Database Develop

[DEV] Kexec-hardboot

PREAMBLE
Just to clear things up - I'm definitely not responsible for anything. This patch will not work on devices with locked bootloaders.
Tasssadar said:
This patch was made by Mike Kasick for Samsung Epic 4G. Since that, it was ported to several devices, one of them is Asus Transformer TF201 - I used patch from TF201 and modified it a bit (basically just changed few SoC specific constants). People at #ubuntu-arm helped me out with that, thanks.
For flo, I've improved the patch a bit - only the host needs to be patched now and I also fixed a bug with /proc/atags not reading all tags.
Click to expand...
Click to collapse
Thanks to omnirom - I used their kernel as a base.
Special thanks to Tasssadar for his kexec-hardboot patch for the Nexus 4. Also thanks to alvinhochun and krabappel2548. I borrowed some of their code.
WHAT'S KEXEC?
Tasssadar said:
It is syscall of Linux kernel, which allows you to boot another Linux kernel without restarting the device - "Linux boots itself". The functionality is equivalent to fastboot -c *cmdline* boot zImage initrd.img, but without PC and fastboot. It is fairly known thing, so more info at wikipedia and man kexec.
Standard kexec call unfortunatelly does not work on Nexus 4. It freezes somewhere, and it is very difficult to find out where - probably some of the drivers are not shut down/re-initialized properly, it is a commong thing among Android devices, which is why kexec-hardboot was made.
Click to expand...
Click to collapse
What is the difference between normal and hardboot kexec?
Tasssadar said:
Kexec-hardboot patch adds a real device restart to that process, so that all the drivers can be properly reinitialized. It stores new kernel to RAM, reboots the device as usual, and kernel from boot partition immediately jumps to the one which was stored to RAM before reboot.
Unlike grouper's kexec-hardboot patch, this one only requires the host kernel to be patched. This is one of the improvements I made, and I think it is pretty significant.
To sumarize the process:
kexec --load-hardboot.... is called and kernel it loaded into RAM.
kexec -e is called. Special info is written to memory (to area which is not overwritten on reboot) and the device is rebooted.
After reboot, very early in the boot process, kernel checks if that special info is present in RAM and if so, it loads new kernel from RAM and jumps to it.
Kexecd' kernel starts and boots.
For more info, read the original thread.
Click to expand...
Click to collapse
INSTRUCTIONs
Download kexec-hardboot-yuga.zip and unzip it
Flash my patched host kernel (kexec-kernel-20140808-yuga.zip)
Push initrd.img, kexec, kexec.sh and zImage to /cache
Use a terminal to do the following:
Code:
adb shell
su
cd cache
chmod 0755 kexec
sh ./kexec.sh
SOURCEs
Kexec-hardboot patch
Kernel
XDA:DevDB Information
Kexec-hardboot patch for Sony Xperia Z, Tool/Utility for the Sony Xperia Z
Contributors
Olivier
Version Information
Status: Testing
Created 2014-08-08
Last Updated 2014-08-08

I'm sorry I would like to ask a question. If I kexec boot my phone with yuga kernel and cwm, flashes the yuga ROM would it be possible to get dual booting the Yuga ROM?
Source: http://forum.xda-developers.com/showpost.php?p=19460677&postcount=25
Pretty old source but would it be possible?

xarive said:
I'm sorry I would like to ask a question. If I kexec boot my phone with yuga kernel and cwm, flashes the yuga ROM would it be possible to get dual booting the Yuga ROM?
Source: http://forum.xda-developers.com/showpost.php?p=19460677&postcount=25
Pretty old source but would it be possible?
Click to expand...
Click to collapse
Sure thing
Gesendet von meinem Xperia Z mit Tapatalk

Nice to see you got a Z now.
Will try this one out definitly

Sweet! Trying this out straight after work!
Beans

I am still not quite clear about dual booting with kexec. Did OP done it before?
Sent from my C6603 using Tapatalk 2

Can we load some other kernal on our devices using kexec without unlocking bootloader??
I had a Motorola atrix 2 which used to do this..:fingers-crossed:

siddhesh1609 said:
Can we load some other kernal on our devices using kexec without unlocking bootloader??
I had a Motorola atrix 2 which used to do this..:fingers-crossed:
Click to expand...
Click to collapse
No, LB Yuga's are missing kexec, even compiling a external kernel module is not possible as the zimage is missing some required symbols for kexec to work.

