yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] NamenIos:
Thanks for the effort Bontzky, these appear to be old logs though. The cache one boots twrp successfully, and the second one seems to set the vibration motor and leds successful.

Wow, just to clarify, so if I get the bootloop on LP due to the recovery I can just flash the old kk Kernel.sin inside the ftf and I can boot into the recovery with the volume rocker? This is very good information. In the next days I might try some debugging of the chargemon script with the notification led … not the prettiest but it should work.
[Sony Cross-Device General] McBane87:
Yes, with old kernel recovery seems to work. But not lollipop itself.
[Sony Cross-Device General] NamenIos:
Great discovery! This is probably it. Maybe [MENTION=3975929]zxz0O0[/MENTION] knows more. Disabling SELinux is not needed in KK as it seems.

The modulecrcpatch shouldn't find all symbols in every module afaik. I am not sure, but probably building the byeselinux module on the phone with lp itsself would probably mean that it should work without modulecrcpatch. Maybe that fixes it, I'll probably try in a few days if there are no new information surfacing, it is possible that [MENTION=3975929]zxz0O0[/MENTION] will shed some light into this.

edit the Kernel source got put onto github 23hours ago, this could help too.

ok next edit, getenforce returns Enforcing on kk. In the README_Xperia file on github it is set to permissive at boot time(?) for the LP Kernel:

Step 2: Assembling the boot.img
$ mkbootimg --kernel zImage --ramdisk ramdisk.img --pagesize 2048 --base 0x80200000 \
--cmdline "androidboot.hardware=qcom user_debug=23 msm_rtb.filter=0x3F ehci-hcd.park=3 [B]androidboot.selinux=permissive[/B] vmalloc=400M androidboot.bootdevice=msm_sdcc.1" \
--ramdisk_offset 0x02000000 --output boot.img

This could maybe mean that loading the module byeselinux is not needed? This option is not present on LP Kernels for the Z1 to Z4/Z3+ I'll test in the next days if commenting out (/deleting) the following parts will fix the bootloop.

# Part of byeselinux, requisit for Lollipop based firmwares.
echo "Checking if byeselinux is required..." >> ${PREPLOG}
ANDROIDVER=`${BUSYBOX} echo "$(DRGETPROP ro.build.version.release) 5.0.0" | ${BUSYBOX} awk '{if ($2 != "" && $1 >= $2) print "lollipop"; else print "other"}'`
echo "ro.build.version.release=$(DRGETPROP ro.build.version.release), test result: $ANDROIDVER" >> ${PREPLOG}
if [ "$ANDROIDVER" = "lollipop" ]; then
echo "Byeselinux is required." >> ${PREPLOG}
# This will allow the modification of the ramdisk, but will only be loaded if needed.
if [ -e "/system/lib/modules/byeselinux.ko" ]; then
echo "Module found, loading it now..." >> ${PREPLOG}
${BUSYBOX} insmod /system/lib/modules/byeselinux.ko
if [ "$?" != "0" -a "$?" != "17" ]; then
echo "Loading the module failed with exit code $?" >> ${PREPLOG}
fi
else
echo "Byeselinux module not found!" >> ${PREPLOG}
fi
fi

If someone wants to try before me don't blame me if it breaks thinks.
[Sony Cross-Device General] McBane87:
By modifying chargemon to not load byselinux, I have no Bootloop anymore and will get Lollipop loaded.

BUT Recovery isn't working. On Boot at the time where (on phone) you would feel vibration, you see only a much brighter RED LED followed by normal boot to Lollipop.

This is generated by following Function:

EXIT2CM(){
# Turn on a red led, as a visual warning to the user
SETLED on 255 0 0

/system/xbin/busybox sleep 2

# Turn off LED
SETLED off

# Ending log
DATETIME=`/system/xbin/busybox date +"%d-%m-%Y %H:%M:%S"`
echo "STOP Dual Recovery STAGE 1 at ${DATETIME}" >> ${PREPLOG}

/system/xbin/busybox umount -l /storage/sdcard1

/system/xbin/busybox rmmod -f byeselinux.ko

export PATH="${_PATH}"

exec /system/bin/chargemon.stock
exit 0
}

Only logfile generated:

/tmp/XZDualRecovery/preperation.log

EDIT

I think we need byeselinux:

shell@SGP321:/ $ getenforce
Enforcing
[Sony Cross-Device General] NamenIos:
Thanks, the recovery fails at copying the busybox binary (Install busybox to /sbin… RET=1).

