Merge branch 'master' into next

11 files changed, 492 insertions, 144 deletions

diff --git a/boot/Kconfig b/boot/Kconfig
index d95a2a70266..8c27f52ec3e 100644
--- a/boot/Kconfig
+++ b/boot/Kconfig
@@ -231,7 +231,7 @@ config SPL_LOAD_FIT_APPLY_OVERLAY
 	depends on SPL_LOAD_FIT
 	select OF_LIBFDT_OVERLAY
 	help
-	  The device tree is loaded from the FIT image. Allow the SPL is to
+	  The device tree is loaded from the FIT image. Allow the SPL to
 	  also load device-tree overlays from the FIT image an apply them
 	  over the device tree.
 
diff --git a/boot/bootdev-uclass.c b/boot/bootdev-uclass.c
index d34b7e37cf7..57d29446476 100644
--- a/boot/bootdev-uclass.c
+++ b/boot/bootdev-uclass.c
@@ -174,6 +174,8 @@ int bootdev_find_in_blk(struct udevice *dev, struct udevice *blk,
 	} else {
 		ret = fs_set_blk_dev_with_part(desc, bflow->part);
 		bflow->state = BOOTFLOWST_PART;
+		if (ret)
+			return log_msg_ret("fs", ret);
 
 		/* Use an #ifdef due to info.sys_ind */
 #ifdef CONFIG_DOS_PARTITION
@@ -181,8 +183,7 @@ int bootdev_find_in_blk(struct udevice *dev, struct udevice *blk,
 			  blk->name, bflow->part, info.sys_ind,
 			  ret ? -1 : fs_get_type());
 #endif
-		if (ret)
-			return log_msg_ret("fs", ret);
+		bflow->blk = blk;
 		bflow->state = BOOTFLOWST_FS;
 	}
 
@@ -364,7 +365,8 @@ int bootdev_unbind_dev(struct udevice *parent)
  * @seqp: Returns the sequence number, or -1 if none
  * @method_flagsp: If non-NULL, returns any flags implied by the label
  * (enum bootflow_meth_flags_t), 0 if none
- * Returns: sequence number on success, else -ve error code
+ * Returns: sequence number on success, -EPFNOSUPPORT is the uclass is not
+ * known, other -ve error code on other error
  */
 static int label_to_uclass(const char *label, int *seqp, int *method_flagsp)
 {
@@ -394,8 +396,7 @@ static int label_to_uclass(const char *label, int *seqp, int *method_flagsp)
 			id = UCLASS_ETH;
 			method_flags |= BOOTFLOW_METHF_DHCP_ONLY;
 		} else {
-			log_warning("Unknown uclass '%s' in label\n", label);
-			return -EINVAL;
+			return -EPFNOSUPPORT;
 		}
 	}
 	if (id == UCLASS_USB)
@@ -458,7 +459,6 @@ int bootdev_find_by_label(const char *label, struct udevice **devp,
 		}
 		log_debug("- no device in %s\n", media->name);
 	}
-	log_warning("Unknown seq %d for label '%s'\n", seq, label);
 
 	return -ENOENT;
 }
@@ -577,9 +577,28 @@ int bootdev_next_label(struct bootflow_iter *iter, struct udevice **devp,
 
 	log_debug("next\n");
 	for (dev = NULL; !dev && iter->labels[++iter->cur_label];) {
-		log_debug("Scanning: %s\n", iter->labels[iter->cur_label]);
-		bootdev_hunt_and_find_by_label(iter->labels[iter->cur_label],
-					       &dev, method_flagsp);
+		const char *label = iter->labels[iter->cur_label];
+		int ret;
+
+		log_debug("Scanning: %s\n", label);
+		ret = bootdev_hunt_and_find_by_label(label, &dev,
+						     method_flagsp);
+		if (iter->flags & BOOTFLOWIF_SHOW) {
+			if (ret == -EPFNOSUPPORT) {
+				log_warning("Unknown uclass '%s' in label\n",
+					    label);
+			} else if (ret == -ENOENT) {
+				/*
+				 * looking for, e.g. 'scsi0' should find
+				 * something if SCSI is present
+				 */
+				if (!trailing_strtol(label)) {
+					log_warning("No bootdevs for '%s'\n",
+						    label);
+				}
+			}
+		}
+
 	}
 
 	if (!dev)
diff --git a/boot/bootm.c b/boot/bootm.c
index 2eec60ec7b5..4144ff3b031 100644
--- a/boot/bootm.c
+++ b/boot/bootm.c
@@ -113,6 +113,10 @@ static int bootm_find_os(struct cmd_tbl *cmdtp, int flag, int argc,
 			 char *const argv[])
 {
 	const void *os_hdr;
+#ifdef CONFIG_ANDROID_BOOT_IMAGE
+	const void *vendor_boot_img;
+	const void *boot_img;
+#endif
 	bool ep_found = false;
 	int ret;
 
@@ -181,14 +185,23 @@ static int bootm_find_os(struct cmd_tbl *cmdtp, int flag, int argc,
 #endif
 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 	case IMAGE_FORMAT_ANDROID:
+		boot_img = os_hdr;
+		vendor_boot_img = NULL;
+		if (IS_ENABLED(CONFIG_CMD_ABOOTIMG)) {
+			boot_img = map_sysmem(get_abootimg_addr(), 0);
+			vendor_boot_img = map_sysmem(get_avendor_bootimg_addr(), 0);
+		}
 		images.os.type = IH_TYPE_KERNEL;
-		images.os.comp = android_image_get_kcomp(os_hdr);
+		images.os.comp = android_image_get_kcomp(boot_img, vendor_boot_img);
 		images.os.os = IH_OS_LINUX;
-
-		images.os.end = android_image_get_end(os_hdr);
-		images.os.load = android_image_get_kload(os_hdr);
+		images.os.end = android_image_get_end(boot_img, vendor_boot_img);
+		images.os.load = android_image_get_kload(boot_img, vendor_boot_img);
 		images.ep = images.os.load;
 		ep_found = true;
+		if (IS_ENABLED(CONFIG_CMD_ABOOTIMG)) {
+			unmap_sysmem(vendor_boot_img);
+			unmap_sysmem(boot_img);
+		}
 		break;
 #endif
 	default:
@@ -889,6 +902,10 @@ static const void *boot_get_kernel(struct cmd_tbl *cmdtp, int flag, int argc,
 	int		os_noffset;
 #endif
 
