Project

General

Profile

SamsungSerial » History » Version 9

Paul Kocialkowski, 09/10/2011 08:11 PM

1 1 Denis 'GNUtoo' Carikli
== Introduction ==
2
This page contains information on how to work on a bootloader replacement.
3 2 Denis 'GNUtoo' Carikli
4
== Informations ==
5 3 Denis 'GNUtoo' Carikli
 * The [http://git.denx.de/cgi-bin/gitweb.cgi?p=u-boot.git;a=summary official u-boot source code] already has support for the S5PC110 SOC(system on a chip) that the Nexus S uses
6
 * The S5PC110 has a bootrom
7 4 Denis 'GNUtoo' Carikli
 * The Nexus S has an usb port with an FSA9480 behind it
8
9 8 Paul Kocialkowski
=== Partitioning informations ===
10
11
Here's a detailed output showing the partitioning of the NAND that you can obtain with {{{ heimdall print-pit }}} with the device in download mode (VOL+ and VOL- held at reboot):
12
{{{
13
Entry Count: 16
14
Unknown 1: 0
15
Unknown 2: 0
16
Unknown 3: 0
17
Unknown 4: 0
18
Unknown 5: 0
19
Unknown 6: 0
20
Unknown 7: 0
21
Unknown 8: 0
22
23
24
--- Entry #0 ---
25
Unused: No
26
Partition Type: 0 (RFS)
27
Partition Identifier: 0
28
Partition Flags: 0 (R)
29
Unknown 1: 0
30
Partition Block Size: 256
31
Partition Block Count: 1
32
Unknown 2: 0
33
Unknown 3: 0
34
Partition Name: IPBL
35
Filename: bootloader.img
36
37
38
--- Entry #1 ---
39
Unused: No
40
Partition Type: 0 (RFS)
41
Partition Identifier: 1
42
Partition Flags: 0 (R)
43
Unknown 1: 0
44
Partition Block Size: 256
45
Partition Block Count: 7
46
Unknown 2: 0
47
Unknown 3: 0
48
Partition Name: SBL
49
Filename: 
50
51
52
--- Entry #2 ---
53
Unused: No
54
Partition Type: 0 (RFS)
55
Partition Identifier: 2
56
Partition Flags: 0 (R)
57
Unknown 1: 0
58
Partition Block Size: 256
59
Partition Block Count: 7
60
Unknown 2: 0
61
Unknown 3: 0
62
Partition Name: SBL2
63
Filename: 
64
65
66
--- Entry #3 ---
67
Unused: No
68
Partition Type: 0 (RFS)
69
Partition Identifier: 3
70
Partition Flags: 0 (R)
71
Unknown 1: 0
72
Partition Block Size: 256
73
Partition Block Count: 4
74
Unknown 2: 0
75
Unknown 3: 0
76
Partition Name: PARAM
77
Filename: 
78
79
80
--- Entry #4 ---
81
Unused: No
82
Partition Type: 0 (RFS)
83
Partition Identifier: 4
84
Partition Flags: 0 (R)
85
Unknown 1: 0
86
Partition Block Size: 256
87
Partition Block Count: 5
88
Unknown 2: 0
89
Unknown 3: 0
90
Partition Name: MISC
91
Filename: 
92
93
94
--- Entry #5 ---
95
Unused: No
96
Partition Type: 0 (RFS)
97
Partition Identifier: 5
98
Partition Flags: 0 (R)
99
Unknown 1: 0
100
Partition Block Size: 256
101
Partition Block Count: 32
102
Unknown 2: 0
103
Unknown 3: 0
104
Partition Name: BOOT
105
Filename: boot.img
106
107
108
--- Entry #6 ---
109
Unused: No
110
Partition Type: 0 (RFS)
111
Partition Identifier: 6
112
Partition Flags: 0 (R)
113
Unknown 1: 0
114
Partition Block Size: 256
115
Partition Block Count: 32
116
Unknown 2: 0
117
Unknown 3: 0
118
Partition Name: RECOVERY
119
Filename: recovery.img
120
121
122
--- Entry #7 ---
123
Unused: No
124
Partition Type: 0 (RFS)
125
Partition Identifier: 7
126
Partition Flags: 1 (R)
127
Unknown 1: 0
128
Partition Block Size: 256
129
Partition Block Count: 1878
130
Unknown 2: 0
131
Unknown 3: 0
132
Partition Name: CACHE
133
Filename: cache.img
134
135
136
--- Entry #8 ---
137
Unused: Yes
138
Partition Type: 0 (RFS)
139
Partition Identifier: 8
140
Partition Flags: 0 (R)
141
