Guest gellmar Posted March 9, 2013 Report Posted March 9, 2013 (edited) Here I will post notes on LG E-400 development. My repos @ github: https://github.com/gellmar/lge-kernel-e400 - Suxsem/UMS kernel (overclock/usb mass storage/tun/swap/pptp etc.) for normal and SDMergE400 https://github.com/gellmar/android_device_lge_e400 branch ics - device patches for normal CM9 (mass storage, checkboxes fixes etc) https://github.com/gellmar/android_device_lge_e400 branch ics-sdmerge400 - device patches for SDMergE400 mod (mass storage, checkboxes fixes etc) https://github.com/gellmar/android_system_core branch ics - system/core for normal and SDMergE400 (charger and encryption fix) https://github.com/gellmar/android_system_vold branch ics - system/vold for normal and SDMergE400 (mass storage - volume manager daemon) Edited April 9, 2013 by gellmar
Guest gellmar Posted March 9, 2013 Report Posted March 9, 2013 (edited) MTP Enable for CM9 - September 30, 2012: I managed to fix ADB + MTP and ADM + PTP bug :) Still no USB storage enabled in Trebuchet though. To fix ADB + MTP(PTP) non-working MTP, you have to edit the system's MTP inf file, adding the VID&PID of LG Optimus L3 CM9 as MTP device and then re-install the device. For example, I had one unrecognized device when I turned on ADB debug with MTP setting: so MTP device did not work. I copied all files from DriverStorage related to wpdmtp to a new folder, opened wpdmtp.inf and added three lines (marked bold): ... [VendorModels.NTx86] ; Kodak PTP %USB\VID_040A&PID_0140.Device%=MTP, USB\VID_040A&PID_0140 %USB\VID_040A&PID_0200.Device%=MTP, USB\VID_040A&PID_0200 %USB\VID_040A&PID_0121.Device%=MTP, USB\VID_040A&PID_0121 %KodakDC4800%=MTP, USB\VID_040A&PID_0160 %LGE400%=MTP, USB\VID_1004&PID_61F9 [VendorModels.NTamd64] ; Kodak PTP %USB\VID_040A&PID_0140.Device%=MTP, USB\VID_040A&PID_0140 %USB\VID_040A&PID_0200.Device%=MTP, USB\VID_040A&PID_0200 %USB\VID_040A&PID_0121.Device%=MTP, USB\VID_040A&PID_0121 %KodakDC4800%=MTP, USB\VID_040A&PID_0160 %LGE400%=MTP, USB\VID_1004&PID_61F9 .... [strings] ;Non-localizable SERVICE_KERNEL_DRIVER = 0x1 SERVICE_DEMAND_START = 0x3 SERVICE_ERROR_NORMAL = 0x1 Msft="Microsoft" ... LGE400="LG Optimus L3 E400" and reinstalled driver with Have Disk method. Now, the device is recognzed and work properly - I can access both SD cards while running ADB shell :) Hope this helps! Edited March 9, 2013 by gellmar
Guest gellmar Posted March 9, 2013 Report Posted March 9, 2013 (edited) Battery charger fix - March 08, 2013: Patch: diff --git a/charger/charger.c b/charger/charger.c index 589a6bf..3f90312 100644 --- a/charger/charger.c +++ b/charger/charger.c @@ -57,7 +57,7 @@ #define BATTERY_UNKNOWN_TIME (2 * MSEC_PER_SEC) #define POWER_ON_KEY_TIME (2 * MSEC_PER_SEC) -#define UNPLUGGED_SHUTDOWN_TIME (10 * MSEC_PER_SEC) +#define UNPLUGGED_SHUTDOWN_TIME (5 * MSEC_PER_SEC) #define BATTERY_FULL_THRESH 95 @@ -855,6 +855,16 @@ static void handle_input_state(struct charger *charger, int64_t now) static void handle_power_supply_state(struct charger *charger, int64_t now) { + /* fixing battery charger bug on LG Opimus L3 E-400 */ + + int ac_online = 0; + int usb_online = 0; + + read_file_int("/sys/class/power_supply/ac/online",&ac_online); + read_file_int("/sys/class/power_supply/usb/online",&usb_online); + + charger->num_supplies_online = ((ac_online == 0) && (usb_online == 0)) ? 0 : 1; + if (charger->num_supplies_online == 0) { if (charger->next_pwr_check == -1) { charger->next_pwr_check = now + UNPLUGGED_SHUTDOWN_TIME; diff --git a/init/init.c b/init/init.c index 010e19f..6d27245 100644 --- a/init/init.c +++ b/init/init.c @@ -720,6 +720,57 @@ static int bootchart_init_action(int nargs, char **args) } #endif +static int read_charger_file(const char *path, char *buf, size_t sz) +{ + int fd; + size_t cnt; + + fd = open(path, O_RDONLY, 0); + if (fd < 0) + goto err; + + cnt = read(fd, buf, sz - 1); + if (cnt <= 0) + goto err; + buf[cnt] = '\0'; + if (buf[cnt - 1] == '\n') { + cnt--; + buf[cnt] = '\0'; + } + + close(fd); + return cnt; + +err: + if (fd >= 0) + close(fd); + return -1; +} + +static int read_file_int(const char *path, int *val) +{ + char buf[32]; + int ret; + int tmp; + char *end; + + ret = read_charger_file(path, buf, sizeof(buf)); + if (ret < 0) + return -1; + + tmp = strtol(buf, &end, 0); + if (end == buf || + ((end < buf+sizeof(buf)) && (*end != '\n' && *end != '\0'))) + goto err; + + *val = tmp; + return 0; + +err: + return -1; +} + + int main(int argc, char **argv) { int fd_count = 0; @@ -778,7 +829,13 @@ int main(int argc, char **argv) get_hardware_name(hardware, &revision); - if (strcmp(bootmode, "charger") == 0 || strcmp(battchg_pause, BOARD_CHARGING_CMDLINE_VALUE) == 0) + int ac_online = 0; + int usb_online = 0; + + read_file_int("/sys/class/power_supply/ac/online",&ac_online); + read_file_int("/sys/class/power_supply/usb/online",&usb_online); + + if ((strcmp(battchg_pause, BOARD_CHARGING_CMDLINE_VALUE) == 0) && (ac_online == 1 || usb_online == 1)) charging_mode = 1; if (!charging_mode_booting()) { Note 1: Some notes on battery bug. The irberserk's overclocked-no-battery-bug kernel solves this bug but adds a much more annoying one. If the phone is turned off (i.e shutdown) and the charger cord is plugged, the bootsplash1 logo (LG) appears but the kernel does not boot. To turn off the phine one needs to pull the battery off the box, which is fairly unacceptable. So I digged inside the sources of https://github.com/C...ics/init/init.c and https://github.com/C.../BoardConfig.mk and found out that the root of all evil here is the string in kernel cmdline: lge.reboot=pwroff In init.c, the is_charger trigger can be activated ever if bootmode is charger, or COMMON_GLOBAL_CFLAGS += -DBOARD_CHARGING_CMDLINE_NAME='"lge.reboot"' -DBOARD_CHARGING_CMDLINE_VALUE='"pwroff"' if (!strcmp(name,BOARD_CHARGING_CMDLINE_NAME)) { strlcpy(battchg_pause, value, sizeof(battchg_pause)); if (strcmp(bootmode, "charger") == 0 || strcmp(battchg_pause, BOARD_CHARGING_CMDLINE_VALUE) == 0) charging_mode = 1; By series of sequential patches I determined that the bootmode does not affect the charger trigger on our device, and the trigger activation relies solely on that pwroff parameter. This is a actually a hack created on xda-developers http://forum.xda-dev...&postcount=4113 and it looks like it does not work on e400. If omitting the pwroff check inside init, the phone boots into CM after the first tap, and boots in CM when you plug the cord. To step further, I am investigating which kernel parameters are passed to stock GB e400 kernel, assuming the firmware is the same and there is a "boot-pause" trigger equal to "charger" trigger in CM's init code. UPD1: In stock e400 Gingerbread V10F_00 init the same pwroff check leads to trigger "boot-pause" that is declared in init.e0.rc as: on boot-pause # exec system/bin/battery_charging ## enable adbd in chargerlogo mode # start adbd exec /sbin/chargerlogo Note 2: Update #2 on battery bug. Strucked by insomnia after previous debugging, I re-read my post again and started looking for commits related to bootmodes and charger modes. In several minutes I found a CM repo https://github.com/p...ore/commits/ics by pershoot and arcee, where the series of commits explained me the history of that string inside init.c: The filesystem exclusion logic before the Samsung lpm stuff was merged was completely broken and always returned true. (i.e., fs hooks always ran) -------- if (strcmp(bootmode, "charger") != 0 || strcmp(battchg_pause, "true") != 0) -------- These 2 conditions are never false simultaneously (they're alternative charger mode flags), so the filesystem mount hooks always happened. The LPM support patch fixed that logic, but broke other devices in the process, since some implementations use stuff from /system (or even link with bionic) for charger mode. This patch makes the exclusion logic apply _only_ to Samsung LPM devices or those supported by the original AOSP code (androidboot.mode=charger), and lets every other device run the fs hooks From https://github.com/p...dd250c5fdcf0122 That and the doubt on LG stock init / chargerlogo together made an assumption that LG does not rely on pwroff to detect charger mode in their stock Gingerbreads, neither relies on selective "charger-or-normal" booting like in CM, nor operates charger as a service. If you examine the LGE400 stock init, you will find the following pseudocode: action_for_each_trigger("init", action_add_queue_tail); action_for_each_trigger("early-fs", action_add_queue_tail); action_for_each_trigger("fs", action_add_queue_tail); action_for_each_trigger("post-fs", action_add_queue_tail); queue_builtin_action(property_service_init_action, "property_service_init"); queue_builtin_action(signal_init_action, "signal_init"); queue_builtin_action(check_startup_action, "check_startup"); /* pause if necessary */ if (battchg_pause) { action_for_each_trigger("boot-pause", action_add_queue_tail); } /* execute all the boot actions to get us started */ action_for_each_trigger("early-boot", action_add_queue_tail); action_for_each_trigger("boot", action_add_queue_tail); From https://github.com/C...ead/init/init.c That means NO conditional fs hooks exist in LG stock init, and the 'boot-pause' trigger fires BEFORE the boot starts. In combination with exec /sbin/chargerlogo it allows the charger application to start and freeze a boot process, if the battery is being charged, or to exit gracefully and continue normal booting if not. In Cyanogen ICS, the charger runs as a service - i.e in parallel, so it is necessary to strip off fs hooks. Examining the code of