SamsungSerial » History » Version 17
Paul Kocialkowski, 01/28/2012 02:12 PM
1 | 16 | Paul Kocialkowski | h2. Introduction |
---|---|---|---|
2 | |||
3 | 1 | Denis 'GNUtoo' Carikli | This page contains information on how to work on a bootloader replacement. |
4 | |||
5 | |||
6 | 16 | Paul Kocialkowski | h2. Informations |
7 | 1 | Denis 'GNUtoo' Carikli | |
8 | 16 | Paul Kocialkowski | * The "official u-boot source code":http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses |
9 | * The S5PC110 has a bootrom |
||
10 | * The Nexus S has an usb port with an FSA9480 behind it |
||
11 | 1 | Denis 'GNUtoo' Carikli | |
12 | |||
13 | 16 | Paul Kocialkowski | h2. Links of interest |
14 | |||
15 | |||
16 | * "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick - XDA-Developers Forums":http://forum.xda-developers.com/showthread.php?t=1233273 |
||
17 | * "HOW-TO [[UnBrick]] the [[UnBrickable]] Vibrant - xda-developers":http://forum.xda-developers.com/showthread.php?t=1277056 |
||
18 | * "Boot sequence interception/redirection for Hummingbird processors":http://code.google.com/p/hummingbird-hibl/ |
||
19 | * "source code for hummingbird-hibl":http://code.google.com/p/hummingbird-hibl/source/browse/trunk/HummingBirdInterceptorBootloader/ |
||
20 | |||
21 | |||
22 | h3. Partitioning informations |
||
23 | |||
24 | |||
25 | <pre> |
||
26 | 8 | Paul Kocialkowski | Entry Count: 16 |
27 | Unknown 1: 0 |
||
28 | Unknown 2: 0 |
||
29 | Unknown 3: 0 |
||
30 | Unknown 4: 0 |
||
31 | Unknown 5: 0 |
||
32 | Unknown 6: 0 |
||
33 | Unknown 7: 0 |
||
34 | Unknown 8: 0 |
||
35 | |||
36 | |||
37 | --- Entry #0 --- |
||
38 | Unused: No |
||
39 | Partition Type: 0 (RFS) |
||
40 | Partition Identifier: 0 |
||
41 | Partition Flags: 0 (R) |
||
42 | Unknown 1: 0 |
||
43 | Partition Block Size: 256 |
||
44 | Partition Block Count: 1 |
||
45 | Unknown 2: 0 |
||
46 | Unknown 3: 0 |
||
47 | Partition Name: IPBL |
||
48 | Filename: bootloader.img |
||
49 | |||
50 | |||
51 | --- Entry #1 --- |
||
52 | Unused: No |
||
53 | Partition Type: 0 (RFS) |
||
54 | Partition Identifier: 1 |
||
55 | Partition Flags: 0 (R) |
||
56 | Unknown 1: 0 |
||
57 | Partition Block Size: 256 |
||
58 | Partition Block Count: 7 |
||
59 | Unknown 2: 0 |
||
60 | Unknown 3: 0 |
||
61 | Partition Name: SBL |
||
62 | Filename: |
||
63 | |||
64 | |||
65 | --- Entry #2 --- |
||
66 | Unused: No |
||
67 | Partition Type: 0 (RFS) |
||
68 | Partition Identifier: 2 |
||
69 | Partition Flags: 0 (R) |
||
70 | Unknown 1: 0 |
||
71 | Partition Block Size: 256 |
||
72 | Partition Block Count: 7 |
||
73 | Unknown 2: 0 |
||
74 | Unknown 3: 0 |
||
75 | Partition Name: SBL2 |
||
76 | Filename: |
||
77 | |||
78 | |||
79 | --- Entry #3 --- |
||
80 | Unused: No |
||
81 | Partition Type: 0 (RFS) |
||
82 | Partition Identifier: 3 |
||
83 | Partition Flags: 0 (R) |
||
84 | Unknown 1: 0 |
||
85 | Partition Block Size: 256 |
||
86 | Partition Block Count: 4 |
||
87 | Unknown 2: 0 |
