[PATCH 4/4] EmbeddedPkg/AndroidBoot: boot android kernel from storage

[Haojian Zhuang <haojian.zhuang@linaro.org>]

Add an android kernel loader that could load kernel from storage
device.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>
---
 .../Application/AndroidBoot/AndroidBootApp.c       | 118 +++++++++
 .../Application/AndroidBoot/AndroidBootApp.h       |  44 ++++
 .../Application/AndroidBoot/AndroidBootApp.inf     |  67 ++++++
 .../Application/AndroidBoot/AndroidBootImg.c       |  91 +++++++
 .../AndroidBoot/Arm/BootAndroidBootImg.c           | 268 +++++++++++++++++++++
 5 files changed, 588 insertions(+)
 create mode 100644 EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.c
 create mode 100644 EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.h
 create mode 100644 EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.inf
 create mode 100644 EmbeddedPkg/Application/AndroidBoot/AndroidBootImg.c
 create mode 100644 EmbeddedPkg/Application/AndroidBoot/Arm/BootAndroidBootImg.c

diff --git a/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.c b/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.c
new file mode 100644
index 0000000..312bfd7
--- /dev/null
+++ b/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.c
@@ -0,0 +1,118 @@
+/** @file
+
+  Copyright (c) 2013-2014, ARM Ltd. All rights reserved.<BR>
+  Copyright (c) 2017, Linaro. All rights reserved.
+
+  This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <Library/BaseMemoryLib.h>
+#include <Library/BdsLib.h>
+#include <Library/DebugLib.h>
+#include <Library/DevicePathLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+
+#include <Protocol/BlockIo.h>
+#include <Protocol/DevicePathFromText.h>
+
+#include "AndroidBootApp.h"
+
+#define IS_DEVICE_PATH_NODE(node,type,subtype) (((node)->Type == (type)) && ((node)->SubType == (subtype)))
+
+STATIC FASTBOOT_PLATFORM_PROTOCOL          *mPlatform;
+
+EFI_STATUS
+EFIAPI
+AndroidBootAppEntryPoint (
+  IN EFI_HANDLE                            ImageHandle,
+  IN EFI_SYSTEM_TABLE                      *SystemTable
+  )
+{
+  EFI_STATUS                          Status;
+  CHAR16                              *BootPathStr;
+  EFI_DEVICE_PATH_FROM_TEXT_PROTOCOL  *EfiDevicePathFromTextProtocol;
+  EFI_DEVICE_PATH                     *DevicePath;
+  EFI_DEVICE_PATH_PROTOCOL            *Node, *NextNode;
+  EFI_BLOCK_IO_PROTOCOL               *BlockIo;
+  HARDDRIVE_DEVICE_PATH               *PartitionPath;
+  UINT32                              MediaId, BlockSize;
+  VOID                                *Buffer;
+  EFI_HANDLE                          Handle;
+
+  BootPathStr = (CHAR16 *)PcdGetPtr (PcdAndroidBootDevicePath);
+  ASSERT (BootPathStr != NULL);
+  Status = gBS->LocateProtocol (&gEfiDevicePathFromTextProtocolGuid, NULL, (VOID **)&EfiDevicePathFromTextProtocol);
+  ASSERT_EFI_ERROR(Status);
+  DevicePath = (EFI_DEVICE_PATH *)EfiDevicePathFromTextProtocol->ConvertTextToDevicePath (BootPathStr);
+  ASSERT (DevicePath != NULL);
+
+  /* Find DevicePath node of Partition */
+  NextNode = DevicePath;
+  while (1) {
+    Node = NextNode;
+    if (IS_DEVICE_PATH_NODE (Node, MEDIA_DEVICE_PATH, MEDIA_HARDDRIVE_DP)) {
+      PartitionPath = (HARDDRIVE_DEVICE_PATH *)Node;
+      break;
+    }
+    NextNode = NextDevicePathNode (Node);
+  }
+
