2024-10-10

mdm_helper

zeroflte:/ $ dmesg | grep MDM
[4:     mdm_helper: 4593] [ALOG] Found private data for MDM9x35
[4:     mdm_helper: 4593]        Name:MDM9x35
[4:     mdm_helper: 4593] [ALOG] Starting MDM helper
[4:     mdm_helper: 4593] [ALOG] Creating thread for MDM9x35
[7:     mdm_helper: 4608] [ALOG] Starting MDM9x35
[7:     mdm_helper: 4608] [ALOG] MDM9x35 : switching state to POWERUP
[7:     mdm_helper: 4608] [ALOG] MDM9x35: Initializing environment
[3:mdm_helper_prox: 4700] [ALOG] Found private data for MDM9x35
[3:mdm_helper_prox: 4700]        Name:MDM9x35
[3:mdm_helper_prox: 4700] [ALOG] Starting MDM helper
[3:mdm_helper_prox: 4700] [ALOG] Creating thread for MDM9x35
[7:     mdm_helper: 4608] [ALOG] MDM9x35: Setting up HSIC boot link
[7:     mdm_helper: 4608] [ALOG] MDM9x35: configure_flashless_boot_dev: Initiating HSIC unbind
[1:     mdm_helper: 4608] [ALOG] MDM9x35: configure_flashless_boot_dev: Initiating HSIC bind
[7:     mdm_helper: 4608] [ALOG] MDM9x35: Loading Sahara images11111
[7:     mdm_helper: 4608] [ALOG] MDM9x35: Running '/system/bin/ks  -w /cpdump/ -p /dev/ks_hsic_bridge -r 21 -s 21:/firmware/image/sbl1.mbn -s 25:/firmware/image/tz.mbn -s 30:/firmware/image/sdi.mbn -s 23:/firmware/image/rpm.mbn -s 31:/firmware/image/mba.mbn -s 8:/firmware/image/qdsp6sw.mbn -s 28:/firmware/image/dsp2.mbn -s 6:/firmware/image/apps.mbn -s 16:/dev/block/modem/m9kefs1 -s 17:/dev/block/modem/m9kefs2 -s 20:/dev/block/modem/m9kefs3 -s 29:/firmware/image/acdb.mbn'
[4:     mdm_helper: 4608] [ALOG] MDM9x35: Running Done'/system/bin/ks  -w /cpdump/ -p /dev/ks_hsic_bridge -r 21 -s 21:/firmware/image/sbl1.mbn -s 25:/firmware/image/tz.mbn -s 30:/firmware/image/sdi.mbn -s 23:/firmware/image/rpm.mbn -s 31:/firmware/image/mba.mbn -s 8:/firmware/image/qdsp6sw.mbn -s 28:/firmware/image/dsp2.mbn -s 6:/firmware/image/apps.mbn -s 16:/dev/block/modem/m9kefs1 -s 17:/dev/block/modem/m9kefs2 -s 20:/dev/block/modem/m9kefs3 -s 29:/firmware/image/acdb.mbn'
[4:     mdm_helper: 4608] [ALOG] MDM9x35: ERROR: ks return code was 32512
[4:     mdm_helper: 4608] [ALOG] MDM9x35: Failed to load image/collect logs
[4:     mdm_helper: 4608] [ALOG] MDM9x35 : Powerup failed
[4:     mdm_helper: 4608] [ALOG] MDM9x35 : Reached failed state. exiting
[4:     mdm_helper: 4608] [ALOG] MDM9x35 : Calling cleanup function
[4:     mdm_helper: 4608] [ALOG] MDM9x35: mdm-helper reached fail state
[0:mdm_helper_prox: 4710] [ALOG] MDM9x35: subsystem powerup fail /dev/subsys_esoc0
zeroflte:/ $

/system/bin/ks を用意する
sepolicyをこれに合わせて修正する
file_contexts

/system/bin/mdm_helper                          u:object_r:mdm_helper_exec:s0
/system/bin/mdm_helper_proxy                    u:object_r:mdm_helper_exec:s0
/system/bin/ks                                  u:object_r:mdm_helper_exec:s0

2024-10-08

SC05G sepolicy

存在しているデバイス

/dev/ttyGS0
/dev/ttyGS1
/dev/ttyGS2
/dev/ttyGS3
/dev/ttySAC0
/dev/ttySAC1
/dev/ttySAC2
/dev/ttySAC3

/efs/imei


ls /efs/imei/mps_code.dat
-rw-rw-r-- 1 radio system 3 2018-01-08 08:06 mps_code.dat

