Database Info

[dev] real MAC wifi reading

Hi devs, I have idea for MAC reading. First, I know real MAC is located in SPL (I know this becouse I'm tried), I'm tried to read MAC from kernel side but problem is reading SPL becouse board-photon.h have defined:
Code:
#define MSM_MEM1_BASE 0x00000000
#define MSM_LINUX_BASE_OFFSET 0x00200000
#define MSM_PHOTON_LINUX1_BASE (MSM_MEM1_BASE + MSM_LINUX_BASE_OFFSET) /* 2MB alignment */
#define MSM_PHOTON_LINUX1_SIZE (MSM_MEM1_SIZE - MSM_LINUX_BASE_OFFSET)
SPL have size of 0x80000 and we skipped it. My idea is:
- patch haret to copy some SPL addreses (addrese where is wifi nvs ram) to another memory location
- read these location from kernel side
or
- edit kernel code to read this location or edit kernel to copy SPL to an memory location
What you think? Maybe you have idea how to read SPL?

i think there is solutions easier than SPL to get MAC addr

real mac == winMo?

i have an idea, but not tested yet:
simply remove "macaddr=00:11:22:33:44:55\n" from htc_wifi_nvs.c
recompile
it should work now
(my guess is the driver already read the good address, but we overwrite it with bad value)

No, I'm tried without static nvs! Only sense I think is reading these nvs from memory, but if we want to read this we must have access to first 0x80000 bytes (SPL), or maybe adding kernel code (command line parameter), or maybe DEX call (I dont know if is possible)
See picture, you will see where is nvs in spl, also you will see we have defined static_nvs diferent than nvs in spl!

you're totaly right.
and htc_wifi_nvs.c for liberty is extracting the NVS from bootloader.
i think the address we have is wrong:
This is the address for Liberty:
#define ATAG_MSM_WIFI 0x57494649 /* MSM WiFi */
Click to expand...
Click to collapse
For our bootloader, it must be different. i'll investigate.

Is the MAC in startup.txt used by Android?
If that is the case, may it is more easy to write a WinMo app that adjusts the startup.txt with the MAC know by WinMo.
Or is that to easy?

-r0bin- said:
you're totaly right.
and htc_wifi_nvs.c for liberty is extracting the NVS from bootloader.
Click to expand...
Click to collapse
I think is not from bootloader becouse liberty bootloader start at 0x0 and is size < 1M, but ok, good thing is - you understand me, and I thk you for it!
We need to read:
- start at 0x65720
- read 0x239 bute

munjeni said:
I think is not from bootloader becouse liberty bootloader start at 0x0 and is size of 1M, but ok, good thing is - you understand me, and I thk you for it!
We need to read:
- start at 0x65720
- read 0x239 bute
Click to expand...
Click to collapse
thanks, but what address do you dump? (0x65720 is only the offset)
how do you create this memory dump?

I showed you how I do it, but you're not ...attention to my post. I'll tell you, unlike you who is hiding information
see this link how I dump memmory.
Code:
976 // cardsharing smem dump
977 /*int i;
978 int x[1000];
979 printk("Battery hex smem dump: ");
980 for (i=0; i<1000; i++)
981 {
982 x[i] = readl(MSM_SHARED_RAM_BASE + 0xfc000 + i) & 0x000000ff;
983 printk("%02x", x[i]);
984 }
985 printk("\n");*/
Problem is: we not have access to spl!

Maybe from this way:
msm_nand_read: 65720 239
Code:
msm_nand_read(struct mtd_info *mtd, loff_t from, size_t len,
size_t *retlen, u_char *buf)
{
int ret;
struct mtd_oob_ops ops;
/* printk("msm_nand_read %llx %x\n", from, len); */
ops.mode = MTD_OOB_PLACE;
ops.len = len;
ops.retlen = 0;
ops.ooblen = 0;
ops.datbuf = buf;
ops.oobbuf = NULL;
ret = msm_nand_read_oob(mtd, from, &ops);
*retlen = ops.retlen;
return ret;
}
return wifi_nvs;
What you think?

munjeni said:
but if we want to read this we must have access to first 0x80000 bytes (SPL)
Click to expand...
Click to collapse
first 0x80000 bytes of what? memory?
munjeni said:
See picture, you will see where is nvs in spl, also you will see we have defined static_nvs diferent than nvs in spl!
Click to expand...
Click to collapse
how did you generated this picture?
i mean, what address did you used?

yes, of memory
haret: pwf spl.dump 0x0 0x80000
Program used to read spl.dump is: X&D hex editor
Program used to screen capture is: FastStone Capture
From kernel side I'm tried to dump android memory (spl from 0x0 len 0x80000), but without success, I think is not possible in this time, we need modifications to do that!

oook i got it!
physical address = 0x65720
thats sounds easy!
and you cannot dump memory like this under Linux, it uses virtual address!!!

ok, good if is easy! Please report here if you got it and how you got it, I need that knownledge for my future development, ok?

munjeni said:
ok, good if is easy! Please report here if you got it and how you got it, I need that knownledge for my future development, ok?
Click to expand...
Click to collapse
under android, when i use this func: "phys_to_virt(0x65720)" it gives me this virtual address: 0xbfe65720
unfortunately system crash when i try to access it.
there must be another way...