chargerlogo, I found that it can reboot android itself or turn the power off, so if the battery is charged and no OS is loaded, the chargerlogo binary shuts the phone down as expected. After several tests I managed to find that the charger actually shuts down after 2*UNPLUGGED_SHUTDOWN_TIME = 20 seconds, so it is not a bug. The second very interesting behavior with CM9 init is that in charger mode, a long power key press boots to normal. The code is responsible for that: static void process_key(struct charger *charger, int code, int64_t now) { struct key_state *key = &charger->keys[code]; int64_t next_key_check; if (code == KEY_POWER) { if (key->down) { int64_t reboot_timeout = key->timestamp + POWER_ON_KEY_TIME; if (now >= reboot_timeout) { LOGI("[%lld] rebooting\n", now); android_reboot(ANDROID_RB_RESTART, 0, 0); } else { /* if the key is pressed but timeout hasn't expired, * make sure we wake up at the right-ish time to check */ set_next_key_check(charger, key, POWER_ON_KEY_TIME); } } else { /* if the power key got released, force screen state cycle */ if (key->pending) kick_animation(charger->batt_anim); } } key->pending = false; } and it looks like the ANDROID_RB_RESTART reason chanes lge.reboot to reboot instead of pwroff and that's why it works. lge.reboot=reboot The charger has to determine somehow what was the reason of boot, or we need a code implementing a scenario - if lge.reboot == pwroff state AND there is an active usb charger, assume user plugged in charger so we have to enter charging mode otherwise boot normally. Edited March 11, 2013 by gellmar
Guest gellmar Posted March 9, 2013 Report Posted March 9, 2013 (edited) USB Mass Storage fix - March 11,2013 Patches: e400-mass-storage-kernel-fix-gellmar.patch (applied on kernel/lge/e400/) diff --git a/arch/arm/mach-msm/lge/board-e0eu.h b/arch/arm/mach-msm/lge/board-e0eu.h index d4314eb..b0c1787 100644 --- a/arch/arm/mach-msm/lge/board-e0eu.h +++ b/arch/arm/mach-msm/lge/board-e0eu.h @@ -115,5 +115,10 @@ enum { #endif extern void snd_fm_vol_mute(void); + +#ifndef CONFIG_LGE_USB_GADGET_DRIVER +#define CONFIG_LGE_USB_GADGET_DRIVER +#endif + #endif diff --git a/drivers/usb/gadget/android.c b/drivers/usb/gadget/android.c index 4ef526b..7c28f40b 100644 --- a/drivers/usb/gadget/android.c +++ b/drivers/usb/gadget/android.c @@ -80,6 +80,12 @@ static const char longname[] = "Gadget Android"; #define VENDOR_ID 0x18D1 #define PRODUCT_ID 0x0001 +/* put necessary LUN quantity for board usb gadget mass storage */ +#ifndef BOARD_USB_MASS_STORAGE_NUM_LUNS +#define BOARD_USB_MASS_STORAGE_NUM_LUNS 2 +#endif + + struct android_usb_function { char *name; void *config; @@ -844,15 +850,21 @@ static int mass_storage_function_init(struct android_usb_function *f, { struct mass_storage_function_config *config; struct fsg_common *common; + char lun_name[5]; int err; + int i = 0; config = kzalloc(sizeof(struct mass_storage_function_config), GFP_KERNEL); if (!config) return -ENOMEM; - config->fsg.nluns = 1; - config->fsg.luns[0].removable = 1; + /* mass storage fix */ + + config->fsg.nluns = BOARD_USB_MASS_STORAGE_NUM_LUNS; + + for (i=0; i < BOARD_USB_MASS_STORAGE_NUM_LUNS; i++) + config->fsg.luns[i].removable = 1; common = fsg_common_init(NULL, cdev, &config->fsg); if (IS_ERR(common)) { @@ -860,15 +872,21 @@ static int mass_storage_function_init(struct android_usb_function *f, return PTR_ERR(common); } - err = sysfs_create_link(&f->dev->kobj, - &common->luns[0].dev.kobj, - "lun"); - if (err) { - fsg_common_release(&common->ref); - kfree(config); - return err; + for (i=0; i < BOARD_USB_MASS_STORAGE_NUM_LUNS; i++) { + + sprintf(lun_name,"lun%d",i); + + err = sysfs_create_link(&f->dev->kobj, + &common->luns[i].dev.kobj, + lun_name); + if (err) { + fsg_common_release(&common->ref); + kfree(config); + return err; + } } + config->common = common; f->config = config; return 0; e400-mass-storage-device-fix-gellmar.patch (applied on device/lg/e400): diff --git a/init.e0.rc b/init.e0.rc index 4b44081..4dc1b0a 100644 --- a/init.e0.rc +++ b/init.e0.rc @@ -115,6 +115,11 @@ on post-fs-data chmod 0771 /data/logger # Log Service [END] + chown system system /sys/class/android_usb/android0/f_mass_storage/lun0/file + chmod 0660 /sys/class/android_usb/android0/f_mass_storage/lun0/file + chown system system /sys/class/android_usb/android0/f_mass_storage/lun1/file + chmod 0660 /sys/class/android_usb/android0/f_mass_storage/lun1/file + on boot chown bluetooth bluetooth /sys/module/bluetooth_power/parameters/power chown bluetooth bluetooth /sys/class/rfkill/rfkill0/type diff --git a/overlay/frameworks/base/core/res/res/xml/storage_list.xml b/overlay/frameworks/base/core/res/res/xml/storage_list.xml index 65c8644..6ee8dd7 100644 --- a/overlay/frameworks/base/core/res/res/xml/storage_list.xml +++ b/overlay/frameworks/base/core/res/res/xml/storage_list.xml @@ -37,10 +37,12 @@ android:storageDescription="@string/storage_sd_card" android:removable="true" android:primary="false" - android:emulated="false"/> + android:emulated="false" + android:allowMassStorage="true"/> <storage android:mountPoint="/mnt/sdcard" android:storageDescription="@string/storage_internal" android:removable="false" android:primary="true" - android:emulated="false"/> + android:emulated="false" + android:allowMassStorage="true"/> </StorageList> e400-mass-storage-vold-fix-gellmar.patch (applied on system/vold): diff --git a/VolumeManager.cpp b/VolumeManager.cpp index fd1e396..8501f99 100644 --- a/VolumeManager.cpp +++ b/VolumeManager.cpp @@ -925,7 +925,7 @@ static const char *LUN_FILES[] = { #endif /* Only andriod0 exists, but the %d in there is a hack to satisfy the format string and also give a not found error when %d > 0 */ - "/sys/class/android_usb/android%d/f_mass_storage/lun/file", + "/sys/class/android_usb/android0/f_mass_storage/lun%d/file", NULL }; e400-disable-adb-on-charger-fix-gellmar.patch (on system/core/rootdir): diff --git a/system.prop b/system.prop index f0d4faa..7a5ced4 100644 --- a/system.prop +++ b/system.prop @@ -26,4 +26,4 @@ telephony.lteOnGsmDevice=0 ro.additionalmounts=/mnt/extra-sd ro.vold.switchablepair=/mnt/sdcard,/mnt/extra-sd -persist.sys.usb.config=mtp,adb +persist.sys.usb.config=none So I started debugging USB mass storage bug after battery charger fix, and found that su setprop sys.usb.config mass_storage, adb pops up the virtual mount without a data, and the device detected is a Linux-CD gadget. From Google I found a command that resulted me with a working USB drive: su echo /dev/block/mmcblk0p20 > /sys/devices/platform/msm_hsusb/gadget/lun0/file setprop sys.usb.config mass_storage, adb The next obvious step was to construct a script like su echo /dev/block/mmcblk0p20 > /sys/devices/platform/msm_hsusb/gadget/lun0/file echo /dev/block/mmcblk1 > /sys/devices/platform/msm_hsusb/gadget/lun1/file setprop sys.usb.config mass_storage, adb to enable the storage, but... there was no lun1. I inspected the kernel sources for gadget and found the following commit in cyanogenmod/lge-kernel-e400: https://github.com/CyanogenMod/lge-kernel-e400/commit/3b03eafb9a2a39438860eb0883a620771e3f27e4 which gave me the code at lge-kernel-e400 / drivers / usb / gadget / android.c: static int mass_storage_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev) { struct mass_storage_function_config *config; struct fsg_common *common; int err; config = kzalloc(sizeof(struct mass_storage_function_config), GFP_KERNEL); if (!config) return -ENOMEM; config->fsg.nluns = 1; config->fsg.luns[0].removable = 1; common = fsg_common_init(NULL, cdev, &config->fsg); if (IS_ERR(common)) { kfree(config); return PTR_ERR(common); } err = sysfs_create_link(&f->dev->kobj, &common->luns[0].dev.kobj, "lun"); if (err) { fsg_common_release(&common->ref); kfree(config); return err; } config->common = common; f->config = config; return 0; } So here was one LUN alloc'ed and registered in sysfs as /sys/class/android_usb/android0/lun. That's why we could use internal SD card as USB drive. But to achieve the multi-card capabilities and to clean the code up, I re-worked it, defining a constant BOARD_USB_MASS_STORAGE_NUM_LUNS for number of LUNs requested (the kernel spec says lun0-7 are acceptable, but I had no chance to check if there are active channels beyond lun1). The new code: static int mass_storage_function_init(struct android_usb_function *f, struct usb_composite_dev *cdev) { struct mass_storage_function_config *config; struct fsg_common *common; char lun_name[5]; int err; int i = 0; config = kzalloc(sizeof(struct mass_storage_function_config), GFP_KERNEL); if (!config) return -ENOMEM; /* mass storage fix */ config->fsg.nluns = BOARD_USB_MASS_STORAGE_NUM_LUNS; for (i=0; i < BOARD_USB_MASS_STORAGE_NUM_LUNS; i++) config->fsg.luns[i].removable = 1; common = fsg_common_init(NULL, cdev, &config->fsg); if (IS_ERR(common)) { kfree(config); return PTR_ERR(common); } for (i=0; i < BOARD_USB_MASS_STORAGE_NUM_LUNS; i++) { sprintf(lun_name,"lun%d",i); err = sysfs_create_link(&f->dev->kobj, &common->luns[i].dev.kobj, lun_name); if (err) { fsg_common_release(&common->ref); kfree(config); return err; } } config->common = common; f->config = config; return 0; } Also I defined a constant CONFIG_LGE_USB_GADGET_DRIVER for kernel/lge/e400/arch/arm/mach-msm/lge/e0eu.h to ensure the LG values for USB VID&PID are considered into build instead of default Qualcomm ones. After that I rebuilt the kernel and got lun0 and lun1 devices as expected. That was not so easy, but that was fine =) The second question was to enable the Mass storage in USB connection dialog. This dialog relies on VolumeStorage->AllowMassStorage property, which in turn goes