Develop Bugs

Haret + Asus P535

Hello !
I PDAphone a asus P535 running Windows Mobile 6 that I would like to try Linux.
These characteristics:
-processor PXA270 520Mhz
-256Mo ROM
-64Mo RAM
-GPS SiRFStar III
-bluetooth
-Usb 1.1
-Wifi IEEE 802.11b+g
I am trying last week to launch a kernel image with Android Haret.exe it does not work.
I have a black screen that appears with:
Haret boot
Shutting down hardware
Turning off MMU...
In preloader
PSR=600000df
Kernel relocated
initrd relocated
jumping to kernel...
Can you help me?

You should create the 'earlyharetlog.txt' file in the same directory as haret.exe
and run haret.exe
It will create the haretlog.txt file, which you may post here.

Haret = haretlog.txt
Thank you.
Could - you tell me where I made a mistake.
Here is the file "log":
===== HaRET 0.5.1 =====
Setting KMode to true.
Old KMode was 1
Finished initializing output
Loading dynamically bound functions
Function '[email protected]@[email protected]@[email protected]' in library 'gx' at 0248D9EC
Function '[email protected]@YAHXZ' in library 'gx' at 0248DDD8
Function '[email protected]@YAPAXXZ' in library 'gx' at 0248D2A8
Function '[email protected]@YAHXZ' in library 'gx' at 0248D36C
Function 'LoadLibraryExW' in library 'coredll' at 03F65FE0
Function 'GetSystemPowerStatusEx2' in library 'coredll' at 03F6C9A8
Function 'SleepTillTick' in library 'coredll' at 03F65F00
Function 'AllocPhysMem' in library 'coredll' at 03F65E38
Function 'FreePhysMem' in library 'coredll' at 03F65EA4
Function 'CreateToolhelp32Snapshot' in library 'toolhelp' at 02E1505C
Function 'Process32First' in library 'toolhelp' at 02E15140
Function 'Process32Next' in library 'toolhelp' at 02E151AC
Function 'Module32First' in library 'toolhelp' at 02E15340
Function 'Module32Next' in library 'toolhelp' at 02E153B0
Function 'CloseToolhelp32Snapshot' in library 'toolhelp' at 02E1507C
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Unable to load library 'ace_ddi'
Detecting memory
WinCE reports memory size 67108864 (phys=53121024 store=171950080)
Detecting current machine
Trying to detect machine (Plat='PocketPC' OEM='Asus P535')
Wince reports processor: core=PXA270 name=520Mhz cat= vend=Intel
Looking at machine Alpine
Looking at machine Apache
Looking at machine AximX50
Looking at machine AximX5
Looking at machine Beetles
Looking at machine Blueangel
Looking at machine Himalaya
Looking at machine Magician
Looking at machine Universal
Looking at machine H1910
Looking at machine H1940
Looking at machine H2200
Looking at machine H3600b
Looking at machine H3700
Looking at machine H3870
Looking at machine H3900
Looking at machine H4000
Looking at machine H4300
Looking at machine H5000
Looking at machine H6340
Looking at machine HX2000
Looking at machine HX4700
Looking at machine Sable
Looking at machine Wizard
Looking at machine Hermes
Looking at machine Trinity
Looking at machine Athena
Looking at machine G500
Looking at machine Artemis
Looking at machine Herald
Looking at machine Prophet
Looking at machine RX3000
Looking at machine Treo700wx
Looking at machine e310
Looking at machine e740
Looking at machine Acer_n30
Looking at machine Mio_P550
Looking at machine Kaiser
Looking at machine Loox5xx
Looking at machine Jornada820
Looking at machine H3100
Looking at machine H3600a
Looking at machine Tornado
Looking at machine Libra
Looking at machine Generic Intel PXA27x
Looking at machine Generic Intel PXA
Looking at machine Generic TI OMAP
Looking at machine Generic TI OMAP15xx
Looking at machine Generic Samsung s3c24xx
Looking at machine Generic MSM7500
Looking at machine Generic ARM 920t
Looking at machine Generic ARM 926
Looking at machine Generic ARM v6
Looking at arch Generic Intel PXA27x
Registering command IGPIO
Registering command WG|PIO
Registering command GPLR
Registering command GPDR
Registering command GAFR
Registering command GPIO
Registering command GPIOST
Registering command LOADLIBRARYEX
Registering command TRACES
Registering command RESUMETRACES
Registering command WI|RQ
Registering command TRACE
Registering command TRACEMASK
Registering command TRACE2
Registering command TRACETYPE
Registering command TRACE2TYPE
Registering command TRACEFORWATCH
Registering command INSN
Registering command INSNREENABLE
Registering command INSNREG1
Registering command INSNREG2
Registering command INSN2
Registering command INSN2REENABLE
Registering command INSN2REG1
Registering command INSN2REG2
Registering command ALTL1TRACE
Registering command MAXL1TRACE
Registering command MAXL1TRACERESUME
Registering command MMUTRACE
Registering command TRACEIGNORE
Registering command PERMISSIVEMMUTRACE
Registering command KILL
Registering command PS
Registering command LSMOD
Registering command ADDR2MOD
Registering command AC97
Not registering command ATIDBG
Initializing for machine 'Generic Intel PXA27x'
HaRET(1)# set ramaddr 0xa0000000
HaRET(2)# addlist IRQS p2v(0x40D00000) 0x480 32 0
HaRET(3)# addlist IRQS p2v(0x40D0009c) 0xfffffffc 32 0
HaRET(4)# addlist IRQS p2v(0x40E00048) 0 32 0
HaRET(5)# addlist IRQS p2v(0x40E0004c) 0 32 0
HaRET(6)# addlist IRQS p2v(0x40E00050) 0 32 0
HaRET(7)# addlist IRQS p2v(0x40E00148) 0 32 0
HaRET(8)# addlist GPIOS p2v(0x40E00000)
HaRET(9)# addlist GPIOS p2v(0x40E00004)
HaRET(10)# addlist GPIOS p2v(0x40E00008)
HaRET(11)# addlist GPIOS p2v(0x40E00100)
HaRET(12)# addlist GPIOS p2v(0x40E0000C)
HaRET(13)# addlist GPIOS p2v(0x40E00010)
HaRET(14)# addlist GPIOS p2v(0x40E00014)
HaRET(15)# addlist GPIOS p2v(0x40E0010C)
HaRET(16)# addlist GPIOS p2v(0x40E00054)
HaRET(17)# addlist GPIOS p2v(0x40E00058)
HaRET(18)# addlist GPIOS p2v(0x40E0005c)
HaRET(19)# addlist GPIOS p2v(0x40E00060)
HaRET(20)# addlist GPIOS p2v(0x40E00064)
HaRET(21)# addlist GPIOS p2v(0x40E00068)
HaRET(22)# addlist GPIOS p2v(0x40E0006c)
HaRET(23)# addlist GPIOS p2v(0x40E00070)
HaRET(24)# newvar CLOCKS GPIOS 'Architecture clock registers'
HaRET(25)# addlist CLOCKS p2v(0x41300000)
HaRET(26)# addlist CLOCKS p2v(0x41300004)
HaRET(27)# addlist CLOCKS p2v(0x41300008)
HaRET(28)# addlist CLOCKS p2v(0x4130000C)
HaRET(29)# addlist CLOCKS cp 14 0 6 0 0
HaRET(30)# addlist CLOCKS cp 14 0 7 0 0
Welcome, this is HaRET 0.5.1 running on WindowsCE v5.2
Minimal virtual address: 00010000, maximal virtual address: 7FFFFFFF
Detected machine Generic Intel PXA27x/PXA27x (Plat='PocketPC' OEM='Asus P535')
CPU is Intel ARM arch 5TE revision 0 product 17 stepping 7 running in system mode
Enter 'HELP' for a short command summary.
Running WSAStartup
Starting gui
In initdialog
Found machine Generic Intel PXA27x
executing startup.txt
HaRET(1)# set mtype 535
HaRET(2)# set kernel "zImage"
HaRET(3)# boot
boot KERNEL=zImage INITRD=
Opening file zImage
boot params: RAMADDR=a0000000 RAMSIZE=04000000 MTYPE=535 CMDLINE='root=/dev/ram0 ro console=tty0'
Boot FB feedback: 1
Built virtual to physical page mapping
Allocated 307 pages (tags=4EC00000/a2309000 kernel=4EC01000/a2308000 initrd=4ED2F000/a21a1000 index=4ED2F000/a21a1000)
Built kernel tags area
Built page index
Video buffer at 48A00080 sx=240 sy=320 mx=60 my=53
Video Phys FB=5c000080 Fonts=a219f064
[email protected]/a219e000 sj=4ED32000 stack=4ED30000/a21a0000 data=4ED31000/a219f000 exec=a219e128
Reading 1235904 bytes...
Read complete
Launching to physical address a219e010
Trampoline setup ([email protected]/1e0241c0/a0b831c0)
MMU setup: mmu=A87D0000/a07d0000
Go Go Go...

To begin with, you need to dump gpio table and pxa27xlccr (with gnuharet).. and then make your own kernel. but you could try my kernel from asus p525
http://rapidshare.com/files/116299470/zImage.html
and yes, for it not to hang. use this startup.txt
set KERNEL zImage
set MTYPE 1554
set CMDLINE "debug rootdelay=10 root=/dev/ram0 console=tty0 fbcon=rotate:0 mem=64M"
boot2

sp3dev said:
To begin with, you need to dump gpio table and pxa27xlccr (with gnuharet)..
Click to expand...
Click to collapse
I've ported the 'dump pxa27x' command to mainline haret:
http://jornada820.sf.net/files/haret/haret-w.exe
but you could try my kernel from asus p525
Click to expand...
Click to collapse
I don't see asus 525 mentioned here
http://www.handhelds.org/moin/moin.cgi/SupportedHandheldSummary
Can you provide the kernel patch for it ?

yes, i mean dump pxa27xgpio of course.. i think i will add asus to hh cvs.. but not now. i've been rather busy. anyhow, i will need to clean the code and fix audio before it.
btw, could you help me with linux? actually, not with hardware (though i need some help with joystick and pca9535).. with qtopia.
btw, thanks for haret

Can any one please post the whole package ? I cant make it run.
thx

sp3dev said:
yes, i mean dump pxa27xgpio of course..
Click to expand...
Click to collapse
'dump pxa27x' in haret-w.exe includes the output of all 'dump pxa27x*' commands
in gnu-haret.
btw, could you help me with linux? actually, not with hardware (though i need some help with joystick and pca9535).. with qtopia.
Click to expand...
Click to collapse
I think you should take the qtopia image from universal, and set joystick key events
to match those used by universal.

