xref: /rk3399_rockchip-uboot/common/image-android.c (revision d0ff3d454829105c81afe7f5d8c79e0d3d18c1a2)
1 /*
2  * Copyright (c) 2011 Sebastian Andrzej Siewior <bigeasy@linutronix.de>
3  *
4  * SPDX-License-Identifier:	GPL-2.0+
5  */
6 
7 #include <common.h>
8 #include <image.h>
9 #include <android_image.h>
10 #include <android_bootloader.h>
11 #include <malloc.h>
12 #include <mapmem.h>
13 #include <errno.h>
14 #include <boot_rkimg.h>
15 #include <crypto.h>
16 #include <sysmem.h>
17 #include <u-boot/sha1.h>
18 #ifdef CONFIG_RKIMG_BOOTLOADER
19 #include <asm/arch/resource_img.h>
20 #endif
21 #ifdef CONFIG_RK_AVB_LIBAVB_USER
22 #include <android_avb/avb_slot_verify.h>
23 #include <android_avb/avb_ops_user.h>
24 #include <android_avb/rk_avb_ops_user.h>
25 #endif
26 #include <optee_include/OpteeClientInterface.h>
27 
28 DECLARE_GLOBAL_DATA_PTR;
29 
30 #define ANDROID_IMAGE_DEFAULT_KERNEL_ADDR	0x10008000
31 #define ANDROID_ARG_FDT_FILENAME "rk-kernel.dtb"
32 
33 static char andr_tmp_str[ANDR_BOOT_ARGS_SIZE + 1];
34 static u32 android_kernel_comp_type = IH_COMP_NONE;
35 
36 static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr)
37 {
38 	/*
39 	 * All the Android tools that generate a boot.img use this
40 	 * address as the default.
41 	 *
42 	 * Even though it doesn't really make a lot of sense, and it
43 	 * might be valid on some platforms, we treat that address as
44 	 * the default value for this field, and try to execute the
45 	 * kernel in place in such a case.
46 	 *
47 	 * Otherwise, we will return the actual value set by the user.
48 	 */
49 	if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR)
50 		return (ulong)hdr + hdr->page_size;
51 
52 #ifdef CONFIG_ARCH_ROCKCHIP
53 	/*
54 	 * If kernel is compressed, kernel_addr is set as decompressed address
55 	 * after compressed being loaded to ram, so let's use it.
56 	 */
57 	if (android_kernel_comp_type != IH_COMP_NONE &&
58 	    android_kernel_comp_type != IH_COMP_ZIMAGE)
59 		return hdr->kernel_addr;
60 
61 	/*
62 	 * Compatble with rockchip legacy packing with kernel/ramdisk/second
63 	 * address base from 0x60000000(SDK versiont < 8.1), these are invalid
64 	 * address, so we calc it by real size.
65 	 */
66 	return (ulong)hdr + hdr->page_size;
67 #else
68 	return hdr->kernel_addr;
69 #endif
70 
71 }
72 
73 void android_image_set_comp(struct andr_img_hdr *hdr, u32 comp)
74 {
75 	android_kernel_comp_type = comp;
76 }
77 
78 u32 android_image_get_comp(const struct andr_img_hdr *hdr)
79 {
80 	return android_kernel_comp_type;
81 }
82 
83 int android_image_parse_kernel_comp(const struct andr_img_hdr *hdr)
84 {
85 	ulong kaddr = android_image_get_kernel_addr(hdr);
86 	return bootm_parse_comp((const unsigned char *)kaddr);
87 }
88 
89 /**
90  * android_image_get_kernel() - processes kernel part of Android boot images
91  * @hdr:	Pointer to image header, which is at the start
92  *			of the image.
93  * @verify:	Checksum verification flag. Currently unimplemented.
94  * @os_data:	Pointer to a ulong variable, will hold os data start
95  *			address.
96  * @os_len:	Pointer to a ulong variable, will hold os data length.
97  *
98  * This function returns the os image's start address and length. Also,
99  * it appends the kernel command line to the bootargs env variable.
100  *
101  * Return: Zero, os start address and length on success,
102  *		otherwise on failure.
103  */
104 int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify,
105 			     ulong *os_data, ulong *os_len)
106 {
107 	u32 kernel_addr = android_image_get_kernel_addr(hdr);
108 
109 	/*
110 	 * Not all Android tools use the id field for signing the image with
111 	 * sha1 (or anything) so we don't check it. It is not obvious that the
112 	 * string is null terminated so we take care of this.