Unknown 1: 0
142
Partition Block Size: 256
143
Partition Block Count: 54
144
Unknown 2: 0
145
Unknown 3: 0
146
Partition Name: RADIO
147
Filename: radio.img
148
149
150
--- Entry #9 ---
151
Unused: No
152
Partition Type: 0 (RFS)
153
Partition Identifier: 9
154
Partition Flags: 1 (R)
155
Unknown 1: 0
156
Partition Block Size: 256
157
Partition Block Count: 27
158
Unknown 2: 0
159
Unknown 3: 0
160
Partition Name: EFS
161
Filename: 
162
163
164
--- Entry #10 ---
165
Unused: No
166
Partition Type: 0 (RFS)
167
Partition Identifier: 10
168
Partition Flags: 0 (R)
169
Unknown 1: 0
170
Partition Block Size: 256
171
Partition Block Count: 1
172
Unknown 2: 0
173
Unknown 3: 0
174
Partition Name: DGS
175
Filename: dgs.img
176
177
178
--- Entry #11 ---
179
Unused: No
180
Partition Type: 2 (EXT4)
181
Partition Identifier: 0
182
Partition Flags: 2 (R/W)
183
Unknown 1: 0
184
Partition Block Size: 512
185
Partition Block Count: 2048
186
Unknown 2: 0
187
Unknown 3: 0
188
Partition Name: PGPT
189
Filename: emmc.img
190
191
192
--- Entry #12 ---
193
Unused: No
194
Partition Type: 2 (EXT4)
195
Partition Identifier: 1
196
Partition Flags: 2 (R/W)
197
Unknown 1: 0
198
Partition Block Size: 512
199
Partition Block Count: 1048576
200
Unknown 2: 0
201
Unknown 3: 0
202
Partition Name: SYSTEM
203
Filename: system.img
204
205
206
--- Entry #13 ---
207
Unused: No
208
Partition Type: 2 (EXT4)
209
Partition Identifier: 2
210
Partition Flags: 2 (R/W)
211
Unknown 1: 0
212
Partition Block Size: 512
213
Partition Block Count: 2097152
214
Unknown 2: 0
215
Unknown 3: 0
216
Partition Name: USERDATA
217
Filename: userdata.img
218
219
220
--- Entry #14 ---
221
Unused: No
222
Partition Type: 2 (EXT4)
223
Partition Identifier: 3
224
Partition Flags: 2 (R/W)
225
Unknown 1: 0
226
Partition Block Size: 512
227
Partition Block Count: 33554432
228
Unknown 2: 0
229
Unknown 3: 0
230
Partition Name: MEDIA
231
Filename: media.img
232
233
234
--- Entry #15 ---
235
Unused: No
236
Partition Type: 2 (EXT4)
237
Partition Identifier: 4
238
Partition Flags: 2 (R/W)
239
Unknown 1: 0
240
Partition Block Size: 512
241
Partition Block Count: 33
242
Unknown 2: 0
243
Unknown 3: 0
244
Partition Name: SGPT
245
Filename: 
246
}}}
247 4 Denis 'GNUtoo' Carikli
248 9 Paul Kocialkowski
== Serial Console ==
249
250
It is possible to setup a serial console on the Nexus S. It will show:
251
* the 1st bootloader output
252
* the 2nd bootloader output
253
* the 2nd bootloader #2 output
254
* the fiq debugger
255
* (the kernel output if enabled)
256
257
=== How to enable serial console ===
258
259
* wire GND and ID (from the microUSB connector) to a 150K resistor
260
* get an UART to USB module like this one: http://www.dealextreme.com/p/usb-to-uart-5-pin-cp2102-module-serial-converter-81872
261
* wire it following this table:
262
|| UART to USB board output || resistor || microUSB connector(s) name(s) || microUSB wire color ||
263
|| N/A || 150K Ohm || ID and GND || ID not wired (the 5th connector that is unused), GND is black ||
264
|| 3.3V || N/A || V+ || red ||
265
|| GND || N/A || GND || black ||
266
|| Rx || N/A || D- || white ||
267
|| Tx || N/A || D+ || green ||
268
269
'''Warning: the voltage to use is 3.3V and not 5V! Using 5V can cause serious damages to the UART component.'''
270
271