+#ifdef CONFIG_ANDROID_BOOT_IMAGE
+	const void *boot_img;
+	const void *vendor_boot_img;
+#endif
 	img_addr = genimg_get_kernel_addr_fit(argc < 1 ? NULL : argv[0],
 					      &fit_uname_config,
 					      &fit_uname_kernel);
@@ -964,10 +981,20 @@ static const void *boot_get_kernel(struct cmd_tbl *cmdtp, int flag, int argc,
 #endif
 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 	case IMAGE_FORMAT_ANDROID:
+		boot_img = buf;
+		vendor_boot_img = NULL;
+		if (IS_ENABLED(CONFIG_CMD_ABOOTIMG)) {
+			boot_img = map_sysmem(get_abootimg_addr(), 0);
+			vendor_boot_img = map_sysmem(get_avendor_bootimg_addr(), 0);
+		}
 		printf("## Booting Android Image at 0x%08lx ...\n", img_addr);
-		if (android_image_get_kernel(buf, images->verify,
+		if (android_image_get_kernel(boot_img, vendor_boot_img, images->verify,
 					     os_data, os_len))
 			return NULL;
+		if (IS_ENABLED(CONFIG_CMD_ABOOTIMG)) {
+			unmap_sysmem(vendor_boot_img);
+			unmap_sysmem(boot_img);
+		}
 		break;
 #endif
 	default:
diff --git a/boot/bootmeth_distro.c b/boot/bootmeth_distro.c
index 356929828b9..b4b73ecbf58 100644
--- a/boot/bootmeth_distro.c
+++ b/boot/bootmeth_distro.c
@@ -150,7 +150,7 @@ static int distro_boot(struct udevice *dev, struct bootflow *bflow)
 	info.dev = dev;
 	info.bflow = bflow;
 	ret = pxe_setup_ctx(&ctx, &cmdtp, distro_getfile, &info, true,
-			    bflow->subdir);
+			    bflow->subdir, false);
 	if (ret)
 		return log_msg_ret("ctx", -EINVAL);
 
diff --git a/boot/bootmeth_efi.c b/boot/bootmeth_efi.c
index 6a97ac02ff5..6f70f2229b9 100644
--- a/boot/bootmeth_efi.c
+++ b/boot/bootmeth_efi.c
@@ -94,7 +94,7 @@ static int get_efi_pxe_vci(char *str, int max_len)
 	return 0;
 }
 
-static int efiload_read_file(struct blk_desc *desc, struct bootflow *bflow)
+static void set_efi_bootdev(struct blk_desc *desc, struct bootflow *bflow)
 {
 	const struct udevice *media_dev;
 	int size = bflow->size;
@@ -102,11 +102,6 @@ static int efiload_read_file(struct blk_desc *desc, struct bootflow *bflow)
 	char devnum_str[9];
 	char dirname[200];
 	char *last_slash;
-	int ret;
-
-	ret = bootmeth_alloc_file(bflow, 0x2000000, 0x10000);
-	if (ret)
-		return log_msg_ret("read", ret);
 
 	/*
 	 * This is a horrible hack to tell EFI about this boot device. Once we
@@ -117,7 +112,9 @@ static int efiload_read_file(struct blk_desc *desc, struct bootflow *bflow)
 	 * this can go away.
 	 */
 	media_dev = dev_get_parent(bflow->dev);
-	snprintf(devnum_str, sizeof(devnum_str), "%x", dev_seq(media_dev));
+	snprintf(devnum_str, sizeof(devnum_str), "%x:%x",
+		 desc ? desc->devnum : dev_seq(media_dev),
+		 bflow->part);
 
 	strlcpy(dirname, bflow->fname, sizeof(dirname));
 	last_slash = strrchr(dirname, '/');
@@ -130,6 +127,15 @@ static int efiload_read_file(struct blk_desc *desc, struct bootflow *bflow)
 	dev_name = device_get_uclass_id(media_dev) == UCLASS_MASS_STORAGE ?
 		 "usb" : dev_get_uclass_name(media_dev);
 	efi_set_bootdev(dev_name, devnum_str, bflow->fname, bflow->buf, size);
+}
+
+static int efiload_read_file(struct blk_desc *desc, struct bootflow *bflow)
+{
+	int ret;
+
+	ret = bootmeth_alloc_file(bflow, 0x2000000, 0x10000);
+	if (ret)
+		return log_msg_ret("read", ret);
 
 	return 0;
 }
@@ -235,21 +241,21 @@ static int distro_efi_read_bootflow_file(struct udevice *dev,
 
 	/* try the various available names */
 	ret = -ENOENT;
-	for (seq = 0; ret; seq++) {
+	*fname = '\0';
+	for (seq = 0; ret == -ENOENT; seq++) {
 		ret = distro_efi_get_fdt_name(fname, sizeof(fname), seq);
-		if (ret == -EALREADY) {
+		if (ret == -EALREADY)
 			bflow->flags = BOOTFLOWF_USE_PRIOR_FDT;
-			break;
-		}
-		if (ret)
-			return log_msg_ret("nam", ret);
-		ret = bootmeth_common_read_file(dev, bflow, fname, fdt_addr,
-						&size);
+		if (!ret)
+			ret = bootmeth_common_read_file(dev, bflow, fname,
+							fdt_addr, &size);
 	}
 
-	bflow->fdt_fname = strdup(fname);
-	if (!bflow->fdt_fname)
-		return log_msg_ret("fil", -ENOMEM);
+	if (*fname) {
+		bflow->fdt_fname = strdup(fname);
+		if (!bflow->fdt_fname)
+			return log_msg_ret("fil", -ENOMEM);
+	}
 
 	if (!ret) {
 		bflow->fdt_size = size;
@@ -373,6 +379,13 @@ int distro_efi_boot(struct udevice *dev, struct bootflow *bflow)
 
