[DEVS-ONLY] SuperSU developer discussion

Search This thread

nkk71

Inactive Recognized Developer / Contributor
May 26, 2010
8,741
7,571
53
Beirut
Thanks for the update. I'll have a look at those commands. losetup -f is specifically not used because I have already encountered devices/recoveries where the built-in losetup does not support this flag. So just loop0 and loop1 are tried, on failure, too bad (guess that could use improvement, hehe). The same goes for the -b test for if, and the -f flag for readlink. While I have not specifically tested the block device test, I know the symlink test fails on some devices. So I need to do some testing.

This is why some things in the ZIP are done is such weird ways instead of just using standard command, they're all work-arounds for encounted recovery versions that didn't support command X or flag Y ...

If it's just regarding MultiROM Recovery versions, then I believe I can fix the loop device release, even without touching your script; MultiROM Recovery does indeed release loop devices, but after it tries to unmount the partitions first; I could rewrite that, to release /data/su.img before starting the other unmounts.

But regarding the dd command, that's going to be an issue... we could work around it with some kind of specific check just for this, but that is not ideal; I'm sure you have your reasons why to first null out the partition (not needed on my devices), before flashing the real kernel, but if the readlink & block device checks are unreliable, perhaps just limit the amount of data dd nulls out
giving dd "free reign" to null out as much as it possible can, could also be potentially unwanted for other recoveries/devices
 

Chainfire

Moderator Emeritus / Senior Recognized Developer
Oct 2, 2007
11,452
87,862
www.chainfire.eu
If it's just regarding MultiROM Recovery versions, then I believe I can fix the loop device release, even without touching your script; MultiROM Recovery does indeed release loop devices, but after it tries to unmount the partitions first; I could rewrite that, to release /data/su.img before starting the other unmounts.

But regarding the dd command, that's going to be an issue... we could work around it with some kind of specific check just for this, but that is not ideal; I'm sure you have your reasons why to first null out the partition (not needed on my devices), before flashing the real kernel, but if the readlink & block device checks are unreliable, perhaps just limit the amount of data dd nulls out
giving dd "free reign" to null out as much as it possible can, could also be potentially unwanted for other recoveries/devices

Oh, I wasn't saying the changes won't happen, just that it may not be a copy/paste of what you stated.

For example, the way it will be used in the script with the expected input and output, "readlink -f FILE" can be replaced with "readlink FILE || echo FILE" twice.

Similarly, instead if "if -b" a "grep /dev/block" after using readlink should work.

Is it 100% foolproof? No. But I'll bet it'll work on every recovery/device currently out there.

As for releasing /data/su.img, I will definitely put this into the script as well. No need to patch MultiROM.
 

Chainfire

Moderator Emeritus / Senior Recognized Developer
Oct 2, 2007
11,452
87,862
www.chainfire.eu

Please see the attached version.

Reading again through this thread, I believe the following issues have been fixed:

- The symlink of the boot image partition to somewhere outside /dev/block is now detected, and the wipe skipped
- The loop device link to the /data/su.img or /cache/su.img file is now released after unmount
- The remount_ro section in launch_daemonsu.sh has been removed, as I now have a different workaround for the remount r/w issue
- If 'setprop sukernel.mount 1' fails to mount, a fallback attempt is made with losetup

That should cover all the issues you raised (correct me if I'm wrong), and hopefully this makes the entire thing work with MultiROM. Please do let me know :)
 

Attachments

  • SuperSU-v2.66-20160121002226.zip
    4.1 MB · Views: 261

nkk71

Inactive Recognized Developer / Contributor
May 26, 2010
8,741
7,571
53
Beirut
Please see the attached version.

Reading again through this thread, I believe the following issues have been fixed:

- The symlink of the boot image partition to somewhere outside /dev/block is now detected, and the wipe skipped
- The loop device link to the /data/su.img or /cache/su.img file is now released after unmount
- The remount_ro section in launch_daemonsu.sh has been removed, as I now have a different workaround for the remount r/w issue
- If 'setprop sukernel.mount 1' fails to mount, a fallback attempt is made with losetup

That should cover all the issues you raised (correct me if I'm wrong), and hopefully this makes the entire thing work with MultiROM. Please do let me know :)

A late reply (I see 2.67 is already out), but ran into a little hiccup :eek:

But can confirm all issues are fixed with your attached zip for MultiROM :good::good:
  1. Installer
    • no longer causes unneccessary wiping
    • releases loop device fine
      .
  2. Bootup behaves as expected
    • first boot will reboot after installing the apk
    • second boot works fine, SuperSU fully functional

Many thanks @Chainfire :highfive:


If I figure out why the setprop didnt work, I'll post back

Also, just an fyi, not sure how important / relevant / intended they are, since SuperSU flashes and works just fine:

1- extract of recovery.log:
Code:
- System-less mode, boot image support required
- Creating image
Creating filesystem with parameters:
    Size: 33554432
    Block size: 4096
    Blocks per group: 32768
    Inodes per group: 2048
    Inode size: 256
    Journal blocks: 1024
    Label: 
    Blocks: 8192
    Block groups: 1
    Reserved block group size: 7
Created filesystem with 11/2048 inodes and 1166/8192 blocks
/data/su.img: clean, 11/2048 files, 1166/8192 blocks
- Mounting image
mknod: /dev/block/loop0: File exists
[B][COLOR="Red"]CANNOT LINK EXECUTABLE: cannot locate symbol "__register_atfork" referenced by "/system/bin/toolbox"...[/COLOR][/B]
page record for 0xb6ef304c was not found (block_size=32)
- Creating paths
- Removing old files

