Project

General

Profile

SamsungSerial » History » Version 18

Paul Kocialkowski, 01/28/2012 02:30 PM

1 16 Paul Kocialkowski
h2. Introduction
2
3 1 Denis 'GNUtoo' Carikli
This page contains information on how to work on a bootloader replacement.
4
5
6 16 Paul Kocialkowski
h2. Informations
7 1 Denis 'GNUtoo' Carikli
8 16 Paul Kocialkowski
* The "official u-boot source code":http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses
9
* The S5PC110 has a bootrom
10
* The Nexus S has an usb port with an FSA9480 behind it
11 1 Denis 'GNUtoo' Carikli
12
13 16 Paul Kocialkowski
h2. Links of interest
14
15
16
* "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick - XDA-Developers Forums":http://forum.xda-developers.com/showthread.php?t=1233273
17
* "HOW-TO [[UnBrick]] the [[UnBrickable]] Vibrant - xda-developers":http://forum.xda-developers.com/showthread.php?t=1277056
18
* "Boot sequence interception/redirection for Hummingbird processors":http://code.google.com/p/hummingbird-hibl/
19
* "source code for hummingbird-hibl":http://code.google.com/p/hummingbird-hibl/source/browse/trunk/HummingBirdInterceptorBootloader/
20
21
22
h3. Partitioning informations
23
24
25
<pre>
26 8 Paul Kocialkowski
Entry Count: 16
27
Unknown 1: 0
28
Unknown 2: 0
29
Unknown 3: 0
30
Unknown 4: 0
31
Unknown 5: 0
32
Unknown 6: 0
33
Unknown 7: 0
34
Unknown 8: 0
35
36
37
--- Entry #0 ---
38
Unused: No
39
Partition Type: 0 (RFS)
40
Partition Identifier: 0
41
Partition Flags: 0 (R)
42
Unknown 1: 0
43
Partition Block Size: 256
44
Partition Block Count: 1
45
Unknown 2: 0
46
Unknown 3: 0
47
Partition Name: IPBL
48
Filename: bootloader.img
49
50
51
--- Entry #1 ---
52
Unused: No
53
Partition Type: 0 (RFS)
54
Partition Identifier: 1
55
Partition Flags: 0 (R)
56
Unknown 1: 0
57
Partition Block Size: 256
58
Partition Block Count: 7
59
Unknown 2: 0
60
Unknown 3: 0
61
Partition Name: SBL
62
Filename: 
63
64
65
--- Entry #2 ---
66
Unused: No
67
Partition Type: 0 (RFS)
68
Partition Identifier: 2
69
Partition Flags: 0 (R)
70
Unknown 1: 0
71
Partition Block Size: 256
72
Partition Block Count: 7
73
Unknown 2: 0
74
Unknown 3: 0
75
Partition Name: SBL2
76
Filename: 
77
78
79
--- Entry #3 ---
80
Unused: No
81
Partition Type: 0 (RFS)
82
Partition Identifier: 3
83
Partition Flags: 0 (R)
84
Unknown 1: 0
85
Partition Block Size: 256
86
Partition Block Count: 4
87
Unknown 2: 0
88
Unknown 3: 0
89
Partition Name: PARAM
90
Filename: 
91
92
93
--- Entry #4 ---
94
Unused: No
95
Partition Type: 0 (RFS)
96
Partition Identifier: 4
97
Partition Flags: 0 (R)
98
Unknown 1: 0
99
Partition Block Size: 256
100
Partition Block Count: 5
101
Unknown 2: 0
102
Unknown 3: 0
103
Partition Name: MISC
104
Filename: 
105
106
107
--- Entry #5 ---
108
Unused: No
109
Partition Type: 0 (RFS)
110
Partition Identifier: 5
111
Partition Flags: 0 (R)
112
Unknown 1: 0
113
Partition Block Size: 256
114
Partition Block Count: 32
115
Unknown 2: 0
116
Unknown 3: 0
117
Partition Name: BOOT
118
Filename: boot.img
119
120
121
--- Entry #6 ---
122
Unused: No
123
Partition Type: 0 (RFS)
124
Partition Identifier: 6
125
Partition Flags: 0 (R)
126
Unknown 1: 0
127
Partition Block Size: 256
128
Partition Block Count: 32
129
Unknown 2: 0
130
Unknown 3: 0
131
Partition Name: RECOVERY
132
Filename: recovery.img
133
134
135
--- Entry #7 ---
136
Unused: No
137
Partition Type: 0 (RFS)
138
Partition Identifier: 7
139
Partition Flags: 1 (R)
140
Unknown 1: 0
141
Partition Block Size: 256
142
Partition Block Count: 1878
143
Unknown 2: 0
144
Unknown 3: 0
145
Partition Name: CACHE
146
Filename: cache.img
147
148
149
--- Entry #8 ---
150
Unused: Yes
151
Partition Type: 0 (RFS)
152
Partition Identifier: 8
153
Partition Flags: 0 (R)
154
Unknown 1: 0
155
Partition Block Size: 256
156
Partition Block Count: 54
157
Unknown 2: 0
158
Unknown 3: 0
159
Partition Name: RADIO
160
Filename: radio.img
161
162
163
--- Entry #9 ---
