Android Tablets Forum banner

Fixed kernel, with working camera and 1.0Ghz

91K views 245 replies 81 participants last post by  pedrof 
#1 · (Edited by Moderator)
Here:

http://www.megaupload.com/?d=RATILM3F

Place the files in the zt-update dir.
And boot with camera+power.

I found out a way to boot the kernel without flashing so it "should" be safe. (So you have to always boot it with camera+power)
Ofcourse, it might turn out that it might overheat or something, but that is a different story


To verify>
-Check "no frills cpu clock" for clockspeed
-The camera now works

-run shell, I have changed the builddate string to 2999

-------------

[johan@myhost ~]$ /opt/android-sdk/platform-tools/adb shell
shell@android:/ $ uname -a
Linux localhost 2.6.34 #2834 Sat Dec 24 13:46:36 CST 2011 armv7l GNU/Linux
shell@android:/ $ exit

[Reboot using camera+power]

[johan@myhost ~]$ /opt/android-sdk/platform-tools/adb shell
shell@android:/ $ uname -a
Linux localhost 2.6.34 #2834 Sat Dec 24 12:34:56 CST 2999 armv7l GNU/Linux
shell@android:/ $

-------------

To get the best performance in "quadrant" I put max&min clock to 1.0Ghz and govenor to performance.

Bugs:
The first time I hade to change from 200 to 1.0Ghz in "No-frills CPU Controll"
At each boot I have to change HDMI mode to panel. (Might have to do with the recovery boot hack, or the SJPedro custom rom) (This is for the camera to work at all)

It should probably be safe to flash, but I have not tried yet. (Just rename the ZT-280.recovery to ZT-280.kernel)

I have only tried the camera with the native "camera app", not skype etc. Please report..

Thanks to "vgrade" for inspiraton for the boot hack, and SjPedro for the rooted rom.
 

Attachments

See less See more
6
#4 ·
Awesome job johane!

Being able to overclock the CPU to 1,0 Ghz was one of the major requests on this forum. You did it!
I'll have to flash the kernel when I get back from work.

What were the major differences you noticed? Does the tablet feel noticably faster? How's the battery life?

Thank you for your efforts, they are much appreciated!

 
#6 ·
So, went ahead and flashed it, worked like a charm. No single bug for me. Camera works fine, got a little bit brighter. I don't think that there is more room for improvement with this camera...

The 1ghz works fine! Will test how fast the battery drains. How did you mangage to achieve this?? Brilliant!
Sadly I lost root rights on my tablet, so I cant do advanced tests.

Big thanks!
 
#8 · (Edited by Moderator)
Probably, but there might be some more things that needs to be change for that.

EDIT: I have added a test 1.1Ghz kernel, But I have not tried it (to tablet here ATM)

The "a9_clk" is divided by two from the "sys_pll", and it has a maximum defined clock of 2ghz. (But it doesn't appear to check it anywere.)

The steps to fix the kernel is basically:

Strip the first 128 bytes with dd.

dd if=.. of=temp1 bs=s skip=128

decompress
lzcat < temp1 > kernel

[Modify the kernel]

Then pack it again using lzma
(Here I ran into troubles since the output from the lzma shipped with my linux dist was not recognized by binwalk, So i downloaded a java lzma compressor "java_lzma_4.23.1.tar.bz2")

Then run mkimage two times, first add a "linux kernel header" and then a "linux firmware header". Here was the next problem, it turned out that the bootloader checked that the signature name was "LK:ZT280_H1_2n" Otherwise it just silently ignored the image.

Then verify with binwalk, and compare against the original file.

This is my packing script:

rm uImage-kernel.temp
rm modkernel.lzma
rm firmware.out
java -Xmx512m -jar JLzma.jar e modkernel modkernel.lzma
../../../../../src/u-boot-amlogic/u-boot/build/tools/mkimage -A arm -O linux -T kernel -C lzma -a 80008000 -e 80008000 -d modkernel.lzma -n Linux-2.6.34 uImage-kernel.temp
../../../../../src/u-boot-amlogic/u-boot/build/tools/mkimage -A arm -O linux -T firmware -C none -a ffffffff -e 00000000 -d uImage-kernel.temp -n LK:ZT280_H1_2n firmware.out
binwalk firmware.out

You have to use a patched version of u-boot mkimage that understands lzma, you might get it from the amlogic wiki.

