[GUIDE][OREO][8.x] How to modify Oreo kernels to support DualBoot Patcher

[haoyangw]

The Problem
TLDR: In Oreo ROMs, i.e. Android 8.0/8.1, DualBoot Patcher no longer works, as patched ROMs/kernels will get stuck on Android logo screen(for the Axon 7, it's the 'ZTE, POWERED BY android' screen), and never boot up.

In Oreo(Android 8.0/8.1), Google introduced a new function to fstab, which is early mounting specific partitions. The purpose was so that Android can boot up faster, by ensuring that essential partitions like /system and /vendor are mounted first and the boot process will not be held back by delays in non-essential things like setting up apps. More details can be found here. So the important changes that affect DualBoot Patcher are: 1) There's an important file 'fstab.qcom', which lists all the partitions that Android can use, that got shifted from the '/' directory(the root partition/ramdisk, Android 7.x and below) to the '/system/vendor/etc' directory(in Android 8.x) 2) In addition, another file 'init.qcom.rc', once found in the '/' directory too(in Android 7.x and below), is now shifted to '/system/vendor/etc/init/hw' directory(in Android 8.x) 3) Because of 1), 'init.qcom.rc' now believes that 'fstab.qcom' is in '/system/vendor/etc' and not '/', and so it asks Android to read 'fstab.qcom' from '/system/vendor/etc' 4) In the 'fstab.qcom' file, there are entries for all partitions except /system(and /vendor for Treble devices). For these 2 partitions, they are now found in the dtb(short for Device Tree Binary). How does this affect DualBoot Patcher? 1) DualBoot Patcher expects that 'fstab.qcom' is still in '/' directory(correct me if I'm wrong), so it fails to find this file in Android 8.x ROMs/kernels 2) DualBoot Patcher expects that '/system' is still defined in 'fstab.qcom', which is not the case. Below are the exact changes that Google made(in the case of our Axon 7), note the red parts(the changes):
fstab.qcom(the strike means those lines are now removed/gone)

/dev/block/bootdevice/by-name/recovery      /recovery      emmc      defaults      defaults
[STRIKE][COLOR="red"]/dev/block/bootdevice/by-name/system      /system      ext4      ro,barrier=1,discard      wait[/COLOR][/STRIKE]

init.qcom.rc

on fs
  wait /dev/block/platform/soc/${ro.boot.bootdevice}
  symlink /dev/block/platform/soc/${ro.boot.bootdevice} /dev/block/bootdevice

  mount_all [COLOR="Red"]/vendor/etc/fstab.qcom[/COLOR]

dtb(converted into dts with dtc)

fstab {
    compatible = "android,fstab";

    vendor {
        compatible = "android,vendor";
        dev = "/dev/block/platform/soc/7464900.sdhci/by-name/vendor";
        type = "ext4";
        mnt_flags = "ro,barrier=1,discard";
        fsmgr_flags = "wait";
        status = "disabled";
    };

    [COLOR="red"]system {
        compatible = "android,system";
        dev = "/dev/block/platform/soc/624000.ufshc/by-name/system";
        type = "ext4";
        mnt_flags = "ro,barrier=1,discard";
        fsmgr_flags = "wait";
        status = "ok";
    };[/COLOR]
};

The Solution
There are 3 changes to make for each ROM/kernel: 1) Edit fstab.qcom, dtb and init.qcom.rc 2) Add fstab.qcom and init.qcom.rc back into the ramdisk(i.e. edit the ramdisk) 3) Delete '/system/vendor/etc/fstab.qcom' and '/system/vendor/etc/init/hw/init.qcom.rc'. There are 2 ways you can do this, either manually, or with my script(Work in progress, my sincere apologies)
Method 1: Manually modify ROM and kernel

