[Galaxy S Advance I9070 Q&A, Help & Troubleshooting] flentus:
Hi Paul,

thanks for your contribution.

A few replies/questions :

* you state that Montblanc dev board and I9070 are completly different: isn't the aim of dev dev board to be close to ME while adding extra connectors to ease debug and interfacing for prototyping? Calao dev board looks very close to I9070: I have compared the schematics and component list: they look very very much alike. For me, NovaThor U8500 plateform consists of a DB8500 SoC, a Mali 400, a built-in modem + chips for USB, audio and SIM operations.

So, to me, I may be wrong, at least the processor (u8500), PLL, eMMC, SDRAM, UART + several low level controlers should be the same. As we are trying to work at such level (just trying to get the basic system to boot to just enable eMMC write), don't we have a chance to manage to have those work (maybe with adressing adaptation, those might be tough)?

* I can't agree with you that "the "seconds" of power you get on the USB is the device looking for JTAG.": on boot time, even without trashed PBL, the ME connects to USB properly with vendor/ID=04cc/8500, and sends its ASIC ID (displayed on PC screen). As stated earlier in the thread, I manage to send some commands and receive response from the ME in this state using STE tools (flashkit_cli, sending commands threw flashkit_backend).

It's definetly not any JTAG stuffs. JTAG on the I9070 is accessible on the mainboard via dedicated pads, you can locate using the light schematics provided in the "Service manual" package.

This early boot behaviour is documented in the "flash-tool-backend.html" document (available in s-4.1_vendor_st-ericsson.tar in ./s-4.1_vendor_st-ericsson/vendor/st-ericsson/tools/platform/flash_kit/flash_tool_backend/com.stericsson.sdk.backend.build/doc):

Boot process description

When the peripheral boot sequence starts, the ME sends an asic id to the connected PC tool.

The PC tool then answers with a boot indication.

- If normal, ADL or production is sent as boot indication; this means that the x-loader will start the binary software stored at the corresponding location in the boot image (based on the location stated by the TOC).

- If programming is used as boot indication, the PC will send a completely new set of boot code to the ME. This is used when a loader is downloaded during service mode startup via the Flash Tool Backend.

- When the normal boot indication is sent, Flash Tool backend sends no more data and the ME is booted with the binary software stored in the place where the normal software is stored according to the TOC.

The ADL boot scenario works like this:

1. Flash Tool Backend receives asic id

2. Boot indication ADL is sent

3. Flash tool backend starts LCD and LCM and waits for a loader startup message.

The loader is stored at the ADL location of the boot image (this is supported by the assemble tool).

* If I understand well, as we don't have the sources for the bootloader, your proposal is to grab one from a working device.

That sounds a really good idea!

Here is the complete partition table/PIT of the I9070 (recovered by someone with a Riff box from a GB archive, if I remember well):

(copy/paste it in a traditional editor and add padding to recover the table).

Partition number Filename in archive Name in PIT starting offset HEX Size in bytes HEX

MBR, GPT 0 20000

STE_boot.bin TOC ISSW XLOADER 20000 60000

mmcblk0p10 GT-I9070P_EUR_XX_8G.pit PIT 80000 100000

mmcblk0p6 cspsa.img CSPSA FS 180000 180000

EMPTY 300000 100000

mmcblk0p7 EFS.img EFS 400000 A00000

mmcblk0p2 modemfs.img MODEM FS E00000 100000

mem_init.bin STE MEM INIT 1E00000 80000

power_management.bin PWR MGT 1E80000 80000

mmcblk0p14 normal.bin SBL 1F00000 200000

mmcblk0p16 normal2.bin SBL_2 2100000 200000

mmcblk0p1 param.lfs PARAM 2300000 1000000

mmcblk0p12 ipl.bin IPL MODEM 3300000 200000

mmcblk0p13 modem.bin MODEM 3500000 1000000

mmcblk0p15 kernel.bin KERNEL 4500000 1000000

mmcblk0p17 kernel2.bin KERNEL2 5500000 1000000

mmcblk0p3 system.img SYSTEM 6500000 26400000

mmcblk0p5 userdata.img DATAFS 2C900000 80000000

mmcblk0p4 cache.img CACHEFS AC900000 13200000

mmcblk0p9 hidden.img HIDDEN BFB00000 14000000

mmcblk0p11 ssgtest.img FOTA D3B00000 3200000

mmcblk0p8 ums.rfs UMS D6D00000 FAA00000

--> PBL corresponds to "TOC ISSW XLOADER" (STE_boot.bin in the flash archive) and SLB to normal.bin. So basically we have our boot files. We can extract them from the GB flash archive or from a ROM dump (I have dd'ed every partitions from 2 different I9070P + a full recovery dump from a 9070 provided by Riff box support files I found once I don't remember where).

So, if I have time one of theses days, I'll try to build a flash archive based on these files and try to boot from STE tools on it using "programming" as boot indication.

* Using the knowledge of the I9100 (Galaxy S II): I'm afraid this is a very different hardware, I9100 uses an Exynos 4210, so I hardly see what we could use from there... Could you give us some more advise on that idea?

Regards