CM10 development for Kindle Fire HD 8.9"

Search This thread

esox_hu

Senior Member
Dec 16, 2010
51
4
N7 vs KFHD

Just to clear this up.
I do not have Kindle Fire HD 7" and so I cannot try.
We've got a volunteer to try this at irc and bootloader unlock works the same way (as expected, but you need a different bootloader binary).
We were not able to get anything to show up on the screen after booting CM10, thought it appears the OS boots and behaves fine, backlight is on too.

Anyway, I'd much rather prefer people to buy Nexus 7, it costs the same as Kindle Fire HD 7, but is a much more open device with much more developer support.
If you need CM10 and further, get Nexus 7 and you'll be soo much more happier. You still can run kindle app on it to read your books if you so desire.

With this out of the way, let's not touch on the 7" device topic here anymore, it's for 8.9" development discussion only. Thank you for your understanding.

I thought its a Kindle Fire (escpecially 8.9") topic not a Nexus 7 which i also have. I know how easy to do anything i want, but KFHD much prettier device. I used to have the "old" Kindle Fire that support cm10... so this is why I presume to ask, but you're guys right buy a nexus 7.
 

urboy4mbx

Senior Member
Oct 13, 2010
96
9
New York
Does anyone know if kindle lending library, movies, etc. works with CM10?

I would test it myself but I am still waiting for mine to arrive.
 

bqq100

Senior Member
Mar 19, 2010
99
15
Virginia
Can someone help a dummy like me understand how this exploit works? :confused: Whats special about the 4kB of 0x00507c80 in the middle of the system partition? And what does the 3 at 4104 of the boot partition do? Once CWM is loaded, does that eliminate the need for modifying the system/boot partition, or does something in verygreens device tree/local_manifest take care of adding the necessary code for every build?

Thanks!
 

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
Can someone help a dummy like me understand how this exploit works? :confused: Whats special about the 4kB of 0x00507c80 in the middle of the system partition? And what does the 3 at 4104 of the boot partition do? Once CWM is loaded, does that eliminate the need for modifying the system/boot partition, or does something in verygreens device tree/local_manifest take care of adding the necessary code for every build?

0x807c5000 is the address where our replacement bootloader is loaded.

Boot partition is used by amazon uboot to get various properties like serial number of device, wifi mac and what partition to boot from.
1 is normal boot, 3 - recovery, 2 - diagnostic kernel (don't boot it if you don't know what you are doing), 5 and 6 are boot from USB.

the need to load uboot address is never disappearing, but updater-script in the install zip takes care of that.
 
Last edited:
  • Like
Reactions: bqq100

bqq100

Senior Member
Mar 19, 2010
99
15
Virginia
0x807c5000 is the address where our replacement bootloader is loaded.

Boot partition is used by amazon uboot to get various properties like serial number of device, wifi mac and what partition to boot from.
1 is normal boot, 3 - recovery, 2 - diagnostic kernel (don't boot it if you don't know what you are doing), 5 and 6 are boot from USB.

the need to load uboot address is never disappearing, but updater-script in the install zip takes care of that.

Thanks verygreen! Couple of add-on questions: Why do you need such a long string repeating the memory address? Is that the part that exploits the bug that fattire found in the stock uboot? 0x807c5000 would be 2GB into storage, wouldn't that be in the userdata partition? Does the updater-script in the install zip also take care of making sure that the custom uboot gets put at the correct address?

Really appreciate the help!
 

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
Thanks verygreen! Couple of add-on questions: Why do you need such a long string repeating the memory address? Is that the part that exploits the bug that fattire found in the stock uboot? 0x807c5000 would be 2GB into storage, wouldn't that be in the userdata partition? Does the updater-script in the install zip also take care of making sure that the custom uboot gets put at the correct address?
Repetitions of the addresses is because we don't really know exact location of the return address, and yes, that's part of the fix for the bug fattire have identified.
Regarding offsets, I think your math is off, it's just a dozen megabytes into /system.
The updated boot.img is already generated to contain uboot at the correct address, so the only job left for the installer script is to write it in place.
 
