care of this. 140 */ 141 strncpy(andr_tmp_str, hdr->name, ANDR_BOOT_NAME_SIZE); 142 andr_tmp_str[ANDR_BOOT_NAME_SIZE] = '\0'; 143 if (strlen(andr_tmp_str)) 144 printf("Android's image name: %s\n", andr_tmp_str); 145 146 printf("Kernel: 0x%08x - 0x%08x (%u KiB)\n", 147 kernel_addr, kernel_addr + hdr->kernel_size, 148 DIV_ROUND_UP(hdr->kernel_size, 1024)); 149 150 int len = 0; 151 if (cmdline) { 152 debug("Kernel command line: %s\n", cmdline); 153 len += strlen(cmdline); 154 } 155 156 char *bootargs = env_get("bootargs"); 157 if (bootargs) 158 len += strlen(bootargs); 159 160 char *newbootargs = malloc(len + 2); 161 if (!newbootargs) { 162 puts("Error: malloc in android_image_get_kernel failed!\n"); 163 return -ENOMEM; 164 } 165 *newbootargs = '\0'; 166 167 if (bootargs) { 168 strcpy(newbootargs, bootargs); 169 strcat(newbootargs, " "); 170 } 171 if (cmdline) 172 strcat(newbootargs, cmdline); 173 174 env_set("bootargs", newbootargs); 175 176 if (os_data) { 177 *os_data = (ulong)hdr; 178 *os_data += hdr->page_size; 179 } 180 if (os_len) 181 *os_len = hdr->kernel_size; 182 return 0; 183 } 184 185 int android_image_check_header(const struct andr_img_hdr *hdr) 186 { 187 return memcmp(ANDR_BOOT_MAGIC, hdr->magic, ANDR_BOOT_MAGIC_SIZE); 188 } 189 190 ulong android_image_get_end(const struct andr_img_hdr *hdr) 191 { 192 ulong end; 193 /* 194 * The header takes a full page, the remaining components are aligned 195 * on page boundary 196 */ 197 end = (ulong)hdr; 198 if (hdr->header_version < 3) { 199 end += hdr->page_size; 200 end += ALIGN(hdr->kernel_size, hdr->page_size); 201 end += ALIGN(hdr->ramdisk_size, hdr->page_size); 202 end += ALIGN(hdr->second_size, hdr->page_size); 203 if (hdr->header_version == 1) { 204 end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size); 205 } else if (hdr->header_version == 2) { 206 end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size); 207 end += ALIGN(hdr->dtb_size, hdr->page_size); 208 } 209 } else { 210 /* boot_img_hdr_v34 */ 211 end += hdr->page_size; 212 end += ALIGN(hdr->kernel_size, hdr->page_size); 213 end += ALIGN(hdr->ramdisk_size, hdr->page_size); 214 } 215 216 return end; 217 } 218 219 u32 android_image_get_ksize(const struct andr_img_hdr *hdr) 220 { 221 return hdr->kernel_size; 222 } 223 224 void android_image_set_kload(struct andr_img_hdr *hdr, u32 load_address) 225 { 226 hdr->kernel_addr = load_address; 227 } 228 229 ulong android_image_get_kload(const struct andr_img_hdr *hdr) 230 { 231 return android_image_get_kernel_addr(hdr); 232 } 233 234 int android_image_get_ramdisk(const struct andr_img_hdr *hdr, 235 ulong *rd_data, ulong *rd_len) 236 { 237 ulong ramdisk_addr_r; 238 ulong start, end; 239 240 if (!hdr->ramdisk_size) { 241 *rd_data = *rd_len = 0; 242 return -1; 243 } 244 245 /* Have been loaded by android_image_load_separate() on ramdisk_addr_r */ 246 ramdisk_addr_r = env_get_ulong("ramdisk_addr_r", 16, 0); 247 if (!ramdisk_addr_r) { 248 printf("No Found Ramdisk Load Address.\n"); 249 return -1; 250 } 251 252 *rd_data = ramdisk_addr_r; 253 *rd_len = hdr->ramdisk_size; 254 if (hdr->header_version >= 3) 255 *rd_len += hdr->vendor_ramdisk_size; 256 if (hdr->header_version >= 4) { 257 *rd_len += hdr->vendor_bootconfig_size + 258 ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE; 259 } 260 261 /* just for print msg */ 262 start = ramdisk_addr_r; 263 if (hdr->header_version >= 3) { 264 end = start + (ulong)hdr->vendor_ramdisk_size; 265 printf("v-ramdisk: 0x%08lx - 0x%08lx (%u KiB)\n", 266 start, end, DIV_ROUND_UP(hdr->vendor_ramdisk_size, 1024)); 267 start = end; 268 } 269 { 270 end = start + (ulong)hdr->ramdisk_size; 271 printf("ramdisk: 0x%08lx - 0x%08lx (%u KiB)\n", 272 start, end, DIV_ROUND_UP(hdr->ramdisk_size, 1024)); 273 start = end; 274 } 275 if (hdr->header_version >= 4) { 276 end = start + (ulong)hdr->vendor_bootconfig_size; 277 printf("bootconfig: 0x%08lx - 0x%08lx (%u KiB)\n", 278 start, end, DIV_ROUND_UP(hdr->vendor_bootconfig_size, 1024)); 279 start = end; 280 end = start + ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE; 281 printf("bootparams: 0x%08lx - 0x%08lx\n", start, end); 282 } 283 284 return 0; 285 } 286 287 int android_image_get_fdt(const struct andr_img_hdr *hdr, 288 ulong *rd_data) 289 { 290 ulong fdt_addr_r; 291 292 if (!hdr->second_size) { 293 *rd_data = 0; 294 return -1; 295 } 296 297 /* Have been loaded by android_image_load_separate() on fdt_addr_r */ 298 fdt_addr_r = env_get_ulong("fdt_addr_r", 16, 0); 299 if (!fdt_addr_r) { 300 printf("No Found FDT Load Address.