Linux_SDK_V1.3.3

Signed-off-by: thead_admin <occ_thead@service.alibaba.com>
2026-06-21 17:12:31 +02:00 · 2023-12-24 19:19:50 +08:00
15 changed files with 615 additions and 108 deletions
--- a/board/thead/light-c910/Makefile
+++ b/board/thead/light-c910/Makefile
@@ -60,6 +60,7 @@ obj-$(CONFIG_THEAD_LIGHT_DIGITAL_SENSOR) += digital_sensor.o digital_sensor_test
 obj-y += clock_config.o
 obj-y += sec_check.o
 obj-y += boot.o
+obj-y += sbmeta/sbmeta.o
 ifndef CONFIG_TARGET_LIGHT_FPGA_FM_C910
 obj-$(CONFIG_LPDDR) += $(DDR_SRC_PATH)/ddr_common_func.o
 obj-$(CONFIG_LPDDR) += $(DDR_SRC_PATH)/common_lib.o
--- a/board/thead/light-c910/boot.c
+++ b/board/thead/light-c910/boot.c
@@ -709,10 +709,12 @@ void sec_firmware_version_dump(void)
 	tf_ver_env = env_get_hex("tf_version", 0);
 	if ((tee_ver_env != tee_ver) && (tee_ver != 0)) {
 		env_set_hex("tee_version", tee_ver);
+		run_command("saveenv", 0);
 	}

 	if ((tf_ver_env != tf_ver) && (tf_ver != 0)) {
 		env_set_hex("tf_version", tf_ver);
+		run_command("saveenv", 0);
 	}

 	printf("\n\n");
--- a/board/thead/light-c910/clock_config.c
+++ b/board/thead/light-c910/clock_config.c
@@ -1306,7 +1306,7 @@ int clk_config(void)

 #if defined (CONFIG_TARGET_LIGHT_FM_C910_VAL_ANT_DISCRETE) || defined (CONFIG_TARGET_LIGHT_FM_C910_BEAGLE) || defined (CONFIG_TARGET_LIGHT_FM_C910_B_REF) || defined (CONFIG_TARGET_LIGHT_FM_C910_VAL_ANT_REF) || defined (CONFIG_TARGET_LIGHT_FM_C910_B_POWER) || defined (CONFIG_TARGET_LIGHT_FM_C910_VAL_B) || defined (CONFIG_TARGET_LIGHT_FM_C910_LPI4A)
 	ap_multimedia_div_num_set(VI_MIPI_CSI0_DIV, 12); /* Input frquency: 2376MHZ */
-	ap_multimedia_div_num_set(VI_ISP0_CORE_DIV, 15); /* Input frquency: 2376MHZ */
+	ap_multimedia_div_num_set(VI_ISP0_CORE_DIV, 12); /* Input frquency: 2376MHZ */
 	ap_multimedia_div_num_set(VI_ISP1_CORE_DIV, 12); /* Input frquency: 2376MHZ */
 	ap_multimedia_div_num_set(VI_ISP_RY_CORE_DIV, 12); /* Input frquency: 2376MHZ */
 	ap_multimedia_div_num_set(VO_DPU_CORE_DIV, 4);	/* Input frquency: 2376MHZ */
--- a/board/thead/light-c910/light.c
+++ b/board/thead/light-c910/light.c
@@ -31,6 +31,7 @@
 #define GMAC0_APB3S_BADDR	0xffec003000
 #define GMAC1_APB3S_BADDR	0xffec004000
 static uint64_t apb3s_baddr;
+extern int check_image_board_id(uint8_t *image_data);

 typedef enum {
 	UART0_TXD = PAD_GRP_BASE_SET(SOC_PIN_AP_RIGHT_TOP),
@@ -1862,10 +1863,18 @@ static void light_usb_boot_check(void)
 	uchar env_enetaddr[6]={0};
 	uchar env_enet1addr[6]={0};
 	int env_ethaddr_flag,env_eth1addr_flag;
+    int ret = 0;
+
 	boot_mode = readl((void *)SOC_OM_ADDRBASE) & 0x7;
 	if (boot_mode & BIT(2))
 		return;

