[Samsung Galaxy Note 8 ROMs, Kernels, Recoveries, &] BigCountry907:
The Goal

In the end this is the boot sequence we would like to see.

If you looked at the strings in the previous post you will recognize some of the information here.

================================================================================

Successful boot sequence

================================================================================

Format: Log Type - Time(microsec) - Message - Optional Info

Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic

S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.0-00301

S - IMAGE_VARIANT_STRING=M8996LAB

S - OEM_IMAGE_VERSION_STRING=crm-ubuntu68

S - Boot Interface: UFS

S - Secure Boot: Off

S - Boot Config @ 0x00076044 = 0x000001c9

S - JTAG ID @ 0x000760f4 = 0x4003e0e1

S - OEM ID @ 0x000760f8 = 0x00000000

S - Serial Number @ 0x00074138 = 0x2e8844ce

S - OEM Config Row 0 @ 0x00074188 = 0x0000000000000000

S - OEM Config Row 1 @ 0x00074190 = 0x0000000000000000

S - Feature Config Row 0 @ 0x000741a0 = 0x0050000010000100

S - Feature Config Row 1 @ 0x000741a8 = 0x00fff00001ffffff

S - Core 0 Frequency, 1228 MHz

B - 0 - PBL, Start

B - 10412 - bootable_media_detect_entry, Start

B - 47480 - bootable_media_detect_success, Start

B - 47481 - elf_loader_entry, Start

B - 49027 - auth_hash_seg_entry, Start

B - 49129 - auth_hash_seg_exit, Start

B - 82403 - elf_segs_hash_verify_entry, Start

B - 84905 - PBL, End

B - 86955 - SBL1, Start

B - 182969 - usb: hs_phy_nondrive_start

B - 183305 - usb: PLL lock success - 0x3

B - 186294 - usb: hs_phy_nondrive_finish

B - 190442 - boot_flash_init, Start

D - 30 - boot_flash_init, Delta

B - 197548 - sbl1_ddr_set_default_params, Start

D - 30 - sbl1_ddr_set_default_params, Delta

B - 205509 - boot_config_data_table_init, Start

D - 200659 - boot_config_data_table_init, Delta - (60 Bytes)

B - 410713 - CDT Version:3,Platform ID:24,Major ID:1,Minor ID:0,Subtype:0

B - 415410 - Image Load, Start

D - 22570 - PMIC Image Loaded, Delta - (37272 Bytes)

B - 437980 - pm_device_init, Start

B - 443744 - PON REASON:PM0:0x200000061 PM1:0x200000021

B - 480161 - PM_SET_VAL:Skip

D - 40016 - pm_device_init, Delta

B - 482083 - pm_driver_init, Start

D - 2928 - pm_driver_init, Delta

B - 488671 - pm_sbl_chg_init, Start

D - 91 - pm_sbl_chg_init, Delta

B - 495442 - vsense_init, Start

D - 0 - vsense_init, Delta

B - 505171 - Pre_DDR_clock_init, Start

D - 396 - Pre_DDR_clock_init, Delta

B - 509045 - ddr_initialize_device, Start

B - 512766 - 8996 v3.x detected, Max frequency = 1.8 GHz

B - 522373 - ddr_initialize_device, Delta

B - 522404 - DDR ID, Rank 0, Rank 1, 0x6, 0x300, 0x300

B - 526247 - Basic DDR tests done

B - 594994 - clock_init, Start

D - 274 - clock_init, Delta

B - 598349 - Image Load, Start

D - 4331 - QSEE Dev Config Image Loaded, Delta - (46008 Bytes)

B - 603808 - Image Load, Start

D - 5338 - APDP Image Loaded, Delta - (0 Bytes)

B - 612409 - usb: UFS Serial - 2f490ecf

B - 616801 - usb: fedl, vbus_low

B - 620431 - Image Load, Start

D - 55418 - QSEE Image Loaded, Delta - (1640572 Bytes)

B - 675849 - Image Load, Start

D - 2013 - SEC Image Loaded, Delta - (4096 Bytes)

B - 683413 - sbl1_efs_handle_cookies, Start

D - 457 - sbl1_efs_handle_cookies, Delta

B - 691892 - Image Load, Start

D - 14396 - QHEE Image Loaded, Delta - (254184 Bytes)

B - 706319 - Image Load, Start

D - 14061 - RPM Image Loaded, Delta - (223900 Bytes)

B - 721111 - Image Load, Start

D - 3233 - STI Image Loaded, Delta - (0 Bytes)

B - 727913 - Image Load, Start

D - 34709 - APPSBL Image Loaded, Delta - (748716 Bytes)

B - 762713 - SBL1, End

D - 680028 - SBL1, Delta

S - Flash Throughput, 94000 KB/s (2959024 Bytes, 31250 us)

S - DDR Frequency, 1017 MHz

Android Bootloader - UART_DM Initialized!!!

