OnePlus 6 (oneplus-enchilada)/Hacking

= Hacking on the OnePlus 6 =

The OnePlus 6 is a pretty good device for lowlevel hacking, if you're already comfortable with lowlevel Qualcomm here's a quick rundown:


 * bkerler's fantastic EDL tool contains the firehose binary for the device, you can use this to flash individual partitions or completely switch up the partition table, as long as you stay within the constraints of the bootloader.


 * The ABL has been modified a fair bit by OnePlus, here's a full bootloader log:

OnePlus 6 bootloader logs Format: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta,  S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.XF.2.0-00364-SDM845LZB-1 S - IMAGE_VARIANT_STRING=SDM845LA S - OEM_IMAGE_VERSION_STRING=rd-build-73 S - Note XBL compiled at Jul 13 2021 21:56:54 S - Boot Interface: UFS S - Secure Boot: On S - Boot Config @ 0x00786070 = 0x000000c1 S - JTAG ID @ 0x00786130 = 0x2008b0e1 S - OEM ID @ 0x00786138 = 0x0051459b S - Serial Number @ 0x00784138 = 0x05662f97 S - Feature Config Row 0 @ 0x007841a0 = 0x0050200080000400 S - Feature Config Row 1 @ 0x007841a8 = 0xe000000000000040 S - Core 0 Frequency, 1516 MHz S - PBL Patch Ver: 1 S - PBL freq: 600 MHZ B -       94 - PBL, Start B -     5275 - bootable_media_detect_entry B -    44238 - bootable_media_detect_success B -    44613 - elf_loader_entry B -    45190 - auth_hash_seg_entry B -    52721 - auth_hash_seg_exit B -    58726 - elf_segs_hash_verify_entry B -    65502 - elf_segs_hash_verify_exit B -    66131 - auth_xbl_sec_hash_seg_entry B -    73338 - auth_xbl_sec_hash_seg_exit B -    73340 - xbl_sec_segs_hash_verify_entry B -    74093 - xbl_sec_segs_hash_verify_exit B -    74116 - PBL, End B -    88968 - SBL1, Start B -   205478 - boot_flash_init, Start D -        0 - boot_flash_init, Delta B -   209443 - xblconfig_init, Start D -     3782 - Auth Metadata D -   207552 - xblconfig_init, Delta B -   421967 - sbl1_ddr_set_default_params, Start D -     1494 - sbl1_ddr_set_default_params, Delta B -   429958 - boot_config_data_table_init, Start B -   434655 - CDT not programmed, using default D -     4575 - boot_config_data_table_init, Delta - (54 Bytes) B -   449143 - CDT Version:3,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0 B -   454846 - pm_device_init, Start B -   460092 - PM: PON REASON: PM0=0x800028000000080:0x40 PM1=0x400008000000020:0x0 PM2=0x400 B -   520177 - PM: SET_VAL:Skip D -    64873 - pm_device_init, Delta B -   523166 - pm_driver_init, Start D -     5337 - pm_driver_init, Delta B -   532072 - PM: Trigger FG IMA Reset B -   535641 - PM: Trigger FG IMA Reset.Completed B -   543052 - PM: [OnePlus]Print Oneplus ADC Config B -   544242 - PM: Name=GPIO_08 adc= 445 adc->id=2 B -   549061 - PM: Name=GPIO_09 adc= 444 adc->id=2 B -   553697 - PM: Name=GPIO_10 adc= 731 adc->id=3 B -   558333 - PM: Name=GPIO_11 adc= 445 adc->id=2 B -   562969 - PM: Name=GPIO_12 adc= 6 adc->id=1 B -   567025 - PM: hw_version = 22 name=PVT B -   571478 - PM: rf_version = 32 name=UNKNOWN B -   575535 - PM: init_a_board_version = 1 name=TMO B -   579896 - PM: enter console_loop time=579896

B -  1184772 - PM: exit console_loop time=1184772

B -  1185779 - PM: set_fast_charge_current=500 B -  1189439 - PM: set_pre_charge_current=250 B -  1193739 - PM: set_float_volt_mv=4365 B -  1197948 - PM: set_usbin_icl=2100 B -  1202737 - PM: EntryVbat: 4231; EntrySOC: -1 B -  1205299 - PM: ADSP result: 8 B -  1209752 - PM: APSD in progress B -  1213107 - PM: pm_sbl_chg_post_init B -  1216248 - PM: hw_version = 22 name=PVT B -  1219939 - PM: get_hw_version: 22 set RF_CLK2 4X B -  1223995 - vsense_init, Start D -        0 - vsense_init, Delta B -  1250927 - sbl1_ddr_set_params, Start B -  1252757 - Pre_DDR_clock_init, Start D -       91 - Pre_DDR_clock_init, Delta D -     7686 - sbl1_ddr_set_params, Delta B -  1262364 - sbl1_ddr_init, Start D -    16134 - sbl1_ddr_init, Delta B -  1282372 - DSF version = 253.10, DSF SHRM version = 173.3 B -  1285697 - Manufacturer ID = 1, Device Type = 7 B -  1291309 - Rank 0 size = 4096 MB, Rank 1 size = 4096 MB B -   1296341 - do_ddr_training, Start B -  1302929 - Frequency = 1355 MHz D -     3507 - do_ddr_training, Delta B -  1311561 - pImem Init Start D -     9729 - pImem Init End, Delta B -  1323212 - clock_init, Start D -      213 - clock_init, Delta B -  1328244 - Image Load, Start D -     6832 - Auth Metadata D -      244 - Segments hash check D -    13085 - APDP Image Loaded, Delta - (7828 Bytes) B -  1344684 - usb: UFS Serial - 5725c671 B -  1349594 - usb: fedl, vbus_low B -  1353956 - PM: 0: PON=0x80:KPDPWR_N: ON=0x80:PON_SEQ: POFF=0x2:PS_HOLD: OFF=0x8:RAW_DVDD_O B -  1362343 - PM: 1: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B -  1372561 - PM: 2: PON=0x20:PON1: ON=0x80:PON_SEQ: OFF=0x4:RAW_XVDD_SHD B -  1379271 - PM: SMEM Chgr Info Write Success B -  1385096 - Image Load, Start D -     3507 - Auth Metadata D -    10187 - Segments hash check D -    20954 - AOP Image Loaded, Delta - (178864 Bytes) B -  1409283 - Image Load, Start D -     3477 - Auth Metadata D -      274 - Segments hash check D -    12139 - QSEE Dev Config Image Loaded, Delta - (34144 Bytes) B -  1430267 - Image Load, Start D -    10065 - Auth Metadata D -    11803 - Segments hash check D -    41907 - QSEE Image Loaded, Delta - (2038800 Bytes) B -  1475437 - Image Load, Start D -      152 - SEC Image Loaded, Delta - (4096 Bytes) B -  1483733 - Image Load, Start D -     3538 - Auth Metadata D -     2440 - Segments hash check D -    18666 - QHEE Image Loaded, Delta - (391232 Bytes) B -  1505663 - Image Load, Start D -     5185 - STI Image Loaded, Delta - (0 Bytes) B -  1514081 - Image Load, Start D -     3447 - Auth Metadata D -      976 - Segments hash check D -    11285 - ABL Image Loaded, Delta - (203344 Bytes) B -  1528721 - Image Load, Start D -     3538 - Auth Metadata D -     9180 - Segments hash check D -    30469 - APPSBL Image Loaded, Delta - (2097152 Bytes) B -  1599847 - success: 1; magic: ; addr: 0x5c00000 B -  1599908 - SBL1, End D -  1515637 - SBL1, Delta S - Flash Throughput, 130000 KB/s (5027834 Bytes,  38631 us) S - DDR Frequency, 1353 MHz

UEFI Start    [ 1956] SEC ASLR       : On DEP         : On Timer Delta : +0 mS RAM Entry 0 : Base 0x0000000080000000  Size 0x0000000100000000 RAM Entry 1 : Base 0x0000000180000000 Size 0x00000000FC8A0000 UEFI Ver   : 5.0.210713.BOOT.XF.2.0-00364-SDM845LZB-1 Build Info : 64b Jul 13 2021 21:57:20 Boot Device : UFS PROD Mode  : TRUE Retail     : TRUE [OpBootloaderLog] Start 13 10 [OpBootloaderLog] Start init bootloader log service [OpBootloaderLog] Already init [OpBootloaderLog] BootCount is 10551 [EFI_D_ERROR] bootloader boot count 10551 times [OpBootloaderLog] Replace segment 10 [OpBootloaderLog] find free segment is 10 PM0: 20, PM1: 21, PM2: 24, Elapsed tick: 0x2919968, Wait tick: 0x2DC6C00 Elapsed tick: 0x2A041EE, Wait tick: 0x2DC6C00 Elapsed tick: 0x2AEEBCE, Wait tick: 0x2DC6C00 Elapsed tick: 0x2BD95B7, Wait tick: 0x2DC6C00 Elapsed tick: 0x2CC3F5C, Wait tick: 0x2DC6C00 Elapsed tick: 0x2DAE8F1, Wait tick: 0x2DC6C00 [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs PanelId--read the LCD register 0xDA the ID1 = :0x0000AD PanelId--read the LCD register 0xDB the ID2 = :0x00000A PanelId--read the LCD register 0xDC the ID3 = :0x000005 PanelId:0xAD0A05 DisplayDxe: Resolution 1080x2280 (1 intf) [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs - Platform Init [ 3129] BDS qWrite addr:0x0 data:0x1 write addr:0x0 error L:0x21 H:0x4 FG TYPE= 0x421 fg_type:0x421 HW_ID:22 BatteryNotMatch--- = 0 KeyPressed=1 Status=0 key_boot_mode=0x2 WrongBatteryShutdown enter WrongBatteryShutdown enterBatteryNotMatch=0 Platform  : MTP Chip Name : SDM845 Chip Ver  : 2.1 Core 0 Freq: 1612 MHz - UEFI Total : 2901 ms POST Time     [ 4857] OS Loader Loader Build Info: May 11 2021 22:56:21 [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs [OpBootloaderLog] Start 48 12 [OpBootloaderLog] Start flush log to ufs LoadSecureApps: Load app from partition(keymaster): Status = 0x0, AppId = 1 VB: RWDeviceState:READ_CONFIG status=0 read_rsp.status=0 secure_device=1 VB: RWDeviceState: Succeed using rpmb! Device support param encryption. enc_header->magic = A0AD646A, ENCRYPTED_MAGIC = A0AD646A SID 300 is encrypted check_enc_block_and_fix: Verify SID 300 Success enc_header->magic = A0AD646A, ENCRYPTED_MAGIC = A0AD646A SID 304 is encrypted check_enc_block_and_fix: Verify SID 304 Success migrate_custflag_from_plaintext[00000131] Start cust flag migration check [get_param_by_index_and_offset] sid_index = 304 offset = 164 buf = 9984CFD4 length = 4 Encrypted block 304 is verified success migrate_custflag_from_plaintext[00000139] Cust flag has been migrated, no need to do further!


 * The bootloader supports selecting the "best match" from multiple DTBs (all appended to the kernel), this is also true for the PocoPhone F1 and makes it possible to use a single boot image across both devices. The OnePlus 6T seems to select the enchilada DTB before it's own though.


 * ABL logs will also be printed via UART, however XBL / SBL logs are only printed if you hook up the Rx line (pulling it high to 1.8v should be enough for this).


 * Qualcomm's public ABL sources can offer a lot of insight here, there is a lot of potential for fuzzing by messing with the partition table and various image headers. https://source.codeaurora.org/quic/la/abl/tianocore/edk2/tree/QcomModulePkg?h=LA.UM.9.3.r1-01500-sdm845.0

UART Muxing
GPIOs 37 and 51 respectively on the TLMM are labelled "usb_sw1" and "usb_sw2", these GPIOs control two MUXES as shown. I've attempted to enable sw1 and get UART out of the USB port but haven't had any luck, something else might be missing.

The MCU pins are muxed when a fast charger is detected, the STM8 MCU then talks to the fast charger via the USB DP/DN pins to negotiate charging current.

┌──────────────────┐                        ┌──────────────┐           │                  │      Second MUX         │              │     Debug UART │               0 ├─────────────────────────┤            0 ├──────────────────── USB       │                  │                         │              │ PORT───────┤                 │                         │              │ │                 │                         │              │     MCU Pins │               1 ├──────────┐              │            1 ├────────────────────           │        S         │          │              │   s          │ └────────┬─────────┘         │              └───┬──────────┘                    │                    │                  │                    │                    │                  │                    │                    │                  │                    │                    │                  │                    │                    │                  │                    │                    │                  │                    │                    │                  │               ┌────┴────┐              USB              usb_sw2 │        │               │   NOT   │ usb_sw1───────┤ GATE   │ │        │               └─────────┘

GPIO 37                     GPIO 51 ┌─────────┬───────────────┐ ┌─────────┬──────────┐               │ usb_sw1 │ Select        │  │ usb_sw2 │ Select   │ ├─────────┼───────────────┤ ├─────────┼──────────┤               │ 0       │ USB           │  │ 0       │ UART     │ ├─────────┼───────────────┤ ├─────────┼──────────┤               │ 1       │ MCU / UAURT   │  │ 1       │ MCU      │ └─────────┴───────────────┘ └─────────┴──────────┘ (The diagram was created with ASCIIFLOW, an editable version can be found here).

If you'd like to experiment with the MUXes, you may add the following to the  file under the   node and toggle the MUXes by modifying the   of the LEDs in. / {       usb-muxes { compatible = "gpio-leds"; sw1 { gpios = <&tlmm 37 GPIO_ACTIVE_HIGH>; default-state = "on"; };

sw2 { gpios = <&tlmm 51 GPIO_ACTIVE_HIGH>; };

mcu_en { gpios = <&tlmm 102 GPIO_ACTIVE_HIGH>; };	}; }

Hypervisor / TZ log
The TZ control block is at, the expected way to use it from Linux is to allocate some memory and then make an SCM call (to the hypervisor) to have it use your memory and copy the log there. The hypervisor log is stored physically at address  and can simply be dumped as is. It uses a circular log buffer with a size of

This is a hypervisor log from a OnePlus 6 running mainline: HYP Timestamp Log Init: 1275970

HYP Version Info: QC_IMAGE_VERSION_STRING=TZ.XF.5.0.1.C5-00083.1

HYP Version Info: IMAGE_VARIANT_STRING=WAXAANAAA

OEM Version Info: OEM_IMAGE_VERSION_STRING=CRM

(0)

SMMU Info: VMID 4 not support

SMMU Info: VMID 4 not support

Mapped SMEM as non-cached to EL2

Mapped region <0> as non-cached to EL2

Mapped region <1> as non-cached to EL2

Is TZ APP region mapped to HLOS VM = 1

first psci cpuon time: 3616292

first suspend time: 3855764

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

video_init_and_start Not halted

video_set_state Init-and-start failed

PILSubsys_setState [300012]

pil_set_state_api_ns [300012]

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

SMMU Virt: Invalid S2CRn value=0x00020000 for Dev ID=1

Partition map
OnePlus 6 partition map /dev/sdf5: PARTLABEL="fsc" PARTUUID="34e1a3ac-925b-2cf4-02d1-be72a53688cf" /dev/sdf3: PARTLABEL="modemst2" PARTUUID="c1355970-da61-8305-aea2-df193f53daae" /dev/sdf1: PARTLABEL="ALIGN_TO_128K_2" PARTUUID="08434f59-3681-c80e-491d-2cc43210add2" /dev/sdf4: PARTLABEL="fsg" PARTUUID="8c15dfe7-5d8e-836b-48c5-9835bc9854b3" /dev/sdf2: PARTLABEL="modemst1" PARTUUID="8d1faeb6-8674-a0a8-5bdf-d466936f5c9d" /dev/sdd2: PARTLABEL="cdt" PARTUUID="0f3c41fd-8720-9dd9-4997-55c1ca92cad1" /dev/sdd3: PARTLABEL="ddr" PARTUUID="a9792eda-8825-aee3-ff96-e616d27e269b" /dev/sdd1: PARTLABEL="ALIGN_TO_128K_1" PARTUUID="962121e3-559d-0641-0f18-81628f3e9448" /dev/sdb2: PARTLABEL="xbl_config_a" PARTUUID="5c3db287-e5ea-6e14-8745-939a24b375a7" /dev/sdb1: PARTLABEL="xbl_a" PARTUUID="c4dd26e5-25d5-f7be-ff2c-eeb242dfa1c2" /dev/sde32: SEC_TYPE="msdos" UUID="00BC-614E" BLOCK_SIZE="4096" TYPE="vfat" PARTLABEL="modem_b" PARTUUID="cfe2f18a-5dbb-ba1e-f080-4b6df5ab5ee2" /dev/sde60: PARTLABEL="sec" PARTUUID="3a98dd15-6ef1-bd3e-65b6-ac86d8bb395e" /dev/sde2: PARTLABEL="tz_a" PARTUUID="6fb4f572-6a80-2df6-129a-a5299a8f3a54" /dev/sde22: PARTLABEL="fw_4u1ea_a" PARTUUID="fb8c320c-fd90-6770-76f6-741c5ab5f944" /dev/sde50: PARTLABEL="fw_4u1ea_b" PARTUUID="522b829c-13c8-bbd0-996a-15bb7fa28b9b" /dev/sde12: PARTLABEL="cmnlib_a" PARTUUID="3faa441a-2136-053f-e802-eb84308d137f" /dev/sde40: PARTLABEL="cmnlib_b" PARTUUID="b4ee26f8-73a5-2f6e-2d19-f2d66f0f4974" /dev/sde69: SEC_TYPE="msdos" LABEL="LOGFS" UUID="D273-55EA" BLOCK_SIZE="4096" TYPE="vfat" PARTLABEL="logfs" PARTUUID="f5c45b71-d6ac-634c-fccd-6a0ba77c7c86" /dev/sde30: PARTLABEL="tz_b" PARTUUID="61c933af-7cbf-51c2-ce59-5ad7ec0fc259" /dev/sde59: LABEL="op1" UUID="ba588e16-ba7a-4232-a407-16e504d35a5d" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="op1" PARTUUID="a0f1da3f-ef2d-35c4-1f90-9b5b0d7e6a2d" /dev/sde20: PARTLABEL="LOGO_a" PARTUUID="b715e14f-fedb-a6eb-c193-0600ba0b0566" /dev/sde49: PARTLABEL="fw_4j1ed_b" PARTUUID="121e7bb1-261f-14bc-2703-acd54d8a1bd2" /dev/sde10: PARTLABEL="keymaster_a" PARTUUID="20fd2a8c-12f2-63af-abfe-32b29b8cede6" /dev/sde39: PARTLABEL="boot_b" PARTUUID="644a664b-c619-849f-6f7f-efac5109f257" /dev/sde67: PARTLABEL="limits" PARTUUID="edccd900-7e8f-7269-1726-29c854829653" /dev/sde9: LABEL="dsp" UUID="af32c008-2a39-7e5b-a5dc-201456d93103" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="dsp_a" PARTUUID="0e5991db-3f34-7f57-0ed2-3d4f01f3f858" /dev/sde29: PARTLABEL="aop_b" PARTUUID="e377e3bb-363d-2920-4835-6733035baf08" /dev/sde57: PARTLABEL="minidump" PARTUUID="6b7d4d38-02a6-bf9a-4b62-1d1af6c3108c" /dev/sde19: PARTLABEL="storsec_a" PARTUUID="58ec2788-71cd-57d4-6cd7-8f62c634c1c1" /dev/sde47: PARTLABEL="storsec_b" PARTUUID="0e097b14-fa1c-4435-bbdf-778bc9154d4b" /dev/sde37: LABEL="dsp" UUID="af32c008-2a39-7e5b-a5dc-201456d93103" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="dsp_b" PARTUUID="3d77a405-02d6-3d8e-bbda-4aa99cf880a3" /dev/sde65: PARTLABEL="spunvm" PARTUUID="5bbb29d8-6c48-d18b-8a92-5e3345c72329" /dev/sde7: PARTLABEL="mdtp_a" PARTUUID="53913901-a106-47f2-f4e5-dad92a4a09ed" /dev/sde27: PARTLABEL="fw_ufs7_a" PARTUUID="3e59f41e-0156-be33-3b1d-58212a4583d6" /dev/sde55: PARTLABEL="fw_ufs7_b" PARTUUID="9844abf0-6597-f788-b6ac-a8c787c1eca5" /dev/sde17: PARTLABEL="vbmeta_a" PARTUUID="c87bf4be-e4ad-7fbc-3b7a-324c3e5dd68d" /dev/sde45: PARTLABEL="vbmeta_b" PARTUUID="a7287247-ce47-f46a-b07d-d334fb7b1a93" /dev/sde35: PARTLABEL="mdtp_b" PARTUUID="1493abb1-a49c-82f9-f983-8cb1c8afe32a" /dev/sde63: PARTLABEL="apdp" PARTUUID="ee8804c6-c7df-0018-8b2a-20f9f47bb76d" /dev/sde5: SEC_TYPE="msdos" UUID="00BC-614E" BLOCK_SIZE="4096" TYPE="vfat" PARTLABEL="bluetooth_a" PARTUUID="b9a2bb0d-d68a-ebda-24a7-8641ca348af9" /dev/sde25: PARTLABEL="fw_ufs5_a" PARTUUID="d5434ba8-cd19-fb7d-8c2c-0981a8ec102a" /dev/sde53: PARTLABEL="fw_ufs5_b" PARTUUID="df6c31a0-1235-86ef-163d-877c1efc7fee" /dev/sde15: PARTLABEL="qupfw_a" PARTUUID="a71b9aa4-c886-d7d5-0159-26ec87d11e9c" /dev/sde43: PARTLABEL="qupfw_b" PARTUUID="2f1509f4-a0df-b844-64f9-ba39162c3cb7" /dev/sde71: PARTLABEL="logdump" PARTUUID="e4b3e36c-871e-c290-7c83-e2a5135d3975" /dev/sde33: SEC_TYPE="msdos" UUID="00BC-614E" BLOCK_SIZE="4096" TYPE="vfat" PARTLABEL="bluetooth_b" PARTUUID="8b52879d-2bf3-acdf-46f8-3fd9a9f4263b" /dev/sde61: PARTLABEL="devinfo" PARTUUID="79779756-7b19-1b17-8472-44d5e118d13a" /dev/sde3: PARTLABEL="hyp_a" PARTUUID="3da91e88-6f04-342c-cc72-1f35cfad3652" /dev/sde23: PARTLABEL="fw_ufs3_a" PARTUUID="53053d60-7897-4fb5-0aee-fdd6817459e0" /dev/sde51: PARTLABEL="fw_ufs3_b" PARTUUID="6e8ecb1c-3ac9-db5d-db78-f66159577211" /dev/sde13: PARTLABEL="cmnlib64_a" PARTUUID="1dab09e4-669a-93b0-fdfe-f594220f887d" /dev/sde41: PARTLABEL="cmnlib64_b" PARTUUID="da1d51ae-903b-2d9c-2dd4-7a8eb35de75e" /dev/sde31: PARTLABEL="hyp_b" PARTUUID="55f774bb-a3af-4d90-95b0-5a0b74fb1744" /dev/sde1: PARTLABEL="aop_a" PARTUUID="2999c52b-e6a0-20d6-baa5-385c19ed4b1a" /dev/sde21: PARTLABEL="fw_4j1ed_a" PARTUUID="92012b8f-65b1-2ff5-95da-b41b471a40db" /dev/sde11: PARTLABEL="boot_a" PARTUUID="b5ce1aae-e996-fbb7-9073-7d5cef4b0505" /dev/sde68: PARTLABEL="toolsfv" PARTUUID="620eb6ce-939b-ab50-dded-77ff675daf6d" /dev/sde58: PARTLABEL="boot_aging" PARTUUID="15139207-cc76-16bd-d322-12379287b83b" /dev/sde48: PARTLABEL="LOGO_b" PARTUUID="80195fcf-5f27-a855-e511-9e5f747b0194" /dev/sde38: PARTLABEL="keymaster_b" PARTUUID="52bfabd3-0b7c-4c4f-1b03-4bc280e21cfb" /dev/sde66: PARTLABEL="splash" PARTUUID="7a258a49-8af9-0802-ecd7-16a93b1c5951" /dev/sde8: PARTLABEL="abl_a" PARTUUID="822a0bb5-4e7f-c6ea-6bbe-b814feefa4b8" /dev/sde28: PARTLABEL="fw_ufs8_a" PARTUUID="c0bdb6fe-4f8c-1a03-8dc7-b6f4d696b350" /dev/sde56: PARTLABEL="fw_ufs8_b" PARTUUID="1a9a7ee2-ad4d-ed57-c466-8b85d7c71bef" /dev/sde18: PARTLABEL="dtbo_a" PARTUUID="07141197-640f-4249-d67c-ec1f03b16e75" /dev/sde46: PARTLABEL="dtbo_b" PARTUUID="d0358985-4108-fe3c-4a16-1dc2a7e38182" /dev/sde36: PARTLABEL="abl_b" PARTUUID="9edeb19a-c563-7128-d722-c06c0c449fe6" /dev/sde64: PARTLABEL="msadp" PARTUUID="0353bd46-a204-2391-e366-1be598cf45cb" /dev/sde6: PARTLABEL="mdtpsecapp_a" PARTUUID="0c0bca32-04fc-cd18-e563-248cd6fd1fbe" /dev/sde26: PARTLABEL="fw_ufs6_a" PARTUUID="b8bfc324-6883-9eca-83a1-5516633b953c" /dev/sde54: PARTLABEL="fw_ufs6_b" PARTUUID="c8e3c520-9f8c-d8b2-cce3-e808c12916ec" /dev/sde16: LABEL="vendor" UUID="2b96c597-1e2f-5ee1-9851-c4a9fa9de36e" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="vendor_a" PARTUUID="52254fdc-a6a8-f6d4-3d74-d73cacbb70d2" /dev/sde44: LABEL="vendor" UUID="0c70056c-5d72-53f7-93e4-c56a1b61e40a" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="vendor_b" PARTUUID="ece4b4bb-ef86-6797-1640-ee5b45a5ca26" /dev/sde72: PARTLABEL="ImageFv" PARTUUID="c2430e90-9c40-9959-ac0a-3e2e772fbaca" /dev/sde34: PARTLABEL="mdtpsecapp_b" PARTUUID="2252fb5f-379f-0c47-0122-fe57c32ab77b" /dev/sde62: PARTLABEL="dip" PARTUUID="c2ca73f9-68d5-690d-86e5-1104baf3ddaf" /dev/sde4: SEC_TYPE="msdos" UUID="00BC-614E" BLOCK_SIZE="4096" TYPE="vfat" PARTLABEL="modem_a" PARTUUID="63a5685c-26ee-dc68-46f4-be7bcfb25696" /dev/sde24: PARTLABEL="fw_ufs4_a" PARTUUID="d45faeac-c670-b9ac-bc0d-fb30a92603a2" /dev/sde52: PARTLABEL="fw_ufs4_b" PARTUUID="317c3348-792c-892b-59d1-80e6e4d88fc2" /dev/sde14: PARTLABEL="devcfg_a" PARTUUID="e1df972a-1c71-6820-8e6f-eee63595a921" /dev/sde42: PARTLABEL="devcfg_b" PARTUUID="eb24d5ff-bb79-aaad-3134-3ab7e8c0f43f" /dev/sde70: PARTLABEL="sti" PARTUUID="c28d9fb3-ebd7-cdbb-9c58-608d20b834db" /dev/sdc2: PARTLABEL="xbl_config_b" PARTUUID="5617b6e7-3c57-d49b-fead-d1f34008c9b3" /dev/sdc1: PARTLABEL="xbl_b" PARTUUID="fa3cdd6b-2541-350f-c910-d5748b2a3cdf" /dev/sda4: PARTLABEL="param" PARTUUID="a5961f11-df32-9d1f-3bea-307d74e02ecc" /dev/sda16: LABEL="odm" UUID="57aa4559-d6fd-4e97-9ade-119922fc1d44" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="odm_b" PARTUUID="f1ae4175-0e9f-0436-dbd1-f85746806b0b" /dev/sda2: UUID="8668a952-516c-427a-951b-b8e376987253" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="persist" PARTUUID="2100a4f5-d401-e224-9bb8-27c47cc005da" /dev/sda14: LABEL="/" UUID="74ab2787-89b4-5f32-9f21-2c085107ac1e" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="system_b" PARTUUID="38544015-f696-30e6-807c-c29c6d5b13cc" /dev/sda12: PARTLABEL="config" PARTUUID="38bcee05-6fdc-ece1-37ae-3d894d48a1ee" /dev/sda9: PARTLABEL="oem_stanvbk" PARTUUID="a8e1cd00-91d0-0f6d-9c1a-b355e8285dd6" /dev/sda10: PARTLABEL="reserve1" PARTUUID="bb68299a-beba-7c17-3d2e-d1d2c6c05e5f" /dev/sda7: LABEL="op2" UUID="f70c2713-9ead-46cb-be37-4b6fde0d81c9" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="op2" PARTUUID="26889376-e539-8f76-e803-0aa514fa86b4" /dev/sda5: PARTLABEL="keystore" PARTUUID="cb2783ff-2610-55a4-c872-94415839d26a" /dev/sda17: PTUUID="2dadf6dc" PTTYPE="dos" PARTLABEL="userdata" PARTUUID="b16d3600-b0e3-3344-98ac-8d5ca27937d2" /dev/sda3: PARTLABEL="misc" PARTUUID="044add9f-3170-486d-e2bd-82862cc04e41" /dev/sda15: LABEL="odm" UUID="57aa4559-d6fd-4e97-9ade-119922fc1d44" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="odm_a" PARTUUID="1dbb3335-40e5-75a8-c41f-e4c8cb4eda53" /dev/sda1: PARTLABEL="ssd" PARTUUID="ee98d4e2-abc9-402c-5401-2a99010bb373" /dev/sda13: LABEL="/" UUID="74ab2787-89b4-5f32-9f21-2c085107ac1e" BLOCK_SIZE="4096" TYPE="ext4" PARTLABEL="system_a" PARTUUID="52668ad3-45bb-5adc-e742-244972beee8c" /dev/sda11: PARTLABEL="reserve2" PARTUUID="5bb92f09-071e-051c-5adb-b6fc8c322572" /dev/sda8: PARTLABEL="oem_dycnvbk" PARTUUID="eb61cc11-4964-ebb9-29ff-dbe968e16c28" /dev/sda6: PARTLABEL="frp" PARTUUID="ec6399ce-26ce-5ae6-59c4-4f2c688b7548"