sunfish-adminandCursor
2d145c2878
Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding and rebuild/sync helpers; document device roles, laptop migration, and Gitea. Co-authored-by: Cursor <cursoragent@cursor.com>
317 lines
16 KiB
Markdown
317 lines
16 KiB
Markdown
<!-- Status: parallel KernelSU track — see docs/007-parallel-on-009.md -->
|
||
|
||
> **Status: parallel KernelSU / SusFS track** (kept). Bridge to current Magisk ROM: [`007-parallel-on-009.md`](007-parallel-on-009.md). Magisk ship resume: [`009-handoff-20261008.md`](009-handoff-20261008.md).
|
||
|
||
# SusFS + ReSukiSU on sunfish LOS 23.2 — full attempt log (for external review)
|
||
|
||
> **Audit correction (2026-09-16):** See [source and artifact audit](007-susfs-source-audit.md).
|
||
> The claims below that missing MANUAL_HOOK caused the vibrator hang, or that
|
||
> the upstream hook choice is intrinsically broken, are hypotheses, not proven
|
||
> causes. The audit confirms incompatible installed/vendor module CRCs, an
|
||
> exec post-hook use-after-free, and incomplete/mismatched SUSFS API wrappers.
|
||
> The exact early-panic cause still requires a trace or controlled experiment.
|
||
|
||
**Date compiled:** 2026-09-16
|
||
**Project:** `sunfish-a16-rom` (independent; not SSYSTEMS)
|
||
**Device (LAB only):** Pixel 4a `sunfish`, serial `11231JEC207477`
|
||
**ROM base:** LineageOS **23.2** / Android **16** (`lineage-23.2-20260915-UNOFFICIAL-sunfish`)
|
||
**Goal:** ReSukiSU root **plus** SusFS hide addon on **our** `msm-4.14` tree (A16), using abu/GOLDEN as **behavioural oracles**, not as flash images.
|
||
|
||
**Ask for help:** Why do MANUAL_HOOK + AUTO_* + CONFIG_KSU_SUSFS builds still `kernel_panic` before userspace on this tree, while (1) penúltimo ReSukiSU-without-SusFS boots, and (2) an earlier SusFS-without-MANUAL build reached Android (then hung on vibrator)? What remaining XOR / composition bugs exist in ReSukiSU when treating SusFS as an addon like KernelSU-Next?
|
||
|
||
---
|
||
|
||
## 1. Concepts (do not confuse)
|
||
|
||
| Name | What it is |
|
||
|------|------------|
|
||
| **KernelSU (KSU)** | Generic root-in-kernel project family |
|
||
| **ReSukiSU** | Fork we ship (kernel driver + Manager). Version code **35153**, `v4.2.0-rc2-…@ReSukiSU` |
|
||
| **KernelSU-Next** | Different fork; what **abu** wires in their reference tree |
|
||
| **SusFS** | Kernel **addon** (simonpunk) for path/mount/uname/cmdline hide. **Not** a replacement for ReSukiSU. Should sit **on top** of a KSU-family driver |
|
||
|
||
**Intended product stack:**
|
||
|
||
```
|
||
apps / banks
|
||
↑
|
||
SusFS ← optional hide (compile into boot)
|
||
↑
|
||
ReSukiSU ← root
|
||
↑
|
||
msm-4.14 + LOS 23.2 system
|
||
```
|
||
|
||
**abu product habit:** two boots (root-only vs root+SusFS). Same idea: SusFS on/off at **compile time** in the boot image, not a runtime “activate SusFS” without the code in the kernel.