maybe is empty virtual (or we not have permisions to read) becouse we skipped first 0x100000 (board_photon.h) from psychical, hmm I not understand why crashed? I'm also tried and also with crashing. If I'm right MSM_SHARED_RAM_BASE is psychical and other defined in board_photon.h is also psychical?

found by schlund:
https://gitorious.org/linux-on-winc...ter/arch/arm/mach-msm/board-htcleo-wifi-nvs.c
on HTC Leo, they read SMEM and can retrieve MAC addr, it is encrypted by CRC32

good! But maybe we also need to change hardcoded_nvs bassed on picture. Are you got mac from smem after crc decode? I've not tried to read

actually it's not the real MAC addr, its a random one
regarding the real NVS data from hardware:
- either the bootloader memory has a special protection
- either we are using the wrong RAM virtual address
- either we dont have the good access method

Froyo Sense 2.2 nand release

Hey, I sucesfully booted froyo from nand (my sd version release). It booting, initrd is dirty packed (wifi not working - can not load dongle firmware - not understand why... say error) but it booting! Our release is for guys who want to play again with Froyo version! Lk bootloader is also recocfigured and included in attachment (system partition is ~270mb needed for our version) so you need to flash lk first! Touch recovery (fixed and stable now) is also included in archive. Kernel 2.6.35 is from derefas repo with a lot of my changes (patch for kernel is included in archive) including some changes with adsp queues that I can not able to test becouse wifi can not working. If you fix wifi than we will test it! Fill free to give your comment!
froyo.2.2_nand.zip

I love sense version

i love sense, but 2.2 froyo is old. is it possible to port gingerbread 2.3.3 with sense to hd mini?

Thanks! Glad to finally see sense!
Hope you can get rid of the bugs

for 2.2 with 2.6.35 we need to use 204 firmware and bcm4329 driver, or try to use firmware from cm7

munjeni,thanks for uploade froyo.but i cant download from your sites that uploaded.
please uploade from mediafire.thanks

munjeni why you don't use acoustic system for wince by schlund? without this phone reboot when play sound in nand
bt and wifi need to fix initrd

I think I found problem for bluetooth and wifi:
Code:
/system/bin/brcm_patchram_plus
open(/sys/module/board_photon/parameters/bdaddr) failed: No such file or directory
ls:
Code:
ls /sys/module/board_photon
parameters
# ls /sys/module/board_photon/parameters
ls /sys/module/board_photon/parameters
bdaddress
bt_fw_version
bt_chip_id
#
derefas said:
munjeni why you don't use acoustic system for wince by schlund? without this phone reboot when play sound in nand
bt and wifi need to fix initrd
Click to expand...
Click to collapse
I using your kernel. Your kernel have schlund acoustic system?

BT FIX
init.photon.rc
service hciattach /system/bin/brcm_patchram_plus --enable_hci \
--baudrate 3000000 --patchram /etc/firmware/bcm4329.hcd /dev/ttyHS0
user bluetooth
group bluetooth net_bt_admin
disabled
Click to expand...
Click to collapse
to
service btld /system/bin/logwrapper /system/bin/btld -lpm 1 -hb 3000000
user root
group bluetooth net_bt_admin
disabled
oneshot
Click to expand...
Click to collapse
WIFI FIX:
use bcm4329 204 module from 2.6.32

Ok, but what about audio system? Your kernel have ported schlund audio?

use schlund kernel
github.com/schlund
about system side , i ported it, will upload later with wifi,bt fix

Code:
#ifndef CONFIG_SERIAL_MSM_HS_PURE_ANDROID
/* for bcm */
static char bdaddress[20];
extern unsigned char *get_bt_bd_ram(void);
static void bt_export_bd_address(void)
{
unsigned char cTemp[6];
memcpy(cTemp, get_bt_bd_ram(), 6);
sprintf(bdaddress, "%02x:%02x:%02x:%02x:%02x:%02x",
cTemp[0], cTemp[1], cTemp[2], cTemp[3], cTemp[4], cTemp[5]);
printk(KERN_INFO "YoYo--BD_ADDRESS=%s\n", bdaddress);
}
module_param_string(bdaddress, bdaddress, sizeof(bdaddress), S_IWUSR | S_IRUGO);
MODULE_PARM_DESC(bdaddress, "BT MAC ADDRESS");
#endif
What about if I change bdaddress to bdaddr? brcm_patchram_plus need path bdaddr instead of bdaddress!

munjeni did you fix the wifi and call echo problem. and I hope battery drain is fixed. if you say yes I will be load your nand version.

