-
Notifications
You must be signed in to change notification settings - Fork 5
Boot image manipulation
(Below provided dtb is only for Joyeuse model. Other model need to change msm-id and some other dtb node. Please refer to sm7125-xiaomi-curtanna.dts and sm7125-xiaomi-joyeuse.dts for detail.)
Since the Android boot.img is lived in xiaomi-miatoll-boot.img.gz within xiaomi-miatoll-next.zip, unzip it or directly open by 7-zip.
Click on the xiaomi-miatoll-boot.img.gz and xiaomi-miatoll-boot.img shows, click on it then a boot.img is there. and other dtbs also avaailable or exchange. Since to make it safe, the embeded dtb is upstream joyeuse dtb with minimal functionality. So by help of boot img editor [1] or other tool to extract.
First I assumed an sdcard is used. Put that in PC and use MS disk manager (or Linux parted) to create 2 partitions (either GPT or MBR are ok), aka, boot and root. Then write above mentioned ext4 img into those partition. Supposed in LOS recovery, the location /dev/block/mmcblk2p1 is boot, and /dev/block/mmcblk2p2 is root, then below to flash into sdcard: `
# adb push xiaomi-miatoll-boot.img /dev/block/mmcblk2p1 # adb push xiaomi-miatoll-root.img /dev/block/mmcblk2p2
There might some cases that init script cant regconise the partition that way, an alternative way to archeive is to partition with gpt and named those two partition as
pmOS_boot pmOS_root
First method is by "fastboot boot boot.img" but it is some kind of useless becaause the dtb is limited functionality for safety sake.
Second method is DIY yourself. Available Image.gz and my dedicated dtb (sm7125-xiaomi-joyeuse-cust.dtb) with the initramfs.gz and initramfs-extra.gz so you can do something below under WSL (so other env, do some change accordingly), please noted that there is a patch that skip all bootloader appended tags to cmdline so all androidboot.* are ignored by kernel after boot. So in order to supply those special tags, bootconfig is needed.
# adb reboot bootloader
# cat initramfs.gz initramfs-extra.gz > /tmp/ramdisk.gz
# fastboot.exe boot Image.gz ramdisk.gz --dtb sm7125-idp.dtb --dtb-offset 32505856 --base 0 --kernel-offset 2097152 --ramdisk-offset 16777216 --tags-offset 256 --page-size 4096 --os-version 11.0.0 --os-patch-level 2020-06-00 --header-version 2 --cmdline pd_ignore_unused clk_ignore_unused no_console_suspend kpti=off nokaslr ignore_loglevel service_locator.enable=1 init=/init console=null root=/dev/mmcblk2p2 PMOS_FORCE_PARTITION_RESIZE pmos_boot=/dev/mmcblk2p1 pmos_root=/dev/mmcblk2p2
Third method is to use boot img editor [1] or mkimage to replace dtb and all rest of boot.img, test it with fastboot boot. If everything is alright, flash it into boot if needed.
Here is a wiki[2] for make the changes needed with ssh. Rough idea is to enable ssh server on init.d and then install windows driver for usb rndis
Below is how to append bootconfig into ramdisk:
# ~/linux/tools/bootconfig/bootconfig -a bootconfig /tmp/ramdisk.gz
The above mentioned bootconfig file content for LOS recovery: `
kernel.androidboot.boot_devices=soc/8804000.mmc
kernel.androidboot.bootdevice=8804000.mmc
kernel.androidboot.fstab_suffix=default
kernel.androidboot.hardware=qcom
kernel.androidboot.keymaster=1
kernel.androidboot.memcg=1
kernel.androidboot.multisim_config=dsds
kernel.androidboot.selinux=permissive
kernel.androidboot.usbcontroller=a600000.usb
kernel.androidboot.configfs=true
init.test=test
androidboot.AdcVol1=464
androidboot.AdcVol2=1307
androidboot.baseband=msm
androidboot.configfs=true
androidboot.console=ttyMSM0
androidboot.cpuid=0xdc1467b8
androidboot.dp=0x0
androidboot.dtb_idx=-1347440721
androidboot.fpsensor=fpc
androidboot.fstab_suffix=default
androidboot.hardware=qcom
androidboot.hwc=VDF_TWO
androidboot.hwlevel=MP
androidboot.hwname=joyeuse
androidboot.hwversion=4.90.0
androidboot.keymaster=1
androidboot.lcmtype=dsi_nt36672c_tianma_fhd_video_display
androidboot.memcg=1
androidboot.multisim_config=dsds
androidboot.secureboot=1
androidboot.selinux=permissive
androidboot.serialno=4d2eb949
androidboot.usbcontroller=a600000.usb
androidboot.verifiedbootstate=orange
androidboot.recovery.usb.vid=0x05c6
androidboot.recovery.usb.pid=0x3225
buildvariant=userdebug
cgroup.memory=nokmem,nosocket
cgroup_disable=pressure
loop.max_part=7
lpm_levels.sleep_disabled=1
msm_drm.dsi_display0=dsi_nt36675_tianma_vid_display:
msm_rtb.enabled=1
msm_rtb.filter=0x237
noirqdebug
rcu_nocbs=0-7
rcupdate.rcu_expedited=1
service_locator.enable=1
swiotlb=1
video=vfb:640x400,bpp=32,memsize=3072000
debug_mask=0x36 `
[1] https://github.com/cfig/Android_boot_image_editor
[2] https://wiki.postmarketos.org/wiki/SSH#Start_the_SSH_Daemon