SamsungSerial » History » Version 24
Paul Kocialkowski, 09/13/2012 04:52 PM
1 | 16 | Paul Kocialkowski | h2. Introduction |
---|---|---|---|
2 | |||
3 | 1 | Denis 'GNUtoo' Carikli | This page contains information on how to work on a bootloader replacement. |
4 | |||
5 | |||
6 | 16 | Paul Kocialkowski | h2. Informations |
7 | 1 | Denis 'GNUtoo' Carikli | |
8 | 16 | Paul Kocialkowski | * The "official u-boot source code":http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses |
9 | * The S5PC110 has a bootrom |
||
10 | * The Nexus S has an usb port with an FSA9480 behind it |
||
11 | 1 | Denis 'GNUtoo' Carikli | |
12 | |||
13 | 16 | Paul Kocialkowski | h2. Links of interest |
14 | |||
15 | |||
16 | * "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick - XDA-Developers Forums":http://forum.xda-developers.com/showthread.php?t=1233273 |
||
17 | * "HOW-TO [[UnBrick]] the [[UnBrickable]] Vibrant - xda-developers":http://forum.xda-developers.com/showthread.php?t=1277056 |
||
18 | * "Boot sequence interception/redirection for Hummingbird processors":http://code.google.com/p/hummingbird-hibl/ |
||
19 | * "source code for hummingbird-hibl":http://code.google.com/p/hummingbird-hibl/source/browse/trunk/HummingBirdInterceptorBootloader/ |
||
20 | 23 | Paul Kocialkowski | * "Unbrick Your Hummingbird-Powered Device by Creating Your Own Bootloader":http://www.xda-developers.com/android/unbrick-your-hummingbird-powered-device-by-creating-your-own-bootloader/ |
21 | * "Create your own I9000/S8500 (& all S5PC110 based devices) bootloader&ultimate unbrick":http://forum.xda-developers.com/showthread.php?t=1233273 |
||
22 | 16 | Paul Kocialkowski | |
23 | h3. Partitioning informations |
||
24 | |||
25 | |||
26 | <pre> |
||
27 | 8 | Paul Kocialkowski | Entry Count: 16 |
28 | Unknown 1: 0 |
||
29 | Unknown 2: 0 |
||
30 | Unknown 3: 0 |
||
31 | Unknown 4: 0 |
||
32 | Unknown 5: 0 |
||
33 | Unknown 6: 0 |
||
34 | Unknown 7: 0 |
||
35 | Unknown 8: 0 |
||
36 | |||
37 | |||
38 | --- Entry #0 --- |
||
39 | Unused: No |
||
40 | Partition Type: 0 (RFS) |
||
41 | Partition Identifier: 0 |
||
42 | Partition Flags: 0 (R) |
||
43 | Unknown 1: 0 |
||
44 | Partition Block Size: 256 |
||
45 | Partition Block Count: 1 |
||
46 | Unknown 2: 0 |
||
47 | Unknown 3: 0 |
||
48 | Partition Name: IPBL |
||
49 | Filename: bootloader.img |
||
50 | |||
51 | |||
52 | --- Entry #1 --- |
||
53 | Unused: No |
||
54 | Partition Type: 0 (RFS) |
||
55 | Partition Identifier: 1 |
||
56 | Partition Flags: 0 (R) |
||
57 | Unknown 1: 0 |
||
58 | Partition Block Size: 256 |
||
59 | Partition Block Count: 7 |
||
60 | Unknown 2: 0 |
||
61 | Unknown 3: 0 |
||
62 | Partition Name: SBL |
||
63 | Filename: |
||
64 | |||
65 | |||
66 | --- Entry #2 --- |
||
67 | Unused: No |
||
68 | Partition Type: 0 (RFS) |
||
69 | Partition Identifier: 2 |
||
70 | Partition Flags: 0 (R) |
||
71 | Unknown 1: 0 |
||
72 | Partition Block Size: 256 |