\n"); 301 return -1; 302 } 303 304 *rd_data = fdt_addr_r; 305 306 debug("FDT load addr 0x%08x size %u KiB\n", 307 hdr->second_addr, DIV_ROUND_UP(hdr->second_size, 1024)); 308 309 return 0; 310 } 311 312 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH 313 static void print_hash(const char *label, u8 *hash, int len) 314 { 315 int i; 316 317 printf("%s:\n 0x", label ? : "Hash"); 318 for (i = 0; i < len; i++) 319 printf("%02x", hash[i]); 320 printf("\n"); 321 } 322 #endif 323 324 typedef enum { 325 IMG_KERNEL, 326 IMG_RAMDISK, 327 IMG_SECOND, 328 IMG_RECOVERY_DTBO, 329 IMG_RK_DTB, /* within resource.img in second position */ 330 IMG_DTB, 331 IMG_VENDOR_RAMDISK, 332 IMG_BOOTCONFIG, 333 IMG_MAX, 334 } img_t; 335 336 #if defined(CONFIG_ANDROID_BOOT_IMAGE_HASH) && !defined(CONFIG_DM_CRYPTO) 337 static sha1_context sha1_ctx; 338 #endif 339 340 static int image_load(img_t img, struct andr_img_hdr *hdr, 341 ulong blkstart, void *ram_base, 342 struct udevice *crypto) 343 { 344 struct blk_desc *desc = rockchip_get_bootdev(); 345 disk_partition_t part_vendor_boot; 346 __maybe_unused u32 typesz; 347 ulong pgsz = hdr->page_size; 348 ulong blksz = desc->blksz; 349 ulong blkcnt, blkoff; 350 ulong memmove_dst = 0; 351 ulong bsoffs = 0; 352 ulong extra = 0; 353 ulong length; 354 void *buffer; 355 int ret = 0; 356 357 switch (img) { 358 case IMG_KERNEL: 359 bsoffs = 0; /* include a page_size(image header) */ 360 length = hdr->kernel_size + pgsz; 361 buffer = (void *)env_get_ulong("android_addr_r", 16, 0); 362 blkcnt = DIV_ROUND_UP(hdr->kernel_size + pgsz, blksz); 363 typesz = sizeof(hdr->kernel_size); 364 if (!sysmem_alloc_base(MEM_KERNEL, 365 (phys_addr_t)buffer, blkcnt * blksz)) 366 return -ENOMEM; 367 break; 368 case IMG_VENDOR_RAMDISK: 369 if (part_get_info_by_name(desc, 370 ANDROID_PARTITION_VENDOR_BOOT, 371 &part_vendor_boot) < 0) { 372 printf("No vendor boot partition\n"); 373 return -ENOENT; 374 } 375 /* Always load vendor boot from storage: avb full load boot/recovery */ 376 blkstart = part_vendor_boot.start; 377 pgsz = hdr->vendor_page_size; 378 ram_base = 0; 379 380 bsoffs = ALIGN(VENDOR_BOOT_HDRv3_SIZE, pgsz); 381 length = hdr->vendor_ramdisk_size; 382 buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0); 383 blkcnt = DIV_ROUND_UP(hdr->vendor_ramdisk_size, blksz); 384 typesz = sizeof(hdr->vendor_ramdisk_size); 385 /* 386 * Add extra memory for generic ramdisk space. 387 * 388 * In case of unaligned vendor ramdisk size, reserve 389 * 1 more blksz. 390 * 391 * Reserve 8KB for bootloader cmdline. 392 */ 393 if (hdr->header_version >= 3) 394 extra += ALIGN(hdr->ramdisk_size, blksz) + blksz; 395 if (hdr->header_version >= 4) 396 extra += ALIGN(hdr->vendor_bootconfig_size, blksz) + 397 ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE; 398 if (length && !sysmem_alloc_base(MEM_RAMDISK, 399 (phys_addr_t)buffer, blkcnt * blksz + extra)) 400 return -ENOMEM; 401 break; 402 case IMG_RAMDISK: 403 bsoffs = pgsz + ALIGN(hdr->kernel_size, pgsz); 404 length = hdr->ramdisk_size; 405 buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0); 406 blkcnt = DIV_ROUND_UP(hdr->ramdisk_size, blksz); 407 typesz = sizeof(hdr->ramdisk_size); 408 409 /* 410 * ramdisk_addr_r v012: 411 * |----------------| 412 * | ramdisk | 413 * |----------------| 414 * 415 * ramdisk_addr_r v3: 416 * |----------------|---------| 417 * | vendor-ramdisk | ramdisk | 418 * |----------------|---------| 419 * 420 * ramdisk_addr_r v4: 421 * |----------------|---------|------------|------------| 422 * | vendor-ramdisk | ramdisk | bootconfig | bootparams | 423 * |----------------|---------|------------|------------| 424 */ 425 if (hdr->header_version >= 3) { 426 buffer += hdr->vendor_ramdisk_size; 427 if (!IS_ALIGNED((ulong)buffer, blksz)) { 