sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
009-axp-los23-port
AXP-Resurection/docs/007-susfs-attempts-chatgpt-brief.md
T
sunfish-adminandCursor 2d145c2878 009: Polish bacon fixes, OTA host scripts, and migration docs. 
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-10-16 21:06:45 +02:00

16 KiB
Raw Permalink Blame History

Status: parallel KernelSU / SusFS track (kept). Bridge to current Magisk ROM: 007-parallel-on-009.md. Magisk ship resume: 009-handoff-20261008.md.

SusFS + ReSukiSU on sunfish LOS 23.2 — full attempt log (for external review)

Audit correction (2026-09-16): See source and artifact audit. The claims below that missing MANUAL_HOOK caused the vibrator hang, or that the upstream hook choice is intrinsically broken, are hypotheses, not proven causes. The audit confirms incompatible installed/vendor module CRCs, an exec post-hook use-after-free, and incomplete/mismatched SUSFS API wrappers. The exact early-panic cause still requires a trace or controlled experiment.

Date compiled: 2026-09-16
Project: sunfish-a16-rom (independent; not SSYSTEMS)
Device (LAB only): Pixel 4a sunfish, serial 11231JEC207477
ROM base: LineageOS 23.2 / Android 16 (lineage-23.2-20260915-UNOFFICIAL-sunfish)
Goal: ReSukiSU root plus SusFS hide addon on our msm-4.14 tree (A16), using abu/GOLDEN as behavioural oracles, not as flash images.

Ask for help: Why do MANUAL_HOOK + AUTO_* + CONFIG_KSU_SUSFS builds still kernel_panic before userspace on this tree, while (1) penúltimo ReSukiSU-without-SusFS boots, and (2) an earlier SusFS-without-MANUAL build reached Android (then hung on vibrator)? What remaining XOR / composition bugs exist in ReSukiSU when treating SusFS as an addon like KernelSU-Next?

1. Concepts (do not confuse)

Name What it is
KernelSU (KSU) Generic root-in-kernel project family
ReSukiSU Fork we ship (kernel driver + Manager). Version code 35153, v4.2.0-rc2-…@ReSukiSU
KernelSU-Next Different fork; what abu wires in their reference tree
SusFS Kernel addon (simonpunk) for path/mount/uname/cmdline hide. Not a replacement for ReSukiSU. Should sit on top of a KSU-family driver

Intended product stack:

apps / banks
    ↑
 SusFS          ← optional hide (compile into boot)
    ↑
 ReSukiSU       ← root
    ↑
 msm-4.14 + LOS 23.2 system

abu product habit: two boots (root-only vs root+SusFS). Same idea: SusFS on/off at compile time in the boot image, not a runtime “activate SusFS” without the code in the kernel.

2. Important paths (host rom-dev01 + laptop)

Host

Path Role
/srv/rom/src/lineage/ LOS 23.2 tree
/srv/rom/src/lineage/kernel/google/msm-4.14/ Our kernel (dirty: ReSukiSU + SusFS + patches)
/srv/rom/src/lineage/kernel/google/msm-4.14/drivers/kernelsu/ ReSukiSU kernel module sources (in-tree)
/srv/rom/src/lineage/kernel/google/msm-4.14/fs/susfs.c SusFS implementation
/srv/rom/src/lineage/kernel/google/msm-4.14/arch/arm64/configs/sunfish_defconfig Defconfig (KSU/SusFS/debug knobs)
/srv/rom/src/lineage/device/google/sunfish/BoardConfig-common.mk BOARD_KERNEL_CMDLINE; optional SUNFISH_DEBUG_PANIC_SCREEN=1 → panic=0 console=tty0
/srv/rom/artifacts/007-kernelsu/ Boot images + managers + RCA
/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/ ikconfig diffs, notes, abu checklist
/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh Normal SusFS bootimage builder
/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh DEBUG builder (SUNFISH_DEBUG_PANIC_SCREEN=1)
/srv/rom/logs/007-build/susfs-bootimage.log Cumulative build log (script tee)
/srv/rom/logs/007-build/susfs-bootimage-debug.log Debug build log
/srv/rom/artifacts/detach-*.log Per-session rom-detach logs
/srv/rom/references/abu-msm-4.14-ksu/ abu reference kernel (A15-era). drivers/kernelsu → symlink KernelSU-Next/kernel
/srv/rom/references/resukisu/ ReSukiSU git reference (non-shallow; version from rev-list)
/srv/rom/references/susfs4ksu/ Upstream SusFS project reference
/srv/rom/artifacts/007-kernelsu/abu-reference/ Owner-supplied abu boot-abu / dtbo-abu (reference only; do not flash as ours)

Laptop workspace

Path Role
/home/aventura/Workspaces/sunfish-a16-rom/ Git project
.local-artifacts/007-kernelsu/ Copied boots, klog dumps, Manager APKs
docs/007-kernelsu-runbook.md Runbook
docs/007-abu-vs-ours-susfs.md abu vs ours checklist
docs/007-debug-boot-panic-screen.md Debug boot / photo Oops notes
specs/007-kernelsu-sunfish/ Feature spec/tasks

SSH: ssh a16-build → android-build@rom-dev01 (see docs/ssh/config).

