yashsingh1/xdaforums huggingface dataset:
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
Findings so far...

[MENTION=503571]Cpasjuste[/MENTION]

I think I have located why the display is not coming up correctly.

The kernel logs shows the following:

mdss_fb_register: FrameBuffer[0] 2560x1600 size=33554432 registered successfully!
<6>[ 0.831687] mdss_mdp_overlay_fb_parse_dt: mixer swap is enabled for fb device=qcom,mdss_fb_primary.175
<3>[ 0.831935] mdss_mdp_mixer_handoff: pipe num 3 staged on unallocated mixer num 0
<3>[ 0.832037] __mdss_mdp_ctl_handoff: failed to handoff mix0
<3>[ 0.832138] mdss_mdp_overlay_handoff: primary ctl handoff failed. rc=-22
<3>[ 0.832197] mdss_mdp_mixer_free: called with ref_cnt=0
<3>[ 0.832296] mdss_mdp_mixer_free: called with ref_cnt=0
<4>[ 0.832351] mdss_mdp_overlay_init: Overlay handoff failed for fb0. rc=-22

What seems to be failing (assuming I'm correct) is that the MDP needs to handoff all the hardware ctl, mixers and pipes that were staged by the bootloader. Once handoff has occurred then the boot animation can then be displayed.

This seems to work fine for the Thor device - no problem.

It seems in the 452 kernel - the correct DTB entry is Thor V2 and Apollo V2.

At the moment I am at a junction for my investigations. I either suspect something in the DT or in the MDP code within the kernel.

If anyone has any experience in this area I would appreciate any help. For now I will continue.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
[MENTION=5749760]ggow[/MENTION]

Have you been able to build the kernel for 4.5.2 or any 3.10 kernels from msm git sources using apollo_defconfig? I have built the apollo kernel from .3.2.1 sources that amazon posted after a few dozen fixes to things, but am getting a lot more compilation errors from .4.5.2. I have had better success with an msm git source using the apollo config, but it keeps getting hung up on the creation of the .dtb files. What toolchain do you use to compile the kernel?

I updated to .3.2.5 system but with this darn kk kernel.....this is a road block. What are you doing to get logs from booting the modified .4.5.2 kernel(s)? When I check last_kmsg....it always seems to be from the last boot into recovery....
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
I can build 4.5.2 fine, I was building a basic recovery image which I setup so that when booted would hold in that state with adb enabled so I could get the last recovery log.

I used the standard 4.7 toolchain to build.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
[MENTION=5749760]ggow[/MENTION]

Do you sign the boot.img with cuber and are you using the same unmodified amazon ramdisk from .4.5.2 sources when trying to debug this?
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
i am signing with cuber and using a build of twrp to debug.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
A build of twrp to debug? How does that work?

I am shooting in the dark by making changes to boot.img (modifying dt.img, reviewing ediff changes on ramdisk, modifing img_info file for kernel commandline, etc.) Then I sign boot.img with cuber, create an update.zip, reboot into your twrp 2.8.1.0 recovery and install from there, then reboot system and see what happens. I then boot back into recovery and copy recovery log and last_kmsg to sdcard and review them, but they seem to be from the last boot into recovery, and nothing from the attempted boot.img. Perhaps this is because there is an early stage bootloader issue and not really a kernel issue? So any logging would be difficult to get to since it is not even progressing to loading init or adb services....
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
Look at post #83.

The issue is the screen isn't coming up either from the 4.5.2 system.img or even from the recovery image. The recovery image is a simple alternative way of debugging; you will have live access to the logs because the kernel does indeed boot. You can adb shell into the device but no gui on the screen. The logs in post #83 came from such a recovery image.

The handoff between the bootloader and kernel for the handles, ctls etc is failing for apollo but seems to work fine for thor with an old bootloader. The bootloader may be doing something untoward for apollo, but not sure as we don't have the source code for it. I did start to look aboot.img but haven't had time to finish yet. Seems to be a million things to do at the moment.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
Perhaps a crazy nonsensical idea not worth risking, but just a thought...

-Is it known if the bootloader checks the recovery image signature upon every boot, or just upon attempting to flash the recovery image?

