Simulating/emulating a gamepad for GearVR? - Samsung Gear VR

I've received my Gear VR last week and found out that most of the better app in Oculus Home require a gamepad. So I've had this crazy idea of trying to use one of my four xbox 360 controllers, that are connect to my PC, to send commands to the Gear Vr over WiFi as a fake gamepad.
Now i'm far from a real programmer and most of my coding experience comes from teaching myself how to work with unity, but I've some progress (albeit a hacky one) - I wrote a script in unity to read the input from my gamepad and send it via wireless ABD terminal to the app.
Code:
using UnityEngine;
using System;
using System.Collections;
using System.Diagnostics;
using XInputDotNetPure;
using System.IO;
public class Datagetter : MonoBehaviour {
public Process process;
public StreamWriter mySW;
public StreamReader mySR;
public bool left = false;
public bool right = false;
public bool up = false;
public bool down = false;
public bool start = false;
public bool xbtn = false;
// Use this for initialization
void Start () {
process = new Process();
process.StartInfo.UseShellExecute = false;
process.StartInfo.RedirectStandardError = true;
process.StartInfo.WorkingDirectory = "C:\\Windows\\System32";
process.StartInfo.FileName = "cmd.exe";
// Redirects the standard input so that commands can be sent to the shell.
process.StartInfo.RedirectStandardInput = true;
// Runs the specified command and exits the shell immediately.
//process.StartInfo.Arguments = @"/c ""dir""";
process.Start();
mySW = process.StandardInput;
mySW.WriteLine ("cd /d C:\\Users\\user");
mySW.WriteLine ("adb tcpip 5555");/////////////
mySW.WriteLine ("adb connect 10.0.0.11");/////////////////
}
IEnumerator timer(){
yield return new WaitForSeconds (3f);
connect ();
}
public void connect(){
mySW.WriteLine ("adb connect 10.0.0.3");
}
// Update is called once per frame
void Update () {
if (GamePad.GetState (PlayerIndex.One).DPad.Left == ButtonState.Pressed) {
if(!left){
left = true;
mySW.WriteLine ("adb shell input keyevent 21");
mySW.Flush ();
}
}
if (GamePad.GetState (PlayerIndex.One).Buttons.X == ButtonState.Pressed) {
if (!right) {
xbtn = true;
mySW.WriteLine ("adb shell input keyevent 188");
mySW.Flush ();
}
}
if (GamePad.GetState (PlayerIndex.One).DPad.Right == ButtonState.Pressed) {
if (!right) {
right = true;
mySW.WriteLine ("adb shell input keyevent 22");
mySW.Flush ();
}
}
if (GamePad.GetState (PlayerIndex.One).DPad.Up == ButtonState.Pressed) {
if (!up) {
up = true;
mySW.WriteLine ("adb shell input keyevent 19");
mySW.Flush ();
}
// UnityEngine.Debug.Log (mySR.ReadLine());
}
if (GamePad.GetState (PlayerIndex.One).DPad.Down == ButtonState.Pressed) {
if (!down) {
down = true;
mySW.WriteLine ("adb shell input keyevent 20");
mySW.Flush ();
}
}
if (GamePad.GetState (PlayerIndex.One).Buttons.Start == ButtonState.Pressed) {
if (!start) {
start = true;
mySW.WriteLine ("control");
mySW.Flush ();
}
}
if (GamePad.GetState (PlayerIndex.One).DPad.Down == ButtonState.Released) {
if (down) {
down = false;
}
}
if (GamePad.GetState (PlayerIndex.One).DPad.Up == ButtonState.Released) {
if (up) {
up = false;
}
}
if (GamePad.GetState (PlayerIndex.One).DPad.Right == ButtonState.Released) {
if (right) {
right = false;
}
}
if (GamePad.GetState (PlayerIndex.One).DPad.Left == ButtonState.Released) {
if (left) {
left = false;
}
}
if (GamePad.GetState (PlayerIndex.One).Buttons.Start == ButtonState.Released) {
if (start) {
start = false;
}
}
}
}
Using this code i'm able to move around in nonVR apps and system menus using the gamepad just fine but for some reason none of the keyEvents work inside the gearVr, with the only exception I've found so far being keyevent 3 which simulates the Back button.
I know this code is pretty horrible and i'll try to rewrite it properly once i get the basics working but for now i'm pretty stuck. Anyone has an idea on how to solve this? This could be a pretty useful solution for people with gearVR who don't want to replace their current gamepad with an overpriced, less comfortable one.

hi , i am quite like you in such regards that i just use my logic and self teach myself which sucks horribly , i reviewed your code and here is the catch , while you managed to come up with a brilliant idea such as mapping all keypresses then resending them via adb shell the catch is : on the device these commands are interpreted as if originating from device itself , not from a connected game pad/keyboard device , however GearVR service checks for a connected device to acquire its input and thus since there isn't any will neglect whatever the device is originating (that's exactly what the service is all about , discarding system activities) so you either have to find a mean to emulate a game pad/keyboard connection using adb or through an app on device's side . how to do that is beyond me
---------- Post added at 03:28 PM ---------- Previous post was at 03:17 PM ----------
if you get to wonder why back button still work its most probably because its a hardware button on device (next to home button) so the service start assuming you are doing this manually (pressing it with your finger) and thus wont filter it out
---------- Post added at 03:35 PM ---------- Previous post was at 03:28 PM ----------
ummm this kind of lit up a bulb here .. why don't you use "sendevent" instead of "keyevent" as these presumably emulate hardware keys , since there is evidence the service don't filter those out .

Great idea! I'll try capturing the event codes for the gamepad on one of my older devices, even though im not sure if the codes are universal across all device, and check if sendevent works. thanks and i'll keep you updated.

try these constants with "sendevent" i assume they are global , there are constants for hardware d-pad even :
0 --> "KEYCODE_UNKNOWN"
1 --> "KEYCODE_MENU"
2 --> "KEYCODE_SOFT_RIGHT"
3 --> "KEYCODE_HOME"
4 --> "KEYCODE_BACK"
5 --> "KEYCODE_CALL"
6 --> "KEYCODE_ENDCALL"
7 --> "KEYCODE_0"
8 --> "KEYCODE_1"
9 --> "KEYCODE_2"
10 --> "KEYCODE_3"
11 --> "KEYCODE_4"
12 --> "KEYCODE_5"
13 --> "KEYCODE_6"
14 --> "KEYCODE_7"
15 --> "KEYCODE_8"
16 --> "KEYCODE_9"
17 --> "KEYCODE_STAR"
18 --> "KEYCODE_POUND"
19 --> "KEYCODE_DPAD_UP"
20 --> "KEYCODE_DPAD_DOWN"
21 --> "KEYCODE_DPAD_LEFT"
22 --> "KEYCODE_DPAD_RIGHT"
23 --> "KEYCODE_DPAD_CENTER"
24 --> "KEYCODE_VOLUME_UP"
25 --> "KEYCODE_VOLUME_DOWN"
26 --> "KEYCODE_POWER"
27 --> "KEYCODE_CAMERA"
28 --> "KEYCODE_CLEAR"
29 --> "KEYCODE_A"
30 --> "KEYCODE_B"
31 --> "KEYCODE_C"
32 --> "KEYCODE_D"
33 --> "KEYCODE_E"
34 --> "KEYCODE_F"
35 --> "KEYCODE_G"
36 --> "KEYCODE_H"
37 --> "KEYCODE_I"
38 --> "KEYCODE_J"
39 --> "KEYCODE_K"
40 --> "KEYCODE_L"
41 --> "KEYCODE_M"
42 --> "KEYCODE_N"
43 --> "KEYCODE_O"
44 --> "KEYCODE_P"
45 --> "KEYCODE_Q"
46 --> "KEYCODE_R"
47 --> "KEYCODE_S"
48 --> "KEYCODE_T"
49 --> "KEYCODE_U"
50 --> "KEYCODE_V"
51 --> "KEYCODE_W"
52 --> "KEYCODE_X"
53 --> "KEYCODE_Y"
54 --> "KEYCODE_Z"
55 --> "KEYCODE_COMMA"
56 --> "KEYCODE_PERIOD"
57 --> "KEYCODE_ALT_LEFT"
58 --> "KEYCODE_ALT_RIGHT"
59 --> "KEYCODE_SHIFT_LEFT"
60 --> "KEYCODE_SHIFT_RIGHT"
61 --> "KEYCODE_TAB"
62 --> "KEYCODE_SPACE"
63 --> "KEYCODE_SYM"
64 --> "KEYCODE_EXPLORER"
65 --> "KEYCODE_ENVELOPE"
66 --> "KEYCODE_ENTER"
67 --> "KEYCODE_DEL"
68 --> "KEYCODE_GRAVE"
69 --> "KEYCODE_MINUS"
70 --> "KEYCODE_EQUALS"
71 --> "KEYCODE_LEFT_BRACKET"
72 --> "KEYCODE_RIGHT_BRACKET"
73 --> "KEYCODE_BACKSLASH"
74 --> "KEYCODE_SEMICOLON"
75 --> "KEYCODE_APOSTROPHE"
76 --> "KEYCODE_SLASH"
77 --> "KEYCODE_AT"
78 --> "KEYCODE_NUM"
79 --> "KEYCODE_HEADSETHOOK"
80 --> "KEYCODE_FOCUS"
81 --> "KEYCODE_PLUS"
82 --> "KEYCODE_MENU"
83 --> "KEYCODE_NOTIFICATION"
84 --> "KEYCODE_SEARCH"
85 --> "TAG_LAST_KEYCODE"