||
73 | Partition Block Count: 7 |
||
74 | Unknown 2: 0 |
||
75 | Unknown 3: 0 |
||
76 | Partition Name: SBL2 |
||
77 | Filename: |
||
78 | |||
79 | |||
80 | --- Entry #3 --- |
||
81 | Unused: No |
||
82 | Partition Type: 0 (RFS) |
||
83 | Partition Identifier: 3 |
||
84 | Partition Flags: 0 (R) |
||
85 | Unknown 1: 0 |
||
86 | Partition Block Size: 256 |
||
87 | Partition Block Count: 4 |
||
88 | Unknown 2: 0 |
||
89 | Unknown 3: 0 |
||
90 | Partition Name: PARAM |
||
91 | Filename: |
||
92 | |||
93 | |||
94 | --- Entry #4 --- |
||
95 | Unused: No |
||
96 | Partition Type: 0 (RFS) |
||
97 | Partition Identifier: 4 |
||
98 | Partition Flags: 0 (R) |
||
99 | Unknown 1: 0 |
||
100 | Partition Block Size: 256 |
||
101 | Partition Block Count: 5 |
||
102 | Unknown 2: 0 |
||
103 | Unknown 3: 0 |
||
104 | Partition Name: MISC |
||
105 | Filename: |
||
106 | |||
107 | |||
108 | --- Entry #5 --- |
||
109 | Unused: No |
||
110 | Partition Type: 0 (RFS) |
||
111 | Partition Identifier: 5 |
||
112 | Partition Flags: 0 (R) |
||
113 | Unknown 1: 0 |
||
114 | Partition Block Size: 256 |
||
115 | Partition Block Count: 32 |
||
116 | Unknown 2: 0 |
||
117 | Unknown 3: 0 |
||
118 | Partition Name: BOOT |
||
119 | Filename: boot.img |
||
120 | |||
121 | |||
122 | --- Entry #6 --- |
||
123 | Unused: No |
||
124 | Partition Type: 0 (RFS) |
||
125 | Partition Identifier: 6 |
||
126 | Partition Flags: 0 (R) |
||
127 | Unknown 1: 0 |
||
128 | Partition Block Size: 256 |
||
129 | Partition Block Count: 32 |
||
130 | Unknown 2: 0 |
||
131 | Unknown 3: 0 |
||
132 | Partition Name: RECOVERY |
||
133 | Filename: recovery.img |
||
134 | |||
135 | |||
136 | --- Entry #7 --- |
||
137 | Unused: No |
||
138 | Partition Type: 0 (RFS) |
||
139 | Partition Identifier: 7 |
||
140 | Partition Flags: 1 (R) |
||
141 | Unknown 1: 0 |
||
142 | Partition Block Size: 256 |
||
143 | Partition Block Count: 1878 |
||
144 | Unknown 2: 0 |
||
145 | Unknown 3: 0 |
||
146 | Partition Name: CACHE |
||
147 | Filename: cache.img |
||
148 | |||
149 | |||
150 | --- Entry #8 --- |
||
151 | Unused: Yes |
||
152 | Partition Type: 0 (RFS) |
||
153 | Partition Identifier: 8 |
||
154 | Partition Flags: 0 (R) |
||
155 | Unknown 1: 0 |
||
156 | Partition Block Size: 256 |
||
157 | Partition Block Count: 54 |
||
158 | Unknown 2: 0 |
||
159 | Unknown 3: 0 |
||
160 | Partition Name: RADIO |
||
161 | Filename: radio.img |
||
162 | |||
163 | |||
164 | --- Entry #9 --- |
||
165 | Unused: No |
||
166 | Partition Type: 0 (RFS) |
||
167 | Partition Identifier: 9 |
||
168 | Partition Flags: 1 (R) |
||
169 | Unknown 1: 0 |
||
170 | Partition Block Size: 256 |
||
171 | Partition Block Count: 27 |
||
172 | Unknown 2: 0 |
||
173 | Unknown 3: 0 |
||
174 | Partition Name: EFS |
||
175 | Filename: |
||
176 | |||
177 | |||
178 | --- Entry #10 --- |
||
179 | Unused: No |
||
180 | Partition Type: 0 (RFS) |
||
