AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
2026-09-16 21:56:22 +00:00
commit 12d2179c20
@@ -0,0 +1,312 @@
+# SusFS + ReSukiSU on sunfish LOS 23.2 — full attempt log (for external review)
+
+> **Audit correction (2026-09-16):** See [source and artifact audit](007-susfs-source-audit.md).
+> The claims below that missing MANUAL_HOOK caused the vibrator hang, or that
+> the upstream hook choice is intrinsically broken, are hypotheses, not proven
+> causes. The audit confirms incompatible installed/vendor module CRCs, an
+> exec post-hook use-after-free, and incomplete/mismatched SUSFS API wrappers.
+> The exact early-panic cause still requires a trace or controlled experiment.
+
+**Date compiled:** 2026-09-16  
+**Project:** `sunfish-a16-rom` (independent; not SSYSTEMS)  
+**Device (LAB only):** Pixel 4a `sunfish`, serial `11231JEC207477`  
+**ROM base:** LineageOS **23.2** / Android **16** (`lineage-23.2-20260915-UNOFFICIAL-sunfish`)  
+**Goal:** ReSukiSU root **plus** SusFS hide addon on **our** `msm-4.14` tree (A16), using abu/GOLDEN as **behavioural oracles**, not as flash images.
+
+**Ask for help:** Why do MANUAL_HOOK + AUTO_* + CONFIG_KSU_SUSFS builds still `kernel_panic` before userspace on this tree, while (1) penúltimo ReSukiSU-without-SusFS boots, and (2) an earlier SusFS-without-MANUAL build reached Android (then hung on vibrator)? What remaining XOR / composition bugs exist in ReSukiSU when treating SusFS as an addon like KernelSU-Next?
+
+---
+
+## 1. Concepts (do not confuse)
+
+| Name | What it is |
+|------|------------|
+| **KernelSU (KSU)** | Generic root-in-kernel project family |
+| **ReSukiSU** | Fork we ship (kernel driver + Manager). Version code **35153**, `v4.2.0-rc2-…@ReSukiSU` |
+| **KernelSU-Next** | Different fork; what **abu** wires in their reference tree |
+| **SusFS** | Kernel **addon** (simonpunk) for path/mount/uname/cmdline hide. **Not** a replacement for ReSukiSU. Should sit **on top** of a KSU-family driver |
+
+**Intended product stack:**
+
+```
+apps / banks
+    ↑
+ SusFS          ← optional hide (compile into boot)
+    ↑
+ ReSukiSU       ← root
+    ↑
+ msm-4.14 + LOS 23.2 system
+```
+
+**abu product habit:** two boots (root-only vs root+SusFS). Same idea: SusFS on/off at **compile time** in the boot image, not a runtime “activate SusFS” without the code in the kernel.
+
+---
+
+## 2. Important paths (host `rom-dev01` + laptop)
+
+### Host
+
+| Path | Role |
+|------|------|
+| `/srv/rom/src/lineage/` | LOS 23.2 tree |
+| `/srv/rom/src/lineage/kernel/google/msm-4.14/` | Our kernel (dirty: ReSukiSU + SusFS + patches) |
+| `/srv/rom/src/lineage/kernel/google/msm-4.14/drivers/kernelsu/` | ReSukiSU kernel module sources (in-tree) |
+| `/srv/rom/src/lineage/kernel/google/msm-4.14/fs/susfs.c` | SusFS implementation |
+| `/srv/rom/src/lineage/kernel/google/msm-4.14/arch/arm64/configs/sunfish_defconfig` | Defconfig (KSU/SusFS/debug knobs) |
+| `/srv/rom/src/lineage/device/google/sunfish/BoardConfig-common.mk` | `BOARD_KERNEL_CMDLINE`; optional `SUNFISH_DEBUG_PANIC_SCREEN=1` → `panic=0 console=tty0` |
+| `/srv/rom/artifacts/007-kernelsu/` | Boot images + managers + RCA |
+| `/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/` | ikconfig diffs, notes, abu checklist |
+| `/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh` | Normal SusFS bootimage builder |
