Combine dev knowledge to get Bluetooth working - Galaxy Y GT-S5360 Android Development

Hello everybody,
I created this thread because I noticed a lot of people are busy with it, but not a lot of knowledge is shared about it.
Unfortunatly this board doesn't use the common way of implementing bluetooth, so bluetooth loading is giving problems with hciattach.
Already a lot of developers notices in the sources of the Samsung Galaxy Y Sources which can be downloaded from Samsungs contains a folder in hardware/broadcom which is called bt.
Also I noticed another bluetooth folder in the external packages in which broadcom also changed some code to the standard bluez stack.
I was able to find almost the exact source base at Code Aurora Forum so I was able to extract the commits which broadcom has added to the bluez stack.
The patch I extracted can be found here:
http://pastebin.com/Biv570y0
It still contains some Code Aurora stuff, because it's almost imposible to find the exact source base Samsung used.
But if you search for broadcom inside the patch you can find the additions broadcom made.
Also I'm searching for the glib source base they used, because in there broadcom also applied some changes, but haven't found the correct base yet.
Hopefully this forum will become one big pool of knowledge which everybody has so we can crack this problem very soon.
Because I saw a lot of people doing the same thing over and over because there isn't much shared about whats already tried.
So hopefully we can combine our forces on this one.
Greetings PsychoGame

nice idea
but what do we actually need to work upon? the bluetooth library files?
i heard broadcom had released test binaries ....will final their release be fixing bluetooth?
Regards
aNubhav

anubhavrev said:
nice idea
but what do we actually need to work upon? the bluetooth library files?
i heard broadcom had released test binaries ....will final their release be fixing bluetooth?
Regards
aNubhav
Click to expand...
Click to collapse
We need to work on reviewing the Bluetooth files in the source code and reverse engineer them to get the Bluetooth working. Broadcomm released test binaries for the chipset, not for the Bluetooth. Hope that helps you. They have not even released their first stable binary, much less their "final release". I think they have forgotten all about it for now and released the test binaries to ease pressure off their backs.

Whats the exact reason that bt is not working? Im a bit disconnected from this forum...

I guess its not detectable cuz unlike wifi this wont even show error :/
BTW nice sig

Indeed the test binaries which have been released by Broadcom are only applicable to the graphics chipset.
For bluetooth the only things we have available is the BCM4330 .hcd binary located in the /system/bin which is in someway loaded by btld.
Also in the kernel broadcom implemented their own form of rfkill which is called bcm-rfkill if I remember correct, but is found on the system in the folder /sys/class/rfkill/rfkill0.
And appart from that only the kernel sources which are provided in the GT-S5360 Opensource package is the only source we have at this time.
From those sources I extracted the patch I added in my first post.
Btld I think should create a hci socket on /dev/ttyS1 which it does in the stock firmware but doesn' t work on the ported versions.
In the logcat it shows an error when loading bluetooth which says something like failed to create hci socket.
I will post a logcat later for exact errors shown in my logcat.
Greetings PsychoGame

Code:
E/bluedroid( 1518): Failed to create bluetooth hci socket: Address family not supported by protocol (97)
Is any kind of documentation available? Maybe you could then change the protocol to a supported one.

PsychoGame said:
Hello everybody,
I created this thread because I noticed a lot of people are busy with it, but not a lot of knowledge is shared about it.
Unfortunatly this board doesn't use the common way of implementing bluetooth, so bluetooth loading is giving problems with hciattach.
Already a lot of developers notices in the sources of the Samsung Galaxy Y Sources which can be downloaded from Samsungs contains a folder in hardware/broadcom which is called bt.
Also I noticed another bluetooth folder in the external packages in which broadcom also changed some code to the standard bluez stack.
I was able to find almost the exact source base at Code Aurora Forum so I was able to extract the commits which broadcom has added to the bluez stack.
The patch I extracted can be found here:
http://pastebin.com/Biv570y0
It still contains some Code Aurora stuff, because it's almost imposible to find the exact source base Samsung used.
But if you search for broadcom inside the patch you can find the additions broadcom made.
Also I'm searching for the glib source base they used, because in there broadcom also applied some changes, but haven't found the correct base yet.
Hopefully this forum will become one big pool of knowledge which everybody has so we can crack this problem very soon.
Because I saw a lot of people doing the same thing over and over because there isn't much shared about whats already tried.
So hopefully we can combine our forces on this one.
Greetings PsychoGame
Click to expand...
Click to collapse
i said for u alls my tentatives about this !

Hello Whitexp,
I never meant to insult you in any way, and I'm sorry if I did that in any way.
I know you shared you're knowledge on this with me, because I have received a PM from you with what you already did.
But after our conversation about that I found out that some other people also tried out what you did with the same results.
That is why I started this topic so we have a central point where all the information is shared.
Also tomorrow I will create a post for you in which I explain what you already tried, so other people know this.
Greetings PsychoGame
whitexp said:
i said for u alls my tentatives about this !
Click to expand...
Click to collapse

PsychoGame said:
Hello Whitexp,
I never meant to insult you in any way, and I'm sorry if I did that in any way.
I know you shared you're knowledge on this with me, because I have received a PM from you with what you already did.
But after our conversation about that I found out that some other people also tried out what you did with the same results.
That is why I started this topic so we have a central point where all the information is shared.
Also tomorrow I will create a post for you in which I explain what you already tried, so other people know this.
Greetings PsychoGame
Click to expand...
Click to collapse
lol
nops
just said for u , i explain my tentaives

Thank you Whitexp,
I misread a little bit what you said, so I interpreted it a little bit wrong.
Then we'll just wait and see what everybody is trying to do.
I know what you already tried was:
- You replaced the bluetooth folder in /external with the folder which was supplied in the GT-S5360 Opensource 2 package from the Samsung opensource website and compiled it with the options given in the Readme. This was no succes, which I can confirm because I also tried it, but took the bluetooth folder from GT-S5360 Opensource update 3 with the same result.
Also the result in android logcat was no different from without the bluetooth folder applied so this error came up:
E/bluedroid( 1518): Failed to create bluetooth hci socket: Address family not supported by protocol (97)
- The second try you made was to use brcm_patchram_plus in combination with btld. Also this lead to a dead end. I haven't tried this myself, so I don't know what errors may have come up in the logcat.
- Third try was to use brcm_patchram_plus without the use of btld, so the way you find it on many of the other CM ports without succes. I can also confirm this and I believe it led to the same error in the logcat as with the first try.
As an addition I found out that the bluedroid error above is found in the android sourcecode in the file <androidsource>/system/bluetooth/bluedroid/bluetooth.c which compiles to the file libbluedroid.so. Also I found in the Android.mk the option BOARD_CUSTOM_BLUEDROID which makes android building possible with a customized bluetooth.c so a libbluedroid.so. An example of this can be found for example on the samsung cooper device: https://github.com/CyanogenMod/android_device_samsung_cooper . I think we may have to do something with this also, because I found that the android port also has strange behavior when copying over the libbluedroid.so from the stock firmware. With the compiled version CM boots without a problem, but with the libbluedroid.so from stock the boot process hangs early on in the bootproces which you can see if you pull a logcat from the device. It doesn't even make it to alsa initialization. To be honest I only tested this with clean compiled CM, so without the external/bluetooth folder replaced with the one from source. Today will test to see if the same happens if I replaced the external/bluetooth folder with the one from the Samsung Opensource package.
Greetings PsychoGame

GermainZ said:
Code:
E/bluedroid( 1518): Failed to create bluetooth hci socket: Address family not supported by protocol (97)
Is any kind of documentation available? Maybe you could then change the protocol to a supported one.
Click to expand...
Click to collapse
Unfortunately as far as I know theres currently no real developer documentation available on the board or bluetooth chip.
The only information which google comes up with is this small bit of information on the bluetooth chip and board:
- BCM21553:
http://www.broadcom.com/products/Cellular/3G-Baseband-Processors/BCM21553
http://pdadb.net/index.php?m=cpu&id=a21553&c=broadcom_bcm21553
- BCM4330
https://www.bluetooth.org/tpg/RefNotes/4330-PB10X-R1.pdf
http://www.broadcom.com/products/Wireless-LAN/802.11-Wireless-LAN-Solutions/BCM4330

Still no luck in getting bluetooth to work.
Even compiling the Android source with the Bluetooth package from the GT-S5360 Opensource in combination with libbluedroid.so from stock didn't do the job.
Still rendered the system unbootable:S.
My developing will be on a low speed in the weekend, so will try new things next week.
Also people who have suggestions are welcome to post over here, but don't spam the thread.
I hope to keep this thread as informational as possible for other porters as well so we have as much information as possible in a central place:good:
Greetings PsychoGame