+    /*check board id of uboot image*/
+	ret = check_image_board_id((uint8_t*)SRAM_BASE_ADDR);
+	if (ret != 0) {
+	    while(1);
+	}
+
 #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG
 	env_set("usb_fastboot", "yes");
 #endif
--- a/board/thead/light-c910/sbmeta/sbmeta.c
+++ b/board/thead/light-c910/sbmeta/sbmeta.c
@@ -0,0 +1,296 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (C) 2021 Alibaba Group Holding Limited
+ */
+
+#include "sbmeta.h"
+
+#define NO_DEBUG 0
+#if NO_DEBUG
+#define print_info(fmt, args...)
+#else
+#define print_info(fmt, args...)    printf(fmt, ##args)
+#endif
+
+#if CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_LPI4A)
+#if CONFIG_IS_ENABLED(LIGHT_SEC_UPGRADE)
+/* digest_size corresponding to digest_scheme specified in sbmeta_info_t */
+static const int digest_size[] = {0, 20, 16, 28, 32, 48, 64, 32, 64};
+static const char* image_name_s[] = {
+    "dtb", "kernel", "tf", "aon", "rootfs", "tee", "uboot", "user"
+};
+
+static const uint32_t image_addrs[] = {
+    LIGHT_DTB_ADDR,
+    LIGHT_KERNEL_ADDR,
+    LIGHT_TF_FW_TMP_ADDR,
+    LIGHT_AON_FW_ADDR,
+    LIGHT_ROOTFS_ADDR,
+    LIGHT_TEE_FW_ADDR,
+    CONFIG_SYS_TEXT_BASE,
+};
+
+static int is_sbmeta_info(uint32_t entry_src_addr)
+{
+    uint32_t *buffer = (uint32_t *)entry_src_addr;
+
+    /* sbmeta_info_t entry should start with magic code 'S''B''M''T' */
+    if (*buffer != SBMETA_MAGIC) {
+        return -1;
+    }
+
+    return 0;
+}
+
+static int dump_sbmeta_info(sbmeta_info_t *sbmeta_info)
+{
+    if (sbmeta_info == NULL) {
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support emmc now */
+    if (sbmeta_info->medium_type != 0) {
+        print_info("Error: medium type %s is not supported now\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support dtb, krlimg/tf, sbi, aon, rootfs, tee, uboot and user-defined type */
+    if (sbmeta_info->image_type > IMAGE_TYPE_NUM || sbmeta_info->image_type < 0) {
+        print_info("Error: image type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support none, sha1, md5, sha224, sha256, sha384, sha512, sm3 and reserved scheme */
+    if (sbmeta_info->digest_scheme > DIGEST_TYPE_NUM || sbmeta_info->digest_scheme < 0) {
+        print_info("Error: digest type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* only support none, rsa1024, rsa2048, ecc256, ecc160, sm2 and reserved scheme */
+    if (sbmeta_info->sign_scheme > SIGN_TYPE_NUM || sbmeta_info->sign_scheme < 0) {
+        print_info("Error: signature type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* DTB, TF, TEE, Kernel will be loaded from default partitions specified in env */
+    if (sbmeta_info->image_type != T_ROOTFS && sbmeta_info->image_type != T_USER) {
+        print_info("Image has been loaded\r\n");
+    }
+
+    /* dump sbmeta_info_t */
+    print_info("image medium type: %d\n", sbmeta_info->medium_type);
+    print_info("image load part: mmc %d:%d\n", sbmeta_info->dev, sbmeta_info->part);
+    print_info("image type: %d \n", sbmeta_info->image_type);
+    print_info("image digest scheme: %d\n", sbmeta_info->digest_scheme);
+    print_info("image sign scheme: %d\n", sbmeta_info->sign_scheme);
+    print_info("image enable encryption: %s\n", sbmeta_info->isencrypted ? "en" : "dis");
+    print_info("image file name: %s\n", sbmeta_info->filename);
+    print_info("image digest:");
+    for (int i = 0; i < digest_size[sbmeta_info->digest_scheme]; i++) {
+        print_info("%02X", sbmeta_info->digest[i]);
+    }
+    print_info("\r\n");
+    
+    return 0;
+}
+
+
+/* Verify image specified in sbmeta_info_t. The image has been loaded to memory before */
+static int sbmeta_verify_image(uint32_t image_load_addr, uint8_t image_type)
+{
+    uint32_t image_size = 0;
+    char *image_name = NULL;
+    
+    /* check image_type to avoid array index out of bounds */
+    if (image_type > IMAGE_TYPE_NUM || image_type < 0) {
+        print_info("Error: image type is out of range\r\n");
+        return CMD_RET_FAILURE;
+    }
+    image_name = image_name_s[image_type];
+
+    /* if image has secure header, do verification. otherwise */
+    if (image_have_head(image_load_addr) == 1) {
+        /* check tee/tf version if needed */
+#ifdef LIGHT_IMG_VERSION_CHECK_IN_BOOT
+        if (image_type == T_TF) {
+            print_info("check TF version in boot \n");
+            if (check_tf_version_in_boot(LIGHT_TF_FW_TMP_ADDR) != 0) {
+                return CMD_RET_FAILURE;
+            }
+        }
+
+        if (image_type == T_TEE) {
+            print_info("check TEE version in boot \n");
+            if (check_tee_version_in_boot(LIGHT_TEE_FW_ADDR) != 0) {
+                return CMD_RET_FAILURE;
+            }
+        }
+#endif
+
+        /* start verifying images */
+        print_info("Process %s image verification ...\n", image_name);
+        dump_image_header_info(image_load_addr);
+        if (image_type == T_UBOOT) {
+            if (csi_sec_uboot_image_verify(image_load_addr, image_load_addr - PUBKEY_HEADER_SIZE) != 0) {
+                print_info("Image(%s) is verified fail, Please go to check!\n\n", image_name);
+                return CMD_RET_FAILURE;
+            }
+        } else {
+            if (csi_sec_custom_image_verify(image_load_addr, UBOOT_STAGE_ADDR) != 0) {
+                print_info("Image(%s) is verified fail, Please go to check!\n\n", image_name);
+                return CMD_RET_FAILURE;
+            }
+        }
+        
+        image_size = get_image_size(image_load_addr);
+        print_info("%s image size: %d\n", image_name, image_size);
+        if (image_size < 0) {
+            print_info("GET %s image size error\n", image_name);
+            return CMD_RET_FAILURE;
+        }
+        
+        /* move image headers always */
+        if (image_type == T_TF) {
+            memmove((void *)LIGHT_TF_FW_ADDR, (const void *)(image_load_addr + HEADER_SIZE), image_size);
+        } else {
+            memmove((void *)image_load_addr, (const void *)(image_load_addr + HEADER_SIZE), image_size);
+        }
+    } else {
+        /* TF should be moved to LIGHT_TF_FW_ADDR all the cases*/
+        if (image_type == T_TF) {
+            /* while image_size is unknown, reload the image */
+            run_command("ext4load mmc 0:3 0x0 trust_firmware.bin", 0);
+        }
+    }
+
+    return 0;
+}
+
+static int light_sbmetaboot(int argc, char *const argv[])
+{
+    int count = 0;
+    uint32_t sbmeta_size = 0;
+    uint32_t info_addr = 0;
+    uint32_t image_load_addr = 0;
+    char cmd[64] = {0};
+    char *image_name = NULL;
+    sbmeta_info_t *sbmeta_info = NULL;
+
+    /* Load sbmeta image to memory */
+    snprintf(cmd, sizeof(cmd), "ext4load mmc %x:%x 0x%p %s", SBMETA_DEV, SBMETA_PART, LIGHT_SBMETA_ADDR, SBMETA_FILENAME);
+    if (run_command(cmd, 0) != 0) {
+        /* if sbmeta doesn't exist, do secboot by default */
+        print_info("SBMETA doesn't exist, go to verify tf/tee\r\n");
+
+        /*
+        * Verify tf and tee by command secboot.
+        * Note that tf and tee has been loaded in "run bootcmd_load"
+        */
+        if (run_command("secboot", 0) != 0) {
+            return CMD_RET_FAILURE;
+        }
+
+        return 0;
+    }
+
+    /* initialize crypto algorithm interfaces */
+    if (csi_sec_init() != 0) {
+        return CMD_RET_FAILURE;
+    }
+
+    /* Check and verify sbmeta image */
+    if (image_have_head(LIGHT_SBMETA_ADDR) == 1) {
+        print_info("Process SBMETA image verification...\r\n");
+        dump_image_header_info(LIGHT_SBMETA_ADDR);
+        if (csi_sec_custom_image_verify(LIGHT_SBMETA_ADDR, UBOOT_STAGE_ADDR) != 0) {
+            print_info("SBMETA is verified fail, Please go to check!\r\n");
+            return CMD_RET_FAILURE;
+        }
+
+        sbmeta_size = get_image_size(LIGHT_SBMETA_ADDR);
+        print_info("sbmeta_size:%d\r\n", sbmeta_size);
+        if (sbmeta_size != SBMETA_SIZE) {
+            print_info("Error: SBMETA header is wrong! Size must equal to %d bytes!\r\n", SBMETA_SIZE);
+            return CMD_RET_FAILURE;
+        }
+        /* move image headers always */
+        memmove((void *)LIGHT_SBMETA_ADDR, (const void *)(LIGHT_SBMETA_ADDR + HEADER_SIZE), sbmeta_size);
+    } else {
+        /* if sbmeta image is not secure, reset */
+        print_info("Error: SBMETA image must be with signature\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* Parse sbmeta_info_t in image sbmeta, then load and verify specified images */
+    info_addr = LIGHT_SBMETA_ADDR;
+    for (count = 0; count < MAX_ENTRY_NUM; count++) {
+        if (is_sbmeta_info(info_addr) == 0) {
+            /* Dump and check sbmeta info */
+            sbmeta_info = (sbmeta_info_t*)info_addr;
+            if (dump_sbmeta_info(sbmeta_info) != 0) {
+                return CMD_RET_FAILURE;
+            }
+
+            image_name = image_name_s[sbmeta_info->image_type];
+            info_addr += ENTRY_SIZE;
+
+            /*
+             * If image_type != T_USER, load to address specified in light-c910.h;
+             * otherwise, load to user-specified address.
+            */
+            if (sbmeta_info->image_type != T_USER) {
+                image_load_addr = image_addrs[sbmeta_info->image_type];
+            } else {
+                image_load_addr = sbmeta_info->relocated_addr;
+            }
+
+            /*
+            * Load image specified in sbmeta info
+            * Note: only load images don't exist in env "bootcmd_load"
+            */
+            if (sbmeta_info->image_type == T_ROOTFS || sbmeta_info->image_type == T_USER) {
+                snprintf(cmd, sizeof(cmd), "ext4load mmc %x:%x %p %s", sbmeta_info->dev,
+                         sbmeta_info->part, \
+                         image_load_addr, sbmeta_info->filename);
+                if (run_command(cmd, 0) != 0) {
+                    return CMD_RET_FAILURE;
+                }
+            }
+
+            /* Check and verify user-specified image */
+            if (sbmeta_verify_image(image_load_addr, sbmeta_info->image_type) != 0) {
+                return CMD_RET_FAILURE;
+            }
+        } else {
+            break;
+        }
+    }
+
+    /* if sbmeta didn't specify images, reset */
+    if (count == 0) {
+        print_info("Error: SBMETA doesn't specify any images!\r\n");
+        return CMD_RET_FAILURE;
+    }
+
+    /* Clear sbmeta buffer in memory */
+    memset((void *)LIGHT_SBMETA_ADDR, 0, PLAIN_SBMETA_TEXT);
+    return 0;
+}
+
+static int do_sbmetaboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
+{
+    if (light_sbmetaboot(argc, argv) != 0) {
+        run_command("reset", 0);
+        return -1;
+    }
+
+    return 0;
+}
+
+U_BOOT_CMD(
+    sbmetaboot, CONFIG_SYS_MAXARGS, 1, do_sbmetaboot,
+    "load and verify image sbmeta, then verify image files specified in sbmeta",
+    ""
+);
+#endif
+#endif
--- a/board/thead/light-c910/sbmeta/sbmeta.h
+++ b/board/thead/light-c910/sbmeta/sbmeta.h
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (C) 2021 Alibaba Group Holding Limited
+ */
+
+#ifndef _LIGHT_SBMETA_H
+#define _LIGHT_SBMETA_H
+
+#include "common.h"
+#include "command.h"
+#include <asm/arch-thead/boot_mode.h>
+
+#define MAX_NAME_SIZE       32
+#define MAX_DIGEST_SIZE     64
+#define SBMETA_MAGIC        0x544D4253  /* = {'S', 'B', 'M', 'T'} */
+
+#if CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_LPI4A)
+#define LIGHT_SBMETA_ADDR   0x10000000
+#endif
+#define SBMETA_DEV          0
+#define SBMETA_PART         6
+#define ENTRY_SIZE          128
+#define PLAIN_SBMETA_TEXT   4096
+#define SBMETA_SIZE         4736  /* 4K SMBETA image + 640 footer */
+#define MAX_ENTRY_NUM       PLAIN_SBMETA_TEXT / ENTRY_SIZE  /* 4K/128=32 */
+#define IMAGE_TYPE_NUM      7
+#define DIGEST_TYPE_NUM     8
+#define SIGN_TYPE_NUM       6
+#define T_USER              7
+#define SBMETA_FILENAME     "sbmeta.bin"
+
+typedef struct {
+    int         magiccode;
+    uint8_t     dev;
+    uint8_t     part;
+    uint8_t     image_type;
+    uint8_t     digest_scheme;
+    uint8_t     sign_scheme;
+    uint8_t     isencrypted;
+    uint8_t     medium_type;
+    uint8_t     reserve0;
+    char        filename[MAX_NAME_SIZE];
+    uint8_t     digest[MAX_DIGEST_SIZE];
+    uint32_t    relocated_addr;
+    uint32_t    reserved[4];
+} sbmeta_info_t;
+
+#endif
--- a/board/thead/light-c910/secimg_load.c
+++ b/board/thead/light-c910/secimg_load.c
@@ -15,7 +15,7 @@
 #define RPMB_BLOCK_SIZE 256
 #define RPMB_ROLLBACK_BLOCK_START 1

