[F1 geek stuff] UFS information, details about LUNs and partition scheme

[scholbert]

Hi,
i started to gather some informations about the internals of the F1 and how the interal storage is arranged on these devices.
The Poco F1 uses a UFS component on the mainboard with 64GB/128GB/256GB capacity.
E.g. for the 128GB variants i found specific part numbers:
SKhynix H28S8Q302CMR
Samsung KLUDG4U1EA-B0C1

Unfortunately there a no detailed datasheet available for these components, as they seem to be confidential.
The sector sizes are 4096Bytes on these parts. The over all capacity varies depending on model.

Anyway, UFS technology allows to create several LUNs inside the chip and thats how it all shows up in underlying linux/android system (see the attached whitepaper for details as well).

After i had a look in the stock firmware package, i could easily put things together and get information about all partitions in detail.
/dev/block/sda -> LUN 0 - HLOS LUN

			pre: 24k, next: 1M-24k
/dev/block/sda1		partition label="switch" size_in_kb="16" type="6A4AFEF7-0D3F-453A-8A48-6373F67FFFF0" bootable="false" readonly="false" filename="dummy.img" (all zero)
/dev/block/sda2		partition label="ssd" size_in_kb="32" type="2C86E742-745E-4FDD-BFD8-B6A7AC638772" bootable="false" readonly="false" filename=""
/dev/block/sda3		partition label="bk01" size_in_kb="440" type="7B00B63B-DB10-4A44-B544-14D344F55DAC" bootable="false" readonly="false" filename=""
/dev/block/sda4		partition label="bk02" size_in_kb="256" type="53E5B8DE-C6A6-4767-875F-6B72ECBED0B0" bootable="false" readonly="false" filename=""
/dev/block/sda5		partition label="bk03" size_in_kb="256" type="7C7E2B25-D52C-4829-BA6E-76408DF1B3CE" bootable="false" readonly="false" filename=""
			pre: 1M, next: 32-1M
/dev/block/sda6		partition label="keystore" size_in_kb="512" type="DE7D4029-0F5B-41C8-AE7E-F6C023A02B33" bootable="false" readonly="false" filename=""
/dev/block/sda7		partition label="frp" size_in_kb="512" type="91B72D4D-71E0-4CBF-9B8E-236381CFF17A" bootable="false" readonly="false" filename=""
/dev/block/sda8		partition label="bk04" size_in_kb="2048" type="3FB510F6-4E73-49E7-9BDB-F6FEABA6086A" bootable="false" readonly="false" filename=""
/dev/block/sda9		partition label="misc" size_in_kb="4096" type="82ACC91F-357C-4A68-9C8F-689E1B1A23A1" bootable="false" readonly="false" filename="misc.img"
/dev/block/sda10	partition label="logfs" size_in_kb="8192" type="BC0330EB-3410-4951-A617-03898DBE3372" bootable="false" readonly="false" filename="logfs_ufs_8mb.bin"
/dev/block/sda11	partition label="oops" size_in_kb="16384" type="C549751F-0A51-4334-A85E-7D3F4FDB3127" bootable="false" readonly="false" filename=""
			pre: 32M, next: 32M
/dev/block/sda12	partition label="devinfo" size_in_kb="16384" type="65ADDCF4-0C5C-4D9A-AC2D-D90B5CBFCD03" bootable="false" readonly="false" filename=""
/dev/block/sda13	partition label="bk05" size_in_kb="16384" type="4EF51EBC-5BF2-410B-8970-C2CE87227DF6" bootable="false" readonly="false" filename=""
			pre: 64M, next: 2*64M
/dev/block/sda14	partition label="persist" size_in_kb="65536" type="6C95E238-E343-4BA8-B489-8681ED22AD0B" bootable="false" readonly="false" filename="" sparse="true"
/dev/block/sda15	partition label="persistbak" size_in_kb="65536" type="6C95E238-E343-4BA8-B489-8681ED22AD0B" bootable="false" readonly="false" filename="" sparse="true"
			pre: 3*64M, next: 3*64M=192M
/dev/block/sda16	partition label="logdump" size_in_kb="65536" type="5AF80809-AABB-4943-9168-CDFC38742598" readonly="false" bootable="false" filename=""
/dev/block/sda17	partition label="minidump" size_in_kb="131072" type="71D24153-E4E2-4275-815C-08E10959803B" readonly="false" bootable="false" filename=""
			pre: 6*64M, next: 18*64M=832M
/dev/block/sda18	partition label="cust" size_in_kb="851968" type="C3008246-512A-4FEB-8A51-068FA4AD5F6D" bootable="false" readonly="false" filename="cust.img" sparse="true"
/dev/block/sda19	partition label="recovery" size_in_kb="65536" type="9D72D4E4-9958-42DA-AC26-BEA7A90B0434" bootable="false" readonly="false" filename="recovery.img"
/dev/block/sda20	partition label="cache" size_in_kb="262144" type="5594C694-C871-4B5F-90B1-690A6F68E0F7" bootable="false" readonly="false" filename="cache.img" sparse="true"
			pre: 24*64M, next: left
/dev/block/sda21	partition label="userdata" size_in_kb="4194304" type="1B81E7E6-F50D-419B-A739-2AEEF8DA3335" bootable="false" readonly="false" filename="userdata.img" sparse="true"

