Replace system apk/app on android

I show how to replace a system apk, that is a apk which uses the shared user android.uid.system.

You will have to look at

adb shell dumpsys package

and find all apk that use this shared user, because they all have to be signed by the same key to be in the shared user.

Then you will have to resign them all with the same key and copy them to the phone.
When you have foobar.apk and foobar.odex on the phone, you will only have to resign the apk and the odex can stay unchanged there. It seems that they are not protected by signature.
(More to come)

Comparison of various LG GW620 firmwares

I extracted various images downloaded directly from the lg site.
The images are:
V10C_02-BOUYGUES-FRANCE
V10E_05-Vodafone
V10G_00-European-Open
V10I_00-European-Open
V10R_00-Korean-KH5200
I extracted the kdz into cab by the LG-Utils, cab by cabextractor, dz by DZExtractor.
You see there the md5sums of those files. What we see is, that there are quite a lot similarities between amsshd.mbn, appsboothd.mbn and oemsbl.mbn and oemsblhd.mbn.
But amss.mbn and appsboot.mbn are different in each version. Maybe there is some version information included?
As far as I know, amss is the modem firmware and appsboot is the fastboot bootloader. I dont know what the *hd.mbn files are for or what oemsbl* do? (bl=bootloader??)


dfb0769dc93ecdc5988380bed9aaff1c *./V10C-Bouygues/amss.mbn
2a17c5247dba9fce11498488fee12061 *./V10E_05-Vodafone/amss.mbn
dd333e6566eef99a969713799553be75 *./V10G-EuOpen/amss.mbn
7253bd80c73edb549300d87253078968 *./V10I-EuOpen/amss.mbn
d8bcae68375240d397522275dbd0830b *./V10R-Korean/amss.mbn

cdda75572994a6daab80c5e5351310b9 *./V10C-Bouygues/appsboot.mbn
314c89a375728fa02442c56992aff1eb *./V10E_05-Vodafone/appsboot.mbn
44967c50fd8301aee1d032a51b7793df *./V10G-EuOpen/appsboot.mbn
70b1b733b69e5dfe2df3c735338394cf *./V10I-EuOpen/appsboot.mbn
6693756d83d122e385780c245ab79b3d *./V10R-Korean/appsboot.mbn

f58e8960cdb4b12b49f9012a9d1ce2b7 *./V10C-Bouygues/amsshd.mbn
e26cd6f9e9fe7b7695f84cdebdf39cd3 *./V10E_05-Vodafone/amsshd.mbn
e26cd6f9e9fe7b7695f84cdebdf39cd3 *./V10G-EuOpen/amsshd.mbn
0d8c685e56e06b85cb7044ed791790d9 *./V10I-EuOpen/amsshd.mbn
0d8c685e56e06b85cb7044ed791790d9 *./V10R-Korean/amsshd.mbn

46d7ede5e2e68dca935f0861ae0483ef *./V10C-Bouygues/appsboothd.mbn
46d7ede5e2e68dca935f0861ae0483ef *./V10E_05-Vodafone/appsboothd.mbn
46d7ede5e2e68dca935f0861ae0483ef *./V10G-EuOpen/appsboothd.mbn
223e9770b5a2df3221395b0063958327 *./V10I-EuOpen/appsboothd.mbn
e94486df5e239789905fec03c095cd47 *./V10R-Korean/appsboothd.mbn

97b73ae9e69966d211ae239a04421482 *./V10C-Bouygues/oemsblhd.mbn
97b73ae9e69966d211ae239a04421482 *./V10E_05-Vodafone/oemsblhd.mbn
97b73ae9e69966d211ae239a04421482 *./V10G-EuOpen/oemsblhd.mbn
97b73ae9e69966d211ae239a04421482 *./V10I-EuOpen/oemsblhd.mbn
e5fcd9de494ac6eb8069726ea224865e *./V10R-Korean/oemsblhd.mbn

923ba573446a32cec1763a8acf752b64 *./V10C-Bouygues/oemsbl.mbn
923ba573446a32cec1763a8acf752b64 *./V10E_05-Vodafone/oemsbl.mbn
923ba573446a32cec1763a8acf752b64 *./V10G-EuOpen/oemsbl.mbn
751718cb392653314127319d490e4c65 *./V10I-EuOpen/oemsbl.mbn
7ee4fcbe4c80f2f9bce340820e57bc93 *./V10R-Korean/oemsbl.mbn

VPN on the GW620 1.5 cupcake

This will make pptp with mppe work on your cupcake GW620 (but it should easily extend to other android 1.5 phones). L2TP, pptp without mppe and other configurations should work, but I have not tested them. You will need root on you phone.