428 memmove_dst = (ulong)buffer; 429 buffer = (void *)ALIGN(memmove_dst, blksz); 430 } 431 } 432 /* sysmem has been alloced by vendor ramdisk */ 433 if (hdr->header_version < 3) { 434 if (length && !sysmem_alloc_base(MEM_RAMDISK, 435 (phys_addr_t)buffer, blkcnt * blksz)) 436 return -ENOMEM; 437 } 438 break; 439 case IMG_BOOTCONFIG: 440 if (hdr->header_version < 4) 441 return 0; 442 if (part_get_info_by_name(desc, 443 ANDROID_PARTITION_VENDOR_BOOT, 444 &part_vendor_boot) < 0) { 445 printf("No vendor boot partition\n"); 446 return -ENOENT; 447 } 448 449 blkstart = part_vendor_boot.start; 450 pgsz = hdr->vendor_page_size; 451 ram_base = 0; 452 453 bsoffs = ALIGN(VENDOR_BOOT_HDRv4_SIZE, pgsz) + 454 ALIGN(hdr->vendor_ramdisk_size, pgsz) + 455 ALIGN(hdr->dtb_size, pgsz) + 456 ALIGN(hdr->vendor_ramdisk_table_size, pgsz); 457 length = hdr->vendor_bootconfig_size; 458 buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0); 459 blkcnt = DIV_ROUND_UP(hdr->vendor_bootconfig_size, blksz); 460 typesz = sizeof(hdr->vendor_bootconfig_size); 461 462 buffer += hdr->vendor_ramdisk_size + hdr->ramdisk_size; 463 if (!IS_ALIGNED((ulong)buffer, blksz)) { 464 memmove_dst = (ulong)buffer; 465 buffer = (void *)ALIGN(memmove_dst, blksz); 466 } 467 break; 468 case IMG_SECOND: 469 bsoffs = pgsz + 470 ALIGN(hdr->kernel_size, pgsz) + 471 ALIGN(hdr->ramdisk_size, pgsz); 472 length = hdr->second_size; 473 blkcnt = DIV_ROUND_UP(hdr->second_size, blksz); 474 buffer = malloc(blkcnt * blksz); 475 typesz = sizeof(hdr->second_size); 476 break; 477 case IMG_RECOVERY_DTBO: 478 bsoffs = pgsz + 479 ALIGN(hdr->kernel_size, pgsz) + 480 ALIGN(hdr->ramdisk_size, pgsz) + 481 ALIGN(hdr->second_size, pgsz); 482 length = hdr->recovery_dtbo_size; 483 blkcnt = DIV_ROUND_UP(hdr->recovery_dtbo_size, blksz); 484 buffer = malloc(blkcnt * blksz); 485 typesz = sizeof(hdr->recovery_dtbo_size); 486 break; 487 case IMG_DTB: 488 bsoffs = pgsz + 489 ALIGN(hdr->kernel_size, pgsz) + 490 ALIGN(hdr->ramdisk_size, pgsz) + 491 ALIGN(hdr->second_size, pgsz) + 492 ALIGN(hdr->recovery_dtbo_size, pgsz); 493 length = hdr->dtb_size; 494 blkcnt = DIV_ROUND_UP(hdr->dtb_size, blksz); 495 buffer = malloc(blkcnt * blksz); 496 typesz = sizeof(hdr->dtb_size); 497 break; 498 case IMG_RK_DTB: 499 #ifdef CONFIG_RKIMG_BOOTLOADER 500 /* No going further, it handles DTBO, HW-ID, etc */ 501 buffer = (void *)env_get_ulong("fdt_addr_r", 16, 0); 502 if (gd->fdt_blob != (void *)buffer) 503 ret = rockchip_read_dtb_file(buffer); 504 #endif 505 return ret < 0 ? ret : 0; 506 default: 507 return -EINVAL; 508 } 509 510 if (!buffer) { 511 printf("No memory for image(%d)\n", img); 512 return -ENOMEM; 513 } 514 515 if (!blksz || !length) 516 goto crypto_calc; 517 518 /* load */ 519 if (ram_base) { 520 memcpy(buffer, (char *)((ulong)ram_base + bsoffs), length); 521 } else { 522 blkoff = DIV_ROUND_UP(bsoffs, blksz); 523 ret = blk_dread(desc, blkstart + blkoff, blkcnt, buffer); 524 if (ret != blkcnt) { 525 printf("Failed to read img(%d), ret=%d\n", img, ret); 526 return -EIO; 527 } 528 } 529 530 if (memmove_dst) 531 memmove((char *)memmove_dst, buffer, length); 532 533 crypto_calc: 534 if (img == IMG_KERNEL) { 535 buffer += pgsz; 536 length -= pgsz; 537 } 538 539 /* sha1 */ 540 if (hdr->header_version < 3) { 541 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH 542 #ifdef CONFIG_DM_CRYPTO 543 crypto_sha_update(crypto, (u32 *)buffer, length); 544 crypto_sha_update(crypto, (u32 *)&length, typesz); 545 #else 546 sha1_update(&sha1_ctx, (void *)buffer, length); 547 sha1_update(&sha1_ctx, (void *)&length, typesz); 548 #endif 549 #endif 550 } 551 552 return 0; 553 } 554 555 static int images_load_verify(struct andr_img_hdr *hdr, ulong part_start, 556 void *ram_base, struct udevice *crypto) 557 { 558 /* load, never change order ! */ 559 if (image_load(IMG_KERNEL, hdr, part_start, ram_base, crypto)) 560 return -1; 561 if (image_load(IMG_RAMDISK, hdr, part_start, ram_base, crypto)) 562 return -1; 563 if (image_load(IMG_SECOND, hdr, part_start, ram_base, crypto)) 564 return -1; 565 if (hdr->header_version > 0) { 566 if (image_load(IMG_RECOVERY_DTBO, hdr, part_start, 567 ram_base, crypto)) 568 return -1; 569 } 570 if (hdr->header_version > 1) { 571 if (image_load(IMG_DTB, hdr, part_start, ram_base, crypto)) 572 return -1; 573 } 574 575 return 0; 576 } 577 578 /* 579 * @ram_base: !NULL means require memcpy for an exist full android image. 