from storage_list.xml from /system/frameworks/framework-res.apk. I fixed it as follows device/lge/e400/overlay/frameworks/base/core/res/res/xml/storage_list.xml): <StorageList xmlns:android="http://schemas.android.com/apk/res/android"> <storage android:mountPoint="/mnt/extra-sd" android:storageDescription="@string/storage_sd_card" android:removable="true" android:primary="false" android:emulated="false" android:allowMassStorage="true"/> <storage android:mountPoint="/mnt/sdcard" android:storageDescription="@string/storage_internal" android:removable="false" android:primary="true" android:emulated="false" android:allowMassStorage="true"/> </StorageList> and did a framework rebuild (before I had to make he whole platform and it took 19 GB on my drive). The resulting framework.jar and framework-res.apk I pulled to the system partition within recovery along with new boot.img and I was able to unlock the setting. The USB Mass Storage panel appeared but it was still not able to mount anything! The logcat told me: VolD: Failed to open lunfile /sys/class/android_usb/android0/f_mass_storage/lun/file for LUN 0 .... VolD: Failed to open lunfile /sys/class/android_usb/android0/f_mass_storage/lun/file for LUN 1 .... That was funny. I realized that vold code was in a close touch with kernel symlink I just broke, and the whole problem of mass storage could be easily solved by replacing frameworks! But I wanted both cards on my USB drive like in a good old Gingerbread, so I fixed one line in system/vold/VolumeManager.cpp: "/sys/class/android_usb/android0/f_mass_storage/lun%d/file" and recompiled vold. That's all done! I also had to apply a minor fix for device's init.rc not to start adb at early bootup, because with a new kernel it allowed me to adb inside the charger :) I was amused but I doubt it is really necessary for an end user. That's all. I made an update, flashed it, ran all tests.. and I am feeling lucky! Edited March 11, 2013 by gellmar
Guest gellmar Posted March 9, 2013 Report Posted March 9, 2013 (edited) FDISK layout of LG E-400 partitions - March 08,2013 Device Boot Start End Blocks Id System Mountpoint /dev/block/mmcblk0p1 * 1 3 20 4d Unknown /dev/block/mmcblk0p2 3 128 1003+ 45 Unknown /dev/block/mmcblk0p3 129 256 1024 46 Unknown /dev/block/mmcblk0p4 257 238592 1906688 5 Extended /dev/block/mmcblk0p5 8193 8704 4096 47 Unknown /dev/block/mmcblk0p6 8705 9216 4096 2c Unknown /dev/block/mmcblk0p7 9217 9728 4096 58 Unknown /dev/block/mmcblk0p8 9729 12800 24576 77 Unknown /dev/block/mmcblk0p9 12801 13824 8192 48 Unknown /dev/block/mmcblk0p10 13825 14336 4096 4a Unknown /dev/block/mmcblk0p11 14337 14848 4096 4b Unknown /dev/block/mmcblk0p12 14849 18432 28672 49 Unknown /dev/block/mmcblk0p13 18433 22016 28672 6c Unknown /dev/block/mmcblk0p14 22017 70656 389120 83 Linux /dev/block/mmcblk0p15 70657 71680 8192 83 Linux /dev/block/mmcblk0p16 71681 80896 73728 83 Linux /dev/block/mmcblk0p17 80897 81920 8192 60 Unknown /dev/block/mmcblk0p18 81921 82944 8192 83 Linux /dev/block/mmcblk0p19 82945 84480 12288 6b Unknown /dev/block/mmcblk0p20 84481 215552 1048576 83 Linux /dev/block/mmcblk0p21 215553 236032 163840 83 Linux /dev/block/mmcblk0p22 236033 238080 16384 83 Linux /dev/block/mmcblk0p23 238081 238592 4096 ff Unknown What is what: /dev/block/mmcblk0p1 - bootable partition of 20480 bytes with boot flag /dev/block/mmcblk0p2 - firmware partition table routines and pre-boot - size 1027072 bytes /dev/block/mmcblk0p3 - OEMSBL radio loader partition of 1 MiB /dev/block/mmcblk0p5 - bootloader (?) partition, ref to fastboot commands - size 4 MiB /dev/block/mmcblk0p6 - unknown partition - size 4 MiB /dev/block/mmcblk0p7 - empty (00) partition - size 4 MiB /dev/block/mmcblk0p8 - "misc" partition, size 24 MiB, partition type 0x77 (MMC_MISC_TYPE), contains info for LCD temperature calibration and test flag for factory reset and fota updates /dev/block/mmcblk0p9 - /boot partition, partition type 0x48 (MMC_BOOT_TYPE), size 8 MiB /dev/block/mmcblk0p10 - rmt_storage (service rmt_storage disabled) - size 4 MiB /dev/block/mmcblk0p11 - rmt_storage (service rmt_storage disabled) - size 4 MiB /dev/block/mmcblk0p12 - OKL4 (?) partition, present references to iguana/server/src/bootinfo.c - size 28 MiB /dev/block/mmcblk0p13 - OKL4 (?) partition, present references to iguana/server/src/bootinfo.c - size 28 MiB /dev/block/mmcblk0p14 - ext4 /system partition /dev/block/mmcblk0p15 - ext4 /persist partition - Qualcomm WLAN binary, Gaspra and qualcomm conf - 8 MiB /dev/block/mmcblk0p16 - ext4 /cache partition /dev/block/mmcblk0p17 - /recovery partition, partition type 0x60 (MMC_RECOVERY_TYPE) size 8 MiB /dev/block/mmcblk0p18 - ext4 /drm partition (LGDRM DivX), size 8 MiB /dev/block/mmcblk0p19 - bootloader (?) partition, ref to fastboot commands, DemiGod crash handler, size 12 MiB /dev/block/mmcblk0p20 - /sdcard - ! GiB /dev/block/mmcblk0p21 - ext4 /data partition, size 157 MiB /dev/block/mmcblk0p22 - ext4 /mpt partition (MLT Porting), size 16 MiB /dev/block/mmcblk0p23 - empty (00) partition, size 4 MiB UPD: fastboot shows the following partition layout (maybe for internal use): /dev/block/mmcblk0p1 - sbl1 /dev/block/mmcblk0p2 - sbl3 /dev/block/mmcblk0p3 - tz /dev/block/mmcblk0p4 - no name /dev/block/mmcblk0p5 - rpm /dev/block/mmcblk0p6 - no name /dev/block/mmcblk0p7 - no name /dev/block/mmcblk0p8 - misc /dev/block/mmcblk0p9 - boot /dev/block/mmcblk0p10 - modem-stl1 /dev/block/mmcblk0p11 - modem-stl2 /dev/block/mmcblk0p12 - no name /dev/block/mmcblk0p13 - no name /dev/block/mmcblk0p14 - system /dev/block/mmcblk0p15 - userdata /dev/block/mmcblk0p16 - persist /dev/block/mmcblk0p17 - recovery /dev/block/mmcblk0p18 - cache /dev/block/mmcblk0p19 - no name /dev/block/mmcblk0p20 - tombstones /dev/block/mmcblk0p21 - no name /dev/block/mmcblk0p22 - no name /dev/block/mmcblk0p23 - no name Edited March 13, 2013 by gellmar
Guest gellmar Posted March 9, 2013 Report Posted March 9, 2013 (edited) The Storage Adventures - March 13, 2013 Notes about storage mounts. The idea about swapping and re-ordering partitions is practically acceptable if one knows where is the exact mount table is. As soon as crazybyte reported success on data / sdcard swap with init.rc, I started investigating the exact place where mount table is. For recovery, it is quite obvious - the recovery.fstab file, but for kernel, crazybyte guessed it was compiled inside kernel... and was right only partially. I inspected kernel sources, fastboot outputs and vold sources and that's I found: the vold.fstab for our device sits at vendor/lge/e400/proprietary/etc/vold.fstab and has the following format (comments are mine): # type label mount_point partition sysfs_path # type is the command (dev_mount) # label is a lable for partition being mounted # partition is either 'auto' (autodetect the first suitable partition) or 1-based partition index on block device on sysfs_path # sysfs_path is a /sys/devices/... path to sdcard facility on msm SoC without the /sys/ part dev_mount sdcard /mnt/sdcard 20 /devices/platform/msm_sdcc.3/mmc_host dev_mount extsdcard /mnt/extra-sd auto /devices/platform/msm_sdcc.1/mmc_host On a platform, there are suitable sysfs paths: /sys/devices/platform/msm_sdcc.1/ /sys/devices/platform/msm_sdcc.2/ /sys/devices/platform/msm_sdcc.3/ the msm_sdcc1 stands for external SD-card slot, msm_sdcc2 for wlan driver (looks like modem part is also pinned to sdcard controller) and msm_sdcc3 is an internal SD card (full internal storage, 1.82 GB total). So the first line shows partition #20 on first sdcard - i.e /dev/block/mmcblk0p20 - right what we expected! The second line looks for auto-partition inside vold/DirectVolume.cpp and finds /dev/block/mmcblk1p1 as expected too. The next interesting question is where the data partition is mounted. To get an answer, we must examine the vold cryptfs again. As soon as /data partition may be encrypted, the ordinary mount commands fails for the first time, and that is a signal for vold that the volume is encrypted. From the vold/builtins.c code I found that the original mount point information is stored in getprops ro.crypto.fs.*. Having read the props from booted phone, I found the combination of mount flags and found aplace ini init.e0.rc where the actual mount is called: #setprop ro.crypto.fuse_sdcard true wait /dev/block/mmcblk0p21 mount ext4 /dev/block/mmcblk0p21 /data nosuid nodev noatime barrier=1,data=ordered,noauto_da_alloc,errors=continue That is the point where crazybyte was right :) So, now we can implement crazybyte's scenario with the following details: Note this is still an untested code! 1. From a recovery, delete partitions #20 and #21 then re-create partition #20 and format the /dev/block/mmcblk0p20 as ext2: # fdisk /dev/block/mmcblk0 # /system/bin/mke2fs -Ldata {blocks count to be calculated later} /dev/block/mmcblk0p20 2. Flash a new recovery.img with the following recovery.fstab: # mount point fstype device [device2] fstype2 /recovery emmc /dev/block/mmcblk0p17 /boot emmc /dev/block/mmcblk0p9 /cache ext4 /dev/block/mmcblk0p16 /data ext4 /dev/block/mmcblk0p20 /emmc tmpfs tmpfs /sdcard vfat /dev/block/mmcblk1 /dev/block/mmcblk1p1 /system ext4 /dev/block/mmcblk0p14 and boot.img, where init.e0.rc is fixed: #setprop ro.crypto.fuse_sdcard true wait /dev/block/mmcblk0p20 mount ext4 /dev/block/mmcblk0p20 /data nosuid nodev noatime barrier=1,data=ordered,noauto_da_alloc,errors=continue Then fix the vold.fstab: dev_mount sdcard /mnt/sdcard auto /devices/platform/msm_sdcc.1/mmc_host system.prop: #ro.additionalmounts=/mnt/extra-sd #ro.vold.switchablepair=/mnt/sdcard,/mnt/extra-sd storage_list.xml: <StorageList xmlns:android="http://schemas.android.com/apk/res/android"> <storage android:mountPoint="/mnt/extra-sd" android:storageDescription="@string/storage_sd_card" android:removable="true" android:primary="false" android:emulated="false" android:allowMassStorage="true"/> <storage android:mountPoint="/mnt/sdcard" android:storageDescription="@string/storage_internal" android:removable="false" android:primary="true" android:emulated="false" android:allowMassStorage="true"/> </StorageList> to <StorageList xmlns:android="http://schemas.android.com/apk/res/android"> <storage android:mountPoint="/mnt/sdcard" android:storageDescription="@string/storage_sd_card" android:removable="true" android:primary="true" android:emulated="false" android:allowMassStorage="true"/> </StorageList> Some strange situations I got and how I solved them: 1. Two internal storages in Storage menu, Camera app and Screenshot tool cannot save pictures telling the storage is empty - checked framework.jar and vold.fstab were new. If old both, the phone boots but the storage is usable only partly. If vold.fstab is new but framework-res.apk (storage_info.xml) is old, the phone stucks on framework booting because /mnt/extra-sd is not found. 