[Feature]add MT2731_MP2_MR2_SVN388 baseline version

Change-Id: Ief04314834b31e27effab435d3ca8ba33b499059
diff --git a/src/bsp/lk/app/blxboot/avb.c b/src/bsp/lk/app/blxboot/avb.c
new file mode 100644
index 0000000..fbeea72
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/avb.c
@@ -0,0 +1,406 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include <lib/bio.h>
+#include <lib/dl_commands.h>
+/* VERIFIED BOOT 2 */
+#include <libavb/libavb.h>
+#include <libavb_ab/libavb_ab.h>
+
+#include <platform/mmc_rpmb.h>
+#include <sys/types.h>
+#include <string.h>
+
+#include "blxboot_ab.h"
+
+static AvbIOResult mt_read_from_partition(AvbOps *ops,
+        const char *partition,
+        int64_t offset,
+        size_t num_bytes,
+        void *buffer,
+        size_t *out_num_read)
+{
+    bdev_t *bdev;
+    off_t part_size;
+    size_t read_bytes;
+
+    bdev = bio_open_by_label(partition) ? : bio_open(partition);
+    if (!bdev) {
+        dprintf(CRITICAL, "Partition [%s] is not exist.\n", partition);
+        return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
+    }
+
+    part_size = bdev->total_size;
+
+    if (offset < 0) {
+        if (-offset > part_size) {
+            bio_close(bdev);
+            return AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION;
+        }
+
+        offset += part_size;
+    }
+
+    if (offset+num_bytes > (uint64_t)part_size) {
+        bio_close(bdev);
+        return AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION;
+    }
+
+    read_bytes = bio_read(bdev, buffer, offset, num_bytes);
+
+    if (out_num_read != NULL)
+        *out_num_read = read_bytes;
+
+    bio_close(bdev);
+    return AVB_IO_RESULT_OK;
+}
+
+static AvbIOResult mt_write_to_partition(AvbOps *ops,
+        const char *partition,
+        int64_t offset,
+        size_t num_bytes,
+        const void *buffer)
+{
+    bdev_t *bdev;
+    off_t part_size;
+    size_t write_bytes;
+
+    bdev = bio_open_by_label(partition) ? : bio_open(partition);
+    if (!bdev) {
+        dprintf(CRITICAL, "Partition [%s] is not exist.\n", partition);
+        return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
+    }
+
+    part_size = bdev->total_size;
+
+    if (offset < 0) {
+        if (-offset > part_size) {
+            bio_close(bdev);
+            return AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION;
+        }
+
+        offset += part_size;
+    }
+
+    if (offset+num_bytes > (uint64_t)part_size) {
+        bio_close(bdev);
+        return AVB_IO_RESULT_ERROR_RANGE_OUTSIDE_PARTITION;
+    }
+
+    write_bytes = bio_write(bdev, buffer,offset, num_bytes);
+
+    if (write_bytes != num_bytes) {
+        bio_close(bdev);
+        return AVB_IO_RESULT_ERROR_IO;
+    }
+
+    bio_close(bdev);
+    return AVB_IO_RESULT_OK;
+}
+
+#ifdef AVB_ENABLE_ANTIROLLBACK
+typedef struct {
+    uint64_t rollback_indexes[AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS];
+} rollback_indexes_t;
+#define VERIDX_IN_PRMB 0
+/*antirollback index is stored in rpmb region block 1*/
+static AvbIOResult mt_read_rollback_index(AvbOps *ops,
+        size_t rollback_index_location,
+        uint64_t *out_rollback_index)
+{
+    int ret=0;
+    unsigned char blk[256] = {0};
+    ret = mmc_rpmb_block_read(VERIDX_IN_PRMB,blk);
+    if (ret != 0 ) {
+        *out_rollback_index = 0;
+        return AVB_IO_RESULT_OK;
+    }
+    rollback_indexes_t *indexes = (rollback_indexes_t *)blk;
+    *out_rollback_index=indexes->rollback_indexes[rollback_index_location];
+#if 0
+    dprintf(CRITICAL, "indexes read: %08llx %08llx %08llx %08llx\n",
+            indexes->rollback_indexes[0], indexes->rollback_indexes[1],
+            indexes->rollback_indexes[2], indexes->rollback_indexes[3]);
+#endif
+    return AVB_IO_RESULT_OK;
+}
+
+static AvbIOResult mt_write_rollback_index(AvbOps *ops,
+        size_t rollback_index_location,
+        uint64_t rollback_index)
+{
+    int ret=0;
+    unsigned char blk[256] = {0};
+    ret = mmc_rpmb_block_read(VERIDX_IN_PRMB,blk);
+    if (ret != 0 ) {
+        return AVB_IO_RESULT_ERROR_IO;
+    }
+    rollback_indexes_t *indexes = (rollback_indexes_t *)blk;
+    indexes->rollback_indexes[rollback_index_location] = rollback_index;
+#if 0
+    dprintf(CRITICAL, "indexes write: %08llx %08llx %08llx %08llx\n",
+            indexes->rollback_indexes[0], indexes->rollback_indexes[1],
+            indexes->rollback_indexes[2], indexes->rollback_indexes[3]);
+#endif
+    ret = mmc_rpmb_block_write(VERIDX_IN_PRMB,(unsigned char *)indexes);
+    if (ret != 0 ) {
+        return AVB_IO_RESULT_ERROR_IO;
+    }
+    return AVB_IO_RESULT_OK;
+}
+#else
+static AvbIOResult mt_read_rollback_index(AvbOps *ops,
+        size_t rollback_index_location,
+        uint64_t *out_rollback_index)
+{
+    *out_rollback_index = 0;
+    return AVB_IO_RESULT_OK;
+}
+
+static AvbIOResult mt_write_rollback_index(AvbOps *ops,
+        size_t rollback_index_location,
+        uint64_t rollback_index)
+{
+    return AVB_IO_RESULT_OK;
+}
+#endif
+
+#define INDEX_RPMB_UNLOCK 1
+#define AVB_DEVICE_UNLOCK 0x5a
+static AvbIOResult mt_read_is_device_unlocked(AvbOps *ops, bool *out_is_unlocked)
+{
+    if (out_is_unlocked != NULL) {
+        *out_is_unlocked = false;
+    }
+
+#if defined(AVB_ENABLE_ANTIROLLBACK) || defined(AVB_ENABLE_DEVICE_STATE_CHANGE)
+    unsigned char blk[256]= {0};
+    int ret = -1;
+
+    ret=mmc_rpmb_block_read(INDEX_RPMB_UNLOCK,&blk[0]);
+    if (ret != 0) {
+        dprintf(CRITICAL, "mmc_rpmb_block_read fail %d.\n", ret);
+        return AVB_IO_RESULT_ERROR_IO;
+    }
+
+    if (blk[0] == AVB_DEVICE_UNLOCK)
+        *out_is_unlocked = true;
+#endif
+
+    dprintf(CRITICAL, "mt_read_is_device_unlocked return: %d.\n", *out_is_unlocked);
+
+    return AVB_IO_RESULT_OK;
+}
+
+static AvbIOResult mt_get_unique_node_for_partition(AvbOps *ops,
+        const char *partition,
+        char *guid_buf,
+        size_t guid_buf_size)
+{
+
+    strlcpy(guid_buf, "/dev/ubiblock0_0", guid_buf_size);
+    return AVB_IO_RESULT_OK;
+
+}
+static AvbIOResult mt_get_unique_guid_for_partition(AvbOps *ops,
+        const char *partition,
+        char *guid_buf,
+        size_t guid_buf_size)
+{
+    bdev_t *bdev;
+
+    bdev = bio_open_by_label(partition) ? : bio_open(partition);
+    if (!bdev) {
+        dprintf(CRITICAL, "Partition [%s] is not exist.\n", partition);
+        return AVB_IO_RESULT_ERROR_NO_SUCH_PARTITION;
+    }
+
+    strlcpy(guid_buf, bdev->unique_uuid, guid_buf_size);
+    bio_close(bdev);
+    return AVB_IO_RESULT_OK;
+}
+
+#include <libfdt.h>
+#include <image.h>
+extern const unsigned char blob[];
+static const unsigned char *get_pubkey_in_blob(void)
+{
+    int sig_node;
+    int noffset;
+    const void *sig_blob=&blob[0];
+    sig_node = fdt_subnode_offset(sig_blob, 0, FDT_SIG_NODE);
+    for (noffset = fdt_first_subnode(sig_blob, sig_node);
+            noffset >= 0;
+            noffset = fdt_next_subnode(sig_blob, noffset)) {
+        return (const unsigned char *)fdt_getprop(sig_blob, noffset, BLOB_MOD_NODE, NULL);
+    }
+    return NULL;
+}
+
+static AvbIOResult mt_validate_vbmeta_public_key(AvbOps *ops,
+        const uint8_t *public_key_data,
+        size_t public_key_length,
+        const uint8_t *public_key_metadata,
+        size_t public_key_metadata_length,
+        bool *out_is_trusted)
+{
+    unsigned char *pubkey_in_blob;
+    unsigned char *pubkey_in_footer;
+    AvbRSAPublicKeyHeader *header;
+
+    header = (AvbRSAPublicKeyHeader *)public_key_data;
+    pubkey_in_blob = (unsigned char *)get_pubkey_in_blob();
+    if (!pubkey_in_blob) {
+        avb_error("Public key is NULL in blob\n");
+        return AVB_IO_RESULT_ERROR_NO_SUCH_VALUE;
+    }
+    pubkey_in_footer = (unsigned char *)(public_key_data+sizeof(AvbRSAPublicKeyHeader));
+    if (memcmp(pubkey_in_blob,pubkey_in_footer,avb_be32toh(header->key_num_bits)/32)==0) {
+        *out_is_trusted = true;
+    } else {
+        *out_is_trusted = false;
+    }
+
+    return AVB_IO_RESULT_OK;
+}
+
+static AvbOps avbops;
+
+static AvbABOps avbabops = {
+    .ops = &avbops,
+
+    .read_ab_metadata = avb_ab_data_read,
+    .write_ab_metadata = avb_ab_data_write,
+};
+
+static AvbIOResult mt_get_size_of_partition(AvbOps *ops,
+        const char *partition,
+        uint64_t *out_size_num_bytes)
+{
+    bdev_t *bdev;
+
+    bdev = bio_open_by_label(partition) ? : bio_open(partition);
+    *out_size_num_bytes = (uint64_t)bdev->total_size;
+    return AVB_IO_RESULT_OK;
+}
+
+static AvbOps avbops = {
+    .ab_ops = &avbabops,
+
+    .read_from_partition = mt_read_from_partition,
+    .write_to_partition = mt_write_to_partition,
+    .validate_vbmeta_public_key = mt_validate_vbmeta_public_key,
+    .read_rollback_index = mt_read_rollback_index,
+    .write_rollback_index = mt_write_rollback_index,
+    .read_is_device_unlocked = mt_read_is_device_unlocked,
+    .get_size_of_partition = mt_get_size_of_partition,
+#ifdef BOOT_DEV_NAND
+    .get_unique_guid_for_partition = mt_get_unique_node_for_partition,
+#else
+    .get_unique_guid_for_partition = mt_get_unique_guid_for_partition,
+#endif
+};
+
+bool is_device_unlocked(void)
+{
+    AvbIOResult io_ret;
+    bool is_device_unlocked;
+    io_ret = avbops.read_is_device_unlocked(&avbops, &is_device_unlocked);
+    if (io_ret != AVB_IO_RESULT_OK) {
+        //any error treat as locked
+        return false;
+    }
+    return is_device_unlocked;
+}
+
+void *get_partition_data(const char *part_name, AvbSlotVerifyData *verifyData)
+{
+    size_t i=0;
+
+    if ((part_name == NULL) || (verifyData == NULL))
+        return NULL;
+
+    for (; i<verifyData->num_loaded_partitions; i++) {
+        if (avb_strcmp(part_name,verifyData->loaded_partitions[i].partition_name)==0) {
+            return verifyData->loaded_partitions[i].data;
+        }
+    }
+    return NULL;
+}
+
+AvbSlotVerifyResult avb_update_rollback_indexes(AvbOps *ops,AvbSlotVerifyData *verifyData)
+{
+    size_t n = 0;
+    AvbIOResult io_ret;
+    AvbSlotVerifyResult ret = AVB_SLOT_VERIFY_RESULT_OK;
+    /* Update stored rollback index such that the stored rollback index
+    * is the largest value supporting all currently bootable slots. Do
+    * this for every rollback index location.