Hi. I want to split two kernels. cyanogenmod and multirom (not for xperia z.)
i have kexec, and it working under multirom kernel.
i have edited one kernel, to load init file from another.
I am trayed zimage from multirom kernel.
Now i cannot run both. i can run cm12 kernel, and rut multirom from there, but cm12 wont boot.
when i used zimage from cm12 kernel, i can boot into cm12, but not in multirom.
is there any command to kexec to load another zimage only, and run another init file?
i have init (cm12) and from there i can use sh commands. i want load initmr (multirecovery) with another zimage file.
is it possible?

gouster3 said:
Hi. I want to split two kernels. cyanogenmod and multirom (not for xperia z.)
i have kexec, and it working under multirom kernel.
i have edited one kernel, to load init file from another.
I am trayed zimage from multirom kernel.
Now i cannot run both. i can run cm12 kernel, and rut multirom from there, but cm12 wont boot.
when i used zimage from cm12 kernel, i can boot into cm12, but not in multirom.
is there any command to kexec to load another zimage only, and run another init file?
i have init (cm12) and from there i can use sh commands. i want load initmr (multirecovery) with another zimage file.
is it possible?
Click to expand...
Click to collapse
Ok... What?

vishal_android freak said:
Ok... What?
Click to expand...
Click to collapse
Is there any arguments for kexec to reboot with another zimage, and exec? i want to run initmr (init file)?
but without ramdisk wipe. (or load ramdisk from kernel partition)?? init file with zimage are there.
when i use "exec /initmr", it will boot, but touch not working, and i have screen-shift bug.

Or. another way. how i can get "hot boot" into some boot.img using kexec on my build-in kernel?

How do you unpack and repack boot.img?

NOTE: Unfortunately I've had to remove links from this post because I'm a new user. I'll add them back in once I have enough posts.
I've been trying to edit a file in boot.img from the CyanogenMod 12.1 (huashan) nightlies but I'm experiencing some issues finding the right tools/methods for the job.
Most scripts I've found expect an Android Magic number at the beginning of the file but this simply isn't there. It seems there is no header at all that matches the specification from bootimg.h (missing link) though I did discover the cmdline argument at the end of the file with a hex editor.
After searching and experimenting for hours I found a script here (missing link) which enabled me to extract the kernel and ramdisk images despite the missing header but now I don't know how to repack the files into a boot.img of the same structure.
I've tried the following but it results in a boot.img that is about 40% larger than the orginal (despite me only adding one line of code) and has an entirely different structure (with an Android Magic number, etc.).
Code:
mkbootimg --base 0x00200000 --pagesize 2048 --kernel boot.img-kernel.gz --ramdisk newramdisk.cpio.gz -o newboot.img
I found this resource (TWRP, missing link) which mentions that Xperia devices have special boot images (or something like that, I didn't understand all of it) - this might explain why the boot.img structure is so different - but I can't find any further documentation on this or instructions on how to deal with the format.
The Xperia devices have a recovery-in-boot arrangement. This means that the recovery is booted using the regular kernel / boot image in the device. Team Win has worked with the FreeXperia device maintainers to come up with a way to extract the ramdisk from the FOTAKernel partition and use the ramdisk from that partition instead of the recovery that is included in the boot image of your device. This means that if you install current CM nightlies and flash TWRP to the FOTAKernel partition, you will be able to use TWRP instead of the CWM or CM recovery that normally comes in a CM boot image. Other boot images including stock kernels can be repacked to include this extraction utility to allow you to use TWRP from the FOTAKernel partition. This setup allows you to choose what recovery you want to have installed and allows you to update your recovery more easily. Unfortunately this setup requires that the boot image that you have installed include the ramdisk extraction utility.
Click to expand...
Click to collapse
So now I'm at a loss at how to continue. I would much appreciate any pointers, ideas or help in general.

