Database Users

Getting serious about root: FIOASYNC bug

Presently we're running a little short on kernel exploits, with the following being the only one that looks remotely plausible:
http://xorl.wordpress.com/2010/01/14/cve-2009-4141-linux-kernel-fasync-locked-file-use-after-free/
Big hold-up? For all that we have a trigger, we don't have an exploit. I believe it's up to us at this point to make that happen.
If I'm reading it right, it looks like the bug initially rears its head right here:
Code:
void __kill_fasync(struct fasync_struct *fa, int sig, int band)
{
while (fa) {
struct fown_struct * fown;
if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n");
return;
}
[B]fown = &fa->fa_file->f_owner;[/B]
/* Don't send SIGURG to processes which have not set a
queued signum: SIGURG has its own default signalling
mechanism. */
if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band);
fa = fa->fa_next;
}
}
... as fa_file now points to invalid memory (having been free'd earlier). The f_owner member gets shot out to send_sigio, which look like this:
Code:
void send_sigio(struct fown_struct *fown, int fd, int band)
{
struct task_struct *p;
enum pid_type type;
struct pid *pid;
int group = 1;
read_lock(&fown->lock);
type = fown->pid_type;
if (type == PIDTYPE_MAX) {
group = 0;
type = PIDTYPE_PID;
}
[B]pid = fown->pid;[/B]
if (!pid)
goto out_unlock_fown;
read_lock(&tasklist_lock);
do_each_pid_task(pid, type, p) {
send_sigio_to_task(p, fown, fd, band, group);
} while_each_pid_task(pid, type, p);
read_unlock(&tasklist_lock);
out_unlock_fown:
read_unlock(&fown->lock);
}
... in which we see the f_owner member being dereferenced. Also it gets pushed through several other functions which may be exploitable.
There are several questions to be answered before we can start attacking this:
Can we resolve the address of the fa_file data structure so we can overwrite the f_owner value?
Can we do anything with it once we've done that? (Presumably we can set it to zero to cause a null-pointer dereference, but we're mmap_min_addr = 32768 on the most recent versions, so unless we can flag the mmap region to grow down and apply memory pressure to reach page 0 this will do us no good.)
Failing the plan above: are any of the functions that f_owner gets pushed into vulnerable? I evaluated this over the weekend, but without the help of a trained kernel dev I'm not going to get very far.
While I studied a lot of this in uni, I'll admit I'm green when it comes to actually writing these exploits. I'm hoping that this will get the creative juices flowing, and perhaps provide a more comprehensive resource in case any hard-core kernel hackers want to take a look at what we're doing or give us pointers (harhar) in the right direction.
Thanks, guys. Great work up to this point.

In the original POC if you change /bin/true to /system/bin/sh you can get a new shell to open just not as root. So I'm guessing that their needs to be more added to the POC to make it a full exploit.

Right, the fork()'s in the PoC exist only to cause the file descriptor's fasync_struct to be erroneously killed, not start a root session. The root session would need to be started (presumably) by the kernel doing something to our maliciously crafted fown_struct.
The tough part is figuring out exactly where and what that fown_struct needs to be.

Well I definetly agree with you that this seems to be our best best bet I am some what of a newbie when it comes to linux allthough i am learning as i go. Do you know of any good sites to read up on kernel hacking?

Sorry Guys just got the word that this one is dead for us.....
Here is the explantion i got.
some_person said:
Nope, the bug didn't exist in 2.6.27. That's why they say >= 2.6.28 are vulnerable.
As far as how the bug works, there are 2 other issues. 1) our kernel probably wasn't compiled with AT_RANDOM 2) we don't have an elf executable.
The exploit you found does not give us root access, it crashes the system. Basically, you open the "random number generator" file, lock it, and close it... but the lock release when you close it. Then you have to call an elf executable because that generates a random number (running an elf executable) provided the kernel was compiled AT_RANDOM. you continue to call that executable (and generating random numbers) until the the lock is released on the "random number generator" file... then it's your program's turn... the kernel tries to send your program notification that the file is available, but your program has moved on. BLAM the kernel stops (or "oops").
Click to expand...
Click to collapse

Sorry to dredge up an old thread:
This exploit *will* work. According to Zanfur, the hole is in our kernel. We need to use it without AT_RANDOM (which I dont know how to do).

http://sourceware.org/ml/libc-alpha/2008-10/msg00016.html

I am pretty sure we do have elf executables, here is proof:
% file m6
m6: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), not stripped
If our kernel is susceptible to this bug then it should work, as long as there is a way to do it without at random.

Though I do not in any way represent my self as a hacker or developer I was wondering if I could throw in my 2 cents. I notice that this bug/exploit won't work because it requires AT RANDOM. I was wondering if it s possible to write code that does what the function does and insert it in. Is root required to do this (i.e. insert code into the kernel that wasn't there before) or is this a matter of know-how? Just some brainstorming I thought that I would throw in.

jballz0682 said:
Though I do not in any way represent my self as a hacker or developer I was wondering if I could throw in my 2 cents. I notice that this bug/exploit won't work because it requires AT RANDOM. I was wondering if it s possible to write code that does what the function does and insert it in. Is root required to do this (i.e. insert code into the kernel that wasn't there before) or is this a matter of know-how? Just some brainstorming I thought that I would throw in.
Click to expand...
Click to collapse
This won't get us root. Even zanfur said it. Moving on....

Framework43 said:
This won't get us root. Even zanfur said it. Moving on....
Click to expand...
Click to collapse
To clarify, even if we get AT_RANDOM functionality working, we can't use this to exploit our kernel. All we can do with this is get data from a file that was recently closed. The point of this exploit is to send a signal to a process, but there are no processes we could send a signal to that would give us root.

Our kernel seems practically invulnerable, it appears that almost all exploits are patched

[Q] Building omni 4.4.1 fails (libgccdemangle)

Hi,
In the past I've built CM for various devices/versions. Moving to omni, I'd like to build for my jfltexx, but it fails during some of the static library builds:
I thought it might be jfltexx specific, but mako dies in a similar way:
Code:
host C: libcorkscrew <= system/core/libcorkscrew/arch-x86/ptrace-x86.c
host SharedLib: libgccdemangle (/home/darrens/android/omni/out/host/linux-x86/obj/lib/libgccdemangle.so)
/home/darrens/android/omni/out/host/linux-x86/obj/SHARED_LIBRARIES/libgccdemangle_intermediates/cp-demangle.o: file not recognized: File truncated
collect2: ld returned 1 exit status
make: *** [/home/darrens/android/omni/out/host/linux-x86/obj/lib/libgccdemangle.so] Error 1
make: *** Waiting for unfinished jobs....
I have a clean tree for CM11 - it is looking like mako will succeed (the .o files that are empty above are present in the CM build) CM11 jfltexx fails, but in a different way to omni.
EDIT: Just produced cm-11-20131212-UNOFFICIAL-mako.zip, but still no luck.
BTW - love the approach omni is taking. As a long time user of Fedora, I can see parallels in the engagement model. The community will be able to engage in a more stuctured way (discussing bugs randomly on XDA is a poor way to manage issues in unreleased software), and I suspect it will be easier for people to stand up and submit fixes, or even report bugs. Good job.

Ah - might be my bad. Had my machine freeze at some stage after/during repo sync - might have corrupted something that wasn't detected by re-sync. removed the source for this lib, and re synced - it's built the object files now, but failed on a few others. Might blow away the whole lot and start clean (is there a way to check integrity of files in the repo?)

dazbys said:
Ah - might be my bad. Had my machine freeze at some stage after/during repo sync - might have corrupted something that wasn't detected by re-sync. removed the source for this lib, and re synced - it's built the object files now, but failed on a few others. Might blow away the whole lot and start clean (is there a way to check integrity of files in the repo?)
Click to expand...
Click to collapse
Nuke your working folder and do a sync from scratch using this method: http://forum.xda-developers.com/showpost.php?p=47625075&postcount=666
It'll sync in no time at all because you already have CM11.0 sauce™ code.