If you run the kernel, please write message

Ok, ATM it seems only me and DaLiV are working on linux on p525. but we wouldnt mind anyone join us.
We have 2.6.21 kernel, correctly set up fb, partly working keypad, sd memory through pxa mmc driver, corgi-bl driver and touchscreen
Sound is working through pxa2xx-ac97, headphones only. need to set volume via alsamixer. we are working on wm9713 driver
The things that are to be done (the most important ones, in the decreasing order of importance)
UDC
Suspend
PCA9535 i2c
Bluetooth
Phone
Anyone who wants to test it
http://rapidshare.com/files/118520723/ln.tgz.html
http://familiar.handhelds.org/relea...0/gpe-image-v0.8.4-ipaq-pxa270.rootfs.tar.bz2
Create an ext2 partition on your flash card (second partition, primary. or edit default.txt)
unpack (e.g. if your flash is - /media/usbdisk-1
bunzip2 gpe-image-v0.8.4-ipaq-pxa270.rootfs.tar.bz2
tar xvpf gpe-image-v0.8.4-ipaq-pxa270.rootfs.tar -C /media/usbdisk-1
certainly, this is to be done under root. to keep permissions for all files
then,
sync
remove /lib/modules and replace with ours. the same is with /etc/modutils
That is all. just copy all files from 'kernel' dir to your pda and run haret.exe
And the log
[ 0.000000] Linux version 2.6.21-hh20 ([email protected]) (gcc version 4.2.1) #94 PREEMPT Fri May 30 21:25:16 MSD 2008
[ 0.000000] CPU: XScale-PXA270 [69054117] revision 7 (ARMv5TE), cr=0000397f
[ 0.000000] Machine: Asus P525
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] On node 0 totalpages: 16384
[ 0.000000] DMA zone: 128 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 16256 pages, LIFO batch:3
[ 0.000000] Normal zone: 0 pages used for memmap
[ 0.000000] Run Mode clock: 208.00MHz (*16)
[ 0.000000] Turbo Mode clock: 208.00MHz (*1.0, active)
[ 0.000000] Memory clock: 104.00MHz (/2)
[ 0.000000] System bus clock: 208.00MHz
[ 0.000000] CPU0: D VIVT undefined 5 cache
[ 0.000000] CPU0: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
[ 0.000000] CPU0: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
[ 0.000000] Built 1 zonelists. Total pages: 16256
[ 0.000000] Kernel command line: debug rootdelay=10 root=/dev/mmcblk0p2 console=tty0 fbcon=rotate:0 mem=64M
[ 0.000000] PID hash table entries: 256 (order: 8, 1024 bytes)
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Memory: 64MB = 64MB total
[ 0.000000] Memory: 61988KB available (2608K code, 182K data, 84K init)
[ 0.010000] Calibrating delay loop... 207.25 BogoMIPS (lpj=1036288)
[ 0.200000] Mount-cache hash table entries: 512
[ 0.200000] CPU: Testing write buffer coherency: ok
[ 0.200000] NET: Registered protocol family 16
[ 0.230000] usbcore: registered new interface driver usbfs
[ 0.230000] usbcore: registered new interface driver hub
[ 0.230000] usbcore: registered new device driver usb
[ 0.240000] Time: pxa_timer clocksource has been installed.
[ 0.240000] NET: Registered protocol family 2
[ 0.310000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.310000] TCP established hash table entries: 2048 (order: 2, 16384 bytes)
[ 0.310000] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[ 0.310000] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.310000] TCP reno registered
[ 0.340000] PXA CPU frequency change support initialized
[ 0.340000] NetWinder Floating Point Emulator V0.97 (double precision)
[ 0.340000] JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
[ 0.340000] io scheduler noop registered
[ 0.340000] io scheduler anticipatory registered (default)
[ 0.340000] io scheduler deadline registered
[ 0.350000] Corgi Backlight Driver Initialized.
[ 0.360000] Console: switching to colour frame buffer device 30x40
[ 0.450000] SA1100/PXA2xx Watchdog Timer: timer margin 60 sec
[ 0.450000] pxa2xx-uart.0: ttyS0 at MMIO 0x40100000 (irq = 22) is a FFUART
[ 0.450000] pxa2xx-uart.1: ttyS1 at MMIO 0x40200000 (irq = 21) is a BTUART
[ 0.460000] pxa2xx-uart.2: ttyS2 at MMIO 0x40700000 (irq = 20) is a STUART
[ 0.490000] RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
[ 0.510000] loop: loaded (max 8 devices)
[ 0.520000] usbmon: debugfs is not available
[ 0.530000] ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
[ 0.550000] usbcore: registered new interface driver usbhid
[ 0.560000] drivers/usb/input/hid-core.c: v2.6:USB HID core driver
[ 0.580000] pxa27x_udc: version 01-01-2006
[ 0.590000] UDC disconnected.
[ 0.600000] UDC disconnected.
[ 0.610000] ether gadget: using random self ethernet address
[ 0.620000] ether gadget: using random host ethernet address
[ 0.640000] usb0: Ethernet Gadget, version: May Day 2005
[ 0.650000] usb0: using pxa27x_udc, OUT ep2out-bulk IN ep1in-bulk STATUS ep3in-intr
[ 0.670000] usb0: MAC 0e:8c:22:12:b3:da
[ 0.680000] usb0: HOST MAC 06:2f:b7:42:8d:6e
[ 0.690000] usb0: RNDIS ready
[ 0.810000] UDC connect.
[ 0.810000] input: gpio-keys as /class/input/input0
[ 0.830000] input: pxa27x-keyboard as /class/input/input1
[ 0.840000] PXA27x keyboard controller enabled
[ 0.850000] sa1100-rtc sa1100-rtc: rtc intf: sysfs
[ 0.870000] sa1100-rtc sa1100-rtc: rtc intf: proc
[ 0.880000] sa1100-rtc sa1100-rtc: rtc intf: dev (254:0)
[ 0.890000] sa1100-rtc sa1100-rtc: rtc core: registered sa1100-rtc as rtc0
[ 0.910000] APM Battery Driver
[ 0.920000] min dma period: 1230768 ps, new clock 624000 kHz
[ 0.930000] min dma period: 1230768 ps, new clock 624000 kHz
[ 0.960000] Advanced Linux Sound Architecture Driver Version 1.0.14rc3 (Wed Mar 14 07:25:50 2007 UTC).
[ 1.040000] ALSA device list:
[ 1.050000] #0: pxa2xx-ac97 (Wolfson WM9713,WM9714)
[ 1.060000] TCP cubic registered
[ 1.070000] NET: Registered protocol family 1
[ 1.080000] NET: Registered protocol family 17
[ 1.090000] XScale iWMMXt coprocessor detected.
[ 1.100000] sa1100-rtc sa1100-rtc: setting the system clock to 1970-01-01 15:22:38 (55358)
[ 1.120000] Waiting 10sec before mounting root device...
[ 1.140000] mmcblk0: mmc0:b368 SD 501248KiB
[ 1.150000] mmcblk0: p1 p2 p3
[ 11.180000] EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
[ 11.200000] VFS: Mounted root (ext2 filesystem).
[ 11.210000] Freeing init memory: 84K
[ 46.750000] wm97xx: version 0.65 [email protected]
[ 46.780000] wm97xx: detected a wm9713 codec
[ 46.810000] input: wm97xx touchscreen as /class/input/input2
[ 46.840000] wm97xx: setting pen detect pull-up to 8000 Ohms

hi
tried on my o2zinc as it has the same processor, will report on any prog. thx

sp3dev said:
Anyone who wants to test it
http://rapidshare.com/files/118520723/ln.tgz.html
http://familiar.handhelds.org/relea...0/gpe-image-v0.8.4-ipaq-pxa270.rootfs.tar.bz2
Create an ext2 partition on your flash card (second partition, primary. or edit default.txt)
unpack (e.g. if your flash is - /media/usbdisk-1
bunzip2 gpe-image-v0.8.4-ipaq-pxa270.rootfs.tar.bz2
tar xvpf gpe-image-v0.8.4-ipaq-pxa270.rootfs.tar -C /media/usbdisk-1
certainly, this is to be done under root. to keep permissions for all files
then,
sync
remove /lib/modules and replace with ours. the same is with /etc/modutils
That is all. just copy all files from 'kernel' dir to your pda and run haret.exe
Click to expand...
Click to collapse
i have a p525 with windows mobile 6 and after a lot of messing around and an unwanted hardreset i managed to make it work. i havent checked everything yet, but as far as i can say from the hardware keys only the number keys work.

I keep on having error about vfs root filesystem, any idea ???

how did you make it work? i'm working on windows pc, how do i proceed? or do i have to install linux... ubuntu perhaps?

guys what about port of android for other devices with pxa27x procesors?

Ok, a test build of qtopia for p525
copy haret.exe, default.txt and zImage to your wince pda
then, make an ext2 or reiserfs filesystem on one of sd card partitions. you can find manuals on using fdisk or gparted on the internet. e.g., your new partition is /dev/sde2
then,
mkfs.ext2 /dev/sde2
mkdir /mnt/asus
mount /dev/sde2 /mnt/asus
tar xvpf asus_qtopia.tar.bz2 -C /mnt/asus
cd /mnt/asus
sync
cd /
umount /mnt/asus
Then, edit you default.txt to point to your partition. replace mmcblk0p2 with the partition name, like mmcblk0p3
At the moment you can only use menu, some qtopia apps, gsm calls do not work. Anyone willing to help me implement gsm calling? i can provide you with gsm logs from 525)).
Here are some screenshots
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Ok, the brief status of the porting
Working in kernel
1. Framebuffer
2. Backlight
3. LEDs and vibro
4. Sound via pxa2xx-ac97 (still need to add sound profiles)
5. Keyboard - partly (only the part connected to pxa)
6. Touchscreen
7. max8588 voltage regulator
8. PCMCIA (not included)
9. SD Memory Card
10. pxa ficp - irda
11. USB partly. if enabled before booting linux
Todo
1. Bluetooth FW loader
2. i2c-connected keypad and joypad
3. Camera (looks like it's mt9m911)
4. Battery (dunno how it is connected)
5. Fix libertas to support our CF8385 B1
As for Qt Extended. GSM is not working. So it's the primary objective for now
If anyone who had the experience with porting qtopia to uni/freerunner/motorola wishes to join the project - you're welcome
http://depositfiles.com/ru/files/awz83fp34

Can't we just use an updated kernel? I mean, kernel 2.6.21 is a little old, and the latest (stable) kernel has bugfixes for the arm platform that 2.6.21 doesn't have.

The kernel in the archive with qtopia is 2.6.27-rc5

sp3dev
Please, can you upload somewhere your kernel config and mach- dir? I'm trying to make kernel for Rover S5 (aka Lenovo ET980), and your kernel is working good on this device (according to the fedora's boot logs), but with 1 major problem - display is not working
p.s. i'm talking about 2.6.21-hh20 kernel config, the new one isn't working

Need help for Asus P565
Hi,
I am on Asus P565 which carries...
Processor - Marvell PXA930
RAM - 128 MB
ROM - 256 MB
Camera - 3.2MP
Inbuilt GPS - SiRF Star III
Can someone share mtype for this phone or guide me to find it by using haret.
Thanks in advance...

[WIP] Lets recover hard-bricks

Hey guys. I'm doing some work to figure out how to recover Galaxy Nexus devices which are hard-bricked.. ie.. they have a bad or no bootloader installed.
the boot sequence
1. IROM - the Internal ROM which cannot be rewritten on the device. This loads the XLoader.
2. XLoader/MLO - This completes the initialization of the processor and memory, and loads up the relatively huge U-Boot ( Samsung modified this and calls it SBL)
3. UBoot/SBL - This "Bootloader" is almost a complete operating system. The U-Boot initializes the screen, provides Odin mode, Fastboot Mode as well as loading the kernel/recovery and provides a UART debugging mode (Yet to be unlocked).
4. Kernel - Once we reach this point, it's all clear.. the kernel is linux which loads android and all sorts of other things.
The Problem
People are bricking their devices at stage 2 and 3 of this boot sequence... This leaves them unable to boot Fastboot or Odin. The device is 100% interchangable with a brick. These devices are ending up hard bricked.
The solution
We must come up with a way to undo the hard brick. Here are some things i'm looking at to use the native hardware to recover itself.
When you plug in the device (when off), you will immediately notice a Texas Instruments D010 device gets enumerated. This is a debug mode for the processor.
Code:
Bus 001 Device 023: ID 0451:d010 Texas Instruments, Inc.
We've started looking at some bootloader output here: http://forum.xda-developers.com/showthread.php?t=1461986
You can find information about the OMAP4 bootloaders here: http://omapedia.org/wiki/Bootloader_Project
Help
I need help locating drivers to initialize the 0451:d010 device and make it readable from within Linux or Windows.. Generally Linux is easier to find appropriate drivers.
I could use some help collecting more reading materials and resources.
I think together as a community we can take care of this problem.

