Project

General

Profile

SamsungSerial » History » Version 33

Kurtis Hanna, 09/25/2020 04:19 PM
replaced dead link

1 16 Paul Kocialkowski
h2. Introduction
2
3 31 Wolfgang Wiedmeyer
This page contains information on how to get serial on at least the following phones:
4 26 Denis 'GNUtoo' Carikli
* Nexus S
5
* Galaxy Nexus
6 1 Denis 'GNUtoo' Carikli
7
8 31 Wolfgang Wiedmeyer
h2. Information
9 1 Denis 'GNUtoo' Carikli
10 16 Paul Kocialkowski
* The S5PC110 has a bootrom
11 31 Wolfgang Wiedmeyer
* The Nexus S has an USB port with an FSA9480 behind it
12 10 Paul Kocialkowski
13 16 Paul Kocialkowski
h2. Serial Console
14
15 10 Paul Kocialkowski
It is possible to setup a serial console on the Nexus S. It will show:
16 16 Paul Kocialkowski
* the 1st bootloader output
17
* the 2nd bootloader output
18 32 Wolfgang Wiedmeyer
* the 2nd bootloader @#2@ output
19 16 Paul Kocialkowski
* the fiq debugger
20
* (the kernel output if enabled)
21 10 Paul Kocialkowski
22 16 Paul Kocialkowski
h3. How to enable serial console
23
24 31 Wolfgang Wiedmeyer
* Completely turn off the Nexus S
25
* Attach the microUSB connector to the Nexus S
26 1 Denis 'GNUtoo' Carikli
* Wire GND and ID (from the microUSB connector) to a 150K resistor
27 33 Kurtis Hanna
* Get an UART to USB module like this one: https://roboticsdna.in/product/usb-to-ttl-cp2012-module-5-pin/
28 31 Wolfgang Wiedmeyer
* Wire it following this table:
29 16 Paul Kocialkowski
30 17 Paul Kocialkowski
|_. UART to USB board output |_. Resistor |_. microUSB connector(s) name(s) |_. microUSB wire color |
31
| N/A | 150K Ohm | ID and GND | ID not wired (the 5th connector that is unused), GND is black |
32
| 3.3V | N/A | V+ | red |
33
| GND | N/A | GND | black |
34
| Rx | N/A | D- | white |
35
| Tx | N/A | D+ | green |
36
37 13 Paul Kocialkowski
*Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.*
38 1 Denis 'GNUtoo' Carikli
39 16 Paul Kocialkowski
To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles):
40
115200 is the baud rate to use (certainly with most UART to USB board). 
41 1 Denis 'GNUtoo' Carikli
42 32 Wolfgang Wiedmeyer
Then, do a regular boot. You should see the second bootloader @#2@ output. To get the 1st and 2nd bootloaders output, press <enter> to get in fiq debugger and write "reboot" then <enter>.
43 13 Paul Kocialkowski
44
Photos: here's what it looks like when all setup:
45 28 Wolfgang Wiedmeyer
!serial_1145.jpeg!
46
!serial_1150.JPG!
47
!serial_1151.jpeg!
48 13 Paul Kocialkowski
49 29 Wolfgang Wiedmeyer
!uart_board.jpg!
50 13 Paul Kocialkowski
51
The UART to USB board. USB is connected to the host PC, UART pins to the microUSB connector.
52
53 29 Wolfgang Wiedmeyer
!nexuss_resistor.jpg!
54 1 Denis 'GNUtoo' Carikli
55
The 150K resistor (two resistors here that make 150K together) soldered to the microUSB connector, that is attached to the Nexus S.
56 16 Paul Kocialkowski
57 9 Paul Kocialkowski
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._ 
58
59 29 Wolfgang Wiedmeyer
!nexuss_global_text.jpg!
60 9 Paul Kocialkowski
61 1 Denis 'GNUtoo' Carikli
The USB cable that is connected to the Nexus S ends on the connectors attached to the UART to USB board.
