Home > Articles > Mobile Application Development & Programming

  • Print
  • + Share This
This chapter is from the book

Booting Android from NAND Flash

With U-Boot, we can also boot Android from NAND flash. This approach is very similar to that used in real-world cases. When using this approach, we keep everything (kernel, RAMDISK image, and file system) in NAND flash and boot from there. As discussed in Chapter 8, three flash devices—system, userdata, and cache—are connected to the Android emulator. Even though Android mounts the RAMDISK as root, all system files are included in system.img. We can put both the kernel and RAMDISK images in system.img as well, allowing us to then boot the entire system from system.img.

Preparing system.img

To put the kernel and RAMDISK images into system.img, we have to recreate them. As mentioned previously, in Android 4.3 and earlier, system.img is in the YAFFS2 format. In Android 4.4 or later, it is in the ext4 format. In the ext4 format, we can mount the system.img file directly and copy both the kernel and RAMDISK in it. In this chapter, we will continue to use the Android Virtual Device hd2 that we created in Chapter 2; it is in YAFFS2 format and relies on Android version 4.0.3.

To regenerate system.img, we need to use YAFFS2 utilities. You can get them after you check out the build repository from GitHub. Two utilities—mkyaffs2image and unyaffs—can be found in the bin folder. Their source code can be found at http://code.google.com.

We have to extract system.img first. After we extract it, we can copy the kernel and RAMDISK images to the system image folder. As we did in the previous section, we need them in the U-Boot format (zImage.uimg and rootfs.uimg).

We can regenerate system.img using the mkyaffs2image command:

$ mkdir system
$ cd system
$ unyaffs ../system.img
$ cd ..
$ cp ./rootfs.uimg system/ramdisk.uimg
$ cp ./zImage.uimg system/zImage.uimg
$ rm ./system.img
$ mkyaffs2image system ./system.img

Now we have a new system.img that contains both the kernel and RAMDISK images. We can use it to boot Android with U-Boot. For the exact procedures, refer to the build target rootfs of Makefile in the build repository.

Booting from NAND Flash

To boot Android from NAND flash, we need to use the –system option to tell the emulator to use our version of system.img instead of the one that comes with the Android SDK:

$ emulator -show-kernel -netfast -avd hd2 -shell -system ./system.img -ramdisk ./
ramdisk.img  -qemu -kernel ./u-boot.bin
U-Boot 2013.01.-rc1-00005-g4627a3e-dirty (Mar 07 2014 - 15:55:45)

U-Boot code: 00010000 -> 0006E2BC  BSS: -> 000A6450
IRQ Stack: 0badc0de
FIQ Stack: 0badc0de
monitor len: 00096450
ramsize: 20000000
TLB table at: 1fff0000
Top of RAM usable for U-Boot at: 1fff0000
Reserving 601k for U-Boot at: 1ff59000
Reserving 4104k for malloc() at: 1fb57000
Reserving 32 Bytes for Board Info at: 1fb56fe0
Reserving 120 Bytes for Global Data at: 1fb56f68
Reserving 8192 Bytes for IRQ stack at: 1fb54f68
New Stack Pointer is: 1fb54f58
RAM Configuration:
Bank #0: 00000000 512 MiB
relocation Offset is: 1ff49000
goldfish_init(), gtty.base=ff012000
WARNING: Caches not enabled
monitor flash len: 00065AD4
Now running in RAM - U-Boot at: 1ff59000
NAND:  base=ff017000
goldfish_nand_init: id=0: name=nand0, nand_name=system
goldfish_nand_init: id=1: name=nand1, nand_name=userdata
goldfish_nand_init: id=2: name=nand2, nand_name=cache
459 MiB
Using default environment
Destroy Hash Table: 1ffb5fe4 table = 00000000
Create Hash Table: N=89
INSERT: table 1ffb5fe4, filled 1/89 rv 1fb572a4 ==> name="bootargs" value="qemu.
gles=1 qemu=1 console=ttyS0 android.qemud=ttyS1 androidboot.console=ttyS2
android.checkjni=1 ndns=1"
INSERT: table 1ffb5fe4, filled 2/89 rv 1fb57160 ==> name="bootcmd" value="bootm
0x210000 0x410000"
INSERT: table 1ffb5fe4, filled 3/89 rv 1fb572f8 ==> name="bootdelay" value="2"
INSERT: table 1ffb5fe4, filled 4/89 rv 1fb57178 ==> name="baudrate" value="38400"
INSERT: table 1ffb5fe4, filled 5/89 rv 1fb57154 ==> name="bootfile" value="/
INSERT: free(data = 1fb57008)
INSERT: done
In:    serial
Out:   serial
Err:   serial
Net:   SMC91111-0
Warning: SMC91111-0 using MAC address from net device

### main_loop entered: bootdelay=2

### main_loop: bootcmd="bootm 0x210000 0x410000"
Hit any key to stop autoboot:  0
## Current stack ends at 0x1fb54b00 *  kernel: cmdline image address = 0x00210000
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Command failed, result=1
Goldfish #