 	/* A non-zero buffer indicates the kernel is there */
 	if (bflow->buf) {
+		/* Set the EFI bootdev again, since reading an FDT loses it! */
+		if (bflow->blk) {
+			struct blk_desc *desc = dev_get_uclass_plat(bflow->blk);
+
+			set_efi_bootdev(desc, bflow);
+		}
+
 		kernel = (ulong)map_to_sysmem(bflow->buf);
 
 		/*
diff --git a/boot/bootmeth_pxe.c b/boot/bootmeth_pxe.c
index ecf8557af83..5a8af2bbd0b 100644
--- a/boot/bootmeth_pxe.c
+++ b/boot/bootmeth_pxe.c
@@ -70,7 +70,7 @@ static int distro_pxe_read_bootflow(struct udevice *dev, struct bootflow *bflow)
 	addr = simple_strtoul(addr_str, NULL, 16);
 
 	log_debug("calling pxe_get()\n");
-	ret = pxe_get(addr, &bootdir, &size);
+	ret = pxe_get(addr, &bootdir, &size, false);
 	log_debug("pxe_get() returned %d\n", ret);
 	if (ret)
 		return log_msg_ret("pxeb", ret);
@@ -146,7 +146,7 @@ static int distro_pxe_boot(struct udevice *dev, struct bootflow *bflow)
 	info.bflow = bflow;
 	info.cmdtp = &cmdtp;
 	ret = pxe_setup_ctx(ctx, &cmdtp, distro_pxe_getfile, &info, false,
-			    bflow->subdir);
+			    bflow->subdir, false);
 	if (ret)
 		return log_msg_ret("ctx", -EINVAL);
 
diff --git a/boot/image-android.c b/boot/image-android.c
index 2628db37412..88e40bc7ec6 100644
--- a/boot/image-android.c
+++ b/boot/image-android.c
@@ -18,7 +18,193 @@
 
 static char andr_tmp_str[ANDR_BOOT_ARGS_SIZE + 1];
 
-static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr)
+static ulong checksum(const unsigned char *buffer, ulong size)
+{
+	ulong sum = 0;
+
+	for (ulong i = 0; i < size; i++)
+		sum += buffer[i];
+	return sum;
+}
+
+static bool is_trailer_present(ulong bootconfig_end_addr)
+{
+	return !strncmp((char *)(bootconfig_end_addr - BOOTCONFIG_MAGIC_SIZE),
+			BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_SIZE);
+}
+
+static ulong add_trailer(ulong bootconfig_start_addr, ulong bootconfig_size)
+{
+	ulong end;
+	ulong sum;
+
+	if (!bootconfig_start_addr)
+		return -1;
+	if (!bootconfig_size)
+		return 0;
+
+	end = bootconfig_start_addr + bootconfig_size;
+	if (is_trailer_present(end))
+		return 0;
+
+	memcpy((void *)(end), &bootconfig_size, BOOTCONFIG_SIZE_SIZE);
+	sum = checksum((unsigned char *)bootconfig_start_addr, bootconfig_size);
+	memcpy((void *)(end + BOOTCONFIG_SIZE_SIZE), &sum,
+	       BOOTCONFIG_CHECKSUM_SIZE);
+	memcpy((void *)(end + BOOTCONFIG_SIZE_SIZE + BOOTCONFIG_CHECKSUM_SIZE),
+	       BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_SIZE);
+
+	return BOOTCONFIG_TRAILER_SIZE;
+}
+
+static void android_boot_image_v3_v4_parse_hdr(const struct andr_boot_img_hdr_v3 *hdr,
+					       struct andr_image_data *data)
+{
+	ulong end;
+
+	data->kcmdline = hdr->cmdline;
+	data->header_version = hdr->header_version;
+	data->ramdisk_ptr = env_get_ulong("ramdisk_addr_r", 16, 0);
+
+	/*
+	 * The header takes a full page, the remaining components are aligned
+	 * on page boundary.
+	 */
+	end = (ulong)hdr;
+	end += ANDR_GKI_PAGE_SIZE;
+	data->kernel_ptr = end;
+	data->kernel_size = hdr->kernel_size;
+	end += ALIGN(hdr->kernel_size, ANDR_GKI_PAGE_SIZE);
+	data->ramdisk_size = hdr->ramdisk_size;
+	data->boot_ramdisk_size = hdr->ramdisk_size;
+	end += ALIGN(hdr->ramdisk_size, ANDR_GKI_PAGE_SIZE);
+
+	if (hdr->header_version > 3)
+		end += ALIGN(hdr->signature_size, ANDR_GKI_PAGE_SIZE);
+
+	data->boot_img_total_size = end - (ulong)hdr;
+}
+
+static void android_vendor_boot_image_v3_v4_parse_hdr(const struct andr_vnd_boot_img_hdr
+						      *hdr, struct andr_image_data *data)
+{
+	ulong end;
+
+	/*
+	 * The header takes a full page, the remaining components are aligned
+	 * on page boundary.
+	 */
+	data->kcmdline_extra = hdr->cmdline;
+	data->tags_addr = hdr->tags_addr;
+	data->image_name = hdr->name;
+	data->kernel_addr = hdr->kernel_addr;
+	data->ramdisk_addr = hdr->ramdisk_addr;
+	data->dtb_load_addr = hdr->dtb_addr;
+	data->bootconfig_size = hdr->bootconfig_size;
+	end = (ulong)hdr;
+	end += hdr->page_size;
+	if (hdr->vendor_ramdisk_size) {
+		data->vendor_ramdisk_ptr = end;
+		data->vendor_ramdisk_size = hdr->vendor_ramdisk_size;
+		data->ramdisk_size += hdr->vendor_ramdisk_size;
+		end += ALIGN(hdr->vendor_ramdisk_size, hdr->page_size);
+	}
+
+	data->dtb_ptr = end;
+	data->dtb_size = hdr->dtb_size;
+
+	end += ALIGN(hdr->dtb_size, hdr->page_size);
+	end += ALIGN(hdr->vendor_ramdisk_table_size, hdr->page_size);
+	data->bootconfig_addr = end;
+	if (hdr->bootconfig_size) {
+		data->bootconfig_size += add_trailer(data->bootconfig_addr,
+						     data->bootconfig_size);
+		data->ramdisk_size += data->bootconfig_size;
+	}
+	end += ALIGN(data->bootconfig_size, hdr->page_size);
+	data->vendor_boot_img_total_size = end - (ulong)hdr;
+}
+
+static void android_boot_image_v0_v1_v2_parse_hdr(const struct andr_boot_img_hdr_v0 *hdr,
+						  struct andr_image_data *data)
+{
+	ulong end;
+
+	data->image_name = hdr->name;
+	data->kcmdline = hdr->cmdline;
+	data->kernel_addr = hdr->kernel_addr;
+	data->ramdisk_addr = hdr->ramdisk_addr;
+	data->header_version = hdr->header_version;
+	data->dtb_load_addr = hdr->dtb_addr;
+
+	end = (ulong)hdr;
+
+	/*
+	 * The header takes a full page, the remaining components are aligned
+	 * on page boundary
+	 */
+
+	end += hdr->page_size;
+
+	data->kernel_ptr = end;
+	data->kernel_size = hdr->kernel_size;
+	end += ALIGN(hdr->kernel_size, hdr->page_size);
+
+	data->ramdisk_ptr = end;
+	data->ramdisk_size = hdr->ramdisk_size;
+	end += ALIGN(hdr->ramdisk_size, hdr->page_size);
+
+	data->second_ptr = end;
+	data->second_size = hdr->second_size;
+	end += ALIGN(hdr->second_size, hdr->page_size);
+
+	if (hdr->header_version >= 1) {
+		data->recovery_dtbo_ptr = end;
+		data->recovery_dtbo_size = hdr->recovery_dtbo_size;
+		end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
+	}
+
+	if (hdr->header_version >= 2) {
+		data->dtb_ptr = end;
+		data->dtb_size = hdr->dtb_size;
+		end += ALIGN(hdr->dtb_size, hdr->page_size);
+	}
+
+	data->boot_img_total_size = end - (ulong)hdr;
+}
+
+bool android_image_get_data(const void *boot_hdr, const void *vendor_boot_hdr,
+			    struct andr_image_data *data)
+{
+	if (!boot_hdr || !data) {
+		printf("boot_hdr or data params can't be NULL\n");
+		return false;
+	}
+
+	if (!is_android_boot_image_header(boot_hdr)) {
+		printf("Incorrect boot image header\n");
+		return false;
+	}
+
+	if (((struct andr_boot_img_hdr_v0 *)boot_hdr)->header_version > 2) {
+		if (!vendor_boot_hdr) {
+			printf("For boot header v3+ vendor boot image has to be provided\n");
+			return false;
+		}
+		if (!is_android_vendor_boot_image_header(vendor_boot_hdr)) {
+			printf("Incorrect vendor boot image header\n");
+			return false;
+		}
+		android_boot_image_v3_v4_parse_hdr(boot_hdr, data);
+		android_vendor_boot_image_v3_v4_parse_hdr(vendor_boot_hdr, data);
+	} else {
+		android_boot_image_v0_v1_v2_parse_hdr(boot_hdr, data);
+	}
+
+	return true;
+}
+
+static ulong android_image_get_kernel_addr(struct andr_image_data *img_data)
 {
 	/*
 	 * All the Android tools that generate a boot.img use this
@@ -31,23 +217,25 @@ static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr)
 	 *
 	 * Otherwise, we will return the actual value set by the user.
 	 */
-	if (hdr->kernel_addr == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR)
-		return (ulong)hdr + hdr->page_size;
+	if (img_data->kernel_addr  == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR)
+		return img_data->kernel_ptr;
 
