Everything Huawei Y550 - Root/CWM/TWRP

[fwiep]

He also cited this:
https://forum.xda-developers.com/android/development/wireguard-rom-integration-t3711635/post74667364 which should help.

As always, you seem to be the master of finding information on XDA. Thanks for the research!

I think I'll give it a go using the "Method B: Integrating into ROMs" - who knows what will happen.
When the November-2020 patches arrive, I'll build as usual without explicit WireGuard stuff - and then build a separate ROM with WG included.

Kind regards,
FWieP

 

[fwiep]

Thanks to the LineageOS-developers this is today's build containing the December-2020 and November-2020 security patches.

Recent changes: LineageOS 14.1
Kernel: https://github.com/HUAWEI-Y550-Y635/android_kernel_huawei_msm8916/commits/los-14.1

ZIP: lineage-14.1-20201220-UNOFFICIAL-y550.zip
MD5: lineage-14.1-20201220-UNOFFICIAL-y550.zip.md5
ASC: lineage-14.1-20201220-UNOFFICIAL-y550.zip.md5.asc

Known bugs:
- the WiFi MAC-address sometimes switches between a Huawei-prefix 68:a0:f6 and an Airgo-prefix 00:0a:f5 on reboot
(I've observed this on my new Moto G6 with RROS OTA, too - so it's probably a generic custom-ROM issue)

Edit: Removed obsolete download links.

Kind regards,
FWieP

 

[GotoDengo]

Thanks to the LineageOS-developers this is today's build containing the December-2020 and November-2020 security patches.

Kind regards,
FWieP

Thanks again, it's working well.

Happy Holidays!

 

[rudolfm]

@fwiep said:
" I'd like your help in testing the WireGuard functionality in this ROM"
I used this Rom for over a year (2018/19) with wireguard and no problems. All I had to do was download the wireguard app from fdroid. Azire had a test phase where you could use it for free with wireguard. I was one of those "happy to test" folks

You also wrote that your Y550 is dying. If you need one to keep on supporting, I could send you mine.

Happy new Year!

 

[fwiep]

All I had to do was download the wireguard app from fdroid.

Thanks for this info. I hoped as much, and will not try to build in kernel support any longer.
The app itself is very capable of making the VPN work. I use it on my primary device regularly.

You also wrote that your Y550 is dying. If you need one to keep on supporting, I could send you mine.

Thank you, but luckily, my Y550 has returned from the dead. It's WiFi was truly fixed by a thorough return to stock.

Kind regards and a happy new year!
FWieP

 

[rudolfm]

Thanks for this info. I hoped as much, and will not try to build in kernel support any longer.

Wireguard support was already in the kernel when you took over. If you can just leave it there then please do.

I used wireguard with the Kernel support, and it worked fine. You can see the Kernel is used when you use the Fdroid Wireguard app, and it does NOT use the VPN slot. The app contains suport for the kernel module and also a userspace module. If the app finds a kernel module it will use that.

I don't really understand why you write that you would (not) try to build in kernel support. It was already inside. Or did you change the kernel?

 

[fwiep]

Wireguard support was already in the kernel when you took over. If you can just leave it there then please do.
...
I don't really understand why you write that you would (not) try to build in kernel support. It was already inside. Or did you change the kernel?

My mistake.
No, I did not change the kernel. I am very grateful that it was ported and developed to what we use today.
I was under the impression that the builtin Wireguard code was out of date and needed an update to work properly. That's why I started tinkering around with it (in a separate, local copy of the source). Rest assured: the kernel included in my builds is as untouched as it was when @desalesouche let me 'take over'.

Kind regards and a happy new year,
FWieP

 

[rudolfm]

@fwiep

I did some research. I thought you continued Desalecouches build, but now I see you started your own.

Desalecouche included wireguard into the kernel in build 20171219, see page 295 of this thread.
It continued until build 20180916, the last one I have with wireguard. I have a build 20181111 marked Desalecouche and a build 20181115 marked Fwiep which both have no wireguard. Later builds I have are yours. Maybe Desalecouche removed it.

I found that out by simply flashing different boot.img files copied out of the build zips, flashing them on a newer system, and seeing what the wireguard app says. It shows either kernel or userspace backend in the settings. You only need to install the app, it needs not be set up tho show if the kernel is used.

If you wish to have a short look, I have attached a .zip including the boot.img 20180916 with kernel support, a screenshot of "about phone" showing your build and the Desalecouche kernel, and a screenshot of the app showing kernel support.

I think that you could simply apply the same wireguard patches Desalecouche used, as you still use the same kernel version. Having wireguard in the kernel is better on battery and speed.