I kinda forgot that thread, it got lost among rom/kernel threads. Thanks for the reminder.
sent from my i9250

Ok... so here's the most complete boot log I've been able to obtain from the device
Code:
[Thermal] OK to boot
Initialize runtime thermal monitoring ...done!
-- OMAP 00004460 (version 04460e11) PPA release 1.6.1 Hash 30639809--
Device type: HS, DEBUG OFF
CPFROM HAL API support integrated
THERMAL support integrated: Run Time + Boot time
HDCP support integrated
-- PROD PPA RC3.2.3 --
Reset reason = 00037ba2
PRM_RSTST = 00000002
PPA freed 2992 bytes
Texas Instruments X-Loader 1.41 (Nov 16 2011 - 16:28:45)
Starting OS Bootloader from MMC/SD1 ...
EXCEPTION : CM_CLKMODE_DPLL_ABE = 0x7
EXCEPTION : CM_IDLEST_DPLL_ABE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_ABE = 0x804018
EXCEPTION : CM_CLKMODE_DPLL_CORE = 0xf
EXCEPTION : CM_IDLEST_DPLL_CORE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_CORE = 0x7d05
EXCEPTION : CM_CLKMODE_DPLL_PER = 0x107
EXCEPTION : CM_IDLEST_DPLL_PER = 0x1
EXCEPTION : CM_CLKSEL_DPLL_PER = 0x1400
EXCEPTION : CM_CLKMODE_DPLL_MPU = 0x117
EXCEPTION : CM_IDLEST_DPLL_MPU = 0x1
EXCEPTION : CM_CLKSEL_DPLL_MPU = 0x807d07
CFG_LOADADDR = 0xa0208000
1st instruct = 0xEA000007
[ __omap_twl6030_init_vbat_cfg :49] SA_PHOENIX_START_CONDITION = 0x4a
[ __omap_twl6030_init_vbat_cfg :54] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :63] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :86] SA_BBSPOR_CFG = 0x78
====== VCELL : 381375, SOC : 49, nType : 5 ======
[Charger] nScaledVCELL : 381375000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x5
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000003
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x40000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
dev : 5
[sbl_board_charger_init_post] : Succeed set model data : 0x78!!!!!
====== VCELL : 381500, SOC : 50, nType : 5 ======
[Charger] nScaledVCELL : 381500000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x5
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000003
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x40000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x1
message.command =
message.status =
message.recovery =
<hit enter twice to activate fiq debugger>
[Thermal] OK to boot
Initialize runtime thermal monitoring ...done!
-- OMAP 00004460 (version 04460e11) PPA release 1.6.1 Hash 30639809--
Device type: HS, DEBUG OFF
CPFROM HAL API support integrated
THERMAL support integrated: Run Time + Boot time
HDCP support integrated
-- PROD PPA RC3.2.3 --
Reset reason = 0003fba2
PRM_RSTST = 00000002
PPA freed 2992 bytes
Texas Instruments X-Loader 1.41 (Nov 16 2011 - 16:28:45)
Starting OS Bootloader from MMC/SD1 ...
EXCEPTION : CM_CLKMODE_DPLL_ABE = 0x7
EXCEPTION : CM_IDLEST_DPLL_ABE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_ABE = 0x804018
EXCEPTION : CM_CLKMODE_DPLL_CORE = 0xf
EXCEPTION : CM_IDLEST_DPLL_CORE = 0x1
EXCEPTION : CM_CLKSEL_DPLL_CORE = 0x7d05
EXCEPTION : CM_CLKMODE_DPLL_PER = 0x107
EXCEPTION : CM_IDLEST_DPLL_PER = 0x1
EXCEPTION : CM_CLKSEL_DPLL_PER = 0x1400
EXCEPTION : CM_CLKMODE_DPLL_MPU = 0x117
EXCEPTION : CM_IDLEST_DPLL_MPU = 0x1
EXCEPTION : CM_CLKSEL_DPLL_MPU = 0x807d07
CFG_LOADADDR = 0xa0208000
1st instruct = 0xEA000007
[ __omap_twl6030_init_vbat_cfg :49] SA_PHOENIX_START_CONDITION = 0x8
[ __omap_twl6030_init_vbat_cfg :54] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :63] SA_PH_CFG_VBATLOWV = 0x80
[ __omap_twl6030_init_vbat_cfg :86] SA_BBSPOR_CFG = 0x78
====== VCELL : 381375, SOC : 50, nType : 5 ======
[Charger] nScaledVCELL : 381375000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
[ __omap_usbacc_test_donwload_by_musb :280] nDeviceType : 0x5
[ omap_usbacc_get_reboot_reason :333] nJigStatus = 0x00000003
[ __sbl_board_hw_init_late :719] final reboot mode in cable = 0x40000
[ __sbl_board_hw_init_late :730] Wake up by TA / USB / JIG
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
<hit enter twice to activate fiq debugger>
Communications established====== VCELL : 381375, SOC : 50, nType : 5 ======
[Charger] nScaledVCELL : 381375000, nDesriedSOC, : 62, nMaxSOC : 82, nMinSOC : 42
* FB base addr = 0xbea70000!
* PANEL_S6E8AA0_ID_READ : 0x12, 0x8e, 0x9f.
[ omap_power_get_reset_source :47] PRM_RSTST : 0x2
<hit enter twice to activate fiq debugger>
debug> console
console mode
[ 3.320373] cannot apply mgr(lcd) on inactive device
[ 3.325805] omapfb omapfb: failed to apply dispc config
[ 3.331359] cannot apply mgr(tv) on inactive device
[ 3.336578] omapfb omapfb: failed to apply dispc config
[ 3.341949] cannot apply mgr(lcd2) on inactive device
[ 3.347167] omapfb omapfb: failed to apply dispc config
[ 3.354888] regulator_init_complete: VDAC: disabling
[ 3.361053] omaplfb OMAPLFBInitFBDev: Device 0: Requesting 4 TILER 2D framebuffers
[ 3.369232] ## wifi_probe
[ 3.371917] wifi_set_power = 1
[ 3.631866] wifi_set_carddetect = 1
[ 3.647338]
[ 3.647338] Dongle Host Driver, version 5.90.125.94
[ 3.647338] Compiled in drivers/net/wireless/bcmdhd on Nov 21 2011 at 19:05:54
[ 3.764984] mmc1: queuing unknown CIS tuple 0x80 (7 bytes)
[ 3.817810] mmc1: queuing unknown CIS tuple 0x80 (3 bytes)
[ 3.837463] mmc1: new high speed SDIO card at address 0001
[ 3.844818] F1 signature read @0x18000000=0x16844330
[ 3.859436] DHD: dongle ram size is set to 294912(orig 294912)
[ 3.866546] wl_create_event_handler thr:5b started
[ 3.871673] dhd_attach thr:5c started
[ 3.875488] dhd_attach thr:5d started
[ 3.879272] dhd_attach thr:5e started
[ 3.883148] wifi_get_mac_addr
[ 3.888519] Broadcom Dongle Host Driver: register interface [wlan0] MAC: 00:90:4c:11:22:33
[ 3.897430] wifi_set_power = 0
[ 4.157012] =========== WLAN placed in RESET ========
[ 4.163116] fsa9480 4-0025: cable detect change, from 'unknown/none' to 'uart'
[ 4.171203] twl_rtc twl_rtc: setting system clock to 2012-05-13 00:25:12 UTC (1336868712)
[ 4.180816] Freeing init memory: 276K
[ 4.187561] init (1): /proc/1/oom_adj is deprecated, please use /proc/1/oom_score_adj instead.
[ 4.214172] max17040 4-0036: online = 1 vcell = 3795000 soc = 48 status = 3 health = 1 temp = 330 charger status = 0
[ 4.288116] keychord: using input dev tuna-gpio-keypad for fevent
[ 4.354614] EXT4-fs (mmcblk0p10): mounted filesystem with ordered data mode. Opts: (null)
[ 4.446746] mms_ts 3-0048: fw version 0x62 already present
[ 4.454498] mms_ts 3-0048: Melfas MMS-series touch controller initialized
[ 4.757202] omap-rproc omap-rproc.1: Loaded BIOS image ducati-m3.bin, size 4489868
[ 4.765838] omap-rproc omap-rproc.1: BIOS image version is 2
[ 4.785888] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
[ 4.806243] omap_hwmod: ipu: failed to hardreset
[ 4.811035] omap-iommu omap-iommu.0: ducati: version 2.1
[ 4.822448] omap-rproc omap-rproc.1: remote processor ipu is now up
[ 4.835571] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.842071] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.848541] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.855072] omap_rpmsg_mbox_callback: received echo reply from ipu !
[ 4.861816] virtio_rpmsg_bus virtio0: creating channel rpmsg-client-sample addr 0x32
[ 4.869812] virtio_rpmsg_bus virtio0: creating channel rpmsg-client-sample addr 0x33
[ 4.877899] virtio_rpmsg_bus virtio0: creating channel rpmsg-omx addr 0x3c
[ 4.885192] rpmsg_omx rpmsg-omx0: new OMX connection srv channel: 1024 -> 60!
[ 5.959960] EXT4-fs (mmcblk0p12): recovery complete
[ 5.974639] EXT4-fs (mmcblk0p12): mounted filesystem with ordered data mode. Opts: nomblk_io_submit,errors=panic
[ 6.021484] virtio_rpmsg_bus virtio1: creating channel rpmsg-omx addr 0x3c
[ 6.029602] rpmsg_omx rpmsg-omx1: new OMX connection srv channel: 1024 -> 60!
[ 6.170227] EXT4-fs (mmcblk0p11): recovery complete
[ 6.178833] EXT4-fs (mmcblk0p11): mounted filesystem with ordered data mode. Opts: nomblk_io_submit,errors=panic
[ 6.199371] EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: (null)
[ 6.269744] android_usb: already disabled
[ 6.274810] mtp_bind_config
[ 6.277740] adb_bind_config
[ 6.297790] HDCP: loaded keys
[ 6.481079] warning: `adbd' uses 32-bit capabilities (legacy support in use)
[ 6.488433] adb_open
[ 6.702026] init: sys_prop: permission denied uid:1001 name:net.rmnet1.dns1
[ 6.709808] init: sys_prop: permission denied uid:1001 name:net.rmnet1.dns2
[ 6.718780] init: sys_prop: permission denied uid:1001 name:net.rmnet1.gw
[ 6.726196] init: sys_prop: permission denied uid:1001 name:net.rmnet2.dns1
[ 6.733612] init: sys_prop: permission denied uid:1001 name:net.rmnet2.dns2
[ 6.741455] init: sys_prop: permission denied uid:1001 name:net.rmnet2.gw
[ 6.749481] PVR: Installing MISR with cookie c0800c2c
[ 6.757415] PVR: Installing device LISR SGX ISR on IRQ 53 with cookie c7aa2700
[ 6.766174] PVR: OSUnMapPhysToLin: unmapping 65535 bytes from c8be0000
[ 6.773162] PVR: SysFinalise: Version string: SGX revision = 1.2.0
[ 6.797027] [MODEM_IF] misc_open : umts_boot0
[ 6.801666] omap_hsi omap_hsi.0: HSI clock is now 96000000
[ 6.824066] omap_hsi omap_hsi.0: Entering RX wakeup in 3 wires mode (no CAWAKE)
[ 6.831634] [MODEM_IF] xmm6260_off()
[ 6.835327] [MODEM_IF] PA EVENT : reset =0, pa=1
[ 6.840057] [MODEM_IF] umts_ipc0 state changed: OFFLINE
[ 6.845367] [MODEM_IF] xmm6260_on()
[ 6.866821] SMC: SecureCRC=0xBC7458DC
[ 6.959045] [MODEM_IF] PA EVENT : reset =1, pa=0
[ 7.042053] SMC PA: INFO 00000001 00:00:00.000 ------ ------ --------------- Booting... (t=00:25:15.356) SMCXG01.04p11.32196 /Widevine Integration
[ 7.058532] SMC PA: INFO 00000002 00:00:00.017 ------ ------ --------------- Booted
[ 7.238128] [MODEM_IF] misc_release : umts_boot0
[ 7.245147] omap_hsi omap_hsi.0: hsi_write_cancel ch 0
[ 7.251708] omap_hsi omap_hsi.0: __hsi_write_cancel : -125
[ 7.258941] omap_hsi omap_hsi.0: hsi_read_cancel ch 0
[ 7.265106] omap_hsi omap_hsi.0: __hsi_read_cancel : -125
[ 7.270629] omap_hsi omap_hsi.0: __hsi_write_cancel : -61
[ 7.276794] omap_hsi omap_hsi.0: __hsi_read_cancel : -61
[ 7.282470] [MODEM_IF] misc_open : umts_boot1
[ 7.287506] omap_hsi omap_hsi.0: Entering RX wakeup in 4 wires mode
[ 8.299774] misc dsscomp: [c7234000] ignoring set failure -22
[ 8.530609] s6e8aa: d/b 1, p 1, b-01390ffb
[ 8.530639] s6e8aa: c0, 1, b-001215fb, got v 3534794, factory wants 3529338
[ 8.530670] s6e8aa: c1, 1, b-00478927, got v 3764175, factory wants 3755229
[ 8.530700] s6e8aa: c2, 1, b-0012a421, got v 3486385, factory wants 3481495
[ 8.530731] s6e8aa: d/b 1, p 2, b-044d7cf9
[ 8.530761] s6e8aa: c0, 2, b-00bc6c9a, got v 3336878, factory wants 3330014
[ 8.530761] s6e8aa: c1, 2, b-01688d4e, got v 3556595, factory wants 3547367
[ 8.530792] s6e8aa: c2, 2, b-00a7db92, got v 3293516, factory wants 3285750
[ 8.530822] s6e8aa: d/b 1, p 3, b-0b323808
[ 8.530853] s6e8aa: c0, 3, b-026395cd, got v 3203365, factory wants 3194725
[ 8.530883] s6e8aa: c1, 3, b-0331a9fb, got v 3435905, factory wants 3424659
[ 8.530914] s6e8aa: c2, 3, b-021e3100, got v 3149091, factory wants 3139262
[ 8.530944] s6e8aa: d/b 1, p 4, b-186611f4
[ 8.530944] s6e8aa: c0, 4, b-062b8517, got v 3065435, factory wants 3053644
[ 8.531036] s6e8aa: c1, 4, b-0725b7f8, got v 3297279, factory wants 3284148
[ 8.531249] s6e8aa: c2, 4, b-053f8b4b, got v 3005194, factory wants 2992315
[ 8.531280] s6e8aa: d/b 1, p 5, b-6840e4ff
[ 8.531311] s6e8aa: c0, 5, b-221c3d41, got v 2688265, factory wants 2667329
[ 8.531341] s6e8aa: c1, 5, b-24fd4a51, got v 2906316, factory wants 2884895
[ 8.531372] s6e8aa: c2, 5, b-1d67176e, got v 2594260, factory wants 2571400
[ 8.531402] s6e8aa: d/b 1, p 6, b-ffffffff
[ 8.531433] s6e8aa: c0, 6, b-59b1b4d2, got v 2325286, factory wants 2292333
[ 8.531463] s6e8aa: c1, 6, b-60d28a3e, got v 2534439, factory wants 2499333
[ 8.531463] s6e8aa: c2, 6, b-4efd2a80, got v 2197307, factory wants 2162000
[ 11.727386] [MODEM_IF] misc_release : umts_boot1
[ 11.732147] omap_hsi omap_hsi.0: hsi_write_cancel ch 0
[ 11.756225] omap_hsi omap_hsi.0: __hsi_write_cancel : -61
[ 11.762268] omap_hsi omap_hsi.0: hsi_read_cancel ch 0
[ 11.767791] omap_hsi omap_hsi.0: __hsi_read_cancel : -125
[ 11.773620] omap_hsi omap_hsi.0: __hsi_write_cancel : -61
[ 11.779174] omap_hsi omap_hsi.0: __hsi_read_cancel : -61
[ 11.785552] [MODEM_IF] misc_open : umts_ipc0
[ 11.790954] omap_hsi omap_hsi.0: Entering RX wakeup in 4 wires mode
[ 11.798675] [MODEM_IF] misc_open : umts_rfs0
[ 11.829528] [MODEM_IF] PA EVENT : reset =1, pa=1
[ 11.834228] [MODEM_IF] umts_ipc0 state changed: ONLINE
[ 14.545074] drivers/misc/inv_mpu/mldl_cfg.c|inv_mpu_get_slave_config|1792 returning 4
[ 26.044372] request_suspend_state: wakeup (3->0) at 26030029299 (2012-05-13 00:25:34.359069826 UTC)
[ 26.622772] acc_open
[ 26.625122] acc_release
[ 26.670013]
[ 26.670043] Dongle Host Driver, version 5.90.125.94
[ 26.670043] Compiled in drivers/net/wireless/bcmdhd on Nov 21 2011 at 19:05:54
[ 26.684082] wl_android_wifi_on in
[ 26.687622] wifi_set_power = 1
[ 26.971282] =========== WLAN going back to live ========
[ 26.977600] sdio_reset_comm():
[ 27.066314] dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded.
[ 27.228179] wifi_get_mac_addr
[ 27.232513] Firmware up: op_mode=1, Broadcom Dongle Host Driver mac=a0:0b:ba:e6:73:ae
[ 27.344390] dhd_rx_frame: net device is NOT registered yet. drop packet
[ 27.351531] dhd_rx_frame: net device is NOT registered yet. drop packet
[ 27.360076] Firmware version = wl0: Oct 5 2011 14:41:12 version 5.90.125.94
[ 28.639709] wl_bss_connect_done succeeded status=(0x9)
[ 28.732391] wl_bss_connect_done succeeded status=(0x11)
[ 29.166564] nfc_power_apply ON
[ 29.201965] nfc_power_apply OFF
[ 29.272308] nfc_power_apply ON
[ 35.672241] rpmsg_omx rpmsg-omx1: local addr assigned: 0x401
[ 35.682067] omap-iommu omap-iommu.0: iommu_get: ducati qos_request
[ 35.703735] omap_hwmod: ipu: failed to hardreset
[ 35.713470] omap-iommu omap-iommu.0: ducati: version 2.1
[ 35.826934] rpmsg_omx rpmsg6: conn rsp: status 0 addr 101
[ 35.975158] rpmsg_omx rpmsg-omx1: Disconnecting from OMX service at 101
[ 39.279998] wlan0: no IPv6 routers present
[ 44.895355] init: untracked pid 1113 exited
[ 44.905731] init: untracked pid 1119 exited
[ 44.918914] init: untracked pid 1123 exited
[ 44.923248] init: untracked pid 1124 exited
[ 44.927612] init: untracked pid 1117 exited
[ 44.932067] init: untracked pid 1120 exited
[ 54.283905] max17040 4-0036: online = 1 vcell = 3788750 soc = 48 status = 3 health = 1 temp = 350 charger status = 0
[ 61.938812] request_suspend_state: sleep (0->3) at 61924468996 (2012-05-13 00:26:10.253540041 UTC)
[ 61.959869] dhd_set_suspend: force extra Suspend setting
first. The device checks if it's too hot or too cold to boot via IROM software (internal read only memory). After that it begins initialization. The IROM version is displayed. Then the device type..
The OMAP processor in the Galaxy Nexus is a HS (High Security) processor, as opposed to GP (General Purpose) processor. This means the first bootloader (AKA MLO or X-Loader) is a signed binary which is e-fused to the device.
I've seen in the past on similar Hummingbird processors that only the first 1K is checked for speed because hashing it takes a little bit of time. This may or may not be the case with this particular device. We will see.
Anyway.. There's a possiblity we can find an MLO which is already presigned somewhere on the Internet. We need whatever they use at Samsung which provides the initial firmware load to a device without any firmware on it.
Here is a relevant page: http://omapedia.org/wiki/Bootloader_Project
Code:
If you are using an HS (High Security) OMAP device, an extra step is required. First, build x-load.bin using the steps above. Then, download the MShield signing tool and use the commands below. Contact your TI representative to get access to this tool.
In order to get the firmware onto the device in the first place, this bootloader must exist. We need a copy of it. Once we have this bootloader, we can revive Galaxy Nexus devices.

