Samsung Galaxy S24 Ultra (samsung-e3q)

== Users owning this device ==
== How to enter flash mode ==
* Download mode: Hold and while connecting the device to a computer with a USB cable.
* Recovery mode: Hold and while connecting the device to a computer with a USB cable.
== How to unlock bootloader ==
# Enable OEM unlocking in the developer options
# Reboot into download mode
# At the blue warning screen, hold 
# On the second screen, press to unlock the bootloader
== Mainline ==
A work-in-progress mainline kernel is being developed here. (Will be upstreamed as soon as possible)
=== Mainline status and hardware ===
Component 	Model 	Status	Mainline driver available?	Notes
Display 	Samsung E3_S6E3HAF_AMB679FN01 	N 	N 	Command mode, DSC, Single DSI
Touchscreen 	Synaptics S3916T 	N 	N 	
Pen input 	Wacom WEZ02 	N 	N 	
USB-C 	USB 2.0 (TI eUSB2 repeater) 	Y 	P 	Driver from sm8450-mainline
USB-C 	USB 3.1 Gen 2 	N 	Y 	Booting with fw_devlink=permissive breaks USB
USB-C 	DisplayPort 	N 	Y 	
Camera 	Samsung ISOCELL S5KHP2 	N 	N 	Main camera
Camera 	Samsung ISOCELL S5K3LU 	N 	N 	Front camera
Camera 	Sony IMX564 	N 	N 	Ultrawide
Camera 	Sony IMX754 	N 	N 	Telephoto
Camera 	Sony IMX854 	N 	N 	Periscope Telephoto
Accelerometer & Gyroscope	STMicroelectronics LSM6DSV / LSM6DSO	N 	Y 	Datasheet
Ambient light sensor 	Sensortek STK33F11 	N 	N 	Front
Ambient light sensor 	Sensortek STK6D2X 	N 	N 	Rear
Time-of-Flight Sensor 	STMicroelectronics VL53L8 	N 	N 	Rear laser autofocus
Proximity sensor 	Samsung Palm Proximity Sensor V2 	N 	N 	Virtual sensor :/
Magnetometer 	AKM AK09918 	N 	N 	Datasheet
Barometer 	STMicroelectronics LPS22DF 	N 	Y 	Datasheet
Hall effect 	Hall IC 	N 	N 	GPIO 98 on main pinctrl, located in the lower right
Charger 	NXP PCA9481 	N 	N 	Datasheet; Direct charger
Charger 	NuVolta NU1668 	N 	N 	Wireless charger
PMIC 	Maxim MAX77775 	N 	N 	Fuel gauge & main charger
PMIC 	Samsung S2DOS07 	N 	N 	Display PMIC
PMIC 	Samsung S2MPB03 	N 	N 	Camera PMIC
PMIC 	Samsung S2MPB02 	N 	N 	Camera PMIC
eSIM 	Samsung S3K250AF 	N 	N 	
NFC 	NXP PN547 	N 	Y 	
Audio 	Cirrus Logic CS35L43 	N 	N 	2x, One for each speaker
Haptics 	Cirrus Logic CS40L26 	N 	P 	Driver available on LKML
Fingerprint sensor 	Qualcomm QFS4008 	N 	N 	
== MAX77775 MUIC ==
The MAX77775 MUIC *should* be able to mux the USB-C pins to AP/CP UART with a 619kΩ resistor. The pinout for a UART cable that works with the S24 Ultra is unknown as of now.
Notes:
* Shorting SBU1 (Pin A8) to GND makes the phone think water is in the USB-C port
== Miscellaneous info ==
=== Creating empty dtbo image ===
Simply erasing the dtbo partition is not enough to make mainline boot on this phone. In order to make it boot we need to sign an empty dtbo image with avbtool:
$ dd if=/dev/zero of=empty_dtbo.img count=1
$ avbtool add_hash_footer --partition_name dtbo --partition_size 16777216 --image empty_dtbo.img
$ heimdall flash --DTBO empty_dtbo.img
If the phone still boots to the blue download screen, make sure stock vbmeta is flashed.
=== simplefb ===
Since at least the "SM Gen 4"/Waipio era, abl checks if a node named exactly /reserved-memory/splash_region exists in the device tree. If not, it will disable the display hardware:
ret = FdtPathOffset (fdt, "/reserved-memory/splash_region");
if (ret < 0) {
 DEBUG ((EFI_D_WARN, "Splash region not found in device tree, " \
 "powering down the display and controller\n"));
=== Command to create boot.img ===
$ make O=output-e3q ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) defconfig sm8650.config
$ make O=output-e3q ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- -j$(nproc) &&
rm -f output-e3q/arch/arm64/boot/Image-dtb output-e3q/arch/arm64/boot/boot.img &&
cat output-e3q/arch/arm64/boot/Image.gz output-e3q/arch/arm64/boot/dts/qcom/sm8650-samsung-e3q.dtb > output-e3q/arch/arm64/boot/Image-dtb &&
mkbootimg --kernel output-e3q/arch/arm64/boot/Image-dtb \
 --ramdisk /tmp/postmarketOS-export/initramfs \
 --pagesize 4096 \
 --kernel_offset 0x8000 \
 --ramdisk_offset 0x2000000 \
 --second_offset 0x0 \
 --tags_offset 0x0 \
 --header_version 0 \
 -o output-e3q/arch/arm64/boot/boot.img &&
(adb reboot download; heimdall flash --BOOT output-e3q/arch/arm64/boot/boot.img)
=== Partition map ===
e3q:/ # ls -lah /dev/block/by-name/
total 0
drwxr-xr-x 2 root root 1.6K 1970-02-02 01:33 .
drwxr-xr-x 5 root root 2.3K 1970-02-02 01:33 ..
