Samsung Galaxy S24 Ultra (samsung-e3q)

Samsung Galaxy S24 Ultra

File:Samsung-e3q.jpg
Manufacturer	Samsung
Name	Galaxy S24 Ultra
Codename	samsung-e3q
Model	SM-S928B
Released	2024
Type	handset
Hardware
Chipset	Qualcomm Snapdragon 8 Gen 3 (SM8650-AC)
CPU	8-core (1x3.40GHz Cortex-X4 & 3x3.15GHz Cortex-A720 & 2x2.96GHz Cortex-A720 & 2x2.26GHz Cortex-A520)
GPU	Adreno 750
Display	1440 x 3120 (120Hz 6.8" LTPO AMOLED)
Storage	256 GB / 512 GB / 1 TB
Memory	12 GB
Architecture	aarch64
Software
Original software	Android (One UI)
Original version	14 (One UI 6.1)
postmarketOS
Category	testing
Pre-built images	no
Mainline	partial

This device is marked as not booting.

Users owning this device

• Ungeskriptet (Notes: LineageOS porting victim)

How to enter flash mode

• Download mode: Hold Volume Up and Volume Down while connecting the device to a computer with a USB cable.
• Recovery mode: Hold Volume Up and Power while connecting the device to a computer with a USB cable.

How to unlock bootloader

WARNING: This process will wipe all user data and will irreversibly trip Knox.

1. Enable OEM unlocking in the developer options
2. Reboot into download mode
3. At the blue warning screen, hold Volume Up
4. On the second screen, press Volume Up to unlock the bootloader

Mainline

A work-in-progress mainline kernel is being developed here. (Will be upstreamed as soon as possible)

Mainline status and hardware

Component	Model	Status	Mainline driver available?	Notes
Display	Samsung E3_S6E3HAF_AMB679FN01	N	N	Command mode, DSC, Single DSI
Touchscreen	Synaptics S3916T	N	N
Pen input	Wacom WEZ02	N	N
USB-C	USB 2.0 (TI eUSB2 repeater)	Y	P	Driver from sm8450-mainline
	USB 3.1 Gen 2	N	Y	Booting with fw_devlink=permissive breaks USB
	DisplayPort	N	Y
Camera	Samsung ISOCELL S5KHP2	N	N	Main camera
	Samsung ISOCELL S5K3LU	N	N	Front camera
	Sony IMX564	N	N	Ultrawide
	Sony IMX754	N	N	Telephoto
	Sony IMX854	N	N	Periscope Telephoto
Accelerometer & Gyroscope	STMicroelectronics LSM6DSV / LSM6DSO	N	Y	Datasheet
Ambient light sensor	Sensortek STK33F11	N	N	Front
	Sensortek STK6D2X	N	N	Rear, maybe for laser autofocus?
Proximity sensor	Samsung Palm Proximity Sensor V2	N	N	Virtual sensor :/
Magnetometer	AKM AK09918	N	N	Datasheet
Barometer	STMicroelectronics LPS22DF	N	Y	Datasheet
Hall effect	Hall IC	N	N
Charger	NXP PCA9481	N	N	Datasheet; Direct charger
	NuVolta NU1668	N	N	Wireless charger
PMIC	Maxim MAX77775	N	N	Fuel gauge & main charger
	Samsung S2DOS07	N	N	Display PMIC
	Samsung S2MPB03	N	N	Camera PMIC
	Samsung S2MPB02	N	N	Camera PMIC
eSIM	Samsung S3K250AF	N	N
NFC	NXP PN547	N	Y
Audio	Cirrus Logic CS35L43	N	N	2x, One for each speaker
Haptics	Cirrus Logic CS40L26	N	P	Driver available on LKML
Fingerprint sensor	Qualcomm QFS4008	N	N

MAX77775 MUIC

The MAX77775 MUIC *should* be able to mux the USB-C pins to AP/CP UART with a 619kΩ resistor. The pinout for a UART cable that works with the S24 Ultra is unknown as of now. Notes:

• Shorting SBU1 (Pin A8) to GND makes the phone think water is in the USB-C port

Miscellaneous info

Creating empty dtbo image

Simply erasing the dtbo partition is not enough to make mainline boot on this phone. In order to make it boot we need to sign an empty dtbo image with avbtool:

$ dd if=/dev/zero of=empty_dtbo.img count=1
$ avbtool add_hash_footer --partition_name dtbo --partition_size 16777216 --image empty_dtbo.img
$ heimdall flash --DTBO empty_dtbo.img

If the phone still boots to the blue download screen, make sure stock vbmeta is flashed.

simplefb

Since at least the "SM Gen 4"/Waipio era, abl checks if a node named exactly /reserved-memory/splash_region exists in the device tree. If not, it will disable the display hardware:

ret = FdtPathOffset (fdt, "/reserved-memory/splash_region");
if (ret < 0) {
  DEBUG ((EFI_D_WARN, "Splash region not found in device tree, " \
                      "powering down the display and controller\n"));