You may have seen this already, but just in case - this seems to be a bootloader of some kind. I couldn't get it to work with my bricked SGN, but it may be of some use to the unbricking effort.
Can't post link, so search for "Unbrick dead Samsung GT-i9250 Galaxy Nexus 32GB".
Best of luck!

The user above is referring to this link, I think:
http://forum.xda-developers.com/showthread.php?t=1640443
The user there shares a .zip file that supposedly is able to unbrick a 32gb GNex using some samsung software. It calls OMAPFlash.exe with a bunch of parameters. I don't know whether it will be useful or not, but it's a start.

The batch file that the post above ^ asks the users to run is this:
Code:
::::
:: Copyright (C) 2010-2011, Samsung Electronics, Co., Ltd. All Rights Reserved.
:: Written by System S/W Group, S/W Platform R&D Team,
:: Mobile Communication Division.
::::
::::
:: Project Name : Proxima GED
::
:: Project Description :
::
:: Comments : tabstop = 8, shiftwidth = 8, noexpandtab
::::
::::
:: File Name : omap4460_tuna_hs.bat
::
:: File Description :
::
:: Author : System Platform 2
:: Dept : System S/W Group (S/W Platform R&D Team)
:: Created : 17/Aug/2011
:: Version : Baby-Raccoon
::::
:__loop
@OMAPFlash.exe -v @Targets\Projects\tuna\omap4460_tuna_hs_pro.txt
@PAUSE
GOTO __loop
Seeing the text file path, I went and looked. Here's what I found:
Code:
##
# Copyright (C) 2010-2011, Samsung Electronics, Co., Ltd. All Rights Reserved.
# Written by System S/W Group, S/W Platform R&D Team,
# Mobile Communication Division.
##
##
# Project Name : Proxima GED
#
# Project Description :
#
# Comments : tabstop = 8, shiftwidth = 8, noexpandtab
##
##
# File Name : omap4460_tuna_hs.txt
#
# File Description :
#
# Author : System Platform 2
# Dept : System S/W Group (S/W Platform R&D Team)
# Created : 17/Aug/2011
# Version : Baby-Raccoon
##
-omap 4
-t 36000 -p OMAP4460_TUNA_8G_HS_PRO -2
#chip_download [email protected] Targets\Projects\tuna\MBR.bin
chip_download [email protected] Targets\Projects\tuna\MLO_4460_HS_PRO
chip_download [email protected] Targets\Projects\tuna\sbl.img
command cold_sw_reset
So it appears that the software writes the files MLO_4460_HS_PRO and sbl.img to different parts of the internal memory.