181 | Partition Identifier: 10 |
||
182 | Partition Flags: 0 (R) |
||
183 | Unknown 1: 0 |
||
184 | Partition Block Size: 256 |
||
185 | Partition Block Count: 1 |
||
186 | Unknown 2: 0 |
||
187 | Unknown 3: 0 |
||
188 | Partition Name: DGS |
||
189 | Filename: dgs.img |
||
190 | |||
191 | |||
192 | --- Entry #11 --- |
||
193 | Unused: No |
||
194 | Partition Type: 2 (EXT4) |
||
195 | Partition Identifier: 0 |
||
196 | Partition Flags: 2 (R/W) |
||
197 | Unknown 1: 0 |
||
198 | Partition Block Size: 512 |
||
199 | Partition Block Count: 2048 |
||
200 | Unknown 2: 0 |
||
201 | Unknown 3: 0 |
||
202 | Partition Name: PGPT |
||
203 | Filename: emmc.img |
||
204 | |||
205 | |||
206 | --- Entry #12 --- |
||
207 | Unused: No |
||
208 | Partition Type: 2 (EXT4) |
||
209 | Partition Identifier: 1 |
||
210 | Partition Flags: 2 (R/W) |
||
211 | Unknown 1: 0 |
||
212 | Partition Block Size: 512 |
||
213 | Partition Block Count: 1048576 |
||
214 | Unknown 2: 0 |
||
215 | Unknown 3: 0 |
||
216 | Partition Name: SYSTEM |
||
217 | Filename: system.img |
||
218 | |||
219 | |||
220 | --- Entry #13 --- |
||
221 | Unused: No |
||
222 | Partition Type: 2 (EXT4) |
||
223 | Partition Identifier: 2 |
||
224 | Partition Flags: 2 (R/W) |
||
225 | Unknown 1: 0 |
||
226 | Partition Block Size: 512 |
||
227 | Partition Block Count: 2097152 |
||
228 | Unknown 2: 0 |
||
229 | Unknown 3: 0 |
||
230 | Partition Name: USERDATA |
||
231 | Filename: userdata.img |
||
232 | |||
233 | |||
234 | --- Entry #14 --- |
||
235 | Unused: No |
||
236 | Partition Type: 2 (EXT4) |
||
237 | Partition Identifier: 3 |
||
238 | Partition Flags: 2 (R/W) |
||
239 | Unknown 1: 0 |
||
240 | Partition Block Size: 512 |
||
241 | Partition Block Count: 33554432 |
||
242 | Unknown 2: 0 |
||
243 | Unknown 3: 0 |
||
244 | Partition Name: MEDIA |
||
245 | Filename: media.img |
||
246 | 1 | Denis 'GNUtoo' Carikli | |
247 | |||
248 | --- Entry #15 --- |
||
249 | Unused: No |
||
250 | Partition Type: 2 (EXT4) |
||
251 | Partition Identifier: 4 |
||
252 | Partition Flags: 2 (R/W) |
||
253 | Unknown 1: 0 |
||
254 | Partition Block Size: 512 |
||
255 | Partition Block Count: 33 |
||
256 | 9 | Paul Kocialkowski | Unknown 2: 0 |
257 | Unknown 3: 0 |
||
258 | Partition Name: SGPT |
||
259 | 10 | Paul Kocialkowski | Filename: |
260 | 16 | Paul Kocialkowski | </pre> |
261 | 10 | Paul Kocialkowski | |
262 | 16 | Paul Kocialkowski | h2. Serial Console |
263 | |||
264 | 10 | Paul Kocialkowski | It is possible to setup a serial console on the Nexus S. It will show: |
265 | 16 | Paul Kocialkowski | * the 1st bootloader output |
266 | * the 2nd bootloader output |
||
267 | * the 2nd bootloader #2 output |
||
268 | * the fiq debugger |
||
269 | * (the kernel output if enabled) |
||
270 | 10 | Paul Kocialkowski | |
271 | 9 | Paul Kocialkowski | |
272 | 16 | Paul Kocialkowski | h3. How to enable serial console |
273 | |||
274 | * completely turn off the Nexus S |