|
||
|
||
---
|
||
|
||
## 2. Important paths (host `rom-dev01` + laptop)
|
||
|
||
### Host
|
||
|
||
| Path | Role |
|
||
|------|------|
|
||
| `/srv/rom/src/lineage/` | LOS 23.2 tree |
|
||
| `/srv/rom/src/lineage/kernel/google/msm-4.14/` | Our kernel (dirty: ReSukiSU + SusFS + patches) |
|
||
| `/srv/rom/src/lineage/kernel/google/msm-4.14/drivers/kernelsu/` | ReSukiSU kernel module sources (in-tree) |
|
||
| `/srv/rom/src/lineage/kernel/google/msm-4.14/fs/susfs.c` | SusFS implementation |
|
||
| `/srv/rom/src/lineage/kernel/google/msm-4.14/arch/arm64/configs/sunfish_defconfig` | Defconfig (KSU/SusFS/debug knobs) |
|
||
| `/srv/rom/src/lineage/device/google/sunfish/BoardConfig-common.mk` | `BOARD_KERNEL_CMDLINE`; optional `SUNFISH_DEBUG_PANIC_SCREEN=1` → `panic=0 console=tty0` |
|
||
| `/srv/rom/artifacts/007-kernelsu/` | Boot images + managers + RCA |
|
||
| `/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/` | ikconfig diffs, notes, abu checklist |
|
||
| `/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh` | Normal SusFS bootimage builder |
|
||
| `/srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh` | DEBUG builder (`SUNFISH_DEBUG_PANIC_SCREEN=1`) |
|
||
| `/srv/rom/logs/007-build/susfs-bootimage.log` | Cumulative build log (script tee) |
|
||
| `/srv/rom/logs/007-build/susfs-bootimage-debug.log` | Debug build log |
|
||
| `/srv/rom/artifacts/detach-*.log` | Per-session `rom-detach` logs |
|
||
| `/srv/rom/references/abu-msm-4.14-ksu/` | **abu reference kernel** (A15-era). `drivers/kernelsu` → symlink `KernelSU-Next/kernel` |
|
||
| `/srv/rom/references/resukisu/` | ReSukiSU git reference (non-shallow; version from `rev-list`) |
|
||
| `/srv/rom/references/susfs4ksu/` | Upstream SusFS project reference |
|
||
| `/srv/rom/artifacts/007-kernelsu/abu-reference/` | Owner-supplied abu `boot-abu` / `dtbo-abu` (reference only; **do not flash as ours**) |
|
||
|
||
### Laptop workspace
|
||
|
||
| Path | Role |
|
||
|------|------|
|
||
| `/home/aventura/Workspaces/sunfish-a16-rom/` | Git project |
|
||
| `.local-artifacts/007-kernelsu/` | Copied boots, klog dumps, Manager APKs |
|
||
| `docs/007-kernelsu-runbook.md` | Runbook |
|
||
| `docs/007-abu-vs-ours-susfs.md` | abu vs ours checklist |
|
||
| `docs/007-debug-boot-panic-screen.md` | Debug boot / photo Oops notes |
|
||
| `specs/007-kernelsu-sunfish/` | Feature spec/tasks |
|
||
|
||
**SSH:** `ssh a16-build` → `android-build@rom-dev01` (see `docs/ssh/config`).
|
||
|
||
---
|
||
|
||
## 3. Boot image changelog (chronological)
|
||
|
||
All under `/srv/rom/artifacts/007-kernelsu/` (and laptop `.local-artifacts/007-kernelsu/` when copied).