Command to create boot.img

$ make O=output-e3q ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) defconfig sm8650.config
$ make O=output-e3q ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) &&
rm -f output-e3q/arch/arm64/boot/Image-dtb output-e3q/arch/arm64/boot/boot.img &&
cat output-e3q/arch/arm64/boot/Image.gz output-e3q/arch/arm64/boot/dts/qcom/sm8650-samsung-e3q.dtb > output-e3q/arch/arm64/boot/Image-dtb &&
mkbootimg --kernel output-e3q/arch/arm64/boot/Image-dtb \
        --ramdisk /tmp/postmarketOS-export/initramfs \
        --pagesize 4096 \
        --kernel_offset 0x8000 \
        --ramdisk_offset 0x2000000 \
        --second_offset 0x0 \
        --tags_offset 0x0 \
        --header_version 0 \
        -o output-e3q/arch/arm64/boot/boot.img &&
(adb reboot download; heimdall flash --BOOT output-e3q/arch/arm64/boot/boot.img)

Partition map

e3q:/ # ls -lah /dev/block/by-name/

total 0
drwxr-xr-x 2 root root 1.6K 1970-02-02 01:33 .
drwxr-xr-x 5 root root 2.3K 1970-02-02 01:33 ..
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 abl -> /dev/block/sdd4
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 aop -> /dev/block/sdd3
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 aop_config -> /dev/block/sdd22
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 apdp -> /dev/block/sdb3
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 apnhlos -> /dev/block/sda23
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 bksecapp -> /dev/block/sdd5
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 boot -> /dev/block/sda27
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 bota -> /dev/block/sda19
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 btd -> /dev/block/sdd16
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 cache -> /dev/block/sda36
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 cdt -> /dev/block/sda12
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 connsec -> /dev/block/sda41
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 cpucp -> /dev/block/sdd23
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 cpucp_dtb -> /dev/block/sdd24
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 ddr -> /dev/block/sda10
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 debug -> /dev/block/sda8
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 devcfg -> /dev/block/sdd7
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 devinfo -> /dev/block/sda15
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 dsp -> /dev/block/sda22
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 dtbo -> /dev/block/sda38
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 efs -> /dev/block/sda6
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 em -> /dev/block/sdd15
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 frp -> /dev/block/sda14
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 fsc -> /dev/block/sda3
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 fsg -> /dev/block/sdd1
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 hdm -> /dev/block/sdd19
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 hyp -> /dev/block/sdd17
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 imagefv -> /dev/block/sdd10
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 init_boot -> /dev/block/sda28
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 keymaster -> /dev/block/sdd6
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 limits -> /dev/block/sda16
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 limits-cdsp -> /dev/block/sda17
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 logfs -> /dev/block/sda45
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 metadata -> /dev/block/sda25
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 misc -> /dev/block/sda13
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 modem -> /dev/block/sda26
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 modemst1 -> /dev/block/sda1
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 modemst2 -> /dev/block/sda2
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 omr -> /dev/block/sda37
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 optics -> /dev/block/sda35
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 pad -> /dev/block/sdc3
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 param -> /dev/block/sda7
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 persist -> /dev/block/sda5
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 persistent -> /dev/block/sda20
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 prism -> /dev/block/sda34
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 pvmfw -> /dev/block/sda32
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 qupfw -> /dev/block/sdd9
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 qweslicstore -> /dev/block/sda40
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 rawdump -> /dev/block/sda18
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 recovery -> /dev/block/sda29
lrwxrwxrwx 1 root root   14 1970-02-02 01:33 sda -> /dev/block/sda
lrwxrwxrwx 1 root root   14 1970-02-02 01:33 sdb -> /dev/block/sdb
lrwxrwxrwx 1 root root   14 1970-02-02 01:33 sdc -> /dev/block/sdc
lrwxrwxrwx 1 root root   14 1970-02-02 01:33 sdd -> /dev/block/sdd
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 sec_efs -> /dev/block/sda9
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 secdata -> /dev/block/sdd12
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 shrm -> /dev/block/sdd26
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 ssd -> /dev/block/sda4
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 steady -> /dev/block/sda21
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 storsec -> /dev/block/sdd8
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 super -> /dev/block/sda33
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 toolsfv -> /dev/block/sda44
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 tz -> /dev/block/sdd2
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 tz_kg -> /dev/block/sdd20
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 tziccc -> /dev/block/sdd18
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 tzsc -> /dev/block/sda42
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 uefi -> /dev/block/sdd21
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 uefisecapp -> /dev/block/sdd11
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 uefivarstore -> /dev/block/sdd13
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 userdata -> /dev/block/sda46
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 vbmeta -> /dev/block/sda39
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 vbmeta_system -> /dev/block/sda24
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 vendor_boot -> /dev/block/sda30
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 vk -> /dev/block/sdd14
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 vm-bootsys -> /dev/block/sda31
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 xbl -> /dev/block/sdb1
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 xbl_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 xbl_config -> /dev/block/sdb2
lrwxrwxrwx 1 root root   15 1970-02-02 01:33 xbl_config_b -> /dev/block/sdc2
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 xbl_ramdump -> /dev/block/sdd25
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 xbl_sc_logs -> /dev/block/sda43
lrwxrwxrwx 1 root root   16 1970-02-02 01:33 xbl_sc_test_mode -> /dev/block/sda11

See also

• GSMArena page
• Device Info HW page
• TWRP download
• Firmware archive
• In-depth disassembly video (in Chinese)
• TechInsights Article (Saved as image to bypass login requirement)
• Mainboard picture (from TechInsights)
• Repair guide