Project

General

Profile

SamsungSerial » History » Version 14

Paul Kocialkowski, 09/11/2011 04:31 PM

1 1 Denis 'GNUtoo' Carikli
== Introduction ==
2
This page contains information on how to work on a bootloader replacement.
3 2 Denis 'GNUtoo' Carikli
4
== Informations ==
5 3 Denis 'GNUtoo' Carikli
 * The [http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary official u-boot source code] already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses
6
 * The S5PC110 has a bootrom
7 4 Denis 'GNUtoo' Carikli
 * The Nexus S has an usb port with an FSA9480 behind it
8
9 8 Paul Kocialkowski
=== Partitioning informations ===
10
11
Here's a detailed output showing the partitioning of the NAND that you can obtain with {{{ heimdall print-pit }}} with the device in download mode (VOL+ and VOL- held at reboot):
12
{{{
13
Entry Count: 16
14
Unknown 1: 0
15
Unknown 2: 0
16
Unknown 3: 0
17
Unknown 4: 0
18
Unknown 5: 0
19
Unknown 6: 0
20
Unknown 7: 0
21
Unknown 8: 0
22
23
24
--- Entry #0 ---
25
Unused: No
26
Partition Type: 0 (RFS)
27
Partition Identifier: 0
28
Partition Flags: 0 (R)
29
Unknown 1: 0
30
Partition Block Size: 256
31
Partition Block Count: 1
32
Unknown 2: 0
33
Unknown 3: 0
34
Partition Name: IPBL
35
Filename: bootloader.img
36
37
38
--- Entry #1 ---
39
Unused: No
40
Partition Type: 0 (RFS)
41
Partition Identifier: 1
42
Partition Flags: 0 (R)
43
Unknown 1: 0
44
Partition Block Size: 256
45
Partition Block Count: 7
46
Unknown 2: 0
47
Unknown 3: 0
48
Partition Name: SBL
49
Filename: 
50
51
52
--- Entry #2 ---
53
Unused: No
54
Partition Type: 0 (RFS)
55
Partition Identifier: 2
56
Partition Flags: 0 (R)
57
Unknown 1: 0
58
Partition Block Size: 256
59
Partition Block Count: 7
60
Unknown 2: 0
61
Unknown 3: 0
62
Partition Name: SBL2
63
Filename: 
64
65
66
--- Entry #3 ---
67
Unused: No
68
Partition Type: 0 (RFS)
69
Partition Identifier: 3
70
Partition Flags: 0 (R)
71
Unknown 1: 0
72
Partition Block Size: 256
73
Partition Block Count: 4
74
Unknown 2: 0
75
Unknown 3: 0
76
Partition Name: PARAM
77
Filename: 
78
79
80
--- Entry #4 ---
81
Unused: No
82
Partition Type: 0 (RFS)
83
Partition Identifier: 4
84
Partition Flags: 0 (R)
85
Unknown 1: 0
86
Partition Block Size: 256
87
Partition Block Count: 5
88
Unknown 2: 0
89
Unknown 3: 0
90
Partition Name: MISC
91
Filename: 
92
93
94
--- Entry #5 ---
95
Unused: No
96
Partition Type: 0 (RFS)
97
Partition Identifier: 5
98
Partition Flags: 0 (R)
99
Unknown 1: 0
100
Partition Block Size: 256
101
Partition Block Count: 32
102
Unknown 2: 0
103
Unknown 3: 0
104
Partition Name: BOOT
105
Filename: boot.img
106
107
108
--- Entry #6 ---
109
Unused: No
110
Partition Type: 0 (RFS)
111
Partition Identifier: 6
112
Partition Flags: 0 (R)
113
Unknown 1: 0
114
Partition Block Size: 256
115
Partition Block Count: 32
116
Unknown 2: 0
117
Unknown 3: 0
118
Partition Name: RECOVERY
119
Filename: recovery.img
120
121
122
--- Entry #7 ---
123
Unused: No
124
Partition Type: 0 (RFS)
125
Partition Identifier: 7
126
Partition Flags: 1 (R)
127
Unknown 1: 0
128
Partition Block Size: 256
129
Partition Block Count: 1878
130
Unknown 2: 0
131
Unknown 3: 0
132
Partition Name: CACHE
133
Filename: cache.img
134
135
136
--- Entry #8 ---
137
Unused: Yes
138
Partition Type: 0 (RFS)
139
Partition Identifier: 8
140
Partition Flags: 0 (R)
141
Unknown 1: 0
142
Partition Block Size: 256
143
Partition Block Count: 54
144
Unknown 2: 0
145
Unknown 3: 0
146
Partition Name: RADIO
147
Filename: radio.img
148
149
150
--- Entry #9 ---
151
Unused: No
152
Partition Type: 0 (RFS)
153
Partition Identifier: 9
154
Partition Flags: 1 (R)
155
Unknown 1: 0
156
Partition Block Size: 256
157
