xref: /rk3399_rockchip-uboot/common/image-android.c (revision ac0849ac913ea106a359915a1fc90da0cbe10bc7)
1 /*
2  * Copyright (c) 2011 Sebastian Andrzej Siewior <bigeasy@linutronix.de>
3  *
4  * SPDX-License-Identifier:	GPL-2.0+
5  */
6 
7 #include <common.h>
8 #include <image.h>
9 #include <android_ab.h>
10 #include <android_bootloader.h>
11 #include <android_image.h>
12 #include <malloc.h>
13 #include <mapmem.h>
14 #include <errno.h>
15 #include <boot_rkimg.h>
16 #include <crypto.h>
17 #include <sysmem.h>
18 #include <u-boot/sha1.h>
19 #ifdef CONFIG_RKIMG_BOOTLOADER
20 #include <asm/arch/resource_img.h>
21 #endif
22 #ifdef CONFIG_RK_AVB_LIBAVB_USER
23 #include <android_avb/avb_slot_verify.h>
24 #include <android_avb/avb_ops_user.h>
25 #include <android_avb/rk_avb_ops_user.h>
26 #endif
27 #include <optee_include/OpteeClientInterface.h>
28 
29 DECLARE_GLOBAL_DATA_PTR;
30 
31 #define ANDROID_IMAGE_DEFAULT_KERNEL_ADDR	0x10008000
32 #define ANDROID_PARTITION_VENDOR_BOOT		"vendor_boot"
33 #define ANDROID_PARTITION_INIT_BOOT		"init_boot"
34 
35 #define BLK_CNT(_num_bytes, _block_size)	\
36 		((_num_bytes + _block_size - 1) / _block_size)
37 
38 static char andr_tmp_str[ANDR_BOOT_ARGS_SIZE + 1];
39 static u32 android_kernel_comp_type = IH_COMP_NONE;
40 
41 static int android_version_init(void)
42 {
43 	struct andr_img_hdr *hdr = NULL;
44 	struct blk_desc *desc;
45 	const char *part_name = PART_BOOT;
46 	disk_partition_t part;
47 	int os_version;
48 
49 	desc = rockchip_get_bootdev();
50 	if (!desc) {
51 		printf("No bootdev\n");
52 		return -1;
53 	}
54 
55 #ifdef CONFIG_ANDROID_AB
56 	part_name = ab_can_find_recovery_part() ? PART_RECOVERY : PART_BOOT;
57 #endif
58 	if (part_get_info_by_name(desc, part_name, &part) < 0)
59 		return -1;
60 
61 	hdr = populate_andr_img_hdr(desc, &part);
62 	if (!hdr)
63 		return -1;
64 
65 	os_version = hdr->os_version;
66 	if (os_version)
67 		printf("Android %u.%u, Build %u.%u, v%d\n",
68 		       (os_version >> 25) & 0x7f, (os_version >> 18) & 0x7F,
69 		       ((os_version >> 4) & 0x7f) + 2000, os_version & 0x0F,
70 		       hdr->header_version);
71 	free(hdr);
72 
73 	return (os_version >> 25) & 0x7f;
74 }
75 
76 u32 android_bcb_msg_sector_offset(void)
77 {
78 	static int android_version = -1;	/* static */
79 
80 	/*
81 	 * get android os version:
82 	 *
83 	 * There are two types of misc.img:
84 	 *	Rockchip platforms defines BCB message at the 16KB offset of
85 	 *	misc.img except for the Android version >= 10. Because Google
86 	 *	defines it at 0x00 offset, and from Android-10 it becoms mandary
87 	 *	on Google VTS.
88 	 *
89 	 * So we must get android 'os_version' to identify which type we
90 	 * are using, then we could able to use rockchip_get_boot_mode()
91 	 * which reads BCB from misc.img.
92 	 */
93 #ifdef CONFIG_RKIMG_BOOTLOADER
94 	if (android_version < 0)
95 		android_version = android_version_init();
96 
97 	return (android_version >= 10) ? 0x00 : 0x20;
98 #else
99 	return 0x00;
100 #endif
101 }
102 
103 static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr)
104 {
105 	/*
106 	 * All the Android tools that generate a boot.img use this
107 	 * address as the default.
108 	 *
109 	 * Even though it doesn't really make a lot of sense, and it
110 	 * might be valid on some platforms, we treat that address as
111 	 * the default value for this field, and try to execute the
112 	 * kernel in place in such a case.
113 	 *
114 	 * Otherwise, we will return the actual value set by the user.
115 	 */
116 	if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR)
117 		return (ulong)hdr + hdr->page_size;
118 
119 #ifdef CONFIG_ARCH_ROCKCHIP
120 	/*
121 	 * If kernel is compressed, kernel_addr is set as decompressed address
122 	 * after compressed being loaded to ram, so let's use it.
123 	 */
124 	if (android_kernel_comp_type != IH_COMP_NONE &&
125 	    android_kernel_comp_type != IH_COMP_ZIMAGE)
126 		return hdr->kernel_addr;
127 
128 	/*
129 	 * Compatble with rockchip legacy packing with kernel/ramdisk/second
130 	 * address base from 0x60000000(SDK versiont < 8.1), these are invalid
131 	 * address, so we calc it by real size.
132 	 */
133 	return (ulong)hdr + hdr->page_size;
134 #else
135 	return hdr->kernel_addr;
136 #endif
137 
138 }
139 
140 void android_image_set_comp(struct andr_img_hdr *hdr, u32 comp)
141 {
142 	android_kernel_comp_type = comp;
143 }
144 
145 u32 android_image_get_comp(const struct andr_img_hdr *hdr)
146 {
147 	return android_kernel_comp_type;
148 }
149 
150 int android_image_parse_kernel_comp(const struct andr_img_hdr *hdr)
151 {
152 	ulong kaddr = android_image_get_kernel_addr(hdr);
153 	return bootm_parse_comp((const unsigned char *)kaddr);
154 }
155 
156 /**
157  * android_image_get_kernel() - processes kernel part of Android boot images
158  * @hdr:	Pointer to image header, which is at the start
159  *			of the image.
160  * @verify:	Checksum verification flag. Currently unimplemented.
161  * @os_data:	Pointer to a ulong variable, will hold os data start
162  *			address.
163  * @os_len:	Pointer to a ulong variable, will hold os data length.
164  *
165  * This function returns the os image's start address and length. Also,
166  * it appends the kernel command line to the bootargs env variable.
167  *
168  * Return: Zero, os start address and length on success,
169  *		otherwise on failure.
170  */
171 int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify,
172 			     ulong *os_data, ulong *os_len)
173 {
174 	u32 kernel_addr = android_image_get_kernel_addr(hdr);
175 	const char *cmdline = hdr->header_version < 3 ?
176 			      hdr->cmdline : hdr->total_cmdline;
177 	/*
178 	 * Not all Android tools use the id field for signing the image with
179 	 * sha1 (or anything) so we don't check it. It is not obvious that the
180 	 * string is null terminated so we take care of this.