2- Patching sepolicy
Code:
check_zero_def "" "LD_LIBRARY_PATH=$SYSTEMLIB 
/su/bin/sukernel --cpio-add /sutmp/ramdisk 
/sutmp/ramdisk [B][COLOR="Blue"]644[/COLOR][/B] sepolicy /sutmp/sepolicy_patched"
Code:
-rw-rw-rw-    1 root     root       2279160 Jan 21 17:19 ramdisk
-rw-rw-rw-    1 root     root       1199423 Jan 21 17:19 ramdisk.packed
-rw-rw-rw-    1 root     root        240961 Jan 21 17:19 sepolicy
[COLOR="Red"]-rw-------[/COLOR]    1 root     root        243577 Jan 21 17:19 sepolicy_patched

Neither of the above two affect anything, as far as I can see, just mentioning it
 
  • Like
Reactions: Chainfire

Surge1223

Recognized Contributor
Nov 6, 2012
2,622
7,466
Florida
Google Pixel 6 Pro
@Chainfire are you using sush to change the default path? After boot even though init.environ.rc is patched? The reason I ask is because when I switch to root user in shell and thus the shell changes from mksh to sush, my path changes and for some reason sbin isn't in either path (not as su or default shell user)

I noticed sush evaluates the default path but I don't know if this is intentional or if it's related to something I've messed up on my part

The only differences from the patched ramdisk that supersu 2.66/67 creates and my current ramdisk is that I changed the perms for /su to 750 instead of 755 and I added some paths to init.environ.rc

Code:
# set up the global environment
on init
    export PATH /su/bin:/sbin:/vendor/bin:/system/sbin:/system/bin:/su/xbin:/system/xbin:/sbin:/data/local/tmp:/data/toolchain/bin:/tmp/bin
setenv LD_LIBRARY_PATH /data/vendor/lib64:/vendor/lib64:/data/lib64:/system/lib64:/data/vendor/lib:/vendor/lib:/data/lib:/system/lib:/data/toolchain/lib
    export ANDROID_BOOTLOGO 1
    export ANDROID_ROOT /system
    export ANDROID_ASSETS /system/app
    export ANDROID_DATA /data
    export ANDROID_STORAGE /storage
    export EXTERNAL_STORAGE /sdcard
    export ASEC_MOUNTPOINT /mnt/asec
    export BOOTCLASSPATH /system/framework/core-libart.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/ims-common.jar:/system/framework/apache-xml.jar:/system/framework/org.apache.http.legacy.boot.jar
    export SYSTEMSERVERCLASSPATH /system/framework/services.jar:/system/framework/ethernet-service.jar:/system/framework/wifi-service.jar
 

Attachments

  • 1453414994937.jpg
    1453414994937.jpg
    166.6 KB · Views: 341
  • Like
Reactions: davidwilson83

Chainfire

Moderator Emeritus / Senior Recognized Developer
Oct 2, 2007
11,452
87,862
www.chainfire.eu
@Chainfire are you using sush to change the default path? After boot even though init.environ.rc is patched? The reason I ask is because when I switch to root user in shell and thus the shell changes from mksh to sush, my path changes and for some reason sbin isn't in either path (not as su or default shell user)

sush is just a copy of /system/bin/sh with a different SELinux context applied. Nothing more, nothing less.

I noticed sush evaluates the default path but I don't know if this is intentional or if it's related to something I've messed up on my part

I don't know either. /sbin is in my $PATH on my test device both with and without root.

The only differences from the patched ramdisk that supersu 2.66/67 creates and my current ramdisk is that I changed the perms for /su to 750 instead of 755 and I added some paths to init.environ.rc

Why would you change it to 750 ?

Not sure if your env changes can cause this, tbh.
 
  • Like
Reactions: Surge1223

nkk71

Inactive Recognized Developer / Contributor
May 26, 2010
8,741
7,571
53
Beirut
@Chainfire regarding that hiccup (courtesy of @Captain_Throwback ) , I mentioned earlier, it seems it's back / still there.

At first we thought it's due to the size of the kernel, but turns out that's not the issue.

Trying to find the cause is proving difficult, so I'll just summarize my findings as best I can:


When installing SuperSU 2.67 from within a custom rom (twrp flashable zip), it fails to properly create the new boot.img (it's truncated for some reason):

extract of the updater-script:
Code:
set_progress(0.700000);
ui_print("Extracting boot image...");
ui_print(" ");
package_extract_file("boot.img", "/dev/block/platform/msm_sdcc.1/by-name/boot");
set_progress(0.800000);
#ROOT
ui_print("Installing SuperSU..."); ui_print(" ");
package_extract_dir("supersu", "/tmp/supersu");
run_program("/sbin/busybox", "unzip", "/tmp/supersu/BETA-SuperSU-v2.67.zip", "META-INF/com/google/android/*", "-d", "/tmp/supersu");
run_program("/sbin/busybox", "sh", "/tmp/supersu/META-INF/com/google/android/update-binary", "dummy", "0", "/tmp/supersu/BETA-SuperSU-v2.67.zip");
ui_print(" ");

extract of the recovery.log error
(towards the end of the SuperSU script, when it runs
/su/bin/sukernel --bootimg-replace-ramdisk $STOCKBOOTIMAGE /sutmp/ramdisk.packed /sutmp/boot.img)
Code:
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire
 