|
||
|
||
| Stamp / file | uname / notes | Config essence | LAB result |
|
||
|--------------|---------------|----------------|------------|
|
||
| **Penúltimo** `boot-resukisu-our-20260915T183729Z.img` | `#1 … Tue Sep 15 18:06:17 UTC 2026` | `MANUAL_HOOK=y` + all **AUTO_***=y; **SusFS off** | **GOOD** — daily LAB root |
|
||
| `boot-005-known-good.img` | Stock bacon kernel (no KSU in practice for root) | LOS boot from zip | Emergency recovery when slots broken |
|
||
| **SusFS #1** `…-susfs-20260916T004038Z.img` | `#3 … Wed Sep 16 00:43:54` | `CONFIG_KSU_SUSFS=y`, **`MANUAL_HOOK` unset** (choice XOR) | Kernel up, **adb alive**, bootanim forever: `system_server` stuck in **VibratorManagerService.nativeGetVibratorIds** (~66s watchdog) |
|
||
| **SusFS #2** `…-susfs-20260916T091211Z.img` | `#4 … Wed Sep 16 09:21:41` | After Kconfig patch: `MANUAL_HOOK=y` + SusFS; **AUTO_* all unset** | **Google logo → reboot loop** (earlier than #1) |
|
||
| **SusFS #3** `…-susfs-20260916T104649Z.img` | `#6 … Wed Sep 16 10:51:09` | `MANUAL` + **AUTO_***=y + SusFS; `susfs_init` in MANUAL path; link fix for `ksu_init_rc_hook` | Still logo→reboot. Proven on **slot a** (same system as penúltimo) → **not A/B system_b** |
|
||
| **SusFS #4 sigfix** `…-susfs-20260916T112839Z.img` | `#7 … Wed Sep 16 11:32:09` sha `472a32d8…` | + sucompat **faccessat/stat** signatures: SusFS `struct filename**` only if `SUSFS && !MANUAL` | **Worse** — returns to fastboot **faster** |
|
||
| **SusFS #5 DEBUG** (building at doc time) | `susfs-boot-debug` session | #4 macros fix (`susfs_*` privilege macros only if `!MANUAL`) + `PANIC_TIMEOUT=0`, no `QCOM_FORCE_WDOG_BITE_ON_PANIC`, `VT`+`FRAMEBUFFER_CONSOLE`, cmdline `panic=0 console=tty0`, `SPOOF_CMDLINE` off | Pending |
|
||
|
||
**Known-good rollback always:**
|
||
`boot-resukisu-our-20260915T183729Z.img` on `boot_a` + `--set-active=a`.
|
||
|
||
**Manager matching 35153:**
|
||
`ReSukiSU_v4.2.0-rc2-spoofed_35153-arm64-v8a-release.apk`
|
||
(without Manager, `su` missing even if kernel has KSU).
|
||
|
||
---
|
||
|
||
## 4. Root-cause chain (what we learned)
|
||
|
||
### 4.1 ReSukiSU upstream treats SusFS as a **hooking method** (XOR)
|
||
|
||
Kconfig `choice "KernelSU Hooking Method"` originally included `KSU_SUSFS` alongside `KSU_MANUAL_HOOK` / `KSU_TRACEPOINT_HOOK`.
|
||
|
||
Enabling SusFS in defconfig → warning `override: KSU_SUSFS changes choice state` → **MANUAL_HOOK off**.
|
||
|
||
**ikconfig proof (T004038Z vs penúltimo):** see
|
||
`/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/ikconfig.diff`.
|
||
|
||
**abu / KernelSU-Next model (correct for addon):** SusFS is a separate `bool` menu under KSU, **not** in the hook choice. Hooks = KPROBES (or manual). `susfs_init()` under `#ifdef CONFIG_KSU_SUSFS` always.
|
||
|
||
### 4.2 First LAB symptom (T004038Z) — vibrator watchdog
|
||
|
||
- Not an early panic: Android mostly up, adb works.
|
||
- `WATCHDOG KILLING SYSTEM PROCESS` blocked in `VibratorManagerService.nativeGetVibratorIds`.
|
||
- Interpreted as fallout of **missing MANUAL_HOOK** (broken input/LSM hook path / module vermagic issues discussed; drv2624 is vendor module).
|
||
|
||
### 4.3 After forcing MANUAL+SusFS — early `kernel_panic`
|
||
|
||
Builds with MANUAL (+ later AUTO) + SusFS die at **Google logo**, reboot, often land in **fastboot** after retries.
|
||
|
||
**Logging reality on Pixel 4a:**
|
||
|
||
- Bootloader **does not support** `fastboot fetch`.
|
||
- `/dev/block/by-name/klog` and `logfs` dumps show many `PM: Reason: kernel_panic` / `HARD RESET by PS_HOLD` but **no Oops / Call trace**.
|
||
- `/sys/fs/pstore` empty after successful penúltimo boot; Pixel ramoops often encrypted (`/vendor/bin/ramoops`, keys under CE — missing/unusable in our tries).
|
||
- Console default: `console=ttyMSM0` only; `# CONFIG_VT is not set` historically → **no Oops text on panel** (only logo).