Any success for the device driver? In the documents above, they say you should use the FTDI VCP (Virtual COM Port) drivers... But included in the package above, there is a driver in the ../usb_drv_windows directory, for exactly the TI driver you mentioned:
Code:
%USB_OMAP4460% = USB_Install, USB\VID_0451&PID_d010
For lazy reference:
Code:
[SIZE=2]-- Usage --
OMAPFlash Host is a command-line based application. It is currently available
for Windows XP only and will run in a Windows command shell. The application can
take commands directly from the command line or via a script file (a more useful
approach). The syntax for calling the tool is:
[B]omapflash [ <option> ] <command>[/B]
or, if a script file is used: omapflash @<file>
-- Options --
The tool has a number of options that can be used to control its overall
behavior.
[B]-com <port number> [/B]By default OMAPFlash will try to communicate with the
target platform using a USB serial link. This option will force OMAPFlash to
use a UART for serial communication and specify the host side COM-port to use.
-t <timeout> By default the timeout for communication on the serial link is 5
seconds. This option allows control of the timeout value by specifying another
timeout value in seconds.
[B]-p <platform>[/B] This option is required by OMAPFlash and specifies the platform
for which the download is to take place. The platform specified is a name tag
that allows OMAPFlash to identify the correct second loader to use. The tag
typically identifies the platform type and the memory used with the OMAP
device present on the platform (“e.g. SDP_MDDR_HYNIX_4G). The tag is used to
look up the second loader in a configuration file (omapflash2nd.txt) in
combination with an OMAP device identifier received from the platform during
peripheral boot.
[B]-omap <version> [/B]This option is required by OMAPFlash if a peripheral boot
sequence is used to transfer a second loader to a target platform. The option
specifies the OMAP generation used on the platform – without this option set,
OMAPFlash will be unable to determine how to correctly perform the peripheral
boot sequence necessary for transfer of the second loader to the platform. The
version number is a single digit integer (e.g. ‘3’ for an OMAP3xxx based
platform or ‘4’ for an OMAP4xxx based platform).
[B]-2[/B] This option controls whether OMAPFlash will try to use the ROM code
peripheral boot sequence to transfer a second loader to internal RAM before
doing anything else. This option will be required for most scenarios where
OMAPFlash is used but can be left out if OMAPFlash Host is interacting with a
second loader already running on a target platform.
[B]-v[/B] The ‘-v’ option controls whether OMAPFlash Host will run in verbose mode.
If set, more information will be shown during the execution of the flashing
sequence. Note that this option should be set in order to see the target
platform response to certain commands (e.g. ‘chips’).
-- Commands --
Commands are executed on the target platform. Any command is prefixed by the
keyword ‘command’ and anything following this keyword will be passed directly to
OMAPFlash Second by OMAPFlash Host without interpretation or modification.
Typically the ‘verbose’ option should be used with commands in order to ensure
that information returned from the platform will be shown on the console.
branch <device> <offset>
This command will cause OMAPFlash Second to make an
unconditional branch to a memory mapped address. The device will typically be
the SDRAM handled by the OMAP SDRAM controller in this case, and the offset
typically zero. The device ID must be one known by OMAPFlash Second and the
offset an integer within the address offset range valid for the device.
peek32 <address> Get the register value of the register with the given
address.
poke32 <address> <value> Modify the register at the given address to the given
value
peekpoke32 <address> <value> <mask> Modify the register at the given address
with the given value and mask
-- Flashing --
OMAPFlash Host is able to handle three basic procedures for accessing memory
devices through the OMAPFlash Second loader. These procedures are used to erase
memory devices, transfer a binary file to a device or upload the device content
to a binary file. In all cases, parameter values specifying sizes or offsets are
hexadecimal.
[B]chip_erase <device>[@offset] <size> [/B]
This procedure is used to erase the
content of a device, either for the whole device or for part of its address
range. The ‘device’ identifier is a string matching one of the devices
available on the platform as listed from the ‘chips’ command – in other words,
a device known to OMAPFlash Second for the particular platform used (SDRAM is
not a valid choice). If an ‘offset’ is used, the device erasure will start at
the offset specified. The offset will need to be compatible with the memory
structure of the device in question – e.g. if the device has a block size of
40000h bytes, the offset will need to be a multiple of the block size. The
‘size’ specifies the number of bytes to erase – a value of zero has the
special meaning of “to the end of the device”, either starting at offset zero
or at the specified ‘offset’ value, and can be used to erase the entire
device. Note that the typical erase functionality of a memory device is based
on the erasure of blocks of memory – it may not make sense to ask for erasure
of a size that is not a multiple of the block size of the device.
[B]chip_download <device>[@offset] <file> [/B]
In order to transfer a binary file to a
device on the platform this procedure is used. The ‘device’ identifier is a
string matching one of the devices available on the platform. If an ‘offset’
is specified the binary will be downloaded to the device starting at the
offset address specified. Using an offset should be done with some caution,
since the meaning of the offset value may be unclear for some device types
(e.g. for a NAND device the offset will be used without consideration of bad
blocks present in the memory space preceding the offset address). The file to
be downloaded is specified by the ‘file’ parameter and must be a raw image.
[B]chip_upload <device>[@offset] <size> <file> [/B]
In order to upload the content of
a memory device this procedure is used. The ‘device’ identifier is a string
matching one of the devices available on the platform. If an ‘offset’ is
specified content will be uploaded from the device starting at the offset
address specified. As for the ‘chip_download’ procedure the use of an offset
should be done with caution. The ‘size’ parameter specifies the number of
bytes to upload and the ‘file’ parameter the file to which the uploaded data
will be saved. Note that due to some limitations on the serial link, upload of
data will be considerably slower than download.
[/SIZE]

First things first. I recieved a PM from user itsalllgood with information regarding this topic. Here's the whole PM, copied and pasted:
itsalllgood said:
Dear fred,
Sorry to bother you...I wanted to post here but iam not allowed.. I am a computer engineer from montreal current living abroad..I had gnex that died and did a lot of work to try to get it back..to summ it all the omapidia project add TI site will get the full picture. the tool you linked is based on TI 1.6 omap flash.. i will keep it short... the link below will summ my work and please copy past it if you think its worth it..thanks in advance..
http://forum.xda-developers.com/showthread.php?p=26334564&posted=1#post26334564
Click to expand...
Click to collapse

^^ Somehow your link got messed up, but I think its this one.

Is it possible to hardware prevent a device like Samsung Galaxy S2 to go fastboot / odin mode when powering on but still be able to load the operating system?
Because even although I have a password set on the device, if it is stolen anyone can connect it to fastboot with power+voldown+menu and restore it to defaults. For example filling that corresponding partition with zeros will prevent from entering odin mode unless you boot into the operating system and with dd restore the partition.

First of all, that's off-topic. But I'll provide a speculative answer nonetheless.
I would think that you would be able to prevent a device from reaching recovery/fastboot/odin-download-mode, but it would have a big disadvantage, which is that if you are not able to boot into the OS somehow, you would have an unusable device. Although a device like the Galaxy Nexus, if stolen, could have its data retrieved by potentially using Odin and/or fastboot to reset the password, removing these failsafes would mean that you have a higher chance of bricking. Besides, that's what remote wipe apps (and other stolen-phone tools) are for. Check out Avast! if you don't have an antivirus/stolen-phone toolkit.
I'm by no means an expert here, but that's just my two cents.
EDIT: By the way, could we have someone (like AdamOutler) look at what we've got in this thread so far to see if the MLO file that we found is what's needed (as mentioned by Adam in the first couple posts)?

It's just that I don't either know the exact boot sequence of the SGS2 GT-I9100 nor the partitions interdependence (for example say that the boot partition needs the recovery or the sbl), I coudn't zero that partition because is a dependence.
What I woukd like to know if is possible:
- Backup all partitions.
- Zero, from android with dd, all partitions that allow anyone to enter odin/fastboot/clockworkmod/recovery so, if I lose the device, no one can make a odin backup or reset my device, unless you restore the partitions from the android or you use a hardware JTAG.
- Even the previous done, the phone must be able to normal boot into operating system.

I have a gut feeling that that's not possible. For recovery/odin modes, it may be possible due to them not really being directly involved in the boot process. However, for fastboot, I think it's part of the bootloader itself and therefore cannot be disabled using simple commands without also disabling the phone's booting process. For example, if you have the proper drivers installed on your computer, a Galaxy Nexus that's booting into Android will show up the same device as if you're connected via Fastboot. Unless someone can alter the source and recompile a bootloader with disabled fastboot, I don't think what you stated above is completely possible.

FredFS456 said:
I have a gut feeling that that's not possible. For recovery/odin modes, it may be possible due to them not really being directly involved in the boot process. However, for fastboot, I think it's part of the bootloader itself and therefore cannot be disabled using simple commands without also disabling the phone's booting process. For example, if you have the proper drivers installed on your computer, a Galaxy Nexus that's booting into Android will show up the same device as if you're connected via Fastboot. Unless someone can alter the source and recompile a bootloader with disabled fastboot, I don't think what you stated above is completely possible.
Click to expand...
Click to collapse
I think what I need could be done with a locked bootloader. As far as I know, the Samsung Galaxy S2 comes with an unlocked bootloader (causing the security flaw) while other like Samsung Galaxy Nexus come with a locked one: that means on stock devices, with use pattern or password and usb debugging disabled, there is no way someway can access you data even if not encryption is set.
Anyone can clarify things on this?

Bump, and back on topic.
Any developments here?

Yes. http://forum.xda-developers.com/showthread.php?t=1640443
it's done.

AdamOutler said:
Yes. http://forum.xda-developers.com/showthread.php?t=1640443
it's done.
Click to expand...
Click to collapse
Does anyone know HOW it's done??
EDIT: Actually the accompanying documentation explains quite well!
@Adam: Do you think we could tweak these drivers etc. for other devices not using OMAP?
(It seem that many protocols are standard, inducing the serial (UART) over USB FTDI-drivers...)

E:V:A said:
Does anyone know HOW it's done??
EDIT: Actually the accompanying documentation explains quite well!
@Adam: Do you think we could tweak these drivers etc. for other devices not using OMAP?
(It seem that many protocols are standard, inducing the serial (UART) over USB FTDI-drivers...)
Click to expand...
Click to collapse
It works just like UBM... but stock.
No. I dont think we can do that. Its an omap tool that requires bootmodes to be proper to work on omap. It can be applied to other properly configured omap devices.