0. Step: get the files
I have uploaded the kernel patch, pppd, mtpd and even busybox and a complete boot.img here and here.
The boot.img may not work for your phone, so you should consider creating it yourself as under step 1.

1. Step: update your kernel and create a boot.img
Use the GW620-LG Kernel sources for 1.5 and apply the patch at the end of this post. This is the state of ppp in 2.6.29 kernel with very little modifications.

I used /proc/config.gz on the phone as my starting point for the config.
After applying the patch, you have to enable
CONFIG_PPP, CONFIG_PPP_ASYN, CONFIG_PPP_MPPE and CONFIG_PPPOPNS.

You will find various resources on how to compile the kernel for android.

Create a new boot.img by
../android-1.5/out/host/linux-x86/bin/mkbootimg --cmdline 'root=/dev/mtdblock1 rootfstype=yaffs2 lpj=1912832 console=/dev/null' --kernel my-kernel/arch/arm/boot/zImage --ramdisk debug-ramdisk.cpio.gz -o debug-boot.img

I got the parameter for cmdline by looking at cat /proc/cmdline on my phone. You may check if it gives the same output on your phone (and I would also be interested to hear it!)
The kernel parameter is (of course!) the path to your kernel image you just created.
The ramdisk can be one extracted from a previous but image.

ATTENTION: Dont flash this right away! First try by using
fastboot boot debug-boot.img
to boot this image without flashing and see if everything works.
If it goes fine, then use fastboot flash boot debug-boot.img to flash it.


If your phone crashes on boot after you have replaced your kernel, you should also replace wireless.ko in /system/lib/modules/. This fixed the crashes for me.

2. Copy pppd and mtpd binaries to /system/bin on your phone.
Those binaries are build when you compile the plain 1.6 android source.

3. create /system/etc/ppp/chap-secrets
See pppd's documentation how this should look like. I would recommend you to test the pptp on your computer first and then use the same chap-secrets file.

4. Using adb to run:

mtpd pptp $hostname 1723 '' name $username defaultroute require-mppe-128 debug mru 1280 mtu 1280

(Everything in one line)
Replace $hostname and $username by their respective values. For $username you should have the entry in chap-secrets.

Here 1723 is the (standard) port for pptp servers. After the port come _two_ _single_ ' and the rest of the commandline is directly passed to the pppd binary.

You will have to omit require-mppe-128 if you dont use it.

When you enable debug, you will see verbose output in logcat. (See my other post on how to enable locat)

At first I tried without mru 1280 mtu 1280, but after half a minute or so, the logcat output would fill with pppd: Unsupported Protocol ... with varying protocol numbers.
Using mru 1280 mtu 1280 fixed this problem.

Notes:
If it does not work, check that the output of 'route' is correct. You may want to install busybox for that, because the supplied route command is awful.

You could call this binary by using ASE - android scripting, for example.

UPDATE:
You will have to make an link /dev.pts to /dev/pts
or apply the following patch to and comile your own pppd:

+++ ../android-1.6/external/ppp/pppd/sys-linux.c 2010-05-12 18:57:24.511791149 +0200
@@ -2561,7 +2561,7 @@
if (mfd >= 0) {
int ptn;
if (ioctl(mfd, TIOCGPTN, &ptn) >= 0) {
- slprintf(pty_name, sizeof(pty_name), "/dev.pts/%d", ptn);
+ slprintf(pty_name, sizeof(pty_name), "/dev/pts/%d", ptn);
chmod(pty_name, S_IRUSR | S_IWUSR);
#ifdef TIOCSPTLCK
ptn = 0;

LG GW620 proximity sensor

Today I'm gonna write about the android based LG GW620 and its proximity sensor and how to enable it with a aosp cupcake build.
The proprietary LG firmware uses a modified framework, which in turn calls a custom function in libhardware_legacy.so to enable the proximity sensor.

