From 1cd0a441066d3003c63fc90d936f6c4e1b47c896 Mon Sep 17 00:00:00 2001 From: Quentin Schulz Date: Thu, 18 Dec 2025 13:19:07 +0100 Subject: boot: fix missing dependency for BOOTMETH_ANDROID The code depends on set_avendor_bootimg_addr and set_abootimg_addr functions which are only defined in cmd/abootimg.c, only built when CMD_ABOOTIMG=y so let's add a dependency. It should be "depends on" to be properly implemented, but we get a circular dependency otherwise: boot/Kconfig:566:error: recursive dependency detected! boot/Kconfig:566: symbol BOOTMETH_ANDROID depends on CMD_ABOOTIMG cmd/Kconfig:504: symbol CMD_ABOOTIMG depends on ANDROID_BOOT_IMAGE boot/Kconfig:7: symbol ANDROID_BOOT_IMAGE is selected by BOOTMETH_ANDROID so instead we do a select. It is safe because CMD_ABOOTIMG depends on ANDROID_BOOT_IMAGE which we select here as well. Fixes: 125d9f3306ea ("bootstd: Add a bootmeth for Android") Signed-off-by: Quentin Schulz Reviewed-by: Kory Maincent Reviewed-by: Mattijs Korpershoek Link: https://lore.kernel.org/r/20251218-bootmeth_android-deps-v1-1-0113c804f951@cherry.de Signed-off-by: Mattijs Korpershoek --- boot/Kconfig | 1 + 1 file changed, 1 insertion(+) (limited to 'boot') diff --git a/boot/Kconfig b/boot/Kconfig index 676a42a6ed4..b090f3c4c11 100644 --- a/boot/Kconfig +++ b/boot/Kconfig @@ -550,6 +550,7 @@ config BOOTMETH_ANDROID depends on X86 || ARM || SANDBOX depends on CMDLINE select ANDROID_BOOT_IMAGE + select CMD_ABOOTIMG select CMD_BCB imply CMD_FASTBOOT imply FASTBOOT if !NET_LWIP -- cgit v1.2.3 From 8fa0cf5f3d7ca15e2d102d0d46a132d246793486 Mon Sep 17 00:00:00 2001 From: Francois Berder Date: Wed, 14 Jan 2026 10:14:55 +0100 Subject: bootstd: android: Add missing free in android_read_bootflow If strdup call fails, one needs to free priv variable. Signed-off-by: Francois Berder Reviewed-by: Mattijs Korpershoek Reviewed-by: Tom Rini Link: https://lore.kernel.org/r/BESP194MB28052734FD0361EA602F6360DA8FA@BESP194MB2805.EURP194.PROD.OUTLOOK.COM Signed-off-by: Mattijs Korpershoek --- boot/bootmeth_android.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'boot') diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c index 1374551dbeb..1d70e8d5c05 100644 --- a/boot/bootmeth_android.c +++ b/boot/bootmeth_android.c @@ -252,8 +252,10 @@ static int android_read_bootflow(struct udevice *dev, struct bootflow *bflow) priv->boot_mode = ANDROID_BOOT_MODE_NORMAL; bflow->os_name = strdup("Android"); } - if (!bflow->os_name) + if (!bflow->os_name) { + free(priv); return log_msg_ret("os", -ENOMEM); + } if (priv->boot_mode == ANDROID_BOOT_MODE_BOOTLOADER) { /* Clear BCB */ -- cgit v1.2.3 From 6b0f079ba260b37a5b3577e6429ba721070ee2bf Mon Sep 17 00:00:00 2001 From: "Mattijs Korpershoek (TI.com)" Date: Mon, 12 Jan 2026 11:55:37 +0100 Subject: boot: android: import addBootConfigParameters() from AOSP To properly implement Android boot image v4, U-Boot must be able to add additional entries to the bootconfig. Add `add_bootconfig_parameters()` to do so. This has been imported from Google's U-Boot source[1] The variables/function names have been reworked to be compliant with U-Boot's coding style. [1] https://android.googlesource.com/platform/external/u-boot/+/7af0a0506d4de6f5ea147d10fb0664a8af07d326 Signed-off-by: Mattijs Korpershoek (TI.com) Reviewed-by: Mattijs Korpershoek Signed-off-by: Guillaume La Roque (TI.com) Link: https://lore.kernel.org/r/20260112-bootconfig-v5-1-79b242159ac7@baylibre.com Signed-off-by: Mattijs Korpershoek --- boot/image-android.