Maybe this is caused by a stupid error by me in commenting all out, including the line that sets ANDROIDVER which is needed later in chargemon, maybe this is caused by selinux doing its work. Just commenting out ${BUSYBOX} insmod /system/lib/modules/byeselinux.ko should be better I guess. But making a folder on the sdcard ("mkdir /storage/sdcard1/XZDualRecovery") fails too, which points at selinux imo (even though why should it be active for the sdcard, but whatever).

Does anyone know why just an "echo 0 > /sys/fs/selinux/enforce" is not enough?

If you want to test, first modify the chargemon file at line 257 (${BUSYBOX} insmod /system/lib/modules/byeselinux.ko) and put a # at the beginning of that line. This should remove the bootloop, maybe even the recovery works, but I don't think so.

If you are an in an experimenting mood you can try (at your own risk) to put "echo 0 > /sys/fs/selinux/enforce" (without " ") into that line. Maybe (probably) it is better to put "echo 1 > /sys/fs/selinux/enforce" into line 116 (), but I don't think this will help.

Weird thing is mount -o remount,rw rootfs / and /system/xbin/busybox mount -o remount,rw /system "work" in they return that they are successful, but "rm /sbin/ric" doesn't.
[Sony Cross-Device General] McBane87:
It's not your fault. I modifyied the chargemon myself. Didn't used your code.

But as I mentioned above some minutes ago:

shell@SGP321:/ $ getenforce
Enforcing

I tried already this instead of loading byeselinux.ko with chargemon:

su - c setenforce 0

But permission denied....

EDIT:

Here are the Results of all Options:

# Part of byeselinux, requisit for Lollipop based firmwares.
echo "Checking if byeselinux is required..." >> ${PREPLOG}
ANDROIDVER=`${BUSYBOX} echo "$(DRGETPROP ro.build.version.release) 5.0.0" | ${BUSYBOX} awk '{if ($2 != "" && $1 >= $2) print "lollipop"; else print "other"}'`
echo "ro.build.version.release=$(DRGETPROP ro.build.version.release), test result: $ANDROIDVER" >> ${PREPLOG}
if [ "$ANDROIDVER" = "lollipop" ]; then
echo "Byeselinux.ko is not working for Lollipop on TabZ." >> ${PREPLOG}
echo "Trying 'setenforce 0' " >> ${PREPLOG}
setenforce 0 >> ${PREPLOG} 2>> ${PREPLOG}
echo "Trying 'su -c setenforce 0' " >> ${PREPLOG}
/system/xbin/su -c setenforce 0 >> ${PREPLOG} 2>> ${PREPLOG}
echo "Trying 'echo 0 > /sys/fs/selinux/enforce' " >> ${PREPLOG}
echo 0 > /sys/fs/selinux/enforce >> ${PREPLOG} 2>> ${PREPLOG}
echo "Trying 'su -c echo 0 > /sys/fs/selinux/enforce' " >> ${PREPLOG}
/system/xbin/su -c echo 0 > /sys/fs/selinux/enforce >> ${PREPLOG} 2>> ${PREPLOG}
echo "SELINUX Mode: $(/system/bin/getenforce)" >> ${PREPLOG}
fi

LOG:

Trying 'setenforce 0'
setenforce: Could not set enforcing status: Permission denied
Trying 'su -c setenforce 0'
setenforce: Could not set enforcing status: Permission denied
Trying 'echo 0 > /sys/fs/selinux/enforce'
0
Trying 'su -c echo 0 > /sys/fs/selinux/enforce'
0
SELINUX Mode: Enforcing

The "echo" Options seem not to throw any error, but the Errors seen above in preperation.log and are still there.

