Deeper comparison of our mainline DTB against the live LineageOS DTB and
the mainline Samsung Galaxy Tab S9 (SM8550) port turned up several
things the Motorola SM8550 firmware needs that mainline sm8550.dtsi does
not provide and the ABL does not reconstruct:
1. reserved-memory: chipinfo @ 0x81cf4000 and llcc_lpi @ 0xff800000 are
no-map in the stock DT but absent from mainline. Both fall inside a
HLOS DRAM bank, so Linux maps and uses firmware/hardware-owned memory
-> external abort -> SoC resets with no console (the <2s reboot). The
Samsung port hit the exact same "NoC error" from missing chipinfo /
LLCC carveouts.
2. __symbols__: build the DTB with dtc -@ (DTC_FLAGS_sm8550-motorola-rtwo
in the qcom Makefile). The SM8550 ABL runs libufdt against the base
DTB; without symbols it drops to the bootloader menu.
3. qcom_tzlog + arch_timer labels: same ABL dtbo-apply path requires
these two labels to exist (LKML "arm64: dts: qcom: sm8550: Fix DTBO
boot failure").
4. compatible: keep qcom,kalama-mtp / qcom,kalama / qcom,mtp next to
qcom,sm8550 - the ABL matches the board on these strings plus
qcom,board-id before launching the kernel.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
modules-initfs listed 'phy-qcom-snps-eusb2', which does not exist in
kernel 7.2 - the SNPS eUSB2 PHY driver is 'phy-snps-eusb2'
(CONFIG_PHY_SNPS_EUSB2=m). pmbootstrap silently skipped the unknown
name, so the built initramfs shipped only phy-qcom-eusb2-repeater.
Without phy-snps-eusb2, phy@88e3000 (qcom,sm8550-snps-eusb2-phy) never
probes -> the built-in dwc3 at usb@a600000 stays on -EPROBE_DEFER ->
no UDC -> the initramfs can't bring up the USB gadget -> no telnet on
172.16.42.1. Not a panic, but it blocks the whole USB-networking goal.
dwc3 and dwc3-qcom are built-in (modules.builtin), pstore/ramoops too
(rtwo.config's CONFIG_PSTORE_RAM=y stuck).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The Sony-modelled minimal DT was electrically correct (verified node by
node against the DTB LineageOS 23.2 actually boots: debug UART SE7,
eUSB2 phy+repeater, hsphy supplies pm8550vs_2_l1/l3 all match exactly)
but missing two things the stock firmware relies on:
- qcom,msm-id = <0x218 0x20000 0x207 0x20000 0x207 0x10000 0x218 0x10000>
qcom,board-id = <0x241 0xb1b0>
The Motorola ABL selects a DTB out of a multi-FDT vendor_boot; without
a matching SoC/board table it may reject our blob (-> no DT -> instant
reset, which matches the <2s black-screen loop).
- ramoops @ 0xae000000 (0x40000 console + 0x20000 record), copied from
the stock DT. rtwo.config already builds CONFIG_PSTORE_RAM; with the
node in place a failed boot's console can be read back from a later
pmOS boot. No 'no-map' (arm64 ramoops needs the linear map).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
rtwo is Android 13: the generic first-stage ramdisk lives in init_boot,
not boot.img, and the bootloader always assembles the initramfs from
init_boot + vendor_boot regardless of what boot.img contains. So the
dubai-style monolithic v2 boot.img cannot work here - keep header v4 and
replace boot (kernel), vendor_boot (dtb+cmdline+initramfs) and init_boot
(generic ramdisk) all with pmOS content.