Success
chasmodo said:
Nuke your working folder and do a sync from scratch using this method: http://forum.xda-developers.com/showpost.php?p=47625075&postcount=666
It'll sync in no time at all because you already have CM11.0 sauce™ code.
Click to expand...
Click to collapse
Yep - some corrupted stuff in my repo - all synced and build OK.
Do you know if I need to extract the proprietary files for the final product to run properly? I ran extract-files.sh, and it failed to find some (using my existing omni 4.4.2 device as the source).

dazbys said:
Yep - some corrupted stuff in my repo - all synced and build OK.
Do you know if I need to extract the proprietary files for the final product to run properly? I ran extract-files.sh, and it failed to find some (using my existing omni 4.4.2 device as the source).
Click to expand...
Click to collapse
I don't know for sure for your device, but I compile builds for n7000 and n7100 using DonCoyote/Samsung blobs, not extracted stuff.

chasmodo said:
I don't know for sure for your device, but I compile builds for n7000 and n7100 using DonCoyote/Samsung blobs, not extracted stuff.
Click to expand...
Click to collapse
OK. I've seen a ref to that, and theMuppets. I guess without the blobs, big chunks of the device won't work. I'll just have to try it out I guess (then perhaps I can assist with the build_jfltexx page on the wiki). I'll add that to my config, as per the i9300 instructions .

dazbys said:
OK. I've seen a ref to that, and theMuppets. I guess without the blobs, big chunks of the device won't work. I'll just have to try it out I guess (then perhaps I can assist with the build_jfltexx page on the wiki). I'll add that to my config, as per the i9300 instructions .
Click to expand...
Click to collapse
I'm trying to build for a jfltexx, but I'm stuck here:
Code:
make: *** Nessuna regola per generare l'obiettivo "/home/francesco/android/omni/out/target/product/jfltexx/obj/lib/libtime_genoff.so", necessario per "/home/francesco/android/omni/out/target/product/jfltexx/obj/SHARED_LIBRARIES/libandroid_runtime_intermediates/LINKED/libandroid_runtime.so". Arresto.
make: *** Attesa per i processi non terminati....
external/sqlite/dist/sqlite3.c: In function 'pcache1Fetch':
external/sqlite/dist/sqlite3.c:37669:25: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
external/sqlite/dist/sqlite3.c:37671:25: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
external/sqlite/dist/sqlite3.c: In function 'fts3SnippetFunc':
external/sqlite/dist/sqlite3.c:129896:11: warning: 'iS' may be used uninitialized in this function [-Wmaybe-uninitialized]
external/sqlite/dist/sqlite3.c:129888:13: note: 'iS' was declared here
Can you please tell me what steps are after Setting Up A Compile Environment?
Thanks

TheMorpheus said:
I'm trying to build for a jfltexx, but I'm stuck here:
Code:
make: *** Nessuna regola per generare l'obiettivo "/home/francesco/android/omni/out/target/product/jfltexx/obj/lib/libtime_genoff.so", necessario per "/home/francesco/android/omni/out/target/product/jfltexx/obj/SHARED_LIBRARIES/libandroid_runtime_intermediates/LINKED/libandroid_runtime.so". Arresto.
make: *** Attesa per i processi non terminati....
external/sqlite/dist/sqlite3.c: In function 'pcache1Fetch':
external/sqlite/dist/sqlite3.c:37669:25: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
external/sqlite/dist/sqlite3.c:37671:25: warning: suggest braces around empty body in an 'if' statement [-Wempty-body]
external/sqlite/dist/sqlite3.c: In function 'fts3SnippetFunc':
external/sqlite/dist/sqlite3.c:129896:11: warning: 'iS' may be used uninitialized in this function [-Wmaybe-uninitialized]
external/sqlite/dist/sqlite3.c:129888:13: note: 'iS' was declared here
Can you please tell me what steps are after Setting Up A Compile Environment?
Thanks
Click to expand...
Click to collapse
Flash latest nightly and do ./device/samsung/jfltexx/extract-files.sh

bugs with SHV-E210K build (i9300 variant)

I have Omni booting and running on a E210K (It is a SGS3 Korean variant, only changes are LTE, 2GB and DMB antenna), but some major bugs need fixing. There not much if any device trees for these out there so I have just been modifying the i9300 and it works.
These are probably the major two issues I have for now:
1. without manually adding ro.zygote.disable_gl_preload=1 to the build prop, it won't boot. I noticed this line wasn't in the i9300 builds either, but it's definitely referenced in my builds:
/android/omni/device/samsung/smdk4412-common/common.mk
# Set default USB interface
PRODUCT_DEFAULT_PROPERTY_OVERRIDES += \
persist.sys.usb.config=mtp \
ro.zygote.disable_gl_preload=true
Click to expand...
Click to collapse
2. Can't adjust the vibration in advanced settings, when I do I get the logcat message below, there is no (very light) feedback because it seems the value is set very low.
If I manually edit the values (by putting it up to 10+) I can get feedback, so it is working.
Code:
I/ActivityManager( 2466): Displayed org.omnirom.device/.DeviceSettings: +428ms
W/DeviceSettings_Utils_Read( 5375): file /sys/vibrator/pwm_val: 2
W/DeviceSettings_Utils( 5375): file /sys/vibrator/pwm_val not found: java.io.FileNotFoundException: /sys/vibrator/pwm_val: open failed: EACCES (Permission denied)
W/DeviceSettings_Haptic( 5375): key: vibrator_tuning
but I have no idea where/how to proceed.
My device tree is up over at:
https://github.com/kaijura/android_device_samsung_e210k
I am using the same omni sources for smdk4412-common and kernel.
Thanks in advance

kaijura said:
I have Omni booting and running on a E210K (It is a SGS3 Korean variant, only changes are LTE, 2GB and DMB antenna), but some major bugs need fixing. There not much if any device trees for these out there so I have just been modifying the i9300 and it works.
These are probably the major two issues I have for now:
1. without manually adding ro.zygote.disable_gl_preload=1 to the build prop, it won't boot. I noticed this line wasn't in the i9300 builds either, but it's definitely referenced in my builds:
2. Can't adjust the vibration in advanced settings, when I do I get the logcat message below, there is no (very light) feedback because it seems the value is set very low.
If I manually edit the values (by putting it up to 10+) I can get feedback, so it is working.
Code:
I/ActivityManager( 2466): Displayed org.omnirom.device/.DeviceSettings: +428ms
W/DeviceSettings_Utils_Read( 5375): file /sys/vibrator/pwm_val: 2
W/DeviceSettings_Utils( 5375): file /sys/vibrator/pwm_val not found: java.io.FileNotFoundException: /sys/vibrator/pwm_val: open failed: EACCES (Permission denied)
W/DeviceSettings_Haptic( 5375): key: vibrator_tuning
but I have no idea where/how to proceed.
My device tree is up over at:
https://github.com/kaijura/android_device_samsung_e210k
I am using the same omni sources for smdk4412-common and kernel.
Thanks in advance
Click to expand...
Click to collapse
LTE screams "qcom modem" to me - perhaps look at the i9305 tree?