3. Boot image changelog (chronological)

All under /srv/rom/artifacts/007-kernelsu/ (and laptop .local-artifacts/007-kernelsu/ when copied).

Stamp / file uname / notes Config essence LAB result
Penúltimo boot-resukisu-our-20260915T183729Z.img #1 … Tue Sep 15 18:06:17 UTC 2026 MANUAL_HOOK=y + all AUTO_*=y; SusFS off GOOD — daily LAB root
boot-005-known-good.img Stock bacon kernel (no KSU in practice for root) LOS boot from zip Emergency recovery when slots broken
SusFS #1 …-susfs-20260916T004038Z.img #3 … Wed Sep 16 00:43:54 CONFIG_KSU_SUSFS=y, MANUAL_HOOK unset (choice XOR) Kernel up, adb alive, bootanim forever: system_server stuck in VibratorManagerService.nativeGetVibratorIds (~66s watchdog)
SusFS #2 …-susfs-20260916T091211Z.img #4 … Wed Sep 16 09:21:41 After Kconfig patch: MANUAL_HOOK=y + SusFS; AUTO_ all unset* Google logo → reboot loop (earlier than #1)
SusFS #3 …-susfs-20260916T104649Z.img #6 … Wed Sep 16 10:51:09 MANUAL + AUTO_*=y + SusFS; susfs_init in MANUAL path; link fix for ksu_init_rc_hook Still logo→reboot. Proven on slot a (same system as penúltimo) → not A/B system_b
SusFS #4 sigfix …-susfs-20260916T112839Z.img #7 … Wed Sep 16 11:32:09 sha 472a32d8… + sucompat faccessat/stat signatures: SusFS struct filename** only if SUSFS && !MANUAL Worse — returns to fastboot faster
SusFS #5 DEBUG (building at doc time) susfs-boot-debug session #4 macros fix (susfs_* privilege macros only if !MANUAL) + PANIC_TIMEOUT=0, no QCOM_FORCE_WDOG_BITE_ON_PANIC, VT+FRAMEBUFFER_CONSOLE, cmdline panic=0 console=tty0, SPOOF_CMDLINE off Pending

Known-good rollback always:
boot-resukisu-our-20260915T183729Z.img on boot_a + --set-active=a.

Manager matching 35153:
ReSukiSU_v4.2.0-rc2-spoofed_35153-arm64-v8a-release.apk
(without Manager, su missing even if kernel has KSU).

4. Root-cause chain (what we learned)

4.1 ReSukiSU upstream treats SusFS as a hooking method (XOR)

Kconfig choice "KernelSU Hooking Method" originally included KSU_SUSFS alongside KSU_MANUAL_HOOK / KSU_TRACEPOINT_HOOK.

Enabling SusFS in defconfig → warning override: KSU_SUSFS changes choice state → MANUAL_HOOK off.

ikconfig proof (T004038Z vs penúltimo): see
/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/ikconfig.diff.

abu / KernelSU-Next model (correct for addon): SusFS is a separate bool menu under KSU, not in the hook choice. Hooks = KPROBES (or manual). susfs_init() under #ifdef CONFIG_KSU_SUSFS always.

4.2 First LAB symptom (T004038Z) — vibrator watchdog

  • Not an early panic: Android mostly up, adb works.
  • WATCHDOG KILLING SYSTEM PROCESS blocked in VibratorManagerService.nativeGetVibratorIds.
  • Interpreted as fallout of missing MANUAL_HOOK (broken input/LSM hook path / module vermagic issues discussed; drv2624 is vendor module).

4.3 After forcing MANUAL+SusFS — early kernel_panic

Builds with MANUAL (+ later AUTO) + SusFS die at Google logo, reboot, often land in fastboot after retries.

Logging reality on Pixel 4a:

  • Bootloader does not support fastboot fetch.
  • /dev/block/by-name/klog and logfs dumps show many PM: Reason: kernel_panic / HARD RESET by PS_HOLD but no Oops / Call trace.
  • /sys/fs/pstore empty after successful penúltimo boot; Pixel ramoops often encrypted (/vendor/bin/ramoops, keys under CE — missing/unusable in our tries).
  • Console default: console=ttyMSM0 only; # CONFIG_VT is not set historically → no Oops text on panel (only logo).