Derefas, I ported old wifi driver but again same problem with "dhdsdio_download_nvram: error reading nvram file: 0", maybe you know why?
Blutooth is fixed!
Problem with audio is located (I comented that line so its reason why audio reboot phone) in board_photon.c: //htc_acoustic_wce_board_data = &htcphoton_acoustic_data; becouse in struct:
Code:
static struct htc_acoustic_wce_board_data htcphoton_acoustic_data = {
.set_headset_amp = photon_headset_amp,
};
photon_headset_amp is not defined corectly!!! Function for photon_headset_amp is defined:
Code:
void photon_headset_amp(int enabled)
{
if (enabled)
{
/* Power up headphone amp */
gpio_configure(PHOTON_GPIO_HEADSET_AMP, GPIOF_DRIVE_OUTPUT | GPIOF_OUTPUT_HIGH);
msleep(30);
gpio_set_value(PHOTON_GPIO_HEADSET_AMP, 1);
} else {
/* Power down headphone amp */
gpio_configure(PHOTON_GPIO_HEADSET_AMP, GPIOF_DRIVE_OUTPUT | GPIOF_OUTPUT_LOW);
msleep(30);
gpio_set_value(PHOTON_GPIO_HEADSET_AMP, 0);
}
}
Did you see there something strange? I see: if we call "photon_headset_amp" without an argument "int enable" it mean we caled it like photon_headset_amp(0) so it mean we called /* Power down headphone amp */
EDIT:
ok, problem for wifi is not bcm4329, problem for wifi is: nvram error in dmesg is error about /proc/calibration becouse calibration data not exist! But why htc_wifi_nvs nand not working? Is there new wifi_nvs driver that is not pushed to github?

munjeni please uplode nand froyo 2.2 from mediafire,because i

When I fix audio and wifi I will upload new version!
EDIT:
wifi fixed! With smartass2+bfk (245-806mhz) its abnormally fast only need to fix audio becouse android reboot when receive any audio signal! Who want to try here is new boot.img, just open zip and replace boot.img with boot.img and replace modules in /system/lib/modules with modules in archive, replace updater-script in /META-INF/com/google/android/ with updater-script from archive. Please let me know how it working to you, I have aria so I could not test keypad buttons becouse its diferent than photon and not working for me.

thanks munjeni,
is cut screen in this froyo fixed?

Thank you Munjeni, but how can I get into fastboot?

youkid90 said:
Thank you Munjeni, but how can I get into fastboot?
Click to expand...
Click to collapse
Power device, wait lk screen, that press volume down

всем привет это прошивка андройд 2.2 ? с htc sense ? и как ее установить напишите плиз

GPS (and wifi?) seems fixed

I tested the GPS a little and it seems to be fixed. It keeps updating every second without resetting after few seconds. Then I checked the configuration files (/etc/gps.conf) and there is indeed a difference:
Code:
# 0x1: RRC CPlane
# 0x2: RRLP UPlane
# 0x4: LLP Uplane
-A_GLONASS_POS_PROTOCOL_SELECT = 0
+A_GLONASS_POS_PROTOCOL_SELECT = 0x2
where "-" is in .175 and "+" is in .182. "#" lines are just comments in the conf file describing the values. Just "0" felt wrong indeed, by convention it should have been at least 0x0. probably someone messed up while editing.
Also I tried disabling the tweak for the wifi showing the exclamation mark:
Code:
settings put global captive_portal_detection_enabled 1
as explained in my post and it seems fine. But that needs more time testing.

Can confirm the GPS is now working as I've took the updated file from the ftf

[email protected] said:
Can confirm the GPS is now working as I've took the updated file from the ftf
Click to expand...
Click to collapse
Can you make flashable zip or just zip them and share? I'm on vacation and don't have pc to mess with ftf's here
Thanks
Sent from my D2303 using Tapatalk

Here this is where I've grabbed all of the updated files from I'm still on 18.6.A.0.175 you can download the required files and push straight to system manually no unzipping or flashing required
http://forum.xda-developers.com/showthread.php?p=64648145

cm 14.1 lost root access, incoming outgoing lost in one simcard

I've flashed cm 14.1 osprey and it is working all fine accept I've lost root and my incoming and outgoing calls are not working in one sim(data is working fine) and second problem is my root access has lost after some time. I tried with latest update of SuperSU but both sim card not shows up, with old versions supersu just don't get installed.
And yes i flashed it more than one time but the problem continues .
Phone status:
Moto g3 ,twrp latest version installed, everything working fine accept these two problems.
Plz help ,any small help will be appreciated.

Clean flash again, don't flash superSU instead use built in root method. Because CM is already rooted.

aadison said:
Clean flash again, don't flash superSU instead use built in root method. Because CM is already rooted.
Click to expand...
Click to collapse
Done clean flashing but still not incoming and outgoing not working on one sim slot.
And thanks for replying.

manmali said:
Done clean flashing but still not incoming and outgoing not working on one sim slot.
And thanks for replying.
Click to expand...
Click to collapse
Wipe system and reflash ROM an gapps, or better yet clean flash the whole thing... Not really sure what calls would have to do with root access though.

acejavelin said:
Wipe system and reflash ROM an gapps, or better yet clean flash the whole thing... Not really sure what calls would have to do with root access though.
Click to expand...
Click to collapse
I always flash rom after a deep wipe and i flashed 3 updates of cm 14.1 but same problem occured in all.
You must think may be slot is not working but to check this i flashed stock rom once, it just worked. Now what to do??
And thanks for suggestions

manmali said:
I always flash rom after a deep wipe and i flashed 3 updates of cm 14.1 but same problem occured in all.
You must think may be slot is not working but to check this i flashed stock rom once, it just worked. Now what to do??
And thanks for suggestions
Click to expand...
Click to collapse
Try a different ROM... AICP or RR or something.