 	/*
 	 * abootimg creates images where all load addresses are 0
 	 * and we need to fix them.
 	 */
-	if (hdr->kernel_addr == 0 && hdr->ramdisk_addr == 0)
+	if (img_data->kernel_addr == 0 && img_data->ramdisk_addr == 0)
 		return env_get_ulong("kernel_addr_r", 16, 0);
 
-	return hdr->kernel_addr;
+	return img_data->kernel_addr;
 }
 
 /**
  * android_image_get_kernel() - processes kernel part of Android boot images
- * @hdr:	Pointer to image header, which is at the start
+ * @hdr:	Pointer to boot image header, which is at the start
  *			of the image.
+ * @vendor_boot_img:	Pointer to vendor boot image header, which is at the
+ *				start of the image.
  * @verify:	Checksum verification flag. Currently unimplemented.
  * @os_data:	Pointer to a ulong variable, will hold os data start
  *			address.
@@ -59,30 +247,42 @@ static ulong android_image_get_kernel_addr(const struct andr_img_hdr *hdr)
  * Return: Zero, os start address and length on success,
  *		otherwise on failure.
  */
-int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify,
+int android_image_get_kernel(const void *hdr,
+			     const void *vendor_boot_img, int verify,
 			     ulong *os_data, ulong *os_len)
 {
-	u32 kernel_addr = android_image_get_kernel_addr(hdr);
-	const struct legacy_img_hdr *ihdr = (const struct legacy_img_hdr *)
-		((uintptr_t)hdr + hdr->page_size);
+	struct andr_image_data img_data = {0};
+	u32 kernel_addr;
+	const struct legacy_img_hdr *ihdr;
+
+	if (!android_image_get_data(hdr, vendor_boot_img, &img_data))
+		return -EINVAL;
+
+	kernel_addr = android_image_get_kernel_addr(&img_data);
+	ihdr = (const struct legacy_img_hdr *)img_data.kernel_ptr;
 