The reason I ask is...it might be worth the risk to go ahead and flash the updated bootloader AFTER having the latest twrp recovery installed and then the 3.10 and kk kernels might work out of the box on apollo. I can see how this might not be worth the risk to test since it could result in a brick or being stuck with a unexploited bootloader.
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
- I can confirm the bootloader checks the signature upon every boot.

- There is no check when flashing the recovery image via dd.

- Flashing the new bootloader would be very risky indeed. The recovery as we have it now on firmware <= 13.3.2.4 has a version 1 DT table structure. Flashing the new bootloader means it will only understand a version 2 DT table structure which will render your device useless as also the boot image would be subject to the same rules.

- The only sane way of flashing the bootloader would be if we had fastboot access.

So I would NOT recommend you flashing the new the new bootloader just yet.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
Do you have the full last_kmsg from this boot?

Edit: Nevermind. I found one I had saved.
[Kindle Fire HDX 7" & 8.9" Android Development] draxie:
Finally, I found some time to fully reverse what Cpastjuste did to the DT...

From the looks of it, the 3rd DT entry got decompiled to text, two parameters changed,

and the result recompiled to binary form, which is what got appended to the original kernel.

$ diff -u 13.4.5.2-orig/3.dtb.dts 13.4.5.2-twrp/dts
--- 13.4.5.2-orig/3.dtb.dts	2015-02-03 19:36:45.015266660 +0100
+++ 13.4.5.2-twrp/dts	2015-02-03 19:44:54.675287340 +0100
@@ -40,7 +40,7 @@
secure_region {
linux,contiguous-region;
linux,reserve-region;
-	reg = <0x0 0x9d00000>;
+	reg = <0x0 0xfc00000>;
label = "secure_mem";
linux,phandle = <0x18>;
phandle = <0x18>;
@@ -7513,7 +7513,7 @@
compatible = "qcom,msm-watchdog";
reg = <0xf9017000 0x1000>;
interrupts = <0x0 0x3 0x0 0x0 0x4 0x0>;
-	qcom,bark-time = <0x4e20>;
+	qcom,bark-time = <0x2ee0>;
qcom,pet-time = <0x2710>;
qcom,ipi-ping;
};

I'm about to test if these changes also work for Apollo,

but I don't have the time right now, and I also want to

make backups before I continue...
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
Tested the changes and still the same result. Kernel boots but with no display output.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
I did not compare the Thor dts differences, but for Apollo, the differences between the the second or third dtbs from the boot image used in 14.3.2.5 and the second or third dtbs from the boot image used in 14.4.5.2 is over 300 lines.

How was it figured which of the three dtb images the bootloader is choosing to load? Just trial and error of appending them by themselves to see which one(s) boot up?

So far, I have attempted to modify the second dts from 14.4.5.2 boot image by comparing it to the second dts from 14.3.2.5 boot image. Most of the changes I have tried are just removing some lines from the qcom,mdss_mdp@fd900000 entry. All of this to no avail. I am still struggling with getting last_kmsg to debug :( It seems it is not there to pull and/or adb is not allowing permission to access it even with root.

The video drivers in the kernel are drastically modified as well from 3.04 to 3.10 too....so not sure if the best approach is to continue to try changes to modify the dts files or look into the kernel drivers. It seems it is highly liklely a bootloader + dts issue as [MENTION=5749760]ggow[/MENTION] already pointed out with the log in this thread above.
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
After booting the 4.5.2 image, if you do a logcat and look at the soc id at the top of the file it is 184 decimal which corresponds to the 3rd DTB entry only having this ID.
[Kindle Fire HDX 7" & 8.9" Android Development] draxie:
I wonder if those are the right changes for Apollo...

We should go back and compare what values those fields have

in the 14.3.2.3.2 DT. I have only tested the same values as above,

without thinking too much. Those values could well be different

for Thor and Apollo. (No computer access right now, unfortunately.)
[Kindle Fire HDX 7" & 8.9" Android Development] draxie:
So, comparing the DT sources, qcom, bark-time is the same for Thor and Apollo.

As for the secure_region , that wasn't present in 3.2.3.2; so, I'd be very interested

in learning where [MENTION=503571]Cpasjuste[/MENTION] got that number from... and, whether or not that made

any difference actually.

BTW, just for the record, I got so desperate that I flashed all the new firmware

with the notable exception of emmc_appsboot.mbn from 4.5.2 to see if that

made any difference. Unfortunately, the answer is NO.