-#ifndef LIGHT_KDF_RPMB_KEYs
+#ifndef LIGHT_KDF_RPMB_KEY
 static const unsigned char emmc_rpmb_key_sample[32] = {0x33, 0x22, 0x11, 0x00, 0x77, 0x66, 0x55, 0x44, \
 												0xbb, 0xaa, 0x99, 0x88, 0xff, 0xee, 0xdd, 0xcc, \
 												0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, \
@@ -121,7 +121,7 @@ bool get_system_boot_type(void)
 	int lc = 0;
 	sboot_st_t sb_flag = SECURE_BOOT_DIS;
 	int ret = 0;
-
+# if 0
 	ret = csi_efuse_get_lc(&lc);
 	/* 0: LC_INIT, 1: LC_DEV, 2: LC_OEM, 3: LC_PRO */
 	if ((ret == 0) && (lc != 0)) {
@@ -134,7 +134,7 @@ bool get_system_boot_type(void)

 		csi_efuse_api_uninit();
 	}
-
+#endif
 	return btype;
 }

--- a/cmd/bootandroid.c
+++ b/cmd/bootandroid.c
@@ -19,8 +19,8 @@
 #define ENV_RAMDISK_ADDR "ramdisk_addr"
 #define ENV_DTB_ADDR     "dtb_addr"
 #define DEFAULT_KERNEL_ADDR  0x00200800
-#define DEFAULT_RAMDISK_ADDR 0x02000000
-#define DEFAULT_DTB_ADDR     0x01f00000
+#define DEFAULT_RAMDISK_ADDR LIGHT_ROOTFS_ADDR
+#define DEFAULT_DTB_ADDR     LIGHT_DTB_ADDR
 #define ENV_RAMDISK_SIZE "ramdisk_size"
 #define MISC_PARTITION "misc"
 #define RECOVERY_PARTITION "recovery"
@@ -49,7 +49,35 @@ static const char *slot_name_suffix = NULL;;
 #define BOOT_IMAGE_HEADER_V3_PAGESIZE 4096

 static struct AvbOps *avb_ops = NULL;
-static struct bootloader_message* s_bcb = NULL;
+static struct bootloader_message_ab *s_bcb = NULL;
+static struct bootloader_control *boot_ctl = NULL;
+
+static char *get_boot_partition_name_suffix(void)
+{
+#ifdef CONFIG_ANDROID_AB
+    if (boot_ctl != NULL) {
+		/* index 0 is _a, index 1 is _b*/
+		if(boot_ctl->slot_info[0].priority < boot_ctl->slot_info[1].priority) {
+			strcpy(boot_ctl->slot_suffix, "_b");
+		} else {
+			strcpy(boot_ctl->slot_suffix, "_a");
+		}
+	} else {
+		printf("get_slot_suffix boot_ctl is null return _a");
+		return "_a";
+	}
+	printf("get_slot_suffix boot_ctl->slot_suffix %s\r\n", boot_ctl->slot_suffix);
+	return boot_ctl->slot_suffix;
+#else
+	return "";
+#endif
+}
+
+static void get_partition_name(const char *partion, char *partion_name)
+{
+	strcpy(partion_name, partion);
+	strcat(partion_name, get_boot_partition_name_suffix());
+}