+    */
+    for (n = 0; n < AVB_MAX_NUMBER_OF_ROLLBACK_INDEX_LOCATIONS; n++) {
+        uint64_t rollback_index_value = 0;
+
+        rollback_index_value = verifyData->rollback_indexes[n];
+        if (rollback_index_value != 0) {
+            uint64_t current_rollback_index_value;
+            io_ret = ops->read_rollback_index(ops, n, &current_rollback_index_value);
+            if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+                ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+                goto out;
+            } else if (io_ret != AVB_IO_RESULT_OK) {
+                avb_error("Error getting rollback index for slot.\n");
+                ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+                goto out;
+            }
+            if (current_rollback_index_value != rollback_index_value) {
+                io_ret = ops->write_rollback_index(ops, n, rollback_index_value);
+                if (io_ret == AVB_IO_RESULT_ERROR_OOM) {
+                    ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+                    goto out;
+                } else if (io_ret != AVB_IO_RESULT_OK) {
+                    avb_error("Error setting stored rollback index.\n");
+                    ret = AVB_SLOT_VERIFY_RESULT_ERROR_OOM;
+                    goto out;
+                }
+            }
+        }
+    }
+out:
+    return ret;
+}
+
+AvbSlotVerifyResult android_verified_boot_2_0(const char *part_name,
+                                              AvbSlotVerifyData **verifyData)
+{
+    AvbSlotVerifyResult verify_result;
+    const char *requested_partitions[] = { part_name, NULL };
+    const char *ab_suffix = get_suffix() ? : "";
+
+    verify_result = avb_slot_verify(&avbops,requested_partitions,ab_suffix,is_device_unlocked(),AVB_HASHTREE_ERROR_MODE_RESTART,verifyData);
+    dprintf(CRITICAL, "avb boot verification result is %s\n",avb_slot_verify_result_to_string(verify_result));
+    if (verify_result == AVB_SLOT_VERIFY_RESULT_OK) {
+        verify_result = avb_update_rollback_indexes(&avbops,*verifyData);
+        dprintf(CRITICAL, "avb boot rollback indexes result is %s\n",avb_slot_verify_result_to_string(verify_result));
+    }
+    return verify_result;
+}
+
diff --git a/src/bsp/lk/app/blxboot/avb.h b/src/bsp/lk/app/blxboot/avb.h
new file mode 100644
index 0000000..18b3fd7
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/avb.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2016 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#pragma once
+
+#include <libavb/libavb.h>
+#include <libavb_ab/libavb_ab.h>
+#include <sys/types.h>
+
+bool is_device_unlocked(void);
+AvbSlotVerifyResult android_verified_boot_2_0(const char *part_name,
+                                              AvbSlotVerifyData **verifyData);
+void *get_partition_data(const char *part_name,AvbSlotVerifyData *verifyData);
+
+
diff --git a/src/bsp/lk/app/blxboot/bl2boot.c b/src/bsp/lk/app/blxboot/bl2boot.c
new file mode 100644
index 0000000..0c2a8f6
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/bl2boot.c
@@ -0,0 +1,295 @@
+/*
+ * Copyright (c) 2018 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#include <assert.h>
+#include <boot_mode.h>
+#include <errno.h>
+#include <kernel/vm.h>
+#include <lib/mempool.h>
+#include <libfdt.h>
+#include <platform.h>
+#include <platform/platform_blx.h>
+#include <stdbool.h>
+#include <string.h>
+#include <trace.h>
+
+#include "blx_common.h"
+#include "blxboot_ab.h"
+#include "blxboot_plat.h"
+
+#define LOCAL_TRACE 0
+
+struct bl2boot {
+    struct blxboot commonboot;
+
+    /* keep image data pointer for quick reference */
+    struct image_load_data *bl33imgdata;
+    struct image_load_data *bootimgdata;
+    struct image_load_data *dtboimgdata;
+    struct image_load_data *tzimgdata;
+    struct image_load_data *vpdimgdata;
+};
+
+enum {
+    ARM32_TO_ARM32,
+    ARM32_TO_ARM64,
+    ARM64_TO_ARM32,
+    ARM64_TO_ARM64,
+};
+
+static bool is_arch_arm64(void)
+{
+#if ARCH_ARM64
+    return true;
+#else
+    return false;
+#endif
+}
+
+static bool is_enabled_builtin_bl33(void)
+{
+#if ENABLE_BUILTIN_BL33
+    return true;
+#else
+    return false;
+#endif
+}
+
+static void update_builtin_bl33(struct blxboot *obj)
+{
+    struct bl2boot *bl2obj = (struct bl2boot *)obj;
+    struct image_load_data *bl33imgdata;
+    uint32_t *bl33;
+
+    if (bl2obj == NULL)
+        return;
+
+    bl33imgdata = bl2obj->bl33imgdata;
+    bl33 = (uint32_t *)paddr_to_kvaddr(bl33imgdata->kernel_entry);
+
+    bl33[12] = (ulong)(bl2obj->bootimgdata->dtb_load);
+    bl33[14] = (unsigned)0;
+    bl33[16] = (unsigned)0;
+    bl33[18] = (unsigned)0;
+    bl33[20] = (ulong)(bl2obj->bootimgdata->kernel_entry);
+    bl33[21] = (ulong)0;
+    bl33[22] = (unsigned)MACH_TYPE;
+}
+
+static int arm_exec_mode_transition(void)
+{
+#if ARCH_ARM64
+    /*Assume BL31 is aarch64 in case BL2 is aarch64. No handling BL2 of aarch64
+      and BL33 of aarch32. */
+    return ARM64_TO_ARM64;
+#else
+#if BL2_BOOT_NEXT_64BITS
+    return ARM32_TO_ARM64;
+#else
+    return ARM32_TO_ARM32;
+#endif
+#endif
+}
+
+void mtk_sip(ulong smc_fid, ulong tz_ep, ulong bl33_addr, ulong boot_reason)
+{
+    jump_func_type jump_func = (jump_func_type)tz_ep;
+    (*jump_func)(bl33_addr, boot_reason, 0UL, 0UL);
+}
+
+static void exitfn_smc64_to_next64(ulong smc_fid, ulong tz_ep,
+                                   ulong bl33_addr, ulong unused0)
+{
+    __asm__ volatile("smc #0\n\t");
+}
+
+static void exitfn_jump32(ulong unused0, ulong tz_ep,
+                          ulong bl33_addr, ulong boot_arg)
+{
+    jump_func_type jump_fn = (jump_func_type)tz_ep;
+    (*jump_fn)(bl33_addr, boot_arg, 0, 0);
+}
+
+__WEAK void platform_set_aarch64_reset_vector(ulong vector)
+{
+    /* implementation in platform, or panic. */
+    PANIC_UNIMPLEMENTED;
+}
+
+static void exitfn_warmreset32_to_next64(ulong unused0, ulong tz_ep,
+        ulong bl33_addr, ulong boot_arg)
+{
+    /* set aarch64 reset vector */
+    platform_set_aarch64_reset_vector(tz_ep);
+
+    /* warm reset to aarch64 */
+#if ARCH_ARM
+    uint32_t tmpr;
+
+    __asm__ volatile(
+        "mrc    p15, 0, %0, c12, c0, 2\n\t"
+        "orr    %0, %0, #1\n\t"
+        "mcr    p15, 0, %0, c12, c0, 2\n\t"
+        "mrc    p15, 0, %0, c12, c0, 2\n\t"
+        "orr    %0, %0, #2\n\t"
+        "mcr    p15, 0, %0, c12, c0, 2\n\t"
+        "mov    r0, %2\n\t"
+        "mov    r1, %3\n\t"
+        "dsb    sy\n\t"
+        "isb    sy\n\t"
+        "wfi\n\t"
+        : "=r" (tmpr)
+        : "0" (tmpr), "r" (bl33_addr), "r" (boot_arg)
+    );
+#endif
+}
+
+static void notify(struct blxboot *obj, struct imageinfo_t *img)
+{
+    struct image_load_data *imgdata = img->imgdata;
+    struct bl2boot *bl2obj = (struct bl2boot *)obj;
+
+    LTRACEF("%s: %s\n", __func__, imgdata->part_name);
+    switch (img->type) {
+        case IMGTYPE_TZ:
+            bl2obj->tzimgdata = imgdata;
+            break;
+        case IMGTYPE_BL33:
+        case IMGTYPE_BUILTIN_BL33:
+            bl2obj->bl33imgdata = imgdata;
+            break;
+        case IMGTYPE_KERNEL:
+            bl2obj->bootimgdata = imgdata;
+            break;
+        case IMGTYPE_DTBO:
+            bl2obj->dtboimgdata = imgdata;
+            break;
+        case IMGTYPE_VPD:
+            bl2obj->vpdimgdata = imgdata;
+            break;
+        case IMGTYPE_SCPSYS:
+            plat_start_scpsys();
+            LTRACEF("start scpsys@%llx\n", current_time_hires());
+            break;
+        default:
+            break;
+    }
+}
+
+static void fixup_image(struct blxboot *obj, void *fdt_dtb)
+{
+    if (is_enabled_builtin_bl33())
+        update_builtin_bl33(obj);
+}
+
+static void setup_boot_param(struct blxboot *obj, struct boot_param *prm)
+{
+    struct bl2boot *bl2obj = (struct bl2boot *)obj;
+    uint32_t boot_mode;
+
+    prm->arg0 = MTK_SIP_KERNEL_BOOT_AARCH64; /* only for 64bits BL2 */
+    prm->arg1 = bl2obj->tzimgdata->kernel_entry; /* next entry point */
+    prm->arg2 = bl2obj->bl33imgdata->kernel_entry; /* next boot param */
+    /* pass bootargs from bl2 to bl33 */
+    extern void *bl2_set_boot_args(uint32_t boot_mode) __attribute__((weak));
+    boot_mode = obj->bootcfg.boot_mode;
+    prm->arg3 = bl2_set_boot_args ?
