[ROM] "GENERIC" SC v2.0 USER/USERDEBUG - S905x2 / S905x3 - AndroidTV 9

[5p0ng3b0b]

its a multi dtb, it means 4 DT's in 1 file, so dunno how you unpacked the roms and the dtb file.

You are the greatest! Thanks alot for pointing this out and apologies for all this being a bit off topic. I wrote a bash script to split the boot image and extract the dtb after examining a few methods written in C, python & perl available on github. None of the scripts/code I encountered accounted for multiple device trees and I was only extracting the first one found. I modified my script to extract the correct DTB and hey presto! Script was written to avoid commands dependent on busybox.

[superceleron]

You are the greatest! Thanks alot for pointing this out and apologies for all this being a bit off topic. I wrote a bash script to split the boot image and extract the dtb after examining a few methods written in C, python & perl available on github. None of the scripts/code I encountered accounted for multiple device trees and I was only extracting the first one found. I modified my script to extract the correct DTB and hey presto! Script was written to avoid commands dependent on busybox.

Nice one, i bet someone will find it very useful... well by the amount of downloads already, it think it is lol

[chenzhuops2]

x96 max plus maybe use the fireware?s905x3
lddr3

[drsam007]

Yes you do of course!

superceleron I bought USB-TTL cable and wired it up with Putty on windows. But on boot, I see only the following message, and nothing comes up after that:

SM1:BL:511f6b:81ca2f;FEAT:A0F83180:20282000;POC:F;RCY:0;EMMC:0;READ:0;0.0;CHK:0;
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id:

I flashed back stock fw, and after that also the serial console shows only this message. The box itself is booting up fine with stock rom. This box does not have labeling for GND, TX, RX, but I assume that the one with square background is GND, and next one is TX and next RX. How to get Uboot logs now?

[drsam007]

superceleron I was able to find out why serial console was not working. It was because of defective USB TTL converter. I bought another one, and now I can see the uboot/kernel logs. I've pasted it at:

https://pastebin.com/pEty6p32

I am not sure what is the issue, but I keep seeing lot of "binder" transaction errors. The CPU also starts getting very hot. Nothing happens on screen other than Android boot animation.

[drsam007]

I have done some more debugging. I compared the serial output with that of stock rom. There are many differences, but I think main issue starts when it tries to enabled wifi. On working stock rom:

aml_wifi wifi: [usb_power_control] Set WiFi power on !
aml_wifi wifi: [pci_reinit] pci wifi reinit!
aml_wifi wifi: [wifi_power_ioctl] Set sdio wifi power up!
aml_wifi wifi: [wifi_power_ioctl] wifi interface dev type: sdio, length = 4
dhd_module_init: in Dongle Host Driver, version 100.10.315.3 (r771911)
======== dhd_wlan_init_plat_data ========
dhd_wlan_init_gpio: WL_HOST_WAKE=-1, oob_irq=84, oob_irq_flags=0x418
dhd_wlan_init_gpio: WL_REG_ON=-1
dhd_wifi_platform_load: Enter
Power-up adapter 'DHD generic adapter'
wifi_platform_set_power = 1
======== PULL WL_REG_ON(-1) HIGH! ========
aml_wifi wifi: [extern_wifi_set_enable] WIFI  Disable! 482
aml_wifi wifi: [extern_wifi_set_enable] WIFI  Enable! 482
BT_RADIO going: on
AML_BT: going ON
wifi_platform_bus_enumerate device present 1

But in case of modified ROM, it is:

aml_wifi wifi: [usb_power_control] Set WiFi power on !
aml_wifi wifi: [pci_reinit] pci wifi reinit!
aml_wifi wifi: [wifi_power_ioctl] Set sdio wifi power up!
aml_wifi wifi: [wifi_power_ioctl] wifi interface dev type: sdio, length = 4
binder_alloc: 3481: binder_alloc_buf, no vma
binder: 3336:3413 transaction failed 29189/-3, size 24-8 line 3258
binder: send failed reply for transaction 10516 to 3481:3623
binder_alloc: 3481: binder_alloc_buf, no vma
binder: 3335:3394 transaction failed 29189/-3, size 100-0 line 3258
binder_alloc: 3481: binder_alloc_buf, no vma
binder: 3335:3394 transaction failed 29189/-3, size 100-0 line 3258
binder: send failed reply for transaction 14259 to 3626:3626
binder: send failed reply for transaction 14268 to 3626:3828
binder: undelivered TRANSACTION_COMPLETE
binder: undelivered TRANSACTION_ERROR: 29189

Any help is appreciated.

[superceleron]

[ 23.046960@2] init: couldn't write 4035 to /dev/cpuset/camera-daemon/tasks: No such file or directory

there is something wrong in the build you doing, if you ever get the error above there is issues in the apk's of the mix you doing!
There is not much i can help when that error happens, it can be a lot of things.

