[ROM] "GENERIC" SC v2.0 USER/USERDEBUG - S905x2 / S905x3 - AndroidTV Build

[drsam007]

ye i forgot... my roms were made for L1 so it as tee/optee since is needed for L1 support (the boxes that support it)

But I thought s905x3 supported L1. Is it possible that some boxes with same SoC don't support it?

[superceleron]

ye i forgot... my roms were made for L1 so it as tee/optee since is needed for L1 support (the boxes that support it)

[drsam007]

I have upload SC2 rom (userdebug version) for T95 Max+ here:

https://mega.nz/#!zJVRVIpb!sed1AAXR4...cN5_A4tyHG9OlA

[drsam007]

superceleron I have a breakthrough. Seeing that "vendor" partition had lot of differences, I took only "system" partition from your ROM, and it works beautifully! I also did vendor partition cleanup by comparing what was there in your ROM. Thanks for all the work. This ROM is now far better than the stock - which was crap.

So, T95Max+ users, if anyone wants SC2 ROM, do let me know. I'll upload it somewhere.

EDIT: typo

[drsam007]

Did some more debugging. If I do "logcat" on serial console, I can see following in the log:

--------- beginning of crash
01-01 00:00:27.136  3574  3574 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
01-01 00:00:27.136  3574  3574 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.intent.action.USER_STARTED flg=0x50000010 (has extras) } in [email protected]
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.app.LoadedApk$ReceiverDispatcher$Args.lambda$getRunnable$0(LoadedApk.java:1401)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.app.-$$Lambda$LoadedApk$ReceiverDispatcher$Args$_BumDX2UKsnxLVrE6UJsJZkotuA.run(Unknown Source:2)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.os.Handler.handleCallback(Handler.java:873)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.os.Handler.dispatchMessage(Handler.java:99)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.os.Looper.loop(Looper.java:193)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.SystemServer.run(SystemServer.java:454)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.SystemServer.main(SystemServer.java:294)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at java.lang.reflect.Method.invoke(Native Method)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:838)
01-01 00:00:27.136  3574  3574 E AndroidRuntime: Caused by: java.lang.NullPointerException: Attempt to invoke interface method 'int android.security.IKeystoreService.exist(java.lang.String, int)' on a null object reference
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.security.KeyStore.contains(KeyStore.java:241)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.security.KeyStore.contains(KeyStore.java:249)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.net.LockdownVpnTracker.isEnabled(LockdownVpnTracker.java:92)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.ConnectivityService.onUserStart(ConnectivityService.java:4120)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.ConnectivityService.access$4800(ConnectivityService.java:198)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.ConnectivityService$7.onReceive(ConnectivityService.java:4177)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.app.LoadedApk$ReceiverDispatcher$Args.lambda$getRunnable$0(LoadedApk.java:1391)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        ... 9 more

So, I compared "vendor" partition of stock rom with SC rom, and I can see that there is no keystore related items in stock (e.g. /vendor/bin/tee-supplicant, /vendor/lib/optee*.ko, etc.)

[drsam007]

[ [email protected]] init: couldn't write 4035 to /dev/cpuset/camera-daemon/tasks: No such file or directory

there is something wrong in the build you doing, if you ever get the error above there is issues in the apk's of the mix you doing!
There is not much i can help when that error happens, it can be a lot of things.

Thanks for the tip. I actually just used the system, vendor, product, odm and vbmeta PARTITION files from your ROM. Even if I take everything from your ROM except DDR.USB, aml_sdc_burn.UBOOT and _aml_dtb.PARTITION, the issue is same. I'll try to debug more. Thanks for all the help.

[superceleron]

[ [email protected]] init: couldn't write 4035 to /dev/cpuset/camera-daemon/tasks: No such file or directory

there is something wrong in the build you doing, if you ever get the error above there is issues in the apk's of the mix you doing!
There is not much i can help when that error happens, it can be a lot of things.