 /*
 *format 4 chars/bytes to a int number
@@ -87,8 +115,8 @@ static int prepare_data_from_vendor_boot(struct andr_img_hdr *hdr, int dtb_start
 	/* if the vendor boot partition name is beyond 32B, arise error */
 	if ((32 - strlen(VENDOR_BOOT_PARTITION)) < 2)
 		return -1;
-	memcpy(vb_part_name, VENDOR_BOOT_PARTITION, strlen(VENDOR_BOOT_PARTITION));
-	strcat(vb_part_name, slot_name_suffix);
+	
+    get_partition_name(VENDOR_BOOT_PARTITION, vb_part_name);

 	printf("blk_get_dev %s\n", vb_part_name);
 	if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
@@ -102,11 +130,11 @@ static int prepare_data_from_vendor_boot(struct andr_img_hdr *hdr, int dtb_start
 		return -1;
 	}

-	vendor_boot_data = avb_malloc(part_info.size * part_info.blksz);
-	if (vendor_boot_data == NULL) {
-		printf("vendor boot data malloc fail \n");
-		return -1;
-	}
+    if (part_info.size * part_info.blksz > CONFIG_FASTBOOT_BUF_SIZE) {
+        return -1;
+    }
+    vendor_boot_data = (uint8_t*)CONFIG_FASTBOOT_BUF_ADDR;
+
 	ret = blk_dread(dev_desc, part_info.start, part_info.size, vendor_boot_data);
 	// vendor_boot.img
 	//* +------------------------+
@@ -170,15 +198,23 @@ static int prepare_data_from_vendor_boot(struct andr_img_hdr *hdr, int dtb_start
 	*buf_bootconfig = avb_malloc(*vendor_bootconfig_size);
 	if (*buf_bootconfig == NULL) {
 		printf("vendor bootconfig malloc fail\n");
-		if (vendor_boot_data != NULL)
-			avb_free(vendor_boot_data);
 		return -1;
 	}
 	int bootconfig_offset=vendor_boot_pagesize * (o + p + q + r);
 	memcpy(*buf_bootconfig, vendor_boot_data + bootconfig_offset, *vendor_bootconfig_size);

-	if (vendor_boot_data != NULL)
-		avb_free(vendor_boot_data);
+#ifdef CONFIG_ANDROID_AB
+	char *find_str = NULL;
+	char *slot_suffix = get_boot_partition_name_suffix();
+    char *slot_suffx_pre = "androidboot.slot_suffix=";
+	printf("prepare_data_from_vendor_boot slot_suffix:%s\n", slot_suffix);
+    printf("prepare_data_from_vendor_boot slot_suffx_pre:%s\n", slot_suffx_pre);
+
+	find_str = strstr((char *)*buf_bootconfig, slot_suffx_pre);
+    if (find_str != NULL) {
+		memcpy(find_str + strlen(slot_suffx_pre), slot_suffix, strlen(slot_suffix));
+	}
+#endif

 	return 0;
 }
@@ -307,7 +343,7 @@ static void clear_bcb(void)
 	struct blk_desc *dev_desc  = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);

 	//bcb clear and store
-	memset(s_bcb, 0, sizeof(struct bootloader_message));
+	memset(s_bcb, 0, sizeof(struct bootloader_message_ab));

 	if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 		printf("BootAndriod bcb err: invalid mmc device\n");
@@ -324,22 +360,48 @@ static void clear_bcb(void)
 	printf("BootAndriod bcb info :clear_bcb write=%d, %ld,%ld,%ld\n", ret, part_info.start, part_info.size, part_info.blksz);
 }

-static int do_andriod_bcb_business(struct AvbOps *avb_ops, struct bootloader_message* s_bcb)
+static int do_andriod_bcb_business(void)
 {
 	AvbIOResult ret = AVB_IO_RESULT_OK;
 	size_t bytes_read = 0;
 	int res = CMD_RET_FAILURE;

-	s_bcb = avb_malloc(sizeof(struct bootloader_message));
+    if (avb_ops != NULL) {
+        avb_ops_free(avb_ops);
+        avb_ops = NULL;
+    }
+
+    avb_ops = avb_ops_alloc(BOOTDEV_DEFAULT);
+    if (avb_ops == NULL) {
+        goto _bcb_err;
+    }
+
+    if (s_bcb != NULL) {
+        avb_free(s_bcb);
+        s_bcb = NULL;
+    }
+
+	s_bcb = avb_malloc(sizeof(struct bootloader_message_ab));
 	if (s_bcb == NULL) {
-		printf("BootAndriod Err: Failed to initialize bcb\n");
+		goto _bcb_err;
+	}
+
+    if (boot_ctl != NULL) {
+        avb_free(boot_ctl);
+        boot_ctl = NULL;
+    }
+
+    boot_ctl = malloc(sizeof(struct bootloader_control));
+	if (boot_ctl == NULL)
+	{
+        ret = -2;
 		goto _bcb_err;
 	}

 	ret = avb_ops->read_from_partition(avb_ops,
 										MISC_PARTITION,
 										0,
-										sizeof(struct bootloader_message),
+										sizeof(struct bootloader_message_ab),
 										s_bcb,
 										&bytes_read);
 	if (ret != AVB_IO_RESULT_OK) {
@@ -348,39 +410,40 @@ static int do_andriod_bcb_business(struct AvbOps *avb_ops, struct bootloader_mes
 	}

 	/* Enter into fastboot mode if bcb string is bootonce or bootrecovery */
-	if (0 == strncmp(s_bcb->command, BCB_BOOTONCE, strlen(BCB_BOOTONCE))|| \
-	    0 == strncmp(s_bcb->command, BCB_BOOTRECOVERY, strlen(BCB_BOOTRECOVERY))) {
-		printf("BootAndriod Info: Bcb read %ld bytes, %s\n", bytes_read, s_bcb->command);
+	if (0 == strncmp(s_bcb->message.command, BCB_BOOTONCE, strlen(BCB_BOOTONCE))|| \
+	    0 == strncmp(s_bcb->message.command, BCB_BOOTRECOVERY, strlen(BCB_BOOTRECOVERY))) {
+		printf("BootAndriod Info: Bcb read %ld bytes, %s\n", bytes_read, s_bcb->message.command);
 		printf("BootAndriod Info: Enter fastboot mode\n");
 		clear_bcb();
 		run_command("fastboot usb 0", 0);
 	}