Loading from [/dev/block/mmcblk0p42] ...
 
magic: [ANDROID!]
kernel: [6662360] (6664192) @ 0x00008000
ramdisk: [1193431] (1193984) @ 0x02000000
second: [0] (0) @ 0x00f00000
tags: @ 0x01e00000
page size: 2048
unused: [0x0040f800] [0x00000000]
dtb(?): [4257792] (4257792)
name: []
command line: [console=ttyHSL0,115200,n8 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x3b7 ehci-hcd.park=3]
extra command line: []
id: [0xc760d7abbc1949e9deaa692a43b1f4b1deee5c43000000000000000000000000]
 
Loading from [/sutmp/ramdisk.packed] ...
 
Saving to [/sutmp/boot.img] ...
 
magic: [ANDROID!]
kernel: [6662360] (6664192) @ 0x00008000
ramdisk: [1200876] (1202176) @ 0x02000000
second: [0] (0) @ 0x00f00000
tags: @ 0x01e00000
page size: 2048
unused: [0x0040f800] [0x00000000]
dtb(?): [4257792] (4257792)
name: []
command line: [console=ttyHSL0,115200,n8 androidboot.hardware=qcom user_debug=30 msm_rtb.filter=0x3b7 ehci-hcd.park=3]
extra command line: []
id: [0xaba2324aa866e82c9a07e21a90b4ea37d01877aa000000000000000000000000]
 
[B][SIZE="3"][COLOR="Red"]Could not write data[/COLOR][/SIZE][/B]
2954+0 records in
2954+0 records out
[B][COLOR="Red"]12099584 [/COLOR][/B]bytes (11.5MB) copied, 0.095180 seconds, 121.2MB/s
 
script result was [M8 GPE 5.07.1700.9 CDMA Edition Installed]
 
M8 GPE 5.07.1700.9 CDMA Edition Installed
I:Legacy property environment disabled.
rm: can't remove 'META-INF/com/google/android': No such file or directory
ZIP successfully installed
I:Running cmd "rm "/dev/block/mmcblk0p42""
I:Running cmd "mv "/dev/block/mmcblk0p42"-orig "/dev/block/mmcblk0p42""
Restoring mounts...
It says succeeded, but the log shows "Could not write data",
and the resulting boot.img is actually too small (it should be 12126208 bytes, not 12099584) and therefore corrupt (which will throw an error, since multirom can inject it's own changes into the kernel)


I've tried debugging, but results are quite confusing :eek:

1- added a sleep command just after
check_zero_def "- Creating boot image" "LD_LIBRARY_PATH=$SYSTEMLIB /su/bin/sukernel --bootimg-replace-ramdisk $STOCKBOOTIMAGE /sutmp/ramdisk.packed /sutmp/boot.img"
checked the recovery log, and it showed "Could not write data" (and incorrect size of boot.img in /sutmp)
opened an adb shell and manually ran
/su/bin/sukernel --bootimg-replace-ramdisk /dev/block/mmcblk0p42 /sutmp/ramdisk.packed /sutmp/boot.img
(p42 is the same as the script is using)
--> succeeded with correct boot.img size, let the script continue and all went well


2- put the script to sleep, and manually ran all the commands from adb shell
Code:
/su/bin/sukernel --bootimg-extract-ramdisk /dev/block/mmcblk0p42 /sutmp/ramdisk.packed
/su/bin/sukernel --ungzip /sutmp/ramdisk.packed /sutmp/ramdisk
/su/bin/sukernel --cpio-extract /sutmp/ramdisk sepolicy /sutmp/sepolicy
/su/bin/supolicy --file /sutmp/sepolicy /sutmp/sepolicy_patched
/su/bin/sukernel --cpio-add /sutmp/ramdisk /sutmp/ramdisk 644 sepolicy /sutmp/sepolicy_patched
/su/bin/sukernel --cpio-add /sutmp/ramdisk /sutmp/ramdisk 700 sbin/launch_daemonsu.sh /tmp/supersu/common/launch_daemonsu.sh
/su/bin/sukernel --patch /sutmp/ramdisk /sutmp/ramdisk /dev/block/mmcblk0p42
/su/bin/sukernel --gzip /sutmp/ramdisk /sutmp/ramdisk.packed
/su/bin/sukernel --bootimg-replace-ramdisk /dev/block/mmcblk0p42 /sutmp/ramdisk.packed /sutmp/boot.img
once using "/sutmp/tst_boot.img" and once directly with "/dev/block/mmcblk0p42", as the script would do
-> both generated the correct patched boot.img


3- changed the SuperSU update-binary to include at line 1184 (after the patch check, but before patching the kernel):
Code:
    cp $STOCKBOOTIMAGE /sutmp/wrk_boot.img
    STOCKBOOTIMAGE=/sutmp/wrk_boot.img
--> succeeded, no issues


I tried playing around with sukernel a bit, and found the following very curious:
Code:
C:\ADB\ADB_M8>[B][COLOR="Blue"]adb push C:\ADB\ADB_M8\MM3\tst_boot.img /tmp[/COLOR][/B]
3705 KB/s ([COLOR="Green"]12118016 [/COLOR]bytes in 3.193s)
 