||
275 | 1 | Denis 'GNUtoo' Carikli | * attach the microUSB connector to the Nexus S |
276 | * wire GND and ID (from the microUSB connector) to a 150K resistor |
||
277 | * get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872 |
||
278 | * wire it following this table: |
||
279 | 16 | Paul Kocialkowski | |
280 | 17 | Paul Kocialkowski | |_. UART to USB board output |_. Resistor |_. microUSB connector(s) name(s) |_. microUSB wire color | |
281 | | N/A | 150K Ohm | ID and GND | ID not wired (the 5th connector that is unused), GND is black | |
||
282 | | 3.3V | N/A | V+ | red | |
||
283 | | GND | N/A | GND | black | |
||
284 | | Rx | N/A | D- | white | |
||
285 | | Tx | N/A | D+ | green | |
||
286 | |||
287 | 13 | Paul Kocialkowski | *Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.* |
288 | 1 | Denis 'GNUtoo' Carikli | |
289 | 16 | Paul Kocialkowski | To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles): |
290 | 115200 is the baud rate to use (certainly with most UART to USB board). |
||
291 | 1 | Denis 'GNUtoo' Carikli | |
292 | 13 | Paul Kocialkowski | Then, do a regular boot. You should see the second bootloader #2 output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>. |
293 | |||
294 | Photos: here's what it looks like when all setup: |
||
295 | 22 | Denis 'GNUtoo' Carikli | !http://redmine.replicant.us/attachments/93/serial_1145.jpeg! |
296 | !http://redmine.replicant.us/attachments/99/serial_1150.JPG! |
||
297 | !http://redmine.replicant.us/attachments/105/serial_1151.jpeg! |
||
298 | 13 | Paul Kocialkowski | |
299 | 17 | Paul Kocialkowski | !http://download.paulk.fr/replicant/crespo/uart/uart_board.jpg! |
300 | 13 | Paul Kocialkowski | |
301 | The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector. |
||
302 | |||
303 | 17 | Paul Kocialkowski | !http://download.paulk.fr/replicant/crespo/uart/nexuss_resistor.jpg! |
304 | 1 | Denis 'GNUtoo' Carikli | |
305 | The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S. |
||
306 | 16 | Paul Kocialkowski | |
307 | 9 | Paul Kocialkowski | _Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ |
308 | |||
309 | 17 | Paul Kocialkowski | !http://download.paulk.fr/replicant/crespo/uart/nexuss_global_text.jpg! |
310 | 9 | Paul Kocialkowski | |
311 | 16 | Paul Kocialkowski | The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board. |
312 | 9 | Paul Kocialkowski | |
313 | _Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ |
||
314 | 16 | Paul Kocialkowski | |
315 | h3. Bootloaders outputs |
||
316 | |||
317 | 24 | Paul Kocialkowski | h4. Nexus S |
318 | |||
319 | 9 | Paul Kocialkowski | first bootloader: |
320 | 16 | Paul Kocialkowski | <pre> |
321 | 9 | Paul Kocialkowski | ----------------------------------------------------------- |
322 | Samsung Primitive Bootloader (PBL) v3.0 |
||
323 | 1 | Denis 'GNUtoo' Carikli | Copyright (C) Samsung Electronics Co., Ltd. 2006-2010 |
