Database Info

S-OFF/S-ON, hboot, the radio, and the kernel

If figure that this would be the place to ask these questions considering that there is no general HTC forum on this board and that I expect a decent amount of conversation about hboot and S-OFF to converge here. My questions are about the boot process and the specifics about how the RTOS that operates the baseband runs on HTC's new devices.
1: I have learned that on most phones, the baseband processor and the application process boot and operate independently of each other. If I am correct, HTC is using Qualcomm's Snapdragon SoC in its newest devices, which includes a higher level of integration between the baseband and application processors. They may even be indistinguishable as far as I know. hboot is not verified by the hardware but verifies any updates to itself, as far as the Flyer is concerned. Knowing that S-OFF allows for the loading of custom radio firmware implies that hboot verifies the baseband's software, and therefore is the absolute root of trust of trust on HTC's devices. What mechanism allows the baseband software and the Linux kernel to run side-by-side without interfering with the other's processes? The only way I can see this working is if a hypervisor is running on the device or the baseband has more privileges.
2: Revolutionary changes S-ON to S-OFF whereas Unrevoked could only patch one of the bootloaders (I think) to ignore secuflag because secuflag was inaccessible. This appears to contradict the statement in the above paragraph that hboot is the root of trust and loads both the baseband firmware and the application firmware. Which is it or is there something I am missing?
3: What is the difference between hboot and the SPL (Secondary Program Loader, I believe. Think HSPL.)?
Sent from my DROID2 GLOBAL using XDA App

I am bumping this thread.

Another bump.

And another one.

Your best bet would be asking Agrabren on twitter. He's been working on getting S-OFF before we got Revolutionary to give the S-OFF. If you look at he EVO 3D forums, there was a lot of chatter and PDF files on how everything was linked together. Since the EVO 3D and Sensation are pretty much the same except the Ram and 3D features, it's the same work.
Edit:There was also an PDF file with the schematics of everything on the motherboard and how everything connected, what booted what. I'll try to find it and I'll private message it to you and post on this thread.
Also, on HTC devices as far as I know, the Radio is the trust of everything, It controls everything on the device. Ever since the G2 was released (this is when they introduced some heavy duty locks and wasn't easy as previous devices), I've also been following up on how everything is controlled on these phones. During the 2 months that it took devs to gain S=OFF, I've read IRC logs and tried everything and got a good idea of how everything works.
But here's what I know. Once the radio is S=OFF then we have *COMPLETE* control over our phones. With the bootloader S=OFF and radio S=OFF, we can still flash recovery, different ENG bootloader but cannot flash any unsigned radio images.
When the phone boots up though, I know the first thing that is booted is the radio, then bootloader, kernel, and OS. (I might have missed one or two more things that's also booted and checked).
The bootloader also checks kernel, and system partition if they are signed with HTC's private keys. If the system partition is changed on a device with S=ON, the system will be changed the way it was back from the factory, this is the reason we have temp root.
Also the baseband has it's own processes in Android and Android will never allow you to modify the radio while it's booted.

Through my conversations with globatron, I was under the impression hboot was the root of trust.

Does anyone else care to comment?
Edit: I have seen some custom radios for HTC's Android phones. What the mechanism is, I don't know.

Yes,I'm follow u
Sent from my HTC Sensation XE with Beats Audio using Tapatalk

that's an interesting question.. i'll have to follow and do some research on it myself

That's more in-depth than I know. What I *do* know is that the s-off flag is kept in the NVRAM. Who reads it and uses it? Probably the radio first.
EDIT: Definitely the radio first, because if you flash an ENG bootloader then go back to S-ON, it bricks the device.

Is that because the radio boots first?

Yes, as agabren pointed out, the radio sets the security keys. If you have a S-off radio then you're pretty much free.
That's also why most devs attack the radio first to gain FULL control of the device.
Even if the bootloader sstates its locked, only the bootloader is, not the radio.
The radio is the most important. The best thing you could do is search for the G2 s-off irc logs. There's a website (I forgot) by a dev that mapped out everything. How everything works on HTC devices. I'll try to find it.
Sent from my HTC Sensation Z710e using XDA App