acejavelin said:
Try a different ROM... AICP or RR or something.
Click to expand...
Click to collapse
I don't know about any other roms accept cm, I'll read about them if they are good, I'll try flashing em. Thanks

manmali said:
I don't know about any other roms accept cm, I'll read about them if they are good, I'll try flashing em. Thanks
Click to expand...
Click to collapse
Lol... I have nothing against CM, but there are definitely other good roms out there, CM is very basic and bland, which is not intended to be negative, but there are much more feature packed roms out there. I hope you enjoy your "journey" past CM.

acejavelin said:
Lol... I have nothing against CM, but there are definitely other good roms out there, CM is very basic and bland, which is not intended to be negative, but there are much more feature packed roms out there. I hope you enjoy your "journey" past CM.
Click to expand...
Click to collapse
Thankyou , suggest me which rom should i try first??

manmali said:
Thankyou , suggest me which rom should i try first??
Click to expand...
Click to collapse
I don't know... Rez Remix was always my favorite on G3, personally I would stick with Marshmallow for now too. Dirty Unicorns, AICP, and BrokenOS are solid options as well.

acejavelin said:
I don't know... Rez Remix was always my favorite on G3, personally I would stick with Marshmallow for now too. Dirty Unicorns, AICP, and BrokenOS are solid options as well.
Click to expand...
Click to collapse
I going for aicp, it's ui customization features seems pretty good. Thanks for your time

manmali said:
I always flash rom after a deep wipe and i flashed 3 updates of cm 14.1 but same problem occured in all.
You must think may be slot is not working but to check this i flashed stock rom once, it just worked. Now what to do??
And thanks for suggestions
Click to expand...
Click to collapse
Same for me on the oneplus-3t. Our similarity is that I also use cm-14.1.
The error message is lengthy (170 lines) and reports things like:
WARNING: linker: /su/bin/sush: unused DT entry: type 0xaa1303e0d00000c1 arg 0x97ff73519111c021
WARNING: linker: /su/bin/sush: unused DT entry: type 0xd00000c134000fa0 arg 0x9111e021aa1303e0
WARNING: linker: /su/bin/sush: unused DT entry: type 0x350010e097ff734c arg 0x910b8062d00000c3
CANNOT LINK EXECUTABLE "/su/bin/sush": empty/missing DT_HASH/DT_GNU_HASH in "/su/bin/sush" (new hash type from the future?)
Aborted
In a different root shell I was able to verify, that the binaries /su/bin/app_process and /su/bin/sush changed both, content and date.
Old (working) version
ls -lani:
23 -rwxr-xr-x 1 0 0 279K 1970-01-17 19:09 /su/bin/sush*
24 -rwxr-xr-x 1 0 0 18K 1970-01-17 19:09 /su/bin/app_process*
md5sum:
daf9ea634bfd1577e62dcf30a998586f /su/bin/sush
4aadf50b46676e6da7c38ab40c0f1ac7 /su/bin/app_process
broken version:
ls -lani
23 -rwxr-xr-x 1 0 0 279K 1970-01-17 19:09 /su/bin/sush*
24 -rwxr-xr-x 1 0 0 18K 1970-01-17 19:09 /su/bin/app_process*
md5sum:
4fddfedaeaea883514cd6d78d2412766 /su/bin/sush
71f9cf0c48095fdf41fab958407bc265 /su/bin/app_process
A reboot fixes the issue. I'll try and see if there are files with the given md5sum on the phone. I tried to find those files: no success. Just to find that sush and app_process vanished altogether. Still: rebooting fixes this.

mrcvs said:
Same for me on the oneplus-3t. Our similarity is that I also use cm-14.1.
The error message is lengthy (170 lines) and reports things like:
WARNING: linker: /su/bin/sush: unused DT entry: type 0xaa1303e0d00000c1 arg 0x97ff73519111c021
WARNING: linker: /su/bin/sush: unused DT entry: type 0xd00000c134000fa0 arg 0x9111e021aa1303e0
WARNING: linker: /su/bin/sush: unused DT entry: type 0x350010e097ff734c arg 0x910b8062d00000c3
CANNOT LINK EXECUTABLE "/su/bin/sush": empty/missing DT_HASH/DT_GNU_HASH in "/su/bin/sush" (new hash type from the future?)
Aborted
In a different root shell I was able to verify, that the binaries /su/bin/app_process and /su/bin/sush changed both, content and date.
Old (working) version
ls -lani:
23 -rwxr-xr-x 1 0 0 279K 1970-01-17 19:09 /su/bin/sush*
24 -rwxr-xr-x 1 0 0 18K 1970-01-17 19:09 /su/bin/app_process*
md5sum:
daf9ea634bfd1577e62dcf30a998586f /su/bin/sush
4aadf50b46676e6da7c38ab40c0f1ac7 /su/bin/app_process
broken version:
ls -lani
23 -rwxr-xr-x 1 0 0 279K 1970-01-17 19:09 /su/bin/sush*
24 -rwxr-xr-x 1 0 0 18K 1970-01-17 19:09 /su/bin/app_process*
md5sum:
4fddfedaeaea883514cd6d78d2412766 /su/bin/sush
71f9cf0c48095fdf41fab958407bc265 /su/bin/app_process
A reboot fixes the issue. I'll try and see if there are files with the given md5sum on the phone. I tried to find those files: no success. Just to find that sush and app_process vanished altogether. Still: rebooting fixes this.
Click to expand...
Click to collapse
Unhappy coensidence, I'm getting the same issue right now on my zte axon 7 and I'm in total panic mode after uncountable firmware flashing and trials, My Phone's nand won't stand long, even tho it's ufs 2.0
different phones, different softwares and the same error, I think supersu is getting weak in general with google's latest policy against modding. It's just...xposed is doa, cm is long gone with the theme engine that everyone loved, rooting is not as easy as it used to be and simple things are getting harder and harder. besides everything, going off-road here, Im sick of dealing with google's bad temper about this, This is the first time in my life I consider a jailbroken iphone over android, which is sad.
anyways, Im looking for a fix of this very annoying issue, btw what file system you use?
maybe f2fs is the reason for all this?