@infernalpostcard , hopefully this tool made by @Adrian DC will help you out.
https://github.com/AdrianDC/android_huashan_bootimg_editor

Raienryu said:
@infernalpostcard , hopefully this tool made by @Adrian DC will help you out.
https://github.com/AdrianDC/android_huashan_bootimg_editor
Click to expand...
Click to collapse
Thanks. This looks really promising. I'm trying it out now...
EDIT: It worked! This is exactly what I needed. Unfortunately what I was actually trying to achieve (apply a fix to break a boot-loop my phone gets in, due to an encrypted filesystem) didn't work so I'll have to come up with new ideas.

Building OnePlusOSS from source

I'm trying to build https://github.com/oneplusoss. I've generated vendor blobs from 3.5.4 full ota zip, because it can't work to access /system via adb pull on user builds (would need a rooted user-debug build in order to fetch all blobs). You can find the final blob collection here: https://github.com/nvertigo/android_vendor_oneplus_oneplus3T
I have massive issues to get device/qcom/hammerhead-kernel (2Mbit with consistent connectionmdrops), so I <remove-project .... /> that one, since that's prebuild kernels for hammerhead. Do I need some dtds from that git?
The build process runs fine (build.sh -c, as well as make, as well as make otaimage). But I can't get it boot far enough (with boot.img-nosecure) to get any logs: it starts with the oneplus-logo (not the three dot animation) the capacitive buttons show their lights, went off again and after about 10 s the device reboots to recovery. Any way I flash the source build rom (fastboot flash or flashing the ota-package via twrp shows the same results.
Sadly neither boot.img nor boot.img-nosecure give me a /proc/last_kmsg...
Any ideas are appriciated. Thanx in advance.
An other question: does the capacitive buttons light indicating extracting ramdisk? That would match my obsevation, that they are switched on longer on twrp boot, then on system boot, since recovery ramdisk is larger.
If someone wonders, why I are trying this: it's not for engancing features, but for two reasons: because the source is there, and because I'm an oldschool gentoo dickhead: what hasn't run through my compiler shouldn't be on my device (also some kind of chain of trust... ).

Been there, done that, have the t-shirt:
finally I got oss to boot: problem was missing f2fs support for data in fstab. It's running fine and srable.
I naivly thought, it's the source of oos - but it's not: it's plain aosp without any custumation (besides it's running on 3t and some codeaurora parts). No file manager, no capacitive buttons, no no-disturb-button-support, really insane AAPT comfiguration (elements and onscreen-buttons [as stated: no capacitive buttons availible]mare that large, that it feels like an htc magic on steroids).
But: it's a working codebase.
For me the most important finding is the camera used on oss: it's codeauroras snapdragon camera. I pulled the apk and 4 libs, and it's working on oos. If anybody is interested, I can make a flashable zip. Since I'm no photographer, I'm not the one to judge the quality and playing with manual options. The snapshots with default settings are as good (or as bad - YMMV) as with oos stock cam.

I Thing they need to put more features in one plus 3 OS cause there is lil bit heavy smartphone so they need to do more additions

harshsharma9619 said:
I Thing they need to put more features in one plus 3 OS cause there is lil bit heavy smartphone so they need to do more additions
Click to expand...
Click to collapse
Watch out to not confuse oos (oxygenos: proprietary closed source with quitemsome features; i.e. capacitive buttons) with oss (OnePlusOpenSourceSoftware: castrated aosp without anything).
For more features: I'm looking very forward to lineageos, when M kernelsources are published by oneplus.