||
88 | Unknown 3: 0 |
||
89 | Partition Name: PARAM |
||
90 | Filename: |
||
91 | |||
92 | |||
93 | --- Entry #4 --- |
||
94 | Unused: No |
||
95 | Partition Type: 0 (RFS) |
||
96 | Partition Identifier: 4 |
||
97 | Partition Flags: 0 (R) |
||
98 | Unknown 1: 0 |
||
99 | Partition Block Size: 256 |
||
100 | Partition Block Count: 5 |
||
101 | Unknown 2: 0 |
||
102 | Unknown 3: 0 |
||
103 | Partition Name: MISC |
||
104 | Filename: |
||
105 | |||
106 | |||
107 | --- Entry #5 --- |
||
108 | Unused: No |
||
109 | Partition Type: 0 (RFS) |
||
110 | Partition Identifier: 5 |
||
111 | Partition Flags: 0 (R) |
||
112 | Unknown 1: 0 |
||
113 | Partition Block Size: 256 |
||
114 | Partition Block Count: 32 |
||
115 | Unknown 2: 0 |
||
116 | Unknown 3: 0 |
||
117 | Partition Name: BOOT |
||
118 | Filename: boot.img |
||
119 | |||
120 | |||
121 | --- Entry #6 --- |
||
122 | Unused: No |
||
123 | Partition Type: 0 (RFS) |
||
124 | Partition Identifier: 6 |
||
125 | Partition Flags: 0 (R) |
||
126 | Unknown 1: 0 |
||
127 | Partition Block Size: 256 |
||
128 | Partition Block Count: 32 |
||
129 | Unknown 2: 0 |
||
130 | Unknown 3: 0 |
||
131 | Partition Name: RECOVERY |
||
132 | Filename: recovery.img |
||
133 | |||
134 | |||
135 | --- Entry #7 --- |
||
136 | Unused: No |
||
137 | Partition Type: 0 (RFS) |
||
138 | Partition Identifier: 7 |
||
139 | Partition Flags: 1 (R) |
||
140 | Unknown 1: 0 |
||
141 | Partition Block Size: 256 |
||
142 | Partition Block Count: 1878 |
||
143 | Unknown 2: 0 |
||
144 | Unknown 3: 0 |
||
145 | Partition Name: CACHE |
||
146 | Filename: cache.img |
||
147 | |||
148 | |||
149 | --- Entry #8 --- |
||
150 | Unused: Yes |
||
151 | Partition Type: 0 (RFS) |
||
152 | Partition Identifier: 8 |
||
153 | Partition Flags: 0 (R) |
||
154 | Unknown 1: 0 |
||
155 | Partition Block Size: 256 |
||
156 | Partition Block Count: 54 |
||
157 | Unknown 2: 0 |
||
158 | Unknown 3: 0 |
||
159 | Partition Name: RADIO |
||
160 | Filename: radio.img |
||
161 | |||
162 | |||
163 | --- Entry #9 --- |
||
164 | Unused: No |
||
165 | Partition Type: 0 (RFS) |
||
166 | Partition Identifier: 9 |
||
167 | Partition Flags: 1 (R) |
||
168 | Unknown 1: 0 |
||
169 | Partition Block Size: 256 |
||
170 | Partition Block Count: 27 |
||
171 | Unknown 2: 0 |
||
172 | Unknown 3: 0 |
||
173 | Partition Name: EFS |
||
174 | Filename: |
||
175 | |||
176 | |||
177 | --- Entry #10 --- |
||
178 | Unused: No |
||
179 | Partition Type: 0 (RFS) |
||
180 | Partition Identifier: 10 |
||
181 | Partition Flags: 0 (R) |
||
182 | Unknown 1: 0 |
||
183 | Partition Block Size: 256 |
||
184 | Partition Block Count: 1 |
||
185 | Unknown 2: 0 |
||
186 | Unknown 3: 0 |
||
187 | Partition Name: DGS |
||
188 | Filename: dgs.img |
||
189 | |||
190 | |||
191 | --- Entry #11 --- |
||
192 | Unused: No |
||
193 | Partition Type: 2 (EXT4) |
||
194 | Partition Identifier: 0 |
||
195 | Partition Flags: 2 (R/W) |
||
196 | Unknown 1: 0 |
||