+  Status = gBS->LocateDevicePath (&gEfiDevicePathProtocolGuid, &DevicePath, &Handle);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  Status = gBS->OpenProtocol (
+                  Handle,
+                  &gEfiBlockIoProtocolGuid,
+                  (VOID **) &BlockIo,
+                  gImageHandle,
+                  NULL,
+                  EFI_OPEN_PROTOCOL_GET_PROTOCOL
+                  );
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "Failed to get BlockIo: %r\n", Status));
+    return Status;
+  }
+
+  MediaId = BlockIo->Media->MediaId;
+  BlockSize = BlockIo->Media->BlockSize;
+  /* Both PartitionStart and PartitionSize are counted as block size. */
+  Buffer = AllocatePages (EFI_SIZE_TO_PAGES (PartitionPath->PartitionSize));
+  if (Buffer == NULL) {
+    return EFI_BUFFER_TOO_SMALL;
+  }
+
+  /* Load header of boot.img */
+  Status = BlockIo->ReadBlocks (
+                      BlockIo,
+                      MediaId,
+                      PartitionPath->PartitionStart / BlockSize,
+                      PartitionPath->PartitionSize,
+                      Buffer
+                      );
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "Failed to read blocks: %r\n", Status));
+    goto EXIT;
+  }
+
+  Status = gBS->LocateProtocol (&gAndroidFastbootPlatformProtocolGuid, NULL, (VOID **) &mPlatform);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((EFI_D_ERROR, "Fastboot: Couldn't open Fastboot Platform Protocol: %r\n", Status));
+    goto EXIT;
+  }
+
+  Status = BootAndroidBootImg (mPlatform, PartitionPath->PartitionSize, Buffer);
+
+EXIT:
+  FreePages (Buffer, EFI_SIZE_TO_PAGES (PartitionPath->PartitionSize));
+  return Status;
+}
diff --git a/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.h b/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.h
new file mode 100644
index 0000000..ed7ea6e
--- /dev/null
+++ b/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.h
@@ -0,0 +1,44 @@
+/** @file
+
+  Copyright (c) 2013-2014, ARM Ltd. All rights reserved.<BR>
+  Copyright (c) 2017, Linaro.
+
+  This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#ifndef __ANDROID_BOOT_APP_H__
+#define __ANDROID_BOOT_APP_H__
+
+#include <Library/BaseLib.h>
+#include <Library/DebugLib.h>
+#include <Library/MemoryAllocationLib.h>
+
+#include <Protocol/AndroidFastbootPlatform.h>
+
+#define BOOTIMG_KERNEL_ARGS_SIZE 1024
+
+EFI_STATUS
+BootAndroidBootImg (
+  IN  FASTBOOT_PLATFORM_PROTOCOL      *Platform,
+  IN  UINTN                            BufferSize,
+  IN  VOID                            *Buffer
+  );
+
+EFI_STATUS
+ParseAndroidBootImg (
+  IN  VOID                            *BootImg,
+  OUT VOID                           **Kernel,
+  OUT UINTN                           *KernelSize,
+  OUT VOID                           **Ramdisk,
+  OUT UINTN                           *RamdiskSize,
+  OUT CHAR8                           *KernelArgs
+  );
+
+#endif //ifdef __ANDROID_BOOT_APP_H__
diff --git a/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.inf b/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.inf
new file mode 100644
index 0000000..176f778
--- /dev/null
+++ b/EmbeddedPkg/Application/AndroidBoot/AndroidBootApp.inf
@@ -0,0 +1,67 @@
+#/** @file
+#
+#  Copyright (c) 2013-2015, ARM Ltd. All rights reserved.<BR>
+#  Copyright (c) 2017, Linaro. All rights reserved.
