Issue #2141


Enable reboot to recovery and reboot to bootloader

Added by Denis 'GNUtoo' Carikli almost 2 years ago. Updated 5 months ago.

Target version:
Start date:
Due date:
% Done:


Estimated time:
Galaxy S 3 (I9300), Galaxy S 3 4G (I9305), Unknown
Type of work:
User testing
Actions #1

Updated by Denis 'GNUtoo' Carikli almost 2 years ago

reboot command -> [...] -> setprop sys.powerctl "reboot,shell" -> picked by init -> kernel -> sec-reboot.c

So we have:

"#define S3C_ADDR(x) (S3C_ADDR_BASE + (x))" at

"#define S5P_VA_PMU S3C_ADDR(0x02180000)" at

#define S5P_PMUREG(x) (S5P_VA_PMU + (x)) at

"#define S5P_INFORM3 S5P_PMUREG (0x080C)" at


So S5P_INFORM3 should be 0xFC000000 + 0x02180000 + 0x080C = 0xFE18080C

"reboot-mode" seem to be used for that in dts nowadays. See Documentation/devicetree/bindings/power/reset/reboot-mode.txt.

Actions #2

Updated by Denis 'GNUtoo' Carikli almost 2 years ago

The patch is mostly done but it needs a bit more testing.

  • So far rebooting to the download mode has been tested, but not extensively.
  • Rebooting to normal needs to be tested: the original driver rebooted to normal when reboot had no arguments.
Actions #3

Updated by Denis 'GNUtoo' Carikli almost 2 years ago

Issues found so far:

  • Reboot to download mode results in a non-working download mode (sudo heimdall close-pc-screen doesn't work) while doing a power off and pressing the right buttons work.
  • Reboot to recovery works fine now, however selecting "reboot system now" results in it rebooting to the recovery again. It probably needs to clear what is in the INFORM3 register. If instead I use 'reboot normal' it reboots to Replicant.
  • It also doesn't charge properly, but that needs to be implemented in a power off driver instead.
Actions #4

Updated by Denis 'GNUtoo' Carikli almost 2 years ago

At second look it looks less clear: If no argument is passed to the reboot system call, it uses the normal reboot mode. However 'reboot normal' seem to work fine. Testing again with the new code also seem to work for rebooting from the recovery to Android.

The download mode still fails though.

Actions #5

Updated by Denis 'GNUtoo' Carikli almost 2 years ago

For the download mode, the device doesn't show up in lsusb

$ heimdall close-pc-screen --usb-log-level debug
Heimdall v1.4.2

Copyright (c) 2010-2017 Benjamin Dobell, Glass Echidna

This software is provided free of charge. Copying and redistribution is

If you appreciate this software and you would like to support future
development please consider donating:

Initialising connection...
Detecting device...
[timestamp] [threadID] facility level [function call] <message>
[ 0.008974] [00007e19] libusb: debug [libusb_get_device_list] 
[ 0.009026] [00007e19] libusb: debug [discovered_devs_append] need to increase capacity
[ 0.009074] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009095] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009121] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009141] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009167] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009188] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009270] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009281] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009288] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009295] [00007e19] libusb: debug [libusb_get_device_descriptor] 
[ 0.009380] [00007e19] libusb: debug [libusb_get_device_descriptor] 
ERROR: Failed to detect compatible download-mode device.
[ 0.009478] [00007e19] libusb: debug [libusb_exit] 
[ 0.009486] [00007e19] libusb: debug [libusb_exit] destroying default context
[ 0.009567] [00007e19] libusb: debug [libusb_handle_events_timeout_completed] doing our own event handling
[ 0.009578] [00007e19] libusb: debug [handle_events] poll fds modified, reallocating
[ 0.009596] [00007e19] libusb: debug [handle_events] poll() 2 fds with timeout in 0ms
[ 0.009675] [00007e19] libusb: debug [handle_events] poll() returned 0
[ 0.009684] [00007e19] libusb: debug [libusb_unref_device] destroy device 2.1
[ 0.009775] [00007e19] libusb: debug [libusb_unref_device] destroy device 8.1
[ 0.009853] [00007e19] libusb: debug [libusb_unref_device] destroy device 7.1
[ 0.009929] [00007e19] libusb: debug [libusb_unref_device] destroy device 6.1
[ 0.010008] [00007e19] libusb: debug [libusb_unref_device] destroy device 1.26
[ 0.013279] [00007e19] libusb: debug [libusb_unref_device] destroy device 1.14
[ 0.013295] [00007e19] libusb: debug [libusb_unref_device] destroy device 1.1
[ 0.013302] [00007e19] libusb: debug [libusb_unref_device] destroy device 5.1
[ 0.013310] [00007e19] libusb: debug [libusb_unref_device] destroy device 4.6
[ 0.013318] [00007e19] libusb: debug [libusb_unref_device] destroy device 4.1
[ 0.013325] [00007e19] libusb: debug [libusb_unref_device] destroy device 3.1
[ 0.013333] [00007e19] libusb: debug [usbi_remove_pollfd] remove fd 6
[ 0.013361] [00007e19] libusb: debug [usbi_remove_pollfd] remove fd 8
[ 0.013512] [00007e1a] libusb: debug [linux_udev_event_thread_main] udev event thread exiting

Heimdall log says the same (cannot find the usb descriptors)

We may need a shutdown driver or to verify that we are really in LPM mode.

Actions #6

Updated by Javi Ferrer over 1 year ago

I think I've understood what this line does:

writel(0x12345678, S5P_INFORM2); /* Don't enter lpm mode */

The bootloader shows a first battery bitmap when booting into LPM. When not booting into LPM, it shows a bitmap with text "Galaxy S3 ..."
Maybe the bootloader do other things besides showing one bitmap or the other.

Booting from recovery -> System shows the LPM battery bitmap so I guess the current implementation of reboot in dtsi doesn't write the magic into S5P_INFORM2 address before rebooting. I fear, an own reboot code should be created.

Actions #7

Updated by _I3^ RELATIVISM over 1 year ago

  • Type of work User testing added
Actions #8

Updated by Belgin Stirbu 5 months ago

I got a functional downoad mode by changing S5P_INFORM2 from 0xF008, to 0x0808, in the relevant dtsi, as found here

On Alpine (pmos) you have to install from apk and use the program reboot-mode (sudo reboot-mode download), as it won't work with the default busybox reboot program.


Also available in: Atom PDF