Files you will need:
Note: the 'files.zip' attached below contains 'dtc', 'magiskboot', 'mkbootimg', 'unpackbootimg'. Extract it to get these files. Feel free to scan them for viruses, I assure you they are clean and not viruses for sure
- boot.img you want to patch
- init.qcom.rc, fstab.qcom from the ROM you are patching
- magiskboot binary(found in /data/magisk or /data/adb/magisk if you installed magisk, otherwise download the one attached below)
- dtc binary(download the one attached below)
If you are patching Hellsgate or Schwifty, you also need:

- unpackbootimg, mkbootimg(attached below)
- Image.gz-dtb(from the flashable zip of the kernel)
Note: You also need a boot.img, but this will be from the ROM you are flashing/have flashed(extract from the ROM zip)

Preliminary step: Prepare the files
- Before you start, I would recommend copying all the files into a directory where you can chmod/execute binaries. I personally recommend '/data/local/tmp', or '/cache'(anywhere in /cache is fine). The guide below assumes that all these files are in the same directory. Also, chmod all the binaries, for example, do this in your working directory:

chmod 0755 *

- Also, I would recommend backing up 'fstab.qcom' and 'init.qcom.rc'
Additional Step: If you wish to patch kernels like Hellsgate and Schwifty

- First, unpack your ROM's stock kernel:

./unpackbootimg -i boot.img

- Then, repack the kernel as a Hellsgate/Schwifty kernel:

./mkbootimg --kernel Image.gz-dtb --ramdisk boot.img-ramdisk.gz --cmdline "androidboot.hardware=qcom user_debug=31 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 [email protected] androidboot.selinux=permissive buildvariant=userdebug" --base 80000000 --pagesize 4096 --kernel_offset 00008000 --ramdisk_offset 01000000 --second_offset 00f00000 --tags_offset 00000100 --os_version 8.1.0 --os_patch_level [COLOR="red"]2018-06[/COLOR] --hash sha1 --output ./boot-new.img

- Note: For the red part in the above command, adjust for the month that your desired kernel is released. E.g. If your desired kernel was released in 2018 June, you put '2018-06', while if it was released in 2018 July, you put '2018-07', and so on.
- From now on, take note that everytime I mention 'boot.img', for you, it will be 'boot-new.img'(I'll bold each one that you have to change to 'boot-new.img')
Step 1: Unpack the boot.img

./magiskboot --unpack [COLOR="red"]boot.img[/COLOR]

- Now you get 3 additional files: 1) kernel(not editing this) 2) ramdisk.cpio(gonna edit this) 3) dtb(also editing this)
Step 2: Decompile the dtb
Note: dtb is a BINARY so don't open it with a text editor

./dtc -I dtb -O dts -o dt.txt dtb

- Another note: It will probably give you a lot of warnings, but it's harmless so just ignore them(I've edited multiple kernels and tested them myself, no bugs so far)
Step 3: Edit the decompiled dts
- Open the created 'dt.txt' with a root text editor(I use Simple Explorer, you can use FX file explorer, or ES file explorer)
- Search for this word:

/system

. You should find this line:

dev = "/dev/block/platform/soc/624000.ufshc/by-name/system";

- Remove the entire chunk quoted below:

system {
    compatible = "android,system";
    dev = "/dev/block/platform/soc/624000.ufshc/by-name/system";
    type = "ext4";
    mnt_flags = "ro,barrier=1,discard";
    fsmgr_flags = "wait";
    status = "ok";
};

- Take note that you will have to remove 1 '};'(at the bottom of the above quote), nothing more, nothing less
Step 4: Recompile the dtb

./dtc -I dts -O dtb -o dtb1 dt.txt

- Again, it might give you a lot of warnings but just ignore them
- Also, rename the new dtb so that magiskboot will compile this new dtb into your modified kernel:

mv dtb dtb.bak

mv dtb1 dtb

Step 5: Edit fstab.qcom
- Open 'fstab.qcom' file with a root text editor
- Add the following red line, below the line about '/recovery', above the line about '/data':

