Linux_SDK_V1.3.3

Signed-off-by: thead_admin <occ_thead@service.alibaba.com>

14 files changed, 546 insertions, 73 deletions

diff --git a/board/thead/light-c910/Makefile b/board/thead/light-c910/Makefile
index 21e9649b..404b9c12 100644
--- a/board/thead/light-c910/Makefile
+++ b/board/thead/light-c910/Makefile
@@ -60,6 +60,7 @@ obj-$(CONFIG_THEAD_LIGHT_DIGITAL_SENSOR) += digital_sensor.o digital_sensor_test
 obj-y += clock_config.o
 obj-y += sec_check.o
 obj-y += boot.o
+obj-y += sbmeta/sbmeta.o
 ifndef CONFIG_TARGET_LIGHT_FPGA_FM_C910
 obj-$(CONFIG_LPDDR) += $(DDR_SRC_PATH)/ddr_common_func.o
 obj-$(CONFIG_LPDDR) += $(DDR_SRC_PATH)/common_lib.o
diff --git a/board/thead/light-c910/boot.c b/board/thead/light-c910/boot.c
index 24f3776f..8bc067a7 100644
--- a/board/thead/light-c910/boot.c
+++ b/board/thead/light-c910/boot.c
@@ -709,10 +709,12 @@ void sec_firmware_version_dump(void)
 	tf_ver_env = env_get_hex("tf_version", 0);
 	if ((tee_ver_env != tee_ver) && (tee_ver != 0)) {
 		env_set_hex("tee_version", tee_ver);
+		run_command("saveenv", 0);
 	}
 
 	if ((tf_ver_env != tf_ver) && (tf_ver != 0)) {
 		env_set_hex("tf_version", tf_ver);
+		run_command("saveenv", 0);
 	}
 
 	printf("\n\n");
diff --git a/board/thead/light-c910/clock_config.c b/board/thead/light-c910/clock_config.c
index f3ea3836..543eafeb 100644
--- a/board/thead/light-c910/clock_config.c
+++ b/board/thead/light-c910/clock_config.c
@@ -1306,7 +1306,7 @@ int clk_config(void)
 
 #if defined (CONFIG_TARGET_LIGHT_FM_C910_VAL_ANT_DISCRETE) || defined (CONFIG_TARGET_LIGHT_FM_C910_BEAGLE) || defined (CONFIG_TARGET_LIGHT_FM_C910_B_REF) || defined (CONFIG_TARGET_LIGHT_FM_C910_VAL_ANT_REF) || defined (CONFIG_TARGET_LIGHT_FM_C910_B_POWER) || defined (CONFIG_TARGET_LIGHT_FM_C910_VAL_B) || defined (CONFIG_TARGET_LIGHT_FM_C910_LPI4A) || defined (CONFIG_TARGET_LIGHT_FM_C910_MILKV_MELES)
 	ap_multimedia_div_num_set(VI_MIPI_CSI0_DIV, 12); /* Input frquency: 2376MHZ */
-	ap_multimedia_div_num_set(VI_ISP0_CORE_DIV, 15); /* Input frquency: 2376MHZ */
+	ap_multimedia_div_num_set(VI_ISP0_CORE_DIV, 12); /* Input frquency: 2376MHZ */
 	ap_multimedia_div_num_set(VI_ISP1_CORE_DIV, 12); /* Input frquency: 2376MHZ */
 	ap_multimedia_div_num_set(VI_ISP_RY_CORE_DIV, 12); /* Input frquency: 2376MHZ */
 	ap_multimedia_div_num_set(VO_DPU_CORE_DIV, 4);	/* Input frquency: 2376MHZ */
diff --git a/board/thead/light-c910/light.c b/board/thead/light-c910/light.c
index 4f7f4b08..6a765400 100644
--- a/board/thead/light-c910/light.c
+++ b/board/thead/light-c910/light.c
@@ -32,6 +32,7 @@
 #define GMAC1_APB3S_BADDR	0xffec004000
 
 static uint64_t apb3s_baddr;
+extern int check_image_board_id(uint8_t *image_data);
 
 typedef enum {
 	UART0_TXD = PAD_GRP_BASE_SET(SOC_PIN_AP_RIGHT_TOP),
@@ -2425,10 +2426,18 @@ static void light_usb_boot_check(void)
 	uchar env_enet1addr[6];
 	int env_ethaddr_flag,env_eth1addr_flag;
 	int boot_mode;
+	int ret = 0;
+
 	boot_mode = readl((void *)SOC_OM_ADDRBASE) & 0x7;
 	if (boot_mode & BIT(2))
 		return;
 