Figured it out, for anyone searching for this problem - the issue has to do with the ramdisk portion of a (custom) kernel as it wasn't matching up omni's init setups.
Entropy512 said:
LTE screams "qcom modem" to me - perhaps look at the i9305 tree?
Click to expand...
Click to collapse
Tried a i9305 build it was a little worse off (no mobile connection), haha. I'm thinking of submitting for an official build after I figure out the build for a working stock omni kernel.
Since this device gets few attention (maybe less than 50 in the sgs3 forum) is it possible that you guys could set the jenkins buildbot to build like every week or other week?

kaijura said:
Figured it out, for anyone searching for this problem - the issue has to do with the ramdisk portion of a (custom) kernel as it wasn't matching up omni's init setups.
Tried a i9305 build it was a little worse off (no mobile connection), haha. I'm thinking of submitting for an official build after I figure out the build for a working stock omni kernel.
Since this device gets few attention (maybe less than 50 in the sgs3 forum) is it possible that you guys could set the jenkins buildbot to build like every week or other week?
Click to expand...
Click to collapse
Hmm, that might be a possibility...

kaijura said:
I have Omni booting and running on a E210K (It is a SGS3 Korean variant, only changes are LTE, 2GB and DMB antenna), but some major bugs need fixing. There not much if any device trees for these out there so I have just been modifying the i9300 and it works.
These are probably the major two issues I have for now:
1. without manually adding ro.zygote.disable_gl_preload=1 to the build prop, it won't boot. I noticed this line wasn't in the i9300 builds either, but it's definitely referenced in my builds:
2. Can't adjust the vibration in advanced settings, when I do I get the logcat message below, there is no (very light) feedback because it seems the value is set very low.
If I manually edit the values (by putting it up to 10+) I can get feedback, so it is working.
Code:
I/ActivityManager( 2466): Displayed org.omnirom.device/.DeviceSettings: +428ms
W/DeviceSettings_Utils_Read( 5375): file /sys/vibrator/pwm_val: 2
W/DeviceSettings_Utils( 5375): file /sys/vibrator/pwm_val not found: java.io.FileNotFoundException: /sys/vibrator/pwm_val: open failed: EACCES (Permission denied)
W/DeviceSettings_Haptic( 5375): key: vibrator_tuning
but I have no idea where/how to proceed.
My device tree is up over at:
https://github.com/kaijura/android_device_samsung_e210k
I am using the same omni sources for smdk4412-common and kernel.
Thanks in advance
Click to expand...
Click to collapse
This says u r building a rom.Is it working fine?
thanks

Omni for MSM8974

Hello I am trying to port the beloved OmniRom to my device which is a KLTE (Samsung Galaxy S5) I have successfully built the ROM from source using kernel and device configs from CM and of course some fixes and cherry picking. The issue I have now is that the ROM will not boot.
I stays at my carrier logo (Samsung) so it does not even let me cat-log. I tried to install the ROM and then restored a backup of Cyanogenmods system directory. It boots to android but all apps forceclose. I did this to see if it was an issue with the boot image and since it can boot to a different system partition I don't believe its a boot.img issue or kernel issue for that matter. Or is it?
Any help getting this to boot would be appreciated. I can provide build logs and my device repo if needed.

gigoo25 said:
Hello I am trying to port the beloved OmniRom to my device which is a KLTE (Samsung Galaxy S5) I have successfully built the ROM from source using kernel and device configs from CM and of course some fixes and cherry picking. The issue I have now is that the ROM will not boot.
I stays at my carrier logo (Samsung) so it does not even let me cat-log. I tried to install the ROM and then restored a backup of Cyanogenmods system directory. It boots to android but all apps forceclose. I did this to see if it was an issue with the boot image and since it can boot to a different system partition I don't believe its a boot.img issue or kernel issue for that matter. Or is it?
Any help getting this to boot would be appreciated. I can provide build logs and my device repo if needed.
Click to expand...
Click to collapse
MSM8974 is our first CAF chipset we're working on supporting.
I'd suggest looking at the Oppo find7/msm8974-common repos as nearly all initial CAF 8974 work is being done on the Find7.
you need android-5.1-caf branches for frameworks/av and frameworks/native for a CAF device until I finish the merge effort

Entropy512 said:
MSM8974 is our first CAF chipset we're working on supporting.
I'd suggest looking at the Oppo find7/msm8974-common repos as nearly all initial CAF 8974 work is being done on the Find7.
you need android-5.1-caf branches for frameworks/av and frameworks/native for a CAF device until I finish the merge effort
Click to expand...
Click to collapse
Thank you! That explains a lot. Maybe you can help me again? I keep coming across building with legacy opposed to CAF and to change it in the configs... What configs are they talking about?
Sent from my SM-G900T using XDA Free mobile app

gigoo25 said:
Thank you! That explains a lot. Maybe you can help me again? I keep coming across building with legacy opposed to CAF and to change it in the configs... What configs are they talking about?
Sent from my SM-G900T using XDA Free mobile app
Click to expand...
Click to collapse
You mean AOSP HALs? It's pretty rare for a CAF device to work with vanilla AOSP HALs.
It's the various QCOM_blah_VARIANT flags - 8974s are caf-bfam

Entropy512 said:
You mean AOSP HALs? It's pretty rare for a CAF device to work with vanilla AOSP HALs.
It's the various QCOM_blah_VARIANT flags - 8974s are caf-bfam
Click to expand...
Click to collapse
Updated my repo to 5.1 source but still getting errors. Here is the device configs that I am using. I am getting the same errors throughout.
First error was
Code:
frameworks/base/core/jni/android_view_Surface.cpp:206:14: error: 'class android::Surface' has no member named 'setDirtyRect'
surface->setDirtyRect(&rect);
Which I solved by cherry-picking THIS
Next I get an error that msmcal-hwdep.h is not found not sure how to fix this yet...
I recreated my devices config from scratch and uploaded it to git... Maybe you can take a look when you have some free time? It would mean alot! https://github.com/Gigoo25/android_device_samsung_klte

gigoo25 said:
Updated my repo to 5.1 source but still getting errors. Here is the device configs that I am using. I am getting the same errors throughout.
First error was
Code:
frameworks/base/core/jni/android_view_Surface.cpp:206:14: error: 'class android::Surface' has no member named 'setDirtyRect'
surface->setDirtyRect(&rect);
Which I solved by cherry-picking THIS
Next I get an error that msmcal-hwdep.h is not found not sure how to fix this yet...
I recreated my devices config from scratch and uploaded it to git... Maybe you can take a look when you have some free time? It would mean alot! https://github.com/Gigoo25/android_device_samsung_klte
Click to expand...
Click to collapse
msmcal_hwdep - look at the stiff in your kernel source under include/ - all of that header-y stuff in some of the Kconfigs
You shouldn't be cherrypicking that, I'm not sure why Max even put that up. Until I finish the CAF av/native merge, anyone declaring QCOM_HARDWARE should be using the android-5.1-caf branches of av and native

Entropy512 said:
msmcal_hwdep - look at the stiff in your kernel source under include/ - all of that header-y stuff in some of the Kconfigs
You shouldn't be cherrypicking that, I'm not sure why Max even put that up. Until I finish the CAF av/native merge, anyone declaring QCOM_HARDWARE should be using the android-5.1-caf branches of av and native
Click to expand...
Click to collapse
Awesome! alright will look into that
Sent from my SM-G900T using XDA Free mobile app