If decide to not go that route and you have a ps3 controller laying around, you can use the sixxaxis app on your phone to control/ play.

If you have 2 phones (one for Gear VR headset and other for VR controller), go Google Play and search "GAMEPAD FOR VR", there is an application with blue icon of Kunkunsoft developer
It make your phone become a VR Controller, help you control your VR Headset phone via Bluetooth.

Related

[INFO] Details on boot logo format

Hi,
I had posted this in the Q&A thread, thought I would post it here as well.
Glossary:
boot logo: the static image you see when you turn on the phone.
boot animation: a series of pics in a zip file that are displayed after the boot logo.
Hi,
If you want to change the boot logo, you just fastboot flash logo logo.bin. It's mmcblk0p8.
The format is a constant string, 4 bytes, "SOL:" followed by 4 zero bytes, followed by 4 bytes for the width, 540, 4 bytes for the height 960, and the raw data of the image. Each pixel is 2 bytes, it's 565 format.
save a png as 540x960 called logo.png
$ convert -depth 8 logo.png rgb:logo.raw
$ ./rgb2565 < logo.raw > temp.bin
$ cat logo-heaader.bin temp.bin > logo.bin
$ sudo ./moto-fastboot flash logo logo.bin
Here is the source to rgb2565:
Code:
/*
* Copyright (C) 2008 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#define to565(r,g,b) \
((((r) >> 3) << 11) | (((g) >> 2) << 5) | ((b) >> 3))
#define from565_r(x) ((((x) >> 11) & 0x1f) * 255 / 31)
#define from565_g(x) ((((x) >> 5) & 0x3f) * 255 / 63)
#define from565_b(x) (((x) & 0x1f) * 255 / 31)
void to_565_raw(void)
{
unsigned char in[3];
unsigned short out;
while(read(0, in, 3) == 3) {
out = to565(in[0],in[1],in[2]);
write(1, &out, 2);
}
return;
}
void to_565_raw_dither(int width)
{
unsigned char in[3];
unsigned short out;
int i = 0;
int e;
int* error = malloc((width+2) * 3 * sizeof(int));
int* next_error = malloc((width+2) * 3 * sizeof(int));
memset(error, 0, (width+2) * 3 * sizeof(int));
memset(next_error, 0, (width+2) * 3 * sizeof(int));
error += 3; // array goes from [-3..((width+1)*3+2)]
next_error += 3;
while(read(0, in, 3) == 3) {
int r = in[0] + error[i*3+0];
int rb = (r < 0) ? 0 : ((r > 255) ? 255 : r);
int g = in[1] + error[i*3+1];
int gb = (g < 0) ? 0 : ((g > 255) ? 255 : g);
int b = in[2] + error[i*3+2];
int bb = (b < 0) ? 0 : ((b > 255) ? 255 : b);
out = to565(rb, gb, bb);
write(1, &out, 2);
#define apply_error(ch) { \
next_error[(i-1)*3+ch] += e * 3 / 16; \
next_error[(i)*3+ch] += e * 5 / 16; \
next_error[(i+1)*3+ch] += e * 1 / 16; \
error[(i+1)*3+ch] += e - ((e*1/16) + (e*3/16) + (e*5/16)); \
}
e = r - from565_r(out);
apply_error(0);
e = g - from565_g(out);
apply_error(1);
e = b - from565_b(out);
apply_error(2);
#undef apply_error
++i;
if (i == width) {
// error <- next_error; next_error <- 0
int* temp = error; error = next_error; next_error = temp;
memset(next_error, 0, (width+1) * 3 * sizeof(int));
i = 0;
}
}
free(error-3);
free(next_error-3);
return;
}
void to_565_rle(void)
{
unsigned char in[3];
unsigned short last, color, count;
unsigned total = 0;
count = 0;
while(read(0, in, 3) == 3) {
color = to565(in[0],in[1],in[2]);
if (count) {
if ((color == last) && (count != 65535)) {
count++;
continue;
} else {
write(1, &count, 2);
write(1, &last, 2);
total += count;
}
}
last = color;
count = 1;
}
if (count) {
write(1, &count, 2);
write(1, &last, 2);
total += count;
}
fprintf(stderr,"%d pixels\n",total);
}
int main(int argc, char **argv)
{
if ((argc == 2) && (!strcmp(argv[1],"-rle"))) {
to_565_rle();
} else {
if (argc > 2 && (!strcmp(argv[1], "-w"))) {
to_565_raw_dither(atoi(argv[2]));
} else {
to_565_raw();
}
}
return 0;
}
See example logo.bin attached.
Cheers!​
dumb question, had u tried this?
luismanson said:
dumb question, had u tried this?
Click to expand...
Click to collapse
Hi,
If you want an example, try my zoomquilt2 bootanimation.
[BOOTANIMATION] HD bootanimation zoom quilt 1 & 2
Only downside is that things like "unlocked" show up on top of the logo, so design with a back background to avoid that.
Cheers!
NFHimself said:
Hi,
If you want an example, try my zoomquilt2 bootanimation.
[BOOTANIMATION] HD bootanimation zoom quilt 1 & 2
Only downside is that things like "unlocked" show up on top of the logo, so design with a back background to avoid that.
Cheers!
Click to expand...
Click to collapse
I believe this post refers to the initial boot logo, not the boot animation that follows.
yeah, the OP got confused... now i dont know if i should try this
Guys, if you read the zoomquilt thread, it replaces the logo.bin and boot animation. OP didn't confuse himself.
Is there a maximum size to the bootlogo file, I have a spica as well and many people have bricked there spica if they flash a bootlogo bigger than 192 kb as it results in overwriting the Bootloader or something like that.
PS:- The bricks are hard bricks.
munchy_cool said:
Is there a maximum size to the bootlogo file, I have a spica as well and many people have bricked there spica if they flash a bootlogo bigger than 192 kb as it results in overwriting the Bootloader or something like that.
PS:- The bricks are hard bricks.
Click to expand...
Click to collapse
Hi,
If you create the file correctly, if will always be the same size (1036820), it's not like other android logos (initlogo.rle) that are rle compressed. there is the header and a raw 565 format image, that's it.
For an initlogo.rle you would use ./rgb2565 -rle < logo.raw > temp.bin.
Cheers!
^^ thanks a lot.
thanks 4 this, finally got it!!!
OSNPA said:
Guys, if you read the zoomquilt thread, it replaces the logo.bin and boot animation. OP didn't confuse himself.
Click to expand...
Click to collapse
My bad.
Didn't catch that part in the zoomquilt thread.
Edit:
This worked like a charm too!
Something I threw together as a test.
Left a black strip up top so I could see boot messages.
The preview below looks like garbage compared to how it looks on the phone.