 	/*
 	 * Not all Android tools use the id field for signing the image with
 	 * sha1 (or anything) so we don't check it. It is not obvious that the
 	 * string is null terminated so we take care of this.
 	 */
-	strncpy(andr_tmp_str, hdr->name, ANDR_BOOT_NAME_SIZE);
+	strlcpy(andr_tmp_str, img_data.image_name, ANDR_BOOT_NAME_SIZE);
 	andr_tmp_str[ANDR_BOOT_NAME_SIZE] = '\0';
 	if (strlen(andr_tmp_str))
 		printf("Android's image name: %s\n", andr_tmp_str);
 
 	printf("Kernel load addr 0x%08x size %u KiB\n",
-	       kernel_addr, DIV_ROUND_UP(hdr->kernel_size, 1024));
+	       kernel_addr, DIV_ROUND_UP(img_data.kernel_size, 1024));
 
 	int len = 0;
-	if (*hdr->cmdline) {
-		printf("Kernel command line: %s\n", hdr->cmdline);
-		len += strlen(hdr->cmdline);
+	if (*img_data.kcmdline) {
+		printf("Kernel command line: %s\n", img_data.kcmdline);
+		len += strlen(img_data.kcmdline);
+	}
+
+	if (img_data.kcmdline_extra) {
+		printf("Kernel extra command line: %s\n", img_data.kcmdline_extra);
+		len += strlen(img_data.kcmdline_extra);
 	}
 
 	char *bootargs = env_get("bootargs");
@@ -100,8 +300,14 @@ int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify,
 		strcpy(newbootargs, bootargs);
 		strcat(newbootargs, " ");
 	}
-	if (*hdr->cmdline)
-		strcat(newbootargs, hdr->cmdline);
+
+	if (*img_data.kcmdline)
+		strcat(newbootargs, img_data.kcmdline);
+
+	if (img_data.kcmdline_extra) {
+		strcat(newbootargs, " ");
+		strcat(newbootargs, img_data.kcmdline_extra);
+	}
 
 	env_set("bootargs", newbootargs);
 
@@ -109,56 +315,63 @@ int android_image_get_kernel(const struct andr_img_hdr *hdr, int verify,
 		if (image_get_magic(ihdr) == IH_MAGIC) {
 			*os_data = image_get_data(ihdr);
 		} else {
-			*os_data = (ulong)hdr;
-			*os_data += hdr->page_size;
+			*os_data = img_data.kernel_ptr;
 		}
 	}
 	if (os_len) {
 		if (image_get_magic(ihdr) == IH_MAGIC)
 			*os_len = image_get_data_size(ihdr);
 		else
-			*os_len = hdr->kernel_size;
+			*os_len = img_data.kernel_size;
 	}
 	return 0;
 }
 
-int android_image_check_header(const struct andr_img_hdr *hdr)
+bool is_android_vendor_boot_image_header(const void *vendor_boot_img)
 {
-	return memcmp(ANDR_BOOT_MAGIC, hdr->magic, ANDR_BOOT_MAGIC_SIZE);
+	return !memcmp(VENDOR_BOOT_MAGIC, vendor_boot_img, ANDR_VENDOR_BOOT_MAGIC_SIZE);
 }
 
-ulong android_image_get_end(const struct andr_img_hdr *hdr)
+bool is_android_boot_image_header(const void *hdr)
 {
-	ulong end;
+	return !memcmp(ANDR_BOOT_MAGIC, hdr, ANDR_BOOT_MAGIC_SIZE);
+}
 
-	/*
-	 * The header takes a full page, the remaining components are aligned
-	 * on page boundary
-	 */
-	end = (ulong)hdr;
-	end += hdr->page_size;
-	end += ALIGN(hdr->kernel_size, hdr->page_size);
-	end += ALIGN(hdr->ramdisk_size, hdr->page_size);
-	end += ALIGN(hdr->second_size, hdr->page_size);
+ulong android_image_get_end(const struct andr_boot_img_hdr_v0 *hdr,
+			    const void *vendor_boot_img)
+{
+	struct andr_image_data img_data;
 
-	if (hdr->header_version >= 1)
-		end += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
+	if (!android_image_get_data(hdr, vendor_boot_img, &img_data))
+		return -EINVAL;
 
-	if (hdr->header_version >= 2)
-		end += ALIGN(hdr->dtb_size, hdr->page_size);
+	if (img_data.header_version > 2)
+		return 0;
 
-	return end;
+	return img_data.boot_img_total_size;
 }
 
-ulong android_image_get_kload(const struct andr_img_hdr *hdr)
+ulong android_image_get_kload(const void *hdr,
+			      const void *vendor_boot_img)
 {
-	return android_image_get_kernel_addr(hdr);
+	struct andr_image_data img_data;
+
+	if (!android_image_get_data(hdr, vendor_boot_img, &img_data))
+		return -EINVAL;
+
+	return android_image_get_kernel_addr(&img_data);
 }
 
-ulong android_image_get_kcomp(const struct andr_img_hdr *hdr)
+ulong android_image_get_kcomp(const void *hdr,
+			      const void *vendor_boot_img)
 {
-	const void *p = (void *)((uintptr_t)hdr + hdr->page_size);
+	struct andr_image_data img_data;
+	const void *p;
+
+	if (!android_image_get_data(hdr, vendor_boot_img, &img_data))
+		return -EINVAL;
 
+	p = (const void *)img_data.kernel_ptr;
 	if (image_get_magic((struct legacy_img_hdr *)p) == IH_MAGIC)
 		return image_get_comp((struct legacy_img_hdr *)p);
 	else if (get_unaligned_le32(p) == LZ4F_MAGIC)
@@ -167,41 +380,66 @@ ulong android_image_get_kcomp(const struct andr_img_hdr *hdr)
 		return image_decomp_type(p, sizeof(u32));
 }
 