[ROM][7.1.2][i9305]Unofficial LineageOS 14.1 by Exynos4 Team

[ROM][7.1.2][i9305]Unofficial LineageOS 14.1 by Exynos4 Team
Code:
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in this ROM
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
What is Exynos4 Team?
The Exynos4 team is composed of the current maintainers for T0LTE/T0LTEKOR for both LineageOS and Resurrection Remix.
(@Option58, @kozmo21 and @PoisonNinja)
Difference between this and official Lineage 14.1
This is more like a bleeding edge build. Upcoming changes/fixes will show up here first, and eventually make it into Lineage official. So, if you want the latest and greatest changes for the Note 2 and than ported to the i9305, if possible, flash this instead of official.
Due to LineageOS rules, if you are switching between official and unofficial builds you will have to clean flash.
Exynos4 Team like to say thanks to:
The great developer community out there. We've had a lot of help from other people.
- the LineageOS team
- the Galaxy S3 LineageOS maintainer github.com/fourkbomb.
- the NamelessROM project github.com/namelessrom.
- xda users for testing and bug reports.
And I want to say thanks to:
PoisonNinja and Option58, who helped me a lot to set up the device tree and vendor blobs for that Exynos4 rom,
which is mainly created or grown out of the hwc idea.
and credits to @p.a.n for his work and providing his changes and patches.
Working
Graphics
Wifi
Data
RIL
Bluetooth (?!?)
Sensors
Vibration
Camera
NFC
Audio
Video Playback
Not working/Bugs/Unknown
[*]GPS is not working currently Fix is in second post!!
Bluetooth audio (may or may not work for you), please check and report back
MTP crashes when uninstalling an app
Installation
Read the FAQ to familiarize yourself with any issues that may come up
Make sure you're using the latest TWRP version
Download and copy latest rom version to the phone, preferably on internal storage
Factory reset in TWRP (Very important! Do not skip)
Format system, cache, dalvik, data
Flash unofficial LineageOS 14.1
Flash Gapps
Optional: Flash root package
Reboot
Be patient. The first boot will take between 5 - 15 minutes.
See the FAQ to avoid common issues
For updates, it's OK to dirty flash. If you experience any issues however, it is recommended that you clean flash.
Download
lineage-14.1-20170618-UNOFFICIAL-i9305-HWC.zip: June 18, 2017
6/18/2017 (i9305)
Sync with the latest Lineage sources
Hardware composer fixes
[*] Switch back to proprietary RIL 4.4 blobs
Properly fixed screencast
Lots of security patches in the kernel
Temporarily switched SELinux to permissive
XDA:DevDB Information
LineageOS 14.1 by Exynos4 Team, ROM for the Samsung SIII LTE (i9305)
Contributors
PoisonNinja, Option58, kozmo21, LineageOS team
Source Code: https://github.com/Exynos4
ROM OS Version: 7.x Nougat
Based On: LineageOS
Version Information
Status: Beta
Created 2017-06-18
Last Updated 2017-06-18

Just a few info
Root
LineageOS removed builtin root, so you need to flash the root package linked above.
Please test especially calls, incoming and outgoing, mobile data and bluetooth.
The rom/build is based on pans vendor proprietary (ril) blobs and should improve our ril and hopefully fix our reboot problem.
Kernel is set to permissive at the moment. Stickt version also ok.
Please also test bluetooth (audio transfer), because I am not sure, whether it works correct.
GPS is currently not working. Will try to fix that with one of the next builds.
Edit: previous GPS fix is working and solve the problem. Changes will be added in next update.
You can also find it here attached fixed in version: 0702
Other than the HWC and blob changes, the rom is based on pure lineageos sources/repos.

if I need another one

I'm getting bootloops with that build (it doesn't reach far enough for adb to pull the logs). I tried building a build with older blobs yesterday. My build was getting SIGSEGV caused by ks. I'll try building a non hwc version using your blobs and i9305 repository.

I also noticed some reboots, but none anymore during the last night. So I assume that the reboots could not be solved with changing the blobs and also not with that different ril sources/blobs. I doubt that the reboots will be gone with a non hwc version, but we will see. Beside of that are the other things working? Calls, mobile data etc?