SELINUX also still enforcing
[Sony Cross-Device General] NamenIos:
Thank you. I am in the process of installing LP on my phone to fiddle around with it myself and explore how this Sony RIC works and if it is active, on KK it seems like this is not the case.
[Sony Cross-Device General] McBane87:
I think the Problem is still SELinux. Because it is in Enforcing Mode. So we need a working byselinux.ko
[Sony Cross-Device General] NamenIos:
Hm, in KK it is on Enforcing too in a booted system, but you don't need the byeselinux module there. But well, I don't even know why we need a Kernel module instead of a simple echo ....

Well I am copying the zip as I write, takes forever in recovery though.
[Sony Cross-Device General] v7:
SELinux in Android 5.x.x is so different from that in 4.4.x.

Tapped from my furious dogo ;)
[Sony Cross-Device General] McBane87:
I still don't get how byeselinux.ko is working at all.

It seems to look for some selinux symbol in Kernel and then is loading another module, which doesn't make any sense to me.

char* argv[] = { "/system/bin/sh", "-c", "/system/bin/insmod /system/lib/modules/mhl_sii8620_8061_drv_orig.ko", NULL };

Because this module isn't existing on both of my devices TabZ (no working byeselinux.ko) and Z1c (working byeselinux.ko).
[Sony Cross-Device General] NamenIos:
This is not helping without clarification what differs.

I am preparing food, eat and then I look into Selinux, Kernel modules and RIC. The LP update seemed successful.

edit 22:01: got into recovery with lp and the old kernel, mounted system, started rickiller.sh - two mount problems and i cant boot lp anymore. rickiller.sh overwrites /system/bin/ric
[Sony Cross-Device General] McBane87:
What I found out so far about byeselinux.ko CRASH:

If I remove the Pointer (*) of "_selinux_enabled" and "_selinux_enforcing" in byeselinux.c and compile it again, I don't get any crash, but SELinux is still enforcing:

dmesg:

<6>[ 756.372894] byeselinux: module loaded
<6>[ 756.630004] byeselinux: old selinux_enabled 1
<6>[ 756.630554] byeselinux: old selinux_enforcing: 0
<6>[ 756.638549] byeselinux: current selinux_enabled 1
<6>[ 756.639099] byeselinux: current selinux_enforcing: 0
<6>[ 756.639617] byeselinux: trying to load original module

check:

shell@SGP321:/ $ getenforce
Enforcing

BTW: I don't know very much about C Programming, so I'm only playing around here.

EDIT:

Is it possible that those Symbols just don't exist in Z-Series?

Z1c:

root@D5503:/ # cat /proc/kallsyms | grep selinux_en
00000000 t selinux_enabled_setup
00000000 t __setup_str_selinux_enabled_setup
00000000 t __setup_selinux_enabled_setup
[B][COLOR="red"]00000000 D selinux_enabled
00000000 B selinux_enforcing[/COLOR][/B]

root@D5503:/ # insmod /system/lib/modules/byeselinux.ko

root@D5503:/ # cat /proc/kallsyms | grep selinux_en
00000000 t selinux_enabled_setup
00000000 t __setup_str_selinux_enabled_setup
00000000 t __setup_selinux_enabled_setup
[B][COLOR="Red"]00000000 D selinux_enabled
00000000 B selinux_enforcing
00000000 b _selinux_enforcing [byeselinux]
00000000 b _selinux_enabled [byeselinux][/COLOR][/B]

TabZ:

root@SGP321:/ # cat /proc/kallsyms | grep selinux_en
00000000 t selinux_enabled_setup

EDIT 2

Those Adresses are not the real ones. They have all Zero Values, which is a Security Feature.

To see real Values you have to first do

echo 1 > /proc/sys/kernel/kptr_restrict

After that you can do this again:

root@SGP321:/ # cat /proc/kallsyms | grep selinux_en
c0d200b4 t selinux_enabled_setup
[Sony Cross-Device General] NamenIos:
I can't boot into LP again neither after disabling the module load in chargemon, nor after renaming chargemon and renaming chargemon.stock to chargemon. This complicates testing, by a lot. At least I have the phone in a state I would call somewhat usable and it's on LP.

Also, a very good finding McBane87, this saves time to try to compile the module with the address patches.

