[WIP!][KERNEL] Razer Phone 2 Kernel (+exfat module, TWRP device tree, and more!)

[thecubed]

Hi all!

What is this?

This is my mostly-working Razer Phone 2 Kernel and TWRP device tree!

I've been reading threads where people are having issues compiling the Razer-provided source for the RP2 and figured I should post what I have so others can use it to help achieve a fully working source-built kernel.

I'm also including a set of scripts to repack a Magisk-patched boot.img so you can iterate on building a new kernel rapidly, and am including a prebuilt magisk-patched boot.img with the custom kernel so we can QA other features while focusing on the known-broken things.

Also also, I'm including an exfat kernel module (not built into kernel for now) so that can be tested too!

Why is this mostly-working?

I've tested many features on this kernel and so far the only feature *not* working is the microphone. (Audio recording, haven't tested in-call audio)
This kernel is a mashup of Razer's source and a few other OSS repos from CAF - specifically the TFA98XX driver, and the audio-kernel repositories, so there's a bit of integration left to do to get all the audio features working.

I also had to edit the defconfig to get the DTB to build, and have to build with some special flags to use the prebuilt DTB compiler (dtc) since the one included in the source isn't capable of compiling the FIH DTBs inside the Razer-provided source (correct me if I'm doing something wrong here, but this was how I ended up getting it to work).

The kernel parameter skip_initramfs has also been renamed to skip__initramfs to break the silly bootloader skipping the ramdisk (and thereby breaking Magisk). This means you don't need to run Magisk's binary patch to rename that kernel argument to make Magisk or TWRP work.
Keep in mind, though, that this means if you use this kernel with a 100% stock ramdisk, you'll only ever get recovery since new Android ramdisks only contain recovery! (Thanks Dees_Troy for the refresher course!)

If you're familiar with the new audio-kernel CAF stuff, please let me know! I could use your assistance getting the microphone working.
It seems like the microphone isn't working because of some mismatches between the in-kernel msm audio drivers and the Razer customized drivers in the vendor partition.

I get errors like

[31269.485217] send_afe_cal_type cal_block not found!!

in dmesg when attempting to record audio. This seems isolated to the q6afe drivers in the kernel (specifically here: https://github.com/thecubed/android_kernel_razer_sdm845/blob/master/techpack/audio/dsp/q6afe.c#L1593 ) not playing nice with the prebuilt snd_soc_sdm845 kernel module.

Where do I get this?

See here for the TWRP device tree (and detailed instructions on how to set up your build tree): https://github.com/thecubed/android_device_razer_cheryl2

See here for just the kernel source: https://github.com/thecubed/android_kernel_razer_sdm845

See here for a kernel-less boot.img skeleton that you can drop your newly minted kernel into and repack with mkbootimg: http://downloads.codefi.re/thecubed/aura2/kernel/magisk_custom_kernel_skel.tar.gz

See here for a prebuilt boot.img with this custom kernel which includes Magisk: http://downloads.codefi.re/thecubed/aura2/kernel/boot_magisk_custom_9.img

See here for an exfat module you can insmod from a booted phone with custom kernel to try mounting exfat SD cards: http://downloads.codefi.re/thecubed/aura2/kernel/exfat_module.tar.gz

See here for a stock Magisk-patched boot.img for when you're done playing with this: http://downloads.codefi.re/thecubed/aura2/kernel/boot_magisk.img

How do I use this?

First off, this isn't for the average user. This kernel is *under development* and is not fully working yet. This means don't try this kernel on your mom's phone, your neighbor's phone, or any device that you aren't comfortable developing for.

Secondly, to test this, you'll need to be oem unlocked. There's plenty of guides to do this, but be aware that it erases all data on your phone when doing so. You could try using adb backup first, but I didn't have much success with that.

I'd suggest looking at the first link in the Where do I get this section and reading the README for the device tree as it'll have the most detailed instructions.

The gist is you'll need to download a minimal OmniROM manifest, add some lines to a file in .repo/local_manifests/cheryl2.xml, and run mka kernel to get a kernel image.
After that, you'll want to use mkbootimg to build a bootable magisk-patched boot.img, which you'll flash to your device with fastboot flash boot_X path/to/boot.img (where X is the active boot partition).

Once you've got the Image.gz-dtb file from your $OUT/obj/KERNEL_OBJ/arch/arm64/boot/Image.gz-dtb you'll want to repack it into a magisk-patched boot.img

Repacking the boot.img can be done with this command:

mkbootimg \
    --kernel Image.gz-dtb \
    --ramdisk boot_magisk.img-ramdisk.gz \
    --cmdline 'console=ttyMSM0,115200n8 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 swiotlb=2048 androidboot.configfs=true androidboot.usbcontroller=a600000.dwc3 buildvariant=user' \
    --base 0x00000000 \
    --pagesize 4096 \
    --kernel_offset 0x00008000 \
    --ramdisk_offset 0x01000000 \
    --second_offset 0x00f00000 \
    --tags_offset 0x00000100 \
    --os_version 8.1.0 \
    --os_patch_level 2018-10 \
    -o ../boot_magisk_custom.img

FAQ

Does this have TWRP?