When the USB to UART module is connected to the host PC, a new tty node will be created on the host PC, usually {{{ /dev/ttyUSB0 }}}. 
272
To read/write on the serial, you can use screen (or picocomm, or any other software that deals with serial consoles):
273
{{ screen /dev/ttyUSB0 115200 }}}
274
115200 is the baud rate to use (certainly with most UART to USB board). 
275
276
Photos: here's what it looks like when all setup:
277
278
=== Bootloaders outputs ===
279
280
first bootloader:
281
{{{
282
-----------------------------------------------------------
283
   Samsung Primitive Bootloader (PBL) v3.0
284
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
285
-----------------------------------------------------------
286
287
Muxed OneNAND 512MB (0x50) Sync
288
Scanning Bad Block .......
289
Bad Block 77 (5)
290
Bad Block 295 (5)
291
Bad Block 1232 (5)
292
Bad Block 1646 (5)
293
Bad Block 1831 (5)
294
Bad Block 2047 (0)
295
SBL loadding success
296
297
Set cpu clk. from 400MHz to 800MHz.
298
OM=0x9, device=OnenandMux(Audi)
299
IROM e-fused - Secure Boot Version.
300
}}}
301
302
second bootloader:
303
{{{
304
-----------------------------------------------------------
305
   Samsung Secondary Bootloader (SBL) v3.0
306
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
307
308
   Board Name: HERRING REV 52
309
   Build On: Jan 20 2011 17:19:41
310
-----------------------------------------------------------
311
312
MMC SEM16G 15188 MB
313
Re_partition: magic code(0x0)
314
Muxed OneNAND 512MB (0x50) Sync
315
Scanning Bad Block .......
316
Bad Block 77 (5)
317
Bad Block 295 (5)
318
Bad Block 1232 (5)
319
Bad Block 1646 (5)
320
Bad Block 1831 (5)
321
Bad Block 2047 (0)
322
Partitions loading success
323
Read image(PARAM) from flash .......
324
Done
325
init_fuel_gauge: vcell = 4083mV, soc = 94
326
PMIC_IRQ1    = 0xc0 
327
PMIC_IRQ2    = 0x0 
328
PMIC_IRQ3    = 0x0 
329
PMIC_IRQ4    = 0x0 
330
PMIC_STATUS1 = 0x0 
331
PMIC_STATUS2 = 0x0 
332
PMIC_STATUS3 = 0x0 
333
PMIC_STATUS4 = 0x0 
334
PMIC_STATUS5 = 0x0 
335
PMIC_SMPL    = 0x0 
336
Key scan = 0x0
337
message.command = 
338
message.status = 
339
message.recovery = 
340
}}}
341
342
second bootloader #2:
343
{{{
344
BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
345
LCD ID = 0x0060a953
346
Done
347
Kernel(boot.img) read success from partition no.5
348
Setting param.serialnr = 0x3733bab6 0x6de200ec
349
Setting param.board_rev = 0x34
350
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
351
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265
352
353
Starting kernel at 0x30008000...
354
355
Uncompressing Linux... done, booting the kernel.
356
}}}
357
358
kernel
359
{{{
360
<hit enter to activate fiq debugger>
361
}}}
362
363 4 Denis 'GNUtoo' Carikli
== TODO ==
364 6 Denis 'GNUtoo' Carikli
 * Look if [http://www.glassechidna.com.au/products/heimdall/ Heimdall] can talk to the bootrom
365 4 Denis 'GNUtoo' Carikli
 * Serial console:
366
  * Use the correct resistors enabling the serial console on the FSA9480
367
  * Mesure the voltage of the Nexus S serial port
368
  * Make a level shifter to shift the serial port levels 
369
  * Cross compile microcom or picocom 
370
  * get a serial console
371 5 Denis 'GNUtoo' Carikli
 * Find the JTAG
372 7 Denis 'GNUtoo' Carikli
 * look if the first stage bootloader(after the bootrom) is signed