Hello ppl ....
jst placing a small request here
could you please run - "rfkill list" in terminal and post your results....
results from both stock and cm7 builds are welcome....
if you get "rfkill" not found on terminal try install busybox ..
i just googled the
Failed to create bluetooth hci socket: Address family not supported by protocol (97)
error and came up with this ....
TIA
anubhav

Not the Combine from Half-Life
</joke>

Hello anubhavrev,
I'll add the output of the rfkill list here in a minute.
Today I'm going to work on the bluetooth problem again.
I've found some new clues, when executing a logcat on the btld and bluetoothd in the stock rom.
I thought lets return to the point it was still working, and put the bluetooth system through the logwrapper.
Currently I'm building CM7 again with the bluetooth line in the init scripts exactly the same.
When finished building and flashing I will pull a logcat again and try to see if the logwrapper on the bluetooth system spits out something different.
Greetings PsychoGame
anubhavrev said:
Hello ppl ....
jst placing a small request here
could you please run - "rfkill list" in terminal and post your results....
results from both stock and cm7 builds are welcome....
if you get "rfkill" not found on terminal try install busybox ..
i just googled the
Failed to create bluetooth hci socket: Address family not supported by protocol (97)
error and came up with this ....
TIA
anubhav
Click to expand...
Click to collapse

Hello everybody,
I thought I'll update on what I tried with bluetooth today.
It looks promising, but it might just be a dead end as well, I'll investigate this further later on.
What I did was study the code in brcm_patchram_plus.c, and found out that it uses the UART H4 interface for bluetooth.
I knew from kernel developing this was a kernel feature, so I thought lets take a look what a search in the default config comes up with.
And bingo the bluetooth UART H4 was disabled in the kernel, so what I did was enable it and compile the kernel again.
To initialize the bluetooth with brcm_patchram_plus I added the next line to the init script in place of the btld daemon:
service hciattach /system/bin/logwrapper /system/bin/brcm_patchram_plus --enable_hci --baudrate 3000000 \
--patchram /system/bin/BCM4330B1_002.001.003.0634.0652.hcd /dev/ttyS1
user bluetooth
group bluetooth net_bt_admin
disabled
Click to expand...
Click to collapse
This time bluetooth started initializing, but the logcat shows that it fails with the following error:
D/DTUN_CLNT( 2055): BTLIF_MAKE_LOCAL_SERVER_NAME return name: brcm.bt.btlif.9000
I/DTUN_CLNT( 2055): connect_srv ret:-1 server name:brcm.bt.btlif.9000
I/bluetoothd( 2054): connect: Connection refused
E/BluetoothEventLoop.cpp( 1538): get_adapter_path: D-Bus error: org.freedesktop.DBus.Error.ServiceUnknown (The name org.bluez was not provided by any .service files)
I just wanted to let everybody know what I'm up to.
Greetings PsychoGame

I have very good news for the GT-S5360 community and other devices with bcm21553 board.
It looks like bluetooth is partially working in my device.
I can scan and find other bluetooth devices in my surrounding, and are able to find the GT-S5360 on other devices as well.
At the moment this is as far as I got, so pairing with the device is still not possible and sending files to the device is also still not possible.
But the first step has been set.
I think I also know what the problem might be with the bluetooth unable to pair, but I don't have time to fix this over the weekend.
As I have said in another thread I'm already investing a great deal of free time into this project, so this weekend I'm gonna take a break again.
Monday I'll start getting all the other problems out so hopefully somewhere next week I'll get bluetooth fully functioning.
In my CM7 thread I'll be releasing a new build where the bluetooth is partially working, so if you want to check it out for yourself then I'll advice you to take a look in the build.
Greetings PsychoGame

PsychoGame said:
I have very good news for the GT-S5360 community and other devices with bcm21553 board.
It looks like bluetooth is partially working in my device.
I can scan and find other bluetooth devices in my surrounding, and are able to find the GT-S5360 on other devices as well.
At the moment this is as far as I got, so pairing with the device is still not possible and sending files to the device is also still not possible.
But the first step has been set.
I think I also know what the problem might be with the bluetooth unable to pair, but I don't have time to fix this over the weekend.
As I have said in another thread I'm already investing a great deal of free time into this project, so this weekend I'm gonna take a break again.
Monday I'll start getting all the other problems out so hopefully somewhere next week I'll get bluetooth fully functioning.
In my CM7 thread I'll be releasing a new build where the bluetooth is partially working, so if you want to check it out for yourself then I'll advice you to take a look in the build.
Greetings PsychoGame
Click to expand...
Click to collapse
Ohh..thats great bro :thumbup: sorry i dnt knw anythng abut build cm7 or related to cm stuff..
Bt one thing i knw U r best in devloping forum for sgy :thumbup:
Keep it Up :thumbup: N all d best bro
I knw one day we will get bugless cm. :thumbup: due to ur awsme work :thumbup:
Sent from my GT-S5360 using xda app-developers app

If anyone wants to help me in my bluetooth development hereby I write what I did to get it working up to the point I'm at, at the moment.
In the kernel the following options have been set to Y and the kernel has been recompiled:
CONFIG_BT=y
CONFIG_BT_L2CAP=y
CONFIG_BT_RFCOMM=y
CONFIG_BT_RFCOMM_TTY=y
CONFIG_BT_BNEP=y
CONFIG_BT_HIDP=y
CONFIG_BT_HCIUART=y
CONFIG_BT_HCIUART_H4=y
About the these I'm not sure if I should include them in the kernel or not. Officially our kernel already had rfkill, which is a bcm-rfkill.
The problem is that the bluetoothd daemon is not able to correctly communicate with this bcm-rfkill. When the options below are not included bluetooth starts but a few bluetooth crashes occur. When I include them I'm able to start bluetooth, but am not able anymore to find any devices, and also my device isn't detected by other bluetooth devices anymore. So I think we will need to do some modifications to make the bluetoothd compatible with bcm-rfkill. Also it it not possible to work without the bcm-rfkill and use the kernels rfkill because then bluetooth isn't able to start anymore at all.
CONFIG_RFKILL=y
CONFIG_RFKILL_INPUT=y
In the init scripts I have set the following things to work with brcm_patchram_plus:
# Set the correct bluetooth MAC Address
setprop ro.bt.bdaddr_path "/data/misc/bluetooth/.nvmac_bt.info"\
# permissions for bluetooth.
chown bluetooth bluetooth /data/misc/bluetooth
chown bluetooth bluetooth ro.bt.bdaddr_path
chown bluetooth bluetooth /dev/ttyS1
chmod 0600 /dev/ttyS1
chmod 0660 /sys/class/rfkill/rfkill0/state
chown bluetooth bluetooth /sys/class/rfkill/rfkill0/state
chown bluetooth bluetooth /sys/class/rfkill/rfkill0/type
service hciattach /system/bin/logwrapper /system/bin/brcm_patchram_plus --enable_hci \
--baudrate 3000000 --patchram /system/bin/BCM4330B1_002.001.003.0634.0652.hcd /dev/ttyS1
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
The bluetoothd line in the init.rc isn't changed, so you can just leave it untouched in the init scripts.
Hopefully we are all able to crack it.
Greetings PsychoGame

Related

Getting bluetooth working in Hero [updated: 8/26/2009]