/dev/block/bootdevice/by-name/recovery      /recovery      emmc      defaults      defaults
[COLOR="red"]/dev/block/bootdevice/by-name/system      /system      ext4      ro,barrier=1,discard      wait[/COLOR]

/dev/block/bootdevice/by-name/userdata /data f2fs nosuid,nodev,noatime,nodiratime,data_flush wait,check,encryptable=/dev/block/bootdevice/by-name/cryptkey,quota,formattable[/CODE]
- Save the 'fstab.qcom' file
Step 6: Edit init.qcom.rc
- Open 'init.qcom.rc' with a root text editor
- Look for this line:

mount_all /vendor/etc/fstab.qcom

- Change it into this line:

mount_all [COLOR="red"]/fstab.qcom[/COLOR]

- Save the 'init.qcom.rc' file
Step 7: Modify kernel ramdisk
-First do:

./magiskboot --cpio ramdisk.cpio 'add 0640 fstab.qcom fstab.qcom'

- Then do:

./magiskboot --cpio ramdisk.cpio 'add 0750 init.qcom.rc init.qcom.rc'

Step 8: Create a new, DBP-compatible boot.img

./magiskboot --repack [COLOR="red"]boot.img[/COLOR]

- You will get a new boot.img, named 'new-boot.img'
Step 9: Install the modified kernel
- First, flash the boot.img(using TWRP or Flashify or another tool)
- Then, delete these 2 files:

/system/vendor/etc/fstab.qcom

and

/system/vendor/etc/init/hw/init.qcom.rc

- Note: Make sure you do not reboot after installing boot.img and before deleting the above 2 files
That's it! If you completed all the steps above properly, you should have a working DBP-compatible boot.img that you can put in a flashable zip and patch with DualBoot Patcher
if you don't know how to make a flashable zip to install your modified boot.img, you can use the one I attached below(named 'flashable-kernel-template.zip'). What you have to do is download it, then extract it and make a new zip containing your modified boot.img(basically, create a new zip with the 'META-INF' folder from my zip and your 'boot.img'. The zip automatically deletes

/system/vendor/etc/fstab.qcom

and

/system/vendor/etc/init/hw/init.qcom.rc

so you won't need to do this yourself
Note: If you are using my flashable zip, note that you have to rename your modified 'new-boot.img' to 'boot.img' before you compress it into a new flashable zip. Otherwise you will get an error when flashing in recovery
Note 2: Avoid using the flashable zip template for non-modified kernels, it can render your ROM unable to boot!

Method 2: Work in Progress

Method 2: Use my automated script

Please do leave feedback on whether this guide is clear, and also if any of the steps are not working for you! Happy Dualbooting
Sources:
Github Problem Discussion
Problem Solution

 

[haoyangw]

Reserved 1

 

[haoyangw]

Reserved 2

 

[Infy_AsiX]

This is going to be useful. Personally I just want to run custom O as primary and N as a secondary. Mainly because O doesn't have properly working Daydream and for a couple of games that aren't compatible anymore with O. If I'm only trying to attach LOS14.1 as secondary I wouldn't need to patch anything extra O from this guide? Though I can't install the patched ROM it gives an error.

Edit: Oops missed reading from the old guide the primary ROM needs to be stock. I guess I need to patch then. Do I need Linux to do all the editing?

 

[haoyangw]

This is going to be useful. Personally I just want to run custom O as primary and N as a secondary. Mainly because O doesn't have properly working Daydream and for a couple of games that aren't compatible anymore with O. If I'm only trying to attach LOS14.1 as secondary I wouldn't need to patch anything extra O from this guide? Though I can't install the patched ROM it gives an error.

Edit: Oops missed reading from the old guide the primary ROM needs to be stock. I guess I need to patch then. Do I need Linux to do all the editing?

