get device bricked after qbootctl -s

[right-0903]

My device died after qbootctl -s b. Before that -c -b -n -m worked well . But I never tested -s.

My device is Oneplus Pad Pro aka Oneplus Pad 2 which is shipped with sm8650.
I modified the partition table (userdata -> userdata(for android os) and userdata2(for postmarket os)).
slot a for postmark, b for androoid, it worked well before that.

I have been warned, so I don't blame it on anyone, but any suggestion?

I tried to attach stock charger and cable, no response (usb power meter shows 5.24v 0.26a then it dropped to 5.24v 0.13a, repeat again and again).

[right-0903]

Addition:
the release version of qbootctl from pmos: qbootctl-systemd-63-r1,
plugging with vol up down being pressed, I can get into edl mode for 30s ,then it got disconnected.

[gralco]

I've experienced this on a OnePlus 6T as well. It "bricks" after using qbootctl -s, I've had to use EDL mode to recover and reflash Mobian & LineageOS from scratch to get it back. I've tested it at least twice with the same result. Using BootControl in LineageOS to select the slot for Mobian works fine, but now I completely avoid using qbootctl -s in Mobian since I know it will "brick."

What I do as a workaround is I have a Raspberry Pi Zero 2 W with fastboot installed and a systemd service that immediately sends fastboot set_active b && fastboot reboot upon booting the Pi. That way I can power the Pi with an external battery and attach the device that's in fastboot mode, which takes around ~10 seconds all together.

If there comes to be a patch for qbootctl then I can test it.

[right-0903]

I've experienced this on a OnePlus 6T as well. It "bricks" after using qbootctl -s, I've had to use EDL mode to recover and reflash Mobian & LineageOS from scratch to get it back. I've tested it at least twice with the same result. Using BootControl in LineageOS to select the slot for Mobian works fine, but now I completely avoid using qbootctl -s in Mobian since I know it will "brick."

Glad to know. So I will follow this to avoid qbootctl -s. Luckily, I found a way to do EDL finally (There is VIP authentication on sm8650 based oneplus devices, buying time-limited granted flashing accounts to do EDL : ( ). Maybe I should use brick as well. BTW, I just knew about bootctl prog, sounds awesome.

What I do as a workaround is I have a Raspberry Pi Zero 2 W with fastboot installed and a systemd service that immediately sends fastboot set_active b && fastboot reboot upon booting the Pi. That way I can power the Pi with an external battery and attach the device that's in fastboot mode, which takes around ~10 seconds all together.

If there comes to be a patch for qbootctl then I can test it.

If you want to switch, you can use qbootctl to mark this partition unbootable(or repeating reboot until it is marked unbootable, about 7 times), then it will switch to another successful slot, if I remember correctly. Then you can use bootctl to switch back?

Can you share the full table which shows the qbootctl option what we can do and what we can't do? Trying it make me bankrupt due to the VIP policy mentioned above.

[khairul169]

I've also experienced it some time ago with my Xiaomi Pad 6 (pipa) and on arch linux arm (dual boot with android, userdata partition also splitted into 2). Bricked after running qbootctl -s a. Installed qbootctl using aur/yay (v0.2.0).

On PostmarketOS, it seems that the qbootctl binary packaged and in the alpine upstream repo is the older version too (v0.1.2)

But after trying to build the binary from source (commit 39a6e6d / v0.2.2) and use it almost everyday, never (and hope that it always never) had this issue again.. maybe the latest version had it fixed?

[right-0903]

I've also experienced it some time ago with my Xiaomi Pad 6 (pipa) and on arch linux arm (dual boot with android, userdata partition also splitted into 2). Bricked after running qbootctl -s a. Installed qbootctl using aur/yay (v0.2.0).

Wow, pipa. Then I prefer to ask about panel insights. Recently, when I am free, I am porting the oneplus device, which also shipped with nt36532 TDDI, could you tell me can I initialize the display panel regardless of touch panel? I have got touchscreen working solely, but the display is really a problem. I don't want to follow the special initial sequence for now which is necessary for them to work together. if display panel can work solely?

