• Announcements

    • PaulOBrien

      Reminder - MoDaCo position on illegal content   07/30/15

      ILLEGAL CONTENT I'd like to just reaffirm MoDaCo's position regarding piracy and illegal content in the light of some recent questions / postings. Posts will be censored by myself or my moderation team if the contain or link to: Illegal / pirated / cracked software or sites that host such software Nintendo emulators / ROMs or sites hosting them (in light of Nintendo's legal stance) CUSTOM ROMS You may discuss and post links to custom device ROMs on MoDaCo, provided the following rules are adhered to: ROMs must not contain any illegal 3rd party software (this includes trial versions included without permission) ROMs must give full credit to the original author ISSUES If you have any issues with this policy, please contact PaulOBrien directly via PM.
    • PaulOBrien

      Reminder: Selling items on the forum directly is not allowed   07/30/15

      Please note that selling items on the forum directly is not allowed by the forum rules. There is a forum for eBay auctions whereby you can list the items on eBay and link to them there. This is the ONLY forum for this type of activity. You may also advertise links to the eBay forum in your signature. Please note that selling directly in contravention of these rules will result in a warning / suspension / ban.

[Tool]AIO Tool for San Diego and xolo

1297 posts in this topic

i have done all things for getting notification bar but unable to get it . as ricky says to download new ics file from xolo.in i done the same 3 times , but nothing happenings if any one having any idea about this plz help me i am gonna to submit my xolo snap shots there is also problem with battery . Battery shows 0 % or unknown .


Share this post

Link to post
Share on other sites
iqbylOYSaqjEv.JPGibqritOjHsicVi.JPG Edited by ashutosh00074

Share this post

Link to post
Share on other sites

did you factory wipe from recovery?


Share this post

Link to post
Share on other sites

i have done all things for getting notification bar but unable to get it . as ricky says to download new ics file from xolo.in i done the same 3 times , but nothing happenings if any one having any idea about this plz help me i am gonna to submit my xolo snap shots there is also problem with battery . Battery shows 0 % or unknown .

Faulty device?


Share this post

Link to post
Share on other sites

Faulty device?

Edited by stephen m

Share this post

Link to post
Share on other sites

did you factory wipe from recovery?

yes . now if you have any command to do then tell me please

Share this post

Link to post
Share on other sites

Did it have the status bar and battery at 0 before you started flashing roms?

Edited by topcat07

Share this post

Link to post
Share on other sites

Did it have the status bar and battery at 0 before you started flashing roms?


Share this post

Link to post
Share on other sites

do this boot in to fastboot and type this

fastboot -i 0x8087 oem erase system


fastboot -i 0x8087 oem erase cache


fastboot -i 0x8087 oem erase factory


fastboot -i 0x8087 oem erase sdcard

then brick fix

if after this its still the same then you'll need to send it for repair as this will wipe everything apart from boot recovery and fastboot


Share this post

Link to post
Share on other sites



2					  ---------------------------


4 On the x86 platform, the Linux kernel uses a rather complicated boot

5 convention.  This has evolved partially due to historical aspects, as

6 well as the desire in the early days to have the kernel itself be a

7 bootable image, the complicated PC memory model and due to changed

8 expectations in the PC industry caused by the effective demise of

9 real-mode DOS as a mainstream operating system.


11 Currently, the following versions of the Linux/x86 boot protocol exist.


13 Old kernels:    zImage/Image support only.  Some very early kernels

14				 may not even support a command line.


16 Protocol 2.00:  (Kernel 1.3.73) Added bzImage and initrd support, as

17				 well as a formalized way to communicate between the

18				 boot loader and the kernel.  setup.S made relocatable,

19				 although the traditional setup area still assumed

20				 writable.


22 Protocol 2.01:  (Kernel 1.3.76) Added a heap overrun warning.


24 Protocol 2.02:  (Kernel 2.4.0-test3-pre3) New command line protocol.

25				 Lower the conventional memory ceiling.  No overwrite

26				 of the traditional setup area, thus making booting

27				 safe for systems which use the EBDA from SMM or 32-bit

28				 BIOS entry points.  zImage deprecated but still

29				 supported.


31 Protocol 2.03:  (Kernel 2.4.18-pre1) Explicitly makes the highest possible

32				 initrd address available to the bootloader.


34 Protocol 2.04:  (Kernel 2.6.14) Extend the syssize field to four bytes.


36 Protocol 2.05:  (Kernel 2.6.20) Make protected mode kernel relocatable.

37				 Introduce relocatable_kernel and kernel_alignment fields.


39 Protocol 2.06:  (Kernel 2.6.22) Added a field that contains the size of

40				 the boot command line.


42 Protocol 2.07:  (Kernel 2.6.24) Added paravirtualised boot protocol.

43				 Introduced hardware_subarch and hardware_subarch_data

44				 and KEEP_SEGMENTS flag in load_flags.


46 Protocol 2.08:  (Kernel 2.6.26) Added crc32 checksum and ELF format

47				 payload. Introduced payload_offset and payload_length

48				 fields to aid in locating the payload.


50 Protocol 2.09:  (Kernel 2.6.26) Added a field of 64-bit physical

51				 pointer to single linked list of struct setup_data.


53 Protocol 2.10:  (Kernel 2.6.31) Added a protocol for relaxed alignment

54				 beyond the kernel_alignment added, new init_size and

55				 pref_address fields.  Added extended boot loader IDs.


57 Protocol 2.11:  (Kernel 3.6) Added a field for offset of EFI handover

58				 protocol entry point.


60 Protocol 2.12:  (Kernel 3.9) Added the xloadflags field and extension fields

61				 to struct boot_params for for loading bzImage and ramdisk

62				 above 4G in 64bit.




66 The traditional memory map for the kernel loader, used for Image or

67 zImage kernels, typically looks like:


69		 |					    |

70 0A0000  +------------------------+

71		 |  Reserved for BIOS	 |	  Do not use.  Reserved for BIOS EBDA.

72 09A000  +------------------------+

73		 |  Command line		  |

74		 |  Stack/heap		    |	  For use by the kernel real-mode code.