*More progress 11:04pm CST 8/26/09*
Tracked down what calls the BTIP service, it's /system/lib/libandroid_runtime.so . Tried replacing it with a cupcake build, rebooted and ran into the issue where /system/framework/framework.jar is still referencing calls that were in the Hero libandroid_runtime.so . So replaced framework.jar and framework.odex from cupcake build and got the following error.
Code:
D/AndroidRuntime( 1517): >>>>>>>>>>>>>> AndroidRuntime START <<<<<<<<<<<<<<
D/AndroidRuntime( 1517): CheckJNI is OFF
I/dalvikvm( 1517): DexOpt: mismatch dep signature for '/system/framework/core.odex'
E/dalvikvm( 1517): /system/framework/framework.jar odex has stale dependencies
I/dalvikvm( 1517): Zip is good, but no classes.dex inside, and no valid .odex file in the same directory
D/libc-abort( 1517): abort() called in pid 1517
Any "educated" ideas?
*Questions & Progress 01:09pm CST 8/17/09*
So lately what I've been trying to do is find where a reference is made to actually call the BTIPS service. I've been lookiing in /system/framework and /data/app_s/Settings.apk but haven't found it yet. What I'm hoping to do is modify the file and have it call BT the same way cupcake did. Has anyone else found where a reference to "btips" is at?
Settings.apk, which is what pops up when on home screen and you hit menu->settings, only makes a call to "android:targetClass="com.android.settings.bluetooth.BluetoothSettings"
Anywho, if you find it in any system libraries or framework files let me know. Please no PM's or posts about where you "THINK" it may be at. I've already tried the random guessing stuff, now I'm going through libraries one by one trying to find it.
*Some more notes 12:30pm CST 7/24/09*
Here are some notes of interest.
There are two versions of the /system/bin/bts daemon that are floating around on the Hero builds
Code:
md5sum bts
29ffa46f12c01e3690690752b4e2d58d bts
md5sum bts
5aeaca42d67d3b3c64ceda9ee4bfec1a bts
There are also two versions of the TIInit_5.3.53.bts firmware files. One is actually just the brf6300.bin file renamed to match what Hero is looking for in /etc/firmware
Code:
md5sum TIInit_5.3.53.bts
d7a214bdb9b4fbc2b4e2dd7e3ab95df0 TIInit_5.3.53.bts
md5sum TIInit_5.3.53.bts
cb3d2ecbfc97c026a0dcceb8c959b7db TIInit_5.3.53.bts
If you run "strings" on /system/bin/bts and grep for "TII" you'll be able to tell which firmware files that version supports
Code:
TIInit_3.4.27.bts
TIInit_4.2.38.bts
TIInit_5.2.34.bts
TIInit_5.3.53.bts
TIInit_6.2.31.bts
*Nice picture illustrating BT architecture in Android 7:04pm CST 7/17/09*
*A note for ROM devs 02:27pm CST 7/17/09*
Something to note, Hero does not use any of the following legacy services and therefore they can be removed from init.rc & init.trout.rc . This is mainly something the ROM cookers should pay attention to. The btips service actually handles all of this now.
REMOVE THE FOLLOWING:
Code:
service hcid /system/bin/hcid -s -n -f /etc/bluez/hcid.conf
socket bluetooth stream 660 bluetooth bluetooth
socket dbus_bluetooth stream 660 bluetooth bluetooth
# init.rc does not yet support applying capabilities, so run as root and
# let hcid drop uid to bluetooth with the right linux capabilities
group bluetooth net_bt_admin misc
disabled
service hciattach /system/bin/hciattach -n -s 115200 /dev/ttyHS0 texas 4000000 flow
user bluetooth
group bluetooth net_bt_admin
disabled
service hfag /system/bin/sdptool add --channel=10 HFAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
service hsag /system/bin/sdptool add --channel=11 HSAG
user bluetooth
group bluetooth net_bt_admin
disabled
oneshot
*Found something 01:48pm CST 7/17/09*
I was looking through init.trout.rc and noticed the following lines
Code:
chown bluetooth bluetooth /sys/devices/platform/msm_serial_hs.0/serial_lock_cpu
chmod 0660 /sys/devices/platform/msm_serial_hs.0/serial_lock_cpu
This may not seem like much but this node does not actually exist in our builds. It's possible, and probably likely, that HTC modified their kernel to support the changes that were made in the bts (btips) daemon.
We all are pretty much not using the HTC kernel, we're using custom compiled kernels from JAC or Cyanogen. I tried using the RUU kernel but couldn't boot at all. Is anyone able to get their phone booting off the RUU kernel and NOT one of the custom kernels that are floating around in these ROMs? If so, can you check if this device node exists?
I believe booting off that kernel could be the answer to the UART clock issues I'm getting and missing devices in /sys .
NEXT
I have been toying around with the following value in init.rc that seems to affect whether or not I get an error.
Code:
/proc/sys/net/unix/max_dgram_qlen
The default is 10, the RUU release of Hero sets it to 999. If I change that to 10000 then it pauses the BT services and just sits there. If I revert to default I get the same error that I see when its set to 999. Wondering if there's a happy medium in queue length (qlen). Just me thinking out loud.
*Latest progress 11:43pm CST 7/15/09*
I wanted to post some newer results I've been having with BT debugging on Hero. I found out how to circumvent the UART disable error. This is done by having the service btips statement in init.rc to look as follows
Code:
service btips /system/bin/bts
socket bluetooth stream 666 bluetooth bluetooth
socket dbus_bluetooth stream 666 bluetooth bluetooth
group bluetooth net_bt_admin root misc
disabled
oneshot
The most important part is "oneshot" which tells Android to NOT restart the btips service after it dies. If you leave this off then it will relaunch btips service and tie up the I2C bus.
The newest error I'm getting is the inability to launch HCI. This is hopefully the LAST error before I can get BT functional! Anyways, just wanted to update everyone that I have not stopped working on bluetooth.
Code:
1247718990.888806 BTSTACK(778) INFO | UATRAN: HCI Command was not acknowledged with an event
[ vendor/ti/btips-linux/B_TIPS/btstack/hcitrans/uart/uarttran.c:298 ]
1247718990.889935 BTSTACK(778) INFO | HCI: HCI_Process detected transport failure
[ vendor/ti/btips-linux/B_TIPS/btstack/stack/hci/hci_proc.c:1596 ]
1247718990.890179 BTSTACK(778) INFO | RADIOMGR: RmgrHciCallback: 0x6
[ vendor/ti/btips-linux/B_TIPS/btstack/stack/radiomgr.c:364 ]
1247718990.890362 BTSTACK(778) INFO | RADIOMGR: HCI init failed (retrying)
[ vendor/ti/btips-linux/B_TIPS/btstack/stack/radiomgr.c:386 ]
1247718990.890484 BTSTACK(778) INFO | RADIOMGR: HCI init error
[ vendor/ti/btips-linux/B_TIPS/btstack/stack/radiomgr.c:335 ]
1247718990.890637 BTSTACK(778) INFO | ME: HCI Init complete status: 22
[ vendor/ti/btips-linux/B_TIPS/btstack/stack/me/me.c:1220 ]
1247718990.890789 BTSTACK(778) INFO | CMGR: Received event HCI_INIT_ERROR
[ vendor/ti/btips-linux/B_TIPS/btstack/profiles/common/conmgr.c:591 ]
1247718990.890942 BTSTACK(778) INFO | Dbus | inside _BTBUS_COMMON_BTL_callback with event: 6 0[ vendor/ti/btips-linux/EBTIPS/apps/btbus_wrap_common.c:62 ]
1247718990.893536 BTSTACK(778) INFO | sending dbus message from BTBUS_COMMON_BTL_callback in {vendor/ti/btips-linux/EBTIPS/apps/btbus_wrap_common.c:84}[ vendor/ti/btips-linux/EBTIPS/apps/btbus_wrap_utils.c:189 ]
1247718990.898022 BTSTACK(778) INFO | Dbus | _BTBUS_COMMON_BTL_callback signal sent: 6 0[ vendor/ti/btips-linux/EBTIPS/apps/btbus_wrap_common.c:87 ]
1247718990.898358 BTSTACK(778) FATAL | HCI Init Status Received while neither FM nor BT On in progress[ vendor/ti/btips-linux/EBTIPS/btl/ti_chip_mngr/ti_chip_mngr.c:1232 ]
1247718990.898541 BTSTACK(778) Assert | 0[ vendor/ti/btips-linux/EBTIPS/btl/ti_chip_mngr/ti_chip_mngr.c:1232 ]
1247718990.899121 BTSTACK(778) FATAL | signal 11 sent to our program from address 0xdeadbaad and code 1[ vendor/ti/btips-linux/EBTIPS/apps/btt_task.c:102 ]
I'll update this main post as I, or others, come up with progress or advancements.
The directories for this are already created in the latest Hero init.rc . Just need to create the ddb file
Code:
touch /data/btips/TI/BtDeviceDb.ddb
chmod 666 /data/btips/TI/BtDeviceDb.ddb
The results of making these changes is you are able to get ALL bluetooth services and sockets created. Bluetooth is working from the commandline, just not on the frontend where we need it.
Going to go ahead and bump this up there
Yeah, I posted in the other thread that I had talked to Haykuro about this. He told me that he got this working 100% without adding any other files; he just used the ones already in the Hero build.
He hasn't been responding to me recently, so I can't get any more info, but when he does, I'll ask him what else we need to do to eliminate the few errors that we are getting.
amgupt01 said:
Yeah, I posted in the other thread that I had talked to Haykuro about this. He told me that he got this working 100% without adding any other files; he just used the ones already in the Hero build.
He hasn't been responding to me recently, so I can't get any more info, but when he does, I'll ask him what else we need to do to eliminate the few errors that we are getting.
Click to expand...
Click to collapse
Hmmm no other files huh, well that helps me keep my focus on what is already in the build then. Thanks, I'll keep hammering at this. I wonder why if Haykuro got bluetooth working, he didn't release Hero with the fix? Strange.
Yeah, he told me that he had Hero 2.0 (yeah, it exists along with Rosie 2.0) working 100%, but he had better Android things to do... I wonder what else Haykuro was working on (before his hard drive got wiped)
amgupt01 said:
Yeah, he told me that he had Hero 2.0 (yeah, it exists along with Rosie 2.0) working 100%, but he had better Android things to do... I wonder what else Haykuro was working on (before his hard drive got wiped)
Click to expand...
Click to collapse
Hero/Rosie 2.0 is most likely the GOLD/Production version of the Hero software whereas we have the alpha/beta version. Would be really nice to get my hands on the production version.....
Doubt he's going to ever give it to anyone.
MUST HAVE ROSIE 2.0 hahaha
i wonder where he got it from ...
maybe if we bribe him with a new phone he'lll share?
If the idiots who tricked him hadn't and people were more respecting and patient, i'll put my $0.02 in that we would have rosie 2.0 by now.
alritewhadeva said:
If the idiots who tricked him hadn't and people were more respecting and patient, i'll put my $0.02 in that we would have rosie 2.0 by now.
Click to expand...
Click to collapse
I wasnt following these forums too closely when all that happened... sorry to get off topic shafty.. just curious what happened someone pm me with the downlow? ... any way back to shafty ... gettin bt enabled "D
Made some more progress, check the main thread guys
amgupt01 said:
Yeah, he told me that he had Hero 2.0 (yeah, it exists along with Rosie 2.0) working 100%, but he had better Android things to do... I wonder what else Haykuro was working on (before his hard drive got wiped)
Click to expand...
Click to collapse
theres always ways to get info off a wiped drive, im sure he was boasting or trying to find a way to get people off his case.
as far as ontopic, i dont see why he's being a baby about all of this and should be some help on getting things fixed up. though with him gone we're getting more people giving out a helping hand.
i have a question you guys are trying to use hero bluetooth drivers? if so was'nt that for the hero phone? cant you use the drivers from ion on hero insteAD? I DUNNO NOTHING JUST SAYING
superg05 said:
i have a question you guys are trying to use hero bluetooth drivers? if so was'nt that for the hero phone? cant you use the drivers from ion on hero insteAD? I DUNNO NOTHING JUST SAYING
Click to expand...
Click to collapse
from what amgupt01 said haykuro got it working with out any additional files. so basically what ever is there, is already there, just needs some touch up apparently
dbhatesyou said:
theres always ways to get info off a wiped drive, im sure he was boasting or trying to find a way to get people off his case.
as far as ontopic, i dont see why he's being a baby about all of this and should be some help on getting things fixed up. though with him gone we're getting more people giving out a helping hand.
Click to expand...
Click to collapse
Actually, I asked him if he had it because I saw a post on the place where SuperHero is now found titled "Rosie 2.0 Is a No-Go." He seemed pretty surprised that I knew about it because he had never told anyone about it. But he told me that he had Rosie 2.0 working 100% including BT and he had gotten LED and BT on the version of Hero he released, as well. He was just pissed that people leaked his stuff so he didn't release it.
He had a bunch of stuff backed up apprently, so if he every feels like responding to me, I'm sure he could tell us what we're missing...
superg05 said:
i have a question you guys are trying to use hero bluetooth drivers? if so was'nt that for the hero phone? cant you use the drivers from ion on hero insteAD? I DUNNO NOTHING JUST SAYING
Click to expand...
Click to collapse
The bluetooth driver is located in /etc/firmware and it is the EXACT same file that is on the cupcake/ion build. You can verify by doing an md5sum on the file in the hero build and the one on the cupcake build and the sums will match up. So it looks like HTC just renamed the driver. I also looked into it further and both the HTC Hero and HTC Dream (G1) are using texas instruments chips and the /system/bin/bts daemon has support for both.
amgupt01 said:
Actually, I asked him if he had it because I saw a post on the place where SuperHero is now found titled "Rosie 2.0 Is a No-Go." He seemed pretty surprised that I knew about it because he had never told anyone about it. But he told me that he had Rosie 2.0 working 100% including BT and he had gotten LED and BT on the version of Hero he released, as well. He was just pissed that people leaked his stuff so he didn't release it.
He had a bunch of stuff backed up apprently, so if he every feels like responding to me, I'm sure he could tell us what we're missing...
Click to expand...
Click to collapse
The easiest thing would be to get one of the BLUEZ developers to lend a hand. They are the ones tasked with working on bluetooth for linux and obviously are doing that for free so they'd probably be nice enough to figure out what modules aren't being loaded. Anyone up for shooting them some emails?
mind giving me the emails?
alritewhadeva said:
mind giving me the emails?
Click to expand...
Click to collapse
http://www.bluez.org/development/lists/
Got BT working!
I got BT working this eve! Ok, more details are required. I really only got BT working from the linux perspective. Using tools that are built into the ADP phones that I transfered over to my G1/Hero I was able to enable BT, scan, and pair with my headset.
1) Push bttest and hcitool to the phone. I put them /data/local/tmp
2) ./bttest enable - you get a RC of 0. Also, watch logcat and you will see hciattach and hcid starting up successfully.
3) ./hcitool dev - will show you the mac address for your hardware
4) ./hcitool scan - will scan for bt devices
5) ./hcitool cc - will connect to the device that you specify.
The good news is that this shows that BT works from the driver/kernel/modules/hardware perspective. Now we just need to close the loop with the upper layers.