197 | Partition Block Size: 512 |
||
198 | Partition Block Count: 2048 |
||
199 | Unknown 2: 0 |
||
200 | Unknown 3: 0 |
||
201 | Partition Name: PGPT |
||
202 | Filename: emmc.img |
||
203 | |||
204 | |||
205 | --- Entry #12 --- |
||
206 | Unused: No |
||
207 | Partition Type: 2 (EXT4) |
||
208 | Partition Identifier: 1 |
||
209 | Partition Flags: 2 (R/W) |
||
210 | Unknown 1: 0 |
||
211 | Partition Block Size: 512 |
||
212 | Partition Block Count: 1048576 |
||
213 | Unknown 2: 0 |
||
214 | Unknown 3: 0 |
||
215 | Partition Name: SYSTEM |
||
216 | Filename: system.img |
||
217 | |||
218 | |||
219 | --- Entry #13 --- |
||
220 | Unused: No |
||
221 | Partition Type: 2 (EXT4) |
||
222 | Partition Identifier: 2 |
||
223 | Partition Flags: 2 (R/W) |
||
224 | Unknown 1: 0 |
||
225 | Partition Block Size: 512 |
||
226 | Partition Block Count: 2097152 |
||
227 | Unknown 2: 0 |
||
228 | Unknown 3: 0 |
||
229 | Partition Name: USERDATA |
||
230 | Filename: userdata.img |
||
231 | |||
232 | |||
233 | --- Entry #14 --- |
||
234 | Unused: No |
||
235 | Partition Type: 2 (EXT4) |
||
236 | Partition Identifier: 3 |
||
237 | Partition Flags: 2 (R/W) |
||
238 | Unknown 1: 0 |
||
239 | Partition Block Size: 512 |
||
240 | Partition Block Count: 33554432 |
||
241 | Unknown 2: 0 |
||
242 | Unknown 3: 0 |
||
243 | Partition Name: MEDIA |
||
244 | Filename: media.img |
||
245 | 1 | Denis 'GNUtoo' Carikli | |
246 | |||
247 | --- Entry #15 --- |
||
248 | Unused: No |
||
249 | Partition Type: 2 (EXT4) |
||
250 | Partition Identifier: 4 |
||
251 | Partition Flags: 2 (R/W) |
||
252 | Unknown 1: 0 |
||
253 | Partition Block Size: 512 |
||
254 | Partition Block Count: 33 |
||
255 | 9 | Paul Kocialkowski | Unknown 2: 0 |
256 | Unknown 3: 0 |
||
257 | Partition Name: SGPT |
||
258 | 10 | Paul Kocialkowski | Filename: |
259 | 16 | Paul Kocialkowski | </pre> |
260 | 10 | Paul Kocialkowski | |
261 | 16 | Paul Kocialkowski | h2. Serial Console |
262 | |||
263 | 10 | Paul Kocialkowski | It is possible to setup a serial console on the Nexus S. It will show: |
264 | 16 | Paul Kocialkowski | * the 1st bootloader output |
265 | * the 2nd bootloader output |
||
266 | * the 2nd bootloader #2 output |
||
267 | * the fiq debugger |
||
268 | * (the kernel output if enabled) |
||
269 | 10 | Paul Kocialkowski | |
270 | 9 | Paul Kocialkowski | |
271 | 16 | Paul Kocialkowski | h3. How to enable serial console |
272 | |||
273 | * completely turn off the Nexus S |
||
274 | 1 | Denis 'GNUtoo' Carikli | * attach the microUSB connector to the Nexus S |
275 | * wire GND and ID (from the microUSB connector) to a 150K resistor |
||
276 | * get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872 |
||
277 | * wire it following this table: |
||
278 | 16 | Paul Kocialkowski | |
279 | 17 | Paul Kocialkowski | |_. UART to USB board output |_. Resistor |_. microUSB connector(s) name(s) |_. microUSB wire color | |