+    /*check board id of uboot image*/
+	ret = check_image_board_id((uint8_t*)SRAM_BASE_ADDR);
+	if (ret != 0) {
+	    while(1);
+	}
+
 #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG
 	env_set("usb_fastboot", "yes");
 #endif
diff --git a/board/thead/light-c910/sbmeta/sbmeta.c b/board/thead/light-c910/sbmeta/sbmeta.c
new file mode 100644
index 00000000..6407ec7a
--- /dev/null
+++ b/board/thead/light-c910/sbmeta/sbmeta.c
@@ -0,0 +1,296 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (C) 2021 Alibaba Group Holding Limited
+ */
+
+#include "sbmeta.h"
+
+#define NO_DEBUG 0
+#if NO_DEBUG
+#define print_info(fmt, args...)
+#else
+#define print_info(fmt, args...)    printf(fmt, ##args)
+#endif
+
+#if CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_LPI4A)
+#if CONFIG_IS_ENABLED(LIGHT_SEC_UPGRADE)
+/* digest_size corresponding to digest_scheme specified in sbmeta_info_t */
+static const int digest_size[] = {0, 20, 16, 28, 32, 48, 64, 32, 64};
+static const char* image_name_s[] = {
+    "dtb", "kernel", "tf", "aon", "rootfs", "tee", "uboot", "user"
+};
+
+static const uint32_t image_addrs[] = {
+    LIGHT_DTB_ADDR,
+    LIGHT_KERNEL_ADDR,
+    LIGHT_TF_FW_TMP_ADDR,
+    LIGHT_AON_FW_ADDR,
+    LIGHT_ROOTFS_ADDR,
+    LIGHT_TEE_FW_ADDR,
+    CONFIG_SYS_TEXT_BASE,
+};
+
+static int is_sbmeta_info(uint32_t entry_src_addr)
+{
+    uint32_t *buffer = (uint32_t *)entry_src_addr;
+
+    /* sbmeta_info_t entry should start with magic code 'S''B''M''T' */
+    if (*buffer != SBMETA_MAGIC) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static int dump_sbmeta_info(sbmeta_info_t *sbmeta_info)
+{
+    if (sbmeta_info == NULL) {
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support emmc now */
+    if (sbmeta_info->medium_type != 0) {
+        print_info("Error: medium type %s is not supported now\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support dtb, krlimg/tf, sbi, aon, rootfs, tee, uboot and user-defined type */
+    if (sbmeta_info->image_type > IMAGE_TYPE_NUM || sbmeta_info->image_type < 0) {
+        print_info("Error: image type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support none, sha1, md5, sha224, sha256, sha384, sha512, sm3 and reserved scheme */
+    if (sbmeta_info->digest_scheme > DIGEST_TYPE_NUM || sbmeta_info->digest_scheme < 0) {
+        print_info("Error: digest type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support none, rsa1024, rsa2048, ecc256, ecc160, sm2 and reserved scheme */
+    if (sbmeta_info->sign_scheme > SIGN_TYPE_NUM || sbmeta_info->sign_scheme < 0) {
+        print_info("Error: signature type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* DTB, TF, TEE, Kernel will be loaded from default partitions specified in env */
+    if (sbmeta_info->image_type != T_ROOTFS && sbmeta_info->image_type != T_USER) {
+        print_info("Image has been loaded\r\n");
+    }
+
+    /* dump sbmeta_info_t */
+    print_info("image medium type: %d\n", sbmeta_info->medium_type);
+    print_info("image load part: mmc %d:%d\n", sbmeta_info->dev, sbmeta_info->part);
+    print_info("image type: %d \n", sbmeta_info->image_type);
+    print_info("image digest scheme: %d\n", sbmeta_info->digest_scheme);
+    print_info("image sign scheme: %d\n", sbmeta_info->sign_scheme);
+    print_info("image enable encryption: %s\n", sbmeta_info->isencrypted ? "en" : "dis");
+    print_info("image file name: %s\n", sbmeta_info->filename);
+    print_info("image digest:");
+    for (int i = 0; i < digest_size[sbmeta_info->digest_scheme]; i++) {
+        print_info("%02X", sbmeta_info->digest[i]);
+    }
+    print_info("\r\n");
+    
+    return 0;
+}
+
+
+/* Verify image specified in sbmeta_info_t. The image has been loaded to memory before */
+static int sbmeta_verify_image(uint32_t image_load_addr, uint8_t image_type)
+{
+    uint32_t image_size = 0;
+    char *image_name = NULL;
+    
+    /* check image_type to avoid array index out of bounds */
+    if (image_type > IMAGE_TYPE_NUM || image_type < 0) {
+        print_info("Error: image type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+    image_name = image_name_s[image_type];
+
+    /* if image has secure header, do verification. otherwise */
+    if (image_have_head(image_load_addr) == 1) {
+        /* check tee/tf version if needed */
+#ifdef LIGHT_IMG_VERSION_CHECK_IN_BOOT
+        if (image_type == T_TF) {
+            print_info("check TF version in boot \n");
+            if (check_tf_version_in_boot(LIGHT_TF_FW_TMP_ADDR) != 0) {
+                return CMD_RET_FAILURE;
+            }
+        }
+
+        if (image_type == T_TEE) {
+            print_info("check TEE version in boot \n");
+            if (check_tee_version_in_boot(LIGHT_TEE_FW_ADDR) != 0) {
+                return CMD_RET_FAILURE;
+            }
+        }
+#endif
+
+        /* start verifying images */
+        print_info("Process %s image verification ...\n", image_name);
+        dump_image_header_info(image_load_addr);
+        if (image_type == T_UBOOT) {
+            if (csi_sec_uboot_image_verify(image_load_addr, image_load_addr - PUBKEY_HEADER_SIZE) != 0) {
+                print_info("Image(%s) is verified fail, Please go to check!\n\n", image_name);
+                return CMD_RET_FAILURE;
+            }
+        } else {
+            if (csi_sec_custom_image_verify(image_load_addr, UBOOT_STAGE_ADDR) != 0) {
+                print_info("Image(%s) is verified fail, Please go to check!\n\n", image_name);
+                return CMD_RET_FAILURE;
+            }
+        }
+        
+        image_size = get_image_size(image_load_addr);
+        print_info("%s image size: %d\n", image_name, image_size);
+        if (image_size < 0) {
+            print_info("GET %s image size error\n", image_name);
+            return CMD_RET_FAILURE;
+        }
+        
+        /* move image headers always */
+        if (image_type == T_TF) {
+            memmove((void *)LIGHT_TF_FW_ADDR, (const void *)(image_load_addr + HEADER_SIZE), image_size);
+        } else {
+            memmove((void *)image_load_addr, (const void *)(image_load_addr + HEADER_SIZE), image_size);
+        }
+    } else {
+        /* TF should be moved to LIGHT_TF_FW_ADDR all the cases*/
+        if (image_type == T_TF) {
+            /* while image_size is unknown, reload the image */
+            run_command("ext4load mmc 0:3 0x0 trust_firmware.bin", 0);
+        }