75 098000  +------------------------+	 

76		 |  Kernel setup		  |	  The kernel real-mode code.

77 090200  +------------------------+

78		 |  Kernel boot sector    |	  The kernel legacy boot sector.

79 090000  +------------------------+

80		 |  Protected-mode kernel |	  The bulk of the kernel image.

81 010000  +------------------------+

82		 |  Boot loader		   |	  <- Boot sector entry point 0000:7C00

83 001000  +------------------------+

84		 |  Reserved for MBR/BIOS |

85 000800  +------------------------+

86		 |  Typically used by MBR |

87 000600  +------------------------+

88		 |  BIOS use only		 |

89 000000  +------------------------+



92 When using bzImage, the protected-mode kernel was relocated to

93 0x100000 ("high memory"), and the kernel real-mode block (boot sector,

94 setup, and stack/heap) was made relocatable to any address between

95 0x10000 and end of low memory. Unfortunately, in protocols 2.00 and

96 2.01 the 0x90000+ memory range is still used internally by the kernel;

97 the 2.02 protocol resolves that problem.


99 It is desirable to keep the "memory ceiling" -- the highest point in

100 low memory touched by the boot loader -- as low as possible, since

101 some newer BIOSes have begun to allocate some rather large amounts of

102 memory, called the Extended BIOS Data Area, near the top of low

103 memory.  The boot loader should use the "INT 12h" BIOS call to verify

104 how much low memory is available.


106 Unfortunately, if INT 12h reports that the amount of memory is too

107 low, there is usually nothing the boot loader can do but to report an

108 error to the user.  The boot loader should therefore be designed to

109 take up as little space in low memory as it reasonably can.  For

110 zImage or old bzImage kernels, which need data written into the

111 0x90000 segment, the boot loader should make sure not to use memory

112 above the 0x9A000 point; too many BIOSes will break above that point.


114 For a modern bzImage kernel with boot protocol version >= 2.02, a

115 memory layout like the following is suggested:


117		 ~					    ~

118		 |  Protected-mode kernel |

119 100000  +------------------------+

120		 |  I/O memory hole	   |

121 0A0000  +------------------------+

122		 |  Reserved for BIOS	 |	  Leave as much as possible unused

123		 ~					    ~

124		 |  Command line		  |	  (Can also be below the X+10000 mark)

125 X+10000 +------------------------+

126		 |  Stack/heap		    |	  For use by the kernel real-mode code.

127 X+08000 +------------------------+	 

128		 |  Kernel setup		  |	  The kernel real-mode code.

129		 |  Kernel boot sector    |	  The kernel legacy boot sector.

130 X	   +------------------------+

131		 |  Boot loader		   |	  <- Boot sector entry point 0000:7C00

132 001000  +------------------------+

133		 |  Reserved for MBR/BIOS |

134 000800  +------------------------+

135		 |  Typically used by MBR |

136 000600  +------------------------+

137		 |  BIOS use only		 |

138 000000  +------------------------+


140 ... where the address X is as low as the design of the boot loader

141 permits.





146 In the following text, and anywhere in the kernel boot sequence, "a

147 sector" refers to 512 bytes.  It is independent of the actual sector

148 size of the underlying medium.


150 The first step in loading a Linux kernel should be to load the

151 real-mode code (boot sector and setup code) and then examine the

152 following header at offset 0x01f1.  The real-mode code can total up to

153 32K, although the boot loader may choose to load only the first two

154 sectors (1K) and then examine the bootup sector size.


156 The header looks like:


158 Offset  Proto   Name		    Meaning

159 /Size


161 01F1/1  ALL(1   setup_sects	 The size of the setup in sectors

162 01F2/2  ALL	 root_flags	  If set, the root is mounted readonly

163 01F4/4  2.04+(2 syssize		 The size of the 32-bit code in 16-byte paras

164 01F8/2  ALL	 ram_size	    DO NOT USE - for bootsect.S use only

165 01FA/2  ALL	 vid_mode	    Video mode control

166 01FC/2  ALL	 root_dev	    Default root device number

167 01FE/2  ALL	 boot_flag	   0xAA55 magic number

168 0200/2  2.00+   jump		    Jump instruction

169 0202/4  2.00+   header		  Magic signature "HdrS"

170 0206/2  2.00+   version		 Boot protocol version supported

171 0208/4  2.00+   realmode_swtch  Boot loader hook (see below)

172 020C/2  2.00+   start_sys_seg   The load-low segment (0x1000) (obsolete)

173 020E/2  2.00+   kernel_version  Pointer to kernel version string

174 0210/1  2.00+   type_of_loader  Boot loader identifier

175 0211/1  2.00+   loadflags	   Boot protocol option flags

176 0212/2  2.00+   setup_move_size Move to high memory size (used with hooks)

177 0214/4  2.00+   code32_start    Boot loader hook (see below)

178 0218/4  2.00+   ramdisk_image   initrd load address (set by boot loader)

179 021C/4  2.00+   ramdisk_size    initrd size (set by boot loader)

180 0220/4  2.00+   bootsect_kludge DO NOT USE - for bootsect.S use only

181 0224/2  2.01+   heap_end_ptr    Free memory after setup end

182 0226/1  2.02+(3 ext_loader_ver  Extended boot loader version

183 0227/1  2.02+(3 ext_loader_type Extended boot loader ID

184 0228/4  2.02+   cmd_line_ptr    32-bit pointer to the kernel command line

185 022C/4  2.03+   ramdisk_max	 Highest legal initrd address

186 0230/4  2.05+   kernel_alignment Physical addr alignment required for kernel

187 0234/1  2.05+   relocatable_kernel Whether kernel is relocatable or not

188 0235/1  2.10+   min_alignment   Minimum alignment, as a power of two

189 0236/2  2.12+   xloadflags	  Boot protocol option flags

190 0238/4  2.06+   cmdline_size    Maximum size of the kernel command line

191 023C/4  2.07+   hardware_subarch Hardware subarchitecture

192 0240/8  2.07+   hardware_subarch_data Subarchitecture-specific data

193 0248/4  2.08+   payload_offset  Offset of kernel payload

194 024C/4  2.08+   payload_length  Length of kernel payload

195 0250/8  2.09+   setup_data	  64-bit physical pointer to linked list

196								 of struct setup_data

197 0258/8  2.10+   pref_address    Preferred loading address

198 0260/4  2.10+   init_size	   Linear memory required during initialization

199 0264/4  2.11+   handover_offset Offset of handover entry point


201 (1) For backwards compatibility, if the setup_sects field contains 0, the

202	 real value is 4.


