[MOD] IsoRec: Isolated Recovery for the Galaxy S2 Family

[makix13]

Using
'kernel-Lanchon-TRIM-FreezeFix-TWRP-20160111-cm-12.1-i9100.zip'
right now.

In which order shall I flash:
......

@ringen00 be careful, if you are on CM12.1 you'll need to flash kernel-Lanchon-TRIM-IsoRec-20160112-cm-12.1-i9100.zip, you put in your message "kernel-Lanchon-TRIM-IsoRec-20160112-cm-11-i9100.zip", it's for KK not for LP rom. [emoji6]

The order if I'm not wrong, first the isorec kernel, then the isorec recovery.

Don't know about cyandelta sorry

S2 Cyanogenmod 5.1.1 [official nightly] - Xposed [official framework] - Viper4Android

 

[Lanchon]

Using
'kernel-Lanchon-TRIM-FreezeFix-TWRP-20160111-cm-12.1-i9100.zip'
right now.

In which order shall I flash:

1. kernel-Lanchon-TRIM-IsoRec-20160112-cm-11-i9100.zip

2. recovery-Lanchon-IsoRec-TWRP-2.8.7.0-20160113-i9100-(by-arnab).zip

3. Lanchon-IsoRec-Disabler-i9100.zip

- Which zip's will i have to put into CyanDelta to flash along with upcoming nightlies?
- Will I be able to go back to older TWRP etc. anytime?
- What is the benefit in one sentence?

do not flash disabler!
order is unimportant.
flash the TWRP manually just once.
then give my CM12.1 kernel to cyandelta to flash after every rom update.

 

[pilgrim011]

So, I have tried to use this: downloaded kernel-Lanchon-TRIM-IsoRec-20160111-cm-12.1-i9100.zip and recovery-Lanchon-IsoRec-TWRP-2.8.7.0-20160113-i9100-(by-arnab).zip, flashed first kernel, then recovery zip, rebooted to recovery, but I still have dreadful CM 12.1 recovery. What am I doing wrong?

 

[franticfreddy]

So, I have tried to use this: downloaded kernel-Lanchon-TRIM-IsoRec-20160111-cm-12.1-i9100.zip and recovery-Lanchon-IsoRec-TWRP-2.8.7.0-20160113-i9100-(by-arnab).zip, flashed first kernel, then recovery zip, rebooted to recovery, but I still have dreadful CM 12.1 recovery. What am I doing wrong?

Hi,
its sure that the flashing was ok?
Because, in stock CM-recovery, you only can flash signed zips..
Maybe you didnt sign the zip files from Lanchon, as he wrote in
instructions..
Try take out battery for 10secs, then put back in, and reboot into CM-recovery,
then flash signed zip files from Lanchon, after that take out battery again, wait 10 secs, put back in and power on into recovery..then twrp should appear..

 

[pilgrim011]

Hi,
its sure that the flashing was ok?
Because, in stock CM-recovery, you only can flash signed zips..
Maybe you didnt sign the zip files from Lanchon, as he wrote in
instructions..
Try take out battery for 10secs, then put back in, and reboot into CM-recovery,
then flash signed zip files from Lanchon, after that take out battery again, wait 10 secs, put back in and power on into recovery..then twrp should appear..

Thanks, but Lanchon zips are already signed, me thinks.

 

[svbarbosa]

My TWRP backup is not including Android Secure. It is displayed as "0 bytes" and not selected.

I have six apps moved to external sdcard. They are not backed up.

Am I missing something? Is there a way to make it work?

hi,

i know it is very recent but still, you are using an obsolete kernel

get the IsoRec kernel plus the separate TWRP recovery. (newer version of it just posted!)

Now I am running latest kernel and IsoRec revovery:

- kernel-Lanchon-TRIM-IsoRec-20160111-cm-12.1-i9100
- recovery-Lanchon-IsoRec-TWRP-2.8.7.0-20160113-i9100-(by-arnab)

Unfortunately the "android secure 0 bytes" problem is still there.

@arnab, will it be possible to fix this?

 

[arnab]

Now I am running latest kernel and IsoRec revovery:

- kernel-Lanchon-TRIM-IsoRec-20160111-cm-12.1-i9100
- recovery-Lanchon-IsoRec-TWRP-2.8.7.0-20160113-i9100-(by-arnab)

Unfortunately the "android secure 0 bytes" problem is still there.

@arnab, will it be possible to fix this?