On PostmarketOS, it seems that the qbootctl binary packaged and in the alpine upstream repo is the older version too (v0.1.2)

But after trying to build the binary from source (commit 39a6e6d / v0.2.2) and use it almost everyday, never (and hope that it always never) had this issue again.. maybe the latest version had it fixed?

I dont dare to try it. I am behaving like what I said above, qbootctl -u if switch to android, bootctl if switch to linux. After all, edl is expensive for sm8650.

[stableversion]

Actually ran into this issue too (sm8250), i've tracked it to ONLY happen on linux >6.15, while 6.13 works just fine, i have built qbootctl from source, so it's impossible for it to change.

sudo ./qbootctl -s a
gpt_get_headers: Failed to resolve path for boot_a 
gpt_disk_get_disk_info: Failed to get GPT headers 
set_active_boot_slot: Failed to set active slot for partitions
SLOT _a: Failed to set active

The reason is unknown currently, but checking edl printgpt reveals that completely random partitions are active, i.e tz_b, vbmeta_system_a xbl_a meaning there is complete chaos in the bootloader

You don't need to fully wipe your phone to fix it, if you have access to pure EDL you can simply use https://github.com/bkerler/edl but modify the firehose.py code to force update the slots even if some are marked as "active/inactive"

                else:
                    for partitionname_a in guid_gpt_a.partentries:
                        slot = partitionname_a.lower()[-2:]
                        partition_a = backup_guid_gpt_a.partentries[partitionname_a]
                        if slot == "_a":
                            active_a = ((partition_a.flags >> (
                                        AB_FLAG_OFFSET * 8)) & 0xFF) & AB_PARTITION_ATTR_SLOT_ACTIVE == AB_PARTITION_ATTR_SLOT_ACTIVE
                            # COMMENT OUT THIS PART!!
                            #if (active_a and slot_a_status) or (not active_a and slot_b_status):
                            #    return True

                            partitionname_b = partitionname_a[:-1] + "b"

Then do:

edl setactiveslot a --loader=yourloader

edl setactiveslot b --loader=yourloader

edl setactiveslot a --loader=yourloader

You may also need to edl reset between the attempts.

edit: upon further investigation 6.13 also bricks itself sometimes, but doesn't show any errors, which is even stranger

---

@right-0903 Funnily enough, im also mainlining the oneplus pad 2, and i'm glad i never got UFS working now 😂

[right-0903]

Actually ran into this issue too (sm8250), i've tracked it to ONLY happen on linux >6.15, while 6.13 works just fine, i have built qbootctl from source, so it's impossible for it to change.

sudo ./qbootctl -s a
gpt_get_headers: Failed to resolve path for boot_a
gpt_disk_get_disk_info: Failed to get GPT headers
set_active_boot_slot: Failed to set active slot for partitions
SLOT _a: Failed to set active

The reason is unknown currently, but checking edl printgpt reveals that completely random partitions are active, i.e tz_b, vbmeta_system_a xbl_a meaning there is complete chaos in the bootloader

You don't need to fully wipe your phone to fix it, if you have access to pure EDL you can simply use https://github.com/bkerler/edl but modify the firehose.py code to force update the slots even if some are marked as "active/inactive"

            else:
                for partitionname_a in guid_gpt_a.partentries:
                    slot = partitionname_a.lower()[-2:]
                    partition_a = backup_guid_gpt_a.partentries[partitionname_a]
                    if slot == "_a":
                        active_a = ((partition_a.flags >> (
                                    AB_FLAG_OFFSET * 8)) & 0xFF) & AB_PARTITION_ATTR_SLOT_ACTIVE == AB_PARTITION_ATTR_SLOT_ACTIVE
                        # COMMENT OUT THIS PART!!
                        #if (active_a and slot_a_status) or (not active_a and slot_b_status):
                        #    return True

                        partitionname_b = partitionname_a[:-1] + "b"

Then do:

edl setactiveslot a --loader=yourloader

edl setactiveslot b --loader=yourloader

edl setactiveslot a --loader=yourloader

You may also need to edl reset between the attempts.

edit: upon further investigation 6.13 also bricks itself sometimes, but doesn't show any errors, which is even stranger

This works on oneplus sm8650? As I said , there is a online VIP authentication when doing edl

@right-0903 Funnily enough, im also mainlining the oneplus pad 2, and i'm glad i never got UFS working now 😂

Nowadays, I am busy with my thesis, I may uncover it in the next few weeks.