[drsam007]

I have done some more debugging. I compared the serial output with that of stock rom. There are many differences, but I think main issue starts when it tries to enabled wifi. On working stock rom:

aml_wifi wifi: [usb_power_control] Set WiFi power on !
aml_wifi wifi: [pci_reinit] pci wifi reinit!
aml_wifi wifi: [wifi_power_ioctl] Set sdio wifi power up!
aml_wifi wifi: [wifi_power_ioctl] wifi interface dev type: sdio, length = 4
dhd_module_init: in Dongle Host Driver, version 100.10.315.3 (r771911)
======== dhd_wlan_init_plat_data ========
dhd_wlan_init_gpio: WL_HOST_WAKE=-1, oob_irq=84, oob_irq_flags=0x418
dhd_wlan_init_gpio: WL_REG_ON=-1
dhd_wifi_platform_load: Enter
Power-up adapter 'DHD generic adapter'
wifi_platform_set_power = 1
======== PULL WL_REG_ON(-1) HIGH! ========
aml_wifi wifi: [extern_wifi_set_enable] WIFI  Disable! 482
aml_wifi wifi: [extern_wifi_set_enable] WIFI  Enable! 482
BT_RADIO going: on
AML_BT: going ON
wifi_platform_bus_enumerate device present 1

But in case of modified ROM, it is:

aml_wifi wifi: [usb_power_control] Set WiFi power on !
aml_wifi wifi: [pci_reinit] pci wifi reinit!
aml_wifi wifi: [wifi_power_ioctl] Set sdio wifi power up!
aml_wifi wifi: [wifi_power_ioctl] wifi interface dev type: sdio, length = 4
binder_alloc: 3481: binder_alloc_buf, no vma
binder: 3336:3413 transaction failed 29189/-3, size 24-8 line 3258
binder: send failed reply for transaction 10516 to 3481:3623
binder_alloc: 3481: binder_alloc_buf, no vma
binder: 3335:3394 transaction failed 29189/-3, size 100-0 line 3258
binder_alloc: 3481: binder_alloc_buf, no vma
binder: 3335:3394 transaction failed 29189/-3, size 100-0 line 3258
binder: send failed reply for transaction 14259 to 3626:3626
binder: send failed reply for transaction 14268 to 3626:3828
binder: undelivered TRANSACTION_COMPLETE
binder: undelivered TRANSACTION_ERROR: 29189

Any help is appreciated.

[drsam007]

superceleron I was able to find out why serial console was not working. It was because of defective USB TTL converter. I bought another one, and now I can see the uboot/kernel logs. I've pasted it at:
https://pastebin.com/pEty6p32

I am not sure what is the issue, but I keep seeing lot of "binder" transaction errors. The CPU also starts getting very hot. Nothing happens on screen other than Android boot animation.

[drsam007]

Yes you do of course!

superceleron I bought USB-TTL cable and wired it up with Putty on windows. But on boot, I see only the following message, and nothing comes up after that:

SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:F;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id:

I flashed back stock fw, and after that also the serial console shows only this message. The box itself is booting up fine with stock rom. This box does not have labeling for GND, TX, RX, but I assume that the one with square background is GND, and next one is TX and next RX. How to get Uboot logs now?

[chenzhuops2]

x96 max plus maybe use the fireware?s905x3
lddr3

[superceleron]

You are the greatest! Thanks alot for pointing this out and apologies for all this being a bit off topic. I wrote a bash script to split the boot image and extract the dtb after examining a few methods written in C, python & perl available on github. None of the scripts/code I encountered accounted for multiple device trees and I was only extracting the first one found. I modified my script to extract the correct DTB and hey presto! Script was written to avoid commands dependent on busybox.

Nice one, i bet someone will find it very useful... well by the amount of downloads already, it think it is lol

[5p0ng3b0b]

its a multi dtb, it means 4 DT's in 1 file, so dunno how you unpacked the roms and the dtb file.

You are the greatest! Thanks alot for pointing this out and apologies for all this being a bit off topic. I wrote a bash script to split the boot image and extract the dtb after examining a few methods written in C, python & perl available on github. None of the scripts/code I encountered accounted for multiple device trees and I was only extracting the first one found. I modified my script to extract the correct DTB and hey presto! Script was written to avoid commands dependent on busybox.

[superceleron]

X96 MAX+ 2/16GB s905x3

I'll lose lcd and reset button?
If yes how can I go back to stock rom (short pin on emmc)?

yes you will lose reset button and lcd.
And yes you can short the pin on emmc to flash it again, or if you flash the debug build just install terminal emulator and open it and connect the usb cable to the OTG port and type this commands on the Terminal Emulator(without the ""):
"su"
"reboot update"

And voila...

[majkool]

X96 MAX+ 2/16GB s905x3

I'll lose lcd and reset button?
If yes how can I go back to stock rom (short pin on emmc)?