62 9 Paul Kocialkowski
63 33 Kurtis Hanna
_Note: it was done the quick and dirty way here, it's better to use a protoboard (prototyping board)._
64 16 Paul Kocialkowski
65
h3. Bootloaders outputs
66
67 24 Paul Kocialkowski
h4. Nexus S
68
69 9 Paul Kocialkowski
first bootloader:
70 16 Paul Kocialkowski
<pre>
71 9 Paul Kocialkowski
-----------------------------------------------------------
72
   Samsung Primitive Bootloader (PBL) v3.0
73 1 Denis 'GNUtoo' Carikli
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
74 9 Paul Kocialkowski
-----------------------------------------------------------
75
76
Muxed [[OneNAND]] 512MB (0x50) Sync
77 16 Paul Kocialkowski
Scanning Bad Block .......
78 9 Paul Kocialkowski
Bad Block 77 (5)
79
Bad Block 295 (5)
80
Bad Block 1232 (5)
81
Bad Block 1646 (5)
82
Bad Block 1831 (5)
83
Bad Block 2047 (0)
84
SBL loadding success
85
86
Set cpu clk. from 400MHz to 800MHz.
87
OM=0x9, device=OnenandMux(Audi)
88
IROM e-fused - Secure Boot Version.
89 16 Paul Kocialkowski
</pre>
90 9 Paul Kocialkowski
91 17 Paul Kocialkowski
second bootloader:51ea3aaa63e65b74b7386fe1365d7b52f4495c43
92 16 Paul Kocialkowski
<pre>
93 1 Denis 'GNUtoo' Carikli
-----------------------------------------------------------
94 9 Paul Kocialkowski
   Samsung Secondary Bootloader (SBL) v3.0
95
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
96
97
   Board Name: HERRING REV 52
98
   Build On: Jan 20 2011 17:19:41
99
-----------------------------------------------------------
100 1 Denis 'GNUtoo' Carikli
101
MMC SEM16G 15188 MB
102
Re_partition: magic code(0x0)
103 16 Paul Kocialkowski
Muxed [[OneNAND]] 512MB (0x50) Sync
104 1 Denis 'GNUtoo' Carikli
Scanning Bad Block .......
105
Bad Block 77 (5)
106
Bad Block 295 (5)
107
Bad Block 1232 (5)
108
Bad Block 1646 (5)
109
Bad Block 1831 (5)
110
Bad Block 2047 (0)
111
Partitions loading success
112 9 Paul Kocialkowski
Read image(PARAM) from flash .......
113
Done
114
init_fuel_gauge: vcell = 4083mV, soc = 94
115
PMIC_IRQ1    = 0xc0 
116
PMIC_IRQ2    = 0x0 
117
PMIC_IRQ3    = 0x0 
118
PMIC_IRQ4    = 0x0 
119
PMIC_STATUS1 = 0x0 
120
PMIC_STATUS2 = 0x0 
121
PMIC_STATUS3 = 0x0 
122
PMIC_STATUS4 = 0x0 
123
PMIC_STATUS5 = 0x0 
124
PMIC_SMPL    = 0x0 
125
Key scan = 0x0
126
message.command = 
127
message.status = 
128
message.recovery = 
129 16 Paul Kocialkowski
</pre>
130 9 Paul Kocialkowski
131 32 Wolfgang Wiedmeyer
second bootloader @#2@:
132 16 Paul Kocialkowski
<pre>
133 9 Paul Kocialkowski
BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
134
LCD ID = 0x0060a953
135
Done
136
Kernel(boot.img) read success from partition no.5
137
Setting param.serialnr = 0x3733bab6 0x6de200ec
138
Setting param.board_rev = 0x34
139
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
140
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265
141
142
Starting kernel at 0x30008000...
143
144 4 Denis 'GNUtoo' Carikli
Uncompressing Linux... done, booting the kernel.
145 16 Paul Kocialkowski
</pre>
146 4 Denis 'GNUtoo' Carikli
147
kernel
148 16 Paul Kocialkowski
<pre>
149 4 Denis 'GNUtoo' Carikli
<hit enter to activate fiq debugger>
150 24 Paul Kocialkowski
</pre>
151
152 25 Paul Kocialkowski
h4. Galaxy S
153
154
<pre>
155
-----------------------------------------------------------
156
   Samsung Primitive Bootloader (PBL) v3.0
157
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
158
-----------------------------------------------------------
159
160
+n1stVPN       2688 
161
+nPgsPerBlk    64 
162
PBL found bootable SBL: Partition(3).