280 | | N/A | 150K Ohm | ID and GND | ID not wired (the 5th connector that is unused), GND is black | |
||
281 | | 3.3V | N/A | V+ | red | |
||
282 | | GND | N/A | GND | black | |
||
283 | | Rx | N/A | D- | white | |
||
284 | | Tx | N/A | D+ | green | |
||
285 | |||
286 | 13 | Paul Kocialkowski | *Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.* |
287 | 1 | Denis 'GNUtoo' Carikli | |
288 | 16 | Paul Kocialkowski | To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles): |
289 | 115200 is the baud rate to use (certainly with most UART to USB board). |
||
290 | 1 | Denis 'GNUtoo' Carikli | |
291 | 13 | Paul Kocialkowski | Then, do a regular boot. You should see the second bootloader #2 output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>. |
292 | |||
293 | |||
294 | Photos: here's what it looks like when all setup: |
||
295 | |||
296 | 17 | Paul Kocialkowski | !http://download.paulk.fr/replicant/crespo/uart/uart_board.jpg! |
297 | 13 | Paul Kocialkowski | |
298 | The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector. |
||
299 | |||
300 | 17 | Paul Kocialkowski | !http://download.paulk.fr/replicant/crespo/uart/nexuss_resistor.jpg! |
301 | 1 | Denis 'GNUtoo' Carikli | |
302 | The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S. |
||
303 | 16 | Paul Kocialkowski | |
304 | 9 | Paul Kocialkowski | _Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ |
305 | |||
306 | 17 | Paul Kocialkowski | !http://download.paulk.fr/replicant/crespo/uart/nexuss_global_text.jpg! |
307 | 9 | Paul Kocialkowski | |
308 | 16 | Paul Kocialkowski | The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board. |
309 | 9 | Paul Kocialkowski | |
310 | _Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ |
||
311 | 16 | Paul Kocialkowski | |
312 | h3. Bootloaders outputs |
||
313 | |||
314 | 9 | Paul Kocialkowski | first bootloader: |
315 | 16 | Paul Kocialkowski | <pre> |
316 | 9 | Paul Kocialkowski | ----------------------------------------------------------- |
317 | Samsung Primitive Bootloader (PBL) v3.0 |
||
318 | 1 | Denis 'GNUtoo' Carikli | Copyright (C) Samsung Electronics Co., Ltd. 2006-2010 |
319 | 9 | Paul Kocialkowski | ----------------------------------------------------------- |
320 | |||
321 | Muxed [[OneNAND]] 512MB (0x50) Sync |
||
322 | 16 | Paul Kocialkowski | Scanning Bad Block ....... |
323 | 9 | Paul Kocialkowski | Bad Block 77 (5) |
324 | Bad Block 295 (5) |
||
325 | Bad Block 1232 (5) |
||
326 | Bad Block 1646 (5) |
||
327 | Bad Block 1831 (5) |
||
328 | Bad Block 2047 (0) |
||
329 | SBL loadding success |
||
330 | |||
331 | Set cpu clk. from 400MHz to 800MHz. |
||
332 | OM=0x9, device=OnenandMux(Audi) |
||
333 | IROM e-fused - Secure Boot Version. |
||
334 | 16 | Paul Kocialkowski | </pre> |
335 | 9 | Paul Kocialkowski | |
336 | 17 | Paul Kocialkowski | second bootloader:51ea3aaa63e65b74b7386fe1365d7b52f4495c43 |
337 | 16 | Paul Kocialkowski | <pre> |
