[Android Software Development] mad_ady:
Hello everyone. Not sure if this forum is the correct place for this, but here goes:

I'm trying to build a CWM-Recovery for my Allview SpeedCity (Onda v701 clone) tablet. I followed the guide here: http://xda-university.com/as-a-developer/porting-clockworkmod-recovery-to-a-new-device and with help from ultravioletnanokitty I managed to get a semi-working recovery.

I tested with the fakeflash method, and I get the recovery screen, the keys work but I am unable to mount /system or /data. If I log in via adb shell I get logged in as UID 2000 (shell), not root, so I am unable to try mounting anything. ultravioletnanokitty helped me add the partition offsets in the build environment, but I still get mount errors.

I uploaded the build environment on github if anybody wants to take a look: https://github.com/mad-ady/android_device_Allview_SpeedCity

So, my mtd partitions are as follows (from the stock firmware):

shell@android:/ $ cat /proc/mtd
dev: size erasesize name
mtd0: 00800000 00200000 "logo"
mtd1: 00800000 00200000 "aml_logo"
mtd2: 00800000 00200000 "recovery"
mtd3: 00800000 00200000 "boot"
mtd4: 40800000 00200000 "system"
mtd5: 10000000 00200000 "cache"
mtd6: 40400000 00200000 "userdata"
mtd7: 16cc00000 00200000 "NFTL_Part"
mtd8: 00060000 00001000 "bootloader"
mtd9: 00008000 00001000 "ubootenv"

And here is some data I managed to get from adb:

~ $ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)
~ $ pwd
/
~ $ uname -a
Linux localhost 3.0.8-geec2035-dirty #1 SMP PREEMPT Wed Dec 19 11:22:27 CST 2012 armv7l GNU/Linux
~ $ cat /etc/fstab
/dev/block/mtdblock5 /cache yaffs2 rw
/dev/block/mtdblock6 /data ubifs rw
/dev/block/mtdblock4 /system ubifs rw
/dev/block/mmcblk0p# /sdcard vfat rw
~ $ cat /proc/mounts
rootfs / rootfs rw 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
/dev/block/mtdblock5 /cache yaffs2 rw,nodev,noatime,nodiratime 0 0
~ $ cat /proc/filesystems
nodev	sysfs
nodev	rootfs
nodev	bdev
nodev	proc
nodev	cgroup
nodev	tmpfs
nodev	devtmpfs
nodev	binfmt_misc
nodev	debugfs
nodev	securityfs
nodev	sockfs
nodev	usbfs
nodev	pipefs
nodev	anon_inodefs
nodev	devpts
ext3
ext2
ext4
nodev	ramfs
vfat
msdos
iso9660
hfsplus
ntfs
nodev	fuse
fuseblk
nodev	fusectl
udf
yaffs
yaffs2
nodev	mtd_inodefs
nodev	ubifs
~ $
~ $ cat /proc/mtd
dev: size erasesize name
mtd0: 00800000 00200000 "logo"
mtd1: 00800000 00200000 "aml_logo"
mtd2: 00800000 00200000 "recovery"
mtd3: 00800000 00200000 "boot"
mtd4: 40800000 00200000 "system"
mtd5: 10000000 00200000 "cache"
mtd6: 40400000 00200000 "userdata"
mtd7: 16cc00000 00200000 "NFTL_Part"
mtd8: 00060000 00001000 "bootloader"
mtd9: 00008000 00001000 "ubootenv"
~ $ mount /system
mount: permission denied (are you root?)
~ $ ls -l /system/
drwxr-xr-x 2 root root 0 Jul 7 19:42 bin
~ $ ls -l /system/bin/
lrwxrwxrwx 1 root root 8 Jul 7 19:42 sh -> /sbin/sh
~ $ ls -l /data
~ $ ls -l /dev/block/mtdblock*
brw------- 1 root root 31, 0 Jul 7 19:42 /dev/block/mtdblock0
brw------- 1 root root 31, 1 Jul 7 19:42 /dev/block/mtdblock1
brw------- 1 root root 31, 2 Jul 7 19:42 /dev/block/mtdblock2
brw------- 1 root root 31, 3 Jul 7 19:42 /dev/block/mtdblock3
brw------- 1 root root 31, 4 Jul 7 19:42 /dev/block/mtdblock4
brw------- 1 root root 31, 5 Jul 7 19:42 /dev/block/mtdblock5
brw------- 1 root root 31, 6 Jul 7 19:42 /dev/block/mtdblock6
brw------- 1 root root 31, 7 Jul 7 19:42 /dev/block/mtdblock7
brw------- 1 root root 31, 8 Jul 7 19:42 /dev/block/mtdblock8
brw------- 1 root root 31, 9 Jul 7 19:42 /dev/block/mtdblock9
~ $ ls -l /sbin/su.recovery
-rwxr-xr-x 1 root shell 95900 Jul 7 19:42 /sbin/su.recovery

So, apart from the fact that /system is not an empty mount point, I'm not sure what's preventing mounting the filesystems.

Also, how am I supposed to become root? The su.recovery binary is not suid. Should I make it suid? A different idea is to tweak /etc/passwd and change the UID of user shell and make it "0", but I think it's a dirty solution.

Also, here is a dmesg output from the recovery kernel: http://pastebin.com/tiDYQ2mg

I am worried about these messages:

<5>[ 2.876367@1] 0x000002800000-0x000043000000 : "system"
<4>[ 2.880025@1] NAND bbt detect factory Bad block at b400000
<4>[ 2.885636@1] NAND bbt detect factory Bad block at b600000
<4>[ 2.891310@1] NAND bbt detect factory Bad block at 25800000
<4>[ 2.897016@1] NAND bbt detect factory Bad block at 32000000
<5>[ 2.904301@1] 0x000043000000-0x000053000000 : "cache"
<5>[ 2.909272@1] 0x000053000000-0x000093400000 : "userdata"
<4>[ 2.913124@1] NAND bbt detect factory Bad block at 81800000
<4>[ 2.918794@1] NAND bbt detect factory Bad block at 81a00000
<5>[ 2.926166@1] 0x000093400000-0x000200000000 : "NFTL_Part"
<4>[ 3.273654@1] aml nand read oob failed at page:647680 blk 2530 chip 0, readretry_failed_cnt:1
<4>[ 3.276629@1] MICRON NAND set partmeters here and read_retry_cnt:1
<4>[ 3.282875@1] aml_nand_set_reg_value_micron, REG(0x89): value:0x1
<4>[ 3.289227@1] aml_nand_set_reg_value_micron, REG(0x89): value:0x0

It looks like there are bad blocks in the NAND, although I don't see their effects in the main ROM. Could these messages prevent the mounting of the filesystem? If yes, then why is the main ROM still booting?

One more thing worries me. I first tried to compile the firmware while the development files (the repo) were mounted remotely over ssh. I think this might have messed some permissions (and removed some suid bits in various places). Running the following command yields no files:

[adrianp@panopticon-proxy android]$ find . -perm -4000
[adrianp@panopticon-proxy android]$

Thanks in advance for any tips.