SnapdragonCamera for OxygenOS
Packaged:
https://forum.xda-developers.com/oneplus-3t/themes/apk-snapdragoncamera-codeaurora-build-t3533687

nvertigo67 said:
I've generated vendor blobs from 3.5.4 full ota zip, because it can't work to access /system via adb pull on user builds ...
Click to expand...
Click to collapse
How do you extract the files from the OTA zip? Of course I know how to unzip a file but I mean how to get the actual files out of the image files. Can this be done with basic Linux Tools?

freepenguin84 said:
How do you extract the files from the OTA zip? Of course I know how to unzip a file but I mean how to get the actual files out of the image files. Can this be done with basic Linux Tools?
Click to expand...
Click to collapse
unpack the rom (you need unpackbootimage - either from your dist, or from android sdk); unpack system.new.dat (sdat2img.py - from your dist, or search with google, don't know if this is in sdk); mount system.img somewhere; edit pull_library.sh from adb pull to cp.
This pull_library.sh is for oss from end of february, you have to edit the current one and - of course - have to change the source of the cp command to meet your local paths:
https://github.com/nvertigo/local_manifest/blob/oneplus/oneplus3t_N/pull_library.sh

[SOLVED] Help building a custom kernel...

Whatever I do, my custom build kernels fail to boot. There's the ZUK logo very briefly, then device drops to bootloader screen. I'm out of ideas what I'm doing wrong, maybe someone here can give me a hint. :good:
I've tried with current AEX kernel git snapshot and also stock kernel sources. Building using the AEX_defconfig goes ok, I have Image.gz, replace it in previously extracted "stock" boot image and use mkbootimg.py to rebuild the new image. Offsets etc. are all correct (I think), like this: (from AEX)
Code:
kernel=kernel
ramdisk=ramdisk
page_size=4096
kernel_size=9101281
ramdisk_size=2671109
base_addr=0x80000000
kernel_offset=0x00008000
ramdisk_offset=0x01000000
tags_offset=0x00000100
cmd_line='androidboot.hardware=qcom ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] buildvariant=userdebug'
board=""
format=gzip
But the damn new image won't boot, like described above. There has to be something (probably very stupid) I'm missing...
If I replace my own Image.gz with the originally extracted one and mkboot and so on, it's ok. So I guess it has something to do with my kernel build and/or environment. Are there any subsequent steps needed to do with the compiled kernel Image.gz? Or is it just my kernel config which is wrong? But I'm using the AEX defconfig (n7x-caf_z2_row_defconfig, to be exactly) so this should be fine, no?

Ok, I've got it. I had forgottten (=didn't know about at all) to append the device tree blob (arch\arm64\boot\dts\qcom\msm8996-v3-pmi8996-mtp.dtb) to kernel zImage... Simply cat'ing these together works!

Goodluck bro.

void23 said:
Ok, I've got it. I had forgottten (=didn't know about at all) to append the device tree blob (arch\arm64\boot\dts\qcom\msm8996-v3-pmi8996-mtp.dtb) to kernel zImage... Simply cat'ing these together works!
Click to expand...
Click to collapse
please explain .. what exactly i need to do with that file..

[UNOFFICIAL][Recovery][Stock][tissot] TWRP 3.2.1-0 for Mi A1 (New installer)

What?
A TWRP bootable-image and installer ZIP for stock-based ROM's (i.e. not LOS 15.1) and maybe others (untested).
Based on:
Latest TWRP build provided by @pl_blaze
The official TWRP installation script for Pixel 2 by Dees_Troy (will install to both slots automatically - more resilient than the other TWRP script)
The IMG uses official kernel 8.1.10 so might be flashable (not tested!)
Not compatible with LineageOS 15.1 because it uses some custom update API that isn't in this TWRP. I considered using the LOS 15.1 TWRP build in this, but it's not compatible with stock encryption (it always thinks the passcode is wrong).
Full credits to @pl_blaze and Dees_Troy for this. I just packaged up something new and wrote clear instructions.
Why?
The old TWRP thread is not maintained and people keep asking/reporting the same questions/problems. I will try to keep this up to date as long as necessary. This is also a more robust installation script, using magiskboot binary to unpack/repack the boot image.
How?
Uninstall Magisk first if you have it installed, just to be safe. Or reflash stock boot.img. (Might not be necessary - a dirty flash worked OK for me but YMMV).
Fastboot boot (hotboot) any existing working TWRP image. Don't worry about working encryption/data, we only need kernel access. For example...
Code:
fastboot boot oreo_3.2.2_recovery.img
... which can be downloaded from Google Drive here (thanks to whoever shared this, I think it's a pl_blaze reshare).
Download attachment ZIP installer and flash in hot-booted TWRP (it will flash to both slots)
Reboot to Recovery and (re-)flash Magisk, if you use it.
Profit