+    }
+
+    return 0;
+}
+
+static int light_sbmetaboot(int argc, char *const argv[])
+{
+    int count = 0;
+    uint32_t sbmeta_size = 0;
+    uint32_t info_addr = 0;
+    uint32_t image_load_addr = 0;
+    char cmd[64] = {0};
+    char *image_name = NULL;
+    sbmeta_info_t *sbmeta_info = NULL;
+
+    /* Load sbmeta image to memory */
+    snprintf(cmd, sizeof(cmd), "ext4load mmc %x:%x 0x%p %s", SBMETA_DEV, SBMETA_PART, LIGHT_SBMETA_ADDR, SBMETA_FILENAME);
+    if (run_command(cmd, 0) != 0) {
+        /* if sbmeta doesn't exist, do secboot by default */
+        print_info("SBMETA doesn't exist, go to verify tf/tee\r\n");
+
+        /*
+        * Verify tf and tee by command secboot.
+        * Note that tf and tee has been loaded in "run bootcmd_load"
+        */
+        if (run_command("secboot", 0) != 0) {
+            return CMD_RET_FAILURE;
+        }
+
+        return 0;
+    }
+
+    /* initialize crypto algorithm interfaces */
+    if (csi_sec_init() != 0) {
+        return CMD_RET_FAILURE;
+    }
+
+    /* Check and verify sbmeta image */
+    if (image_have_head(LIGHT_SBMETA_ADDR) == 1) {
+        print_info("Process SBMETA image verification...\r\n");
+        dump_image_header_info(LIGHT_SBMETA_ADDR);
+        if (csi_sec_custom_image_verify(LIGHT_SBMETA_ADDR, UBOOT_STAGE_ADDR) != 0) {
+            print_info("SBMETA is verified fail, Please go to check!\r\n");
+            return CMD_RET_FAILURE;
+        }
+
+        sbmeta_size = get_image_size(LIGHT_SBMETA_ADDR);
+        print_info("sbmeta_size:%d\r\n", sbmeta_size);
+        if (sbmeta_size != SBMETA_SIZE) {
+            print_info("Error: SBMETA header is wrong! Size must equal to %d bytes!\r\n", SBMETA_SIZE);
+            return CMD_RET_FAILURE;
+        }
+        /* move image headers always */
+        memmove((void *)LIGHT_SBMETA_ADDR, (const void *)(LIGHT_SBMETA_ADDR + HEADER_SIZE), sbmeta_size);
+    } else {
+        /* if sbmeta image is not secure, reset */
+        print_info("Error: SBMETA image must be with signature\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* Parse sbmeta_info_t in image sbmeta, then load and verify specified images */
+    info_addr = LIGHT_SBMETA_ADDR;
+    for (count = 0; count < MAX_ENTRY_NUM; count++) {
+        if (is_sbmeta_info(info_addr) == 0) {
+            /* Dump and check sbmeta info */
+            sbmeta_info = (sbmeta_info_t*)info_addr;
+            if (dump_sbmeta_info(sbmeta_info) != 0) {
+                return CMD_RET_FAILURE;
+            }
+
+            image_name = image_name_s[sbmeta_info->image_type];
+            info_addr += ENTRY_SIZE;
+
+            /*
+             * If image_type != T_USER, load to address specified in light-c910.h;
+             * otherwise, load to user-specified address.
+            */
+            if (sbmeta_info->image_type != T_USER) {
+                image_load_addr = image_addrs[sbmeta_info->image_type];
+            } else {
+                image_load_addr = sbmeta_info->relocated_addr;
+            }
+
+            /*
+            * Load image specified in sbmeta info
+            * Note: only load images don't exist in env "bootcmd_load"
+            */
+            if (sbmeta_info->image_type == T_ROOTFS || sbmeta_info->image_type == T_USER) {
+                snprintf(cmd, sizeof(cmd), "ext4load mmc %x:%x %p %s", sbmeta_info->dev,
+                         sbmeta_info->part, \
+                         image_load_addr, sbmeta_info->filename);
+                if (run_command(cmd, 0) != 0) {
+                    return CMD_RET_FAILURE;
+                }
+            }
+
+            /* Check and verify user-specified image */
+            if (sbmeta_verify_image(image_load_addr, sbmeta_info->image_type) != 0) {
+                return CMD_RET_FAILURE;
+            }
+        } else {
+            break;
+        }
+    }
+
+    /* if sbmeta didn't specify images, reset */
+    if (count == 0) {
+        print_info("Error: SBMETA doesn't specify any images!\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* Clear sbmeta buffer in memory */
+    memset((void *)LIGHT_SBMETA_ADDR, 0, PLAIN_SBMETA_TEXT);
+    return 0;
+}
+
+static int do_sbmetaboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+{
+    if (light_sbmetaboot(argc, argv) != 0) {
+        run_command("reset", 0);
+        return -1;
+    }
+
+    return 0;
+}
+
+U_BOOT_CMD(
+    sbmetaboot, CONFIG_SYS_MAXARGS, 1, do_sbmetaboot,
+    "load and verify image sbmeta, then verify image files specified in sbmeta",
+    ""
+);
+#endif
+#endif
diff --git a/board/thead/light-c910/sbmeta/sbmeta.h b/board/thead/light-c910/sbmeta/sbmeta.h
new file mode 100644
index 00000000..4955d758
--- /dev/null
+++ b/board/thead/light-c910/sbmeta/sbmeta.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (C) 2021 Alibaba Group Holding Limited
+ */
+
+#ifndef _LIGHT_SBMETA_H
+#define _LIGHT_SBMETA_H
+
+#include "common.h"
+#include "command.h"
+#include <asm/arch-thead/boot_mode.h>
+
+#define MAX_NAME_SIZE       32
+#define MAX_DIGEST_SIZE     64
+#define SBMETA_MAGIC        0x544D4253  /* = {'S', 'B', 'M', 'T'} */
+
+#if CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_LPI4A)
+#define LIGHT_SBMETA_ADDR   0x10000000
+#endif
+#define SBMETA_DEV          0
+#define SBMETA_PART         6
+#define ENTRY_SIZE          128
+#define PLAIN_SBMETA_TEXT   4096
+#define SBMETA_SIZE         4736  /* 4K SMBETA image + 640 footer */
+#define MAX_ENTRY_NUM       PLAIN_SBMETA_TEXT / ENTRY_SIZE  /* 4K/128=32 */
+#define IMAGE_TYPE_NUM      7
+#define DIGEST_TYPE_NUM     8
+#define SIGN_TYPE_NUM       6
+#define T_USER              7
+#define SBMETA_FILENAME     "sbmeta.bin"
+
+typedef struct {
+    int         magiccode;
+    uint8_t     dev;
+    uint8_t     part;
+    uint8_t     image_type;
+    uint8_t     digest_scheme;
+    uint8_t     sign_scheme;
+    uint8_t     isencrypted;
+    uint8_t     medium_type;
+    uint8_t     reserve0;
+    char        filename[MAX_NAME_SIZE];
+    uint8_t     digest[MAX_DIGEST_SIZE];
+    uint32_t    relocated_addr;
+    uint32_t    reserved[4];
+} sbmeta_info_t;
+
+#endif
diff --git a/board/thead/light-c910/secimg_load.c b/board/thead/light-c910/secimg_load.c
index f5f1111e..49b8262d 100644
--- a/board/thead/light-c910/secimg_load.c
+++ b/board/thead/light-c910/secimg_load.c
@@ -15,7 +15,7 @@
 #define RPMB_BLOCK_SIZE 256
 #define RPMB_ROLLBACK_BLOCK_START 1
 