204 (2) For boot protocol prior to 2.04, the upper two bytes of the syssize

205	 field are unusable, which means the size of a bzImage kernel

206	 cannot be determined.


208 (3) Ignored, but safe to set, for boot protocols 2.02-2.09.


210 If the "HdrS" (0x53726448) magic number is not found at offset 0x202,

211 the boot protocol version is "old".  Loading an old kernel, the

212 following parameters should be assumed:


214		 Image type = zImage

215		 initrd not supported

216		 Real-mode kernel must be located at 0x90000.


218 Otherwise, the "version" field contains the protocol version,

219 e.g. protocol version 2.01 will contain 0x0201 in this field.  When

220 setting fields in the header, you must make sure only to set fields

221 supported by the protocol version in use.





226 For each field, some are information from the kernel to the bootloader

227 ("read"), some are expected to be filled out by the bootloader

228 ("write"), and some are expected to be read and modified by the

229 bootloader ("modify").


231 All general purpose boot loaders should write the fields marked

232 (obligatory).  Boot loaders who want to load the kernel at a

233 nonstandard address should fill in the fields marked (reloc); other

234 boot loaders can ignore those fields.


236 The byte order of all fields is littleendian (this is x86, after all.)


238 Field name:	 setup_sects

239 Type:		   read

240 Offset/size:    0x1f1/1

241 Protocol:	   ALL


243   The size of the setup code in 512-byte sectors.  If this field is

244   0, the real value is 4.  The real-mode code consists of the boot

245   sector (always one 512-byte sector) plus the setup code.


247 Field name:	  root_flags

248 Type:		    modify (optional)

249 Offset/size:	 0x1f2/2

250 Protocol:	    ALL


252   If this field is nonzero, the root defaults to readonly.  The use of

253   this field is deprecated; use the "ro" or "rw" options on the

254   command line instead.


256 Field name:	 syssize

257 Type:		   read

258 Offset/size:    0x1f4/4 (protocol 2.04+) 0x1f4/2 (protocol ALL)

259 Protocol:	   2.04+


261   The size of the protected-mode code in units of 16-byte paragraphs.

262   For protocol versions older than 2.04 this field is only two bytes

263   wide, and therefore cannot be trusted for the size of a kernel if

264   the LOAD_HIGH flag is set.


266 Field name:	 ram_size

267 Type:		   kernel internal

268 Offset/size:    0x1f8/2

269 Protocol:	   ALL


271   This field is obsolete.


273 Field name:	 vid_mode

274 Type:		   modify (obligatory)

275 Offset/size:    0x1fa/2


277   Please see the section on SPECIAL COMMAND LINE OPTIONS.


279 Field name:	 root_dev

280 Type:		   modify (optional)

281 Offset/size:    0x1fc/2

282 Protocol:	   ALL


284   The default root device device number.  The use of this field is

285   deprecated, use the "root=" option on the command line instead.


287 Field name:	 boot_flag

288 Type:		   read

289 Offset/size:    0x1fe/2

290 Protocol:	   ALL


292   Contains 0xAA55.  This is the closest thing old Linux kernels have

293   to a magic number.


295 Field name:	 jump

296 Type:		   read

297 Offset/size:    0x200/2

298 Protocol:	   2.00+


300   Contains an x86 jump instruction, 0xEB followed by a signed offset

301   relative to byte 0x202.  This can be used to determine the size of

302   the header.


304 Field name:	 header

305 Type:		   read

306 Offset/size:    0x202/4

307 Protocol:	   2.00+


309   Contains the magic number "HdrS" (0x53726448).


311 Field name:	 version

312 Type:		   read

313 Offset/size:    0x206/2

314 Protocol:	   2.00+


316   Contains the boot protocol version, in (major << 8)+minor format,

317   e.g. 0x0204 for version 2.04, and 0x0a11 for a hypothetical version

318   10.17.


320 Field name:	 realmode_swtch

321 Type:		   modify (optional)

322 Offset/size:    0x208/4

323 Protocol:	   2.00+


325   Boot loader hook (see ADVANCED BOOT LOADER HOOKS below.)


327 Field name:	 start_sys_seg

328 Type:		   read

329 Offset/size:    0x20c/2

330 Protocol:	   2.00+


332   The load low segment (0x1000).  Obsolete.


334 Field name:	 kernel_version

335 Type:		   read

336 Offset/size:    0x20e/2

337 Protocol:	   2.00+


339   If set to a nonzero value, contains a pointer to a NUL-terminated

340   human-readable kernel version number string, less 0x200.  This can

341   be used to display the kernel version to the user.  This value

342   should be less than (0x200*setup_sects).


344   For example, if this value is set to 0x1c00, the kernel version

345   number string can be found at offset 0x1e00 in the kernel file.

346   This is a valid value if and only if the "setup_sects" field

347   contains the value 15 or higher, as:


349		 0x1c00  < 15*0x200 (= 0x1e00) but

350		 0x1c00 >= 14*0x200 (= 0x1c00)


352		 0x1c00 >> 9 = 14, so the minimum value for setup_secs is 15.


354 Field name:	 type_of_loader

355 Type:		   write (obligatory)

356 Offset/size:    0x210/1

357 Protocol:	   2.00+


359   If your boot loader has an assigned id (see table below), enter

360   0xTV here, where T is an identifier for the boot loader and V is

361   a version number.  Otherwise, enter 0xFF here.


