Project

General

Profile

SamsungSerial » History » Version 17

Paul Kocialkowski, 01/28/2012 02:12 PM

1 16 Paul Kocialkowski
h2. Introduction
2
3 1 Denis 'GNUtoo' Carikli
This page contains information on how to work on a bootloader replacement.
4
5
6 16 Paul Kocialkowski
h2. Informations
7 1 Denis 'GNUtoo' Carikli
8 16 Paul Kocialkowski
* The "official u-boot source code":http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses
9
* The S5PC110 has a bootrom
10
* The Nexus S has an usb port with an FSA9480 behind it
11 1 Denis 'GNUtoo' Carikli
12
13 16 Paul Kocialkowski
h2. Links of interest
14
15
16
* "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick - XDA-Developers Forums":http://forum.xda-developers.com/showthread.php?t=1233273
17
* "HOW-TO [[UnBrick]] the [[UnBrickable]] Vibrant - xda-developers":http://forum.xda-developers.com/showthread.php?t=1277056
18
* "Boot sequence interception/redirection for Hummingbird processors":http://code.google.com/p/hummingbird-hibl/
19
* "source code for hummingbird-hibl":http://code.google.com/p/hummingbird-hibl/source/browse/trunk/HummingBirdInterceptorBootloader/
20
21
22
h3. Partitioning informations
23
24
25
<pre>
26 8 Paul Kocialkowski
Entry Count: 16
27
Unknown 1: 0
28
Unknown 2: 0
29
Unknown 3: 0
30
Unknown 4: 0
31
Unknown 5: 0
32
Unknown 6: 0
33
Unknown 7: 0
34
Unknown 8: 0
35
36
37
--- Entry #0 ---
38
Unused: No
39
Partition Type: 0 (RFS)
40
Partition Identifier: 0
41
Partition Flags: 0 (R)
42
Unknown 1: 0
43
Partition Block Size: 256
44
Partition Block Count: 1
45
Unknown 2: 0
46
Unknown 3: 0
47
Partition Name: IPBL
48
Filename: bootloader.img
49
50
51
--- Entry #1 ---
52
Unused: No
53
Partition Type: 0 (RFS)
54
Partition Identifier: 1
55
Partition Flags: 0 (R)
56
Unknown 1: 0
57
Partition Block Size: 256
58
Partition Block Count: 7
59
Unknown 2: 0
60
Unknown 3: 0
61
Partition Name: SBL
62
Filename: 
63
64
65
--- Entry #2 ---
66
Unused: No
67
Partition Type: 0 (RFS)
68
Partition Identifier: 2
69
Partition Flags: 0 (R)
70
Unknown 1: 0
71
Partition Block Size: 256
72
Partition Block Count: 7
73
Unknown 2: 0
74
Unknown 3: 0
75
Partition Name: SBL2
76
Filename: 
77
78
79
--- Entry #3 ---
80
Unused: No
81
Partition Type: 0 (RFS)
82
Partition Identifier: 3
83
Partition Flags: 0 (R)
84
Unknown 1: 0
85
Partition Block Size: 256
86
Partition Block Count: 4
87
Unknown 2: 0
88
Unknown 3: 0
89
Partition Name: PARAM
90
Filename: 
91
92
93
--- Entry #4 ---
94
Unused: No
95
Partition Type: 0 (RFS)
96
Partition Identifier: 4
97
Partition Flags: 0 (R)
98
Unknown 1: 0
99
Partition Block Size: 256
100
Partition Block Count: 5
101
Unknown 2: 0
102
Unknown 3: 0
103
Partition Name: MISC
104
Filename: 
105
106
107
--- Entry #5 ---
108
Unused: No
109
Partition Type: 0 (RFS)
110
Partition Identifier: 5
111
Partition Flags: 0 (R)
112
Unknown 1: 0
113
Partition Block Size: 256
114
Partition Block Count: 32
115
Unknown 2: 0
116
Unknown 3: 0
117
Partition Name: BOOT
118
Filename: boot.img
119
120
121
--- Entry #6 ---
122
Unused: No
123
Partition Type: 0 (RFS)
124
Partition Identifier: 6
125
Partition Flags: 0 (R)
126
Unknown 1: 0
127
Partition Block Size: 256
128
Partition Block Count: 32
129
Unknown 2: 0
130
Unknown 3: 0
131
Partition Name: RECOVERY
132
Filename: recovery.img
133
134
135
--- Entry #7 ---
136
Unused: No
137
Partition Type: 0 (RFS)
138
Partition Identifier: 7
139
Partition Flags: 1 (R)
140
Unknown 1: 0
141
Partition Block Size: 256
142
Partition Block Count: 1878
143
Unknown 2: 0
144
Unknown 3: 0
145
Partition Name: CACHE
146
Filename: cache.img
147
148
149
--- Entry #8 ---
150
Unused: Yes
151
Partition Type: 0 (RFS)
152
Partition Identifier: 8
153
Partition Flags: 0 (R)
154
Unknown 1: 0
155
Partition Block Size: 256
156
Partition Block Count: 54
157
Unknown 2: 0
158
Unknown 3: 0
159
Partition Name: RADIO
160
Filename: radio.img
161
162
163
--- Entry #9 ---
164
Unused: No
165
Partition Type: 0 (RFS)
166
Partition Identifier: 9
167