The App "Sensor Dump" shows the sensor as GP2AP002, but no values are shown.

The driver for this device is defined in LG's kernel source in drivers/input/misc/prox_sharp.c.

To enable this sensor, just do a
echo 1 > /sys/devices/platform/i2c-gpio.6/i2c-adapter/i2c-6/6-0044/enable
(for example in an init script)

Now "Sensor Dump" finally shows us some values!

I suppose LG's firmware deactivates the proximity sensor when the phone is sleeping, but I have not looked into this and how this could be archieved with cupcake aosp.

Internals of the LG GW620 RIL protocol

Hey everyone!

Today I'm gonna talk a bit about my findings with the proprietary RIL implementation in the GW620.
It consists of the files bin/rild, lib/libril.so lib/libril-qc-1.so. The rild daemon has not changend much, so we could use the plain rild from cupcake, but it will enable debugging output, when you
write "1" to /data/nv/QCRilLog_flag.

I have comiled the android framwork from plain cupcake android source, and it works quite well.
I can send SMS, receive SMS, get GPRS and UMTS (but UMTS status is not showed - it looks like GPRS), and I can receive calls (I had to modify the Phone app, because the GW620 has no "call" button to answer the call).

But I can't dial out.
I have tracked the process of Dialing from the PhoneApp/PhoneUtils -> framework/GSMPhone -> framework/CallTracker -> framework/gsm/RIL. It really helped to enable the DBG-flag in all those source files.

So when I dial, the DIAL command is send to the RIL socket /dev/socket/rild and no answer is received. In the radio log, I get the line
E/RILC ( 1002): invalid command block for token 133 request DIAL
from the qc ril implementation, so something of the format changed?
(See my other blog entry to enable verbose logging)

Later on we get a
D/MyRILJ ( 1193): WAKE_LOCK_TIMEOUT mReqPending=0 mRequestList=1
D/MyRILJ ( 1193): 0: [133] DIAL
in the log, because the the framework waits for an answer to our DIAL request, but gets no response.

I actually can dial out, by running the command
radiooptions 8 [numberToCall] from the commandline. This program is part of the android tree and usese /dev/socket/rild-debug to communicate with the rild daemon.

So I will have to look at the source code to figure out, how they changed the formatting of the DIAL request. I'll keep you updated!

EDIT:

To enable HSDPA status:
--- a/telephony/java/com/android/internal/telephony/gsm/ServiceStateTracker.java
+++ b/telephony/java/com/android/internal/telephony/gsm/ServiceStateTracker.java
@@ -78,7 +78,8 @@ final class ServiceStateTracker extends Handler
static final int DATA_ACCESS_GPRS = 1;
static final int DATA_ACCESS_EDGE = 2;
static final int DATA_ACCESS_UMTS = 3;
-
+ static final int DATA_ACCESS_HSDPA = 7;
+
static final int MAX_NUM_DATA_STATE_READS = 15;
static final int DATA_STATE_POLL_SLEEP_MS = 100;

@@ -901,6 +902,9 @@ final class ServiceStateTracker extends Handler
case DATA_ACCESS_UMTS:
ret = "UMTS";
break;
+ case DATA_ACCESS_HSDPA:
+ ret = "HSDPA";
+ break;
}

return ret;

To use menu key to receive calls:
--- a/src/com/android/phone/InCallScreen.java
+++ b/src/com/android/phone/InCallScreen.java
@@ -1233,6 +1233,8 @@ public class InCallScreen extends Activity
enableTouchLock(false);
resetTouchLockTimer();
return true;
+ } else {
+ handleCallKey(); /* we have no call key, so use menu */
}
break;

