[Xperia Z4/Z3+ Q&A, Help & Troubleshooting] brzezik:
Hi all,

I have unlocked bootloader and flashed zROM v1.1 so I got root. I want to enable Diag port to connect phone to the QXDM. Here is what i know.

Most important files are /init.usbmode.sh and /init.usbmode.platform.sh:

/init.usbmode.sh:

-disables USB and writes VendorID

echo 0 > /sys/class/android_usb/android0/enable
echo ${VENDOR_ID} > /sys/class/android_usb/android0/idVendor

-it setups engineering port with /init.usbmode.platform.sh if "getprop perist.usb.eng" is set to 1

-writes PID and USB FUNCTION

echo ${PID} > /sys/class/android_usb/android0/idProduct
echo ${USB_FUNCTION} > /sys/class/android_usb/android0/functions

-enables USB

echo 1 > /sys/class/android_usb/android0/enable

/init.usbmode.platform.sh:

setup_engmode()
{
PID_PREFIX=0
SUPPORT_RMNET=1
case ${1} in
"mass_storage,adb") PID_PREFIX=6 ;;
"mtp,adb") PID_PREFIX=5 ;;
"rndis,adb")
PID_PREFIX=D
SUPPORT_RMNET=0
;;
*)
/system/bin/log -t ${TAG} -p i "No eng PID for: ${1}"
exit 1
;;
esac

PID=${PID_PREFIX}146
USB_FUNCTION=${1},serial,diag
echo diag > /sys/class/android_usb/android0/f_diag/clients
echo smd,tty > /sys/class/android_usb/android0/f_serial/transports
if [ ${SUPPORT_RMNET} -eq 1 ] ; then
USB_FUNCTION=${USB_FUNCTION},rmnet
echo qti,bam2bam_ipa > /sys/class/android_usb/android0/f_rmnet/transports
fi

echo "${PID} ${USB_FUNCTION}"
exit 0
}

set_rndis_qc()
{
(...)
}

case ${1} in
"eng_setup")
if [ $# -ne 2 ] ; then
exit 1
fi

setup_engmode ${2}
;;
"set_rndis_qc")
set_rndis_qc
exit 0
;;
esac

-returns PID and USB_FUNCTION to /init.usbmode.sh, By default phone has USB_FUNCTION set to "mtp,adb" so there should be PID=5146 and USB_FUNCTION=mtp,adb,serial,diag,rmnet

-echoes

echo diag > /sys/class/android_usb/android0/f_diag/clients
echo qti,bam2bam_ipa > /sys/class/android_usb/android0/f_rmnet/transports

The main issue is that "getprop perist.usb.eng" doesn't exist.

As you know this Android runs on SE Linux. In /property_contexts file we can find following lines:

#line 1 "vendor/semc/system/sepolicy/Bootstrap_Applications/1.0.0/usbeng/property_contexts"
persist.usb.eng u:object_r:usb_eng_prop:s0
sys.usb.diag_mode u:object_r:usb_diag_mode_prop:s0
persist.sys.usb.config u:object_r:usb_config_prop:s0
persist.service.adb.enable u:object_r:usb_adb_enable_prop:s0

Only "persist.sys.usb.config " is visible in getprop command. This custom ROM has script located in /system/su.d/permissive.sh which enables permissive mode on SE Linux:

#!/system/bin/sh
/system/bin/setenforce 0

So in theory restrictions to the file types and process domains should not operate. Correct me if I am wrong.

Also there is a file /system/bin/usbeng which should be stared as a service by /init.sony.usb.rc

#Start usbeng
service usbeng /system/bin/usbeng
user system
group system
class late_start
oneshot

But it can't be seen in services list or process list. Also "getprop init.svc.usbeng" says it is "stopped". We can find SE Linux properties of this file in /file_contexts:

#line 1 "vendor/semc/system/sepolicy/Bootstrap_Applications/1.0.0/usbeng/file_contexts"
/system/bin/usbeng u:object_r:usbeng_exec:s0

I have tried echoing mentioned lines with a script:

echo 0 > /sys/class/android_usb/android0/enable
echo diag > /sys/class/android_usb/android0/f_diag/clients
echo qti,bam2bam_ipa > /sys/class/android_usb/android0/f_rmnet/transports
echo 5146 > /sys/class/android_usb/android0/idProduct
echo mtp,adb,serial,diag,rmnet > /sys/class/android_usb/android0/functions
echo 1 > /sys/class/android_usb/android0/enable

But last line seems to fail and USB doesn't get enabled and reboot is needed.

Seems that SE Linux is one of main reasons that Diag port can't be enabled. In effect there is lack of "persist.usb.eng" "sys.usb.diag_mode" in "getprop" command and "usbeng" service. Here comes question to you guys. Do you have idea how to enable mentioned properties and service? I will very appreciate any help or information that will help me enabling Diag port.

Best regards,

Piotr