4.4 Composition bugs fixed in-tree (still not enough for a clean boot)

Patches applied under drivers/kernelsu/ (and defconfig / BoardConfig):

# File(s) Change
1 Kconfig + Kbuild SusFS out of hook choice; SusFS addon + MANUAL together (abu-like). Snapshot: susfs-fail-rca/kconfig-fix-20260916T090322Z/
2 arch/.../sunfish_defconfig Re-enable AUTO_SETUID/INITRC/INPUT=y (T091211Z had them explicitly unset)
3 runtime/ksud_integration.c #elif CONFIG_KSU_SUSFS → only if && !CONFIG_KSU_MANUAL_HOOK so ksu_init_rc_hook is defined under MANUAL+AUTO (else link error undefined symbol: ksu_init_rc_hook)
4 core/init.c In MANUAL_HOOK branch, also #ifdef CONFIG_KSU_SUSFS susfs_init() (abu always inits SusFS)
5 feature/sucompat.h + .c faccessat/stat: SusFS struct filename ** API only if SUSFS && !MANUAL. MANUAL call sites in fs/open.c / fs/stat.c pass const char __user ** — with SusFS signatures → ABI mismatch / panic
6 feature/sucompat.h Privilege macros: SusFS susfs_is_current_proc_no_su etc. only if SUSFS && !MANUAL (was still SusFS when both set — likely early panic)
7 defconfig + BoardConfig (DEBUG) PANIC_TIMEOUT=0, disable QCOM_FORCE_WDOG_BITE_ON_PANIC, enable VT/FRAMEBUFFER_CONSOLE, cmdline panic=0 console=tty0 when SUNFISH_DEBUG_PANIC_SCREEN=1; SPOOF_CMDLINE off

** empirically:** fix #5 (sigfix T112839Z) made LAB failure faster to fastboot → either wrong direction for some other call path, or #6 was the dominant bug and #5 alone left broken macros. #6 is in the DEBUG build, not yet LAB-proven.

4.5 Slot / A/B lesson (not the SusFS root cause)

  • After failed trials, current-slot:b, slot-unbootable:a:yes left LAB unbootable until both slots got boot-005 + --set-active=a.
  • SusFS on slot a (same system_a as working penúltimo) still bootlooped → failure is SusFS/MANUAL kernel composition, not stale system_b.

Flash discipline now: penúltimo on boot_a, experiment on boot_b, --set-active; rollback = --set-active=a (and reflash a if needed).

5. Critical comparison: why T004038Z got further than MANUAL+SusFS

T004038Z (SusFS as hook choice) T091211Z+ (MANUAL+SusFS addon attempts)
MANUAL_HOOK off on (+ AUTO on later builds)
Early boot Survives to userspace / adb kernel_panic, logo loop
Later failure Vibrator HAL / system_server watchdog Never gets there

Hypothesis for reviewers: ReSukiSU still has multiple #ifdef CONFIG_KSU_SUSFS paths written for XOR (SusFS instead of MANUAL). Turning both on without auditing every elif leaves:

  • Wrong sucompat prototypes vs fs/*.c hooks
  • Wrong privilege helpers (susfs_* vs TIF flags)
  • Possibly more (execveat_sucompat, dispatch mark, input hooks, etc.)

abu avoids this by using Next + KPROBES and SusFS as a pure addon with #ifdef CONFIG_KSU_SUSFS init, not ReSukiSU’s choice XOR.

6. abu reference details (oracle, not flash path)

Tree: /srv/rom/references/abu-msm-4.14-ksu/
KSU: drivers/kernelsu → ../KernelSU-Next/kernel

Kconfig pattern (excerpt behaviour):

  • CONFIG_KSU tristate
  • CONFIG_KSU_KPROBES_HOOK (default y) — not ReSukiSU MANUAL choice
  • menu "KernelSU - SUSFS" → CONFIG_KSU_SUSFS bool addon + many KSU_SUSFS_* features
  • ksu.c: #ifdef CONFIG_KSU_SUSFS → susfs_init(); unconditional on SusFS, independent of kprobes

Feature flags abu has that our ReSukiSU SusFS Kconfig may lack:
HAS_MAGIC_MOUNT, AUTO_ADD_SUS_*, TRY_UMOUNT*, SUS_SU (kprobes), etc.

abu sunfish_defconfig in this mirror: 0 CONFIG_KSU* lines — do not treat as the SusFS pin list.

Owner note: abu also ships separate ReSukiSU-oriented boots / managers under artifacts; still reference. Our flash path is only /srv/rom/artifacts/007-kernelsu/boot-resukisu-* built from our tree.