Entropy512 said:
msmcal_hwdep - look at the stiff in your kernel source under include/ - all of that header-y stuff in some of the Kconfigs
You shouldn't be cherrypicking that, I'm not sure why Max even put that up. Until I finish the CAF av/native merge, anyone declaring QCOM_HARDWARE should be using the android-5.1-caf branches of av and native
Click to expand...
Click to collapse
Having issues compiling the camera I get the error
Code:
device/samsung/klte/camera/CameraWrapper.cpp: In function 'char* camera_fixup_setparams(int, const char*)':
device/samsung/klte/camera/CameraWrapper.cpp:161:20: error: 'KEY_DIS' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_DIS, android::CameraParameters::DIS_DISABLE);
^
device/samsung/klte/camera/CameraWrapper.cpp:161:56: error: 'DIS_DISABLE' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_DIS, android::CameraParameters::DIS_DISABLE);
^
device/samsung/klte/camera/CameraWrapper.cpp:162:20: error: 'KEY_ZSL' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_OFF);
^
device/samsung/klte/camera/CameraWrapper.cpp:162:56: error: 'ZSL_OFF' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_OFF);
^
device/samsung/klte/camera/CameraWrapper.cpp:164:20: error: 'KEY_ZSL' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_ON);
^
device/samsung/klte/camera/CameraWrapper.cpp:164:56: error: 'ZSL_ON' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_ON);
^
make: *** [/home/rob/android/omni51/out/target/product/klte/obj/SHARED_LIBRARIES/camera.msm8974_intermediates/CameraWrapper.o] Error 1
make: *** Waiting for unfinished jobs...
Is this a framework issue?

gigoo25 said:
Having issues compiling the camera I get the error
Code:
device/samsung/klte/camera/CameraWrapper.cpp: In function 'char* camera_fixup_setparams(int, const char*)':
device/samsung/klte/camera/CameraWrapper.cpp:161:20: error: 'KEY_DIS' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_DIS, android::CameraParameters::DIS_DISABLE);
^
device/samsung/klte/camera/CameraWrapper.cpp:161:56: error: 'DIS_DISABLE' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_DIS, android::CameraParameters::DIS_DISABLE);
^
device/samsung/klte/camera/CameraWrapper.cpp:162:20: error: 'KEY_ZSL' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_OFF);
^
device/samsung/klte/camera/CameraWrapper.cpp:162:56: error: 'ZSL_OFF' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_OFF);
^
device/samsung/klte/camera/CameraWrapper.cpp:164:20: error: 'KEY_ZSL' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_ON);
^
device/samsung/klte/camera/CameraWrapper.cpp:164:56: error: 'ZSL_ON' is not a member of 'android::CameraParameters'
params.set(android::CameraParameters::KEY_ZSL, android::CameraParameters::ZSL_ON);
^
make: *** [/home/rob/android/omni51/out/target/product/klte/obj/SHARED_LIBRARIES/camera.msm8974_intermediates/CameraWrapper.o] Error 1
make: *** Waiting for unfinished jobs...
Is this a framework issue?
Click to expand...
Click to collapse
Looks like maybe some missing Samsung patches

Entropy512 said:
Looks like maybe some missing Samsung patches
Click to expand...
Click to collapse
I appreciate all the help you have been giving me in trying to port Omni to the KLTE! I could not have done it without you!
I ended up having a booting and working build when I removed the camera and RIL
RIL gives me an error of
Code:
frameworks/opt/telephony/../../../device/samsung/klte/ril/telephony/java/com/android/internal/telephony/KlteRIL.java:282: error: no suitable constructor found for SignalStrength(int,int,int,int,int,int,int,int,int,int,int,int,int,boolean)
return new SignalStrength(gsmSignalStrength, gsmBitErrorRate, cdmaDbm, cdmaEcio, evdoDbm,
^
constructor SignalStrength.SignalStrength(Parcel) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(SignalStrength) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(int,int,int,int,int,int,int,boolean) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(int,int,int,int,int,int,int,int,int,int,int,int,boolean) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(boolean) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength() is not applicable
(actual and formal argument lists differ in length)
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.
1 error
It should be a frameworks/opt/telephony issue correct? Except it doesn't display the full file path?

gigoo25 said:
I appreciate all the help you have been giving me in trying to port Omni to the KLTE! I could not have done it without you!
I ended up having a booting and working build when I removed the camera and RIL
RIL gives me an error of
Code:
frameworks/opt/telephony/../../../device/samsung/klte/ril/telephony/java/com/android/internal/telephony/KlteRIL.java:282: error: no suitable constructor found for SignalStrength(int,int,int,int,int,int,int,int,int,int,int,int,int,boolean)
return new SignalStrength(gsmSignalStrength, gsmBitErrorRate, cdmaDbm, cdmaEcio, evdoDbm,
^
constructor SignalStrength.SignalStrength(Parcel) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(SignalStrength) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(int,int,int,int,int,int,int,boolean) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(int,int,int,int,int,int,int,int,int,int,int,int,boolean) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength(boolean) is not applicable
(actual and formal argument lists differ in length)
constructor SignalStrength.SignalStrength() is not applicable
(actual and formal argument lists differ in length)
Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: Some input files use unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.
1 error
It should be a frameworks/opt/telephony issue correct? Except it doesn't display the full file path?
Click to expand...
Click to collapse
It looks like the KLTE actually specifies its own RIL subclass (interesting trick, I've never seen that before) and that subclass is depending on something in frameworks/opt/tel that Omni doesn't have.
Either find the missing patch in f/opt/tel or figure out how to adapt KlteRIL.java

Entropy512 said:
It looks like the KLTE actually specifies its own RIL subclass (interesting trick, I've never seen that before) and that subclass is depending on something in frameworks/opt/tel that Omni doesn't have.
Either find the missing patch in f/opt/tel or figure out how to adapt KlteRIL.java
Click to expand...
Click to collapse
I seem to have gotten everything working fine besides the camera. The app and libraries compile fine but when the rom boots I cannot see it in the app drawer. When I try to launch it through the lockscreen it just force closes. Not sure what could be causing the problem? All the permissions seem to be checking out, and messing with the BoardConfiv and Device make files has not seemed to help. Any suggestions on how to fix this? Could it be a framework issue?

gigoo25 said:
I seem to have gotten everything working fine besides the camera. The app and libraries compile fine but when the rom boots I cannot see it in the app drawer. When I try to launch it through the lockscreen it just force closes. Not sure what could be causing the problem? All the permissions seem to be checking out, and messing with the BoardConfiv and Device make files has not seemed to help. Any suggestions on how to fix this? Could it be a framework issue?
Click to expand...
Click to collapse
Look through the logcat for camera errors, especially any errors about missing libraries.
Not appearing in app drawer indicates that Android doesn't think there is a camera present. There are 2349734297320 different things that could cause this - missing camera HAL dependency, kernel/HAL mismatch, many other things.

Entropy512 said:
Look through the logcat for camera errors, especially any errors about missing libraries.
Not appearing in app drawer indicates that Android doesn't think there is a camera present. There are 2349734297320 different things that could cause this - missing camera HAL dependency, kernel/HAL mismatch, many other things.
Click to expand...
Click to collapse
Here is what I found in the logcat
Code:
--------- beginning of crash
[ 06-01 20:08:07.366 3437: 3437 E/AndroidRuntime ]
FATAL EXCEPTION: main
Process: com.android.camera2, PID: 3437
java.lang.RuntimeException: Unable to start activity ComponentInfo{com.android.camera2/com.android.camera.CameraActivity}: java.lang.NullPointerException: Attempt to invoke virtual method 'void com.android.camera.util.PhotoSphereHelper$PanoramaViewHelper.onStart()' on a null object reference
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2325)
at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2387)
at android.app.ActivityThread.access$800(ActivityThread.java:151)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1303)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:135)
at android.app.ActivityThread.main(ActivityThread.java:5254)
at java.lang.reflect.Method.invoke(Native Method)
at java.lang.reflect.Method.invoke(Method.java:372)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
Caused by: java.lang.NullPointerException: Attempt to invoke virtual method 'void com.android.camera.util.PhotoSphereHelper$PanoramaViewHelper.onStart()' on a null object reference
at com.android.camera.CameraActivity.onStartTasks(CameraActivity.java:1885)
at com.android.camera.util.QuickActivity.onStart(QuickActivity.java:111)
at android.app.Instrumentation.callActivityOnStart(Instrumentation.java:1236)
at android.app.Activity.performStart(Activity.java:6006)
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2288)
... 10 more

gigoo25 said:
Here is what I found in the logcat
Code:
--------- beginning of crash
[ 06-01 20:08:07.366 3437: 3437 E/AndroidRuntime ]
FATAL EXCEPTION: main
Process: com.android.camera2, PID: 3437
java.lang.RuntimeException: Unable to start activity ComponentInfo{com.android.camera2/com.android.camera.CameraActivity}: java.lang.NullPointerException: Attempt to invoke virtual method 'void com.android.camera.util.PhotoSphereHelper$PanoramaViewHelper.onStart()' on a null object reference
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2325)
at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2387)
at android.app.ActivityThread.access$800(ActivityThread.java:151)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1303)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:135)
at android.app.ActivityThread.main(ActivityThread.java:5254)
at java.lang.reflect.Method.invoke(Native Method)
at java.lang.reflect.Method.invoke(Method.java:372)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:903)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:698)
Caused by: java.lang.NullPointerException: Attempt to invoke virtual method 'void com.android.camera.util.PhotoSphereHelper$PanoramaViewHelper.onStart()' on a null object reference
at com.android.camera.CameraActivity.onStartTasks(CameraActivity.java:1885)
at com.android.camera.util.QuickActivity.onStart(QuickActivity.java:111)
at android.app.Instrumentation.callActivityOnStart(Instrumentation.java:1236)
at android.app.Activity.performStart(Activity.java:6006)
at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2288)
... 10 more
Click to expand...
Click to collapse
Pretty much - if you can't figure out what is wrong from reading a logcat, most likely, you can't figure out what parts of the logcat are relevant and which are not.
That excerpt basically tells me nothing.
I assume that was from trying to forcefully start the camera with no camera actually present as far as Android was concerned. That's a symptom, not the root cause of the problem. Based on what you've described, the root cause of the problem will likely be visible even if no attempt is made to use the camera.

Entropy512 said:
Pretty much - if you can't figure out what is wrong from reading a logcat, most likely, you can't figure out what parts of the logcat are relevant and which are not.
That excerpt basically tells me nothing.
I assume that was from trying to forcefully start the camera with no camera actually present as far as Android was concerned. That's a symptom, not the root cause of the problem. Based on what you've described, the root cause of the problem will likely be visible even if no attempt is made to use the camera.
Click to expand...
Click to collapse
I've been messing around with the device configurations and logcats. I I think I have found the culprit for my camera not working. It shows that it loads the module but then fails to open it? Is this a CameraWrapper issue? Still trying to fix the camera so I can use this as a daily build but I have limited experience as a developer.
EDIT: Also the camera shows up on first boot but then disappears and says that the application is not installed. I'm trying to logcat it but not sure how to do that on the first boot without allowing my PC
EDIT2: From the looks of it searching the web it seems to be an issue with frameworks/av/camera/CameraParameters.cpp & frameworks/av/camera/include/CameraParameters.h
Code:
I/CameraService( 381): CameraService started (pid=381)
I/CameraService( 381): Loaded "MSM8974 Camera Wrapper" camera module
I/CameraWrapper( 381): camera_get_number_of_cameras
I/CameraWrapper( 381): check_vendor_module
I/PackageManager( 741): /system/priv-app/MmsService changed; collecting certs
I/PackageManager( 741): /system/priv-app/OmniSwitch changed; collecting certs
E/HAL ( 381): load: module=/system/lib/hw/camera.vendor.msm8974.so
E/HAL ( 381): dlopen failed: cannot locate symbol "_ZN7android16CameraParameters25KEY_DYNAMIC_RANGE_CONTROLE" referenced by "camera.vendor.msm8974.so"...
E/CameraWrapper( 381): failed to open vendor camera module

gigoo25 said:
I've been messing around with the device configurations and logcats. I I think I have found the culprit for my camera not working. It shows that it loads the module but then fails to open it? Is this a CameraWrapper issue? Still trying to fix the camera so I can use this as a daily build but I have limited experience as a developer.
EDIT: Also the camera shows up on first boot but then disappears and says that the application is not installed. I'm trying to logcat it but not sure how to do that on the first boot without allowing my PC
EDIT2: From the looks of it searching the web it seems to be an issue with frameworks/av/camera/CameraParameters.cpp & frameworks/av/camera/include/CameraParameters.h
Code:
I/CameraService( 381): CameraService started (pid=381)
I/CameraService( 381): Loaded "MSM8974 Camera Wrapper" camera module
I/CameraWrapper( 381): camera_get_number_of_cameras
I/CameraWrapper( 381): check_vendor_module
I/PackageManager( 741): /system/priv-app/MmsService changed; collecting certs
I/PackageManager( 741): /system/priv-app/OmniSwitch changed; collecting certs
E/HAL ( 381): load: module=/system/lib/hw/camera.vendor.msm8974.so
E/HAL ( 381): dlopen failed: cannot locate symbol "_ZN7android16CameraParameters25KEY_DYNAMIC_RANGE_CONTROLE" referenced by "camera.vendor.msm8974.so"...
E/CameraWrapper( 381): failed to open vendor camera module
Click to expand...
Click to collapse
Looks like a patch for CameraParameters needed by your device is missing since no one has tried to bring that device up before, or hasn't tried bringing it up with 5.x
Since it's a Qualcomm-based device and likely using CAF repos, you'll probably have to patch frameworks/av-caf and not frameworks/av - see https://lists.omnirom.org/pipermail/maintainers/2015-June/000101.html for details (we need to add this info to the wiki...)

Entropy512 said:
Looks like a patch for CameraParameters needed by your device is missing since no one has tried to bring that device up before, or hasn't tried bringing it up with 5.x
Since it's a Qualcomm-based device and likely using CAF repos, you'll probably have to patch frameworks/av-caf and not frameworks/av - see https://lists.omnirom.org/pipermail/maintainers/2015-June/000101.html for details (we need to add this info to the wiki...)
Click to expand...
Click to collapse
So I would have to split av into two folders then applying I believe THIS patch to av-caf in order to compile it properly?
Also does native-caf branch still have to be merged before compiling?

gigoo25 said:
So I would have to split av into two folders then applying I believe THIS patch to av-caf in order to compile it properly?
Also does native-caf branch still have to be merged before compiling?
Click to expand...
Click to collapse
Well, the splitting of av is already done. Native is already merged with ifdefs (it didn't require nearly as much ifdefing as av, so we have a "unified" CAF+AOSP native). The only thing that is needed for device maintainers is adding av-caf to omni.dependencies - see the maintainers list post I linked to, or look at the Oppo find7 history.
So once you're pulling in av-caf via omni.dependencies, you should be able to apply that patch to av-caf and then submit it to Gerrit for review.
You might want to start idling in IRC, #omni is where most device maintainers are (in fact, all maintainers for supported devices idle their routinely, it's now a requirement for maintainers to routinely idle in IRC so they can see what's going on/people can ping them with questions.)

Entropy512 said:
Well, the splitting of av is already done. Native is already merged with ifdefs (it didn't require nearly as much ifdefing as av, so we have a "unified" CAF+AOSP native). The only thing that is needed for device maintainers is adding av-caf to omni.dependencies - see the maintainers list post I linked to, or look at the Oppo find7 history.
So once you're pulling in av-caf via omni.dependencies, you should be able to apply that patch to av-caf and then submit it to Gerrit for review.
You might want to start idling in IRC, #omni is where most device maintainers are (in fact, all maintainers for supported devices idle their routinely, it's now a requirement for maintainers to routinely idle in IRC so they can see what's going on/people can ping them with questions.)
Click to expand...
Click to collapse
Turns out I might of fixed the problem. Instead of messing with frameworks/av I can just override it with a file inside include/camera? Looking back at the Cyanogenmod repo for my device THIS is present while in my source it is not.
Compiling now. Will post results after.

Need help building a SM-T555 (gt510lte) LineageOS ROM

Dear all,
I am trying to build a LineageOS 17.1 ROM for the Galaxy Tab A 9.7 (gt510lte) SM-T555.
Using the repos of @retiredtab and aala27's repos I managed to build a config that resulted in a buildable LineageOS that I could install and that shows the Lineage boot animation but crashes/reboots after a while.
Fyi, my forks for the GT510LTE (SM-T555) I currently maintain here: https://github.com/blizzard4591?tab=repositories
Questions to @retiredtab:
- What is your current local_manifest/roomservice? I could not locate this in your Github and used one posted by aala27 in a different thread, but it might be "off".
- Did you extract the required proprietary files by hand from stock ROMs or is there an automated way? I have "SM-T555_1_20190103084053_we4a668guy_fac" with T555XXU1CQHA/T555XXU1CRG1 that I know works on my T555.
- The repo "vendor-samsung-gt5note10wifi" in your Github only contains a branch for Lineage 18.1, is that intentional?
Sadly, I am a total noob in the area of building Lineage, so I might miss some obvious things!
I am willing to put in some time and effort to make this work, but I just do not know enough to do it efficiently.
If you can spare the time for a few hints, I believe I can make some progress!
Cheers
Update 1:
My image is working, i.e. it boots and gives a stable system.
Problem: Bluetooth does not work and crashes a lot, I have no clue what the problem is.
Problem: Audio is not working, I see a lot of "audio_route: unable to find path 'low-latency-playback speaker'
The system settings dialog is missing the "Android Patchlevel" information - is this expected? I am building using "repo sync, breakfast gt510lte, brunch gt510lte" - is this correct? I am just an idiot.
Update 2:
Bluetooth and Audio are working, SELinux is not, so permissive it is for now.
Builds available on request.

RandomAndroidTinkerer said:
- What is your current local_manifest/roomservice? I could not locate this in your Github and used one posted by aala27 in a different thread, but it might be "off".
Click to expand...
Click to collapse
It was there before, but I think after the switch to Xenforo on Dec 1, 2020, it might have gotten lost. It's there now and what I use to generate 17.1 for T550.
RandomAndroidTinkerer said:
- Did you extract the required proprietary files by hand from stock ROMs or is there an automated way? I have "SM-T555_1_20190103084053_we4a668guy_fac" with T555XXU1CQHA/T555XXU1CRG1 that I know works on my T555.
Click to expand...
Click to collapse
No, I just used what's in at https://github.com/Galaxy-MSM8916. Having said that, I found that for the SM-T350, it was missing some very important files so I grabbed those from stock.
RandomAndroidTinkerer said:
- The repo "vendor-samsung-gt5note10wifi" in your Github only contains a branch for Lineage 18.1, is that intentional?
Click to expand...
Click to collapse
gt5note10wifi is for the P550, not T550. You shouldn't be using that as the *.mk files won't copy the correct blobs for your device.
RandomAndroidTinkerer said:
Update 1:
My image is working, i.e. it boots and gives a stable system.
Problem: Bluetooth does not work and crashes a lot, I have no clue what the problem is.
The system settings dialog is missing the "Android Patchlevel" information - is this expected? I am building using "repo sync, breakfast gt510lte, brunch gt510lte" - is this correct?
Click to expand...
Click to collapse
Congrats on getting a bootable stable system. For bluetooth, you are probably missing a bluetooth blob. Look in your adb logcat (see below) for red messages that are bluetooth related. It might say something like "missing libbt-nv.so".
Missing Android Patchlevel means you don't have a property declared in your *.mk file. Right now, I can' t remember what it is, but I will look for it.
Instead of brunch, I do
Code:
TARGET_BUILD_TYPE=debug TARGET_BUILD_VARIANT=eng make -j2 bacon
This makes an engineering build that starts adb logcat immediately. That way, you can see all the messages as soon as the device boots. It helps a lot in troubleshooting stuck at boot animation problems.
The -j2 indicates how many CPU cores I have. If you have more, say 4, then -j4.
Once you solved all your problems and if you want to share your ROM, then do a brunch which is userdebug by default (for me, I just do a make -j2 bacon).
For adb logcat, I find
Code:
adb logcat -C | nl
helpful. It color codes the log so anything in red (error) needs attention. Nl numbers the log so it's easier to remember where you error messages are vs a timestamp.

For the Android patch level, show me a screenshot so I exactly what you mean.

RandomAndroidTinkerer said:
Problem: Audio is not working, I see a lot of "audio_route: unable to find path 'low-latency-playback speaker'
Click to expand...
Click to collapse
Try not to edit your initial post because I didnt' see the audio problem. Just make a new one so that I see new responses.
The audio problem is likely you don't have the correct definition in mixer_paths.xml. aala27 had the exact same problem. It's likely this
[UNOFFICIAL][ROM] LineageOS 17.1 for Galaxy Tab A 9.7[SM-P550]
NOTE: There is no S-pen support. If you need S-pen, DO NOT USE THIS ROM. I am not responsible for lost data, identity theft, lost money, security vulnerabilities, bricked devices or any other hardware or software malfunctions that comes as a...
forum.xda-developers.com
For SM-T550, the line inside mixer_paths.xml looks like
Code:
<path name="low-latency-playback speaker">
<ctl name="QUAT_MI2S_RX Audio Mixer MultiMedia5" value="1" />
</path>
You can see above, I have a path name that matches 'low-latency-playback speaker' exactly. Your mixer_paths.xml probably doesn't have this defined so you get no audio.

BTW, all the info I'm giving wasn't available via search engine when I first started. It's extremely frustrating to troubleshoot when I first started. Even now, I have problems with audio over bluetooth and stuttering audio over bluetooth for two platforms that both worked perfectly on the previous last major revision on Android.

Thank you so much; I know how hard this kind of initial research is!
Regarding the audio issues:
I tried that already, as you can see in https://github.com/blizzard4591/android_device_samsung_gt510lte/tree/lineage-17.1/configs/audio I used the config files from my stock image (I had assumed they would work, but they do not - why?) and then added said speaker there, but no luck, it still has the same error message. What am I misunderstanding?
Regarding Bluetooth:
Thanks to you tip, I added the libbt-nv.so module, but this did not change the situation.
I am now building a debug/eng build, but in the log I still see no messages of missing drivers/firmware/SOs. You can find my Logcat attached - could you take a look and tell me whether I am missing something? Should there be messages?
How did you find out that you were missing BLOBs?

RandomAndroidTinkerer said:
I tried that already, as you can see in https://github.com/blizzard4591/android_device_samsung_gt510lte/tree/lineage-17.1/configs/audio I used the config files from my stock image (I had assumed they would work, but they do not - why?) and then added said speaker there, but no luck, it still has the same error message. What am I misunderstanding?
Click to expand...
Click to collapse
You need to check the actual rom image to see if the mixer_paths.xml is correct. Do
Code:
adb pull /system/vendor/etc/mixer_paths.xml
and compare if the two are the same.
RandomAndroidTinkerer said:
Regarding Bluetooth:
Thanks to you tip, I added the libbt-nv.so module, but this did not change the situation.
Click to expand...
Click to collapse
I only guessed at what might be missing. The logs will tell who what's missing.
RandomAndroidTinkerer said:
You can find my Logcat attached - could you take a look and tell me whether I am missing something?
Click to expand...
Click to collapse
I see no log attached. Zip the log and then attach it.