I hope I find some time late this evening to look further into things.
[Sony Cross-Device General] lolexfor4pda:
http://xdaforums.com/xperia-zl/development/kernel-ub-t3132806 (UB Only)

NUT,It may be something to help fix XZDualRecovery
[Sony Cross-Device General] NamenIos:
No it won't, McBane87 narrowed the problem down as you can read. And it has nothing to do with that. It is nice that you want to help, but the way XZDualRecovery starts up and boots into the recovery is the problem.

I now have some time to look into this for a few hours I think. I got a nice promising PM with some information I have to look into and write back, I have to look into weather the SECURITYFS Kernel option is used for the ramdisk or could be used for anything related to our problem or if it is just for sysfs entries. And I really hope I don't have to compile the modules with our Kernel source or to read the Android SE Linux mailinglist.
[Sony Cross-Device General] Rootk1t:
Guys, is NUT's kernelbuilder working now?:confused: Tried uploading kernel with 3 different browsers. It either gives error or bootloops uploading :silly:
[Sony Cross-Device General] NamenIos:
Well bad message for the Z1-Z4 guys, this change will maybe come to your device too:

/security/selinux/hooks.c
static int sb_finish_set_opts(struct super_block *sb)
/*
* Special handling for rootfs. Is genfs but supports
* setting SELinux context on in-core inodes.
*/
if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
sbsec->flags |= SE_SBLABELSUPP;

I believe that could be one of the problems XZDualRecovery is facing.

I don't have a clue why selinux_enforcing is not exposed in the XZ Kernel.

Lots of requests for you [MENTION=4712883]McBane87[/MENTION] , sorry in advance, hope it doesn't bother you too much.

Can you post a list of all selinux Kernel modules with selinux in your Z1c please? cat /proc/kallsyms | grep selinux

Can you give me a short rundown what you did to compile the module? Just extracting the XZ Kernel, extracting the toolchain and putting the paths into the makefile variables KERNEL_BUILD KERNEL_CROSS_COMPILE and do a make all?

Did you manage to change chargemon script in a way that LP will boot? I get bootloops, no matter if I rename the module, if I comment the module loading out or if I rename chargemon to chargemon.dualrec and rename the chargemon.stock binary to chargemon. At least that was the case if I remember correctly.

Thanks, I hope this will help me figuring out what is wrong.

I will look into the ramdisk a little and maybe into the sepolicies of the rootfs. Hopefully I get to dive into the helpful PM and write back.
[Sony Cross-Device General] Sebi673:
If you guys need a guinea pig with XZ C6603 LB KK (with PRF for .454 NCB) I'm all yours. I also have a Z3 if you need a file or smthg. :D

I gave L a try but some xposed modules made it bootloop and without recovery I went back to KK, so I'm dieing to have L working.
[Sony Cross-Device General] McBane87:
Could this be our Problem?

(It's a Config-Option of Kernel.)

Z1c:

CONFIG_KALLSYMS_ALL=y

TabZ:

# CONFIG_KALLSYMS_ALL is not set
[Sony Cross-Device General] Bontzky:
According to official Android sources g o o . g l / s K P O N p (remove spaces) this option should be anabled by default on all android devices. It's necessary for kernel debugging as it loads all names of variables from the data sections.
[Sony Cross-Device General] McBane87:
OK, maybe it is recommended but Sony didn't implement it on Kernel-Source (defconfig):

cat .config | grep KALLSYMS
CONFIG_KALLSYMS=y
# CONFIG_KALLSYMS_ALL is not set
[Sony Cross-Device General] NamenIos:
Wow this is great thanks. I am not sure if I get to work at it at all, I am tired and tied until late evening. Just wanted to say thanks. There could be a workaround for the symbols, afaik you can lookup the names in another way inside Kernel modules. I'll see if I fire up a ubuntu vm or if I get the toolchain to work on my arch vm, then I'll search for the symbols in the Kernel and if I can access them.
[Sony Cross-Device General] McBane87:
Do you like to share this Idea with me :)

EDIT:

Now it is official. This option is causing the problem with the nonexistig symbols/addresses in /proc/kallsyms

CONFIG_KALLSYMS_ALL

I just build a kernel with this option enabled and was able to see those symbols.