diffing kj4 - kj6 kernels

as kj6 is supposed to bring some bug fixes, I thought I'd check the kernel source.
there's not a huge amount of difference, but some looks interesting, hopefully of use to anyone wanting to building it.
Code:
--- drivers/input/touchscreen/mxt540e.c 2011-10-20 02:58:48.000000000
+++ drivers/input/touchscreen/mxt540e.c 2011-10-25 17:58:10.000000000
@@ -907,16 +907,16 @@
}
if (object_type == PROCG_NOISESUPPRESSION_T48) {
if (msg[4] == 5) { /* Median filter error */
printk("[TSP] Median filter Error\n");
get_object_info(data, PROCG_NOISESUPPRESSION_T48, &size, &obj_address);
- value = data->calcfg_batt_e;
+ value = 0;
error = write_mem(data, obj_address+2, 1, &value);
- msleep(5);
- value |= 0x20;
+ msleep(15);
+ value = data->calcfg_batt_e;
error |= write_mem(data, obj_address+2, 1, &value);
if(error) printk(KERN_ERR "[TSP] failed to reenable CHRGON\n");
}
}
if (object_type == TOUCH_MULTITOUCHSCREEN_T9) {
Code:
--- drivers/input/keyboard/cypress/cypress-touchkey.c 2011-10-20 02:58:48.000000000
+++ drivers/input/keyboard/cypress/cypress-touchkey.c 2011-10-25 17:58:10.000000000
@@ -1909,18 +1909,20 @@
int ret = 0;
#ifdef TEST_JIG_MODE
unsigned char get_touch = 0x40;
#endif
+#ifndef CONFIG_MACH_Q1_REV02
if (gpio_request(_3_TOUCH_SDA_28V, "_3_TOUCH_SDA_28V"))
WARN(1, "Fail to request gpio (_3_TOUCH_SDA_28V)\n");
if (gpio_request(_3_TOUCH_SCL_28V, "_3_TOUCH_SCL_28V"))
WARN(1, "Fail to request gpio (_3_TOUCH_SCL_28V)\n");
if (gpio_request(_3_GPIO_TOUCH_EN, "_3_GPIO_TOUCH_EN"))
WARN(1, "Fail to request gpio (_3_GPIO_TOUCH_EN)\n");
+#endif
if (gpio_request(_3_GPIO_TOUCH_INT, "_3_GPIO_TOUCH_INT"))
WARN(1, "Fail to request gpio (_3_GPIO_TOUCH_INT)\n");
/*20110222 N1_firmware_sync*/
sec_touchkey = device_create(sec_class, NULL, 0, NULL, "sec_touchkey");
@@ -2212,18 +2214,20 @@
misc_deregister(&touchkey_update_device);
if (touchkey_wq) {
destroy_workqueue(touchkey_wq);
}
+#ifndef CONFIG_MACH_Q1_REV02
gpio_free(_3_TOUCH_SDA_28V);
gpio_free(_3_TOUCH_SCL_28V);
gpio_free(_3_GPIO_TOUCH_EN);
+#endif
gpio_free(_3_GPIO_TOUCH_INT);
}
late_initcall(touchkey_init);
module_exit(touchkey_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("@@@");
MODULE_DESCRIPTION("melfas touch keypad");
Code:
--- drivers/leds/leds-max8997.c 2011-10-20 02:58:48.000000000
+++ drivers/leds/leds-max8997.c 2011-10-25 17:58:10.000000000
@@ -242,19 +242,30 @@
regulator_led_disable(led);
regulator_put(led->vcc);
kfree(led);
return 0;
}
+static void regulator_led_shutdown(struct platform_device *pdev)
+{
+ struct regulator_led *led = platform_get_drvdata(pdev);
+
+ if (regulator_is_enabled(led->vcc)) {
+ regulator_led_disable(led);
+ }
+ return;
+}
+
static struct platform_driver regulator_led_driver = {
.driver = {
.name = "leds-max8997",
.owner = THIS_MODULE,
},
.probe = regulator_led_probe,
.remove = __devexit_p(regulator_led_remove),
+ .shutdown = regulator_led_shutdown,
};
static int __init regulator_led_init(void)
{
return platform_driver_register(&regulator_led_driver);
}
Code:
--- drivers/media/video/samsung/mali/common/mali_kernel_mem_os.c 2011-10-20 02:58:48.000000000
+++ drivers/media/video/samsung/mali/common/mali_kernel_mem_os.c 2011-10-25 17:58:10.000000000
@@ -251,12 +251,13 @@
{
if ( allocation_order > 0 ) {
--allocation_order;
} else {
/* return OOM */
_mali_osk_lock_signal(info->mutex, _MALI_OSK_LOCKMODE_RW);
+ MALI_PRINT(("Failed to allocate consistent memory in all sizes.\n"));
return MALI_MEM_ALLOC_NONE;
}
}
/* try to allocate 2^(allocation_order) pages, if that fails, try
* allocation_order-1 to allocation_order 0 (inclusive) */
@@ -270,18 +271,21 @@
--allocation_order;
}
if ( NULL == virt )
{
MALI_DEBUG_PRINT(1, ("Failed to allocate consistent memory. Is CONSISTENT_DMA_SIZE set too low?\n"));
+ MALI_PRINT(("Failed to allocate consistent memory. Is CONSISTENT_DMA_SIZE set too low?\n"));
/* return OOM */
_mali_osk_lock_signal(info->mutex, _MALI_OSK_LOCKMODE_RW);
return MALI_MEM_ALLOC_NONE;
}
MALI_DEBUG_PRINT(5, ("os_allocator_allocate_page_table_block: Allocation of order %i succeeded\n",
+ allocation_order));
+ MALI_PRINT(("os_allocator_allocate_page_table_block: Allocation of order %i succeeded\n",
allocation_order));
/* we now know the size of the allocation since we know for what
* allocation_order the allocation succeeded */
size = _MALI_OSK_CPU_PAGE_SIZE << allocation_order;
Code:
--- drivers/media/video/m5mo.c 2011-10-20 02:58:48.000000000
+++ drivers/media/video/m5mo.c 2011-10-25 17:58:10.000000000
@@ -1707,13 +1707,13 @@
}
#endif
static int m5mo_set_touch_auto_focus(struct v4l2_subdev *sd, int val)
{
struct m5mo_state *state = to_state(sd);
- int err = -EINVAL;
+ int err;
cam_info("%s\n", val ? "start" : "stop");
state->focus.touch = val;
if (val) {
err = m5mo_set_af_mode(sd, FOCUS_MODE_TOUCH);
@@ -1727,13 +1727,13 @@
err = m5mo_writew(sd, M5MO_CATEGORY_LENS,
M5MO_LENS_AF_TOUCH_POSY, state->focus.pos_y);
CHECK_ERR(err);
}
cam_trace("X\n");
- return err;
+ return 0;
}
static int m5mo_set_zoom(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
{
struct m5mo_state *state = to_state(sd);
struct v4l2_queryctrl qc = {0,};
Code:
--- drivers/power/smb328_charger.c 2011-10-20 02:58:49.000000000
+++ drivers/power/smb328_charger.c 2011-10-25 17:58:10.000000000
@@ -820,18 +820,26 @@
{
struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
struct smb328_chip *chip;
int ret = 0;
int gpio = 0;
u8 data;
+ int i;
- if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
- return -EIO;
+ i = 10;
+ while (1) {
+ if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
+ goto I2CERROR;
- if (smb328_i2c_read(client, 0x36, &data)<0) /* check HW */
- return -EIO;
+ if (smb328_i2c_read(client, 0x36, &data)>=0) /* check HW */
+ break;
+
+I2CERROR:
+ if (!i--) return -EIO;
+ msleep(300);
+ }
dev_info(&client->dev, "%s : SMB328 Charger Driver Loading\n", __func__);
chip = kzalloc(sizeof(struct smb328_chip), GFP_KERNEL);
if (!chip)
return -ENOMEM;
Code:
--- drivers/video/samsung/s3cfb_s6e8aa0.c 2011-10-20 02:58:50.000000000
+++ drivers/video/samsung/s3cfb_s6e8aa0.c 2011-10-25 17:58:10.000000000
@@ -1009,19 +1009,27 @@
return 0;
}
int s6e8ax0_read_mtp(struct lcd_info *lcd, u8 *mtp_data)
{
int ret;
+ u8 retry_cnt = 3;
s6e8ax0_write(lcd, enable_mtp_register, ARRAY_SIZE(enable_mtp_register));
+
+read_retry:
ret = s6e8ax0_read(lcd, LDI_MTP_ADDR, LDI_MTP_LENGTH, mtp_data);
if (!ret) {
- printk("ERROR:MTP read failed\n");
- return 0;
+ if (retry_cnt) {
+ printk("[WARN:LCD] : %s : retry cnt : %d\n", __func__, retry_cnt);
+ retry_cnt--;
+ goto read_retry;
+ } else
+ printk("ERROR:MTP read failed\n");
}
+
s6e8ax0_write(lcd, disable_mtp_register, ARRAY_SIZE(disable_mtp_register));
return ret;
}
#endif
static ssize_t lcdtype_show(struct device *dev, struct
@@ -1228,12 +1236,13 @@
struct s5p_platform_dsim *pd = (struct s5p_platform_dsim *)pdev->dev.platform_data;
#endif
#ifdef SMART_DIMMING
u8 mtp_data[LDI_MTP_LENGTH] = {0,};
u32 i;
u8 id_buf[3] = {0,};
+ u8 retry_cnt = 3;
#endif
lcd = kzalloc(sizeof(struct lcd_info), GFP_KERNEL);
if (!lcd) {
pr_err("failed to allocate for lcd\n");
ret = -ENOMEM;
@@ -1330,17 +1339,24 @@
dev_info(&lcd->ld->dev, "s6e8aa0 lcd panel driver has been probed.\n");
#ifdef SMART_DIMMING
mutex_init(&lcd->bl_lock);
- //read mpt
+read_retry:
ret = s6e8ax0_read(lcd, PANEL_ID_COMMAND, 3, id_buf);
if (!ret) {
- printk("[LCD:ERROR] : %s read id failed\n", __func__);
- //return -1;
+ if (retry_cnt) {
+ printk("[WARN:LCD] : %s : retry cnt : %d\n", __func__, retry_cnt);
+ retry_cnt--;
+ goto read_retry;
+ } else {
+ printk("[ERROR:LCD] : %s : Read ID Failed\n", __func__);
+ /*To protect ELVSS Wrong Operation*/
+ id_buf[2] = 0x33;
+ }
}
printk("Read ID : %x, %x, %x\n", id_buf[0], id_buf[1], id_buf[2]);
if (id_buf[2] == 0x33) {
lcd->support_elvss = 0;
@@ -1361,22 +1377,23 @@
init_table_info(&lcd->smart);
ret = s6e8ax0_read_mtp(lcd, mtp_data);
if (!ret) {
printk("[LCD:ERROR] : %s read mtp failed\n", __func__);
- //return -1;
+ lcd->connected = 0;
+ dev_info(&lcd->ld->dev, "panel is not connected well\n");
+ /*return -1;*/
}
calc_voltage_table(&lcd->smart, mtp_data);
s6e8ax0_adb_brightness_update(lcd, lcd->bd->props.brightness, 1);
#endif
- if (id_buf[0] == 0xa2) {
- lcd->connected = 1;
+ if (lcd->connected) {
INIT_DELAYED_WORK(&hs_clk_re_try, hs_clk_re_try_work);
lcd->irq = gpio_to_irq(GPIO_OLED_DET);
s3c_gpio_cfgpin(GPIO_OLED_DET, S3C_GPIO_SFN(0xf));