+                (ulong)kvaddr_to_paddr(bl2_set_boot_args(boot_mode)) : 0;
+}
+
+static int init(void)
+{
+    int rc;
+
+    rc = check_ab_boot();
+    if ((rc == 0) || (rc == -ENOTSUP))
+        return 0;
+
+    return rc;
+}
+
+static void get_overlay_image(struct blxboot *obj, void **fdt_dtb,
+                              void **dtbo, void **vpd)
+{
+    struct bl2boot *bl2obj = (struct bl2boot *)obj;
+
+    assert(obj);
+
+    *fdt_dtb = NULL;
+    *dtbo = NULL;
+    *vpd = NULL;
+    if (!is_enabled_builtin_bl33())
+        return;
+
+    if (bl2obj->bootimgdata)
+        *fdt_dtb = (void *)bl2obj->bootimgdata->dtb_load;
+
+    if (bl2obj->dtboimgdata)
+        *dtbo = (void *)bl2obj->dtboimgdata->dtb_load;
+
+    if (bl2obj->vpdimgdata)
+        *vpd = (void *)bl2obj->vpdimgdata->dtb_load;
+}
+
+struct blxboot *blxboot_create(void)
+{
+    struct bl2boot *bl2obj;
+    struct blxboot *blxobj;
+    struct blxOps *ops;
+    struct blxCfg *cfg;
+
+    bl2obj = mempool_alloc(sizeof(struct bl2boot), MEMPOOL_ANY);
+    if (!bl2obj)
+        return NULL;
+
+    memset(bl2obj, 0, sizeof(struct bl2boot));
+
+    blxobj = (struct blxboot *)bl2obj;
+
+    cfg = &blxobj->bootcfg;
+    cfg->boot_mode = NORMAL_BOOT;
+    cfg->ab_suffix = NULL;
+
+    ops = &blxobj->ops;
+    ops->init = init;
+    ops->notify = notify;
+    ops->fixup_image = fixup_image;
+    ops->setup_boot_param = setup_boot_param;
+    ops->get_overlay_image = get_overlay_image;
+
+    switch (arm_exec_mode_transition()) {
+        case ARM32_TO_ARM32:
+            ops->exit = exitfn_jump32;
+            break;
+        case ARM32_TO_ARM64:
+            ops->exit = exitfn_warmreset32_to_next64;
+            break;
+        case ARM64_TO_ARM32:
+            ops->exit = NULL; /* assert to stop here? */
+            break;
+        case ARM64_TO_ARM64:
+            ops->exit = exitfn_smc64_to_next64;
+            break;
+    }
+
+    return (struct blxboot *)bl2obj;
+}
diff --git a/src/bsp/lk/app/blxboot/bl33boot.c b/src/bsp/lk/app/blxboot/bl33boot.c
new file mode 100644
index 0000000..bfe3815
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/bl33boot.c
@@ -0,0 +1,264 @@
+/*
+ * Copyright (c) 2018 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <assert.h>
+#include <boot_mode.h>
+#include <compiler.h>
+#include <debug.h>
+#include <kernel/vm.h>
+#include <lib/mempool.h>
+#include <libfdt.h>
+#include <platform/psci.h>
+#include <stdbool.h>
+#include <string.h>
+#include <trace.h>
+
+#include "blx_common.h"
+#include "blxboot_plat.h"
+
+#define LOCAL_TRACE 0
+
+#ifndef SLAVE_CPU
+#define SLAVE_CPU                3
+#endif
+#define SLAVE_CPU_COLDBOOT_TAG   0x10000001
+
+struct bl33boot {
+    struct blxboot commonboot;
+
+    /* keep image data pointer for quick reference */
+    struct image_load_data *bootimgdata;
+    struct image_load_data *dtboimgdata;
+    struct image_load_data *vpdimgdata;
+};
+
+enum {
+    ARM32_TO_ARM32,
+    ARM32_TO_ARM64,
+    ARM64_TO_ARM32,
+    ARM64_TO_ARM64,
+};
+
+static bool is_next_boot_64bits(void)
+{
+#if BL33_BOOT_NEXT_64BITS
+    return true;
+#else
+    return false;
+#endif
+}
+
+static int arm_exec_mode_transition(void)
+{
+#if ARCH_ARM64
+#if BL33_BOOT_NEXT_64BITS
+    return ARM64_TO_ARM64;
+#else
+    return ARM64_TO_ARM32;
+#endif
+#else
+#if BL33_BOOT_NEXT_64BITS
+    return ARM32_TO_ARM64;
+#else
+    return ARM32_TO_ARM32;
+#endif
+#endif
+}
+
+/* various bl33 exit functions */
+/* 32bits bl33 to 32bits kernel */
+static void exitfn_jump32(ulong unused0, ulong kernel_ep, ulong machtype,
+                          ulong fdt_addr)
+{
+    jump_func_type jump_fn = (jump_func_type)kernel_ep;
+    (*jump_fn)(0, machtype, fdt_addr, 0);
+}
+
+/* 64bits bl33 to 32bits kernel */
+static void exitfn_smc64_to_next32(ulong smc_fid, ulong kernel_ep,
+                                   ulong machtype, ulong fdt_addr)
+{
+    /* x0 ~ x3 already in place, set x4 */
+    __asm__ volatile("mov x4, %0\n\t"
+                     "smc #0\n\t"
+                     : : "I" (BOOT_AARCH32));
+}
+
+/* 32bits bl33 to 64bits kernel */
+static void exitfn_smc32_to_next64(ulong smc_fid, ulong kernel_ep,
+                                   ulong fdt_addr, ulong unused)
+{
+    /* w0 ~ w3 already in place, set w4 */
+    __asm__ volatile("mov w4, %0\n\t"
+                     "smc #0\n\t"
+                     : : "I" (BOOT_AARCH64));
+}
+
+void mtk_sip(ulong smc_fid, ulong kernel_hyp_ep, ulong fdt_addr)
+{
+    jump_func_type jump_fn = (jump_func_type)kernel_hyp_ep;
+    (*jump_fn)(fdt_addr, 0, 0, 0);
+}
+
+/* 64bits bl33 to 64bits kernel or hypervisor */
+static void exitfn_hvc64_to_next64(ulong smc_fid, ulong kernel_hyp_ep,
+                                   ulong fdt_addr, ulong unused0)
+{
+    __asm__ volatile("hvc #0\n\t");
+}
+
+static void notify(struct blxboot *obj, struct imageinfo_t *img)
+{
+    extern void platform_next_entry(addr_t entry) __attribute__((weak));
+    int ret __UNUSED;
+    paddr_t entry_addr __UNUSED;
+    struct image_load_data *imgdata = img->imgdata;
+    struct bl33boot *bl33obj = (struct bl33boot *)obj;
+
+    LTRACEF("%s: %s\n", __func__, imgdata->part_name);
+    switch (img->type) {
+        case IMGTYPE_KERNEL:
+            bl33obj->bootimgdata = imgdata;
+            break;
+        case IMGTYPE_DTBO:
+            bl33obj->dtboimgdata = imgdata;
+            break;
+        case IMGTYPE_VPD:
+            bl33obj->vpdimgdata = imgdata;
+            break;
+#if ENABLE_SLAVE_CPU_LOAD
+        case IMGTYPE_SLAVE_CPU:
+            if (platform_next_entry) {
+                platform_next_entry(imgdata->kernel_entry);
+                /* entry point for slave CPU */
+                entry_addr = kvaddr_to_paddr ?
+                             kvaddr_to_paddr((void *)&platform_next_entry) :
+                             ((void *)&platform_next_entry);
+            } else {
+                entry_addr = (paddr_t)imgdata->kernel_entry;
+            }
+
+            ret = psci_cpu_on(SLAVE_CPU, (ulong)entry_addr,
+                              SLAVE_CPU_COLDBOOT_TAG);
+            if (ret != E_PSCI_SUCCESS) {
+                /* error handling for adsp cpu on failure */
+                LTRACEF("psci_cpu_on cpu%d fail, err=%d\n", SLAVE_CPU, ret);
+            }
+            break;
+#endif
+        default:
+            break;
+    }
+}
+
+static void setup_kernel32_boot_param(struct blxboot *obj,
+                                      struct boot_param *prm)
+{
+    struct bl33boot *bl33obj = (struct bl33boot *)obj;
+
+    prm->arg0 = MTK_SIP_KERNEL_BOOT_AARCH32; /* used in smc call */
+    prm->arg1 = bl33obj->bootimgdata->kernel_entry;
+    prm->arg2 = MACH_TYPE;
+    prm->arg3 = kvaddr_to_paddr ?
+                kvaddr_to_paddr((void *)bl33obj->bootimgdata->dtb_load) :
+                bl33obj->bootimgdata->dtb_load;
+}
+
+static void setup_kernel64_boot_param(struct blxboot *obj,
+                                      struct boot_param *prm)
+{
+    struct bl33boot *bl33obj = (struct bl33boot *)obj;
+
+    prm->arg0 = MTK_SIP_KERNEL_BOOT_AARCH64;
+    prm->arg1 = bl33obj->bootimgdata->kernel_entry;
+    prm->arg2 = kvaddr_to_paddr ?
+                kvaddr_to_paddr((void *)bl33obj->bootimgdata->dtb_load) :
+                bl33obj->bootimgdata->dtb_load;
+    prm->arg3 = 0; /* unused */
+}
+
+static void get_overlay_image(struct blxboot *obj, void **fdt_dtb,
+                              void **dtbo, void **vpd)
+{
+    struct bl33boot *bl33obj = (struct bl33boot *)obj;
+
+    assert(obj);
+
+    *fdt_dtb = NULL;
+    *dtbo = NULL;
+    *vpd = NULL;
+
+    if (bl33obj->bootimgdata)
+        *fdt_dtb = (void *)bl33obj->bootimgdata->dtb_load;
+
+    if (bl33obj->dtboimgdata)
+        *dtbo = (void *)bl33obj->dtboimgdata->dtb_load;
+
+    if (bl33obj->vpdimgdata)
+        *vpd = (void *)bl33obj->vpdimgdata->dtb_load;
+}
+
+struct blxboot *blxboot_create(void)
+{
+    struct bl33boot *bl33obj;
+    struct blxboot *blxobj;
+    struct blxOps *ops;
+    struct blxCfg *cfg;
+
+    bl33obj = mempool_alloc(sizeof(struct bl33boot), MEMPOOL_ANY);
+    if (!bl33obj)
+        return NULL;
+
+    memset(bl33obj, 0, sizeof(struct bl33boot));
+
+    blxobj = (struct blxboot *)bl33obj;
+
+    cfg = &blxobj->bootcfg;
+    cfg->boot_mode = NORMAL_BOOT;
+    cfg->ab_suffix = NULL;
+
+    ops = &blxobj->ops;
+    ops->init = NULL;
+    ops->notify = notify;
+    ops->fixup_image = NULL;
+    ops->setup_boot_param = is_next_boot_64bits() ?