-#ifndef LIGHT_KDF_RPMB_KEYs
+#ifndef LIGHT_KDF_RPMB_KEY
 static const unsigned char emmc_rpmb_key_sample[32] = {0x33, 0x22, 0x11, 0x00, 0x77, 0x66, 0x55, 0x44, \
 												0xbb, 0xaa, 0x99, 0x88, 0xff, 0xee, 0xdd, 0xcc, \
 												0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, \
@@ -121,7 +121,7 @@ bool get_system_boot_type(void)
 	int lc = 0;
 	sboot_st_t sb_flag = SECURE_BOOT_DIS;
 	int ret = 0;
-
+# if 0
 	ret = csi_efuse_get_lc(&lc);
 	/* 0: LC_INIT, 1: LC_DEV, 2: LC_OEM, 3: LC_PRO */
 	if ((ret == 0) && (lc != 0)) {
@@ -134,7 +134,7 @@ bool get_system_boot_type(void)
 
 		csi_efuse_api_uninit();
 	}
-
+#endif
 	return btype;
 }
 
diff --git a/cmd/bootandroid.c b/cmd/bootandroid.c
index 48fa21fb..fbd43546 100644
--- a/cmd/bootandroid.c
+++ b/cmd/bootandroid.c
@@ -19,8 +19,8 @@
 #define ENV_RAMDISK_ADDR "ramdisk_addr"
 #define ENV_DTB_ADDR     "dtb_addr"
 #define DEFAULT_KERNEL_ADDR  0x00200800
-#define DEFAULT_RAMDISK_ADDR 0x02000000
-#define DEFAULT_DTB_ADDR     0x01f00000
+#define DEFAULT_RAMDISK_ADDR LIGHT_ROOTFS_ADDR
+#define DEFAULT_DTB_ADDR     LIGHT_DTB_ADDR
 #define ENV_RAMDISK_SIZE "ramdisk_size"
 #define MISC_PARTITION "misc"
 #define RECOVERY_PARTITION "recovery"
@@ -49,7 +49,35 @@ static const char *slot_name_suffix = NULL;;
 #define BOOT_IMAGE_HEADER_V3_PAGESIZE 4096
 