s3c_gpio_setpull(GPIO_OLED_DET, S3C_GPIO_PULL_NONE);
@@ -1384,15 +1401,12 @@
if (request_irq(lcd->irq, oled_det_int, IRQF_TRIGGER_FALLING, "vgh_toggle", 0)) {
pr_err("failed to reqeust irq. %d\n", lcd->irq);
ret = -EINVAL;
goto out_free_backlight;
}
- } else {
- lcd->connected = 0;
- dev_info(&lcd->ld->dev, "panel is not connected\n");
}
return 0;
out_free_backlight:
lcd_device_unregister(lcd->ld);
Code:
--- drivers/video/samsung/s5p-dsim.c 2011-10-20 02:58:50.000000000
+++ drivers/video/samsung/s5p-dsim.c 2011-10-25 17:58:10.000000000
@@ -115,13 +115,13 @@
#define MIPI_CMD_GENERIC_RD_2 0x24
#define MIPI_CMD_DSI_RD_0 0x06
#define MIPI_CMD_DSI_SET_PKT_SZ 0x37
-#define MIPI_RX_TIMEOUT HZ
+#define MIPI_RX_TIMEOUT msecs_to_jiffies(250)
#define DSMI_RX_FIFO_READ_DONE 0x30800002
#define DSIM_MAX_RX_FIFO 20
#define S5P_DSIM_INT_SFR_FIFO_EMPTY 29
#define S5P_DSIM_INT_BTA 25
#define S5P_DSIM_INT_MSK_FRAME_DONE 24
@@ -358,13 +358,13 @@
}
rxhd = readl(reg_base + S5P_DSIM_RXFIFO);
printk("rxhd : %x\n", rxhd);
if ((u8)(rxhd & 0xff) != response) {
printk(KERN_ERR "[DSIM:ERROR]:%s wrong response rxhd : %x, response:%x\n"
- ,__func__, rxhd, response);
+ , __func__, rxhd, response);
goto clear_rx_fifo;
}
// for short packet
if (count <= 2) {
for (i = 0; i < count; i++)
buf[i] = (rxhd >> (8+(i*8))) & 0xff;
@@ -379,21 +379,21 @@
goto clear_rx_fifo;
}
for (i = 0; i < rxsize>>2; i++) {
temp = readl(reg_base + S5P_DSIM_RXFIFO);
printk("pkt : %08x\n", temp);
- for(j=0; j < 4; j++) {
+ for (j = 0; j < 4; j++) {
buf[(i*4)+j] = (u8)(temp>>(j*8))&0xff;
//printk("Value : %02x\n",(temp>>(j*8))&0xff);
}
}
if (rxsize % 4) {
temp = readl(reg_base + S5P_DSIM_RXFIFO);
printk("pkt-l : %08x\n", temp);
- for(j=0; j < rxsize%4; j++) {
+ for (j = 0; j < rxsize%4; j++) {
buf[(i*4)+j] = (u8)(temp>>(j*8))&0xff;
//printk("Value : %02x\n",(temp>>(j*8))&0xff);
}
}
}
@@ -1089,30 +1089,30 @@
writel(int_stat, dsim.reg_base + S5P_DSIM_INTMSK);
}
int s5p_dsim_fifo_clear(void)
{
- int dsim_count=0,ret;
+ int dsim_count = 0, ret;
writel(SwRstRelease, dsim.reg_base + S5P_DSIM_INTSRC);
-
+
writel(DSIM_FUNCRST, dsim.reg_base + S5P_DSIM_SWRST);
- do{
- if(++dsim_count>90000){
- printk("dsim fifo clear fail re_try dsim resume\n");
- ret=0;
+ do {
+ if (++dsim_count > 90000) {
+ printk("dsim fifo clear fail re_try dsim resume\n");
+ ret = 0;
break;
- }
-
- if(readl(dsim.reg_base + S5P_DSIM_INTSRC) & SwRstRelease){
- s5p_dsim_interrupt_mask_set();
- ret=1;
+ }
+
+ if (readl(dsim.reg_base + S5P_DSIM_INTSRC) & SwRstRelease) {
+ s5p_dsim_interrupt_mask_set();
+ ret = 1;
break;
}
- }while(1);
+ } while (1);
return ret;
}
#ifdef CONFIG_HAS_EARLYSUSPEND
void s5p_dsim_early_suspend(void)
@@ -1140,24 +1140,24 @@
if (dsim.mipi_drv->suspend)
dsim.mipi_drv->suspend(dsim.dev, state);
if (dsim.mipi_ddi_pd->lcd_power_on)
dsim.mipi_ddi_pd->lcd_power_on(dsim.dev, 0);
-
+
s5p_dsim_enable_hs_clock(dsim.reg_base, 0);
s5p_dsim_set_clock(dsim.reg_base, dsim.dsim_info->e_byte_clk, 0);
-
+
writel(0xffff, dsim.reg_base + S5P_DSIM_CLKCTRL);
writel(0x0, dsim.reg_base + S5P_DSIM_PLLCTRL);
writel(0x0, dsim.reg_base + S5P_DSIM_PLLTMR);
writel(0x0, dsim.reg_base + S5P_DSIM_PHYACCHR);
- writel(0x0, dsim.reg_base + S5P_DSIM_PHYACCHR1);
+ writel(0x0, dsim.reg_base + S5P_DSIM_PHYACCHR1);
writel(0x1, dsim.reg_base + S5P_DSIM_SWRST);
-
+
clk_disable(dsim.clock);
#if 0
if (dsim.pd->mipi_power)
dsim.pd->mipi_power(0);
else
Code:
--- drivers/video/samsung/s6e8aa0_param.h 2011-10-20 02:58:50.000000000
+++ drivers/video/samsung/s6e8aa0_param.h 2011-10-25 17:58:10.000000000
@@ -66,13 +66,14 @@
static const unsigned char SEQ_APPLY_LEVEL_2_KEY[] = {
0xFC,
0x5A, 0x5A
};
static const unsigned char SEQ_SLEEP_OUT[] = {
- 0x11
+ 0x11,
+ 0x00,0x00
};
static const unsigned char SEQ_PANEL_CONDITION_SET[] = {
0xF8,
0x25, 0x34, 0x00, 0x00, 0x00, 0x95, 0x00, 0x3C, 0x7D, 0x08,
0x27, 0x00, 0x00, 0x10, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00,
@@ -83,13 +84,14 @@
static const unsigned char SEQ_DISPLAY_CONDITION_SET[] = {
0xF2,
0x80, 0x03, 0x0D
};
static const unsigned char SEQ_GAMMA_UPDATE[] = {
- 0xF7, 0x03
+ 0xF7, 0x03,
+ 0x00
};
static const unsigned char SEQ_ETC_SOURCE_CONTROL[] = {
0xF6,
0x00, 0x02, 0x00
};
@@ -116,30 +118,35 @@
0x14, 0x40, 0x0C, 0xCB, 0xCE,
0x6E, 0xC4, 0x0F, 0x40, 0x41,
0xD9, 0x00, 0x00, 0x00
};
static const unsigned char SEQ_DISPLAY_ON[] = {
- 0x29
+ 0x29,
+ 0x00,0x00
};
static const unsigned char SEQ_DISPLAY_OFF[] = {
- 0x28
+ 0x28,
+ 0x00,0x00
};
static const unsigned char SEQ_STANDBY_ON[] = {
- 0x01
+ 0x01,
+ 0x00,0x00
};
static const unsigned char SEQ_ACL_ON[] = {
0xC0, 0x01,
+ 0x00
};
static const unsigned char SEQ_ACL_OFF[] = {
0xC0, 0x00,
+ 0x00
};
static const unsigned char SEQ_ACL_CUTOFF_20[] = {
0xC1,
0x47, 0x53, 0x13, 0x53, 0x00,
0x00, 0x03, 0x1F, 0x00, 0x00,
and they changed to codesourcery for toolchain
+CROSS_COMPILE ?= /opt/toolchains/arm-2009q3/bin/arm-none-linux-gnueabi-
Not a massive amount of differences, the screen driver changes looks most interesting to me.
fards said:
and they changed to codesourcery for toolchain
+CROSS_COMPILE ?= /opt/toolchains/arm-2009q3/bin/arm-none-linux-gnueabi-
Not a massive amount of differences, the screen driver changes looks most interesting to me.
Click to expand...
Click to collapse
Is there a new kernel source?
Sent from my GT-I9100
yes, kj6 is up,
the diffs are between kj4 and that kj6
to show the file differences (there's also some docs changes but they aren't really needed)
fards said:
yes, kj6 is up,
the diffs are between kj4 and that kj6
to show the file differences (there's also some docs changes but they aren't really needed)
Click to expand...
Click to collapse
Where did you get the kernel source?
https://opensource.samsung.com/index.jsp
search for N7000
I presume the kkx build will be there under the other device code.
fards said:
https://opensource.samsung.com/index.jsp
search for N7000
I presume the kkx build will be there under the other device code.
Click to expand...
Click to collapse
LOL you have the Hong Kong version source code xD
netchip said:
LOL you have the Hong Kong version source code xD
Click to expand...
Click to collapse
kj6 as I said...
to compare against kj4 as 6 is supposed to bring bugfixes..
fards said:
Not a massive amount of differences, the screen driver changes looks most interesting to me.
Click to expand...
Click to collapse
Maybe that diff solves my screen issue.
Just to explain, sometimes my screen does not wake up even if the phone is still running (long pressing the on/off button makes the phone vibrate which means that it is still working) and when I hard reboot it (8 seconds long on/off button press), it restarts and in the battery usage I can see that the phone has been awake for a long time instead of having been idle (when it happens, it is generally during the night).
As I am facing it globally (with both European stock and Hong Kong ROMs), I hope this kernel change corrects it.
The_Steph said:
Maybe that diff solves my screen issue.
Just to explain, sometimes my screen does not wake up even if the phone is still running (long pressing the on/off button makes the phone vibrate which means that it is still working) and when I hard reboot it (8 seconds long on/off button press), it restarts and in the battery usage I can see that the phone has been awake for a long time instead of having been idle (when it happens, it is generally during the night).
As I am facing it globally (with both European stock and Hong Kong ROMs), I hope this kernel change corrects it.
Click to expand...
Click to collapse
I've seen the same thing a couple of times. Still haven't tested the KJ6 kernel to see the effect of those patches yet.
Actually thats spurred me onto testing the KJ6.. Initialtesting suggests Screen powers back up Much quicker from standby
KJ6, where did you get it?
Edit: I have Baseband version N7000XXKJ6 but Kernel N7000ZSKK1. Is is this version you are talking about?
The_Steph said:
KJ6, where did you get it?
Edit: I have Baseband version N7000XXKJ6 but Kernel N7000ZSKK1. Is is this version you are talking about?
Click to expand...
Click to collapse
no there's threads with the kj6 kernel, including the CF root thread.
I've just built kernel with the patches, working well so far.
Basically, what you did is you installed KJ6 kernel, rooted it and install the kernel you built?
If yes, do you mind, allowing me to download the kernel you built in order to use it?