|
||
|
||
### 4.4 Composition bugs fixed in-tree (still not enough for a clean boot)
|
||
|
||
Patches applied under `drivers/kernelsu/` (and defconfig / BoardConfig):
|
||
|
||
| # | File(s) | Change |
|
||
|---|---------|--------|
|
||
| 1 | `Kconfig` + `Kbuild` | SusFS **out of** hook `choice`; SusFS addon + MANUAL together (abu-like). Snapshot: `susfs-fail-rca/kconfig-fix-20260916T090322Z/` |
|
||
| 2 | `arch/.../sunfish_defconfig` | Re-enable `AUTO_SETUID/INITRC/INPUT=y` (T091211Z had them explicitly **unset**) |
|
||
| 3 | `runtime/ksud_integration.c` | `#elif CONFIG_KSU_SUSFS` → only if `&& !CONFIG_KSU_MANUAL_HOOK` so `ksu_init_rc_hook` is defined under MANUAL+AUTO (else **link error** `undefined symbol: ksu_init_rc_hook`) |
|
||
| 4 | `core/init.c` | In `MANUAL_HOOK` branch, also `#ifdef CONFIG_KSU_SUSFS susfs_init()` (abu always inits SusFS) |
|
||
| 5 | `feature/sucompat.h` + `.c` | `faccessat`/`stat`: SusFS `struct filename **` API **only** if `SUSFS && !MANUAL`. MANUAL call sites in `fs/open.c` / `fs/stat.c` pass `const char __user **` — with SusFS signatures → **ABI mismatch / panic** |
|
||
| 6 | `feature/sucompat.h` | Privilege macros: SusFS `susfs_is_current_proc_no_su` etc. **only** if `SUSFS && !MANUAL` (was still SusFS when both set — likely early panic) |
|
||
| 7 | defconfig + BoardConfig (DEBUG) | `PANIC_TIMEOUT=0`, disable `QCOM_FORCE_WDOG_BITE_ON_PANIC`, enable `VT`/`FRAMEBUFFER_CONSOLE`, cmdline `panic=0 console=tty0` when `SUNFISH_DEBUG_PANIC_SCREEN=1`; `SPOOF_CMDLINE` off |
|
||
|
||
** empirically:** fix #5 (sigfix T112839Z) made LAB failure **faster** to fastboot → either wrong direction for some other call path, or #6 was the dominant bug and #5 alone left broken macros. #6 is in the DEBUG build, **not yet LAB-proven**.
|
||
|
||
### 4.5 Slot / A/B lesson (not the SusFS root cause)
|
||
|
||
- After failed trials, `current-slot:b`, `slot-unbootable:a:yes` left LAB unbootable until **both** slots got `boot-005` + `--set-active=a`.
|
||
- SusFS on **slot a** (same `system_a` as working penúltimo) **still** bootlooped → failure is **SusFS/MANUAL kernel composition**, not stale `system_b`.
|
||
|
||
**Flash discipline now:** penúltimo on `boot_a`, experiment on `boot_b`, `--set-active`; rollback = `--set-active=a` (and reflash `a` if needed).
|
||
|
||
---
|
||
|
||
## 5. Critical comparison: why T004038Z got further than MANUAL+SusFS
|
||
|
||
| | T004038Z (SusFS as hook choice) | T091211Z+ (MANUAL+SusFS addon attempts) |
|
||
|--|----------------------------------|----------------------------------------|
|
||
| MANUAL_HOOK | **off** | **on** (+ AUTO on later builds) |
|
||
| Early boot | Survives to userspace / adb | `kernel_panic`, logo loop |
|
||
| Later failure | Vibrator HAL / system_server watchdog | Never gets there |
|
||
|
||
**Hypothesis for reviewers:** ReSukiSU still has multiple `#ifdef CONFIG_KSU_SUSFS` paths written for **XOR** (SusFS *instead of* MANUAL). Turning both on without auditing every `elif` leaves:
|
||
|
||
- Wrong sucompat prototypes vs `fs/*.c` hooks
|
||
- Wrong privilege helpers (`susfs_*` vs TIF flags)
|
||
- Possibly more (execveat_sucompat, dispatch mark, input hooks, etc.)
|
||
|
||
abu avoids this by using **Next + KPROBES** and SusFS as a pure addon with `#ifdef CONFIG_KSU_SUSFS` init, not ReSukiSU’s choice XOR.
|
||
|
||
---
|
||
|
||
## 6. abu reference details (oracle, not flash path)
|
||
|
||
**Tree:** `/srv/rom/references/abu-msm-4.14-ksu/`
|
||
**KSU:** `drivers/kernelsu` → `../KernelSU-Next/kernel`
|
||
|
||
**Kconfig pattern (excerpt behaviour):**
|
||
|
||
- `CONFIG_KSU` tristate
|
||
- `CONFIG_KSU_KPROBES_HOOK` (default y) — not ReSukiSU MANUAL choice
|
||
- `menu "KernelSU - SUSFS"` → `CONFIG_KSU_SUSFS` bool addon + many `KSU_SUSFS_*` features
|
||
- `ksu.c`: `#ifdef CONFIG_KSU_SUSFS` → `susfs_init();` **unconditional on SusFS**, independent of kprobes
|
||
|
||
**Feature flags abu has that our ReSukiSU SusFS Kconfig may lack:**
|
||
`HAS_MAGIC_MOUNT`, `AUTO_ADD_SUS_*`, `TRY_UMOUNT*`, `SUS_SU` (kprobes), etc.
|
||
|
||
**abu `sunfish_defconfig` in this mirror:** **0** `CONFIG_KSU*` lines — do not treat as the SusFS pin list.
|
||
|
||
**Owner note:** abu also ships separate ReSukiSU-oriented boots / managers under artifacts; still **reference**. Our flash path is only `/srv/rom/artifacts/007-kernelsu/boot-resukisu-*` built from **our** tree.
|
||
|
||
---
|
||
|
||
## 7. Parallel work same day (context, not SusFS)
|
||
|
||
- microG Location UI missing on LAB: we had staged official **`*-hw.apk`** (`versionName=…-hw`) which **omits** `NetworkLocationService` / `NetworkLocationProviderService`.
|
||
- GOLDEN/abu show full Location options with **default** (non-hw) GmsCore.
|
||
- Fixed: stage `com.google.android.gms-252432032.apk` (non-hw); LAB `adb install -r` restored NLP UI.
|
||
- GOLDEN/abu = **A15 scheme oracle**; we keep **newer** packages on A16.
|
||
|
||
---
|
||
|
||
## 8. How we build / logs
|
||
|
||
```bash
|
||
# normal SusFS bootimage (host)
|
||
/srv/rom/artifacts/bin/rom-detach susfs-boot-NAME -- \
|
||
bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage.sh
|
||
|
||
# DEBUG (panic freeze + tty0)
|
||
/srv/rom/artifacts/bin/rom-detach susfs-boot-debug -- \
|
||
bash -lc /srv/rom/artifacts/007-kernelsu/run-susfs-bootimage-debug.sh
|
||
```
|
||
|
||
Always record:
|
||
|
||
- `/srv/rom/artifacts/detach-<session>-<TS>.log`
|
||
- `/srv/rom/logs/007-build/susfs-bootimage.log` (or `-debug.log`)
|
||
- `detach-<session>.status` (`exit=0` / `exit=1`)
|
||
|
||
Verify image before flash:
|
||
|
||
```bash
|
||
unpack_bootimg + lz4 -dc kernel + scripts/extract-ikconfig
|
||
# expect MANUAL_HOOK=y, three AUTO_*=y, KSU_SUSFS=y
|
||
```
|
||
|
||
---
|
||
|
||
## 9. LAB recovery / log capture protocol (4a)
|
||
|
||
```text
|
||
1. SusFS on boot_b, penúltimo on boot_a, --set-active=b, reboot
|
||
2. On logo loop: Vol- + Power → fastboot
|
||
3. fastboot fetch klog → FAILS on this device (unsupported)
|
||
4. fastboot flash boot_a <penúltimo>; --set-active=a; reboot
|
||
5. IMMEDIATELY on adb:
|
||
su -c 'dd if=/dev/block/by-name/klog …; dd if=/dev/block/by-name/logfs …'
|
||
adb pull → lab-klog-*.bin / lab-logfs-*.bin
|
||
6. strings | grep kernel_panic|Oops|Call trace|susfs
|
||
```
|
||
|
||
Observed: step 6 usually only `PM: Reason: kernel_panic` — **insufficient for stack**. Hence DEBUG on-screen build.
