Xiaomi Mi 6 (xiaomi-sagit)

Contributors

 * Hacker420
 * MayeulC
 * Illen
 * Degdag (mainlining)

How to enter flash mode

 * Power + Volume Down buttons or use TWRP reboot bootloader, or adb reboot bootloader

Installation
Use pmbootstrap flasher.

Virtual terminal
Virtual terminal is broken in downstream, causing early reboot without logs in pstore. This patch is needed to make virtual terminal working properly.

Input
Touchscreen works well on gnome. All the buttons except for home button (which is is integrated with fingerprint scanner) are working.

Display
Seems to work well. Currently only xfce4 and mate and gnome have been tested.

USB OTG
Tested USB Hub with ethernet adapter, USB Audio device, and HID peripherals. Everything works well. NB: only on downstream, on mainline you need to use edk2 UEFI as a bootloader if you want OTG support

Mainline kernel
Here's a list of stuff that is currently (Linux 5.15.0-rc5) known to be working (in at least some capacity):


 * The kernel itself stays booted (i.e. no random panics) and is "stable"
 * UFS internal storage
 * Display (via Panel via JDI FHD R63452 (not on upstream yet))
 * Touchscreen using mainline RMI4
 * Xorg & Wayland (tested with MATE & Weston respectively)
 * Bluetooth
 * Power button
 * Volume up
 * Volume down
 * USB Networking
 * GPU
 * GPS
 * Haptics
 * WiFi
 * NFC

Check the links below for source code.

Building
It's easiest to build mainline (for pmOS anyway) with pmbootstrap, so get that setup and remember the install location (in this guide  is an example).

After you've run through the installation steps found on this site at least once please  & save the produced downstream   to a known location as we'll reuse the initramfs found inside later.

Next start following the instructions below:

git clone https://github.com/degdag/W.I.P_sagit_mainline.git cd W.I.P_sagit_mainline/ source ~/pmOS/pmbootstrap/helpers/envkernel.sh    # adjust to match where you've cloned PMB yourself make sagit_defconfig make -j`nproc`

Boot image generation
Now that the kernel image and DTBs have been built we can assemble a bootable Android-friendly boot.img (assuming you're still in the root of the cloned kernel dir):

pmbootstrap chroot -- apk add abootimg android-tools mkbootimg dtbtool export DEVICE=`pmbootstrap config device | cut -d'-' -f2` WORK=`pmbootstrap config work` PMOS_BOOT_IMG_PATH="~/pmOS/downstream-boot.img" export TEMP="$WORK/chroot_native/tmp/mainline/" DTB="$PWD/.output/arch/arm64/boot/dts/qcom/msm8998-$DEVICE.dtb" rm -r "$TEMP"; mkdir -p "$TEMP" cat .output/arch/arm64/boot/Image.gz "$DTB" > "$TEMP/Image.gz-dtb" cp "$PMOS_BOOT_IMG_PATH" "$TEMP/boot.img"         # replace "$PMOS_BOOT_IMG_PATH" with the known location of a pmOS downstream boot.img pmbootstrap chroot -- abootimg -u /tmp/mainline/boot.img -k /tmp/mainline/Image.gz-dtb -c "bootsize=67108864"

At this point you get to choose whether to  the new kernel image or more "permanently"   it on the device's boot partition instead ^^

Boot:

Flash:

Bootloader
An EDK-II port exists.

UART
The UART test point is 0.5 mm and is located on different sides of the motherboard. The default baudrate is 115200