[0] BUILD_VERSION=

[0] BUILD_DATE=16:07:51 - Nov 17 2017

[0] welcome to lk

[10] platform_init()

[10] target_init()

[10] RPM GLink Init

[10] Opening RPM Glink Port success

[10] Opening SSR Glink Port success

[20] Glink Connection between APPS and RPM established

[20] Glink Connection between APPS and RPM established

[40] UFS init success

[80] Qseecom Init Done in Appsbl

[80] secure app region addr=0x86600000 size=0x2200000[90] TZ App region notif returned with status:0 addr:86600000 size:35651584

[100] TZ App log region register returned with status:0 addr:916d4000 size:4096

[100] Qseecom TZ Init Done in Appsbl

[120] Loading cmnlib done

[120] qseecom_start_app: Loading app keymaster for the first time

[150] <8>keymaster: ""KEYMASTER Init ""

[160] Selected panel: none

Skip panel configuration

[160] pm8x41_get_is_cold_boot: cold boot

[170] boot_verifier: Device is in ORANGE boot state.

[180] Device is unlocked! Skipping verification...

[180] Loading (boot) image (348160): start

[190] Loading (boot) image (348160): done

[190] use_signed_kernel=1, is_unlocked=1, is_tampered=0.

[200] Your device has been unlocked and cant be trusted.

Wait for 5 seconds before proceeding

[5200] mdtp: mdtp_img loaded

[5210] mdtp: is_test_mode: test mode is set to 1

[5210] mdtp: read_metadata: SUCCESS

[5230] LK SEC APP Handle: 0x1

[5230] Return value from recv_data: 14

[5240] Return value from recv_data: 14

[5250] Return value from recv_data: 14

[5260] DTB Total entry: 1, DTB version: 3

[5260] Using DTB entry 0x00000123/00000000/0x00000018/0 for device 0x00000123/00030001/0x00010018/0

[5270] cmdline: androidboot.bootdevice=624000.ufshc androidboot.verifiedbootstate=orange androidboot.veritymode=enforcing androidboot.serialno=2f490ecf androidboot.baseband=apq mdss_mdp.panel=0

[5290] Updating device tree: start

[5290] Updating device tree: done

[5290] Return value from recv_data: 14

[5300] RPM GLINK UnInit

[5300] Qseecom De-Init Done in Appsbl

[5300] booting linux @ 0x80080000, ramdisk @ 0x82200000 (0), tags/device tree @ 0x82000000

[5310] Jumping to kernel via monitor

U-Boot 2017.11-00145-ge895117 (Nov 29 2017 - 10:04:06 +0100)

Qualcomm-DragonBoard 820C

DRAM: 3 GiB

PSCI: v1.0

MMC: sdhci@74a4900: 0

In: serial@75b0000

Out: serial@75b0000

Err: serial@75b0000

Net: Net Initialization Skipped

No ethernet found.

Hit any key to stop autoboot: 0

switch to partitions #0, OK

mmc0 is current device

Scanning mmc 0:1...

Found /extlinux/extlinux.conf

Retrieving file: /extlinux/extlinux.conf

433 bytes read in 71 ms (5.9 KiB/s)

1: nfs root

Retrieving file: /uImage

19397184 bytes read in 2024 ms (9.1 MiB/s)

append: root=/dev/nfs rw nfsroot=192.168.1.2:/db820c/rootfs,v3,tcp rootwait ip=dhcp consoleblank=0 console=tty0 console=ttyMSM0,115200n8 earlyprintk earlycon=msm_serial_dm,0x75b0000 androidboot.bootdevice=624000.ufshc androidboot.verifiedbootstate=orange androidboot.ver0

Retrieving file: /apq8096-db820c.dtb

38134 bytes read in 37 ms (1005.9 KiB/s)

## Booting kernel from Legacy Image at 95000000 ...

Image Name: Dragonboard820c

Image Type: AArch64 Linux Kernel Image (uncompressed)

Data Size: 19397120 Bytes = 18.5 MiB

Load Address: 80080000

Entry Point: 80080000

Specifically what we want to accomplish.

Format: Log Type - Time(microsec) - Message - Optional Info

Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic

S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.0-00301

S - IMAGE_VARIANT_STRING=M8996LAB

S - OEM_IMAGE_VERSION_STRING=crm-ubuntu68

S - Boot Interface: UFS

S - Secure Boot: Off

S - Boot Config @ 0x00076044 = 0x000001c9

S - JTAG ID @ 0x000760f4 = 0x4003e0e1

S - OEM ID @ 0x000760f8 = 0x00000000

S - Serial Number @ 0x00074138 = 0x2e8844ce

S - OEM Config Row 0 @ 0x00074188 = 0x0000000000000000

S - OEM Config Row 1 @ 0x00074190 = 0x0000000000000000

S - Feature Config Row 0 @ 0x000741a0 = 0x0050000010000100

S - Feature Config Row 1 @ 0x000741a8 = 0x00fff00001ffffff

S - Core 0 Frequency, 1228 MHz

B - 0 - PBL, Start

B - 10412 - bootable_media_detect_entry, Start

B - 47480 - bootable_media_detect_success, Start

If we can set this the bootloader is unlocked.

Boot Config @ 0x00076044 = 0x000001c9

From our xbl.elf strings.

Secure Boot:

%s @ 0x%08x = 0x%016llx

%s @ 0x%08x = 0x%08x

Boot Config

JTAG ID

OEM ID

Serial Number

OEM Config Row 0

OEM Config Row 1

Feature Config Row 0

Feature Config Row 1

0x00070000, 0x00010000, "BOOT_CONFIG", AddDev, MMAP_IO, UNCACHEABLE, MmIO, NS_DEVICE