|
||
|
||
---
|
||
|
||
## 10. Current tree intent (defconfig snapshot at doc time)
|
||
|
||
```
|
||
CONFIG_KSU=y
|
||
CONFIG_KSU_MANUAL_HOOK=y
|
||
CONFIG_KSU_MANUAL_HOOK_AUTO_SETUID_HOOK=y
|
||
CONFIG_KSU_MANUAL_HOOK_AUTO_INITRC_HOOK=y
|
||
CONFIG_KSU_MANUAL_HOOK_AUTO_INPUT_HOOK=y
|
||
CONFIG_KSU_SUSFS=y
|
||
CONFIG_KSU_SUSFS_SUS_PATH=y
|
||
CONFIG_KSU_SUSFS_SUS_MOUNT=y
|
||
CONFIG_KSU_SUSFS_SUS_KSTAT=y
|
||
# CONFIG_KSU_SUSFS_SPOOF_UNAME is not set
|
||
CONFIG_KSU_SUSFS_ENABLE_LOG=y
|
||
CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y
|
||
# CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG is not set
|
||
CONFIG_KSU_SUSFS_OPEN_REDIRECT=y
|
||
CONFIG_KSU_SUSFS_SUS_MAP=y
|
||
# DEBUG bring-up:
|
||
CONFIG_PANIC_TIMEOUT=0
|
||
# CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC is not set
|
||
CONFIG_VT=y
|
||
CONFIG_VT_CONSOLE=y
|
||
CONFIG_FRAMEBUFFER_CONSOLE=y
|
||
…
|
||
```
|
||
|
||
---
|
||
|
||
## 11. Open questions for a second opinion
|
||
|
||
1. Is ReSukiSU **fundamentally** unsafe to run with `CONFIG_KSU_MANUAL_HOOK=y` **and** `CONFIG_KSU_SUSFS=y` without a larger port from KernelSU-Next’s addon model (more than Kconfig)?
|
||
2. Given T004038Z reached userspace with SusFS-as-choice (no MANUAL), should bring-up prefer that path and fix vibrator separately, vs insisting on MANUAL+AUTO+SusFS?
|
||
3. Remaining `#ifdef CONFIG_KSU_SUSFS` sites to audit in ReSukiSU when MANUAL is also on (`sucompat.c` execveat_sucompat, `dispatch.c`, input, etc.)?
|
||
4. Best way to get a **panic backtrace** on Pixel 4a 4.14 without UART cable (fbcon reliability? pstore decrypt? `CONFIG_PSTORE_CONSOLE`?)?
|
||
5. Any known ReSukiSU + susfs4ksu commit/tag combo that officially supports “SusFS addon + manual hooks” on non-GKI 4.14?
|
||
|
||
---
|
||
|
||
## 12. Related docs in-repo
|
||
|
||
- `docs/007-abu-vs-ours-susfs.md`
|
||
- `docs/007-debug-boot-panic-screen.md`
|
||
- `docs/007-kernelsu-runbook.md`
|
||
- `docs/session-20260916-handoff.md`
|
||
- Host: `/srv/rom/artifacts/007-kernelsu/susfs-fail-rca/SUMMARY.txt` and `NOTE-*.txt`
|
||
|
||
---
|
||
|
||
## 13. Non-goals / constraints
|
||
|
||
- No Magisk as production root.
|
||
- Do not flash abu/torukk/Downloads boots as product.
|
||
- LAB only; never GOLDEN.
|
||
- Prefer small attributable patches; large Android builds on `rom-dev01` only, detached (`rom-detach`).
|
||
|
||
---
|
||
|
||
*End of brief — 2026-09-16 afternoon LAB session after T112839Z failure; DEBUG build in flight.*
|