@pl_blaze brother always thank you for the contributions that you do without coming to the light .and thanks for you @op to post working twrp for stock

this twrp will work on 7.1.2 ? i'm now on aex rom

Thanks @CosmicDan for starting this thread. I started to implement @pl_blaze changes into the official TWRP but I've been failing miserably (I'm a noob). Can you provide sources for the images?
I can't trust binaries floating all over the internet if it's not from a reliable dev. If you've compiled it yourself I'll give a try.

I reshare this twrp img on Telegram group,I tested it, works without problem
Flash of permaent twrp not tested by me
It's a good twrp!

CosmicDan said:
What?
A TWRP bootable-image and installer ZIP for stock-based ROM's (i.e. not LOS 15.1) and maybe others (untested).
Based on:
Latest TWRP build provided by @pl_blaze
The official TWRP installation script for Pixel 2 by Dees_Troy (will install to both slots automatically - more resilient than the other TWRP script)
The IMG uses official kernel 8.1.10 so might be flashable (not tested!)
Not compatible with LineageOS 15.1 because it uses some custom update API that isn't in this TWRP. I considered using the LOS 15.1 TWRP build in this, but it's not compatible with stock encryption (it always thinks the passcode is wrong).
Full credits to @pl_blaze and Dees_Troy for this. I just packaged up something new and wrote clear instructions.
Why?
The old TWRP thread is not maintained and people keep asking/reporting the same questions/problems. I will try to keep this up to date as long as necessary. This is also a more robust installation script, using magiskboot binary to unpack/repack the boot image.
How?
Uninstall Magisk first if you have it installed, just to be safe. Or reflash stock boot.img. (Might not be necessary - a dirty flash worked OK for me but YMMV).
Fastboot boot (hotboot) any existing working TWRP image. Don't worry about working encryption/data, we only need kernel access. For example...
Code:
fastboot boot oreo_3.2.2_recovery.img
... which can be downloaded from Google Drive here (thanks to whoever shared this, I think it's a pl_blaze reshare).
Download attachment ZIP installer and flash in hot-booted TWRP (it will flash to both slots)
Reboot to Recovery and (re-)flash Magisk, if you use it.
Profit
Click to expand...
Click to collapse
what does mean "hot boot", sorry am novice, Not even he could boot boot recovery from Minimal ADB and fastboot ,,, What am I doing wrong?
View attachment 4438212

teacapan said:
Fastboot boot (hotboot) anwhat does mean "hot boot", sorry am novice, Not even he could boot boot recovery from Minimal ADB and fastboot ,,, What am I doing wrong?
Click to expand...
Click to collapse
Hot boot means you are not flashing the recovery image just running it temporarily. Stock boot image is untouched in this process.
Run
fastboot devices
To check whether your device is connected.

alkesh95 said:
Hot boot means you are not flashing the recovery image just running it temporarily. Stock boot image is untouched in this process.
Run
fastboot devices
To check whether your device is connected.
Click to expand...
Click to collapse
thanks for reply, if you look at the screenshot it looks I am connected, the point is that it does not load the file, it does not find it, so if it does not start in recovery I can not do anything I'm stuck.

teacapan said:
thanks for reply, if you look at the screenshot it looks I am connected, the point is that it does not load the file, it does not find it, so if it does not start in recovery I can not do anything I'm stuck.
Click to expand...
Click to collapse
Did you put your recovery into the fastboot forder?
Did you unpack the zip ?
Also check if the name of recovery image is the same

It's possible to make password for twrp

DELETED.

lef7er1s said:
Did you put your recovery into the fastboot forder?
Did you unpack the zip ?
Also check if the name of recovery image is the same
Click to expand...
Click to collapse
1-yes
2-yes
3-yes
Anyway thanks for try help me.