C:\ADB\ADB_M8>[B][COLOR="Blue"]adb shell[/COLOR][/B]

~ # [6n [B][COLOR="Blue"]/su/bin/sukernel --backup /tmp/tst_boot.img[/COLOR][/B]
/su/bin/sukernel --backup /tmp/tst_boot.img
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire
 
[/tmp/tst_boot.img]([COLOR="Green"]12118016[/COLOR]) --> [/data/stock_boot_[COLOR="Green"]22acb886172c5eb575bfd7c9ee070fc2f2cc8bf7[/COLOR].img.gz](8629168)
 
 
~ # [6n [B][COLOR="Blue"]dd if=/tmp/tst_boot.img of=/dev/block/mmcblk0p42[/COLOR][/B]
dd if=/tmp/tst_boot.img of=/dev/block/mmcblk0p42
23668+0 records in
23668+0 records out
12118016 bytes (11.6MB) copied, 0.398213 seconds, 29.0MB/s
 
 
~ # [6n [B][COLOR="Blue"]/su/bin/sukernel --backup /dev/block/mmcblk0p42[/COLOR][/B]
/su/bin/sukernel --backup /dev/block/mmcblk0p42
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire
 
[/dev/block/mmcblk0p42]([COLOR="Red"]12058624[/COLOR]) --> [/data/stock_boot_[COLOR="Red"]18effe115987f74d93b0657b3da93c2e4e95a7f6[/COLOR].img.gz](8616560)
 
 
~ # [6n [B][COLOR="Blue"]sha1sum /dev/block/mmcblk0p42[/COLOR][/B]
sha1sum /dev/block/mmcblk0p42
[COLOR="Green"]22acb886172c5eb575bfd7c9ee070fc2f2cc8bf7[/COLOR]  /dev/block/mmcblk0p42

Hope this helps you narrow it down

PS: at first I thought it was a memory issue, but that is sort of ruled out by the --backup command, and number 2 and 3 above
 

nkk71

Inactive Recognized Developer / Contributor
May 26, 2010
8,741
7,571
53
Beirut
This only happens when SuperSU is embedded in another ZIP ?

It does smell of a memory issue, but indeed the output is weird.

Yes, only when embedded in another ZIP.

I tried the exact same ROM without SuperSU installation chained in the installer; then immediately flashed SuperSU 2.67 afterwards, and it went through perfectly.
Also using the copy to a tmp file "wrk_boot.img", also worked fine directly in the embedded zip.

What I find most peculiar is the output of the --backup , which was done on a clean reboot into recovery, so plenty of free space
- backing up from file, yields proper size and sha1
- backing up from "fake" mmcblk, yields incorrect size and wrong sha1
---- but running sha1sum on the fake mmcblk gives the correct sha1
---- and cp from fake mmcblk, as well as dd from fake mmcblk, also work properly

As for the memory issue, I'm honestly uncertain, the device in question is the HTC One M8 (tested on GSM and Sprint variants), which reports 1.8GB space in recovery, 1.6GB free.
The ROM itself is ~500MB compressed and ~1GB uncompressed, that should still leave enough "working space" for pretty much anything
 

Flyview

Senior Member
May 17, 2010
2,557
1,675
Toronto/San Diego
Hey @Chainfire , I've been using the context switching command to make the root commands work in my app LeanDroid. You probably don't remember but when Lollipop was new you showed me how to use your SuperSU library to switch context to system. As I understood this was in order to get around selinux restricting my root commands which involve system processes. My app calls the "phone" service through root and it seems that they only work by switching the context to system. I have been requiring my users to have SuperSU as their root, as for example CyanogenMod's built in root still isn't working. Is SuperSU still the only root option that allows context switching or can I code the call to work with other root modules as well?

Thanks for your time!

Code:
if(systemAppContext) {
                    Shell.run("su --context u:r:system_app:s0", commands, null, false);
                } else {
                    Shell.SU.run(commands);
                }
 

Manh_IT

Senior Member
Feb 10, 2013
681
1,481
Ha Noi
choimobile.vn
Try Root G925S Android 6.0.1

I tried to modified ramdisk to Root G925S - Android 6.0.1 Rom, but get bootloop!

I see su binary,... in /system/xbin/ and symlink app_process > daemonsu in /system/bin/, but symlink app_process64 > daemonsu is missing

My modified:
- Patched sepolicy by SuperSU 2.67 via N920P - Android 5.1.1 devices
- Remove ",support_scfs,verify" in fstab files
- Add /sbin/injectsu.sh , /sbin/busybox & sbin/su/ (include SuperSU 2.67 binary files,...)
Code:
#!/system/bin/sh

/sbin/busybox mount -o remount,rw /system

# Inject SuperSU
if [ ! -f /system/xbin/su ]; then
	# Make necessary folders
	/sbin/busybox mkdir /system/etc/init.d

	# Extract SU from ramdisk to correct locations
	/sbin/busybox rm -rf /system/bin/app_process
	/sbin/busybox rm -rf /system/bin/install-recovery.sh
	/sbin/busybox cp /sbin/su/supolicy /system/xbin/
	/sbin/busybox cp /sbin/su/su /system/xbin/
	/sbin/busybox cp /sbin/su/libsupol.so /system/lib64/
	/sbin/busybox cp /sbin/su/install-recovery.sh /system/etc/
	/sbin/busybox cp /sbin/su/99SuperSUDaemon /system/etc/init.d/

