Project

General

Profile

SamsungSerial » History » Version 24

Paul Kocialkowski, 09/13/2012 04:52 PM

1 16 Paul Kocialkowski
h2. Introduction
2
3 1 Denis 'GNUtoo' Carikli
This page contains information on how to work on a bootloader replacement.
4
5
6 16 Paul Kocialkowski
h2. Informations
7 1 Denis 'GNUtoo' Carikli
8 16 Paul Kocialkowski
* The "official u-boot source code":http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses
9
* The S5PC110 has a bootrom
10
* The Nexus S has an usb port with an FSA9480 behind it
11 1 Denis 'GNUtoo' Carikli
12
13 16 Paul Kocialkowski
h2. Links of interest
14
15
16
* "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick - XDA-Developers Forums":http://forum.xda-developers.com/showthread.php?t=1233273
17
* "HOW-TO [[UnBrick]] the [[UnBrickable]] Vibrant - xda-developers":http://forum.xda-developers.com/showthread.php?t=1277056
18
* "Boot sequence interception/redirection for Hummingbird processors":http://code.google.com/p/hummingbird-hibl/
19
* "source code for hummingbird-hibl":http://code.google.com/p/hummingbird-hibl/source/browse/trunk/HummingBirdInterceptorBootloader/
20 23 Paul Kocialkowski
* "Unbrick Your Hummingbird-Powered Device by Creating Your Own Bootloader":http://www.xda-developers.com/android/unbrick-your-hummingbird-powered-device-by-creating-your-own-bootloader/
21
* "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick":http://forum.xda-developers.com/showthread.php?t=1233273
22 16 Paul Kocialkowski
23
h3. Partitioning informations
24
25
26
<pre>
27 8 Paul Kocialkowski
Entry Count: 16
28
Unknown 1: 0
29
Unknown 2: 0
30
Unknown 3: 0
31
Unknown 4: 0
32
Unknown 5: 0
33
Unknown 6: 0
34
Unknown 7: 0
35
Unknown 8: 0
36
37
38
--- Entry #0 ---
39
Unused: No
40
Partition Type: 0 (RFS)
41
Partition Identifier: 0
42
Partition Flags: 0 (R)
43
Unknown 1: 0
44
Partition Block Size: 256
45
Partition Block Count: 1
46
Unknown 2: 0
47
Unknown 3: 0
48
Partition Name: IPBL
49
Filename: bootloader.img
50
51
52
--- Entry #1 ---
53
Unused: No
54
Partition Type: 0 (RFS)
55
Partition Identifier: 1
56
Partition Flags: 0 (R)
57
Unknown 1: 0
58
Partition Block Size: 256
59
Partition Block Count: 7
60
Unknown 2: 0
61
Unknown 3: 0
62
Partition Name: SBL
63
Filename: 
64
65
66
--- Entry #2 ---
67
Unused: No
68
Partition Type: 0 (RFS)
69
Partition Identifier: 2
70
Partition Flags: 0 (R)
71
Unknown 1: 0
72
Partition Block Size: 256
73
Partition Block Count: 7
74
Unknown 2: 0
75
Unknown 3: 0
76
Partition Name: SBL2
77
Filename: 
78
79
80
--- Entry #3 ---
81
Unused: No
82
Partition Type: 0 (RFS)
83
Partition Identifier: 3
84
Partition Flags: 0 (R)
85
Unknown 1: 0
86
Partition Block Size: 256
87
Partition Block Count: 4
88
Unknown 2: 0
89
Unknown 3: 0
90
Partition Name: PARAM
91
Filename: 
92
93
94
--- Entry #4 ---
95
Unused: No
96
Partition Type: 0 (RFS)
97
Partition Identifier: 4
98
Partition Flags: 0 (R)
99
Unknown 1: 0
100
Partition Block Size: 256
101
Partition Block Count: 5
102
Unknown 2: 0
103
Unknown 3: 0
104
Partition Name: MISC
105
Filename: 
106
107
108
--- Entry #5 ---
109
Unused: No
110
Partition Type: 0 (RFS)
111
Partition Identifier: 5
112
Partition Flags: 0 (R)
113
Unknown 1: 0
114
Partition Block Size: 256
115
Partition Block Count: 32
116
Unknown 2: 0
117
Unknown 3: 0
118
Partition Name: BOOT
119
Filename: boot.img
120
121
122
--- Entry #6 ---
123
Unused: No
124
Partition Type: 0 (RFS)
125
Partition Identifier: 6
126
Partition Flags: 0 (R)
127
Unknown 1: 0
128
Partition Block Size: 256
129
Partition Block Count: 32
130
Unknown 2: 0
131
Unknown 3: 0
132
Partition Name: RECOVERY
133
Filename: recovery.img
134
135
136
--- Entry #7 ---
137
Unused: No
138
Partition Type: 0 (RFS)
139
Partition Identifier: 7
140
Partition Flags: 1 (R)
141
Unknown 1: 0
142
Partition Block Size: 256
143
Partition Block Count: 1878
144
Unknown 2: 0
145
Unknown 3: 0
146
