← ALL PROJECTS
DRAFTFIG. ZUCCHINI-LNX
ACTIVE // HARDWAREQualcomm MSM8937Arch Linux ARM64AVB 2.0 Bypass
LineageOS GSI FallbackEDL Sahara 9008

ZUCCHINI-LINUX - Bare-Metal Bring-Up

1. the problem

OEM tablets are designed as disposable media consumption slabs locked to obsolete Android versions with zero native kernel control. The Samsung Galaxy Tab A (SM-T295) ships with an enforced Knox bootloader and locked Knox partitions. Hardware you can't install Linux on isn't hardware you own: turning locked ARM64 silicon into a daily-driver Arch workstation.

INTERACTIVE PIPELINEClick any box to inspect architecture
edl 9008 dumpqualcomm saharafirehose raw eMMClow-level dumpbootloader patch• AVB 2.0 disarmed• dm-verity disabled• unlocked executionabl / xbl patcheddual-boot menuvolume key interruptfbcon visual promptpayload switcherinitramfs hookARCHARM64Lineagebare-metal
STAGE 01 // Qualcomm Sahara EDL 9008

ROLE: Hardware test-point short to force Qualcomm Emergency Download (EDL) mode 9008 via USB, bypassing Android OS and Knox hypervisor.

$ lsusb -d 05c6:9008 Bus 001 Device 014: ID 05c6:9008 Qualcomm HS-USB QDLoader 9008 $ python3 edl.py --loader prog_emmc_firehose_8937.mbn --dump-all raw_backup/ [OK] Read 62,537,728 sectors (30,536 MB) at 19.4 MB/s [OK] Partitions verified: aboot, boot, system, vendor, userdata, modem
INVARIANT: Sector-accurate raw eMMC dump before modifying single byte of flash.
FAILURE GUARD: Watchdog USB packet drops isolated via hardware flow control chunks (64KB buffers).

2. what i built

Reverse engineering and bare-metal bring-up on Qualcomm MSM8937 hardware:

Qualcomm Sahara EDL dump
initramfs hardware key hook
LineageOS dual-boot fallback
AVB 2.0 signature bypass
Arch Linux ARM64 rootfs
battery gas-gauge calibration
raw eMMC partition table
fbcon framebuffer driver

3. problems i had to crack

Click card to view root cause & code diff
Asahara firehose timeout
▼ DIFF

Qualcomm EDL protocol reset the USB connection before raw partition dumps completed. The emergency programmer timed out on large eMMC sector ranges. Fix: patched edl.py with hardware flow control and chunked 64KB transfer buffers.

Bavb 2.0 loop on boot
▼ DIFF

Modifying the kernel image tripped Android Verified Boot 2.0 cryptographic tree validation, sending the tablet into recovery. Fix: authored a patched vbmeta.img with flag --flags 2 disabling verification checks entirely.

Cframebuffer black screen
▼ DIFF

The Arch Linux kernel booted, but the Qualcomm display driver kept backlight off without Android SurfaceFlinger. Fix: configured native fbcon framebuffer console redirection directly in the kernel commandline arguments with forced panel power-on sequencing.

Dtouchscreen matrix inverted
▼ DIFF

The FocalTech FT5446 touch driver loaded, but coordinates on the portrait panel were transposed 90 degrees with inverted Y-axis. Fix: authored a custom udev rule and libinput calibration matrix mapped to the physical panel geometry.

OPEN HARDWARE PROJECT. Full bring-up logs, EDL scripts, and kernel patches documented.

PROJECTZUCCHINI-LINUX
DRAWN BYBIDYA B. NANDA
STATUSACTIVE // HARDWARE
← BROCCOLI
NEXT: HOSHCARE CLIENT →