164
Unused: No
165
Partition Type: 0 (RFS)
166
Partition Identifier: 9
167
Partition Flags: 1 (R)
168
Unknown 1: 0
169
Partition Block Size: 256
170
Partition Block Count: 27
171
Unknown 2: 0
172
Unknown 3: 0
173
Partition Name: EFS
174
Filename: 
175
176
177
--- Entry #10 ---
178
Unused: No
179
Partition Type: 0 (RFS)
180
Partition Identifier: 10
181
Partition Flags: 0 (R)
182
Unknown 1: 0
183
Partition Block Size: 256
184
Partition Block Count: 1
185
Unknown 2: 0
186
Unknown 3: 0
187
Partition Name: DGS
188
Filename: dgs.img
189
190
191
--- Entry #11 ---
192
Unused: No
193
Partition Type: 2 (EXT4)
194
Partition Identifier: 0
195
Partition Flags: 2 (R/W)
196
Unknown 1: 0
197
Partition Block Size: 512
198
Partition Block Count: 2048
199
Unknown 2: 0
200
Unknown 3: 0
201
Partition Name: PGPT
202
Filename: emmc.img
203
204
205
--- Entry #12 ---
206
Unused: No
207
Partition Type: 2 (EXT4)
208
Partition Identifier: 1
209
Partition Flags: 2 (R/W)
210
Unknown 1: 0
211
Partition Block Size: 512
212
Partition Block Count: 1048576
213
Unknown 2: 0
214
Unknown 3: 0
215
Partition Name: SYSTEM
216
Filename: system.img
217
218
219
--- Entry #13 ---
220
Unused: No
221
Partition Type: 2 (EXT4)
222
Partition Identifier: 2
223
Partition Flags: 2 (R/W)
224
Unknown 1: 0
225
Partition Block Size: 512
226
Partition Block Count: 2097152
227
Unknown 2: 0
228
Unknown 3: 0
229
Partition Name: USERDATA
230
Filename: userdata.img
231
232
233
--- Entry #14 ---
234
Unused: No
235
Partition Type: 2 (EXT4)
236
Partition Identifier: 3
237
Partition Flags: 2 (R/W)
238
Unknown 1: 0
239
Partition Block Size: 512
240
Partition Block Count: 33554432
241
Unknown 2: 0
242
Unknown 3: 0
243
Partition Name: MEDIA
244
Filename: media.img
245 1 Denis 'GNUtoo' Carikli
246
247
--- Entry #15 ---
248
Unused: No
249
Partition Type: 2 (EXT4)
250
Partition Identifier: 4
251
Partition Flags: 2 (R/W)
252
Unknown 1: 0
253
Partition Block Size: 512
254
Partition Block Count: 33
255 9 Paul Kocialkowski
Unknown 2: 0
256
Unknown 3: 0
257
Partition Name: SGPT
258 10 Paul Kocialkowski
Filename: 
259 16 Paul Kocialkowski
</pre>
260 10 Paul Kocialkowski
261 16 Paul Kocialkowski
h2. Serial Console
262
263 10 Paul Kocialkowski
It is possible to setup a serial console on the Nexus S. It will show:
264 16 Paul Kocialkowski
* the 1st bootloader output
265
* the 2nd bootloader output
266
* the 2nd bootloader #2 output
267
* the fiq debugger
268
* (the kernel output if enabled)
269 10 Paul Kocialkowski
270 9 Paul Kocialkowski
271 16 Paul Kocialkowski
h3. How to enable serial console
272
273
* completely turn off the Nexus S
274 1 Denis 'GNUtoo' Carikli
* attach the microUSB connector to the Nexus S
275
* wire GND and ID (from the microUSB connector) to a 150K resistor
276
* get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872
277
* wire it following this table:
278 16 Paul Kocialkowski
279 17 Paul Kocialkowski
|_. UART to USB board output |_. Resistor |_. microUSB connector(s) name(s) |_. microUSB wire color |
280
| N/A | 150K Ohm | ID and GND | ID not wired (the 5th connector that is unused), GND is black |
281
| 3.3V | N/A | V+ | red |
282
| GND | N/A | GND | black |
283
| Rx | N/A | D- | white |
284
| Tx | N/A | D+ | green |
285
286 13 Paul Kocialkowski
*Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.*
287 1 Denis 'GNUtoo' Carikli
288 16 Paul Kocialkowski
To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles):
289
115200 is the baud rate to use (certainly with most UART to USB board). 
290 1 Denis 'GNUtoo' Carikli
291 13 Paul Kocialkowski
Then, do a regular boot. You should see the second bootloader #2 output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>.
292
293
Photos: here's what it looks like when all setup:
294
295 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/uart_board.jpg!
296 13 Paul Kocialkowski
297