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) (limited to 'boot') diff --git a/boot/image-android.c b/boot/image-android.c index ea47869a64c..5407390ef36 100644 --- a/boot/image-android.c +++ b/boot/image-android.c @@ -57,6 +57,46 @@ static ulong add_trailer(ulong bootconfig_start_addr, ulong bootconfig_size) return BOOTCONFIG_TRAILER_SIZE; } +/* + * Add a string of boot config parameters to memory appended by the trailer. + * NOTE: This function expects bootconfig_start_addr to be already mapped. + * It works directly with the mapped pointer, not a physical address. + */ +static long add_bootconfig_parameters(char *params, long params_len, + ulong bootconfig_start_addr, u32 bootconfig_size) +{ + long applied_bytes = 0; + long new_size = 0; + ulong end; + + if (!params || !bootconfig_start_addr) + return -EINVAL; + + if (params_len == 0) + return 0; + + end = bootconfig_start_addr + bootconfig_size; + + if (is_trailer_present(end)) { + end -= BOOTCONFIG_TRAILER_SIZE; + applied_bytes -= BOOTCONFIG_TRAILER_SIZE; + memcpy(&new_size, (void *)end, BOOTCONFIG_SIZE_SIZE); + } else { + /* + * When no trailer is present, the bootconfig_size includes the actual content. + * We should write new parameters right after the existing content. + */ + end = bootconfig_start_addr + bootconfig_size; + new_size = bootconfig_size; + } + + memcpy((void *)end, params, params_len); + applied_bytes += params_len; + applied_bytes += add_trailer(bootconfig_start_addr, + bootconfig_size + applied_bytes); + return applied_bytes; +} + __weak ulong get_avendor_bootimg_addr(void) { return -1; -- cgit v1.2.3 From 8f6d43557056c73469c1e70d2949ebef6ce5ce44 Mon Sep 17 00:00:00 2001 From: "Guillaume La Roque (TI.com)" Date: Mon, 12 Jan 2026 11:55:38 +0100 Subject: boot: android: Add sandbox memory mapping support Use map_to_sysmem() to convert header pointers to physical addresses in parse_hdr functions, and add proper map_sysmem()/unmap_sysmem() calls in android_image_get_data() for sandbox compatibility. Reviewed-by: Mattijs Korpershoek Reviewed-by: Simon Glass Signed-off-by: Guillaume La Roque (TI.com) Link: https://lore.kernel.org/r/20260112-bootconfig-v5-2-79b242159ac7@baylibre.com Signed-off-by: Mattijs Korpershoek --- boot/image-android.c | 58 ++++++++++++++++++++++++++++++---------------------- 1 file changed, 33 insertions(+), 25 deletions(-) (limited to 'boot') diff --git a/boot/image-android.c b/boot/image-android.c index 5407390ef36..b9e0b3f68b0 100644 --- a/boot/image-android.c +++ b/boot/image-android.c @@ -114,7 +114,7 @@ static void android_boot_image_v3_v4_parse_hdr(const struct andr_boot_img_hdr_v3 * The header takes a full page, the remaining components are aligned * on page boundary. */ - end = (ulong)hdr; + end = map_to_sysmem(hdr); end += ANDR_GKI_PAGE_SIZE; data->kernel_ptr = end; data->kernel_size = hdr->kernel_size; @@ -127,7 +127,7 @@ static void android_boot_image_v3_v4_parse_hdr(const struct andr_boot_img_hdr_v3 if (hdr->header_version > 3) end += ALIGN(hdr->signature_size, ANDR_GKI_PAGE_SIZE); - data->boot_img_total_size = end - (ulong)hdr; + data->boot_img_total_size = end - map_to_sysmem(hdr); } static void android_vendor_boot_image_v3_v4_parse_hdr(const struct andr_vnd_boot_img_hdr @@ -146,7 +146,7 @@ static void android_vendor_boot_image_v3_v4_parse_hdr(const struct andr_vnd_boot data->ramdisk_addr = hdr->ramdisk_addr; data->dtb_load_addr = hdr->dtb_addr; data->bootconfig_size = hdr->bootconfig_size; - end = (ulong)hdr; + end = map_to_sysmem(hdr); if (hdr->header_version > 3) end += ALIGN(ANDR_VENDOR_BOOT_V4_SIZE, hdr->page_size); @@ -167,12 +167,16 @@ static void