3バイトらしい


7.0で定義されているもの

/dev/ttyGS[0-9]*        u:object_r:usb_serial_device:s0
/dev/ttySAC[0-9]*       u:object_r:uart_device:s0
/dev/ttyUSB[0-9]*       u:object_r:usb_device:s0

sc03eをみるに以下を追加した方がよいと思われる


#/dev/ttyUSB0   u:object_r:serial_device:s0
#/dev/ttySAC0   u:object_r:serial_device:s0

/dev/ttySAC1    u:object_r:gps_device:s0
/efs/imei           u:object_r:radio_data_file:s0
/dev/block/modem(/.*)?      u:object_r:radio_device:s0

qmuxdは radio_device, sock_deviceにアクセス

/sys/devices/virtual/hsicctl/%s/modem_wait
/sys/devices/virtual/smdpkt/%s/open_timeout
/dev/hsicctl0
/dev/hsicctl1
/dev/hsicctl2
/dev/hsicctl3
/dev/hsicctl4
/dev/hsicctl5
/dev/hsicctl6
/dev/hsicctl7
/dev/smuxctl32
/dev/hsusbctl0
/dev/hsusbctl1
/dev/hsusbctl2
/dev/hsusbctl3
/dev/mhi_pipe_14
/dev/mhi_pipe_16
/dev/socket/qmux_radio/qmux_connect_socket
/dev/socket/qmux_audio/qmux_connect_socket
/dev/socket/qmux_bluetooth/qmux_connect_socket
/dev/socket/qmux_gps/qmux_connect_socket
/dev/socket/qmux_nfc/qmux_connect_socket
/dev/socket/qmux_radio/proxy_qmux_client_socket
/dev/socket/qmux_radio/proxy_qmux_connect_socket

mdm_helper は以下にアクセス
/dev/subsys_%s
/dev/ks_hsic_bridge
/dev/efs_hsic_bridge
/dev/block/modem/
/dev/block/modem/m9kefs1
/dev/block/modem/m9kefs2
/dev/block/modem/m9kefs3

at_distributor

dev/ttyHSL0
/dev/ttySAC2

$ strings libsec-ril.so | grep efs
/efs/imei/mps_code.dat

やっぱりlibsec-ril.soがIMEIを読んでいる

2024-10-05

バージョンの古い rild を動かす

手順）
純正の libril.so、librilutil.so を /system/lib64 に入れる

vendor/etc/initに rild.rc を入れる、rildは純正、/system/binに入れる

/system/vendor/etc/init/rild.rc

service ril-daemon /system/bin/rild
    class main
    socket rild stream 660 root radio
    socket sap_uim_socket1 stream 660 bluetooth bluetooth
    socket rild-debug stream 660 radio system
    user root
    group radio cache inet misc audio log system drmrpc vpn readproc

以下のエラーが出る。対処が必要

linker  : CANNOT LINK EXECUTABLE "/system/bin/rild": cannot locate symbol "RIL_onRequestAck" referenced by "/system/bin/rild"...

https://github.com/bb-qq/android_device_lge_g3-kddi-common に参考になるソースがあった

ril_shim.cpp

#include <stdlib.h>

extern "C" void RIL_onRequestAck() {}

Android.mk

LOCAL_PATH := $(call my-dir)

include $(CLEAR_VARS)

LOCAL_SRC_FILES := \
    ril_shim.cpp

LOCAL_SHARED_LIBRARIES := libbinder

LOCAL_MODULE := ril_shim
LOCAL_MODULE_TAGS := optional
LOCAL_MODULE_CLASS := SHARED_LIBRARIES

include $(BUILD_SHARED_LIBRARY)

7.0の時は、init.rc に結合させるsoを記述

on init
    export LD_SHIM_LIBS /system/lib/libril.so|ril_shim.so

8.1以降はBoardConfig.mkに記述してlinkerの設定ファイルに格納する方法に変わっている

# SHIMS
TARGET_LD_SHIM_LIBS := \
    /system/bin/rild | ril_shim.so \

2024-09-20

初回起動時にadbを有効にする

以下のリンクを参考にした
https://gist.github.com/varhub/7b9555cdd1e5ad785ffde2300fcfd0bd?permalink_comment_id=3190034
https://github.com/LineageOS/android_device_samsung_serrano-common/blob/lineage-15.1/system_prop_debug.mk

ビルドの際には device.mk に以下を記述する(Android 8.1)の場合

PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
    ro.adb.secure=0 \
    ro.debuggable=1 \
    persist.service.adb.enable=1 \
    persist.sys.usb.config=adb

Android 11の場合は、以下

PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
    ro.adb.secure=0 \
    persist.service.adb.enable=1 \
    persist.sys.usb.config=adb \
    service.adb.root=1

バージョンによって変わるらしい、ramdiskのdefault.prop に以下を記述する

persist.service.adb.enable=1                                                    
persist.service.debuggable=1
persist.sys.usb.config=mtp,adb