580 */ 581 static int android_image_separate(struct andr_img_hdr *hdr, 582 const disk_partition_t *part, 583 void *load_address, 584 void *ram_base) 585 { 586 ulong bstart; 587 int ret; 588 589 if (android_image_check_header(hdr)) { 590 printf("Bad android image header\n"); 591 return -EINVAL; 592 } 593 594 /* set for image_load(IMG_KERNEL, ...) */ 595 env_set_hex("android_addr_r", (ulong)load_address); 596 bstart = part ? part->start : 0; 597 598 /* 599 * 1. Load images to their individual target ram position 600 * in order to disable fdt/ramdisk relocation. 601 */ 602 603 /* load rk-kernel.dtb alone */ 604 if (image_load(IMG_RK_DTB, hdr, bstart, ram_base, NULL)) 605 return -1; 606 607 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH 608 if (hdr->header_version < 3) { 609 struct udevice *dev = NULL; 610 uchar hash[20]; 611 #ifdef CONFIG_DM_CRYPTO 612 sha_context ctx; 613 614 ctx.length = 0; 615 ctx.algo = CRYPTO_SHA1; 616 dev = crypto_get_device(ctx.algo); 617 if (!dev) { 618 printf("Can't find crypto device for SHA1\n"); 619 return -ENODEV; 620 } 621 622 /* v1 & v2: requires total length before sha init */ 623 ctx.length += hdr->kernel_size + sizeof(hdr->kernel_size) + 624 hdr->ramdisk_size + sizeof(hdr->ramdisk_size) + 625 hdr->second_size + sizeof(hdr->second_size); 626 if (hdr->header_version > 0) 627 ctx.length += hdr->recovery_dtbo_size + 628 sizeof(hdr->recovery_dtbo_size); 629 if (hdr->header_version > 1) 630 ctx.length += hdr->dtb_size + sizeof(hdr->dtb_size); 631 crypto_sha_init(dev, &ctx); 632 #else 633 sha1_starts(&sha1_ctx); 634 #endif 635 ret = images_load_verify(hdr, bstart, ram_base, dev); 636 if (ret) 637 return ret; 638 639 #ifdef CONFIG_DM_CRYPTO 640 crypto_sha_final(dev, &ctx, hash); 641 #else 642 sha1_finish(&sha1_ctx, hash); 643 #endif 644 if (memcmp(hash, hdr->id, 20)) { 645 print_hash("Hash from header", (u8 *)hdr->id, 20); 646 print_hash("Hash real", (u8 *)hash, 20); 647 return -EBADFD; 648 } else { 649 printf("ANDROID: Hash OK\n"); 650 } 651 } else 652 #endif 653 { 654 ret = images_load_verify(hdr, bstart, ram_base, NULL); 655 if (ret) 656 return ret; 657 } 658 659 /* 2. Disable fdt/ramdisk relocation, it saves boot time */ 660 env_set("bootm-no-reloc", "y"); 661 662 return 0; 663 } 664 665 static int android_image_separate_v34(struct andr_img_hdr *hdr, 666 const disk_partition_t *part, 667 void *load_address, void *ram_base) 668 { 669 ulong bstart; 670 671 if (android_image_check_header(hdr)) { 672 printf("Bad android image header\n"); 673 return -EINVAL; 674 } 675 676 /* set for image_load(IMG_KERNEL, ...) */ 677 env_set_hex("android_addr_r", (ulong)load_address); 678 bstart = part ? part->start : 0; 679 680 /* 681 * 1. Load images to their individual target ram position 682 * in order to disable fdt/ramdisk relocation. 683 */ 684 if (image_load(IMG_RK_DTB, hdr, bstart, ram_base, NULL)) 685 return -1; 686 if (image_load(IMG_KERNEL, hdr, bstart, ram_base, NULL)) 687 return -1; 688 if (image_load(IMG_VENDOR_RAMDISK, hdr, bstart, ram_base, NULL)) 689 return -1; 690 if (image_load(IMG_RAMDISK, hdr, bstart, ram_base, NULL)) 691 return -1; 692 if (image_load(IMG_BOOTCONFIG, hdr, bstart, ram_base, NULL)) 693 return -1; 694 /* 695 * Copy the populated hdr to load address after image_load(IMG_KERNEL) 696 * 697 * The image_load(IMG_KERNEL) only reads boot_img_hdr_v34 while 698 * vendor_boot_img_hdr_v34 is not included, so fix it here. 699 */ 700 memcpy((char *)load_address, hdr, hdr->page_size); 701 702 /* 2. Disable fdt/ramdisk relocation, it saves boot time */ 703 env_set("bootm-no-reloc", "y"); 704 705 return 0; 706 } 707 708 static ulong android_image_get_comp_addr(struct andr_img_hdr *hdr, int comp) 709 { 710 ulong kernel_addr_c; 711 ulong load_addr = 0; 712 713 kernel_addr_c = env_get_ulong("kernel_addr_c", 16, 0); 714 715 #ifdef CONFIG_ARM64 716 /* 717 * On 64-bit kernel, assuming use IMAGE by default. 