163
164
Set cpu clk. from 400MHz to 800MHz.
165
OM=0x9, device=OnenandMux(Audi)
166
IROM e-fused - Non Secure Boot Version.
167
168
-----------------------------------------------------------
169
   Samsung Secondary Bootloader (SBL) v3.0
170
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
171
172
   Board Name: ARIES REV 03
173
   Build On: Dec 29 2011 16:57:09
174
-----------------------------------------------------------
175
176
Re_partition: magic code(0x0)
177
[PAM:   ] ++FSR_PAM_Init
178
[PAM:   ]   OneNAND physical base address       : 0xb0000000
179
[PAM:   ]   OneNAND virtual  base address       : 0xb0000000
180
[PAM:   ]   OneNAND nMID=0xec : nDID=0x50
181
[PAM:   ] --FSR_PAM_Init
182
fsr_bml_load_partition: pi->nNumOfPartEntry = 12
183
partitions loading success
184
board partition information update.. source: 0x0
185
.Done.
186
read 1 units.
187
==== PARTITION INFORMATION ====
188
 ID         : IBL+PBL (0x0)
189
 ATTR       : RO SLC (0x1002)
190
 FIRST_UNIT : 0
191
 NO_UNITS   : 1
192
===============================
193
 ID         : PIT (0x1)
194
 ATTR       : RO SLC (0x1002)
195
 FIRST_UNIT : 1
196
 NO_UNITS   : 1
197
===============================
198
 ID         : EFS (0x14)
199
 ATTR       : RW STL SLC (0x1101)
200
 FIRST_UNIT : 2
201
 NO_UNITS   : 40
202
===============================
203
 ID         : SBL (0x3)
204
 ATTR       : RO SLC (0x1002)
205
 FIRST_UNIT : 42
206
 NO_UNITS   : 5
207
===============================
208
 ID         : SBL2 (0x4)
209
 ATTR       : RO SLC (0x1002)
210
 FIRST_UNIT : 47
211
 NO_UNITS   : 5
212
===============================
213
 ID         : PARAM (0x15)
214
 ATTR       : RW STL SLC (0x1101)
215
 FIRST_UNIT : 52
216
 NO_UNITS   : 20
217
===============================
218
 ID         : KERNEL (0x6)
219
 ATTR       : RO SLC (0x1002)
220
 FIRST_UNIT : 72
221
 NO_UNITS   : 30
222
===============================
223
 ID         : RECOVERY (0x7)
224
 ATTR       : RO SLC (0x1002)
225
 FIRST_UNIT : 102
226
 NO_UNITS   : 30
227
===============================
228
 ID         : FACTORYFS (0x16)
229
 ATTR       : RW STL SLC (0x1101)
230
 FIRST_UNIT : 132
231
 NO_UNITS   : 1146
232
===============================
233
 ID         : DBDATAFS (0x17)
234
 ATTR       : RW STL SLC (0x1101)
235
 FIRST_UNIT : 1278
236
 NO_UNITS   : 536
237
===============================
238
 ID         : CACHE (0x18)
239
 ATTR       : RW STL SLC (0x1101)
240
 FIRST_UNIT : 1814
241
 NO_UNITS   : 140
242
===============================
243
 ID         : MODEM (0xb)
244
 ATTR       : RO SLC (0x1002)
245
 FIRST_UNIT : 1954
246
 NO_UNITS   : 50
247
===============================
248
loke_init: j4fs_open success..
249
load_lfs_parameters valid magic code and version.
250
load_debug_level reading debug level from file successfully(0x574f4c44).
251
init_fuel_gauge: vcell = 4062mV, soc = 95
252
reading nps status file is successfully!.
253
nps status=0x504d4f43
254
PMIC_IRQ1    = 0x0 
255
PMIC_IRQ2    = 0x0 
256
PMIC_IRQ3    = 0x0 
257
PMIC_IRQ4    = 0x0 
258
PMIC_STATUS1 = 0x0 
259
PMIC_STATUS2 = 0x0 
260
get_debug_level current debug level is 0x574f4c44.