+#
+#  This program and the accompanying materials
+#  are licensed and made available under the terms and conditions of the BSD License
+#  which accompanies this distribution. The full text of the license may be found at
+#  http://opensource.org/licenses/bsd-license.php
+#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+#
+#
+#**/
+
+[Defines]
+  INF_VERSION                    = 0x00010019
+  BASE_NAME                      = AndroidBootApp
+  FILE_GUID                      = 3a738b36-b9c5-4763-abbd-6cbd4b25f9ff
+  MODULE_TYPE                    = UEFI_APPLICATION
+  VERSION_STRING                 = 1.0
+  ENTRY_POINT                    = AndroidBootAppEntryPoint
+
+[Sources.common]
+  AndroidBootApp.c
+  AndroidBootImg.c
+
+[Sources.ARM, Sources.AARCH64]
+  Arm/BootAndroidBootImg.c
+
+[LibraryClasses]
+  BaseLib
+  BaseMemoryLib
+  BdsLib
+  DebugLib
+  DevicePathLib
+  DxeServicesTableLib
+  FdtLib
+  MemoryAllocationLib
+  PcdLib
+  PrintLib
+  UefiApplicationEntryPoint
+  UefiBootServicesTableLib
+  UefiLib
+  UefiRuntimeServicesTableLib
+
+[Protocols]
+  gAndroidFastbootPlatformProtocolGuid
+  gEfiBlockIoProtocolGuid
+  gEfiDevicePathFromTextProtocolGuid
+  gEfiSimpleTextOutProtocolGuid
+  gEfiSimpleTextInProtocolGuid
+
+[Packages]
+  EmbeddedPkg/EmbeddedPkg.dec
+  MdeModulePkg/MdeModulePkg.dec
+  MdePkg/MdePkg.dec
+
+[Packages.ARM, Packages.AARCH64]
+  ArmPkg/ArmPkg.dec
+  ArmPlatformPkg/ArmPlatformPkg.dec
+
+[Guids]
+  gFdtTableGuid
+
+[Pcd]
+  gEmbeddedTokenSpaceGuid.PcdAndroidBootDevicePath
diff --git a/EmbeddedPkg/Application/AndroidBoot/AndroidBootImg.c b/EmbeddedPkg/Application/AndroidBoot/AndroidBootImg.c
new file mode 100644
index 0000000..abfd8c6
--- /dev/null
+++ b/EmbeddedPkg/Application/AndroidBoot/AndroidBootImg.c
@@ -0,0 +1,91 @@
+/** @file
+
+  Copyright (c) 2013-2014, ARM Ltd. All rights reserved.<BR>
+
+  This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include "AndroidBootApp.h"
+
+#define BOOT_MAGIC        "ANDROID!"
+#define BOOT_MAGIC_LENGTH sizeof (BOOT_MAGIC) - 1
+
+// Check Val (unsigned) is a power of 2 (has only one bit set)
+#define IS_POWER_OF_2(Val) (Val != 0 && ((Val & (Val - 1)) == 0))
+
+// No documentation for this really - sizes of fields has been determined
+// empirically.
+#pragma pack(1)
+typedef struct {
+  CHAR8   BootMagic[BOOT_MAGIC_LENGTH];
+  UINT32  KernelSize;
+  UINT32  KernelAddress;
+  UINT32  RamdiskSize;
+  UINT32  RamdiskAddress;
+  UINT32  SecondStageBootloaderSize;
+  UINT32  SecondStageBootloaderAddress;
+  UINT32  KernelTaggsAddress;
+  UINT32  PageSize;
+  UINT32  Reserved[2];
+  CHAR8   ProductName[16];
+  CHAR8   KernelArgs[BOOTIMG_KERNEL_ARGS_SIZE];
+  UINT32  Id[32];
+} ANDROID_BOOTIMG_HEADER;
+#pragma pack()
+
+// Find the kernel and ramdisk in an Android boot.img.
+// return EFI_INVALID_PARAMTER if the boot.img is invalid (i.e. doesn't have the
+//  right magic value),
+// return EFI_NOT_FOUND if there was no kernel in the boot.img.
+// Note that the Ramdisk is optional - *Ramdisk won't be touched if it isn't
+// present, but RamdiskSize will be set to 0.
+EFI_STATUS
+ParseAndroidBootImg (
+  IN  VOID    *BootImg,
+  OUT VOID   **Kernel,
+  OUT UINTN   *KernelSize,
+  OUT VOID   **Ramdisk,
+  OUT UINTN   *RamdiskSize,
+  OUT CHAR8   *KernelArgs
+  )
+{
+  ANDROID_BOOTIMG_HEADER   *Header;
+  UINT8                    *BootImgBytePtr;
+
+  // Cast to UINT8 so we can do pointer arithmetic
+  BootImgBytePtr = (UINT8 *) BootImg;
+
+  Header = (ANDROID_BOOTIMG_HEADER *) BootImg;
+
+  if (AsciiStrnCmp (Header->BootMagic, BOOT_MAGIC, BOOT_MAGIC_LENGTH) != 0) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if (Header->KernelSize == 0) {
+    return EFI_NOT_FOUND;
+  }
+
+  ASSERT (IS_POWER_OF_2 (Header->PageSize));
+
+  *KernelSize = Header->KernelSize;
+  *Kernel = BootImgBytePtr + Header->PageSize;
+  *RamdiskSize = Header->RamdiskSize;
+
+  if (Header->RamdiskSize != 0) {
+    *Ramdisk = (VOID *) (BootImgBytePtr
+                 + Header->PageSize
+                 + ALIGN_VALUE (Header->KernelSize, Header->PageSize));
+  }
+
+  AsciiStrnCpyS (KernelArgs, BOOTIMG_KERNEL_ARGS_SIZE, Header->KernelArgs,
+    BOOTIMG_KERNEL_ARGS_SIZE);
+
+  return EFI_SUCCESS;
+}
diff --git a/EmbeddedPkg/Application/AndroidBoot/Arm/BootAndroidBootImg.c b/EmbeddedPkg/Application/AndroidBoot/Arm/BootAndroidBootImg.c
new file mode 100644
index 0000000..87b657d
--- /dev/null
+++ b/EmbeddedPkg/Application/AndroidBoot/Arm/BootAndroidBootImg.c
@@ -0,0 +1,268 @@
+/** @file
+
+  Copyright (c) 2013-2015, ARM Ltd. All rights reserved.<BR>
+  Copyright (c) 2017, Linaro. All rights reserved.