[Q] USB Host API on Semaphore ICS 1.2

(Unfortunately I couldn't post in the relevant thread because of forum permissions)
I'm using Semaphore ICS kernel 1.2 on my Galaxy S (Dark Knight 5.5). I tried to use the Android USB Host API. But UsbManager fails to enumerate all my devices.
I tried to circumvent the "normal" way by constructing and hacking my way by constructing UsbDevice, UsbInterface and UsbInterface manually by scanning the filesystem (/sys/bus/usb/devices)
In the end I still hit a wall -
Code:
public UsbDeviceConnection openDevice(UsbManager manager, UsbDevice device)
{
String devname = device.getDeviceName();
try
{
Field f = UsbManager.class.getDeclaredField("mService");
f.setAccessible(true);
Object service = f.get(manager);
if(service == null)
return null;
Class<?> IUsbManager = Class.forName("android.hardware.usb.IUsbManager");
Method opendevice = IUsbManager.getMethod("openDevice", new Class<?>[] { String.class });
opendevice.setAccessible(true);
ParcelFileDescriptor pfd = (ParcelFileDescriptor)opendevice.invoke(service, new Object[] { devname });
if(pfd == null)
return null;
Class<?> UsbDevConnection = UsbDeviceConnection.class;
Constructor<?> ctor = UsbDevConnection.getConstructor(new Class<?>[] { String.class, ParcelFileDescriptor.class });
ctor.setAccessible(true);
UsbDeviceConnection conn = (UsbDeviceConnection)ctor.newInstance(new Object[] { devname, pfd });
Method open = UsbDevConnection.getMethod("open", new Class<?>[] { UsbDevice.class });
open.setAccessible(true);
Boolean result = (Boolean)open.invoke(new Object[] { conn, device });
pfd.close();
if(result)
return conn;
}
catch(Exception ex)
{
Log.i("USB_MANAGER", "Exception: " + ex.getMessage());
}
return null;
}
Invoking IUsbDevice.open() would throw an exception:
java.lang.IllegalArgumentException: device /dev/bus/usb/001/002 does not exist or is restricted
Putting that aside, chmod -R 777 /dev/bus/usb with root permissions does not work.
I've ran out of hacks I could find... As this is supposed to be a supported feature in ICS installed on USB Host capable device, I resort to (wanting to) ask the kernel author on this issue here.
Edit:
Native USB access works (UHC managed to mount my thumb drives)
Same problem here. Have you fixed this?