363   For boot loader IDs above T = 0xD, write T = 0xE to this field and

364   write the extended ID minus 0x10 to the ext_loader_type field.

365   Similarly, the ext_loader_ver field can be used to provide more than

366   four bits for the bootloader version.


368   For example, for T = 0x15, V = 0x234, write:


370   type_of_loader  <- 0xE4

371   ext_loader_type <- 0x05

372   ext_loader_ver  <- 0x23


374   Assigned boot loader ids (hexadecimal):


376		 0  LILO				 (0x00 reserved for pre-2.00 bootloader)

377		 1  Loadlin

378		 2  bootsect-loader	  (0x20, all other values reserved)

379		 3  Syslinux

380		 4  Etherboot/gPXE/iPXE

381		 5  ELILO

382		 7  GRUB

383		 8  U-Boot

384		 9  Xen

385		 A  Gujin

386		 B  Qemu

387		 C  Arcturus Networks uCbootloader

388		 D  kexec-tools

389		 E  Extended			 (see ext_loader_type)

390		 F  Special			  (0xFF = undefined)

391	    10  Reserved

392	    11  Minimal Linux Bootloader <http://sebastian-plotz.blogspot.de>


394   Please contact <[email protected]> if you need a bootloader ID

395   value assigned.


397 Field name:	 loadflags

398 Type:		   modify (obligatory)

399 Offset/size:    0x211/1

400 Protocol:	   2.00+


402   This field is a bitmask.


404   Bit 0 (read): LOADED_HIGH

405		 - If 0, the protected-mode code is loaded at 0x10000.

406		 - If 1, the protected-mode code is loaded at 0x100000.


408   Bit 5 (write): QUIET_FLAG

409		 - If 0, print early messages.

410		 - If 1, suppress early messages.

411				 This requests to the kernel (decompressor and early

412				 kernel) to not write early messages that require

413				 accessing the display hardware directly.


415   Bit 6 (write): KEEP_SEGMENTS

416		 Protocol: 2.07+

417		 - If 0, reload the segment registers in the 32bit entry point.

418		 - If 1, do not reload the segment registers in the 32bit entry point.

419				 Assume that %cs %ds %ss %es are all set to flat segments with

420				 a base of 0 (or the equivalent for their environment).


422   Bit 7 (write): CAN_USE_HEAP

423		 Set this bit to 1 to indicate that the value entered in the

424		 heap_end_ptr is valid.  If this field is clear, some setup code

425		 functionality will be disabled.


427 Field name:	 setup_move_size

428 Type:		   modify (obligatory)

429 Offset/size:    0x212/2

430 Protocol:	   2.00-2.01


432   When using protocol 2.00 or 2.01, if the real mode kernel is not

433   loaded at 0x90000, it gets moved there later in the loading

434   sequence.  Fill in this field if you want additional data (such as

435   the kernel command line) moved in addition to the real-mode kernel

436   itself.


438   The unit is bytes starting with the beginning of the boot sector.


440   This field is can be ignored when the protocol is 2.02 or higher, or

441   if the real-mode code is loaded at 0x90000.


443 Field name:	 code32_start

444 Type:		   modify (optional, reloc)

445 Offset/size:    0x214/4

446 Protocol:	   2.00+


448   The address to jump to in protected mode.  This defaults to the load

449   address of the kernel, and can be used by the boot loader to

450   determine the proper load address.


452   This field can be modified for two purposes:


454   1. as a boot loader hook (see ADVANCED BOOT LOADER HOOKS below.)


456   2. if a bootloader which does not install a hook loads a

457	  relocatable kernel at a nonstandard address it will have to modify

458	  this field to point to the load address.


460 Field name:	 ramdisk_image

461 Type:		   write (obligatory)

462 Offset/size:    0x218/4

463 Protocol:	   2.00+


465   The 32-bit linear address of the initial ramdisk or ramfs.  Leave at

466   zero if there is no initial ramdisk/ramfs.


468 Field name:	 ramdisk_size

469 Type:		   write (obligatory)

470 Offset/size:    0x21c/4

471 Protocol:	   2.00+


473   Size of the initial ramdisk or ramfs.  Leave at zero if there is no

474   initial ramdisk/ramfs.


476 Field name:	 bootsect_kludge

477 Type:		   kernel internal

478 Offset/size:    0x220/4

479 Protocol:	   2.00+


481   This field is obsolete.


483 Field name:	 heap_end_ptr

484 Type:		   write (obligatory)

485 Offset/size:    0x224/2

486 Protocol:	   2.01+


488   Set this field to the offset (from the beginning of the real-mode

489   code) of the end of the setup stack/heap, minus 0x0200.


491 Field name:	 ext_loader_ver

492 Type:		   write (optional)

493 Offset/size:    0x226/1

494 Protocol:	   2.02+


496   This field is used as an extension of the version number in the

497   type_of_loader field.  The total version number is considered to be

498   (type_of_loader & 0x0f) + (ext_loader_ver << 4).


500   The use of this field is boot loader specific.  If not written, it

501   is zero.


503   Kernels prior to 2.6.31 did not recognize this field, but it is safe

504   to write for protocol version 2.02 or higher.


506 Field name:	 ext_loader_type

507 Type:		   write (obligatory if (type_of_loader & 0xf0) == 0xe0)

508 Offset/size:    0x227/1

509 Protocol:	   2.02+


511   This field is used as an extension of the type number in

512   type_of_loader field.  If the type in type_of_loader is 0xE, then

513   the actual type is (ext_loader_type + 0x10).


515   This field is ignored if the type in type_of_loader is not 0xE.


517   Kernels prior to 2.6.31 did not recognize this field, but it is safe

518   to write for protocol version 2.02 or higher.


520 Field name:	 cmd_line_ptr

521 Type:		   write (obligatory)

522 Offset/size:    0x228/4

523 Protocol:	   2.02+


525   Set this field to the linear address of the kernel command line.

526   The kernel command line can be located anywhere between the end of

527   the setup heap and 0xA0000; it does not have to be located in the

528   same 64K segment as the real-mode code itself.


