Android port for Samsung WAVE3 (GT-S8600)

Search This thread

oleg_k

Retired Recognized Developer
Dec 19, 2005
183
620
Moscow
Hi all.
This thread only for developers! Only! No questions - when?!!!!!!!

This is my attempt to porting android on S8600.
I wrote custom bootloader - emmcboot, based on codeaurora LK-bootloader.
Bootloader is successfully start, work and trying to load android kernel from internal
microsd card.
Now is unsuccessfully,after type message "Uncompressing Linux... done, booting the kernel." device rebooted or stopped.

[370] Panel is power on
[370] Display initialized
[370] Display logo
[370] Waiting for modem+++
[370] Waiting for modem: Done
[370] smem ram ptable found: ver: 0 len: 6
[370] scratch: 0x8000000
[370] Starting in SD mode!
[370] SD_DETECT pin : 0x0
[380] Initializing MMC host data structure and clock!
[380] Error No. 2: Failure Initializing MMC Card!
[400] Decoded CID fields:
[400] Manufacturer ID: 27
[400] OEM ID: 0x5048
[400] Product Name: SD16G
[400] Product revision: 3.0
[400] Product serial number: 7C88FF04
[400] Manufacturing date: 2 2012
[410] Serial number -[410] serial number:
[410] partition misc doesn't exist
[410] error in emmc_recovery_init
[580]
kernel @ 208000 (4132528 bytes)
[580] ramdisk @ 1200000 (175204 bytes)
[580] cmdline = 'console=null androidboot.hardware=qcom user_debug=31'
[580]
Booting Linux
[580] smem ram ptable found: ver: 0 len: 6
[580] booting linux @ 0x208000, ramdisk @ 0x1200000 (175204)
[590] cmdline: console=null androidboot.hardware=qcom user_debug=31
Uncompressing Linux... done, booting the kernel.

source code for lk-bootloader for S8600:
https://github.com/Oleg-k/LK_BOOT_S8600
To build for S8600, type: "make -j4 s8600 EMMC_BOOT=1"

Also, i got memory dump, stage - after load oemsbl and before loading my bootloader.
as we see, oemsbl decompress and load apps_compressed.bin into memory,
starting at 0x200000.
https://www.dropbox.com/s/5wf6dp5gfgudkdc/MEM_DUMP_128MB.rar

And for for understanding boot process on MSM7x30, read this:
http://tjworld.net/wiki/Android/HTC/Vision/BootProcess#BootProcess
 
Last edited:

oleg_k

Retired Recognized Developer
Dec 19, 2005
183
620
Moscow
Sounds interesting.

1.
You found ELF files for S8600 Boot ?

2.
You found way without JTAG, or JTAG is needed to write your Boot?

Thanx in advance.

Best Regards

No, don't ELF files for S8600, i wrote new bootloader for boot linux kernel.
Now i use JTAG, but if we find a way to cript my bootloader,like appsboot.mbn,we will use regular multiloader
 

Attachments

  • bootloader.tar
    150 KB · Views: 3,485
Last edited:

Rebellos

Senior Recognized Developer
May 13, 2009
1,353
3,428
Gdańsk
it's my current config for my kernel:

Thanks. I'd check debug macros and debug uart configuration. There's few UART ports in it, and maybe kernel is printing to the wrong one... though this wouldn't explain why kernel unpacker is printing something (Uncompressing and booting comes already from zImage) - this would indicate that debug port number is correct. Are you sure that kernel and ATAGs location is correct, and RAM is set up properly by LK? Maybe something bad happens when kernel proceeds to enabling MMU and caches... I'm pretty clueless. :<
I collected some links I found useful in this article: http://xda-university.com/as-a-developer/porting-android-to-non-android-devices
Especially interesting for you might be last link in "Custom bootloader" section. :)
 

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
No, don't ELF files for S8600, i wrote new bootloader for boot linux kernel.
Now i use JTAG, but if we find a way to cript my bootloader,like appsboot.mbn,we will use regular multiloader

For S8500 I found way to write direct into OneNAND at:
Code:
0x0010 0001
No need to encrypt something... :D

With Multiloader... choose ETC.
http://xdaforums.com/showpost.php?p=37229969&postcount=37

S8600 not tested...

This is far far away from perfect... but maybe helpfull.

