[Transformer TF300T Android Development] Geometry:
kexec boot loader with menu

So here I describe a proof-of-concept implementation of the kexec-hardboot method to boot a system of choice on the tf300t. This is based on this kernel. The initramfs was produced with this xubuntu 14.04 rootfs.

INSTALLATION INSTRUCTIONS:

I assume you just have some Android ROM installed (could be stock). It may not even be rooted. However, the tablet must be unlocked.

1. You need the ROM you are using as a falshable zip file. I give two examples:

- Stock: Download this from the ASUS website. The file should be named "WW_epad-user-10.6.1.27.5.zip" or similar, depending on the region. Unzip this. Inside there is a file called "blob". Now unpack this using "blobunpack" from here:

> blobunpack blob

One of the files produced is called "blob.LNX". Now use the tool "abootimg" (in Ubuntu package "abootimg" for example, don't know about Windows) as follows:

> abootimg -x blob.LNX

This produces various files. The ones you need are "zImage" (the kernel) and "initrd.img" (the initramfs).

- CM11 (other custom ROMs should be similar): If this is installed on your device, the zip file be likely on your device in the folder "cmupdater" in internal storage, i.e., at "/storage/emulated/0/cmupdater/" (aka "/data/media/0/cmupdater"). Otherwise get it from the cyanogemod website. The file might be named "cm-11-20141112-SNAPSHOT-M12-tf300t.zip" or similar. Unzip this. Inside is a file named "boot.blob". Apply blobunpack to it (see above). This produces a file "boot.blob.LNX". Apply "abootimg -x" to it, (see above). This yields "zImage" (the kernel) and "initrd.img" (the initramfs).

2. Create a folder "boot" in internal storage, i.e., "/storage/emulated/0/boot/" (aka "/data/media/0/boot/"). Rename "zImage" to "zImage-0" and place it inside. Rename "initrd.img" to "initrd-0.img" and place it inside.

3. (DO THIS ONLY IF YOU ARE EXPERIENCED, YOU MIGHT BRICK YOUR DEVICE)

Unzip the attached file "kexec-boot-menu.blob.zip" to obtain "kexec-boot-menu.blob". Flash this file to the staging partition. There are different ways to do this (choose one):

a) connect the tf300t to a PC, put the tf300t into fastboot mode and use the fastboot tool on the PC (on Ubuntu this is in the package "android-tools-fastboot"):

> fastboot flash staging kexec-boot-menu.blob

b) if you have rooted Android, in a terminal do:

> su
> dd if=kexcec-boot-menu.blob of=/dev/block/mmcblk0p4

(Be VERY CAREFUL that the last number is "4", nothing else)

c) if you have a working Linux installed, do:

> sudo dd if=kexcec-boot-menu.blob of=/dev/mmcblk0p4

4. Reboot

5. When the device boots you should get some kernel messages and after about 5 seconds a menu appears, waiting for your input. So far, only Android is configured, this is option "0". So either choose this option, or press the "volume down" key or wait 10 seconds. The device should then reboot with Android as you are used to it.

OK, so far nothing interesting, just a more complicated way to boot Android. But the thing is, you can now install other systems, in particular Linux on your tf300t and boot them by choosing other numbers than "0" in the boot menu. Just place the corresponding kernel named "zImage-x" and initramfs named "initrd-x.img" into "/storage/emuldated/0/boot/" (i.e. "/data/media/0/boot/") with x replaced by a number 1...9. When you choose this number in the boot menu, the corresponding system will be booted. In particular, you can use this to boot Linux. For example if this xubuntu 14.04 rootfs is installed on the first partition of an inserted micdrosd card you could rename "/boot/vmliuz-3.1.10" to "zImage-1" and "/boot/initrd.img-3.1.10" to "initrd-1.img" and place them there and boot this linux with option "1".

The boot loader has the additional functionality to boot linux directly via the "l" option, i.e., without using kexec with a reboot. But in the version provided this only works for linux in the first partition of the microsd card and using this kernel. To make this work with this xubuntu 14.04 rootfs you need to extract these kernel files into it.

HOW WAS THIS DONE?

I see this just as a proof-of-concept and it can easily be improved/modified. To reproduce, use this xubuntu rootfs with these kernel files. In addition you need the "kexec" binary from here. In Linux, place this in "/usr/sbin/kexec". The bootloader itself is implemented through a small script called "boot-menu" placed in "/etc/initramfs-tools/scripts/init-premount/". For this to work another small script has to be put in "/etc/initramfs-tools/hooks/". Both are inluded in the attached file "initramfs-boot.tar.gz". Then, in Linux, do

> sudo update-initramfs -c -k 3.1.10

This produces a new initramfs file "/boot/initrd.img-3.1.10". Then do

> abootimg --create boot.img -k /boot/vmlinuz-3.1.10 -r /boot/initrd.img-3.1.10

This creates the Android boot image "boot.img". To make this flashable, convert this to a boot blob file with "blobpack". Unfortunately the version from here did not work for me. I am using one included in the cyaongenmod source tools, called "blobpack_tfp":

> blobpack_tfp kexec-boot-menu.blob LNX boot.img

So I hope this will make people able to experiment with this and improve it!

For example some of the nice features of Graiden05's kernel/initramfs such as automatic detection of the location of linux for direct boot could be implemented...