113 	 */
114 	strncpy(andr_tmp_str, hdr->name, ANDR_BOOT_NAME_SIZE);
115 	andr_tmp_str[ANDR_BOOT_NAME_SIZE] = '\0';
116 	if (strlen(andr_tmp_str))
117 		printf("Android's image name: %s\n", andr_tmp_str);
118 
119 	printf("Kernel load addr 0x%08x size %u KiB\n",
120 	       kernel_addr, DIV_ROUND_UP(hdr->kernel_size, 1024));
121 
122 	int len = 0;
123 	if (*hdr->cmdline) {
124 		debug("Kernel command line: %s\n", hdr->cmdline);
125 		len += strlen(hdr->cmdline);
126 	}
127 
128 	char *bootargs = env_get("bootargs");
129 	if (bootargs)
130 		len += strlen(bootargs);
131 
132 	char *newbootargs = malloc(len + 2);
133 	if (!newbootargs) {
134 		puts("Error: malloc in android_image_get_kernel failed!\n");
135 		return -ENOMEM;
136 	}
137 	*newbootargs = '\0';
138 
139 	if (bootargs) {
140 		strcpy(newbootargs, bootargs);
141 		strcat(newbootargs, " ");
142 	}
143 	if (*hdr->cmdline)
144 		strcat(newbootargs, hdr->cmdline);
145 
146 	env_set("bootargs", newbootargs);
147 
148 	if (os_data) {
149 		*os_data = (ulong)hdr;
150 		*os_data += hdr->page_size;
151 	}
152 	if (os_len)
153 		*os_len = hdr->kernel_size;
154 	return 0;
155 }
156 
157 int android_image_check_header(const struct andr_img_hdr *hdr)
158 {
159 	return memcmp(ANDR_BOOT_MAGIC, hdr->magic, ANDR_BOOT_MAGIC_SIZE);
160 }
161 
162 ulong android_image_get_end(const struct andr_img_hdr *hdr)
163 {
164 	ulong end;
165 	/*
166 	 * The header takes a full page, the remaining components are aligned
167 	 * on page boundary
168 	 */
169 	end = (ulong)hdr;
170 	end += hdr->page_size;
171 	end += ALIGN(hdr->kernel_size, hdr->page_size);
172 	end += ALIGN(hdr->ramdisk_size, hdr->page_size);
173 	end += ALIGN(hdr->second_size, hdr->page_size);
174 
175 	if (hdr->header_version >= 1)
176 		end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
177 
178 	return end;
179 }
180 
181 u32 android_image_get_ksize(const struct andr_img_hdr *hdr)
182 {
183 	return hdr->kernel_size;
184 }
185 
186 void android_image_set_kload(struct andr_img_hdr *hdr, u32 load_address)
187 {
188 	hdr->kernel_addr = load_address;
189 }
190 
191 ulong android_image_get_kload(const struct andr_img_hdr *hdr)
192 {
193 	return android_image_get_kernel_addr(hdr);
194 }
195 
196 int android_image_get_ramdisk(const struct andr_img_hdr *hdr,
197 			      ulong *rd_data, ulong *rd_len)
198 {
199 	if (!hdr->ramdisk_size) {
200 		*rd_data = *rd_len = 0;
201 		return -1;
202 	}
203 
204 	/* We have load ramdisk at "ramdisk_addr_r" */
205 #ifdef CONFIG_ANDROID_BOOT_IMAGE_SEPARATE
206 	ulong ramdisk_addr_r;
207 
208 	ramdisk_addr_r = env_get_ulong("ramdisk_addr_r", 16, 0);
209 	if (!ramdisk_addr_r) {
210 		printf("No Found Ramdisk Load Address.\n");
211 		return -1;
212 	}
213 
214 	*rd_data = ramdisk_addr_r;
215 #else
216 	*rd_data = (unsigned long)hdr;
217 	*rd_data += hdr->page_size;
218 	*rd_data += ALIGN(hdr->kernel_size, hdr->page_size);
219 #endif
220 
221 	*rd_len = hdr->ramdisk_size;
222 
223 	printf("RAM disk load addr 0x%08lx size %u KiB\n",
224 	       *rd_data, DIV_ROUND_UP(hdr->ramdisk_size, 1024));
225 