Partition Name: CACHE
147
Filename: cache.img
148
149
150
--- Entry #8 ---
151
Unused: Yes
152
Partition Type: 0 (RFS)
153
Partition Identifier: 8
154
Partition Flags: 0 (R)
155
Unknown 1: 0
156
Partition Block Size: 256
157
Partition Block Count: 54
158
Unknown 2: 0
159
Unknown 3: 0
160
Partition Name: RADIO
161
Filename: radio.img
162
163
164
--- Entry #9 ---
165
Unused: No
166
Partition Type: 0 (RFS)
167
Partition Identifier: 9
168
Partition Flags: 1 (R)
169
Unknown 1: 0
170
Partition Block Size: 256
171
Partition Block Count: 27
172
Unknown 2: 0
173
Unknown 3: 0
174
Partition Name: EFS
175
Filename: 
176
177
178
--- Entry #10 ---
179
Unused: No
180
Partition Type: 0 (RFS)
181
Partition Identifier: 10
182
Partition Flags: 0 (R)
183
Unknown 1: 0
184
Partition Block Size: 256
185
Partition Block Count: 1
186
Unknown 2: 0
187
Unknown 3: 0
188
Partition Name: DGS
189
Filename: dgs.img
190
191
192
--- Entry #11 ---
193
Unused: No
194
Partition Type: 2 (EXT4)
195
Partition Identifier: 0
196
Partition Flags: 2 (R/W)
197
Unknown 1: 0
198
Partition Block Size: 512
199
Partition Block Count: 2048
200
Unknown 2: 0
201
Unknown 3: 0
202
Partition Name: PGPT
203
Filename: emmc.img
204
205
206
--- Entry #12 ---
207
Unused: No
208
Partition Type: 2 (EXT4)
209
Partition Identifier: 1
210
Partition Flags: 2 (R/W)
211
Unknown 1: 0
212
Partition Block Size: 512
213
Partition Block Count: 1048576
214
Unknown 2: 0
215
Unknown 3: 0
216
Partition Name: SYSTEM
217
Filename: system.img
218
219
220
--- Entry #13 ---
221
Unused: No
222
Partition Type: 2 (EXT4)
223
Partition Identifier: 2
224
Partition Flags: 2 (R/W)
225
Unknown 1: 0
226
Partition Block Size: 512
227
Partition Block Count: 2097152
228
Unknown 2: 0
229
Unknown 3: 0
230
Partition Name: USERDATA
231
Filename: userdata.img
232
233
234
--- Entry #14 ---
235
Unused: No
236
Partition Type: 2 (EXT4)
237
Partition Identifier: 3
238
Partition Flags: 2 (R/W)
239
Unknown 1: 0
240
Partition Block Size: 512
241
Partition Block Count: 33554432
242
Unknown 2: 0
243
Unknown 3: 0
244
Partition Name: MEDIA
245
Filename: media.img
246 1 Denis 'GNUtoo' Carikli
247
248
--- Entry #15 ---
249
Unused: No
250
Partition Type: 2 (EXT4)
251
Partition Identifier: 4
252
Partition Flags: 2 (R/W)
253
Unknown 1: 0
254
Partition Block Size: 512
255
Partition Block Count: 33
256 9 Paul Kocialkowski
Unknown 2: 0
257
Unknown 3: 0
258
Partition Name: SGPT
259 10 Paul Kocialkowski
Filename: 
260 16 Paul Kocialkowski
</pre>
261 10 Paul Kocialkowski
262 16 Paul Kocialkowski
h2. Serial Console
263
264 10 Paul Kocialkowski
It is possible to setup a serial console on the Nexus S. It will show:
265 16 Paul Kocialkowski
* the 1st bootloader output
266
* the 2nd bootloader output
267
* the 2nd bootloader #2 output
268
* the fiq debugger
269
* (the kernel output if enabled)
270 10 Paul Kocialkowski
271 9 Paul Kocialkowski
272 16 Paul Kocialkowski
h3. How to enable serial console
273
274
* completely turn off the Nexus S
275 1 Denis 'GNUtoo' Carikli
* attach the microUSB connector to the Nexus S
276
* wire GND and ID (from the microUSB connector) to a 150K resistor
277
* get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872
278
* wire it following this table:
279 16 Paul Kocialkowski
280 17 Paul Kocialkowski
|_. UART to USB board output |_. Resistor |_. microUSB connector(s) name(s) |_. microUSB wire color |
281
| N/A | 150K Ohm | ID and GND | ID not wired (the 5th connector that is unused), GND is black |
282
| 3.3V | N/A | V+ | red |
283
| GND | N/A | GND | black |
284
| Rx | N/A | D- | white |
285
| Tx | N/A | D+ | green |
286
287 13 Paul Kocialkowski
*Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.*
288 1 Denis 'GNUtoo' Carikli
289 16 Paul Kocialkowski
To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles):
290
115200 is the baud rate to use (certainly with most UART to USB board). 