You need to check the actual rom image to see if the mixer_paths.xml is correct. Do
Code:
adb pull /system/vendor/etc/mixer_paths.xml
and compare if the two are the same.
Click to expand...
Click to collapse
Yes, the file was incorrect, I guess the path
Code:
$(LOCAL_PATH)/configs/audio/mixer_paths.xml:$(TARGET_COPY_OUT_VENDOR)/etc/mixer_paths.xml
did not resolve to where it should, I changed that, once the build is done I will check.
I see no log attached. Zip the log and then attach it.
Click to expand...
Click to collapse
Interesting, I can see it, but I attached it as ZIP!

The log you attached is missing all the bootup sequence. You need to start adb logcat as soon as the device boots.
Audio
=====
Your mixer_paths.xml should be in /vendor/etc. /system/vendor is usually a link to /vendor. From my P550.
Code:
$ adb shell
gt5note10wifi:/ # ls -al vendor
lrw-r--r-- 1 root root 14 2008-12-31 17:00 vendor -> /system/vendor
If you are using the 17.1 msm8916-common repo, see lines 80 to 83
android_device_samsung_msm8916-common/msm8916.mk at lineage-17.1 · Galaxy-MSM8916/android_device_samsung_msm8916-common
Common MSM8916 tree for Samsung devices. Contribute to Galaxy-MSM8916/android_device_samsung_msm8916-common development by creating an account on GitHub.
github.com
may be overwriting your stock mixer_paths. I would comment out lines 80 to 83 as a test.
Bluetooth
=========
You have tons of errors with your bluetooth. If you view your logcat in color, these are all in red.
Code:
04-01 13:19:22.910 1212 1212 F DEBUG : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
04-01 13:19:22.911 1212 1212 F DEBUG : LineageOS Version: '17.1-20210401-UNOFFICIAL-gt510lte'
04-01 13:19:22.911 1212 1212 F DEBUG : Build fingerprint: 'samsung/gt510ltexx/gt510lte:7.1.1/NMF26X/T555XXU1CQI8:user/release-keys'
04-01 13:19:22.911 1212 1212 F DEBUG : Revision: '8'
04-01 13:19:22.911 1212 1212 F DEBUG : ABI: 'arm'
04-01 13:19:22.912 1212 1212 F DEBUG : Timestamp: 2021-04-01 13:19:22+0200
04-01 13:19:22.912 1212 1212 F DEBUG : pid: 866, tid: 1203, name: bt_hci_thread >>> com.android.bluetooth <<<
04-01 13:19:22.912 1212 1212 F DEBUG : uid: 1002
04-01 13:19:22.912 1212 1212 F DEBUG : signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
04-01 13:19:22.912 1212 1212 F DEBUG : Abort message: '[0401/131922.772914:FATAL:hci_layer_android.cc(119)] Check failed: btHci != nullptr.
When it crashes hard like above, there's no way bluetooth will work.
Again, if you are using the 17.1 msm8916-common repo, it's missing the bluetooth entries for manifest.xml and msm8916.mk.
For the manifest.xml you need something like
Code:
<hal format="hidl">
<name>android.hardware.bluetooth</name>
<transport arch="32+64">passthrough</transport>
<version>1.0</version>
<interface>
<name>IBluetoothHci</name>
<instance>default</instance>
</interface>
</hal>
For msm8916.mk, you need
Code:
# Bluetooth
PRODUCT_PACKAGES += \
[email protected]

[Sorry for the delay]
Okay, I think I ironed out most of the issues.
What is confirmed working:
- WLAN
- Bluetooth
- Audio
- GPS (though the initial fix took 30min+...)
What does not work
- SELinux
WLAN:
I see a messages like
wificond: No Offload Service available
wificond: Offload HAL not supported
wificond: Failed to get NL80211_ATTR_EXT_FEATURES
Click to expand...
Click to collapse
Is that an issue? I don't know...
I see a lot of messages from the PowerHAL:
QTI PowerHAL: Failed to acquire lock.
Click to expand...
Click to collapse
I already tried https://review.statixos.com/c/android_device_essential_mata/+/1626/1 but that apparently was not enough.
SELInux:
I added the policies by https://github.com/VirsysElectron/android_device_samsung_gt510wifi and made them work, but it seems they are not really working.
Example:
I/init ( 233): type=1400 audit(0.0:4): avc: denied { mounton } for path="/firmware-modem" dev="mmcblk0p25" ino=27 scontext=u:r:init:s0 tcontext=ubject_r:tmp_root_mount_file:s0 tclass=dir permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:5): avc: denied { read } for name="mmcblk0p13" dev="tmpfs" ino=7580 scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:6): avc: denied { open } for path="/dev/block/mmcblk0p13" dev="tmpfs" ino=7580 scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:7): avc: denied { write } for name="mmcblk0p13" dev="tmpfs" ino=7580 scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/e2fsck ( 253): type=1400 audit(0.0:8): avc: denied { ioctl } for path="/dev/block/mmcblk0p13" dev="tmpfs" ino=7580 ioctlcmd=127c scontext=u:r:fsck:s0 tcontext=ubject_r:efs_block_device:s0 tclass=blk_file permissive=1
I/init ( 1): type=1400 audit(0.0:9): avc: denied { relabelfrom } for name="rmt_storage" dev="debugfs" ino=6571 scontext=u:r:init:s0 tcontext=ubject_r:debugfs_rmt:s0 tclass=dir permissive=1
I/init ( 1): type=1400 audit(0.0:10): avc: denied { relabelfrom } for name="rmts" dev="debugfs" ino=6574 scontext=u:r:init:s0 tcontext=ubject_r:debugfs_rmt:s0 tclass=file permissive=1
Click to expand...
Click to collapse
I declare
/firmware-modem(/.*)? ubject_r:tmp_root_mount_file:s0
Click to expand...
Click to collapse
in device/samsung/gt510lte/sepolicy/file_contexts, but it is not applied:
dr-xr-x--- 3 system drmrpc ubject_r:vfat:s0 16384 1970-01-01 01:00 firmware-modem
Click to expand...
Click to collapse
And I really do not know enough about SELinux to effectively engage this.
@retiredtab: How did you solve SELinux in your builds for the T550?

RandomAndroidTinkerer said:
- GPS (though the initial fix took 30min+...)
Click to expand...
Click to collapse
That seems like a really long time. Did you go outside to do the GPS reading? Sometimes it makes a difference if you are in or outside. You should do an adb logcat while testing out GPS. It might show some clues as to why it takes so long.
With the P550 and using GPStest from
GPSTest | F-Droid - Free and Open Source Android App Repository
An app for testing GPS and GNSS capabilities of a device
f-droid.org
I get a lock in 48 seconds by the window.
RandomAndroidTinkerer said:
What does not work
- SELinux
Click to expand...
Click to collapse
You need to read posts 202 and beyond at
[ROM][SM-T350][UNOFFICIAL][crDroidAndroid-10.0][v6.17][ANDROID 10] Galaxy Tab A 8.0
Finally this thread is back :)
forum.xda-developers.com
I list the tools that you can use to help build selinux policies. As I wrote in the other thread, do you blindly trust the policies generated by the tools? I'm not an expert so I don't know and it's highly dependent on each hardware device.
I built an image with selinux enforcing as a test sometime in March and while it works, I'm not confident and ready to release that. In addition, each device will require it's own set of selinux policies. What might work for the P550 may not work on the T555 due to differences in hardware (LTE, S-pen).
Building the correct selinux policies is an iterative exercise. Wipe everything on your device, format data. Install the ROM only. You grant the initial batch of policies, reboot, look at logs, grant some more and repeat until they are gone. You should do this with the ROM only. Don't load gapps, games, apps, etc and then run selinux.
RandomAndroidTinkerer said:
Is that an issue? I don't know...
Click to expand...
Click to collapse
I see them in my own builds and so far there's been no problem.
RandomAndroidTinkerer said:
I see a lot of messages from the PowerHAL:
Click to expand...
Click to collapse
Same as above.
RandomAndroidTinkerer said:
I already tried https://review.statixos.com/c/android_device_essential_mata/+/1626/1 but that apparently was not enough.
Click to expand...
Click to collapse
You will find through experience and more building that what works for one platform may not work for another. It's highly dependent on the device and code specific to that device.
RandomAndroidTinkerer said:
SELInux:
I added the policies by https://github.com/VirsysElectron/android_device_samsung_gt510wifi and made them work, but it seems they are not really working.
Click to expand...
Click to collapse
In order to boot selinux enforcing, you need to remove line 140 from
android_device_samsung_msm8916-common/BoardConfigCommon.mk at lineage-17.1 · blizzard4591/android_device_samsung_msm8916-common
Common MSM8916 tree for Samsung devices. Contribute to blizzard4591/android_device_samsung_msm8916-common development by creating an account on GitHub.
github.com
Also, I'm not an expert in selinux, but I don't know why you would permit untrusted_app.te, untrusted_app_25.te and untrusted_app_27.te?