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 abl -> /dev/block/sdd4
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 aop -> /dev/block/sdd3
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 aop_config -> /dev/block/sdd22
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 apdp -> /dev/block/sdb3
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 apnhlos -> /dev/block/sda23
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 bksecapp -> /dev/block/sdd5
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 boot -> /dev/block/sda27
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 bota -> /dev/block/sda19
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 btd -> /dev/block/sdd16
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 cache -> /dev/block/sda36
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 cdt -> /dev/block/sda12
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 connsec -> /dev/block/sda41
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 cpucp -> /dev/block/sdd23
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 cpucp_dtb -> /dev/block/sdd24
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 ddr -> /dev/block/sda10
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 debug -> /dev/block/sda8
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 devcfg -> /dev/block/sdd7
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 devinfo -> /dev/block/sda15
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 dsp -> /dev/block/sda22
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 dtbo -> /dev/block/sda38
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 efs -> /dev/block/sda6
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 em -> /dev/block/sdd15
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 frp -> /dev/block/sda14
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 fsc -> /dev/block/sda3
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 fsg -> /dev/block/sdd1
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 hdm -> /dev/block/sdd19
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 hyp -> /dev/block/sdd17
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 imagefv -> /dev/block/sdd10
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 init_boot -> /dev/block/sda28
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 keymaster -> /dev/block/sdd6
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 limits -> /dev/block/sda16
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 limits-cdsp -> /dev/block/sda17
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 logfs -> /dev/block/sda45
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 metadata -> /dev/block/sda25
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 misc -> /dev/block/sda13
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 modem -> /dev/block/sda26
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 modemst1 -> /dev/block/sda1
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 modemst2 -> /dev/block/sda2
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 omr -> /dev/block/sda37
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 optics -> /dev/block/sda35
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 pad -> /dev/block/sdc3
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 param -> /dev/block/sda7
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 persist -> /dev/block/sda5
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 persistent -> /dev/block/sda20
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 prism -> /dev/block/sda34
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 pvmfw -> /dev/block/sda32
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 qupfw -> /dev/block/sdd9
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 qweslicstore -> /dev/block/sda40
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 rawdump -> /dev/block/sda18
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 recovery -> /dev/block/sda29
lrwxrwxrwx 1 root root 14 1970-02-02 01:33 sda -> /dev/block/sda
lrwxrwxrwx 1 root root 14 1970-02-02 01:33 sdb -> /dev/block/sdb
lrwxrwxrwx 1 root root 14 1970-02-02 01:33 sdc -> /dev/block/sdc
lrwxrwxrwx 1 root root 14 1970-02-02 01:33 sdd -> /dev/block/sdd
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 sec_efs -> /dev/block/sda9
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 secdata -> /dev/block/sdd12
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 shrm -> /dev/block/sdd26
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 ssd -> /dev/block/sda4
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 steady -> /dev/block/sda21
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 storsec -> /dev/block/sdd8
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 super -> /dev/block/sda33
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 toolsfv -> /dev/block/sda44
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 tz -> /dev/block/sdd2
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 tz_kg -> /dev/block/sdd20
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 tziccc -> /dev/block/sdd18
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 tzsc -> /dev/block/sda42
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 uefi -> /dev/block/sdd21
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 uefisecapp -> /dev/block/sdd11
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 uefivarstore -> /dev/block/sdd13
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 userdata -> /dev/block/sda46
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 vbmeta -> /dev/block/sda39
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 vbmeta_system -> /dev/block/sda24
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 vendor_boot -> /dev/block/sda30
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 vk -> /dev/block/sdd14
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 vm-bootsys -> /dev/block/sda31
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 xbl -> /dev/block/sdb1
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 xbl_b -> /dev/block/sdc1
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 xbl_config -> /dev/block/sdb2
lrwxrwxrwx 1 root root 15 1970-02-02 01:33 xbl_config_b -> /dev/block/sdc2
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 xbl_ramdump -> /dev/block/sdd25
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 xbl_sc_logs -> /dev/block/sda43
lrwxrwxrwx 1 root root 16 1970-02-02 01:33 xbl_sc_test_mode -> /dev/block/sda11
== See also ==
* GSMArena page
* Device Info HW page
* Firmware archive
* In-depth disassembly video (in Chinese)
* TechInsights Article (Saved as image to bypass login requirement)
* Mainboard picture (from TechInsights)
* Repair guide