device-motorola-dubai (Motorola Edge 30, SM7325) is the closest working
Motorola mainline pmOS port. Match it:
- header_version 2 + append_dtb=true: one monolithic boot.img with the
DTB glued to the kernel, flashed to 'boot'. No vendor_boot / init_boot
/ GKI ramdisk layering.
- 'earlycon' back on the cmdline - dubai's kernel-cmdline.conf says the
Motorola ABL reboots the phone immediately WITHOUT it. This matches
our exact <2s symptom; removing it earlier was the wrong call.
- explicit flash_offset_* (base 0, dtb 0x1f00000, ...) and
--os_patch_level, as dubai sets them.
- dtbo.img = 24 MB of zeros (full partition), dubai's trick to make the
bootloader skip overlay application.
- kernel: gzip'd Image again (dubai uses gz, not raw).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Same SoC, working mainline port. Strip everything speculative:
- no /memory node (Sony relies on the bootloader to inject it)
- no qcom,msm-id / qcom,board-id (Sony's Qualcomm bootloader doesn't
need them)
- no reserved-memory / ramoops / framebuffer overrides
- regulator tree copied verbatim from Sony, including the rails it
deliberately omits with 'the board seems to crash on access' - our
MTP-derived tree (with vdd-*-supply chains + bob2 + L4) may have been
voting an RPMh rail that resets the SoC early.
Only the debug UART and USB HS-peripheral are enabled - enough for the
initramfs + USB networking. cmdline: console=ttyMSM0 (no earlycon).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
New hypotheses from re-comparing with the stock boot:
- 'earlycon' (bare) brings up uart7 in setup_arch(), before the clock
framework. Stock uses console=null and almost certainly leaves the
QUP0 clock gated -> touching uart7 MMIO faults before any console.
Drop earlycon + the serial console; keep console=tty0 only.
- Also drop clk_ignore_unused / pd_ignore_unused (can break qcom power
domain init) and ignore_loglevel stays for the fb console.
- Move the simple-framebuffer out of /chosen and drop the
#address-cells override there, so the bootloader's /memory + initrd
patching into /chosen is not disturbed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Framebuffer stays black on the <2s loop -> the kernel dies before any
console, i.e. in setup_arch(). Neither sm8550.dtsi nor our .dts has a
/memory node; if the Motorola ABL does not inject one for our DTB the
kernel has no RAM and panics immediately. Copy the stock bank layout.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
We are past the bootloader (pmOS images boot, LineageOS ones abort to
fastboot) but the kernel panics in <2s with no output. Re-add the
simple-framebuffer (console=tty0 shows the panic on the panel) and a
ramoops region matching the stock layout (readable from stock Android
after a failed boot).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Our boot.img had os_version=0. The stock image is 16.0.0 / 2026-08 and
the Motorola bootloader does anti-rollback on the boot image security
patch level - a 0 value is below the stored minimum and gets rejected
(instant reboot). Match the stock values via bootimg_custom_args.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
So 'pmbootstrap flasher flash_vbmeta' generates + flashes a
verification-disabled vbmeta. Motorola bootloaders can still enforce AVB
on boot/dtbo/init_boot/vendor_boot even when unlocked, rebooting when the
flashed images don't match the stock vbmeta hashes.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
A zero-entry DT table (32 bytes) fails Motorola's fastboot pre-flash
validation. Build a real no-op overlay with the kernel's dtc, wrap it in
a 1-entry DT table padded to 4 KB. Still applies nothing to the base DTB.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
From the stock LineageOS images:
- boot.img carries a raw uncompressed arm64 Image (MZ header), not
Image.gz. Install arch/arm64/boot/Image as vmlinuz.