226 	return 0;
227 }
228 
229 int android_image_get_fdt(const struct andr_img_hdr *hdr,
230 			      ulong *rd_data)
231 {
232 	if (!hdr->second_size) {
233 		*rd_data = 0;
234 		return -1;
235 	}
236 
237 	/* We have load fdt at "fdt_addr_r" */
238 #if defined(CONFIG_USING_KERNEL_DTB) || \
239     defined(CONFIG_ANDROID_BOOT_IMAGE_SEPARATE)
240 	ulong fdt_addr_r;
241 
242 	fdt_addr_r = env_get_ulong("fdt_addr_r", 16, 0);
243 	if (!fdt_addr_r) {
244 		printf("No Found FDT Load Address.\n");
245 		return -1;
246 	}
247 
248 	*rd_data = fdt_addr_r;
249 #else
250 	*rd_data = (unsigned long)hdr;
251 	*rd_data += hdr->page_size;
252 	*rd_data += ALIGN(hdr->kernel_size, hdr->page_size);
253 	*rd_data += ALIGN(hdr->ramdisk_size, hdr->page_size);
254 #endif
255 
256 	debug("FDT load addr 0x%08x size %u KiB\n",
257 	      hdr->second_addr, DIV_ROUND_UP(hdr->second_size, 1024));
258 
259 	return 0;
260 }
261 
262 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
263 static void print_hash(const char *label, u8 *hash, int len)
264 {
265 	int i;
266 
267 	printf("%s:\n    0x", label ? : "Hash");
268 	for (i = 0; i < len; i++)
269 		printf("%02x", hash[i]);
270 	printf("\n");
271 }
272 
273 /*
274  * This is only for Non-AVB image, because AVB image is verified by AVB bootflow.
275  * The kernel/ramdisk/second address should be the real address in hdr before
276  * calling this function.
277  *
278  * mkbootimg tool always use SHA1 for images.
279  */
280 static int android_image_hash_verify(struct andr_img_hdr *hdr)
281 {
282 	u8 hash[20];
283 
284 #ifdef DEBUG
285 	android_print_contents(hdr);
286 #endif
287 
288 	if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR) {
289 		printf("No real image address in android hdr\n");
290 		return -EINVAL;
291 	}
292 
293 #ifdef CONFIG_DM_CRYPTO
294 	struct udevice *dev;
295 	sha_context ctx;
296 
297 	dev = crypto_get_device(CRYPTO_SHA1);
298 	if (!dev) {
299 		printf("Can't find crypto device for SHA1 capability\n");
300 		return -ENODEV;
301 	}
302 
303 	ctx.algo = CRYPTO_SHA1;
304 	ctx.length = hdr->kernel_size + sizeof(hdr->kernel_size) +
305 		     hdr->ramdisk_size + sizeof(hdr->ramdisk_size) +
306 		     hdr->second_size + sizeof(hdr->second_size);
307 #ifdef CONFIG_HASH_ROCKCHIP_LEGACY
308 	ctx.length += sizeof(hdr->tags_addr) + sizeof(hdr->page_size) +
309 		      sizeof(hdr->unused) + sizeof(hdr->name) +
310 		      sizeof(hdr->cmdline);
311 #endif
312 
313 	crypto_sha_init(dev, &ctx);
314 
315 	crypto_sha_update(dev, (u32 *)(ulong)hdr->kernel_addr,
316 			  hdr->kernel_size);
317 	crypto_sha_update(dev, (u32 *)&hdr->kernel_size,
318 			  sizeof(hdr->kernel_size));
319 	crypto_sha_update(dev, (u32 *)(ulong)hdr->ramdisk_addr,
320 			  hdr->ramdisk_size);
321 	crypto_sha_update(dev, (u32 *)&hdr->ramdisk_size,
322 			  sizeof(hdr->ramdisk_size));
323 	crypto_sha_update(dev, (u32 *)(ulong)hdr->second_addr,
324 			  hdr->second_size);
325 	crypto_sha_update(dev, (u32 *)&hdr->second_size,
326 			  sizeof(hdr->second_size));
327 #ifdef CONFIG_HASH_ROCKCHIP_LEGACY