I has been hoping that hboot was first. I don't like the baseband-application architecture. I don't like designs with two or more independent systems. Just a matter of taste (as dumb as that sounds).
I have another question: does the radio boot hboot or are the two processes started separately at boot time?
Sent from my DROID2 GLOBAL using XDA App

xdviper said:
Yes, as agabren pointed out, the radio sets the security keys. If you have a S-off radio then you're pretty much free.
That's also why most devs attack the radio first to gain FULL control of the device.
Even if the bootloader sstates its locked, only the bootloader is, not the radio.
The radio is the most important. The best thing you could do is search for the G2 s-off irc logs. There's a website (I forgot) by a dev that mapped out everything. How everything works on HTC devices. I'll try to find it.
Sent from my HTC Sensation Z710e using XDA App
Click to expand...
Click to collapse
Hi,
I own a HTC Sensation, but the bootloader shows UNLOCKED, S-ON and hboot 1.23.0000. I wanted to get the S-OFF. Can you help me? Or wait for the new issue in the Revolutionary?
Thanks

djnero666 said:
Hi,
I own a HTC Sensation, but the bootloader shows UNLOCKED, S-ON and hboot 1.23.0000. I wanted to get the S-OFF. Can you help me? Or wait for the new issue in the Revolutionary?
Thanks
Click to expand...
Click to collapse
Start a new thread. I am really sick of replies that have nothing to do with the topic.

djnero666 said:
Hi,
I own a HTC Sensation, but the bootloader shows UNLOCKED, S-ON and hboot 1.23.0000. I wanted to get the S-OFF. Can you help me? Or wait for the new issue in the Revolutionary?
Thanks
Click to expand...
Click to collapse
You need to flash an older h boot, 1.17, however, if you used HTC unlock method I am not sure about s off using Revolutionary, it used to not be possible. IDK, maybe it's changed now.
Sent from my HTC Sensation 4G XE with Beats Audio using xda premium

Does the NVRAM reside on a separate chip?

Can't succed on flashing the newest radio

I everyone, hope that I post my question in the good part of the forum!
I tried to follow the instructions on that thread http://forum.xda-developers.com/showthread.php?t=1684477 in order to flash the newest radio.
Currently my radio is 0.17.31501S.10_2_10.27.31501S.10L but I'd like to flash the 0.16.31501S.17_2_10.23.31501S.10L one. I both tried with CWM and TWRP and the radio's flash process seems to be done correctly in the recovery (no errors) but when I go to settings>about phone it's still the old one...
I can't find what I'm doing wrong... I'm on Coldblooded CM10 rom (JB) and my hboot is 1.13
Hope you'll be able to answer my question!
:fingers-crossed:
Thx in advance.

From all reports around here, hboot 1.13 doesn't allow flashing the new radio separatly.
I am on the same hboot and can't flash it.
If you are desperate, go the superCID way.
Sent from my HTC One S

Pheroh said:
From all reports around here, hboot 1.13 doesn't allow flashing the new radio separatly.
I am on the same hboot and can't flash it.
If you are desperate, go the superCID way.
Sent from my HTC One S
Click to expand...
Click to collapse
So there is no solutions yet to upgrade our hboot?

kipox said:
So there is no solutions yet to upgrade our hboot?
Click to expand...
Click to collapse
I suppose you meant downgrade? upgrading hboot is possible via RUU or OTA which will also upgrade your radio.
Staying at an older hboot is preferred because you could access exploits like upgrading radio only.

in the dev-section football upload the RUU of 4.0.4 that update everything, radio and hboot. i tried yesterday and everything goes fine...now i've not no more the signal problem!

Ok so now I have a dilemma :
- Should I stay on my older Hboot 1.13
- Should I upgrade it to a new one to have the newest radio
...
The question is more like : Is the newest radio is really better than the one i currently have?
If some people have upgraded theirs can give some usefull answers.
NB : I'm on CM10 ROM now! (which is a very great rom except for the camera pb but I'm confident, the devs will find a solution!)

kipox said:
Ok so now I have a dilemma :
- Should I stay on my older Hboot 1.13
- Should I upgrade it to a new one to have the newest radio
...
The question is more like : Is the newest radio is really better than the one i currently have?
If some people have upgraded theirs can give some usefull answers.
NB : I'm on CM10 ROM now! (which is a very great rom except for the camera pb but I'm confident, the devs will find a solution!)
Click to expand...
Click to collapse
1.13 hboot does not differ much from 1.14.. but the newest radio did really a great job on solving the signal issue.

the new radio is awesome .
Sent from my HTC One S

yup, hboot 1.13 and 1.14 are pretty much the same..i suggest you go get the new RUU..remember to supercid first, try to install it on HTC__001 but it failed..supercid does the trick

Q Desire S Hboot and Radio

Hello! I want to upgrade to the new hboot and radio. CUrrently got the 6.98.0000 S-OFF by Revolutionary and want to put the reengineered 2.00.0002 - 7.00.0002. Im wondering which radio should I use in case of not getting it bricked and if someone can give me links for the new radio and hboot I will be thankfull.
P.S. I want to flash them via fastboot flash [hboot] [recovery]

Do your research.
Radio can be upgraded if you're s-off. Search how.
Radio version to be used should ne determined by the rom you use.
Sent from my HTC Desire S using xda app-developers app

I also suggest you read around the subject so that you COMPLETELY understand what you're doing before you start
See links in my signature, including INDEX
Although suspect that as you're on 6.98 (revolutionary) you may have to go to engineered 7.00 rather than 2.00, but not 100% sure
Sywepd form my DsereiS

[Q] Where to get firmware (not radio)?