Partition Block Count: 27
158
Unknown 2: 0
159
Unknown 3: 0
160
Partition Name: EFS
161
Filename: 
162
163
164
--- Entry #10 ---
165
Unused: No
166
Partition Type: 0 (RFS)
167
Partition Identifier: 10
168
Partition Flags: 0 (R)
169
Unknown 1: 0
170
Partition Block Size: 256
171
Partition Block Count: 1
172
Unknown 2: 0
173
Unknown 3: 0
174
Partition Name: DGS
175
Filename: dgs.img
176
177
178
--- Entry #11 ---
179
Unused: No
180
Partition Type: 2 (EXT4)
181
Partition Identifier: 0
182
Partition Flags: 2 (R/W)
183
Unknown 1: 0
184
Partition Block Size: 512
185
Partition Block Count: 2048
186
Unknown 2: 0
187
Unknown 3: 0
188
Partition Name: PGPT
189
Filename: emmc.img
190
191
192
--- Entry #12 ---
193
Unused: No
194
Partition Type: 2 (EXT4)
195
Partition Identifier: 1
196
Partition Flags: 2 (R/W)
197
Unknown 1: 0
198
Partition Block Size: 512
199
Partition Block Count: 1048576
200
Unknown 2: 0
201
Unknown 3: 0
202
Partition Name: SYSTEM
203
Filename: system.img
204
205
206
--- Entry #13 ---
207
Unused: No
208
Partition Type: 2 (EXT4)
209
Partition Identifier: 2
210
Partition Flags: 2 (R/W)
211
Unknown 1: 0
212
Partition Block Size: 512
213
Partition Block Count: 2097152
214
Unknown 2: 0
215
Unknown 3: 0
216
Partition Name: USERDATA
217
Filename: userdata.img
218
219
220
--- Entry #14 ---
221
Unused: No
222
Partition Type: 2 (EXT4)
223
Partition Identifier: 3
224
Partition Flags: 2 (R/W)
225
Unknown 1: 0
226
Partition Block Size: 512
227
Partition Block Count: 33554432
228
Unknown 2: 0
229
Unknown 3: 0
230
Partition Name: MEDIA
231
Filename: media.img
232
233
234
--- Entry #15 ---
235
Unused: No
236
Partition Type: 2 (EXT4)
237
Partition Identifier: 4
238
Partition Flags: 2 (R/W)
239
Unknown 1: 0
240
Partition Block Size: 512
241
Partition Block Count: 33
242
Unknown 2: 0
243
Unknown 3: 0
244
Partition Name: SGPT
245
Filename: 
246
}}}
247 4 Denis 'GNUtoo' Carikli
248 9 Paul Kocialkowski
== Serial Console ==
249
250
It is possible to setup a serial console on the Nexus S. It will show:
251 10 Paul Kocialkowski
 * the 1st bootloader output
252
 * the 2nd bootloader output
253
 * the 2nd bootloader #2 output
254
 * the fiq debugger
255
 * (the kernel output if enabled)
256 9 Paul Kocialkowski
257
=== How to enable serial console ===
258
259 12 Paul Kocialkowski
 * completely turn off the Nexus S
260
 * attach the microUSB connector to the Nexus S
261 10 Paul Kocialkowski
 * wire GND and ID (from the microUSB connector) to a 150K resistor
262
 * get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872
263
 * wire it following this table:
264 9 Paul Kocialkowski
|| UART to USB board output || resistor || microUSB connector(s) name(s) || microUSB wire color ||
265
|| N/A || 150K Ohm || ID and GND || ID not wired (the 5th connector that is unused), GND is black ||
266
|| 3.3V || N/A || V+ || red ||
267
|| GND || N/A || GND || black ||
268
|| Rx || N/A || D- || white ||
269
|| Tx || N/A || D+ || green ||
270
271
'''Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.'''
272
273
When the USB to UART module is connected to the host PC, a new tty node will be created on the host PC, usually {{{ /dev/ttyUSB0 }}}. 
274
To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles):
275 11 Paul Kocialkowski
{{{ screen /dev/ttyUSB0 115200 }}}
276 9 Paul Kocialkowski
115200 is the baud rate to use (certainly with most UART to USB board). 
277
278 13 Paul Kocialkowski
Then, do a regular boot. You should see the second bootloader #2 output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>.
279
280
281 12 Paul Kocialkowski
Photos: here's what it looks like when all setup:
282 1 Denis 'GNUtoo' Carikli
283 13 Paul Kocialkowski
[[Image(http://download.paulk.fr/replicant/crespo/uart/uart_board.jpg)]]
284
285
The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector.
286
287
[[Image(http://download.paulk.fr/replicant/crespo/uart/nexuss_resistor.jpg)]]
288
289
The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S.
290
291
''Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board).'' 
292
293
[[Image(http://download.paulk.fr/replicant/crespo/uart/nexuss_global_text.jpg)]]
294
295
The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board.
296 14 Paul Kocialkowski
297 13 Paul Kocialkowski
''Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board).'' 
298 9 Paul Kocialkowski
299
=== Bootloaders outputs ===
300
301
first bootloader:
302
{{{
303
-----------------------------------------------------------
304
   Samsung Primitive Bootloader (PBL) v3.0
305
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
306
-----------------------------------------------------------
307
308
Muxed OneNAND 512MB (0x50) Sync
309
Scanning Bad Block .......
310
Bad Block 77 (5)
311
Bad Block 295 (5)
312
Bad Block 1232 (5)
313
Bad Block 1646 (5)
314
Bad Block 1831 (5)
315
Bad Block 2047 (0)
316
SBL loadding success
317
318
Set cpu clk. from 400MHz to 800MHz.
319
OM=0x9, device=OnenandMux(Audi)
320
IROM e-fused - Secure Boot Version.
321
}}}
322
323
second bootloader:
324
{{{
325
-----------------------------------------------------------
326
   Samsung Secondary Bootloader (SBL) v3.0
327
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
328
329
   Board Name: HERRING REV 52
330
   Build On: Jan 20 2011 17:19:41
331
-----------------------------------------------------------
332
333
MMC SEM16G 15188 MB
334
Re_partition: magic code(0x0)
335
Muxed OneNAND 512MB (0x50) Sync
336
Scanning Bad Block .......
337
Bad Block 77 (5)
338
Bad Block 295 (5)
339
Bad Block 1232 (5)
340
Bad Block 1646 (5)
341
Bad Block 1831 (5)
342
Bad Block 2047 (0)
343
Partitions loading success
344
Read image(PARAM) from flash .......
345
Done
346
init_fuel_gauge: vcell = 4083mV, soc = 94
347
PMIC_IRQ1    = 0xc0 
348
PMIC_IRQ2    = 0x0 
349
PMIC_IRQ3    = 0x0 
350
PMIC_IRQ4    = 0x0 
351
PMIC_STATUS1 = 0x0 
352
PMIC_STATUS2 = 0x0 
353
PMIC_STATUS3 = 0x0 
354
PMIC_STATUS4 = 0x0 
355
PMIC_STATUS5 = 0x0 
356
PMIC_SMPL    = 0x0 
357
Key scan = 0x0
358
message.command = 
359
message.status = 
360
message.recovery = 
361
}}}
362
363
second bootloader #2:
364
{{{
365
BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
366
LCD ID = 0x0060a953
367
Done
368
Kernel(boot.img) read success from partition no.5
369
Setting param.serialnr = 0x3733bab6 0x6de200ec
370
Setting param.board_rev = 0x34
371
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
372
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265
373
374
Starting kernel at 0x30008000...
375
376
Uncompressing Linux... done, booting the kernel.
377
}}}
378
379
kernel
380
{{{
381
<hit enter to activate fiq debugger>
382
}}}
383
384 4 Denis 'GNUtoo' Carikli
== TODO ==
385 6 Denis 'GNUtoo' Carikli
 * Look if [http://www.glassechidna.com.au/products/heimdall/ Heimdall] can talk to the bootrom
386 4 Denis 'GNUtoo' Carikli
 * Serial console:
387
  * Use the correct resistors enabling the serial console on the FSA9480
388
  * Mesure the voltage of the Nexus S serial port
389
  * Make a level shifter to shift the serial port levels 
390
  * Cross compile microcom or picocom 
391
  * get a serial console
392 5 Denis 'GNUtoo' Carikli
 * Find the JTAG
393 7 Denis 'GNUtoo' Carikli
 * look if the first stage bootloader(after the bootrom) is signed