/dev/block/sdb -> LUN 1 - Boot LUN A

			pre: 24k
/dev/block/sdb1		partition label="xbl_config_a" size_in_kb="512" type="5A325AE4-4276-B66D-0ADD-3494DF27706A" bootable="false" readonly="true" filename="xbl_config.img"
/dev/block/sdb2		partition label="xbl_a" size_in_kb="7168" type="DEA0BA2C-CBDD-4805-B4F9-F428251C3E98" bootable="false" readonly="true" filename="xbl.img"
			partition label="last_parti" size_in_kb="0" type="00000000-0000-0000-0000-000000000000" bootable="false" readonly="true" filename=""

/dev/block/sdc -> LUN 2 - Boot LUN B

			pre: 24k
/dev/block/sdc1		partition label="xbl_config_b" size_in_kb="512" type="5A325AE4-4276-B66D-0ADD-3494DF27706A" bootable="false" readonly="true" filename="xbl_config.img"
/dev/block/sdc2		partition label="xbl_b" size_in_kb="7168" type="DEA0BA2C-CBDD-4805-B4F9-F428251C3E98" bootable="false" readonly="true" filename="xbl.img"
			partition label="last_parti" size_in_kb="0" type="00000000-0000-0000-0000-000000000000" bootable="false" readonly="true" filename=""

/dev/block/sdd -> LUN 3 - OTP LUN

/dev/block/sdd1		partition label="bk31" size_in_kb="32" type="D37A3651-9C07-467D-9898-E83881B4B1EC" bootable="false" readonly="true"
/dev/block/sdd2		partition label="cdt" size_in_kb="128" type="A19F205F-CCD8-4B6D-8F1E-2D9BC24CFFB1" bootable="false" readonly="true" filename=""
/dev/block/sdd3		partition label="bk32" size_in_kb="864" type="97312B22-8EDC-45E2-853A-1FE3D41083E4" bootable="false" readonly="true" filename=""
/dev/block/sdd4		partition label="ddr" size_in_kb="1024" type="20A0C19C-286A-42FA-9CE7-F64C3226A794" bootable="false" readonly="true"
/dev/block/sdd5		partition label="bk33" size_in_kb="1024" type="6CE93C62-BC7F-4D47-97CD-0095F8EED0FC" bootable="false" readonly="true" filename=""
			partition label="last_parti" size_in_kb="0" type="00000000-0000-0000-0000-000000000000" bootable="false" readonly="true" filename=""