To enable dialing out we have to add two options to the packet, which we send through /dev/socket/rild. The first is called "whichLine" and the second comes from "isEmergency". Their default in LG's code is zero.
--- a/telephony/java/com/android/internal/telephony/gsm/RIL.java
+++ b/telephony/java/com/android/internal/telephony/gsm/RIL.java
@@ -740,10 +742,12 @@ public final class RIL extends BaseCommands implements CommandsInterface
public void
dial (String address, int clirMode, Message result)
{
RILRequest rr = RILRequest.obtain(RIL_REQUEST_DIAL, result);

rr.mp.writeString(address);
rr.mp.writeInt(clirMode);
+ rr.mp.writeInt(0); /* whichLine */
+ rr.mp.writeInt(0); /* isEmergencyCall */

if (RILJ_LOGD) riljLog(rr.serialString() + "> " + requestToString(rr.mRequest));

Enable logcat on the GW620

To see something more, we have to log lower priority events to, so do a

echo 2 >/sys/kernel/logger/log_main/priority
echo 2 >/sys/kernel/logger/log_events/priority
echo 2 >/sys/kernel/logger/log_radio/priority

for reference, see kernel/drivers/misc/logger.c

GW620 proprietary files

Files on the /system for germany/vodafone V10e image (android 1.5), which are not generated by
a compile from source.
I have used strings and readelf -d to find out, what those remaining files are for.

Fonts:

• fonts/{SJGothicFull.ttf SJSans-Bold.ttf SJSans.ttf}

Sounds:

• media/audio/notifications/F1_New_Call.ogg - set in system/build.prop as ro.config.notification_sound
• sounds/lgeAT/Startup.wav the bootup sound (during Android logo)

Keylayout:

• usr/keychars/eve_qwerty.kcm.bin binary map for Keycode to character?
  
• usr/keylayout/eve_qwerty.kl ASCII file for keymapping and which keys can wake up from keypad lock!
• both are used in libui, see source code at frameworks/base/libs/ui
  
  

OMADM:

• etc/omadm/omadmclient_v12.xml

Frameworks:

• framework/com.android.syncml.shared.jar ?
  
• framework/com.google.android.gtalkservice.jar ?
  
• framework/com.google.android.maps.jar Google maps
  
• framework/lge-res.apk -> images for the "keypad unlock" and more..?

Apps:

• xbin/btlifc ??? Something about RFCOM links against libbluetooth.so, no further reference in the rest of the image
• bin/akmd2 - software to process and adjust compass/accelerometer events
• bin/AT ??? opens /dev/smd0
• bin/{rft rft.sh} - RF test script - so maybe not needed at all
• bin/BCM4325D0_004.001.007.0168.0169.hcd: this is no executable and referenced by libbluedroid.so and libril-qc-1.so, maybe some firmware for the BCM4325 chip, which includes wifi, bluetooth and FM
• bin/brcm_chg_bd_addr: what is a BD address?
• bin/brcm_dutMode enable DUT (=test) mode for BCM4325 (?)
• bin/btld daemon for some bluetooth?
• bin/eta Something with "ATS agent", touchscreen testing maybe? reference to ro.build.hiddenmenu and /dev/graphics/fb0
• bin/lgesystemd references to Factory Reset...?
  
• diag_klog
  
• fsck_msdos
  
• hci_qcomm_init
  
• loc_api_app
  
• mm-adspsvc-test
  
• mm-jpeg-dec-test
  
• mm-jpeg-enc-test
  
• mm-qcamera-test
  
• mm-vdec-omxh264-test
  
• mm-vdec-omxmp4-test
  
• mm-venc-omx-test
  
• port-bridge
  
• qemu-props
  
• qmuxd
  
• set_grp_id
  
• su - standard unix util to get root
  
• test_diag
  
  

Libs: (in lib/)

• modules/wireless.ko
  
• libhgl.so - qualcomm/ati opengl ES library
• libmmcamera.so - qcom camera driver (dlopend by libcamera.so)
• libmm-qcamera-tgt.so - qcom camera driver (dlopend by libcamera.so)
• libmmjpeg.so needed by libmmcamera.so
  
• hw/copybit.eve.so - hal driver for the screen/framebuffer
• hw/lights.eve.so - backlight and leds
  
• hw/lights.goldfish.so - same for emulator?
  