Non hwc version booted ok. at_distributor is having problems :
Code:
06-19 03:06:25.941 2812 2812 F libc : CANNOT LINK EXECUTABLE "/system/bin/at_distributor": cannot locate symbol "supportExpandedNV" referenced by "/system/bin/at_distributor"...
06-19 03:06:25.941 2812 2812 F libc : Fatal signal 6 (SIGABRT), code -6 in tid 2812 (at_distributor)
but RIL works anyway (at least SMS). I'll try replacing it with stock i9305 at_distributor. I've got one reboot but I didn't launch logcat/kmsg before and had only short last_kmsg. We should try replacing the blobs with the stock i9305 ones because for now they are mixed. We could give a shot to persist.radio.apm_sim_not_pwdn=1 in system.prop too. I haven't tested anything beside RIL reboots (I'm testing it during night and hoping it will manage to reboot before next day because for daily usage I'm going back to the last stable rom).

Many thanks and when you managed to solve the mix up and your tests are ok, it would be good, if you can upload your changes to github. Think it doesn't make sense that we do all the work twice
Edit: seems to be again or still:
Code:
Kernel panic - not syncing: Fatal exception
and I think caused because of:
Code:
<6>[ 184.685341] c0 mdm_hsic_pm_notify_event: unblock request
<6>[ 184.685375] c0 notify_modem_fatal or shutdown
<6>[ 184.685403] c0 ap2mdm_status is high
<6>[ 184.685425] c0 ap2mdm_errfatal is high
<6>[ 184.685449] c0 mdm2ap_status is low
<6>[ 184.685471] c0 mdm2ap_errfatal is low
<6>[ 184.685492] c0 During shutdown, return notify_modem_fatal

rodman01 said:
Many thanks and when you managed to solve the mix up and your tests are ok, it would be good, if you can upload your changes to github. Think it doesn't make sense that we do all the work twice
Edit: seems to be again or still:
Code:
Kernel panic - not syncing: Fatal exception
and I think caused because of:
Code:
<6>[ 184.685341] c0 mdm_hsic_pm_notify_event: unblock request
<6>[ 184.685375] c0 notify_modem_fatal or shutdown
<6>[ 184.685403] c0 ap2mdm_status is high
<6>[ 184.685425] c0 ap2mdm_errfatal is high
<6>[ 184.685449] c0 mdm2ap_status is low
<6>[ 184.685471] c0 mdm2ap_errfatal is low
<6>[ 184.685492] c0 During shutdown, return notify_modem_fatal
Click to expand...
Click to collapse
Don't worry, I'll upload when I have something that's worth uploading. If you got
Code:
<6>[ 184.685425] c0 ap2mdm_errfatal is high
then the issue is still there.
Update
at_distributor from stock references the same function (supportExpandedNV) so the problem rather doesn't lie in the at_distributor itself but in a missing file that contains the missing function.
Update 2
Replacing ks blob with i9305 stock one alone won't work. That leads to the problem that @p.a.n had (https://forum.xda-developers.com/showpost.php?p=64395738&postcount=218) (https://forum.xda-developers.com/showpost.php?p=64448961&postcount=269)

mtr_ said:
Update 2
Replacing ks blob with i9305 stock one alone won't work. That leads to the problem that @p.a.n had (https://forum.xda-developers.com/showpost.php?p=64395738&postcount=218) (https://forum.xda-developers.com/showpost.php?p=64448961&postcount=269)
Click to expand...
Click to collapse
There is a simple solution (or hack to be more precise) to this and I believe I`ve also described it somewhere here - open the ks binary with some binary editor, find the connect string (it should be there twice) and replace it something else with the same length (I used xonnect).
This is a linker related problem, ks contains symbol connect, which replaces connect from libc (I hope it is there, if not it is some other system library), but with a totally different functionality, which causes a crash. Don`t ask me why this is happening in one environment and in other (the old one), I don`t know.