+                            setup_kernel64_boot_param : setup_kernel32_boot_param;
+    ops->get_overlay_image = get_overlay_image;
+
+    switch (arm_exec_mode_transition()) {
+        case ARM32_TO_ARM32:
+            ops->exit = exitfn_jump32;
+            break;
+        case ARM32_TO_ARM64:
+            ops->exit = exitfn_smc32_to_next64;
+            break;
+        case ARM64_TO_ARM32:
+            ops->exit = exitfn_smc64_to_next32;
+            break;
+        case ARM64_TO_ARM64:
+            ops->exit = exitfn_hvc64_to_next64;
+            break;
+    }
+
+    return (struct blxboot *)bl33obj;
+}
diff --git a/src/bsp/lk/app/blxboot/blx_common.h b/src/bsp/lk/app/blxboot/blx_common.h
new file mode 100644
index 0000000..9921da3
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/blx_common.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2018 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#pragma once
+
+#include "imageinfo.h"
+
+/* smc function id from ATF MTK SiP service */
+#define MTK_SIP_KERNEL_BOOT_AARCH32 0x82000200
+#define MTK_SIP_KERNEL_BOOT_AARCH64 0xc2000200
+
+#define BOOT_AARCH32    0
+#define BOOT_AARCH64    1
+
+extern __WEAK paddr_t kvaddr_to_paddr(void *ptr);
+
+typedef void (*jump_func_type)(ulong arg0, ulong arg1, ulong arg2,
+                               ulong arg3) __NO_RETURN;
+
+struct boot_param {
+    ulong arg0;
+    ulong arg1;
+    ulong arg2;
+    ulong arg3;
+};
+
+struct blxboot;
+
+struct blxOps {
+    int (*init)(void);
+    void (*notify)(struct blxboot *obj, struct imageinfo_t *img);
+    void (*fixup_image)(struct blxboot *obj, void *fdt_dtb);
+    void (*setup_boot_param)(struct blxboot *obj, struct boot_param *prm);
+    void (*exit)(ulong arg0, ulong arg1, ulong arg2, ulong arg3);
+    void (*get_overlay_image)(struct blxboot *obj, void **fdt_dtb,
+                              void **dtbo, void **vpd);
+};
+
+struct blxCfg {
+    uint32_t boot_mode;
+    const char *ab_suffix;
+};
+
+struct blxboot {
+    struct blxOps ops;
+    struct blxCfg bootcfg;
+};
+
+struct blxboot *blxboot_create(void);
+
diff --git a/src/bsp/lk/app/blxboot/blxboot.c b/src/bsp/lk/app/blxboot/blxboot.c
new file mode 100644
index 0000000..5b154ef
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/blxboot.c
@@ -0,0 +1,248 @@
+/*
+ * Copyright (c) 2018 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <app.h>
+#include <assert.h>
+#include <boot_mode.h>
+#include <err.h>
+#include <errno.h>
+#include <fit.h>
+#include <kernel/event.h>
+#include <kernel/thread.h>
+#include <kernel/vm.h>
+#include <libfdt.h>
+#include <lib/dl_commands.h>        /* [TODO] separate rpmb define from fastboot */
+#include <lib/mempool.h>
+#include <platform.h>
+#include <rpmb/include/rpmb_mac.h> /* [TODO] #include <lib/rpmb_mac.h> */
+#include <trace.h>
+
+#include "blx_common.h"
+#include "blxboot_ab.h"
+#include "blxboot_plat.h"
+#include "dto.h"
+#include "imageinfo.h"
+
+#define LOCAL_TRACE 0
+
+extern void ext_boot(void);
+extern struct imageinfo_t imagelist[];
+
+static int load_all_images(struct blxboot *obj)
+{
+    int rc;
+    int load_idx;
+    struct imageinfo_t *img;
+    const char *part_name[3];
+    uint32_t *boot_mode = &(obj->bootcfg.boot_mode);
+
+    img = &imagelist[0];
+    while (img->type != IMGTYPE_NONE) {
+        LTRACEF("image load: %s\n", img->imgdata->part_name);
+
+        ASSERT((img->load != NULL) && (img->imgdata != NULL));
+
+        /* setup the load retry sequence: fastboot -> normal -> recovery */
+        if (*boot_mode == NORMAL_BOOT)
+            load_idx = 1;
+        else if (*boot_mode == RECOVERY_BOOT)
+            load_idx = 0;
+        else /* FASTBOOT_BOOT */
+            load_idx = 2;
+
+        part_name[2] = img->imgdata->membdev_name;
+        part_name[1] = img->imgdata->part_name;
+        part_name[0] = img->imgdata->recovery_part_name;
+
+        /* for non recovery boot partition, no need to try recovery partition
+         * if its name is the same with normal boot partition */
+        if (*boot_mode != RECOVERY_BOOT) {
+            if ((part_name[0] != NULL) && (part_name[1] != NULL) &&
+                (!strcmp(part_name[0], part_name[1])))
+                part_name[0] = NULL;
+        }
+
+        rc = -ENODEV;
+        while (load_idx >= 0) {
+            if (part_name[load_idx] != NULL) {
+                rc = img->load(part_name[load_idx], img);
+                if (rc == 0)
+                    break;
+            }
+
+            load_idx--;
+        }
+
+        if (rc == 0) {
+            if (obj->ops.notify)
+                obj->ops.notify(obj, img);
+        } else {
+            LTRACEF("load part: %s, type=%d failed\n",
+                    img->imgdata->part_name, img->type);
+            if ((img->type != IMGTYPE_DTBO) && (img->type != IMGTYPE_VPD))
+                return -1;
+
+            /* dtbo/vpd image: allow partition not exist or no valid data.
+             * Other cases, boot fail */
+            if ((rc != -ENODEV) && (rc != -ENOTSUP))
+                return -1;
+        }
+        img++;
+    }
+
+    return 0;
+}
+
+static void append_suffix(const char **name, const char *suffix, int suffix_len)
+{
+    char *new_name;
+    int len;
+
+    len = strlen(*name) + suffix_len + 1;
+    new_name = mempool_alloc(len, MEMPOOL_ANY);
+    ASSERT(new_name != NULL);
+    sprintf(new_name, "%s%s", *name, suffix);
+    *name = new_name;
+}
+
+static void update_image_partition_name(const char *suffix)
+{
+    struct imageinfo_t *img;
+    struct image_load_data *imgdata;
+    int suffix_len;
+
+    suffix_len = strlen(suffix);
+    for (img = &imagelist[0]; img->type != IMGTYPE_NONE; img++) {
+        ASSERT((img != NULL) && (img->imgdata != NULL));
+        imgdata = img->imgdata;
+        if (!imgdata->has_slot)
+            continue;
+
+        append_suffix(&imgdata->part_name, suffix, suffix_len);
+        if (imgdata->recovery_part_name)
+            append_suffix(&imgdata->recovery_part_name, suffix, suffix_len);
+    }
+}
+
+static void blxboot_task(const struct app_descriptor *app, void *args)
+{
+    struct blxboot *blxobj;
+    struct boot_param bprm;
+    bool fastboot_on_fail;
+    uint32_t *boot_mode;
+    void *fdt_dtb, *dtbo, *vpd;
+    int rc;
+
+#if (defined AVB_ENABLE_ANTIROLLBACK) || (defined AVB_ENABLE_DEVICE_STATE_CHANGE)
+    rpmb_init();
+#endif
+
+    if (plat_fixup_init() != NO_ERROR)
+        return;
+
+    blxobj = blxboot_create();
+    if (!blxobj)
+        return;
+
+    boot_mode = &(blxobj->bootcfg.boot_mode);
+    *boot_mode = get_boot_mode();
+    assert(*boot_mode <= FASTBOOT_BOOT);
+
+    if (blxobj->ops.init) {
+        rc = blxobj->ops.init();
+        /*
+         * if init fails, and boot mode is
+         *   - fastboot mode: enter fastboot mode
+         *   - non fastboot mode:
+         *       . AB OTA updater enabled: reboot,
+         *       . non AB OTA updater: enter fastboot mode
+         */
+        if (rc && (*boot_mode != FASTBOOT_BOOT)) {
+            if (is_enabled_ab_ota_updater())
+                platform_halt(HALT_ACTION_REBOOT, HALT_REASON_SW_RESET);
+            else
+                *boot_mode = FASTBOOT_BOOT;
+        }
+    }
+
+    blxobj->bootcfg.ab_suffix = get_suffix();
+    if (blxobj->bootcfg.ab_suffix != NULL)
+        update_image_partition_name(blxobj->bootcfg.ab_suffix);
+
+    if (is_enabled_ab_ota_updater())
+        fastboot_on_fail = false;
+    else
+        fastboot_on_fail = true; /* enter fastboot mode if load fail */
+
+    do {
+        if (*boot_mode == FASTBOOT_BOOT) {
+            ext_boot();
+            fastboot_on_fail = false;
+        }
+
+        if ((rc = load_all_images(blxobj)) == 0)
+            break;
+
+        if (fastboot_on_fail)
+            *boot_mode = FASTBOOT_BOOT;
+    } while (fastboot_on_fail);
+
+    if (rc != 0) {
+        if (is_enabled_ab_ota_updater())
+            platform_halt(HALT_ACTION_REBOOT, HALT_REASON_SW_RESET);
+
+        return;
+    }
+
+    /* dtbo may contains kernel bootargs, do overlay_fdt before fixup_image */
+    blxobj->ops.get_overlay_image(blxobj, &fdt_dtb, &dtbo, &vpd);
+    if (fdt_dtb && (dtbo || vpd)) {
+        rc = overlay_fdt(fdt_dtb, dtbo, vpd);
+        if (rc) {
+            LTRACEF_LEVEL(CRITICAL, "dtbo overlay failed\n");
+            return;
+        }
+    }
+
+    if (blxobj->ops.fixup_image)
+        blxobj->ops.fixup_image(blxobj, fdt_dtb);
+
+    plat_fixup_hook(*boot_mode, blxobj->bootcfg.ab_suffix,
+                    fdt_dtb, MAX_DTB_SIZE);
+
+    if (blxobj->ops.setup_boot_param) {
+        blxobj->ops.setup_boot_param(blxobj, &bprm);
+    }
+
+    dprintf(ALWAYS, "LK run time: %lld (us)\n", current_time_hires());
+    dprintf(ALWAYS, "jump to next ep %p, arg (0x%lx)\n",
+            (void *)bprm.arg1, bprm.arg2);
+
+    arch_chain_load((void *)blxobj->ops.exit,
+                    bprm.arg0, bprm.arg1, bprm.arg2, bprm.arg3);
+}
+
+APP_START(blxboot)
+.entry = blxboot_task,
+ .flags = 0,
+  APP_END
diff --git a/src/bsp/lk/app/blxboot/blxboot_ab.c b/src/bsp/lk/app/blxboot/blxboot_ab.c
new file mode 100644
index 0000000..c6a3687
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/blxboot_ab.c
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <compiler.h>
+#include <errno.h>
+#include <stdbool.h>
+#include <stddef.h>
+
+/* ab related */
+__WEAK int check_ab_boot(void)
+{
+    return -ENOTSUP;
+}
+
+__WEAK const char *get_suffix(void)
+{
+    return NULL;
+}
+
+bool is_enabled_ab_ota_updater(void)
+{
+    /* [todo] remove #if defined(MT2712_ANDROID) when yocto is ready */
+#if defined(MT2712_ANDROID) && defined(AB_OTA_UPDATER)
+    return true;
+#else
+    return false;
+#endif
+}
diff --git a/src/bsp/lk/app/blxboot/blxboot_ab.h b/src/bsp/lk/app/blxboot/blxboot_ab.h
new file mode 100644
index 0000000..41a82e9
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/blxboot_ab.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <stdbool.h>
+
+/* check_ab_boot() - check ab boot status and do slot switch if necessary
+ * blxboot_ab.c has only weak imp., return -ENOTSUP */
+int check_ab_boot(void);
+
+/* get_suffix() - get current slot suffix, blxboot_ab.c has only weak imp.,
+ * return NULL */
+const char *get_suffix(void);
+
+/*
+ * is_enabled_ab_ota_updater() - check whether AB_OTA_UPDATER feature is enabled
+ */
+bool is_enabled_ab_ota_updater(void);
diff --git a/src/bsp/lk/app/blxboot/blxboot_plat.c b/src/bsp/lk/app/blxboot/blxboot_plat.c
new file mode 100644
index 0000000..623e022
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/blxboot_plat.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <compiler.h>
+#include <err.h>
+#include <stddef.h>
+
+#include "blxboot_plat.h"
+
+/* scpsys related weak impl. */
+__WEAK void plat_start_scpsys(void)
+{
+}
+
+/* platform fixup related weak impl. */
+__WEAK int plat_fixup_init(void)
+{
+    return NO_ERROR;
+}
+
+__WEAK void plat_fixup_append(char *append_str)
+{
+}
+
+__WEAK void plat_fixup_hook(uint32_t boot_mode, const char *ab_suffix,
+                            void *dtb, size_t dtb_size)
+{
+}
+
+/* dtbo hardware information comprison function */
+__WEAK int plat_compare_dtbo_hwinfo(uint32_t dtbo_version,
+                                    struct dt_table_entry *entry)
+{
+    /* [TODO] For boot time consideration (decompression speed), compressed
+     * overlays is not supported for now. */
+    if ((dtbo_version > ANDROID_DTBO_V0) &&
+            android_dtbo_tbl_entry_compress_algo(entry) != NO_COMPRESSION) {
+        return -1;
+    }
+
+    return 0;
+}
diff --git a/src/bsp/lk/app/blxboot/blxboot_plat.h b/src/bsp/lk/app/blxboot/blxboot_plat.h
new file mode 100644
index 0000000..0a0704b
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/blxboot_plat.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#pragma once
+
+#include <lib/android_dtbo.h>
+#include <stddef.h>
+
+/*
+ * plat_start_scpsys() - start scpsys processor
+ *
+ * blxboot has only weak imp., override this function if necessary.