[drsam007]

[ 23.046960@2] init: couldn't write 4035 to /dev/cpuset/camera-daemon/tasks: No such file or directory

there is something wrong in the build you doing, if you ever get the error above there is issues in the apk's of the mix you doing!
There is not much i can help when that error happens, it can be a lot of things.

Thanks for the tip. I actually just used the system, vendor, product, odm and vbmeta PARTITION files from your ROM. Even if I take everything from your ROM except DDR.USB, aml_sdc_burn.UBOOT and _aml_dtb.PARTITION, the issue is same. I'll try to debug more. Thanks for all the help.

[drsam007]

Did some more debugging. If I do "logcat" on serial console, I can see following in the log:

--------- beginning of crash
01-01 00:00:27.136  3574  3574 E AndroidRuntime: *** FATAL EXCEPTION IN SYSTEM PROCESS: main
01-01 00:00:27.136  3574  3574 E AndroidRuntime: java.lang.RuntimeException: Error receiving broadcast Intent { act=android.intent.action.USER_STARTED flg=0x50000010 (has extras) } in com.android.server.ConnectivityService$7@2fe0dfa
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.app.LoadedApk$ReceiverDispatcher$Args.lambda$getRunnable$0(LoadedApk.java:1401)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.app.-$$Lambda$LoadedApk$ReceiverDispatcher$Args$_BumDX2UKsnxLVrE6UJsJZkotuA.run(Unknown Source:2)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.os.Handler.handleCallback(Handler.java:873)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.os.Handler.dispatchMessage(Handler.java:99)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.os.Looper.loop(Looper.java:193)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.SystemServer.run(SystemServer.java:454)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.SystemServer.main(SystemServer.java:294)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at java.lang.reflect.Method.invoke(Native Method)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:493)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:838)
01-01 00:00:27.136  3574  3574 E AndroidRuntime: Caused by: java.lang.NullPointerException: Attempt to invoke interface method 'int android.security.IKeystoreService.exist(java.lang.String, int)' on a null object reference
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.security.KeyStore.contains(KeyStore.java:241)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.security.KeyStore.contains(KeyStore.java:249)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.net.LockdownVpnTracker.isEnabled(LockdownVpnTracker.java:92)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.ConnectivityService.onUserStart(ConnectivityService.java:4120)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.ConnectivityService.access$4800(ConnectivityService.java:198)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at com.android.server.ConnectivityService$7.onReceive(ConnectivityService.java:4177)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        at android.app.LoadedApk$ReceiverDispatcher$Args.lambda$getRunnable$0(LoadedApk.java:1391)
01-01 00:00:27.136  3574  3574 E AndroidRuntime:        ... 9 more

So, I compared "vendor" partition of stock rom with SC rom, and I can see that there is no keystore related items in stock (e.g. /vendor/bin/tee-supplicant, /vendor/lib/optee*.ko, etc.)

[drsam007]

superceleron I have a breakthrough. Seeing that "vendor" partition had lot of differences, I took only "system" partition from your ROM, and it works beautifully! I also did vendor partition cleanup by comparing what was there in your ROM. Thanks for all the work. This ROM is now far better than the stock - which was crap.

So, T95Max+ users, if anyone wants SC2 ROM, do let me know. I'll upload it somewhere.

EDIT: typo

[drsam007]

I have upload SC2 rom (userdebug version) for T95 Max+ here:

https://mega.nz/#!zJVRVIpb!sed1AAXR4mYWaoWBV5yBMIFb7lbCGcN5_A4tyHG9OlA

[superceleron]

ye i forgot... my roms were made for L1 so it as tee/optee since is needed for L1 support (the boxes that support it)

[drsam007]

ye i forgot... my roms were made for L1 so it as tee/optee since is needed for L1 support (the boxes that support it)

But I thought s905x3 supported L1. Is it possible that some boxes with same SoC don't support it?

[drsam007]

superceleron sorry for nagging so much, but one last question - I put a simple "android tv" splash as "bootup" logo, and after flashing it, it is shown correctly - but only during first boot. After that if I reboot, it shows me messed up superceleron logo, even though I have not even taken the logo partition from your ROM. I took only the "system" and "recovery" partitions. I am not able to debug how this bootup logo is getting overwritten and where. Any suggestion?

[superceleron]

But I thought s905x3 supported L1. Is it possible that some boxes with same SoC don't support it?

No.. 99% of the boxes out there with a s905x2/x3 does not support L1

superceleron sorry for nagging so much, but one last question - I put a simple "android tv" splash as "bootup" logo, and after flashing it, it is shown correctly - but only during first boot. After that if I reboot, it shows me messed up superceleron logo, even though I have not even taken the logo partition from your ROM. I took only the "system" and "recovery" partitions. I am not able to debug how this bootup logo is getting overwritten and where. Any suggestion?

That one you need to figure it out by yourself hehe