328 	crypto_sha_update(dev, (u32 *)&hdr->tags_addr, sizeof(hdr->tags_addr));
329 	crypto_sha_update(dev, (u32 *)&hdr->page_size, sizeof(hdr->page_size));
330 	crypto_sha_update(dev, (u32 *)&hdr->header_version,
331 			  sizeof(hdr->header_version));
332 	crypto_sha_update(dev, (u32 *)&hdr->os_version, sizeof(hdr->os_version));
333 	crypto_sha_update(dev, (u32 *)&hdr->name, sizeof(hdr->name));
334 	crypto_sha_update(dev, (u32 *)&hdr->cmdline, sizeof(hdr->cmdline));
335 #endif
336 
337 	crypto_sha_final(dev, &ctx, hash);
338 
339 #elif CONFIG_SHA1
340 	sha1_context ctx;
341 
342 	sha1_starts(&ctx);
343 	sha1_update(&ctx, (u8 *)(ulong)hdr->kernel_addr, hdr->kernel_size);
344 	sha1_update(&ctx, (u8 *)&hdr->kernel_size, sizeof(hdr->kernel_size));
345 	sha1_update(&ctx, (u8 *)(ulong)hdr->ramdisk_addr, hdr->ramdisk_size);
346 	sha1_update(&ctx, (u8 *)&hdr->ramdisk_size, sizeof(hdr->ramdisk_size));
347 	sha1_update(&ctx, (u8 *)(ulong)hdr->second_addr, hdr->second_size);
348 	sha1_update(&ctx, (u8 *)&hdr->second_size, sizeof(hdr->second_size));
349 #ifdef CONFIG_HASH_ROCKCHIP_LEGACY
350 	sha1_update(&ctx, (u8 *)&hdr->tags_addr, sizeof(hdr->tags_addr));
351 	sha1_update(&ctx, (u8 *)&hdr->page_size, sizeof(hdr->page_size));
352 	sha1_update(&ctx, (u8 *)&hdr->header_version,
353 		    sizeof(hdr->header_version));
354 	sha1_update(&ctx, (u8 *)&hdr->os_version, sizeof(hdr->os_version));
355 	sha1_update(&ctx, (u8 *)&hdr->name, sizeof(hdr->name));
356 	sha1_update(&ctx, (u8 *)&hdr->cmdline, sizeof(hdr->cmdline));
357 #endif
358 
359 	sha1_finish(&ctx, hash);
360 #endif	/* CONFIG_SHA1 */
361 
362 	if (memcmp(hash, hdr->id, 20)) {
363 		print_hash("SHA1 from image header", (u8 *)hdr->id, 20);
364 		print_hash("SHA1 real", (u8 *)hash, 20);
365 		return -EBADFD;
366 	}
367 
368 	return 0;
369 }
370 #endif
371 
372 #ifdef CONFIG_ANDROID_BOOT_IMAGE_SEPARATE
373 int android_image_load_separate(struct andr_img_hdr *hdr,
374 				const disk_partition_t *part,
375 				void *load_address, void *ram_src)
376 {
377 	struct blk_desc *dev_desc = rockchip_get_bootdev();
378 	ulong ramdisk_addr_r = env_get_ulong("ramdisk_addr_r", 16, 0);
379 	ulong kernel_addr_r = env_get_ulong("kernel_addr_r", 16, 0);
380 	char *fdt_high = env_get("fdt_high");
381 	char *ramdisk_high = env_get("initrd_high");
382 	ulong blk_start, blk_cnt, size;
383 	ulong start, second_addr_r = 0;
384 	int ret, blk_read = 0;
385 
386 	if (android_image_check_header(hdr)) {
387 		printf("Bad android image header\n");
388 		return -EINVAL;
389 	}
390 
391 	if (hdr->kernel_size) {
392 		size = hdr->kernel_size + hdr->page_size;
393 		blk_cnt = DIV_ROUND_UP(size, dev_desc->blksz);
394 		if (!sysmem_alloc_base(MEMBLK_ID_KERNEL,
395 				       (phys_addr_t)load_address,
396 				       blk_cnt * dev_desc->blksz))
397 			return -ENXIO;
398 
399 		if (ram_src) {
400 			start = (ulong)ram_src;
401 			memcpy((char *)load_address, (char *)start, size);
402 		} else {
403 			blk_start = part->start;
404 			ret = blk_dread(dev_desc, blk_start,
405 					blk_cnt, load_address);
406 			if (ret != blk_cnt) {