/dev/block/sde -> LUN 4 - Protected RO LUN

			pre: 24k, next: 1M-24k
/dev/block/sde1		partition label="sec" size_in_kb="32" type="303E6AC3-AF15-4C54-9E9B-D9A8FBECF401" bootable="false" readonly="true" filename=""
/dev/block/sde2		partition label="limits" size_in_kb="32" type="10A0C19C-516A-5444-5CE3-664C3226A794" bootable="false" readonly="true" filename="dummy.img"
/dev/block/sde3		partition label="bk41" size_in_kb="168" type="2191E897-1B50-410A-9190-1ADD6203484B" bootable="false" readonly="true" filename=""
/dev/block/sde4		partition label="qupfw_a" size_in_kb="128" type="21D1219F-2ED1-4AB4-930A-41A16AE75f7F" bootable="false" readonly="true" filename="qupfw.img"
/dev/block/sde5		partition label="qupfw_b" size_in_kb="128" type="7E2F513D-7D9E-4C69-8607-FF9C796896FF" bootable="false" readonly="true" filename="qupfw.img"
/dev/block/sde6		partition label="apdp" size_in_kb="256" type="E6E98DA2-E22A-4D12-AB33-169E7DEAA507" bootable="false" readonly="true" filename=""
/dev/block/sde7		partition label="msadp" size_in_kb="256" type="ED9E8101-05FA-46B7-82AA-8D58770D200B" bootable="false" readonly="true" filename=""
			pre: 1M, next: 16-1M
/dev/block/sde8		partition label="vbmeta" size_in_kb="128" type="4B7A15D6-322C-42AC-8110-88b7DA0C5D77" bootable="false" readonly="true" filename=""
/dev/block/sde9		partition label="bk42" size_in_kb="128" type="9D30B727-48F6-4BF2-A513-11C4D4850950" bootable="false" readonly="true" filename=""
/dev/block/sde10	partition label="storsec_a" size_in_kb="128" type="02DB45FE-AD1B-4CB6-AECC-0042C637DEFA" bootable="false" readonly="true" filename="storsec.img"
/dev/block/sde11	partition label="storsec_b" size_in_kb="128" type="E59F3F13-8F26-42C4-B75C-70C3CA15F4A7" bootable="false" readonly="true" filename="storsec.img"
/dev/block/sde12	partition label="devcfg_a" size_in_kb="256" type="F65D4B16-343D-4E25-AAFC-BE99B6556A6D" bootable="false" readonly="true" filename="devcfg.img"
/dev/block/sde13	partition label="devcfg_b" size_in_kb="256" type="EFD49359-6F37-4167-AEC5-DA3B23317A2B" bootable="false" readonly="true" filename="devcfg.img"
/dev/block/sde14	partition label="aop_a" size_in_kb="512" type="D69E90A5-4CAB-0071-F6DF-AB977F141A7F" bootable="false" readonly="true" filename="aop.img"
/dev/block/sde15	partition label="aop_b" size_in_kb="512" type="05D825D4-7213-4455-BF7F-7A8186CEB325" bootable="false" readonly="true" filename="aop.img"
/dev/block/sde16	partition label="bk43" size_in_kb="512" type="68852B76-70DF-4C1F-A268-8C339DD79F1E" bootable="false" readonly="true" filename=""
/dev/block/sde17	partition label="bk44" size_in_kb="512" type="ED08AB2A-50FA-4BF3-95A9-5F38802FB8FD" bootable="false" readonly="true" filename=""
/dev/block/sde18	partition label="cmnlib_a" size_in_kb="1024" type="73471795-AB54-43F9-A847-4F72EA5CBEF5" bootable="false" readonly="true" filename="cmnlib.img"
/dev/block/sde19	partition label="cmnlib_b" size_in_kb="1024" type="B8AF4F43-5797-4642-ACA9-AFFA3DC066AF" bootable="false" readonly="true" filename="cmnlib.img"
/dev/block/sde20	partition label="cmnlib64_a" size_in_kb="1024" type="8EA64893-1267-4A1B-947C-7C362ACAAD2C" bootable="false" readonly="true" filename="cmnlib64.img"
/dev/block/sde21	partition label="cmnlib64_b" size_in_kb="1024" type="3864BA83-61FF-4B82-A749-9ED7560D0503" bootable="false" readonly="true" filename="cmnlib64.img"
/dev/block/sde22	partition label="keymaster_a" size_in_kb="1024" type="A11D2A7C-D82A-4C2F-8A01-1805240E6626" bootable="false" readonly="true" filename="keymaster.img"
/dev/block/sde23	partition label="keymaster_b" size_in_kb="1024" type="E8DF5A85-A0BF-4FD0-9B9A-DECB191EECCB" bootable="false" readonly="true" filename="keymaster.img"
/dev/block/sde24	partition label="bluetooth" size_in_kb="1024" type="6CB747F1-C2EF-4092-ADD0-CA39F79C7AF4" bootable="false" readonly="true" filename="bluetooth.img"
/dev/block/sde25	partition label="bk45" size_in_kb="1024" type="1079AD2F-F4BC-488D-A185-32723E482E91" bootable="false" readonly="true" filename=""