530   Fill in this field even if your boot loader does not support a

531   command line, in which case you can point this to an empty string

532   (or better yet, to the string "auto".)  If this field is left at

533   zero, the kernel will assume that your boot loader does not support

534   the 2.02+ protocol.


536 Field name:	 ramdisk_max

537 Type:		   read

538 Offset/size:    0x22c/4

539 Protocol:	   2.03+


541   The maximum address that may be occupied by the initial

542   ramdisk/ramfs contents.  For boot protocols 2.02 or earlier, this

543   field is not present, and the maximum address is 0x37FFFFFF.  (This

544   address is defined as the address of the highest safe byte, so if

545   your ramdisk is exactly 131072 bytes long and this field is

546   0x37FFFFFF, you can start your ramdisk at 0x37FE0000.)


548 Field name:	 kernel_alignment

549 Type:		   read/modify (reloc)

550 Offset/size:    0x230/4

551 Protocol:	   2.05+ (read), 2.10+ (modify)


553   Alignment unit required by the kernel (if relocatable_kernel is

554   true.)  A relocatable kernel that is loaded at an alignment

555   incompatible with the value in this field will be realigned during

556   kernel initialization.


558   Starting with protocol version 2.10, this reflects the kernel

559   alignment preferred for optimal performance; it is possible for the

560   loader to modify this field to permit a lesser alignment.  See the

561   min_alignment and pref_address field below.


563 Field name:	 relocatable_kernel

564 Type:		   read (reloc)

565 Offset/size:    0x234/1

566 Protocol:	   2.05+


568   If this field is nonzero, the protected-mode part of the kernel can

569   be loaded at any address that satisfies the kernel_alignment field.

570   After loading, the boot loader must set the code32_start field to

571   point to the loaded code, or to a boot loader hook.


573 Field name:	 min_alignment

574 Type:		   read (reloc)

575 Offset/size:    0x235/1

576 Protocol:	   2.10+


578   This field, if nonzero, indicates as a power of two the minimum

579   alignment required, as opposed to preferred, by the kernel to boot.

580   If a boot loader makes use of this field, it should update the

581   kernel_alignment field with the alignment unit desired; typically:


583		 kernel_alignment = 1 << min_alignment


585   There may be a considerable performance cost with an excessively

586   misaligned kernel.  Therefore, a loader should typically try each

587   power-of-two alignment from kernel_alignment down to this alignment.


589 Field name:	 xloadflags

590 Type:		   read

591 Offset/size:    0x236/2

592 Protocol:	   2.12+


594   This field is a bitmask.


596   Bit 0 (read): XLF_KERNEL_64

597		 - If 1, this kernel has the legacy 64-bit entry point at 0x200.


599   Bit 1 (read): XLF_CAN_BE_LOADED_ABOVE_4G

600		 - If 1, kernel/boot_params/cmdline/ramdisk can be above 4G.


602   Bit 2 (read): XLF_EFI_HANDOVER_32

603		 - If 1, the kernel supports the 32-bit EFI handoff entry point

604		   given at handover_offset.


606   Bit 3 (read): XLF_EFI_HANDOVER_64

607		 - If 1, the kernel supports the 64-bit EFI handoff entry point

608		   given at handover_offset + 0x200.


610 Field name:	 cmdline_size

611 Type:		   read

612 Offset/size:    0x238/4

613 Protocol:	   2.06+


615   The maximum size of the command line without the terminating

616   zero. This means that the command line can contain at most

617   cmdline_size characters. With protocol version 2.05 and earlier, the

618   maximum size was 255.


620 Field name:	 hardware_subarch

621 Type:		   write (optional, defaults to x86/PC)

622 Offset/size:    0x23c/4

623 Protocol:	   2.07+


625   In a paravirtualized environment the hardware low level architectural

626   pieces such as interrupt handling, page table handling, and

627   accessing process control registers needs to be done differently.


629   This field allows the bootloader to inform the kernel we are in one

630   one of those environments.


632   0x00000000    The default x86/PC environment

633   0x00000001    lguest

634   0x00000002    Xen

635   0x00000003    Moorestown MID

636   0x00000004    CE4100 TV Platform


638 Field name:	 hardware_subarch_data

639 Type:		   write (subarch-dependent)

640 Offset/size:    0x240/8

641 Protocol:	   2.07+


643   A pointer to data that is specific to hardware subarch

644   This field is currently unused for the default x86/PC environment,

645   do not modify.


647 Field name:	 payload_offset

648 Type:		   read

649 Offset/size:    0x248/4

650 Protocol:	   2.08+


652   If non-zero then this field contains the offset from the beginning

653   of the protected-mode code to the payload.


655   The payload may be compressed. The format of both the compressed and

656   uncompressed data should be determined using the standard magic

657   numbers.  The currently supported compression formats are gzip

658   (magic numbers 1F 8B or 1F 9E), bzip2 (magic number 42 5A), LZMA

659   (magic number 5D 00), and XZ (magic number FD 37).  The uncompressed

660   payload is currently always ELF (magic number 7F 45 4C 46).


662 Field name:	 payload_length

663 Type:		   read

664 Offset/size:    0x24c/4

665 Protocol:	   2.08+


667   The length of the payload.


669 Field name:	 setup_data

670 Type:		   write (special)

671 Offset/size:    0x250/8

672 Protocol:	   2.09+


674   The 64-bit physical pointer to NULL terminated single linked list of

675   struct setup_data. This is used to define a more extensible boot

676   parameters passing mechanism. The definition of struct setup_data is

677   as follow:


679   struct setup_data {

680		   u64 next;

681		   u32 type;

682		   u32 len;

683		   u8  data[0];

684   };


686   Where, the next is a 64-bit physical pointer to the next node of

687   linked list, the next field of the last node is 0; the type is used

688   to identify the contents of data; the len is the length of data

689   field; the data holds the real payload.


691   This list may be modified at a number of points during the bootup

692   process.  Therefore, when modifying this list one should always make

693   sure to consider the case where the linked list already contains

694   entries.


696 Field name:	 pref_address

697 Type:		   read (reloc)

698 Offset/size:    0x258/8

699 Protocol:	   2.10+


701   This field, if nonzero, represents a preferred load address for the

702   kernel.  A relocating bootloader should attempt to load at this

703   address if possible.


705   A non-relocatable kernel will unconditionally move itself and to run

706   at this address.


708 Field name:	 init_size

709 Type:		   read

710 Offset/size:    0x260/4


712   This field indicates the amount of linear contiguous memory starting

713   at the kernel runtime start address that the kernel needs before it

714   is capable of examining its memory map.  This is not the same thing

715   as the total amount of memory the kernel needs to boot, but it can

716   be used by a relocating boot loader to help select a safe load

717   address for the kernel.


719   The kernel runtime start address is determined by the following algorithm:


721   if (relocatable_kernel)

722		 runtime_start = align_up(load_address, kernel_alignment)

723   else

724		 runtime_start = pref_address


726 Field name:	 handover_offset

727 Type:		   read

728 Offset/size:    0x264/4


730   This field is the offset from the beginning of the kernel image to

731   the EFI handover protocol entry point. Boot loaders using the EFI

732   handover protocol to boot the kernel should jump to this offset.


734   See EFI HANDOVER PROTOCOL below for more details.





739 From boot protocol version 2.08 onwards the CRC-32 is calculated over

740 the entire file using the characteristic polynomial 0x04C11DB7 and an

741 initial remainder of 0xffffffff.  The checksum is appended to the

742 file; therefore the CRC of the file up to the limit specified in the

743 syssize field of the header is always 0.





748 The kernel command line has become an important way for the boot

749 loader to communicate with the kernel.  Some of its options are also

750 relevant to the boot loader itself, see "special command line options"

751 below.


753 The kernel command line is a null-terminated string. The maximum

754 length can be retrieved from the field cmdline_size.  Before protocol

755 version 2.06, the maximum was 255 characters.  A string that is too

756 long will be automatically truncated by the kernel.


758 If the boot protocol version is 2.02 or later, the address of the

759 kernel command line is given by the header field cmd_line_ptr (see

760 above.)  This address can be anywhere between the end of the setup

761 heap and 0xA0000.


763 If the protocol version is *not* 2.02 or higher, the kernel

764 command line is entered using the following protocol:


766		 At offset 0x0020 (word), "cmd_line_magic", enter the magic

767		 number 0xA33F.


769		 At offset 0x0022 (word), "cmd_line_offset", enter the offset

770		 of the kernel command line (relative to the start of the

771		 real-mode kernel).


773		 The kernel command line *must* be within the memory region

774		 covered by setup_move_size, so you may need to adjust this

775		 field.





780 The real-mode code requires a stack/heap to be set up, as well as

781 memory allocated for the kernel command line.  This needs to be done

782 in the real-mode accessible memory in bottom megabyte.


784 It should be noted that modern machines often have a sizable Extended

785 BIOS Data Area (EBDA).  As a result, it is advisable to use as little

786 of the low megabyte as possible.


788 Unfortunately, under the following circumstances the 0x90000 memory

789 segment has to be used:


791		 - When loading a zImage kernel ((loadflags & 0x01) == 0).

792		 - When loading a 2.01 or earlier boot protocol kernel.


794		   -> For the 2.00 and 2.01 boot protocols, the real-mode code

795			  can be loaded at another address, but it is internally

796			  relocated to 0x90000.  For the "old" protocol, the

797			  real-mode code must be loaded at 0x90000.


799 When loading at 0x90000, avoid using memory above 0x9a000.


801 For boot protocol 2.02 or higher, the command line does not have to be

802 located in the same 64K segment as the real-mode setup code; it is

803 thus permitted to give the stack/heap the full 64K segment and locate

804 the command line above it.


806 The kernel command line should not be located below the real-mode

807 code, nor should it be located in high memory.





812 As a sample configuration, assume the following layout of the real

813 mode segment:


815	 When loading below 0x90000, use the entire segment:


817		 0x0000-0x7fff   Real mode kernel

818		 0x8000-0xdfff   Stack and heap

819		 0xe000-0xffff   Kernel command line


821	 When loading at 0x90000 OR the protocol version is 2.01 or earlier:


823		 0x0000-0x7fff   Real mode kernel

824		 0x8000-0x97ff   Stack and heap

825		 0x9800-0x9fff   Kernel command line


827 Such a boot loader should enter the following fields in the header:


829		 unsigned long base_ptr; /* base address for real-mode segment */


831		 if ( setup_sects == 0 ) {

832				 setup_sects = 4;

833		 }


835		 if ( protocol >= 0x0200 ) {

836				 type_of_loader = <type code>;

837				 if ( loading_initrd ) {

838						 ramdisk_image = <initrd_address>;

839						 ramdisk_size = <initrd_size>;

840				 }


842				 if ( protocol >= 0x0202 && loadflags & 0x01 )

843						 heap_end = 0xe000;

844				 else

845						 heap_end = 0x9800;


847				 if ( protocol >= 0x0201 ) {

848						 heap_end_ptr = heap_end - 0x200;

849						 loadflags |= 0x80; /* CAN_USE_HEAP */

850				 }


852				 if ( protocol >= 0x0202 ) {

853						 cmd_line_ptr = base_ptr + heap_end;

854						 strcpy(cmd_line_ptr, cmdline);

855				 } else {

856						 cmd_line_magic  = 0xA33F;

857						 cmd_line_offset = heap_end;

858						 setup_move_size = heap_end + strlen(cmdline)+1;

859						 strcpy(base_ptr+cmd_line_offset, cmdline);

860				 }

861		 } else {

862				 /* Very old kernel */


864				 heap_end = 0x9800;


866				 cmd_line_magic  = 0xA33F;

867				 cmd_line_offset = heap_end;


869				 /* A very old kernel MUST have its real-mode code

870				    loaded at 0x90000 */


872				 if ( base_ptr != 0x90000 ) {

873						 /* Copy the real-mode kernel */

874						 memcpy(0x90000, base_ptr, (setup_sects+1)*512);

875						 base_ptr = 0x90000;			  /* Relocated */

876				 }


878				 strcpy(0x90000+cmd_line_offset, cmdline);


880				 /* It is recommended to clear memory up to the 32K mark */

881				 memset(0x90000 + (setup_sects+1)*512, 0,

882					    (64-(setup_sects+1))*512);

883		 }





888 The 32-bit (non-real-mode) kernel starts at offset (setup_sects+1)*512

889 in the kernel file (again, if setup_sects == 0 the real value is 4.)