324 | 9 | Paul Kocialkowski | ----------------------------------------------------------- |
325 | |||
326 | Muxed [[OneNAND]] 512MB (0x50) Sync |
||
327 | 16 | Paul Kocialkowski | Scanning Bad Block ....... |
328 | 9 | Paul Kocialkowski | Bad Block 77 (5) |
329 | Bad Block 295 (5) |
||
330 | Bad Block 1232 (5) |
||
331 | Bad Block 1646 (5) |
||
332 | Bad Block 1831 (5) |
||
333 | Bad Block 2047 (0) |
||
334 | SBL loadding success |
||
335 | |||
336 | Set cpu clk. from 400MHz to 800MHz. |
||
337 | OM=0x9, device=OnenandMux(Audi) |
||
338 | IROM e-fused - Secure Boot Version. |
||
339 | 16 | Paul Kocialkowski | </pre> |
340 | 9 | Paul Kocialkowski | |
341 | 17 | Paul Kocialkowski | second bootloader:51ea3aaa63e65b74b7386fe1365d7b52f4495c43 |
342 | 16 | Paul Kocialkowski | <pre> |
343 | 1 | Denis 'GNUtoo' Carikli | ----------------------------------------------------------- |
344 | 9 | Paul Kocialkowski | Samsung Secondary Bootloader (SBL) v3.0 |
345 | Copyright (C) Samsung Electronics Co., Ltd. 2006-2010 |
||
346 | |||
347 | Board Name: HERRING REV 52 |
||
348 | Build On: Jan 20 2011 17:19:41 |
||
349 | ----------------------------------------------------------- |
||
350 | 1 | Denis 'GNUtoo' Carikli | |
351 | MMC SEM16G 15188 MB |
||
352 | Re_partition: magic code(0x0) |
||
353 | 16 | Paul Kocialkowski | Muxed [[OneNAND]] 512MB (0x50) Sync |
354 | 1 | Denis 'GNUtoo' Carikli | Scanning Bad Block ....... |
355 | Bad Block 77 (5) |
||
356 | Bad Block 295 (5) |
||
357 | Bad Block 1232 (5) |
||
358 | Bad Block 1646 (5) |
||
359 | Bad Block 1831 (5) |
||
360 | Bad Block 2047 (0) |
||
361 | Partitions loading success |
||
362 | 9 | Paul Kocialkowski | Read image(PARAM) from flash ....... |
363 | Done |
||
364 | init_fuel_gauge: vcell = 4083mV, soc = 94 |
||
365 | PMIC_IRQ1 = 0xc0 |
||
366 | PMIC_IRQ2 = 0x0 |
||
367 | PMIC_IRQ3 = 0x0 |
||
368 | PMIC_IRQ4 = 0x0 |
||
369 | PMIC_STATUS1 = 0x0 |
||
370 | PMIC_STATUS2 = 0x0 |
||
371 | PMIC_STATUS3 = 0x0 |
||
372 | PMIC_STATUS4 = 0x0 |
||
373 | PMIC_STATUS5 = 0x0 |
||
374 | PMIC_SMPL = 0x0 |
||
375 | Key scan = 0x0 |
||
376 | message.command = |
||
377 | message.status = |
||
378 | message.recovery = |
||
379 | 16 | Paul Kocialkowski | </pre> |
380 | 9 | Paul Kocialkowski | |
381 | second bootloader #2: |
||
382 | 16 | Paul Kocialkowski | <pre> |
383 | 9 | Paul Kocialkowski | BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee)) |
384 | LCD ID = 0x0060a953 |
||
385 | Done |
||
386 | Kernel(boot.img) read success from partition no.5 |
||
387 | Setting param.serialnr = 0x3733bab6 0x6de200ec |
||
388 | Setting param.board_rev = 0x34 |
||
389 | Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked |
||
390 | Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265 |
||
391 | |||
392 | Starting kernel at 0x30008000... |
||
393 | |||
394 | 4 | Denis 'GNUtoo' Carikli | Uncompressing Linux... done, booting the kernel. |