Combine everything learned:
- header v4, append_dtb off (dtb in vendor_boot)
- earlycon on the cmdline (Motorola ABL requirement, from dubai)
- raw Image kernel (stock LineageOS rtwo evidence)
- base 0 + explicit offsets + os_version/os_patch_level
- 24 MB zero dtbo (dubai trick)
- the Sony-Xperia-1-V-modelled minimal .dts (no /memory, no msm-id, no
speculative regulators)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
device-motorola-dubai (Motorola Edge 30, SM7325) is the closest working
Motorola mainline pmOS port. Match it:
- header_version 2 + append_dtb=true: one monolithic boot.img with the
DTB glued to the kernel, flashed to 'boot'. No vendor_boot / init_boot
/ GKI ramdisk layering.
- 'earlycon' back on the cmdline - dubai's kernel-cmdline.conf says the
Motorola ABL reboots the phone immediately WITHOUT it. This matches
our exact <2s symptom; removing it earlier was the wrong call.
- explicit flash_offset_* (base 0, dtb 0x1f00000, ...) and
--os_patch_level, as dubai sets them.
- dtbo.img = 24 MB of zeros (full partition), dubai's trick to make the
bootloader skip overlay application.
- kernel: gzip'd Image again (dubai uses gz, not raw).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Same SoC, working mainline port. Strip everything speculative:
- no /memory node (Sony relies on the bootloader to inject it)
- no qcom,msm-id / qcom,board-id (Sony's Qualcomm bootloader doesn't
need them)
- no reserved-memory / ramoops / framebuffer overrides
- regulator tree copied verbatim from Sony, including the rails it
deliberately omits with 'the board seems to crash on access' - our
MTP-derived tree (with vdd-*-supply chains + bob2 + L4) may have been
voting an RPMh rail that resets the SoC early.
Only the debug UART and USB HS-peripheral are enabled - enough for the
initramfs + USB networking. cmdline: console=ttyMSM0 (no earlycon).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
New hypotheses from re-comparing with the stock boot:
- 'earlycon' (bare) brings up uart7 in setup_arch(), before the clock
framework. Stock uses console=null and almost certainly leaves the
QUP0 clock gated -> touching uart7 MMIO faults before any console.
Drop earlycon + the serial console; keep console=tty0 only.
- Also drop clk_ignore_unused / pd_ignore_unused (can break qcom power
domain init) and ignore_loglevel stays for the fb console.
- Move the simple-framebuffer out of /chosen and drop the
#address-cells override there, so the bootloader's /memory + initrd
patching into /chosen is not disturbed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Framebuffer stays black on the <2s loop -> the kernel dies before any
console, i.e. in setup_arch(). Neither sm8550.dtsi nor our .dts has a
/memory node; if the Motorola ABL does not inject one for our DTB the
kernel has no RAM and panics immediately. Copy the stock bank layout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
We are past the bootloader (pmOS images boot, LineageOS ones abort to
fastboot) but the kernel panics in <2s with no output. Re-add the
simple-framebuffer (console=tty0 shows the panic on the panel) and a
ramoops region matching the stock layout (readable from stock Android
after a failed boot).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Our boot.img had os_version=0. The stock image is 16.0.0 / 2026-08 and
the Motorola bootloader does anti-rollback on the boot image security
patch level - a 0 value is below the stored minimum and gets rejected
(instant reboot). Match the stock values via bootimg_custom_args.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
So 'pmbootstrap flasher flash_vbmeta' generates + flashes a
verification-disabled vbmeta. Motorola bootloaders can still enforce AVB
on boot/dtbo/init_boot/vendor_boot even when unlocked, rebooting when the
flashed images don't match the stock vbmeta hashes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
A zero-entry DT table (32 bytes) fails Motorola's fastboot pre-flash
validation. Build a real no-op overlay with the kernel's dtc, wrap it in
a 1-entry DT table padded to 4 KB. Still applies nothing to the base DTB.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
From the stock LineageOS images:
- boot.img carries a raw uncompressed arm64 Image (MZ header), not
Image.gz. Install arch/arm64/boot/Image as vmlinuz.