+
+  This program and the accompanying materials
+  are licensed and made available under the terms and conditions of the BSD License
+  which accompanies this distribution.  The full text of the license may be found at
+  http://opensource.org/licenses/bsd-license.php
+
+  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+
+**/
+
+#include <Protocol/DevicePath.h>
+#include <Protocol/LoadedImage.h>
+
+#include <Library/BdsLib.h>
+#include <Library/DevicePathLib.h>
+#include <Library/MemoryAllocationLib.h>
+#include <Library/PrintLib.h>
+#include <Library/UefiBootServicesTableLib.h>
+#include <Library/UefiLib.h>
+
+#include <libfdt.h>
+
+#include "AndroidBootApp.h"
+
+#define ALIGN(x, a)     (((x) + ((a) - 1)) & ~((a) - 1))
+
+// Additional size that could be used for FDT entries added by the UEFI OS Loader
+#define FDT_ADDITIONAL_ENTRIES_SIZE       0x400
+
+// Device Path representing an image in memory
+#pragma pack(1)
+typedef struct {
+  MEMMAP_DEVICE_PATH                      Node1;
+  EFI_DEVICE_PATH_PROTOCOL                End;
+} MEMORY_DEVICE_PATH;
+#pragma pack()
+
+/* It's the value of arm64 efi stub kernel */
+#define KERNEL_IMAGE_STEXT_OFFSET         0x12C
+#define KERNEL_IMAGE_RAW_SIZE_OFFSET      0x130
+
+#define FDT_SIZE_OFFSET                   0x4
+
+STATIC CONST MEMORY_DEVICE_PATH MemoryDevicePathTemplate =
+{
+  {
+    {
+      HARDWARE_DEVICE_PATH,
+      HW_MEMMAP_DP,
+      {
+        (UINT8)(sizeof (MEMMAP_DEVICE_PATH)),
+        (UINT8)((sizeof (MEMMAP_DEVICE_PATH)) >> 8),
+      },
+    }, // Header
+    0, // StartingAddress (set at runtime)
+    0  // EndingAddress   (set at runtime)
+  }, // Node1
+  {
+    END_DEVICE_PATH_TYPE,
+    END_ENTIRE_DEVICE_PATH_SUBTYPE,
+    { sizeof (EFI_DEVICE_PATH_PROTOCOL), 0 }
+  } // End
+};
+
+EFI_STATUS
+PrepareFdt (
+  IN EFI_PHYSICAL_ADDRESS             FdtBlobBase,
+  IN UINTN                           *FdtBlobSize,
+  IN OUT CHAR16                      *KernelArgs
+  )
+{
+  VOID                               *fdt;
+  INTN                                err;
+  INTN                                node;
+  INT32                               lenp;
+  CONST VOID                         *BootArg;
+  UINTN                               OriginalFdtSize;
+  EFI_STATUS                          Status;
+  EFI_PHYSICAL_ADDRESS                NewFdtBlobBase;
+  UINTN                               NewFdtBlobSize;
+  CHAR16                              Arg[BOOTIMG_KERNEL_ARGS_SIZE];
+  UINTN                               Size;
+
+  //
+  // Sanity checks on the original FDT blob.
+  //
+  err = fdt_check_header ((VOID*)(UINTN)FdtBlobBase);
+  if (err != 0) {
+    Print (L"ERROR: Device Tree header not valid (err:%d)\n", err);
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // The original FDT blob might have been loaded partially.
+  // Check that it is not the case.
+  OriginalFdtSize = (UINTN)fdt_totalsize ((VOID*)(UINTN)FdtBlobBase);
+  if (OriginalFdtSize > *FdtBlobSize) {
+    Print (L"ERROR: Incomplete FDT. Only %d/%d bytes have been loaded.\n",
+           FdtBlobSize, OriginalFdtSize);
+    return EFI_INVALID_PARAMETER;
+  }
+
+  //
+  // Relocate the FDT to its final location since some platform may update FDT.