	# Begin SuperSU install process
	/sbin/busybox cp /system/xbin/su /system/xbin/daemonsu
	/sbin/busybox cp /system/xbin/su /system/xbin/sugote
	/sbin/busybox cp /system/bin/sh /system/xbin/sugote-mksh
	/sbin/busybox mkdir -p /system/bin/.ext
	/sbin/busybox cp /system/xbin/su /system/bin/.ext/.su

	/sbin/busybox cp /system/bin/app_process64 /system/bin/app_process_init
	/sbin/busybox mv /system/bin/app_process64 /system/bin/app_process64_original

	/sbin/busybox echo 1 > /system/etc/.installed_su_daemon

	/sbin/busybox chmod 755 /system/xbin/su
	/sbin/busybox chmod 755 /system/xbin/daemonsu
	/sbin/busybox chmod 755 /system/xbin/sugote
	/sbin/busybox chmod 755 /system/xbin/sugote-mksh
	/sbin/busybox chmod 755 /system/xbin/supolicy
	/sbin/busybox chmod 777 /system/bin/.ext
	/sbin/busybox chmod 755 /system/bin/.ext/.su
	/sbin/busybox chmod 755 /system/bin/app_process_init
	/sbin/busybox chmod 755 /system/bin/app_process64_original
	/sbin/busybox chmod 644 /system/lib64/libsupol.so
	/sbin/busybox chmod 755 /system/etc/install-recovery.sh
	/sbin/busybox chmod 644 /system/etc/.installed_su_daemon
	
	/sbin/busybox ln -s /system/etc/install-recovery.sh /system/bin/install-recovery.sh
	/sbin/busybox ln -s /system/xbin/daemonsu /system/bin/app_process
	/sbin/busybox ln -s /system/xbin/daemonsu /system/bin/app_process64

	/system/xbin/su --install
fi

# Inject Busybox if not present
if [ ! -f /system/xbin/busybox ]; then
	/sbin/busybox cp /sbin/busybox /system/xbin/
	/sbin/busybox chmod 755 /system/xbin/busybox
	/system/xbin/busybox --install -s /system/xbin
fi
	
# Kill securitylogagent
if [ -d /system/app/SecurityLogAgent ]; then
	/sbin/busybox rm -fR /system/app/SecurityLogAgent
	/sbin/busybox rm -fR /system/priv-app/KLMSAgent
	/sbin/busybox rm -fR /system/app/*Knox*
	/sbin/busybox rm -fR /system/app/*KNOX*
	/sbin/busybox rm -fR /system/container
	/sbin/busybox rm -fR /system/app/Bridge
	/sbin/busybox rm -fR /system/app/BBCAgent
	/sbin/busybox rm -fR /system/priv-app/FotaClient
	/sbin/busybox rm -fR /system/priv-app/SyncmIDM
	/sbin/busybox rm -fR /system/priv-app/*FWUpdate*
fi
	
# Enforce init.d script perms on any post-root added files
/sbin/busybox chmod 755 /system/etc/init.d
/sbin/busybox chmod 755 /system/etc/init.d/*

# Run init.d scripts
/sbin/busybox mount -t rootfs -o remount,rw rootfs
/sbin/busybox run-parts /system/etc/init.d

# Deep sleep fix
if [ ! -d /system/su.d ]; then
	/sbin/busybox mkdir /system/su.d
	/sbin/busybox chmod 0700 /system/su.d
	if [ ! -f /system/su.d/000000deepsleep ]; then
		/sbin/busybox cp -f /sbin/su/000000deepsleep /system/su.d/
		/sbin/busybox chmod 0700 /system/su.d/000000deepsleep
	fi
	/system/bin/reboot
fi

#  Wait for 5 seconds from boot before starting the SuperSU daemon
/sbin/busybox sleep 5
/system/xbin/daemonsu --auto-daemon &

sync

- Add lines to init.rc file
Code:
# Inject SuperSU
service daemonsu /sbin/injectsu.sh
    class late_start
    user root
    seclabel u:r:init:s0
    oneshot

Sorry bad english
 
Last edited:
  • Like
Reactions: thanhnvt194

Chainfire

Moderator Emeritus / Senior Recognized Developer
Oct 2, 2007
11,452
87,862
www.chainfire.eu
Yes, only when embedded in another ZIP.

...

Have you had any more discoveries about this by any chance?

Hey @Chainfire , I've been using the context switching command to make the root commands work in my app LeanDroid. You probably don't remember but when Lollipop was new you showed me how to use your SuperSU library to switch context to system. As I understood this was in order to get around selinux restricting my root commands which involve system processes. My app calls the "phone" service through root and it seems that they only work by switching the context to system. I have been requiring my users to have SuperSU as their root, as for example CyanogenMod's built in root still isn't working. Is SuperSU still the only root option that allows context switching or can I code the call to work with other root modules as well?

Thanks for your time!

Code:
if(systemAppContext) {
                    Shell.run("su --context u:r:system_app:s0", commands, null, false);
                } else {
                    Shell.SU.run(commands);
                }

This should probably have gone into the 'How-To SU' thread.

I don't really know which other root tools can and can't do this. You'll have to do that investigation yourself.