718 * 719 * kernel_addr_c is for LZ4-IMAGE but maybe not defined. 720 * kernel_addr_r is for IMAGE. 721 */ 722 if (comp != IH_COMP_NONE) { 723 ulong comp_addr; 724 725 if (kernel_addr_c) { 726 comp_addr = kernel_addr_c; 727 } else { 728 printf("Warn: No \"kernel_addr_c\"\n"); 729 comp_addr = CONFIG_SYS_SDRAM_BASE + 0x2000000;/* 32M */ 730 env_set_hex("kernel_addr_c", comp_addr); 731 } 732 733 load_addr = comp_addr - hdr->page_size; 734 } 735 #else 736 /* 737 * On 32-bit kernel: 738 * 739 * The input load_addr is from env value: "kernel_addr_r", it has 740 * different role depends on whether kernel_addr_c is defined: 741 * 742 * - kernel_addr_r is for lz4/zImage if kernel_addr_c if [not] defined. 743 * - kernel_addr_r is for IMAGE if kernel_addr_c is defined. 744 */ 745 if (comp == IH_COMP_NONE) { 746 if (kernel_addr_c) { 747 /* input load_addr is for Image, nothing to do */ 748 } else { 749 /* input load_addr is for lz4/zImage, set default addr for Image */ 750 load_addr = CONFIG_SYS_SDRAM_BASE + 0x8000; 751 env_set_hex("kernel_addr_r", load_addr); 752 753 load_addr -= hdr->page_size; 754 } 755 } else { 756 if (kernel_addr_c) { 757 /* input load_addr is for Image, so use another for lz4/zImage */ 758 load_addr = kernel_addr_c - hdr->page_size; 759 } else { 760 /* input load_addr is for lz4/zImage, nothing to do */ 761 } 762 } 763 #endif 764 765 return load_addr; 766 } 767 768 void android_image_set_decomp(struct andr_img_hdr *hdr, int comp) 769 { 770 ulong kernel_addr_r; 771 772 env_set_ulong("os_comp", comp); 773 774 /* zImage handles decompress itself */ 775 if (comp != IH_COMP_NONE && comp != IH_COMP_ZIMAGE) { 776 kernel_addr_r = env_get_ulong("kernel_addr_r", 16, 0x02080000); 777 android_image_set_kload(hdr, kernel_addr_r); 778 android_image_set_comp(hdr, comp); 779 } else { 780 android_image_set_comp(hdr, IH_COMP_NONE); 781 } 782 } 783 784 static int android_image_load_separate(struct andr_img_hdr *hdr, 785 const disk_partition_t *part, 786 void *load_addr) 787 { 788 if (hdr->header_version < 3) 789 return android_image_separate(hdr, part, load_addr, NULL); 790 else 791 return android_image_separate_v34(hdr, part, load_addr, NULL); 792 } 793 794 int android_image_memcpy_separate(struct andr_img_hdr *hdr, ulong *load_addr) 795 { 796 ulong comp_addr; 797 int comp; 798 799 comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size); 800 comp_addr = android_image_get_comp_addr(hdr, comp); 801 802 /* non-compressed image: already in-place */ 803 if ((ulong)hdr == *load_addr) 804 return 0; 805 806 /* compressed image */ 807 if (comp_addr) { 808 *load_addr = comp_addr; 809 if ((ulong)hdr == comp_addr) /* already in-place */ 810 return 0; 811 } 812 813 /* 814 * The most possible reason to arrive here is: 815 * 816 * VBoot=1 and AVB load full partition to a temp memory buffer, now we 817 * separate(memcpy) subimages from boot.img to where they should be. 818 */ 819 if (hdr->header_version < 3) { 820 if (android_image_separate(hdr, NULL, (void *)(*load_addr), hdr)) 821 return -1; 822 } else { 823 if (android_image_separate_v34(hdr, NULL, (void *)(*load_addr), hdr)) 824 return -1; 825 } 826 827 android_image_set_decomp((void *)(*load_addr), comp); 828 829 return 0; 830 } 831 832 long android_image_load(struct blk_desc *dev_desc, 833 const disk_partition_t *part_info, 834 unsigned long load_address, 835 unsigned long max_size) { 836 struct andr_img_hdr *hdr; 837 ulong comp_addr; 838 int comp, ret; 839 int blk_off; 840 841 if (max_size < part_info->blksz) 842 return -1; 843 844 hdr = populate_andr_img_hdr(dev_desc, (disk_partition_t *)part_info); 845 if (!hdr) { 846 printf("No valid android hdr\n"); 847 return -1; 848 } 849 850 /* 851 * create the layout: 852 * 853 * |<- page_size ->|1-blk | 854 * |-----|---------|------|-----| 855 * | hdr | ... | kernel | 856 * |-----|----- ---|------------| 857 * 858 * Alloc page_size and 1 more blk for reading kernel image to 859 * get it's compression type, then fill the android hdr what 860 * we have populated before. 861 * 862 * Why? see: android_image_get_kernel_addr(). 