[dev][kernel][kexec]

Last Update : August, 19, 2014
Hi,
I'm still try to bypass the MMU protection.
I have fixe a lot of bug, like memory misalignment, bad adresses allocation, dtb correction, etc...
Last sources and binaries here :
kexec-tools V11.zip : http://forum.xda-developers.com/attachment.php?attachmentid=2902912&stc=1&d=1408401794
kexec-tools binaries V11.zip : http://forum.xda-developers.com/attachment.php?attachmentid=2902913&stc=1&d=1408401794
Sorry, i have always 13 sec reboot after new kernel boot.
"cpu_proc_fin" use a "mcr p15" to init cache and proc that cause freeze.
I try to find solution for that.
Last Update : June, 22, 2014
Hi,
My sources are horrible... but i give something new.
This kexec is for stock kernel only (tested on .757). I thinks theses sources work on other kernel too.
In "kexec-tools V10.zip", you have all my sources. It's highly recommended to mod them to have something OK.
In "kexec binaries.zip", you have binaries to install
=> "kexec_load.ko" and "procfs_rw.ko" must be placed in "/system/lib/modules" folder with "chmod 777"
=> "kexec" must be placed in /system/bin" folder with "chmod 777"
=> cd /system/lib/modules
=> insmod kexec_load.ko
For sources :
Mod and adapt all you want, it's free.
You have 2 scripts in Zip : "./compil-kexec" in "kexec-tools" folder to rebuild and send in device directly (install Adbtcp on device and send by tcp with : adb connect xxx.xxx.xxx.xxx) = work perfectly with me.
"scriptZ1" is for compil stock kernel or another kernel (doomlord kernel for eg)
You must rename "custom_final_files" folder after compil to "final_file" manually ; You can have guest kernel in "custom_final_files" and stock kernel in "final_files" for "kexec-tools" path ... Don't mix a guest and host kernel please ^^
I am tired... i let you test and say if it's ok for you...
Thank a lot to munjeni for his help.
kexec-tools V10.zip : http://forum.xda-developers.com/attachment.php?attachmentid=2811994&stc=1&d=1403456181
kexec binaries.zip : http://forum.xda-developers.com/attachment.php?attachmentid=2811995&stc=1&d=1403456181
Last Update : November, 23, 2013
Hi,
For few days now, i haven't no more kernel panic with my kexec.
I have fixed few stuffs into sources, and add a lot.
These adds are, to include a "dt.img" image file into kexec load process.
This image file is a "device_tree" image to match hardware to software.
So, i assume to don't include atags into boot process, but pass bootloader informations by this DT.
I have programmed a little scan memory to found dynamicly all magic tags, because i found 3 device_tree into memory (magic is "0xd00dfeed").
These 2 device_tree are echo from first and nice structure.
The boot process need to have informations from this DT, and need all informations to initialize hardware (no HDW initialisation by the kernel)
I must first fix issues ; Regroup zImage and dt.img into memory to load a solid bloc to kexec_load module to boot into, and second, fix an offset i can't explain, 0x800 in memory causing misalignment memory
Keep tuned..
Last Update : November, 17, 2013
Hi everybody,
My kexec-tools work for Sony Xperia Z1 stock kernel "3.4.0-perf"
This tools can work on all locked bootloader for all locked device, not only Sony or Z1 models.
This kexec-tools add a kexec_load kernel module (LKM) and use a driver to grant a communication between "kexec" user program and kexec_load.ko module
what is for ?
"kexec" user program load in memory a custom kernel in zImage format, but can load ".tar" image too
This user tool load ramdisk in memory if necessary
This tool is for this purpose only, and don't keep in memory the custom kernel at device reboot.
It is a "user" program, not a "kernel" extension... So, to really do the magic, we need the host kernel (stock sony locked kernel) have a kexec_load capability to reboot in a new gest kernel (custom kernel).
Infortuntly, stock kernel don't have kexec_load capability.
Sony have compiled his stock kernel without this option, and "standard" kexec-tools "need" this option to work.
To see all system call capability of kernel, you can run theses command :
Code:
echo 0 > /proc/sys/kernel/dmesg_restrict
echo 0 > /proc/sys/kernel/kptr_restrict
cat /proc/kallsyms
Do all grep you want here.
The "echo 0" "restrict" is here to unmask logical adresses to "system calls"
Like you can see, "__NR_kexec_load" capability isn't here.
To add kexec_load capability in stock locked kernel, we need to add manualy a kernel module wich add this function into the kernel.
Why ? Because the way to keep in memory a custom kernel need to know a lot of parameters, and keep a specific memory range alive at reboot.
Only kernel can do this.
All user program will be terminated at reboot.
"Standard" kexec_load.ko module use a method to implement the "__NR_kexec_load" function in system call table.
Since 2.6.0 kernel, linux for security reason, have locked in memory the "system_call_table" ; No more add or modification is authorized.
If kexec tool try to add a value, "kexec_load" for us, we causes a kernel panic, and reboot device.
For this reason, i have modify kexec user program and kexec_load module to implement a driver to talk to each other.
this driver replace syscall method, and we no more need to use a system call table.
For this reason, this tool is now compatible with modern kernel like our "3.4.0"
For this reason, this tool must work for other device (Xperia X, P, S, etc...) and another brand
For this reason, if kernel is locked, we can bootstrap to run a new kernel.
Installation
First, you can compil your own kexec tool
Here, sources : http://forum.xda-developers.com/attachment.php?attachmentid=2397299&stc=1&d=1384689174
And here, the binaries : http://forum.xda-developers.com/attachment.php?attachmentid=2397305&stc=1&d=1384689406
(it's not a cwm zip, i have no time to create an installer for now ; use "./compil-kexec" if you want an automatic install)
Install *.ko in /system/lib/modules
Install kexec and kdump in /system/bin
Grant with "chmod 777"
Unzip in kexec-tools folder
Install a toolchain (sudo apt-get install gcc-arm-linux-gnueabi)
launch => ./compil-kexec
what's all
This script can do everythinks for you
- Compilation of tools
- Compilation of modules
- installation in device
This script can compil for every brand you have.
Except you must remove or adapt the patch (see below why)
Patch ??
This patch is because a module must be compiled in the same time the kernel himself.
For this reason a "vermagic", an identifier, is used by system to block every module not compil with kernel
Some custom kernel bypass this to authorize every modules.
But for stock kernel, it is not allowed.
You can easely strapp this by busybox.
"busybox modprobe" for help
"-f" to force load without vermagic
To see this vermagic :
Code:
# uname -r
This "uname -r" must be the same that
Code:
# strings kexec_load.ko | grep vermagic
vermagic=3.4.0-perf-g66807d4-02450-g9a218f1 SMP preempt mod_unload modversions ARMv7
If you want use automaticaly this vermagic, you can modify into the custom kernel this file :
Code:
"include/config/kernel.release" and add :
"3.4.0-perf-g66807d4-02450-g9a218f1"
This file will be use at module compil to match the vermagic.
Infortunatly, it is not enought. :silly:
The infamous "no symbol version for module_layout"
When a module compil is created, it use symbols link to system call function, translate by adresses
Theses symbols are not at same physical adresses in stock kernel and modules (compiled from DooMLoRD kernel).
So, theses adresses must be convert into modules itself to match with stock symbols adress.
A patch is needed.
If you use my script, modules are automatically patched.
Here patches :
Code:
sed -i 's/\x32\x76\x86\x29/\x72\xFF\x5E\x20/' procfs_rw.ko
sed -i 's/\x32\x76\x86\x29/\x72\xFF\x5E\x20/' kexec_load.ko
sed -i 's/\xBB\xD0\xF8\x4D/\x0E\x1C\x63\x77/' kexec_load.ko
sed -i 's/\xA6\x26\x81\x1A/\xD4\x56\x02\x7E/' kexec_load.ko
sed -i 's/\xA3\xD1\xEC\x96/\xEC\x43\x28\x1A/' kexec_load.ko
sed -i 's/\x8C\xE6\x6A\x5F/\x3D\xDF\x02\xF2/' kexec_load.ko
sed -i 's/\x3E\xF3\xEF\xE9/\x18\x7F\xA6\x8A/' kexec_load.ko
sed -i 's/\x8B\xD2\x92\x10/\xC8\x19\x08\x9C/' kexec_load.ko
sed -i 's/\x1C\xE8\x18\xE1/\x7C\x71\x9E\xEF/' kexec_load.ko
sed -i 's/\xAB\x2C\x2F\x8B/\x8E\xD7\x63\xC0/' kexec_load.ko
sed -i 's/\xF5\x62\xAA\x4B/\x34\x80\x1B\x74/' kexec_load.ko
sed -i 's/\x00\x52\xD6\xD7/\x6F\x80\x91\x20/' kexec_load.ko
sed -i 's/\x4F\x77\x57\x6A/\x0C\x57\xC7\x63/' kexec_load.ko
sed -i 's/\xCA\x2F\x65\x71/\x92\xB8\x7F\x53/' kexec_load.ko
sed -i 's/\x0F\xD0\xA0\x91/\xFA\x80\x15\xB4/' kexec_load.ko
sed -i 's/\x29\xA0\x6D\x48/\x6C\x6B\x96\x54/' kexec_load.ko
sed -i 's/\x6D\x1F\x1F\x37/\xCC\x5E\x79\x8B/' kexec_load.ko
sed -i 's/\xFD\x23\xD0\xFB/\xE3\xE3\x68\x52/' kexec_load.ko
You can use hexedit or hexdump to see these adresses :
Code:
hexdump kexec_load.ko | grep ff72
0003d50 b0b0 80ac ff72 205e 6f6d 7564 656c 6c5f
how does it work ?
# kexec --help
For kexec help... nothing more to say.
# lsmod
List loaded modules... You must see
kexec_load 31369 0 - Live 0x00000000 (O)
# rmmod kexec_load.ko
Remove kexec_load module from memory.
# grep kexec /proc/device
To see installed driver.
You must see :
100 kexec_driver
First number is "major" number to identify your driver in system.
# mknod /dev/kexec_driver c 100 0
Install driver.
Major number (here 100), is important for module.
This Major must be the same between module and driver.
By default, 100 is used.
# insmod kexec_load.ko
To install "LKM", kexec_load kernel module.
If another Major is needed, you can use "insmod kexec_load.ko 101" for Major 101
You can use "modprob" if you want, but you must configure the module folder.
How kexec and module exchange informations ?
By the driver.
Normal output for a kernel module is to write in "dmsg" file.
To see kernel output, launch this command :
Code:
# dmesg
To see last kernel log, see in :
Code:
# cat /proc/last_kmsg
For kexec module, this normal way still exist, and give a lot of informations, but to speak with, you must use the driver.
/dev/kexec_driver
You can yourself test communication:
Code:
# cat /dev/kexec_driver
You can send kernel by this communication channel.
Type following commands for help
=> echo help >/dev/kexec_driver
=> dmesg | grep Kexec
Code:
# echo help >/dev/kexec_driver
# cat /dev/kexec_driver
Last command : 'help'
Please type following command :
=> dmesg|grep Kexec
Every command send into driver is receive by kexec_load.ko module and running into the kernel.
The answer can by read thru the driver
Here, you can see that normal way to see messages is allway dmesg.
Code:
# dmesg|grep Kexec
<4>[15050.521628] Kexec: Starting kexec_module...
<6>[15050.521656] Kexec: kexec_driver_contener allocation
<6>[15050.521673] Kexec: kexec_memory_buffer allocation
<4>[15050.521691] Kexec:----------------------------------------------------
<4>[15050.521710] Kexec: kexec_driver created with major : '100'
<4>[15050.521728] Kexec: Please, prepare by typing the following commands :
<4>[15050.521746] Kexec: => mknod /dev/kexec_driver c 100 0
<4>[15050.521761] Kexec: => cat /dev/kexec_driver
<4>[15050.521775] Kexec:-----------------------------------------------------
<4>[15050.521791] Kexec: For help
<4>[15050.521803] Kexec: => echo help >/dev/kexec_driver
(...)
I have add a lot of informations to help to configure kexec.
rdtags, atags ??
Not sure for this part of kernel.
"atags" is the most used method to bootloader to parse commands and informations to kernel at boot.
"atags" is a form of structure in memory to organise informations.
At boot, a address chain is created and can be compulse in /proc/atags file.
This file is read only system.
"rdtags" is another way to bootloader to parse information to kernel.
"rdtags" is not stocked in "/proc"
But, as i see, stock kernel can use "atags" from bootloader.
kexec can substitute bootloader function to create fromscratch a atags chain, and parse to new kernel.
I have change this part to stock atags in "/data/atags", and reuse or change if need.
If this don't work, i must create a rdtags chain to replace atags ; It's not a hard work.
Status
For the moment, kexec tools works.
=> Phase one OK.
I can start Phase Two : new kernel patch.
If you want to help me...
Actually, load a custom kernel and boot into with kexec tools work.
But at boot into, a kernel panic occurs.
It seems, a part of kexec patch is missing in custom kernel.

