[Hardware Hacking General] TheBeano:
To (hopefully) clear up the UART/USB confusion:

If the OneNAND load fails the IROM first tries to boot from SDMMC, then UART, then USB. Then it has one more try at OneNAND, then it locks up. This boot sequence starts at IROM address 0D005B60, see the code fragments below.

Boot error messages and the UART upload protocol show up as 115200 bps serial signals on the USB port, if the FSA9480 (the switch attached to the USB port) is switched to the UART signal path by one of the UART resistor values on the ID pin.

The default is for the FSA9480 to be switched to the USB signal path, so without a resistor on the ID pin you will only see the USB device show up.

There is definitely enough USB code to do the bootloader upload in the IROM, that is well documented in the S5PC110 manual. It isn't the same protocol and USB device that ODIN and Heimdall use, that's all implemented in the I9000 SBL.

It's interesting that the USB device only shows up for a few seconds. There's a sub at D000224 that waits 3 seconds for a USB OTG cable cable to be inserted, so that's probably what's happening. I'm not sure the I9000 is wired up correctly for this cable detection to work though.

ROM:0D005B58 CMP R8, #BOOTTYPE_4_SGS ; This is the normal branch on the SGS with OM=9
ROM:0D005B5C BNE loc_D005B9C
ROM:0D005B60 BL _LoadFromOneNand_NormalForSGS
ROM:0D005B64 MOVS R9, R0
ROM:0D005B68 BEQ checkAndRunBootloader
ROM:0D005B6C MOV R1, R9
ROM:0D005B70 MOV R0, #0
ROM:0D005B74 BL _DisplayError_code_in_R1_row_in_R0
ROM:0D005B78 MOV R0, #2
ROM:0D005B7C BL _LoadBootloaderFromSDMMC
ROM:0D005B80 MOVS R9, R0
ROM:0D005B84 BEQ checkAndRunBootloader
ROM:0D005B88 MOV R1, R9
ROM:0D005B8C MOV R0, #0
ROM:0D005B90 BL _DisplayError_code_in_R1_row_in_R0
ROM:0D005B94 BL DownloadBootloader ; UART first, then USB
ROM:0D005B98 B checkAndRunBootloader
...........
ROM:0D0087F4 DownloadBootloader ; CODE XREF: _ChooseBootModeAndBoot+1D0p
ROM:0D0087F4 ; _ChooseBootModeAndBoot+21Cp ...
ROM:0D0087F4 STMFD SP!, {R4-R6,LR}
ROM:0D0087F8 MOV R3, #0x15400 ; 87,040
ROM:0D0087FC LDR R2, =0xD0020000 ; IRAM start
ROM:0D008800 MOV R1, #0x23 ; '#' ; Baud rate divisor
ROM:0D008804 MOV R0, #2 ; UART 2
ROM:0D008808 BL _Download_BL1_From_UART
ROM:0D00880C MOVS R4, R0
ROM:0D008810 BEQ downloadOK
ROM:0D008814 MOV R1, R4
ROM:0D008818 MOV R0, #0
ROM:0D00881C BL _DisplayError_code_in_R1_row_in_R0
ROM:0D008820 BL _Download_BL1_From_USB
ROM:0D008824 AND R0, R0, #0xFF
ROM:0D008828 MOVS R4, R0
ROM:0D00882C BEQ downloadOK
ROM:0D008830 MOV R1, R4
ROM:0D008834 MOV R0, #0
ROM:0D008838 BL _DisplayError_code_in_R1_row_in_R0
ROM:0D00883C LDR R0, =0xE010E000
ROM:0D008840 LDR R5, [R0,#0x100] ; OM Status register
ROM:0D008844 MOV R5, R5,LSR#1
ROM:0D008848 AND R5, R5, #7 ; Now R5 = 4 on SGS
...................................
ROM:0D00887C loc_D00887C ; CODE XREF: DownloadBootloader+7Cj
ROM:0D00887C CMP R5, #4
ROM:0D008880 BEQ SGSboot
ROM:0D008884 CMP R5, #5
ROM:0D008888 BNE loc_D008894
ROM:0D00888C
ROM:0D00888C SGSboot ; CODE XREF: DownloadBootloader+8Cj
ROM:0D00888C MOV R6, #BOOTTYPE_4_SGS
ROM:0D008890 B loc_D0088BC
...................................
ROM:0D0088E8 loc_D0088E8 ; CODE XREF: DownloadBootloader+CCj
ROM:0D0088E8 CMP R6, #BOOTTYPE_4_SGS
ROM:0D0088EC BNE loc_D008914
ROM:0D0088F0 BL _LoadFromOneNand_NormalForSGS
ROM:0D0088F4 AND R0, R0, #0xFF
ROM:0D0088F8 MOVS R4, R0
ROM:0D0088FC BEQ downloadOK
ROM:0D008900 MOV R1, R4
ROM:0D008904 MOV R0, #0
ROM:0D008908 BL _DisplayError_code_in_R1_row_in_R0
ROM:0D00890C NOP
ROM:0D008910
ROM:0D008910 lockup ; CODE XREF: DownloadBootloader:lockupj
ROM:0D008910 B lockup