(Had to unlock bootloader and wipe data, to make this possible :( )
[Sony Cross-Device General] SquallATF:
[MENTION=3233991]NamenIos[/MENTION] [MENTION=4712883]McBane87[/MENTION]

can this help?

echo "0" > /proc/sys/kernel/kptr_restrict
cat /proc/kallsyms | grep selinux

then get

from my xperia z
[Sony Cross-Device General] McBane87:
Thanks, but this is something we already know.
[Sony Cross-Device General] sumitverma1:
Is there any recovery for xperia c3 dual d2502..
[Sony Cross-Device General] zxz0O0:
Nice find. Seems this is indeed the problem. The symbols are not registred and a null pointer exception occurs. I will try changing the method to patch selinux.

Anyway, have you tried installing dualrecovery without byeselinux on LP version? What happens?
[Sony Cross-Device General] McBane87:
Yes, I did:

http://xdaforums.com/showpost.php?p=61272315&postcount=5295
[Sony Cross-Device General] SquallATF:
I have successful get byeselinux work on my xperiz z

[IMG="byeselinux"]http://squallatf.info/byeselinux.png[/IMG]

I have build kernel with offical source and default config, and use IDA compare my self build kernel with offical kernel, and try to find symble address.

Then found selinux_is_enabled address is 0xc03052dc (can find in /proc/kallsyms ) it is same in my self build System.map, and selinux_enabled address is 0xc0ece05c in IDA, also same in System.map, and selinux_enforcing address is 0xc10570a4 in IDA, also same in System.map

I changed byeselinux sorce from

_selinux_is_enabled = (void*)kallsyms_lookup_name("selinux_is_enabled");
_selinux_enabled = (unsigned long*)kallsyms_lookup_name("selinux_enabled");
_selinux_enforcing = (unsigned long*)kallsyms_lookup_name("selinux_enforcing");

to

_selinux_is_enabled = (void*)0xc03052dc;
_selinux_enabled = (unsigned long*)0xc0ece05c;
_selinux_enforcing = (unsigned long*)0xc10570a4;

then it work.
[Sony Cross-Device General] McBane87:
Thanks, this was something I was trying on TabZ, too.

But couldn't find out correct address. The Adresses of the symbols in official Kernel-Source System.map (build for TabZ) where different than those in /proc/kallsyms.

So nice finding. But I think this solution is only individual usable for Xperia Z. Not for the other Z-Devices.

TabZ:

c0305650 T selinux_is_enabled
[Sony Cross-Device General] SquallATF:
yep, I think we can make these addresses as kernel module parameters and let it work for all other Z devices
[Sony Cross-Device General] McBane87:
Did I understand something wrong or did you? :)

On my TabZ those Addresses are wrong. So not working for all Z-Devices.
[Sony Cross-Device General] SquallATF:
Sorry for my English.

I mean is to find the address of each device, may be a hard work but feasible，
[Sony Cross-Device General] McBane87:
Ah OK, Maybe you can tell me how I can find out?

My System.map is not having the right address.
[Sony Cross-Device General] SquallATF:
I use aosp gcc4.8 arm-eabi- cross compile,and get some symble same address.

first you need unpack piggy.lzo from kernel image may help script(I down this with winhex)

second use lzop -d piggy.lzo get striped vmlinux binarry name is piggy. cat /proc/kallsyms > /sdcard/kallsyms and take it on computer, it will be useful later.

open piggy with IDA and set processor type to ARM Little-endian [ARM]

[IMG="step 1"]http://xdaforums.com/attachment.php?attachmentid=3360625&stc=1&d=1434195135[/IMG]

In Disassembly memory organization window

set ROM start address to 0xc00080000, ROM size to 0x2000000, Loading address to 0xc00080000, then start analysis.

