Android 4 on the Odys Loox Tablet PC

Warning & precautions

I do NOT take responsibility or liability from any kind of damage created by the instructions described in this article. Mind, that you may loose warranty for your device, or worse, destroy it. I have intentionally left some blanks (i.e. not explained how to compile the programs described herein) as I assume that the reader does know how to do that - if you don't, you shouldn't read further anyways.
Please also mind, that the flash of your device is completely erased in the process, so make a backup of your precious data before flashing. Aside from that, you should also backup the low-level flash contents via rkflashtool:

rkflashtool r 0x00000000 0x00800000 > flash-backup.img

Intro

The Odys Loox is a Tablet which comes with Android version 2.3 preinstalled. As I recently checked for updates on the manufacturer's site, I discovered that the device doesn't exist anymore, but occurs to be superseded by a newer one "Loox Plus". The hardware specification of the newer device looked identical to the one I've got, so I thought, I'd give it a try and install Ice Cream Sandwich on mine...

So I downloaded the software and unpacked the zip archive. I discovered several filesystem images for the distinct partitions and an installer program, that - who'd have guessed - only works on windows.

In my previous experiments, I've found a neat tool to flash tablet devices from the same OEM (rockdev), so I tried flashing the images manually with an open source tool (rkflashtool). Well, just flashing the plain images didn't work and I investigated a little further. Soon I found out, that the images appearently were formatted differently than on previous versions of the device...

Converting the images

The next logical step was to find out what format the filesystems were and how they had to be. Luckily I had made a backup of the entire flash of the device, so I could compare both, old and new ones.

It turns out that some of the old images were in the rockdev image format, while the new images had the (classical) Android boot image format. Obviously there *is* a slight difference in between the two devices, namely their bootloader. As I didn't want to fiddle with the bootloader and risk to brick my device, I looked for a way to install the software without modifying the bootloader.

The solution was to convert the images from the new to the old format. So, in order to make the new images work with the old loader (which expects rockdev formatted images), I had to convert kernel.img, boot.img and recovery.img to the old (rockdev) format. In order to that, two tools are required:
* abootimg to extract the new images
* rkcrc to generate images of the old format.

Another thing I discovered while i was at it, was a different partition layout. The partitions are regions within the device's flash. Their boundaries are passed to the kernel as arguments. These arguments are read by the device's bootloader and are defined within first few bytes of the flash area (address range 0x0000 to 0x2000). The so-called "parameter" partition contains information with is interpreted by the bootloader. A sample parameter definition looks as follows:

MWARE_VER:0.2.3
MACHINE_MODEL:LOOX Plus
MACHINE_ID:007
MANUFACTURER:RK29SDK
MAGIC: 0x5041524B
ATAG: 0x60000800
MACHINE: 2929
CHECK_MASK: 0x80
KERNEL_IMG: 0x60408000
#COMBINATION_KEY: 0,6,A,1,0
#(misc)(kernel)(boot)(recovery)(backup)(cache)(userdata)(kpanic)(system)(user)
CMDLINE: console=ttyS1,115200n8n androidboot.console=ttyS1 init=/init initrd=0x62000000,0x800000 mtdparts=rk29xxnand:0x00002000@0x00002000(misc),0x00004000@0x00004000(kernel),0x00008000@0x00008000(boot),0x00008000@0x00010000(recovery),0x0012C000@0x00018000(backup),0x0003a000@0x00144000(cache),0x00200000@0x0017e000(userdata),0x00002000@0x0037e000(kpanic),0x000dc000@0x00380000(system),-@0x0045c000(user)

The last (very long) line (CMDLINE) is the kernel command line that is passed to the kernel. The partitions in this line have to match the partition layout on the device's flash and represent addresses in the flash's native block format (512 bytes).

In order to generate valid parameter information, one needs to add a checksum to the file and generate an image from it. This can be done with

rkcrc -p parameter parameter.img

Above command generates a parameter image, which can be uploaded to the device's flash at address 0x0000. To do so, you'll need to run

rkflashtool w 0x0000 0x2000 < parameter.img

Mind, that we still need to convert the images from the android to the rockdev format. To do so, you'll need to cd into the directory where the images are and run:

for i in {boot,recovery,kernel} ; do
	D="%{i}-extract"
	mkdir $D
	cd $D
	abootimg -x ../${i}.img
	rkcrc -k initrd.img ../${i}.rockdev-img
	cd ..
done
rm kernel.rockdev-img
rkcrc -k kernel-extract/zImage kernel.rockdev-img

After this step, you'll have {kernel,boot,recovery}.rockdev-img ready to be flashed onto the device. Flashing can now be done with the following command:

rkflashtool w 0x00004000 0x00004000 < kernel.rockdev-img
rkflashtool w 0x00008000 0x00008000 < boot.rockdev-img
rkflashtool w 0x00010000 0x00008000 < recovery.rockdev-img

The images misc.img and system.img do not require special formatting, they can simply be written to the device as they are:

rkflashtool w 0x00002000 0x00002000 < misc.img
rkflashtool w 0x00380000 0x000dc000 < system.img

Applying this guide to other devices

This guide is possibly applicable to other rockchip devices (rk29xx class devices). Different vendors ship their devices with different partition layouts, so you'll probably need to adjust the flash boundaries to match your device's configuration.

To identify the type of image your device requires, you'll need to download the images from the flash and inspect their header. If the first few bytes read "ANDROID" you've got a bootloader that expects the android image format, if the first bytes are "KRNL" or "PARM", you've got the older version of the bootloader which requires rockdev-formatted images.

When porting, you'll also need to find out the key combination to activate the bootloader. For the Odys Loox, you need to hold the menu key down and then reset the device by putting a needle into the reset-switch pinhole. The procedure should (of course) only be conducted with the power supply plugged in.
_