Patched Xiaomi Miatoll kernel doesn't boot Android

[Zekiu]

I use LineageOS 22.1, didn't test with MIUI.
Here are the steps I took:

• unpacked LineageOS's boot.img with unpack_bootimg --boot_img boot.img --format=mkbootimg
• patched the kernel with DualBootKernelPatcher out/kernel SM7125_EFI_SB.fd PatchedKernel Config/DualBoot.Sm7125.cfg ShellCode/ShellCode.Miatoll.bin
• replaced the kernel in out/ with PatchedKernel
• repackaged the boot.img with mkbootimg --header_version 2 --os_version 15.0.0 --os_patch_level 2025-03 --kernel out/kernel --ramdisk out/ramdisk --dtb out/dtb --pagesize 0x00001000 --base 0x00000000 --kernel_offset 0x00008000 --ramdisk_offset 0x01000000 --second_offset 0x00000000 --tags_offset 0x00000100 --dtb_offset 0x0000000001f00000 --board '' --cmdline 'androidboot.console=ttyMSM0 androidboot.hardware=qcom androidboot.memcg=1 androidboot.usbcontroller=a600000.dwc3 cgroup.memory=nokmem,nosocket console=ttyMSM0,115200n8 earlycon=msm_geni_serial,0xa88000 loop.max_part=7 lpm_levels.sleep_disabled=1 msm_rtb.enabled=1 msm_rtb.filter=0x237 service_locator.enable=1 swiotlb=1 video=vfb:640x400,bpp=32,memsize=3072000' -o boot_uefi.img
• flashed the image with fastboot flash boot boot_uefi.img

The unpacking and repacking process works correctly, because just unpacking and repacking the boot.img works and I can successfully boot into Android. With the patched kernel the phone bootloops when booting into Android, pushing Volume Up works correctly and it boots into UEFI, just the Android part doesn't work. I haven't tried booting full Windows yet with this DualBootKernel. Doing this with magiskboot unpack and magiskboot repack produces the same results.
Am I doing something wrong? Does this not work with LineageOS?

[sunflower2333]

Hi. The steps are correct.
You mentioned the phone run into a boot loop. Does the phone run lineage kernel successfully(e.g. adb / lineage logo shown)?

[Zekiu]

When trying to boot Android, the phones stays at Xiaomi logo, vibrates, and then restarts after a couple of seconds. Booting into LineageOS recovery works fine however.

[sunflower2333]

OK I see. Can you attach the compressed bootimage or kernel your are using here?

[Zekiu]

boot_uefi.img.gz

PatchedKernel.gz

[sunflower2333]

Please also send original unpatched boot or kernel

[Zekiu]

boot.zip

[sunflower2333]

boot.zip

Are you sure you was using kernel in this boot to patch? I am comparing head of the kernel and i found they jump to different place.

[sunflower2333]

The two pics below are unpatched and patched kernel in boot.zip you sent.

it jumps to 0x1b80000, which is normal.

But in the patched kernel you sent before, it jumps to 0x2580000, which is not same with the offset i got.

[Zekiu]

Oh, sorry, I may have used the LineageOS boot.img instead of the stock one, here's the LineageOS one

boot.zip
I may try this again with the stock boot.img, but I'm not sure if it'll even boot LineageOS

[Zekiu]

I may try this again with the stock boot.img, but I'm not sure if it'll even boot LineageOS

The stock boot.img doesn't boot LineageOS, of course :D, but I tried patching the kernel from LineageOS's boot.img and these files are definitely the correct ones (I used a release FV file with serial output to screen enabled that I compiled before fyi):

boot.zip

new-boot.zip

[sunflower2333]

OK thanks. I previously plan to test with qemu but when i try to boot your kernel it stuck(damn). Maybe it does not support a virt platform so I have no idea how to test now.

[sunflower2333]

Okay i think i know the reason

[sunflower2333]

The dualboot kernel patcher overlayed some b(jump) instructions here

[sunflower2333]

It will cause issue while kernel booting