261
aries_process_platform: Debug Level Low
262
keypad_scan: key value ----------------->= 0x0
263
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48 
264
aries_process_platform: final s1 booting mode = 0
265
DISPLAY_PATH_SEL[MDNIE 0x1]is on
266
MDNIE setting Init start!!
267
vsync interrupt is off
268
video interrupt is off
269
[fb0] turn on
270
MDNIE setting Init end!!
271
272
Autoboot (0 seconds) in progress, press any key to stop 
273
get_debug_level current debug level is 0x574f4c44.
274
get_debug_level current debug level is 0x574f4c44.
275
boot_kernel: Debug Level Low
276
FOTA Check Bit 
277
 Read BML page=, NumPgs=
278
FOTA Check Bit (0xffffffff)
279
Load Partion idx = (6)
280
..............................done
281
Kernel read success from kernel partition no.6, idx.6.
282
setting param.serialnr=0x38301804 0xb3e900ec
283
setting param.board_rev=0x30
284
setting param.cmdline=console=ttySAC2,115200 loglevel=4
285
286
Starting kernel at 0x32000000...
287
</pre>
288
289 24 Paul Kocialkowski
h4. Galaxy Nexus 
290
291
<pre>
292
reading nps status file is successfully!.
293
nps status=0x504d4f43
294
PMIC_IRQ1    = 0x80 
295
PMIC_IRQ2    = 0x0 
296
PMIC_IRQ3    = 0x1 
297
PMIC_IRQ4    = 0x0 
298
PMIC_STATUS1 = 0x80 
299
PMIC_STATUS2 = 0x0 
300
get_debug_level current debug level is 0x574f4c44.
301
aries_process_platform: Debug Level Low
302
keypad_scan: key value ----------------->= 0x40
303
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48 
304
aries_process_platform: final s1 booting mode = 0
305
DISPLAY_PATH_SEL[MDNIE 0x1]is on
306
MDNIE setting Init start!!
307
vsync interrupt is off
308
video interrupt is off
309
[fb0] turn on
310
MDNIE setting Init end!!
311
312
Autoboot (0 seconds) in progress, press any key to stop 
313
get_debug_level current debug level is 0x574f4c44.
314
get_debug_level current debug level is 0x574f4c44.
315
boot_kernel: Debug Level Low
316
FOTA Check Bit 
317
 Read BML page=, NumPgs=
318
FOTA Check Bit (0xffffffff)
319
Load Partion idx = (6)
320
..............................done
321
Kernel read success from kernel partition no.6, idx.6.
322
setting param.serialnr=0x38301804 0xb3e900ec
323
setting param.board_rev=0x30
324
setting param.cmdline=console=ttySAC2,115200 loglevel=4
325
326
Starting kernel at 0x32000000...
327 16 Paul Kocialkowski
</pre>
328 1 Denis 'GNUtoo' Carikli
329 18 Paul Kocialkowski
h2. JTAG
330 16 Paul Kocialkowski
331 18 Paul Kocialkowski
Here is the location and the description of the JTAG pins on the Nexus S board:
332 16 Paul Kocialkowski
333 30 Wolfgang Wiedmeyer
!jtag-pins.png!
334
!jtag-pins-desc.png!
335 18 Paul Kocialkowski
336 19 Paul Kocialkowski
JTAG was untested on the device so far. 
337 1 Denis 'GNUtoo' Carikli
338 19 Paul Kocialkowski
h2. Conclusions
339 1 Denis 'GNUtoo' Carikli
340 31 Wolfgang Wiedmeyer
* Heimdall mode is accessible but we didn't try to flash images with Heimdall
341 19 Paul Kocialkowski
* Serial can be set up and works
342 31 Wolfgang Wiedmeyer
* The bootrom (IROM) seems signed: @IROM e-fused@
343 19 Paul Kocialkowski
* JTAG is there but we didn't try it
344
345
*As the IROM is apparently signed, porting a free bootloader will most likely fail as Primary Boot Loader (PBL).*