DivestOS: long term device support with enhanced privacy and security

Totally_Wildman · August 22, 2021, 9:20am

@SkewedZeppelin Love the idea of this ROM and enjoyed it on my Essential ph1. Unfortunately it does not boot on my Poco F3. I have tried everything I know but no go. Hope it will be fixed in the future.

Thanks, Totally_Wildman.

SkewedZeppelin · August 22, 2021, 2:35pm

@Totally_Wildman
Yep, I seem to have an issue with booting on any device with Linux 4.9 or newer.
I mostly ruled out the defconfig hardening, so it must be a patch applied by the CVE checker.
I don’t have any such device myself, so

SkewedZeppelin · August 23, 2021, 10:33pm

For the past while WebView updates have only been included with system updates each month/build.
In order to provide users with more up-to-date WebViews, especially when there are vulnerabilities in the wild it is critical that I can push out updates quicker.

I am announcing an experimental F-Droid repository that lets you update to the latest Chromium 92.0.4515.159, from the current shipping 92.0.4515.131.

Please do test if you can, that your WebView updates successfully to the new version and that apps utilizing the WebView function correctly.

If all goes well, this repository will be added and enabled by default for fresh installs in the next build cycle for rapid WebView updates to all.

anon46495926 · August 24, 2021, 1:37am

2 devices updated OK. 2 apps - Privacy Browser and GMapsWV work OK.

fossys · August 24, 2021, 9:59am

Open and enlarge image in new tab

Samsung Galaxy S4 ‘jfltexx’ DOS 18.1 / 11.0 / R
After package source update successful update of DivestOS system WebView 92.0.4515.131 to Chromium 92.0.4515.159.

fossys · August 24, 2021, 8:06pm

Xiaomi Poco F1 (beryllium)

DOS build divested-18.1-20210809-dos-beryllium.zip

What was foreshadowed and therefore very likely has been confirmed to me in reality: the DivestOS 18.1-20210809 ROM does not boot - as the only one of four tested custom ROMs. But let’s take it one step at a time.

After I was allowed to unlock the bootloader of my Xiaomi Pocophone P1 (with Stock Android 10) today with official permission from Xiaomi, I first successfully installed, booted and set up /e/ OS e-0.18-q-20210813129945-dev-beryllium.zip (AOSP 10 Q) without incident. Almost obligatory with /e/ OS: The missing FM-radio. Frequently publicised as a shortcoming by the /e/ community, the /e/ communication leader asks in amazement, demands proof of the presence of the FM-radio in stock Android and promises to bring the issue to the developers. Then nothing happens for months. But at least the /e/ ROM is a working custom ROM alternative.

The second successfully installed and working ROM was LOS 18.1 lineage-18.1-20210807-nightly-beryllium-signed.zip (AOSP 11 R). Here, as with the fourth successfully installed and working ROM, LineageOS18.1-for-microG, the FM-radio is integrated and works.

The third installed ROM, DivestOS divested-18.1-20210809-dos-beryllium.zip, could be installed, but only booted up to the POCO logo and remained like this without any movement for about 1 1/2 minutes, only to start OrangeFox Recovery after an automatic reboot with a very short display of the POCO logo in the custom recovery. OrangeFox is a very good TWRP alternative.

I've also tried - without success:

Installation of boot.img from the LOS 18.1 ROM
Installation of vbmeta from the LOS 18.1 ROM
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
fastboot flash boot boot.img

Open and enlarge image

Last but not least, I installed LineageOS18.1-for-microG lineage-18.1-20210810-microG-beryllium.zip. It boots as it should, and can be set up completely. As with /e/ OS and LOS 18.1, I didn’t install the microG recovery because of the reduced features. TWRP 3.5.2_10-0-beryllium and OrangeFox-beryllium-stable@R11.1 (2021-06-26) have more to offer me.

DivestOS ROMs like Google Pixel 3a (sargo), OnePlus 7 pro, OnePlus 6T, OnePlus 6 (enchilada) or Xiaomi Poco F3 that don’t boot properly remind me of the painful DivestsOS early days. The serious shortcoming that the DOS dev does not himself have the majority of the devices for which he designs and builds ROMs available for initial testing clearly comes into play here. This is one more reason to postpone a DivestOS test with my Google Pixel 4a 5G (bramble) with DivestOS, which costs several hundred US dollars, until further notice. It runs splendidly with re-locked bootlaoder with GrapheneOS and CalyxOS.

SkewedZeppelin · August 24, 2021, 8:56pm

Bad news is that none of the newer devices boot.
Good news is that none of the newer devices boot, which means it is likely only one or two issues affecting them all.

I think I will try disabling a few things for all the 4.9+ devices to hopefully make them boot next cycle.

Thank you again @fossys for your thorough testing.

fossys · August 25, 2021, 9:23am

The Google Pixel 3a (sargo), OnePlus 6 (enchilada) and Xiaomi Poco F1 (beryllium) devices are planned to be in my hands for several months so I can do more (boot) tests.

@SkewedZeppelin, it would be an outstanding result if we could prove thats bootloader of ‘enchilada’ and ‘beryllium’ could be locked again.

Antsu · September 1, 2021, 4:46pm

Hi there!

I’ve been setting up my d855 with DivestOS and everything’s gone well. One minor issue is the heating which isn’t rom related. If remember right, it was like that from the beginning since I bought the phone.
But, but. How much of a job it would be to lower the max freq? To 2265MHz or even to 1958MHz. Or would that even make a difference regarding the heating.

SkewedZeppelin · September 1, 2021, 5:44pm

@Antsu
How much is it an issue?
Underclocking is possible, and I think I already have old patches in the repo for it, but I haven’t noticed any issues on my two d852s.

Antsu · September 1, 2021, 6:37pm

Well, like I said it’s an minor issue. It isn’t a toaster luckily.

Correct me if I’m wrong but I think d852 has 800 and d855 has 801 series processor. d855 has a bit higher cpu and gpu freqs. Like oneplus 3 versus 3t.

I could try with rooted lineageos before jumping to conclusions. But I’m not sure how sticky the underclocking is by handling it from userspace.

SkewedZeppelin · September 1, 2021, 7:06pm

I am pretty confident that all G3 models are the SD801/MSM8974AC v3:

github.com

LineageOS/android_kernel_lge_g3/blob/lineage-18.1/arch/arm/boot/dts/msm8974pro-g3-ca/msm8974pro-ac-g3-ca.dts#L16


      
          *
          * This program is distributed in the hope that it will be useful,
          * but WITHOUT ANY WARRANTY; without even the implied warranty of
          * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
          * GNU General Public License for more details.
          */
          
          /dts-v1/;
          
          /include/ "../msm8974pro.dtsi"
          /include/ "../msm8974pro-ac-pm8941.dtsi"
          /include/ "../msm8974-leds.dtsi"
          
          /include/ "../msm8974pro-lge-common/msm8974pro-ac-lge.dtsi"
          /include/ "msm8974pro-g3-ca.dtsi"
          
          / {
          	model = "Qualcomm MSM 8974 AC G3 Canada";
          	compatible = "qcom,msm8974";
          	qcom,msm-id = <194 121 0x10001>;
          };

github.com

LineageOS/android_kernel_lge_g3/blob/lineage-18.1/arch/arm/boot/dts/msm8974pro-g3-global_com/msm8974pro-ac-g3-global_com.dts#L16


      
          *
          * This program is distributed in the hope that it will be useful,
          * but WITHOUT ANY WARRANTY; without even the implied warranty of
          * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
          * GNU General Public License for more details.
          */
          
          /dts-v1/;
          
          /include/ "../msm8974pro.dtsi"
          /include/ "../msm8974pro-ac-pm8941.dtsi"
          /include/ "../msm8974-leds.dtsi"
          
          /include/ "../msm8974pro-lge-common/msm8974pro-ac-lge.dtsi"
          /include/ "msm8974pro-g3-global_com.dtsi"
          
          / {
          	model = "Qualcomm MSM 8974 AC G3 GLOBAL COM";
          	compatible = "qcom,msm8974";
          	qcom,msm-id = <194 118 0x10001>;
          };

Antsu · September 1, 2021, 7:27pm

Oh yes, you got that right. I was looking for the wrong model of 852. Thanks for the answer.

I think the best practise for me is to use it for a week to see the actual behaviour and not judging anything by couple of days usage.

SkewedZeppelin · September 1, 2021, 8:52pm

@fossys

No, I’ve banned OSS 11 until further notice. I’ve experienced ‘CrashDump Mode’ three times with OOS 11.

LineageOS now has an upstream fix merged for the bootloader issues on the 11 firmware:
https://review.lineageos.org/c/LineageOS/android_kernel_oneplus_sdm845/+/315208

Furthermore, thanks to recent donations I have just bought a OnePlus 6T.
Hopefully I will have DivestOS fully working on it by next week.
And that whatever the fix is, fixes other devices too.

fossys · September 2, 2021, 1:45pm

That’s hopeful news after days of silence. It’s no secret: developers with their own device solve serious problems of their own custom ROMS much easier and thus reduce the risk of losing the devices of external testers.

fossys · September 2, 2021, 1:46pm

I use two LG G3 d855: 2/16GB and 3/32GB. I can confirm the experiences reported on the WWW: The smaller version with 2 GB RAM 16 GB eMMC 5.0 gets noticeably warmer than model with 3/32GB.

Licaon_Kter · September 2, 2021, 2:00pm

Ain’t that good enough to run Linux instead?

fossys · September 2, 2021, 2:38pm

Can you relock the bootloader on a Linux phone and start with verified boot?

I’ve tried Ubuntu Touch on OnePlus 6. Apart from the UBports installer not completing the installation on my OP6 and leaving an unusable ‘enchilada’, I switched back to a tried and proven degoogled AOSP custom ROM.

If @SkewedZeppelin succeeds in realising his intended goal (Relocked Bootloader | AVB key), the OnePlus 6/6T will belong to the small but fine guild of up to only twenty-five comprehensive »relocked bootloader | verfied boot« capable Android devices.

anon46495926 · September 2, 2021, 2:53pm

If Raspberry pi 1 is “good enough” to run Linux, then what phone isn’t?

Licaon_Kter · September 2, 2021, 2:54pm

99.9999% of them since you can’t do this?!