2. Mass storage checkbox is accessible but no USB Mass Storage application pos up - the storage_info.xml inside framework-res.apk has to include the "android.primary" attribute for our sdcard set to "true". 3. To revert back, we need a stock coy of MBR and a recovery with ADB support like CWM. Flash old CWM recovery and cm9 boot.img with fastboot, boot into recovery and go adb shell. Push mbr_stock.bin to /emmc then dd to /dev/block/mmcblk0 and reboot immediately in recovery. After recovery boots in second time, mount /system, open adb and # /system/bin/mke2fs -Ldata /dev/block/mmcblk0p21 # /system/bin/mke2fs /dev/block/mmcblk0p22 # /system/bin/mkdosfs /dev/block/mmcblk0p20 then reboot normally. Should work fine. The hack works. USB Mass Storage works, camera app works, adding applications and transferring them to SD card works too. I will make patches and publish them under the last spoiler. To revert back partition table to stock, KDZ stock reflasher works - just tested it and stock V10F_00 booted like a charm. Edited April 9, 2013 by gellmar
Guest gellmar Posted March 31, 2013 Report Posted March 31, 2013 (edited) A little note on recovery fixing. During creation of three-step installer of SDMergE400, we got a problem of safely fdisk-ing the mmcblk0 which was used as cache by CWM. So I fixed the init.rc: on early-init start ueventd on init export PATH /sbin export ANDROID_ROOT /system export ANDROID_DATA /data export EXTERNAL_STORAGE /sdcard symlink /system/etc /etc mkdir /boot mkdir /sdcard mkdir /sd-ext mkdir /datadata mkdir /emmc mkdir /system mkdir /data mkdir /cache mount tmpfs tmpfs /tmp mount tmpfs tmpfs /cache on boot ifup lo hostname localhost domainname localdomain class_start default service ueventd /sbin/ueventd critical service recovery /sbin/recovery service adbd /sbin/adbd recovery disabled # Always start adbd on userdebug and eng builds # In recovery, always run adbd as root. on property:ro.debuggable=1 write /sys/class/android_usb/android0/enable 0 write /sys/class/android_usb/android0/idVendor 18D1 write /sys/class/android_usb/android0/idProduct D001 write /sys/class/android_usb/android0/functions adb #write /sys/class/android_usb/android0/enable 1 write /sys/class/android_usb/android0/iManufacturer $ro.product.manufacturer write /sys/class/android_usb/android0/iProduct $ro.product.model write /sys/class/android_usb/android0/iSerial $ro.serialno #start adbd setprop service.adb.root 1 # Restart adbd so it can run as root on property:service.adb.root=1 write /sys/class/android_usb/android0/enable 0 restart adbd write /sys/class/android_usb/android0/enable 1 and recovery.fstab: # mount point fstype device [device2] fstype2 /recovery emmc /dev/block/mmcblk0p17 /boot emmc /dev/block/mmcblk0p9 /cache tmpfs tmpfs /data ext4 /dev/block/mmcblk0p21 /emmc vfat /dev/block/mmcblk0p20 /sdcard vfat /dev/block/mmcblk1 /dev/block/mmcblk1p1 /system ext4 /dev/block/mmcblk0p14 and repacked recovery.img with dsixda's kitchen. Now the mount table shows no references to mmcblk0 at all :) if CWM recovery shows error 'format expects 3 args, got 4' - use update-binary from CM9 flashable zip. Edited March 31, 2013 by gellmar
Guest gellmar Posted April 4, 2013 Report Posted April 4, 2013 A note on VPN kernel counterparts. The VPN problem in CM9 consists of two sub-troubles: 1. The absence of /dev/tun module in the kernel 2. The MTPD failing to open PPPoX socket with message D/mtpd ( 1131): Received SCCRP -> Sending OCRQ (local = 57090) I/mtpd ( 1131): Tunnel established D/mtpd ( 1131): Received OCRQ (remote = 32972) I/mtpd ( 1131): Session established I/mtpd ( 1131): Creating PPPoX socket F/mtpd ( 1131): Socket() Protocol not supported I/LegacyVpnRunner( 497): Aborting I/LegacyVpnRunner( 497): java.lang.IllegalStateException: mtpd is dead I/LegacyVpnRunner( 497): at com.android.server.connectivity.Vpn$LegacyVpnRunner.execute(Vpn.java:569) I/LegacyVpnRunner( 497): at com.android.server.connectivity.Vpn$LegacyVpnRunner.run(Vpn.java:447) The first problem is beaten by simply changing a line in kernel's cyanogenmod_e0_defconfig from CONFIG_TUN=m to CONFIG_TUN=y and rebuilding the kernel. The second problem is slightly deeper, I had to spend 3 hours to find out what's wrong. The reason of PPTP/L2TP VPN is not working is because mtpd uses the mismatching values for PX_PROTO_OLAP and PX_PROTO_OPNS constants, used in the socket creation code. This problem is noted in detail in the following Google Groups discussion: https://groups.google.com/forum/#!msg/android-x86/1uCHFx4glgc/Yis3PkrD-nwJ So I had to re-arrange the ./include/linux/if_pppox.h numbers just to match external/mtpd/ and bionic includes: gellmar@android:/opt/cm9/kernel/lge/e400$ grep -R PX_PROTO /opt/cm9/bionic/libc/kernel/common/linux/ /opt/cm9/bionic/libc/kernel/common/linux/if_pppox.h:#define PX_PROTO_OE 0 /opt/cm9/bionic/libc/kernel/common/linux/if_pppox.h:#define PX_PROTO_OL2TP 1 /opt/cm9/bionic/libc/kernel/common/linux/if_pppox.h:#define PX_PROTO_PPTP 2 /opt/cm9/bionic/libc/kernel/common/linux/if_pppox.h:#define PX_PROTO_OLAC 3 /opt/cm9/bionic/libc/kernel/common/linux/if_pppox.h:#define PX_PROTO_OPNS 4 and re-compile the kernel. Also I enabled L2TP module with netlink (cyanogenmod_e0_defconfig): CONFIG_L2TP=y CONFIG_L2TP_V3=y Now compile, repack and reflash :) Happy VPNing!
Guest gellmar Posted April 9, 2013 Report Posted April 9, 2013 Note on missing checkboxes / combo-boxes / buttons in webkit render. When one uses stock browser, one may notice that there are no checkboxes / radio buttons rendered on a webpage. This is because of absence of several render skin files in framework-res.apk. The following files are referred in https://github.com/CyanogenMod/android_external_webkit/tree/ics/Source/WebKit/android/ RenderXXX.cpp and they ought to be located in frameworks/base/core/res/res/drawable-ldpi but these aren't there. So I copied the following files from drawable-mdpi folder to drawable-ldpi and recompiled framework-res.apk: # core/res/res/drawable-ldpi/btn_check_off_holo.png # core/res/res/drawable-ldpi/btn_check_on_holo.png # core/res/res/drawable-ldpi/btn_default_disabled_holo.9.png # core/res/res/drawable-ldpi/btn_default_focused_holo.9.png # core/res/res/drawable-ldpi/btn_default_normal_holo.9.png # core/res/res/drawable-ldpi/btn_default_pressed_holo.9.png # core/res/res/drawable-ldpi/btn_radio_off_holo.png # core/res/res/drawable-ldpi/btn_radio_on_holo.png # core/res/res/drawable-ldpi/combobox_disabled.png # core/res/res/drawable-ldpi/combobox_nohighlight.png # core/res/res/drawable-ldpi/ic_media_stop.png # core/res/res/drawable-ldpi/scrubber_control_disabled_holo.png # core/res/res/drawable-ldpi/scrubber_control_focused_holo.png # core/res/res/drawable-ldpi/scrubber_control_normal_holo.png # core/res/res/drawable-ldpi/scrubber_control_pressed_holo.png # core/res/res/drawable-ldpi/scrubber_primary_holo.9.png # core/res/res/drawable-ldpi/scrubber_secondary_holo.9.png # core/res/res/drawable-ldpi/scrubber_track_holo_dark.9.png # core/res/res/drawable-ldpi/scrubber_track_holo_light.9.png # core/res/res/drawable-ldpi/spinner_76_inner_holo.png # core/res/res/drawable-ldpi/spinner_76_outer_holo.png and got all the skinned controls visible and clickable. Also for now, a stock browser crash inside the WebCore on some websites with an error cause 'Http:Transaction:DoCacheReadData' can be worked around by disabling Javascript. The permanent issue is discussed at http://code.google.com/p/android/issues/detail?id=40784 and the possible fix is to force reloading of JS scripts file if there is no cached version before the WebCore starts trying to load them from cache.
Guest gellmar Posted April 15, 2013 Report Posted April 15, 2013 Note on layout xml editing. When I tried to fix lockscreen, I faced the xml layout editing problem. Here I will describe certain tricks I used to re-order the interface just fit our 120ppi 320x240 screen. First of all, the offset of a field from left side of previous view inside LinearLayout can be specified by android:marginLeft attribute. Second, to add new named control, you need to specify a new android:id="@+id/yournewid" and in this case the text for your new control has to be placed in frameworks/base/core/res/res/xml/strings.xml (not in overlay file for your device!) Third, if you see a GridLayout a nd a component spanning several rows, you shoud assume that one widget sibling of GridLayout is a row.
