NexusSI902xBootloader » History » Revision 4
Revision 3 (Paul Kocialkowski, 02/08/2015 02:17 PM) → Revision 4/19 (Paul Kocialkowski, 02/08/2015 02:59 PM)
h1. Nexus S (I902x) Bootloader The Nexus S (I902x) comes with a bootrom and a set of two proprietary bootloaders. The bootrom: internal ROM (iROM) is stored read-only on the S5PC110 SoC chip. It loads the first bootloader: Samsung Primitive Bootloader (PBL), which loads the Samsung Secondary Bootloader (SBL). These bootloaders are proprietary software. More information on the booting sequence is available on the S5PC110 User Manual, section 2 (system), part 6 (booting sequence). h2. Boot device priority The S5PC110 bootrom (iROM) allows booting from various devices such as NAND, MMC, eMMC, UART and USB. The boot device priority is selected using the Operating Mode (OM) pins. Boolean values for each pin depend on the voltage applied to the pin: a positive voltage represents a logical 1 while ground represents a logical 0. h3. On-board resistors OM pins are set to boolean values using pull-up (logical 1) and pull-down (logical 0) resistors. The Nexus S (I902x) schematics show all the possible resistors connected to the pins. !crespo_om_schematics.jpg! Only a few are actually populated on the board: !{width: 50%}crespo_om_board.jpg! !{width: 50%}crespo_om_components.jpg! Resistors highlighted in green are not populated on the board. Hence, the actual layout is the following: | |_. XOM5 |_. XOM4 |_. XOM3 |_. XOM2 |_. XOM1 |_. XOM0 | | Pull-up resistor | N/A | N/A | R429 | N/A | N/A | R435 | | Pull-down resistor | R448 | R447 | N/A | R445 | R444 | N/A | | Boolean value | 0 | 0 | 1 | 0 | 0 | 1 | According to the S5PC110 User Manual, section 2 (system), part 6.2.4 (OM pin configuration), table 6-3, this indicates OnenandMux as first boot device. h2. Secure boot According to the S5PC110 User Manual The bootrom and the bootloaders appear to be implementing secure boot mechanisms that enforce signature checks on each bootloader. However, there is no signature check enforced regarding the Linux kernel. Changing a single byte on the first bootloader ended up in the system refusing to boot. In addition, a few messages from the bootloaders output suggest that such signature checks are enforced: @IROM e-fused - Secure Boot Version@. Since signature checks are enforced by the bootrom and provided that there is apparently no easy way of replacing the public key the signatures are checked against, running a free software bootloader on the Nexus S (I902x) seems impossible. // mention that it will jump to the next one h2. Stock bootloaders output <pre> ----------------------------------------------------------- Samsung Primitive Bootloader (PBL) v3.0 Copyright (C) Samsung Electronics Co., Ltd. 2006-2010 ----------------------------------------------------------- Muxed [[OneNAND]] 512MB (0x50) Sync Scanning Bad Block ....... Bad Block 77 (5) Bad Block 295 (5) Bad Block 1232 (5) Bad Block 1646 (5) Bad Block 1831 (5) Bad Block 2047 (0) SBL loadding success Set cpu clk. from 400MHz to 800MHz. OM=0x9, device=OnenandMux(Audi) IROM e-fused - Secure Boot Version. ----------------------------------------------------------- Samsung Secondary Bootloader (SBL) v3.0 Copyright (C) Samsung Electronics Co., Ltd. 2006-2010 Board Name: HERRING REV 52 Build On: Jan 20 2011 17:19:41 ----------------------------------------------------------- MMC SEM16G 15188 MB Re_partition: magic code(0x0) Muxed [[OneNAND]] 512MB (0x50) Sync Scanning Bad Block ....... Bad Block 77 (5) Bad Block 295 (5) Bad Block 1232 (5) Bad Block 1646 (5) Bad Block 1831 (5) Bad Block 2047 (0) Partitions loading success Read image(PARAM) from flash ....... Done init_fuel_gauge: vcell = 4083mV, soc = 94 PMIC_IRQ1 = 0xc0 PMIC_IRQ2 = 0x0 PMIC_IRQ3 = 0x0 PMIC_IRQ4 = 0x0 PMIC_STATUS1 = 0x0 PMIC_STATUS2 = 0x0 PMIC_STATUS3 = 0x0 PMIC_STATUS4 = 0x0 PMIC_STATUS5 = 0x0 PMIC_SMPL = 0x0 Key scan = 0x0 message.command = message.status = message.recovery = BOOT_MODE_NORMAL (SW_RST(0x00000004), INFORM(0x000000ee)) LCD ID = 0x0060a953 Done Kernel(boot.img) read success from partition no.5 Setting param.serialnr = 0x3733bab6 0x6de200ec Setting param.board_rev = 0x34 Setting param.cmdline = console=ttyFIQ0 no_console_suspend androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0xee,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked Setting param.initrd_start = 0x31000000, param.initrd_size = 0x23265 Starting kernel at 0x30008000... Uncompressing Linux... done, booting the kernel. </pre> h2. References * S5PC110 User Manual: http://dl.project-voodoo.org/documentation/S5PC110_EVT1_UM10.pdf * Nexus S (I902x) Schematics: http://mobilcoms.ru/load/1-1-0-4499 *These documents are the propriety of Samsung Electronics and are not hosted by the Replicant project. However, some excerpts from these documents are provided, for the purpose of providing technical evidence of the facts that are mentioned in this page. We believe that this particular use of the copyrighted work is fair use.*