/dev/block/sde26	partition label="hyp_a" size_in_kb="1024" type="E1A6A689-0C8D-4CC6-B4E8-55A4320FBD8A" bootable="false" readonly="true" filename="hyp.img"
/dev/block/sde27	partition label="hyp_b" size_in_kb="1024" type="DF718C12-3599-4F84-881F-89271F769A8F" bootable="false" readonly="true" filename="hyp.img"
/dev/block/sde28	partition label="dip" size_in_kb="1024" type="4114B077-005D-4E12-AC8C-B493BDA684FB" bootable="false" readonly="true" filename=""
/dev/block/sde29	partition label="bk46" size_in_kb="1024" type="71B28EC7-DF02-41E8-921F-725ECD024CD4" bootable="false" readonly="true" filename=""
			pre: 16M, next: 16M
/dev/block/sde30	partition label="sti" size_in_kb="2048" type="AA9A5C4C-4F1F-7D3A-014A-22BD33BF7191" bootable="false" readonly="true" filename=""
/dev/block/sde31	partition label="toolsfv" size_in_kb="2048" type="97745ABA-135A-44C3-9ADC-05616173C24C" bootable="false" readonly="true" filename=""
/dev/block/sde32	partition label="abl_a" size_in_kb="2048" type="BD6928A1-4CE0-A038-4F3A-1495E3EDDFFB" bootable="false" readonly="true" filename="abl.img"
/dev/block/sde33	partition label="abl_b" size_in_kb="2048" type="9F68DAA1-EAAE-41F9-8C5F-69E15CC6AEB1" bootable="false" readonly="true" filename="abl.img"
/dev/block/sde34	partition label="tz_a" size_in_kb="4096" type="A053AA7F-40B8-4B1C-BA08-2F68AC71A4F4" bootable="false" readonly="true" filename="tz.img"
/dev/block/sde35	partition label="tz_b" size_in_kb="4096" type="1D5075D8-363A-4125-916B-C8B3E97B995C" bootable="false" readonly="true" filename="tz.img"
			pre: 32M, next: 32M
/dev/block/sde36	partition label="fsg" size_in_kb="8192" type="638FF8E2-22C9-E33B-8F5D-0E81686A68CB" bootable="false" readonly="true" filename=""
/dev/block/sde37	partition label="dtbo" size_in_kb="8192" type="24D0D418-D31D-4D8D-aC2C-4D4305188450" bootable="false" readonly="true" filename=""
/dev/block/sde38	partition label="bk47" size_in_kb="8192" type="D388D29F-1309-4487-8944-A61DF37365BC" bootable="false" readonly="true" filename=""
/dev/block/sde39	partition label="spunvm" size_in_kb="8192" type="E42E2B4C-33D0-429B-b1EF-D341C547022C" bootable="false" readonly="true" filename=""
			pre: 64M, next: 64M
/dev/block/sde40	partition label="bk48" size_in_kb="16384" type="B7EED6B5-020D-428F-A588-EF43148AF032" bootable="false" readonly="true" filename=""
/dev/block/sde41	partition label="bk49" size_in_kb="16384" type="7EF491C1-813C-4C8A-AF57-C968D72460BF" bootable="false" readonly="true" filename=""
/dev/block/sde42	partition label="splash" size_in_kb="32768" type="AD99F201-DC71-4E30-9630-E19EEF553D1B" bootable="false" readonly="true" filename=""
			pre: 2*64M, next: 64M
/dev/block/sde43	partition label="logo" size_in_kb="32768" type="E5947DDB-0FDF-4FF0-A1E2-E408BC3DA4A7" bootable="false" readonly="true" filename="logo.img"
/dev/block/sde44	partition label="dsp" size_in_kb="32768" type="7EFE5010-2A1A-4A1A-B8BC-990257813512" bootable="false" readonly="true" filename="dsp.img"
			pre: 3*64M, next: 64M
/dev/block/sde45	partition label="boot" size_in_kb="65536" type="20117F86-E985-4357-B9EE-374BC1D8487D" bootable="false" readonly="true" filename="boot.img"
			pre: 4*64M, next: 3*64M=192M
/dev/block/sde46	partition label="modem" size_in_kb="196608" type="EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" bootable="false" readonly="true" filename="modem.img"
			pre: 7*64M, next: 1G
/dev/block/sde47	partition label="vendor" size_in_kb="1048576" type="97D7B011-54DA-4835-B3C4-917AD6E73D74" bootable="false" readonly="true" filename="vendor.img" sparse="true"
			pre: 7*64M+1G, next: 3G
/dev/block/sde48	partition label="system" size_in_kb="3145728" type="97D7B011-54DA-4835-B3C4-917AD6E73D74" bootable="false" readonly="true" filename="system.img" sparse="true"
			Total: 7*64M+4G=4544M, left: left 64M
			partition label="last_parti" size_in_kb="0" type="00000000-0000-0000-0000-000000000000" bootable="false" readonly="true" filename=""