Guest gellmar Posted April 24, 2013 Report Posted April 24, 2013 (edited) Note on porting the SDMergE400 mod for stock 2.3.6 firmware, First, I de-odexed the ROM with dsixda's kitchen, also added root. Then I fixed stock init.rc as follows: on early-init start ueventd on init sysclktz 0 loglevel 3 # setup the global environment export PATH /sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin export LD_LIBRARY_PATH /vendor/lib:/system/lib export ANDROID_BOOTLOGO 1 export ANDROID_ROOT /system export ANDROID_ASSETS /system/app export ANDROID_DATA /data export EXTERNAL_STORAGE /mnt/sdcard export ASEC_MOUNTPOINT /mnt/asec export LOOP_MOUNTPOINT /mnt/obb # [START] LGE_USE_INTERNAL_FAT export EXTERNAL_ADD_STORAGE /mnt/sdcard/_ExternalSD export ASEC_ADD_MOUNTPOINT /mnt/extasec export LOOP_ADD_MOUNTPOINT /mnt/extobb # [END] LGE_USE_INTERNAL_FAT export BOOTCLASSPATH /system/framework/core.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar # Backward compatibility symlink /system/etc /etc symlink /sys/kernel/debug /d # Right now vendor lives on the same filesystem as system, # but someday that may change. symlink /system/vendor /vendor # create mountpoints mkdir /mnt 0775 root system mkdir /mnt/sdcard 0000 system system # Create cgroup mount point for cpu accounting mkdir /acct mount cgroup none /acct cpuacct mkdir /acct/uid # Backwards Compat - XXX: Going away in G* symlink /mnt/sdcard /sdcard # [START] LGE_USE_INTERNAL_FAT symlink /mnt/sdcard/_ExternalSD /sdcard/_ExternalSD # [END] LGE_USE_INTERNAL_FAT mkdir /system mkdir /data 0771 system system mkdir /persist 0771 system system mkdir /cache 0770 system cache mkdir /config 0500 root root mkdir /persist 0771 system system # [START] MLT Porting mkdir /mpt 0771 system system # [END] MLT Porting # Directory for putting things only root should see. mkdir /mnt/secure 0700 root root # Directory for staging bindmounts mkdir /mnt/secure/staging 0700 root root # Directory-target for where the secure container # imagefile directory will be bind-mounted mkdir /mnt/secure/asec 0700 root root # [START] LGE_USE_INTERNAL_FAT mkdir /mnt/extsecure 0700 root root mkdir /mnt/extsecure/staging 0700 root root mkdir /mnt/extsecure/extasec 0700 root root # [END] LGE_USE_INTERNAL_FAT # Secure container public mount points. mkdir /mnt/asec 0700 root system mount tmpfs tmpfs /mnt/asec mode=0755,gid=1000 # Filesystem image public mount points. mkdir /mnt/obb 0700 root system mount tmpfs tmpfs /mnt/obb mode=0755,gid=1000 # [START] LGE_USE_INTERNAL_FAT mkdir /mnt/extasec 0000 root system mount tmpfs tmpfs /mnt/extasec mode=0755,gid=1000 mkdir /mnt/extobb 0700 root system mount tmpfs tmpfs /mnt/extobb mode=0755,gid=1000 # [END] LGE_USE_INTERNAL_FAT write /proc/sys/kernel/panic_on_oops 1 write /proc/sys/kernel/hung_task_timeout_secs 0 write /proc/cpu/alignment 4 write /proc/sys/kernel/sched_latency_ns 10000000 write /proc/sys/kernel/sched_wakeup_granularity_ns 2000000 write /proc/sys/kernel/sched_compat_yield 1 write /proc/sys/kernel/sched_child_runs_first 0 # Create cgroup mount points for process groups mkdir /dev/cpuctl mount cgroup none /dev/cpuctl cpu chown system system /dev/cpuctl chown system system /dev/cpuctl/tasks chmod 0777 /dev/cpuctl/tasks write /dev/cpuctl/cpu.shares 1024 mkdir /dev/cpuctl/fg_boost chown system system /dev/cpuctl/fg_boost/tasks chmod 0777 /dev/cpuctl/fg_boost/tasks write /dev/cpuctl/fg_boost/cpu.shares 1024 mkdir /dev/cpuctl/bg_non_interactive chown system system /dev/cpuctl/bg_non_interactive/tasks chmod 0777 /dev/cpuctl/bg_non_interactive/tasks # 5.0 % write /dev/cpuctl/bg_non_interactive/cpu.shares 52 # LGDRM, DivX [[email protected]], 2011-07-16 [START] mkdir /drm 0771 system system # LGDRM, DivX [[email protected]], 2011-07-16 [END] on fs # mount mtd partitions # Mount /system rw first to give the filesystem a chance to save a checkpoint mount yaffs2 mtd@system /system #mount yaffs2 mtd@system /system ro remount mount yaffs2 mtd@userdata /data nosuid nodev mount yaffs2 mtd@persist /persist nosuid nodev mount yaffs2 mtd@cache /cache nosuid nodev mount yaffs2 mtd@persist /persist nosuid nodev on emmc-fs # mount mmc partitions # [E2FSPROGS 1.41.14] change e2fsck option from -p to -y so that filesystem problems # are fixed without human intervention. # if there're too many problems -p option requests manual operation. wait /dev/block/mmcblk0p14 mount ext4 /dev/block/mmcblk0p14 /system ro data=ordered barrier=1 wait /dev/block/mmcblk0p20 exec /system/bin/demigod_make_ext4fs -e /dev/block/mmcblk0p20 /data exec /system/bin/e2fsck -y /dev/block/mmcblk0p20 mount ext4 /dev/block/mmcblk0p20 /data nosuid nodev noatime barrier=1 data=ordered noauto_da_alloc errors=continue wait /dev/block/mmcblk0p15 exec /system/bin/demigod_make_ext4fs -e /dev/block/mmcblk0p15 /persist exec /system/bin/e2fsck -y /dev/block/mmcblk0p15 mount ext4 /dev/block/mmcblk0p15 /persist nosuid nodev data=ordered barrier=1 wait /dev/block/mmcblk0p16 exec /system/bin/demigod_make_ext4fs -e /dev/block/mmcblk0p16 /cache exec /system/bin/e2fsck -y /dev/block/mmcblk0p16 mount ext4 /dev/block/mmcblk0p16 /cache nosuid nodev data=ordered barrier=1 wait /dev/block/mmcblk0p18 exec /system/bin/demigod_make_ext4fs -e /dev/block/mmcblk0p18 /drm exec /system/bin/e2fsck -y /dev/block/mmcblk0p18 mount ext4 /dev/block/mmcblk0p18 /drm nosuid nodev data=ordered barrier=1 # [START] LGE_USE_INTERNAL_FAT #wait /dev/block/mmcblk0p20 #exec /system/bin/resize2fs /dev/block/mmcblk0p20 #exec /system/bin/e2fsck -y /dev/block/mmcblk0p20 #mount vfat /dev/block/mmcblk0p20 /mnt/sdcard # [END] LGE_USE_INTERNAL_FAT # [START] MLT Porting wait /dev/block/mmcblk0p21 exec /system/bin/demigod_make_ext4fs -e /dev/block/mmcblk0p21 /mpt exec /system/bin/e2fsck -y /dev/block/mmcblk0p21 mount ext4 /dev/block/mmcblk0p21 /mpt nosuid nodev data=ordered barrier=1 # [END] MLT Porting ## ANDY_PORTING LGDRM [[email protected] 100401] # LGDRM, DivX [[email protected]], 2011-07-16 [START] chown system system /drm chmod 0771 /drm #LGDRM mkdir /drm/lgdrm 0770 lgdrm lgdrm_acc chown lgdrm lgdrm_acc /drm/lgdrm chmod 0770 /drm/lgdrm #DivX mkdir /drm/multimedia 0770 media system chown media system /drm/multimedia chmod 0770 /drm/multimedia # LGDRM, DivX [[email protected]], 2011-07-16 [END] ## ANDY_END ## [email protected] [2011-07-26] - Referred from Victor model start rmt_storage on post-fs # once everything is setup, no need to modify / mount rootfs rootfs / ro noatime remount # We chown/chmod /data again so because mount is run as root + defaults chown system system /data chmod 0771 /data # Mounting of persist is moved to 'on emmc-fs' and 'on fs' sections # We chown/chmod /persist again so because mount is run as root + defaults chown system system /persist chmod 0771 /persist chmod 0664 /sys/devices/platform/msm_sdcc.1/polling chmod 0664 /sys/devices/platform/msm_sdcc.2/polling chmod 0664 /sys/devices/platform/msm_sdcc.3/polling chmod 0664 /sys/devices/platform/msm_sdcc.4/polling # Chown polling nodes as needed from UI running on system server chown system system /sys/devices/platform/msm_sdcc.1/polling chown system system /sys/devices/platform/msm_sdcc.2/polling chown system system /sys/devices/platform/msm_sdcc.3/polling chown system system /sys/devices/platform/msm_sdcc.4/polling # Create dump dir and collect dumps. # Do this before we mount cache so eventually we can use cache for # storing dumps on platforms which do not have a dedicated dump partition. mkdir /data/dontpanic # FRANDRO_CHANGE_S [[email protected]] <For Error Handler> chmod 662 /dev/log/main chmod 662 /dev/log/system chmod 662 /dev/log/events chmod 662 /dev/log/radio #chown root log /data/dontpanic chown root system /data/dontpanic #chmod 0750 /data/dontpanic chmod 0775 /data/dontpanic mkdir /data/tombstones chown system system /data/tombstones chmod 0755 /data/tombstones # FRANDRO_CHANGE_E [[email protected]] # Collect apanic data, free resources and re-arm trigger copy /proc/apanic_console /data/dontpanic/apanic_console chown root log /data/dontpanic/apanic_console chmod 0640 /data/dontpanic/apanic_console copy /proc/apanic_threads /data/dontpanic/apanic_threads chown root log /data/dontpanic/apanic_threads chmod 0640 /data/dontpanic/apanic_threads write /proc/apanic_console 1 # [START] MLT Porting chown system system /mpt chmod 0771 /mpt # [END] MLT Porting # Same reason as /data above chown system cache /cache chmod 0770 /cache # This may have been created by the recovery system with odd permissions chown system cache /cache/recovery chmod 0770 /cache/recovery #change permissions on vmallocinfo so we can grab it from bugreports chown root log /proc/vmallocinfo chmod 0440 /proc/vmallocinfo #change permissions on kmsg & sysrq-trigger so bugreports can grab kthread stacks chown root system /proc/kmsg chmod 0440 /proc/kmsg chown root system /proc/sysrq-trigger chmod 0220 /proc/sysrq-trigger # create basic filesystem structure mkdir /data/misc 01771 system misc mkdir /data/misc/bluetoothd 0770 bluetooth bluetooth mkdir /data/misc/bluetooth 0770 system system mkdir /data/misc/keystore 0700 keystore keystore mkdir /data/misc/vpn 0770 system system mkdir /data/misc/systemkeys 0700 system system mkdir /data/misc/vpn/profiles 0770 system system # give system access to wpa_supplicant.conf for backup and restore mkdir /data/misc/wifi 0770 wifi wifi #[email protected] [2011/07/27], change 0770 to 0771 for OTA test chmod 0771 /data/misc/wifi chmod 0660 /data/misc/wifi/wpa_supplicant.conf mkdir /data/local 0771 shell shell mkdir /data/local/tmp 0771 shell shell mkdir /data/data 0771 system system mkdir /data/app-private 0771 system system mkdir /data/app 0771 system system mkdir /data/property 0700 root root mkdir /data/radio 0770 radio radio # we use "radio" for gid to access from "rild" for AT cmd. chown system radio /system/etc/firmware/wlan/volans/WCN1314_qcom_wlan_nv.bin chmod 0660 /system/etc/firmware/wlan/volans/WCN1314_qcom_wlan_nv.bin # LGE_CHANGE_E, 20110727, [email protected] # [email protected](2010.01.11).begin: add for XT9 user dictionary #mkdir /data/xt9 0777 system system #chown system system /data/xt9 #chmod 0777 /data/xt9 # [email protected](2010.01.11).end mkdir /data/misc/sensors 0775 root root write /data/system/sensors/settings 0 chmod 0664 /data/system/sensors/settings # create dalvik-cache and double-check the perms mkdir /data/dalvik-cache 0771 system system chown system system /data/dalvik-cache chmod 0771 /data/dalvik-cache # create the lost+found directories, so as to enforce our permissions mkdir /data/lost+found 0770 mkdir /cache/lost+found 0770 # double check the perms, in case lost+found already exists, and set owner chown root root /data/lost+found chmod 0770 /data/lost+found chown root root /cache/lost+found chmod 0770 /cache/lost+found #LGE_DEV_PORTING M3_NFC # NFC chmod 0666 /dev/pn544 setprop ro.nfc.port I2C #LGE_DEV_END # 20110216 [email protected] for ANDY_LGDRM [START] ## ANDY_PORTING LGDRM [[email protected] 100401] # create dirs if not exist mkdir /data/lgdrm 0770 lgdrm lgdrm_acc mkdir /data/wmdrm 0770 lgdrm lgdrm_acc ## ANDY_END # 20110216 [email protected] for ANDY_LGDRM [END] # LGE_DEV_PORTING, [[email protected]], 2011-05-06 ## LGE_MERGE_S # Nextreaming - DIVX_DRM mkdir /drm/multimedia/nx 0770 media system chown media system /drm/multimedia/nx chmod 0770 /drm/multimedia/nx mkdir /drm/multimedia/uma 0770 media system chown media system /drm/multimedia/uma chmod 0770 /drm/multimedia/uma mkdir /drm/multimedia/scnt 0770 media system chown media system /drm/multimedia/scnt chmod 0770 /drm/multimedia/scnt mkdir /drm/multimedia/scnt/sdadf 0770 media system chown media system /drm/multimedia/scnt/sdadf chmod 0770 /drm/multimedia/scnt/sdadf # END : Nextreaming - DIVX_DRM ## LGE_MERGE_E # LGE_DEV_END [[email protected]] #ifdef LGE_ROOTING_FEATURE ## princlee add for rooting mkdir /persist/hidden chown root root /persist/hidden chmod 0755 /persist/hidden #endif ## or ## #ifdef LGE_ROOTING_FEATURE ## princlee add for rooting ## change direcoty to persist incase of QCT ## mkdir /data/hidden ## chown root root /data/hidden ## chmod 0755 /data/hidden ## #endif #if defined(ANDY_ERS) ## ERS mkdir /data/data/com.lge.ers mkdir /data/data/com.lge.ers/android mkdir /data/data/com.lge.ers/kernel mkdir /data/data/com.lge.ers/arm9 chmod 0777 /data/data/com.lge.ers/android chmod 0777 /data/data/com.lge.ers/kernel chmod 0777 /data/data/com.lge.ers/arm9 #endif # 20110824, [email protected], make ringtone,alarm property directory [START] mkdir /data/audioprop 0777 system system # 20110824, [email protected], make ringtone,alarm property directory [END] on boot # basic network init ifup lo hostname localhost domainname localdomain # set RLIMIT_NICE to allow priorities from 19 to -20 setrlimit 13 40 40 # don't require sim setprop keyguard.no_require_sim 1 # Define the oom_adj values for the classes of processes that can be # killed by the kernel. These are used in ActivityManagerService. setprop ro.FOREGROUND_APP_ADJ 0 setprop ro.VISIBLE_APP_ADJ 1 setprop ro.PERCEPTIBLE_APP_ADJ 2 setprop ro.HEAVY_WEIGHT_APP_ADJ 3 setprop ro.SECONDARY_SERVER_ADJ 4 setprop ro.BACKUP_APP_ADJ 5 setprop ro.HOME_APP_ADJ 6 setprop ro.HIDDEN_APP_MIN_ADJ 7 setprop ro.EMPTY_APP_ADJ 15 # Define the memory thresholds at which the above process classes will # be killed. These numbers are in pages (4k). setprop ro.FOREGROUND_APP_MEM 2048 setprop ro.VISIBLE_APP_MEM 3072 setprop ro.PERCEPTIBLE_APP_MEM 4096 setprop ro.HEAVY_WEIGHT_APP_MEM 4096 setprop ro.SECONDARY_SERVER_MEM 6144 setprop ro.BACKUP_APP_MEM 6144 setprop ro.HOME_APP_MEM 6144 setprop ro.HIDDEN_APP_MEM 7168 setprop ro.EMPTY_APP_MEM 8192 # Write value must be consistent with the above properties. # Note that the driver only supports 6 slots, so we have combined some of # the classes into the same memory level; the associated processes of higher # classes will still be killed first. write /sys/module/lowmemorykiller/parameters/adj 0,1,2,4,7,15 write /proc/sys/vm/overcommit_memory 1 write /proc/sys/vm/min_free_order_shift 4 write /sys/module/lowmemorykiller/parameters/minfree 2048,3072,4096,6144,7168,8192 # Set init its forked children's oom_adj. write /proc/1/oom_adj -16 # Tweak background writeout write /proc/sys/vm/dirty_expire_centisecs 200 write /proc/sys/vm/dirty_background_ratio 5 # LGE_CHANGE_S, [Data_Patch_014] [[email protected]], 2011-04-26 <Define TCP buffer sizes for various networks> # Adjust socket buffer to enlarge TCP receive window for high bandwidth write /proc/sys/net/ipv4/tcp_adv_win_scale 2 #<-- (1 -> 2) 20100816 NJ sewon.kim QC SR result for android.net.cts.TrafficStatsTest#testTrafficStatsForLocalhost # LGE_CHANGE_E, [Data_Patch_014] [[email protected]], 2011-04-26 <Define TCP buffer sizes for various networks> # Permissions for System Server and daemons. chown radio system /sys/android_power/state chown radio system /sys/android_power/request_state chown radio system /sys/android_power/acquire_full_wake_lock chown radio system /sys/android_power/acquire_partial_wake_lock chown radio system /sys/android_power/release_wake_lock chown radio system /sys/power/state chown radio system /sys/power/wake_lock chown radio system /sys/power/wake_unlock chmod 0660 /sys/power/state chmod 0660 /sys/power/wake_lock chmod 0660 /sys/power/wake_unlock chown system system /sys/class/timed_output/vibrator/enable chown system system /sys/class/leds/keyboard-backlight/brightness chown system system /sys/class/leds/lcd-backlight/brightness chown system system /sys/class/leds/button-backlight/brightness chown system system /sys/class/leds/jogball-backlight/brightness chown system system /sys/class/leds/red/brightness chown system system /sys/class/leds/green/brightness chown system system /sys/class/leds/blue/brightness chown system system /sys/class/leds/red/device/grpfreq chown system system /sys/class/leds/red/device/grppwm chown system system /sys/class/leds/red/device/blink chown system system /sys/class/leds/red/brightness chown system system /sys/class/leds/green/brightness chown system system /sys/class/leds/blue/brightness chown system system /sys/class/leds/red/device/grpfreq chown system system /sys/class/leds/red/device/grppwm chown system system /sys/class/leds/red/device/blink chown system system /sys/class/timed_output/vibrator/enable chown system system /sys/module/sco/parameters/disable_esco chown system system /sys/kernel/ipv4/tcp_wmem_min chown system system /sys/kernel/ipv4/tcp_wmem_def chown system system /sys/kernel/ipv4/tcp_wmem_max chown system system /sys/kernel/ipv4/tcp_rmem_min chown system system /sys/kernel/ipv4/tcp_rmem_def chown system system /sys/kernel/ipv4/tcp_rmem_max chown root radio /proc/cmdline # [110801 [email protected] M3_ALL]Add AT%FPRICRC [START] # fpritest mkdir /data/fpri chown system system /data/fpri chmod 0777 /data/fpri # [110801 [email protected] M3_ALL] [END] ## Openchannel BEGIN [[email protected] 111122] # Define OpenChannel Properties setprop openchannel.net.dns 127.0.0.1:7053 setprop openchannel.net.active 0 setprop openchannel.net1.forward_port 8072 setprop openChannel.net1.forwards_to 127.0.0.1 ## Openchannel END ## LGE UPDATE_FOTA_S M3 [email protected] 20011/09/29 chown system system /sys/module/lge_emmc_direct_access/parameters/fota_id_check chown system system /sys/module/lge_emmc_direct_access/parameters/fota_id_read ## LGE UPDATE_FOTA_E M3 [email protected] 20011/09/29 #LGE_CHANGE_GPSONEXTRA [[email protected]][2010.08.28] [BEGIN] mkdir /data/gpscfg 0777 system system chown system system /data/gpscfg/gps_env.conf chmod 0777 /data/gpscfg/gps_env.conf #LGE_CHANGE_GPSONEXTRA [[email protected]][2010.08.28] [END] # Define TCP buffer sizes for various networks # ReadMin, ReadInitial, ReadMax, WriteMin, WriteInitial, WriteMax, setprop net.tcp.buffersize.default 4096,87380,110208,4096,16384,110208 setprop net.tcp.buffersize.wifi 4095,87380,110208,4096,16384,110208 setprop net.tcp.buffersize.umts 4094,87380,110208,4096,16384,110208 setprop net.tcp.buffersize.edge 4093,26280,35040,4096,16384,35040 setprop net.tcp.buffersize.gprs 4092,8760,11680,4096,8760,11680 setprop net.tcp.buffersize.lte 4094,87380,1220608,4096,16384,1220608 setprop net.tcp.buffersize.evdo_b 4094,87380,262144,4096,16384,262144 # Assign TCP buffer thresholds to be ceiling value of technology maximums # Increased technology maximums should be reflected here. write /proc/sys/net/core/rmem_max 1220608 write /proc/sys/net/core/wmem_max 1220608 class_start default #[email protected] not used chown system system /sys/module/android/parameters/usb_mode #[email protected] not used chmod 0666 /sys/module/u_lgeusb/parameters/user_mode chown root system /sys/class/usb_composite/usb_mass_storage/enable chown root system /sys/class/usb_composite/ecm/enable chown system system /sys/devices/platform/usb_cdrom_storage/lun0/file