Need someone who is able to remove restriction from ML to use lower adresses then 0x10000...
I was only able to change text strings... in ML...

Best Regards
 

oleg_k

Retired Recognized Developer
Dec 19, 2005
183
620
Moscow
On first page i posted bootloader source and memory dump, stage - after load oemsbl and before loading my bootloader.

To Adfree,
S8600 don't use OneNAND, used EMMC flash memory (like sd-card).
 
  • Like
Reactions: Wave3.3 and hero355

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
Today I've found S8600XXKI9.zip

I have forgotten this Firmware... but I have now short compared with Bootfiles from XXKJC... BIG differences... So I think this should be nearly identical with PlatformDownloader_S8600_KI5.exe

Still unsolved to decrypt or extract content of:
PlatformDownloader_S8600_KI5.exe
and
PlatformDownloader_S8600_KJ7.exe
:eek:

Best Regards
 
  • Like
Reactions: black0000

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
Not my S8600... but user tried PlatformDownloader_S8600_KJ7.exe
:eek:

It seems it was wrong Partition Table aka partition.bin... :eek:

Code:
Boot Binary Download Start Ch[0]
Appsboot 338.7KB OK[1.1s]
OemSbl 1757.7KB OK[1.8s]
ERR : NAK_FLASH_ERROR 0
Error : [B]partition Write[/B] [0.2s]
ERR : NAK_FLASH_ERROR 0
Download Start Ch[0]
Amss 16654.3KB OK[15.6s]
Apps 29622.3KB OK[54.1s]
_Open_Europe_Common 40370.2KB OK[73.5s]
(Low) 2980.3KB OK[1.9s]
ERR : NAK_INVALID_CONTENT 0
ERR : _Open_Europe_Common Erase

Now S8600 ask for QHSUSB_DLOAD

My first idea is Qualcomm QPST now...

Or maybe if Driver used, then Multiloader will work again... for second attempt..

Found only 64 Bit Driver yet... not tested nor Thread... only attachment...
http://xdaforums.com/attachment.php?attachmentid=631288&d=1308601930

Will check also QPST to check what is needed...

Best Regards

Edit 1.

More Driver...
http://xdaforums.com/showpost.php?p=21911621&postcount=2
 
Last edited:
  • Like
Reactions: black0000

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
Okay...
It seems for QPST fsbl.mbn is missing...

I can remember from old MSM6250 handsets it is mandatory to have all files for QPST... because otherwise you need JTAG...

Important...
Qualcomm not use Encryption for QPST files...
This is Samsung thingie + "end.bin" last 1024 Byte...

So decrypt all Bootfiles and cut last 1024 Byte...

For fsbl.mbn I will check JTAG dump from S8600...

Best Regards

Edit 1.
http://xdaforums.com/showthread.php?t=1367055
downgrade_WM6_boot.zip contain fsbl.mbn ... maybe as example...
 

Attachments

  • S8600QPST1.jpg
    S8600QPST1.jpg
    48.2 KB · Views: 1,201
Last edited:
  • Like
Reactions: black0000

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
http://forum.gsmhosting.com/vbb/f634/htc-desire-s-qhsusb_dload-driver-1436354/

Found this...

Here is also fsbl.mbn maybe not available... or...

But maybe if we can attach such S8600 we can see few infos...

Best Regards

Edit 1.
About QPST Version contain this eMMC...
Code:
4. RELEASE NOTES
...
10/27/11 QPST [B]2.7.378[/B]
1) Add support for QSC11x5 CDMA only (4073) and CDMA+GSM (4074).
2) Fix problem with eMMC Software Download not correctly patching addresses > 8 GB.

10/13/11 QPST 2.7.377
1) Fix crash when QPSTServer.config are NULs (bad format).
2) Add model ID 4072 = "APQ8064". Apps processor only, no service programming.
3) Change flash programmer name from nprg9615.hex to nprg9x15.hex.
4) Add emergency download support for user partitions.
5) Fix case where user partition download fails if the flash programmer is on a file share.
6) Fix error case when add port is used but no port is specified.
7) Fix case where restoring an EFS file doesn't work if the file was modified by QXDM.
8) In Service Programming BC SMS fix case where if user enters 32 as the service type it get written to NV as 4096.
9) Fix case where a phone will stay in "no phone" state if the phone takes > 20 seconds to reboot.
10) Take care of cases in eMMC Software Download where we try to lock the disk volume but the drive letter isn't available.
11) Fix "server busy" issue when a device connects but it's modem isn't running.
12) Insert more status message in Memory Debug app so that we can see why fast unframed dump failed.

