u-boot.git/boot/image-android.c, branch v2026.01

android: boot: fix wrong end of header in v3/v4 parsing

2025-09-24T17:03:16+00:00

The android boot header is page aligned but the current code made the
assumption that the header was always smaller than the current header
format.

When the page_size is defined as 2048, as this is the case with the
cuttlefish target, the current code sets the end of the header in the
middle of it as the v3 and v4 headers are respectively 2112 and 2128
bytes long.

Fix that by aligning to page_size

Fixes: 1115027d2f75 ("android: boot: update android_image_get_data to support v3, v4")
Signed-off-by: Guillaume Ranquet

boot: android: Prevent use of unintialised variable

2025-07-02T10:10:25+00:00

Initialise vhdr to prevent its use when uninitialised.

This issue was found with Smatch.

Fixes: e058176be32b (android: boot: add vendor boot image to prepare for v3, v4 support)
Signed-off-by: Andrew Goodbody 
Reviewed-by: Mattijs Korpershoek 
Link: https://lore.kernel.org/r/20250625-abootimg_fix-v4-2-df7af00e87b0@linaro.org
Signed-off-by: Mattijs Korpershoek

boot/image-android: Workaround kernel/ramdisk invalid addr

2025-06-24T13:54:51+00:00

Some androidboot image have invalid kernel/ramdisk load addr,
force to ignore those value and use loadaddr instead.

There is a concern on exposing the whole memory to image loading is
dangerous. Also, since it's not always possible to change the load
addr by repacking the boot.img (mainly due to AVB signature mismatch),
we need a way to use kernel_addr_r and ramdisk_addr_r.

Suggested-by: Casey Connolly 
Reviewed-by: Neil Armstrong 
Tested-by: Mattijs Korpershoek 
Signed-off-by: George Chan 
Link: https://lore.kernel.org/r/20250518-android-boot-v3-1-02c8768e131f@gmail.com
Signed-off-by: Casey Connolly

image: android: fix ramdisk default address

2025-05-30T19:44:05+00:00

Commit 21e7fa0e3ac5 ("image: android: handle ramdisk default address")
changed the default behavior for header versions less than or equal to 2.

The ramdisk address (img_data.ramdisk_ptr) is only assigned to *rd_data
if the physical load address (img_data.ramdisk_addr) is equal to 0 or
the Android default ramdisk address.

    /* Ramdisk can be used in-place, use current ptr */
    if (img_data.ramdisk_addr == 0 ||
            img_data.ramdisk_addr == ANDROID_IMAGE_DEFAULT_RAMDISK_ADDR) {
        *rd_data = img_data.ramdisk_ptr;
    } else {
        ramdisk_ptr = img_data.ramdisk_addr;
        *rd_data = ramdisk_ptr;
        memcpy((void *)(ramdisk_ptr), (void *)img_data.ramdisk_ptr,
                img_data.ramdisk_size);
    }

When the img_data.ramdisk_addr and the img_data.kernel_addr are the same
*rd_data needs to be assigned to the ramdisk address (ramdisk_ptr), not
the physical address (ramdisk_addr).

As a result of the current behavior, we can no longer boot a kernel on
the Renesas R-Car S4 board.

Add an additional check to the if clause so that the ramdisk address is
assigned when the kernel address and the ramdisk address are the same,
restoring the previous default behavior.

Fixes: 21e7fa0e3ac5 ("image: android: handle ramdisk default address")
Signed-off-by: Eddie Kovsky 
Reviewed-by: Mattijs Korpershoek 
Tested-by: Mattijs Korpershoek  # khadas vim3

boot: android: handle boot images with missing DTB

2025-02-06T08:09:09+00:00

607b07554e2 removed the check on the return status of the
android_image_get_dtb_img_addr call from android_image_get_dtb_by_index,
which results in null pointer accesses shortly after when trying to
check the header of a nonexistent DTB.

Fixes: 607b07554e2 ("android: boot: move to andr_image_data structure")
Signed-off-by: Sam Day 
Reviewed-by: Mattijs Korpershoek 
Link: https://lore.kernel.org/r/20250123-android-handle-no-dtb-v1-1-1cb7373247da@samcday.com
Signed-off-by: Mattijs Korpershoek

boot: android: Check kcmdline's for NULL in android_image_get_kernel()

2025-01-23T14:19:37+00:00

kcmdline and kcmdline_extra strings can be NULL. In that case, we still
read the content from 0x00000 and pass that to the kernel, which is
completely wrong.

Fix android_image_get_kernel() to check for NULL before checking if
they are empty strings.

Fixes: 53a0ddb6d3be ("boot: android: fix extra command line support")
Signed-off-by: Aaron Kling 
Reviewed-by: Nicolas Belin 
Reviewed-by: Julien Masson 
Tested-by: Sam Day 
Link: https://lore.kernel.org/r/20250113-kcmdline-extra-fix-v1-1-03cc9c039159@baylibre.com
Signed-off-by: Mattijs Korpershoek

Merge tag 'v2025.01-rc5' into next

2024-12-26T04:31:04+00:00

Prepare v2025.01-rc5

boot: android: rework bootargs concatenation

2024-12-18T13:04:23+00:00

Rework the bootargs concatenation allocating more accurately
the length that is needed.
Do not forget an extra byte for the null termination byte as,
in some cases, the allocation was 1 byte short.

Fixes: 86f4695b ("image: Fix Android boot image support")
Signed-off-by: Nicolas Belin 
Reviewed-by: Mattijs Korpershoek 
Link: https://lore.kernel.org/r/20241217-fix-bootargs-concatenation-v2-3-b2fd7cf4e130@baylibre.com
Signed-off-by: Mattijs Korpershoek

boot: android: free newbootargs when done

2024-12-18T13:04:23+00:00

Free newbootargs when the concatenation is done and bootargs env
is set.

Fixes: 86f4695b ("image: Fix Android boot image support")
Reviewed-by: Mattijs Korpershoek 
Signed-off-by: Nicolas Belin 
Link: https://lore.kernel.org/r/20241217-fix-bootargs-concatenation-v2-2-b2fd7cf4e130@baylibre.com
Signed-off-by: Mattijs Korpershoek

boot: android: fix extra command line support

2024-12-18T13:04:23+00:00

Check that the value at the address kcmdline_extra is not 0
instead of checking the address value itself keeping it
consistent with what is done for kcmdline.

Fixes: b36b227b ("android: boot: support extra command line")
Reviewed-by: Mattijs Korpershoek 
Signed-off-by: Nicolas Belin 
Link: https://lore.kernel.org/r/20241217-fix-bootargs-concatenation-v2-1-b2fd7cf4e130@baylibre.com
Signed-off-by: Mattijs Korpershoek