chown system system /sys/devices/platform/msm_hsusb/gadget/usb_state chown system system /sys/module/u_lgeusb/parameters/user_mode chown system system /sys/module/u_lgeusb/parameters/mode chmod 0664 /sys/class/usb_composite/usb_mass_storage/enable chmod 0664 /sys/class/usb_composite/ecm/enable chmod 0664 /sys/devices/platform/usb_cdrom_storage/lun0/file chmod 0664 /sys/devices/platform/msm_hsusb/gadget/usb_state chmod 0664 /sys/module/u_lgeusb/parameters/user_mode chmod 0664 /sys/module/u_lgeusb/parameters/mode ### ## Daemon processes to be run by init. ## service ueventd /sbin/ueventd critical service console /system/bin/sh console disabled user shell group log # [START] LGE_USE_INTERNAL_FAT service formatfat /system/bin/sh /system/etc/format_fat32.sh oneshot # [END] LGE_USE_INTERNAL_FAT # [email protected] merge from victor .default disable. #on property:ro.secure=0 # start console # adbd is controlled by the persist.service.adb.enable system property service adbd /sbin/adbd disabled # adbd on at boot in emulator on property:ro.kernel.qemu=1 start adbd on property:persist.service.adb.enable=1 start adbd on property:persist.service.adb.enable=0 stop adbd #if defined(ANDY_ERS) ## ANDY_PORTING ERS #ERS rpc daemon for qcom service lge_ers_rpcd /system/bin/lge_ers_rpcd # lge_ers_rpcd do not run in user build type on property:ro.build.type=eng stop lge_ers_rpcd start lge_ers_rpcd ## ANDY_END #endif service servicemanager /system/bin/servicemanager user system critical onrestart restart zygote onrestart restart media service vold /system/bin/vold socket vold stream 0660 root mount ioprio be 2 service netd /system/bin/netd socket netd stream 0660 root system service debuggerd /system/bin/debuggerd service ril-daemon /system/bin/rild socket rild stream 660 root radio socket rild-debug stream 660 radio system user root #MUSCAT_PORTING # START : FROM_MUSCAT 20110210 : REVIEWME # Need to check whether any side effects happen later. Applied Muscat's. group radio cache inet misc audio qcom_oncrpc diag system sdcard_rw #group radio cache inet misc audio sdcard_rw qcom_oncrpc diag #disabled # END : FROM_MUSCAT 20110210 #MUSCAT_END # 20110216 [email protected] for ANDY_LGDRM [START] ## ANDY_PORTING LGDRM [[email protected] 100401] # Must executed before system_server service lgdrm /system/bin/lgdrmserver user lgdrm group lgdrm_acc system sdcard_rw qcom_oncrpc radio ## ANDY_END # 20110216 [email protected] for ANDY_LGDRM [END] ## [email protected] [2011-07-26] - Referred from Victor model service rmt_storage /system/bin/rmt_storage /dev/block/mmcblk0p10 /dev/block/mmcblk0p11 user root disabled service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server socket zygote stream 660 root system onrestart write /sys/android_power/request_state wake onrestart write /sys/power/state on onrestart restart media onrestart restart netd service media /system/bin/mediaserver user media group system audio camera graphics inet net_bt net_bt_admin net_raw qcom_oncrpc ioprio rt 4 service bootanim /system/bin/bootanimation user graphics group graphics lg_fota disabled oneshot service dbus /system/bin/dbus-daemon --system --nofork socket dbus stream 660 bluetooth bluetooth user bluetooth group bluetooth net_bt_admin service bluetoothd /system/bin/bluetoothd -n socket bluetooth stream 660 bluetooth bluetooth socket dbus_bluetooth stream 660 bluetooth bluetooth # init.rc does not yet support applying capabilities, so run as root and # let bluetoothd drop uid to bluetooth with the right linux capabilities group bluetooth net_bt_admin misc disabled service hfag /system/bin/sdptool add --channel=10 HFAG user bluetooth group bluetooth net_bt_admin disabled oneshot service hsag /system/bin/sdptool add --channel=11 HSAG user bluetooth group bluetooth net_bt_admin disabled oneshot service opush /system/bin/sdptool add --psm=5255 --channel=12 OPUSH user bluetooth group bluetooth net_bt_admin disabled oneshot service pbap /system/bin/sdptool add --channel=19 PBAP user bluetooth group bluetooth net_bt_admin disabled oneshot service installd /system/bin/installd socket installd stream 600 system system service flash_recovery /system/etc/install-recovery.sh oneshot service racoon /system/bin/racoon socket racoon stream 600 system system # racoon will setuid to vpn after getting necessary resources. group net_admin disabled oneshot service mtpd /system/bin/mtpd socket mtpd stream 600 system system user vpn group vpn net_admin net_raw disabled oneshot service keystore /system/bin/keystore /data/misc/keystore user keystore group keystore socket keystore stream 666 service dumpstate /system/bin/dumpstate -s socket dumpstate stream 0660 shell log disabled oneshot #LGE_UPDATE_S, lgospd is removed in OSP 2.0, [email protected], 20110613 #ANDY_PORTING OSP [[email protected] 101027] #service lgospd-hid /system/bin/lgospd-hid # user root # group system # oneshot #service lgospd /system/bin/lgospd # user root # group system graphics diag radio #ANDY_END #LGE_UPDATE_E, lgospd is removed in OSP 2.0, [email protected], 20110613 and re-packed the kernel. Also I changed the /system/etc/format-fat32.sh that forcedly restored vfat partition on new data partition: #!/system/bin/sh exit 0 and packed a flashable zip with a custom-fixed updater-script. I had to use convert update-script feature from kitchen, but finally this approach had missed several critical symlinks, so I mounted the system.img in my linux box and got the list of necessary symlinks pretty-printed for edify scripting: find . -type l | while read LINE; do symstr=`ls -la $LINE` echo 'symlink("'`echo $symstr | awk '{print $11}' | sed 's/^\./\/system/'`'","'`echo $symstr | awk '{print $9}' | sed 's/^\./\/system/'`'");' >> /tmp/kernels/stock_e400/stock_e400_symlinks done Finally I zipaligned and created a zip archive and tried to flash. Nothing! So I had to take zip from CyanogenMod and replace system folder with mine and the updater-script with new one. That worked. The phone booted, but it still misses a /mnt/extra-sd so I need to patch storage_info.xml too. UPDATE: there is no storage.info in Gingerbread (only ICS+) and I got a damaged card issue. So I digged inside and found that mmcblk0p20 value is hardcoded (sic!) into vold, framework, camera, browser etc! UPDATE: The LG's tivoized vold forces /dev/block/vold/179:20 (0xb314) for /mnt/sdcard and /dev/block/vold/179:32 for /mnt/sdcard/_ExternalSD. External SD entry is controlled by vold.fstab, and /mnt/sdcard by code inside vold to prevent end-users from modding. I had to patch vold to alter 0xb314 partNode with 0xb320 and used stock vold.fstab. As a result, the external SD card was mounted twice - as primary and secondary cards. To prevent the second mountpoint to process, I trued to delete the ExternalSD entry, but that caused vold to lose partition at all. The obvious solution was the following vold.fstab: # Copyright (c) 2011, Code Aurora Forum. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above # copyright notice, this list of conditions and the following # disclaimer in the documentation and/or other materials provided # with the distribution. # * Neither the name of Code Aurora Forum, Inc. nor the names of its # contributors may be used to endorse or promote products derived # from this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED # WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN # IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #dev_mount sdcard /mnt/sdcard auto /devices/platform/msm_sdcc.1/mmc_host # LGE_CHANGE # If sdcard isn't exist, mount emmc partition # 2011-06-14, [email protected] #dev_mount sdcard /mnt/sdcard auto /devices/platform/msm_sdcc.1/mmc_host /devices/platform/msm_sdcc.3/mmc_host dev_mount sdcard /mnt/sdcard auto /devices/platform/msm_sdcc.3/mmc_host dev_mount extsdcard /mnt/extra-sd auto /devices/platform/msm_sdcc.1/mmc_host Here we have an ExternalSD entry but its name is not ExternalSD, so vold drops a framework request but handles the partition internally on 'volume mount /mnt/sdcard' call to vold. Now the external card is reported as absent and the primary card has the size and feel of external one. The USB storage also works at full-speed (~4MB/sec) so this task can be considered as done :) Edited April 27, 2013 by gellmar
Guest gellmar Posted April 27, 2013 Report Posted April 27, 2013 Note on GDBugging the Linux native binaries on Android phone. First of all I tried to use IDA Pro 6.1 + android_server. That gave me SIGSTOP on breakpoint, so I decided to use gdbserver and Affinic Debugger GUi for GDB. I grabbed a copy of gdbserver from http://gnutoolchains.com/android/ and dropped the gdbserver binary to /system/bin: adb root adb remount adb push gdbserver /system/bin adb shell chmod 755 /system/bin/gdbserver Then I installed Affinic and pointed it to arm-linux-androideabi-gdb.exe from gdbserver bundle. Now to start a debugging session, one simply needs the following snippet: adb forward tcp:23946 tcp:23946 adb shell # gdbserver localhost:23946 /your/app/name/bin or # gdbserver localhost:23946 --attach your-pid Then connect to GDB server from Affinic debugger top-level menu and select localhost:23946 as remote gdbserver host. After the debugger attaches to the remote, issue a command: set arm fallback-mode thumb to prevent gdbserver from mangling instruction errors. Then one can set breakpoints and do usual debugging.