863 */ 864 blk_off = BLK_CNT(hdr->page_size, dev_desc->blksz); 865 hdr = (struct andr_img_hdr *) 866 realloc(hdr, (blk_off + 1) * dev_desc->blksz); 867 if (!hdr) 868 return -1; 869 870 if (blk_dread(dev_desc, part_info->start + blk_off, 1, 871 (char *)hdr + hdr->page_size) != 1) { 872 free(hdr); 873 return -1; 874 } 875 876 /* Changed to compressed address ? */ 877 comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size); 878 comp_addr = android_image_get_comp_addr(hdr, comp); 879 if (comp_addr) 880 load_address = comp_addr; 881 else 882 load_address -= hdr->page_size; 883 884 ret = android_image_load_separate(hdr, part_info, (void *)load_address); 885 if (ret) { 886 printf("Failed to load android image\n"); 887 goto fail; 888 } 889 android_image_set_decomp((void *)load_address, comp); 890 891 debug("Loading Android Image to 0x%08lx\n", load_address); 892 893 free(hdr); 894 return load_address; 895 896 fail: 897 free(hdr); 898 return -1; 899 } 900 901 static struct andr_img_hdr * 902 extract_boot_image_v012_header(struct blk_desc *dev_desc, 903 const disk_partition_t *boot_img) 904 { 905 struct andr_img_hdr *hdr; 906 long blk_cnt, blks_read; 907 908 blk_cnt = BLK_CNT(sizeof(struct andr_img_hdr), dev_desc->blksz); 909 hdr = (struct andr_img_hdr *)malloc(blk_cnt * dev_desc->blksz); 910 911 if (!blk_cnt || !hdr) 912 return NULL; 913 914 blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, hdr); 915 if (blks_read != blk_cnt) { 916 debug("boot img header blk cnt is %ld and blks read is %ld\n", 917 blk_cnt, blks_read); 918 return NULL; 919 } 920 921 if (android_image_check_header((void *)hdr)) { 922 printf("boot header magic is invalid.\n"); 923 return NULL; 924 } 925 926 if (hdr->page_size < sizeof(*hdr)) { 927 printf("android hdr is over size\n"); 928 return NULL; 929 } 930 931 return hdr; 932 } 933 934 static struct boot_img_hdr_v34 * 935 extract_boot_image_v34_header(struct blk_desc *dev_desc, 936 const disk_partition_t *boot_img) 937 { 938 struct boot_img_hdr_v34 *boot_hdr; 939 long blk_cnt, blks_read; 940 941 blk_cnt = BLK_CNT(sizeof(struct boot_img_hdr_v34), dev_desc->blksz); 942 boot_hdr = (struct boot_img_hdr_v34 *)malloc(blk_cnt * dev_desc->blksz); 943 944 if (!blk_cnt || !boot_hdr) 945 return NULL; 946 947 blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, boot_hdr); 948 if (blks_read != blk_cnt) { 949 debug("boot img header blk cnt is %ld and blks read is %ld\n", 950 blk_cnt, blks_read); 951 return NULL; 952 } 953 954 if (android_image_check_header((void *)boot_hdr)) { 955 printf("boot header magic is invalid.\n"); 956 return NULL; 957 } 958 959 if (boot_hdr->header_version < 3) { 960 printf("boot header %d, is not >= v3.\n", 961 boot_hdr->header_version); 962 return NULL; 963 } 964 965 return boot_hdr; 966 } 967 968 static struct vendor_boot_img_hdr_v34 * 969 extract_vendor_boot_image_v34_header(struct blk_desc *dev_desc, 970 const disk_partition_t *part_vendor_boot) 971 { 972 struct vendor_boot_img_hdr_v34 *vboot_hdr; 973 long blk_cnt, blks_read; 974 975 blk_cnt = BLK_CNT(sizeof(struct vendor_boot_img_hdr_v34), 976 part_vendor_boot->blksz); 977 vboot_hdr = (struct vendor_boot_img_hdr_v34 *) 978 malloc(blk_cnt * part_vendor_boot->blksz); 979 980 if (!blk_cnt || !vboot_hdr) 981 return NULL; 982 983 blks_read = blk_dread(dev_desc, part_vendor_boot->start, 984 blk_cnt, vboot_hdr); 985 if (blks_read != blk_cnt) { 986 debug("vboot img header blk cnt is %ld and blks read is %ld\n", 987 blk_cnt, blks_read); 988 return NULL; 989 } 990 991 if (strncmp(VENDOR_BOOT_MAGIC, (void *)vboot_hdr->magic, 992 VENDOR_BOOT_MAGIC_SIZE)) { 993 printf("vendor boot header is invalid.\n"); 994 return NULL; 995 } 996 997 if (vboot_hdr->header_version < 3) { 998 printf("vendor boot header %d, is not >= v3.