This chapter is from the book
This chapter is from the book
This chapter is from the book
Booting Android from NAND Flash
With U-Boot, we can also boot Android from NAND flash. This approach is very similar to that used in real-world cases. When using this approach, we keep everything (kernel, RAMDISK image, and file system) in NAND flash and boot from there. As discussed in Chapter 8, three flash devices—system, userdata, and cache—are connected to the Android emulator. Even though Android mounts the RAMDISK as root, all system files are included in system.img. We can put both the kernel and RAMDISK images in system.img as well, allowing us to then boot the entire system from system.img.
Preparing system.img
To put the kernel and RAMDISK images into system.img, we have to recreate them. As mentioned previously, in Android 4.3 and earlier, system.img is in the YAFFS2 format. In Android 4.4 or later, it is in the ext4 format. In the ext4 format, we can mount the system.img file directly and copy both the kernel and RAMDISK in it. In this chapter, we will continue to use the Android Virtual Device hd2 that we created in Chapter 2; it is in YAFFS2 format and relies on Android version 4.0.3.
To regenerate system.img, we need to use YAFFS2 utilities. You can get them after you check out the build repository from GitHub. Two utilities—mkyaffs2image and unyaffs—can be found in the bin folder. Their source code can be found at http://code.google.com.
We have to extract system.img first. After we extract it, we can copy the kernel and RAMDISK images to the system image folder. As we did in the previous section, we need them in the U-Boot format (zImage.uimg and rootfs.uimg).
We can regenerate system.img using the mkyaffs2image command:
$ mkdir system $ cd system $ unyaffs ../system.img $ cd .. $ cp ./rootfs.uimg system/ramdisk.uimg $ cp ./zImage.uimg system/zImage.uimg $ rm ./system.img $ mkyaffs2image system ./system.img
Now we have a new system.img that contains both the kernel and RAMDISK images. We can use it to boot Android with U-Boot. For the exact procedures, refer to the build target rootfs of Makefile in the build repository.
Booting from NAND Flash
To boot Android from NAND flash, we need to use the –system option to tell the emulator to use our version of system.img instead of the one that comes with the Android SDK:
$ emulator -show-kernel -netfast -avd hd2 -shell -system ./system.img -ramdisk ./ ramdisk.img -qemu -kernel ./u-boot.bin ... U-Boot 2013.01.-rc1-00005-g4627a3e-dirty (Mar 07 2014 - 15:55:45) U-Boot code: 00010000 -> 0006E2BC BSS: -> 000A6450 IRQ Stack: 0badc0de FIQ Stack: 0badc0de monitor len: 00096450 ramsize: 20000000 TLB table at: 1fff0000 Top of RAM usable for U-Boot at: 1fff0000 Reserving 601k for U-Boot at: 1ff59000 Reserving 4104k for malloc() at: 1fb57000 Reserving 32 Bytes for Board Info at: 1fb56fe0 Reserving 120 Bytes for Global Data at: 1fb56f68 Reserving 8192 Bytes for IRQ stack at: 1fb54f68 New Stack Pointer is: 1fb54f58 RAM Configuration: Bank #0: 00000000 512 MiB relocation Offset is: 1ff49000 goldfish_init(), gtty.base=ff012000 WARNING: Caches not enabled monitor flash len: 00065AD4 Now running in RAM - U-Boot at: 1ff59000 NAND: base=ff017000 goldfish_nand_init: id=0: name=nand0, nand_name=system goldfish_nand_init: id=1: name=nand1, nand_name=userdata goldfish_nand_init: id=2: name=nand2, nand_name=cache 459 MiB Using default environment Destroy Hash Table: 1ffb5fe4 table = 00000000 Create Hash Table: N=89 INSERT: table 1ffb5fe4, filled 1/89 rv 1fb572a4 ==> name="bootargs" value="qemu. gles=1 