407 				printf("%s: read kernel failed, ret=%d\n",
408 				      __func__, ret);
409 				return -1;
410 			}
411 			blk_read += ret;
412 		}
413 	}
414 
415 	if (hdr->ramdisk_size) {
416 		size = hdr->page_size + ALIGN(hdr->kernel_size, hdr->page_size);
417 		blk_cnt = DIV_ROUND_UP(hdr->ramdisk_size, dev_desc->blksz);
418 		if (!sysmem_alloc_base(MEMBLK_ID_RAMDISK,
419 				       ramdisk_addr_r,
420 				       blk_cnt * dev_desc->blksz))
421 			return -ENXIO;
422 		if (ram_src) {
423 			start = (unsigned long)ram_src;
424 			start += hdr->page_size;
425 			start += ALIGN(hdr->kernel_size, hdr->page_size);
426 			memcpy((char *)ramdisk_addr_r,
427 			       (char *)start, hdr->ramdisk_size);
428 		} else {
429 			blk_start = part->start +
430 				DIV_ROUND_UP(size, dev_desc->blksz);
431 			ret = blk_dread(dev_desc, blk_start,
432 					blk_cnt, (void *)ramdisk_addr_r);
433 			if (ret != blk_cnt) {
434 				printf("%s: read ramdisk failed, ret=%d\n",
435 				      __func__, ret);
436 				return -1;
437 			}
438 			blk_read += ret;
439 		}
440 	}
441 
442 	/*
443 	 * Load dtb file by rockchip_read_dtb_file() which support pack
444 	 * dtb in second position or resource file.
445 	 */
446 #ifdef CONFIG_RKIMG_BOOTLOADER
447 	ulong fdt_addr_r = env_get_ulong("fdt_addr_r", 16, 0);
448 
449 	if (hdr->second_size && (gd->fdt_blob != (void *)fdt_addr_r)) {
450 		ulong fdt_size;
451 
452 		fdt_size = rockchip_read_dtb_file((void *)fdt_addr_r);
453 		if (fdt_size < 0) {
454 			printf("%s: read fdt failed\n", __func__);
455 			return ret;
456 		}
457 
458 		blk_read += DIV_ROUND_UP(fdt_size, dev_desc->blksz);
459 	}
460 #endif
461 
462 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
463 	if (hdr->second_size) {
464 		ulong blk_start, blk_cnt;
465 
466 		/* Just for image data hash calculation */
467 		second_addr_r = (ulong)malloc(hdr->second_size);
468 		if (!second_addr_r)
469 			return -ENOMEM;
470 
471 		size = hdr->page_size +
472 		       ALIGN(hdr->kernel_size, hdr->page_size) +
473 		       ALIGN(hdr->ramdisk_size, hdr->page_size);
474 		blk_cnt = DIV_ROUND_UP(hdr->second_size, dev_desc->blksz);
475 
476 		if (ram_src) {
477 			start = (unsigned long)ram_src;
478 			start += hdr->page_size;
479 			start += ALIGN(hdr->kernel_size, hdr->page_size);
480 			start += ALIGN(hdr->ramdisk_size, hdr->page_size);
481 			memcpy((char *)second_addr_r,
482 			       (char *)start, hdr->second_size);
483 		} else {
484 			blk_start = part->start +
485 					DIV_ROUND_UP(size, dev_desc->blksz);
486 			ret = blk_dread(dev_desc, blk_start, blk_cnt,
487 					(void *)second_addr_r);
488 			if (ret != blk_cnt) {
489 				printf("%s: read second pos failed, ret=%d\n",
490 				       __func__, ret);
491 				return -1;
492 			}
493 
494 			blk_read += blk_cnt;
495 		}
496 	}
497 #endif
498 
499 	/* Update hdr with real image address */
500 	hdr->kernel_addr = kernel_addr_r;
501 	hdr->second_addr = second_addr_r;
502 	hdr->ramdisk_addr = ramdisk_addr_r;
503 
504 	/*
505 	 * Since images are loaded separate, fdt/ramdisk relocation
506 	 * can be disabled, it saves boot time.