+ */
+void plat_start_scpsys(void);
+
+/*
+ * plat_fixup_init() - init platform fixup stuff
+ *
+ * blxboot has only weak imp. override this function if necessary.
+ *
+ * return:
+ *     NO_ERROR, on success
+ *     otherwise, on failure
+ */
+int plat_fixup_init(void);
+
+/*
+ * plat_fixup_append() - append string for platform fixup
+ *
+ * blxboot has only weak imp. override this function if necessary.
+ *
+ * @append_str: the string to be appended to kernel command line
+ */
+void plat_fixup_append(char *append_str);
+
+/*
+ * plat_fixup_hook() - platform fixup hook function
+ *
+ * blxboot has only weak imp. override this function if necessary.
+ *
+ * @boot_mode: current boot mode, one of NORMAL_BOOT, RECOVERY_BOOT and
+ *             FASTBOOT_BOOT
+ * @ab_suffix: pointer to ab boot suffix string, could be NULL if ab is
+ *             not enabled
+ * @dtb:       pointer to the device tree blob
+ * @dtb_size:  the maximum size of dtb
+ */
+void plat_fixup_hook(uint32_t boot_mode, const char *ab_suffix,
+                     void *dtb, size_t dtb_size);
+
+/*
+ * plat_compare_dtbo_hwinfo() - platform defined dtbo hardware information
+ *                              comparison function
+ *
+ * blxboot has only weak imp., override this function if necessary.
+ *
+ * @dtbo_version: android dtbo format version
+ * @entry: pointer to the table entry which contains the id, rev, and custom
+ *         information for matching the dtbo to current hardware configuration
+ *
+ * return:
+ *     0, on success (entry selected)
+ *     -1, on failure
+ */
+int plat_compare_dtbo_hwinfo(uint32_t dtbo_version,
+                             struct dt_table_entry *entry);
diff --git a/src/bsp/lk/app/blxboot/dto.c b/src/bsp/lk/app/blxboot/dto.c
new file mode 100644
index 0000000..7a6b2b0
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/dto.c
@@ -0,0 +1,197 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <debug.h>
+#include <lib/android_dtbo.h>
+#include <lib/mempool.h>
+#include <libfdt.h>
+#include <platform.h>
+#include <trace.h>
+
+#include "blxboot_plat.h"
+#include "imageinfo.h"
+
+#define LOCAL_TRACE 0
+
+struct bootargs_overlay {
+    int noffset;
+    int len;
+    const void *path;
+    const char *prop;
+};
+
+int extract_fdt(void *fdt, int size)
+{
+    int ret = 0;
+
+    ret = fdt_open_into(fdt, fdt, size);
+    if (ret) {
+        dprintf(CRITICAL, "open fdt failed\n");
+        return ret;
+    }
+    ret = fdt_check_header(fdt);
+    if (ret) {
+        dprintf(CRITICAL, "check fdt failed\n");
+        return ret;
+    }
+
+    return ret;
+}
+
+static int dtbo_overlay(void *fdt_dtb, void *dtbo_entry)
+{
+    struct bootargs_overlay bootargs;
+    int noffset;
+
+    if (fdt_check_header(dtbo_entry)) {
+        LTRACEF("%s failed.\n", "dtbo check header");
+        return -1;
+    }
+
+    do {
+        noffset = fdt_path_offset(dtbo_entry, "/__symbols__");
+        if (noffset < 0)
+            break;
+
+        bootargs.path = fdt_getprop(dtbo_entry, noffset, "chosen", NULL);
+        if (bootargs.path == NULL)
+            break;
+
+        bootargs.noffset = fdt_path_offset(dtbo_entry, bootargs.path);
+        if (bootargs.noffset < 0)
+            break;
+
+        bootargs.prop = fdt_getprop(dtbo_entry, bootargs.noffset,
+            "bootargs_ext", &bootargs.len);
+        if (bootargs.prop == NULL)
+            break;
+
+        plat_fixup_append((char *)bootargs.prop);
+    } while (0);
+
+    if (fdt_overlay_apply(fdt_dtb, dtbo_entry)) {
+        LTRACEF("%s failed.\n", "fdt_overlay_apply");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int android_dtbo_overlay(void *fdt_dtb, void *dtbo, bool update_cmd)
+{
+/* assume the maxium dtbo entries in dtbo.img */
+#define MAX_DTBO_ENTRIES_COUNT  100
+
+    static const char android_dtbo_param[] = "androidboot.dtbo_idx=";
+    uint32_t i;
+    uint32_t dtbo_entry_count;
+    uint32_t dtbo_version;
+    char *dtbo_idx_str;
+    char *dtbo_idx_str_end;
+    void *dtbo_entry;
+    struct dt_table_entry *tbl_entry;
+
+    if (android_dtbo_check_header(dtbo) != DTBO_RET_OK) {
+        LTRACEF("%s failed.\n", "android dtbo check header");
+        return -1;
+    }
+
+    dtbo_entry_count = android_dtbo_dt_entry_count(dtbo);
+    if (dtbo_entry_count >= MAX_DTBO_ENTRIES_COUNT) {
+        LTRACEF("Too many dtbo entries.\n");
+        return -1;
+    }
+
+    dtbo_idx_str_end = NULL;
+    if (update_cmd) {
+        dtbo_idx_str = mempool_alloc((dtbo_entry_count * 3) +
+                       strlen(android_dtbo_param) + 1, MEMPOOL_ANY);
+        if (dtbo_idx_str == NULL) {
+            LTRACEF("mempool_alloc for dtboidx_str failed.\n");
+            return -1;
+        }
+        dtbo_idx_str_end = dtbo_idx_str;
+        sprintf(dtbo_idx_str_end, "%s", android_dtbo_param);
+        dtbo_idx_str_end += strlen(android_dtbo_param);
+    }
+
+    dtbo_version = android_dtbo_version(dtbo);
+    for (i = 0; i < dtbo_entry_count; i++) {
+        if (android_dtbo_get_dt_table_entry(dtbo, i, &tbl_entry) != DTBO_RET_OK)
+            break;
+
+        if (plat_compare_dtbo_hwinfo(dtbo_version, tbl_entry) != 0)
+            continue;
+
+        dtbo_entry = android_dtbo_get_dt_dtbo_entry(dtbo, i);
+        if (dtbo_entry == NULL)
+            break;
+
+        if (dtbo_overlay(fdt_dtb, dtbo_entry)) {
+            LTRACEF("fdt_overlay_apply failed: index=%u\n", i);
+            continue;
+        }
+
+        if (update_cmd) {
+            sprintf(dtbo_idx_str_end, "%d,", i);
+            dtbo_idx_str_end += i < 10 ? 2 : 3;
+        }
+    }
+
+    if (update_cmd) {
+        if (dtbo_idx_str_end != (dtbo_idx_str + strlen(android_dtbo_param))) {
+            *(dtbo_idx_str + strlen(dtbo_idx_str) - 1) = '\0';
+            plat_fixup_append(dtbo_idx_str);
+        }
+        mempool_free(dtbo_idx_str);
+    }
+
+    return 0;
+}
+
+int overlay_fdt(void *fdt_dtb, void *dtbo, void *vpd)
+{
+    /* [TODO] clarify: can we remove ERR_ADDR, just to check it against NULL */
+    if (fdt_dtb == (void *)ERR_ADDR) {
+        LTRACEF("no valid dtb.\n");
+        return -1;
+    }
+
+    if (extract_fdt(fdt_dtb, MAX_DTB_SIZE)) {
+        LTRACEF("%s failed.\n", "extract_fdt");
+        return -1;
+    }
+
+    if (vpd && (android_dtbo_overlay(fdt_dtb, vpd, false) != 0) &&
+            (dtbo_overlay(fdt_dtb, vpd) != 0))
+        return -1;
+
+    if (dtbo && (android_dtbo_overlay(fdt_dtb, dtbo, true) != 0) &&
+            (dtbo_overlay(fdt_dtb, dtbo) != 0))
+        return -1;
+
+    if (fdt_pack(fdt_dtb))
+        return -1;
+
+    return 0;
+}
diff --git a/src/bsp/lk/app/blxboot/dto.h b/src/bsp/lk/app/blxboot/dto.h
new file mode 100644
index 0000000..59a1cd8
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/dto.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2019 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#pragma once
+
+/**
+ * overlay_fdt() - overlay dtbo image with kernel dtb
+ *
+ * @fdt_dtb: kernel dtb start address
+ * @dtbo: feature dtbo start address
+ * @vpd: vital project data dtbo start address
+ *
+ * returns:
+ *     0, on success
+ *     -1, on failure
+ */
+int overlay_fdt(void *fdt_dtb, void *dtbo, void *vpd);
diff --git a/src/bsp/lk/app/blxboot/imageinfo.h b/src/bsp/lk/app/blxboot/imageinfo.h
new file mode 100644
index 0000000..e9fbbfb
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/imageinfo.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2018 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#pragma once
+
+#include <stdbool.h>
+#include <sys/types.h>
+
+#define ERR_ADDR        (0xffffffff)
+
+enum {
+    IMGTYPE_NONE,
+    IMGTYPE_TZ,
+    IMGTYPE_BL33,
+    IMGTYPE_BUILTIN_BL33,
+    IMGTYPE_KERNEL,
+    IMGTYPE_CM4,
+    IMGTYPE_SLAVE_CPU,
+    IMGTYPE_SPM,
+    IMGTYPE_HYPERVISOR,
+    IMGTYPE_DTBO,
+    IMGTYPE_VPD,
+    IMGTYPE_SCPSYS,
+    IMGTYPE_SCPDATA,
+    IMGTYPE_SCPCFG,
+    IMGTYPE_MODEM,
+    IMGTYPE_HSM_OS,
+};
+
+struct image_load_data {
+    const char *part_name;
+    const char *recovery_part_name;
+    const char *membdev_name; /* for fastboot flash download:xx command */
+    void *buf;
+    bool has_slot;
+
+    ulong kernel_entry;
+    ulong dtb_load;
+    ulong trustedos_entry;
+};
+
+struct imageinfo_t {
+    uint32_t type;
+    struct image_load_data *imgdata;
+    int (*load)(const char *part_name, struct imageinfo_t *img);
+};
diff --git a/src/bsp/lk/app/blxboot/imagelist.c b/src/bsp/lk/app/blxboot/imagelist.c
new file mode 100644
index 0000000..d320600
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/imagelist.c
@@ -0,0 +1,806 @@
+/*
+ * Copyright (c) 2018 MediaTek Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files
+ * (the "Software"), to deal in the Software without restriction,