After the emulator is running, we are sent to the U-Boot command prompt because we have interrupted the autoboot process. We can then mount system.img from the U-Boot command line. First, we use the U-Boot command ydevconfig to configure the NAND device. We configure the device name as sys starting from block 0 to 0x64d (1613). The device number is 0:

Goldfish # ydevconfig sys 0 0x0 0x64d
Configures yaffs mount sys: dev 0 start block 0, end block 1613

We can check the configuration using the command ydevls:

Goldfish # ydevls
sys            0 0x00000 0x0064d not mounted

Next, we use the ymount command to mount the device sys. After mounting the device, we can list its contents using the command yls:

Goldfish # ymount sys
Mounting yaffs2 mount point sys
Goldfish # yls sys

Once we find both the kernel and RAMDISK image (zImage.uimg and ramdisk.uimg), we need to load them into memory using the command yrdm before we can boot the system. After we load them into memory, we can use the command iminfo to verify them:

Goldfish # yrdm sys/ramdisk.uimg 0x410000
Copy sys/ramdisk.uimg to 0x00410000...     [DONE]
Goldfish # iminfo 0x410000

## Checking Image at 00410000 ...
   Legacy image found
   Image Name:
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    187703 Bytes = 183.3 KiB
   Load Address: 00800000
   Entry Point:  00800000
   Verifying Checksum ... OK
Goldfish # yrdm sys/zImage.uimg 0x210000
Copy sys/zImage.uimg to 0x00210000...     [DONE]
Goldfish # iminfo 0x210000

## Checking Image at 00210000 ...
   Legacy image found
   Image Name:
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1722852 Bytes = 1.6 MiB
   Load Address: 00010000
   Entry Point:  00010000
   Verifying Checksum ... OK

Now we are ready to boot the system. This stage is the same as what we did when booting with NOR flash in the previous section. We use the umount command to dismount the YAFFS2 file system first and use the bootm command to boot the system:

Goldfish # yumount sys
Unmounting yaffs2 mount point sys
Goldfish # bootm 0x210000 0x410000
## Current stack ends at 0x1fb54b10 *  kernel: cmdline image address = 0x00210000
## Booting kernel from Legacy Image at 00210000 ...
   Image Name:
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1722852 Bytes = 1.6 MiB
   Load Address: 00010000
   Entry Point:  00010000
   kernel data at 0x00210040, len = 0x001a49e4 (1722852)
*  ramdisk: cmdline image address = 0x00410000
## Loading init Ramdisk from Legacy Image at 00410000 ...
   Image Name:
   Image Type:   ARM Linux RAMDisk Image (uncompressed)
   Data Size:    187703 Bytes = 183.3 KiB
   Load Address: 00800000
   Entry Point:  00800000
   ramdisk start = 0x00800000, ramdisk end = 0x0082dd37
   Loading Kernel Image ... OK
CACHE: Misaligned operation at range [00010000, 006a2790]
   kernel loaded at 0x00010000, end = 0x001b49e4
using: ATAGS
## Transferring control to Linux (at address 00010000)...

Starting kernel ...