Here is a thread with radio and firmware from the ICS RUU: [RADIO] [FIRMWARE] ICS firmware and radio from WWE RUU. Also there are a threads with radios here and there. But where can i get older firmwares than the one from ICS RUU thread?
Offtopic: I flashed this firmware with radio (because i wanted the newest, and i had the oldest after downgrading to get S-OFF... i expect i'll get some hatred from the forum for flashing radio without strong reason). It was said in thread that it contains touchscreen drivers. I also flashed cyanogen 10.1 rom. The thing is I feel scrolling and especialy it's "kinetics" are weird, compared to stock rom i had before (i have problems controlling scrolling speed, it's either too slow or too fast). Sadly, i can't remember had it changed after i flashed cyanogen or this new firmware, therefore can't tell the reason. I was wondering what if i had to downgrade firmware - i don't know where to get it. Or maybe i should start a thread about scrolling issue?

and i had the oldest after downgrading to get S-OFF
Click to expand...
Click to collapse
confused with that line.
what is your phone bootloader status right now? s-on s-off
idk if this one is older or, refer to juggies post here http://forum.xda-developers.com/showpost.php?p=43692733&postcount=1814

You can try extracting it from ruus, that's what someone did (from the Ics ruu) in that thread you got it from. But I doubt the extra firmware being upgraded is your problem anyway, haven't heard of anyone else with such issues.
CyanogenMod does feel different scrolling etc. than sense roms, maybe you just have to get used to it

[Request] HTC One XL network issue

I have a HTC one XL (s-on, hboot 1.14) with magio rom (4.2) installed. Suddenly my phone stopped getting a network signal. At first I thought its a hardware issue but then I found out it with the software plus its a common issue. Im not an experienced user.
So far I've found out the solutions are
1) Updating the firmware - I have no idea about this. Do I have to install the stock and root again? Is this installing the stock RUU? My CID is all ones, something like 1111111. Will I brick my phone? Do I have to install both th rom and firmware?
2) Beastmod - I feel dumb after reading this thread because it doesnt say what are the requirements to install this. Never installed a kernal before.
http://forum.xda-developers.com/showthread.php?t=2165880
3) Market app - network speed boost - I tried this, workd like a charm in the first.Sent a few texts but as soon as I made a call I lost the network
Due to my lack of knowledge on the subject I'm sacared to experiment because there is a chance of bricking the phone. I understand the issue is related with android 4.2 so a noob proof guide will help everyone who have the issue.
(example - http://forum.xda-developers.com/showthread.php?t=1787148)
kind regards

Whether you decide to update the firmware or install the Beastmode kernel, you will need s-off. You'll find the s-off thread here. You'll almost definitely need to change ROMs temporarily as it seems to be virtually impossible to achieve on a Sense 5 Android 4.2.2 ROM.
The kernel is s-on friendly but many people who are s-on have had trouble installing it. The 2.15 firmware can be found in the first post of this thread, along with instructions on how to flash it. It has nothing to do with returning to stock or RUUs and you don't need to modify your phone other than getting s-off first.
Sent from my Evita

dragz said:
So far I've found out the solutions are
1) Updating the firmware - I have no idea about this. Do I have to install the stock and root again? Is this installing the stock RUU? My CID is all ones, something like 1111111. Will I brick my phone? Do I have to install both th rom and firmware?
Click to expand...
Click to collapse
The firmware package being discussed (for resolving signal drop issues on Sense 5 ROMs) and linked by timmaaa above is not an RUU, but just the hboot, radio, boot.img, media and WiFi modules that came with the "official" Sense 5 OTA. It will only overwrite the modules I named, not the ROM. Nothing else needs to be done (you will still have your current ROM, root, etc.).
You must be s-off to install this.

timmaaa said:
Whether you decide to update the firmware or install the Beastmode kernel, you will need s-off. You'll find the s-off thread here. You'll almost definitely need to change ROMs temporarily as it seems to be virtually impossible to achieve on a Sense 5 Android 4.2.2 ROM.
The kernel is s-on friendly but many people who are s-on have had trouble installing it. The 2.15 firmware can be found in the first post of this thread, along with instructions on how to flash it. It has nothing to do with returning to stock or RUUs and you don't need to modify your phone other than getting s-off first.
Sent from my Evita
Click to expand...
Click to collapse
thank you, it worked