Evert's website

Hacking the Modecom FreeTAB 9000 (2)

After my previous post on the FreeTAB, I noticed that GitHub user archeYR has already made a lot of progress on porting a recent Linux version to SFI-based platforms. His work is spread over three repositories:

These repositories are relatively light on documentation, so let's see if we can get the bootstub and kernel working on the FreeTAB.

Bootstub #

After cloning the sfi-bootstub repo above, we can build it for the Clover Trail+ platform by running:

PLATFORM=MOORESTOWN make

This will result in a binary bootstub appearing in the root of the repository.

Kernel #

Grab a copy of the intel-sfi branch. Select the defconfig for SFI platforms included in the repository and then build the kernel for the i386 architecture (I like to use Clang/LLVM for cross-compiling):

make ARCH=i386 LLVM=1 sfi_defconfig
make ARCH=i386 LLVM=1 -j$(nproc)
After a few minutes (depending on your machine) the kernel is available at `arch/x86/boot/bzImage`.

Building a minimal initrd #

For the initrd I decided to go with a statically linked version of BusyBox. Grab the latest version of the BusyBox source, extract it and build a static 32-bit version using:

make defconfig
make ARCH=i386 \
    CC="clang --target=i686-linux-gnu" \
    LD="clang --target=i686-linux-gnu" \
    AR="llvm-ar" \
    NM="llvm-nm" \
    STRIP="llvm-strip" \
    OBJCOPY="llvm-objcopy" \
    OBJDUMP="llvm-objdump" \
    EXTRA_CFLAGS="-march=atom" \
    EXTRA_LDFLAGS="-fuse-ld=lld -static" \
    -j$(nproc)

If your host machine is on a recent kernel version (>= 6.8) you might need to set CONFIG_TC=n in .config after running make defconfig, see this bug.

After a few minutes (depending on your machine) the BusyBox binary is available in the root of the source directory. We can now build a minimal initrd:

mkdir initrd && cd initrd
mkdir bin dev proc sys
cp <busybox directory>/busybox bin/busybox

# Create symlinks for common utilities provided by BusyBox
for cmd in \
    awk blkid cat cp date dd df dmesg du echo env \
    false fdisk find free grep head hostname hwclock id \
    insmod install ip kill less ln ls lsmod lsof lspci lsusb \
    mkdir modinfo modprobe mount mountpoint mv nproc ping pkill \
    poweroff printf ps pwd reboot rm rmdir rmmod sed sh sleep sort \
    split stat strings su sysctl tail tar tee time top touch tr true \
    umount uname uptime usleep vi wc which xargs yes zcat; do
    ln -s busybox bin/$cmd
done

# Create a simple init script
cat <<EOF > bin/init
#!/bin/sh
mount -t proc none /proc
mount -t sysfs none /sys
exec /bin/sh
EOF

chmod +x bin/init

find . | cpio -o -H newc | gzip -c -9 > ramdisk

Building archeYR's intel-ifwi-study tools #

Clone archeYR's intel-ifwi-study repository and build the tools using make. If you are using a recent version of GCC, you might need to add #include <unistd.h> to all .c files.

Building the boot image #

Now we can start building the boot image:

Testing #

Flash the resulting patched.boot.img file from droidboot using fastboot flash boot patched.boot.img and then reboot the device via fastboot reboot. After the reboot you should see the bootstub print some messages, and a few seconds later the kernel should begin booting:

The bootstub and kernel booting. Sorry for the shaky video :-)

Remarks #

1: The modified bootstub also introduced support for the Multiboot specification, as archeYR seems to intend to port ReactOS to SFI-based platforms.