291 1 Denis 'GNUtoo' Carikli
292 13 Paul Kocialkowski
Then, do a regular boot. You should see the second bootloader #2 output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>.
293
294
Photos: here's what it looks like when all setup:
295 22 Denis 'GNUtoo' Carikli
!http://redmine.replicant.us/attachments/93/serial_1145.jpeg!
296
!http://redmine.replicant.us/attachments/99/serial_1150.JPG!
297
!http://redmine.replicant.us/attachments/105/serial_1151.jpeg!
298 13 Paul Kocialkowski
299 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/uart_board.jpg!
300 13 Paul Kocialkowski
301
The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector.
302
303 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/nexuss_resistor.jpg!
304 1 Denis 'GNUtoo' Carikli
305
The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S.
306 16 Paul Kocialkowski
307 9 Paul Kocialkowski
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
308
309 17 Paul Kocialkowski
!http://download.paulk.fr/replicant/crespo/uart/nexuss_global_text.jpg!
310 9 Paul Kocialkowski
311 16 Paul Kocialkowski
The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board.
312 9 Paul Kocialkowski
313
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
314 16 Paul Kocialkowski
315
h3. Bootloaders outputs
316
317 24 Paul Kocialkowski
h4. Nexus S
318
319 9 Paul Kocialkowski
first bootloader:
320 16 Paul Kocialkowski
<pre>
321 9 Paul Kocialkowski
-----------------------------------------------------------
322
   Samsung Primitive Bootloader (PBL) v3.0
323 1 Denis 'GNUtoo' Carikli
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
324 9 Paul Kocialkowski
-----------------------------------------------------------
325
326
Muxed [[OneNAND]] 512MB (0x50) Sync
327 16 Paul Kocialkowski
Scanning Bad Block .......
328 9 Paul Kocialkowski
Bad Block 77 (5)
329
Bad Block 295 (5)
330
Bad Block 1232 (5)
331
Bad Block 1646 (5)
332
Bad Block 1831 (5)
333
Bad Block 2047 (0)
334
SBL loadding success
335
336
Set cpu clk. from 400MHz to 800MHz.
337
OM=0x9, device=OnenandMux(Audi)
338
IROM e-fused - Secure Boot Version.
339 16 Paul Kocialkowski
</pre>
340 9 Paul Kocialkowski
341 17 Paul Kocialkowski
second bootloader:51ea3aaa63e65b74b7386fe1365d7b52f4495c43
342 16 Paul Kocialkowski
<pre>
343 1 Denis 'GNUtoo' Carikli
-----------------------------------------------------------
344 9 Paul Kocialkowski
   Samsung Secondary Bootloader (SBL) v3.0
345
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
346
347
   Board Name: HERRING REV 52
348
   Build On: Jan 20 2011 17:19:41
349
-----------------------------------------------------------
350 1 Denis 'GNUtoo' Carikli
351
MMC SEM16G 15188 MB
352
Re_partition: magic code(0x0)
353 16 Paul Kocialkowski
Muxed [[OneNAND]] 512MB (0x50) Sync
354 1 Denis 'GNUtoo' Carikli
Scanning Bad Block .......
355
Bad Block 77 (5)
356
Bad Block 295 (5)
357
Bad Block 1232 (5)
358
Bad Block 1646 (5)
359
Bad Block 1831 (5)
360
Bad Block 2047 (0)
361
Partitions loading success
362 9 Paul Kocialkowski
Read image(PARAM) from flash .......