Maybe this last_kmsg looks better now?
Code:
Samsung S-Boot 4.0 for GT-I9305 (Sep 12 2014 - 13:40:58)
EXYNOS4412(EVT 1.1) / 2044MB / 0MB / Rev 2 / I9305XXUFNI3 /(PKG_ID 0xb070018)
BOOTLOADER VERSION : I9305XXUFNI3
PMIC rev = PASS2(4)
BUCK1OUT(vdd_mif) = 0x05
BUCK3DVS1(vdd_int) = 0x20
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
[mmc] capacity = 30777344
MODEL_NAME:{{GT-I9305}}
eMMC_SERIAL_NUMBER:{{1501004D4147344642F74A00ABD19F03}}
- read_bl1
pit_check_signature (PIT) valid.
initialize_ddi_data: usable! (4:0xe)
[RPMB] emmc_rpmb_open:
Get DATA success.
[RPMB] emmc_rpmb_close:
initialize_rpmb_data: usable! (GT-I9305:VERSION_-+A3)
PARAM ENV VERSION: v1.0..
set_charger_current: chg curr(3f), in curr(17)
set_charger_state: buck(1), chg(1), reg(0x05)
microusb_get_attached_device: STATUS1:0x3f, 2:0x00
set_auto_current: ta_state(0), curr(700)
init_fuelgauge: fuelgauge power ok
init_fuelgauge: POR status
fuelgauge_por: POR start: vcell(3975), vfocv(4026), soc(79)
fuelgauge_por: update SDI M0 parameter
fuelgauge_por: RCOMP(0x0063), TEMPCO(0x0930)
fuelgauge_por: POR finish: vcell(3977), vfocv(4085), soc(73)
get_table_soc: vcell(3976) is caculated to t-soc(75.735)
init_fuelgauge: start: vcell(3976), vfocv(4081), soc(73), table soc(75)
init_fuelgauge: finish: vcell(3976), vfocv(4081), soc(73), table soc(75)
init_microusb_ic: before MUIC: CDETCTRL:0x2d
init_microusb_ic: after MUIC: CDETCTRL:0x2d
init_microusb_ic: MUIC: CONTROL1:0x00
init_microusb_ic: MUIC: CONTROL1:0x00
init_microusb_ic: MUIC: CONTROL2:0x3b
init_microusb_ic: MUIC: CONTROL2:0x3b
PMIC_ID = 0x02
PMIC_IRQSRC = 0x00
PMIC_IRQ1 = 0x02
PMIC_IRQ2 = 0x00
PMIC_IRQ1M = 0xff
PMIC_IRQ2M = 0xff
PMIC_STATUS1 = 0x13
PMIC_STATUS2 = 0x00
PMIC_PWRON = 0x01
PMIC_RTCINT = 0x11
PMIC_RTCINTM = 0x3f
s5p_check_keypad: 0x100000
s5p_check_reboot_mode: INFORM3 = 0 ... skip
s5p_check_upload: MAGIC(0xc1d0c0d6), RST_STAT(0x10000)
microusb_get_attached_device: STATUS1:0x3f, 2:0x00
s5p_check_download: 0
microusb_get_attached_device: STATUS1:0x3f, 2:0x00
check_pm_status: charger is not detected
check_pm_status: voltage(3978) is ok
cmu_div:1, div:7, src_clk:800000000, pixel_clk:38102400
s5p_dsim_display_config: VIDEO MODE
a2, 60, 90,
<start_checksum:481>CHECKSUM_HEADER_SECTOR :4096
<start_checksum:483>offset:50, size:6296
<start_checksum:485>CHECKSUM_HEADER_INFO : NeedChecksum:0 PartNo:20
Not Need Movinand Checksum
Movinand Checksum Confirmation Pass
[mobi_drv] add: 0x43e52500, size: 3933
MobiCore INIT response = 0
MobiCore RTM has initialized!
MobiCore IDLE flag = 0
MobiCore driver address 43e52500, size = 3933
MobiCore RTM Notified back!
MobiCore Driver loaded and RTM IDLE!
MobiCore RTM has been uninitialized!
load_kernel: loading boot image from 106496..
Verify_Binary_Signature: failed.
pit_check_signature (BOOT) invalid.
Set invalid sign flag
No need to update kernel type.
SMC Num = 0x83000001
mobismc success!!! [ret = 0]
[s5p_check_sboot_version_rpmb]cur_version:VERSION_-+A3, rpmb_version:VERSION_-+A3
rpmb_version:51, cur_version:51
ATAG_CORE: 5 54410001 0 0 0
ATAG_MEM: 4 54410002 20000000 40000000
ATAG_MEM: 4 54410002 20000000 60000000
ATAG_MEM: 4 54410002 20000000 80000000
ATAG_MEM: 4 54410002 1FC00000 A0000000
ATAG_SERIAL: 4 54410006 42f74a00 abd19f03
ATAG_INITRD2: 4 54420005 42000000 17b548
ATAG_REVISION: 3 54410007 2
check_rustproof [0]
ATAG_CMDLINE: b1 54410009 'console=ram loglevel=4 androidboot.baseband=mdm sec_debug.level=0 sec_watchdog.sec_pet=5 androidboot.debug_level=0x4f4c [email protected] [email protected] [email protected] s3cfb.bootloaderfb=0x5ec00000 lcdtype=96 consoleblank=0 lpj=3981312 vmalloc=176m oops=panic pmic_info=67 cordon=471c411f44a4d1cb9c99510ec7e578a1 connie=GT-I9305_OPEN_EUR_10e569b8255514f00b8793d908e78a26 androidboot.emmc_checksum=3 androidboot.boot_salescode= androidboot.odin_download=1 androidboot.bootloader=I9305XXUFNI3 androidboot.selinux=enforcing androidboot.warranty_bit=1 androidboot.sec_atd.tty=/dev/ttySAC2 androidboot.serialno=42f74a00abd19f03 snd_soc_core.pmdown_time=1000'
ATAG_NONE: 0 0
Starting kernel at 0x40008000...
SWITCH_SEL(3)

p.a.n said:
There is a simple solution (or hack to be more precise) to this and I believe I`ve also described it somewhere here - open the ks binary with some binary editor, find the connect string (it should be there twice) and replace it something else with the same length (I used xonnect).
This is a linker related problem, ks contains symbol connect, which replaces connect from libc (I hope it is there, if not it is some other system library), but with a totally different functionality, which causes a crash. Don`t ask me why this is happening in one environment and in other (the old one), I don`t know.
Click to expand...
Click to collapse
Thanks for hint, I know that you don't work on i9305 anymore. Isn't that connect that comes internally in ks used somewhere ? After all they had to have a reason to place an internal function like that. After you left the development, it seems that the current ks that is being used in LineageOS based roms seems to be taken from other device. The current situation is as follows: the modem crashes from time to time, ks during that crash is having issues during SAHARA protocol file transfer. I don't know whether it is the modem that causes the ks crash, or ks that causes modem crash.
rodman01 said:
Maybe this last_kmsg looks better now?
Click to expand...
Click to collapse
The pasted log contains only what happened after reboot. It shows the next boot. If you wanted to show a crash, it isn't saved. It could be truncated, because last_kmsg has limited buffer (for most of the modem issues it was just too small to show everything). You can use the methods to capture logs I posted somewhere else.