+    memset(boot_ctl, 0, sizeof(struct bootloader_control));
+    memcpy(boot_ctl, (struct bootloader_control*)s_bcb->slot_suffix, sizeof(struct bootloader_control));
+
 	res = CMD_RET_SUCCESS;

 _bcb_err:
-	if (s_bcb != NULL)
-		avb_free(s_bcb);
+	if (res != CMD_RET_SUCCESS) {
+        if (avb_ops != NULL) {
+            avb_ops_free(avb_ops);
+            avb_ops = NULL;
+        }
+
+		if (boot_ctl != NULL) {
+            avb_free(boot_ctl);
+            boot_ctl = NULL;
+        }
+
+        if (s_bcb != NULL) {
+            avb_free(s_bcb);
+            s_bcb = NULL;
+        }
+    }

 	return res;
 }

-static const char *get_boot_partition_name_suffix(void)
-{
-#if defined (CONFIG_ANDROID_AB)
-	char *slot_suffix = "_a";
-#else
-	char *slot_suffix = "";
-#endif
-
-	char *tmp = NULL;
-	tmp = env_get("boot_ab");
-	if (tmp != NULL)
-		slot_suffix = tmp;
-
-	return slot_suffix;
-}
-
 static int do_bootandroid(struct cmd_tbl_s *cmdtp, int flag, int argc,
 						char * const argv[]) {
 	
@@ -391,23 +454,18 @@ static int do_bootandroid(struct cmd_tbl_s *cmdtp, int flag, int argc,
 	AvbSlotVerifyFlags slotflags = AVB_SLOT_VERIFY_FLAGS_NONE;
 	AvbHashtreeErrorMode htflags = AVB_HASHTREE_ERROR_MODE_RESTART_AND_INVALIDATE;
 	int res = CMD_RET_FAILURE;
+    char bp_name[32] = {0};
+
+    res = do_andriod_bcb_business();
+    if (res != CMD_RET_SUCCESS) {
+        goto exit;
+    }

 	/* Retieve boot partition 's name suffix */
 	slot_name_suffix = get_boot_partition_name_suffix();

 	/* Start with slot verification in secure boot */
 	if (get_system_boot_type()) {
-
-		avb_ops = avb_ops_alloc(BOOTDEV_DEFAULT);
-		if (avb_ops == NULL) {
-			goto _ba_err;
-		}
-
-		res = do_andriod_bcb_business(avb_ops, s_bcb);
-		if (res != CMD_RET_SUCCESS) {
-			goto _ba_err;
-		}
-				
 		/* Verify boot partition requested in vbmeta.img */
 		slot_result = avb_slot_verify(avb_ops,
 									  requested_partitions,
@@ -428,19 +486,13 @@ static int do_bootandroid(struct cmd_tbl_s *cmdtp, int flag, int argc,
 			/* In case of avb slot verification failure, Force system reset */
 			run_command("reset", 0);
 		}
-_ba_err:
-		if (avb_ops)
-			avb_ops_free(avb_ops);
-
 	} else {
-	/* Go to load BOOT partition directly in non-secure boot */
-		char bp_name[32] = {0};
-		
-		strcat(bp_name, BOOT_PARTITION);
-		strcat(bp_name, slot_name_suffix);
+	/* Go to load BOOT partition directly in non-secure boot */		
+        get_partition_name(BOOT_PARTITION, bp_name);
 		prepare_partition_data(bp_name);
 	}
-
+    
+exit:
 	return res;
 }

--- a/configs/light_a_val_android_defconfig
+++ b/configs/light_a_val_android_defconfig
@@ -101,6 +101,7 @@ CONFIG_PMIC_VOL_INIT=y
 CONFIG_DDR_REGU_0V6=600000
 CONFIG_DDR_REGU_0V8=800000
 CONFIG_DDR_REGU_1V1=1100000
+CONFIG_SPL_TEXT_BASE=0xffe0000800
 CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_A=y
 # CONFIG_AVB_USE_OEM_KEY is not set
 # CONFIG_AVB_ROLLBACK_ENABLE is not set
--- a/configs/light_b_product_android_defconfig
+++ b/configs/light_b_product_android_defconfig
@@ -105,8 +105,11 @@ CONFIG_PMIC_VOL_INIT=y
 CONFIG_DDR_REGU_0V6=600000
 CONFIG_DDR_REGU_0V8=800000
 CONFIG_DDR_REGU_1V1=1100000
+CONFIG_SPL_TEXT_BASE=0xffe0000800
 CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_B=y
-CONFIG_AVB_USE_OEM_KEY=y
+# CONFIG_AVB_USE_OEM_KEY is not set
+# CONFIG_AVB_ROLLBACK_ENABLE is not set
+# CONFIG_AVB_HW_ENGINE_ENABLE is not set
 CONFIG_ANDROID_BOOT_IMAGE=y
 CONFIG_LIBAVB=y
 CONFIG_AVB_VERIFY=y
--- a/configs/light_lpi4a_android_defconfig
+++ b/configs/light_lpi4a_android_defconfig
@@ -101,6 +101,11 @@ CONFIG_PMIC_VOL_INIT=y
 CONFIG_DDR_REGU_0V6=600000
 CONFIG_DDR_REGU_0V8=800000
 CONFIG_DDR_REGU_1V1=1100000
+CONFIG_SPL_TEXT_BASE=0xffe0000800
+CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_B=y
+# CONFIG_AVB_USE_OEM_KEY is not set
+# CONFIG_AVB_ROLLBACK_ENABLE is not set
+# CONFIG_AVB_HW_ENGINE_ENABLE is not set
 CONFIG_ANDROID_BOOT_IMAGE=y
 CONFIG_LIBAVB=y
 CONFIG_AVB_VERIFY=y
--- a/drivers/fastboot/fb_command.c
+++ b/drivers/fastboot/fb_command.c
@@ -14,6 +14,7 @@
 #include <stdlib.h>

 #define BLOCK_SIZE 512
+#define BOARD_ID_OFFSET 0x26

 /**
 * image_size - final fastboot image size
@@ -42,6 +43,7 @@ static void reboot_bootloader(char *, char *);
 static void oem_format(char *, char *);
 #endif
 static void oem_command(char *, char *);
+int image_have_head(unsigned long img_src_addr);

 static const struct {
 	const char *command;
@@ -263,6 +265,41 @@ void fastboot_data_complete(char *response)
 	fastboot_bytes_received = 0;
 }