+| `/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh` | DEBUG builder (`SUNFISH_DEBUG_PANIC_SCREEN=1`) |
+| `/srv/rom/logs/007-build/susfs-bootimage.log` | Cumulative build log (script tee) |
+| `/srv/rom/logs/007-build/susfs-bootimage-debug.log` | Debug build log |
+| `/srv/rom/artifacts/detach-*.log` | Per-session `rom-detach` logs |
+| `/srv/rom/references/abu-msm-4.14-ksu/` | **abu reference kernel** (A15-era). `drivers/kernelsu` → symlink `KernelSU-Next/kernel` |
+| `/srv/rom/references/resukisu/` | ReSukiSU git reference (non-shallow; version from `rev-list`) |
+| `/srv/rom/references/susfs4ksu/` | Upstream SusFS project reference |
+| `/srv/rom/artifacts/007-kernelsu/abu-reference/` | Owner-supplied abu `boot-abu` / `dtbo-abu` (reference only; **do not flash as ours**) |
+
+### Laptop workspace
+
+| Path | Role |
+|------|------|
+| `/home/aventura/Workspaces/sunfish-a16-rom/` | Git project |
+| `.local-artifacts/007-kernelsu/` | Copied boots, klog dumps, Manager APKs |
+| `docs/007-kernelsu-runbook.md` | Runbook |
+| `docs/007-abu-vs-ours-susfs.md` | abu vs ours checklist |
+| `docs/007-debug-boot-panic-screen.md` | Debug boot / photo Oops notes |
+| `specs/007-kernelsu-sunfish/` | Feature spec/tasks |
+
+**SSH:** `ssh a16-build` → `android-build@rom-dev01` (see `docs/ssh/config`).
+
+---
+
+## 3. Boot image changelog (chronological)
+
+All under `/srv/rom/artifacts/007-kernelsu/` (and laptop `.local-artifacts/007-kernelsu/` when copied).
+
+| Stamp / file | uname / notes | Config essence | LAB result |
+|--------------|---------------|----------------|------------|
+| **Penúltimo** `boot-resukisu-our-20260915T183729Z.img` | `#1 … Tue Sep 15 18:06:17 UTC 2026` | `MANUAL_HOOK=y` + all **AUTO_***=y; **SusFS off** | **GOOD** — daily LAB root |
+| `boot-005-known-good.img` | Stock bacon kernel (no KSU in practice for root) | LOS boot from zip | Emergency recovery when slots broken |
+| **SusFS #1** `…-susfs-20260916T004038Z.img` | `#3 … Wed Sep 16 00:43:54` | `CONFIG_KSU_SUSFS=y`, **`MANUAL_HOOK` unset** (choice XOR) | Kernel up, **adb alive**, bootanim forever: `system_server` stuck in **VibratorManagerService.nativeGetVibratorIds** (~66s watchdog) |
+| **SusFS #2** `…-susfs-20260916T091211Z.img` | `#4 … Wed Sep 16 09:21:41` | After Kconfig patch: `MANUAL_HOOK=y` + SusFS; **AUTO_* all unset** | **Google logo → reboot loop** (earlier than #1) |
+| **SusFS #3** `…-susfs-20260916T104649Z.img` | `#6 … Wed Sep 16 10:51:09` | `MANUAL` + **AUTO_***=y + SusFS; `susfs_init` in MANUAL path; link fix for `ksu_init_rc_hook` | Still logo→reboot. Proven on **slot a** (same system as penúltimo) → **not A/B system_b** |
+| **SusFS #4 sigfix** `…-susfs-20260916T112839Z.img` | `#7 … Wed Sep 16 11:32:09` sha `472a32d8…` | + sucompat **faccessat/stat** signatures: SusFS `struct filename**` only if `SUSFS && !MANUAL` | **Worse** — returns to fastboot **faster** |
+| **SusFS #5 DEBUG** (building at doc time) | `susfs-boot-debug` session | #4 macros fix (`susfs_*` privilege macros only if `!MANUAL`) + `PANIC_TIMEOUT=0`, no `QCOM_FORCE_WDOG_BITE_ON_PANIC`, `VT`+`FRAMEBUFFER_CONSOLE`, cmdline `panic=0 console=tty0`, `SPOOF_CMDLINE` off | Pending |
+
+**Known-good rollback always:**  
+`boot-resukisu-our-20260915T183729Z.img` on `boot_a` + `--set-active=a`.
+
+**Manager matching 35153:**  
+`ReSukiSU_v4.2.0-rc2-spoofed_35153-arm64-v8a-release.apk`  
+(without Manager, `su` missing even if kernel has KSU).