No. This does not have TWRP. The device tree is for TWRP eventually, and to make compiling the kernel easier (since Android kernels don't like compiling outside of Android's makefile system anymore)​

Does this have Magisk?

Yes! It's "pre-patched" too, as long as you're using my prebuilt one above.​

Do I need the custom kernel to use the exfat module?

Yes. This is because the Razer stock kernel has module signing forced. I don't have Razer's kernel module signing key so I can't compile kernel modules for the stock kernel. My kernel has module signing set to allow mismatched signatures, so both the Razer modules in /vendor/lib/modules (required for sound) and my exfat module can coexist.​

Why is exfat not compiled into the kernel?

Laziness, primarily. Actually, in this case I just didn't want to add extra variables to testing the kernel. If adding exfat into the kernel directly causes other issues it could potentially derail my quest to get this kernel up to par with the stock kernel.​

Why did other kernels not boot?

Most likely due to incompatible audio-kernel revisions, or dtb issues. I'm not sure, but getting this kernel to compile required a bit more hacking than it should have.​

Are you working on TWRP for Razer Phone 2?

Yep. Look for another post once the kernel is good to go. I aim to get encryption support working too, unless Dees_Troy beats me to it ​

Is audio still not working?

I'll update the post to remove the WIP tag and the section about audio as soon as it's working.​

Is anything else not working?

Feel free to download and test to let me know what else isn't working and I'll add it to the OP.​

Acknowledgements

Special thanks to Rashed97 and Dees_Troy for all their help.

y u quote OP?

 

[Kachelistic]

Thanks for your work! Looking forward for a stable version. Wanna help but RP2 is currently my only working phone..

 

[hertz9511]

u sir,deserve a beer,thanks for working rp2 and not to forget other devs who help u along the way,we will wait patiently,cheers!!!!

 

[Warrior1988]

Thank you.

 

[thecubed]

Interesting discovery just now, seems that the stock kernel gives the same 'error' in dmesg when recording audio (but obviously audio recording still works).

[ 1365.950315] send_afe_cal_type cal_block not found!!

This could mean that Razer doesn't have a calibration profile for the microphone anyway (interesting, wonder if there's an opportunity to improve recording quality here?) and that I'm barking up the wrong tree re: calibration mismatches.

I've also confirmed that I get the same 'ASoC: no backend DAIs enabled for [backend name here]' messages in the stock kernel when brute force trying all PCM inputs with:

for f in `seq 1 80`; do tinycap /sdcard/wavs/device-$f.wav -D 0 -d $f -r 48000; done

It's also (very) possible that I don't understand how tinycap works.

I dumped the list of PCM inputs/outputs with:

for f in `ls -d /proc/asound/sdm845tavilsndc/** | grep pcm`; do echo "$f : `grep 'id' $f/info`"; done

and

cat /proc/asound/pcm

on both kernels (stock and custom) and they seem to match.

I'm thinking I should figure out how to record sound outside of android (from adb only) from stock kernel, and use that same test to try in the custom kernel. If I can find a test like that, I should be able to determine if I need to rename one of my DAI links to match whatever's baked into the XML files in /vendor/etc .

Any ideas?

 

[Warrior1988]

Are you using the audio.a2dp.default.so driver?

 

[thecubed]

Warrior1988: A2DP isn't in play here, and I'm using the stock /system and /vendor partitions, so any razer-customized tweaks are still present.

Currently, I've been working on figuring out the codec mappings to make sure that when audio is being recorded in the custom kernel that all the appropriate routing is set to enable audio from the tfa98xx chip (NXP amplifier, apparently supports digital microphones too?) or the wcd934x codec.
I'm not sure where the microphones are physically connected internally, so I'm working backwards from what gets enabled/disabled when recording audio in the stock kernel.

So far I have observed a few things (pardon my potentially incorrect terminology, the whole linux ASOC sound layer is new to me):

1. Audio in the stock and custom kernels is being captured by the mixer device called "SDM845 Media1", and it is capturing from SLIMBUS_0_TX input.