Actually yeah, if your custom O is primary you don't need to patch it(the kernel, I mean)! You still need to patch the ROM so that it doesn't wipe /system when you OTA update your custom O, which means you need an unpatched custom O stock kernel flsshable zip(sorry for the mouthful). But if you don't OTA update then no need The last I tried, using stock ROM as secondary worked for me though? Didn't find any issues. But I might just be lucky, be careful if you try that.
As for your last question, nope all these commands are meant for Terminal Emulator app on an Android phone! Just use the binaries in the attached files.zip, they are all compiled for Android and do not work on Linux desktops. All the best If you need help just ask here!

 

[Infy_AsiX]

Actually yeah, if your custom O is primary you don't need to patch it(the kernel, I mean)! You still need to patch the ROM so that it doesn't wipe /system when you OTA update your custom O, which means you need an unpatched custom O stock kernel flsshable zip(sorry for the mouthful). But if you don't OTA update then no need The last I tried, using stock ROM as secondary worked for me though? Didn't find any issues. But I might just be lucky, be careful if you try that.
As for your last question, nope all these commands are meant for Terminal Emulator app on an Android phone! Just use the binaries in the attached files.zip, they are all compiled for Android and do not work on Linux desktops. All the best If you need help just ask here!

Figured out the error after dual boot patch on LOS14.1 was my mistake in modifying the update-script incorrectly. Nothing to do with N/O/this guide. However now I tried installing it to data slot so dirty flashing and restoring the system partition won't be complicated. The issue is trying to boot primary it vibrates five times at ZTE logo and goes to recovery. Trying to switch to primary in dualbootutilities gives an error something like (from memory) data/media/0/boot.img cannot be found. I guess DBP installed even on data changes the structure of boot and primary on O doesn't fit so can't boot. Just want your advice, it probably means patching O when O is primary is necessary then?

 

[haoyangw]

Figured out the error after dual boot patch on LOS14.1 was my mistake in modifying the update-script incorrectly. Nothing to do with N/O/this guide. However now I tried installing it to data slot so dirty flashing and restoring the system partition won't be complicated. The issue is trying to boot primary it vibrates five times at ZTE logo and goes to recovery. Trying to switch to primary in dualbootutilities gives an error something like (from memory) data/media/0/boot.img cannot be found. I guess DBP installed even on data changes the structure of boot and primary on O doesn't fit so can't boot. Just want your advice, it probably means patching O when O is primary is necessary then?

Oh you mean you flashed custom O, and after that you flashed you N data slot ROM? You're partially right, if you flash your data slot ROM after a non-patched ROM, you'll have the data slot kernel installed i.e. the LOS 14.1 stock kernel, which cannot boot an O ROM. This is because DBP works by storing multiple kernels on your /data/media/0/Multiboot folder, when you 'switch ROMs' actually what happens is DBP flashes the kernel of the ROM you're switching to. Obviously a N kernel cannot boot an O ROM so you cannot boot. Unfortunately, DBP only stores kernels that you flash with patched zips(i.e. if you flash a DBP-patched ROM/kernel zip, only then will DBP store the kernel in its custom Multiboot folder). So because you didn't patch your O primary ROM, its kernel is not saved and you cannot use DBPUtilities. What you can do is either make your own non-patched kernel zip file for your O ROM's stock kernel that you flash everytime you want to switch to primary, or you patch your primary ROM and then you can use DBPUtilities. However B01 kernel has a slightly different precedure for adding DBP support that this guide doesn't explain(I'm sorry) I'll update it when I find time. Don't follow this guide to patch B01! It won't boot, I tried But I know what changes to make when modifying a B01 kernel don't worry

 

[Infy_AsiX]

lost this post when I pressed reply. This RR-O Kranoner 20180511 has the fstab.qcom and init.qcom.rc still on root / directory. But patching only DBP patching hellsgate kernel after having LOS14.1 on data slot 1 still has the same issue. Alternatively installing the mod boot.img allows primary to boot but after using DBP utilities to switch to data slot 1 (onscreen says success) the data slot 1 gets stuck on ZTE logo with 5 vibrates instead. Even tried flashing the final Beastmode 14.1 kernel DBP patched to data slot 1 after switched, five vibrates to recovery.