Extracting boot.img and recovery.img

Hello,
I was hoping I could help port a custom recovery to the x86 platform, but I ran into a problem pretty early...:
I have extracted the boot and recovery partitionen images like this:
Code:
# cat /proc/partitions
major minor #blocks name alias
179 0 7766016 mmcblk0 (null)
179 1 11264 mmcblk0p1 bos
179 2 11264 mmcblk0p2 bosbackup
179 3 1024 mmcblk0p3 ulogo
179 4 1024 mmcblk0p4 logo
179 5 11264 mmcblk0p5 boot
179 6 11264 mmcblk0p6 recovery
179 7 128 mmcblk0p7 cid
179 8 2048 mmcblk0p8 sp
179 9 8192 mmcblk0p9 panic
179 10 512 mmcblk0p10 devtree
179 11 512 mmcblk0p11 devtreeBackup
259 0 8192 mmcblk0p12 pds
259 1 512 mmcblk0p13 misc
259 2 655360 mmcblk0p14 cache
259 3 153600 mmcblk0p15 cdrom
259 4 1253376 mmcblk0p16 system
259 5 5599471 mmcblk0p17 userdata
179 12 3872256 mmcblk1 (null)
179 13 2840820 mmcblk1p1
179 14 1000000 mmcblk1p2
179 15 31435 mmcblk1p3
# cat /dev/block/mmcblk0p6 > /external1/recovery.img
# cat /dev/block/mmcblk0p5 > /external1/boot.img
But I get the following message when I try to extract the recovery's ramdisk:
Code:
$ ./split_bootimg.pl recovery.img
Android Magic not found in recovery.img. Giving up.
I haven't had this problem before. Is it happening because the differences between the x86 and ARM images is too different?
Thanks!
EDIT:
I have extracted the kernel and ramdisk from the recovery.img using a Hex Editor. You'll find a link to the files below:
dl.dropbox.com/u/19117372/recovery_files.zip
That's what the theory is. Its stopping us from using the kernel source and making a custom recovery because we cannot unpack or pack them.
Sent from my XT890 using Tapatalk 2
mattlgroff said:
That's what the theory is. Its stopping us from using the kernel source and making a custom recovery because we cannot unpack or pack them.
Sent from my XT890 using Tapatalk 2
Click to expand...
Click to collapse
Apparently the script I used looks for this string: "ANDROID!" in the beginning of the binary file. But this image starts with "init=/init". Is there any other Android devices that does this?
I've downloaded the Android x86 ics source code from Intel and they use the standard:
Code:
#define BOOT_MAGIC "ANDROID!"
When packing the img.
V-g- said:
Apparently the script I used looks for this string: "ANDROID!" in the beginning of the binary file. But this image starts with "init=/init". Is there any other Android devices that does this?
I've downloaded the Android x86 ics source code from Intel and they use the standard:
Code:
#define BOOT_MAGIC "ANDROID!"
When packing the img.
Click to expand...
Click to collapse
It would be better to look at the other Intel Android Devices like the Orange San Diego and see what their images are. The Android x86 project doesn't even pack the boot.img from when I used it, but maybe I'm remembering wrong.
Sent from my XT890 using Tapatalk 2
mattlgroff said:
That's what the theory is. Its stopping us from using the kernel source and making a custom recovery because we cannot unpack or pack them.
Sent from my XT890 using Tapatalk 2
Click to expand...
Click to collapse
I've been able to unpack and repack the boot.img using a hex editor (same way we got insecure boot in the first place) and am able to manipulate the contents of the ramdisk, but have not been able to compile a recovery for Intel. As for the standard tools/scripts, I don't think they're capable of dealing with the second stage which is optional in the img format but used by the Razr i (http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images).
dew.man said:
I've been able to unpack and repack the boot.img using a hex editor (same way we got insecure boot in the first place) and am able to manipulate the contents of the ramdisk, but have not been able to compile a recovery for Intel. As for the standard tools/scripts, I don't think they're capable of dealing with the second stage which is optional in the img format but used by the Razr i (http://android-dls.com/wiki/index.php?title=HOWTO:_Unpack%2C_Edit%2C_and_Re-Pack_Boot_Images).
Click to expand...
Click to collapse
I think our best bet right now is to hope Motorola can give us documentation on this when the new MotoDev.com comes on November 1st. No device has really been in this position before, so the current tools and documentation aren't helpful. I appreciate you taking a look.
---------- Post added at 03:28 PM ---------- Previous post was at 03:19 PM ----------
Found this in the sourceforge under system_core.tar.gz:
Maybe helpful...maybe not. The tools could be in the sourceforge.
Android.mk
Code:
LOCAL_PATH:= $(call my-dir)
include $(CLEAR_VARS)
LOCAL_SRC_FILES := mkbootimg.c
LOCAL_STATIC_LIBRARIES := libmincrypt
LOCAL_MODULE := mkbootimg
include $(BUILD_HOST_EXECUTABLE)
$(call dist-for-goals,dist_files,$(LOCAL_BUILT_MODULE))
mkbootimg.c
Code:
/* tools/mkbootimg/mkbootimg.c
**
** Copyright 2007, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License");
** you may not use this file except in compliance with the License.
** You may obtain a copy of the License at
**
** http://www.apache.org/licenses/LICENSE-2.0
**
** Unless required by applicable law or agreed to in writing, software
** distributed under the License is distributed on an "AS IS" BASIS,
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
** See the License for the specific language governing permissions and
** limitations under the License.
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include "mincrypt/sha.h"
#include "bootimg.h"
static void *load_file(const char *fn, unsigned *_sz)
{
char *data;
int sz;
int fd;
data = 0;
fd = open(fn, O_RDONLY);
if(fd < 0) return 0;
sz = lseek(fd, 0, SEEK_END);
if(sz < 0) goto oops;
if(lseek(fd, 0, SEEK_SET) != 0) goto oops;
data = (char*) malloc(sz);
if(data == 0) goto oops;
if(read(fd, data, sz) != sz) goto oops;
close(fd);
if(_sz) *_sz = sz;
return data;
oops:
close(fd);
if(data != 0) free(data);
return 0;
}
int usage(void)
{
fprintf(stderr,"usage: mkbootimg\n"
" --kernel <filename>\n"
" --ramdisk <filename>\n"
" [ --second <2ndbootloader-filename> ]\n"
" [ --cmdline <kernel-commandline> ]\n"
" [ --board <boardname> ]\n"
" [ --base <address> ]\n"
" [ --pagesize <pagesize> ]\n"
" -o|--output <filename>\n"
);
return 1;
}
static unsigned char padding[4096] = { 0, };
int write_padding(int fd, unsigned pagesize, unsigned itemsize)
{
unsigned pagemask = pagesize - 1;
unsigned count;
if((itemsize & pagemask) == 0) {
return 0;
}
count = pagesize - (itemsize & pagemask);
if(write(fd, padding, count) != count) {
return -1;
} else {
return 0;
}
}
int main(int argc, char **argv)
{
boot_img_hdr hdr;
char *kernel_fn = 0;
void *kernel_data = 0;
char *ramdisk_fn = 0;
void *ramdisk_data = 0;
char *second_fn = 0;
void *second_data = 0;
char *cmdline = "";
char *bootimg = 0;
char *board = "";
unsigned pagesize = 2048;
int fd;
SHA_CTX ctx;
uint8_t* sha;
argc--;
argv++;
memset(&hdr, 0, sizeof(hdr));
/* default load addresses */
hdr.kernel_addr = 0x10008000;
hdr.ramdisk_addr = 0x11000000;
hdr.second_addr = 0x10F00000;
hdr.tags_addr = 0x10000100;