[IMG="setp 2"]http://xdaforums.com/attachment.php?attachmentid=3360626&stc=1&d=1434195135[/IMG]

after analysis open File -> script command, run follow python script, change J:\firmware\kallsyms to your kallsyms path(this setp is not needed, just make code easy to read).

ksyms = open(r"J:\firmware\kallsyms") # path to the kallsyms/map file
for line in ksyms:
if line[9]=='A': continue # skip absolute symbols
addr = int(line[:8], 16)
name = line[11:-1]
if name[-1]==']': continue # skip module symbols
idaapi.set_debug_name(addr, name)
MakeNameEx(addr, name, SN_NOWARN)
Message("%08X: %s\n"%(addr, name))

[IMG="setp 3"]http://xdaforums.com/attachment.php?attachmentid=3360627&stc=1&d=1434195135[/IMG]

find selinux_is_enabled address from kallsyms, in my case is c03052dc, jump to this address in IDA, then get selinux_enabled address 0xC0ECE05C in my case

[IMG="setp 4"]http://xdaforums.com/attachment.php?attachmentid=3360628&stc=1&d=1434195135[/IMG]

next find sel_read_enforce address from kallsyms, in my case is c0302314, jump to this address in IDA, then get selinux_enforcing address 0xC10570A4 in my case

[IMG="setp 5"]http://xdaforums.com/attachment.php?attachmentid=3360629&stc=1&d=1434195135[/IMG]
[Sony Cross-Device General] McBane87:
Woah, thank you.

One question: Those Symbol-Addresses you found in IDA.

Are they the same as found in your /path/to/kernel/source/System.map ?
[Sony Cross-Device General] SquallATF:
In my case selinux_is_enabled,selinux_enabled and selinux_enforcing are same in System.map. but some address are not same.
[Sony Cross-Device General] SquallATF:
All addresses taked from my build, if these addresses can work then we don't need found them with IDA

fusion3_pollux_defconfig Xperia Tablet Z Tablet SGP351/SGP341
c0305638 T selinux_is_enabled
c0ece5dc D selinux_enabled
c10565e4 B selinux_enforcing

fusion3_pollux_windy_defconfig Xperia Tablet Z Tablet SGP311(16G)/SGP312(32G)
c0305638 T selinux_is_enabled
c0ecdcdc D selinux_enabled
c1055ce4 B selinux_enforcing

fusion3_odin_defconfig Xperia ZL C6503/C6506/C6502
c03059d4 T selinux_is_enabled
c0ecc01c D selinux_enabled
c1054ea4 B selinux_enforcing

fusion3_dogo_defconfig Xperia ZR C5503/C5502
c03051f0 T selinux_is_enabled
c0ecdfdc D selinux_enabled
c10582e4 B selinux_enforcing
[Sony Cross-Device General] McBane87:
Unfortunately, those values are not working for my Tablet.

Are you able to get those Values out of Stock-Kernel, too?

I can attach the kernel extracted out of kernel.sin.
[Sony Cross-Device General] zxz0O0:
Try replacing the byeselinux in the dualrecovery package with this one: https://www.mediafire.com/?bgm9133149thb4b

It should correctly set selinux_enabled, but it won't set enforcing. So I'm not sure if that's enough to boot recovery.
[Sony Cross-Device General] McBane87:
It's is loading:

<6>[ 2072.799530] byeselinux: module loaded
<6>[ 2072.812469] byeselinux: old selinux_enabled 1
<6>[ 2072.958099] byeselinux: Error finding symbols in kallsyms
<6>[ 2072.958648] byeselinux: Trying different method
<6>[ 2072.970214] byeselinux: current selinux_enabled 0
<6>[ 2072.970581] byeselinux: trying to load original module

But Recovery still isn't working.
[Sony Cross-Device General] SquallATF:
selinux_enabled is 0xc0ece5dc

if sel_read_enforce is c0302688 then selinux_enforcing is 0xc10565e4
[Sony Cross-Device General] zxz0O0:
Just to make sure, you didn't simply execute insmod, you let dualrecovery set it up. Correct? If so, I'll try to also implement selinux_enforcing.
[Sony Cross-Device General] McBane87:
Yes, I did both.

First just insmod manually, to check if it is loading.

After that copied new byselinux.ko into XZDR-Installer and excecuted the hole installation correctly.

---------- Post added at 04:02 PM ---------- Previous post was at 03:59 PM ----------

Great, these are the right addresses for me.

It's loading and working.

Thank you.