- dtbo.img is an 8-entry overlay table; the bootloader applies overlay
#7 (androidboot.dtbo_idx=7, 87 fragments) onto the base DTB by
phandle. Against our mainline DTB that produces a corrupt merged tree
-> instant panic. Ship an empty dtbo (0 entries) to flash to dtbo_b,
and set deviceinfo_flash_fastboot_partition_dtbo.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
append_dtb=true makes boot-deploy concatenate the raw DTB onto the
gzip'd kernel Image inside boot.img. arm64 has no appended-DTB support;
the trailing bytes corrupt the kernel load -> instant panic. GKI v4
devices put the DTB only in vendor_boot (--dtb); the kernel stays plain.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
pmbootstrap's boot-deploy calls mkbootimg for header v4 without --base or
any --*_offset, so it uses the mkbootimg default base 0x10000000: the DTB
lands at dtb_addr 0x11f00000, well outside RAM (starts at 0x80000000).
LineageOS/Motorola build with base 0. Pass the stock offsets via
deviceinfo_bootimg_custom_args.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The Motorola bootloader does Qualcomm-style DTB selection: it matches
qcom,msm-id / qcom,board-id from each FDT in vendor_boot against the
detected SoC/board and passes only the match to the kernel. Mainline
qcom DTs dropped these props, so ours had none -> no match -> the ABL
hands the kernel no DTB -> instant panic, no console, <2s bootloop
(seen on every kernel version tried). Values from the stock live DT
(SM8550 = 0x218, board-id 0x241/0xb1b0). Mainline ignores them.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Full .dts + fixed 7.2 kernel still resets in <2s with no output. Cut the
.dts to SoC + regulators + debug UART + HS-peripheral USB only - no
reserved-memory, no simple-framebuffer, no touch/SD/UFS/keys. If this
reaches the initramfs the fault was in a removed node; if it also resets
the problem is the kernel/config/boot image.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The 7.2 build installed vmlinuz.efi (EFI ZBOOT self-decompressor) into
the Android boot.img; the Motorola bootloader can't execute it and
resets in <2s. Disable CONFIG_EFI_ZBOOT, install arch/arm64/boot/Image.gz
as vmlinuz, and drop pmb:kconfigcheck-uefi (which mandates ZBOOT and is
irrelevant for an Android-boot.img device).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The full initramfs (12.8 MB) does not fit init_boot (8 MB), and stock
init_boot's /init overrides pmOS's in vendor_boot. Splitting produces a
small base initramfs that fits, so it can be flashed to init_boot too.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
7.2 flattened the qcom dwc3 nodes: no more usb_1_dwc3 label, usb_1 is the
dwc3 itself. Move dr_mode/maximum-speed onto &usb_1 and drop the
SuperSpeed phy + usb-role-switch so it comes up as a plain HS gadget
without pmic-glink.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The Dec-2024 sm8550 bring-up snapshot (6.13-rc3) black-screen bootloops
on rtwo with no output. Switch to plain upstream 7.2 (kernel.org, same
tarball as linux-postmarketos-mainline) which has ~18 months of SM8550
fixes (SPMI, watchdog node, USB, UFS, display, ...).
- config base is now config-mainline.aarch64 (copied as
config-motorola-rtwo.aarch64) + the rtwo.config fragment appended.
- rtwo.config: disable RUST + DEBUG_INFO + non-Qualcomm ARCH_* to keep
the build within disk; add SIMPLEDRM/SYSFB_SIMPLEFB alongside FB_SIMPLE.
- drop the hand-added APSS watchdog node from the .dts (upstream
sm8550.dtsi has it since 6.8).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The generic arm64 defconfig builds modules for every SoC family; the
build tree blew past the disk (SIGBUS in modfinal). Disable DEBUG_INFO
and every non-Qualcomm ARCH_* family in rtwo.config.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
'fastboot boot' hands off cleanly (OKAY / booting) and the device then
resets - classic unpetted APSS watchdog. sm8550.dtsi at 6.13-rc3 has no
watchdog node; add it for rtwo so qcom_wdt binds and keeps it fed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The device resets right after 'fastboot boot' with no output. Add tools
to see why:
- rtwo.config kernel fragment: PSTORE_RAM=y + PSTORE_CONSOLE=y (capture the
kernel log in ramoops at 0xae000000, readable afterwards from stock
Android or a later pmOS boot), QCOM_WDT=y (pet the APSS watchdog early
in case the bootloader armed it), FB_SIMPLE/FRAMEBUFFER_CONSOLE on.