I sort of expected that I'd have to reflash those partitions (dbi, rpm, tz, sbl1) back to

their 3.2.3.2 versions once I was done with the 4.5.2 experiment (and was hoping

that I'd be able to do so :cowboy:), but there was no need: the 3.2.3.2 system/boot

restored and works fine with the newer firmwares.

Next step is to disable signature-checking in the 4.5.2 aboot and try to flash that.

I'm not entirely positive that this is safe even with our newly "unlocked" bootloader,

but I'm considering taking the jump, anyway. Once I figure out where to disable the

signature checks, of course.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
I assumed that [MENTION=503571]Cpasjuste[/MENTION] just used the 3rd dtb entry from the official Amazon 4.5.2 boot.img unaltered. It just works for thor, but not apollo. It does seem that the Thor dtb used in the CM11 rom compared to the 4.5.2 apollo 3rd dtb does have a different display panel section using a single "Novatek 1080p" whereas apollo has two different panels being set with jdi mipi something or other.

I did this as well, but also went so far as to update the boot.img and system to 14.3.2.5 (the latest update.bin that I have from Amazon that works on this old bootloader from 14.3.2.3.2).

Building a custom lk bootloader?
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
Any modified aboot.img would have to be signed because it is verified by SBL.
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
We have amazon patches for mdm9615 lk but i havent see them for the main chip. (3.1.0 source)

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Android Development] draxie:
I'm attaching the script I use to generate a boot.img that is bit for bit

identical and the complete update-*.zip that is content-wise identical

(the different dates/times make it too laborious to produce identical

.zip files ;)) to what [MENTION=503571]Cpasjuste[/MENTION] had posted.

If you can read bash/python/diff/patch (no offense, but not all xda

readers are developers), then you'll see that not only was the DT source

changed, but also the header of the recompiled binary DTB differs from

what standard dtc produces.

Pass in the official 13.4.5.2 update along with the 'c' flag

and compare the result (unzipped) with the -twrp.zip from [MENTION=503571]Cpasjuste[/MENTION].

Unfortunately, I still haven't found a combination that works.

Hmm.. good idea! I downgraded from 3.2.6 when TWRP came,

but I hear people talk about 3.2.8 as the latest. If anyone has

the download link, we could make an update.zip flashable via

fastboot update'...

I've just come across a 3.2.6 link. ;)

No, I meant patching the standard Amazon one to always return success

when asked to check a signature, but [MENTION=5749760]ggow[/MENTION] made me less enthusiastic...:silly:
[Kindle Fire HDX 7" & 8.9" Android Development] draxie:
OK. So, the latest bootloader unlock really only saves us having to sign

each boot/recovery image; it does not open the way for messing with

the bootloader itself... a pity!

I'll look later if needed, but do we know what algorithms and implementation

SBL might use for verification?
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
I remember it been another 256 byte RSA signature, maybe it is susceptible to a variation of the forged signature exploit.
[Kindle Fire HDX 7" & 8.9" Android Development] draxie:
On another thought, who'd be silly enough to test such an exploit?

What remedies are left if aboot doesn't load? No fastboot, no recovery.

Pry open the device and hope to find JTAG pins?
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
I was thinking exactly the same thing :)
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
I have some doubt about what I read here on dtb.

From my experience I had with lantiq router and openwrt, bootloader don't know anything about devicetree.

Is the kernel itself that parse them.. however i'll check if I found reference in aboot.

4.5.2 kernel have changed a lot device/video/msm/* that's why panel section of dtb has changed so much.

On openwrt bootloader pass to kernel the hardware model string that should match with dtb.

I give a look on 4.5.2 aboot and panel init seems similar to 3.1.0. When we see kindle fire in gray and fastboot info.. we have panel ready. So is kernel that have problem.. see u later...