qemu=1 console=ttyS0 android.qemud=ttyS1 androidboot.console=ttyS2 android.checkjni=1 ndns=1" INSERT: table 1ffb5fe4, filled 2/89 rv 1fb57160 ==> name="bootcmd" value="bootm 0x210000 0x410000" INSERT: table 1ffb5fe4, filled 3/89 rv 1fb572f8 ==> name="bootdelay" value="2" INSERT: table 1ffb5fe4, filled 4/89 rv 1fb57178 ==> name="baudrate" value="38400" INSERT: table 1ffb5fe4, filled 5/89 rv 1fb57154 ==> name="bootfile" value="/ tftpboot/uImage" INSERT: free(data = 1fb57008) INSERT: done In: serial Out: serial Err: serial Net: SMC91111-0 Warning: SMC91111-0 using MAC address from net device ### main_loop entered: bootdelay=2 ### main_loop: bootcmd="bootm 0x210000 0x410000" Hit any key to stop autoboot: 0 ## Current stack ends at 0x1fb54b00 * kernel: cmdline image address = 0x00210000 Wrong Image Format for bootm command ERROR: can't get kernel image! Command failed, result=1 Goldfish #
After the emulator is running, we are sent to the U-Boot command prompt because we have interrupted the autoboot process. We can then mount system.img from the U-Boot command line. First, we use the U-Boot command ydevconfig to configure the NAND device. We configure the device name as sys starting from block 0 to 0x64d (1613). The device number is 0:
Goldfish # ydevconfig sys 0 0x0 0x64d Configures yaffs mount sys: dev 0 start block 0, end block 1613
We can check the configuration using the command ydevls:
Goldfish # ydevls sys 0 0x00000 0x0064d not mounted
Next, we use the ymount command to mount the device sys. After mounting the device, we can list its contents using the command yls:
Goldfish # ymount sys Mounting yaffs2 mount point sys Goldfish # yls sys build.prop media fonts lib ramdisk.uimg usr zImage.uimg xbin etc framework tts bin app lost+found
Once we find both the kernel and RAMDISK image (zImage.uimg and ramdisk.uimg), we need to load them into memory using the command yrdm before we can boot the system. After we load them into memory, we can use the command iminfo to verify them:
Goldfish # yrdm sys/ramdisk.uimg 0x410000 Copy sys/ramdisk.uimg to 0x00410000... [DONE] Goldfish # iminfo 0x410000 ## Checking Image at 00410000 ... Legacy image found Image Name: Image Type: ARM Linux RAMDisk Image (uncompressed) Data Size: 187703 Bytes = 183.3 KiB Load Address: 00800000 Entry Point: 00800000 Verifying Checksum ... OK Goldfish # yrdm sys/zImage.uimg 0x210000 Copy sys/zImage.uimg to 0x00210000... [DONE] Goldfish # iminfo 0x210000 ## Checking Image at 00210000 ... Legacy image found Image Name: Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1722852 Bytes = 1.6 MiB Load Address: 00010000 Entry Point: 00010000 Verifying Checksum ... OK
Now we are ready to boot the system. This stage is the same as what we did when booting with NOR flash in the previous section. We use the umount command to dismount the YAFFS2 file system first and use the bootm command to boot the system:
Goldfish # yumount sys Unmounting yaffs2 mount point sys Goldfish # bootm 0x210000 0x410000 ## Current stack ends at 0x1fb54b10 * kernel: cmdline image address = 0x00210000 ## Booting kernel from Legacy Image at 00210000 ... Image Name: Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1722852 Bytes = 1.6 MiB Load Address: 00010000 Entry Point: 00010000 kernel data at 0x00210040, len = 0x001a49e4 (1722852) * ramdisk: cmdline image address = 0x00410000 ## Loading init Ramdisk from Legacy Image at 00410000 ... Image Name: Image Type: ARM Linux RAMDisk Image (uncompressed) Data Size: 187703 Bytes = 183.3 KiB Load Address: 00800000 Entry Point: 00800000 ramdisk start = 0x00800000, ramdisk end = 0x0082dd37 Loading Kernel Image ... OK CACHE: Misaligned operation at range [00010000, 006a2790] OK kernel loaded at 0x00010000, end = 0x001b49e4 using: ATAGS ## Transferring control to Linux (at address 00010000)... Starting kernel ... Uncompressing Linux.............................................................. .......................................... done, booting the kernel. goldfish_fb_get_pixel_format:167: display surface,pixel format: bits/pixel: 16 bytes/pixel: 2 depth: 16 red: bits=5 mask=0xf800 shift=11 max=0x1f green: bits=6 mask=0x7e0 shift=5 max=0x3f blue: bits=5 mask=0x1f shift=0 max=0x1f alpha: bits=0 mask=0x0 shift=0 max=0x0 Initializing cgroup subsys cpu Linux version 2.6.29-ge3d684d (sye1@ubuntu) (gcc version 4.6.3 (Sourcery CodeBench Lite 2012.03-57) ) #4 Fri Mar 7 15:59:39 CST 2014 CPU: ARMv7 Processor [410fc080] revision 0 (ARMv7), cr=10c5387f CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache Machine: Goldfish Memory policy: ECC disabled, Data cache writeback Built 1 zonelists in Zone order, mobility grouping on. Total pages: 130048 Kernel command line: qemu.gles=1 qemu=1 console=ttyS0 android.qemud=ttyS1 androidboot.console=ttyS2 android.checkjni=1 ndns=1 Unknown boot option 'qemu.gles=1': ignoring Unknown boot option 'android.qemud=ttyS1': ignoring Unknown boot option 'androidboot.console=ttyS2': ignoring Unknown boot option 'android.checkjni=1': ignoring PID hash table entries: 2048 (order: 11, 8192 bytes) Console: colour dummy device 80x30 Dentry cache hash table entries: 65536 (order: 6, 262144 bytes) Inode-cache hash table entries: 32768 (order: 5, 131072 bytes) Memory: 512MB = 512MB total Memory: 515456KB available (2956K code, 707K data, 124K init) Calibrating delay loop... 452.19 BogoMIPS (lpj=2260992) Mount-cache hash table entries: 512 Initializing cgroup subsys debug Initializing cgroup subsys cpuacct Initializing cgroup subsys freezer CPU: Testing write buffer coherency: ok net_namespace: 936 bytes NET: Registered protocol family 16 bio: create slab <bio-0> at 0 NET: Registered protocol family 2 IP route cache hash table entries: 16384 (order: 4, 65536 bytes) TCP established hash table entries: 65536 (order: 7, 524288 bytes) TCP bind hash table entries: 65536 (order: 6, 262144 bytes) TCP: Hash tables configured (established 65536 bind 65536) TCP reno registered NET: Registered protocol family 1 checking if image is initramfs... it is Freeing initrd memory: 180K goldfish_new_pdev goldfish_interrupt_controller at ff000000 irq -1 goldfish_new_pdev goldfish_device_bus at ff001000 irq 1 goldfish_new_pdev goldfish_timer at ff003000 irq 3 goldfish_new_pdev goldfish_rtc at ff010000 irq 10 goldfish_new_pdev goldfish_tty at ff002000 irq 4 goldfish_new_pdev goldfish_tty at ff011000 irq 11 goldfish_new_pdev goldfish_tty at ff012000 irq 12 goldfish_new_pdev smc91x at ff013000 irq 13 goldfish_new_pdev goldfish_fb at ff014000 irq 14 goldfish_new_pdev goldfish_audio at ff004000 irq 15 goldfish_new_pdev goldfish_mmc at ff005000 irq 16 goldfish_new_pdev goldfish_memlog at ff006000 irq -1 goldfish_new_pdev goldfish-battery at ff015000 irq 17 goldfish_new_pdev goldfish_events at ff016000 irq 18 goldfish_new_pdev goldfish_nand at ff017000 irq -1 goldfish_new_pdev qemu_pipe at ff018000 irq 19 goldfish_new_pdev goldfish-switch at ff01a000 irq 20 goldfish_new_pdev goldfish-switch at ff01b000 irq 21 goldfish_pdev_worker registered goldfish_interrupt_controller goldfish_pdev_worker registered goldfish_device_bus goldfish_pdev_worker registered goldfish_timer goldfish_pdev_worker