Nexus S (I902x) Bootloader¶

The Nexus S (I902x) comes with a bootrom and a set of two proprietary bootloaders. The bootrom: internal ROM (iROM) is stored read-only on the S5PC110 SoC chip. It loads the first bootloader: Samsung Primitive Bootloader (PBL), which loads the Samsung Secondary Bootloader (SBL). These bootloaders are proprietary software.

More information on the booting sequence is available on the S5PC110 User Manual, section 2 (system), part 6 (booting sequence).

Boot device priority¶

The S5PC110 bootrom (iROM) allows booting from various devices such as NAND, MMC, eMMC, UART and USB. The boot device priority is selected using the Operating Mode (OM) pins. Boolean values for each pin depend on the voltage applied to the pin: a positive voltage represents a logical 1 while ground represents a logical 0.

On-board resistors¶

OM pins are set to boolean values using pull-up (logical 1) and pull-down (logical 0) resistors. The Nexus S (I902x) schematics show all the possible resistors connected to the pins.

Only a few are actually populated on the board:

Resistors highlighted in green are not populated on the board. Hence, the actual layout is the following:

	XOM5	XOM4	XOM3	XOM2	XOM1	XOM0
Pull-up resistor	N/A	N/A	R429	N/A	N/A	R435
Pull-down resistor	R448	R447	N/A	R445	R444	N/A
Boolean value	0	0	1	0	0	1

According to the S5PC110 User Manual, section 2 (system), part 6.2.4 (OM pin configuration), table 6-3, this indicates OnenandMux as first boot device.

Secure boot¶

According to the S5PC110 User Manual

The bootrom and the bootloaders appear to be implementing secure boot mechanisms that enforce signature checks on each bootloader.
However, there is no signature check enforced regarding the Linux kernel.

Changing a single byte on the first bootloader ended up in the system refusing to boot. In addition, a few messages from the bootloaders output suggest that such signature checks are enforced: IROM e-fused - Secure Boot Version.

Since signature checks are enforced by the bootrom and provided that there is apparently no easy way of replacing the public key the signatures are checked against, running a free software bootloader on the Nexus S (I902x) seems impossible.

// mention that it will jump to the next one

Stock bootloaders output¶

-----------------------------------------------------------
   Samsung Primitive Bootloader (PBL) v3.0
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010
-----------------------------------------------------------

Muxed [[OneNAND]] 512MB (0x50) Sync
Scanning Bad Block .......
Bad Block 77 (5)
Bad Block 295 (5)
Bad Block 1232 (5)
Bad Block 1646 (5)
Bad Block 1831 (5)
Bad Block 2047 (0)
SBL loadding success

Set cpu clk. from 400MHz to 800MHz.
OM=0x9, device=OnenandMux(Audi)
IROM e-fused - Secure Boot Version.

-----------------------------------------------------------
   Samsung Secondary Bootloader (SBL) v3.0
   Copyright (C) Samsung Electronics Co., Ltd. 2006-2010

   Board Name: HERRING REV 52
   Build On: Jan 20 2011 17:19:41
-----------------------------------------------------------

MMC SEM16G 15188 MB
Re_partition: magic code(0x0)
Muxed [[OneNAND]] 512MB (0x50) Sync
Scanning Bad Block .......
Bad Block 77 (5)
Bad Block 295 (5)
Bad Block 1232 (5)
Bad Block 1646 (5)
Bad Block 1831 (5)
Bad Block 2047 (0)
Partitions loading success
Read image(PARAM) from flash .......
Done
init_fuel_gauge: vcell = 4083mV, soc = 94
PMIC_IRQ1    = 0xc0 
PMIC_IRQ2    = 0x0 
PMIC_IRQ3    = 0x0 
PMIC_IRQ4    = 0x0 
PMIC_STATUS1 = 0x0 
PMIC_STATUS2 = 0x0 
PMIC_STATUS3 = 0x0 
PMIC_STATUS4 = 0x0 
PMIC_STATUS5 = 0x0 
PMIC_SMPL    = 0x0 
Key scan = 0x0
message.command = 
message.status = 
message.recovery = 

BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee))
LCD ID = 0x0060a953
Done
Kernel(boot.img) read success from partition no.5
Setting param.serialnr = 0x3733bab6 0x6de200ec
Setting param.board_rev = 0x34
Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked 
Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265

Starting kernel at 0x30008000...

Uncompressing Linux... done, booting the kernel.

References¶

• S5PC110 User Manual: http://dl.project-voodoo.org/documentation/S5PC110_EVT1_UM10.pdf
• Nexus S (I902x) Schematics: http://mobilcoms.ru/load/1-1-0-4499

These documents are the propriety of Samsung Electronics and are not hosted by the Replicant project. However, some excerpts from these documents are provided, for the purpose of providing technical evidence of the facts that are mentioned in this page. We believe that this particular use of the copyrighted work is fair use.