507 	 */
508 	if (blk_read > 0 || ram_src) {
509 		if (!fdt_high) {
510 			env_set_hex("fdt_high", -1UL);
511 			printf("Fdt ");
512 		}
513 		if (!ramdisk_high) {
514 			env_set_hex("initrd_high", -1UL);
515 			printf("Ramdisk ");
516 		}
517 		if (!fdt_high || !ramdisk_high)
518 			printf("skip relocation\n");
519 	}
520 
521 	return blk_read;
522 }
523 
524 int android_image_memcpy_separate(struct andr_img_hdr *hdr, void *load_address)
525 {
526 	return android_image_load_separate(hdr, NULL, load_address, hdr);
527 }
528 #endif /* CONFIG_ANDROID_BOOT_IMAGE_SEPARATE */
529 
530 long android_image_load(struct blk_desc *dev_desc,
531 			const disk_partition_t *part_info,
532 			unsigned long load_address,
533 			unsigned long max_size) {
534 	void *buf;
535 	long blk_cnt = 0;
536 	long blk_read = 0;
537 	u32 comp;
538 	u32 kload_addr;
539 	u32 blkcnt;
540 	struct andr_img_hdr *hdr;
541 
542 	if (max_size < part_info->blksz)
543 		return -1;
544 
545 	/*
546 	 * Read the Android boot.img header and a few parts of
547 	 * the head of kernel image(2 blocks maybe enough).
548 	 */
549 	blkcnt = DIV_ROUND_UP(sizeof(*hdr), 512) + 2;
550 	hdr = memalign(ARCH_DMA_MINALIGN, blkcnt * 512);
551 	if (!hdr) {
552 		printf("%s: no memory\n", __func__);
553 		return -1;
554 	}
555 
556 	if (blk_dread(dev_desc, part_info->start, blkcnt, hdr) != blkcnt)
557 		blk_read = -1;
558 
559 	if (!blk_read && android_image_check_header(hdr) != 0) {
560 		printf("** Invalid Android Image header **\n");
561 		blk_read = -1;
562 	}
563 
564 	/* page_size for image header */
565 	load_address -= hdr->page_size;
566 
567 	/* We don't know the size of the Android image before reading the header
568 	 * so we don't limit the size of the mapped memory.
569 	 */
570 	buf = map_sysmem(load_address, 0 /* size */);
571 	if (!blk_read) {
572 		blk_cnt = (android_image_get_end(hdr) - (ulong)hdr +
573 			   part_info->blksz - 1) / part_info->blksz;
574 		comp = android_image_parse_kernel_comp(hdr);
575 		/*
576 		 * We should load compressed kernel Image to high memory at
577 		 * address "kernel_addr_c".
578 		 */
579 		if (comp != IH_COMP_NONE) {
580 			ulong kernel_addr_c;
581 
582 			env_set_ulong("os_comp", comp);
583 			kernel_addr_c = env_get_ulong("kernel_addr_c", 16, 0);
584 			if (kernel_addr_c) {
585 				load_address = kernel_addr_c - hdr->page_size;
586 				unmap_sysmem(buf);
587 				buf = map_sysmem(load_address, 0 /* size */);
588 			}
589 #ifdef CONFIG_ARM64
590 			else {
591 				printf("Warn: \"kernel_addr_c\" is not defined "
592 				       "for compressed kernel Image!\n");
593 				load_address += android_image_get_ksize(hdr) * 3;
594 				load_address = ALIGN(load_address, ARCH_DMA_MINALIGN);
595 				env_set_ulong("kernel_addr_c", load_address);
596 
597 				load_address -= hdr->page_size;
598 				unmap_sysmem(buf);
599 				buf = map_sysmem(load_address, 0 /* size */);
600 			}
601 #endif
602 		}
603 
604 		if (blk_cnt * part_info->blksz > max_size) {
605 			debug("Android Image too big (%lu bytes, max %lu)\n",
606 			      android_image_get_end(hdr) - (ulong)hdr,
607 			      max_size);
608 			blk_read = -1;
609 		} else {
610 			debug("Loading Android Image (%lu blocks) to 0x%lx... ",
611 			      blk_cnt, load_address);
612 
613 #ifdef CONFIG_ANDROID_BOOT_IMAGE_SEPARATE
614 			blk_read =
615 			android_image_load_separate(hdr, part_info, buf, NULL);
616 #else
617 			if (!sysmem_alloc_base(MEMBLK_ID_ANDROID,