+/**
+ * check_image_board_id() - check if board id in image matched with board id in env 
+ *
+ * @image_data: Image data
+ *
+ * 0 if success otherwise failed
+ */
+int check_image_board_id(uint8_t *image_data)
+{
+	char *env_board_id = NULL;
+    char board_id[3] = {0};
+
+	env_board_id = env_get("board#");
+
+	/*if current board id is null or image has no header,skip check*/
+	if (env_board_id == NULL || env_board_id[0] == 0 || image_have_head((unsigned long)image_data) == 0) {
+		return 0;
+	}
+
+	memcpy(board_id, image_data + BOARD_ID_OFFSET,sizeof(uint16_t));
+
+    /*if image board id is null,skip check*/
+    if (*(uint16_t*)board_id == 0) {
+        return 0;
+	}
+
+    /*check if current board id match with board id in image*/
+	if (strncmp(env_board_id, board_id, sizeof(board_id)) != 0) {
+	    printf("U-BOOT image download via fastboot is interrupted due to the U-BOOT for board %s does not work in the board %s\r\n",board_id,env_board_id);
+		return -1;
+	}
+
+	return 0;
+}
+
 #if CONFIG_IS_ENABLED(FASTBOOT_FLASH)
 /**
 * flash() - write the downloaded image to the indicated partition.
@@ -279,8 +316,15 @@ static void flash(char *cmd_parameter, char *response)
 	char cmdbuf[32];
 	u32 block_cnt;
 	struct blk_desc *dev_desc;
+    int ret = 0;

 	if (strcmp(cmd_parameter, "uboot") == 0) {
+        ret = check_image_board_id(fastboot_buf_addr);
+		if (ret != 0) {
+            fastboot_fail("U-BOOT image does not match the type of BOARD", response);
+			return;
+		}
+
 		dev_desc = blk_get_dev("mmc", CONFIG_FASTBOOT_FLASH_MMC_DEV);
 		if (!dev_desc || dev_desc->type == DEV_TYPE_UNKNOWN) {
 			fastboot_fail("invalid mmc device", response);
@@ -298,7 +342,6 @@ static void flash(char *cmd_parameter, char *response)

 		run_command(cmdbuf, 0);
 		run_command("mmc partconf 0 1 0 0", 0);
-
 	} else if ((strcmp(cmd_parameter, "fw") == 0)) {
 		memcpy((void *)LIGHT_FW_ADDR, fastboot_buf_addr, image_size);
 	} else if ((strcmp(cmd_parameter, "uImage") == 0)) {
--- a/include/configs/light-c910.h
+++ b/include/configs/light-c910.h
@@ -23,7 +23,7 @@
 #define CONFIG_SYS_INIT_SP_ADDR     (CONFIG_SYS_TEXT_BASE + SZ_1M)
 #define CONFIG_SYS_LOAD_ADDR        (CONFIG_SYS_TEXT_BASE + SZ_1M)
 #ifdef CONFIG_ANDROID_BOOT_IMAGE
-#define CONFIG_SYS_MALLOC_LEN       (128*SZ_1M)
+#define CONFIG_SYS_MALLOC_LEN       (64*SZ_1M)
 #else
 #define CONFIG_SYS_MALLOC_LEN       SZ_1M
 #endif
@@ -62,14 +62,14 @@
 #define THEAD_LIGHT_FASTBOOT	1
 #define LIGHT_FW_ADDR		0x0
 #define LIGHT_KERNEL_ADDR	0x200000
-#define LIGHT_DTB_ADDR		0x2800000
+#define LIGHT_DTB_ADDR		0x3800000
 #define LIGHT_ROOTFS_ADDR	0x2000000
 #define LIGHT_AON_FW_ADDR	0xffffef8000
 #define LIGHT_TEE_FW_ADDR	0x1c000000
 #define LIGHT_TF_FW_ADDR	LIGHT_FW_ADDR
 #define LIGHT_TF_FW_TMP_ADDR	0x100000
 #define LIGHT_KERNEL_ADDR_CMD	"0x200000"
-#define LIGHT_DTB_ADDR_CMD	"0x2800000"
+#define LIGHT_DTB_ADDR_CMD	"0x3800000"


 /* trust image name string */
@@ -114,26 +114,52 @@
 #if defined (U_BUILD_DEBUG)
 #define ENV_KERNEL_LOGLEVEL "kernel_loglevel=7\0"
 #define ENV_STR_BOOT_DELAY
+#define CONFIG_ENV_OVERWRITE
 #else
 #define ENV_KERNEL_LOGLEVEL "kernel_loglevel=4\0"
 #define ENV_STR_BOOT_DELAY	"bootdelay=0\0"
 #endif

+/* Define board ID in ENV for firmware download protection */
+#if defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_A) || \
+    defined(CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A) || \
+    defined(CONFIG_TARGET_LIGHT_FM_C910_VAL_A)
+#define ENV_STR_BOARD "board#=LA\0"
+#elif defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_B) || \
+      defined(CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B) || \
+      defined(CONFIG_TARGET_LIGHT_FM_C910_VAL_B)
+#define ENV_STR_BOARD "board#=LB\0"
+#elif defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_LPI4A) || \
+      defined(CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_LPI4A) || \
+      defined(CONFIG_TARGET_LIGHT_FM_C910_LPI4A)
+#define ENV_STR_BOARD "board#=LP\0"
+#elif defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_BEAGLE) || \
+      defined(CONFIG_TARGET_LIGHT_FM_C910_BEAGLE)
+#define ENV_STR_BOARD "board#=LG\0"
+#elif defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_ANT_REF) || \
+      defined(CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_ANT_REF) || \
+      defined(CONFIG_TARGET_LIGHT_FM_C910_VAL_ANT_REF)
+#define ENV_STR_BOARD "board#=LD\0"
+#endif
+
+
 #if defined (CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A)
 #define CONFIG_EXTRA_ENV_SETTINGS \
 	"splashimage=0x30000000\0" \
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
+    ENV_STR_BOARD \
 	"tf_addr=0x100000\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
+	"str_ram_addr=0xffe0000000\0" \
 	"fwaddr=0x10000000\0"\
 	"tee_addr=0x1c000000\0" \
 	"sec_upgrade_mode=0\0"\
 	"mmcdev=0\0" \
-	"mmcpart=6\0" \
+	"mmcpart=7\0" \
 	"mmcbootpart=2\0" \
 	ENV_KERNEL_LOGLEVEL \
 	"kdump_buf=180M\0" \
@@ -143,14 +169,15 @@
 	"tf_version=0x00000000\0"\
 	"fdt_file=light-a-val-sec.dtb\0" \
 	"uuid_rootfs=80a5a8e9-c744-491a-93c1-4f4194fd690b\0" \
-	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=tf,size=50MiB,type=boot;name=tee,size=50MiB,type=boot;name=stash,size=50MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
+	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=tf,size=50MiB,type=boot;name=tee,size=50MiB,type=boot;name=stash,size=50MiB,type=boot;name=sbmeta,size=8MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
 	"finduuid=part uuid mmc ${mmcdev}:${mmcpart} uuid\0" \
 	"gpt_partition=gpt write mmc ${mmcdev} $partitions\0" \
 	"set_bootargs=setenv bootargs console=ttyS0,115200 root=PARTUUID=${uuid} rootfstype=ext4 rdinit=/sbin/init rootwait rw earlycon clk_ignore_unused loglevel=${kernel_loglevel} eth=$ethaddr crashkernel=${kdump_buf}\0" \
 	"load_aon=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_aon_fpga.bin;cp.b $fwaddr $aon_ram_addr $filesize\0"\
 	"load_c906_audio=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_c906_audio.bin;cp.b $fwaddr $audio_ram_addr $filesize\0"\
-	"bootcmd_load=run load_aon;run load_c906_audio; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
-	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; secboot; booti $kernel_addr - $dtb_addr;\0" \
+	"load_str=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr str.bin;cp.b $fwaddr $str_ram_addr $filesize\0"\
+	"bootcmd_load=run load_aon;run load_c906_audio;run load_str;ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
+	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; sbmetaboot; booti $kernel_addr - $dtb_addr;\0" \
        "\0"