- dtbo.img is an 8-entry overlay table; the bootloader applies overlay
#7 (androidboot.dtbo_idx=7, 87 fragments) onto the base DTB by
phandle. Against our mainline DTB that produces a corrupt merged tree
-> instant panic. Ship an empty dtbo (0 entries) to flash to dtbo_b,
and set deviceinfo_flash_fastboot_partition_dtbo.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
append_dtb=true makes boot-deploy concatenate the raw DTB onto the
gzip'd kernel Image inside boot.img. arm64 has no appended-DTB support;
the trailing bytes corrupt the kernel load -> instant panic. GKI v4
devices put the DTB only in vendor_boot (--dtb); the kernel stays plain.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
pmbootstrap's boot-deploy calls mkbootimg for header v4 without --base or
any --*_offset, so it uses the mkbootimg default base 0x10000000: the DTB
lands at dtb_addr 0x11f00000, well outside RAM (starts at 0x80000000).
LineageOS/Motorola build with base 0. Pass the stock offsets via
deviceinfo_bootimg_custom_args.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The Motorola bootloader does Qualcomm-style DTB selection: it matches
qcom,msm-id / qcom,board-id from each FDT in vendor_boot against the
detected SoC/board and passes only the match to the kernel. Mainline
qcom DTs dropped these props, so ours had none -> no match -> the ABL
hands the kernel no DTB -> instant panic, no console, <2s bootloop
(seen on every kernel version tried). Values from the stock live DT
(SM8550 = 0x218, board-id 0x241/0xb1b0). Mainline ignores them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Full .dts + fixed 7.2 kernel still resets in <2s with no output. Cut the
.dts to SoC + regulators + debug UART + HS-peripheral USB only - no
reserved-memory, no simple-framebuffer, no touch/SD/UFS/keys. If this
reaches the initramfs the fault was in a removed node; if it also resets
the problem is the kernel/config/boot image.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The 7.2 build installed vmlinuz.efi (EFI ZBOOT self-decompressor) into
the Android boot.img; the Motorola bootloader can't execute it and
resets in <2s. Disable CONFIG_EFI_ZBOOT, install arch/arm64/boot/Image.gz
as vmlinuz, and drop pmb:kconfigcheck-uefi (which mandates ZBOOT and is
irrelevant for an Android-boot.img device).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The full initramfs (12.8 MB) does not fit init_boot (8 MB), and stock
init_boot's /init overrides pmOS's in vendor_boot. Splitting produces a
small base initramfs that fits, so it can be flashed to init_boot too.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
7.2 flattened the qcom dwc3 nodes: no more usb_1_dwc3 label, usb_1 is the
dwc3 itself. Move dr_mode/maximum-speed onto &usb_1 and drop the
SuperSpeed phy + usb-role-switch so it comes up as a plain HS gadget
without pmic-glink.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The Dec-2024 sm8550 bring-up snapshot (6.13-rc3) black-screen bootloops
on rtwo with no output. Switch to plain upstream 7.2 (kernel.org, same
tarball as linux-postmarketos-mainline) which has ~18 months of SM8550
fixes (SPMI, watchdog node, USB, UFS, display, ...).
- config base is now config-mainline.aarch64 (copied as
config-motorola-rtwo.aarch64) + the rtwo.config fragment appended.
- rtwo.config: disable RUST + DEBUG_INFO + non-Qualcomm ARCH_* to keep
the build within disk; add SIMPLEDRM/SYSFB_SIMPLEFB alongside FB_SIMPLE.
- drop the hand-added APSS watchdog node from the .dts (upstream
sm8550.dtsi has it since 6.8).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The generic arm64 defconfig builds modules for every SoC family; the
build tree blew past the disk (SIGBUS in modfinal). Disable DEBUG_INFO
and every non-Qualcomm ARCH_* family in rtwo.config.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
'fastboot boot' hands off cleanly (OKAY / booting) and the device then
resets - classic unpetted APSS watchdog. sm8550.dtsi at 6.13-rc3 has no
watchdog node; add it for rtwo so qcom_wdt binds and keeps it fed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The device resets right after 'fastboot boot' with no output. Add tools
to see why:
- rtwo.config kernel fragment: PSTORE_RAM=y + PSTORE_CONSOLE=y (capture the
kernel log in ramoops at 0xae000000, readable afterwards from stock
Android or a later pmOS boot), QCOM_WDT=y (pet the APSS watchdog early
in case the bootloader armed it), FB_SIMPLE/FRAMEBUFFER_CONSOLE on.