Guest gellmar Posted May 2, 2013 Report Posted May 2, 2013 Note on USB mass storage fix on CyanogenMod 9. As you maybe know, the USB flash speed was one of breaking points for daily CM9 use. So I decided to find out what's wrong with it. I got some luck to get a custom stock kernel by kgdhost which performed well with USB, so I finally got something to compare with. I used sudo lsusb -vvv to obtain USB flash configurations for cm9 and kgdhost's kernels, and tried to put them in turn. But then... a Luck :) I changed the zImage inside boot.img, flashed... and got a USB drive while my phone was charging! Long after that I realized that tthe boot.img I used to swap zImage was a very early engineering build from my USB fix. And the speed was awesome! So I started digging. I made the following experiment: 1. Booted the phone with new kernel. 2. Unmounted the SD card from the menu. 3. Issued as root: echo "/dev/block/vold/179:32" > /sys/class/android_usb/android0/f_mass_storage/lun0/file just like vold does 4.Set governor as performance (another trick gained from LG's stock firmware vold) 5. Got 3.6 MB/sec average write speed. Cool! Then unmounted the storage with echo "" > /sys/class/android_usb/android0/f_mass_storage/lun0/file and shared volume via vold: vdc volume share /mnt/sdcard ums and got 870 kb/sec as expected. Fail! That was the spot! I looked at system/vold/VolumeManager.cpp and found out what vold did that I did never: if (mUmsSharingCount++ == 0) { FILE* fp; mSavedDirtyRatio = -1; // in case we fail if ((fp = fopen("/proc/sys/vm/dirty_ratio", "r+"))) { char line[16]; if (fgets(line, sizeof(line), fp) && sscanf(line, "%d", &mSavedDirtyRatio)) { fprintf(fp, "%d\n", mUmsDirtyRatio); } else { SLOGE("Failed to read dirty_ratio (%s)", strerror(errno)); } fclose(fp); } else { SLOGE("Failed to open /proc/sys/vm/dirty_ratio (%s)", strerror(errno)); } } Funny, eh? The dirty-ratio trick did all the speed magic! And VolumeManager::VolumeManager() { mDebug = false; mVolumes = new VolumeCollection(); mActiveContainers = new AsecIdCollection(); mBroadcaster = NULL; mUmsSharingCount = 0; mSavedDirtyRatio = -1; mVolManagerDisabled = 0; mNextLunNumber = 0; // set dirty ratio to ro.vold.umsdirtyratio (default 0) when UMS is active char dirtyratio[PROPERTY_VALUE_MAX]; property_get("ro.vold.umsdirtyratio", dirtyratio, "0"); mUmsDirtyRatio = atoi(dirtyratio); } So I put ro.vold.umsdirtyratio=20 into build prop and fixed the governor change like LG did... Pushed new vold, rebooted - voila! 3.70 MB/sec on CM9!
Guest gellmar Posted May 10, 2013 Report Posted May 10, 2013 Note on in-call speaker mode fix. When one activates the speaker mode when making a call, its volume differs from the general mode negligibly. This was a bug of CM9 setup, which have never been present to the stock ROMs. so it was marked for fix in update 1.4 of my SDMergE400 and gellmar-mod ROMs. I spent abut five days to sort it out (with a three-day holiday, of course!) and now I found out what is wrong, and even can be the source of other possible bugs and improvements. First of all, let me describe the Android audio subsystem. The sound in Android is built around the AudioFlinger service which in turn uses hardware/libhardware_legacy and hardware/qcom/media (for Qualcomm MSM-based phones). So I started logcat and got the following log for a speakerphone call: D/InCallScreen( 657): toggleSpeaker(): newSpeakerState = true I/AudioHardwareMSM76XXA( 430): Routing audio to Speakerphone W/AudioHardwareMSM76XXA( 430): rpc_snd_set_device(6, 0, 0) .... D/InCallScreen( 657): toggleSpeaker(): newSpeakerState = false I/AudioHardwareMSM76XXA( 430): Routing audio to Handset W/AudioHardwareMSM76XXA( 430): rpc_snd_set_device(6, 0, 0) I started digging around setting volumes and audio routes. My very first attempt to patch was AndroidPoliceManager::setVoiceVolume multiplier in hardware/qcom/audio/msm7x27a/AndroidPolicyManager.cpp. That worked, but I was still not satisfied with the volume, because the stock one was noticeably louder. So I had to revert to stock and grab a logcat: D/PhoneUtils( 502): turnOnSpeaker(flag=true, store=true)... V/AudioHardwareMSM76XXA( 130): AudioStreamOutMSM72xx::setParameters() routing=2 V/AudioHardwareMSM76XXA( 130): set output routing 2 V/AudioHardwareMSM76XXA( 130): [LGE]doRouting(): outputDevices 2 ,mode 2 I/AudioHardwareMSM76XXA( 130): [LGE] ****** routing outputDevices[2] tty[0] I/AudioHardwareMSM76XXA( 130): Routing call to Speakerphone V/AudioHardwareMSM76XXA( 130): [LGE] Final outputDevices 2 new:7 mCur:6 E/AudioHardwareMSM76XXA( 130): [LGE]doAudioRouteOrMute() device 7, mMode 2, mMicMute 0 W/AudioHardwareMSM76XXA( 130): rpc_snd_set_device(7, 0, 0) W/AudioHardwareMSM76XXA( 130): setVoiceVolume(0.666667) called D/AudioHardwareMSM76XXA( 130): setVoiceVolume(0.666667) I/AudioHardwareMSM76XXA( 130): Setting in-call volume to 4 (available range is 0 to 7) D/AudioHardwareMSM76XXA( 130): rpc_snd_set_volume(32, 0, 5) ... D/CallManager( 502): setEchoSuppression(true) D/CallManager( 502): ########### Dump CallManager ############ D/CallManager( 502): CallManager state = OFFHOOK D/CallManager( 502): - Foreground: ACTIVE from Handler{407c5ee8} D/CallManager( 502): Conn: [ incoming: false state: ACTIVE post dial state: COMPLETE] D/CallManager( 502): - Background: IDLE from Handler{407c5ee8} D/CallManager( 502): Conn: [] D/CallManager( 502): - Ringing: IDLE from Handler{407c5ee8} D/CallManager( 502): Phone: Handler{407c5ee8}, name = GSM, state = OFFHOOK D/CallManager( 502): - Foreground: ACTIVE Background: IDLE Ringing: IDLE D/CallManager( 502): ########## End Dump CallManager ########## D/CallManager( 502): End setEchoSuppression(true) D/CallManager( 502): ########### Dump CallManager ############ D/CallManager( 502): CallManager state = OFFHOOK D/CallManager( 502): - Foreground: ACTIVE from Handler{407c5ee8} D/CallManager( 502): Conn: [ incoming: false state: ACTIVE post dial state: COMPLETE] D/CallManager( 502): - Background: IDLE from Handler{407c5ee8} D/CallManager( 502): Conn: [] D/CallManager( 502): - Ringing: IDLE from Handler{407c5ee8} D/CallManager( 502): Phone: Handler{407c5ee8}, name = GSM, state = OFFHOOK D/CallManager( 502): - Foreground: ACTIVE Background: IDLE Ringing: IDLE D/CallManager( 502): ########## End Dump CallManager ########## What do we see here? A lot of... but the most interesting is I/AudioHardwareMSM76XXA( 130): Routing call to Speakerphone V/AudioHardwareMSM76XXA( 130): [LGE] Final outputDevices 2 new:7 mCur:6 E/AudioHardwareMSM76XXA( 130): [LGE]doAudioRouteOrMute() device 7, mMode 2, mMicMute 0 W/AudioHardwareMSM76XXA( 130): rpc_snd_set_device(7, 0, 0) rpc_snd_set_device is a routine that does real routing by switching ioctl's to 7x27a driver. So we get device number 7 in stock and 6 in Cyan. I compared the kernel sources and found that files related to endpoints were identical. So I patched a line in AudioHardware constructor and got the following mapping of endpoints ID vs endpoint name: E/AudioHardwareMSM76XXA( 115): cnt = 0 ept->name = HANDSET_LOOPBACK ept->id = 5 E/AudioHardwareMSM76XXA( 115): cnt = 1 ept->name = HANDSET ept->id = 6 E/AudioHardwareMSM76XXA( 115): cnt = 2 ept->name = HEADSET_LOOPBACK ept->id = 1 E/AudioHardwareMSM76XXA( 115): cnt = 3 ept->name = HEADSET ept->id = 2 E/AudioHardwareMSM76XXA( 115): cnt = 4 ept->name = HEADSET_STEREO ept->id = 3 E/AudioHardwareMSM76XXA( 115): cnt = 5 ept->name = SPEAKER ept->id = 0 E/AudioHardwareMSM76XXA( 115): cnt = 6 ept->name = SPEAKER_IN_CALL ept->id = 7 E/AudioHardwareMSM76XXA( 115): cnt = 7 ept->name = SPEAKER_RING ept->id = 8 E/AudioHardwareMSM76XXA( 115): cnt = 8 ept->name = STEREO_HEADSET_AND_SPEAKER ept->id = 8 E/AudioHardwareMSM76XXA( 115): cnt = 9 ept->name = FM_HEADSET ept->id = 10 E/AudioHardwareMSM76XXA( 115): cnt = 10 ept->name = FM_SPEAKER ept->id = 11 E/AudioHardwareMSM76XXA( 115): cnt = 11 ept->name = BT ept->id = 13 E/AudioHardwareMSM76XXA( 115): cnt = 12 ept->name = TTY_HEADSET ept->id = 15 E/AudioHardwareMSM76XXA( 115): cnt = 13 ept->name = TTY_VCO ept->id = 16 E/AudioHardwareMSM76XXA( 115): cnt = 14 ept->name = TTY_HCO ept->id = 17 E/AudioHardwareMSM76XXA( 115): cnt = 15 ept->name = TTY_HCO_SPEAKER ept->id = 18 E/AudioHardwareMSM76XXA( 115): cnt = 16 ept->name = HANDSET_VR ept->id = 20 E/AudioHardwareMSM76XXA( 115): cnt = 17 ept->name = HEADSET_VR ept->id = 21 E/AudioHardwareMSM76XXA( 115): cnt = 18 ept->name = BT_VR ept->id = 23 E/AudioHardwareMSM76XXA( 115): cnt = 19 ept->name = NO_MIC_HEADSET ept->id = 4 E/AudioHardwareMSM76XXA( 115): cnt = 20 ept->name = HEADSET_WITHOUT_MIC_VR ept->id = 22 E/AudioHardwareMSM76XXA( 115): cnt = 21 ept->name = SPEAKER_LOOPBACK ept->id = 29 E/AudioHardwareMSM76XXA( 115): cnt = 22 ept->name = SPEAKER_AUXMIC ept->id = 30 E/AudioHardwareMSM76XXA( 115): cnt = 23 ept->name = CURRENT ept->id = 32 Everything clear? We have a state of SPEAKER_IN_CALL that operates at fuil possible volume, while SPEAKER limits the volume to prevent your ears to leak :) I changed the routing in do_routing and voila - it works. You can see the patch vommitted in my github repo. Additionally, I'd like to post a mapping of stream numbers that setStreamVolume, startOutput and other functions use: enum stream_type { DEFAULT =-1, VOICE_CALL = 0, SYSTEM = 1, RING = 2, MUSIC = 3, ALARM = 4, NOTIFICATION = 5, BLUETOOTH_SCO = 6, ENFORCED_AUDIBLE = 7, // Sounds that cannot be muted by user and must be routed to speaker DTMF = 8, TTS = 9, #if defined(QCOM_HARDWARE) && !defined(USES_AUDIO_LEGACY) FM = 10, #endif NUM_STREAM_TYPES }; The volume change for media files (STREAM_MUSIC) is operated via AndroidPolicyManagerBase::setStreamVolume and the in-call voice (routed to handset aka normal operation mode) - by AndroidPolicyManager::setVoiceVolume. Also I noticed that Cyanogenmod's msm7x27a AudioHardware.cpp lacks of many endpoints - marked as unnecessary, their absence leads to non-working loudspeaker, FM radio etc. That is why I post so detailed reference here.
Recommended Posts
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now