890 It should be loaded at address 0x10000 for Image/zImage kernels and

891 0x100000 for bzImage kernels.


893 The kernel is a bzImage kernel if the protocol >= 2.00 and the 0x01

894 bit (LOAD_HIGH) in the loadflags field is set:


896		 is_bzImage = (protocol >= 0x0200) && (loadflags & 0x01);

897		 load_address = is_bzImage ? 0x100000 : 0x10000;


899 Note that Image/zImage kernels can be up to 512K in size, and thus use

900 the entire 0x10000-0x90000 range of memory.  This means it is pretty

901 much a requirement for these kernels to load the real-mode part at

902 0x90000.  bzImage kernels allow much more flexibility.





907 If the command line provided by the boot loader is entered by the

908 user, the user may expect the following command line options to work.

909 They should normally not be deleted from the kernel command line even

910 though not all of them are actually meaningful to the kernel.  Boot

911 loader authors who need additional command line options for the boot

912 loader itself should get them registered in

913 Documentation/kernel-parameters.txt to make sure they will not

914 conflict with actual kernel options now or in the future.


916   vga=<mode>

917		 <mode> here is either an integer (in C notation, either

918		 decimal, octal, or hexadecimal) or one of the strings

919		 "normal" (meaning 0xFFFF), "ext" (meaning 0xFFFE) or "ask"

920		 (meaning 0xFFFD).  This value should be entered into the

921		 vid_mode field, as it is used by the kernel before the command

922		 line is parsed.


924   mem=<size>

925		 <size> is an integer in C notation optionally followed by

926		 (case insensitive) K, M, G, T, P or E (meaning << 10, << 20,

927		 << 30, << 40, << 50 or << 60).  This specifies the end of

928		 memory to the kernel. This affects the possible placement of

929		 an initrd, since an initrd should be placed near end of

930		 memory.  Note that this is an option to *both* the kernel and

931		 the bootloader!


933   initrd=<file>

934		 An initrd should be loaded.  The meaning of <file> is

935		 obviously bootloader-dependent, and some boot loaders

936		 (e.g. LILO) do not have such a command.


938 In addition, some boot loaders add the following options to the

939 user-specified command line:


941   BOOT_IMAGE=<file>

942		 The boot image which was loaded.  Again, the meaning of <file>

943		 is obviously bootloader-dependent.


945   auto

946		 The kernel was booted without explicit user intervention.


948 If these options are added by the boot loader, it is highly

949 recommended that they are located *first*, before the user-specified

950 or configuration-specified command line.  Otherwise, "init=/bin/sh"

951 gets confused by the "auto" option.





956 The kernel is started by jumping to the kernel entry point, which is

957 located at *segment* offset 0x20 from the start of the real mode

958 kernel.  This means that if you loaded your real-mode kernel code at

959 0x90000, the kernel entry point is 9020:0000.


961 At entry, ds = es = ss should point to the start of the real-mode

962 kernel code (0x9000 if the code is loaded at 0x90000), sp should be

963 set up properly, normally pointing to the top of the heap, and

964 interrupts should be disabled.  Furthermore, to guard against bugs in

965 the kernel, it is recommended that the boot loader sets fs = gs = ds =

966 es = ss.


968 In our example from above, we would do:


970		 /* Note: in the case of the "old" kernel protocol, base_ptr must

971		    be == 0x90000 at this point; see the previous sample code */


973		 seg = base_ptr >> 4;


975		 cli();  /* Enter with interrupts disabled! */


977		 /* Set up the real-mode kernel stack */

978		 _SS = seg;

979		 _SP = heap_end;


981		 _DS = _ES = _FS = _GS = seg;

982		 jmp_far(seg+0x20, 0);   /* Run the kernel */


984 If your boot sector accesses a floppy drive, it is recommended to

985 switch off the floppy motor before running the kernel, since the

986 kernel boot leaves interrupts off and thus the motor will not be

987 switched off, especially if the loaded kernel has the floppy driver as

988 a demand-loaded module!





993 If the boot loader runs in a particularly hostile environment (such as

994 LOADLIN, which runs under DOS) it may be impossible to follow the

995 standard memory location requirements.  Such a boot loader may use the

996 following hooks that, if set, are invoked by the kernel at the

997 appropriate time.  The use of these hooks should probably be

998 considered an absolutely last resort!


1000 IMPORTANT: All the hooks are required to preserve %esp, %ebp, %esi and

1001 %edi across invocation.


1003   realmode_swtch:

1004		 A 16-bit real mode far subroutine invoked immediately before

1005		 entering protected mode.  The default routine disables NMI, so

1006		 your routine should probably do so, too.


1008   code32_start:

1009		 A 32-bit flat-mode routine *jumped* to immediately after the

1010		 transition to protected mode, but before the kernel is

1011		 uncompressed.  No segments, except CS, are guaranteed to be

1012		 set up (current kernels do, but older ones do not); you should

1013		 set them up to BOOT_DS (0x18) yourself.


1015		 After completing your hook, you should jump to the address

1016		 that was in this field before your boot loader overwrote it

1017		 (relocated, if appropriate.)



1020 **** 32-bit BOOT PROTOCOL


1022 For machine with some new BIOS other than legacy BIOS, such as EFI,

1023 LinuxBIOS, etc, and kexec, the 16-bit real mode setup code in kernel

1024 based on legacy BIOS can not be used, so a 32-bit boot protocol needs

1025 to be defined.