+  //
+  Size = OriginalFdtSize + FDT_ADDITIONAL_ENTRIES_SIZE;
+  NewFdtBlobSize = ALIGN (Size, EFI_PAGE_SIZE);
+
+  // Try anywhere there is available space.
+  Status = gBS->AllocatePages (AllocateAnyPages, EfiBootServicesData,
+                  EFI_SIZE_TO_PAGES (NewFdtBlobSize), &NewFdtBlobBase);
+  if (EFI_ERROR (Status)) {
+    ASSERT_EFI_ERROR (Status);
+    return EFI_OUT_OF_RESOURCES;
+  } else {
+    DEBUG ((EFI_D_WARN, "WARNING: Loaded FDT at random address 0x%lX.\nWARNING: There is a risk of accidental overwriting by other code/data.\n", NewFdtBlobBase));
+  }
+
+  // Load the Original FDT tree into the new region
+  err = fdt_open_into ((VOID*)(UINTN) FdtBlobBase,
+            (VOID*)(UINTN)(NewFdtBlobBase), NewFdtBlobSize);
+  if (err) {
+    DEBUG ((EFI_D_ERROR, "fdt_open_into(): %a\n", fdt_strerror (err)));
+    gBS->FreePages (NewFdtBlobBase, EFI_SIZE_TO_PAGES (NewFdtBlobSize));
+    return EFI_INVALID_PARAMETER;
+  }
+
+  // If we succeeded to generate the new Device Tree then free the old Device Tree
+  gBS->FreePages (FdtBlobBase, EFI_SIZE_TO_PAGES (OriginalFdtSize));
+
+  fdt = (VOID*)(UINTN)NewFdtBlobBase;
+
+  node = fdt_subnode_offset (fdt, 0, "chosen");
+  if (node < 0) {
+    // The 'chosen' node does not exist, create it
+    node = fdt_add_subnode (fdt, 0, "chosen");
+    if (node < 0) {
+      DEBUG ((EFI_D_ERROR, "Error on finding 'chosen' node\n"));
+      Status = EFI_INVALID_PARAMETER;
+      goto FAIL_COMPLETE_FDT;
+    }
+  }
+
+  // Merge bootargs into command line arguments
+  BootArg = fdt_getprop (fdt, node, "bootargs", &lenp);
+  if (BootArg != NULL) {
+    AsciiStrToUnicodeStrS (BootArg, Arg, BOOTIMG_KERNEL_ARGS_SIZE);
+    // StrCatS() is using the size of CHAR16
+    StrCatS (KernelArgs, BOOTIMG_KERNEL_ARGS_SIZE >> 1, L" ");
+    StrCatS (KernelArgs, BOOTIMG_KERNEL_ARGS_SIZE >> 1, Arg);
+  }
+
+  // Update the real size of the Device Tree
+  fdt_pack ((VOID*)(UINTN)(NewFdtBlobBase));
+
+  *FdtBlobSize = (UINTN)fdt_totalsize ((VOID*)(UINTN)(NewFdtBlobBase));
+
+  Status = gBS->InstallConfigurationTable (
+                  &gFdtTableGuid,
+                  (VOID *)(UINTN)NewFdtBlobBase
+                  );
+  return Status;
+
+FAIL_COMPLETE_FDT:
+  gBS->FreePages (NewFdtBlobBase, EFI_SIZE_TO_PAGES (NewFdtBlobSize));
+
+  return EFI_SUCCESS;
+}
+
+EFI_STATUS
+BootAndroidBootImg (
+  IN FASTBOOT_PLATFORM_PROTOCOL      *Platform,
+  IN UINTN                            BufferSize,
+  IN VOID                            *Buffer
+  )
+{
+  EFI_STATUS                          Status;
+  CHAR8                               KernelArgs[BOOTIMG_KERNEL_ARGS_SIZE];
+  VOID                               *Kernel;
+  UINTN                               KernelSize;
+  VOID                               *Ramdisk;
+  UINTN                               RamdiskSize;
+  MEMORY_DEVICE_PATH                  KernelDevicePath;
+  EFI_HANDLE                          ImageHandle;
+  EFI_PHYSICAL_ADDRESS                FdtBase;
+  UINTN                               FdtSize, Index;
+  UINT8                              *FdtPtr;
+  VOID                               *NewKernelArg;