• libamcm.so
• libAMMediaFileSplitter.so
• libampostprocess.so
• libAMVideoDecoder.so
• libarcplatform.so
• libautohan_jni.so
• libbcmwl.so
• libcameraservice.so
• libcamera.so
• libcm.so
• libcommondefs.so
  
• libdiag.so
  
• libDioHWR.so
  
• libdsm.so
  
• libdss.so
  
• libfotajni.so
  
• libgps.so
  
• libgsdi_exp.so
  
• libgstk_exp.so
  
• libjbedvm.so
  
• liblgdrm.so
  
• liblgeat.so
  
• liblgerft.so
  
• libloc_api.so
  
• libmm-adspsvc.so
  
• libmmgsdilib.so
  
• libmm-omxcore.so main lib for codecs for decoding
  
• libmvs.so
  
• libnv.so
  
• liboem_rapi.so
• libOmxCore.so lib for codecs
  
• libOmxH264Dec.so codec
  
• libOmxMpeg4Dec.so codec
  
• libOmxVidEnc.so codec
  
• liboncrpc.so
  
• libpdapi.so
  
• libpdsm_atl.so
  
• libping_mdm.so
  
• libqmi.so
  
• libqueue.so
  
• libril_log.so
  
• libril-qc-1.so main lib for radio
  
• libsnd.so
  
• libspeech.so
  
• libuim.so
  
• libunishape.so
  
• libvdmengine.so - something with syncml and OMA DM
  
• libvdmfumo.so
  
• libwbxml_syncml_jni.so
  
• libwbxml_syncml.so
  
• libwmdrmpd.so
  
• libwms.so
  
• libwmsts.so
  
• libwnndict.so
  
• libWnnEngDic.so
  
• libWnnJpnDic.so
  
• libxt9_jni.so
  

Help is needed to identify the remaining files!
(I have omitted the files under 3rd_party/ArcSoft/{Camera DivXReg MediaGallery MediaPlayer VideoEditor})

LG GW620 - Compiling the system

1. Get the mango.cupcake branch from codeaurora:
   repo init -u git://codeaurora.org/platform/manifest.git -b mango.cupcake
   


2. Extract the LG-Source and copy it into that directory you just checked out.


3. I have replaced msm7201a-perf_defconfig by eve_defconfig in vendor/qcom/msm7201a_surf/AndroidBoard.mk



4. We have to fix some include paths and change vendor/lge/hardware/wifi/dhd/Android.mk and vendor/lge/hardware/wifi/wl/Android.mkby adding $(LOCAL_PATH)/../../../../../kernel/include to LOCAL_C_INCLUDES.



5. And I needed to comment out line 845 of file vendor/lge/hardware/sensors/sensors_ak8973.c, which read
   sSensors[ID_P].proximity.distance = event.value;



6. In the file vendor/qcom/msm7201a_surf/boot/eve/Android.mk, comment out the last line wich reads
   include $(BUILD_RAW_STATIC_LIBRARY).
   This keeps libboot_board_surf from building.



7. In the file bootable/bootloader/legacy/nandwrite/Android.mk and bootable/bootloader/legacy/usbloader/Android.mk comment out the line
   include $(BUILD_RAW_EXECUTABLE)
   because those two depend on libboot_board_surf. I'm not quite sure what they do.



8. In the file vendor/qcom/msm7201a_surf/boot/tools/Android.mk, comment out the two lines that say
   include $(BUILD_SYSTEM)/base_rules.mk
   That change keeps appsboot.mbn and appsboothd.mbn from building, which depend on usbloader.
9. [Skip this step for now] Copy qcom propertiary libraries, by mkdir -p out/target/product/msm7201a_surf/obj/lib and then copy libloc_api.so, libdiag.so, libOmxCore.so, libmmcamera.so, libcamera.so from a stock image into that directory.
   

For building, updating or rebuilding, always use the next three commands (they set up the environment) (the last command is one line)

• . build/envsetup.sh
• choosecombo 1 1 msm7201a_surf eng
• LGE_MODEL=eve make -j3 BOARD_HAVE_BLUETOOTH=true BRCM_BT_USE_BTL_IF=true WPA_BUILD_SUPPLICANT=true

Be aware, that there are many files missing or changed from the full image that comes installed to you phone. Especially init scripts, configuration files and propertiary binaries as for the radio ship must be copied over to out/target/product/msm7201a_surf/system and the system.img regenerated. I'm also not sure, how much you can trust the boot.img as the bootloader was not compiled. (but I think its not in boot.img).


I could not test the images created herefrom, because my GW620 got a hardware error berfore and I had to send it to support. Missing files under system/ are:

system/usr/keylayout/eve_qwerty.kl
system/usr/keychars/eve_qwerty.kcm.bin
system/fonts/SJSans-Bold.ttf
system/fonts/SJGothicFull.ttf
system/fonts/SJSans.ttf
system/sounds/lgeAT/1kHz_0dB_L128k.mp3
system/sounds/lgeAT/NoSignal_LR_128k.mp3
system/sounds/lgeAT/MultiSine_20-20kHz-0dBp_128k.mp3
system/sounds/lgeAT/1kHz_0dB_R_128k.mp3
system/sounds/lgeAT/PowerOn.mp3
system/sounds/lgeAT/Startup.wav
system/sounds/lgeAT/1kHz_0dB_LR_128k.mp3
system/sounds/Aging.mp3
system/xbin/btlifc
system/framework/com.google.android.maps.jar
system/framework/lge-res.apk
system/framework/com.android.syncml.shared.jar
system/framework/com.google.android.gtalkservice.jar
system/app/SimChecker.apk
system/app/GoogleSettingsProvider.apk
system/app/ArcVideoEditor.apk
system/app/Memo.apk
system/app/Email.apk
system/app/DivxRegistration.apk
system/app/ArcMMP.apk
system/app/WapService.apk
system/app/Quickoffice.apk
system/app/lgecamera.apk
system/app/MediaUploader.apk
system/app/GmailProvider.apk
system/app/NetworkLocation.apk
system/app/DrmDataMngr.apk
system/app/LGSystemProvider.apk
system/app/XIM.apk
system/app/ChargingTest.apk
system/app/checkin.apk
system/app/SyncMLProvider.apk
system/app/ExternalMemoryTest.apk
system/app/Homecube.apk
system/app/Street.apk
system/app/Homeselector.apk
system/app/ApiDemos.apk
system/app/Gmail.apk
system/app/gtalkservice.apk
system/app/ArcMediaGallery.apk
system/app/Linkbook.apk
system/app/DrmService.apk
system/app/SetupWizard.apk
system/app/orangephorowidget.apk
system/app/Calculator.apk
system/app/RingsExtended.apk
system/app/GooglePartnerSetup.apk
system/app/Talk.apk
system/app/YouTube.apk
system/app/PowerOff.apk
system/app/GoogleApps.apk
system/app/ELTTest.apk
system/app/ArcWorkshop.apk
system/app/Maps.apk
system/app/FavoriteContacts.apk
system/app/My_e-mail_Android.apk
system/app/LGSetupWizard.apk
system/app/Vending.apk
system/app/LgeFmRadio.apk
system/app/HiddenMenu.apk
system/media/audio/ringtones/WhistlingWizard.mp3
system/media/audio/ringtones/Airport.mp3
system/media/audio/ringtones/ThisTime.mp3
system/media/audio/ringtones/Crystal.mp3
system/media/audio/ringtones/CallingTrip.mp3
system/media/audio/notifications/F1_New_Call.ogg
system/media/lgdrm/developcert.cer
system/media/lgdrm/DRMCERTTYPE.TXT
system/etc/wl/nvram.txt
system/etc/omadm/omadmclient_v12.xml
system/etc/gps.conf
system/etc/flex/settings.db
system/etc/flex/flex.xml
system/etc/flex/NOTICE.html.gz
system/etc/LGE_favorites-400x240.xml
system/etc/favorites-400x240.xml
system/etc/favorites-320x240.xml
system/etc/email/hiddenesp.db
system/etc/favorites.xml
system/etc/permissions/com.android.syncml.shared.xml
system/etc/permissions/com.google.android.gtalkservice.xml
system/etc/permissions/com.google.android.maps.xml
system/lib/libmm-omxcore.so
system/lib/libWnnJpnDic.so
system/lib/libdsm.so
system/lib/libpdapi.so
system/lib/libgstk_exp.so
system/lib/libvdmengine.so
system/lib/libAMVideoDecoder.so
system/lib/libmmcamera.so