  • Like
Reactions: bqq100 and fattire

Troupster

Member
Sep 10, 2012
47
13
Repetitions of the addresses is because we don't really know exact location of the return address, and yes, that's part of the fix for the bug fattire have identified.
Regarding offsets, I think your math is off, it's just a dozen megabytes into /system.
The updated boot.img is already generated to contain uboot at the correct address, so the only job left for the installer script is to write it in place.

Is there any way I can assist you in developing this faster?

I just ordered a KF HD 8.9, and would love CM10 on it.
 

bqq100

Senior Member
Mar 19, 2010
99
15
Virginia
Repetitions of the addresses is because we don't really know exact location of the return address, and yes, that's part of the fix for the bug fattire have identified.
Regarding offsets, I think your math is off, it's just a dozen megabytes into /system.
The updated boot.img is already generated to contain uboot at the correct address, so the only job left for the installer script is to write it in place.

Thanks!
 

verygreen

Senior Member
Feb 13, 2011
1,305
2,637
TN
linuxhacker.ru
Is there any way I can assist you in developing this faster?
Sure, download the source and submit patches?

Yes.

Maybe Hashcode could help us out as I know he has a lot of experience with TI hw.
Last I heard he got KFHD8.9 a few days ago. I imagine he's not planning to use it as a bookreader ;)
 

timnan

Senior Member
Aug 31, 2008
76
7
I am not familiar with dev. While I think there might be some difficulties on kindle hd 8.9 as it could be difficult to find drivers for this particular device and it is also actually slow to have a cm 10 available currently. So is it easier if we start a dev from cm9 which is ICS same as the system buildin?



Sent from my KFJWI using Tapatalk 2
 

Top Liked Posts

  • There are no posts matching your filters.
  • 27
    Development for the KFire HD 8.9 is progressing rather nicely to my point of view. I just haven't released anything yet. :)

    I'm working on Android 4.2.1. And the kernel is fully migrated to 3.0.50 (which matches AOSP kernel/common)

    Right now I have display running a newer version of the gfx blit system + powervr libs built for jellybean, bluetooth, hw accelleration, and sensors.

    I'm currently updating the wifi driver to match AOSP, and then I need to troubleshoot codecs/camera, graphics memory allocation and audio.

    Almost every facet of the device is running updated drivers.

    Sent from my DROID RAZR HD using Tapatalk 2
    25
    Hi all!

    Without much ado I am presenting you this repo for CM10 that lets you build somewhat functional CM10 ROM for Kindle Fire HD 8.9".
    (Obviously this is not end-user friendly yet. If you don't know how to compile CM10 yourself, you are not a target audience for this yet, sorry. Many things don't work to make it viable main ROM yet anyway)

    Build instructions (assuming you met all other CM10 build dependencies).
    Download code:
    Code:
    mkdir android/system
    cd android/system
    curl https://dl-ssl.google.com/dl/googlesource/git-repo/repo > ~/repo
    chmod a+x ~/repo
    repo init -u git://github.com/CyanogenMod/android.git -b jellybean
    wget -O .repo/local_manifest.xml https://github.com/verygreen/android_manifests/raw/master/bowser-jb/local_manifest.xml
    repo sync -j16

    Build:
    Code:
    . build/envsetup.sh
    lunch cm_bowser-userdebug
    . vendor/cm/get-prebuilts
    mka bacon

    In the out/target/product/bowser output dir you'll have two important files generated:
    recovery.img and cm-10-XXXXXXXX-UNOFFICIAL-bowser.zip