Partition Flags: 1 (R)
168
Unknown 1: 0
169
Partition Block Size: 256
170
Partition Block Count: 27
171
Unknown 2: 0
172
Unknown 3: 0
173
Partition Name: EFS
174
Filename: 
175
176
177
--- Entry #10 ---
178
Unused: No
179
Partition Type: 0 (RFS)
180
Partition Identifier: 10
181
Partition Flags: 0 (R)
182
Unknown 1: 0
183
Partition Block Size: 256
184
Partition Block Count: 1
185
Unknown 2: 0
186
Unknown 3: 0
187
Partition Name: DGS
188
Filename: dgs.img
189
190
191
--- Entry #11 ---
192
Unused: No
193
Partition Type: 2 (EXT4)
194
Partition Identifier: 0
195
Partition Flags: 2 (R/W)
196
Unknown 1: 0
197
Partition Block Size: 512
198
Partition Block Count: 2048
199
Unknown 2: 0
200
Unknown 3: 0
201
Partition Name: PGPT
202
Filename: emmc.img
203
204
205
--- Entry #12 ---
206
Unused: No
207
Partition Type: 2 (EXT4)
208
Partition Identifier: 1
209
Partition Flags: 2 (R/W)
210
Unknown 1: 0
211
Partition Block Size: 512
212
Partition Block Count: 1048576
213
Unknown 2: 0
214
Unknown 3: 0
215
Partition Name: SYSTEM
216
Filename: system.img
217
218
219
--- Entry #13 ---
220
Unused: No
221
Partition Type: 2 (EXT4)
222
Partition Identifier: 2
223
Partition Flags: 2 (R/W)
224
Unknown 1: 0
225
Partition Block Size: 512
226
Partition Block Count: 2097152
227
Unknown 2: 0
228
Unknown 3: 0
229
Partition Name: USERDATA
230
Filename: userdata.img
231
232
233
--- Entry #14 ---
234
Unused: No
235
Partition Type: 2 (EXT4)
236
Partition Identifier: 3
237
Partition Flags: 2 (R/W)
238
Unknown 1: 0
239
Partition Block Size: 512
240
Partition Block Count: 33554432
241
Unknown 2: 0
242
Unknown 3: 0
243
Partition Name: MEDIA
244
Filename: media.img
245 1 Denis 'GNUtoo' Carikli
246
247
--- Entry #15 ---
248
Unused: No
249
Partition Type: 2 (EXT4)
250
Partition Identifier: 4
251
Partition Flags: 2 (R/W)
252
Unknown 1: 0
253
Partition Block Size: 512
254
Partition Block Count: 33
255 9 Paul Kocialkowski
Unknown 2: 0
256
Unknown 3: 0
257
Partition Name: SGPT
258 10 Paul Kocialkowski
Filename: 
259 16 Paul Kocialkowski
</pre>
260 10 Paul Kocialkowski
261 16 Paul Kocialkowski
h2. Serial Console
262
263 10 Paul Kocialkowski
It is possible to setup a serial console on the Nexus S. It will show:
264 16 Paul Kocialkowski
* the 1st bootloader output
265
* the 2nd bootloader output
266
* the 2nd bootloader #2 output
267
* the fiq debugger
268
* (the kernel output if enabled)
269 10 Paul Kocialkowski
270 9 Paul Kocialkowski
271 16 Paul Kocialkowski
h3. How to enable serial console
272
273
* completely turn off the Nexus S
274 1 Denis 'GNUtoo' Carikli
* attach the microUSB connector to the Nexus S
275
* wire GND and ID (from the microUSB connector) to a 150K resistor
276
* get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872
277
* wire it following this table:
278 16 Paul Kocialkowski
279 17 Paul Kocialkowski
|_. UART to USB board output |_. Resistor |_. microUSB connector(s) name(s) |_. microUSB wire color |
280
| N/A | 150K Ohm | ID and GND | ID not wired (the 5th connector that is unused), GND is black |
281
| 3.3V | N/A | V+ | red |
282
| GND | N/A | GND | black |
283
| Rx | N/A | D- | white |
284
| Tx | N/A | D+ | green |
285
286 13 Paul Kocialkowski
*Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.*
287 1 Denis 'GNUtoo' Carikli
288 16 Paul Kocialkowski
To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles):
289
115200 is the baud rate to use (certainly with most UART to USB board). 
290 1 Denis 'GNUtoo' Carikli
291 13 Paul Kocialkowski
Then, do a regular boot. You should see the second bootloader #2 output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>.
292
293
294
Photos: here's what it looks like when all setup:
295
296 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/uart_board.jpg!
297 13 Paul Kocialkowski
298
The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector.
299
300 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/nexuss_resistor.jpg!
301 1 Denis 'GNUtoo' Carikli
302