 static struct AvbOps *avb_ops = NULL;
-static struct bootloader_message* s_bcb = NULL;
+static struct bootloader_message_ab *s_bcb = NULL;
+static struct bootloader_control *boot_ctl = NULL;
+
+static char *get_boot_partition_name_suffix(void)
+{
+#ifdef CONFIG_ANDROID_AB
+    if (boot_ctl != NULL) {
+		/* index 0 is _a, index 1 is _b*/
+		if(boot_ctl->slot_info[0].priority < boot_ctl->slot_info[1].priority) {
+			strcpy(boot_ctl->slot_suffix, "_b");
+		} else {
+			strcpy(boot_ctl->slot_suffix, "_a");
+		}
+	} else {
+		printf("get_slot_suffix boot_ctl is null return _a");
+		return "_a";
+	}
+	printf("get_slot_suffix boot_ctl->slot_suffix %s\r\n", boot_ctl->slot_suffix);
+	return boot_ctl->slot_suffix;
+#else
+	return "";
+#endif
+}
+
+static void get_partition_name(const char *partion, char *partion_name)
+{
+	strcpy(partion_name, partion);
+	strcat(partion_name, get_boot_partition_name_suffix());
+}
 
 /*
  *format 4 chars/bytes to a int number
@@ -87,8 +115,8 @@ static int prepare_data_from_vendor_boot(struct andr_img_hdr *hdr, int dtb_start
 	/* if the vendor boot partition name is beyond 32B, arise error */
 	if ((32 - strlen(VENDOR_BOOT_PARTITION)) < 2)
 		return -1;
-	memcpy(vb_part_name, VENDOR_BOOT_PARTITION, strlen(VENDOR_BOOT_PARTITION));
-	strcat(vb_part_name, slot_name_suffix);
+	
+    get_partition_name(VENDOR_BOOT_PARTITION, vb_part_name);
 
 	printf("blk_get_dev %s\n", vb_part_name);
 	if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
@@ -102,11 +130,11 @@ static int prepare_data_from_vendor_boot(struct andr_img_hdr *hdr, int dtb_start
 		return -1;
 	}
 
-	vendor_boot_data = avb_malloc(part_info.size * part_info.blksz);
-	if (vendor_boot_data == NULL) {
-		printf("vendor boot data malloc fail \n");
-		return -1;
-	}
+    if (part_info.size * part_info.blksz > CONFIG_FASTBOOT_BUF_SIZE) {
+        return -1;
+    }
+    vendor_boot_data = (uint8_t*)CONFIG_FASTBOOT_BUF_ADDR;
+
 	ret = blk_dread(dev_desc, part_info.start, part_info.size, vendor_boot_data);
 	// vendor_boot.img
 	//* +------------------------+
@@ -170,15 +198,23 @@ static int prepare_data_from_vendor_boot(struct andr_img_hdr *hdr, int dtb_start
 	*buf_bootconfig = avb_malloc(*vendor_bootconfig_size);
 	if (*buf_bootconfig == NULL) {
 		printf("vendor bootconfig malloc fail\n");
-		if (vendor_boot_data != NULL)
-			avb_free(vendor_boot_data);
 		return -1;
 	}
 	int bootconfig_offset=vendor_boot_pagesize * (o + p + q + r);
 	memcpy(*buf_bootconfig, vendor_boot_data + bootconfig_offset, *vendor_bootconfig_size);
 
-	if (vendor_boot_data != NULL)
-		avb_free(vendor_boot_data);
+#ifdef CONFIG_ANDROID_AB
+	char *find_str = NULL;
+	char *slot_suffix = get_boot_partition_name_suffix();
+    char *slot_suffx_pre = "androidboot.slot_suffix=";
+	printf("prepare_data_from_vendor_boot slot_suffix:%s\n", slot_suffix);
+    printf("prepare_data_from_vendor_boot slot_suffx_pre:%s\n", slot_suffx_pre);
+
+	find_str = strstr((char *)*buf_bootconfig, slot_suffx_pre);
+    if (find_str != NULL) {
+		memcpy(find_str + strlen(slot_suffx_pre), slot_suffix, strlen(slot_suffix));
+	}
+#endif
 
 	return 0;
 }
@@ -307,7 +343,7 @@ static void clear_bcb(void)
 	struct blk_desc *dev_desc  = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 
 	//bcb clear and store
-	memset(s_bcb, 0, sizeof(struct bootloader_message));
+	memset(s_bcb, 0, sizeof(struct bootloader_message_ab));
 
 	if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 		printf("BootAndriod bcb err: invalid mmc device\n");
@@ -324,22 +360,48 @@ static void clear_bcb(void)
 	printf("BootAndriod bcb info :clear_bcb write=%d, %ld,%ld,%ld\n", ret, part_info.start, part_info.size, part_info.blksz);
 }
 
-static int do_andriod_bcb_business(struct AvbOps *avb_ops, struct bootloader_message* s_bcb)
+static int do_andriod_bcb_business(void)
 {
 	AvbIOResult ret = AVB_IO_RESULT_OK;
 	size_t bytes_read = 0;
 	int res = CMD_RET_FAILURE;
 
-	s_bcb = avb_malloc(sizeof(struct bootloader_message));
+    if (avb_ops != NULL) {
+        avb_ops_free(avb_ops);
+        avb_ops = NULL;
+    }
+
+    avb_ops = avb_ops_alloc(BOOTDEV_DEFAULT);
+    if (avb_ops == NULL) {
+        goto _bcb_err;
+    }
+
+    if (s_bcb != NULL) {
+        avb_free(s_bcb);
+        s_bcb = NULL;
+    }
+
+	s_bcb = avb_malloc(sizeof(struct bootloader_message_ab));
 	if (s_bcb == NULL) {
-		printf("BootAndriod Err: Failed to initialize bcb\n");
+		goto _bcb_err;
+	}
+
+    if (boot_ctl != NULL) {
+        avb_free(boot_ctl);
+        boot_ctl = NULL;
+    }
+
+    boot_ctl = malloc(sizeof(struct bootloader_control));
+	if (boot_ctl == NULL)
+	{
+        ret = -2;
 		goto _bcb_err;
 	}
 
 	ret = avb_ops->read_from_partition(avb_ops,
 										MISC_PARTITION,
 										0,
-										sizeof(struct bootloader_message),
+										sizeof(struct bootloader_message_ab),
 										s_bcb,
 										&bytes_read);
 	if (ret != AVB_IO_RESULT_OK) {
@@ -348,39 +410,40 @@ static int do_andriod_bcb_business(struct AvbOps *avb_ops, struct bootloader_mes
 	}
 
 	/* Enter into fastboot mode if bcb string is bootonce or bootrecovery */
-	if (0 == strncmp(s_bcb->command, BCB_BOOTONCE, strlen(BCB_BOOTONCE))|| \
-	    0 == strncmp(s_bcb->command, BCB_BOOTRECOVERY, strlen(BCB_BOOTRECOVERY))) {
-		printf("BootAndriod Info: Bcb read %ld bytes, %s\n", bytes_read, s_bcb->command);
+	if (0 == strncmp(s_bcb->message.command, BCB_BOOTONCE, strlen(BCB_BOOTONCE))|| \
+	    0 == strncmp(s_bcb->message.command, BCB_BOOTRECOVERY, strlen(BCB_BOOTRECOVERY))) {
+		printf("BootAndriod Info: Bcb read %ld bytes, %s\n", bytes_read, s_bcb->message.command);
 		printf("BootAndriod Info: Enter fastboot mode\n");
 		clear_bcb();
 		run_command("fastboot usb 0", 0);
 	}
 
+    memset(boot_ctl, 0, sizeof(struct bootloader_control));
+    memcpy(boot_ctl, (struct bootloader_control*)s_bcb->slot_suffix, sizeof(struct bootloader_control));
+
 	res = CMD_RET_SUCCESS;
 
 _bcb_err:
-	if (s_bcb != NULL)
-		avb_free(s_bcb);
+	if (res != CMD_RET_SUCCESS) {
+        if (avb_ops != NULL) {
+            avb_ops_free(avb_ops);
+            avb_ops = NULL;
+        }
+
+		if (boot_ctl != NULL) {
+            avb_free(boot_ctl);
+            boot_ctl = NULL;
+        }
+
+        if (s_bcb != NULL) {
+            avb_free(s_bcb);
+            s_bcb = NULL;
+        }
+    }
 
 	return res;
 }
 
-static const char *get_boot_partition_name_suffix(void)
-{
-#if defined (CONFIG_ANDROID_AB)
-	char *slot_suffix = "_a";
-#else
-	char *slot_suffix = "";
-#endif
-
-	char *tmp = NULL;
-	tmp = env_get("boot_ab");
-	if (tmp != NULL)
-		slot_suffix = tmp;
-
-	return slot_suffix;
-}
-
 static int do_bootandroid(struct cmd_tbl_s *cmdtp, int flag, int argc,
 						char * const argv[]) {
 	
@@ -391,23 +454,18 @@ static int do_bootandroid(struct cmd_tbl_s *cmdtp, int flag, int argc,
 	AvbSlotVerifyFlags slotflags = AVB_SLOT_VERIFY_FLAGS_NONE;
 	AvbHashtreeErrorMode htflags = AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE;
 	int res = CMD_RET_FAILURE;
+    char bp_name[32] = {0};
+
+    res = do_andriod_bcb_business();
+    if (res != CMD_RET_SUCCESS) {
+        goto exit;
+    }
 
 	/* Retieve boot partition 's name suffix */
 	slot_name_suffix = get_boot_partition_name_suffix();
 
 	/* Start with slot verification in secure boot */
 	if (get_system_boot_type()) {
-
-		avb_ops = avb_ops_alloc(BOOTDEV_DEFAULT);
-		if (avb_ops == NULL) {
-			goto _ba_err;
-		}
-
-		res = do_andriod_bcb_business(avb_ops, s_bcb);
-		if (res != CMD_RET_SUCCESS) {
-			goto _ba_err;
-		}
-				
 		/* Verify boot partition requested in vbmeta.img */
 		slot_result = avb_slot_verify(avb_ops,
 									  requested_partitions,
@@ -428,19 +486,13 @@ static int do_bootandroid(struct cmd_tbl_s *cmdtp, int flag, int argc,
 			/* In case of avb slot verification failure, Force system reset */
 			run_command("reset", 0);
 		}
-_ba_err:
-		if (avb_ops)
-			avb_ops_free(avb_ops);
-
 	} else {
-	/* Go to load BOOT partition directly in non-secure boot */
-		char bp_name[32] = {0};
-		
-		strcat(bp_name, BOOT_PARTITION);
-		strcat(bp_name, slot_name_suffix);
+	/* Go to load BOOT partition directly in non-secure boot */		
+        get_partition_name(BOOT_PARTITION, bp_name);
 		prepare_partition_data(bp_name);
 	}
-
+    
+exit:
 	return res;
 }
 
