Samsung Galaxy Note 9 (Exynos) (samsung-crownlte)
USB Networking |
Partial |
---|---|
Flashing |
Works |
Touchscreen |
Works |
Display |
Works |
WiFi |
Works |
Xwayland |
Works |
FDE | |
Mainline | |
Battery |
Partial |
3D Acceleration | |
Audio |
Broken |
Bluetooth |
Broken |
Camera | |
GPS | |
Mobile data | |
SMS | |
Calls | |
USB OTG |
Works |
NFC |
Broken |
Accelerometer | |
---|---|
Magnetometer | |
Ambient Light | |
Proximity | |
Hall Effect | |
Ir TX |
Unavailable |
---|---|
TrustZone | |
Contributors
- rom4nik - porting
Users owning this device
- Rom4nik (Notes: 6/128 model)
How to enter recovery/Odin mode
- Press and hold Bixby Key + Volume Down simultaneously while device is powered off, then plug USB cable in for Odin mode.
- Press and hold Bixby Key + Volume Up + Power simultaneously while device is powered off for recovery mode.
- Press and hold Volume Down + Power simultaneously for 7-8 seconds while device is powered on to force reboot. Once time is up immediately release the keys and press one of combinations above before boot logo appears, otherwise device will boot normally.
Installation
1. Unlock bootloader.
2. Flash using Heimdall:
$ pmbootstrap install
$ pmbootstrap flasher flash_rootfs
or follow Installation_from_recovery_mode instead.
USB networking
RNDIS
Similarly to Samsung_Galaxy_S8_(samsung-dreamlte), RNDIS interface fails to come up without additional setup in initfs-hook.sh, making no appearances in dmesg on host. With this hook, RNDIS interface appears in dmesg:
[279777.979155] usb 1-2: new high-speed USB device number 87 using xhci_hcd [279778.121336] usb 1-2: New USB device found, idVendor=18d1, idProduct=d001, bcdDevice= 4.09 [279778.121349] usb 1-2: New USB device strings: Mfr=5, Product=6, SerialNumber=7 [279778.121355] usb 1-2: Product: Samsung Galaxy Note 9 [279778.121359] usb 1-2: Manufacturer: Samsung [279778.121362] usb 1-2: SerialNumber: postmarketOS [279778.126491] rndis_host 1-2:1.0 usb0: register 'rndis_host' at usb-0000:00:14.0-2, RNDIS device, 4a:cd:d6:82:45:85 [279778.165343] rndis_host 1-2:1.0 enp0s20f0u2: renamed from usb0
and in ip addr on PC:
79: enp0s20f0u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 1000 link/ether 2a:8a:39:88:72:b8 brd ff:ff:ff:ff:ff:ff inet6 fe80::198c:608d:4538:79a/64 scope link noprefixroute valid_lft forever preferred_lft forever
Here's pmOS_init.log output:
Setup usb network Setting up an USB gadget through android_usb /init: line 394: can't create /sys/class/android_usb/android0/idVendor: Permission denied /init: line 395: can't create /sys/class/android_usb/android0/idProduct: Permission denied sh: write error: No such device Setting up an USB gadget through configfs mkdir: can't create directory '/config/usb_gadget/g1': File exists Couldn't create /config/usb_gadget/g1 mkdir: can't create directory '/config/usb_gadget/g1/functions/rndis.usb0': File exists Couldn't create /config/usb_gadget/g1/functions/rndis.usb0 mkdir: can't create directory '/config/usb_gadget/g1/configs/c.1': File exists Couldn't create /config/usb_gadget/g1/configs/c.1 ln: /config/usb_gadget/g1/configs/c.1/rndis.usb0: File exists Couldn't symlink rndis.usb0 Starting unudhcpd Using interface rndis0 Starting the DHCP daemon Trying to start server with parameters: Server IP addr: 172.16.42.1:67, client IP addr: 172.16.42.2, interface: rndis0 ERROR: boot partition not found! Trying to bind to interface: rndis0 Server started! Received DHCP DISCOVER from client: 2a:8a:39:88:72:b8
Please ignore missing boot partition error. Last line is repeated many times, assumedly due to many attempts by NetworkManager on my PC to obtain a DHCP lease. Despite that, DHCP doesn't actually work and static IP assignment results in "no route to host" on ping, ssh and telnet attempts. I guess that packets PC -> phone go through, but not phone -> PC? Needs more investigation.
It should also be noted that this hook doesn't help at all - nothing in dmesg on PC.
DHCP server takes a lot of time to start?
This is more of a note to self, but: if you're dumping the log to SD card by cat /tmp/init_pmOS.log >> /sdcard/init_pmOS.log once a second, DHCP DISCOVER entries appear after ~ 150 seconds. No idea why. Maybe they'll appear in NCM approach too?
Actually, it's the DHCP server that starts after ~ 150 seconds - the following block appears:
Trying to bind to interface: rndis0 Server started! Received DHCP DISCOVER from client: 2a:8a:39:88:72:b8 Received DHCP DISCOVER from client: 2a:8a:39:88:72:b8 Received DHCP DISCOVER from client: 2a:8a:39:88:72:b8 ...
PC still doesn't get a DHCP lease.
Lack of MAC addresses in ARP table
Both phone and PC has (incomplete) where MAC address of the other device should be.
Miraculous broken telnet connection
I'd also like to note that some time ago, somehow, I managed to get RNDIS working (not sure if DHCP or manual assignment) and was able to telnet into the device (with debug-shell hook), but pressing Return inside shell caused a disconnection. I was able to reconnect a few times without having to reboot the device or anything like that. I could type and autocomplete using Tab to poke around the initramfs, but not much more. Best thing is, I really have no idea how I achieved this - I remember that mere rebuilding of device package broke this. There was some hefty initfs-hook involved I think. I put this section here as a glimmer of hope for anyone else who might want to try working on this phone.
Here is my message on #postmarketos asking for help understanding what happened. Not much luck, sadly.
CDC NCM
Here's a very rough initfs-hook that brings up NCM interface somewhat:
# prevent automatic network setup touch /tmp/_setup_usb_network # adapted from samsung-dream, required for android0 to appear CONFIGFS=/config/usb_gadget mkdir $CONFIGFS/g1 mkdir $CONFIGFS/g1/functions/ncm.usb0 mkdir $CONFIGFS/g1/configs/c.1 ln -s $CONFIGFS/g1/functions/ncm.usb0 $CONFIGFS/g1/configs/c.1 # adapted from LineageOS echo 0 > /sys/class/android_usb/android0/enable echo 0x685d > $CONFIGFS/g1/idProduct echo 0x04e8 > $CONFIGFS/g1/idVendor echo ncm > /sys/class/android_usb/android0/functions echo 2 > $CONFIGFS/g1/bDeviceClass echo "10c00000.dwc3" > $CONFIGFS/g1/UDC echo 1 > /sys/class/android_usb/android0/enable
samsung-dream reference is this hook, LineageOS reference is this part of init.usb_accessory.rc.
dmesg output on PC:
[279564.808997] usb 1-2: new high-speed USB device number 84 using xhci_hcd [279564.951002] usb 1-2: New USB device found, idVendor=04e8, idProduct=685d, bcdDevice= 4.09 [279564.951016] usb 1-2: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [279564.976909] cdc_ncm 1-2:1.0: MAC-Address: 4a:ad:cd:07:2e:77 [279564.977850] cdc_ncm 1-2:1.0 usb0: register 'cdc_ncm' at usb-0000:00:14.0-2, CDC NCM, 4a:ad:cd:07:2e:77
ip addr output on PC:
76: enp0s20f0u2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000 link/ether 76:70:98:24:d4:d6 brd ff:ff:ff:ff:ff:ff
Notice the NO-CARRIER. Connectivity doesn't work - ncm0 interface on phone stays down without IP (but with MAC), possibly due to DHCP server function expecting one of following: rndis0, usb0 and eth0. After patching init_functions.sh to try ncm0, apparently IP assignment fails on that interface for some reason. Needs more investigation.
Disabling DHCP server in deviceinfo and adding:
ifconfig ncm0 172.42.16.1 ( unudhcpd -i ncm0 -s 172.16.42.1 -c 172.16.42.2 ) &
to initfs-hook causes phone to show up in dmesg on PC this way:
[281483.275024] usb 1-2: new high-speed USB device number 96 using xhci_hcd [281483.416922] usb 1-2: New USB device found, idVendor=04e8, idProduct=685d, bcdDevice= 4.09 [281483.416936] usb 1-2: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [281483.445437] cdc_ncm 1-2:1.0: MAC-Address: 56:7e:e2:2c:02:98 [281483.446893] cdc_ncm 1-2:1.0 usb0: register 'cdc_ncm' at usb-0000:00:14.0-2, CDC NCM, 56:7e:e2:2c:02:98 [281483.474033] cdc_ncm 1-2:1.0 enp0s20f0u2: renamed from usb0 [281483.599245] IPv6: ADDRCONF(NETDEV_CHANGE): enp0s20f0u2: link becomes ready
and in ip addr on PC this way:
81: enp0s20f0u2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 06:8a:54:d1:8c:ba brd ff:ff:ff:ff:ff:ff inet6 fe80::198c:608d:4538:79a/64 scope link noprefixroute valid_lft forever preferred_lft forever
but DHCP assignment fails, there are no DHCP DISCOVER entries in init_pmOS.log unlike with RNDIS, and static IP assignment on PC leads to no pings, ssh, telnet, etc. just like with RNDIS above.