8/17/11 QPST 2.7.375
1) Add support for MDM9615 (model 4070). Rename model 4068 to 7627A-ANDROID from SURF7627A.
   Add model 4071 (7627A-WinMob). Add 1x/UMTS service programming to 4068 and 4071.
2) eMMC Software Download: Don't try to lock volume if drive letter not present.
   Devices that use GPT will not mount and get a drive letter assigned.

7/22/11 QPST 2.7.374
1) Added missing file to installer to fix Service Programming problem in 2.7.373.
2) For eMMC Software Download, abort the download if a sparse="true" directive is present.
   Sparse files cannot be downloaded with QPST, only with fastboot.
3) Began the process of moving QPST application and server settings from registry to
   configuration files.
4) Added more error checking to EFS Explorer file drop code.

7/5/11 QPST 2.7.373
1) Add support for SURF8960 model ID 4069.
2) Fix issue with Port Enable/Disable for IP Ports.
3) NAND Software Download: Correct flash programmer descriptions for 7225A, 7625A, 7227A, and 7627A.
4) Roaming List Editor: Added two new bands LTE 24 and LTE 25.
5) eMMC Software Download:
   - Fix problem where some file names print as "(null)".
   - Add support for Meta Build contents.xml file ("Build Contents"). The contents file will provide the path for the
     rawprogram and patch files, extra search paths, and names of flash programmer and boot image files.
   - Ignore unexpected elements in schema.
   - Support zeroout directive to zero parts of partitions.
   - Allow usage by app of "orderly" as well as surprise removal storage devices.
   - Add support for computations in the <patch> (CRC32 for GPT support), <program>, and <zeroout> directives.
6) EfsExplorer:
   - Enable reset button in Efs Explorer even if target not in offline mode.
   - More text description in Mode column for Efs Explorer 
   - Modify the list context menu of Efs-Explorer.
   - If the proposed item file size copy is > 2048 bytes, warn the user and bail out.
...
 

Attachments

  • HTCeMMCQPST.jpg
    HTCeMMCQPST.jpg
    62 KB · Views: 1,080
Last edited:
  • Like
Reactions: black0000

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
link pls for founded S8600XXKI9.zip
http://hotfile.com/dl/145796951/79ecec6/S8600XXKI9.zip.html?lang=de

Try this. If not then I search again...

About fsbl.mbn...

I have searched for fsbl_hw.c string in 4 GB JTAG dump SAMSUNG_GTS8600_FullFlash.bin...

Can not find so I think fsbl is not or in other area... :confused:

About your Memory Dump FROM_MEM_0_128MB.bin
:eek:

I am not 100 % sure but maybe read problems...
Short tried to extract Cert, but string Qualcomm is not written correct...
Q5alcomm1
qualcoem.com

Best Regards
 
Last edited:

oleg_k

Retired Recognized Developer
Dec 19, 2005
183
620
Moscow
I try to read again memory dump )
thanks for links...
Also,
i find,what samsung used OKL4 Microkernel 3.0 (maybe 4.0)
http://wiki.ok-labs.com/Release/3.0
About ver 4.0 --
The OKL4 Microvisor is designed from the ground up as a high-performance mobile virtualization platform. It is a microkernel-based embedded hypervisor - called a Microvisor, with a small footprint and the right combination of performance and hardware support to target mobile telephony use. The OKL4 Microvisor 4.0 is distinguished by supporting mobile virtualization, componentization, and security, enabling a new generation of applications and capabilities with impact across the mobile ecosystem.

OKL4(with Qualcomm RTOS) also used in modem AMSS

http://xdaforums.com/showthread.php?t=1829915
 
Last edited:
  • Like
Reactions: hero355

adfree

Senior Member
Jun 14, 2008
10,619
6,175
Samsung Galaxy Watch 4
Samsung Galaxy S22
Need overview/list with Firmware packages with Bootfiles included...

Here this is what I have...
Later I will compare if difference...