I tried to modified ramdisk to Root G925S - Android 6.0.1 Rom, but get bootloop!

...


Why would you even do this instead of normal SuperSU installation? I don't know why exactly it doesn't work, but you're asking for issues.
 

dr.ketan

Recognized Developer / Recognized Contributor
Have you had any more discoveries about this by any chance?
.
I have seen two roms today in N5 developer section and seems rom having stock kernel and system less root so embedded in other zip should work. Though I have not look script but just for acknowledge if @nkk71 want to explore.
 

nkk71

Inactive Recognized Developer / Contributor
May 26, 2010
8,741
7,571
53
Beirut
I have seen two roms today in N5 developer section and seems rom having stock kernel and system less root so embedded in other zip should work. Though I have not look script but just for acknowledge if @nkk71 want to explore.
I don't think it's an issue with the script.


Have you had any more discoveries about this by any chance?

I just went through some more debugging, and the issue seems to be with sukernel when accessing files or symlinks in the /dev/ subfolder... long story short it truncates down to the nearest 65536 block size:

Code:
tst_BLOCKSIZE        Original   Truncated
                     12148736    12124160
    65536             [COLOR="Red"]185.375[/COLOR]         [COLOR="Blue"]185[/COLOR]

Test: 186x65536..:   [COLOR="Blue"]12189696[/COLOR]

test 2: +/- 1byte:   12189697    12189695
Result...........:   [COLOR="Red"]12189696    12124160[/COLOR]

here are some sample shell outputs:
Code:
~ # [6ndd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dev/dummyfile4 bs=[COLOR="Blue"][B]12189696 [/B][/COLOR]count=1
dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dev/dummyfile4 bs=1218
9696 count=1
1+0 records in
1+0 records out
12189696 bytes (11.6MB) copied, 0.238792 seconds, 48.7MB/s
~ # [6n/su/bin/sukernel --backup /dev/dummyfile4
/su/bin/sukernel --backup /dev/dummyfile4
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire

[/dev/dummyfile4]([COLOR="Blue"][B]12189696[/B][/COLOR]) --> [/data/stock_boot_df95813d3fb0376d87b6fd5cae14f3de30d402a6.img.gz](9933359)

~ # [6nsha1sum /dev/dummyfile4
sha1sum /dev/dummyfile4
df95813d3fb0376d87b6fd5cae14f3de30d402a6  /dev/dummyfile4
~ # [6ndd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dev/dummyfile5 bs=[COLOR="Blue"][B]12189695 [/B][/COLOR]count=1
dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dev/dummyfile5 bs=1218
9695 count=1
1+0 records in
1+0 records out
12189695 bytes (11.6MB) copied, 0.174374 seconds, 66.7MB/s
~ # [6n/su/bin/sukernel --backup /dev/dummyfile5
/su/bin/sukernel --backup /dev/dummyfile5
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire

[/dev/dummyfile5]([COLOR="Red"]12124160[/COLOR]) --> [/data/stock_boot_85db6903438fd5f7de7b7297ec1664ee0ab364b6.img.gz](9927456)

~ # dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dev/dummyfile6 bs=[COLOR="Blue"][B]12189697 [/B][/COLOR]count=1
dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dev/dummyfile6 bs=1218
9697 count=1
1+0 records in
1+0 records out
12189697 bytes (11.6MB) copied, 0.175018 seconds, 66.4MB/s
~ # /su/bin/sukernel --backup /dev/dummyfile6
/su/bin/sukernel --backup /dev/dummyfile6
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire

[/dev/dummyfile6]([COLOR="Red"][B]12189696[/B][/COLOR]) --> [/data/stock_boot_df95813d3fb0376d87b6fd5cae14f3de30d402a6.img.gz](9933359)

I don't want to post extensive shell code of all the test's i've performed, but anything that sukernel accesses through /dev/ is truncated down to the nearest 65536 block size.

On the other hand a symbolic link from outside /dev/ to inside /dev/ seems to work:
Code:
~ # [6nln -s /dev/dummyfile6 /tmp/dummyfile6
ln -s /dev/dummyfile6 /tmp/dummyfile6

~ # [6n/su/bin/sukernel --backup /tmp/dummyfile6
/su/bin/sukernel --backup /tmp/dummyfile6
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire

[/tmp/dummyfile6]([B][COLOR="Blue"]12189697[/COLOR][/B]) --> [/data/stock_boot_882a37f1a9b3979da5f8b0fba4a65b7fa86f3c3c.img.gz](9933359)

But symlinks from inside /dev/ to elsewhere also truncate:
Code:
~ # [6ndd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dummyfile7 bs=[B][COLOR="Blue"]12189697 [/COLOR][/B]count=1
dd if=/dev/block/platform/msm_sdcc.1/by-name/boot of=/dummyfile7 bs=12189697
 count=1
1+0 records in
1+0 records out
12189697 bytes (11.6MB) copied, 0.225071 seconds, 51.6MB/s
~ # [6nln -s /dummyfile7 /dev/dummylink7
ln -s /dummyfile7 /dev/dummylink7
~ # [6n/su/bin/sukernel --backup /dev/dummylink7
/su/bin/sukernel --backup /dev/dummylink7
sukernel v2.67 (ndk:armeabi-v7a) - Copyright (C) 2014-2016 - Chainfire

[/dev/dummylink7]([B][COLOR="Red"]12189696[/COLOR][/B]) --> [/data/stock_boot_df95813d3fb0376d87b6fd5cae14f3de30d402a6.img.gz](9933359)

Also worth noting, is other commands, such as dd , cp , ls , sha1sum directly into /dev/dummyfile(s) work properly, only sukernel is showing this issue.