The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector.
298
299 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/nexuss_resistor.jpg!
300 1 Denis 'GNUtoo' Carikli
301
The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S.
302 16 Paul Kocialkowski
303 9 Paul Kocialkowski
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
304
305 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/nexuss_global_text.jpg!
306 9 Paul Kocialkowski
307 16 Paul Kocialkowski
The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board.
308 9 Paul Kocialkowski
309
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
310 16 Paul Kocialkowski
311
h3. Bootloaders outputs
312
313 9 Paul Kocialkowski
first bootloader:
314 16 Paul Kocialkowski
<pre>
315 9 Paul Kocialkowski
-----------------------------------------------------------
316
   Samsung Primitive Bootloader (PBL) v3.0
317 1 Denis 'GNUtoo' Carikli
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
318 9 Paul Kocialkowski
-----------------------------------------------------------
319
320
Muxed [[OneNAND]] 512MB (0x50) Sync
321 16 Paul Kocialkowski
Scanning Bad Block .......
322 9 Paul Kocialkowski
Bad Block 77 (5)
323
Bad Block 295 (5)
324
Bad Block 1232 (5)
325
Bad Block 1646 (5)
326
Bad Block 1831 (5)
327
Bad Block 2047 (0)
328
SBL loadding success
329
330
Set cpu clk. from 400MHz to 800MHz.
331
OM=0x9, device=OnenandMux(Audi)
332
IROM e-fused - Secure Boot Version.
333 16 Paul Kocialkowski
</pre>
334 9 Paul Kocialkowski
335 17 Paul Kocialkowski
second bootloader:51ea3aaa63e65b74b7386fe1365d7b52f4495c43
336 16 Paul Kocialkowski
<pre>
337 1 Denis 'GNUtoo' Carikli
-----------------------------------------------------------
338 9 Paul Kocialkowski
   Samsung Secondary Bootloader (SBL) v3.0
339
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
340
341
   Board Name: HERRING REV 52
342
   Build On: Jan 20 2011 17:19:41
343
-----------------------------------------------------------
344 1 Denis 'GNUtoo' Carikli
345
MMC SEM16G 15188 MB
346
Re_partition: magic code(0x0)
347 16 Paul Kocialkowski
Muxed [[OneNAND]] 512MB (0x50) Sync
348 1 Denis 'GNUtoo' Carikli
Scanning Bad Block .......
349
Bad Block 77 (5)
350
Bad Block 295 (5)
351
Bad Block 1232 (5)
352
Bad Block 1646 (5)
353
Bad Block 1831 (5)
354
Bad Block 2047 (0)
355
Partitions loading success
356 9 Paul Kocialkowski
Read image(PARAM) from flash .......
357
Done
358
init_fuel_gauge: vcell = 4083mV, soc = 94
359
PMIC_IRQ1    = 0xc0 
360
PMIC_IRQ2    = 0x0 
361
PMIC_IRQ3    = 0x0 
362
PMIC_IRQ4    = 0x0 
363
PMIC_STATUS1 = 0x0 
364
PMIC_STATUS2 = 0x0 
365
PMIC_STATUS3 = 0x0 
366
PMIC_STATUS4 = 0x0 
367
PMIC_STATUS5 = 0x0 
368
PMIC_SMPL    = 0x0 
369
Key scan = 0x0
370
message.command = 
371
message.status = 
372
message.recovery = 
373 16 Paul Kocialkowski
</pre>
374 9 Paul Kocialkowski
375
second bootloader #2:
376 16 Paul Kocialkowski
<pre>
377 9 Paul Kocialkowski
BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
378
LCD ID = 0x0060a953
379
Done
380
Kernel(boot.img) read success from partition no.5
381
Setting param.serialnr = 0x3733bab6 0x6de200ec
382
Setting param.board_rev = 0x34
383
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
384
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265
385
386
Starting kernel at 0x30008000...
387
388 4 Denis 'GNUtoo' Carikli
Uncompressing Linux... done, booting the kernel.
389 16 Paul Kocialkowski
</pre>
390 4 Denis 'GNUtoo' Carikli
391
kernel
392 16 Paul Kocialkowski
<pre>
393 4 Denis 'GNUtoo' Carikli
<hit enter to activate fiq debugger>
394 16 Paul Kocialkowski
</pre>
395 1 Denis 'GNUtoo' Carikli
396 18 Paul Kocialkowski
h2. JTAG
397 16 Paul Kocialkowski
398 18 Paul Kocialkowski
Here is the location and the description of the JTAG pins on the Nexus S board:
399 16 Paul Kocialkowski
400 18 Paul Kocialkowski
401
402
h2 Conclusions
403
404
* The bootrom seems signed