Spolier

[stableversion]

@right-0903 Unfortunately it does not work for VIP if you cant' authenticate EDL, i also had to pay to unbirck my sm8650 oneplus pad 2 because i deleted abl by accident. Luckily sm8250 has xiaomi auth bypass.

Would be eager to know your .config and .dts ! I can contribute my ath12k patch to enable wifi :)

[right-0903]

@right-0903 Unfortunately it does not work for VIP if you cant' authenticate EDL, i also had to pay to unbirck my sm8650 oneplus pad 2 because i deleted abl by accident. Luckily sm8250 has xiaomi auth bypass.

Would be eager to know your .config and .dts ! I can contribute my ath12k patch to enable wifi :)

I am glad to see that someone would like to help. Actually, wifi works, this picture was shot weeks ago. At that time, boradfile from android didn't work, but I found a sm8550 board file later. (sm8550 was shipped with wcn7580 as well)

Recently, partial patches are lingering. So I don't submit the DT. Do you mind leaving a email? Then I can cc you when I send initial device support to LKML at next time.

[kcxt]

hey all, thanks for reporting this and for all the comments. The version of qbootctl in postmarketos is currently quite old, it saw an entire rewrite since then. If someone who is comfortable unbricking can give slot switching on the latest tag a try i would be really grateful, please uncomment the #define DEBUG in the common header so we have some useful logs when things go wrong.

You can also use lsblk -O to dump the partition table including vendor attribute bits that qbootctl touches, i would recommend running this before abs after qbootctl (and before rebooting )

[stableversion]

@/right-0903 no need, i never contributed to mainline, won't be much of help there 😅 just publish your sources on github when your ready or elsewhere :D Maybe I'll gather the courage for mainline eventually

I noticed that all of us(including me) have modified the "userdata" partition to give space to linux, this is worth investigating

I will try gathering additional information as per @/kcxt comment once i have an edl cable (ripped open my phone for test points too many times already) I already was on latest head as built from source

[stableversion]

@kcxt Here's what i've gathered

qbootctl -s a Output
qbootctl-error.txt

lsblk -O Output:

before.txt
after.txt
after-reboot.txt

edl printgpt

printgpt.txt

Note: Sometimes, it doesn't brick when i reboot, like this time, it simply booted slot_b again, but when i tried setting fastboot set_active a that's when it bricked and i had to use EDL. So the edl printgpt command represents my broken slot_a state

[right-0903]

@/right-0903 no need, i never contributed to mainline, won't be much of help there 😅 just publish your sources on github when your ready or elsewhere :D Maybe I'll gather the courage for mainline eventually

Since clk fix is just applied, ensure you are on the top of linux-next. For the DT and mini guide, check here

To enable simple framebuffer, include the following to the end of DT

/ {
	chosen {
		#address-cells = <2>;
		#size-cells = <2>;
		ranges;

		framebuffer: framebuffer@d5100000 {
			compatible = "simple-framebuffer";
			reg = <0 0xd5100000 0 0x2b00000>;
			width = <3000>;
			height = <2120>;
			stride = <(3000 * 4)>;
			format = "a8r8g8b8";
		};
	};
};

&dispcc {
	status = "disabled";
};

&mdss {
	status = "disabled";
};

[ChariskRichy]

@stableversion My friend, thank you very much for your ideas and solutions. My phone finally woke up after being "sleeping" for two weeks.