/dev/block/sdf -> LUN 5 - Protected RW LUN

/dev/block/sdf1		partition label="fsc" size_in_kb="256" type="57B90A16-22C9-E33B-8F5D-0E81686A68CB" bootable="false" readonly="false" filename=""
/dev/block/sdf2		partition label="bk51" size_in_kb="744" type="694BE4BC-8A47-4D18-870A-EB07C9D07CB2" bootable="false" readonly="false" filename=""
/dev/block/sdf3		partition label="bk52" size_in_kb="1024" type="3B02C43F-8F67-49BE-86FE-D8D030F2CCA6" bootable="false" readonly="false" filename=""
/dev/block/sdf4		partition label="ImageFv" size_in_kb="2048" type="17911177-C9E6-4372-933C-804B678E666F" bootable="false" readonly="false" filename="imagefv.elf"
/dev/block/sdf5		partition label="bk53" size_in_kb="4096" type="DD6DC330-95B2-4244-B45F-A52078EA7F67" bootable="false" readonly="false" filename=""
/dev/block/sdf6		partition label="modemst1" size_in_kb="8192" type="EBBEADAF-22C9-E33B-8F5D-0E81686A68CB" bootable="false" readonly="false" filename=""
/dev/block/sdf7		partition label="modemst2" size_in_kb="8192" type="0A288B1F-22C9-E33B-8F5D-0E81686A68CB" bootable="false" readonly="false" filename=""
			partition label="last_parti" size_in_kb="0" type="00000000-0000-0000-0000-000000000000" bootable="false" readonly="false" filename=""

Furthermore i found out that fastboot is able to handle all these partitions.
Try:
fastboot getvar all

... and you'll see every single partition is shown with type and size.
Though there are no LUNs specified here, fastboot does not need them... the LUNs are only visible in the kernels device structure.

That's it by now.
Just thought it may be useful for others, as i found nothing specific about it

EDIT:
HLOS (High-Level Operating System) = Android OS

abl = android bootloader, signed part of uefi
tz = trustzone
xbl = extensable bootloader
cdt = configuration data table
frp = factory reset partition, signed part of uefi

imagefv = lzma compressed bitmaps (battery), signed part of uefi

P.S.: For a better overview, find the partiton info as a text file attached.