system/lib/libOmxMpeg4Dec.so
system/lib/libOmxH264Dec.so
system/lib/libbcmwl.so
system/lib/libOmxCore.so
system/lib/libcamera.so
system/lib/libautohan_jni.so
system/lib/libcm.so
system/lib/libcommondefs.so
system/lib/liblgerft.so
system/lib/libspeech.so
system/lib/libamcm.so
system/lib/hw/lights.eve.so
system/lib/hw/copybit.eve.so
system/lib/hw/lights.goldfish.so
system/lib/modules/wireless.ko
system/lib/libvdmfumo.so
system/lib/libwmsts.so
system/lib/libmm-qcamera-tgt.so
system/lib/libwbxml_syncml.so
system/lib/libAMMediaFileSplitter.so
system/lib/libpdsm_atl.so
system/lib/liblgdrm.so
system/lib/libwmdrmpd.so
system/lib/libarcplatform.so
system/lib/libwbxml_syncml_jni.so
system/lib/libwms.so
system/lib/liboem_rapi.so
system/lib/libmvs.so
system/lib/libsnd.so
system/lib/liboncrpc.so
system/lib/libril-qc-1.so
system/lib/libWnnEngDic.so
system/lib/libril_log.so
system/lib/libDioHWR.so
system/lib/libmmgsdilib.so
system/lib/libqueue.so
system/lib/libqmi.so
system/lib/libmmjpeg.so
system/lib/liblgeat.so
system/lib/libxt9_jni.so
system/lib/libnv.so
system/lib/libwnndict.so
system/lib/libuim.so
system/lib/libfotajni.so
system/lib/libping_mdm.so
system/lib/libhgl.so
system/lib/libunishape.so
system/lib/libgsdi_exp.so
system/lib/libmm-adspsvc.so
system/lib/libgps.so
system/lib/libdss.so
system/lib/libdiag.so
system/lib/libampostprocess.so
system/lib/libloc_api.so
system/lib/libOmxVidEnc.so
system/lib/libjbedvm.so
system/3rd_party/ArcSoft/*
system/bin/qemu-props
system/bin/set_grp_id
system/bin/eta
system/bin/rft.sh
system/bin/rft
system/bin/AT
system/bin/su
system/bin/mm-jpeg-enc-test
system/bin/fsck_msdos
system/bin/mm-vdec-omxh264-test
system/bin/mm-qcamera-test
system/bin/lgesystemd
system/bin/test_diag
system/bin/port-bridge
system/bin/qmuxd
system/bin/btld
system/bin/mm-venc-omx-test
system/bin/hci_qcomm_init
system/bin/mm-jpeg-dec-test
system/bin/brcm_chg_bd_addr
system/bin/loc_api_app
system/bin/diag_klog
system/bin/akmd2
system/bin/brcm_dutMode
system/bin/mm-vdec-omxmp4-test
system/bin/mm-adspsvc-test
system/bin/BCM4325D0_004.001.007.0168.0169.hcd

DMA error headache: power supply died silently

After 23 days of uptime, the server started to throw DMA errors on different hard drives of the raid5.
Checking the drives with seagate tools showed no errors, and all IDE-cables had been swapped for new ones. I first suspected the PCI-IDE Controller to be defect, but onboard ide showed the same symptoms:

When put on load, any of the drives would produce DMA errors after some time and then cause a ide bus reset.

...
[1847037.014479] hdh: dma_intr: status=0x51 { DriveReady SeekComplete Error }
[1847037.014486] hdh: dma_intr: error=0x84 { DriveStatusError BadCRC }
[1847037.014489] ide: failed opcode was: unknown
[1847037.060018] ide3: reset: success
..

I finally found the issue: The power supply had died in an unexpected way - it would work nicely till under load and then drop voltage, which caused the hard drives break spinning, which in turn timed out running DMA transfers. After changing it, everything is up an running fine again!
Phew!