[Galaxy S III General] scholbert:
... further experiments

Hi,

i made further progress with my attempts to boot my GT-I9305 completely from external MicroSD.

As proposed in my last post i prepared a card with the following commands:

echo "Exynos4412 FWBL1+BL2"
dd if=./emmc_auto.sbl.bin of=/dev/sda bs=512 seek=1

echo "Exynos4412 TZSW"
dd if=./E4412_S.TN.bl1.bin of=/dev/sda bs=512 seek=9500

Next is to prepare the board.

You'll need Anyway JIG or a dedicated UART connection as described in my first post.

To block access to internal eMMC the resistor R634 on the GT-I9305 mainboard got shorted.

Insert the MicroSD with the proprietary boot files into the socket.

Connect to a terminal and attach supply voltage of 3.8-4.0V to the battery connector.

Press the power button and hold it.

Here's the output so far:

TN default
<OK>
<OK>
[DVFS] INT(1) : 0
DRAM Type : LPDDR2 16G
[DVFS] MIF(3) : 0
[EPLL][VPLL][CLK_DIV] OK
<OK>
[LOCK SW/HW]ARM:0/0 INT:0/0 G3D:0/0 MIF:0/0 SHIFT:0/0
[DVFS] ARM(0) : 5
[DVFS] INT(1) : 0
[DVFS] G3D(2) : 0
[DVFS] MIF(3) : 0
[SD_INIT
SDMMC_HighSpeed:DONE]
SD_READ: 20000 20000 0x40008000 -> 422650 usec
<OK>
Inp32(uAddr) : 0x0
LINUX Bootingøq!ñ¥¡Õ

At this point there are no further outputs, as there's nothing to be executed.

Like known from the sboot, hitting enter on your terminal from the very beginning gives a commandline interface.

Unfortunately, it seems that the watchdog is not stopped at this point and maybe the PMIC is not fully initialized.

This leads to repeated resets.

Anyway if you're fast enough, you may get this command list from the proprietary bootloader:

BL>help
CMD LIST
LOG
WAIT
USB
GET
JUMP
RUN
RUN2
INIT
INIT2
DMC
CLK
DVFS
ASV
DVFSQA
EMA
PMIC
SD
EMMC
ZIP
ABB
RESET
DUMP
MEMCPY
MEMCMP
MEMSET
OUTP32
INP32
SETBITS
GETBITS
COPYRUN
MEMCPY_RUN
PATTERN
BOOT
CTA
ASB
COM
HELP
H
TEST
TN
<OK>
BL>

Some of these commands play an important role for starting up the ASB test suite if present.

These command are included in BL2 and they seem to be interpreted by ASB:

TN M0|PMIC
INIT2 3|init2|TEST
EMMC
0x10020800 1|TEST RUN

I started to mod these, but as far as i did not start the ASB image yet there's nothing to observe.

By looking at other logs from brick recoveries, i found a relationship between the first output of ASB and these commands.

My idea is that by changing these we could influence the behaviour of the ASB code for educational purpose.

As described above, without parts of ASB the PMIC seems not to be fully initialized,

because i found out that you need to hold the power button to keep the board alive.

This is little strange, as i am pretty sure that this was not the case in the begining, but maybe i'm wrong.

Anyway as far as i observed it, the board starts normally from internal eMMC after my experiments had finished.

At least nothing indicates that something got damaged...

Just to check out what happens i put a raw recovery image at position 20000 (0x9c4000) on the card.

This is the beginning of kernel code.

Afterwards i started a new terminal session and i saw that the first command of kernel code got printed,

but unfortunately after the bootcode jumps to this code there's no further output.

Something is still missing.

Could be something obvious (e.g. missing TAGS at 0x40000100) or could be not.

Maybe it would be a good idea to compile a version of u-boot and try again.

Let's see :D

scholbert