Cheers,
scholbert

 

[scholbert]

Hi,
as there'd been some interest here already and as i started some research, here's an addon...

UEFI bootloader (main) partitions:
/dev/block/sdb1 type="5A325AE4-4276-B66D-0ADD-3494DF27706A" xbl_config.img (elf format, trusted secure configuration for xbl, includes/refers to binary blobs for hardware setup (e.g. PMIC))
/dev/block/sdb2 type="DEA0BA2C-CBDD-4805-B4F9-F428251C3E98" xbl.img (elf-format, trusted secure extensible bootloader, part of UEFI, QC_IMAGE_VERSION: BOOT.XF.2.0-00389-SDM845LZB-1)

/dev/block/sde32 type="BD6928A1-4CE0-A038-4F3A-1495E3EDDFFB" abl.img (elf-format, includes LinuxLoader, implements fastboot, starts Android kernel, part of UEFI)

Many more parts are required for all the secure boot stuff (tz.img, keymaster.img, hyp.img, ...), but there's not much information to be found about the inards...
... and there's not much we could influence here, as all parts are signed for the secure world :silly:

Reference: https://worthdoingbadly.com/qcomxbl/
Reference: https://source.codeaurora.org/quic/la/abl/tianocore/edk2/
Especially: https://source.codeaurora.org/quic/...r/LinuxLoader.c?h=LA.UM.8.3.r1-07900-sdm845.0
Fun: https://github.com/edk2-porting/edk2-sdm845

Some other (known) partitions related to the bare metal:
/dev/block/sde24 type="6CB747F1-C2EF-4092-ADD0-CA39F79C7AF4" bluetooth.img (fat16 file format, includes firmware binaries for BT chipset)
/dev/block/sde46 type="EBD0A0A2-B9E5-4433-87C0-68B6B72699C7" modem.img (fat16 file format, includes firmware binaries for baseband, wifi, widevine... many other parts)

TBC

Regards,
scholbert

 

[scholbert]

Beryllium fastboot commands

Hi again!

In the meantime i started dissecting abl.img (Android bootloader, a.k.a. LinuxLoader), which is an essential part of the UEFI framework used on the Poco F1 to boot everything up.
The code inside abl UEFI binary is compressed using LZMA. Fortunately there are some great developers out there, who program awesome tools like this:
https://forum.xda-developers.com/android/general/tool-imjtool-unpack-extract-variety-ota-t4078159

This tool is really straight forward and after taking a look into uncompressed binary code of LinuxLoader,
it's easy to get an idea of the implemented fastboot commands (as fastboot routines are part of this code).
See my second post, where i gave some links to the codeaurora sources of LinuxLoader...

So here's the fastboot command list for Poco F1 (beryllium):

flash: 
erase: 
set_active 
oem unlock 
oem lock 
flashing get_unlock_ability 
flashing unlock 
flashing lock 
flashing lock_critical 
oem enable-charger-screen 
oem disable-charger-screen 
oem enable-qseelog 
oem disable-qseelog 
oem off-mode-charge 
oem select-display-panel 
oem device-info 
oem edl 
oem reboot-recovery 
continue 
reboot-bootloader 
oem poweroff 
getvar: 
download: 
oem uefilog 
oem lkmsg 
oem lpmsg 
oem mini

Again, here's a nice sum up of the protocol...
Reference: https://gerrit.pixelexperience.org/..._core/+/refs/tags/android-10.0.0_r2/fastboot/

As most commands are well explained and we do know what they do... others (esp. the "oem" ones) are not very well documented and it is mostly unknown what happens under the hood.
So as always, be very careful not to brick or damage your device if you fiddle around with thoose.
EDIT:
Some oem commands could be found in the official/open release...
https://source.codeaurora.org/quic/.../FastbootCmds.c?h=LA.UM.8.3.r1-07900-sdm845.0
... some are vendor specific proprietary code.

The last command "oem mini" really draw some interest on my side, as i suppose it could be an underlying test system (afaik Mini OS was first found on LG devices).
Please be very careful if you try... at the moment i do know nothing in detail, it's your own risk

Stay clean!
scholbert