- .dts: simple-framebuffer at 0xb8000000 reworked (x8r8g8b8, 1080x2400) -
reuses the bootloader framebuffer, no panel driver needed.
- deviceinfo cmdline: console=tty0 (framebuffer console), ignore_loglevel,
clk_ignore_unused + pd_ignore_unused (keep the bootloader display path
powered so the framebuffer does not freeze).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
boot-deploy needs the AOSP mkbootimg (from android-tools) to build the
header v4 boot.img + vendor_boot.img pair; mkbootimg-osm0sis does not
handle GKI/vendor_boot. Matches the other header-v4 devices (Pixel 6).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The reference-design rail voltages that both sm8550-mtp and the rtwo
downstream share are unchanged, but three rails carry board-specific
ranges in the Motorola DT / device DTB dump:
L11B (panel VDD): 1.20-1.50 V -> 1.23-1.28 V
L1E (USB HS phy): fixed 0.88 V -> 0.88-0.912 V
L1G (UFS VCCQ): fixed 1.20 V -> 1.144-1.256 V
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Cross-referenced the LineageOS 23.2 sources (android_device_motorola_rtwo,
sm8550-common, sm8550-devicetrees) and the DTB dumped from the device:
- Fix debug UART: it is GENI SE7 under qupv3_id_0 (@ac0000), not qupv3_id_1.
- Add ramoops (0xae000000/0x60000) and a cont_splash reserved region
(0xb8000000), both matching the stock reserved-memory map.
- Add a simple-framebuffer at 0xb8000000 (1080x2400) so there is an early
console on the panel; deviceinfo screen size corrected to 1080x2400.
- Goodix GT9916 touchscreen on spi4 (SE4), reset TLMM24 / irq TLMM25,
avdd = pm8550 L9B, vddio = pm8550 L10B (new rails L8B/L10B added).
- gpio-keys: volume-up on pm8550 GPIO6; enable PMIC pwrkey + resin
(volume-down).
- SD card: real card-detect on pm8550 GPIO12, vqmmc = L8B.
- modules-initfs: add goodix-berlin + eusb2 phy modules.
Panel/DRM, GPU, modem, WiFi/BT (WCN7850), charger and camera are documented
as TODO in the .dts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Bring-up for the Motorola Moto Edge 40 Pro (codename "rtwo", SM8550 /
Snapdragon 8 Gen 2).
New linux-postmarketos-qcom-sm8550 aport:
- Built from the postmarketOS soc/qcom-sm8550 tree (branch bringup,
6.13-rc3, commit 22591bbc).
- Kernel config is generated at build time from the in-tree upstream
defconfig plus the repo's pmos.config and devices.config fragments.
- Ships a WIP sm8550-motorola-rtwo.dts: SoC + PMICs + the sm8550-mtp
regulator tree, UART7 debug console, USB in high-speed peripheral mode,
UFS and SD card. Display panel, touchscreen, modem, WiFi/BT, GPU zap
shader and reserved-memory carveouts still need to be described from
Motorola's downstream sources.
device-motorola-rtwo:
- deviceinfo completed from bootimg analysis of the stock boot.img:
Android boot header v4, 4096-byte pages, no qcdt, fastboot flashing.
Added screen geometry, UFS sector size and a serial getty; framebuffer
disabled until the panel works.
- Depends on the new kernel, soc-qcom and mkbootimg.
Both packages still need 'pmbootstrap checksum' for the kernel tarball and
a real boot test; see the TODO comments in the APKBUILDs and the .dts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
snlavaiseandClaude Sonnet 5