[Recording]
aura:/sys/module # cat /sys/kernel/debug/asoc/sdm845-tavil-snd-card/SDM845\ Media1/state
[SDM845 Media1 - Playback]
State: new
Backends:
 No active DSP links
[SDM845 Media1 - Capture]
State: start
Hardware Params: Format = S16_LE, Channels = 1, Rate = 16000
Backends:
- SLIMBUS_0_TX
   State: start
   Hardware Params: Format = S16_LE, Channels = 1, Rate = 48000

2. You can also see when recording and not recording that in both kernels the SLIMBUS_0_TX input is wired correctly to the right mixer:

[Not recording] 
aura:/sys # cat ./kernel/debug/asoc/sdm845-tavil-snd-card/platform:soc:qcom,msm-pcm-routing/dapm/SLIMBUS_0_TX
SLIMBUS_0_TX: Off  in 2 out 0 - R0(0x0) mask 0x1
 stream Slimbus Capture inactive
 out  "static" "SLIM0_UL_HL"
 in  "static" "Slimbus Capture"
 in  "static" "BE_IN"

[Recording]
aura:/sys # cat ./kernel/debug/asoc/sdm845-tavil-snd-card/platform:soc:qcom,msm-pcm-routing/dapm/SLIMBUS_0_TX
SLIMBUS_0_TX: On  in 2 out 1 - R0(0x0) mask 0x1
 stream Slimbus Capture inactive
 out  "static" "SLIM0_UL_HL"
 out  "SLIM_0_TX" "MultiMedia1 Mixer"
 in  "static" "Slimbus Capture"
 in  "static" "BE_IN"

Now that I've observed those things, I need to do a bit more research on how audio can get enabled/disabled on each of the chips that touch it.

For instance, in the custom kernel, I noticed that during recording sounds the DMIC* lines on the second tfa98xx aren't enabled. I haven't checked in the stock kernel yet - but if the tfa98xx chip is providing mic bias, it's possible that everything is wired right for input but since the mic bias isn't on, the mic isn't powered and thus we get no sound.
(Updated side note, why is Razer Phone 2 is using two TFA9888 chips? The tfa98xx.cnt firmware references TFA9892 which is mono only, too. I need to see a disassembly to figure out what chips it's actually using...)

aura:/sys # cat ./kernel/debug/asoc/sdm845-tavil-snd-card/codec:tfa98xx.4-0034/dapm/DMIC*
DMIC1: Off  in 1 out 0
 out  "static" "AIF OUT"
DMIC2: Off  in 1 out 0
 out  "static" "AIF OUT"
DMIC3: Off  in 1 out 0
 out  "static" "AIF OUT"
DMIC4: Off  in 1 out 0
 out  "static" "AIF OUT"
aura:/sys # cat ./kernel/debug/asoc/sdm845-tavil-snd-card/codec:tfa98xx.4-0035/dapm/DMIC*
DMIC1: Off  in 1 out 0
 out  "static" "AIF OUT"
 in  "static" "MIC BIAS1"
DMIC2: Off  in 1 out 0
 out  "static" "AIF OUT"
DMIC3: Off  in 1 out 0
 out  "static" "AIF OUT"
 in  "static" "MIC BIAS3"
DMIC4: Off  in 1 out 0
 out  "static" "AIF OUT"

Update: just noticed that this path doesn't exist on stock kernel. So the TFA driver I have doesn't match the one Razer is using. Interesting!

Also, I'm not sure why SLIMBUS_2 playback/capture aren't shown as 'dynamic DAI' linked (the '(*)' means it's a dynamic DAI)... Probably not important though.

aura:/proc/asound # cat pcm
00-00: MultiMedia1 (*) :  : playback 1 : capture 1
00-01: MultiMedia2 (*) :  : playback 1 : capture 1
00-02: VoiceMMode1 (*) :  : playback 1 : capture 1
00-03: VoIP (*) :  : playback 1 : capture 1
00-04: MultiMedia3 (*) :  : playback 1
00-05: SLIMBUS_0 Hostless (*) :  : playback 1 : capture 1
00-06: AFE-PROXY RX msm-stub-rx-6 :  : playback 1
00-07: AFE-PROXY TX msm-stub-tx-7 :  : capture 1
00-09: AUXPCM Hostless (*) :  : playback 1 : capture 1
00-10: SLIMBUS_1 Hostless (*) :  : playback 1 : capture 1
00-11: SLIMBUS_3 Hostless (*) :  : playback 1 : capture 1
00-12: SLIMBUS_4 Hostless (*) :  : playback 1 : capture 1
00-13: MultiMedia5 (*) :  : playback 1 : capture 1
00-14: Listen 1 Audio Service (*) :  : capture 1
00-16: MultiMedia10 (*) :  : playback 1 : capture 1
00-17: MM_NOIRQ (*) :  : playback 1 : capture 1
00-18: HDMI_RX_HOSTLESS (*) :  : playback 1
00-19: VoiceMMode2 (*) :  : playback 1 : capture 1
00-20: Listen 2 Audio Service (*) :  : capture 1
00-21: Listen 3 Audio Service (*) :  : capture 1
00-22: Listen 4 Audio Service (*) :  : capture 1
00-23: Listen 5 Audio Service (*) :  : capture 1
00-24: Listen 6 Audio Service (*) :  : capture 1
00-25: Listen 7 Audio Service (*) :  : capture 1
00-26: Listen 8 Audio Service (*) :  : capture 1
00-27: MultiMedia9 (*) :  : playback 1 : capture 1
00-33: MM_NOIRQ_2 (*) :  : playback 1 : capture 1
00-34: SLIMBUS8_HOSTLESS Capture (*) :  : capture 1
00-35: Slimbus4 Capture tavil_vifeedback-35 :  : capture 1
00-36: SLIMBUS_2 Hostless Playback tavil_rx2-36 :  : playback 1
00-37: SLIMBUS_2 Hostless Capture tavil_tx2-37 :  : capture 1
00-38: MultiMedia6 (*) :  : playback 1 : capture 1
00-39: USB Audio Hostless (*) :  : playback 1 : capture 1
00-80: QUAT_MI2S_RX Hostless (*) :  : playback 1