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
Well, the fact that the 4.5.2 stock update.bin from Amazon works on apollo, but when attempting to apply this update (minus the aboot) using the old bootloader, the panel does not appear to work, suggests to me that the bootloader is in fact involved in the issue here somehow. That doesn't mean that a kernel change won't fix the issue....it is definitely possible, but I was hoping it would be something in the dt, and as such have been spending way too much time making small alterations to that (to no avail thus far though).
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
4.5.2 bootloader:

additional oem command:

fastboot_register("oem enable-charger-screen", cmd_oem_enable_charger_screen);

fastboot_register("oem disable-charger-screen", cmd_oem_disable_charger_screen);

fastboot_register("oem select-display-panel", cmd_oem_select_display_panel);

more standard oem unlock

fastboot_register("oem unlock", cmd_oem_unlock);

Requirement boot.img for 4.5.2 bl:

1 - Wants QCDT header (so our images can't work on 4.5.2 yet even if we will sign it until we fix this)

2 - read following properties

board_prop = (const char *)fdt_getprop(dtb, root_offset, "qcom,board-id", &len_board_id); //DTB version2

plat_prop = (const char *)fdt_getprop(dtb, root_offset, "qcom,msm-id", &len_plat_id);

finally bootloader update cmdline with display configured (if fastboot oem select-display-panel)

and update_device_tree with boot args

and update device_tree into idme

LOOK AT devicetree/bindings/arm/msm/msm-id.txt

bootloader should pass to kernel the correct dt.

(I'll update later my analisys)

nice find:

<3>[ 0.662728] mdss_mdp_parse_bootarg: mdss_mdp_parse_bootarg:1502:cmdline panel not set disp_idx=[ (null)]
[Kindle Fire HDX 7" & 8.9" Android Development] p1gl3t:
The exact same thing got my interest and after going through the source code I managed to boot it with display output using this config

BOARD_KERNEL_CMDLINE := console=ttyHSL0,115200,n8 androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x37 ehci-hcd.park=3 mdss_mdp.panel=0:qcom,mdss_dsi_jdi_dualmipi0_video:1:qcom,mdss_dsi_jdi_dualmipi1_video:
BOARD_MKBOOTIMG_ARGS := --ramdisk_offset 0x01000000 --tags_offset 0x00000100

Forgot to mention that I am testing by fastbooting a TWRP recovery.img compiled from the OmniROM src.
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
really it works?

Great... you anticipated me... this night was too late to apply further testing...

what you are working to? I'm trying to get a working cm-11 for apollo starting from Cpasjuste tree.

Actually It build correctly but don't start yet...

PS: 4.5.3 is out... what we should download? fire_hdx_9inch_4.5.3.tar.bz2 or kindle_fire_hd_7inch_4.5.3.tar.bz2? inside kindle_fire_hd_7inch_4.1.1.tar.bz2 I found omap code :-/

diff between 4.5.2 and 4.5.3:

-<-><-->qcom,mdss-ib-factor-overlap = <7 4>;<-->/* 1.75 times */

+<-><-->qcom,mdss-ib-factor-overlap = <2 1>;<-->/* 2 times */

+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y

+CONFIG_USB_QCOM_MDM_BRIDGE=y

+<->{ USB_DEVICE_INTERFACE_NUMBER(0x1949, 0x9005, 3),

+<->.driver_info = (unsigned long)rmnet_hsic_bridge_names,

+<->},
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
I have a build of AOSP kitkat I have been unable to boot because of this issue. Will try it out later and let you guys know what happens.

Thanks p1gl3t, dpeddi
[Kindle Fire HDX 7" & 8.9" Android Development] p1gl3t:
I'm trying to boot a stock 4.5.2 for testing the CVE-2014-7911/CVE-2014-4322 exploits.
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
OT p1gl3t, ggow:

- What about OTG? Do you think we can get it working?

- What about port https://github.com/Tasssadar/multirom to our device? (I can't still understand if it needs otg) I think it might be really useful for development / testing og new firmware

---------- Post added at 03:18 PM ---------- Previous post was at 03:16 PM ----------

NICE: fire_hdx_9inch_4.5.3.tar.bz2 is linux 3.10 and should support apollo, thor and saturn!
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
I think we can get OTG working, the hardware certainly supports supply of voltage to the port. I also looked into multirom, all we need to do is implement kexec hardboot patch. OTG is not required for multirom but from what I read we may be able to boot optionally a rom off OTG connected USB stick (someone correct me if understood wrongly).
[Kindle Fire HDX 7" & 8.9" Android Development] Cpasjuste:
So [MENTION=5749760]ggow[/MENTION] is the boot cmdline trick working on appolo ? :)
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
I won't be able to try it until I'm home from work tonight, but will definitely let you all know :)
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
Recovery boot up with 4.5.2 3.4 kernel and p1gl3t cmdline all built from scratch

ggow:yours is better and not stretched like mine however i can start playing with...

