ModemFirmwarePartitions¶

Modem partitions¶

Name	Content	GT-I9100	GT-N7000	GT-I9250	GT-I9300	GT-N7100	GT-P3100	GT-N5100	GT-P5100
TOC	Partition table	None			[ 0x0 -> 0xfff ]				TODO
PSIRAM	First stage bootloader	[ 0x0 -> 0xefff ]			[ 0x1000 -> 0xefff ]
EBL	Second stage bootloader ?	[ 0xF000 -> 0x27fff ]
MAIN	?	[ 0x28000 -> 0x9fffff ]			[ 0x28000 -> 0x9ff7ff ]
SECPACK	?	[ 0x9ff800 -> 0x9fffff ]
NV	nvdata default values	[ 0xa00000 -> 0xbfffff ]

Name	Content	aries
TOC	Partition table	None
PSIRAM	First stage bootloader	[ 0x0-> 0x4fff ]
MAIN?	Modem firmware? Is it splitable?	[ 0x5000 -> 0x9fffff ]
NV	? (/efs/nv_data.bin loaded instead)
Filled with only 0xffff		[ 0xa00000 -> 0xbfffff ]
Modem firmware size		12 MiB

Name	Content	crespo
TOC	Partition table	\ None
PSIRAM	First stage bootloader	[ 0x0-> 0x4fff ]
MAIN?	Modem firmware? Is it splitable?	[ 0x5000 -> 0x9fffff ]
NV	? (/efs/nv_data.bin loaded instead)
Beside very few data (144 bytes starting at 0xc00000 ), it's filled with 0xFFs	[ 0xa00000 -> 0xd7ffff ]
Modem firmware size		13.5 MiB

And the respective libsamsung-ipc functions:

Partition	Content	aries	crespo	GT-I9100	GT-N7000	GT-I9250	GT-I9300	GT-N7100	GT-P3100	GT-P5100	GT-N5100
PSIRAM	First stage bootloader	xmm616_psi_send		xmm626_hsic_psi_send		xmm626_mipi_psi_send	xmm626_hsic_psi_send		xmm626_mipi_psi_send		xmm626_hsic_psi_send
EBL	Second stage bootloader ?	?		xmm626_hsic_ebl_send		xmm626_mipi_ebl_send	xmm626_hsic_ebl_send		xmm626_mipi_ebl_send		xmm626_hsic_ebl_send
MAIN	?	xmm616_firmware_send		xmm626_hsic_firmware_send		xmm626_mipi_firmware_send	xmm626_hsic_firmware_send		xmm626_mipi_firmware_send		xmm626_hsic_firmware_send
SECPACK	?	?		xmm626_hsic_sec_start_send		xmm626_mipi_sec_start_send	xmm626_hsic_sec_start_send		xmm626_mipi_sec_start_send		xmm626_hsic_sec_start_send
NV	nvdata default values	xmm616_nv_data_send		xmm626_hsic_nv_data_send		xmm626_mipi_nv_data_send	xmm626_hsic_nv_data_send		xmm626_mipi_nv_data_send		xmm626_hsic_nv_data_send

At least some of these functions can be merged together if we have a modem_data_send function:

• The only difference between xmm626_mipi_nv_data_send and xmm626_mipi_hsic_data_send is the use of xmm626_mipi_modem_data_send vs xmm626_hsic_modem_data_send

TODO: find the place in libsamsung-ipc source mentioning that

References for the table:

• https://git.replicant.us/replicant/hardware_replicant_libsamsung-ipc/tree/samsung-ipc/devices/i9300/i9300.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc
• https://git.replicant.us/replicant/hardware_replicant_libsamsung-ipc/tree/samsung-ipc/devices/n7100/n7100.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc
• Verified on GT-I9300 and GT-N7100 modem partition table

GT-I9300, GT-N7100, GT-P3100 modem partition table dump¶

TODO:

• Send patch for the modem-partition-tool
• Make sure that we know the device from the command line
• Understand the field depths along the way when supporting more devices
• Document all other devices that don't have this partition table
• Find the name of this partition table

$ hexdump -C RADIO.img
00000000  50 53 49 52 41 4d 00 00  00 00 00 00 00 10 00 00  |PSIRAM..........|
00000010  00 00 00 00 00 e0 00 00  00 00 00 00 00 00 00 00  |................|
00000020  45 42 4c 00 00 00 00 00  00 00 00 00 00 f0 00 00  |EBL.............|
00000030  00 00 00 60 00 90 01 00  00 00 00 00 00 00 00 00  |...`............|
00000040  4d 41 49 4e 00 00 00 00  00 00 00 00 00 80 02 00  |MAIN............|
00000050  00 00 30 60 00 78 9d 00  00 00 00 00 00 00 00 00  |..0`.x..........|
00000060  53 45 43 50 41 43 4b 00  00 00 00 00 00 f8 9f 00  |SECPACK.........|
00000070  00 00 00 00 00 08 00 00  00 00 00 00 00 00 00 00  |................|
00000080  4e 56 00 00 00 00 00 00  00 00 00 00 00 00 a0 00  |NV..............|
00000090  00 00 e8 60 00 00 20 00  00 00 00 00 00 00 00 00  |...`.. .........|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
[...]

Devices with a different partition table¶

• The devices with a Qualcomm modem like the GT-I9305 and the GT-N7105 have individual files inside the vfat modem partition. See the Samsung_Midas_4G on the quectel-modems osmocom project for more details.

Unknown¶

We would need to get a device and dump the modem firmware to check, but given the offset of the PSIRAM, it probably contains the same header:

• Galaxy Note 8.0
• GT-P5100 is untested but but it's probably similar to the GT-P3100