    For the first install only:
    Step 0; Connect kindle to your computer, have android sdk installed and adb and fastboot in the path.
    Step 1: (very important) Back up raw partitions from kindle responsible for recovery, boot and system.
    (this requires root, though root-less installation is also possible, you will need the backups to return to stock!)
    Code:
    adb shell su -c "chmod 777 /dev/block/*"
    adb pull /dev/block/mmcblk0p9
    adb pull /dev/block/mmcblk0p10
    adb pull /dev/block/mmcblk0p11
    [code]
    Save these block images.
    Step 2: Prepare and run CWM:
    [code]
    rm -f /tmp/stack; for i in $(seq 1024) ; do echo -ne '\x00\x50\x7c\x80' >>/tmp/stack ; done
    adb push /tmp/stack /data/local/tmp/
    adb shell su -c "dd if=/data/local/tmp/stack of=/dev/block/platform/omap/omap_hsmmc.1/by-name/boot bs=6519488 seek=1"
    adb shell su -c "chmod 777 /cache"
    adb push /path/to/cm-10-XXXXXXXX-UNOFFICIAL-bowser.zip /cache/
    adb shell su -c "echo 0 > /sys/block/mmcblk0boot0/force_ro"
    adb shell su -c "echo -n 3 | dd of=/dev/block/mmcblk0boot0 bs=1 count=1 seek=4104"
    fastboot flash recovery /path/to/recovery.img  -i 0x1949
    This last command will stop waiting for the fastboot device to appear. Do not unplug the kindle from USB.
    Now reboot kindle: either power it off and on via it's GUI, or do adb reboot from a different terminal session (do not interrupt fastboot command still waiting!)
    You'll see a "fastboot mode" on the screen and fastboot command started earlier will finally finish after writing the image onto the kindle.
    Reboot kindle again via fastboot:
    Code:
    fastboot reboot -i 0x1949
    This will reboot you into CWM recovery
    Step 3: In CWM recovery, do install from sdcard and install the cm-10...zip file we transferred in the previous step.
    the /data/ settings from stock amazon install are not compatible with CM10, but (very important)Do not reformat /data/ and /cache from CWM, this will result in a corrupted filesystem due to 3.0.21 kernel currently used by amazon not having necessary fs features!!!
    Instead, clean /data via adb while booted to CWM:
    Code:
    adb shell "mount /data"
    adb shell "rm -r /data/*"
    Step 4: Now, installation is complete, you may reboot and it will bring you to your freshly-installed CM10 - enjoy.
    (note by default this CM10 install starts with adb disabled, so you'll need to enable it in settings again).

    How to reflash back to stock
    Step 1: Remember where did you put those backups from step 1 during install.
    Step 2:
    Code:
    fastboot flash recovery /path/to/mmcblk0p9 -i 0x1949
    Now either connect a powered off kindle, or reboot an already connected kindle.
    (note: I don't remember if stock rom is smart enough to wipe /data in this case or if it bootloops, so you might want to do rm -r /data/* before the final reboot)
    once Kindle enters fastboot mode and recovery image is written, write the other two images too:
    Code:
    fastboot flash boot /path/to/mmcblk0p10 -i 0x1949
    fastboot flash system /path/to/mmcblk0p11 -i 0x1949 # This one will take a few minutes
    fastboot reboot -i 0x1949
    Now you are back to factory stock.

    Not so short video on the install starting from somewhere around step 3 for those who cannot perform the steps, but need to ensure this ROM is not for them yet:

    Many things don't work yet:
    - Sound
    - Video playback
    - Sensors (no rotation)
    - Camera
    - BT
    - probably some other stuff I have not noticed yet.

    Please do send in your patches/fixes.
    12
    from hashcode@twitter, seems that everything else is good to go now except audio.

    https://twitter.com/Hashcode0f/status/291949787551518720

    @klescuts soon as I get audio working, ill release cm10.1 for KDHD8.9
    11
    I've decided to release my current 2nd-bootloader setup + CM10.1 ROM even though the audio is not working yet.

    You can find all of the information in these 2 threads:

    2nd-bootloader install for coming from Amazon stock OS:
    http://xdaforums.com/showthread.php?t=2128175

    CM10.1 ROM for install in custom recovery:
    http://xdaforums.com/showthread.php?t=2128201

    Enjoy and please read through the OP's before starting the installs.
    11
    Not to be a bother, but has any more progress been made? I realize that these sorts of things take time, but even the slightest news of progress would be nice.

    Process is being made. Trust me, it'll be worth the wait.

    If you are a Kindle Fire 2 owner, don't think we forgot about you!