+ * including without limitation the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+#include <debug.h>
+#include <errno.h>
+#include <fit.h>
+#include <kernel/vm.h>
+#include <lib/bio.h>
+#include <lib/mempool.h>
+#include <libfdt.h>
+#include <platform.h>
+#include <string.h>
+#include <sys/types.h>
+#include <trace.h>
+
+#include "avb.h"
+#include "blxboot_ab.h"
+#include "blxboot_plat.h"
+#include "imageinfo.h"
+
+#if ENABLE_ANDROID_BOOTIMG_SUPPORT
+#include <lib/android_bootimg.h>
+#include <lib/boot_info.h>
+#endif
+
+#define LOCAL_TRACE 0
+
+/* BL33 load and entry point address */
+#define CFG_BL33_LOAD_EP_ADDR   (BL33_ADDR)
+
+/* ramdisk args to be appended to kernel command line */
+#define MAX_RAMDISK_ARG_LEN (45)
+#define RAMDISK_ARG_STR_FMT "initrd=0x%lx,0x%x"
+
+extern __WEAK paddr_t kvaddr_to_paddr(void *ptr);
+
+/* forward declaration */
+static int load_avb_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_builtin_bl33_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_fit_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_android_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_dtbo_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_scpsys_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_scpdata_image(const char *part_name,
+                    struct imageinfo_t *img);
+static int load_scpcfg_image(const char *part_name,
+                    struct imageinfo_t *img);
+#if ENABLE_MODEM_LOAD
+static int load_md_image(const char *part_name,
+                    struct imageinfo_t *img);
+#endif
+#if ENABLE_HSM_OS_LOAD
+static int load_hsm_os_image(const char *part_name,
+                    struct imageinfo_t *img);
+#endif
+
+struct image_load_data tzimg = {
+    .part_name = TZ_PART_NAME,
+    .recovery_part_name = RECOVERY_TZ_PART_NAME,
+    .membdev_name = "download:tz",
+    .has_slot = (TZ_HAS_SLOT != 0),
+};
+
+struct image_load_data bl33img = {
+    .part_name = BL33_PART_NAME,
+    .recovery_part_name = RECOVERY_BL33_PART_NAME,
+    .membdev_name = "download:bl33",
+    .has_slot = (BL33_HAS_SLOT != 0),
+};
+
+#if ENABLE_SLAVE_CPU_LOAD
+struct image_load_data scpuimg = {
+    .part_name = SLAVE_CPU_PART_NAME,
+    .recovery_part_name = RECOVERY_SLAVE_CPU_PART_NAME,
+    .membdev_name = "download:scpu",
+    .has_slot = (SLAVE_CPU_HAS_SLOT != 0),
+};
+#endif
+
+struct image_load_data bootimg = {
+    .part_name = BOOT_PART_NAME,
+    .recovery_part_name = RECOVERY_BOOT_PART_NAME,
+    .membdev_name = "download:boot",
+    .has_slot = (BOOT_HAS_SLOT != 0),
+};
+
+struct image_load_data dtboimg = {
+    .part_name = DTBO_PART_NAME,
+    .has_slot = (DTBO_HAS_SLOT != 0),
+};
+
+struct image_load_data vpdimg = {
+#if defined(VPD_PART_NAME)
+    .part_name = VPD_PART_NAME,
+#endif
+#if defined(RECOVERY_VPD_PART_NAME)
+    .recovery_part_name = RECOVERY_VPD_PART_NAME,
+#endif
+    .membdev_name = "download:vpd",
+    .has_slot = (VPD_HAS_SLOT != 0),
+};
+
+#if ENABLE_SCP_LOAD
+struct image_load_data scpsysimg = {
+    .part_name = SCPSYS_PART_NAME,
+    .recovery_part_name = RECOVERY_SCPSYS_PART_NAME,
+    .membdev_name = "download:scpsys",
+    .has_slot = (SCPSYS_HAS_SLOT != 0),
+};
+#endif
+
+#if ENABLE_SCP_AUX_LOAD
+struct image_load_data scpdataimg = {
+    .part_name = SCPDATA_PART_NAME,
+    .recovery_part_name = RECOVERY_SCPDATA_PART_NAME,
+    .membdev_name = "download:scpdata",
+    .has_slot = (SCPDATA_HAS_SLOT != 0),
+};
+
+struct image_load_data scpcfgimg = {
+    .part_name = SCPCFG_PART_NAME,
+    .recovery_part_name = RECOVERY_SCPCFG_PART_NAME,
+    .buf = (void *)SCP_CFG_VA,
+    .has_slot = (SCPCFG_HAS_SLOT != 0),
+};
+#endif
+
+#if ENABLE_SPM_FW_LOAD
+struct image_load_data spmfwimg = {
+    .part_name = SPM_PART_NAME,
+    .recovery_part_name = SPM_PART_NAME,
+    .membdev_name = "download:spmfw",
+    .has_slot = (SPMFW_HAS_SLOT != 0),
+};
+#endif
+
+#if ENABLE_MODEM_LOAD
+struct image_load_data mdimg = {
+    .part_name = MD_PART_NAME,
+    .membdev_name = "download:md",
+    .buf = (void *)MD_ADDR,
+    .has_slot = (MD_HAS_SLOT != 0),
+};
+#endif
+
+#if ENABLE_HSM_OS_LOAD
+struct image_load_data hsm_os_img = {
+    .part_name = HSM_OS_PART_NAME,
+    .membdev_name = "download:hsmos",
+    .buf = (void *)HSM_OS_ADDR,
+    .has_slot = (HSM_OS_HAS_SLOT != 0),
+};
+#endif
+
+struct imageinfo_t imagelist[] = {
+#if ENABLE_SCP_AUX_LOAD
+    {
+        .type = IMGTYPE_SCPDATA,
+        .load = load_scpdata_image,
+        .imgdata = &scpdataimg,
+    },
+    {
+        .type = IMGTYPE_SCPCFG,
+        .load = load_scpcfg_image,
+        .imgdata = &scpcfgimg,
+    },
+#endif
+
+#if ENABLE_SCP_LOAD
+    {
+        .type = IMGTYPE_SCPSYS,
+        .load = load_scpsys_image,
+        .imgdata = &scpsysimg,
+    },
+#endif
+
+#if ENABLE_TZ_LOAD
+    {
+        .type = IMGTYPE_TZ,
+        .load = load_fit_image,
+        .imgdata = &tzimg,
+    },
+#endif /* ENABLE_TZ_LOAD */
+
+#if ENABLE_BL33_LOAD
+    {
+#if ENABLE_BUILTIN_BL33
+        .type = IMGTYPE_BUILTIN_BL33,
+        .load = load_builtin_bl33_image,
+#else
+        .type = IMGTYPE_BL33,
+        .load = load_fit_image,
+#endif
+        .imgdata = &bl33img,
+    },
+#endif /* ENABLE_BL33_LOAD */
+
+#if ENABLE_SLAVE_CPU_LOAD
+    {
+        .type = IMGTYPE_SLAVE_CPU,
+        .load = load_fit_image,
+        .imgdata = &scpuimg,
+    },
+#endif /* ENABLE_DSP_LOAD */
+
+#if ENABLE_KERNEL_LOAD
+    {
+        .type = IMGTYPE_KERNEL,
+#if defined(AVB_VERIFY_KERNEL)
+        .load = load_avb_image,
+#else
+#if ENABLE_ANDROID_BOOTIMG_SUPPORT
+        .load = load_android_image,
+#else
+        .load = load_fit_image,
+#endif
+#endif
+        .imgdata = &bootimg,
+    },
+    {
+        .type = IMGTYPE_VPD,
+        .load = load_dtbo_image,
+        .imgdata = &vpdimg,
+    },
+    {
+        .type = IMGTYPE_DTBO,
+        .load = load_dtbo_image,
+        .imgdata = &dtboimg,
+    },
+#endif /* ENABLE_KERNEL_LOAD */
+
+#if ENABLE_SPM_FW_LOAD
+    {
+        .type = IMGTYPE_SPM,
+        .load = load_fit_image,
+        .imgdata = &spmfwimg,
+    },
+#endif /* ENABLE_SPM_FW_LOAD */
+
+#if ENABLE_MODEM_LOAD
+    {
+        .type = IMGTYPE_MODEM,
+        .load = load_md_image,
+        .imgdata = &mdimg,
+    },
+#endif
+
+#if ENABLE_HSM_OS_LOAD
+    {
+        .type = IMGTYPE_HSM_OS,
+        .load = load_hsm_os_image,
+        .imgdata = &hsm_os_img,
+    },
+#endif
+
+    { .type = IMGTYPE_NONE } /* imagelist end marker */
+};
+
+static void append_cmdline_ramdisk_arg(addr_t ramdisk_addr, uint32_t ramdisk_sz)
+{
+    char ramdisk_arg[MAX_RAMDISK_ARG_LEN];
+
+    memset(ramdisk_arg, 0x0, sizeof(ramdisk_arg));
+    snprintf(ramdisk_arg, MAX_RAMDISK_ARG_LEN, RAMDISK_ARG_STR_FMT,
+             ramdisk_addr, ramdisk_sz);
+    plat_fixup_append(ramdisk_arg);
+}
+
+static int fit_load_images(void *fit, struct image_load_data *fit_data,
+                           bool need_verified)
+{
+    addr_t load;
+    size_t load_size;
+    int ret;
+
+    /* TODO: decide verify policy with config. */
+    if (need_verified) {
+        dprintf(ALWAYS, "verify fit conf sig: %s\n", fit_data->part_name);
+        ret = fit_conf_verify_sig(NULL, fit);
+        if (ret < 0)
+            return ret;
+    }
+
+    ret = fit_load_image(NULL, "kernel", fit, NULL, NULL,
+                         (paddr_t *)&fit_data->kernel_entry, need_verified);
+    if (ret && (ret != -ENOENT)) {
+        dprintf(CRITICAL, "%s load kernel failed\n", fit_data->part_name);
+        return ret;
+    }
+
+    ret = fit_load_image(NULL, "ramdisk", fit, &load, &load_size, NULL,
+                         need_verified);
+    if (ret) {
+        if (ret != -ENOENT) {
+            dprintf(CRITICAL, "%s load ramdisk failed\n", fit_data->part_name);
+            return ret;
+        }
+    } else {
+#if WITH_KERNEL_VM
+        load = kvaddr_to_paddr((void *)load);
+#endif
+        append_cmdline_ramdisk_arg(load, load_size);
+    }
+
+    ret = fit_load_image(NULL, "fdt", fit, (addr_t *)&fit_data->dtb_load, NULL,
+                         NULL, need_verified);
+    if (ret && (ret != -ENOENT)) {
+        fit_data->dtb_load = ERR_ADDR; /* [TODO] remove or assign it to NULL */
+        dprintf(CRITICAL, "%s load fdt failed\n", fit_data->part_name);
+        return ret;
+    }
+
+    ret = fit_load_image(NULL, "tee", fit, NULL, NULL,
+                         (paddr_t *)&fit_data->trustedos_entry, need_verified);
+    if (ret && (ret != -ENOENT)) {
+        dprintf(CRITICAL, "%s load trustedos failed\n", fit_data->part_name);
+        return ret;
+    }
+
+    return 0;
+}
+
+#if ENABLE_ANDROID_BOOTIMG_SUPPORT
+static int load_android_hdr_images(const void *part_data,
+        struct image_load_data *android_data)
+{
+    int rc;
+    uint32_t ramdisk_target_addr, kernel_target_addr;
+    uint32_t ramdisk_sz, zimage_sz, dtb_sz;