android_vendor_boot_image_v3_v4_parse_hdr(const struct andr_vnd_boot end += ALIGN(hdr->vendor_ramdisk_table_size, hdr->page_size); data->bootconfig_addr = end; if (hdr->bootconfig_size) { - data->bootconfig_size += add_trailer(data->bootconfig_addr, + void *bootconfig_ptr = map_sysmem(data->bootconfig_addr, + data->bootconfig_size + + BOOTCONFIG_TRAILER_SIZE); + data->bootconfig_size += add_trailer((ulong)bootconfig_ptr, data->bootconfig_size); + unmap_sysmem(bootconfig_ptr); data->ramdisk_size += data->bootconfig_size; } end += ALIGN(data->bootconfig_size, hdr->page_size); - data->vendor_boot_img_total_size = end - (ulong)hdr; + data->vendor_boot_img_total_size = end - map_to_sysmem(hdr); } static void android_boot_image_v0_v1_v2_parse_hdr(const struct andr_boot_img_hdr_v0 *hdr, @@ -187,7 +191,7 @@ static void android_boot_image_v0_v1_v2_parse_hdr(const struct andr_boot_img_hdr data->header_version = hdr->header_version; data->dtb_load_addr = hdr->dtb_addr; - end = (ulong)hdr; + end = map_to_sysmem(hdr); /* * The header takes a full page, the remaining components are aligned @@ -220,7 +224,7 @@ static void android_boot_image_v0_v1_v2_parse_hdr(const struct andr_boot_img_hdr end += ALIGN(hdr->dtb_size, hdr->page_size); } - data->boot_img_total_size = end - (ulong)hdr; + data->boot_img_total_size = end - map_to_sysmem(hdr); } bool android_image_get_bootimg_size(const void *hdr, u32 *boot_img_size) @@ -271,31 +275,42 @@ bool android_image_get_vendor_bootimg_size(const void *hdr, u32 *vendor_boot_img bool android_image_get_data(const void *boot_hdr, const void *vendor_boot_hdr, struct andr_image_data *data) { + const struct andr_boot_img_hdr_v0 *bhdr; + const struct andr_vnd_boot_img_hdr *vhdr; + if (!boot_hdr || !data) { printf("boot_hdr or data params can't be NULL\n"); return false; } - if (!is_android_boot_image_header(boot_hdr)) { + bhdr = map_sysmem((ulong)boot_hdr, sizeof(*bhdr)); + if (!is_android_boot_image_header(bhdr)) { printf("Incorrect boot image header\n"); + unmap_sysmem(bhdr); return false; } - if (((struct andr_boot_img_hdr_v0 *)boot_hdr)->header_version > 2) { + if (bhdr->header_version > 2) { if (!vendor_boot_hdr) { printf("For boot header v3+ vendor boot image has to be provided\n"); + unmap_sysmem(bhdr); return false; } - if (!is_android_vendor_boot_image_header(vendor_boot_hdr)) { + vhdr = map_sysmem((ulong)vendor_boot_hdr, sizeof(*vhdr)); + if (!is_android_vendor_boot_image_header(vhdr)) { printf("Incorrect vendor boot image header\n"); + unmap_sysmem(vhdr); + unmap_sysmem(bhdr); return false; } - android_boot_image_v3_v4_parse_hdr(boot_hdr, data); - android_vendor_boot_image_v3_v4_parse_hdr(vendor_boot_hdr, data); + android_boot_image_v3_v4_parse_hdr((const struct andr_boot_img_hdr_v3 *)bhdr, data); + android_vendor_boot_image_v3_v4_parse_hdr(vhdr, data); + unmap_sysmem(vhdr); } else { - android_boot_image_v0_v1_v2_parse_hdr(boot_hdr, data); + android_boot_image_v0_v1_v2_parse_hdr(bhdr, data); } + unmap_sysmem(bhdr); return true; } @@ -724,21 +739,14 @@ bool android_image_get_dtb_by_index(ulong hdr_addr, ulong vendor_boot_img, u32 index, ulong *addr, u32 *size) { struct andr_image_data img_data; - const struct andr_boot_img_hdr_v0 *hdr; - const struct andr_vnd_boot_img_hdr *vhdr = NULL; + const void *vendor_boot_hdr = NULL; - hdr = map_sysmem(hdr_addr, sizeof(*hdr)); if (vendor_boot_img != -1) - vhdr = map_sysmem(vendor_boot_img, sizeof(*vhdr)); - if (!android_image_get_data(hdr, vhdr, &img_data)) { - if (vendor_boot_img != -1) - unmap_sysmem(vhdr); - unmap_sysmem(hdr); + vendor_boot_hdr = (const void *)vendor_boot_img; + + if (!android_image_get_data((const void *)hdr_addr, vendor_boot_hdr, + &img_data)) return false; - } - if (vendor_boot_img != -1) - unmap_sysmem(vhdr); - unmap_sysmem(hdr); ulong dtb_img_addr; /* address of DTB part in boot image */ u32 dtb_img_size; /* size of DTB payload in boot image */ -- cgit v1.2.3 From 733f5a601989f5404947c4b268d40724bac414f6 Mon Sep 17 00:00:00 2001 From: "Guillaume La Roque (TI.com)" Date: Mon, 12 Jan 2026 11:55:39 +0100 Subject: boot: android: Add bootconfig support For android vendor boot image version 4 bootconfig is mandatory.[1] In the android_image_get_ramdisk function, after copying both vendor and boot ramdisks, we extract all androidboot.* entries from the kernel command line. These entries are added to the bootconfig section. We then update the sizes of the ramdisk and bootconfig. Finally, all androidboot.* entries are removed from the kernel command line. [1] https://source.android.com/docs/core/architecture/partitions/vendor-boot-partitions#bootloader-support Reviewed-by: Simon Glass Signed-off-by: Guillaume La Roque (TI.com) Link: https://lore.kernel.org/r/20260112-bootconfig-v5-3-79b242159ac7@baylibre.com [mkorpershoek: dropped irrelevant code comments] Signed-off-by: Mattijs Korpershoek --- boot/image-android.c | 174 +++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 163 insertions(+), 11 deletions(-) (limited to 'boot') diff --git a/boot/image-android.c b/boot/image-android.c index b9e0b3f68b0..fb26290d40c 100644 --- a/boot/image-android.c +++ b/boot/image-android.c @@ -505,6 +505,166 @@ ulong android_image_get_kcomp(const void *hdr, return image_decomp_type(p, sizeof(u32)); } +/** + * android_boot_append_bootconfig() - Append bootconfig parameters to ramdisk + * @img_data: Pointer to Android image data + * @params: Pointer to boot config parameters to append + * @params_len: Length of boot config parameters + * @ramdisk_dest: Destination address for the merged ramdisk + * + * This function copies the vendor ramdisk, boot ramdisk, and bootconfig to + * the destination. It then appends the provided bootconfig parameters. + * + * Return: Bytes added to the bootconfig on success, negative on error. + */ +static long android_boot_append_bootconfig(const struct andr_image_data *img_data, + char *params, long params_len, + void *ramdisk_dest) +{ + void *vendor_ramdisk_src; + void *boot_ramdisk_src; + void *bootconfig_src; + long bytes_added = 0; + + /* Map sources */ + vendor_ramdisk_src = map_sysmem(img_data->vendor_ramdisk_ptr, + img_data->vendor_ramdisk_size); + boot_ramdisk_src = map_sysmem(img_data->ramdisk_ptr, + img_data->boot_ramdisk_size); + + /* Copy Vendor Ramdisk */ + memcpy(ramdisk_dest, vendor_ramdisk_src, img_data->vendor_ramdisk_size); + + /* Copy Boot Ramdisk */ + memcpy((char *)ramdisk_dest + img_data->vendor_ramdisk_size, + boot_ramdisk_src, img_data->boot_ramdisk_size); + + /* Copy Bootconfig and Append Params */ + if (img_data->bootconfig_size) { + bootconfig_src = map_sysmem(img_data->bootconfig_addr, + img_data->bootconfig_size); + memcpy((char *)ramdisk_dest + img_data->vendor_ramdisk_size + + img_data->boot_ramdisk_size, + bootconfig_src, img_data->bootconfig_size); + unmap_sysmem(bootconfig_src); + + if (params && params_len > 1) { + void *bootconfig_ptr = (char *)ramdisk_dest + + img_data->vendor_ramdisk_size + + img_data->boot_ramdisk_size; + bytes_added = add_bootconfig_parameters(params, params_len, + (ulong)bootconfig_ptr, + img_data->bootconfig_size); + } + } + + unmap_sysmem(boot_ramdisk_src); + unmap_sysmem(vendor_ramdisk_src); + + if (bytes_added < 0) + return bytes_added; + + return bytes_added; +} + +/** + * android_image_set_bootconfig() - Extract androidboot.