+
+---
+
+## 4. Root-cause chain (what we learned)
+
+### 4.1 ReSukiSU upstream treats SusFS as a **hooking method** (XOR)
+
+Kconfig `choice "KernelSU Hooking Method"` originally included `KSU_SUSFS` alongside `KSU_MANUAL_HOOK` / `KSU_TRACEPOINT_HOOK`.
+
+Enabling SusFS in defconfig → warning `override: KSU_SUSFS changes choice state` → **MANUAL_HOOK off**.
+
+**ikconfig proof (T004038Z vs penúltimo):** see  
+`/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/ikconfig.diff`.
+
+**abu / KernelSU-Next model (correct for addon):** SusFS is a separate `bool` menu under KSU, **not** in the hook choice. Hooks = KPROBES (or manual). `susfs_init()` under `#ifdef CONFIG_KSU_SUSFS` always.
+
+### 4.2 First LAB symptom (T004038Z) — vibrator watchdog
+
+- Not an early panic: Android mostly up, adb works.  
+- `WATCHDOG KILLING SYSTEM PROCESS` blocked in `VibratorManagerService.nativeGetVibratorIds`.  
+- Interpreted as fallout of **missing MANUAL_HOOK** (broken input/LSM hook path / module vermagic issues discussed; drv2624 is vendor module).
+
+### 4.3 After forcing MANUAL+SusFS — early `kernel_panic`
+
+Builds with MANUAL (+ later AUTO) + SusFS die at **Google logo**, reboot, often land in **fastboot** after retries.
+
+**Logging reality on Pixel 4a:**
+
+- Bootloader **does not support** `fastboot fetch`.  
+- `/dev/block/by-name/klog` and `logfs` dumps show many `PM: Reason: kernel_panic` / `HARD RESET by PS_HOLD` but **no Oops / Call trace**.  
+- `/sys/fs/pstore` empty after successful penúltimo boot; Pixel ramoops often encrypted (`/vendor/bin/ramoops`, keys under CE — missing/unusable in our tries).  
+- Console default: `console=ttyMSM0` only; `# CONFIG_VT is not set` historically → **no Oops text on panel** (only logo).
+
+### 4.4 Composition bugs fixed in-tree (still not enough for a clean boot)
+
+Patches applied under `drivers/kernelsu/` (and defconfig / BoardConfig):
+
+| # | File(s) | Change |
+|---|---------|--------|
+| 1 | `Kconfig` + `Kbuild` | SusFS **out of** hook `choice`; SusFS addon + MANUAL together (abu-like). Snapshot: `susfs-fail-rca/kconfig-fix-20260916T090322Z/` |
+| 2 | `arch/.../sunfish_defconfig` | Re-enable `AUTO_SETUID/INITRC/INPUT=y` (T091211Z had them explicitly **unset**) |
+| 3 | `runtime/ksud_integration.c` | `#elif CONFIG_KSU_SUSFS` → only if `&& !CONFIG_KSU_MANUAL_HOOK` so `ksu_init_rc_hook` is defined under MANUAL+AUTO (else **link error** `undefined symbol: ksu_init_rc_hook`) |
+| 4 | `core/init.c` | In `MANUAL_HOOK` branch, also `#ifdef CONFIG_KSU_SUSFS susfs_init()` (abu always inits SusFS) |
+| 5 | `feature/sucompat.h` + `.c` | `faccessat`/`stat`: SusFS `struct filename **` API **only** if `SUSFS && !MANUAL`. MANUAL call sites in `fs/open.c` / `fs/stat.c` pass `const char __user **` — with SusFS signatures → **ABI mismatch / panic** |
+| 6 | `feature/sucompat.h` | Privilege macros: SusFS `susfs_is_current_proc_no_su` etc. **only** if `SUSFS && !MANUAL` (was still SusFS when both set — likely early panic) |
+| 7 | defconfig + BoardConfig (DEBUG) | `PANIC_TIMEOUT=0`, disable `QCOM_FORCE_WDOG_BITE_ON_PANIC`, enable `VT`/`FRAMEBUFFER_CONSOLE`, cmdline `panic=0 console=tty0` when `SUNFISH_DEBUG_PANIC_SCREEN=1`; `SPOOF_CMDLINE` off |
+
+** empirically:** fix #5 (sigfix T112839Z) made LAB failure **faster** to fastboot → either wrong direction for some other call path, or #6 was the dominant bug and #5 alone left broken macros. #6 is in the DEBUG build, **not yet LAB-proven**.
