[PATCH v2 1/5] boot/image-android: Workaround kernel/ramdisk invalid addr

[Neil Armstrong]

On 05/05/2025 11:17, George Chan via B4 Relay wrote:
> From: George Chan <gchan9527 at gmail.com>
> 
> Some androidboot image have invalid kernel/ramdisk load addr,
> force to ignore those value and use loadaddr instead.
> 
> Suggested-by: Casey Connolly <casey.connolly at linaro.org>
> Signed-off-by: George Chan <gchan9527 at gmail.com>
> ---
>   boot/Kconfig         | 6 ++++++
>   boot/image-android.c | 9 ++++++---
>   2 files changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/boot/Kconfig b/boot/Kconfig
> index fb37d912bc9..4bdac384181 100644
> --- a/boot/Kconfig
> +++ b/boot/Kconfig
> @@ -11,6 +11,12 @@ config ANDROID_BOOT_IMAGE
>   	  This enables support for booting images which use the Android
>   	  image format header.
>   
> +config ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR
> +	bool "Android Boot Image ignore addr"
> +	default n
> +	help
> +	  This ignore kernel/ramdisk load addr specified in androidboot header.
> +
>   config TIMESTAMP
>   	bool "Show image date and time when displaying image information"
>   	default y if CMD_DATE
> diff --git a/boot/image-android.c b/boot/image-android.c
> index 1746b018900..7b8eb6a4f64 100644
> --- a/boot/image-android.c
> +++ b/boot/image-android.c
> @@ -268,7 +268,8 @@ static ulong android_image_get_kernel_addr(struct andr_image_data *img_data,
>   	 *
>   	 * Otherwise, we will return the actual value set by the user.
>   	 */
> -	if (img_data->kernel_addr  == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR) {
> +	if (img_data->kernel_addr  == ANDROID_IMAGE_DEFAULT_KERNEL_ADDR ||
> +		IS_ENABLED(CONFIG_ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR)) {
>   		if (comp == IH_COMP_NONE)
>   			return img_data->kernel_ptr;
>   		return env_get_ulong("kernel_addr_r", 16, 0);
> @@ -464,7 +465,8 @@ int android_image_get_ramdisk(const void *hdr, const void *vendor_boot_img,
>   	 */
>   	if (img_data.header_version > 2) {
>   		/* Ramdisk can't be used in-place, copy it to ramdisk_addr_r */
> -		if (img_data.ramdisk_addr == ANDROID_IMAGE_DEFAULT_RAMDISK_ADDR) {
> +		if (img_data.ramdisk_addr == ANDROID_IMAGE_DEFAULT_RAMDISK_ADDR ||
> +			(IS_ENABLED(CONFIG_ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR))) {
>   			ramdisk_ptr = env_get_ulong("ramdisk_addr_r", 16, 0);
>   			if (!ramdisk_ptr) {
>   				printf("Invalid ramdisk_addr_r to copy ramdisk into\n");
> @@ -488,7 +490,8 @@ int android_image_get_ramdisk(const void *hdr, const void *vendor_boot_img,
>   	} else {
>   		/* Ramdisk can be used in-place, use current ptr */
>   		if (img_data.ramdisk_addr == 0 ||
> -		    img_data.ramdisk_addr == ANDROID_IMAGE_DEFAULT_RAMDISK_ADDR) {
> +		    img_data.ramdisk_addr == ANDROID_IMAGE_DEFAULT_RAMDISK_ADDR ||
> +			(IS_ENABLED(CONFIG_ANDROID_BOOT_IMAGE_IGNORE_BLOB_ADDR))) {
>   			*rd_data = img_data.ramdisk_ptr;
>   		} else {
>   			ramdisk_ptr = img_data.ramdisk_addr;
> 

I like this and should be the default except rare cases, exposing the whole memory
to image loading sound really dangerous..

Reviewed-by: Neil Armstrong <neil.armstrong at linaro.org>

@Mattijs would this still work on Amlogic board if we set loadaddr to the address
curently used in the boot images ?

Neil


Reviewed-by: Neil Armstrong <neil.armstrong at linaro.org>