Xiaomi Mi 6 bootloader logs Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta,  S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.2.2.c1-00001-M8998LZB-1 S - IMAGE_VARIANT_STRING=Msm8998LA S - OEM_IMAGE_VERSION_STRING=modem-ci S - Boot Interface: UFS S - Secure Boot: On S - Boot Config @ 0x00786070 = 0x000002c1 S - JTAG ID @ 0x00786130 = 0x2005e0e1 S - OEM ID @ 0x00786138 = 0x00000000 S - Serial Number @ 0x00784138 = 0x5eaeca6e S - Feature Config Row 0 @ 0x007841a0 = 0x0050200000000000 S - Feature Config Row 1 @ 0x007841a8 = 0x00000000000000a0 S - Core 0 Frequency, 1305 MHz S - PBL Patch Ver: 2 B -        0 - PBL, Start B -     9445 - bootable_media_detect_entry, Start B -    54528 - bootable_media_detect_success, Start B -    54535 - elf_loader_entry, Start B -    55833 - auth_hash_seg_entry, Start B -    77529 - auth_hash_seg_exit, Start B -   127352 - elf_segs_hash_verify_entry, Start B -   157908 - elf_segs_hash_verify_exit, Start B -   157923 - auth_xbl_sec_hash_seg_entry, Start B -   181755 - auth_xbl_sec_hash_seg_exit, Start B -   181757 - xbl_sec_segs_hash_verify_entry, Start B -   187155 - xbl_sec_segs_hash_verify_exit, Start B -   187221 - PBL, End B -   220149 - SBL1, Start B -   331901 - boot_flash_init, Start D -        0 - boot_flash_init, Delta B -   334432 - sbl1_ddr_set_default_params, Start D -      122 - sbl1_ddr_set_default_params, Delta B -   342423 - boot_config_data_table_init, Start B -   587796 - CDT not programmed, using default D -   240889 - boot_config_data_table_init, Delta - (54 Bytes) B -   591120 - CDT Version:3,Platform ID:30,Major ID:1,Minor ID:0,Subtype:0 B -   596946 - Image Load, Start D -    17995 - Auth Metadata D -      549 - Segments hash check D -    27633 - PMIC Image Loaded, Delta - (45608 Bytes) B -   627903 - pm_device_init, Start B -   635345 - PM: PON REASON: PM0=0x400008000000020:0x0 PM1=0x400008000000020:0x0 PM2=0x400008000000020:0x0 B -   694393 - PM: SET_VAL:Skip D -    62921 - pm_device_init, Delta B -   696315 - pm_driver_init, Start D -     5429 - pm_driver_init, Delta B -   705068 - pm_sbl_chg_init, Start B -   709491 - PM: Trigger FG IMA Reset B -   710924 - PM: Trigger FG IMA Reset.Completed B -   715011 - PM: EntryVbat: 3678; EntrySOC: -1 B -   718946 - PM: BATT TEMP: 31 DegC D -    16195 - pm_sbl_chg_init, Delta B -   726754 - vsense_init, Start D -        0 - vsense_init, Delta B -   783758 - Pre_DDR_clock_init, Start D -      213 - Pre_DDR_clock_init, Delta D -        0 - sbl1_ddr_set_params, Delta B -   795013 - DSF version = 108.2, DSF RPM version = 58.1 B -   795043 - Max Frequency = 1804 MHz B -   799527 - do_ddr_training, Start B -   815814 - Bootup frequency set to 1296000 D -    12962 - do_ddr_training, Delta B -   841068 - clock_init, Start D -      274 - clock_init, Delta B -   843721 - ADC done - mv: 376396, percent: 13155 B -   846039 - Platform type KEEP in C1 B -    851499 - ADC done - mv: 1128730, percent: 39451 B -   854549 - Platform version: MP B -    859856 - Image Load, Start D -     2836 - APDP Image Loaded, Delta - (0 Bytes) B -   867176 - PM: 0: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B -   870500 - PM: 1: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B -   877241 - PM: 2: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B -   883859 - PM: SMEM Chgr Info Write Success B -   890905 - sbl1_efs_handle_cookies, Start D -        0 - sbl1_efs_handle_cookies, Delta B -   898987 - Image Load, Start D -    20526 - Auth Metadata D -     1098 - Segments hash check D -    27328 - QSEE Dev Config Image Loaded, Delta - (49140 Bytes) B -   929335 - Image Load, Start D -      305 - SEC Image Loaded, Delta - (4096 Bytes) B -   938180 - Image Load, Start D -    59414 - Auth Metadata D -    16805 - Segments hash check D -    92079 - QSEE Image Loaded, Delta - (1864504 Bytes) B -  1032120 - Image Load, Start D -    20527 - Auth Metadata D -     3447 - Segments hash check D -    34404 - QHEE Image Loaded, Delta - (248560 Bytes) B -  1068537 - Image Load, Start D -    20588 - Auth Metadata D -     2348 - Segments hash check D -    33580 - RPM Image Loaded, Delta - (228180 Bytes) B -  1105015 - Image Load, Start D -     4209 - STI Image Loaded, Delta - (0 Bytes) B -  1112823 - Image Load, Start D -    20466 - Auth Metadata D -     1250 - Segments hash check D -    27419 - ABL Image Loaded, Delta - (105112 Bytes) B -  1143445 - Image Load, Start D -    21076 - Auth Metadata D -    13572 - Segments hash check D -    47092 - APPSBL Image Loaded, Delta - (1792000 Bytes) B -  1192824 - SBL1, End D -   977677 - SBL1, Delta S - Flash Throughput, 149000 KB/s (4342466 Bytes,  28967 us) S - DDR Frequency, 1296 MHz