-int android_image_get_ramdisk(const struct andr_img_hdr *hdr,
+int android_image_get_ramdisk(const void *hdr, const void *vendor_boot_img,
 			      ulong *rd_data, ulong *rd_len)
 {
-	if (!hdr->ramdisk_size) {
+	struct andr_image_data img_data = {0};
+	ulong ramdisk_ptr;
+
+	if (!android_image_get_data(hdr, vendor_boot_img, &img_data))
+		return -EINVAL;
+
+	if (!img_data.ramdisk_size) {
 		*rd_data = *rd_len = 0;
 		return -1;
 	}
+	if (img_data.header_version > 2) {
+		ramdisk_ptr = img_data.ramdisk_ptr;
+		memcpy((void *)(ramdisk_ptr), (void *)img_data.vendor_ramdisk_ptr,
+		       img_data.vendor_ramdisk_size);
+		memcpy((void *)(ramdisk_ptr + img_data.vendor_ramdisk_size),
+		       (void *)img_data.ramdisk_ptr,
+		       img_data.boot_ramdisk_size);
+		if (img_data.bootconfig_size) {
+			memcpy((void *)
+			       (ramdisk_ptr + img_data.vendor_ramdisk_size +
+			       img_data.boot_ramdisk_size),
+			       (void *)img_data.bootconfig_addr,
+			       img_data.bootconfig_size);
+		}
+	}
 
-	printf("RAM disk load addr 0x%08x size %u KiB\n",
-	       hdr->ramdisk_addr, DIV_ROUND_UP(hdr->ramdisk_size, 1024));
+	printf("RAM disk load addr 0x%08lx size %u KiB\n",
+	       img_data.ramdisk_ptr, DIV_ROUND_UP(img_data.ramdisk_size, 1024));
 
-	*rd_data = (unsigned long)hdr;
-	*rd_data += hdr->page_size;
-	*rd_data += ALIGN(hdr->kernel_size, hdr->page_size);
+	*rd_data = img_data.ramdisk_ptr;
 
-	*rd_len = hdr->ramdisk_size;
+	*rd_len = img_data.ramdisk_size;
 	return 0;
 }
 
-int android_image_get_second(const struct andr_img_hdr *hdr,
-			      ulong *second_data, ulong *second_len)
+int android_image_get_second(const void *hdr, ulong *second_data, ulong *second_len)
 {
-	if (!hdr->second_size) {
+	struct andr_image_data img_data;
+
+	if (!android_image_get_data(hdr, NULL, &img_data))
+		return -EINVAL;
+
+	if (img_data.header_version > 2) {
+		printf("Second stage bootloader is only supported for boot image version <= 2\n");
+		return -EOPNOTSUPP;
+	}
+
+	if (!img_data.second_size) {
 		*second_data = *second_len = 0;
 		return -1;
 	}
 
-	*second_data = (unsigned long)hdr;
-	*second_data += hdr->page_size;
-	*second_data += ALIGN(hdr->kernel_size, hdr->page_size);
-	*second_data += ALIGN(hdr->ramdisk_size, hdr->page_size);
+	*second_data = img_data.second_ptr;
 
 	printf("second address is 0x%lx\n",*second_data);
 
-	*second_len = hdr->second_size;
+	*second_len = img_data.second_size;
 	return 0;
 }
 
@@ -226,19 +464,19 @@ int android_image_get_second(const struct andr_img_hdr *hdr,
  */
 bool android_image_get_dtbo(ulong hdr_addr, ulong *addr, u32 *size)
 {
-	const struct andr_img_hdr *hdr;
+	const struct andr_boot_img_hdr_v0 *hdr;
 	ulong dtbo_img_addr;
 	bool ret = true;
 
 	hdr = map_sysmem(hdr_addr, sizeof(*hdr));
-	if (android_image_check_header(hdr)) {
+	if (!is_android_boot_image_header(hdr)) {
 		printf("Error: Boot Image header is incorrect\n");
 		ret = false;
 		goto exit;
 	}
 
-	if (hdr->header_version < 1) {
-		printf("Error: header_version must be >= 1 to get dtbo\n");
+	if (hdr->header_version != 1 && hdr->header_version != 2) {
+		printf("Error: header version must be >= 1 and <= 2 to get dtbo\n");
 		ret = false;
 		goto exit;
 	}
@@ -269,18 +507,20 @@ exit:
 /**
  * android_image_get_dtb_img_addr() - Get the address of DTB area in boot image.
  * @hdr_addr: Boot image header address
+ * @vhdr_addr: Vendor Boot image header address
  * @addr: Will contain the address of DTB area in boot image
  *
  * Return: true on success or false on fail.
  */
-static bool android_image_get_dtb_img_addr(ulong hdr_addr, ulong *addr)
+static bool android_image_get_dtb_img_addr(ulong hdr_addr, ulong vhdr_addr, ulong *addr)
 {
-	const struct andr_img_hdr *hdr;
+	const struct andr_boot_img_hdr_v0 *hdr;
+	const struct andr_vnd_boot_img_hdr *v_hdr;
 	ulong dtb_img_addr;
 	bool ret = true;
 
 	hdr = map_sysmem(hdr_addr, sizeof(*hdr));
-	if (android_image_check_header(hdr)) {
+	if (!is_android_boot_image_header(hdr)) {
 		printf("Error: Boot Image header is incorrect\n");
 		ret = false;
 		goto exit;
@@ -292,22 +532,40 @@ static bool android_image_get_dtb_img_addr(ulong hdr_addr, ulong *addr)
 		goto exit;
 	}
 
-	if (hdr->dtb_size == 0) {
-		printf("Error: dtb_size is 0\n");
-		ret = false;
-		goto exit;
+	if (hdr->header_version == 2) {
+		if (!hdr->dtb_size) {
+			printf("Error: dtb_size is 0\n");
+			ret = false;
+			goto exit;
+		}
+		/* Calculate the address of DTB area in boot image */
+		dtb_img_addr = hdr_addr;
+		dtb_img_addr += hdr->page_size;
+		dtb_img_addr += ALIGN(hdr->kernel_size, hdr->page_size);
+		dtb_img_addr += ALIGN(hdr->ramdisk_size, hdr->page_size);
+		dtb_img_addr += ALIGN(hdr->second_size, hdr->page_size);
+		dtb_img_addr += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
+
+		*addr = dtb_img_addr;
 	}
 