+    uint64_t dtb_target_addr;
+    vaddr_t ramdisk_addr, kernel_addr, dtb_addr;
+    char android_dtb_param[] = "androidboot.dtb_idx=0";
+
+    load_bootinfo_bootimg_hdr((struct bootimg_hdr *)part_data);
+    set_bootimg_loaded((vaddr_t)part_data);
+
+    ramdisk_target_addr = get_ramdisk_target_addr();
+    ramdisk_addr = get_ramdisk_addr();
+    ramdisk_sz = get_ramdisk_real_sz();
+
+    kernel_target_addr = get_kernel_target_addr();
+    kernel_addr = get_kernel_addr();
+    zimage_sz = get_kernel_real_sz();
+
+    dtb_target_addr = get_dtb_target_addr();
+    dtb_addr = get_dtb_addr();
+    dtb_sz = get_dtb_size();
+
+    assert(ramdisk_target_addr != 0);
+    assert(ramdisk_addr != 0);
+    assert(kernel_target_addr != 0);
+    assert(kernel_addr != 0);
+    assert(dtb_target_addr != 0);
+    assert(dtb_addr != 0);
+
+    if(get_header_version() < BOOT_HEADER_VERSION_TWO) {
+        LTRACEF_LEVEL(CRITICAL,
+                "Android Image Header version is lower than v2\n");
+        return -EINVAL;
+    }
+
+    rc = android_processing_data("ramdisk", ramdisk_addr,
+            ramdisk_target_addr, ramdisk_sz);
+    if (rc != 0) {
+        LTRACEF_LEVEL(CRITICAL, "load %s failed\n", "ramdisk");
+        return -EINVAL;
+    }
+    append_cmdline_ramdisk_arg((addr_t)ramdisk_target_addr, ramdisk_sz);
+
+    rc = android_processing_data("kernel", kernel_addr,
+            kernel_target_addr, zimage_sz);
+    if (rc != 0) {
+        LTRACEF_LEVEL(CRITICAL, "load %s failed\n", "kernel");
+        return -EINVAL;
+    }
+    android_data->kernel_entry = kernel_target_addr;
+
+    rc = android_processing_data("dtb", dtb_addr,
+            dtb_target_addr, dtb_sz);
+    if (rc != 0) {
+        LTRACEF_LEVEL(CRITICAL, "load %s failed\n", "dtb");
+        return -EINVAL;
+    }
+#if WITH_KERNEL_VM
+    dtb_target_addr = (vaddr_t)paddr_to_kvaddr(dtb_target_addr);
+#endif
+    android_data->dtb_load = dtb_target_addr;
+
+    plat_fixup_append(android_dtb_param);
+
+    return 0;
+}
+#endif
+
+static int load_avb_image(const char *part_name, struct imageinfo_t *img)
+{
+    int ret;
+    size_t part_name_len;
+    struct image_load_data *imgdata;
+    char *raw_part_name;
+    const char *suffix;
+    AvbSlotVerifyResult verify_result;
+    AvbSlotVerifyData *verify_data;
+
+    if ((img == NULL) || (img->imgdata == NULL))
+        return -1;
+
+    imgdata = img->imgdata;
+
+    raw_part_name = strdup(part_name);
+    if (raw_part_name == NULL)
+        return -ENOMEM;
+
+    if (imgdata->has_slot) {
+        /* prepare partition name without ab suffix */
+        part_name_len = strlen(part_name);
+        suffix = get_suffix();
+        if (suffix && (part_name_len > strlen(suffix))) {
+            part_name_len -= strlen(suffix);
+            *(raw_part_name + part_name_len) = '\0';
+        }
+    }
+
+    ret = 0;
+    verify_result = android_verified_boot_2_0(raw_part_name, &verify_data);
+    if ((verify_result != AVB_SLOT_VERIFY_RESULT_OK) && !is_device_unlocked()) {
+        ret = -10;
+        goto exit;
+    }
+
+    void *part_data = get_partition_data(raw_part_name, verify_data);
+    if (part_data == NULL) {
+        ret = -11;
+        goto exit;
+    }
+
+#if ENABLE_ANDROID_BOOTIMG_SUPPORT
+    if (img->type == IMGTYPE_KERNEL) {
+        ret = load_android_hdr_images(part_data, imgdata);
+    } else {
+        if (android_dtbo_check_header((const void *)part_data) == DTBO_RET_OK) {
+            /* android dtbo image without fit header */
+            imgdata->dtb_load = (ulong)part_data;
+        } else {
+            /* android dtbo image with fit header */
+            ret = fit_load_images(part_data, imgdata, false);
+        }
+    }
+#else
+    ret = fit_load_images(part_data, imgdata, false);
+#endif
+
+    if (ret) {
+        LTRACEF_LEVEL(CRITICAL, "load %s image failed\n", part_name);
+        ret = -21;
+        goto exit;
+    }
+
+    if (img->type == IMGTYPE_KERNEL)
+        plat_fixup_append(verify_data->cmdline);
+
+exit:
+    if (raw_part_name)
+        free(raw_part_name);
+
+    return ret;
+}
+
+static int load_builtin_bl33_image(const char *part_name,
+                                   struct imageinfo_t *img)
+{
+    uint32_t bl33[] = { 0xea000005,  /* b BL33_32_ENTRY  | ands x5, x0, x0  */
+                        0x58000160,  /* .word 0x58000160 | ldr x0, _X0      */
+                        0x58000181,  /* .word 0x58000181 | ldr x1, _X1      */
+                        0x580001a2,  /* .word 0x580001a2 | ldr x2, _X2      */
+                        0x580001c3,  /* .word 0x580001c3 | ldr x3, _X3      */
+                        0x580001e4,  /* .word 0x580001e4 | ldr x4, _X4      */
+                        0xd61f0080,  /* .word 0xd61f0080 | br  x4           */
+                        /* BL33_32_ENTRY:                |                  */
+                        0xe59f0030,  /*    ldr r0, _R0   | .word 0xe59f0030 */
+                        0xe59f1030,  /*    ldr r1, _R1   | .word 0xe59f1030 */
+                        0xe59f2004,  /*    ldr r2, _X0   | .word 0xe59f2004 */
+                        0xe59ff020,  /*    ldr pc, _X4   | .word 0xe59ff020 */
+                        0x00000000,  /*      .word   0x00000000 */
+                        0x00000000,  /* _X0: .word   0x00000000 */
+                        0x00000000,  /*      .word   0x00000000 */
+                        0x00000000,  /* _X1: .word   0x00000000 */
+                        0x00000000,  /*      .word   0x00000000 */
+                        0x00000000,  /* _X2: .word   0x00000000 */
+                        0x00000000,  /*      .word   0x00000000 */
+                        0x00000000,  /* _X3: .word   0x00000000 */
+                        0x00000000,  /*      .word   0x00000000 */
+                        0x00000000,  /* _X4: .word   0x00000000 */
+                        0x00000000,  /* _R0: .word   0x00000000 */
+                        0x00000000,  /* _R1: .word   0x00000000 */
+                        0x00000000   /*      .word   0x00000000 */
+                      };
+
+    memcpy((void *)CFG_BL33_LOAD_EP_ADDR, bl33, sizeof(bl33));
+    img->imgdata->kernel_entry = kvaddr_to_paddr ?
+                                 kvaddr_to_paddr((void *)CFG_BL33_LOAD_EP_ADDR) : CFG_BL33_LOAD_EP_ADDR;
+
+    return 0;
+}
+
+static int load_fit_image(const char *part_name, struct imageinfo_t *img)
+{
+    int err;
+
+    if ((err = fit_get_image(part_name, &img->imgdata->buf)) == 0) {
+        err = fit_load_images(img->imgdata->buf, img->imgdata, true);
+    }
+
+    return err;
+}
+
+#if ENABLE_ANDROID_BOOTIMG_SUPPORT
+static int load_android_image(const char *part_name, struct imageinfo_t *img)
+{
+    int err;
+
+    if ((err = android_get_image(part_name, &img->imgdata->buf)) == 0) {
+        err = load_android_hdr_images(img->imgdata->buf, img->imgdata);
+    }
+
+    return err;
+}
+#endif
+
+static int load_android_dtbo_image(const char *part_name,
+                                   struct imageinfo_t *img, uint32_t size)
+{
+    int ret;
+
+    /* android dtbo format */
+    LTRACEF("part_name(%s) in pure android dtbo format.\n", part_name);
+#if defined(AVB_VERIFY_KERNEL)
+    ret = load_avb_image(part_name, img);
+#else
+    bdev_t *bdev;
+    void *buf;
+    ssize_t read_bytes;
+
+    bdev = bio_open_by_label(part_name) ? : bio_open(part_name);
+    if (!bdev)
+        return -ENODEV;
+
+    ret = 0;
+    buf = mempool_alloc(size, MEMPOOL_ANY);
+    if (!buf) {
+        ret = -ENOMEM;
+        goto _err;
+    }
+
+    read_bytes = bio_read(bdev, buf, 0, size);
+    if (read_bytes < (ssize_t)size) {
+        LTRACEF("Read android dtbo image fail: read(0x%x), got(0x%zx)\n",
+                size, read_bytes);
+        mempool_free(buf);
+        ret = -EIO;
+        goto _err;
+    }
+
+    img->imgdata->dtb_load = (ulong)buf;
+
+_err:
+    if (bdev)
+        bio_close(bdev);
+#endif
+
+    return ret;
+}
+
+static int load_fdt_dtbo_image(const char *part_name, struct imageinfo_t *img)
+{
+    int ret;
+    int noffset;
+
+    /* legacy fdt format dtbo or android dtbo format with FIT header */
+    ret = fit_get_image(part_name, &img->imgdata->buf);
+    if (ret != 0)
+        return ret;
+
+    /* check configuration node to know it's legacy dtbo or not */
+    noffset = fdt_path_offset(img->imgdata->buf, "/configurations");
+    if (noffset < 0) {
+        LTRACEF("part_name(%s) in legacy dtbo format\n", part_name);
+        img->imgdata->dtb_load = (ulong)img->imgdata->buf;
+        return 0;
+    }
+
+    LTRACEF("part_name(%s) in fit android dtbo format.\n", part_name);
+    /* we verifies android dtbo image in the same method with kernel */
+#if defined(AVB_VERIFY_KERNEL)
+    if (img->type == IMGTYPE_DTBO) {
+        mempool_free(img->imgdata->buf);