The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S.
303 16 Paul Kocialkowski
304 9 Paul Kocialkowski
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
305
306 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/nexuss_global_text.jpg!
307 9 Paul Kocialkowski
308 16 Paul Kocialkowski
The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board.
309 9 Paul Kocialkowski
310
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
311 16 Paul Kocialkowski
312
h3. Bootloaders outputs
313
314 9 Paul Kocialkowski
first bootloader:
315 16 Paul Kocialkowski
<pre>
316 9 Paul Kocialkowski
-----------------------------------------------------------
317
   Samsung Primitive Bootloader (PBL) v3.0
318 1 Denis 'GNUtoo' Carikli
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
319 9 Paul Kocialkowski
-----------------------------------------------------------
320
321
Muxed [[OneNAND]] 512MB (0x50) Sync
322 16 Paul Kocialkowski
Scanning Bad Block .......
323 9 Paul Kocialkowski
Bad Block 77 (5)
324
Bad Block 295 (5)
325
Bad Block 1232 (5)
326
Bad Block 1646 (5)
327
Bad Block 1831 (5)
328
Bad Block 2047 (0)
329
SBL loadding success
330
331
Set cpu clk. from 400MHz to 800MHz.
332
OM=0x9, device=OnenandMux(Audi)
333
IROM e-fused - Secure Boot Version.
334 16 Paul Kocialkowski
</pre>
335 9 Paul Kocialkowski
336 17 Paul Kocialkowski
second bootloader:51ea3aaa63e65b74b7386fe1365d7b52f4495c43
337 16 Paul Kocialkowski
<pre>
338 1 Denis 'GNUtoo' Carikli
-----------------------------------------------------------
339 9 Paul Kocialkowski
   Samsung Secondary Bootloader (SBL) v3.0
340
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
341
342
   Board Name: HERRING REV 52
343
   Build On: Jan 20 2011 17:19:41
344
-----------------------------------------------------------
345 1 Denis 'GNUtoo' Carikli
346
MMC SEM16G 15188 MB
347
Re_partition: magic code(0x0)
348 16 Paul Kocialkowski
Muxed [[OneNAND]] 512MB (0x50) Sync
349 1 Denis 'GNUtoo' Carikli
Scanning Bad Block .......
350
Bad Block 77 (5)
351
Bad Block 295 (5)
352
Bad Block 1232 (5)
353
Bad Block 1646 (5)
354
Bad Block 1831 (5)
355
Bad Block 2047 (0)
356
Partitions loading success
357 9 Paul Kocialkowski
Read image(PARAM) from flash .......
358
Done
359
init_fuel_gauge: vcell = 4083mV, soc = 94
360
PMIC_IRQ1    = 0xc0 
361
PMIC_IRQ2    = 0x0 
362
PMIC_IRQ3    = 0x0 
363
PMIC_IRQ4    = 0x0 
364
PMIC_STATUS1 = 0x0 
365
PMIC_STATUS2 = 0x0 
366
PMIC_STATUS3 = 0x0 
367
PMIC_STATUS4 = 0x0 
368
PMIC_STATUS5 = 0x0 
369
PMIC_SMPL    = 0x0 
370
Key scan = 0x0
371
message.command = 
372
message.status = 
373
message.recovery = 
374 16 Paul Kocialkowski
</pre>
375 9 Paul Kocialkowski
376
second bootloader #2:
377 16 Paul Kocialkowski
<pre>
378 9 Paul Kocialkowski
BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
379
LCD ID = 0x0060a953
380
Done
381
Kernel(boot.img) read success from partition no.5
382
Setting param.serialnr = 0x3733bab6 0x6de200ec
383
Setting param.board_rev = 0x34
384
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
385
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265
386
387
Starting kernel at 0x30008000...
388
389 4 Denis 'GNUtoo' Carikli
Uncompressing Linux... done, booting the kernel.
390 16 Paul Kocialkowski
</pre>
391 4 Denis 'GNUtoo' Carikli
392
kernel
393 16 Paul Kocialkowski
<pre>
394 4 Denis 'GNUtoo' Carikli
<hit enter to activate fiq debugger>
395 16 Paul Kocialkowski
</pre>
396 4 Denis 'GNUtoo' Carikli
397 16 Paul Kocialkowski
398
h2. TODO
399
400
* Look if "Heimdall":http://www.glassechidna.com.au/products/heimdall/ can talk to the bootrom
401
* Serial console:
402
** Use the correct resistors enabling the serial console on the FSA9480
403
** Mesure the voltage of the Nexus S serial port
404
** Make a level shifter to shift the serial port levels 
405
** Cross compile microcom or picocom 
406
** get a serial console
407
* Find the JTAG
408
* look if the first stage bootloader(after the bootrom) is signed