To know what to patch I looked in the amlogic kernel sourcecode to understand how it works, and then I have basically only changed the data for "maximum" a9_clk and part of the init struct for the camera.
A big thanks to abrekk and vgrade for posting their scripts for stripping and packing the kernel. Otherwise it would have taken me forewer to figure that out.

EDIT:

This is the diffs for 1.1Ghz (untested) The max a9_clk is @ 0x009ab70c
1100000000 > 0x4190ab00 and with correct endiannes: 00ab9041

[johan@myhost unlzma]$ hexdump -C myfile > stock_dump
[johan@myhost unlzma]$ hexdump -C oc_camerafix > mod_dump
[johan@myhost unlzma]$ diff stock_dump mod_dump
508758,508759c508758,508759
< 007c98c0 34 20 53 61 74 20 44 65 63 20 32 34 20 31 33 3a |4 Sat Dec 24 13:|
< 007c98d0 34 36 3a 33 36 20 43 53 54 20 32 30 31 31 0a 00 |46:36 CST 2011..|
---
> 007c98c0 34 20 53 61 74 20 44 65 63 20 32 34 20 31 32 3a |4 Sat Dec 24 12:|
> 007c98d0 32 33 3a 34 35 20 43 53 54 20 32 39 39 39 0a 00 |23:45 CST 2999..|
628259,628260c628259,628260
< 009aae00 20 32 34 20 31 33 3a 34 36 3a 33 36 20 43 53 54 | 24 13:46:36 CST|
< 009aae10 20 32 30 31 31 00 00 00 00 00 00 00 00 00 00 00 | 2011...........|
---
> 009aae00 20 32 34 20 31 32 3a 33 34 3a 35 36 20 43 53 54 | 24 12:34:56 CST|
> 009aae10 20 32 39 39 39 00 00 00 00 00 00 00 00 00 00 00 | 2999...........|
628396c628396
< 009ab700 48 81 8f c0 00 46 c3 23 00 c2 eb 0b 00 08 af 2f |H....F.#......./|
---
> 009ab700 48 81 8f c0 00 46 c3 23 00 c2 eb 0b 00 ab 90 41 |H....F.#.......A|
638550c638550
< 009da2a0 df 23 d9 00 da 00 e0 09 ed 04 ee a0 ef 40
03 |.#...........@..|
---
> 009da2a0 df 23 d9 00 da 00 e0 09 ed 04 ee ff ef ff
03 |.#..............|

Output from the packing script:

[johan@myhost unlzma]$ ./script

LZMA# 4.23 Copyright (c) 1999-2004 Igor Pavlov 2004-12-10
JAVA LZMA Encoder 4.23.1 myspace

time : 12601 ms
Image Name: Linux-2.6.34
Created: Thu Jan 5 23:42:20 2012
Image Type: ARM Linux Kernel Image (lzma compressed)
Data Size: 3714216 Bytes = 3627.16 kB = 3.54 MB
Load Address: 80008000
Entry Point: 80008000
Image Name: LK:ZT280_H1_2n
Created: Thu Jan 5 23:42:20 2012
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 3714280 Bytes = 3627.23 kB = 3.54 MB
Load Address: ffffffff
Entry Point: 00000000

DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xF5677D8, created: Thu Jan 5 23:42:20 2012, image size: 3714280 bytes, Data Address: 0xFFFFFFFF, Entry Point: 0x0, data CRC: 0x7F0545BA, OS: Linux, CPU: ARM, image type: Firmware Image, compression type: none, image name: LK:ZT280_H1_2n
64 0x40 uImage header, header size: 64 bytes, header CRC: 0x59BFCC8C, created: Thu Jan 5 23:42:20 2012, image size: 3714216 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xA6FD70C8, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: lzma, image name: Linux-2.6.34
128 0x80 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 10409056 bytes

A 1.1 Ghz kernel can be found at: http://www.megaupload.com/?d=Y14ND4J7 [!!!_BUT I HAVE _NOT_ TESTED IT_!!!], please report what you find.. (No tablet here at the moment..)