363
Done
364
init_fuel_gauge: vcell = 4083mV, soc = 94
365
PMIC_IRQ1    = 0xc0 
366
PMIC_IRQ2    = 0x0 
367
PMIC_IRQ3    = 0x0 
368
PMIC_IRQ4    = 0x0 
369
PMIC_STATUS1 = 0x0 
370
PMIC_STATUS2 = 0x0 
371
PMIC_STATUS3 = 0x0 
372
PMIC_STATUS4 = 0x0 
373
PMIC_STATUS5 = 0x0 
374
PMIC_SMPL    = 0x0 
375
Key scan = 0x0
376
message.command = 
377
message.status = 
378
message.recovery = 
379 16 Paul Kocialkowski
</pre>
380 9 Paul Kocialkowski
381
second bootloader #2:
382 16 Paul Kocialkowski
<pre>
383 9 Paul Kocialkowski
BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
384
LCD ID = 0x0060a953
385
Done
386
Kernel(boot.img) read success from partition no.5
387
Setting param.serialnr = 0x3733bab6 0x6de200ec
388
Setting param.board_rev = 0x34
389
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
390
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265
391
392
Starting kernel at 0x30008000...
393
394 4 Denis 'GNUtoo' Carikli
Uncompressing Linux... done, booting the kernel.
395 16 Paul Kocialkowski
</pre>
396 4 Denis 'GNUtoo' Carikli
397
kernel
398 16 Paul Kocialkowski
<pre>
399 4 Denis 'GNUtoo' Carikli
<hit enter to activate fiq debugger>
400 24 Paul Kocialkowski
</pre>
401
402
h4. Galaxy Nexus 
403
404
<pre>
405
reading nps status file is successfully!.
406
nps status=0x504d4f43
407
PMIC_IRQ1    = 0x80 
408
PMIC_IRQ2    = 0x0 
409
PMIC_IRQ3    = 0x1 
410
PMIC_IRQ4    = 0x0 
411
PMIC_STATUS1 = 0x80 
412
PMIC_STATUS2 = 0x0 
413
get_debug_level current debug level is 0x574f4c44.
414
aries_process_platform: Debug Level Low
415
keypad_scan: key value ----------------->= 0x40
416
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48 
417
aries_process_platform: final s1 booting mode = 0
418
DISPLAY_PATH_SEL[MDNIE 0x1]is on
419
MDNIE setting Init start!!
420
vsync interrupt is off
421
video interrupt is off
422
[fb0] turn on
423
MDNIE setting Init end!!
424
425
Autoboot (0 seconds) in progress, press any key to stop 
426
get_debug_level current debug level is 0x574f4c44.
427
get_debug_level current debug level is 0x574f4c44.
428
boot_kernel: Debug Level Low
429
FOTA Check Bit 
430
 Read BML page=, NumPgs=
431
FOTA Check Bit (0xffffffff)
432
Load Partion idx = (6)
433
..............................done
434
Kernel read success from kernel partition no.6, idx.6.
435
setting param.serialnr=0x38301804 0xb3e900ec
436
setting param.board_rev=0x30
437
setting param.cmdline=console=ttySAC2,115200 loglevel=4
438
439
Starting kernel at 0x32000000...
440 16 Paul Kocialkowski
</pre>
441 1 Denis 'GNUtoo' Carikli
442 18 Paul Kocialkowski
h2. JTAG
443 16 Paul Kocialkowski
444 18 Paul Kocialkowski
Here is the location and the description of the JTAG pins on the Nexus S board:
445 16 Paul Kocialkowski
446 19 Paul Kocialkowski
!http://redmine.replicant.us/attachments/3/jtag-pins.png!
447 20 Paul Kocialkowski
!http://redmine.replicant.us/attachments/9/jtag-pins-desc.png!
448 18 Paul Kocialkowski
449 19 Paul Kocialkowski
JTAG was untested on the device so far. 
450 1 Denis 'GNUtoo' Carikli
451 19 Paul Kocialkowski
h2. Conclusions
452 1 Denis 'GNUtoo' Carikli
453 19 Paul Kocialkowski
* Heimdall mode is accessible but we didn't try to flash images with heimdall
454
* Serial can be set up and works
455
* The bootrom(IROM) seems signed: <pre>IROM e-fused</pre>
456
* JTAG is there but we didn't try it
457
458
*As the IROM is apparently signed, porting a free bootloader will most likely fail as Primary Boot Loader (PBL).*