[INFO] Nexus 5 booting kernel 4.11

[scholbert]

Hi,

i just wanted to give some information on my latest attempts to boot kernel 4.11 on the Nexus 5.
This is just for fun or at least a proof of concept to boot mainline kernel.
Have a look at bootup text file attached to this post.

You may first see my other post here:
https://forum.xda-developers.com/showpost.php?p=72681973&postcount=13

As i already stated this "project" is of no real practical use, other then learning about latest kernel and getting used to DTS files.
Many parts are missing and booting into Android would be a very dusty and rocky road... it is more that this will never happen!

Anyway i decided to switch to kernel 4.11, as there'd been some improvements on some SoC internals (e.g. USB).
So i took this kernel:
https://git.linaro.org/landing-team...shot/kernel-release/db820c/qcomlt-4.11.tar.gz

After some first tests i decided to check out more options in the kernel config file to get little nearer to the 3.4 kernel config we all know.
You'll find the config file below.

In order to do some testing easily i decided to use TWRP recovery as an initrd here.
To make it more handy i simply added a service to get a console shell.
In other words, there's busybox and some other tools to examine the system.

The image uses the serial debug console as the user interface.
To interact with the system you'll need an earjack debug adapter.
See the image (debug_3.5mm.jpg) for some information... or search the web.

To boot the image, unzip hammerhead-4.11.zip go into bootloader mode and use fastboot:
fastboot boot hammerhead-4.11.img

EDIT: Updated the attachments, as there'd been some progress (see post #7).

EDIT2: YAU (Yet Another Update)

Have fun!

scholbert

 

[95A31]

Nice job!

Some time ago I tried to build from scratch 3.10 kernel, you can find the code here.

From the log look like that the internal memory is missing, maybe due incomplete device tree entry. The related documentation should be this.

 

[scholbert]

Hi 95A31!

Nice job!

Some time ago I tried to build from scratch 3.10 kernel, you can find the code here.

From the log look like that the internal memory is missing, maybe due incomplete device tree entry. The related documentation should be this.

Thanks for your reply. Any hints and ideas are higly appreciated
Basically the sdhc entries look o.k. to me.
I already compared many parts of the DT entries in kernel 4.11 with the ones in kernel 3.4 as well (and yes they slightly changed their style).

There might be some issues with DT in general here, but i suspect some basic stuff is missing to initiate the power supply (PM8841 & PM8941) correctly.
Maybe i'll dig a little deeper... maybe not :angel:

Anyway, leave some comments here if you like!

Cheers,

scholbert

 

[95A31]

...
There might be some issues with DT in general here, but i suspect some basic stuff is missing to initiate the power supply (PM8841 & PM8941) correctly.
....

What make you think this?

 

[abkdmn]

Gonna test it on my phone.

 

[scholbert]

What make you think this?

See those snippets from bootlog of kernel 3.4:

...
[    0.143223] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.144749] socinfo_print: v8, id=126, ver=2.2, raw_id=1968, raw_ver=7, hw_plat=150, hw_plat_ver=65536
[    0.144755]  accessory_chip=0, hw_plat_subtype=0, pmic_model=65537, pmic_die_revision=196609
[    0.158993] gpiochip_add: registered GPIOs 0 to 145 on device: msmgpio
[    0.175335] msm_watchdog f9017000.qcom,wdt: MSM Watchdog Initialized
[    0.194446] 8841_s1: 675 <--> 1050 mV at 0 mV normal idle 
[    0.194895] 8841_s1_ao: 675 <--> 1050 mV at 0 mV normal idle 
[    0.195357] 8841_s1_so: 675 <--> 1050 mV at 675 mV normal idle 
[    0.195859] 8841_s2: 500 <--> 1050 mV at 0 mV normal idle 
[    0.196322] 8841_s2_corner: 0 <--> 0 mV at 0 mV normal idle 
[    0.196785] 8841_s2_corner_ao: 0 <--> 0 mV at 0 mV normal idle 
[    0.197235] 8841_s2_floor_corner: 0 <--> 0 mV at 0 mV normal idle 
[    0.197723] 8841_s3: 1050 mV normal idle 
[    0.198201] 8841_s4: 815 <--> 900 mV at 0 mV normal idle 
[    0.198675] 8841_s4_corner: 0 <--> 0 mV at 0 mV normal idle 
[    0.199145] 8841_s4_floor_corner: 0 <--> 0 mV at 0 mV normal idle 
[    0.199630] 8941_s1: 1300 mV normal idle 
[    0.200131] 8941_s2: 2150 mV normal idle 
[    0.200614] 8941_s3: 1800 mV normal idle 
[    0.201146] 8941_l1: 1225 mV normal idle 
[    0.201627] 8941_l2: 1200 mV normal idle 
[    0.202120] 8941_l3: 1225 mV normal idle 
[    0.202608] 8941_l4: 1225 mV normal idle 
[    0.203117] 8941_l5: 1800 mV normal idle 
[    0.203599] 8941_l6: 1800 mV normal idle 
[    0.204088] 8941_l7: 1800 mV normal idle 
[    0.204588] 8941_l8: 1800 mV normal idle 
[    0.205066] 8941_l9: 1800 <--> 2950 mV at 2950 mV normal idle 
[    0.205554] 8941_l10: 1800 <--> 2950 mV at 2950 mV normal idle 
[    0.206025] 8941_l11: 1300 mV normal idle 
[    0.206520] 8941_l12: 1800 mV normal idle 
[    0.206982] 8941_l12_ao: 1800 mV normal idle 
[    0.207462] 8941_l13: 1800 <--> 2950 mV at 2950 mV normal idle 
[    0.207961] 8941_l14: 1800 mV normal idle 
[    0.208434] 8941_l15: 2050 mV normal idle 
[    0.208930] 8941_l16: 2700 mV normal idle 
[    0.209418] 8941_l17: 3000 mV normal idle 
[    0.209909] 8941_l18: 2850 mV normal idle 
[    0.210405] 8941_l19: 3000 <--> 3300 mV at 3300 mV normal idle 
[    0.210917] 8941_l20: 2950 mV normal idle 
[    0.211414] 8941_l21: 2950 mV normal idle 
[    0.211907] 8941_l22: 3000 <--> 3300 mV at 3100 mV normal idle 
[    0.212411] 8941_l23: 3000 mV normal idle 
[    0.212898] 8941_l24: 3075 mV normal idle 
[    0.213387] 8941_lvs1: 
[    0.213821] 8941_lvs2: 
[    0.214265] 8941_lvs3:
...

...and these messages from kernel 4.11:

...
[    0.213352] DMA: preallocated 256 KiB pool for atomic coherent allocations
[    0.215005] cpuidle: using governor menu
[    0.215647] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[    0.215657] hw-breakpoint: maximum watchpoint size is 8 bytes.
[    0.216665] irq: no irq domain found for /smp2p-adsp/slave-kernel !
[    0.232062] irq: no irq domain found for /soc/[email protected] !
[    0.251356] AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver
[    0.251635] reg-fixed-voltage vreg-boost: could not find pctldev for node /soc/[email protected]/[email protected]/[email protected]/boost-bypass, deferring probe
...

Regards,

scholbert

 

[scholbert]

Hey,

short update... found something to get the messages from PMIC :victory:
There was a missing option in my configuration. We need CONFIG_RPMSG_QCOM_SMD to be set.
Unfortunately still no sign from the eMMC ...

EDIT: grrrrr... still some issues here.
If RPM shared memory driver gets activated, this seems to change some setup in clock unit of the chip, which as a result disables RTC or destroys something else.
So in the end i'm not sure if shared memory driver should be used here
Anyway will play around with all this in the next weeks... but remember it's summer... so it may all take it's time!

EDIT2: yeeeessssss.. some issues solved!
I forgot that i made a change in dtsi which seemed to block the interrupt to smbi... in the end reverted it, applied new configuration, and there it is.
We got eMMC now :highfive:

See new attached files and have anice weekend!

EDIT3: Moved the attachments to the first post!


BTW, there's a guy at the fairphone forum who does similar experiments with the FP2 (MSM8974 based as well):
https://forum.fairphone.com/t/kernel-hackers-upstream-kernel-for-fp2-openos/28628

Here's his github repo:
https://github.com/z3ntu/linux

Regards,

scholbert

 

[95A31]

Hey,
short update... found something to get the messages from PMIC :victory:
There was a missing option in my configuration. We need CONFIG_RPMSG_QCOM_SMD to be set.
Unfortunately still no sign from the eMMC ...

[...]

Good job!

Look like system can not access to memory:

[    1.800624] init: /init.rc: 66: invalid command 'load_system_props'

[    1.995481] init: /init.recovery.hammerhead.rc: 17: invalid command '/sbin/ln'

Maybe the change msm_sdcc.1 -> f9824900.sdhci had broke something. Before the kernel messages I have this part in my logs:

[7040] use_signed_kernel=0, is_unlocked=1, is_tampered=1.
[7040] Loading boot image (9416704): start
[7380] Loading boot image (9416704): done
[7380] Found Appeneded Flattened Device tree
[7380] DTB: platform id 126, board id 150, soc rev 20002, board rev 11
[7390] get_display_kcal = 0, 0, 0, x
[7390] 
Booting Linux
[7440] vibe
[7540] splash: boot
[7580] splash: unlocked
[7620] cmdline: console=ttyHSL0,115200,n8 androidboot.hardware=hammerhead user_debug=31 msm_watchdog_v2.enable=1 mdss_mdp.panel=dsi androidboot.bootdevice=msm_sdcc.1 uart_console=enable gpt=enable lge.kcal=0|0|0|x lge.rev=rev_11 androidboot.laf androidboot.emmc=[7640] Updating device tree: start
[7650] Updating device tree: done
[7660] booting linux @ 0x8000, ramdisk @ 0x2900000 (1115413), tags/device tree @ 0x2700000
[7660] Turn off MIPI_CMD_PANEL.
[7660] Continuous splash enabled, keeping panel alive.
Uncompressing Linux... done, booting the kernel.

Can be the value of androidboot.bootdevice related with this problem?

Here a Linaro guy is working on Nexus 7 (APQ8064 based unfortunately).

EDIT:
Moreover fstab.hammerhead use msm_sdcc.1 and this is wrong for sure.

 

[scholbert]

Hi 95A31,

thanks for your comments and information about the Nexus 7 project.

The errors you find in the logs are related to the TWRP initrd and setup stuff.
Please refer to these messages i grabbed some time ago from the standard TWRP image:

...
[    5.341167] init: /init.rc: 66: invalid command 'load_system_props'
[    5.346559] init: could not import file '/init.recovery.logd.rc' from '/init.rc'
[    5.353919] init: /init.recovery.hammerhead.rc: 17: invalid command 'ln'
[    5.362647] healthd: wakealarm_init: timerfd_create failed
[    5.863315] android_usb: already disabled
[    6.134887] init: Unable to open persistent property directory /data/property errno: 2
[    6.141831] init: Unable to open persistent property directory /data/property errno: 2
...

As you see it's barely the same stuff printed out (independent of the kernel you use).
You may modify the initrd as you like to

The partitions can be mounted and accessed from serial console with this kernel now:

~ # mount -t ext4 /dev/block/mmcblk0p28 /data
[  237.878280] EXT4-fs (mmcblk0p28): mounted filesystem with ordered data mode. Opts: (null)
~ # df
Filesystem           1K-blocks      Used Available Use% Mounted on
tmpfs                   968568        28    968540   0% /dev
tmpfs                   968568       288    968280   0% /tmp
/dev/block/mmcblk0p28
                      27971732  10849488  17105860  39% /data
~ # cd data
/data # ls
adb             backup          data            media           security
anr             bootchart       drm             mediadrm        ss
app             bugreports      fdAlbum         misc            su
app-asec        cam_socket1     local           nfc             system
app-lib         cam_socket2     lost+found      property        tombstones
app-private     dalvik-cache    maru            resource-cache  user
/data #

Please check out the expermimental image and try yourself.
Be careful what you do at anytime though, because your dealing with your phones file system from within an experimental ramdisk.
So please do not brick your phone, while playing around :angel:

BTW... speaking of memory is more common for RAM, while storage may be used for eMMC and mass storage devices.

Of course a lot of tweaks and fixes are needed as this is all very experimental, so anyway thanks for your hint.
EDIT: ... and yes as for the numbering and naming this has to be corrected somewhere in time.
The eMMC is detected as device mmc0 (controller sdhci1) for now, because WLAN SDIO (using controller sdhci2) is not implemented yet.
Same for the fstab file.
Someone may try to rename some entries and see what happens, but as far as many parts are missing, there's no need for this right now.


Regards,

scholbert

 

[95A31]

[...]
The errors you find in the logs are related to the TWRP initrd and setup stuff.
[...]

You are more skilled than me about this topic

[...]
Someone may try to rename some entries and see what happens, but as far as many parts are missing, there's no need for this right now.
[...]

Which should be the next thing to fix?
I attached the list of commits commited by LG in aosp kernel

 

[scholbert]

You are more skilled than me about this topic

Thanks for the flowers

Which should be the next thing to fix?

I would like to get a working usb connection and use adb to communicate with the phone.
This would possibly increase the amount of interested people to check out a console based system on their phone and do some experiments.
I guess there are only a few people who got this earjack adapter or something.

At least the Nexus 5 is an interesting piece of embedded hardware to play with, even if the display got crashed.

I attached the list of commits commited by LG in aosp kernel

Nice! Thanks for the list.
As this refers to AOSP kernel 3.4 it gives a good overview of the patches fixes and changes of course.
For mainline kernel 4.11 this is list would look very different though.

I still concentrate on fine tuning of the kernel configuration, as there are still many things to discover.
To get some Nexus 5 specific device drivers integrated would be nice as well (e.g. check BQ24190/2 code and implement it to DT).

Anyway... always remember this is a just for fun thing.
Could be some educational project if your like, but without all the binary blobs adopted to kernel 4.11 there will never be a working Android.

EDIT:
As for the educational purpose (my very own )
We can sample some interrupts from the PM8941 subsystem very well:

~ # cat /proc/interrupts
           CPU0
 18:       8925     GIC-0  20 Level     arch_timer
 20:          0     GIC-0  39 Level     arch_mem_timer
 22:          0     GIC-0 194 Edge      adsp
 23:          0     GIC-0 190 Edge      smp2p
 24:          0     GIC-0  59 Edge      smp2p
 25:          0     GIC-0 175 Edge      smp2p
 26:       1181     GIC-0 139 Level     msm_serial0
 27:         80     GIC-0 155 Edge      mmc0
 28:          0     GIC-0 170 Edge      f9824900.sdhci
176:          0     GIC-0 127 Level     i2c_qup
178:          0     GIC-0 271 Level     bam_dma
179:          0     GIC-0 166 Edge      msm_otg
186:          0  pmic_arb 6357309 Edge      pm8xxx_rtc_alarm
187:          2  pmic_arb 524325 Edge      pm8941_pwrkey
188:          0  pmic_arb 1050408 Edge      chg-done
189:          0  pmic_arb 1049896 Edge      chg-fast
190:          0  pmic_arb 1049640 Edge      chg-trkl
191:          0  pmic_arb 1179946 Edge      bat-temp-ok
192:          0  pmic_arb 1179690 Edge      bat-present
193:          0  pmic_arb 1245739 Edge      chg-gone
194:          4  pmic_arb 1245483 Edge      usb-valid
195:          0  pmic_arb 1311020 Edge      dc-valid
197:          2  pmic_arb 12648535 Edge      volume_up
198:          2  pmic_arb 12714072 Edge      volume_down
243:          0     GIC-0 188 Edge      adsp
244:          0     GIC-0  57 Edge      modem
245:         47     GIC-0 200 Edge      rpm
246:          0     GIC-0  58 Edge      smsm
247:          0     GIC-0 189 Edge      smsm
248:          0     GIC-0 176 Edge      smsm
249:          0     smp2p   0 Edge      adsp
250:          0     smp2p   1 Edge      adsp
251:          0     smp2p   2 Edge      adsp
252:          0     smp2p   3 Edge      adsp
IPI0:          0  CPU wakeup interrupts
IPI1:          0  Timer broadcast interrupts
IPI2:        652  Rescheduling interrupts
IPI3:          5  Function call interrupts
IPI4:          0  CPU stop interrupts
IPI5:          0  IRQ work interrupts
IPI6:          0  completion interrupts
Err:          0

To be more precisely:
volume_up, volume_down, pwrkey and usb-valid are detected and working.
Unfortunately no reaction from the host and no kernel message, when micro usb cable is attached or detached...

Whatever...

Regards,

scholbert

 

[95A31]

[..]
I would like to get a working usb connection and use adb to communicate with the phone.
This would possibly increase the amount of interested people to check out a console based system on their phone and do some experiments.
I guess there are only a few people who got this earjack adapter or something.

At least the Nexus 5 is an interesting piece of embedded hardware to play with, even if the display got crashed.
[...]

Nice, I hope to have time to seriously play with it and maybe make something work.

[...]
Anyway... always remember this is a just for fun thing.
Could be some educational project if your like, but without all the binary blobs adopted to kernel 4.11 there will never be a working Android.
[...]

I know, I know, sometime I follow my enthusiasm . Yes, blobs are a big problem for a working Android and when I think about how address it, and how much time it will require I die inside

 

[scholbert]

Wow!!!

Hey there,

i just wondered how time goes by
I'm still using my hammerhead for daily use and from time to time i'm searching the web how things are evolving.
This is the coolest project i've seen for a while:
https://github.com/flto/linux/wiki/hammerhead-upstream

Need to do some research who's behind it

Have a nice day!
scholbert