Meanwhile, we've reached out to Razer to see if they'll bless us with the full and complete kernel source this time

 

[blackknightavalon]

I doubt it. They won't even answer simple questions as to an estimate of when we're getting Pie

 

[RKBD]

I doubt it. They won't even answer simple questions as to an estimate of when we're getting Pie

>simple question
>eta
pick one

 

[rogeriskira]

Any progress on this kernel? I'm really curious now that we have pie.

 

[thecubed]

No progress as of yet, I've been busy with work recently and Razer hasn't dropped source for the new kernel version (still 4.9 but a different patch level).
I'm hopeful that Razer will drop the complete source for Pie's kernel and I can backport that to the Oreo kernel for those who want to keep the old OS.

I haven't updated my RP2 to Pie yet so I can test out any changes once the source for the new kernel is out. I'll be sure to post here when I have any updates

 

[thecubed]

Audio-kernel source is out! https://s3.amazonaws.com/cheryl-factory-images/audio-kernel-aura-2009.tar.gz
I'll be rebuilding my kernel very soon and testing.

 

[Warrior1988]

https://s3.amazonaws.com/cheryl-factory-images/

 

[thecubed]

https://s3.amazonaws.com/cheryl-factory-images/

Yup, I'm building it right now!

 

[thecubed]

Yup, it works! I have fully working audio and microphone now. Seems like there's a bunch of DAI changes and some offset changes to calibration stuff that FIH added (ugh).
Please hold while I get the commit up on my Github, and I'll get a build with exfat going here in just a minute after.

Plan is:
- Github updates (readme changes, etc) UPDATE: done
- Upload this current build I just tested for anyone that wants it
- Add exfat module to kernel and rebuild / test UPDATE: exfat support works, BUT I need to recompile vold to support exfat. I can mount the SD card just fine, but Android doesn't understand that it's mounted because vold isn't tracking it


Also, <3 u razer, thanks
I'm bummed to hear about the layoffs, and I really appreciate whomever uploaded the source even after that. Hopefully Razer's phone team will grow again and get to make us a Razer Phone 3 at some point in the future.

 

[thecubed]

For anyone that's still running 8.1 and wants to try my custom kernel (no, no exfat support yet until I get vold fixed), here's a link: http://downloads.codefi.re/thecubed/aura2/kernel/boot_magisk_custom_10.img
Github has been updated as well.

I'll be sure to update the OP tomorrow when it's not 2AM.

EDIT: Fixed link, 2AM is not kind to my typing skills

 

[Youssarian]

Awesome work! Very excited to try it out tomorrow.
Also sad to see your post about their layoffs. Pretty fun phone with much potential for future.
I think some of the reviews are pretty harsh given the penchant of Pixel / Samsung / Apple worship out there.
Anyway, thanks so much for this.

 

[jal3223]

For anyone that's still running 8.1 and wants to try my custom kernel (no, no exfat support yet until I get vold fixed), here's a link: http://downloads.codefi.re/thecubed/aura2/boot_magisk_custom_10.img
Github has been updated as well.

I'll be sure to update the OP tomorrow when it's not 2AM.

Thank you for this!

It's showing up "Not found" on the download link though.

 

[thecubed]

Thank you for this!

It's showing up "Not found" on the download link though.

Fixed the link in my previous post - sorry about that!

I'll be updating the OP tonight too when I get home from work.

 

[Gamesoul Master]

Looking good! Is the sound as good as stock (or maybe better, considering the low volume crackling we get)?

Hoping to give this a shot soon, as soon as I figure out rooting on 9.0. I saw a thread about it, but nobody answered my question there, and light digging through threads didn't turn up an answer, so trying this kernel will have to wait a bit. Makes me miss the HTC root days, when finding out about root was a simple yes or no situation... lol.