+        img->imgdata->buf = NULL;
+
+        /* [TODO] load_avb_image() will waste time to load dtbo image again */
+        ret = load_avb_image(part_name, img);
+    } else {
+        ret = fit_load_images(img->imgdata->buf, img->imgdata, true);
+    }
+#else
+    /* get android dtbo */
+    ret = fit_load_images(img->imgdata->buf, img->imgdata, true);
+#endif
+
+    return ret;
+}
+
+static int load_dtbo_image(const char *part_name, struct imageinfo_t *img)
+{
+    int ret;
+    uint32_t total_size;
+    ssize_t read_bytes;
+    void *buf;
+    bdev_t *bdev;
+
+    bdev = bio_open_by_label(part_name) ? : bio_open(part_name);
+    if (!bdev) {
+        LTRACEF("Partition [%s] is not exist.\n", part_name);
+        return -ENODEV;
+    }
+
+    ret = 0;
+    /* read 1 block to determine the dtbo image format */
+    buf = malloc(bdev->block_size);
+    if (!buf) {
+        ret = -ENOMEM;
+        goto _err;
+    }
+
+    memset(buf, 0, bdev->block_size);
+    read_bytes = bio_read(bdev, buf, 0, bdev->block_size);
+    if (read_bytes < (ssize_t)bdev->block_size) {
+        LTRACEF("bio_read offset: 0, size: %ld, got: %ld\n",
+                bdev->block_size, read_bytes);
+        ret = -EIO;
+        goto _err;
+    }
+
+    if (android_dtbo_check_header((const void *)buf) == DTBO_RET_OK) {
+        total_size = android_dtbo_total_size((const void *)buf);
+        if (load_android_dtbo_image(part_name, img, total_size) < 0)
+            ret = -EINVAL;
+    } else if (fdt_check_header((const void *)buf) == 0) {
+        if (load_fdt_dtbo_image(part_name, img) < 0)
+            ret = -EINVAL;
+    } else {
+        LTRACEF("Not valid dtbo image.\n");
+        ret = -ENOTSUP;
+    }
+
+_err:
+    if (buf)
+        free(buf);
+    bio_close(bdev);
+
+    return ret;
+}
+
+static int load_scpsys_image(const char *part_name, struct imageinfo_t *img)
+{
+    int err;
+    void *fit;
+
+    err = fit_get_image(part_name, &img->imgdata->buf);
+    if (err) {
+        LTRACEF("fit_get_image %s fail, err=%d\n", part_name, err);
+        return err;
+    }
+    fit = img->imgdata->buf;
+
+    dprintf(ALWAYS, "verify fit conf sig: %s\n", part_name);
+    err = fit_conf_verify_sig(NULL, fit);
+    if (err < 0)
+        return err;
+
+    err = fit_load_image(NULL, "kernel", fit, NULL, NULL, NULL, true);
+    if (err) {
+        LTRACEF("fit_load_image %s: sram fw fail, err=%d\n", part_name, err);
+        return err;
+    }
+
+    /* the dram part of scpsys image is an optional image, could be absent */
+    err = fit_load_image(NULL, "firmware", fit, NULL, NULL, NULL, true);
+    if (err && err != -ENOENT) {
+        LTRACEF("fit_load_image %s: dram fw fail, err=%d\n", part_name, err);
+        return err;
+    }
+
+    return 0;
+}
+
+static int load_scpdata_image(const char *part_name, struct imageinfo_t *img)
+{
+#define FIT_FASTLOGO_IMG_NODE_NAME  "logo"
+#define FIT_GUIDELINE_IMG_NODE_NAME "guideline"
+#define FIT_WARNMSG_IMG_NODE_NAME   "warnmsg"
+#define FIT_CVBSIMG_IMG_NODE_NAME   "cvbsimg"
+
+    int err;
+    void *fit;
+
+    err = fit_get_image(part_name, &img->imgdata->buf);
+    if (err) {
+        LTRACEF("fit_get_image %s fail, err=%d\n", part_name, err);
+        return err;
+    }
+    fit = img->imgdata->buf;
+
+    err = fit_load_loadable_image(fit, FIT_FASTLOGO_IMG_NODE_NAME, NULL);
+    if (err) {
+        LTRACEF("fit_load_loadable_image %s fail, err=%d\n",
+                FIT_FASTLOGO_IMG_NODE_NAME, err);
+        return err;
+    }
+
+    err = fit_load_loadable_image(fit, FIT_GUIDELINE_IMG_NODE_NAME, NULL);
+    if (err) {
+        LTRACEF("fit_load_loadable_image %s fail, err=%d\n",
+                FIT_GUIDELINE_IMG_NODE_NAME, err);
+        return err;
+    }
+
+    err = fit_load_loadable_image(fit, FIT_WARNMSG_IMG_NODE_NAME, NULL);
+    if (err) {
+        LTRACEF("fit_load_loadable_image %s fail, err=%d\n",
+                FIT_WARNMSG_IMG_NODE_NAME, err);
+        return err;
+    }
+
+    err = fit_load_loadable_image(fit, FIT_CVBSIMG_IMG_NODE_NAME, NULL);
+    if (err) {
+        LTRACEF("fit_load_loadable_image %s fail, err=%d\n",
+                FIT_CVBSIMG_IMG_NODE_NAME, err);
+        return err;
+    }
+
+    return 0;
+}
+
+/* [TODO] mvoe load_scpcfg_image to mt2712 platform layer to keep SCP_CFG_VA
+ * invisble to others */
+static int load_scpcfg_image(const char *part_name, struct imageinfo_t *img)
+{
+    int err;
+    ssize_t bytes_read;
+    bdev_t *bdev;
+
+    bdev = bio_open_by_label(part_name) ? : bio_open(part_name);
+    if (!bdev)
+        return -ENODEV;
+
+    err = 0;
+    bytes_read = bio_read(bdev, img->imgdata->buf, 0, bdev->total_size);
+    if (bytes_read < bdev->total_size)
+        err = -EIO;
+
+    bio_close(bdev);
+
+    return err;
+}
+
+#if ENABLE_MODEM_LOAD
+extern int  load_modem_image(const char *part_name);
+static int load_md_image(const char *part_name, struct imageinfo_t *img)
+{
+    return load_modem_image(part_name);
+}
+#endif
+
+#if ENABLE_HSM_OS_LOAD
+extern int load_hsm_os(const char *part_name);
+static int load_hsm_os_image(const char *part_name, struct imageinfo_t *img)
+{
+    return load_hsm_os(part_name);
+}
+#endif
diff --git a/src/bsp/lk/app/blxboot/images_ab_slot_def.mk b/src/bsp/lk/app/blxboot/images_ab_slot_def.mk
new file mode 100644
index 0000000..b305db3
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/images_ab_slot_def.mk
@@ -0,0 +1,30 @@
+# default ab slot configuration
+
+TZ_HAS_SLOT ?= 0
+DTBO_HAS_SLOT ?= 0
+VPD_HAS_SLOT ?= 0
+BL33_HAS_SLOT ?= 0
+BOOT_HAS_SLOT ?= 0
+ROOTFS_HAS_SLOT ?= 0
+SLAVE_CPU_HAS_SLOT ?= 0
+SCPSYS_HAS_SLOT ?= 0
+SCPDATA_HAS_SLOT ?= 0
+SCPCFG_HAS_SLOT ?= 0
+SPMFW_HAS_SLOT ?= 0
+MD_HAS_SLOT ?= 0
+HSM_OS_HAS_SLOT ?= 0
+
+GLOBAL_DEFINES += TZ_HAS_SLOT=$(TZ_HAS_SLOT) \
+                  DTBO_HAS_SLOT=$(DTBO_HAS_SLOT) \
+                  VPD_HAS_SLOT=$(VPD_HAS_SLOT) \
+                  BL33_HAS_SLOT=$(BL33_HAS_SLOT) \
+                  BOOT_HAS_SLOT=$(BOOT_HAS_SLOT) \
+                  ROOTFS_HAS_SLOT=$(ROOTFS_HAS_SLOT) \
+                  SLAVE_CPU_HAS_SLOT=$(SLAVE_CPU_HAS_SLOT) \
+                  SCPSYS_HAS_SLOT=$(SCPSYS_HAS_SLOT) \
+                  SCPDATA_HAS_SLOT=$(SCPDATA_HAS_SLOT) \
+                  SCPCFG_HAS_SLOT=$(SCPCFG_HAS_SLOT) \
+                  SPMFW_HAS_SLOT=$(SPMFW_HAS_SLOT) \
+                  MD_HAS_SLOT=$(MD_HAS_SLOT) \
+                  HSM_OS_HAS_SLOT=$(HSM_OS_HAS_SLOT) \
+
diff --git a/src/bsp/lk/app/blxboot/rules.mk b/src/bsp/lk/app/blxboot/rules.mk
new file mode 100644
index 0000000..6c69041
--- /dev/null
+++ b/src/bsp/lk/app/blxboot/rules.mk
@@ -0,0 +1,82 @@
+LOCAL_DIR := $(GET_LOCAL_DIR)
+
+MODULE := $(LOCAL_DIR)
+MTK_COMMON_PLAT_DIR := $(LOCAL_DIR)/../../platform/mediatek/common
+# [TODO] follow normal ways to remove lib from MODULE_INCLUDES
+MODULE_INCLUDES += $(MODULE_BUILDDIR)/../../../include lib \
+                   $(MTK_COMMON_PLAT_DIR)/include
+
+SCRATCH_SIZE ?= 0x04000000 # 64MB
+MAX_DTB_SIZE ?= 0x00200000 # 2MB
+
+GLOBAL_DEFINES += SCRATCH_SIZE=$(SCRATCH_SIZE) \
+                  MAX_DTB_SIZE=$(MAX_DTB_SIZE)
+
+# secure boot options
+ifeq ($(strip $(SECURE_BOOT_ENABLE)),yes)
+ifeq ($(strip $(SECURE_BOOT_TYPE)),avb)
+GLOBAL_COMPILEFLAGS += -DAVB_VERIFY_KERNEL
+
+ifeq ($(strip $(AVB_ENABLE_ANTIROLLBACK)),yes)
+GLOBAL_COMPILEFLAGS += -DAVB_ENABLE_ANTIROLLBACK
+endif
+endif # SECURE_BOOT_TYPE
+endif # SECURE_BOOT_ENABLE
+
+ifeq ($(strip $(AB_OTA_UPDATER)),yes)
+GLOBAL_COMPILEFLAGS += -DAB_OTA_UPDATER
+endif
+
+# loading kernel format config,
+# 0: fit image header 1: android image header
+ENABLE_ANDROID_BOOTIMG_SUPPORT ?= 0
+GLOBAL_DEFINES += \
+    ENABLE_ANDROID_BOOTIMG_SUPPORT=$(ENABLE_ANDROID_BOOTIMG_SUPPORT)
+
+ifeq ($(strip $(ENABLE_ANDROID_BOOTIMG_SUPPORT)),1)
+MODULE_DEPS += lib/android_bootimg
+endif
+
+# Todo: remove this option after cmdlineoverlay integration done
+ifeq ($(strip $(ANDROID_2712)),yes)
+MODULE_COMPILEFLAGS += -DMT2712_ANDROID
+endif
+
+MODULE_DEPS += \
+    lib/bio \
+    lib/mempool \
+    lib/fdt \
+    lib/fit \
+    lib/fastboot \
+    lib/libavb \
+    lib/libavb_ab \
+    lib/android_dtbo
+
+MODULE_SRCS += \
+    $(LOCAL_DIR)/blxboot.c \
+    $(LOCAL_DIR)/blxboot_ab.c \
+    $(LOCAL_DIR)/blxboot_plat.c \
+    $(LOCAL_DIR)/dto.c \
+    $(LOCAL_DIR)/imagelist.c \
+    $(LOCAL_DIR)/avb.c \
+    $(MTK_COMMON_PLAT_DIR)/drivers/smc/smc.c \
+    $(MTK_COMMON_PLAT_DIR)/drivers/smc/psci.c
+
+ifeq ($(strip $(AB_OTA_UPDATER)),yes)
+MODULE_DEPS += lib/bootctrl
+endif
+
+ifeq ($(strip $(AB_UPGRADE_APP)),yes)
+MODULE_DEPS += lib/upgrade_app_ctrl
+endif
+
+ifeq ($(LK_AS_BL33),0)
+MODULE_SRCS += $(LOCAL_DIR)/bl2boot.c
+else
+MODULE_SRCS += $(LOCAL_DIR)/bl33boot.c
+endif
+
+GLOBAL_COMPILEFLAGS += -Os
+
+include $(LOCAL_DIR)/images_ab_slot_def.mk
+include make/module.mk