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
[MENTION=438903]dpeddi[/MENTION] , [MENTION=503571]Cpasjuste[/MENTION]

Yes it works :)

I built from the 4.5.3 sources. I will post a new recovery image.
[Kindle Fire HDX 7" & 8.9" Android Development] Cpasjuste:
So cool, I'll finally get some help on cm :)
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
Yes, very cool :)

Will get myself set up properly with the latest CM sources, mine is out of date by miles now. Will re-sync it tomorrow when I have a better internet connection available.
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
[MENTION=438903]dpeddi[/MENTION], [MENTION=503571]Cpasjuste[/MENTION],

I think we can also boot lollipop now quite easily.
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
Did you manage to boot stock 4.5.2 yet?
[Kindle Fire HDX 7" & 8.9" Android Development] Cpasjuste:
At least I was not able to. There was some binaries incompatibility that prevented me to get it working (don't remember what was the problem/s but i did go deep) but who knows ..
[Kindle Fire HDX 7" & 8.9" Android Development] p1gl3t:
I was afk util now. I guess it should be straight forward, the only thing that I'm concerned about is the system_files_state.txt file and other integrity/version checks.

LE Only otaverifier.apk seems to be referencing system_files_state.txt.
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
uploaded kernel 3.10 https://github.com/KFireHDX/kernel_amazon_hdx-common/tree/amz-4.5.3_3.10.0
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
Bin incompatibility between what?

As said before amz release 3.10 for saturn.

We shoud download bin upgrade for saturn as well and boot apollo with 3.10 from scratch and saturn ko and so. (I haven't checked hardware difference between 2013 and 2014 model yet... so maybe it won't be possible)

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Android Development] ggow:
[MENTION=503571]Cpasjuste[/MENTION], I can't seem to sync my source's so far today. I think I'll have to do a complete resync as something seems to now be messed up in local repo. So much for good internet connection - hardly any bandwidth. I'll try overnight through my mobile phone.

[MENTION=438903]dpeddi[/MENTION], I'm going to start work on lollipop this evening as I already have a sync'ed set of sources in reserve. Will post source code when I have made progress.
[Kindle Fire HDX 7" & 8.9" Android Development] p1gl3t:
Done. Seems to be fine, but LTE might not work without updating the modem. Unfortunately I don't have a nano sim at hand other that the one that I received with the tablet. I am pretty sure that I was getting radio signal with that, even if it was in roaming, but now I only got a cross on the icon indicating no connectivity.
[Kindle Fire HDX 7" & 8.9" Android Development] dpeddi:
Avoid fw upgrade. .. the lte may have anti rollback tooo

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" Android Development] Cpasjuste:
Yep i noticed that !

I'm actually working on it for thor but did you guys fix the "label or path, 'fb_mem', not found" problem in dts compilation ? I think i fixed it in the past (well or not i don't remember it's now a lot of month back :)).
[Kindle Fire HDX 7" & 8.9" Android Development] p1gl3t:
That's why I didn't upgrade the modem. Maybe we can get away with swapping the ril so with the old one.
[Kindle Fire HDX 7" & 8.9" Android Development] gbgadgets:
Is this bootable version of 4.5.2 at a point it could be shared? I have attempted to install a modified 4.5.3.zip and am not getting past the splash screen. I am following this process to modify the 4.5.3 stock amazon update.bin:

-start with stock amazon update.bin

-delete files/folders that I do not want to flash (aboot, recovery, anti-rollback, etc);

-modify the updater-script (remove the modem update section, remove 3 files related to symlinking since I cannot locate them- see request thread in general section, remove the anit-rollback items);

-modify the boot.img (decompile, break apart the dt.img into the header and 3 dtb files, then delete the dt.img, and append the 3rd dtb entry to the zImage, modify the kernel commandline for the panel info, recompile the boot.img and sign with cuber);

-zip the modified update.bin and install in latest twrp;

This boots past the grey logo to the one with the animated boot image, but does not proceed.

adb logcat attached.

If you could post or send directly the working 4.5.2 you have going....that would be awesome. If not, I understand. I know others are working on cm11, cm12, aosp, etc, but I like fire os to a certain degree but would just like full gapps, store, and root on it.