I can merge all scanning function into one "helper",= just introduce a new variable to condition which partition we needed.

But I have no idea about test and document and I have n= ot seen anything in test/ or doc/ folder. Can you give me some advice?

I will refactor the AVB logic in the next patch in future.=

Best regards,

Valentin Liu

2026=E5=B9=B48=E6=9C=8820=E6=97=A5=E4=B8=8B=E5= =8D=888:31=EF=BC=8CSimon Glass <sjg@chromium.org> =E5=86=99=E9=81=93= =EF=BC=9A

Hi Valentin,

On 2026-08-18T17:53:00, Valentin Liu <valentinl= iu@icloud.com> wrote:

boot: android: Add= Android 13+ bootflow support to bootmeth.

Please drop the trailing period and keep the subject under 60 characters.=

The dev= ices launching Android 13+ were using a new partition
named init= _boot to store generic ramdisk.

In the new bootflow, kernel still be = stored in boot image,

however, the First Stage files in ramdisk = were moved to

init_boot image. We should load it to memory and v= erify it

so that the kernel can execute init program to continue= booting.

Currently, we have supported loading th= e init_boot image by

abootimg command, but we still need bring t= his ability to

bootmeth, so that booting Android 13+ will be mor= e easily.

Please use present/imperat= ive tense throughout: 'were using' -> 'use',

'kernel still be= stored' -> 'the kernel is still stored', 'were moved'

-> = 'are moved', 'we still need bring' -> 'we still need to bring',

'more easily' -> 'easier'.

In the new bootflow, kernel still be stored in bo= ot image,
however, the First Stage files in ramdisk were moved t= o
init_boot image. We should load it to memory and verify it
so that the kernel can execute init program to continue booting.

Currently, we have supported loading the init_boot = image by
abootimg command, but we still need bring this ability = to
bootmeth, so that booting Android 13+ will be more easily.
Bootmeth will be able to recognize the new partition layout,
=
and boot Android normally.

Link: https://source.android.com/docs/core/architec= ture/partitions/generic-boot
Signed-off-by: Valentin Liu <= ;valentinliu@icloud.com>

boot/bootmeth_android= .c | 67 ++++++++++++++++++++++++++++++++++++++++
boot/= image-android.c | 16 ++++++++++
cmd/abootimg.c = | 5 +++
doc/develop/bootstd/overview.rst | 3 ++=
include/android_image.h | 1 +
include/ima= ge.h | 35 +++++++++++++++++++++
6 files change= d, 127 insertions(+)

Please can you = look at how to add a test for this addition?

diff --git a/boot/bootmeth_android.c b/boot/bootmeth= _android.c

@@ -113,6 +115,51 @@ static int scan_boot_part(struct= udevice *blk, struct android_priv *priv)

+static int scan_init_= boot_part(struct udevice *blk, struct android_priv *priv)

+ struct blk_desc *desc =3D dev_get_uclass_plat(blk);

+ struct disk_partition partition;

+ char partname[PART= _NAME_LEN];

+ ulong num_blks, bufsz;

+ char *b= uf;

+ int ret;

+ if (priv->slot= )

+ sprintf(partname, INIT_BOOT_PART_NAME "_%s", pri= v->slot);

+ else

+ sprintf(partname= , INIT_BOOT_PART_NAME);

This is a ne= ar-duplicate of scan_boot_part() and

scan_vendor_boot_part(). Pl= ease factor the common logic (build

partname, read the header bl= ock, check magic, extract size) into a

helper rather than adding= a third copy.