I havent tested for MultiROM purposes (as of yet), but it shouldn't be difficult to just pad the boot.img (which in MultiROM would be a regular file) to be on the correct boundary.

Though, I felt you should need to know this about sukernel
and whether this is an expected result, or a possible bug


PS: all these tests were done in normal twrp recovery adb shell mode, nothing was being modified by multirom extensions.
 
  • Like
Reactions: ezio84 and Black-FR

nkk71

Inactive Recognized Developer / Contributor
May 26, 2010
8,741
7,571
53
Beirut
This is some excellent bug hunting!

Please confirm the attached version fixes the issue.

Perfectissimo :good::good:

  • adb shell confirms no more truncation
  • embedding the above SuperSU without any other changes into the previously problematic ROM, now works perfectly
  • recovery.log also confirms no issues at all during installation

Many thanks :D

Oh, and yes, the ROM booted fine (auto-reboot on first bootup, second boot went fine), and SuperSU working perfectly.
 
  • Like
Reactions: ezio84 and Black-FR

garyd9

Inactive Recognized Developer
Sep 13, 2006
2,643
2,732
53
Pittsburgh, PA
Chainfire, is there any chance that "custom_boot_image_patch.sh" can be called BEFORE the boot image (and ramdisk) is repacked?

Or better yet, perhaps a new optional script allowed for that would be run while the ramdisk is still opened up? ("custom_ramdisk_patch.sh")

It would be useful for changes to default.prop or init*rc files on systemless root...

Thanks
Gary
 

Chainfire

Moderator Emeritus / Senior Recognized Developer
Oct 2, 2007
11,452
87,862
www.chainfire.eu
Chainfire, is there any chance that "custom_boot_image_patch.sh" can be called BEFORE the boot image (and ramdisk) is repacked?

Or better yet, perhaps a new optional script allowed for that would be run while the ramdisk is still opened up? ("custom_ramdisk_patch.sh")

It would be useful for changes to default.prop or init*rc files on systemless root...

I'll consider it.
 
T

tsunamical

Guest
Hey Chainfire, a few questions here:
-The sepolicy commit is still required to boot in enforcing, correct?
-As of 2.67, it's still required to re-bump after flashing on LG devices, correct? If so, wouldn't a simple solution be to just add an additional zip to the main OP which re-bumps it?

I had a few more as well, just can't remember them off the top of my head :-/
 

Chainfire

Moderator Emeritus / Senior Recognized Developer
Oct 2, 2007
11,452
87,862
www.chainfire.eu
Hey Chainfire, a few questions here:
-The sepolicy commit is still required to boot in enforcing, correct?
-As of 2.67, it's still required to re-bump after flashing on LG devices, correct? If so, wouldn't a simple solution be to just add an additional zip to the main OP which re-bumps it?

I had a few more as well, just can't remember them off the top of my head :-/

That commit is only required if you want a system-based su installation. It's not needed for system-less root. It's still in testing, though.

Bumping is still required for the G3. Not sure about any other LGs. However, SuperSU does allow for a post-boot-image-patch script to be executed, I'm surprised nobody has made a ZIP yet that simply installs this script and makes all future flashes auto-bump the image.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 6
    THIS THREAD IS FOR DEVELOPERS ONLY. IF YOU ARE NOT A DEVELOPER (or very tech-savvy and well-versed), MOST LIKELY YOU SHOULD NOT POST HERE.

    By request, I am creating this thread for developer discussion. This is the place for developers to ask questions about how to handle/implement/embed SuperSU, discuss the operation of SuperSU, suggest improvements to compatibility, etc.

    This thread hopefully reduces important developer related matters from being buried in the more user-oriented threads.

    Please always include the version number of SuperSU you are referring to, even if it's the latest version right now. If applicable, also include information about phone and firmware you are testing with.
    6
    I don't think it's an issue with the script.

    This is some excellent bug hunting!

    Please confirm the attached version fixes the issue.
    4
    The stop-gap solution is to disable this caching completely, which is what the 000000deepsleep script does, which you can find mentioned or quoted in many posts around the forum. From SuperSU 2.66 onwards, that script is automatically installed on Samsung devices when systemless root is used.
    Please forgive me for posting (in a cf-auto-root thread) and digging afterwards. I had thought I'd just dump the info and forget about it, but I couldn't stop digging...

    ...which led me to the quoted material.

    Digging in the supersu 2.66 update-scriptbinary, I see that you're detecting "samsung" in the build fingerprint, and if true, doing a systemless install AND applying a deepsleep fix. This works for Galaxy S6 devices, but not for some other similar platform devices. In particular, the Note5 has THREE devices that need caching disabled in order for deep sleep to function. (0:0:0:3 as well as :2 and :1.)

    My first question is: does the SGS6 even have a file named "/sys/class/scsi_disk/0:0:0:3/cache_type"? If not, just write to all three files and don't worry about it. The third write would fail on the SGS6 and all would be good. It'd be no worse of a work-around than already exists (and I think it's a bad work-around.)