Hi new thread created for kernel kexec development.
Status: not working: wrong values for mem defines under the kernel is giving segmentation fault as its attempting to write to memory areas that are currently being used byyyyy the system
Instructions:
Make kernel compatible?:
1. Download kernel diff patch from below
2. Terminal - diff patch > diff.txt
How to use:
1. Download kexec-tools (kexec binary) from below
2. Copy into system/bin directory and give it executable permission
3. Download compatible kernel
4. Terminal - kexec --load-hardboot zImage --initrd=initrd.img --mem-min=0x20000000 --command-line="$(cat /proc/cmdline)"
kexec -e
Download links:
Kexec tool- https://db.tt/8DZXQ9eV
Ramdisk firmware 1.548 : https://db.tt/8DZXQ9eV
zImage (kernel):
Source code:
Kernel diff patch: https://db.tt/Xi2htT7Q (currently contains wrong values for mem defines)
Kexec-tools: https://db.tt/I22ofr3b
Special thanks: @delewer @krabappel2548

Reserved

Please move this thread to Xda Devdb, then I can also edit first post etc if I find new stuff
Sent from my C6903 using xda app-developers app

krabappel2548 said:
Please move this thread to Xda Devdb, then I can also edit first post etc if I find new stuff
Sent from my C6903 using xda app-developers app
Click to expand...
Click to collapse
Devdb?
Pm me i dont know what Devdb is lol

Recieved segmentation fault with delewers calculated mem values too
We need to write to memory where we have write access to, maybe lockedbootloader is not allowing us to write? Orrr we are just writing to wrong area of memory

If kexec works on the Z1, can it be ported over to Xperia Z/ZL/T/Ultra? I believe they don't all share the same processor.

Shaky156 said:
Devdb?
Pm me i dont know what Devdb is lol
Click to expand...
Click to collapse
Shaky156 said:
Recieved segmentation fault with delewers calculated mem values too
We need to write to memory where we have write access to, maybe lockedbootloader is not allowing us to write? Orrr we are just writing to wrong area of memory
Click to expand...
Click to collapse
I'll discuss with Kali- today if he's available.
Knucklessg1 said:
If kexec works on the Z1, can it be ported over to Xperia Z/ZL/T/Ultra? I believe they don't all share the same processor.
Click to expand...
Click to collapse
Doesn't need to be same processor, can be ported
Sent from my C6903 using xda app-developers app

Knucklessg1 said:
If kexec works on the Z1, can it be ported over to Xperia Z/ZL/T/Ultra? I believe they don't all share the same processor.
Click to expand...
Click to collapse
Yes it wont matter much, since its not s800 it should be easier for you guys , take the kexec-tool use that, implement the patch write to the correct mem addresses which is free, it should boot if you guys have issues let me know,
I need to calculate the correct addresses.
Ive noticed s800 uses a dt.img, might need to modify kexec-tool to support dt.img, not sure what dt.img does yet, only know it holds values

Shaky156 said:
I need to calculate the correct addresses.
Ive noticed s800 uses a dt.img, might need to modify kexec-tool to support dt.img, not sure what dt.img does yet, only know it holds values
Click to expand...
Click to collapse
the dt.img is needed by the kernel to boot, so I guess we need to load that too in kexec.
EDIT: people that wanna try add kexec patch to their kernel, check github: android_kernel_sony_msm8974/commits/kexec

krabappel2548, i have compil your kernel by my script (fromscratch)
My script (instruction in "DoomLord Build kernel thread" : scriptZ1 http://forum.xda-developers.com/attachment.php?attachmentid=2346163&d=1382568778
(for thoses who want to help us...)
You have a little mod to do here (bad compil) :
In "sound/soc/msm/qdsp6v2/rtac.c"
you must change
#include <q6voice.h>
by
#include "q6voice.h"
btw : no more ideas to load kexec for the moment ...

delewer said:
krabappel2548, i have compil your kernel by my script (fromscratch)
My script (instruction in "DoomLord Build kernel thread" : scriptZ1 http://forum.xda-developers.com/attachment.php?attachmentid=2346163&d=1382568778
(for thoses who want to help us...)
You have a little mod to do here (bad compil) :
In "sound/soc/msm/qdsp6v2/rtac.c"
you must change
#include <q6voice.h>
by
#include "q6voice.h"
btw : no more ideas to load kexec for the moment ...
Click to expand...
Click to collapse
Sorry, I'm trying to get caught up on the forum, but what seems to be the current standing issue to get kexec working?

Knucklessg1 said:
Sorry, I'm trying to get caught up on the forum, but what seems to be the current standing issue to get kexec working?
Click to expand...
Click to collapse
Read the OP
Status paragraph

Memory regions
00000000-07afffff : System RAM
00008000-00b79383 : Kernel code
00d04000-00f0cddb : Kernel data
0ff00000-779fffff : System RAM
7ff00000-7ff3ffff : rdtags_mem
7ff80000-7ffa0fff : last_kmsg
7ffa1000-7ffa5fff : last_amsslog
System RAM MEM = 00000000
So --min-mem=0x20000000
Now need to find a free memory area thatll allow us to write and hopefully the mmu/pmu on locked bootloader wont cancel it
@delewer? @DooMLoRD @kali @Bin4ry

I know I shouldn't disturb, but i must ask: if You achieve Your goal, would it be possible to port it to devices like Xperia P, S, T, U and other NXT? It would be great, many ppl are ready to give a prize for it. Thanks in advance, good luck and sorry again.
Sent from my LT22i using xda app-developers app

king960 said:
I know I shouldn't disturb, but i must ask: if You achieve Your goal, would it be possible to port it to devices like Xperia P, S, T, U and other NXT? It would be great, many ppl are ready to give a prize for it. Thanks in advance, good luck and sorry again.
Sent from my LT22i using xda app-developers app
Click to expand...
Click to collapse
These devices are not 2013 devices, they arent s800 socs, so they are much easier to do, simply take the kexec-tools from op, implement the patch in your kernel, write the correct memory values for your specific device and execute in terminal via the command in op, minmem depends on your device too, good luck

I think some1 tried it already, but it works only for unlocked devices... Anyway, thanks for help.
Sent from my LT22i using xda app-developers app

king960 said:
I know I shouldn't disturb, but i must ask: if You achieve Your goal, would it be possible to port it to devices like Xperia P, S, T, U and other NXT? It would be great, many ppl are ready to give a prize for it. Thanks in advance, good luck and sorry again.
Sent from my LT22i using xda app-developers app
Click to expand...
Click to collapse
Does doing this require having an Unlocked Boot loader prior to implementation?
Sent from my C6603 using xda app-developers app

A few informations about kexec-tools debug
in kexec.c
Fonction :
if (file_type.load(argc, argv, kernel_buf,
kernel_size, &info) < 0) {
fprintf(stderr, "Cannot load %s\n", kernel);
return -1;
}
With a forced execution of kexec (bypass error to see...)
--mem-min=0x90000000
kernel: 0xb6b9d008 kernel_size: 3e9340
debug: 1 - after get memory range
debug: 2 - after type test
debug: 3 - after type test
debug: 4 - after info.kexec
debug: Focus 1 - argc '5' ; argv 'be856774' ; kernel_buf 'b6b9d008' ; kernel_size '3e9340' ; info 'be856548' ; i '1' ; file_type.name 'zImage'
Could not find a free area of memory of 3f1340 bytes...
Cannot load zImage
debug: 10 - before trampoline
debug: 11 - after trampoline
debug: 12 - before segment load
debug: 13 - after segment load
debug: 8 - before sort_segment
debug: 9 - after sort_segment
debug: 6 - before purgatory
debug: 7 - after purgatory
kexec_load: entry = (nil) flags = 280004
nr_segments = 0
kexec_load failed: Function not implemented
entry = (nil) flags = 280004
nr_segments = 0
debug: 5 - return result : ffffffff
With a forced bypass on file_type.load , we have this :
--mem-min=0x20000000
debug: Focus 1 - argc '5' ; argv 'bef18774' ; kernel_buf 'b6bc7008' ; kernel_size '3e9340' ; info 'bef18548' ; i '1' ; file_type.name 'zImage'
Segmentation fault

delewer said:
A few informations about kexec-tools debug
in kexec.c
Fonction :
if (file_type.load(argc, argv, kernel_buf,
kernel_size, &info) < 0) {
fprintf(stderr, "Cannot load %s\n", kernel);
return -1;
}
With a forced execution of kexec (bypass error to see...)
--mem-min=0x90000000
kernel: 0xb6b9d008 kernel_size: 3e9340
debug: 1 - after get memory range
debug: 2 - after type test
debug: 3 - after type test
debug: 4 - after info.kexec
debug: Focus 1 - argc '5' ; argv 'be856774' ; kernel_buf 'b6b9d008' ; kernel_size '3e9340' ; info 'be856548' ; i '1' ; file_type.name 'zImage'
Could not find a free area of memory of 3f1340 bytes...
Cannot load zImage
debug: 10 - before trampoline
debug: 11 - after trampoline
debug: 12 - before segment load
debug: 13 - after segment load
debug: 8 - before sort_segment
debug: 9 - after sort_segment
debug: 6 - before purgatory
debug: 7 - after purgatory
kexec_load: entry = (nil) flags = 280004
nr_segments = 0
kexec_load failed: Function not implemented
entry = (nil) flags = 280004
nr_segments = 0
debug: 5 - return result : ffffffff
With a forced bypass on file_type.load , we have this :
--mem-min=0x20000000
debug: Focus 1 - argc '5' ; argv 'bef18774' ; kernel_buf 'b6bc7008' ; kernel_size '3e9340' ; info 'bef18548' ; i '1' ; file_type.name 'zImage'
Segmentation fault
Click to expand...
Click to collapse
Did you compile this kexec yourself? Or did you get this from krapabbel? I issued krapabbel to compile a new debug version have gave him the code but never heard back from him :/
Anywayz so cannot find free memory is the issue

Kernel panic

Need help i'm having the boot loop with KitKat kernels .I told about this issue to Sultan XDA ..and he replied as
Tell those kernel devs to fix their keypad driver:
[ 109.012786] Unable to handle kernel NULL pointer dereference at virtual address 0000001c
[ 109.012969] pgd = d5f14000
[ 109.013061] [0000001c] *pgd=5594e831, *pte=00000000, *ppte=00000000
[ 109.013458] Internal error: Oops: 17 [#1] PREEMPT SMP
[ 109.013580] Modules linked in: dhd vibrator frandom
[ 109.013977] CPU: 1 Not tainted (3.0.101-stock++ #1)
[ 109.014099] PC is at sec_keypad_enable_show+0x10/0x24.
[ 109.014282] LR is at dev_attr_show+0x1c/0x48...so find my problem here: http://forum.xda-developers.com/gal...t-4-3-roms-t2999362/post58093351#post58093351
I askes for a fix and he replied :
Your keypad hardware is slow to initialize at boot:
[ * *1.250640] [TKEY] get_touchkey_firmware F/W version: 0x0, Module version:0x0
[ * *1.250762] f/w read fail retry 6
[ * *1.250946] EXT_I2C No ACK
So some of the data structs in the keypad driver remain in a null state until keypad probe can complete. Some of that data is accessed before keypad probe on your specific device can finish (so it is dereferencing null data), thus crashing the kernel. It's being caused by the keypad-disabler feature, which my kernel does not have. Sorry, but I'm not really interested in fixing other people's kernels, so I can't help you with that........ Can any devs fix this for me plzz!!