yes I noticed this too after pulling another one.
But with my current used blobs I do not have that:
Code:
<6>[ 184.685425] c0 ap2mdm_errfatal is high
anymore, but still reboots and:
Code:
<6>[ 1581.571051] c0 mdm_subsys_powerup: mdm modem restart timed out.
<0>[ 1581.571210] c0 Kernel panic - not syncing: subsystem_restart_wq_func[eac9d720]: Failed to powerup external_modem!

rodman01 said:
yes I noticed this too after pulling another one.
But with my current used blobs I do not have that:
Code:
<6>[ 184.685425] c0 ap2mdm_errfatal is high
anymore, but still reboots and:
Code:
<6>[ 1581.571051] c0 mdm_subsys_powerup: mdm modem restart timed out.
<0>[ 1581.571210] c0 Kernel panic - not syncing: subsystem_restart_wq_func[eac9d720]: Failed to powerup external_modem!
Click to expand...
Click to collapse
Still not good. Have you tried modyfing the stock ks as @p.a.n wrote ? I think that the blobs can be swapped on already installed Android, without recompiling everything. Doing adb push should work too. Something like: adb root, adb remount, adb push, reboot.

I know that this is not good.
No I haven't, I have no such editor and haven't searched for it. Have you tried that already?

rodman01 said:
I know that this is not good.
No I haven't, I have no such editor and haven't searched for it. Have you tried that already?
Click to expand...
Click to collapse
Any hex editor should be enough (for Windows you could try https://mh-nexus.de/en/hxd/ ). I haven't tried yet, I returned to stock rom.

mtr_ said:
Thanks for hint, I know that you don't work on i9305 anymore. Isn't that connect that comes internally in ks used somewhere ? After all they had to have a reason to place an internal function like that. After you left the development, it seems that the current ks that is being used in LineageOS based roms seems to be taken from other device. The current situation is as follows: the modem crashes from time to time, ks during that crash is having issues during SAHARA protocol file transfer. I don't know whether it is the modem that causes the ks crash, or ks that causes modem crash.
Click to expand...
Click to collapse
I actually do work on it, just don`t publish, since I was under impression that the official version is fine and the problem you are describing here is caused by old version of modem. I didn`t want to change it, so I solved the problem by using the KitKat RIL with the modification I mentioned.
As far as I know the connect symbol in the ks binary is used only internaly (and shouldn`t be exported at all). It seems like a simple name colision, which was handled differently in KitKat. I`ve been using the modified ks for a long time and it doesn`t seem to have any negative side effect.
I`ll try to put together all the changes against the official code I have and publish again some of my builds. LineageOS 14.1 is quite stable on my device, so I hope this will help you. I just cannnot promise, when this will be, since I am pretty bussy now (more I`ve ever been).

I am uploading at the moment a new test build, where in my logcat no at distributor error and no SIGABRT error or message is to be seen at the moment. Maybe someone is around who is willing to test it....?!?

New test build is uploaded now.
Its based on todays leos sources and nameless/crazyweasel 3.0 vendor/blobs.
Download
lineage-14.1-20170621-UNOFFICIAL-i9305-hwc.zip: https://www.androidfilehost.com/?fid=673368273298966239
Please report back about reboots and or any other error or bug.
GPS is fixed and should work now.

p.a.n said:
I actually do work on it, just don`t publish, since I was under impression that the official version is fine and the problem you are describing here is caused by old version of modem. I didn`t want to change it, so I solved the problem by using the KitKat RIL with the modification I mentioned.
Click to expand...
Click to collapse
Lucky. It seems that by doing that you avoided the RIL problems (and thus saved time ). The thing worth mentioning is that there are quite new stock releases available (I9305XXSFQ series).
rodman01 said:
New test build is uploaded now.
Its based on todays leos sources and nameless/crazyweasel 3.0 vendor/blobs.
Please report back about bootloops and or any other error or bug.
GPS is fixed and should work now.
Click to expand...
Click to collapse
Tested, unfortunately bootloops. Did you try it after a dirty flash or a clean one ?
I made a non hwc build with https://github.com/CrazyWeasel/proprietary_vendor_samsung/tree/n-3.0/i9305 and modified ks from https://github.com/p-an/android_device_samsung_i9305/blob/cm-14.1/proprietary/system/bin/ks . ks works, at_distributor doesn't whine about missing symbol, but that it can't connect to ATD.
Code:
06-22 04:24:28.916 5290 5290 V AT_Distributor_diag: can't connect to atd socket
06-22 04:24:29.046 5293 5293 V AT_Distributor_diag: ConnectToATD
I was running the build for an hour, so not long enough to tell whether the modem issue appears. 4:50 AM, time to get back to stock

I had a reboot during the night too. And now, since the last half an hour, several reboots again. So I would say, this test version is almost unusable at the moment. Did a clean flash after changing to crazyweasel blobs.