UEFI Start    [ 1351] SEC PROD Mode  : On DEBUG Mode  : On ASLR        : On Timer Delta : +8 mS RAM Entry 0 : Base 0x0000000040000000  Size 0x00000000C0000000 RAM Entry 1 : Base 0x0000000100000000 Size 0x00000000BD8C0000 UEFI Ver   : 4.2.170609.BOOT.XF.1.2.2.c1-00001-M8998LZB-1 Build Info : 64b Jun  9 2017 03:18:01 Boot Device : UFS InitSSUSBPhy: Init SSUSBPhy Enable Error InitSSUSBPhy: Init SSUSBPhy - HWIO_PERIPH_SS_USB3PHY_PCIE_USB3_PHY_PCS_STATUS = 0x69696969 Setvariable Splash Image returned Success Setvariable Logo Image returned Success get_Panel_Id: lcd id = 0 Render Splash [ 2899] EnvDxe Render Callback LoadImageFromPartitionUsingGuid Failed: 2 LoadImageFromPartitionUsingGuid Failed: 2 LoadImageFromPartitionUsingGuid Failed: 2 Keymaster failed to load! Status = 0x2 LoadSecureApps: Load app from partition(keymaster): Status = 0x0, AppId = 65537 TsFastboot: TsFastBootEntryPoint, VERSION 2 - Platform Init [ 3051] BDS UEFI Ver  : 4.2.170609.BOOT.XF.1.2.2.c1-00001-M8998LZB-1 Platform  : C1 Chip Name  : MSM8998 Chip Ver  : 2.1 Core 0 Freq: 1555 MHz - Battery prfile BATTERY.PROVISION1, platform type 30 UEFI Total : 3539 ms POST Time     [ 4890] OS Loader Loader Build Info: May 16 2017 22:51:03 Type-C Status: dfp_curr_adv = 3 Type-C Status: ufp_conn_type = 11 TsFastBoot: Error locating the TsFastboot protocol TsFastboot: Failed to determing goto fastboot through Touch: 0000000E Booting Into Mission Mode Loading Image Start : 4908 ms Loading Image Done : 4908 ms Total Image Read size : 4096 Bytes Loading Image Start : 4908 ms Loading Image Done : 4933 ms Total Image Read size : 6520832 Bytes No Ffbm cookie found, ignore: Not Found VB: DeviceInit: Device is unlocked! Skipping verification! VB: VerifyImage: Image verification done! boot state is: ORANGE Load image :3 Width = 1080 Height = 1920 DisplayFastbootLogo: Fastboot Logo Successfully Loaded Width = 1080 Height = 1920 Render Splash [ 4980] Memory Base Address: 0x40000000 Decompressing kernel image start: 4983 ms Decompressing kernel image done: 4989 ms PON Reason is 32 cold_boot:1 charger path: 1 Device will boot into off mode charging mode Cmdline: androidboot.veritymode=enforcing androidboot.verifiedbootstate=orange Device tree exact match the board: <0x124 0x1E 0x20001 0x0> == <0x124 0x1E 0x20001 0x0> Device tree exact match the board: <0x124 0x1E 0x20000 0x0> == <0x124 0x1E 0x20001 0x0> Device tree exact match the board: <0x124 0x1E 0x20000 0x0> == <0x124 0x1E 0x20001 0x0> Best match DTB tags 292/0000001E/0x00000000/20001/20014/20115/20018/0/(offset)0x7F2DDA11/(size)0x00068AC8 Using pmic info 0x20014/0x20115/0x20018/0x0 for device 0x20014/0x20115/0x20018/0x0 Memory Base Address: 0x40000000 RAM Partitions Adding Base: 0x0000000040000000 Available Length: 0x00000000C0000000 Adding Base: 0x0000000100000000 Available Length: 0x00000000BD8C0000 kaslr-Seed is added to chosen node pureason = 80020 PartialGoodType:0, SubBin: 0, MemLat:0 Sending Milestone Call

Shutting Down UEFI Boot Services: 5035 ms BDS: LogFs sync skipped, Unsupported App Log Flush : 34 ms Exit BS       [ 5072] UEFI End