618 					       (phys_addr_t)buf,
619 						blk_cnt * part_info->blksz))
620 				return -ENXIO;
621 
622 			blk_read = blk_dread(dev_desc, part_info->start,
623 					     blk_cnt, buf);
624 #endif
625 		}
626 
627 		/* Verify image hash */
628 #ifdef CONFIG_ANDROID_BOOT_IMAGE_HASH
629 		if (android_image_hash_verify(hdr)) {
630 			printf("Image hash miss match!\n");
631 			return -EBADFD;
632 		}
633 
634 		printf("Image hash verify ok\n");
635 #endif
636 		/*
637 		 * zImage is not need to decompress
638 		 * kernel will handle decompress itself
639 		 */
640 		if (comp != IH_COMP_NONE && comp != IH_COMP_ZIMAGE) {
641 			kload_addr = env_get_ulong("kernel_addr_r", 16, 0x02080000);
642 			android_image_set_kload(buf, kload_addr);
643 			android_image_set_comp(buf, comp);
644 		} else {
645 			android_image_set_comp(buf, IH_COMP_NONE);
646 		}
647 
648 	}
649 
650 	free(hdr);
651 	unmap_sysmem(buf);
652 
653 #ifndef CONFIG_ANDROID_BOOT_IMAGE_SEPARATE
654 	debug("%lu blocks read: %s\n",
655 	      blk_read, (blk_read == blk_cnt) ? "OK" : "ERROR");
656 	if (blk_read != blk_cnt)
657 		return -1;
658 #else
659 	debug("%lu blocks read\n", blk_read);
660 	if (blk_read < 0)
661 		return blk_read;
662 #endif
663 
664 	return load_address;
665 }
666 
667 #if !defined(CONFIG_SPL_BUILD)
668 /**
669  * android_print_contents - prints out the contents of the Android format image
670  * @hdr: pointer to the Android format image header
671  *
672  * android_print_contents() formats a multi line Android image contents
673  * description.
674  * The routine prints out Android image properties
675  *
676  * returns:
677  *     no returned results
678  */
679 void android_print_contents(const struct andr_img_hdr *hdr)
680 {
681 	const char * const p = IMAGE_INDENT_STRING;
682 	/* os_version = ver << 11 | lvl */
683 	u32 os_ver = hdr->os_version >> 11;
684 	u32 os_lvl = hdr->os_version & ((1U << 11) - 1);
685 	u32 header_version = hdr->header_version;
686 
687 	printf("%skernel size:      %x\n", p, hdr->kernel_size);
688 	printf("%skernel address:   %x\n", p, hdr->kernel_addr);
689 	printf("%sramdisk size:     %x\n", p, hdr->ramdisk_size);
690 	printf("%sramdisk addrress: %x\n", p, hdr->ramdisk_addr);
691 	printf("%ssecond size:      %x\n", p, hdr->second_size);
692 	printf("%ssecond address:   %x\n", p, hdr->second_addr);
693 	printf("%stags address:     %x\n", p, hdr->tags_addr);
694 	printf("%spage size:        %x\n", p, hdr->page_size);
695 	printf("%sheader_version:   %x\n", p, header_version);
696 	/* ver = A << 14 | B << 7 | C         (7 bits for each of A, B, C)
697 	 * lvl = ((Y - 2000) & 127) << 4 | M  (7 bits for Y, 4 bits for M) */
698 	printf("%sos_version:       %x (ver: %u.%u.%u, level: %u.%u)\n",
699 	       p, hdr->os_version,
700 	       (os_ver >> 7) & 0x7F, (os_ver >> 14) & 0x7F, os_ver & 0x7F,
701 	       (os_lvl >> 4) + 2000, os_lvl & 0x0F);
702 	printf("%sname:             %s\n", p, hdr->name);
703 	printf("%scmdline:          %s\n", p, hdr->cmdline);
704 
705 	if (header_version >= 1) {
706 		printf("%srecovery dtbo size:    %x\n", p, hdr->recovery_dtbo_size);
707 		printf("%srecovery dtbo offset:  %llx\n", p, hdr->recovery_dtbo_offset);
708 		printf("%sheader size:           %x\n", p, hdr->header_size);
709 	}
710 
711 	if (header_version >= 2) {
712 		printf("%sdtb size:              %x\n", p, hdr->dtb_size);
713 		printf("%sdtb addr:              %llx\n", p, hdr->dtb_addr);
714 	}
715 }
716 #endif
717