Lost Magisk install after step nine. Just reinstalling it is fine. Did you forget the flashable zip template by the way?

 

[haoyangw]

lost this post when I pressed reply. This RR-O Kranoner 20180511 has the fstab.qcom and init.qcom.rc still on root / directory. But patching only DBP patching hellsgate kernel after having LOS14.1 on data slot 1 still has the same issue. Alternatively installing the mod boot.img allows primary to boot but after using DBP utilities to switch to data slot 1 (onscreen says success) the data slot 1 gets stuck on ZTE logo with 5 vibrates instead. Even tried flashing the final Beastmode 14.1 kernel DBP patched to data slot 1 after switched, five vibrates to recovery.

Lost Magisk install after step nine. Just reinstalling it is fine. Did you forget the flashable zip template by the way?

Oh hmm did you install the right version of Hellsgate for your data slot 1? I think LOS 14.1 needs a very old version(R2.1? I think). I'm not sure about beastmode kernel though, I'm sorry And thanks for the reminder about the zip template, o dear I forgot about it I'll upload it now!

 

[Infy_AsiX]

Oh hmm did you install the right version of Hellsgate for your data slot 1? I think LOS 14.1 needs a very old version(R2.1? I think). I'm not sure about beastmode kernel though, I'm sorry And thanks for the reminder about the zip template, o dear I forgot about it I'll upload it now!

Sorry that post was worded poorly due to rushed recalling. I meant RR-O primary had Hellsgate kernel patched by this guide, which shouldn't be necessary as the two issue ROM files are still on root directory (patching with DBP instead didn't work as I posted before)? Still had to install the mod boot.img to manage to boot but then data slot 1 LOS14.1 won't boot. I was going to try patching with this guide the kernel I intend for LOS14.1 but it's lacking the image.gz-dtb file, I'd only patched it with DBP and that should be enough as it's an N ROM. I guess I could use an older hellsgate suited to N but Beastmode was updated til a little later so I'd prefer it.

Thanks for the zip template. Just checking, it's not actually needed if I can just install the modded boot.img directly in TWRP anyway?

 

[haoyangw]

Sorry that post was worded poorly due to rushed recalling. I meant RR-O primary had Hellsgate kernel patched by this guide, which shouldn't be necessary as the two issue ROM files are still on root directory (patching with DBP instead didn't work as I posted before)? Still had to install the mod boot.img to manage to boot but then data slot 1 LOS14.1 won't boot. I was going to try patching with this guide the kernel I intend for LOS14.1 but it's lacking the image.gz-dtb file, I'd only patched it with DBP and that should be enough as it's an N ROM. I guess I could use an older hellsgate suited to N but Beastmode was updated til a little later so I'd prefer it.

Thanks for the zip template. Just checking, it's not actually needed if I can just install the modded boot.img directly in TWRP anyway?

Oh you're right, if the 2 files are still present you don't have to patch using this guide. Just checking, what version of hellsgate are you using for primary? And yes you're right! N ROMs/kernels don't have to be patched with this guide for DBP I'm not very sure why you can't boot and get the 5 led flashes though
As for your last question, you're right no need this zip in you install using TWRP.

 

[Infy_AsiX]

Oh you're right, if the 2 files are still present you don't have to patch using this guide. Just checking, what version of hellsgate are you using for primary? And yes you're right! N ROMs/kernels don't have to be patched with this guide for DBP I'm not very sure why you can't boot and get the 5 led flashes though
As for your last question, you're right no need this zip in you install using TWRP.

The last B32+10 hellsgate v3.0. Dunno but the guide did manage to allow primary to boot whereas it wouldn't before. Both N hellsgate and beastmode are lacking the image.gz-dtb so I can't patch them. I guess I'll try stock next, I really wanted KCAL to use on Daydream tho ::crying:. If that fails I might try stock N as primary when I'm about to clean flash update O.