system call -> SOFTAP on -> infrastructure mode

Hello,
Has anyone taken a look at the bcm4329's kernel module? I've been looking around and trying to figure out how the Sprint Hotspot application works and I've found it calls the SIOCSIWPRIV system call on the interface to bring up this mode.
Does anyone have any experience on this matter? I'm looking to get infrastructure mode working.
My current approach is to write a native C app, do the ioctl with some sort of struct (I'm tempted just to memalloc and hand-write the first one), and see what happens.
The driver throws a bunch of debug info into the kernel log when you invoke the command so its dead easy to spot.
Any suggestions?
andrew500 said:
Hello,
Has anyone taken a look at the bcm4329's kernel module? I've been looking around and trying to figure out how the Sprint Hotspot application works and I've found it calls the SIOCSIWPRIV system call on the interface to bring up this mode.
Does anyone have any experience on this matter? I'm looking to get infrastructure mode working.
My current approach is to write a native C app, do the ioctl with some sort of struct (I'm tempted just to memalloc and hand-write the first one), and see what happens.
The driver throws a bunch of debug info into the kernel log when you invoke the command so its dead easy to spot.
Any suggestions?
Click to expand...
Click to collapse
im definitely not up to speed on this but if you wanna post some links to the source files you're referencing, it might help me and anybody else who is interested to get up to speed quicker and provide suggestions.
appreciate your work on troubleshooting and experimenting with wifi tether!
joeykrim,
I'm knee deep in it right now. I'm taking the source code to iwconfig and using it as a template to implement the system calls I need, using a hybrid of the structs in wireless.h and in the bcm4329 driver source, from the bravo kernel. Basically I create a big struct in memory and pass it into the driver using a pointer to a iw_point struct, which holds my big master struct, and then the driver copies it out of user-space into kernel space and acts upon it.
I'll put together all the details once they are a little more solid.
It looks like infrastructure-mode on the EVO is a very distinct possibility, this code will also translate into the workaround for built-in tether on Froyo, from what I've seen they are exclusively using this broadcom interface so far.
It's a hardware specific hack, but many of the phones that have come out lately are using the bcm4329 (and with good reason, chip has freakin everything).

[Q] Android JNI problem. Bad build tools?