Yeah well, I'm still stuck where, some help would be very appreciated.
View attachment 4438552
View attachment 4438553

Polluktus said:
this twrp will work on 7.1.2 ? i'm now on aex rom
Click to expand...
Click to collapse
Not sure, I've only tested on stock Oreo. Try and and let us know!
atttoush said:
Thanks @CosmicDan for starting this thread. I started to implement @pl_blaze changes into the official TWRP but I've been failing miserably (I'm a noob). Can you provide sources for the images?
I can't trust binaries floating all over the internet if it's not from a reliable dev. If you've compiled it yourself I'll give a try.
Click to expand...
Click to collapse
Indeed, no I have not compiled it myself - just ripped from pl_blaze.
I have a Oreo source repo cloned now for other reasons, but I might try and compile TWRP myself. Although it's been a couple years since I've tried to compile device-specific stuff from an AOSP tree so I don't know how long that will take.
teacapan said:
thanks for reply, if you look at the screenshot it looks I am connected, the point is that it does not load the file, it does not find it, so if it does not start in recovery I can not do anything I'm stuck.
Click to expand...
Click to collapse
Sounds like you just need to learn more about how to use console tools. You need to make sure the "fastboot boot filename.img" command will have a "filename.img" that matches the img filename in the current directory. This is just an example - substitute "filename.img" for the real filename. Use the CD command to change directory to where the img is.

teacapan said:
Yeah well, I'm still stuck where, some help would be very appreciated.
View attachment 4438552
View attachment 4438553
Click to expand...
Click to collapse
Try renaming the img file to something simpler like oreo_twrp.img
Edit: ah yes, the file you are pointing to has to be in the same directory where you opened cmd window, as cosmicdan stated above

CosmicDan said:
Indeed, no I have not compiled it myself - just ripped from pl_blaze.
I have a Oreo source repo cloned now for other reasons, but I might try and compile TWRP myself. Although it's been a couple years since I've tried to compile device-specific stuff from an AOSP tree so I don't know how long that will take.
Click to expand...
Click to collapse
Glad you open this thread. I'll wait for your compiled version to give it a try
teacapan said:
Yeah well, I'm still stuck where, some help would be very appreciated.
Click to expand...
Click to collapse
I don't know man, these adb and fastboot binaries look old (2014?). Try to get recent ones. And repeat the process.

silv3rfox said:
Glad you open this thread. I'll wait for your compiled version to give it a try
I don't know man, these adb and fastboot binaries look old (2014?). Try to get recent ones. And repeat the process.
Click to expand...
Click to collapse
Thanks, i will.

teacapan said:
Yeah well, I'm still stuck where, some help would be very appreciated.
Click to expand...
Click to collapse
Before flashing recovery
CD C:\Users\YOUR_USERNAME\Desktop\Adb

teacapan said:
Yeah well, I'm still stuck where, some help would be very appreciated.
Click to expand...
Click to collapse
The name of the file is ending with .img, delete ending " .img ", see below that patched_boot without .img in the end

Thanks for this. I checked out the differences between this and the flashable zip I was using (twrp-3.2.1-1-installer-tissot-FIXED_By_DroiDMester) and found this:
Code:
# write the new boot image to boot block
write_boot() {
print "Writing new boot image to memory..."
cd "$tmp"
if $use_dd; then
dd if=boot-new-a.img of="$boot_block"_a
[ $? = 0 ] || abort "Failed to write boot image A! You may need to restore your boot partition"
dd if=boot-new-b.img of="$boot_block"_b
[ $? = 0 ] || abort "Failed to write boot image B! You may need to restore your boot partition"
else
flash_image "$boot_block" boot-new.img
fi
[ $? = 0 ] || abort "Failed to write boot image! You may need to restore your boot partition"
}
This also flashes it into boot_a and boot_b correct?
What other differences does this have over that?