[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
mixing bootloader components from different versions

Sony stock fw contains bootloader in the boot.zip (or boot/ subdirectory) - like

bootloader_X_BOOT_MSM8998_LA2_0_P_114_X-FLASH-ALL-C93B.sin

file present in the G8441-47.2.A.10.107 firmware (similarly for other yoshino phones).

When the .sin file is extracted, the big file is a .tar archive with following files in it:

$ tar xvf bootloader.000
abl_X_BOOT_MSM8998_LA2_0_P_114.mbn
cmnlib64_X_BOOT_MSM8998_LA2_0_P_114.mbn
cmnlib_X_BOOT_MSM8998_LA2_0_P_114.mbn
devcfg_X_BOOT_MSM8998_LA2_0_P_114.mbn
hyp_X_BOOT_MSM8998_LA2_0_P_114.mbn
keymaster_X_BOOT_MSM8998_LA2_0_P_114.mbn
pmic_X_BOOT_MSM8998_LA2_0_P_114.mbn
rpm_X_BOOT_MSM8998_LA2_0_P_114.mbn
tz_X_BOOT_MSM8998_LA2_0_P_114.mbn
tzxfl_X_BOOT_MSM8998_LA2_0_P_114.mbn
tzxflattest_X_BOOT_MSM8998_LA2_0_P_114.mbn
xbl_X_BOOT_MSM8998_LA2_0_P_114.mbn
xfl_X_BOOT_MSM8998_LA2_0_P_114.mbn

I believe that the prefix (the name part before _X_BOOT) corresponds to a partition with the same name, to which the mbn file is actually flashed, when flashing the bootloader.

It seems that each .mbn file contains sony signature.

In my opinion, it may be possible to flash these bootloader components manually from a root shell on the phone via a dd command for example:

dd if=xfl_X_BOOT_MSM8998_LA2_0_P_114.mbn of=/dev/block/bootdevice/by-name/xfl

I've verified, that if an image is retrieved from the phone of a component of bootloader (like for example xfl partition), it exactly matches the corresponding .mbn file (except the image is bigger due to the partition being larger, containing zero bytes filling the remaining space).

It seems to me, that the primary bootloader (contained in a ROM and not part of a flashable firmware) loads the flashable bootloader components from all those partitions, most likely first the Trust Zone stuff (hyp, tzxfl, tz, tzxflattest, keymaster, cmnlib64, cmnlib, pmic, rpm), then xbl (eXtensible Boot Loader) which loads abl (Android Boot Loader), which in turn loads and starts linux kernel with android. Both xbl and abl are implemented as uefi bootloaders.

If pie fw is booted by oreo bootloader, then camera hangs on pie for example.

In my opinion it is due to the trust zone stuff flashed as bootloader components and their incompatibilities between oreo and pie variants.

So I am wondering, if we could combine components let's say from an oreo bootloader with components from a pie bootloader, for example?

Like if there was found a vulnerability in some of those components (let's say abl), if we could downgrade just the needed component and have the other bootloader's components (like the trust zone stuff) intact?

Or do you think there is some version matching between the components implemented, refusing to boot mixed versions?

Any thoughts on this?

[MENTION=7543898]Blu-eyes[/MENTION], [MENTION=9509161]d3dm[/MENTION], [MENTION=5400898]HandyMenny[/MENTION], [MENTION=7836278]LazerL0rd[/MENTION], [MENTION=4900593]mirhl[/MENTION], [MENTION=4120742]munjeni[/MENTION], [MENTION=599722]niaboc79[/MENTION], [MENTION=9191353]notaz[/MENTION], [MENTION=4782500]pbarrette[/MENTION], [MENTION=9467091]pwnphones[/MENTION], [MENTION=5505196]Raz0Rfail[/MENTION], [MENTION=4688377]russel5[/MENTION], [MENTION=9795951]screw80[/MENTION], [MENTION=3989065]serajr[/MENTION], [MENTION=4675598]shoey63[/MENTION], [MENTION=3665957]the_laser[/MENTION], [MENTION=8030733]Yurienu[/MENTION]

Thanks.