-	/* Calculate the address of DTB area in boot image */
-	dtb_img_addr = hdr_addr;
-	dtb_img_addr += hdr->page_size;
-	dtb_img_addr += ALIGN(hdr->kernel_size, hdr->page_size);
-	dtb_img_addr += ALIGN(hdr->ramdisk_size, hdr->page_size);
-	dtb_img_addr += ALIGN(hdr->second_size, hdr->page_size);
-	dtb_img_addr += ALIGN(hdr->recovery_dtbo_size, hdr->page_size);
-
-	*addr = dtb_img_addr;
-
+	if (hdr->header_version > 2) {
+		v_hdr = map_sysmem(vhdr_addr, sizeof(*v_hdr));
+		if (!v_hdr->dtb_size) {
+			printf("Error: dtb_size is 0\n");
+			ret = false;
+			unmap_sysmem(v_hdr);
+			goto exit;
+		}
+		/* Calculate the address of DTB area in boot image */
+		dtb_img_addr = vhdr_addr;
+		dtb_img_addr += v_hdr->page_size;
+		if (v_hdr->vendor_ramdisk_size)
+			dtb_img_addr += ALIGN(v_hdr->vendor_ramdisk_size, v_hdr->page_size);
+		*addr = dtb_img_addr;
+		unmap_sysmem(v_hdr);
+		goto exit;
+	}
 exit:
 	unmap_sysmem(hdr);
 	return ret;
@@ -316,6 +574,7 @@ exit:
 /**
  * android_image_get_dtb_by_index() - Get address and size of blob in DTB area.
  * @hdr_addr: Boot image header address
+ * @vendor_boot_img: Pointer to vendor boot image header, which is at the start of the image.
  * @index: Index of desired DTB in DTB area (starting from 0)
  * @addr: If not NULL, will contain address to specified DTB
  * @size: If not NULL, will contain size of specified DTB
@@ -325,20 +584,32 @@ exit:
  *
  * Return: true on success or false on error.
  */
-bool android_image_get_dtb_by_index(ulong hdr_addr, u32 index, ulong *addr,
-				    u32 *size)
+bool android_image_get_dtb_by_index(ulong hdr_addr, ulong vendor_boot_img,
+				    u32 index, ulong *addr, u32 *size)
 {
-	const struct andr_img_hdr *hdr;
-	bool res;
+	struct andr_image_data img_data;
+	const struct andr_boot_img_hdr_v0 *hdr;
+	const struct andr_vnd_boot_img_hdr *vhdr;
+
+	hdr = map_sysmem(hdr_addr, sizeof(*hdr));
+	if (vendor_boot_img != -1)
+		vhdr = map_sysmem(vendor_boot_img, sizeof(*vhdr));
+	if (!android_image_get_data(hdr, vhdr, &img_data)) {
+		if (vendor_boot_img != -1)
+			unmap_sysmem(vhdr);
+		unmap_sysmem(hdr);
+		return false;
+	}
+	if (vendor_boot_img != -1)
+		unmap_sysmem(vhdr);
+	unmap_sysmem(hdr);
+
 	ulong dtb_img_addr;	/* address of DTB part in boot image */
 	u32 dtb_img_size;	/* size of DTB payload in boot image */
 	ulong dtb_addr;		/* address of DTB blob with specified index  */
 	u32 i;			/* index iterator */
 
-	res = android_image_get_dtb_img_addr(hdr_addr, &dtb_img_addr);
-	if (!res)
-		return false;
-
+	android_image_get_dtb_img_addr(hdr_addr, vendor_boot_img, &dtb_img_addr);
 	/* Check if DTB area of boot image is in DTBO format */
 	if (android_dt_check_header(dtb_img_addr)) {
 		return android_dt_get_fdt_by_index(dtb_img_addr, index, addr,
@@ -346,9 +617,7 @@ bool android_image_get_dtb_by_index(ulong hdr_addr, u32 index, ulong *addr,
 	}
 
 	/* Find out the address of DTB with specified index in concat blobs */
-	hdr = map_sysmem(hdr_addr, sizeof(*hdr));
-	dtb_img_size = hdr->dtb_size;
-	unmap_sysmem(hdr);
+	dtb_img_size = img_data.dtb_size;
 	i = 0;
 	dtb_addr = dtb_img_addr;
 	while (dtb_addr < dtb_img_addr + dtb_img_size) {
@@ -393,8 +662,12 @@ bool android_image_get_dtb_by_index(ulong hdr_addr, u32 index, ulong *addr,
  * returns:
  *     no returned results
  */
-void android_print_contents(const struct andr_img_hdr *hdr)
+void android_print_contents(const struct andr_boot_img_hdr_v0 *hdr)
 {
+	if (hdr->header_version >= 3) {
+		printf("Content print is not supported for boot image header version > 2");
+		return;
+	}
 	const char * const p = IMAGE_INDENT_STRING;
 	/* os_version = ver << 11 | lvl */
 	u32 os_ver = hdr->os_version >> 11;
@@ -427,7 +700,7 @@ void android_print_contents(const struct andr_img_hdr *hdr)
 		       hdr->header_size);
 	}
 
-	if (hdr->header_version >= 2) {
+	if (hdr->header_version == 2) {
 		printf("%sdtb size:             %x\n", p, hdr->dtb_size);
 		printf("%sdtb addr:             %llx\n", p, hdr->dtb_addr);
 	}
@@ -485,14 +758,14 @@ static bool android_image_print_dtb_info(const struct fdt_header *fdt,
  */
 bool android_image_print_dtb_contents(ulong hdr_addr)
 {
-	const struct andr_img_hdr *hdr;
+	const struct andr_boot_img_hdr_v0 *hdr;
 	bool res;
 	ulong dtb_img_addr;	/* address of DTB part in boot image */
 	u32 dtb_img_size;	/* size of DTB payload in boot image */
 	ulong dtb_addr;		/* address of DTB blob with specified index  */
 	u32 i;			/* index iterator */
 