Hello, XDA. This is my first post.
Before I start out looking like I'm helpless, and keeping with the mindset that I don't expect something for nothing, I've spent the time to write up newbie-friendly guides:
(edit: Apparently, I have to make eight posts before I can post external links) I will probably accumulate eight posts in this thread, and will edit this at that point.)
Adding OpenVPN and liblzo to the AOSP source tree and compiling a kernel to support it. Includes instructions for patching OpenSSL1.0.0a to enable engine support.
Wrangling with USB permissions
Making a custom boot animation from an animated gif
If it would be better to have the content located on the forum somewhere, tell me where it ought to go.
My problem:
I am trying to roll my own ROM from AOSP (Gingerbread 2.3.4). I have been successfully building images and even kernels for the Nexus S for several weeks now. Recently, I broke something.
I've beat my head against this for three days now. I think I read the entire internet before posting here. I think there is a problem with my build tools, but I don't know where I should be looking for it, or how to test it. The problem is not in the AOSP source tree. I know this because I checked out a clean copy of it, followed Google's instructions, and I get the same result. I get the same result in both the emulator, and on the Nexus S.
When I launch the browser, this is the output from logcat:
(edit: Wow... the parser that tells me I can't post URLs is so aggressive, that I can't paste my logcat output either... I have base64 encoded it instead.)
Code:
SS9BY3Rpdml0eU1hbmFnZXIoICAgNjYpOiBTdGFydCBwcm9jIGNvbS5hbmRyb2lkLmJyb3dzZXIg
Zm9yIGFjdGl2aXR5IGNvbS5hbmRyb2lkLmJyb3dzZXIvLkJyb3dzZXJBY3Rpdml0eTogcGlkPTM1
NyB1aWQ9MTAwMjEgZ2lkcz17MzAwMywgMTAxNX0NCkkvQWN0aXZpdHlUaHJlYWQoICAzNTcpOiBQ
dWIgYnJvd3NlcjogY29tLmFuZHJvaWQuYnJvd3Nlci5Ccm93c2VyUHJvdmlkZXINCkkvQnJvd3Nl
clNldHRpbmdzKCAgMzU3KTogU2VsZWN0ZWQgc2VhcmNoIGVuZ2luZTogQWN0aXZpdHlTZWFyY2hF
bmdpbmV7YW5kcm9pZC5hcHAuU2VhcmNoYWJsZUluZm9ANDA1OTU4Yzh9DQpEL2RhbHZpa3ZtKCAg
MzU3KTogR0NfQ09OQ1VSUkVOVCBmcmVlZCA0NTZLLCA1MSUgZnJlZSAyOTE0Sy81ODMxSywgZXh0
ZXJuYWwgOTM0Sy8xMDM4SywgcGF1c2VkIDVtcyszbXMNClcvZGFsdmlrdm0oICAzNTcpOiBObyBp
bXBsZW1lbnRhdGlvbiBmb3VuZCBmb3IgbmF0aXZlIExhbmRyb2lkL3dlYmtpdC9KV2ViQ29yZUph
dmFCcmlkZ2U7Lm5hdGl2ZUNvbnN0cnVjdG9yICgpVg0KVy9kYWx2aWt2bSggIDM1Nyk6IHRocmVh
ZGlkPTExOiB0aHJlYWQgZXhpdGluZyB3aXRoIHVuY2F1Z2h0IGV4Y2VwdGlvbiAoZ3JvdXA9MHg0
MDAxNTU2MCkNCkUvQW5kcm9pZFJ1bnRpbWUoICAzNTcpOiBGQVRBTCBFWENFUFRJT046IFdlYlZp
ZXdDb3JlVGhyZWFkDQpFL0FuZHJvaWRSdW50aW1lKCAgMzU3KTogamF2YS5sYW5nLlVuc2F0aXNm
aWVkTGlua0Vycm9yOiBuYXRpdmVDb25zdHJ1Y3Rvcg0KRS9BbmRyb2lkUnVudGltZSggIDM1Nyk6
IAlhdCBhbmRyb2lkLndlYmtpdC5KV2ViQ29yZUphdmFCcmlkZ2UubmF0aXZlQ29uc3RydWN0b3Io
TmF0aXZlIE1ldGhvZCkNCkUvQW5kcm9pZFJ1bnRpbWUoICAzNTcpOiAJYXQgYW5kcm9pZC53ZWJr
aXQuSldlYkNvcmVKYXZhQnJpZGdlLjxpbml0PihKV2ViQ29yZUphdmFCcmlkZ2UuamF2YTo2MCkN
CkUvQW5kcm9pZFJ1bnRpbWUoICAzNTcpOiAJYXQgYW5kcm9pZC53ZWJraXQuQnJvd3NlckZyYW1l
Ljxpbml0PihCcm93c2VyRnJhbWUuamF2YToxOTIpDQpFL0FuZHJvaWRSdW50aW1lKCAgMzU3KTog
CWF0IGFuZHJvaWQud2Via2l0LldlYlZpZXdDb3JlLmluaXRpYWxpemUoV2ViVmlld0NvcmUuamF2
YToxOTApDQpFL0FuZHJvaWRSdW50aW1lKCAgMzU3KTogCWF0IGFuZHJvaWQud2Via2l0LldlYlZp
ZXdDb3JlLmFjY2VzcyQ1MDAoV2ViVmlld0NvcmUuamF2YTo1MykNCkUvQW5kcm9pZFJ1bnRpbWUo
ICAzNTcpOiAJYXQgYW5kcm9pZC53ZWJraXQuV2ViVmlld0NvcmUkV2ViQ29yZVRocmVhZCQxLmhh
bmRsZU1lc3NhZ2UoV2ViVmlld0NvcmUuamF2YTo2MTQpDQpFL0FuZHJvaWRSdW50aW1lKCAgMzU3
KTogCWF0IGFuZHJvaWQub3MuSGFuZGxlci5kaXNwYXRjaE1lc3NhZ2UoSGFuZGxlci5qYXZhOjk5
KQ0KRS9BbmRyb2lkUnVudGltZSggIDM1Nyk6IAlhdCBhbmRyb2lkLm9zLkxvb3Blci5sb29wKExv
b3Blci5qYXZhOjEzMCkNCkUvQW5kcm9pZFJ1bnRpbWUoICAzNTcpOiAJYXQgYW5kcm9pZC53ZWJr
aXQuV2ViVmlld0NvcmUkV2ViQ29yZVRocmVhZC5ydW4oV2ViVmlld0NvcmUuamF2YTo2MzMpDQpF
L0FuZHJvaWRSdW50aW1lKCAgMzU3KTogCWF0IGphdmEubGFuZy5UaHJlYWQucnVuKFRocmVhZC5q
YXZhOjEwMTkpDQpXL0FjdGl2aXR5TWFuYWdlciggICA2Nik6ICAgRm9yY2UgZmluaXNoaW5nIGFj
dGl2aXR5IGNvbS5hbmRyb2lkLmJyb3dzZXIvLkJyb3dzZXJBY3Rpdml0eQ0KVy9kYWx2aWt2bSgg