EDIT2:

A precompile mkimage for 64bit linux with glibc 2.14 can be found at:
http://www.megaupload.com/?d=R7973E8H
EDIT3:
A statically compiled mkimage is at: http://www.megaupload.com/?d=W3ZMP6NI (should work on "all" 64bit linuxes..)
 
#10 · (Edited by Moderator)
Very true :)

Again, a big thanks from me for your description! Is is very detailed and helps to understand the process. And also for the time that you invested. You, sir, are a hero.

Sadly I am in my starting phase with linux related things.
I have a question, since you were able to change the maximum cpu speed, do you think that you would be able to insert steps? Like 200, 400, 800, 1000? Im thinking if this could increase batterylife or if it would just annoy because it would stutter more and not save any energy.
Do you know if the cpu voltage is changed along with the cpu speed? Perhaps we could massivley undervolt at 200mhz to save energy? Just in case there is a way we could change the setting.

Thanks again! Did you tell atp how to do it? So that they can rerelease a few firmwares?

Cant test your 1.1 patch atm, because I have no computer and do not want to possibly live without my tablet :)
 
#11 ·
awesome work johane! If I had noticed this sooner, I would have added this kernel to the 1.1 ROM I posted an hour ago!

As for the 5 point multi-touch thing, I have noticed that exist a few mods for cellphones that edit simple files and other things. I will research it again and get back to you

Since we are in a kernel hacking mood, I would like to share with you the following issue:

WPA2-TKIP encryption as you know (because I mention it a lot lol) is still a big issue on my tablet and other users' tablets

I figured out the problem seems to be in the tablet's ability to decrypt it successfully. It tries to decrypt but gets stuck on a loop that is impossible to go over unless you move outside of the range of the connection or reset the tablet. I have managed to screenshot the dmesg on such an occasion and I am wondering if maybe you and me can get to the bottom of this.

the image is attached to this post!

again..great fu*** work
 

Attachments

#12 ·
Sorry to sound ignorant, use AES. Its better.

Reporting a very unbelievable thing:

So I watched House MD in 720p for 1:20 h.
Afterwards, played Defender from Droidhen for 2h.
Sum: 3h 20min. Still left: 65 % battery if the meter is accurate, what I do not believe. However, if this is righ, this is the freaking best tablet with the freaking best mod ever... !!!
 
#19 · (Edited by Moderator)
Hi all

Several people have asked about doing something similar for the C71 and I think it is possible do do exactly the same, The offsets just have to be calculated. (The same would apply to the 3n version af the C91 and future kernel releases)

basically just search for the number 800000000 in the decompressed binary and change to 1000000000. (hex: 00 08 af 2f change to 00 ab 90 41)
And the same for the camera (if it is the same") search for ee a0 ef 40 and change to ee ff ef ff.

If there is multiple occurances then look at the neighbouring data to find out which one is the correct one.

Someone good at scripting could do some automatic fix for this.

Or it might be possible to make a kernel module that searches for the data and patches the kernel at runtime.

--

I noticed that some people have lookup problems, and I can think of a few problems..
1. This is for 2n version (someone should do the same for 3n).
2. The 1.1Ghz version doesn't work. (I havent bothered to try it) Has anyone tested it?
3.1. The filename is wrong. For temporary testing the modified kernel it should be called ZT280.recovery with the commandfile from the first post(This file should really not be needed, but I have not bothered to try and remove it). And SJPedros ICS firmware or official 1224 version should be flashed. (This is like "multi-boot": Camera + Power to start modified kernel, Power to start stock kernel).
3.2 Or to flash it "permanent": Swap the ZT280.kernel from official 1224 firmware or SJPedro modified firmware with this modified one, and then flash it (Camera+power).
4. Some tablets is more "unstable" than others and will not support this clockfrequency. (There is probably a reason for AMlogic to only put 800M as default speed.

The default AM-logic source does not seem to change the CPU-voltage when it changes frequency. But this should be trivial to add with WHEN the sourcecode is availible..

Regarding frequency stepping and fixing the encryption I would say that it is definetely possible but the better solution is to persuade zenithink to release the modified amlogic source. (Or they just release a Patch against the amlogic source)
They do seem to be worried about copyright etc since they have removed AC3 and now also some videocodecs from their firmware. So I think it would makes sense to also comply with the GPL.
http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic

What is your opinion about this atp_uestc?