diff --git a/configs/light_a_val_android_defconfig b/configs/light_a_val_android_defconfig
index 81489ac8..4ac4bedb 100644
--- a/configs/light_a_val_android_defconfig
+++ b/configs/light_a_val_android_defconfig
@@ -101,6 +101,7 @@ CONFIG_PMIC_VOL_INIT=y
 CONFIG_DDR_REGU_0V6=600000
 CONFIG_DDR_REGU_0V8=800000
 CONFIG_DDR_REGU_1V1=1100000
+CONFIG_SPL_TEXT_BASE=0xffe0000800
 CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_A=y
 # CONFIG_AVB_USE_OEM_KEY is not set
 # CONFIG_AVB_ROLLBACK_ENABLE is not set
diff --git a/configs/light_b_product_android_defconfig b/configs/light_b_product_android_defconfig
index 80a20f3f..777e3d55 100644
--- a/configs/light_b_product_android_defconfig
+++ b/configs/light_b_product_android_defconfig
@@ -105,8 +105,11 @@ CONFIG_PMIC_VOL_INIT=y
 CONFIG_DDR_REGU_0V6=600000
 CONFIG_DDR_REGU_0V8=800000
 CONFIG_DDR_REGU_1V1=1100000
+CONFIG_SPL_TEXT_BASE=0xffe0000800
 CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_B=y
-CONFIG_AVB_USE_OEM_KEY=y
+# CONFIG_AVB_USE_OEM_KEY is not set
+# CONFIG_AVB_ROLLBACK_ENABLE is not set
+# CONFIG_AVB_HW_ENGINE_ENABLE is not set
 CONFIG_ANDROID_BOOT_IMAGE=y
 CONFIG_LIBAVB=y
 CONFIG_AVB_VERIFY=y
diff --git a/configs/light_lpi4a_android_defconfig b/configs/light_lpi4a_android_defconfig
index 67b6d488..3f161fbf 100644
--- a/configs/light_lpi4a_android_defconfig
+++ b/configs/light_lpi4a_android_defconfig
@@ -101,6 +101,11 @@ CONFIG_PMIC_VOL_INIT=y
 CONFIG_DDR_REGU_0V6=600000
 CONFIG_DDR_REGU_0V8=800000
 CONFIG_DDR_REGU_1V1=1100000
+CONFIG_SPL_TEXT_BASE=0xffe0000800
+CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_B=y
+# CONFIG_AVB_USE_OEM_KEY is not set
+# CONFIG_AVB_ROLLBACK_ENABLE is not set
+# CONFIG_AVB_HW_ENGINE_ENABLE is not set
 CONFIG_ANDROID_BOOT_IMAGE=y
 CONFIG_LIBAVB=y
 CONFIG_AVB_VERIFY=y
diff --git a/drivers/fastboot/fb_command.c b/drivers/fastboot/fb_command.c
index 4b081668..9dc70beb 100644
--- a/drivers/fastboot/fb_command.c
+++ b/drivers/fastboot/fb_command.c
@@ -14,6 +14,7 @@
 #include <stdlib.h>
 
 #define BLOCK_SIZE 512
+#define BOARD_ID_OFFSET 0x26
 
 /**
  * image_size - final fastboot image size
@@ -42,6 +43,7 @@ static void reboot_bootloader(char *, char *);
 static void oem_format(char *, char *);
 #endif
 static void oem_command(char *, char *);
+int image_have_head(unsigned long img_src_addr);
 
 static const struct {
 	const char *command;
@@ -263,6 +265,41 @@ void fastboot_data_complete(char *response)
 	fastboot_bytes_received = 0;
 }
 
+/**
+ * check_image_board_id() - check if board id in image matched with board id in env 
+ *
+ * @image_data: Image data
+ *
+ * 0 if success otherwise failed
+ */
+int check_image_board_id(uint8_t *image_data)
+{
+	char *env_board_id = NULL;
+    char board_id[3] = {0};
+
+	env_board_id = env_get("board#");
+
+	/*if current board id is null or image has no header,skip check*/
+	if (env_board_id == NULL || env_board_id[0] == 0 || image_have_head((unsigned long)image_data) == 0) {
+		return 0;
+	}
+
+	memcpy(board_id, image_data + BOARD_ID_OFFSET,sizeof(uint16_t));
+
+    /*if image board id is null,skip check*/
+    if (*(uint16_t*)board_id == 0) {
+        return 0;
+	}
+
+    /*check if current board id match with board id in image*/
+	if (strncmp(env_board_id, board_id, sizeof(board_id)) != 0) {
+	    printf("U-BOOT image download via fastboot is interrupted due to the U-BOOT for board %s does not work in the board %s\r\n",board_id,env_board_id);
+		return -1;
+	}
+
+	return 0;
+}
+
 #if CONFIG_IS_ENABLED(FASTBOOT_FLASH)
 /**
  * flash() - write the downloaded image to the indicated partition.
@@ -279,8 +316,15 @@ static void flash(char *cmd_parameter, char *response)
 	char cmdbuf[32];
 	u32 block_cnt;
 	struct blk_desc *dev_desc;
+    int ret = 0;
 