IDM1Nyk6IE5vIGltcGxlbWVudGF0aW9uIGZvdW5kIGZvciBuYXRpdmUgTGFuZHJvaWQvd2Via2l0
L1dlYlZpZXc7Lm5hdGl2ZU1vdmVHZW5lcmF0aW9uICgpSQ0KRC9BbmRyb2lkUnVudGltZSggIDM1
Nyk6IFNodXR0aW5nIGRvd24gVk0NClcvZGFsdmlrdm0oICAzNTcpOiB0aHJlYWRpZD0xOiB0aHJl
YWQgZXhpdGluZyB3aXRoIHVuY2F1Z2h0IGV4Y2VwdGlvbiAoZ3JvdXA9MHg0MDAxNTU2MCkNCkkv
UHJvY2VzcyAoICAzNTcpOiBTZW5kaW5nIHNpZ25hbC4gUElEOiAzNTcgU0lHOiA5
At first, I thought maybe it was some setting specific to the browser. But then I tried another application that also calls native libraries (CSIPSimple). Whenever CSIP tries to load native libraries, I see something like this:
Code:
RC9kYWx2aWt2bSggIDQyOCk6IFRyeWluZyB0byBsb2FkIGxpYiAvZGF0YS9kYXRhL2NvbS5jc2lw
c2ltcGxlL2xpYi9saWJwanNpcGpuaS5zbyAweDQwNTEzNDg4DQpFL1BqU2VydmljZSggIDQyOCk6
IFdlIGhhdmUgYSBwcm9ibGVtIHdpdGggdGhlIGN1cnJlbnQgc3RhY2suLi4uIE5PVCBZRVQgSW1w
bGVtZW50ZWQNCkUvUGpTZXJ2aWNlKCAgNDI4KTogamF2YS5sYW5nLlVuc2F0aXNmaWVkTGlua0Vy
cm9yOiBDYW5ub3QgbG9hZCBsaWJyYXJ5OiByZWxvY19saWJyYXJ5WzEzMTVdOiAgICAzMiBjYW5u
b3QgbG9jYXRlICdfX2Rzb19oYW5kbGUnLi4uDQpFL1BqU2VydmljZSggIDQyOCk6IA0KRS9QalNl
cnZpY2UoICA0MjgpOiAJYXQgamF2YS5sYW5nLlJ1bnRpbWUubG9hZChSdW50aW1lLmphdmE6Mzk0
KQ0KRS9QalNlcnZpY2UoICA0MjgpOiAJYXQgamF2YS5sYW5nLlN5c3RlbS5sb2FkKFN5c3RlbS5q
YXZhOjUzNCkNCkUvUGpTZXJ2aWNlKCAgNDI4KTogCWF0IGNvbS5jc2lwc2ltcGxlLnBqc2lwLlBq
U2lwU2VydmljZS50cnlUb0xvYWRTdGFjayhQalNpcFNlcnZpY2UuamF2YToxMTkpDQpFL1BqU2Vy
dmljZSggIDQyOCk6IAlhdCBjb20uY3NpcHNpbXBsZS5zZXJ2aWNlLlNpcFNlcnZpY2UubG9hZFN0
YWNrKFNpcFNlcnZpY2UuamF2YTo5MTMpDQpFL1BqU2VydmljZSggIDQyOCk6IAlhdCBjb20uY3Np
cHNpbXBsZS5zZXJ2aWNlLlNpcFNlcnZpY2Uub25TdGFydChTaXBTZXJ2aWNlLmphdmE6ODczKQ0K
RS9QalNlcnZpY2UoICA0MjgpOiAJYXQgYW5kcm9pZC5hcHAuU2VydmljZS5vblN0YXJ0Q29tbWFu
ZChTZXJ2aWNlLmphdmE6NDI4KQ0KRS9QalNlcnZpY2UoICA0MjgpOiAJYXQgYW5kcm9pZC5hcHAu
QWN0aXZpdHlUaHJlYWQuaGFuZGxlU2VydmljZUFyZ3MoQWN0aXZpdHlUaHJlYWQuamF2YToyMDM5
KQ0KRS9QalNlcnZpY2UoICA0MjgpOiAJYXQgYW5kcm9pZC5hcHAuQWN0aXZpdHlUaHJlYWQuYWNj
ZXNzJDI4MDAoQWN0aXZpdHlUaHJlYWQuamF2YToxMTcpDQpFL1BqU2VydmljZSggIDQyOCk6IAlh
dCBhbmRyb2lkLmFwcC5BY3Rpdml0eVRocmVhZCRILmhhbmRsZU1lc3NhZ2UoQWN0aXZpdHlUaHJl
YWQuamF2YTo5OTQpDQpFL1BqU2VydmljZSggIDQyOCk6IAlhdCBhbmRyb2lkLm9zLkhhbmRsZXIu
ZGlzcGF0Y2hNZXNzYWdlKEhhbmRsZXIuamF2YTo5OSkNCkUvUGpTZXJ2aWNlKCAgNDI4KTogCWF0
IGFuZHJvaWQub3MuTG9vcGVyLmxvb3AoTG9vcGVyLmphdmE6MTMwKQ0KRS9QalNlcnZpY2UoICA0
MjgpOiAJYXQgYW5kcm9pZC5hcHAuQWN0aXZpdHlUaHJlYWQubWFpbihBY3Rpdml0eVRocmVhZC5q
YXZhOjM2ODMpDQpFL1BqU2VydmljZSggIDQyOCk6IAlhdCBqYXZhLmxhbmcucmVmbGVjdC5NZXRo
b2QuaW52b2tlTmF0aXZlKE5hdGl2ZSBNZXRob2QpDQpFL1BqU2VydmljZSggIDQyOCk6IAlhdCBq
YXZhLmxhbmcucmVmbGVjdC5NZXRob2QuaW52b2tlKE1ldGhvZC5qYXZhOjUwNykNCkUvUGpTZXJ2
aWNlKCAgNDI4KTogCWF0IGNvbS5hbmRyb2lkLmludGVybmFsLm9zLlp5Z290ZUluaXQkTWV0aG9k
QW5kQXJnc0NhbGxlci5ydW4oWnlnb3RlSW5pdC5qYXZhOjgzOSkNCkUvUGpTZXJ2aWNlKCAgNDI4
KTogCWF0IGNvbS5hbmRyb2lkLmludGVybmFsLm9zLlp5Z290ZUluaXQubWFpbihaeWdvdGVJbml0
LmphdmE6NTk3KQ0KRS9QalNlcnZpY2UoICA0MjgpOiAJYXQgZGFsdmlrLnN5c3RlbS5OYXRpdmVT
dGFydC5tYWluKE5hdGl2ZSBNZXRob2Qp
Are there any veteran android devs that can point me in the correct general direction? I don't need to have my hand held, but having never written any app more complex than HelloWorld, I'm not sure where to begin debugging.
edit: As long as I'm thwarting the parser with Base64, here are the external links I am not supposed to be able to post. I hope it helps someone. Figuring all that out was a lot of work.
Code:
W0xJU1RdDQpbKl1bVVJMPSJodHRwOi8vd3d3Lmpvc2hpYW5saW5kc2F5LmNvbS9pbmRleC5waHA/
aWQ9MTEzIl1BZGRpbmcgT3BlblZQTiBhbmQgbGlibHpvIHRvIHRoZSBBT1NQIHNvdXJjZSB0cmVl
IGFuZCBjb21waWxpbmcgYSBrZXJuZWwgdG8gc3VwcG9ydCBpdC4gSW5jbHVkZXMgaW5zdHJ1Y3Rp
b25zIGZvciBwYXRjaGluZyBPcGVuU1NMMS4wLjBhIHRvIGVuYWJsZSBlbmdpbmUgc3VwcG9ydC5b
L1VSTF0NClsqXVtVUkw9Imh0dHA6Ly93d3cuam9zaGlhbmxpbmRzYXkuY29tL2luZGV4LnBocD9p
ZD0xMTIiXVdyYW5nbGluZyB3aXRoIFVTQiBwZXJtaXNzaW9uc1svVVJMXQ0KWypdW1VSTD0iaHR0
cDovL3d3dy5qb3NoaWFubGluZHNheS5jb20vaW5kZXgucGhwP2lkPTExMSJdTWFraW5nIGEgY3Vz
dG9tIGJvb3QgYW5pbWF0aW9uIGZyb20gYW4gYW5pbWF0ZWQgZ2lmWy9VUkxdDQpbL0xJU1Rd
Thanks in advance for any help you are willing to give.