-	res = android_image_get_dtb_img_addr(hdr_addr, &dtb_img_addr);
+	res = android_image_get_dtb_img_addr(hdr_addr, 0, &dtb_img_addr);
 	if (!res)
 		return false;
 
diff --git a/boot/image-board.c b/boot/image-board.c
index 9bf70824cb7..d500da1b4b9 100644
--- a/boot/image-board.c
+++ b/boot/image-board.c
@@ -284,7 +284,7 @@ int genimg_get_format(const void *img_addr)
 			return IMAGE_FORMAT_FIT;
 	}
 	if (IS_ENABLED(CONFIG_ANDROID_BOOT_IMAGE) &&
-	    !android_image_check_header(img_addr))
+	    is_android_boot_image_header(img_addr))
 		return IMAGE_FORMAT_ANDROID;
 
 	return IMAGE_FORMAT_INVALID;
@@ -328,7 +328,7 @@ static int select_ramdisk(struct bootm_headers *images, const char *select, u8 a
 	bool done_select = !select;
 	bool done = false;
 	int rd_noffset;
-	ulong rd_addr;
+	ulong rd_addr = 0;
 	char *buf;
 
 	if (CONFIG_IS_ENABLED(FIT)) {
@@ -426,11 +426,22 @@ static int select_ramdisk(struct bootm_headers *images, const char *select, u8 a
 		break;
 	case IMAGE_FORMAT_ANDROID:
 		if (IS_ENABLED(CONFIG_ANDROID_BOOT_IMAGE)) {
-			void *ptr = map_sysmem(images->os.start, 0);
 			int ret;
+			if (IS_ENABLED(CONFIG_CMD_ABOOTIMG)) {
+				void *boot_img = map_sysmem(get_abootimg_addr(), 0);
+				void *vendor_boot_img = map_sysmem(get_avendor_bootimg_addr(), 0);
+
+				ret = android_image_get_ramdisk(boot_img, vendor_boot_img,
+								rd_datap, rd_lenp);
+				unmap_sysmem(vendor_boot_img);
+				unmap_sysmem(boot_img);
+			} else {
+				void *ptr = map_sysmem(images->os.start, 0);
+
+				ret = android_image_get_ramdisk(ptr, NULL, rd_datap, rd_lenp);
+				unmap_sysmem(ptr);
+			}
 
-			ret = android_image_get_ramdisk(ptr, rd_datap, rd_lenp);
-			unmap_sysmem(ptr);
 			if (ret)
 				return ret;
 			done = true;
@@ -1115,7 +1126,8 @@ fallback:
 			}
 
 			/* get script subimage data address and length */
-			if (fit_image_get_data(fit_hdr, noffset, &fit_data, &fit_len)) {
+			if (fit_image_get_data_and_size(fit_hdr, noffset,
+							&fit_data, &fit_len)) {
 				puts("Could not find script subimage data\n");
 				return 1;
 			}
diff --git a/boot/image-fdt.c b/boot/image-fdt.c
index 714d05d1a53..f10200f6474 100644
--- a/boot/image-fdt.c
+++ b/boot/image-fdt.c
@@ -529,14 +529,15 @@ int boot_get_fdt(int flag, int argc, char *const argv[], uint8_t arch,
 		}
 #ifdef CONFIG_ANDROID_BOOT_IMAGE
 	} else if (genimg_get_format(buf) == IMAGE_FORMAT_ANDROID) {
-		struct andr_img_hdr *hdr = buf;
+		void *hdr = buf;
 		ulong		fdt_data, fdt_len;
 		u32			fdt_size, dtb_idx;
 		/*
 		 * Firstly check if this android boot image has dtb field.
 		 */
 		dtb_idx = (u32)env_get_ulong("adtb_idx", 10, 0);
-		if (android_image_get_dtb_by_index((ulong)hdr, dtb_idx, &fdt_addr, &fdt_size)) {
+		if (android_image_get_dtb_by_index((ulong)hdr, 0,
+						   dtb_idx, &fdt_addr, &fdt_size)) {
 			fdt_blob = (char *)map_sysmem(fdt_addr, 0);
 			if (fdt_check_header(fdt_blob))
 				goto no_fdt;
diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
index 3a1e50f2b1b..d13c47dd942 100644
--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -1578,7 +1578,7 @@ void handle_pxe_menu(struct pxe_context *ctx, struct pxe_menu *cfg)
 
 int pxe_setup_ctx(struct pxe_context *ctx, struct cmd_tbl *cmdtp,
 		  pxe_getfile_func getfile, void *userdata,
-		  bool allow_abs_path, const char *bootfile)
+		  bool allow_abs_path, const char *bootfile, bool use_ipv6)
 {
 	const char *last_slash;
 	size_t path_len = 0;
@@ -1588,6 +1588,7 @@ int pxe_setup_ctx(struct pxe_context *ctx, struct cmd_tbl *cmdtp,
 	ctx->getfile = getfile;
 	ctx->userdata = userdata;
 	ctx->allow_abs_path = allow_abs_path;
+	ctx->use_ipv6 = use_ipv6;
 
 	/* figure out the boot directory, if there is one */
 	if (bootfile && strlen(bootfile) >= MAX_TFTP_PATH_LEN)
diff --git a/boot/vbe_simple.c b/boot/vbe_simple.c
index 59676d8613f..12682abd399 100644
--- a/boot/vbe_simple.c
+++ b/boot/vbe_simple.c
@@ -148,11 +148,13 @@ static int vbe_simple_read_bootflow(struct udevice *dev, struct bootflow *bflow)
 {
 	int ret;
 
-	if (vbe_phase() == VBE_PHASE_FIRMWARE) {
-		ret = vbe_simple_read_bootflow_fw(dev, bflow);
-		if (ret)
-			return log_msg_ret("fw", ret);
-		return 0;
+	if (CONFIG_IS_ENABLED(BOOTMETH_VBE_SIMPLE_FW)) {
+		if (vbe_phase() == VBE_PHASE_FIRMWARE) {
+			ret = vbe_simple_read_bootflow_fw(dev, bflow);
+			if (ret)
+				return log_msg_ret("fw", ret);
+			return 0;
+		}
 	}
 
 	return -EINVAL;