 

[Yalmanlar]

Hi Guys I'm stuck on Custom room boot loop
Huawei y635-l01
Fix camera. zip caused it.it was running Remix Android 7.1 after I installed fix Camera.zip it stuck since in bootloop
I can't find a way out. I installed stock rom many times, it works well in stock rom but when I install custom rom it stuck in Boot Loop.

 

[fwiep]

Thanks to the LineageOS-developers this is today's build containing the February- and January-2021 security patches.
Regarding WireGuard integration: I have not yet found the time to work on this; maybe later.

Recent changes: LineageOS 14.1
Kernel: https://github.com/HUAWEI-Y550-Y635/android_kernel_huawei_msm8916/commits/los-14.1

ZIP: lineage-14.1-20210218-UNOFFICIAL-y550.zip
MD5: lineage-14.1-20210218-UNOFFICIAL-y550.zip.md5
ASC: lineage-14.1-20210218-UNOFFICIAL-y550.zip.md5.asc

Known bugs:
- the WiFi MAC-address sometimes switches between a Huawei-prefix 68:a0:f6 and an Airgo-prefix 00:0a:f5 on reboot
(I've observed this on a Moto G6 with RROS OTA, too - so it's probably a generic custom-ROM issue)

Edit: Removed obsolete download links.

Kind regards,
FWieP

 

[bahram360]

Thanks fwiep

 

[fwiep]

Thanks to the LineageOS-developers this is today's build containing the March-2021 security patches.

Recent changes: LineageOS 14.1
Kernel: https://github.com/HUAWEI-Y550-Y635/android_kernel_huawei_msm8916/commits/los-14.1

Regular, without Wireguard built into kernel:
ZIP: lineage-14.1-20210307-UNOFFICIAL-y550.zip
MD5: lineage-14.1-20210307-UNOFFICIAL-y550.zip.md5
ASC: lineage-14.1-20210307-UNOFFICIAL-y550.zip.md5.asc

With Wireguard built into kernel:
ZIP: lineage-14.1-20210307-wg-UNOFFICIAL-y550.zip
MD5: lineage-14.1-20210307-wg-UNOFFICIAL-y550.zip.md5
ASC: lineage-14.1-20210307-wg-UNOFFICIAL-y550.zip.md5.asc

Please test the Wireguard build. I've tried myself, but the Wireguard app always says: "Go userspace backend", no matter which of the two kernels I use. Do I need to have root access? Give some special permissions?

Update 1: Wireguard support was not actually included - please see my later builds from april 26, 2021 onwards.

Update 2: Removed obsolete download links.

Known bugs:
- the WiFi MAC-address sometimes switches between a Huawei-prefix 68:a0:f6 and an Airgo-prefix 00:0a:f5 on reboot
(I've observed this on a Moto G6 with RROS OTA, too - so it's probably a generic custom-ROM issue)

Kind regards,
FWieP

 

[fwiep]

Dear all,

I've built for the Y550 with another WG-implementation. The previous one (see last post) was with sources from wireguard-monolithic-historical. Now I'm using the sources from wireguard-linux-compat. The latter name sounds more current, more up-to-date.

Here are the download links:
lineage-14.1-20210308-wg-UNOFFICIAL-y550.zip
lineage-14.1-20210308-wg-UNOFFICIAL-y550.zip.md5
lineage-14.1-20210308-wg-UNOFFICIAL-y550.zip.md5.asc

My personal Y550-L01 has given up; permanently, so it seems. Yesterday, I was happily testing the WG stuff and switched it off using the power menu. This morning, there was no life in the device at all. Connecting the charger should boot up to show a loading animation, but does nothing. The battery itself is fully charged at 3,7V. I've taken the device apart to see if there's nothing obviously defective or loose - there isn't.

Update - when connected to a PC via USB, the device is detected as QHSUSB__BULK.
So, there's hope after all. I'm searching XDA for further instructions.

I hope my second Y550 will return to me in a few days time, but until then... I won't be able to test myself what I upload right here on the forum.

If any of you know a reanimation trick for a 7-year old smartphone - please tell me!

Kind regards,
FWieP

 

[GotoDengo]

Thanks to the LineageOS-developers this is today's build containing the March-2021 security patches.

Thanks for this. I've installed the standard version and it's working fine so far.

If any of you know a reanimation trick for a 7-year old smartphone - please tell me!

I would have suspected the battery myself (as I had to replace mine recently) but as you've tested that out it could be a motherboard failure!

 

[szty0pa]

Dear all,

...

My personal Y550-L01 has given up; permanently, so it seems.
...
If any of you know a reanimation trick for a 7-year old smartphone - please tell me!

Thank you for your work as always!

I would suspect that your bootloader is corrupted. (So it might indicate NAND failure...) Were you able to restore your phone to a working state?
If not i think the way would be to extract the full raw disk image from a factory update file (especially the bootloader) and write it out to your phone's NAND as a raw disk image. Since you use linux dd would be the best choice.
Best of luck with it!