[Q] Some information about sec.ko ???

Hi kernel hackers,
it is getting very silent recently about possible security hacks on the Milestone platform.
Today i stumbled over some kernel code located in /drivers/misc/sec.
Maybe this had been discussed already.... anyway
There're some interesting functions in the source code and i wonder which application is using this module to enter the secure world of OMAP.
Some of the functions are accessing registers, that are also involved in low level routines of the bootcode (e.g. mbmloader).
Some questions:
Which application in android userspace is using this module?
Could we tweak this module to get access to some of the protected OMAP registers?
Is it a signed module?
Would be nice to use a modified module and activate some of the blocked features (e.g. DAP controller for debugging).
Any comments welcome!!!
Regards,
scholbert
scholbert said:
Hi kernel hackers,
it is getting very silent recently about possible security hacks on the Milestone platform.
Today i stumbled over some kernel code located in /drivers/misc/sec.
Maybe this had been discussed already.... anyway
There're some interesting functions in the source code and i wonder which application is using this module to enter the secure world of OMAP.
Some of the functions are accessing registers, that are also involved in low level routines of the bootcode (e.g. mbmloader).
Some questions:
Which application in android userspace is using this module?
Could we tweak this module to get access to some of the protected OMAP registers?
Is it a signed module?
Would be nice to use a modified module and activate some of the blocked features (e.g. DAP controller for debugging).
Any comments welcome!!!
Regards,
scholbert
Click to expand...
Click to collapse
Well, I'm not a kernel hacker, but I have an educated guess...
I believe that the radio system uses those functions to check whether the kernel is valid or not, so, we have the radio not working with a replacement kernel that is loaded using kexec...
Perhaps, if it is possible to "change" this function using a module, we could get a function always telling the kernel is valid and have kexec working on Milestone. Again, I'm not a kernel hacker, but that is my guess.
Hi, I'm sorry that I wont be much help but these guys might;
https://www.droid-developers.org/
irc://irc.freenode.net/#milestone-modding
Hi,
thanks for your comments so far.
To be more precisely i think this kernel driver is calling the secure monitor in some way. See here:
https://www.droid-developers.org/wiki/Secure_Monitor
There's also a structure defined in that driver. I think i'll have to compare some of the ioctl entries.
https://www.droid-developers.org/wiki/Secure_Services
I'll do some investigation on this issue and search the web for some userland source code using this driver.
Again, if someone knows more about it, your welcome
Cheers,
scholbert
scholbert said:
Hi,
thanks for your comments so far.
To be more precisely i think this kernel driver is calling the secure monitor in some way. See here:
https://www.droid-developers.org/wiki/Secure_Monitor
There's also a structure defined in that driver. I think i'll have to compare some of the ioctl entries.
https://www.droid-developers.org/wiki/Secure_Services
I'll do some investigation on this issue and search the web for some userland source code using this driver.
Again, if someone knows more about it, your welcome
Cheers,
scholbert
Click to expand...
Click to collapse
you don't have to search for the source, it's on SourceForge:
http://sourceforge.net/projects/milestone.motorola/files/
SophT said:
you don't have to search for the source, it's on SourceForge:
http://sourceforge.net/projects/milestone.motorola/files/
Click to expand...
Click to collapse
Yeah sure, i knew this
Anyway, thanks for the hyperlink!
In the meantime i grepped all binaries from the latest distribution.
I found out, that two applications are using /dev/sec.
1. dbvc_atvc_property_set
2. tcmd
If someone knows which package of source code they belong to... would save some time searching.
EDIT:
O.K. Google did it for me...
Seems that both binaries are proprietary code. Some early conclusions:
1. dbvc_atvc_property_set
This one is started as a service in init.mapphone_umts.rc and seems to use /dev/sec for granting rights to access OMAP secure world (e.g. read eFuse values for unique device id, IMEI etc.).
This binary contains a certificate which is not Milestone specific (XT720 uses the same).
So right now i don't know, if this certificate is needed to access /dev/sec or the application itself identifies itself as trusted application (signed app).
Would make sense, if the BP uses signed applications to access certain low level functions, e.g. read/write the eFuse bank.
2. tcmd
This one is also started as a service in init.mapphone_umts.rc to access a variety of devices. Seems to be related to data streaming or stuff.
As stated it has an entry for /dev/sec and it got no certifcate.
Would be interesting to get some more info about that.
Further comments....
P.S.: This bloody security stuff is making me sick
Regards,
scholbert
Hi again,
i just compared some of the defines in the kernel driver headers (/drivers/misc/sec/sec_core.h) with the ones xvilka reversed inside mbmloader.
Code:
...
#define API_HAL_KM_SOFTWAREREVISION_READ 33 // 0x21
...
#define API_HAL_NB_MAX_SVC 39 // 0x27
#define API_HAL_MOT_EFUSE (API_HAL_NB_MAX_SVC + 10) // 0x31
#define API_HAL_MOT_EFUSE_READ (API_HAL_NB_MAX_SVC + 15) // 0x36
...
For comparison see the table here:
https://www.droid-developers.org/wiki/Secure_Services
It is obvious that /dev/sec allows to access OMAP secure world and uses the above mentioned API calls to push information to userspace apps.
The question would be, if ioctl must be certified through the API using some key ...
O.K. i see this is deep down code creeping, but maybe someone understands what i try to work out
See ya,
scholbert
scholbert said:
O.K. i see this is deep down code creeping, but maybe someone understands what i try to work out
Click to expand...
Click to collapse
I think I know what you are trying to work out, but I can't think of any way to help
You're pretty much comparing the results of your findings with that of the mbmloader dump right?
I would like so much to fully understand what you are doing, but I can understand just a little..
btw I hope that you'll be glad to know that you have all my psychological support!
mystichobo said:
I think I know what you are trying to work out, but I can't think of any way to help
You're pretty much comparing the results of your findings with that of the mbmloader dump right?
Click to expand...
Click to collapse
Yeah, kind of... we know for sure there's an API to access security functions on OMAP. I just digged out some parallels in kernel code and mbmloader.
If we could make use of security functions from within kernel space (by using a tweaked module) this would be a nice playground.
Perhaps, there's any bug or backdoor we could shamelessly exploit to:
a. boot custom kernel with second boot
b. tweak the security system and enable some hidden functions inside OMAP
puffo81 said:
I would like so much to fully understand what you are doing, but I can understand just a little..
btw I hope that you'll be glad to know that you have all my psychological support!
Click to expand...
Click to collapse
Thanks a lot for pointing out
Best regards,
scholbert
scholbert said:
Yeah, kind of... we know for sure there's an API to access security functions on OMAP. I just digged out some parallels in kernel code and mbmloader.
If we could make use of security functions from within kernel space (by using a tweaked module) this would be a nice playground.
Perhaps, there's any bug or backdoor we could shamelessly exploit to:
a. boot custom kernel with second boot
b. tweak the security system and enable some hidden functions inside OMAP
Click to expand...
Click to collapse
That's what I thought
Surprised noone has looked into it earlier really
Anyway good luck with it, adding my moral support too.
Cheers,
hobo
mystichobo said:
Surprised noone has looked into it earlier really
Anyway good luck with it, adding my moral support too.
Click to expand...
Click to collapse
I got into contact with xvilka.
Obviously there'd been some investigations concerning this issue.
To be honest, i don't know if it's worth to digg a little deeper or if it will ever led to something useful in the end. Could be fun though
Perhaps it would be nice idea to tweak the driver and put some debug message in the code.
Another interesting thing to do would be a logging function.
This way it would be possible to get some insights of the API to secure monitor.
Anyway, i think it's never useless to discuss about some hacking here. At least were at xda-developers
If you like to tweak some kernel code, join in!!!
Have fun!
scholbert