Uncompressing Linux..............................................................
.......................................... done, booting the kernel.
goldfish_fb_get_pixel_format:167: display surface,pixel format:
  bits/pixel:  16
  bytes/pixel: 2
  depth:       16
  red:         bits=5 mask=0xf800 shift=11 max=0x1f
  green:       bits=6 mask=0x7e0 shift=5 max=0x3f
  blue:        bits=5 mask=0x1f shift=0 max=0x1f
  alpha:       bits=0 mask=0x0 shift=0 max=0x0
Initializing cgroup subsys cpu
Linux version 2.6.29-ge3d684d (sye1@ubuntu) (gcc version 4.6.3 (Sourcery
CodeBench Lite 2012.03-57) ) #4 Fri Mar 7 15:59:39 CST 2014
CPU: ARMv7 Processor [410fc080] revision 0 (ARMv7), cr=10c5387f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Goldfish
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 130048
Kernel command line: qemu.gles=1 qemu=1 console=ttyS0 android.qemud=ttyS1
androidboot.console=ttyS2 android.checkjni=1 ndns=1
Unknown boot option 'qemu.gles=1': ignoring
Unknown boot option 'android.qemud=ttyS1': ignoring
Unknown boot option 'androidboot.console=ttyS2': ignoring
Unknown boot option 'android.checkjni=1': ignoring
PID hash table entries: 2048 (order: 11, 8192 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 512MB = 512MB total
Memory: 515456KB available (2956K code, 707K data, 124K init)
Calibrating delay loop... 452.19 BogoMIPS (lpj=2260992)
Mount-cache hash table entries: 512
Initializing cgroup subsys debug
Initializing cgroup subsys cpuacct
Initializing cgroup subsys freezer
CPU: Testing write buffer coherency: ok
net_namespace: 936 bytes
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
NET: Registered protocol family 1
checking if image is initramfs... it is
Freeing initrd memory: 180K
goldfish_new_pdev goldfish_interrupt_controller at ff000000 irq -1
goldfish_new_pdev goldfish_device_bus at ff001000 irq 1
goldfish_new_pdev goldfish_timer at ff003000 irq 3
goldfish_new_pdev goldfish_rtc at ff010000 irq 10
goldfish_new_pdev goldfish_tty at ff002000 irq 4
goldfish_new_pdev goldfish_tty at ff011000 irq 11
goldfish_new_pdev goldfish_tty at ff012000 irq 12
goldfish_new_pdev smc91x at ff013000 irq 13
goldfish_new_pdev goldfish_fb at ff014000 irq 14
goldfish_new_pdev goldfish_audio at ff004000 irq 15
goldfish_new_pdev goldfish_mmc at ff005000 irq 16
goldfish_new_pdev goldfish_memlog at ff006000 irq -1
goldfish_new_pdev goldfish-battery at ff015000 irq 17
goldfish_new_pdev goldfish_events at ff016000 irq 18
goldfish_new_pdev goldfish_nand at ff017000 irq -1
goldfish_new_pdev qemu_pipe at ff018000 irq 19
goldfish_new_pdev goldfish-switch at ff01a000 irq 20
goldfish_new_pdev goldfish-switch at ff01b000 irq 21
goldfish_pdev_worker registered goldfish_interrupt_controller
goldfish_pdev_worker registered goldfish_device_bus
goldfish_pdev_worker registered goldfish_timer
goldfish_pdev_worker registered goldfish_rtc
goldfish_pdev_worker registered goldfish_tty
goldfish_pdev_worker registered goldfish_tty
goldfish_pdev_worker registered goldfish_tty
goldfish_pdev_worker registered smc91x
goldfish_pdev_worker registered goldfish_fb
goldfish_pdev_worker registered goldfish_audio
goldfish_pdev_worker registered goldfish_mmc
goldfish_pdev_worker registered goldfish_memlog
goldfish_pdev_worker registered goldfish-battery
goldfish_pdev_worker registered goldfish_events
goldfish_pdev_worker registered goldfish_nand
goldfish_pdev_worker registered qemu_pipe
goldfish_pdev_worker registered goldfish-switch
goldfish_pdev_worker registered goldfish-switch
ashmem: initialized
Installing knfsd (copyright (C) 1996 okir@monad.swb.de).
fuse init (API version 7.11)
yaffs Mar  7 2014 15:57:44 Installing.
msgmni has been set to 1007
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
allocating frame buffer 480 * 800, got ffa00000
console [ttyS0] enabled
brd: module loaded
loop: module loaded
nbd: registered device at major 43
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
smc91x.c: v1.1, sep 22 2004 by Nicolas Pitre <nico@cam.org>
eth0 (smc91x): not using net_device_ops yet
eth0: SMC91C11xFD (rev 1) at e080c000 IRQ 13 [nowait]
eth0: Ethernet addr: 52:54:00:12:34:56
goldfish nand dev0: size c9c0000, page 2048, extra 64, erase 131072
goldfish nand dev1: size c200000, page 2048, extra 64, erase 131072
goldfish nand dev2: size 4000000, page 2048, extra 64, erase 131072
mice: PS/2 mouse device common for all mice
*** events probe ***
events_probe() addr=0xe0814000 irq=18
events_probe() keymap=qwerty2
input: qwerty2 as /devices/virtual/input/input0
goldfish_rtc goldfish_rtc: rtc core: registered goldfish_rtc as rtc0
device-mapper: uevent: version 1.0.3
device-mapper: ioctl: 4.14.0-ioctl (2008-04-23) initialised: dm-devel@redhat.com
logger: created 64K log 'log_main'
logger: created 256K log 'log_events'
logger: created 64K log 'log_radio'
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (8192 buckets, 32768 max)
CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use
nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or
sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
ctnetlink v0.93: registering with nfnetlink.
NF_TPROXY: Transparent proxy support initialized, version 4.1.0
NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd.
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 0
goldfish_rtc goldfish_rtc: setting system clock to 2014-03-10 10:04:08 UTC
Freeing init memory: 124K
mmc0: new SD card at address e118
mmcblk0: mmc0:e118 SU02G 100 MiB
init: cannot open '/initlogo.rle'
yaffs: dev is 32505856 name is "mtdblock0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.0, "mtdblock0"
yaffs_read_super: isCheckpointed 0
save exit: isCheckpointed 1
yaffs: dev is 32505857 name is "mtdblock1"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.1, "mtdblock1"
yaffs_read_super: isCheckpointed 0
yaffs: dev is 32505858 name is "mtdblock2"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.2, "mtdblock2"
yaffs_read_super: isCheckpointed 0
init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
eth0: link up
shell@android:/ $ warning: 'rild' uses 32-bit capabilities (legacy support in
  • + Share This
  • 🔖 Save To Your Account