\n", 999 vboot_hdr->header_version); 1000 return NULL; 1001 } 1002 1003 return vboot_hdr; 1004 } 1005 1006 static int populate_boot_info(const struct boot_img_hdr_v34 *boot_hdr, 1007 const struct vendor_boot_img_hdr_v34 *vendor_boot_hdr, 1008 struct andr_img_hdr *hdr) 1009 { 1010 memset(hdr->magic, 0, ANDR_BOOT_MAGIC_SIZE); 1011 memcpy(hdr->magic, boot_hdr->magic, ANDR_BOOT_MAGIC_SIZE); 1012 1013 hdr->kernel_size = boot_hdr->kernel_size; 1014 /* don't use vendor_boot_hdr->kernel_addr, we prefer "hdr + hdr->page_size" */ 1015 hdr->kernel_addr = ANDROID_IMAGE_DEFAULT_KERNEL_ADDR; 1016 /* generic ramdisk: immediately following the vendor ramdisk */ 1017 hdr->boot_ramdisk_size = boot_hdr->ramdisk_size; 1018 hdr->ramdisk_size = boot_hdr->ramdisk_size; 1019 1020 /* actually, useless */ 1021 hdr->ramdisk_addr = env_get_ulong("ramdisk_addr_r", 16, 0); 1022 1023 /* removed in v3 */ 1024 hdr->second_size = 0; 1025 hdr->second_addr = 0; 1026 1027 hdr->tags_addr = vendor_boot_hdr->tags_addr; 1028 1029 /* fixed in v3 */ 1030 hdr->page_size = 4096; 1031 hdr->header_version = boot_hdr->header_version; 1032 hdr->os_version = boot_hdr->os_version; 1033 1034 memset(hdr->name, 0, ANDR_BOOT_NAME_SIZE); 1035 strncpy(hdr->name, (const char *)vendor_boot_hdr->name, ANDR_BOOT_NAME_SIZE); 1036 1037 /* removed in v3 */ 1038 memset(hdr->cmdline, 0, ANDR_BOOT_ARGS_SIZE); 1039 memset(hdr->id, 0, 32); 1040 memset(hdr->extra_cmdline, 0, ANDR_BOOT_EXTRA_ARGS_SIZE); 1041 hdr->recovery_dtbo_size = 0; 1042 hdr->recovery_dtbo_offset = 0; 1043 1044 hdr->header_size = boot_hdr->header_size; 1045 hdr->dtb_size = vendor_boot_hdr->dtb_size; 1046 hdr->dtb_addr = vendor_boot_hdr->dtb_addr; 1047 1048 /* boot_img_hdr_v34 fields */ 1049 hdr->vendor_ramdisk_size = vendor_boot_hdr->vendor_ramdisk_size; 1050 hdr->vendor_page_size = vendor_boot_hdr->page_size; 1051 hdr->vendor_header_version = vendor_boot_hdr->header_version; 1052 hdr->vendor_header_size = vendor_boot_hdr->header_size; 1053 1054 hdr->total_cmdline = calloc(1, TOTAL_BOOT_ARGS_SIZE); 1055 if (!hdr->total_cmdline) 1056 return -ENOMEM; 1057 strncpy(hdr->total_cmdline, (const char *)boot_hdr->cmdline, 1058 sizeof(boot_hdr->cmdline)); 1059 strncat(hdr->total_cmdline, " ", 1); 1060 strncat(hdr->total_cmdline, (const char *)vendor_boot_hdr->cmdline, 1061 sizeof(vendor_boot_hdr->cmdline)); 1062 1063 /* new for header v4 */ 1064 if (vendor_boot_hdr->header_version > 3) { 1065 hdr->vendor_ramdisk_table_size = 1066 vendor_boot_hdr->vendor_ramdisk_table_size; 1067 hdr->vendor_ramdisk_table_entry_num = 1068 vendor_boot_hdr->vendor_ramdisk_table_entry_num; 1069 hdr->vendor_ramdisk_table_entry_size = 1070 vendor_boot_hdr->vendor_ramdisk_table_entry_size; 1071 /* 1072 * If we place additional "androidboot.xxx" parameters after 1073 * bootconfig, this field value should be increased, 1074 * but not over than ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE. 1075 */ 1076 hdr->vendor_bootconfig_size = 1077 vendor_boot_hdr->vendor_bootconfig_size; 1078 } else { 1079 hdr->vendor_ramdisk_table_size = 0; 1080 hdr->vendor_ramdisk_table_entry_num = 0; 1081 hdr->vendor_ramdisk_table_entry_size = 0; 1082 hdr->vendor_bootconfig_size = 0; 1083 } 1084 1085 if (hdr->page_size < sizeof(*hdr)) { 1086 printf("android hdr is over size\n"); 1087 return -EINVAL; 1088 } 1089 1090 return 0; 1091 } 1092 1093 /* 1094 * The possible cases of boot.img + recovery.img: 1095 * 1096 * [N]: 0, 1, 2 1097 * [M]: 0, 1, 2, 3, 4 1098 * 1099 * |--------------------|---------------------| 1100 * | boot.img | recovery.img | 1101 * |--------------------|---------------------| 1102 * | boot_img_hdr_v[N] | boot_img_hdr_v[N] | <= if A/B is not required 1103 * |--------------------|---------------------| 1104 * | boot_img_hdr_v34 | boot_img_hdr_v2 | <= if A/B is not required 1105 * |------------------------------------------| 1106 * | boot_img_hdr_v[M], no recovery.img | <= if A/B is required 1107 * |------------------------------------------| 1108 */ 1109 struct andr_img_hdr *populate_andr_img_hdr(struct blk_desc *dev_desc, 1110 disk_partition_t *part_boot) 1111 { 1112 disk_partition_t part_vendor_boot; 1113 struct vendor_boot_img_hdr_v34 *vboot_hdr; 1114 struct boot_img_hdr_v34 *boot_hdr; 1115 struct andr_img_hdr *andr_hdr; 1116 int header_version; 1117 1118 if (!dev_desc || !part_boot) 1119 return NULL; 1120 1121 andr_hdr = (struct andr_img_hdr *)malloc(1 * dev_desc->blksz); 1122 if (!andr_hdr) 1123 return NULL; 1124 1125 if (blk_dread(dev_desc, part_boot->start, 1, andr_hdr) != 1) { 1126 free(andr_hdr); 1127 return NULL; 1128 } 