Update to native-first driver model + user build docs

Confirmed kernel modules on Pixel 10 Pro Fold (rango):
All gamepad drivers native (xpad, hid-playstation, hid-nintendo,
hid-sony, hid-microsoft, hid-logitech, hid-steam, wacom).
SDR uses userspace USB (no kernel modules). WiFi nexmon and
joydev need user-built firmware/modules — documented in
BUILDING_MODULES.md with full instructions.
This commit is contained in:
sssnake
2026-03-31 07:20:55 -07:00
parent 50f4b718ce
commit 7776b6c497
4 changed files with 387 additions and 167 deletions

View File

@@ -1,6 +1,16 @@
#!/system/bin/sh
# Driver Manager - late service
# Manages GPU, WiFi, Bluetooth, SDR, and game controller drivers
#
# Native kernel support confirmed on Pixel 10 Pro Fold (rango):
# GPU: pvrsrvkm (PowerVR DXT-48-1536) — built-in
# WiFi: bcmdhd4390 (Broadcom BCM4390) — built-in
# Bluetooth: btqca, btbcm, bluetooth, rfcomm, hidp — built-in
# Controllers: xpad, hid-playstation, hid-nintendo, hid-sony,
# hid-microsoft, hid-logitech, hid-steam, wacom — all built-in
# USB: usbhid, usb_storage, ftdi_sio, cdc_acm, snd_usb_audio — built-in
# SDR: No kernel DVB/SDR modules — all SDR uses userspace USB via OTG
# (librtlsdr, libhackrf, libairspy talk directly to USB device)
MODDIR=${0%/*}
LOGFILE="$MODDIR/driver-manager.log"
@@ -30,91 +40,109 @@ GPU=$(getprop ro.hardware.egl)
mlog "Boot complete. Device=$DEVICE SoC=$SOC Platform=$PLATFORM API=$API GPU=$GPU"
# ============================================================
# GPU DRIVER MANAGEMENT — PowerVR DXT-48-1536
# GPU — PowerVR DXT-48-1536 (pvrsrvkm, native)
# ============================================================
# Tensor G5 shipped with outdated v24.3 drivers
# v25.1+ adds Vulkan 1.4, better thermal efficiency
# Driver files live in /vendor/lib64/egl/ and /vendor/firmware/
# Vulkan 1.4, OpenGL ES 3.x, OpenCL 3.0
# Driver: /vendor/lib64/egl/libGLES_powervr.so
# Firmware: /vendor/firmware/powervr/
GPU_MODE=$(cat "$CONFDIR/gpu_mode" 2>/dev/null || echo "performance")
case "$GPU_MODE" in
performance)
# Max GPU clock, prefer quality
resetprop vendor.powervr.gpu.freq_hint max
resetprop debug.hwui.renderer skiagl
resetprop debug.renderengine.backend skiavk
resetprop debug.hwui.renderer skiagl
resetprop debug.hwui.use_hint_manager true
mlog "GPU mode: performance (Vulkan renderer, max freq)"
# Request max GPU frequency via thermal hint
echo "max" > /sys/class/powervr/frequency_hint 2>/dev/null
mlog "GPU: performance (Vulkan render, max freq)"
;;
balanced)
resetprop vendor.powervr.gpu.freq_hint auto
resetprop debug.hwui.renderer skiagl
resetprop debug.renderengine.backend skiaglthreaded
mlog "GPU mode: balanced"
resetprop debug.hwui.renderer skiagl
echo "auto" > /sys/class/powervr/frequency_hint 2>/dev/null
mlog "GPU: balanced"
;;
powersave)
resetprop vendor.powervr.gpu.freq_hint min
resetprop debug.hwui.renderer skiagl
resetprop debug.renderengine.backend skiagl
mlog "GPU mode: powersave"
resetprop debug.hwui.renderer skiagl
echo "min" > /sys/class/powervr/frequency_hint 2>/dev/null
mlog "GPU: powersave"
;;
compute)
# Optimized for OpenCL workloads
# OpenCL compute priority — CUDA alternative
resetprop vendor.powervr.opencl.allowfp16 1
resetprop vendor.powervr.opencl.profiling 1