 

[fwiep]

I would suspect that your bootloader is corrupted. (So it might indicate NAND failure...) Were you able to restore your phone to a working state?

Unfortunately, no.

If not i think the way would be to extract the full raw disk image from a factory update file (especially the bootloader) and write it out to your phone's NAND as a raw disk image.

Thank you for the pointing into this direction. Using these instructions I have pulled a mmcblk0.img from my second, working Y550. Then, I wrote that image to a blank SD-card and inserted it into the patient.

Using these instructions as a guideline, I booted the device with vol-down and connecting the charger. Yes, the phone came to life, scrolled lots of messages through the screen and even showed me a fastboot prompt. The screen showed that the bootloader is locked. Trying to flash or even boot TWRP via fastboot failed (not allowed). Somewhere, I read the message

error:allocating memory for ssd buffer

But then, it kept on rebooting showing about one hundred lines of

boardid:8096

Then the next reboot.

I'm sorry, but the repair of this device is beyond me. Luckily, its sister is in the house, again!

Kind regards,
FWieP

 

[szty0pa]

Unfortunately, no.


Thank you for the pointing into this direction. Using these instructions I have pulled a mmcblk0.img from my second, working Y550. Then, I wrote that image to a blank SD-card and inserted it into the patient.

Using these instructions as a guideline, I booted the device with vol-down and connecting the charger. Yes, the phone came to life, scrolled lots of messages through the screen and even showed me a fastboot prompt. The screen showed that the bootloader is locked. Trying to flash or even boot TWRP via fastboot failed (not allowed). Somewhere, I read the message

error:allocating memory for ssd buffer

But then, it kept on rebooting showing about one hundred lines of

boardid:8096

Then the next reboot.

I'm sorry, but the repair of this device is beyond me. Luckily, its sister is in the house, again!

Kind regards,
FWieP

Sorry to hear that you didn't succeed at first try - it needs a lot of experience and some luck to do so, but don't give up so easily, you are about halfway there!

Modern ARM devices are almost impossible to "hard-brick" (by modern I mean ARMv7+ which Y550 certainly is)!
(As a side note I think I was wrong as the phone has eMMC, not NAND but that does not make any difference for us.)

So what can be concluded from your experiments is that the hardcoded (ROM) bootloader works alright as it loads and executes the second-stage bootloader from your SD card alright. You now have an mmcblk0 image (that is the second-stage bootloader) which is awesome and the key to success!!!
(Note that the instructions you linked for extracting the image are a bit vague and inaccurate but should _mostly_ work. The problem is that it does not pay attention to the size of the partition - that should not be a problem - and possible bad sectors - that could be a problem though. I recommend the command to be something like "dd if=/dev/mmcblk0 of=/link/to/dir/mmcblk0.img conv=sync bs=1M status=progress"; if: the partition you want to image, of: output image file, conv=sync: skip bad sectors, bs=1M: use 1 megabyte sectorsize to speed up the copy, status=progress: to show you how it's progressing.)

One thing I would try is that connect your (dead) phone so your PC sees it as a bulk disk (using linux would be easier for me to help you with), you should see an entry for it under /dev/. (If you issue a "dmesg | tail" after you connect it you should see how it is recognised.) It probably won't be a disk popping up your file manager.
Once you get the correct /dev/sdX entry use dd to copy mmcblk0.img back to the phone: "dd if=/path/to/mmcblk0.img of=/dev/sdX conv=sync bs=1M status=progress". Oh and don't forget to issue "sync" a few times (2 or 3 for safety and historic reasons - might be a bit of superstition) after you use dd - that makes sure the whole image is transferred and it is safe to unplug the phone!

Hope this helps reviving your phone mate!

[edit] It probably won't be /dev/sdX but /dev/mmcblkX. Oh and to copy only the bootloader the correct entry is probably /dev/mmcblk0p1? /dev/partitions will tell you that.

 

[fwiep]

I've tried the direct USB connection to my Linux-PC. dmesg shows the following:

usb 3-10.3: new high-speed USB device number 60 using xhci_hcd
usb 3-10.3: New USB device found, idVendor=05c6, idProduct=9008, bcdDevice= 0.00
usb 3-10.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 3-10.3: Product: QHSUSB__BULK
qcserial 3-10.3:1.0: Qualcomm USB modem converter detected
usb 3-10.3: Qualcomm USB modem converter now attached to ttyUSB0

So, there's no block device to write to.