Wayland server for Android

ABANDONED
Hi! Does anyone here use Linux desktop distributions in chroot environment on Android device?
I am developing wayland protocol server for Android devices. If anyone is interested in checking my project, latest version of apk is always available here:
ftp://ftp.drivehq.com/mogryph/sparkle/
Currently I am only focused on running Xwayland as client. Also apk supports audio output.
Simplest instruction:
1. Android 6 or newer required, busybox required, root required
2. Prepare linux distribution in directory, image or on partition. Make sure you have Xwayland installed in it. Make sure you specify which DE to run (or at least xterm) in ~/.xinitrc
3. Install and start sparkle.apk
4. Press "edit user.sh", uncomment (remove #) line starting with start_generic_container. Change rest of this line to match your device:
first arg - image or partition where distribution is installed. If distribution is installed in directory and mouting is not needed, leave this arg unchanged.
second arg - mount point or directory with distribution. If you use mounting (first arg), this arg can be left unchanged.
third arg - name of the user which will be used to start Xwayland and DE. Its better to specify non-root. Also this is the user who must have .xinitrc in his home dir (see step 2).
5. Save user.sh and click "Start".
6. Any problems and crashes will be reflected in the log.
If you want audio output:
1. Compile and install driver from pcm_sparkle.tar.gz in your distribtion
2. cp 1.asoundrc ~/.asoundrc
If you have blinking problem, change upload_mode from 1 to 2 in settings. If you have bad performance, setting no_damage to true may help, but in most cases no_damage=false is better. Fastest upload mode is 0 (if it works).
If you don't trust me and don't want to give sparkle root permissions (I perfectly understand this) you don't have to. Also you can do without busybox.
But in this case, you need to understand and do a lot of things. Check sparkle's user.sh to get idea about what needs to be done. Basically:
1. You need to make /data/data/com.sion.sparkle/files accessible from inside chroot container. You can use bind bound.
2. Make sure you have tmpfs mounted over /tmp in container.
3. You may need to change selinux context on /tmp to match sparkle's context or disable SELinux.
4. You need to create new directory in /tmp, symlink sparkle's wayland socket from /data/data/com.sion.sparkle/files/wayland-0 to this dir. And export XDG_RUNTIME_DIR to point to this dir. Dir must be (ch)owned by user who will be running Xwayland and DE.
5. After all this, you can try to start Xwayland and your DE.
new version
New version
rgho.st/8Fbz64Rxj
Added x86 and x86_64 support. Actually it is rewritten almost from scratch but x86 support is the only thing others can notice...
Hello! This project is interesting. I tried you app and it works on my Xiaomi Redmi Note 4X(chromium and glmark from chrooted environment works very well)! Can you publish source code on Github, because it really interesting project?
Also I'm interested, please post it on github!
Did you put this up on github or move this thread? Looks very interesting.
1
Argh, sorry, I decided to abandon this project. You are free to delete thread. Also no copyleft-licensed components were used so I don't have to bother releasing sources.
Hentacler said:
Argh, sorry, I decided to abandon this project. You are free to delete thread. Also no copyleft-licensed components were used so I don't have to bother releasing sources.
Click to expand...
Click to collapse
Check your PM please!
1
Hello again.
For last two weeks I was rewriting it from scratch (yes. again... yes, third time).
Probably need another week to make it stable.
Currently I am not sure it runs on any device except my own 5-year old phone (LineageOS 14).
I will maintain last version here:
ftp://ftp.drivehq.com/mogryph/sparkle/
There is no English documentation, but you can see script "user.sh" to get idea about how to start xwayland. In most cases it should be enough to edit few lines in that script to make it work on another device. If you execute this script on your device with "install" argument, it is supposed to place itself into sparkle's directory and sparkle is supposed to run it ("start" function) automatically. Sparkle doesn't request root unless script does.
Here is video of sparkle working:
https://www.youtube.com/watch?v=tOSFYxCF7Q8
But it seems that KDE + video recording was too much for my old phone
Still, if you going to see video, don't close it until 2:00 where I turned of composition which caused lags.
Also on device everything looks much smoother than on video, even after 2:00.
When I watch fullscreen (1280x720) video on my device, sparkle + xwayland together add just 5% of CPU load (20% load of single core).
Thats it I guess... I tried to to discuss sparkle on 4pda.ru (russian forums), but got very bad reception. "xsdl is perfect, dont reinvent the wheel" they say. So I started to hate humanity and I decided to make sparkle personal project. Also this is last time I am solving reCAPTCHA to leave post on XDA.
Still alive
We are still alive. I've changed first post to reflect actual state. Now sparkle supports audio, auto-mouting containers and is lot more stable.
Yet there are still many things I want to improve in sparkle's core before adding new functions.
Also there are few demo videos on ftp.
Amazing!
Working great on my redmi 6 pro. Stock miui 9.9.3 rom. With linuxdeploy and sparkle from your ftp. No lag on visual and sound. My Linux distribution is alpinelinux arm64 arch.
Since first time I see your posting on 4pda. I'm interested in it. And finally it's on xda.
Thanks dev.
---------- Post added at 02:52 AM ---------- Previous post was at 02:44 AM ----------
For anyone interested in the topic. Please follow the instructions in documentation from ftp. And Translate it to eng from rus.
This sounds amazing! Just curious, is it related to https://github.com/twaik/sparkle ?
I now have it working very well on my Samsung Tab S3 using Xwayland and a tiling window manager. Firefox runs amazingly well!
Is it meant to be used only with Xwayland or will it also work with native Wayland applications?
BTW, I think if you open sourced this project and promoted it a bit, it could become quite popular. It's basically the first way to run X11 GUI applications on Android devices at full speed. If you set up a donation link, you could also get compensated for your time and effort. I'll personally contribute $20 if it's open sourced, and I'm sure others will chip in as well.
robsmith11 said:
This sounds amazing! Just curious, is it related to https://github.com/twaik/sparkle ?
Click to expand...
Click to collapse
Thanks for feedback. Nice to hear that someone managed to start this thing
Twaik's repository is clone of my very very old version of sparkle. I made that version years ago when I was just starting to learn linux and C++. Sparkle was rewritten from scratch two or three times since that version. And (I believe) current version is much better.
Regarding making it open source... Few months ago I had to find real job. Can't spend much time on personal projects any more. But I have my own strange programming style and my own vision of what sparkle should be. Not sure I want others to paint on my picture. It's probably all because of Twaik! I hate how he used old open source version of sparkle. He did terrible things to it, outraging all my beliefs Sorry!
P.S.: Yesterday I've uploaded another apk to my ftp. The file is called "sparkle-testing.apk". This version is much newer and has many fixes. But I've also changed to many things since tested version including some fundamental changes. No guarantee it will run at all on other devices. Interest is mega low and I get no test reports at all.
Hi Hentacler, I've just found your project - it looks really promising. Unfortunately, the only link currently working on this thread is to github. Is this project still live?
I have a samsung galaxy note 10+, and am using it as a laptop replacement. In addition to the android apps using Samsung Dex (Samsung's desktop solution), I have several linux distributions installed inside a chroot using userLand - so far, its working great. I'd be keen to give you project a try if it's still live, and am happy to help out with testing from my device.
Re open source - while I like your project, I'm not super interested in investing time into something that's not open sourced - I appreciate your concerns about wanting to maintain the direction, but having transparent development is pretty important to me. Is Twaik's fork of your project a better place to go?
Cheers.
tillum said:
Hi Hentacler, I've just found your project - it looks really promising. Unfortunately, the only link currently working on this thread is to github. Is this project still live?
I have a samsung galaxy note 10+, and am using it as a laptop replacement. In addition to the android apps using Samsung Dex (Samsung's desktop solution), I have several linux distributions installed inside a chroot using userLand - so far, its working great. I'd be keen to give you project a try if it's still live, and am happy to help out with testing from my device.
Re open source - while I like your project, I'm not super interested in investing time into something that's not open sourced - I appreciate your concerns about wanting to maintain the direction, but having transparent development is pretty important to me. Is Twaik's fork of your project a better place to go?
Cheers.
Click to expand...
Click to collapse
ftp://ftp.drivehq.com/mogryph/sparkle/
Link to FTP should work and there you can get two versions:
sparkle.apk - old version, but confirmed to work by 3-4 people.
sparkle-testing.apk - latest version, but only briefly tested by me.
I don't ask anyone to invest anything... Sparkle doesn't request root access or any other dangerous permissions (unless you enable automatic container mounting and starting) so it's safe to try for anyone who wants.
Btw, somewhere between these two versions I've replaced BASH container initialization script with LUA version. That was probably a bad idea. LUA script is harder to start directly as root and hacks I used may not work (currently may even cause application freeze if root access is denied). Going to revert to BASH probably. But this only touches people who want sparkle to mount container and launch everything automatically on single button press.
p.s.: Why I need to solve captcha every time I post something?
Thanks for the new release! I've updated and everything seems to be working without any changes on my Samsung Tab S3 with chroot and Arch Arm Linux.
Your changes also solved the flickering for me! The old version would flicker the screen whenever my keyboard's trackpoint activated, but it's not flickering at all any more. Performance seems to be about the same.
I think this could be quite popular, but not many people know about it. Perhaps a post on Hacker News or Reddit would raise awareness.
I understand your position on open source and maintaining control. One idea if you haven't already considered it is releasing the code with a restrictive license that forbids any forks. But either way, I'm enjoying being to properly use X11 on my tablet.
BTW, have you tried any native Wayland compositors? I don't really understand the Wayland ecosystem that well. I gave Sway a brief try, but it didn't seem to work. I've only been using XWayland.
@Hentacler Thanks for your reply! Very keen to get this working, but having a few issues. I'm unsure how to configure the user.lua file - I'm using your latest apk.
I have a non-rooted device, and am running archlinux under termux. Works fine with xsdl. I have installed xorg-server-wayland for X11. I'd appreciate any advice you have.
@robsmith11 Are you able to share how you got this working on Arch? Thanks!!!!
tillum said:
@Hentacler Thanks for your reply! Very keen to get this working, but having a few issues. I'm unsure how to configure the user.lua file - I'm using your latest apk.
I have a non-rooted device, and am running archlinux under termux. Works fine with xsdl. I have installed xorg-server-wayland for X11. I'd appreciate any advice you have.
@robsmith11 Are you able to share how you got this working on Arch? Thanks!!!!
Click to expand...
Click to collapse
I am not sure it is possible to use sparkle without root...
Sparkle makes it's directory accessible for everyone (chmod 777). Before Android 8 or 9 this was enough and xwayland from termux was able to connect to sparkle. Here is how people used to start it:
export XDG_RUNTIME_DIR=/data/data/com.sion.sparkle/files
Xwayland
But newer versions of Android brought more restrictions and termux can no longer connect to sparkle. These new restrictions are implemented using SELinux if you know what it is. Applications now have different security contexts.
But that is not all. Newest versions of android brought even more terrible meaningless restrictions effectively "killing" applications like termux and many others.
In short, from now one applications are not allowed to execute code (binary) that comes from "untrusted" sources. Termux used to download a lot of such code from it's own repositories. And now it can't. We can't even unpack binaries from assets.
So I can only help with rooted devices.
P.S. Please forgive me, but I am leaving this website. Making people solve recaptcha every time they want to post something is unacceptable level of contempt.
My mail: [email protected]
Thanks for that, will have a play. I could always just root my device. Weird about recaptcha, not having this issue. Currently through termux I have access to the whole sdcard, and am able to download packages (and distros) in it - will have a play and see what else is possible.
@tillum
I basically just followed the instructions on the first post for using Sparkle without busybox. I didn't need to modify the Lua scripts.
I'm guessing SELinux may be a problem without root. I'll try setting it up without root when I have a chance later.

Categories

Resources