+
+### 4.5 Slot / A/B lesson (not the SusFS root cause)
+
+- After failed trials, `current-slot:b`, `slot-unbootable:a:yes` left LAB unbootable until **both** slots got `boot-005` + `--set-active=a`.  
+- SusFS on **slot a** (same `system_a` as working penúltimo) **still** bootlooped → failure is **SusFS/MANUAL kernel composition**, not stale `system_b`.
+
+**Flash discipline now:** penúltimo on `boot_a`, experiment on `boot_b`, `--set-active`; rollback = `--set-active=a` (and reflash `a` if needed).
+
+---
+
+## 5. Critical comparison: why T004038Z got further than MANUAL+SusFS
+
+| | T004038Z (SusFS as hook choice) | T091211Z+ (MANUAL+SusFS addon attempts) |
+|--|----------------------------------|----------------------------------------|
+| MANUAL_HOOK | **off** | **on** (+ AUTO on later builds) |
+| Early boot | Survives to userspace / adb | `kernel_panic`, logo loop |
+| Later failure | Vibrator HAL / system_server watchdog | Never gets there |
+
+**Hypothesis for reviewers:** ReSukiSU still has multiple `#ifdef CONFIG_KSU_SUSFS` paths written for **XOR** (SusFS *instead of* MANUAL). Turning both on without auditing every `elif` leaves:
+
+- Wrong sucompat prototypes vs `fs/*.c` hooks  
+- Wrong privilege helpers (`susfs_*` vs TIF flags)  
+- Possibly more (execveat_sucompat, dispatch mark, input hooks, etc.)
+
+abu avoids this by using **Next + KPROBES** and SusFS as a pure addon with `#ifdef CONFIG_KSU_SUSFS` init, not ReSukiSU’s choice XOR.
+
+---
+
+## 6. abu reference details (oracle, not flash path)
+
+**Tree:** `/srv/rom/references/abu-msm-4.14-ksu/`  
+**KSU:** `drivers/kernelsu` → `../KernelSU-Next/kernel`  
+
+**Kconfig pattern (excerpt behaviour):**
+
+- `CONFIG_KSU` tristate  
+- `CONFIG_KSU_KPROBES_HOOK` (default y) — not ReSukiSU MANUAL choice  
+- `menu "KernelSU - SUSFS"` → `CONFIG_KSU_SUSFS` bool addon + many `KSU_SUSFS_*` features  
+- `ksu.c`: `#ifdef CONFIG_KSU_SUSFS` → `susfs_init();` **unconditional on SusFS**, independent of kprobes  
+
+**Feature flags abu has that our ReSukiSU SusFS Kconfig may lack:**  
+`HAS_MAGIC_MOUNT`, `AUTO_ADD_SUS_*`, `TRY_UMOUNT*`, `SUS_SU` (kprobes), etc.
+
+**abu `sunfish_defconfig` in this mirror:** **0** `CONFIG_KSU*` lines — do not treat as the SusFS pin list.
+
+**Owner note:** abu also ships separate ReSukiSU-oriented boots / managers under artifacts; still **reference**. Our flash path is only `/srv/rom/artifacts/007-kernelsu/boot-resukisu-*` built from **our** tree.
+
+---
+
+## 7. Parallel work same day (context, not SusFS)
+
+- microG Location UI missing on LAB: we had staged official **`*-hw.apk`** (`versionName=…-hw`) which **omits** `NetworkLocationService` / `NetworkLocationProviderService`.  
+- GOLDEN/abu show full Location options with **default** (non-hw) GmsCore.  
+- Fixed: stage `com.google.android.gms-252432032.apk` (non-hw); LAB `adb install -r` restored NLP UI.  
+- GOLDEN/abu = **A15 scheme oracle**; we keep **newer** packages on A16.