EDIT:



Is this some known bug (The encryption problem..) for linux/the wifi driver we are using?

EDIT2: Fixed some typos etc..
 
#20 ·
honestly I have no idea. I have tried to google it a few times and I haven't found anything. But it does seem to be either a driver problem or a kernel problem with the TKIP encryption. On gingerbread releases the tablet would actually connect and be able to stay connected for a while. it would then loose connection, freeze and never be able to connect again to it. So there is something on the kernel or the driver that sometimes works and sometimes doesn't.

On ICS releases the tablet just quite simply freezes and doesn't allow connection.

Quite puzzling


Drivers or kernel or a combination of both? You tell me! I don't have the slightest clue. The only thing even close to a clue was that dmesg screen I managed to get (complete stroke of luck to get it!)
 
#25 ·
johane, you are AWESOME
Seriously, I never got so excited over a firmware upgrade like this. And didn't even need to flash the whole tablet, it just updated the kernel.

It's so much better comparing to the previous kernel, 200MHz make an astonishing difference, thank you very much. I have to press now SJ to upload another version of his ROM with this modification


When the GPU drivers are working properly, this is going to be a helluva smooth tablet as it never has been before!
 
#26 ·
weird thing just happened. Just installed chainfire and the tablet suddenly decided to forget about the overclock (which i embedded directly onto the firmware) and decided it should run at 800 Mhz again


oh well...will reboot it and see what happens

but for the few moments I enjoyed 1ghz it was AWESOME!
 
#27 ·
weird thing just happened. Just installed chainfire and the tablet suddenly decided to forget about the overclock (which i embedded directly onto the firmware) and decided it should run at 800 Mhz again
Well after this morning, lucky you, I believe. After uninstalling Chainfire 3D I noticed the Launcher froze quite a few times, and it apparently was having lots of Kernel panics. Either the Chainfire driver did something that made it super unstable, or the kernel itself is unstable.

After formatting with the 1GHz kernel it started doing the same thing again, so it has to be something with the kernel. Or maybe my tablet, I hope I didn't damage anything... Flashing with SJ's rom now, with the previous kernel, and preying...
 
#28 ·
OK I have a question. New here I have the zt280 c91 . for your update to work properly what rom should I be running? I understand the rooting and flashing procedures but when I saw turfier you posted it intimidated me.are you just "showing your work?" Or is it a part of the process? Sorry if it's a dumb question
 
#30 ·
Still too new to download here and my C91 is stock still, and only had a few little problems..

Obviously the 800Mhz thing needs to be sorted though, i may then try more softwares etc.

Can it be possible to set the min/max just in menu? Or to be just say 400Mhz min, 1Ghz maximum?
 
#32 ·
Hi,

thank you for the detailed description! This has been a real eye-opener for me about the way these ROMs are packaged, and now I'll be able to start messing around in my ROM much better than before. Really really great work!

Unfortunately I couldn't get my C71 patched yet, as it fails miserably on boot. It might be because I messed up on locating the coressponding value in the binary (there were two matches, and I might have just picked the wrong offset) But I'll have another go later today.

I have a few questions though:
-did anyone successfully patch C71 kernel yet? If so, was it a type N or F?
-how does the day-to-day power usage compare to that of the unpatched kernel? On ICS I've already witnessed a huge battery life increase, so it shan't be compered to GB
-would we actually have significant power saving if we had the kernel source and had it patched to use variable voltage (I gather the processor supports that, but it's not impplemented in the kernel) if so, I supose that would enhance the value of the tablet tremendously!

Sent from my ZT ICS using Tapatalk
 
#33 · (Edited by Moderator)
Hi,

thank you for the detailed description! This has been a real eye-opener for me about the way these ROMs are packaged, and now I'll be able to start messing around in my ROM much better than before. Really really great work!