diff --g= it a/boot/bootmeth_android.c b/boot/bootmeth_android.c
@@ -291,6= +338,17 @@ static int android_read_bootflow(struct udevice *dev, struct b= ootflow *bflow)
+ if (priv->header_version >=3D 4) {
+ ret =3D scan_init_boot_part(bflow->blk, priv);
+ if (ret < 0) {
+ /= *
+ * Android 12 devices do not have the in= it_boot partition.
+ * Some devices upgrade= d to Android 13 or later from
+ * earlier A= ndroid versions may also not have one.
+ */=
+ log_debug("scan init_boot failed: err=3D%= d\n", ret);
+ }
+ }

priv is allocated with plain malloc() above, so it is = not zeroed. On

failure here priv->init_boot_img_size is left = uninitialised, then

boot_android_normal() and (in patch 2) run_a= vb_verification() read it

back as 'priv->init_boot_img_size &= gt; 0'. Please use calloc()/memset(),

or explicitly set priv->= ;init_boot_img_size =3D 0 before the call and on

the failure pat= h.

diff --git a/boot/bo= otmeth_android.c b/boot/bootmeth_android.c
@@ -556,6 +614,7 @@ s= tatic int boot_android_normal(struct bootflow *bflow)
ulong loa= daddr =3D env_get_hex("loadaddr", 0);
+ ulong iloadaddr =3D = env_get_hex("init_boot_comp_addr_r", 0);
ulong vloadaddr =3D en= v_get_hex("vendor_boot_comp_addr_r", 0);

If init_boot_comp_addr_r is unset, env_get_hex() returns 0 and you

silently load init_boot at address 0 and call

set_ainit_= bootimg_addr(0). Please check that iloadaddr is non-zero and

err= or out with a clear message before using it - the vendor_boot path

has the same weakness, but let's not extend the pattern.

diff --git a/boot/image-android.c b/b= oot/image-android.c
@@ -326,6 +326,22 @@ bool android_image_get_= data(const void *boot_hdr, const void *vendor_boot_hdr,
+bool an= droid_image_get_data_v4(const void *boot_hdr, const void *vendor_boot_hdr,=
+ const void *init_boot_hdr, struct = andr_image_data *data)
+{
+ if (!android_image_get= _data(boot_hdr, vendor_boot_hdr, data))
+ return fal= se;
+
+ if (!is_android_boot_image_header(init_boo= t_hdr)) {
+ printf("Incorrect init boot image header= \n");
+ return false;
+ }
+<= /div>
+ android_boot_image_v3_v4_parse_hdr(init_boot_hdr, data);
+
+ return true;
+}

I can't find any caller of android_image_get_data_v4(). P= lease either

wire it up to whatever consumes init_boot_img_total= _size, or drop it

(and the new struct field, and the header decl= aration) until it is

needed.

diff --git a/include/image.h b/include/image.h
@= @ -2167,6 +2184,17 @@ bool android_image_print_dtb_contents(ulong hdr_addr= );
+/**
+ * is_android_init_boot_image_header() - Chec= k the magic of init boot image
+ *
+ * This checks the= header of Android init boot image and verifies the
+ * magic is= "ANDROID!" (same with the boot image)
+ *
+ * @init_b= oot_img: Pointer to boot image
+ * Return: non-zero if the magic= is correct, zero otherwise
+ */
+bool is_android_init= _boot_image_header(const void *init_boot_img);

Declared but never defined or called - scan_init_boot_part() us= es

is_android_boot_image_header() directly, which is correct sin= ce the

magic is identical. Please drop the declaration.

diff --git a/include/image.h b/= include/image.h
@@ -2199,6 +2227,13 @@ void set_abootimg_addr(ul= ong addr);
+/**
+ * set_ainit_bootimg_addr() - Set And= roid init boot image address
+ *
+ * Return: no return= ed results
+ */
+void set_ainit_bootimg_addr(ulong add= r);

Missing @addr: description, and = a void function does not need a

Return: line - please drop it.

diff --git a/doc/develop= /bootstd/overview.rst b/doc/develop/bootstd/overview.rst
@@ -293= ,6 +293,9 @@ script_offset_f
+init_boot_comp_addr_r
+ = Address to which to load the init_boot Android image, e.g. 0xd0000000

Since this env var is required for An= droid 13+ to boot, please also

document it in the relevant board= README(s) / sample env, and handle

the missing case gracefully = in the code (see comment on

boot_android_normal()).

Regards,

Simon