395 | 16 | Paul Kocialkowski | </pre> |
396 | 4 | Denis 'GNUtoo' Carikli | |
397 | kernel |
||
398 | 16 | Paul Kocialkowski | <pre> |
399 | 4 | Denis 'GNUtoo' Carikli | <hit enter to activate fiq debugger> |
400 | 24 | Paul Kocialkowski | </pre> |
401 | |||
402 | h4. Galaxy Nexus |
||
403 | |||
404 | <pre> |
||
405 | reading nps status file is successfully!. |
||
406 | nps status=0x504d4f43 |
||
407 | PMIC_IRQ1 = 0x80 |
||
408 | PMIC_IRQ2 = 0x0 |
||
409 | PMIC_IRQ3 = 0x1 |
||
410 | PMIC_IRQ4 = 0x0 |
||
411 | PMIC_STATUS1 = 0x80 |
||
412 | PMIC_STATUS2 = 0x0 |
||
413 | get_debug_level current debug level is 0x574f4c44. |
||
414 | aries_process_platform: Debug Level Low |
||
415 | keypad_scan: key value ----------------->= 0x40 |
||
416 | CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48 |
||
417 | aries_process_platform: final s1 booting mode = 0 |
||
418 | DISPLAY_PATH_SEL[MDNIE 0x1]is on |
||
419 | MDNIE setting Init start!! |
||
420 | vsync interrupt is off |
||
421 | video interrupt is off |
||
422 | [fb0] turn on |
||
423 | MDNIE setting Init end!! |
||
424 | |||
425 | Autoboot (0 seconds) in progress, press any key to stop |
||
426 | get_debug_level current debug level is 0x574f4c44. |
||
427 | get_debug_level current debug level is 0x574f4c44. |
||
428 | boot_kernel: Debug Level Low |
||
429 | FOTA Check Bit |
||
430 | Read BML page=, NumPgs= |
||
431 | FOTA Check Bit (0xffffffff) |
||
432 | Load Partion idx = (6) |
||
433 | ..............................done |
||
434 | Kernel read success from kernel partition no.6, idx.6. |
||
435 | setting param.serialnr=0x38301804 0xb3e900ec |
||
436 | setting param.board_rev=0x30 |
||
437 | setting param.cmdline=console=ttySAC2,115200 loglevel=4 |
||
438 | |||
439 | Starting kernel at 0x32000000... |
||
440 | 16 | Paul Kocialkowski | </pre> |
441 | 1 | Denis 'GNUtoo' Carikli | |
442 | 18 | Paul Kocialkowski | h2. JTAG |
443 | 16 | Paul Kocialkowski | |
444 | 18 | Paul Kocialkowski | Here is the location and the description of the JTAG pins on the Nexus S board: |
445 | 16 | Paul Kocialkowski | |
446 | 19 | Paul Kocialkowski | !http://redmine.replicant.us/attachments/3/jtag-pins.png! |
447 | 20 | Paul Kocialkowski | !http://redmine.replicant.us/attachments/9/jtag-pins-desc.png! |
448 | 18 | Paul Kocialkowski | |
449 | 19 | Paul Kocialkowski | JTAG was untested on the device so far. |
450 | 1 | Denis 'GNUtoo' Carikli | |
451 | 19 | Paul Kocialkowski | h2. Conclusions |
452 | 1 | Denis 'GNUtoo' Carikli | |
453 | 19 | Paul Kocialkowski | * Heimdall mode is accessible but we didn't try to flash images with heimdall |
454 | * Serial can be set up and works |
||
455 | * The bootrom(IROM) seems signed: <pre>IROM e-fused</pre> |
||
456 | * JTAG is there but we didn't try it |
||
457 | |||
458 | *As the IROM is apparently signed, porting a free bootloader will most likely fail as Primary Boot Loader (PBL).* |