The recovery tht i gave u lanchon is made with M sepolicies branch... And there is a denial of .android_secure of selinux frm mmcblk0p11 ie the emmc part... Either u have to switch to permissive or get the policy defined if ur using it in enforcing.. It will show up in last_kmsg... Alternatively if u dnt wanna fix sepolicies u can either switch to permissive or
https://github.com/kularny/GeniSys.Kernel/tree/smdk4210/out/ramdisk get the latest last ramdisk available that was built with the old cm12.1 compatible sepolicies frm the link.... Or u can delete the . Android_secure manually in usb mass storage mode frm twrp by showing hidden items. But i think u have to fix sepolicies in both cases.. With the new one that i gave u or the old one. It will come frm ubject_r:vfat:s0 and it will be in like allow init vfat:file {read open}.. The avc denial will be of read open.. But i think it will be for both new one and the old ones.
Sent from my MI 3W using XDA Free mobile app

 

[svbarbosa]

The recovery tht i gave u lanchon is made with M sepolicies branch... And there is a denial of .android_secure of selinux frm mmcblk0p11 ie the emmc part... Either u have to switch to permissive or get the policy defined if ur using it in enforcing.. It will show up in last_kmsg... Alternatively if u dnt wanna fix sepolicies u can either switch to permissive or
https://github.com/kularny/GeniSys.Kernel/tree/smdk4210/out/ramdisk get the latest last ramdisk available that was built with the old cm12.1 compatible sepolicies frm the link.... Or u can delete the . Android_secure manually in usb mass storage mode frm twrp by showing hidden items. But i think u have to fix sepolicies in both cases.. With the new one that i gave u or the old one. It will come frm ubject_r:vfat:s0 and it will be in like allow init vfat:file {read open}.. The avc denial will be of read open.. But i think it will be for both new one and the old ones.
Sent from my MI 3W using XDA Free mobile app

Thanks for the quick reply.

I am just a user and do not know how to proceed.
@Lanchon, can you use these instructions to make the IsoRec TWRP handle android_secure under CM 12.1?

 

[arnab]

last_kmsg denial:

<5>[    3.280191] c1 type=1400 audit(1452277167.830:9): avc:  denied  { read } for  pid=1886 comm="recovery" name=".android_secure" dev=mmcblk0p11 ino=2 scontext=u:r:init:s0 tcontext=u:object_r:vfat:s0 tclass=dir permissive=1
<5>[    3.280312] c1 type=1400 audit(1452277167.830:10): avc:  denied  { open } for  pid=1886 comm="recovery" name=".android_secure" dev=mmcblk0p11 ino=2 scontext=u:r:init:s0 tcontext=u:object_r:vfat:s0 tclass=dir permissive=1

The fix:

file_contexts    
/storage/sdcard0/.android_secure                       u:object_r:vfat:s0

init.te
allow init vfat:dir { read open };

I am building a new DU release which will incorporate these seploicies. Lets hope the new ramdisk that Il get, probably tomorrow Il build, will fix this issue...There were gazillions of denials that I postponed for the final release..I will do the fixing in 2 parts...One half part was done in 9.8 which had logcat and dmsg denials fixed...remaining part will be of frm a last_kmsg...the final one will have this denial fixed..and alot of others too. Ofcourse Iam a human being and not a machine..So i went thru 2 part policy. Maintaining both Kernel and ROM is a tad bit difficult.

 

[kal4metal]

For me it works like a charm! Thank you @Lanchon! I hope it gets merged alongside trim! One more obstacle thrown away!

 

[Naudiz]

Just out of curiosity:
If I remember correctly, older versions of TWRP on the i9100 had the possibility to backup /efs.
The current one from OP seems to lack this. Is this intended?

 

[Lanchon]

The recovery tht i gave u lanchon is made with M sepolicies branch... And there is a denial of .android_secure of selinux frm mmcblk0p11 ie the emmc part... Either u have to switch to permissive or get the policy defined if ur using it in enforcing.. It will show up in last_kmsg... Alternatively if u dnt wanna fix sepolicies u can either switch to permissive or
https://github.com/kularny/GeniSys.Kernel/tree/smdk4210/out/ramdisk get the latest last ramdisk available that was built with the old cm12.1 compatible sepolicies frm the link.... Or u can delete the . Android_secure manually in usb mass storage mode frm twrp by showing hidden items. But i think u have to fix sepolicies in both cases.. With the new one that i gave u or the old one. It will come frm ubject_r:vfat:s0 and it will be in like allow init vfat:file {read open}.. The avc denial will be of read open.. But i think it will be for both new one and the old ones.
Sent from my MI 3W using XDA Free mobile app

instead of packing your last ramdrive with CM12.1 policies, i'll better wait for the ramdrive of your new Dirty Unicorns; i think it will create less confusion. thanks again for all your hard work and please excuse all the tagging of your name that happened here

 

[arnab]

Just out of curiosity:
If I remember correctly, older versions of TWRP on the i9100 had the possibility to backup /efs.
The current one from OP seems to lack this. Is this intended?