 

[haoyangw]

The last B32+10 hellsgate v3.0. Dunno but the guide did manage to allow primary to boot whereas it wouldn't before. Both N hellsgate and beastmode are lacking the image.gz-dtb so I can't patch them. I guess I'll try stock next, I really wanted KCAL to use on Daydream tho ::crying:. If that fails I might try stock N as primary when I'm about to clean flash update O.

Oh dear I'm sorry to hear Just checking are you using LOS 14.1 builds from 2018? I might know what's wrong

 

[Infy_AsiX]

Oh dear I'm sorry to hear Just checking are you using LOS 14.1 builds from 2018? I might know what's wrong

yeah latest official

Sent from my Xperia Z3C using XDA Labs

 

[haoyangw]

yeah latest official

Oh I probably should add this in the OP, Nougat builds with 2018 Security patch level behaves the same way as Oreo ROMs, they also have the init.qcom.rc and fstab.qcom in /system. So I would believe that latest LOS 14.1 also needs the exact same patching method as Oreo(if you can check and confirm this that'll be great). I haven't analysed the Nougat hellsgate and beastmode kernels so I'm not sure how to patch them, I'll let you know asap when I find out something. Sorry about the mistake, I didn't realise there's still a Nougat ROM being regularly updated

 

[Infy_AsiX]

Great thanks for the guide and mods. Sorry for the late follow up, it did take awhile to get working. After some confusion and trouble with figuring out how some O ROMs still don't use the early mount method. While N ROM and kernels don't in fact need patching by this guide. Also B12 can't be dual booted with any N ROMs due to bootstack incompatibility (flashing bootstack after a DBP install doesn't seem to take effect to help). My target kernel was Hellsgate 3 for B32+10, which oddly needed fstab.qcom modded per guide but not init.qcom.rc all despite the kernel being for non early mount ROMs. Yes really, after all of that figured out, I got it working!

I'm glad to report it works as intended with the right setup. Now with B12 ROMs currently all affected by the wired audio cpu extra 50% load bug, using B32+10 is a working fallback. The trade off being apparently dual-sim issues (reported by some as present, some not), no GCam HDR support and improper hi-res audio support (though hi-fi DAC was already working and hi-res is debatably useless). In any case if dual booting O with N is desired B32+10 is the latest supported available with above stated differences. This is the only way presently for using a stable-ish O ROM and N's fully functioning Daydream and a couple of AAA games deprecated after N such as Fahrenheit: Indigo Prophecy and Jade Empire. Now I can also play around testing Kranoner's N Vertex EAS supported ROM and kernel.

I've attached the B32+10 Hellsgate 3 modded per this guide using Kranoner's 180511 RR-O for anyone interested in getting it straight working without the mess. A few pointers. The zip still needs needs to be patched to primary/secondary/whatever chosen slot before use. Magisk has to be reinstalled after installing the modified kernel, primary Magisk zip does not need DB patching. Using secondary slot, to fill up like huge wasted space 6GB system partition is smart if you're not installing many apps.

Sent from my ZTE Axon 7 using XDA Labs

 

[chaopac]

////[removed]////

 

[PizzaG]

Tried this with my device and it didn't work. Alcatel Tetra with 8.1 Stock. Runs GSI images up to 10. MT6739 SOC. Doesn't boot if you simply remove the entry. Couldn't even change ro to rw and have it boot. I was able to remove verify and that was about it. I was able to get the fstab and init file migrated back to ramdisk and it booted once i modified the init file to point to the right locations. I got DBP supporting my treble device properly. The last step is to figure out how to disable/remove the system early mount. This topic seems dead but I figure it's worth a try. I've been working on this Project on and off for 2+ months now and would really like to hit paydirt.

 

[mrrocketdog]

you do realize this is an Axon7 thread , yes?

 

[LgPWN'd]

you do realize this is an Axon7 thread , yes?

I'm Sure he's not lost .
U realize this is a place Dev's take ideas from each other and try to port it to other devices Right?