registered goldfish_rtc goldfish_pdev_worker registered goldfish_tty goldfish_pdev_worker registered goldfish_tty goldfish_pdev_worker registered goldfish_tty goldfish_pdev_worker registered smc91x goldfish_pdev_worker registered goldfish_fb goldfish_pdev_worker registered goldfish_audio goldfish_pdev_worker registered goldfish_mmc goldfish_pdev_worker registered goldfish_memlog goldfish_pdev_worker registered goldfish-battery goldfish_pdev_worker registered goldfish_events goldfish_pdev_worker registered goldfish_nand goldfish_pdev_worker registered qemu_pipe goldfish_pdev_worker registered goldfish-switch goldfish_pdev_worker registered goldfish-switch ashmem: initialized Installing knfsd (copyright (C) 1996 okir@monad.swb.de). fuse init (API version 7.11) yaffs Mar 7 2014 15:57:44 Installing. msgmni has been set to 1007 alg: No test for stdrng (krng) io scheduler noop registered io scheduler anticipatory registered (default) io scheduler deadline registered io scheduler cfq registered allocating frame buffer 480 * 800, got ffa00000 console [ttyS0] enabled brd: module loaded loop: module loaded nbd: registered device at major 43 goldfish_audio_probe tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> smc91x.c: v1.1, sep 22 2004 by Nicolas Pitre <nico@cam.org> eth0 (smc91x): not using net_device_ops yet eth0: SMC91C11xFD (rev 1) at e080c000 IRQ 13 [nowait] eth0: Ethernet addr: 52:54:00:12:34:56 goldfish nand dev0: size c9c0000, page 2048, extra 64, erase 131072 goldfish nand dev1: size c200000, page 2048, extra 64, erase 131072 goldfish nand dev2: size 4000000, page 2048, extra 64, erase 131072 mice: PS/2 mouse device common for all mice *** events probe *** events_probe() addr=0xe0814000 irq=18 events_probe() keymap=qwerty2 input: qwerty2 as /devices/virtual/input/input0 goldfish_rtc goldfish_rtc: rtc core: registered goldfish_rtc as rtc0 device-mapper: uevent: version 1.0.3 device-mapper: ioctl: 4.14.0-ioctl (2008-04-23) initialised: dm-devel@redhat.com logger: created 64K log 'log_main' logger: created 256K log 'log_events' logger: created 64K log 'log_radio' Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (8192 buckets, 32768 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. ctnetlink v0.93: registering with nfnetlink. NF_TPROXY: Transparent proxy support initialized, version 4.1.0 NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. xt_time: kernel timezone is -0000 ip_tables: (C) 2000-2006 Netfilter Core Team arp_tables: (C) 2002 David S. Miller TCP cubic registered NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 RPC: Registered udp transport module. RPC: Registered tcp transport module. 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 0 goldfish_rtc goldfish_rtc: setting system clock to 2014-03-10 10:04:08 UTC (1394445848) Freeing init memory: 124K mmc0: new SD card at address e118 mmcblk0: mmc0:e118 SU02G 100 MiB mmcblk0: init: cannot open '/initlogo.rle' yaffs: dev is 32505856 name is "mtdblock0" yaffs: passed flags "" yaffs: Attempting MTD mount on 31.0, "mtdblock0" yaffs_read_super: isCheckpointed 0 save exit: isCheckpointed 1 yaffs: dev is 32505857 name is "mtdblock1" yaffs: passed flags "" yaffs: Attempting MTD mount on 31.1, "mtdblock1" yaffs_read_super: isCheckpointed 0 yaffs: dev is 32505858 name is "mtdblock2" yaffs: passed flags "" yaffs: Attempting MTD mount on 31.2, "mtdblock2" yaffs_read_super: isCheckpointed 0 init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery' eth0: link up shell@android:/ $ warning: 'rild' uses 32-bit capabilities (legacy support in use)