Yes i purposely disabled efs partition backup...it contains sensitive info like imei data and all..if u begin to play with it and if in some case backup restore fails..u will loose ur imei data including wifi mac and all others like device serial no...many users had a bad experience on other threads of playing with efs..so i disabled it altogether..u shud never touch efs partition.

Sent from my MotoG3 using XDA Free mobile app

---------- Post added at 11:33 PM ---------- Previous post was at 11:32 PM ----------

instead of packing your last ramdrive with CM12.1 policies, i'll better wait for the ramdrive of your new Dirty Unicorns; i think it will create less confusion. thanks again for all your hard work and please excuse all the tagging of your name that happened here

Its cool..am happy to help

Sent from my MotoG3 using XDA Free mobile app

 

[Lanchon]

So, I have tried to use this: downloaded kernel-Lanchon-TRIM-IsoRec-20160111-cm-12.1-i9100.zip and recovery-Lanchon-IsoRec-TWRP-2.8.7.0-20160113-i9100-(by-arnab).zip, flashed first kernel, then recovery zip, rebooted to recovery, but I still have dreadful CM 12.1 recovery. What am I doing wrong?

im very sorry about this, booting to a CM 12.1 recovery can be a pretty scary experience, yes...

did you solve it? i suppose maybe you got a bad TWRP download. you can get the MD5 hash of your downloaded files and compare them to the MD5 displayed on the file download page.

else something might be overwriting your partitions? you can pull your current partitions and check the contents. boot to recovery, connect via adb using sudo/administrator mode (adb kill-server; sudo adb devices), then pull the partitions:

adb pull /dev/block/mmcblk0p5 kernel.img
adb pull /dev/block/mmcblk0p6 recovery.img

Thanks, but Lanchon zips are already signed, me thinks.

your are correct.

 

[pilgrim011]

im very sorry about this, booting to a CM 12.1 recovery can be a pretty scary experience, yes...

did you solve it? i suppose maybe you got a bad TWRP download. you can get the MD5 hash of your downloaded files and compare them to the MD5 displayed on the file download page.

else something might be overwriting your partitions? you can pull your current partitions and check the contents. boot to recovery, connect via adb using sudo/administrator mode (adb kill-server; sudo adb devices), then pull the partitions:

adb pull /dev/block/mmcblk0p5 kernel.img
adb pull /dev/block/mmcblk0p6 recovery.img

your are correct.

Sorry, forgot to post - everything is ok now, after I have flashed LA's twrp kernel first, and after that, from his twrp recovery flashed your kernel and recovery.

 

[arnab]

Update

A small update...Despite me fixing the policies I still got denials...then i saw that twrp is made to run in permissive even kernel is set to enforcing...Not going into much technical details...

Connect emmc in usb mass storage mode from mounts...before that disable mtp...open .android_secure..put any file which is 1mb+ ..it will show the value...Earlier the size was in kb...thats why it didnt show up as twrps unit was in mb. every thing is good and works fine.

service set_permissive /sbin/toolbox setenforce 0
    oneshot
    seclabel u:r:recovery:s0

This code is here. See the setenforce 0. It means twrp will start in permissive mode on every boot.

 

[makix13]

Just flash isorec kernel plus isorec twrp recovery from arnab and all fine.
Big thanks @Lanchon and @arnab from your amazing work [emoji122] [emoji122] [emoji106]

S2 Cyanogenmod 5.1.1 [official nightly] - Xposed [official framework] - Viper4Android

 

[TeutonJon78]

Thanks for doing this. I've been wanting to switch to CM from OmniROM on my i777 since CM is still being worked on, but I couldn't deal with that horrible recovery. This made the ability to switch painless.

You can also add this to another report of it working correctly. The only issue I've run across is that the MTP under TWRP has a file transfer limit, and it's too small to transfer a full GAPPS package. Not sure if that is a problem with TWRP in general, or this build.

 

[Lysergic Acid]

So, I see the patch on gerrit. Is this working fine, without anything else needed? The change seems so simple that I coudn't believe it. I'll merge it on official kernel if no one has complaints

 

[Lanchon]

So, I see the patch on gerrit. Is this working fine, without anything else needed? The change seems so simple that I coudn't believe it. I'll merge it on official kernel if no one has complaints

cool! lol yes extremely simple and yes, it's working fine on devices affected by the change, i9100 and i777, both tested.

the change would also affect n7000 and d710, but only theoretically as those devices dont have cm12.1 branches. yet it should work fine on those devices too, they identical in this regard.

btw, i made cm11 isorec kernels for n7000 and d710 but received no feedback. i also made a cm11 kernel for i9100 and tested: isorec works fine on cm11 too.