1027 In 32-bit boot protocol, the first step in loading a Linux kernel

1028 should be to setup the boot parameters (struct boot_params,

1029 traditionally known as "zero page"). The memory for struct boot_params

1030 should be allocated and initialized to all zero. Then the setup header

1031 from offset 0x01f1 of kernel image on should be loaded into struct

1032 boot_params and examined. The end of setup header can be calculated as

1033 follow:


1035		 0x0202 + byte value at offset 0x0201


1037 In addition to read/modify/write the setup header of the struct

1038 boot_params as that of 16-bit boot protocol, the boot loader should

1039 also fill the additional fields of the struct boot_params as that

1040 described in zero-page.txt.


1042 After setting up the struct boot_params, the boot loader can load the

1043 32/64-bit kernel in the same way as that of 16-bit boot protocol.


1045 In 32-bit boot protocol, the kernel is started by jumping to the

1046 32-bit kernel entry point, which is the start address of loaded

1047 32/64-bit kernel.


1049 At entry, the CPU must be in 32-bit protected mode with paging

1050 disabled; a GDT must be loaded with the descriptors for selectors

1051 __BOOT_CS(0x10) and __BOOT_DS(0x18); both descriptors must be 4G flat

1052 segment; __BOOT_CS must have execute/read permission, and __BOOT_DS

1053 must have read/write permission; CS must be __BOOT_CS and DS, ES, SS

1054 must be __BOOT_DS; interrupt must be disabled; %esi must hold the base

1055 address of the struct boot_params; %ebp, %edi and %ebx must be zero.




1059 This protocol allows boot loaders to defer initialisation to the EFI

1060 boot stub. The boot loader is required to load the kernel/initrd(s)

1061 from the boot media and jump to the EFI handover protocol entry point

1062 which is hdr->handover_offset bytes from the beginning of

1063 startup_{32,64}.


1065 The function prototype for the handover entry point looks like this,


1067	 efi_main(void *handle, efi_system_table_t *table, struct boot_params *bp)


1069 'handle' is the EFI image handle passed to the boot loader by the EFI

1070 firmware, 'table' is the EFI system table - these are the first two

1071 arguments of the "handoff state" as described in section 2.3 of the

1072 UEFI specification. 'bp' is the boot loader-allocated boot params.


1074 The boot loader *must* fill out the following fields in bp,


1076	 o hdr.code32_start

1077	 o hdr.cmd_line_ptr

1078	 o hdr.cmdline_size

1079	 o hdr.ramdisk_image (if applicable)

1080	 o hdr.ramdisk_size  (if applicable)


1082 All other fields should be zero.


Share this post

Link to post
Share on other sites


Xolo X500 will get 4.1 that means we can get the 4.1 for xolo x900

Edited by ashutosh00074

Share this post

Link to post
Share on other sites

do this boot in to fastboot and type this

fastboot -i 0x8087 oem erase system


fastboot -i 0x8087 oem erase cache


fastboot -i 0x8087 oem erase factory


fastboot -i 0x8087 oem erase sdcard

then brick fix

if after this its still the same then you'll need to send it for repair as this will wipe everything apart from boot recovery and fastboot

Microsoft Windows XP [Version 5.1.2600]

© Copyright 1985-2001 Microsoft Corp.

C:\SanDiego\tools>fastboot -i 0x8087 oem erase system

... OKAY [ 50.266s]

finished. total time: 50.266s

C:\SanDiego\tools>fastboot -i 0x8087 oem erase cache

... OKAY [108.078s]

finished. total time: 108.078s

C:\SanDiego\tools>fastboot -i 0x8087 oem erase factory

... OKAY [ 18.297s]

finished. total time: 18.297s

C:\SanDiego\tools>fastboot -i 0x8087 oem erase sdcard

... FAILED (remote: erase)

finished. total time: 1532.234s

C:\SanDiego\tools>fastboot -i 0x8087 oem erase sdcard

... FAILED (remote: erase)

finished. total time: 1559.094s



Share this post

Link to post
Share on other sites

fastboot -i 0x8087 oem erase /sdcard


Share this post

Link to post
Share on other sites

Xolo X500 will get 4.1 that means we can get the 4.1 for xolo x900

does the x500 use ics which we use with the X900 then?

Share this post

Link to post
Share on other sites

Hello man, i'vo got an Orange San Diego

When i boot the phone, he asks me my Gmail account but i don't remember this!

Si i can't unlock the phone in the lock screen.

And when i want to enter in recovery mode, i just see the droidboot logo.

Help me please! :wacko:

Romain from France


Share this post

Link to post
Share on other sites

The xolo x500 is a lot less powerful than the OSD so I don't see why we shouldn't receive jellybean if that device is


Share this post

Link to post
Share on other sites

The xolo x500 is a lot less powerful than the OSD so I don't see why we shouldn't receive jellybean if that device is

More powerful but is it as popular? I could see them continuing support on the x500, over the AZ210, if that model sold a lot more units.


Share this post

Link to post
Share on other sites

Hello man, i'vo got an Orange San Diego

When i boot the phone, he asks me my Gmail account but i don't remember this!

Si i can't unlock the phone in the lock screen.

And when i want to enter in recovery mode, i just see the droidboot logo.

Help me please! :wacko:

Romain from France


Share this post

Link to post
Share on other sites

shut phone down and then hold volume up and at the same time press power your phone will enter recovery the factory reset but this will format all data on phone even your sdcard


Share this post

Link to post
Share on other sites

I've make this but the phone is lock in the droidboot load :/


Share this post

Link to post
Share on other sites

It says remount failed: operation not permitted when trying to deodex it with the tool.

What am I doing wrong?


Share this post

Link to post
Share on other sites
It says remount failed: operation not permitted when trying to deodex it with the tool.

What am I doing wrong?

was root sucesfull?

Share this post

Link to post
Share on other sites

Yeah root worked, but deodexing doesn't.


Share this post

Link to post
Share on other sites

did you enble adbd unsecure both boxes and then remove usb wait min and plug in


Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

MoDaCo is part of the MoDaCo.network, © Paul O'Brien 2002-2016. MoDaCo uses IntelliTxt technology.