For your info, these are the commands I used to extract the mmcblk0.img:

y550:/ # cat /proc/partitions                                                  
major minor  #blocks  name

 254        0     524288 zram0
 179        0    3817472 mmcblk0
 179        1        512 mmcblk0p1
 179        2        512 mmcblk0p2
 179        3         32 mmcblk0p3
 179        4         32 mmcblk0p4
 179        5        512 mmcblk0p5
 179        6        512 mmcblk0p6
 179        7       5056 mmcblk0p7
 179        8       1024 mmcblk0p8
 179        9      65536 mmcblk0p9
 179       10       4096 mmcblk0p10
 179       11       4096 mmcblk0p11
 179       12      98304 mmcblk0p12
 179       13       4096 mmcblk0p13
 179       14       2048 mmcblk0p14
 179       15       2048 mmcblk0p15
 179       16      65536 mmcblk0p16
 179       17      32768 mmcblk0p17
 179       18      20480 mmcblk0p18
 179       19      24576 mmcblk0p19
 179       20     262144 mmcblk0p20
 179       21     196608 mmcblk0p21
 179       22       4096 mmcblk0p22
 179       23    1310720 mmcblk0p23
 179       24    1703919 mmcblk0p24
 179       32       4096 mmcblk0rpmb
 179       64   15183872 mmcblk1
 179       65   15181824 mmcblk1p1

y550:/ # dd if=/dev/block/mmcblk0 of=/storage/59DB-FABF/mmcblk0.img bs=1024k count=3728

Can I use the /dev/ttyUSB0 to restore the device?

Thanks,
FWieP

 

[szty0pa]

I've tried the direct USB connection to my Linux-PC. dmesg shows the following:

usb 3-10.3: new high-speed USB device number 60 using xhci_hcd
usb 3-10.3: New USB device found, idVendor=05c6, idProduct=9008, bcdDevice= 0.00
usb 3-10.3: New USB device strings: Mfr=0, Product=2, SerialNumber=0
usb 3-10.3: Product: QHSUSB__BULK
qcserial 3-10.3:1.0: Qualcomm USB modem converter detected
usb 3-10.3: Qualcomm USB modem converter now attached to ttyUSB0

So, there's no block device to write to.

For your info, these are the commands I used to extract the mmcblk0.img:

y550:/ # cat /proc/partitions                                                 
major minor  #blocks  name

254        0     524288 zram0
179        0    3817472 mmcblk0
179        1        512 mmcblk0p1
179        2        512 mmcblk0p2
179        3         32 mmcblk0p3
179        4         32 mmcblk0p4
179        5        512 mmcblk0p5
179        6        512 mmcblk0p6
179        7       5056 mmcblk0p7
179        8       1024 mmcblk0p8
179        9      65536 mmcblk0p9
179       10       4096 mmcblk0p10
179       11       4096 mmcblk0p11
179       12      98304 mmcblk0p12
179       13       4096 mmcblk0p13
179       14       2048 mmcblk0p14
179       15       2048 mmcblk0p15
179       16      65536 mmcblk0p16
179       17      32768 mmcblk0p17
179       18      20480 mmcblk0p18
179       19      24576 mmcblk0p19
179       20     262144 mmcblk0p20
179       21     196608 mmcblk0p21
179       22       4096 mmcblk0p22
179       23    1310720 mmcblk0p23
179       24    1703919 mmcblk0p24
179       32       4096 mmcblk0rpmb
179       64   15183872 mmcblk1
179       65   15181824 mmcblk1p1

y550:/ # dd if=/dev/block/mmcblk0 of=/storage/59DB-FABF/mmcblk0.img bs=1024k count=3728

Can I use the /dev/ttyUSB0 to restore the device?

Thanks,
FWieP

I see! So you have the whole eMMC imaged then. I think the first megabyte or so would be enough to kickstart it. I will try to check the partition map to find out which partion stores what. (Trouble is that there might be calibration data somewhere which would be best kept intact if possible.)

/dev/ttyUSB0 is a serial console which can be used to restore your phone - but as you noticed is not a block device, so it needs a different way to utilise. If you have the time it's great learning experience to connect to it and see what you can do with it. Under linux minicom or screen (for example) can be used for that, under Windows i think PuTTY is the obvious choice. I suspect there must be some special Qualcomm tool for restoring the phone from an image. I'll try to look around for that.

 

[fwiep]

I suspect there must be some special Qualcomm tool for restoring the phone from an image. I'll try to look around for that.

I think the QPST-tool may be helpful, see these instructions and downloads.

Question is: which parts (partitions) from the working device would I need to flash for 'Phone image' and 'Boot image'?

update 1 - I'm going to try connecting the device to a virtual Windows and run the QPST tools. The drivers are included, and I've got a BOOT.img and SYSTEM.img from the Y550's original firmware. To be continued .

update 2 - I can 'see' the phone as 'Phone in Download Mode', but that's all. The tool insists on a valid .hex file format for anything to be flashed. If I try to rename Huawei's SYSTEM.img to SYSTEM.img.hex, it says it isn't a valid HEX-file. Which is true, of course. Do you have any insights?

Kind regards,
FWieP