181 	 */
182 	strncpy(andr_tmp_str, hdr->name, ANDR_BOOT_NAME_SIZE);
183 	andr_tmp_str[ANDR_BOOT_NAME_SIZE] = '\0';
184 	if (strlen(andr_tmp_str))
185 		printf("Android's image name: %s\n", andr_tmp_str);
186 
187 	printf("Kernel: 0x%08x - 0x%08x (%u KiB)\n",
188 	       kernel_addr, kernel_addr + hdr->kernel_size,
189 	       DIV_ROUND_UP(hdr->kernel_size, 1024));
190 
191 	int len = 0;
192 	if (cmdline) {
193 		debug("Kernel command line: %s\n", cmdline);
194 		len += strlen(cmdline);
195 	}
196 
197 	char *bootargs = env_get("bootargs");
198 	if (bootargs)
199 		len += strlen(bootargs);
200 
201 	char *newbootargs = malloc(len + 2);
202 	if (!newbootargs) {
203 		puts("Error: malloc in android_image_get_kernel failed!\n");
204 		return -ENOMEM;
205 	}
206 	*newbootargs = '\0';
207 
208 	if (bootargs) {
209 		strcpy(newbootargs, bootargs);
210 		strcat(newbootargs, " ");
211 	}
212 	if (cmdline)
213 		strcat(newbootargs, cmdline);
214 
215 	env_set("bootargs", newbootargs);
216 
217 	if (os_data) {
218 		*os_data = (ulong)hdr;
219 		*os_data += hdr->page_size;
220 	}
221 	if (os_len)
222 		*os_len = hdr->kernel_size;
223 	return 0;
224 }
225 
226 int android_image_check_header(const struct andr_img_hdr *hdr)
227 {
228 	return memcmp(ANDR_BOOT_MAGIC, hdr->magic, ANDR_BOOT_MAGIC_SIZE);
229 }
230 
231 ulong android_image_get_end(const struct andr_img_hdr *hdr)
232 {
233 	ulong end;
234 	/*
235 	 * The header takes a full page, the remaining components are aligned
236 	 * on page boundary
237 	 */
238 	end = (ulong)hdr;
239 	if (hdr->header_version < 3) {
240 		end += hdr->page_size;
241 		end += ALIGN(hdr->kernel_size, hdr->page_size);
242 		end += ALIGN(hdr->ramdisk_size, hdr->page_size);
243 		end += ALIGN(hdr->second_size, hdr->page_size);
244 		if (hdr->header_version == 1) {
245 			end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
246 		} else if (hdr->header_version == 2) {
247 			end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
248 			end += ALIGN(hdr->dtb_size, hdr->page_size);
249 		}
250 	} else {
251 		/* boot_img_hdr_v34 */
252 		end += hdr->page_size;
253 		end += ALIGN(hdr->kernel_size, hdr->page_size);
254 		end += ALIGN(hdr->ramdisk_size, hdr->page_size);
255 	}
256 
257 	return end;
258 }
259 
260 u32 android_image_get_ksize(const struct andr_img_hdr *hdr)
261 {
262 	return hdr->kernel_size;
263 }
264 
265 void android_image_set_kload(struct andr_img_hdr *hdr, u32 load_address)
266 {
267 	hdr->kernel_addr = load_address;
268 }
269 
270 ulong android_image_get_kload(const struct andr_img_hdr *hdr)
271 {
272 	return android_image_get_kernel_addr(hdr);
273 }
274 
275 int android_image_get_ramdisk(const struct andr_img_hdr *hdr,
276 			      ulong *rd_data, ulong *rd_len)
277 {
278 	ulong ramdisk_addr_r;
279 	ulong start, end;
280 
281 	if (!hdr->ramdisk_size) {
282 		*rd_data = *rd_len = 0;
283 		return -1;
284 	}
285 
286 	/* Have been loaded by android_image_load_separate() on ramdisk_addr_r */
287 	ramdisk_addr_r = env_get_ulong("ramdisk_addr_r", 16, 0);
288 	if (!ramdisk_addr_r) {
289 		printf("No Found Ramdisk Load Address.\n");
290 		return -1;
291 	}
292 
293 	*rd_data = ramdisk_addr_r;
294 	*rd_len = hdr->ramdisk_size;
295 	if (hdr->header_version >= 3)
296 		*rd_len += hdr->vendor_ramdisk_size;
297 	if (hdr->header_version >= 4) {
298 		 *rd_len += hdr->vendor_bootconfig_size +
299 		  ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE;
300 	}
301 
302 	/* just for print msg */
303 	start = ramdisk_addr_r;
304 	if (hdr->header_version >= 3) {
305 		end = start + (ulong)hdr->vendor_ramdisk_size;
306 		printf("v-ramdisk:  0x%08lx - 0x%08lx (%u KiB)\n",
307 		       start, end, DIV_ROUND_UP(hdr->vendor_ramdisk_size, 1024));
308 		start = end;
309 	}
310 	{
311 		end = start + (ulong)hdr->ramdisk_size;
312 		printf("ramdisk:    0x%08lx - 0x%08lx (%u KiB)\n",
313 		       start, end, DIV_ROUND_UP(hdr->ramdisk_size, 1024));
314 		start = end;
315 	}
316 	if (hdr->header_version >= 4) {
317 		end = start + (ulong)hdr->vendor_bootconfig_size;
318 		printf("bootconfig: 0x%08lx - 0x%08lx (%u KiB)\n",
319 		       start, end, DIV_ROUND_UP(hdr->vendor_bootconfig_size, 1024));
320 		start = end;
321 		end = start + ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE;
322 		printf("bootparams: 0x%08lx - 0x%08lx\n", start, end);
323 	}
324 
325 	return 0;
326 }
327 
328 int android_image_get_fdt(const struct andr_img_hdr *hdr,
329 			      ulong *rd_data)
330 {
331 	ulong fdt_addr_r;
332 
333 	if (!hdr->second_size) {
334 		*rd_data = 0;
335 		return -1;
336 	}
337 
338 	/* Have been loaded by android_image_load_separate() on fdt_addr_r */
339 	fdt_addr_r = env_get_ulong("fdt_addr_r", 16, 0);
340 	if (!fdt_addr_r) {
341 		printf("No Found FDT Load Address.\n");
342 		return -1;
343 	}
344 
345 	*rd_data = fdt_addr_r;
346 
347 	debug("FDT load addr 0x%08x size %u KiB\n",
348 	      hdr->second_addr, DIV_ROUND_UP(hdr->second_size, 1024));
349 
350 	return 0;
351 }
352 
353 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
354 static void print_hash(const char *label, u8 *hash, int len)
355 {
356 	int i;
357 
358 	printf("%s:\n    0x", label ? : "Hash");
359 	for (i = 0; i < len; i++)
360 		printf("%02x", hash[i]);
361 	printf("\n");
362 }
363 #endif
364 
365 typedef enum {
366 	IMG_KERNEL,
367 	IMG_RAMDISK,	/* within boot.img or init_boot.img(Android-13 or later) */
368 	IMG_SECOND,
369 	IMG_RECOVERY_DTBO,
370 	IMG_RK_DTB,	/* within resource.img in second position */
371 	IMG_DTB,
372 	IMG_VENDOR_RAMDISK,
373 	IMG_BOOTCONFIG,
374 	IMG_MAX,
375 } img_t;
376 
377 #if defined(CONFIG_ANDROID_BOOT_IMAGE_HASH) && !defined(CONFIG_DM_CRYPTO)
378 static sha1_context sha1_ctx;
379 #endif
380 
381 static int image_load(img_t img, struct andr_img_hdr *hdr,
382 		      ulong blkstart, void *ram_base,
383 		      struct udevice *crypto)
384 {
385 	struct blk_desc *desc = rockchip_get_bootdev();
386 	disk_partition_t part_vendor_boot;
387 	disk_partition_t part_init_boot;
388 	__maybe_unused u32 typesz;
389 	u32 andr_version = (hdr->os_version >> 25) & 0x7f;
390 	ulong pgsz = hdr->page_size;
391 	ulong blksz = desc->blksz;
392 	ulong blkcnt, blkoff;
393 	ulong memmove_dst = 0;
394 	ulong bsoffs = 0;
395 	ulong extra = 0;
396 	ulong length;
397 	void *buffer;
398 	void *tmp = NULL;
399 	int ret = 0;
400 
401 	switch (img) {
402 	case IMG_KERNEL:
403 		bsoffs = 0; /* include a page_size(image header) */
404 		length = hdr->kernel_size + pgsz;
405 		buffer = (void *)env_get_ulong("android_addr_r", 16, 0);
406 		blkcnt = DIV_ROUND_UP(hdr->kernel_size + pgsz, blksz);
407 		typesz = sizeof(hdr->kernel_size);
408 		if (!sysmem_alloc_base(MEM_KERNEL,
409 			(phys_addr_t)buffer, blkcnt * blksz))
410 			return -ENOMEM;
411 		break;
412 	case IMG_VENDOR_RAMDISK:
413 		if (hdr->vendor_boot_buf) {
414 			ram_base = hdr->vendor_boot_buf;
415 		} else {
416 			if (part_get_info_by_name(desc,
417 						  ANDROID_PARTITION_VENDOR_BOOT,
418 						  &part_vendor_boot) < 0) {
419 				printf("No vendor boot partition\n");
420 				return -ENOENT;
421 			}
422 			ram_base = 0;
423 		}
424 
425 		blkstart = part_vendor_boot.start;
426 		pgsz = hdr->vendor_page_size;
427 		bsoffs = ALIGN(VENDOR_BOOT_HDRv3_SIZE, pgsz);
428 		length = hdr->vendor_ramdisk_size;
429 		buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0);
430 		blkcnt = DIV_ROUND_UP(hdr->vendor_ramdisk_size, blksz);
431 		typesz = sizeof(hdr->vendor_ramdisk_size);
432 		/*
433 		 * Add extra memory for generic ramdisk space.
434 		 *
435 		 * In case of unaligned vendor ramdisk size, reserve
436 		 * 1 more blksz.
437 		 *
438 		 * Reserve 8KB for bootloader cmdline.
439 		 */
440 		if (hdr->header_version >= 3)
441 			extra += ALIGN(hdr->ramdisk_size, blksz) + blksz;
442 		if (hdr->header_version >= 4)
443 			extra += ALIGN(hdr->vendor_bootconfig_size, blksz) +
444 				 ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE;
445 		if (length && !sysmem_alloc_base(MEM_RAMDISK,
446 			(phys_addr_t)buffer, blkcnt * blksz + extra))
447 			return -ENOMEM;
448 		break;
449 	case IMG_RAMDISK:
450 		/* get ramdisk from init_boot.img ? */
451 		if (hdr->header_version >= 4 && andr_version >= 13) {
452 			if (hdr->init_boot_buf) {
453 				ram_base = hdr->init_boot_buf;
454 			} else {
455 				if (part_get_info_by_name(desc,
456 				    ANDROID_PARTITION_INIT_BOOT, &part_init_boot) < 0) {
457 					printf("No init boot partition\n");
458 					return -ENOENT;
459 				}
460 				blkstart = part_init_boot.start;
461 				ram_base = 0;
462 			}
463 			bsoffs = pgsz;
464 		} else {
465 			/* get ramdisk from generic boot.img */
466 			bsoffs = pgsz + ALIGN(hdr->kernel_size, pgsz);
467 		}
468 
469 		length = hdr->ramdisk_size;
470 		buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0);
471 		blkcnt = DIV_ROUND_UP(hdr->ramdisk_size, blksz);
472 		typesz = sizeof(hdr->ramdisk_size);
473 
474 		/*
475 		 * ramdisk_addr_r v012:
476 		 *	|----------------|
477 		 *	|    ramdisk     |
478 		 *	|----------------|
479 		 *
480 		 * ramdisk_addr_r v3 (Android-11 and later):
481 		 *	|----------------|---------|
482 		 *	| vendor-ramdisk | ramdisk |
483 		 *	|----------------|---------|
484 		 *
485 		 * ramdisk_addr_r v4 (Android-12 and later):
486 		 *	|----------------|---------|------------|------------|
487 		 *	| vendor-ramdisk | ramdisk | bootconfig | bootparams |
488 		 *	|----------------|---------|------------|------------|
489 		 *
490 		 * ramdisk_addr_r v4 + init_boot(Android-13 and later):
491 		 *	|----------------|----------------|------------|------------|
492 		 *	| vendor-ramdisk | (init_)ramdisk | bootconfig | bootparams |
493 		 *	|----------------|----------------|------------|------------|
494 		 */
495 		if (hdr->header_version >= 3) {
496 			buffer += hdr->vendor_ramdisk_size;
497 			if (!IS_ALIGNED((ulong)buffer, blksz)) {
498 				memmove_dst = (ulong)buffer;
499 				buffer = (void *)ALIGN(memmove_dst, blksz);
500 			}
501 		}
502 		/* sysmem has been alloced by vendor ramdisk */
503 		if (hdr->header_version < 3) {
504 			if (length && !sysmem_alloc_base(MEM_RAMDISK,
505 				(phys_addr_t)buffer, blkcnt * blksz))
506 				return -ENOMEM;
507 		}
508 		break;
509 	case IMG_BOOTCONFIG:
510 		if (hdr->header_version < 4)
511 			return 0;
512 
513 		if (hdr->vendor_boot_buf) {
514 			ram_base = hdr->vendor_boot_buf;
515 		} else {
516 			if (part_get_info_by_name(desc,
517 						  ANDROID_PARTITION_VENDOR_BOOT,
518 						  &part_vendor_boot) < 0) {
519 				printf("No vendor boot partition\n");
520 				return -ENOENT;
521 			}
522 			ram_base = 0;
523 		}
524 		blkstart = part_vendor_boot.start;
525 		pgsz = hdr->vendor_page_size;
526 		bsoffs = ALIGN(VENDOR_BOOT_HDRv4_SIZE, pgsz) +
527 			 ALIGN(hdr->vendor_ramdisk_size, pgsz) +
528 			 ALIGN(hdr->dtb_size, pgsz) +
529 			 ALIGN(hdr->vendor_ramdisk_table_size, pgsz);
530 		length = hdr->vendor_bootconfig_size;
531 		buffer = (void *)env_get_ulong("ramdisk_addr_r", 16, 0);
532 		blkcnt = DIV_ROUND_UP(hdr->vendor_bootconfig_size, blksz);
533 		typesz = sizeof(hdr->vendor_bootconfig_size);
534 
535 		buffer += hdr->vendor_ramdisk_size + hdr->ramdisk_size;
536 		if (!IS_ALIGNED((ulong)buffer, blksz)) {
537 			memmove_dst = (ulong)buffer;
538 			buffer = (void *)ALIGN(memmove_dst, blksz);
539 		}
540 		break;
541 	case IMG_SECOND:
542 		bsoffs = pgsz +
543 			 ALIGN(hdr->kernel_size, pgsz) +
544 			 ALIGN(hdr->ramdisk_size, pgsz);
545 		length = hdr->second_size;
546 		blkcnt = DIV_ROUND_UP(hdr->second_size, blksz);
547 		buffer = tmp = malloc(blkcnt * blksz);
548 		typesz = sizeof(hdr->second_size);
549 		break;
550 	case IMG_RECOVERY_DTBO:
551 		bsoffs = pgsz +
552 			 ALIGN(hdr->kernel_size, pgsz) +
553 			 ALIGN(hdr->ramdisk_size, pgsz) +
554 			 ALIGN(hdr->second_size, pgsz);
555 		length = hdr->recovery_dtbo_size;
556 		blkcnt = DIV_ROUND_UP(hdr->recovery_dtbo_size, blksz);
557 		buffer = tmp = malloc(blkcnt * blksz);
558 		typesz = sizeof(hdr->recovery_dtbo_size);
559 		break;
560 	case IMG_DTB:
561 		bsoffs = pgsz +
562 			 ALIGN(hdr->kernel_size, pgsz) +
563 			 ALIGN(hdr->ramdisk_size, pgsz) +
564 			 ALIGN(hdr->second_size, pgsz) +
565 			 ALIGN(hdr->recovery_dtbo_size, pgsz);
566 		length = hdr->dtb_size;
567 		blkcnt = DIV_ROUND_UP(hdr->dtb_size, blksz);
568 		buffer = tmp = malloc(blkcnt * blksz);
569 		typesz = sizeof(hdr->dtb_size);
570 		break;
571 	case IMG_RK_DTB:
572 #ifdef CONFIG_RKIMG_BOOTLOADER
573 		/* No going further, it handles DTBO, HW-ID, etc */
574 		buffer = (void *)env_get_ulong("fdt_addr_r", 16, 0);
575 		if (gd->fdt_blob != (void *)buffer)
576 			ret = rockchip_read_dtb_file(buffer);
577 #endif
578 		return ret < 0 ? ret : 0;
579 	default:
580 		return -EINVAL;
581 	}
582 
583 	if (!buffer) {
584 		printf("No memory for image(%d)\n", img);
585 		return -ENOMEM;
586 	}
587 
588 	if (!blksz || !length)
589 		goto crypto_calc;
590 
591 	/* load */
592 	if (ram_base) {
593 		memcpy(buffer, (char *)((ulong)ram_base + bsoffs), length);
594 	} else {
595 		blkoff = DIV_ROUND_UP(bsoffs, blksz);
596 		ret = blk_dread(desc, blkstart + blkoff, blkcnt, buffer);
597 		if (ret != blkcnt) {
598 			printf("Failed to read img(%d), ret=%d\n", img, ret);
599 			return -EIO;
600 		}
601 	}
602 
603 	if (memmove_dst)
604 		memmove((char *)memmove_dst, buffer, length);
605 
606 crypto_calc:
607 	if (img == IMG_KERNEL) {
608 		buffer += pgsz;
609 		length -= pgsz;
610 	}
611 
612 	/* sha1 */
613 	if (hdr->header_version < 3) {
614 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
615 #ifdef CONFIG_DM_CRYPTO
616 		crypto_sha_update(crypto, (u32 *)buffer, length);
617 		crypto_sha_update(crypto, (u32 *)&length, typesz);
618 #else
619 		sha1_update(&sha1_ctx, (void *)buffer, length);
620 		sha1_update(&sha1_ctx, (void *)&length, typesz);
621 #endif
622 #endif
623 	}
624 
625 	if (tmp)
626 		free(tmp);
627 
628 	return 0;
629 }
630 
631 static int images_load_verify(struct andr_img_hdr *hdr, ulong part_start,
632 			      void *ram_base, struct udevice *crypto)
633 {
634 	/* load, never change order ! */
635 	if (image_load(IMG_KERNEL, hdr, part_start, ram_base, crypto))
636 		return -1;
637 	if (image_load(IMG_RAMDISK, hdr, part_start, ram_base, crypto))
638 		return -1;
639 	if (image_load(IMG_SECOND, hdr, part_start, ram_base, crypto))
640 		return -1;
641 	if (hdr->header_version > 0) {
642 		if (image_load(IMG_RECOVERY_DTBO, hdr, part_start,
643 			       ram_base, crypto))
644 			return -1;
645 	}
646 	if (hdr->header_version > 1) {
647 		if (image_load(IMG_DTB, hdr, part_start, ram_base, crypto))
648 			return -1;
649 	}
650 
651 	return 0;
652 }
653 
654 /*
655  * @ram_base: !NULL means require memcpy for an exist full android image.
656  */
657 static int android_image_separate(struct andr_img_hdr *hdr,
658 				  const disk_partition_t *part,
659 				  void *load_address,
660 				  void *ram_base)
661 {
662 	ulong bstart;
663 	int ret;
664 
665 	if (android_image_check_header(hdr)) {
666 		printf("Bad android image header\n");
667 		return -EINVAL;
668 	}
669 
670 	/* set for image_load(IMG_KERNEL, ...) */
671 	env_set_hex("android_addr_r", (ulong)load_address);
672 	bstart = part ? part->start : 0;
673 
674 	/*
675 	 * 1. Load images to their individual target ram position
676 	 *    in order to disable fdt/ramdisk relocation.
677 	 */
678 
679 	/* load rk-kernel.dtb alone */
680 	if (image_load(IMG_RK_DTB, hdr, bstart, ram_base, NULL))
681 		return -1;
682 
683 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
684 	if (hdr->header_version < 3) {
685 		struct udevice *dev = NULL;
686 		uchar hash[20];
687 #ifdef CONFIG_DM_CRYPTO
688 		sha_context ctx;
689 
690 		ctx.length = 0;
691 		ctx.algo = CRYPTO_SHA1;
692 		dev = crypto_get_device(ctx.algo);
693 		if (!dev) {
694 			printf("Can't find crypto device for SHA1\n");
695 			return -ENODEV;
696 		}
697 
698 		/* v1 & v2: requires total length before sha init */
699 		ctx.length += hdr->kernel_size + sizeof(hdr->kernel_size) +
700 			      hdr->ramdisk_size + sizeof(hdr->ramdisk_size) +
701 			      hdr->second_size + sizeof(hdr->second_size);
702 		if (hdr->header_version > 0)
703 			ctx.length += hdr->recovery_dtbo_size +
704 						sizeof(hdr->recovery_dtbo_size);
705 		if (hdr->header_version > 1)
706 			ctx.length += hdr->dtb_size + sizeof(hdr->dtb_size);
707 		crypto_sha_init(dev, &ctx);
708 #else
709 		sha1_starts(&sha1_ctx);
710 #endif
711 		ret = images_load_verify(hdr, bstart, ram_base, dev);
712 		if (ret)
713 			return ret;
714 
715 #ifdef CONFIG_DM_CRYPTO
716 		crypto_sha_final(dev, &ctx, hash);
717 #else
718 		sha1_finish(&sha1_ctx, hash);
719 #endif
720 		if (memcmp(hash, hdr->id, 20)) {
721 			print_hash("Hash from header", (u8 *)hdr->id, 20);
722 			print_hash("Hash real", (u8 *)hash, 20);
723 			return -EBADFD;
724 		} else {
725 			printf("ANDROID: Hash OK\n");
726 		}
727 	} else
728 #endif
729 	{
730 		ret = images_load_verify(hdr, bstart, ram_base, NULL);
731 		if (ret)
732 			return ret;
733 	}
734 
735 	/* 2. Disable fdt/ramdisk relocation, it saves boot time */
736 	env_set("bootm-no-reloc", "y");
737 
738 	return 0;
739 }
740 
741 static int android_image_separate_v34(struct andr_img_hdr *hdr,
742 				      const disk_partition_t *part,
743 				      void *load_address, void *ram_base)
744 {
745 	ulong bstart;
746 
747 	if (android_image_check_header(hdr)) {
748 		printf("Bad android image header\n");
749 		return -EINVAL;
750 	}
751 
752 	/* set for image_load(IMG_KERNEL, ...) */
753 	env_set_hex("android_addr_r", (ulong)load_address);
754 	bstart = part ? part->start : 0;
755 
756 	/*
757 	 * 1. Load images to their individual target ram position
758 	 *    in order to disable fdt/ramdisk relocation.
759 	 */
760 	if (image_load(IMG_RK_DTB,  hdr, bstart, ram_base, NULL))
761 		return -1;
762 	if (image_load(IMG_KERNEL,  hdr, bstart, ram_base, NULL))
763 		return -1;
764 	if (image_load(IMG_VENDOR_RAMDISK, hdr, bstart, ram_base, NULL))
765 		return -1;
766 	if (image_load(IMG_RAMDISK, hdr, bstart, ram_base, NULL))
767 		return -1;
768 	if (image_load(IMG_BOOTCONFIG, hdr, bstart, ram_base, NULL))
769 		return -1;
770 	/*
771 	 * Copy the populated hdr to load address after image_load(IMG_KERNEL)
772 	 *
773 	 * The image_load(IMG_KERNEL) only reads boot_img_hdr_v34 while
774 	 * vendor_boot_img_hdr_v34 is not included, so fix it here.
775 	 */
776 	memcpy((char *)load_address, hdr, hdr->page_size);
777 
778 	/* 2. Disable fdt/ramdisk relocation, it saves boot time */
779 	env_set("bootm-no-reloc", "y");
780 
781 	return 0;
782 }
783 
784 static ulong android_image_get_comp_addr(struct andr_img_hdr *hdr, int comp)
785 {
786 	ulong kernel_addr_c;
787 	ulong load_addr = 0;
788 
789 	kernel_addr_c = env_get_ulong("kernel_addr_c", 16, 0);
790 
791 #ifdef CONFIG_ARM64
792 	/*
793 	 * On 64-bit kernel, assuming use IMAGE by default.
794 	 *
795 	 * kernel_addr_c is for LZ4-IMAGE but maybe not defined.
796 	 * kernel_addr_r is for IMAGE.
797 	 */
798 	if (comp != IH_COMP_NONE) {
799 		ulong comp_addr;
800 
801 		if (kernel_addr_c) {
802 			comp_addr = kernel_addr_c;
803 		} else {
804 			printf("Warn: No \"kernel_addr_c\"\n");
805 			comp_addr = CONFIG_SYS_SDRAM_BASE + 0x2000000;/* 32M */
806 			env_set_hex("kernel_addr_c", comp_addr);
807 		}
808 
809 		load_addr = comp_addr - hdr->page_size;
810 	}
811 #else
812 	/*
813 	 * On 32-bit kernel:
814 	 *
815 	 * The input load_addr is from env value: "kernel_addr_r", it has
816 	 * different role depends on whether kernel_addr_c is defined:
817 	 *
818 	 * - kernel_addr_r is for lz4/zImage if kernel_addr_c if [not] defined.
819 	 * - kernel_addr_r is for IMAGE if kernel_addr_c is defined.
820 	 */
821 	if (comp == IH_COMP_NONE) {
822 		if (kernel_addr_c) {
823 			/* input load_addr is for Image, nothing to do */
824 		} else {
825 			/* input load_addr is for lz4/zImage, set default addr for Image */
826 			load_addr = CONFIG_SYS_SDRAM_BASE + 0x8000;
827 			env_set_hex("kernel_addr_r", load_addr);
828 
829 			load_addr -= hdr->page_size;
830 		}
831 	} else {
832 		if (kernel_addr_c) {
833 			/* input load_addr is for Image, so use another for lz4/zImage */
834 			load_addr = kernel_addr_c - hdr->page_size;
835 		} else {
836 			/* input load_addr is for lz4/zImage, nothing to do */
837 		}
838 	}
839 #endif
840 
841 	return load_addr;
842 }
843 
844 void android_image_set_decomp(struct andr_img_hdr *hdr, int comp)
845 {
846 	ulong kernel_addr_r;
847 
848 	env_set_ulong("os_comp", comp);
849 
850 	/* zImage handles decompress itself */
851 	if (comp != IH_COMP_NONE && comp != IH_COMP_ZIMAGE) {
852 		kernel_addr_r = env_get_ulong("kernel_addr_r", 16, 0x02080000);
853 		android_image_set_kload(hdr, kernel_addr_r);
854 		android_image_set_comp(hdr, comp);
855 	} else {
856 		android_image_set_comp(hdr, IH_COMP_NONE);
857 	}
858 }
859 
860 static int android_image_load_separate(struct andr_img_hdr *hdr,
861 				       const disk_partition_t *part,
862 				       void *load_addr)
863 {
864 	if (hdr->header_version < 3)
865 		return android_image_separate(hdr, part, load_addr, NULL);
866 	else
867 		return android_image_separate_v34(hdr, part, load_addr, NULL);
868 }
869 
870 int android_image_memcpy_separate(struct andr_img_hdr *hdr, ulong *load_addr)
871 {
872 	ulong comp_addr;
873 	int comp;
874 
875 	comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size);
876 	comp_addr = android_image_get_comp_addr(hdr, comp);
877 
878 	/* non-compressed image: already in-place */
879 	if ((ulong)hdr == *load_addr)
880 		return 0;
881 
882 	/* compressed image */
883 	if (comp_addr) {
884 		*load_addr = comp_addr;
885 		if ((ulong)hdr == comp_addr)	/* already in-place */
886 			return 0;
887 	}
888 
889 	/*
890 	 * The most possible reason to arrive here is:
891 	 *
892 	 * VBoot=1 and AVB load full partition to a temp memory buffer, now we
893 	 * separate(memcpy) subimages from boot.img to where they should be.
894 	 */
895 	if (hdr->header_version < 3) {
896 		if (android_image_separate(hdr, NULL, (void *)(*load_addr), hdr))
897 			return -1;
898 	} else {
899 		if (android_image_separate_v34(hdr, NULL, (void *)(*load_addr), hdr))
900 			return -1;
901 	}
902 
903 	android_image_set_decomp((void *)(*load_addr), comp);
904 
905 	return 0;
906 }
907 
908 long android_image_load(struct blk_desc *dev_desc,
909 			const disk_partition_t *part_info,
910 			unsigned long load_address,
911 			unsigned long max_size) {
912 	struct andr_img_hdr *hdr;
913 	ulong comp_addr;
914 	int comp, ret;
915 	int blk_off;
916 
917 	if (max_size < part_info->blksz)
918 		return -1;
919 
920 	hdr = populate_andr_img_hdr(dev_desc, (disk_partition_t *)part_info);
921 	if (!hdr) {
922 		printf("No valid android hdr\n");
923 		return -1;
924 	}
925 
926 	/*
927 	 * create the layout:
928 	 *
929 	 * |<- page_size ->|1-blk |
930 	 * |-----|---------|------|-----|
931 	 * | hdr |   ...   |   kernel   |
932 	 * |-----|----- ---|------------|
933 	 *
934 	 * Alloc page_size and 1 more blk for reading kernel image to
935 	 * get it's compression type, then fill the android hdr what
936 	 * we have populated before.
937 	 *
938 	 * Why? see: android_image_get_kernel_addr().
939 	 */
940 	blk_off = BLK_CNT(hdr->page_size, dev_desc->blksz);
941 	hdr = (struct andr_img_hdr *)
942 			realloc(hdr, (blk_off + 1) * dev_desc->blksz);
943 	if (!hdr)
944 		return -1;
945 
946 	if (blk_dread(dev_desc, part_info->start + blk_off, 1,
947 		      (char *)hdr + hdr->page_size) != 1) {
948 		free(hdr);
949 		return -1;
950 	}
951 
952 	/* Changed to compressed address ? */
953 	comp = bootm_parse_comp((void *)(ulong)hdr + hdr->page_size);
954 	comp_addr = android_image_get_comp_addr(hdr, comp);
955 	if (comp_addr)
956 		load_address = comp_addr;
957 	else
958 		load_address -= hdr->page_size;
959 
960 	ret = android_image_load_separate(hdr, part_info, (void *)load_address);
961 	if (ret) {
962 		printf("Failed to load android image\n");
963 		goto fail;
964 	}
965 	android_image_set_decomp((void *)load_address, comp);
966 
967 	debug("Loading Android Image to 0x%08lx\n", load_address);
968 
969 	free(hdr);
970 	return load_address;
971 
972 fail:
973 	free(hdr);
974 	return -1;
975 }
976 
977 static struct andr_img_hdr *
978 extract_boot_image_v012_header(struct blk_desc *dev_desc,
979 			       const disk_partition_t *boot_img)
980 {
981 	struct andr_img_hdr *hdr;
982 	long blk_cnt, blks_read;
983 
984 	blk_cnt = BLK_CNT(sizeof(struct andr_img_hdr), dev_desc->blksz);
985 	hdr = (struct andr_img_hdr *)malloc(blk_cnt * dev_desc->blksz);
986 
987 	if (!blk_cnt || !hdr)
988 		return NULL;
989 
990 	blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, hdr);
991 	if (blks_read != blk_cnt) {
992 		debug("boot img header blk cnt is %ld and blks read is %ld\n",
993 		      blk_cnt, blks_read);
994 		return NULL;
995 	}
996 
997 	if (android_image_check_header((void *)hdr)) {
998 		printf("boot header magic is invalid.\n");
999 		return NULL;
1000 	}
1001 
1002 	if (hdr->page_size < sizeof(*hdr)) {
1003 		printf("android hdr is over size\n");
1004 		return NULL;
1005 	}
1006 
1007 	return hdr;
1008 }
1009 
1010 static struct boot_img_hdr_v34 *
1011 extract_boot_image_v34_header(struct blk_desc *dev_desc,
1012 			      const disk_partition_t *boot_img)
1013 {
1014 	struct boot_img_hdr_v34 *boot_hdr;
1015 	disk_partition_t part;
1016 	long blk_cnt, blks_read;
1017 
1018 	blk_cnt = BLK_CNT(sizeof(struct boot_img_hdr_v34), dev_desc->blksz);
1019 	boot_hdr = (struct boot_img_hdr_v34 *)malloc(blk_cnt * dev_desc->blksz);
1020 
1021 	if (!blk_cnt || !boot_hdr)
1022 		return NULL;
1023 
1024 	blks_read = blk_dread(dev_desc, boot_img->start, blk_cnt, boot_hdr);
1025 	if (blks_read != blk_cnt) {
1026 		debug("boot img header blk cnt is %ld and blks read is %ld\n",
1027 		      blk_cnt, blks_read);
1028 		return NULL;
1029 	}
1030 
1031 	if (android_image_check_header((void *)boot_hdr)) {
1032 		printf("boot header magic is invalid.\n");
1033 		return NULL;
1034 	}
1035 
1036 	if (boot_hdr->header_version < 3) {
1037 		printf("boot header %d, is not >= v3.\n",
1038 		       boot_hdr->header_version);
1039 		return NULL;
1040 	}
1041 
1042 	/* Start from android-13 GKI, it doesn't assign 'os_version' */
1043 	if (boot_hdr->header_version >= 4 && boot_hdr->os_version == 0) {
1044 		if (part_get_info_by_name(dev_desc,
1045 				ANDROID_PARTITION_INIT_BOOT, &part) > 0)
1046 			boot_hdr->os_version = 13 << 25;
1047 	}
1048 
1049 	return boot_hdr;
1050 }
1051 
1052 static struct vendor_boot_img_hdr_v34 *
1053 extract_vendor_boot_image_v34_header(struct blk_desc *dev_desc,
1054 				     const disk_partition_t *part_vendor_boot)
1055 {
1056 	struct vendor_boot_img_hdr_v34 *vboot_hdr;
1057 	long blk_cnt, blks_read;
1058 
1059 	blk_cnt = BLK_CNT(sizeof(struct vendor_boot_img_hdr_v34),
1060 				part_vendor_boot->blksz);
1061 	vboot_hdr = (struct vendor_boot_img_hdr_v34 *)
1062 				malloc(blk_cnt * part_vendor_boot->blksz);
1063 
1064 	if (!blk_cnt || !vboot_hdr)
1065 		return NULL;
1066 
1067 	blks_read = blk_dread(dev_desc, part_vendor_boot->start,
1068 			      blk_cnt, vboot_hdr);
1069 	if (blks_read != blk_cnt) {
1070 		debug("vboot img header blk cnt is %ld and blks read is %ld\n",
1071 		      blk_cnt, blks_read);
1072 		return NULL;
1073 	}
1074 
1075 	if (strncmp(VENDOR_BOOT_MAGIC, (void *)vboot_hdr->magic,
1076 		    VENDOR_BOOT_MAGIC_SIZE)) {
1077 		printf("vendor boot header is invalid.\n");
1078 		return NULL;
1079 	}
1080 
1081 	if (vboot_hdr->header_version < 3) {
1082 		printf("vendor boot header %d, is not >= v3.\n",
1083 		       vboot_hdr->header_version);
1084 		return NULL;
1085 	}
1086 
1087 	return vboot_hdr;
1088 }
1089 
1090 int populate_boot_info(const struct boot_img_hdr_v34 *boot_hdr,
1091 		       const struct vendor_boot_img_hdr_v34 *vendor_boot_hdr,
1092 		       const struct boot_img_hdr_v34 *init_boot_hdr,
1093 		       struct andr_img_hdr *hdr, bool save_hdr)
1094 {
1095 	memset(hdr->magic, 0, ANDR_BOOT_MAGIC_SIZE);
1096 	memcpy(hdr->magic, boot_hdr->magic, ANDR_BOOT_MAGIC_SIZE);
1097 
1098 	hdr->kernel_size = boot_hdr->kernel_size;
1099 	/* don't use vendor_boot_hdr->kernel_addr, we prefer "hdr + hdr->page_size" */
1100 	hdr->kernel_addr = ANDROID_IMAGE_DEFAULT_KERNEL_ADDR;
1101 
1102 	/*
1103 	 * generic ramdisk: immediately following the vendor ramdisk.
1104 	 * It can be from init_boot.img or boot.img.
1105 	 */
1106 	if (init_boot_hdr)
1107 		hdr->ramdisk_size = init_boot_hdr->ramdisk_size;
1108 	else
1109 		hdr->ramdisk_size = boot_hdr->ramdisk_size;
1110 
1111 	/* actually, useless */
1112 	hdr->ramdisk_addr = env_get_ulong("ramdisk_addr_r", 16, 0);
1113 
1114 	/* removed in v3 */
1115 	hdr->second_size = 0;
1116 	hdr->second_addr = 0;
1117 
1118 	hdr->tags_addr = vendor_boot_hdr->tags_addr;
1119 
1120 	/* fixed in v3 */
1121 	hdr->page_size = 4096;
1122 	hdr->header_version = boot_hdr->header_version;
1123 	hdr->os_version = boot_hdr->os_version;
1124 
1125 	memset(hdr->name, 0, ANDR_BOOT_NAME_SIZE);
1126 	strncpy(hdr->name, (const char *)vendor_boot_hdr->name, ANDR_BOOT_NAME_SIZE);
1127 
1128 	/* removed in v3 */
1129 	memset(hdr->cmdline, 0, ANDR_BOOT_ARGS_SIZE);
1130 	memset(hdr->id, 0, 32);
1131 	memset(hdr->extra_cmdline, 0, ANDR_BOOT_EXTRA_ARGS_SIZE);
1132 	hdr->recovery_dtbo_size = 0;
1133 	hdr->recovery_dtbo_offset = 0;
1134 
1135 	hdr->header_size = boot_hdr->header_size;
1136 	hdr->dtb_size = vendor_boot_hdr->dtb_size;
1137 	hdr->dtb_addr = vendor_boot_hdr->dtb_addr;
1138 
1139 	/* boot_img_hdr_v34 fields */
1140 	hdr->vendor_ramdisk_size = vendor_boot_hdr->vendor_ramdisk_size;
1141 	hdr->vendor_page_size = vendor_boot_hdr->page_size;
1142 	hdr->vendor_header_version = vendor_boot_hdr->header_version;
1143 	hdr->vendor_header_size = vendor_boot_hdr->header_size;
1144 
1145 	hdr->total_cmdline = calloc(1, TOTAL_BOOT_ARGS_SIZE);
1146 	if (!hdr->total_cmdline)
1147 		return -ENOMEM;
1148 	strncpy(hdr->total_cmdline, (const char *)boot_hdr->cmdline,
1149 		sizeof(boot_hdr->cmdline));
1150 	strncat(hdr->total_cmdline, " ", 1);
1151 	strncat(hdr->total_cmdline, (const char *)vendor_boot_hdr->cmdline,
1152 		sizeof(vendor_boot_hdr->cmdline));
1153 
1154 	/* new for header v4 */
1155 	if (vendor_boot_hdr->header_version >= 4) {
1156 		hdr->vendor_ramdisk_table_size =
1157 				vendor_boot_hdr->vendor_ramdisk_table_size;
1158 		hdr->vendor_ramdisk_table_entry_num =
1159 				vendor_boot_hdr->vendor_ramdisk_table_entry_num;
1160 		hdr->vendor_ramdisk_table_entry_size =
1161 				vendor_boot_hdr->vendor_ramdisk_table_entry_size;
1162 		/*
1163 		 * If we place additional "androidboot.xxx" parameters after
1164 		 * bootconfig, this field value should be increased,
1165 		 * but not over than ANDROID_ADDITION_BOOTCONFIG_PARAMS_MAX_SIZE.
1166 		 */
1167 		hdr->vendor_bootconfig_size =
1168 				vendor_boot_hdr->vendor_bootconfig_size;
1169 	} else {
1170 		hdr->vendor_ramdisk_table_size = 0;
1171 		hdr->vendor_ramdisk_table_entry_num = 0;
1172 		hdr->vendor_ramdisk_table_entry_size = 0;
1173 		hdr->vendor_bootconfig_size = 0;
1174 	}
1175 
1176 	hdr->init_boot_buf = save_hdr ? (void *)init_boot_hdr : 0;
1177 	hdr->vendor_boot_buf = save_hdr ? (void *)vendor_boot_hdr : 0;
1178 
1179 	if (hdr->page_size < sizeof(*hdr)) {
1180 		printf("android hdr is over size\n");
1181 		return -EINVAL;
1182 	}
1183 
1184 	return 0;
1185 }
1186 
1187 /*
1188  * The possible cases of boot.img + recovery.img:
1189  *
1190  * [N]: 0, 1, 2
1191  * [M]: 0, 1, 2, 3, 4
1192  *
1193  * |--------------------|---------------------|
1194  * |   boot.img         |    recovery.img     |
1195  * |--------------------|---------------------|
1196  * | boot_img_hdr_v[N]  |  boot_img_hdr_v[N]  | <= if A/B is not required
1197  * |--------------------|---------------------|
1198  * | boot_img_hdr_v34   |  boot_img_hdr_v2    | <= if A/B is not required
1199  * |------------------------------------------|
1200  * | boot_img_hdr_v[M], no recovery.img       | <= if A/B is required
1201  * |------------------------------------------|
1202  */
1203 struct andr_img_hdr *populate_andr_img_hdr(struct blk_desc *dev_desc,
1204 					   disk_partition_t *part_boot)
1205 {
1206 	disk_partition_t part_vendor_boot;
1207 	disk_partition_t part_init_boot;
1208 	struct vendor_boot_img_hdr_v34 *vboot_hdr = NULL;
1209 	struct boot_img_hdr_v34 *iboot_hdr = NULL;
1210 	struct boot_img_hdr_v34 *boot_hdr = NULL;
1211 	struct andr_img_hdr *andr_hdr = NULL;
1212 	int header_version;
1213 	int andr_version;
1214 
1215 	if (!dev_desc || !part_boot)
1216 		return NULL;
1217 
1218 	andr_hdr = (struct andr_img_hdr *)malloc(1 * dev_desc->blksz);
1219 	if (!andr_hdr)
1220 		return NULL;
1221 
1222 	if (blk_dread(dev_desc, part_boot->start, 1, andr_hdr) != 1) {
1223 		free(andr_hdr);
1224 		return NULL;
1225 	}
1226 
1227 	if (android_image_check_header(andr_hdr)) {
1228 		free(andr_hdr);
1229 		return NULL;
1230 	}
1231 
1232 	header_version = andr_hdr->header_version;
1233 	free(andr_hdr);
1234 	andr_hdr = NULL;
1235 
1236 	if (header_version < 3) {
1237 		return extract_boot_image_v012_header(dev_desc, part_boot);
1238 	} else {
1239 		if (part_get_info_by_name(dev_desc,
1240 					  ANDROID_PARTITION_VENDOR_BOOT,
1241 					  &part_vendor_boot) < 0) {
1242 			printf("No vendor boot partition\n");
1243 			return NULL;
1244 		}
1245 		boot_hdr = extract_boot_image_v34_header(dev_desc, part_boot);
1246 		vboot_hdr = extract_vendor_boot_image_v34_header(dev_desc,
1247 							&part_vendor_boot);
1248 		if (!boot_hdr || !vboot_hdr)
1249 			goto image_load_exit;
1250 
1251 		andr_version = (boot_hdr->os_version >> 25) & 0x7f;
1252 		if (header_version >= 4 && andr_version >= 13) {
1253 			if (part_get_info_by_name(dev_desc,
1254 						  ANDROID_PARTITION_INIT_BOOT,
1255 						  &part_init_boot) < 0) {
1256 				printf("No init boot partition\n");
1257 				return NULL;
1258 			}
1259 			iboot_hdr = extract_boot_image_v34_header(dev_desc, &part_init_boot);
1260 			if (!iboot_hdr)
1261 				goto image_load_exit;
1262 			if (!iboot_hdr->ramdisk_size) {
1263 				printf("No ramdisk in init boot partition\n");
1264 				goto image_load_exit;
1265 			}
1266 		}
1267 
1268 		andr_hdr = (struct andr_img_hdr *)
1269 				malloc(sizeof(struct andr_img_hdr));
1270 		if (!andr_hdr) {
1271 			printf("No memory for andr hdr\n");
1272 			goto image_load_exit;
1273 		}
1274 
1275 		if (populate_boot_info(boot_hdr, vboot_hdr,
1276 				       iboot_hdr, andr_hdr, false)) {
1277 			printf("populate boot info failed\n");
1278 			goto image_load_exit;
1279 		}
1280 
1281 image_load_exit:
1282 		if (boot_hdr)
1283 			free(boot_hdr);
1284 		if (iboot_hdr)
1285 			free(iboot_hdr);
1286 		if (vboot_hdr)
1287 			free(vboot_hdr);
1288 
1289 		return andr_hdr;
1290 	}
1291 
1292 	return NULL;
1293 }
1294 
1295 #if !defined(CONFIG_SPL_BUILD)
1296 /**
1297  * android_print_contents - prints out the contents of the Android format image
1298  * @hdr: pointer to the Android format image header
1299  *
1300  * android_print_contents() formats a multi line Android image contents
1301  * description.
1302  * The routine prints out Android image properties
1303  *
1304  * returns:
1305  *     no returned results
1306  */
1307 void android_print_contents(const struct andr_img_hdr *hdr)
1308 {
1309 	const char * const p = IMAGE_INDENT_STRING;
1310 	/* os_version = ver << 11 | lvl */
1311 	u32 os_ver = hdr->os_version >> 11;
1312 	u32 os_lvl = hdr->os_version & ((1U << 11) - 1);
1313 	u32 header_version = hdr->header_version;
1314 
1315 	printf("%skernel size:      %x\n", p, hdr->kernel_size);
1316 	printf("%skernel address:   %x\n", p, hdr->kernel_addr);
1317 	printf("%sramdisk size:     %x\n", p, hdr->ramdisk_size);
1318 	printf("%sramdisk address: %x\n", p, hdr->ramdisk_addr);
1319 	printf("%ssecond size:      %x\n", p, hdr->second_size);
1320 	printf("%ssecond address:   %x\n", p, hdr->second_addr);
1321 	printf("%stags address:     %x\n", p, hdr->tags_addr);
1322 	printf("%spage size:        %x\n", p, hdr->page_size);
1323 	printf("%sheader_version:   %x\n", p, header_version);
1324 	/* ver = A << 14 | B << 7 | C         (7 bits for each of A, B, C)
1325 	 * lvl = ((Y - 2000) & 127) << 4 | M  (7 bits for Y, 4 bits for M) */
1326 	printf("%sos_version:       %x (ver: %u.%u.%u, level: %u.%u)\n",
1327 	       p, hdr->os_version,
1328 	       (os_ver >> 7) & 0x7F, (os_ver >> 14) & 0x7F, os_ver & 0x7F,
1329 	       (os_lvl >> 4) + 2000, os_lvl & 0x0F);
1330 	printf("%sname:             %s\n", p, hdr->name);
1331 	printf("%scmdline:          %s\n", p, hdr->cmdline);
1332 
1333 	if (header_version == 1 || header_version == 2) {
1334 		printf("%srecovery dtbo size:    %x\n", p, hdr->recovery_dtbo_size);
1335 		printf("%srecovery dtbo offset:  %llx\n", p, hdr->recovery_dtbo_offset);
1336 		printf("%sheader size:           %x\n", p, hdr->header_size);
1337 	}
1338 
1339 	if (header_version == 2 || header_version == 3) {
1340 		printf("%sdtb size:              %x\n", p, hdr->dtb_size);
1341 		printf("%sdtb addr:              %llx\n", p, hdr->dtb_addr);
1342 	}
1343 
1344 	if (header_version >= 3) {
1345 		printf("%scmdline:               %s\n", p, hdr->total_cmdline);
1346 		printf("%svendor ramdisk size:   %x\n", p, hdr->vendor_ramdisk_size);
1347 		printf("%svendor page size:      %x\n", p, hdr->vendor_page_size);
1348 		printf("%svendor header version: %d\n", p, hdr->vendor_header_version);
1349 		printf("%svendor header size:    %x\n", p, hdr->vendor_header_size);
1350 	}
1351 
1352 	if (header_version >= 4) {
1353 		printf("%svendor ramdisk table size:        %x\n",
1354 		       p, hdr->vendor_ramdisk_table_size);
1355 		printf("%svendor ramdisk table entry num:   %x\n",
1356 		       p, hdr->vendor_ramdisk_table_entry_num);
1357 		printf("%svendor ramdisk table entry size:  %x\n",
1358 		       p, hdr->vendor_ramdisk_table_entry_size);
1359 		printf("%svendor bootconfig size:           %d\n",
1360 		       p, hdr->vendor_bootconfig_size);
1361 	}
1362 }
1363 #endif
1364