* args and append to bootconfig + * @hdr: Pointer to boot image header + * @vendor_boot_img: Pointer to vendor boot image header + * @ramdisk_addr: Destination address for the merged ramdisk + * + * Return: Size of the bootconfig section (including new params) on success, negative on error. + */ +static long android_image_set_bootconfig(const void *hdr, + const void *vendor_boot_img, + ulong ramdisk_addr) +{ + const char *bootargs = env_get("bootargs"); + char *params = NULL; + char *new_bootargs = NULL; + long params_len = 0; + struct andr_image_data img_data; + long ret; + size_t len; + const char *src; + char *bc_dst; + char *args_dst; + ulong total_size; + void *ramdisk_dest; + + if (!android_image_get_data(hdr, vendor_boot_img, &img_data)) + return -EINVAL; + + /* Extract androidboot.* parameters from bootargs */ + if (bootargs && img_data.bootconfig_size) { + len = strlen(bootargs); + src = bootargs; + + params = malloc(len + 1); + new_bootargs = malloc(len + 1); + if (!params || !new_bootargs) { + free(params); + free(new_bootargs); + printf("Error: malloc failed\n"); + return -ENOMEM; + } + + bc_dst = params; + args_dst = new_bootargs; + + /* Extract androidboot.* and build new bootargs in one pass */ + while (*src) { + /* Skip leading spaces */ + while (*src == ' ') + src++; + if (!*src) + break; + + /* Check if this param starts with androidboot. */ + if (strncmp(src, "androidboot.", 12) == 0) { + /* Copy to bootconfig (add newline if not first) */ + if (bc_dst != params) + *bc_dst++ = '\n'; + while (*src && *src != ' ') + *bc_dst++ = *src++; + } else { + /* Copy to new bootargs (add space if not first) */ + if (args_dst != new_bootargs) + *args_dst++ = ' '; + while (*src && *src != ' ') + *args_dst++ = *src++; + } + } + + *bc_dst++ = '\n'; /* Final newline for bootconfig */ + *bc_dst = '\0'; + *args_dst = '\0'; + params_len = bc_dst - params; + + /* Update bootargs if we extracted any androidboot params */ + if (params_len > 1) + env_set("bootargs", new_bootargs); + } + + /* Calculate total size for mapping */ + total_size = img_data.ramdisk_size + img_data.bootconfig_size; + if (params_len > 1) + total_size += params_len + BOOTCONFIG_TRAILER_SIZE; + + /* Map Dest */ + ramdisk_dest = map_sysmem(ramdisk_addr, total_size); + + /* Copy data */ + ret = android_boot_append_bootconfig(&img_data, params, params_len, + ramdisk_dest); + + unmap_sysmem(ramdisk_dest); + free(params); + free(new_bootargs); + + return ret; +} + int android_image_get_ramdisk(const void *hdr, const void *vendor_boot_img, ulong *rd_data, ulong *rd_len) { @@ -536,17 +696,9 @@ int android_image_get_ramdisk(const void *hdr, const void *vendor_boot_img, ramdisk_ptr = img_data.ramdisk_addr; } *rd_data = ramdisk_ptr; - memcpy((void *)(ramdisk_ptr), (void *)img_data.vendor_ramdisk_ptr, - img_data.vendor_ramdisk_size); - ramdisk_ptr += img_data.vendor_ramdisk_size; - memcpy((void *)(ramdisk_ptr), (void *)img_data.ramdisk_ptr, - img_data.boot_ramdisk_size); - ramdisk_ptr += img_data.boot_ramdisk_size; - if (img_data.bootconfig_size) { - memcpy((void *) - (ramdisk_ptr), (void *)img_data.bootconfig_addr, - img_data.bootconfig_size); - } + if (img_data.header_version > 3) + img_data.ramdisk_size += + android_image_set_bootconfig(hdr, vendor_boot_img, ramdisk_ptr); } else { /* Ramdisk can be used in-place, use current ptr */ if (img_data.ramdisk_addr == 0 || -- cgit v1.2.3