+
+---
+
+## 8. How we build / logs
+
+```bash
+# normal SusFS bootimage (host)
+/srv/rom/artifacts/bin/rom-detach susfs-boot-NAME -- \
+  bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh
+
+# DEBUG (panic freeze + tty0)
+/srv/rom/artifacts/bin/rom-detach susfs-boot-debug -- \
+  bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh
+```
+
+Always record:
+
+- `/srv/rom/artifacts/detach-<session>-<TS>.log`  
+- `/srv/rom/logs/007-build/susfs-bootimage.log` (or `-debug.log`)  
+- `detach-<session>.status` (`exit=0` / `exit=1`)
+
+Verify image before flash:
+
+```bash
+unpack_bootimg + lz4 -dc kernel + scripts/extract-ikconfig
+# expect MANUAL_HOOK=y, three AUTO_*=y, KSU_SUSFS=y
+```
+
+---
+
+## 9. LAB recovery / log capture protocol (4a)
+
+```text
+1. SusFS on boot_b, penúltimo on boot_a, --set-active=b, reboot
+2. On logo loop: Vol- + Power → fastboot
+3. fastboot fetch klog  → FAILS on this device (unsupported)
+4. fastboot flash boot_a <penúltimo>; --set-active=a; reboot
+5. IMMEDIATELY on adb:
+   su -c 'dd if=/dev/block/by-name/klog …; dd if=/dev/block/by-name/logfs …'
+   adb pull → lab-klog-*.bin / lab-logfs-*.bin
+6. strings | grep kernel_panic|Oops|Call trace|susfs
+```
+
+Observed: step 6 usually only `PM: Reason: kernel_panic` — **insufficient for stack**. Hence DEBUG on-screen build.
+
+---
+
+## 10. Current tree intent (defconfig snapshot at doc time)
+
+```
+CONFIG_KSU=y
+CONFIG_KSU_MANUAL_HOOK=y
+CONFIG_KSU_MANUAL_HOOK_AUTO_SETUID_HOOK=y
+CONFIG_KSU_MANUAL_HOOK_AUTO_INITRC_HOOK=y
+CONFIG_KSU_MANUAL_HOOK_AUTO_INPUT_HOOK=y
+CONFIG_KSU_SUSFS=y
+CONFIG_KSU_SUSFS_SUS_PATH=y
+CONFIG_KSU_SUSFS_SUS_MOUNT=y
+CONFIG_KSU_SUSFS_SUS_KSTAT=y
+# CONFIG_KSU_SUSFS_SPOOF_UNAME is not set
+CONFIG_KSU_SUSFS_ENABLE_LOG=y
+CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y
+# CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG is not set
+CONFIG_KSU_SUSFS_OPEN_REDIRECT=y
+CONFIG_KSU_SUSFS_SUS_MAP=y
+# DEBUG bring-up:
+CONFIG_PANIC_TIMEOUT=0
+# CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC is not set
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_FRAMEBUFFER_CONSOLE=y
+…
+```
+
+---
+
+## 11. Open questions for a second opinion
+
+1. Is ReSukiSU **fundamentally** unsafe to run with `CONFIG_KSU_MANUAL_HOOK=y` **and** `CONFIG_KSU_SUSFS=y` without a larger port from KernelSU-Next’s addon model (more than Kconfig)?  
+2. Given T004038Z reached userspace with SusFS-as-choice (no MANUAL), should bring-up prefer that path and fix vibrator separately, vs insisting on MANUAL+AUTO+SusFS?  
+3. Remaining `#ifdef CONFIG_KSU_SUSFS` sites to audit in ReSukiSU when MANUAL is also on (`sucompat.c` execveat_sucompat, `dispatch.c`, input, etc.)?  
+4. Best way to get a **panic backtrace** on Pixel 4a 4.14 without UART cable (fbcon reliability? pstore decrypt? `CONFIG_PSTORE_CONSOLE`?)?  
+5. Any known ReSukiSU + susfs4ksu commit/tag combo that officially supports “SusFS addon + manual hooks” on non-GKI 4.14?
+
+---
+
+## 12. Related docs in-repo
+
+- `docs/007-abu-vs-ours-susfs.md`  
+- `docs/007-debug-boot-panic-screen.md`  
+- `docs/007-kernelsu-runbook.md`  
+- `docs/session-20260916-handoff.md`  
+- Host: `/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/SUMMARY.txt` and `NOTE-*.txt`
+
+---
+
+## 13. Non-goals / constraints
+
+- No Magisk as production root.  
+- Do not flash abu/torukk/Downloads boots as product.  
+- LAB only; never GOLDEN.  
+- Prefer small attributable patches; large Android builds on `rom-dev01` only, detached (`rom-detach`).
+
+---
+
+*End of brief — 2026-09-16 afternoon LAB session after T112839Z failure; DEBUG build in flight.*