+  EFI_LOADED_IMAGE_PROTOCOL          *ImageInfo;
+  CHAR16                             *PlatformKernelArgs;
+
+  Status = ParseAndroidBootImg (
+            Buffer,
+            &Kernel,
+            &KernelSize,
+            &Ramdisk,
+            &RamdiskSize,
+            KernelArgs
+            );
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  /* Install Fdt that is attached at the end of kernel */
+  KernelSize = *(UINT32 *)((EFI_PHYSICAL_ADDRESS)(UINTN)Kernel + KERNEL_IMAGE_STEXT_OFFSET) +
+               *(UINT32 *)((EFI_PHYSICAL_ADDRESS)(UINTN)Kernel + KERNEL_IMAGE_RAW_SIZE_OFFSET);
+
+  /* FDT is at the end of kernel image */
+  FdtBase = (EFI_PHYSICAL_ADDRESS)(UINTN)Kernel + KernelSize;
+  FdtPtr = (UINT8 *)(FdtBase + FDT_SIZE_OFFSET);
+  for (Index = 0, FdtSize = 0; Index < sizeof (UINT32); Index++) {
+    FdtSize |= *FdtPtr << ((sizeof (UINT32) - 1 - Index) * 8);
+    FdtPtr++;
+  }
+
+  NewKernelArg = AllocateZeroPool (BOOTIMG_KERNEL_ARGS_SIZE);
+  if (NewKernelArg == NULL) {
+    DEBUG ((DEBUG_ERROR, "Fail to allocate memory\n"));
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  // Set the ramdisk in command line arguments
+  UnicodeSPrint (
+    (CHAR16 *)NewKernelArg, BOOTIMG_KERNEL_ARGS_SIZE,
+    L"initrd=0x%x,0x%x ",
+    (UINTN)Ramdisk, (UINTN)RamdiskSize
+    );
+  // Merge kernel arguments from Android boot image into command line arguments
+  AsciiStrToUnicodeStrS (KernelArgs, NewKernelArg + StrLen (NewKernelArg) * sizeof (CHAR16), BOOTIMG_KERNEL_ARGS_SIZE >> 1);
+  // StrCatS() is using the size of CHAR16
+  StrCatS ((CHAR16 *)NewKernelArg, BOOTIMG_KERNEL_ARGS_SIZE >> 1, L" ");
+  // Merge platform arguemnts into command line arguments
+  PlatformKernelArgs = Platform->GetKernelArgs ();
+  if (PlatformKernelArgs) {
+    StrCatS ((CHAR16 *)NewKernelArg, BOOTIMG_KERNEL_ARGS_SIZE >> 1, PlatformKernelArgs);
+  }
+  Status = PrepareFdt (FdtBase, &FdtSize, NewKernelArg);
+  if (EFI_ERROR (Status)) {
+    FreePool (NewKernelArg);
+    return EFI_INVALID_PARAMETER;
+  }
+
+  KernelDevicePath = MemoryDevicePathTemplate;
+
+  // Have to cast to UINTN before casting to EFI_PHYSICAL_ADDRESS in order to
+  // appease GCC.
+  KernelDevicePath.Node1.StartingAddress = (EFI_PHYSICAL_ADDRESS)(UINTN) Kernel;
+  KernelDevicePath.Node1.EndingAddress   = (EFI_PHYSICAL_ADDRESS)(UINTN) Kernel + KernelSize;
+
+  Status = gBS->LoadImage (TRUE, gImageHandle, (EFI_DEVICE_PATH *)&KernelDevicePath, (VOID*)(UINTN)Kernel, KernelSize, &ImageHandle);
+
+  // Set kernel arguments
+  Status = gBS->HandleProtocol (ImageHandle, &gEfiLoadedImageProtocolGuid, (VOID **) &ImageInfo);
+  ImageInfo->LoadOptions = NewKernelArg;
+  ImageInfo->LoadOptionsSize = StrLen (NewKernelArg) * sizeof (CHAR16);
+
+  // Before calling the image, enable the Watchdog Timer for  the 5 Minute period
+  gBS->SetWatchdogTimer (5 * 60, 0x0000, 0x00, NULL);
+  // Start the image
+  Status = gBS->StartImage (ImageHandle, NULL, NULL);
+  // Clear the Watchdog Timer after the image returns
+  gBS->SetWatchdogTimer (0x0000, 0x0000, 0x0000, NULL);
+  return EFI_SUCCESS;
+}
-- 
2.7.4