retiredtab said:
That seems like a really long time. Did you go outside to do the GPS reading? Sometimes it makes a difference if you are in or outside. You should do an adb logcat while testing out GPS. It might show some clues as to why it takes so long.
With the P550 and using GPStest from
GPSTest | F-Droid - Free and Open Source Android App Repository
An app for testing GPS and GNSS capabilities of a device
f-droid.org
I get a lock in 48 seconds by the window.
Click to expand...
Click to collapse
I think it was just the initial, first fix, and yes, I was not in the best position. Now that it knows where and when it is, a new fix even inside takes a couple of seconds. I used the same tool, also from F-Droid
retiredtab said:
You need to read posts 202 and beyond at
[ROM][SM-T350][UNOFFICIAL][crDroidAndroid-10.0][v6.17][ANDROID 10] Galaxy Tab A 8.0
Finally this thread is back :)
forum.xda-developers.com
I list the tools that you can use to help build selinux policies. As I wrote in the other thread, do you blindly trust the policies generated by the tools? I'm not an expert so I don't know and it's highly dependent on each hardware device.
I built an image with selinux enforcing as a test sometime in March and while it works, I'm not confident and ready to release that. In addition, each device will require it's own set of selinux policies. What might work for the P550 may not work on the T555 due to differences in hardware (LTE, S-pen).
Building the correct selinux policies is an iterative exercise. Wipe everything on your device, format data. Install the ROM only. You grant the initial batch of policies, reboot, look at logs, grant some more and repeat until they are gone. You should do this with the ROM only. Don't load gapps, games, apps, etc and then run selinux.
Click to expand...
Click to collapse
I had to load Magisk and LiveBoot to even get the early-boot log. Using ADB logcat I was unable to get a log from "system start" - the adb process would hang and wait for the device to be fully booted. Even afterwards, no messages from boot. I had USB debugging enabled, default USB conf "file transfer", etc.
Any ideas what I am doing wrong?
retiredtab said:
I see them in my own builds and so far there's been no problem.
Same as above.
You will find through experience and more building that what works for one platform may not work for another. It's highly dependent on the device and code specific to that device.
In order to boot selinux enforcing, you need to remove line 140 from
android_device_samsung_msm8916-common/BoardConfigCommon.mk at lineage-17.1 · blizzard4591/android_device_samsung_msm8916-common
Common MSM8916 tree for Samsung devices. Contribute to blizzard4591/android_device_samsung_msm8916-common development by creating an account on GitHub.
github.com
Also, I'm not an expert in selinux, but I don't know why you would permit untrusted_app.te, untrusted_app_25.te and untrusted_app_27.te?
Click to expand...
Click to collapse
Good catch - I simply copied the policies from VirsysElectron to start, but since they do not really work, I don't think I will continue much on this path. I share your opinion on old drivers and the greater picture. I had hoped the old policies would work for most of the basics, but they do not.

RandomAndroidTinkerer said:
I had to load Magisk and LiveBoot to even get the early-boot log.
Click to expand...
Click to collapse
For an eng build, there's no need for Magisk and LiveBoot to get an adb logcat. Part of the eng parameters is that it enables adb right away.
For developing selinux policies, you leave it in permissive first, develop the policies as I stated and then when you think you are done, then enable selinux enforcing. More at
Validating SELinux | Android Open Source Project
source.android.com
RandomAndroidTinkerer said:
Good catch - I simply copied the policies from VirsysElectron to start,
Click to expand...
Click to collapse
And that's the problem right there. It's so easy to kang or copy someone else's work today (legal or illegal) that some don't bother to check if it's right in the first place. I'm not saying VirsysElectron code is wrong, he may have a good reason why those files are generated.
I also fall into that boat. I use the public open source repos, but there's no way that I have the expertise or time to check everything in the repo for errors, security vulnerabilities, code correctness, etc.

retiredtab said:
For an eng build, there's no need for Magisk and LiveBoot to get an adb logcat. Part of the eng parameters is that it enables adb right away.
Click to expand...
Click to collapse
No, that is the problem - it did not. I am using eng-builds and, as I described, adb did not work, and I have no clue why.
retiredtab said:
For developing selinux policies, you leave it in permissive first, develop the policies as I stated and then when you think you are done, then enable selinux enforcing. More at
Validating SELinux | Android Open Source Project
source.android.com
Click to expand...
Click to collapse
I read that and some other introductions to SELinux, I get the general idea and concept - but as shown in my example, the labeling rule
/firmware-modem(/.*)? u: object_r :tmp_root_mount_file:s0
Click to expand...
Click to collapse
is not applied, I did not find anything that would tell me why or how to debug such an issue.
retiredtab said:
And that's the problem right there. It's so easy to kang or copy someone else's work today (legal or illegal) that some don't bother to check if it's right in the first place. I'm not saying VirsysElectron code is wrong, he may have a good reason why those files are generated.
Click to expand...
Click to collapse
I started writing my own policies from scratch (its somewhere in the repo history), but I first wanted to get my bearings, see how things work - ideally from a known, working starting point - which was a good idea, as otherwise the issue mentioned above regarding the labeling rule that does not get applied would have cost me much more sanity than just questioning someone else's code

Hello RandomAndroidTinkerer
I also own a T555, currently with TWRP 3.3.1 and LineageOS 16.0 from Virsys( 20191231). It's very stable, except the SIM didn't work.
Am of course interested in your image and would like to test it out. Which TWRP version do you use ?
Friendly greetings
Schaagi

Hallo RandomAndroidTinkerer,
thank you very much for your work and of course thanks for retiredtab and the others for their work This is my first post here and I you are the only one I found who builded an actual image. I'm very interested in testing your build. Could you send me an link, please? Thank you and bye bye.

Hi, I applied for an uploader account at AndroidFileHost, once this is granted I will upload a current build.

Current engineering build is up: https://www.androidfilehost.com/?w=files&flid=324776
I am using TWRP 3.1.0 from here.
Be kind on the feedback

RandomAndroidTinkerer said:
Current engineering build is up: https://www.androidfilehost.com/?w=files&flid=324776
I am using TWRP 3.1.0 from here.
Click to expand...
Click to collapse
For fun, I tried it on the P550 and not surprisingly, it doesn't boot. It doesn't even out adb logcat.
LineageOS also builds it's own recovery.img as another recovery option to TWRP. It's not as user friendly and lacks some features, but it's functional.

Thank you so much for your image - I am very excited to test it. Feedback follows in the next days.