while(argc > 0){
char *arg = argv[0];
char *val = argv[1];
if(argc < 2) {
return usage();
}
argc -= 2;
argv += 2;
if(!strcmp(arg, "--output") || !strcmp(arg, "-o")) {
bootimg = val;
} else if(!strcmp(arg, "--kernel")) {
kernel_fn = val;
} else if(!strcmp(arg, "--ramdisk")) {
ramdisk_fn = val;
} else if(!strcmp(arg, "--second")) {
second_fn = val;
} else if(!strcmp(arg, "--cmdline")) {
cmdline = val;
} else if(!strcmp(arg, "--base")) {
unsigned base = strtoul(val, 0, 16);
hdr.kernel_addr = base + 0x00008000;
hdr.ramdisk_addr = base + 0x01000000;
hdr.second_addr = base + 0x00F00000;
hdr.tags_addr = base + 0x00000100;
} else if(!strcmp(arg, "--board")) {
board = val;
} else if(!strcmp(arg,"--pagesize")) {
pagesize = strtoul(val, 0, 10);
if ((pagesize != 2048) && (pagesize != 4096)) {
fprintf(stderr,"error: unsupported page size %d\n", pagesize);
return -1;
}
} else {
return usage();
}
}
hdr.page_size = pagesize;
if(bootimg == 0) {
fprintf(stderr,"error: no output filename specified\n");
return usage();
}
if(kernel_fn == 0) {
fprintf(stderr,"error: no kernel image specified\n");
return usage();
}
if(ramdisk_fn == 0) {
fprintf(stderr,"error: no ramdisk image specified\n");
return usage();
}
if(strlen(board) >= BOOT_NAME_SIZE) {
fprintf(stderr,"error: board name too large\n");
return usage();
}
strcpy(hdr.name, board);
memcpy(hdr.magic, BOOT_MAGIC, BOOT_MAGIC_SIZE);
if(strlen(cmdline) > (BOOT_ARGS_SIZE - 1)) {
fprintf(stderr,"error: kernel commandline too large\n");
return 1;
}
strcpy((char*)hdr.cmdline, cmdline);
kernel_data = load_file(kernel_fn, &hdr.kernel_size);
if(kernel_data == 0) {
fprintf(stderr,"error: could not load kernel '%s'\n", kernel_fn);
return 1;
}
if(!strcmp(ramdisk_fn,"NONE")) {
ramdisk_data = 0;
hdr.ramdisk_size = 0;
} else {
ramdisk_data = load_file(ramdisk_fn, &hdr.ramdisk_size);
if(ramdisk_data == 0) {
fprintf(stderr,"error: could not load ramdisk '%s'\n", ramdisk_fn);
return 1;
}
}
if(second_fn) {
second_data = load_file(second_fn, &hdr.second_size);
if(second_data == 0) {
fprintf(stderr,"error: could not load secondstage '%s'\n", second_fn);
return 1;
}
}
/* put a hash of the contents in the header so boot images can be
* differentiated based on their first 2k.
*/
SHA_init(&ctx);
SHA_update(&ctx, kernel_data, hdr.kernel_size);
SHA_update(&ctx, &hdr.kernel_size, sizeof(hdr.kernel_size));
SHA_update(&ctx, ramdisk_data, hdr.ramdisk_size);
SHA_update(&ctx, &hdr.ramdisk_size, sizeof(hdr.ramdisk_size));
SHA_update(&ctx, second_data, hdr.second_size);
SHA_update(&ctx, &hdr.second_size, sizeof(hdr.second_size));
sha = SHA_final(&ctx);
memcpy(hdr.id, sha,
SHA_DIGEST_SIZE > sizeof(hdr.id) ? sizeof(hdr.id) : SHA_DIGEST_SIZE);
fd = open(bootimg, O_CREAT | O_TRUNC | O_WRONLY, 0644);
if(fd < 0) {
fprintf(stderr,"error: could not create '%s'\n", bootimg);
return 1;
}
if(write(fd, &hdr, sizeof(hdr)) != sizeof(hdr)) goto fail;
if(write_padding(fd, pagesize, sizeof(hdr))) goto fail;
if(write(fd, kernel_data, hdr.kernel_size) != hdr.kernel_size) goto fail;
if(write_padding(fd, pagesize, hdr.kernel_size)) goto fail;
if(write(fd, ramdisk_data, hdr.ramdisk_size) != hdr.ramdisk_size) goto fail;
if(write_padding(fd, pagesize, hdr.ramdisk_size)) goto fail;
if(second_data) {
if(write(fd, second_data, hdr.second_size) != hdr.second_size) goto fail;
if(write_padding(fd, pagesize, hdr.ramdisk_size)) goto fail;
}
return 0;
fail:
unlink(bootimg);
close(fd);
fprintf(stderr,"error: failed writing '%s': %s\n", bootimg,
strerror(errno));
return 1;
}
bootimg.h
Code:
/* tools/mkbootimg/bootimg.h
**
** Copyright 2007, The Android Open Source Project
**
** Licensed under the Apache License, Version 2.0 (the "License");
** you may not use this file except in compliance with the License.
** You may obtain a copy of the License at
**
** http://www.apache.org/licenses/LICENSE-2.0
**
** Unless required by applicable law or agreed to in writing, software
** distributed under the License is distributed on an "AS IS" BASIS,
** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
** See the License for the specific language governing permissions and
** limitations under the License.
*/
#ifndef _BOOT_IMAGE_H_
#define _BOOT_IMAGE_H_
typedef struct boot_img_hdr boot_img_hdr;
#define BOOT_MAGIC "ANDROID!"
#define BOOT_MAGIC_SIZE 8
#define BOOT_NAME_SIZE 16
#define BOOT_ARGS_SIZE 512
struct boot_img_hdr
{
unsigned char magic[BOOT_MAGIC_SIZE];
unsigned kernel_size; /* size in bytes */
unsigned kernel_addr; /* physical load addr */
unsigned ramdisk_size; /* size in bytes */
unsigned ramdisk_addr; /* physical load addr */
unsigned second_size; /* size in bytes */
unsigned second_addr; /* physical load addr */
unsigned tags_addr; /* physical addr for kernel tags */
unsigned page_size; /* flash page size we assume */
unsigned unused[2]; /* future expansion: should be 0 */
unsigned char name[BOOT_NAME_SIZE]; /* asciiz product name */
unsigned char cmdline[BOOT_ARGS_SIZE];
unsigned id[8]; /* timestamp / checksum / sha1 / etc */
};
/*
** +-----------------+
** | boot header | 1 page
** +-----------------+
** | kernel | n pages
** +-----------------+
** | ramdisk | m pages
** +-----------------+
** | second stage | o pages
** +-----------------+
**
** n = (kernel_size + page_size - 1) / page_size
** m = (ramdisk_size + page_size - 1) / page_size
** o = (second_size + page_size - 1) / page_size
**
** 0. all entities are page_size aligned in flash
** 1. kernel and ramdisk are required (size != 0)
** 2. second is optional (second_size == 0 -> no second)
** 3. load each element (kernel, ramdisk, second) at
** the specified physical address (kernel_addr, etc)
** 4. prepare tags at tag_addr. kernel_args[] is
** appended to the kernel commandline in the tags.
** 5. r0 = 0, r1 = MACHINE_TYPE, r2 = tags_addr
** 6. if second_size != 0: jump to second_addr
** else: jump to kernel_addr
*/
#if 0
typedef struct ptentry ptentry;
struct ptentry {
char name[16]; /* asciiz partition name */
unsigned start; /* starting block number */
unsigned length; /* length in blocks */
unsigned flags; /* set to zero */
};
/* MSM Partition Table ATAG
**
** length: 2 + 7 * n
** atag: 0x4d534d70
** <ptentry> x n
*/
#endif
#endif
http://www.sourceforge.net/motorola/razr-i/
dew.man said:
I've been able to unpack and repack the boot.img using a hex editor (same way we got insecure boot in the first place) and am able to manipulate the contents of the ramdisk, but have not been able to compile a recovery for Intel. As for the standard tools/scripts, I don't think they're capable of dealing with the second stage which is optional in the img format but used by the Razr i.
Click to expand...
Click to collapse
Great! - Would you mind sharing how you did it?
V-g- said:
Great! - Would you mind sharing how you did it?
Click to expand...
Click to collapse
http://forum.xda-developers.com/showpost.php?p=32406634&postcount=120
Hey guys currently trying it too, because i realy need my lovely cwm
when i open the boot.img i see this:
androidboot.bootmedia=sdcard
so if i theoretically would change that to external1
would it boot from my sdcard?!

[HELP] why Zygisk need to force dlopen /system/bin/app_process

1. Why use android_dlopen_ext in the first_stage_entry function to force open /system/bin/app_process?
2. Why dlclose immediately after dlopen in second_stage_entry? Why do it?
// native/jni/zygisk/entry.cpp
static void first_stage_entry() {
android_logging();
ZLOGD("inject 1st stage\n");
char path[PATH_MAX];
char buf[256];
char *ld = getenv("LD_PRELOAD");
if (char *c = strrchr(ld, ':')) {
*c = '\0';
strlcpy(path, c + 1, sizeof(path));
setenv("LD_PRELOAD", ld, 1); // Restore original LD_PRELOAD
} else {
unsetenv("LD_PRELOAD");
strlcpy(path, ld, sizeof(path));
}
// Force the linker to load the library on top of ourselves, so we do not
// need to unmap the 1st stage library that was loaded with LD_PRELOAD.
int fd = xopen(path, O_RDONLY | O_CLOEXEC);
// Use fd here instead of path to make sure inode is the same as 2nd stage
snprintf(buf, sizeof(buf), "%d", fd);
setenv(MAGISKFD_ENV, buf, 1);
struct stat s{};
xfstat(fd, &s);
android_dlextinfo info {
.flags = ANDROID_DLEXT_FORCE_LOAD | ANDROID_DLEXT_USE_LIBRARY_FD,
.library_fd = fd,
};
// 通过 inode 在 maps 中搜索 /sbin/magisk(app_process) 对应的内存区域
auto [addr, size] = find_map_range(path, s.st_ino);
if (addr && size) {
// 下面使用 android_dlopen_ext 重复加载 /sbin/magisk,
// 通过 reserved_addr 强制覆盖内存.
info.flags |= ANDROID_DLEXT_RESERVED_ADDRESS;
info.reserved_addr = addr;
// The existing address is guaranteed to fit, as 1st stage and 2nd stage
// are exactly the same ELF (same inode). However, the linker could over
// estimate the required size and refuse to dlopen. The estimated size
// is not accurate so size the size to unlimited.
info.reserved_size = -1;
}
setenv(INJECT_ENV_2, "1", 1);
// Force dlopen ourselves to make ourselves dlclose-able.
// After this call, all global variables will be reset.
// 重复加载 /sbin/magisk 到内存, 覆盖之后全局变量将被重置
// 这里为什么要强制 dlopen? 只是为了以后可以使用 dlclose 释放 zygisk 吗????
android_dlopen_ext(path, RTLD_LAZY, &info);
}
Code:
// // native/jni/zygisk/entry.cpp
static void second_stage_entry() {
zygisk_logging();
ZLOGD("inject 2nd stage\n");
char path[PATH_MAX];
MAGISKTMP = getenv(MAGISKTMP_ENV);
int fd = parse_int(getenv(MAGISKFD_ENV));
snprintf(path, sizeof(path), "/proc/self/fd/%d", fd);
xreadlink(path, path, PATH_MAX);
android_dlextinfo info {
.flags = ANDROID_DLEXT_USE_LIBRARY_FD,
.library_fd = fd,
};
// 这里的dlopen并不会重新调用 zygisk_init, 这里是假的dlopen? 只是为了下一行的 dlclose?
// 为什么要这样做?
// Why do this?
self_handle = android_dlopen_ext(path, RTLD_LAZY, &info);
dlclose(self_handle);
close(fd);
unsetenv(MAGISKTMP_ENV);
unsetenv(MAGISKFD_ENV);
sanitize_environ();
hook_functions();
}

Categories

Resources