 #elif defined (CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B)
@@ -158,16 +185,18 @@
 	"splashimage=0x30000000\0" \
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
+    ENV_STR_BOARD \
 	"tf_addr=0x100000\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
+	"str_ram_addr=0xffe0000000\0" \
 	"fwaddr=0x10000000\0"\
 	"tee_addr=0x1c000000\0" \
 	"sec_upgrade_mode=0\0"\
 	"mmcdev=0\0" \
-	"mmcpart=6\0" \
+	"mmcpart=7\0" \
 	"mmcbootpart=2\0" \
 	ENV_KERNEL_LOGLEVEL \
 	"kdump_buf=180M\0" \
@@ -177,14 +206,15 @@
 	"tf_version=0x00000000\0"\
 	"fdt_file=light-b-product-sec.dtb\0" \
 	"uuid_rootfs=80a5a8e9-c744-491a-93c1-4f4194fd690b\0" \
-	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=tf,size=50MiB,type=boot;name=tee,size=50MiB,type=boot;name=stash,size=50MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
+	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=tf,size=50MiB,type=boot;name=tee,size=50MiB,type=boot;name=stash,size=50MiB,type=boot;name=sbmeta,size=8MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
 	"finduuid=part uuid mmc ${mmcdev}:${mmcpart} uuid\0" \
 	"gpt_partition=gpt write mmc ${mmcdev} $partitions\0" \
 	"set_bootargs=setenv bootargs console=ttyS0,115200 root=PARTUUID=${uuid} rootfstype=ext4 rdinit=/sbin/init rootwait rw earlycon clk_ignore_unused loglevel=${kernel_loglevel} eth=$ethaddr crashkernel=${kdump_buf}\0" \
 	"load_aon=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_aon_fpga.bin;cp.b $fwaddr $aon_ram_addr $filesize\0"\
 	"load_c906_audio=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_c906_audio.bin;cp.b $fwaddr $audio_ram_addr $filesize\0"\
-	"bootcmd_load=run load_aon;run load_c906_audio; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
-	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; secboot; booti $kernel_addr - $dtb_addr;\0" \
+	"load_str=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr str.bin;cp.b $fwaddr $str_ram_addr $filesize\0"\
+	"bootcmd_load=run load_aon;run load_c906_audio;run load_str; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
+	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; sbmetaboot; booti $kernel_addr - $dtb_addr;\0" \
        "\0"

 #elif defined (CONFIG_LIGHT_SEC_BOOT_WITH_VERIFY_ANT_REF)
@@ -192,11 +222,13 @@
 	"splashimage=0x30000000\0" \
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
+    ENV_STR_BOARD \
 	"tf_addr=0x100000\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
+	"str_ram_addr=0xffe0000000\0" \
 	"fwaddr=0x10000000\0"\
 	"tee_addr=0x1c000000\0" \
 	"sec_upgrade_mode=0\0"\
@@ -217,7 +249,8 @@
 	"set_bootargs=setenv bootargs console=ttyS0,115200 root=PARTUUID=${uuid} rootfstype=ext4 rdinit=/sbin/init rootwait rw earlycon clk_ignore_unused loglevel=${kernel_loglevel} eth=$ethaddr crashkernel=${kdump_buf}\0" \
 	"load_aon=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_aon_fpga.bin;cp.b $fwaddr $aon_ram_addr $filesize\0"\
 	"load_c906_audio=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_c906_audio.bin;cp.b $fwaddr $audio_ram_addr $filesize\0"\
-	"bootcmd_load=run load_aon;run load_c906_audio; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
+	"load_str=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr str.bin;cp.b $fwaddr $str_ram_addr $filesize\0"\
+	"bootcmd_load=run load_aon;run load_c906_audio;run load_str; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
 	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; secboot; booti $kernel_addr - $dtb_addr;\0" \
        "\0"

@@ -226,16 +259,18 @@
 	"splashimage=0x30000000\0" \
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
+    ENV_STR_BOARD \
 	"tf_addr=0x100000\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
+	"str_ram_addr=0xffe0000000\0" \
 	"fwaddr=0x10000000\0"\
 	"tee_addr=0x1c000000\0" \
 	"sec_upgrade_mode=0\0"\
 	"mmcdev=0\0" \
-	"mmcpart=6\0" \
+	"mmcpart=7\0" \
 	"mmcbootpart=2\0" \
 	ENV_KERNEL_LOGLEVEL \
 	"kdump_buf=180M\0" \
@@ -245,14 +280,15 @@
 	"tf_version=0x00000000\0"\
 	"fdt_file=light-lpi4a-sec.dtb\0" \
 	"uuid_rootfs=80a5a8e9-c744-491a-93c1-4f4194fd690b\0" \
-	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=tf,size=50MiB,type=boot;name=tee,size=50MiB,type=boot;name=stash,size=50MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
+	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=tf,size=50MiB,type=boot;name=tee,size=50MiB,type=boot;name=stash,size=50MiB,type=boot;name=sbmeta,size=8MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
 	"finduuid=part uuid mmc ${mmcdev}:${mmcpart} uuid\0" \
 	"gpt_partition=gpt write mmc ${mmcdev} $partitions\0" \
 	"set_bootargs=setenv bootargs console=ttyS0,115200 root=PARTUUID=${uuid} rootfstype=ext4 rdinit=/sbin/init rootwait rw earlycon clk_ignore_unused loglevel=${kernel_loglevel} eth=$ethaddr crashkernel=${kdump_buf}\0" \
 	"load_aon=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_aon_fpga.bin;cp.b $fwaddr $aon_ram_addr $filesize\0"\
 	"load_c906_audio=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_c906_audio.bin;cp.b $fwaddr $audio_ram_addr $filesize\0"\
-	"bootcmd_load=run load_aon;run load_c906_audio; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
-	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; secboot; booti $kernel_addr - $dtb_addr;\0" \
+	"load_str=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr str.bin;cp.b $fwaddr $str_ram_addr $filesize\0"\
+	"bootcmd_load=run load_aon;run load_c906_audio;run load_str; ext4load mmc 0:3 $tf_addr trust_firmware.bin; ext4load mmc 0:4 $tee_addr tee.bin;ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
+	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; sbmetaboot; booti $kernel_addr - $dtb_addr;\0" \
        "\0"