resetprop vendor.powervr.gpu.freq_hint max
mlog "GPU mode: compute (OpenCL optimized)"
echo "max" > /sys/class/powervr/frequency_hint 2>/dev/null
mlog "GPU: compute (OpenCL 3.0, FP16 enabled)"
;;
esac
# Force Vulkan 1.4 feature level if driver supports it
# Updatable GPU driver — Pixel 10 supports Game Update Pack
# v25.1+ brings Vulkan 1.4 and major perf improvements over v24.3
resetprop ro.gfx.driver.1 com.google.pixel.powervr.gfxdriver
mlog "GPU: PowerVR DXT-48-1536, Vulkan 1.4, OpenGL ES 3.x, OpenCL 3.0"
mlog "GPU driver: PowerVR DXT-48-1536 (pvrsrvkm native)"
# ============================================================
# WIFI DRIVER MANAGEMENT — BCM4390 (bcmdhd4390)
# WIFI — BCM4390 (bcmdhd4390, native)
# ============================================================
# Modes: standard, monitor, injection (nexmon), mesh
# Capabilities: Wi-Fi 7, WFD R2, P2P, VHT, DFS
# Firmware: /vendor/firmware/fw_bcmdhd4390.bin
WIFI_MODE=$(cat "$CONFDIR/wifi_mode" 2>/dev/null || echo "standard")
case "$WIFI_MODE" in
standard)
# Normal operation
resetprop wifi.direct.interface p2p-dev-wlan0
mlog "WiFi mode: standard"
resetprop wifi.direct.go_intent 15
mlog "WiFi: standard (P2P enabled)"
;;
monitor)
# Enable monitor mode on BCM4390
# Requires nexmon-patched firmware or native support
# BCM4390 monitor mode via nexmon firmware patch
if [ -f "$MODDIR/firmware/fw_bcm4390_monitor.bin" ]; then
# Back up stock firmware on first use
if [ ! -f "$MODDIR/firmware/fw_bcm4390_stock.bin" ]; then
cp /vendor/firmware/fw_bcmdhd4390.bin "$MODDIR/firmware/fw_bcm4390_stock.bin"
mlog "WiFi: backed up stock firmware"
fi
cp "$MODDIR/firmware/fw_bcm4390_monitor.bin" /vendor/firmware/fw_bcmdhd4390.bin
mlog "WiFi mode: monitor (nexmon firmware loaded)"
# Reload driver
echo 1 > /sys/module/bcmdhd4390/parameters/reload 2>/dev/null
mlog "WiFi: monitor mode (nexmon firmware loaded)"
else
# Try native monitor via iw/ip
mlog "WiFi mode: monitor (native, nexmon firmware not found)"
mlog "WiFi: monitor mode requested — nexmon firmware not found"
mlog "WiFi: see BUILDING_MODULES.md for instructions"
fi
;;
injection)
# Frame injection — requires nexmon patches for BCM4390
if [ -f "$MODDIR/firmware/fw_bcm4390_injection.bin" ]; then
if [ ! -f "$MODDIR/firmware/fw_bcm4390_stock.bin" ]; then
cp /vendor/firmware/fw_bcmdhd4390.bin "$MODDIR/firmware/fw_bcm4390_stock.bin"
fi
cp "$MODDIR/firmware/fw_bcm4390_injection.bin" /vendor/firmware/fw_bcmdhd4390.bin
mlog "WiFi mode: injection (nexmon firmware loaded)"
echo 1 > /sys/module/bcmdhd4390/parameters/reload 2>/dev/null
mlog "WiFi: injection mode (nexmon firmware loaded)"
else
mlog "WiFi mode: injection requested but no nexmon firmware"
mlog "WiFi: injection requested nexmon firmware not found"
mlog "WiFi: see BUILDING_MODULES.md for instructions"
fi
;;
mesh)
# 802.11s mesh networking
resetprop wifi.interface wlan0
mlog "WiFi mode: mesh (802.11s)"
restore)
# Restore stock firmware
if [ -f "$MODDIR/firmware/fw_bcm4390_stock.bin" ]; then
cp "$MODDIR/firmware/fw_bcm4390_stock.bin" /vendor/firmware/fw_bcmdhd4390.bin
echo 1 > /sys/module/bcmdhd4390/parameters/reload 2>/dev/null
mlog "WiFi: stock firmware restored"
fi
echo "standard" > "$CONFDIR/wifi_mode"
mlog "WiFi: restored to standard"
;;
esac
# ============================================================
# BLUETOOTH DRIVER MANAGEMENT — QCA (btqca)
# BLUETOOTH — QCA + BCM (btqca, btbcm, native)
# ============================================================
# rfcomm, hidp, bluetooth all built into kernel
BT_MODE=$(cat "$CONFDIR/bt_mode" 2>/dev/null || echo "standard")
@@ -124,178 +152,175 @@ case "$BT_MODE" in
resetprop bluetooth.profile.hfp.ag.enabled true
resetprop bluetooth.profile.hid.host.enabled true
resetprop bluetooth.profile.pan.nap.enabled true
mlog "BT mode: standard"
mlog "BT: standard"
;;
pentest)
# Enable all profiles + raw HCI access for BLE scanning/exploitation
# All profiles enabled, raw HCI access
resetprop bluetooth.profile.a2dp.source.enabled true
resetprop bluetooth.profile.hfp.ag.enabled true
resetprop bluetooth.profile.hid.host.enabled true
resetprop bluetooth.profile.hid.device.enabled true
resetprop bluetooth.profile.pan.nap.enabled true
resetprop bluetooth.profile.opp.enabled true
# Enable BLE scanning without location requirement
resetprop bluetooth.le.disable_apcf_extended_features 0
mlog "BT mode: pentest (all profiles, raw HCI)"
# Allow BLE scan without location
resetprop bluetooth.le.no_location_permission_scan true
mlog "BT: pentest (all profiles + raw HCI)"
;;
disabled)
resetprop bluetooth.profile.a2dp.source.enabled false
resetprop bluetooth.profile.hfp.ag.enabled false
mlog "BT mode: disabled"
resetprop bluetooth.profile.hid.host.enabled false
mlog "BT: disabled"
;;
esac
# ============================================================
# SDR DRIVER MANAGEMENT — RTL-SDR, HackRF, Airspy, LimeSDR
# SDR — Userspace USB (no kernel modules needed)
# ============================================================
# Kernel modules for USB SDR devices via OTG
# DVB-T vs SDR mode switching for RTL-SDR
# RTL-SDR, HackRF, Airspy, LimeSDR all use userspace USB libs
# Android apps (SDR Touch, RF Analyzer) or Termux tools
# (rtl_sdr, hackrf_transfer, etc.) talk directly to USB device.
#
# The kernel has NO DVB/RTL-SDR modules compiled in, so there's
# no DVB-T vs SDR conflict to manage — it's always userspace.
#
# What we DO manage: USB device permissions and decoder processes
SDR_MODE=$(cat "$CONFDIR/sdr_mode" 2>/dev/null || echo "sdr")
# Load USB SDR kernel modules if available
load_sdr_module() {
MOD_NAME=$1
MOD_PATH="$MODDIR/modules/$MOD_NAME.ko"
if [ -f "$MOD_PATH" ]; then
insmod "$MOD_PATH" 2>/dev/null
if [ $? -eq 0 ]; then
mlog "SDR: loaded $MOD_NAME"
else
mlog "SDR: failed to load $MOD_NAME (kernel mismatch?)"
fi
fi
# Ensure USB OTG is enabled for SDR dongles
resetprop persist.sys.usb.otg 1
# Set USB device permissions for known SDR hardware
# This runs udev-style permission fixing for USB devices
fix_sdr_permissions() {
# Find USB devices by vendor:product and chmod them
for dev in /dev/bus/usb/*/*; do
[ -e "$dev" ] || continue
# Read vendor/product from sysfs
USBDEV=$(readlink -f "$dev" 2>/dev/null)
VENDOR=$(cat "$(dirname "$USBDEV")/idVendor" 2>/dev/null)
PRODUCT=$(cat "$(dirname "$USBDEV")/idProduct" 2>/dev/null)
case "$VENDOR:$PRODUCT" in
0bda:2832|0bda:2838|0bda:2840) # RTL-SDR v1-v4
chmod 666 "$dev" 2>/dev/null
mlog "SDR USB: RTL-SDR at $dev"
;;
1d50:6089) # HackRF One
chmod 666 "$dev" 2>/dev/null
mlog "SDR USB: HackRF at $dev"
;;
1d50:60a1) # Airspy
chmod 666 "$dev" 2>/dev/null
mlog "SDR USB: Airspy at $dev"
;;
1d50:6108) # Airspy HF+
chmod 666 "$dev" 2>/dev/null
mlog "SDR USB: Airspy HF+ at $dev"
;;
0403:6014|04b4:00f3) # LimeSDR (FTDI/Cypress)
chmod 666 "$dev" 2>/dev/null
mlog "SDR USB: LimeSDR at $dev"
;;
1df7:2500|1df7:3020) # SDRplay RSP1/RSP2
chmod 666 "$dev" 2>/dev/null
mlog "SDR USB: SDRplay at $dev"
;;
esac
done
}
fix_sdr_permissions
case "$SDR_MODE" in
sdr)
# SDR scanner mode — blacklist DVB-T drivers, use userspace RTL-SDR
# Remove DVB-T kernel module if loaded (conflicts with librtlsdr)
rmmod dvb_usb_rtl28xxu 2>/dev/null
rmmod dvb_usb_rtl2832u 2>/dev/null
rmmod rtl2832 2>/dev/null
rmmod rtl2832_sdr 2>/dev/null
rmmod dvb_usb_v2 2>/dev/null
# Load HackRF module
load_sdr_module "hackrf"
# Load Airspy module
load_sdr_module "airspy"
# Set USB permissions for SDR devices
# RTL-SDR: vendor 0x0bda, products 0x2832 0x2838
# HackRF: vendor 0x1d50, product 0x6089
# Airspy: vendor 0x1d50, product 0x60a1
# LimeSDR: vendor 0x0403 (FTDI) or 0x04b4 (Cypress)
mlog "SDR mode: scanner (DVB-T blacklisted, userspace SDR)"
mlog "SDR: scanner mode (userspace USB, all devices)"
;;
dvbt)
# DVB-T digital TV mode — load DVB kernel drivers
load_sdr_module "dvb_usb_rtl28xxu"
load_sdr_module "rtl2832"
load_sdr_module "rtl2832_sdr"
# Remove conflicting SDR modules
rmmod hackrf 2>/dev/null
rmmod airspy 2>/dev/null
mlog "SDR mode: DVB-T (digital TV receiver)"
# DVB-T mode — uses same USB device but with DVB-T app
# No kernel module switching needed; app handles the protocol
mlog "SDR: DVB-T mode (userspace, Aerial TV or similar app)"
;;
hackrf)
# HackRF-only mode — TX/RX capable
rmmod dvb_usb_rtl28xxu 2>/dev/null
load_sdr_module "hackrf"
mlog "SDR mode: HackRF (TX/RX enabled)"
mlog "SDR: HackRF TX/RX mode (userspace USB)"
;;
off)
# Unload all SDR modules
rmmod hackrf 2>/dev/null
rmmod airspy 2>/dev/null
rmmod dvb_usb_rtl28xxu 2>/dev/null
rmmod rtl2832 2>/dev/null
mlog "SDR mode: off"
mlog "SDR: off"
;;
esac
# SDR decoder management
DECODER_MODE=$(cat "$CONFDIR/decoder_mode" 2>/dev/null || echo "off")
TERMUX_BIN="/data/data/com.termux/files/usr/bin"
case "$DECODER_MODE" in
adsb)
if [ -x "$TERMUX_BIN/rtl_adsb" ]; then
"$TERMUX_BIN/rtl_adsb" > "$MODDIR/adsb_output.txt" 2>/dev/null &
mlog "Decoder: ADS-B started via Termux (1090 MHz)"
else
mlog "Decoder: ADS-B requested — install rtl-sdr in Termux"
fi
;;
fm)
FREQ=$(cat "$CONFDIR/fm_freq" 2>/dev/null || echo "100.0M")
if [ -x "$TERMUX_BIN/rtl_fm" ]; then
"$TERMUX_BIN/rtl_fm" -f "$FREQ" -M wbfm -s 200000 -r 48000 - 2>/dev/null | \
"$TERMUX_BIN/aplay" -r 48000 -f S16_LE -t raw -c 1 2>/dev/null &
mlog "Decoder: FM radio ($FREQ) via Termux"
else
mlog "Decoder: FM requested — install rtl-sdr in Termux"
fi
;;
spectrum)
RANGE=$(cat "$CONFDIR/spectrum_range" 2>/dev/null || echo "24M:1800M")
if [ -x "$TERMUX_BIN/rtl_power" ]; then
"$TERMUX_BIN/rtl_power" -f "$RANGE" -g 50 -i 1 "$MODDIR/spectrum_data.csv" 2>/dev/null &
mlog "Decoder: spectrum scan ($RANGE) via Termux"
else
mlog "Decoder: spectrum requested — install rtl-sdr in Termux"
fi
;;
off)
# Kill any running decoders
pkill -f rtl_adsb 2>/dev/null
pkill -f rtl_fm 2>/dev/null
pkill -f rtl_power 2>/dev/null
mlog "Decoder: off"
;;
esac
# ============================================================
# GAME CONTROLLER DRIVERS — Xbox, PS5, Switch Pro, 8BitDo
# GAME CONTROLLERS — All native, all built into kernel
# ============================================================
# Android already has HID support but some controllers need
# specific prop tweaks or module loading for full support
# xpad (Xbox) — CONFIG_JOYSTICK_XPAD=y
# hid-playstation (PS5 DualSense, PS4 DualShock) — built-in
# hid-nintendo (Switch Pro, Joy-Con) — built-in
# hid-sony (PS3 Sixaxis, PS4 DS4) — built-in
# hid-microsoft (Xbox One BT) — built-in
# hid-logitech + hidpp (F310, F710, etc.) — built-in
# hid-steam (Steam Controller) — built-in
# wacom (drawing tablets) — built-in
# hid-generic (8BitDo, generic HID gamepads) — built-in
#
# NOTE: CONFIG_INPUT_JOYDEV is NOT set, so /dev/input/jsX
# does not exist. Games use /dev/input/eventX via evdev instead,
# which is standard on Android. Apps that need joydev will need
# a custom kernel — see BUILDING_MODULES.md
GAMEPAD_MODE=$(cat "$CONFDIR/gamepad_mode" 2>/dev/null || echo "auto")
case "$GAMEPAD_MODE" in
auto)
# Enable all supported gamepad types
# All controllers already supported natively
# Just ensure the HID input prop is set
resetprop input.gamepad.enabled true
# Xbox controller — xpad or xone kernel module
load_sdr_module "xpad"
# PS5 DualSense — hid-playstation
load_sdr_module "hid-playstation"
# Nintendo Switch Pro — hid-nintendo
load_sdr_module "hid-nintendo"
# 8BitDo and generic HID gamepads — standard HID stack
# Ensure hid-generic is loaded
load_sdr_module "hid-generic"
mlog "Gamepad mode: auto (all controllers enabled)"
;;
xbox)
load_sdr_module "xpad"
mlog "Gamepad mode: Xbox"
;;
playstation)
load_sdr_module "hid-playstation"
mlog "Gamepad mode: PlayStation DualSense"
;;
nintendo)
load_sdr_module "hid-nintendo"
mlog "Gamepad mode: Nintendo Switch Pro"
mlog "Controllers: auto (xpad, hid-playstation, hid-nintendo, hid-sony, hid-microsoft, hid-logitech, hid-steam, wacom — all native)"
;;
off)
mlog "Gamepad mode: off"
;;
esac
# ============================================================
# SDR DECODERS — Auto-start background decoders if configured
# ============================================================
DECODER_MODE=$(cat "$CONFDIR/decoder_mode" 2>/dev/null || echo "off")
case "$DECODER_MODE" in
adsb)
# ADS-B aircraft tracking on 1090 MHz
if command -v rtl_adsb >/dev/null 2>&1; then
rtl_adsb &
mlog "Decoder: ADS-B started (1090 MHz)"
fi
;;
fm)
FREQ=$(cat "$CONFDIR/fm_freq" 2>/dev/null || echo "100.0M")
if command -v rtl_fm >/dev/null 2>&1; then
rtl_fm -f "$FREQ" -M wbfm -s 200000 -r 48000 - | \
aplay -r 48000 -f S16_LE -t raw -c 1 &
mlog "Decoder: FM radio started ($FREQ)"
fi
;;
spectrum)
# Power spectrum scan
if command -v rtl_power >/dev/null 2>&1; then
RANGE=$(cat "$CONFDIR/spectrum_range" 2>/dev/null || echo "24M:1800M")
rtl_power -f "$RANGE" -g 50 -i 1 "$MODDIR/spectrum_data.csv" &
mlog "Decoder: spectrum scan started ($RANGE)"
fi
;;
off)
mlog "Decoder: off"
mlog "Controllers: off (native drivers still loaded, cannot unload built-in)"
;;
esac