1129 1130 if (android_image_check_header(andr_hdr)) { 1131 free(andr_hdr); 1132 return NULL; 1133 } 1134 1135 header_version = andr_hdr->header_version; 1136 free(andr_hdr); 1137 1138 if (header_version < 3) { 1139 return extract_boot_image_v012_header(dev_desc, part_boot); 1140 } else { 1141 if (part_get_info_by_name(dev_desc, 1142 ANDROID_PARTITION_VENDOR_BOOT, 1143 &part_vendor_boot) < 0) { 1144 printf("No vendor boot partition\n"); 1145 return NULL; 1146 } 1147 boot_hdr = extract_boot_image_v34_header(dev_desc, part_boot); 1148 vboot_hdr = extract_vendor_boot_image_v34_header(dev_desc, 1149 &part_vendor_boot); 1150 if (!boot_hdr || !vboot_hdr) 1151 goto image_load_exit; 1152 1153 andr_hdr = (struct andr_img_hdr *) 1154 malloc(sizeof(struct andr_img_hdr)); 1155 if (!andr_hdr) { 1156 printf("No memory for andr hdr\n"); 1157 goto image_load_exit; 1158 } 1159 1160 if (populate_boot_info(boot_hdr, vboot_hdr, andr_hdr)) { 1161 printf("populate boot info failed\n"); 1162 goto image_load_exit; 1163 } 1164 1165 free(boot_hdr); 1166 free(vboot_hdr); 1167 1168 return andr_hdr; 1169 1170 image_load_exit: 1171 free(boot_hdr); 1172 free(vboot_hdr); 1173 1174 return NULL; 1175 } 1176 1177 return NULL; 1178 } 1179 1180 #if !defined(CONFIG_SPL_BUILD) 1181 /** 1182 * android_print_contents - prints out the contents of the Android format image 1183 * @hdr: pointer to the Android format image header 1184 * 1185 * android_print_contents() formats a multi line Android image contents 1186 * description. 1187 * The routine prints out Android image properties 1188 * 1189 * returns: 1190 * no returned results 1191 */ 1192 void android_print_contents(const struct andr_img_hdr *hdr) 1193 { 1194 const char * const p = IMAGE_INDENT_STRING; 1195 /* os_version = ver << 11 | lvl */ 1196 u32 os_ver = hdr->os_version >> 11; 1197 u32 os_lvl = hdr->os_version & ((1U << 11) - 1); 1198 u32 header_version = hdr->header_version; 1199 1200 printf("%skernel size: %x\n", p, hdr->kernel_size); 1201 printf("%skernel address: %x\n", p, hdr->kernel_addr); 1202 printf("%sramdisk size: %x\n", p, hdr->ramdisk_size); 1203 printf("%sramdisk address: %x\n", p, hdr->ramdisk_addr); 1204 printf("%ssecond size: %x\n", p, hdr->second_size); 1205 printf("%ssecond address: %x\n", p, hdr->second_addr); 1206 printf("%stags address: %x\n", p, hdr->tags_addr); 1207 printf("%spage size: %x\n", p, hdr->page_size); 1208 printf("%sheader_version: %x\n", p, header_version); 1209 /* ver = A << 14 | B << 7 | C (7 bits for each of A, B, C) 1210 * lvl = ((Y - 2000) & 127) << 4 | M (7 bits for Y, 4 bits for M) */ 1211 printf("%sos_version: %x (ver: %u.%u.%u, level: %u.%u)\n", 1212 p, hdr->os_version, 1213 (os_ver >> 7) & 0x7F, (os_ver >> 14) & 0x7F, os_ver & 0x7F, 1214 (os_lvl >> 4) + 2000, os_lvl & 0x0F); 1215 printf("%sname: %s\n", p, hdr->name); 1216 printf("%scmdline: %s\n", p, hdr->cmdline); 1217 1218 if (header_version == 1 || header_version == 2) { 1219 printf("%srecovery dtbo size: %x\n", p, hdr->recovery_dtbo_size); 1220 printf("%srecovery dtbo offset: %llx\n", p, hdr->recovery_dtbo_offset); 1221 printf("%sheader size: %x\n", p, hdr->header_size); 1222 } 1223 1224 if (header_version == 2 || header_version == 3) { 1225 printf("%sdtb size: %x\n", p, hdr->dtb_size); 1226 printf("%sdtb addr: %llx\n", p, hdr->dtb_addr); 1227 } 1228 1229 if (header_version >= 3) { 1230 printf("%scmdline: %s\n", p, hdr->total_cmdline); 1231 printf("%svendor ramdisk size: %x\n", p, hdr->vendor_ramdisk_size); 1232 printf("%svendor page size: %x\n", p, hdr->vendor_page_size); 1233 printf("%svendor header version: %d\n", p, hdr->vendor_header_version); 1234 printf("%svendor header size: %x\n", p, hdr->vendor_header_size); 1235 } 1236 1237 if (header_version >= 4) { 1238 printf("%svendor ramdisk table size: %x\n", 1239 p, hdr->vendor_ramdisk_table_size); 1240 printf("%svendor ramdisk table entry num: %x\n", 1241 p, hdr->vendor_ramdisk_table_entry_num); 1242 printf("%svendor ramdisk table entry size: %x\n", 1243 p, hdr->vendor_ramdisk_table_entry_size); 1244 printf("%svendor bootconfig size: %d\n", 1245 p, hdr->vendor_bootconfig_size); 1246 } 1247 } 1248 #endif 1249