338 | 1 | Denis 'GNUtoo' Carikli | ----------------------------------------------------------- |
339 | 9 | Paul Kocialkowski | Samsung Secondary Bootloader (SBL) v3.0 |
340 | Copyright (C) Samsung Electronics Co., Ltd. 2006-2010 |
||
341 | |||
342 | Board Name: HERRING REV 52 |
||
343 | Build On: Jan 20 2011 17:19:41 |
||
344 | ----------------------------------------------------------- |
||
345 | 1 | Denis 'GNUtoo' Carikli | |
346 | MMC SEM16G 15188 MB |
||
347 | Re_partition: magic code(0x0) |
||
348 | 16 | Paul Kocialkowski | Muxed [[OneNAND]] 512MB (0x50) Sync |
349 | 1 | Denis 'GNUtoo' Carikli | Scanning Bad Block ....... |
350 | Bad Block 77 (5) |
||
351 | Bad Block 295 (5) |
||
352 | Bad Block 1232 (5) |
||
353 | Bad Block 1646 (5) |
||
354 | Bad Block 1831 (5) |
||
355 | Bad Block 2047 (0) |
||
356 | Partitions loading success |
||
357 | 9 | Paul Kocialkowski | Read image(PARAM) from flash ....... |
358 | Done |
||
359 | init_fuel_gauge: vcell = 4083mV, soc = 94 |
||
360 | PMIC_IRQ1 = 0xc0 |
||
361 | PMIC_IRQ2 = 0x0 |
||
362 | PMIC_IRQ3 = 0x0 |
||
363 | PMIC_IRQ4 = 0x0 |
||
364 | PMIC_STATUS1 = 0x0 |
||
365 | PMIC_STATUS2 = 0x0 |
||
366 | PMIC_STATUS3 = 0x0 |
||
367 | PMIC_STATUS4 = 0x0 |
||
368 | PMIC_STATUS5 = 0x0 |
||
369 | PMIC_SMPL = 0x0 |
||
370 | Key scan = 0x0 |
||
371 | message.command = |
||
372 | message.status = |
||
373 | message.recovery = |
||
374 | 16 | Paul Kocialkowski | </pre> |
375 | 9 | Paul Kocialkowski | |
376 | second bootloader #2: |
||
377 | 16 | Paul Kocialkowski | <pre> |
378 | 9 | Paul Kocialkowski | BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee)) |
379 | LCD ID = 0x0060a953 |
||
380 | Done |
||
381 | Kernel(boot.img) read success from partition no.5 |
||
382 | Setting param.serialnr = 0x3733bab6 0x6de200ec |
||
383 | Setting param.board_rev = 0x34 |
||
384 | Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked |
||
385 | Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265 |
||
386 | |||
387 | Starting kernel at 0x30008000... |
||
388 | |||
389 | 4 | Denis 'GNUtoo' Carikli | Uncompressing Linux... done, booting the kernel. |
390 | 16 | Paul Kocialkowski | </pre> |
391 | 4 | Denis 'GNUtoo' Carikli | |
392 | kernel |
||
393 | 16 | Paul Kocialkowski | <pre> |
394 | 4 | Denis 'GNUtoo' Carikli | <hit enter to activate fiq debugger> |
395 | 16 | Paul Kocialkowski | </pre> |
396 | 4 | Denis 'GNUtoo' Carikli | |
397 | 16 | Paul Kocialkowski | |
398 | h2. TODO |
||
399 | |||
400 | * Look if "Heimdall":http://www.glassechidna.com.au/products/heimdall/ can talk to the bootrom |
||
401 | * Serial console: |
||
402 | ** Use the correct resistors enabling the serial console on the FSA9480 |
||
403 | ** Mesure the voltage of the Nexus S serial port |
||
404 | ** Make a level shifter to shift the serial port levels |
||
405 | ** Cross compile microcom or picocom |
||
406 | ** get a serial console |
||
407 | * Find the JTAG |
||
408 | * look if the first stage bootloader(after the bootrom) is signed |