After ~ 140 seconds some output from DHCP server suddenly appeared (just like with RNDIS), but it was a bit different:
Trying to bind to interface: ncm0 Server started! Received DHCP DISCOVER from client: 8e:9f:b6:8e:9b:6e Received DHCP REQUEST from client: 8e:9f:b6:8e:9b:6e Received DHCP REQUEST from client: 8e:9f:b6:8e:9b:6e Received DHCP REQUEST from client: 8e:9f:b6:8e:9b:6e Received DHCP REQUEST from client: 8e:9f:b6:8e:9b:6e Received DHCP REQUEST from client: 8e:9f:b6:8e:9b:6e Received DHCP DISCOVER from client: 8e:9f:b6:8e:9b:6e Received DHCP DISCOVER from client: 8e:9f:b6:8e:9b:6e Received DHCP DISCOVER from client: 8e:9f:b6:8e:9b:6e ...
After that it took ~ 420 seconds for another batch of DISCOVERs (no REQUESTs) to appear.
Fairphone_3_(fairphone-fp3) seems to be the only device in pmaports that uses NCM, but it didn't need any special tricks to get it running, unlike this phone.
USB OTG with external NIC
I needed to enable CONFIG_USB_RTL8152 for my USB NIC. However, NIC shows up in kernel logs after ~ 30 seconds since boot, which is way past start_unudhcpd() from init_functions.sh. Maybe enabling debug-shell and delaying boot in initfs-hook will help?
Yes it does. Enabled debug-shell hook, added sleep 40 in initfs-hook.sh and it worked.
- DHCP works
- pings return
- telnet works (and pressing Return doesn't result in segfaults)
Display
Current status
- pmOS splash screen - works
- console, fbkeyboard - screen is black, "echo 0 > blank" shows splash screen, "echo 0,0 > pan" and msm-fb-refresher doesn't help, IIRC disabling decon_release like here didn't help either
- Maybe needs CONFIG_FRAMEBUFFER_CONSOLE=y? This causes kernel panic after 6 seconds though.
- i3wm, lxqt, mate, sxmo-de-dwm, xfce4 - screen works with just msm-fb-refresher
- I guess all X11 based UIs will work?
- weston - won't work anymore since upstream dropped the fbdev backend (pmaports#1431, pmaports!2950) and AFAIK there is no Direct Rendering Management support in vendor kernel
- sxmo-de-sway, sway, phosh - won't work since fbdev is not supported by wlroots and AFAIK there is no DRM support in vendor kernel
Todo
- You can refresh the screen manually with "echo 0,0 > /sys/class/graphics/fb0/pan" or use msm-fb-refresher. When reading Troubleshooting:display#Screen_does_not_refresh I was under the impression that msm-fb-refresher wouldn't be helpful, since "cat modes > mode" didn't refresh screen on this phone. Maybe this note could be added to that wiki page, if true?
Serial debugging
Kernel config has CONFIG_MUIC_MAX77705 enabled. Kernel code (android_kernel_samsung_universal9810/drivers/muic/max77705-muic.c) has this:
static const struct max77705_muic_vps_data muic_vps_table[] = { { .adc = MAX77705_UIADC_523K, .vbvolt = VB_LOW, .chgtyp = CHGTYP_NO_VOLTAGE, .muic_switch = COM_UART, .vps_name = "JIG UART OFF", .attached_dev = ATTACHED_DEV_JIG_UART_OFF_MUIC, }, { .adc = MAX77705_UIADC_523K, .vbvolt = VB_HIGH, .chgtyp = CHGTYP_DONTCARE, .muic_switch = COM_UART, .vps_name = "JIG UART OFF/VB", .attached_dev = ATTACHED_DEV_JIG_UART_OFF_VB_MUIC, }, { .adc = MAX77705_UIADC_619K, .vbvolt = VB_LOW, .chgtyp = CHGTYP_NO_VOLTAGE, .muic_switch = COM_UART, .vps_name = "JIG UART ON", .attached_dev = ATTACHED_DEV_JIG_UART_ON_MUIC, }, { .adc = MAX77705_UIADC_619K, .vbvolt = VB_HIGH, .chgtyp = CHGTYP_DONTCARE, .muic_switch = COM_UART, .vps_name = "JIG UART ON/VB", .attached_dev = ATTACHED_DEV_JIG_UART_ON_VB_MUIC,
Perhaps a serial cable could be made? Serial_debugging:Cable_schematics#Samsung_Galaxy_S7_and_S5
USB OTG
Tested, works: mouse, RTL8152 based NIC, DAC (Fiio E10K).