    If that file DOES exist in the SGS6, then something would have caching turned off that really shouldn't. Of course, existing or not, automatically tossing in this deepsleep patch for every single device that has "samsung" in the build fingerprint would seem likely break proper caching in some yet unknown samsung device. Perhaps the SGS7 will change things up so that :1 should be left cache flushable, and :2 would be the only one that should block cache flushing.

    As well, it's also possible that Samsung will pull in the kernel fix to resolve this issue before they release Android M. (Okay, perhaps it'd be more likely for Samsung to open source touchwiz... but we can always have fantasies.)

    My problem with the work-around is expressed above: it can break something in the future (and cause a support headache when some ONE exynos7420 device is fixed, but the rest aren't.) As well, it sets precedent of having platform specific hacks in the generic update.zip (but only allowing for a single platform and not in an easily expandable way.)

    Obviously, it would be a maintenance nightmare to have different "00000deepsleep" files for every different device model. (if 'zerolte.*', SGS6. If 'nobellte.*', Note5, etc.)...

    In keeping with what I tell other people, I feel I now have an obligation to suggest A Better Way. (a person shouldn't complain about something unless they can make a reasonable suggestion on how it'd be better.)

    So, here's my slightly convoluted (but expandable) suggestion:

    You currently use /data/.supersu to read certain variables that modify the supersu.zip installer script. Perhaps those "platform specific lines" could be added to that file, and the installer script would put them in place. So, I could do the following in a recovery root shell before installing supersu.zip:

    Code:
    echo PLATFORMSTARTUP='echo "temporary none" > /sys/class/scsi_disk/0:0:0:1/cache_type' >> /data/.supersu
    (I'd have included both (or all three) needed lines for samsung deep sleep, but I forget how to include CR in a shell cmdline.. )

    Then, the supersu installer script would just read PLATFORMSTARTUP and write it's contents to /su/su.d/00000platformstartup (and set perms.)
    Given this type of thing, the existing 000000deepsleep hack would be removed. Then, individual devs could easily create simplistic "pre-installers" for supersu for specific platforms that need changes. Those "pre" installers would just write the needed PLATFORMSTARTUP lines to /data/.supersu...

    ... and then supersu.zip no longer needs platform specific hacks.

    Some random XDA developer could then generate a simple "SGS6-supersu.zip" would only contain an edify script to mount /data and add/edit the .supersu file's PLATFORMSTARTUP variable to contain the two lines needed for deep sleep (and another dev could write a Note5 for the 3 lines needed on that platform... and so on..)

    Take care
    Gary
    3
    The only problem with that is that it requires users to have two brain cells to rub together. We've seen time and time again on these forums that you can't assume this is always the case.

    I think that Chainfire is doing pretty much the right thing here. At worst, disabling write-back caching will make I/O a bit slower, but that's better than not having deep sleep.

    The problems with the existing solution are:
    1. It blindly alters the system kernel behavior for every single device samsung manufactures.
    2. It only actually does any good for a single one of the dozens of devices from that sam manufacturer.
    3. It completely ignores every OTHER device that might need a bit of help (and potentially does more harm than good for those devices.)
    4. It encourages device developers (users on XDA) to download SuperSU.zip and re-package it to have device specific hacks in the .zip archive (creating a mess.)

    Actually, I don't think I need to explain all the problems with the existing hack. I'd imagine (hope) that it was done as something quick to test out an idea, and was never intended to be left in place in it's current form.

    The only suggestion I'd have is to add more devices (maybe up to 5), and to check for their existence before writing to them.
    Which 5 devices? Who maintains that list? Who updates it for each firmware change that might require an update? Will there be a new "SuperSU.zip" package each time a firmware change on a device requires that one of those 5 be changed? Who deals with the support nightmare of saying "use SuperSU v a.bc for device X firmwawre Y" and "superSU v d.ef for device X firmware Z", etc?

    My proposed solution takes all the device-specific stuff completely out of the SuperSU package. It changes it from a device-specific solution to be a more generic and expandable solution that requires LESS support from SuperSU and places the device specific burden outside.

    Instead of encouraging device developers to repackage supersu to device specific packages, it encourages device developers to package something else alongside supersu that would work with the existing (and unaltered) supersu.zip (and would be future compatible.)

    Take care
    Gary
    3
    Hello @Chainfire, I'm the original author of systemless Xposed.

    Recently I released a systemless Xposed based on your latest 2.76 version, which loads on post-fs-data if possible.
    [UNOFFICIAL][v86.0][July 12] Systemless / System Universal Compatibility Xposed
    Several users reported that Xposed won't work on secure boot enabled devices (require password to boot up). By viewing the boot logcat, it seems SuperSU is not able to load on post-fs-data is this specific situation (I assumed it because there are other processes running at the same time when su.d scripts are executing, however no logs from SuperSU has shown. Although you did log which mode SuperSU is running in "log_print", launch_daemonsu.sh only logs in very few situations like image merging, apk moving etc., which in most cases there will be no logs showing which mode SuperSU is running with in logcat)

    By viewing your scripts and the result boot image, I see you used similar techniques I used in my previous systemless Xposed versions to load in post-fs-data. However in my previous systemless xposed versions, I can handle secure boot devices. A wild guess is that you placed init.supersu.rc in the last of the import lists in init.rc, but other factors might cause daemonsu to fall back to service too, I'm not sure.