- .dts: simple-framebuffer at 0xb8000000 reworked (x8r8g8b8, 1080x2400) -
reuses the bootloader framebuffer, no panel driver needed.
- deviceinfo cmdline: console=tty0 (framebuffer console), ignore_loglevel,
clk_ignore_unused + pd_ignore_unused (keep the bootloader display path
powered so the framebuffer does not freeze).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
boot-deploy needs the AOSP mkbootimg (from android-tools) to build the
header v4 boot.img + vendor_boot.img pair; mkbootimg-osm0sis does not
handle GKI/vendor_boot. Matches the other header-v4 devices (Pixel 6).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
The reference-design rail voltages that both sm8550-mtp and the rtwo
downstream share are unchanged, but three rails carry board-specific
ranges in the Motorola DT / device DTB dump:
L11B (panel VDD): 1.20-1.50 V -> 1.23-1.28 V
L1E (USB HS phy): fixed 0.88 V -> 0.88-0.912 V
L1G (UFS VCCQ): fixed 1.20 V -> 1.144-1.256 V
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Cross-referenced the LineageOS 23.2 sources (android_device_motorola_rtwo,
sm8550-common, sm8550-devicetrees) and the DTB dumped from the device:
- Fix debug UART: it is GENI SE7 under qupv3_id_0 (@ac0000), not qupv3_id_1.
- Add ramoops (0xae000000/0x60000) and a cont_splash reserved region
(0xb8000000), both matching the stock reserved-memory map.
- Add a simple-framebuffer at 0xb8000000 (1080x2400) so there is an early
console on the panel; deviceinfo screen size corrected to 1080x2400.
- Goodix GT9916 touchscreen on spi4 (SE4), reset TLMM24 / irq TLMM25,
avdd = pm8550 L9B, vddio = pm8550 L10B (new rails L8B/L10B added).
- gpio-keys: volume-up on pm8550 GPIO6; enable PMIC pwrkey + resin
(volume-down).
- SD card: real card-detect on pm8550 GPIO12, vqmmc = L8B.
- modules-initfs: add goodix-berlin + eusb2 phy modules.
Panel/DRM, GPU, modem, WiFi/BT (WCN7850), charger and camera are documented
as TODO in the .dts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
Bring-up for the Motorola Moto Edge 40 Pro (codename "rtwo", SM8550 /
Snapdragon 8 Gen 2).
New linux-postmarketos-qcom-sm8550 aport:
- Built from the postmarketOS soc/qcom-sm8550 tree (branch bringup,
6.13-rc3, commit 22591bbc).
- Kernel config is generated at build time from the in-tree upstream
defconfig plus the repo's pmos.config and devices.config fragments.
- Ships a WIP sm8550-motorola-rtwo.dts: SoC + PMICs + the sm8550-mtp
regulator tree, UART7 debug console, USB in high-speed peripheral mode,
UFS and SD card. Display panel, touchscreen, modem, WiFi/BT, GPU zap
shader and reserved-memory carveouts still need to be described from
Motorola's downstream sources.
device-motorola-rtwo:
- deviceinfo completed from bootimg analysis of the stock boot.img:
Android boot header v4, 4096-byte pages, no qcdt, fastboot flashing.
Added screen geometry, UFS sector size and a serial getty; framebuffer
disabled until the panel works.
- Depends on the new kernel, soc-qcom and mkbootimg.
Both packages still need 'pmbootstrap checksum' for the kernel tarball and
a real boot test; see the TODO comments in the APKBUILDs and the .dts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QF5HebjUsRaxbW4cBX6HJP
snlavaiseandClaude Sonnet 5