Issues
- It seems that OTG starts working ~ 30 seconds after boot.
- If phone was rebooted due to kernel panic, OTG adapter needs to be reconnected.
- Xfce battery status icon shows battery as charging whenever OTG adapter is plugged in.
Battery
Charge level reporting and charging works on Xfce, using either wired or wireless charger.
charging-sdl has been disabled in postmarketos-mkinitfs (pmaports#1064, pmaports!2111). I tried doing Charging-sdl#Charge mode not detected, but couldn't get the modified init_functions.sh to appear in initramfs flashed to device.
diff between kernel cmdline when booted into TWRP by button press and when booted into pmOS by charger:
$ diff cmdline_twrp cmdline_charger 41,42c41,42 < sec_debug.reset_reason=9 < sec_reset.reset_reason=9 --- > sec_debug.reset_reason=7 > sec_reset.reset_reason=7 44c44 < sec_debug.pwronsrc=0x1 --- > sec_debug.pwronsrc=0x4
When booted by charger, touch screen, stylus and USB OTG doesn't work.
Audio
So far broken. Without firmware there's only Star-Madera output device available.
samsung-abox complains in dmesg about lack of following firmware: AP_AUDIO_SLSI.bin APBargeIn_AUDIO_SLSI.bin APBiBF_AUDIO_SLSI.bin APDV_AUDIO_SLSI.bin calliope_dram.bin calliope_iva.bin calliope_sram.bin dsm.bin dsm_tune.bin SoundBoosterParam.bin, all from /vendor/firmware. I've also patched /drivers/base/firmware_class.c to include /lib/firmware/postmarketos in fw_path.
abox_rdma output device appears in Xfce volume control once firmware is loaded (which sometimes happens automatically after a few minutes). Manual restart of PulseAudio (killall pulseaudio) sometimes forces firmware to be loaded, sometimes it fails with e.g. samsung-abox-rdma 17c51000.abox_rdma: ASoC: can't open platform 17c51000.abox_rdma: -16
or samsung-abox 17c50000.abox: Invalid calliope state: 0
in dmesg. Once it works, killing PulseAudio one more time causes a kernel panic. One time I've had the kernel panic after opening Xfce audio mixer while Xfce audio widget already had abox_rdma on output list.
There's /etc/SoundBoosterParam.txt in vendor partition, but I'm not sure if it's important.
Bluetooth
By default soft blocked in rfkill. Unblocking it and restarting bluetoothd doesn't fix No default controller available
in bluetoothctl.
Unixbench
======================================================================== BYTE UNIX Benchmarks (Version 5.1.3) System: samsung-crownlte: Linux OS: Linux -- 4.9.218 -- #2-postmarketOS SMP PREEMPT Wed Mar 2 17:43:34 UTC 2022 Machine: aarch64 (unknown) Language: en_US.utf8 (charmap=, collate=) 11:42:14 up 16 min, 0 users, load average: 13.10, 12.52, 8.48; runlevel ------------------------------------------------------------------------ Benchmark Run: Fri Mar 04 2022 11:42:14 - 11:47:03 8 CPUs in system; running 1 parallel copy of tests Dhrystone 2 using register variables 15519098.8 lps (10.0 s, 7 samples) Double-Precision Whetstone 4379.0 MWIPS (10.1 s, 7 samples) System Benchmarks Partial Index BASELINE RESULT INDEX Dhrystone 2 using register variables 116700.0 15519098.8 1329.8 Double-Precision Whetstone 55.0 4379.0 796.2 ======== System Benchmarks Index Score (Partial Only) 1029.0 ------------------------------------------------------------------------ Benchmark Run: Fri Mar 04 2022 11:47:03 - 11:51:58 8 CPUs in system; running 8 parallel copies of tests Dhrystone 2 using register variables 85154028.8 lps (10.0 s, 7 samples) Double-Precision Whetstone 27623.8 MWIPS (9.8 s, 7 samples) System Benchmarks Partial Index BASELINE RESULT INDEX Dhrystone 2 using register variables 116700.0 85154028.8 7296.8 Double-Precision Whetstone 55.0 27623.8 5022.5 ======== System Benchmarks Index Score (Partial Only) 6053.8
See also
- Device package
- Kernel package
- Firmware package
- Another kernel port with plenty of working features (including USB networking): XDA thread, GitHub repo
- pmaports!1699 - samsung-dream2lte MR, has USB networking discussion
- pmaports!1725 - Combined samsung-dream MR
- pmaports!1843 - samsung-dream color order fix and different networking setup in initfs-hook.sh (the one that also works for crownlte)