Unfortunately I couldn't get my C71 patched yet, as it fails miserably on boot. It might be because I messed up on locating the coressponding value in the binary (there were two matches, and I might have just picked the wrong offset) But I'll have another go later today.
You can follow the pointer to the a9_clk string to be 100% sure you are patching the correct memoryaddress.

static struct clk a9_clk = {
.name = "a9_clk",
.rate = 600000000,
.min = 200000000,
.max = 800000000,
.set_rate = clk_set_rate_a9_clk,
};

-would we actually have significant power saving if we had the kernel source and had it patched to use variable voltage (I gather the processor supports that, but it's not impplemented in the kernel) if so, I supose that would enhance the value of the tablet tremendously!
My feeling is that it should be a significant increase i batterylife. But on the other hand, if it would be so easy then why hasn't amligic implemented it in their "reference" kernel?

This GPL thing is really starting to annoy me, I bought this tablet mainly cause it seemed to have great community support and I assumed that the kernel source was availible.

do I need to havea custom rom instlled for this to work properly?
No, stock ICS-1224 will work as well. (probably the other ICS releases aswell)

EDIT: Automatic patching script if someone is interested, should patch "ALL" verisons of the kernel (probably even for C71)
Note, I have not tested it so proceed with caution


Code:
<br />
rm kernel*<br />
rm *.dump<br />
rm ZT280.recovery<br />
<br />
dd if=ZT280.kernel of=kernel1.lzma bs=128 skip=1<br />
<br />
lzcat < kernel1.lzma > kernel1<br />
<br />
hexdump -C kernel1 > stock.dump<br />
<br />
#Do camera patch<br />
sed 's/\xee\xa0\xef\x40/\xee\xff\xef\xff/' kernel1 > kernel2<br />
<br />
#Do overclock patch to 1000Mhz (search for 60000000, 200000000, 800000000 and patch to 60000000, 200000000, 1000000000 (0x3B9ACA00) )<br />
sed 's/\x00\x46\xc3\x23\x00\xc2\xeb\x0b\x00\x08\xaf\x2f/\x00\x46\xc3\x23\x00\xc2\xeb\x0b\x00\xca\x9a\x3b/' kernel2 > kernel3<br />
<br />
##Do overclock patch to 900Mhz (0x35A4E900)<br />
#sed 's/\x00\x46\xc3\x23\x00\xc2\xeb\x0b\x00\x08\xaf\x2f/\x00\x46\xc3\x23\x00\xc2\xeb\x0b\x00\xe9\xa4\x35/' kernel2 > kernel3<br />
<br />
##Don't do oc patch<br />
#cp kernel2 kernel3<br />
<br />
hexdump -C kernel3 > mod.dump<br />
<br />
java -Xmx512m -jar JLzma.jar e kernel3 kernel.patched.lzma<br />
./mkimage -A arm -O linux -T kernel -C lzma -a 80008000 -e 80008000 -d kernel.patched.lzma -n Linux-2.6.34 kernel.patched.uImage<br />
./mkimage -A arm -O linux -T firmware -C none -a ffffffff -e 00000000 -d uImage-kernel.temp -n [URL=LK:ZT280_H1_2n]LK:ZT280_H1_2n[/URL] ZT280.recovery<br />
<br />
diff mod.dump stock.dump<br />
binwalk ZT280.recovery<br />
 
#34 ·
If I use the Ics rom won't that nullify flash 11? Or will that still work after the kernel is changed?
 
#35 ·
I gave another try to the overclock, and this morning everything was fine, but suddenly, I was reading a few PDFs and listening to music, and it got more kernel panics which forced the tablet to restart. Had to restart it manually so I could boot with the original kernel.

I've got a theory I'm still going to test, but discussed it with SJPedro today. What if the voltage supplied isn't enough when the battery drops for it to work at 1GHz? I know from a battery level app that when charged it measures 8.5V, but drops over time as discharging.
 
#38 ·
Thanks for the more detailed explanation, I'm not really good at reading hex code these days. :)

The script you provided does the same modification that I achieved following your original description. This came as a good news to me personally, so I knew I understood the process well. :) Naturally I didn't do the camera patch having a different model with a working (but unbelievably poor quality) camera.

The bad news for C71 owners, this baby won't boot at 1GHz. I didn't try 900 MHz, but I don't think it's worth fussing with it, as that would probably just overclock and destabilize the tablet with not much gained.

I really hope that Zenithink will finally release the kernel source, so we could have a proper run for a working kernel!

Sent from my GT-I9001 using Tapatalk
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top