7. Parallel work same day (context, not SusFS)

  • microG Location UI missing on LAB: we had staged official *-hw.apk (versionName=…-hw) which omits NetworkLocationService / NetworkLocationProviderService.
  • GOLDEN/abu show full Location options with default (non-hw) GmsCore.
  • Fixed: stage com.google.android.gms-252432032.apk (non-hw); LAB adb install -r restored NLP UI.
  • GOLDEN/abu = A15 scheme oracle; we keep newer packages on A16.

8. How we build / logs

# normal SusFS bootimage (host)
/srv/rom/artifacts/bin/rom-detach susfs-boot-NAME -- \
  bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh

# DEBUG (panic freeze + tty0)
/srv/rom/artifacts/bin/rom-detach susfs-boot-debug -- \
  bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh

Always record:

  • /srv/rom/artifacts/detach-<session>-<TS>.log
  • /srv/rom/logs/007-build/susfs-bootimage.log (or -debug.log)
  • detach-<session>.status (exit=0 / exit=1)

Verify image before flash:

unpack_bootimg + lz4 -dc kernel + scripts/extract-ikconfig
# expect MANUAL_HOOK=y, three AUTO_*=y, KSU_SUSFS=y

9. LAB recovery / log capture protocol (4a)

1. SusFS on boot_b, penúltimo on boot_a, --set-active=b, reboot
2. On logo loop: Vol- + Power → fastboot
3. fastboot fetch klog  → FAILS on this device (unsupported)
4. fastboot flash boot_a <penúltimo>; --set-active=a; reboot
5. IMMEDIATELY on adb:
   su -c 'dd if=/dev/block/by-name/klog …; dd if=/dev/block/by-name/logfs …'
   adb pull → lab-klog-*.bin / lab-logfs-*.bin
6. strings | grep kernel_panic|Oops|Call trace|susfs

Observed: step 6 usually only PM: Reason: kernel_panic — insufficient for stack. Hence DEBUG on-screen build.

10. Current tree intent (defconfig snapshot at doc time)

CONFIG_KSU=y
CONFIG_KSU_MANUAL_HOOK=y
CONFIG_KSU_MANUAL_HOOK_AUTO_SETUID_HOOK=y
CONFIG_KSU_MANUAL_HOOK_AUTO_INITRC_HOOK=y
CONFIG_KSU_MANUAL_HOOK_AUTO_INPUT_HOOK=y
CONFIG_KSU_SUSFS=y
CONFIG_KSU_SUSFS_SUS_PATH=y
CONFIG_KSU_SUSFS_SUS_MOUNT=y
CONFIG_KSU_SUSFS_SUS_KSTAT=y
# CONFIG_KSU_SUSFS_SPOOF_UNAME is not set
CONFIG_KSU_SUSFS_ENABLE_LOG=y
CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y
# CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG is not set
CONFIG_KSU_SUSFS_OPEN_REDIRECT=y
CONFIG_KSU_SUSFS_SUS_MAP=y
# DEBUG bring-up:
CONFIG_PANIC_TIMEOUT=0
# CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC is not set
CONFIG_VT=y
CONFIG_VT_CONSOLE=y
CONFIG_FRAMEBUFFER_CONSOLE=y
…

11. Open questions for a second opinion

  1. Is ReSukiSU fundamentally unsafe to run with CONFIG_KSU_MANUAL_HOOK=y and CONFIG_KSU_SUSFS=y without a larger port from KernelSU-Next’s addon model (more than Kconfig)?
  2. Given T004038Z reached userspace with SusFS-as-choice (no MANUAL), should bring-up prefer that path and fix vibrator separately, vs insisting on MANUAL+AUTO+SusFS?
  3. Remaining #ifdef CONFIG_KSU_SUSFS sites to audit in ReSukiSU when MANUAL is also on (sucompat.c execveat_sucompat, dispatch.c, input, etc.)?
  4. Best way to get a panic backtrace on Pixel 4a 4.14 without UART cable (fbcon reliability? pstore decrypt? CONFIG_PSTORE_CONSOLE?)?
  5. Any known ReSukiSU + susfs4ksu commit/tag combo that officially supports “SusFS addon + manual hooks” on non-GKI 4.14?

12. Related docs in-repo

  • docs/007-abu-vs-ours-susfs.md
  • docs/007-debug-boot-panic-screen.md
  • docs/007-kernelsu-runbook.md
  • docs/session-20260916-handoff.md
  • Host: /srv/rom/artifacts/007-kernelsu/susfs-fail-rca/SUMMARY.txt and NOTE-*.txt

13. Non-goals / constraints

  • No Magisk as production root.
  • Do not flash abu/torukk/Downloads boots as product.
  • LAB only; never GOLDEN.
  • Prefer small attributable patches; large Android builds on rom-dev01 only, detached (rom-detach).

End of brief — 2026-09-16 afternoon LAB session after T112839Z failure; DEBUG build in flight.

Reference in new issue View Git Blame Copy Permalink