[DEV] Building a custom kernel and kernel modules for stock kernel

Since fire phone doesn't have a bootloader unlock at the moment. There is no point in building a custom kernel. But By building a kernel we can build kernel modules which work on the stock kernel. And yes you can load unsigned kernel modules without a problem since fire phone doesn't use tz apps to verify kernel modules like Samsung does.
Setup
Source
Download the fire phone sources for firmware 4.6.1 from here. And extract the platfrom.tar inside the archive to somewhere(KERNEL_DIR).
toolchain
You can use the android ndk from google, But it requires some setup. I'm using linaro toolchain from here. You can use compiler version 4.7, 4.8 or 4.9. Kernel I'm using (Firmware 4.6.3 - Linux 3.4-perf-g280c96c) is built with gcc-4.7. But I'm using this gcc-4.9. Download it, extract is somewhere(TOOLCHAIN_DIR) and add the $TOOLCHAIN_DIR/bin to your PATH. Theoretically you would be able to build the kernel on windows using Cygwin or MSYS tools but using Linux is better.
config
Connect your phone trough adb and run
Code:
adb pull /proc/config.gz
zcat config.gz > $KERNEL_DIR/kernel/qcom/3.4/.config
With this config you will run into some problems because of a missing "trapz_generated_kernel.h". I don't know if this is an auto generated file when they build android as a whole or amazon removed this explicitly(can they do that without violating GPL?). Anyway It looks trapz is some low level kernel debugging function(comment here if you know more about it). We can safely disable it. Open $KERNEL_DIR/kernel/qcom/3.4/.config in a text editor and change the lines
Code:
CONFIG_TRAPZ=y
CONFIG_TRAPZ_TP=y
CONFIG_TRAPZ_TRIGGER=y
CONFIG_HAVOK=y
to
Code:
#CONFIG_TRAPZ=y
#CONFIG_TRAPZ_TP=y
#CONFIG_TRAPZ_TRIGGER=y
#CONFIG_HAVOK=y
building
Now edit the $KERNEL_DIR/kernel/qcom/3.4/Makefile and add this changes
Code:
EXTRAVERSION = -perf-g280c96c
This is at the top of the makefile. If we don't add this, vermagic for the modules will differ from stock kernel and they won't load.
ARCH=arm
CROSS_COMPILE=arm-linux-gnueabihf-
Click to expand...
Click to collapse
Here arm-linux-gnueabihf- is my cross compiler frefix. Look in $TOOLCHAIN_DIR/bin/ to find it.
Now cd into $KERNEL_DIR/kernel/qcom/3.4/ and do
Code:
make
The build will fail a few times complaining about missing headers. Most of the time it's just
Code:
#include <myheader.h>
instead of
Code:
#include "myheader.h"
Edit the source file where the build fails and change <>s to ""s. (maybe android ndk ignores the difference and include the headers anyway)
After kernel compiles, we are good to go. We can use this kernel sources to build kernel modules for stock kernel.
Kernel modules
To build the kernel modules, we basically need two things. An approximate kernel source and the Module.symvers file from the original kernel. We can get the Module.symvers file by building the complete kernel as explained above or Just extract it from our stock kernel.
To extract the Module.symvers from the stock kernel, extract the boot.img file from firmware update image. Get mkbootimg tools from here compile it and run
Code:
unmkbootimg --kernel zImage ---ramdisk ramdisk.cpio.gz -i boot.img
After you get the zImage. Download extract-symvers script from here and run
Code:
python2 extract-symvers.py -B 0xc0008000 zImage > Module.symvers
place this file in $KERNEL_DIR/kernel/qcom/3.4/ (You still have to do the changes mentioned above in kernel config and building section run make in the $KERNEL_DIR/kernel/qcom/3.4 and intrupt it after few seconds)
Now you can build loadable modules against this source. Here is a hello world kernel module.
Code:
//hello.c
#include<linux/module.h>
#include<linux/kernel.h>
#include<linux/init.h>
static int __init hello_start(void)
{
printk("hello to the world from module");
return 0;
}
static void __exit hello_end(void)
{
printk("heloo exit");
}
module_init(hello_start);
module_exit(hello_end);
Code:
#Makefile
KERNEL_DIR=<your kernel dir>/kernel/qcom/3.4
obj-m := hello.o
PWD := $(shell pwd)
default:
$(MAKE) ARCH=arm CROSS_COMPILE=armeb-linux-gnueabi- -C $(KERNEL_DIR) SUBDIRS=$(PWD) modules
Put this files in a folder and run make in it. Change the paths and cross compiler prefix according to your setup. and run make.
After the build push the hello.ko to the phone.
Code:
adb push hello.ko /sdcard/
adb shell
su
cd sdcard
insmod hello.ko
run dmesg and you'll see the message.
I'm currently trying to build kexec module from hashcode's sources and USB OTG modules.
I'm attaching a few thing helped me do this.

since they have released this version of the fire os they have to provide the source code
see
http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic
you have just shown that the source code they releases for the kernel does not match the one used to build the kernel. This means it is a clear violation of the gpl and amazon is in breach and can be sued.
on another note.
are the drivers for the nfc and camera compiled as a module or into the kernel?

They have yet to provide 4.6.3 and 4.6.4 kernel sources too.
I don't know exactly but in order for NFC and camera to work drivers are required and they are in fact compiled into the kernel.
The problem we currently have with NFC and camera is proprietary hal (hardware abstraction libraries) They are a part of Android and does not subject to GPL. Amazon changed the original android way how hal works and didn't release the sources!
by looking at the kernel drivers maybe we would be able to implement hal from scratch. But I don't see that intense dev support for fire phone. If you are up for it camera sources are at $KERNEL_DIR/kernel/qcom/3.4/drivers/media/platform/msm/camera_v2/

Major MAJOR respect for all of you making the Fire Phone even better!

@madushan1000
Could we do something like this to install a custom boot.img?
http://forum.xda-developers.com/optimus-l9/general/guide-install-custom-roms-locked-t3249828

I don't own this device but has anyone tried to see if kexec works?

spudowiar said:
I don't own this device but has anyone tried to see if kexec works?
Click to expand...
Click to collapse
Nope, I was working on it. But then I got a job. It will be sometime before I can start working on it again.

Could someone please provide the config extracted from /proc/config.gz?
I can't find this on CM11 rom for some reason.

Building the kernel now.
Some bugs are in the code and -Wall and gcc-wrapper.py escalate the warnings.
I wonder if those errors are there on purpose XD
helloworld.ko loaded successfully
I was able to execute kexec without anything. Just the binary.
Will keep you posted - this hacking might take a while to figure it all out.
I already have 3.4 kernel from the amazon sources.
I have the kexec userland program.
What is left is a loadable kexec kernel module (if that is possible at all).

removed

Okarin said:
Are we even sure those Amazon Kernel Sources are correct?
Those errors caught by the wrapper scripts are giving me the creeps.
Git the kexec_load.ko build.
Currently hands on insmod.
Phone doesn't do a reboot any longer:
insmod kexec_load.ko
init_module(0xb6e6c008, 408241, "") = -1 ENOENT (No such file or directory)
write(2, "insmod: init_module '/sdcard/kex"..., 79insmod: init_module '/sdcard/kexec_load.ko' failed (No such file or directory)
) = 79
munmap(0xb6e6c000, 409600) = 0
mprotect(0xb6f8c000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0xb6f8c000, 4096, PROT_READ) = 0
close(0) = 0
close(1) = 0
close(2) = 0
futex(0xb6f6cd74, FUTEX_WAKE_PRIVATE, 2147483647) = 0
munmap(0xb6f8c000, 4096) = 0
exit_group(-1) = ?
First goal is to get module loaded.
Goal reached:
kexec_load 27813 0 - Live 0x00000000 (O)
procfs_rw 12770 0 - Live 0x00000000 (O)
wlan 3793980 0 - Live 0x00000000 (O)
Shouldn't be functional at all..
I disabled some function calls just to get the module loaded.
The missing symbols are:
soft_restart
arch_kexec
machine_shutdown
And the version I use does some insane function hooking ..
More rework is needed.
[email protected]:/data/local # ./kexec /sdcard/vmlinux
kernel: 0xaf12d008 kernel_size: 7e1354c
unrecoverable error: could not scan "/proc/device-tree/": No such file or directory
<6>[ 97.681256] Kexec_load: Replacement... :
<6>[ 97.681344] kexec_load : my_syscall_table : c0106244
<6>[ 97.681405] kexec_load : kexec_load before replacement : c01b346c
<6>[ 97.681480] kexec_load : kexec_load after replacement : bf3a5650
<6>[ 97.681546] kexec_load : reboot before replacement : c01a83f0
<6>[ 97.681616] kexec_load : reboot after replacement : bf3a6348
<6>[ 97.681675] Kexec_load: End replacement... :
<6>[ 202.694691] Kexec: - Starting kexec_load...
<6>[ 202.694849] Kexec: - ---- kexec_load - result : '0'
It gets better:
255|[email protected]:/data/local # ./kexec --dtb=/sdcard/zImage-dtb /sdcard/vmlinux
kernel: 0xaf1b1008 kernel_size: 7e1354c
kexec-zImage-arm : dtb.img BEFORE CUT : Start : '0xae66f008' - Length : '0xb411e9' - End : '0xaf1b01f1'
Segmentation fault
More tomorrow.
Click to expand...
Click to collapse
Where are you getting your kexec module sources from? BTW try using the original amazon kernal binary the phone is shipped with (we are sure it works). Don't use the custom kernel for the kexec tests (We don't know the custom kernel actually works)

madushan1000 said:
Where are you getting your kexec module sources from? BTW try using the original amazon kernal binary the phone is shipped with (we are sure it works). Don't use the custom kernel for the kexec tests (We don't know the custom kernel actually works)
Click to expand...
Click to collapse
Here is the thread I used as a starting point.
I will put up my "fork" on github after I get permission to do that
The userland part build like a charm once I took the compiler you recommended.
The kernel-module was tricky because the whole thing is modded like hell.
To be able to load I had to comment out some hard coded addresses and the calls to unresolvable symbols.

removed

Okay the kernel gets loaded.
But
kexec -e shuts off the device.
strace doesn't help.
On the plus side:
Devices are shutdown
Look promising
I need a way to tail dmesg ...
Okay a lot of digging around and I found out that the reboot syscall doesn't work properly..
It doesn't look like it hits the kexec_module it looks more like it hits the actualy sys_reboot
Okay reboot syscall hits my reboot-hook.
But the softreboot doesn't work now.
Okay there is some kind of watchdog runnig which doesn't like my kexec.
I need to kill it - that should happen tomorrow.

removed

I hit the same wall when I tried to isolate the kexec code from the kernel itself to a module. I stopped working on it because I lacked the time. BTW the error you are facing now
<3>[ 80.580644] BUG: scheduling while atomic: kexec/4067/0x00000002
Click to expand...
Click to collapse
is because memory allocator is trying to switch threads while you are in a syscall. it's because of lines like this
image = kzalloc(sizeof(*image), GFP_KERNEL);
Click to expand...
Click to collapse
Try changing GFP_KERNEL to GFP_ATOMIC. Other than that, I have another suggestion. Try to get the kernel to run in a single core mode before running kexec code. This might simplify things. I don't know how to do this though.

madushan1000 said:
I hit the same wall when I tried to isolate the kexec code from the kernel itself to a module. I stopped working on it because I lacked the time. BTW the error you are facing now
is because memory allocator is trying to switch threads while you are in a syscall. it's because of lines like this
Try changing GFP_KERNEL to GFP_ATOMIC. Other than that, I have another suggestion. Try to get the kernel to run in a single core mode before running kexec code. This might simplify things. I don't know how to do this though.
Click to expand...
Click to collapse
The atmic error is gone now. It went away after I disabled the watchtog.
smp_disable() is what you are looking for - but this causes the system to hard_reboot ATM XD

what happens if you kill every userlevel program before smp_disable()?

removed

#define tomorrow
Okay .. I worked out the preemption thing.
At least it does something.
Still a black screen and the MSM_WATCHDOG is a ***** again.
It needs to be suspended .. at least that what I get from the code I read here.
If I remove the driver too early the output in /proc/kmsg stops ..
If I try to remove it too late ... well it causes a resched while atomic.