 #elif defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_A) || defined(CONFIG_LIGHT_ANDROID_BOOT_IMAGE_VAL_B)
@@ -293,11 +329,12 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
 	"fwaddr=0x10000000\0"\
+    ENV_STR_BOARD \
 	"mmcdev=0\0" \
 	"mmcpart=3\0" \
 	"mmcbootpart=2\0" \
@@ -321,7 +358,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -349,7 +386,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -377,7 +414,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -405,7 +442,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -433,7 +470,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -461,7 +498,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -489,7 +526,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -500,7 +537,7 @@
 	ENV_KERNEL_LOGLEVEL \
 	"kdump_buf=180M\0" \
 	ENV_STR_BOOT_DELAY \
-	"fdt_file=light-lpi4a.dtb\0" \
+	"fdt_file=light-lpi4a-hdmi.dtb\0" \
 	"uuid_rootfs=80a5a8e9-c744-491a-93c1-4f4194fd690b\0" \
 	"partitions=name=table,size=2031KB;name=boot,size=200MiB,type=boot;name=root,size=-,type=linux,uuid=${uuid_rootfs}\0" \
 	"finduuid=part uuid mmc ${mmcdev}:${mmcpart} uuid\0" \
@@ -517,7 +554,7 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
@@ -545,10 +582,11 @@
 	"splashpos=m,m\0" \
 	"fdt_high=0xffffffffffffffff\0" \
 	"opensbi_addr=0x0\0" \
-	"dtb_addr=0x02800000\0" \
+	"dtb_addr=0x03800000\0" \
 	"kernel_addr=0x00200000\0" \
 	"aon_ram_addr=0xffffef8000\0" \
 	"audio_ram_addr=0x32000000\0" \
+	"str_ram_addr=0xffe0000000\0" \
 	"fwaddr=0x10000000\0"\
 	"mmcdev=0\0" \
 	"mmcpart=3\0" \
@@ -564,7 +602,8 @@
 	"set_bootargs=setenv bootargs console=ttyS0,115200 root=PARTUUID=${uuid} rootfstype=ext4 rdinit=/sbin/init rootwait rw earlycon clk_ignore_unused loglevel=${kernel_loglevel} eth=$ethaddr crashkernel=${kdump_buf}\0" \
 	"load_aon=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_aon_fpga.bin;cp.b $fwaddr $aon_ram_addr $filesize\0"\
 	"load_c906_audio=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr light_c906_audio.bin;cp.b $fwaddr $audio_ram_addr $filesize\0"\
-	"bootcmd_load=run load_aon;run load_c906_audio; ext4load mmc ${mmcdev}:${mmcbootpart} $opensbi_addr fw_dynamic.bin; ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
+	"load_str=ext4load mmc ${mmcdev}:${mmcbootpart} $fwaddr str.bin;cp.b $fwaddr $str_ram_addr $filesize\0"\
+	"bootcmd_load=run load_aon;run load_c906_audio; run load_str;ext4load mmc ${mmcdev}:${mmcbootpart} $opensbi_addr fw_dynamic.bin; ext4load mmc ${mmcdev}:${mmcbootpart} $dtb_addr ${fdt_file}; ext4load mmc ${mmcdev}:${mmcbootpart} $kernel_addr Image\0" \
 	"bootcmd=run bootcmd_load; bootslave; run finduuid; run set_bootargs; booti $kernel_addr - $dtb_addr;\0" \
        "\0"
 #endif
--- a/include/env_flags.h
+++ b/include/env_flags.h
@@ -70,11 +70,18 @@ enum env_flags_varaccess {
 #define SERIAL_FLAGS ""
 #endif

+#ifndef CONFIG_ENV_OVERWRITE
+#define BOARD_FLAGS "board#:so,"
+#else
+#define BOARD_FLAGS ""
+#endif
+
 #define ENV_FLAGS_LIST_STATIC \
 	ETHADDR_FLAGS \
 	NET_FLAGS \
 	SERIAL_FLAGS \
-	CONFIG_ENV_FLAGS_LIST_STATIC
+	CONFIG_ENV_FLAGS_LIST_STATIC \
+    BOARD_FLAGS

 #ifdef CONFIG_CMD_ENV_FLAGS
 /*
--- a/lib/image-sparse.c
+++ b/lib/image-sparse.c
@@ -52,10 +52,10 @@ int write_sparse_image(struct sparse_storage *info,
 	lbaint_t blk;
 	lbaint_t blkcnt;
 	lbaint_t blks;
-	uint32_t bytes_written = 0;
+	uint64_t bytes_written = 0;
 	unsigned int chunk;
 	unsigned int offset;
-	unsigned int chunk_data_sz;
+	uint64_t chunk_data_sz;
 	uint32_t *fill_buf = NULL;
 	uint32_t fill_val;
 	sparse_header_t *sparse_header;
@@ -129,8 +129,8 @@ int write_sparse_image(struct sparse_storage *info,
 				 sizeof(chunk_header_t));
 		}

-		chunk_data_sz = sparse_header->blk_sz * chunk_header->chunk_sz;
-		blkcnt = chunk_data_sz / info->blksz;
+		chunk_data_sz = ((u64)sparse_header->blk_sz) * chunk_header->chunk_sz;
+		blkcnt = DIV_ROUND_UP_ULL(chunk_data_sz, info->blksz);
 		switch (chunk_header->chunk_type) {
 		case CHUNK_TYPE_RAW:
 			if (chunk_header->total_sz !=
@@ -159,7 +159,7 @@ int write_sparse_image(struct sparse_storage *info,
 				return -1;
 			}
 			blk += blks;
-			bytes_written += blkcnt * info->blksz;
+			bytes_written += ((u64)blkcnt) * info->blksz;
 			total_blocks += chunk_header->chunk_sz;
 			data += chunk_data_sz;
 			break;
@@ -219,8 +219,9 @@ int write_sparse_image(struct sparse_storage *info,
 				blk += blks;
 				i += j;
 			}
-			bytes_written += blkcnt * info->blksz;
-			total_blocks += chunk_data_sz / sparse_header->blk_sz;
+			bytes_written += ((u64)blkcnt) * info->blksz;
+			total_blocks += DIV_ROUND_UP_ULL(chunk_data_sz,
+							 sparse_header->blk_sz);
 			free(fill_buf);
 			break;

@@ -250,7 +251,7 @@ int write_sparse_image(struct sparse_storage *info,

 	debug("Wrote %d blocks, expected to write %d blocks\n",
 	      total_blocks, sparse_header->total_blks);
-	printf("........ wrote %u bytes to '%s'\n", bytes_written, part_name);
+	printf("........ wrote %llu bytes to '%s'\n", bytes_written, part_name);

 	if (total_blocks != sparse_header->total_blks) {
 		info->mssg("sparse image write failure", response);