 	if (strcmp(cmd_parameter, "uboot") == 0) {
+        ret = check_image_board_id(fastboot_buf_addr);
+		if (ret != 0) {
+            fastboot_fail("U-BOOT image does not match the type of BOARD", response);
+			return;
+		}
+
 		dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 		if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 			fastboot_fail("invalid mmc device", response);
@@ -298,7 +342,6 @@ static void flash(char *cmd_parameter, char *response)
 
 		run_command(cmdbuf, 0);
 		run_command("mmc partconf 0 1 0 0", 0);
-
 	} else if ((strcmp(cmd_parameter, "fw") == 0)) {
 		memcpy((void *)LIGHT_FW_ADDR, fastboot_buf_addr, image_size);
 	} else if ((strcmp(cmd_parameter, "uImage") == 0)) {
diff --git a/include/configs/light-c910.h b/include/configs/light-c910.h
index 7f6bbc9d..eb4fff54 100644
--- a/include/configs/light-c910.h
+++ b/include/configs/light-c910.h
@@ -23,7 +23,7 @@
 #define CONFIG_SYS_INIT_SP_ADDR     (CONFIG_SYS_TEXT_BASE + SZ_1M)
 #define CONFIG_SYS_LOAD_ADDR        (CONFIG_SYS_TEXT_BASE + SZ_1M)
 #ifdef CONFIG_ANDROID_BOOT_IMAGE
-#define CONFIG_SYS_MALLOC_LEN       (128*SZ_1M)
+#define CONFIG_SYS_MALLOC_LEN       (64*SZ_1M)
 #else
 #define CONFIG_SYS_MALLOC_LEN       SZ_1M
 #endif
@@ -63,14 +63,14 @@
 #define THEAD_LIGHT_FASTBOOT	1
 #define LIGHT_FW_ADDR		0x0
 #define LIGHT_KERNEL_ADDR	0x200000
-#define LIGHT_DTB_ADDR		0x2800000
+#define LIGHT_DTB_ADDR		0x3800000
 #define LIGHT_ROOTFS_ADDR	0x2000000
 #define LIGHT_AON_FW_ADDR	0xffffef8000
 #define LIGHT_TEE_FW_ADDR	0x1c000000
 #define LIGHT_TF_FW_ADDR	LIGHT_FW_ADDR
 #define LIGHT_TF_FW_TMP_ADDR	0x100000
 #define LIGHT_KERNEL_ADDR_CMD	"0x200000"
-#define LIGHT_DTB_ADDR_CMD	"0x2800000"
+#define LIGHT_DTB_ADDR_CMD	"0x3800000"
 
 
 /* trust image name string */
@@ -115,6 +115,7 @@
 #if defined (U_BUILD_DEBUG)
 #define ENV_KERNEL_LOGLEVEL "kernel_loglevel=7\0"
 #define ENV_STR_BOOT_DELAY
+#define CONFIG_ENV_OVERWRITE
 #else
 #define ENV_KERNEL_LOGLEVEL "kernel_loglevel=4\0"
 #define ENV_STR_BOOT_DELAY	"bootdelay=0\0"
@@ -122,20 +123,25 @@
 
 #define CONFIG_MISC_INIT_R
 
+#define ENV_STR_BOARD "board#=LP\0"
+
 #define CONFIG_EXTRA_ENV_SETTINGS \
 	"scriptaddr=0x00500000\0" \
 	"pxefile_addr_r=0x00600000\0" \
-	"fdt_addr_r=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
+    "fdt_addr=0x03800000\0" \
 	"kernel_addr_r=0x00200000\0" \
 	"ramdisk_addr_r=0x06000000\0" \
 	"boot_conf_addr_r=0xc0000000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
+    "str_ram_addr=0xffe0000000\0" \
 	"opensbi_addr=0x0\0" \
 	"fwaddr=0x10000000\0" \
 	"splashimage=0x30000000\0" \
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
+    ENV_STR_BOARD \
 	"kernel_addr_r=0x00200000\0" \
 	"kdump_buf=180M\0" \
 	"mmcdev=0\0" \
@@ -152,4 +158,4 @@
 	"fdtfile=" CONFIG_DEFAULT_FDT_FILE "\0" \
 	"\0"
 
-#endif /* __CONFIG_H */
+#endif /* __CONFIG_H */
\ No newline at end of file
diff --git a/include/env_flags.h b/include/env_flags.h
index 725841a8..7b8bf7b7 100644
--- a/include/env_flags.h
+++ b/include/env_flags.h
@@ -70,11 +70,18 @@ enum env_flags_varaccess {
 #define SERIAL_FLAGS ""
 #endif
 
+#ifndef CONFIG_ENV_OVERWRITE
+#define BOARD_FLAGS "board#:so,"
+#else
+#define BOARD_FLAGS ""
+#endif
+
 #define ENV_FLAGS_LIST_STATIC \
 	ETHADDR_FLAGS \
 	NET_FLAGS \
 	SERIAL_FLAGS \
-	CONFIG_ENV_FLAGS_LIST_STATIC
+	CONFIG_ENV_FLAGS_LIST_STATIC \
+    BOARD_FLAGS
 
 #ifdef CONFIG_CMD_ENV_FLAGS
 /*