Code:
XXKI9
XXKJC
S8600BOKJ1_TPLKJ1.rar
S8600BOKK6_S8500TPLKK7_T-Mobile.rar
S8600JPKK2_S8500OJPKK2_OJP.rar
S8600ZCLA1.7z
S8600NAKL1_S8600EPLKL1

Best Regards
 
Last edited:
  • Like
Reactions: black0000

Top Liked Posts

  • There are no posts matching your filters.
  • 32
    Hi all.
    This thread only for developers! Only! No questions - when?!!!!!!!

    This is my attempt to porting android on S8600.
    I wrote custom bootloader - emmcboot, based on codeaurora LK-bootloader.
    Bootloader is successfully start, work and trying to load android kernel from internal
    microsd card.
    Now is unsuccessfully,after type message "Uncompressing Linux... done, booting the kernel." device rebooted or stopped.

    [370] Panel is power on
    [370] Display initialized
    [370] Display logo
    [370] Waiting for modem+++
    [370] Waiting for modem: Done
    [370] smem ram ptable found: ver: 0 len: 6
    [370] scratch: 0x8000000
    [370] Starting in SD mode!
    [370] SD_DETECT pin : 0x0
    [380] Initializing MMC host data structure and clock!
    [380] Error No. 2: Failure Initializing MMC Card!
    [400] Decoded CID fields:
    [400] Manufacturer ID: 27
    [400] OEM ID: 0x5048
    [400] Product Name: SD16G
    [400] Product revision: 3.0
    [400] Product serial number: 7C88FF04
    [400] Manufacturing date: 2 2012
    [410] Serial number -[410] serial number:
    [410] partition misc doesn't exist
    [410] error in emmc_recovery_init
    [580]
    kernel @ 208000 (4132528 bytes)
    [580] ramdisk @ 1200000 (175204 bytes)
    [580] cmdline = 'console=null androidboot.hardware=qcom user_debug=31'
    [580]
    Booting Linux
    [580] smem ram ptable found: ver: 0 len: 6
    [580] booting linux @ 0x208000, ramdisk @ 0x1200000 (175204)
    [590] cmdline: console=null androidboot.hardware=qcom user_debug=31
    Uncompressing Linux... done, booting the kernel.

    source code for lk-bootloader for S8600:
    https://github.com/Oleg-k/LK_BOOT_S8600
    To build for S8600, type: "make -j4 s8600 EMMC_BOOT=1"

    Also, i got memory dump, stage - after load oemsbl and before loading my bootloader.
    as we see, oemsbl decompress and load apps_compressed.bin into memory,
    starting at 0x200000.
    https://www.dropbox.com/s/5wf6dp5gfgudkdc/MEM_DUMP_128MB.rar

    And for for understanding boot process on MSM7x30, read this:
    http://tjworld.net/wiki/Android/HTC/Vision/BootProcess#BootProcess
    12
    YES! YES! YES!

    WE HAVE KERNEL!

    https://github.com/Oleg-k/kernel_source_s8600
    @oleg_k is, big thanks :*

    But he tell, we can brick our device
    9
    FASTBOOT Driver and Commands working. :good: :cool:
    But now it is really dangerous to try without to know what you do...

    I have JTAG to fix Software failures...

    Enter help, you see some Commands:
    Code:
    fastboot help
    result:
    Code:
    usage: fastboot [ <option> ] <command>
    
    commands:
      update <filename>                        reflash device from update.zip
      flashall                                 flash boot + recovery + system
      flash <partition> [ <filename> ]         write a file to a flash partition
      erase <partition>                        erase a flash partition
      getvar <variable>                        display a bootloader variable
      boot <kernel> [ <ramdisk> ]              download and boot kernel
      flash:raw boot <kernel> [ <ramdisk> ]    create bootimage and flash it
      devices                                  list all connected devices
      reboot                                   reboot device normally
      reboot-bootloader                        reboot device into bootloader
    
    options:
      -w                                       erase userdata and cache
      -s <serial number>                       specify device serial number
      -p <product>                             specify product name
      -c <cmdline>                             override kernel commandline
      -i <vendor id>                           specify a custom USB vendor id

    Best Regards
    8
    Welcome back my friend ))

    If you able to port,I 100% will buy S8600 :)

    Good Luck
    8
    it's my current config for my kernel: