Fun with resistors (home/car dock mode + more)
- Thread starter TheBeano
- Start date
In theory it should work on any of the Galaxy S range. There are other Samsung phones that use similar USB switching chips, e.g. the GT-S8500, but I am less sure about them, you would need to dig into their open source code to check.
I made some progress with the UART on the USB port: I got a kernel boot log off it (attached). This is with resistor value 619K (RID_FM_BOOT_ON_UART).
To hook this up you need a USB-to-2.8V or 3.3V serial adapter. I'm using the Seeedstudio UARTSB v2.1, just because I already had one. Their latest version 3.0 UartSBee is here and should also work. You can't use a USB-to-RS232 serial adapter, the voltages are all wrong. See this article for links to other suitable adapters:
http://www.instructables.com/id/Android-G1-Serial-Cable/
The hookup goes:
MicroUSB pin 2 (D-) -> UARTSB RXD
MicroUSB pin 3 (D+) -> UARTSB TXD
MicroUSB pin 5 (GND) -> UARTSB GND
MicroUSB pin 4/5 (ID/GND) -> 619K resistor
If you're using the UARTSB set the VCC switch to 3.3V. If you're using a TTL level board don't hook up the TXD to USB pin 3 as the voltage is too high, leave it disconnected or use a voltage divider to drop the voltage.
On your PC run a terminal program like Teraterm, select the UARTSB serial port and set the baud rate to 115200.
Switch the phone off, wait for it to shut down completely, then plug in the dongle. Like the USB jig version it switches the phone on automatically, then you should see the boot log in the terminal program.
The phone boots normally with this resistor value, that is it doesn't go into download mode. Its only use seems to be to turn on the serial output, as it doesn't appear without this resistor in place. The other UART resistor value, RID_FM_BOOT_OFF_UART, does exactly the same thing including switching the phone on.
The boot log is probably not a lot of use for most people but if you can't repair your phone it may give you some insight as to why it isn't booting. Also it could be handy for ROM developers.
To hook this up you need a USB-to-2.8V or 3.3V serial adapter. I'm using the Seeedstudio UARTSB v2.1, just because I already had one. Their latest version 3.0 UartSBee is here and should also work. You can't use a USB-to-RS232 serial adapter, the voltages are all wrong. See this article for links to other suitable adapters:
http://www.instructables.com/id/Android-G1-Serial-Cable/
The hookup goes:
MicroUSB pin 2 (D-) -> UARTSB RXD
MicroUSB pin 3 (D+) -> UARTSB TXD
MicroUSB pin 5 (GND) -> UARTSB GND
MicroUSB pin 4/5 (ID/GND) -> 619K resistor
If you're using the UARTSB set the VCC switch to 3.3V. If you're using a TTL level board don't hook up the TXD to USB pin 3 as the voltage is too high, leave it disconnected or use a voltage divider to drop the voltage.
On your PC run a terminal program like Teraterm, select the UARTSB serial port and set the baud rate to 115200.
Switch the phone off, wait for it to shut down completely, then plug in the dongle. Like the USB jig version it switches the phone on automatically, then you should see the boot log in the terminal program.
The phone boots normally with this resistor value, that is it doesn't go into download mode. Its only use seems to be to turn on the serial output, as it doesn't appear without this resistor in place. The other UART resistor value, RID_FM_BOOT_OFF_UART, does exactly the same thing including switching the phone on.
The boot log is probably not a lot of use for most people but if you can't repair your phone it may give you some insight as to why it isn't booting. Also it could be handy for ROM developers.
Last edited:
The three-button hotkeys are active while this is going on so you can get a log of going into download and recovery mode (not very interesting).
Download mode:
Recovery mode:
Download mode:
Code:
--- (PBL and SBL start snipped) ---
keypad_scan: key value ----------------->= 0x50
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
keypad_scan: handler name = usb download
==> Welcome to ARIES!
==> Entering usb download mode..
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!Recovery mode:
Code:
keypad_scan: key value ----------------->= 0x60
CONFIG_ARIES_REV:48 , CONFIG_ARIES_REV03:48
aries_process_platform: final s1 booting mode = 0
DISPLAY_PATH_SEL[MDNIE 0x1]is on
MDNIE setting Init start!!
vsync interrupt is off
video interrupt is off
[fb0] turn on
MDNIE setting Init end!!
Autoboot (0 seconds) in progress, press any key to stop
get_debug_level current debug level is 0x574f4c44.
get_debug_level current debug level is 0x574f4c44.
boot_kernel: Debug Level Low
FOTA Check Bit
Read BML page=, NumPgs=
FOTA Check Bit (0xffffffff)
Load Partion idx = (6)
..............................done
Kernel read success from kernel partition no.6, idx.6.
setting param.serialnr=0x******** 0x********
setting param.board_rev=0x30
setting param.cmdline=bootmode=2 console=ttySAC2,115200 loglevel=4
Starting kernel at 0x32000000...If you hook up the TXD line to D+ on the port, and hammer the return key in the terminal program while it's booting, you get this:
Looks handy.
Code:
Autoboot (0 seconds) in progress, press any key to stop Autoboot aborted..
SBL> help
Following commands are supported:
* setenv
* saveenv
* printenv
* help
* reset
* boot
* kernel
* format
* open
* close
* erasepart
* eraseall
* loadkernel
* showpart
* addpart
* delpart
* savepart
* nkernel
* nramdisk
* nandread
* nandwrite
* usb
* mmctest
* keyread
* usb_read
* usb_write
* fuelgauge
* pmic_read
* pmic_write
To get commands help, Type "help <command>"
SBL>Looks handy.
If you hook up the TXD line to D+ on the port, and hammer the return key in the terminal program while it's booting, you get this:
Code:Autoboot (0 seconds) in progress, press any key to stop Autoboot aborted.. SBL> help Following commands are supported: * setenv * saveenv * printenv * help * reset * boot * kernel * format * open * close * erasepart * eraseall * loadkernel * showpart * addpart * delpart * savepart * nkernel * nramdisk * nandread * nandwrite * usb * mmctest * keyread * usb_read * usb_write * fuelgauge * pmic_read * pmic_write To get commands help, Type "help <command>" SBL>
Looks handy.
If the phone is fully bricked with this maybe you can fix it? Would be nice!
It's part of the SBL so if the phone is black-screen bricked (no SBL) it won't help.
Needless to say I have no idea what most of these commands do and a lot of them look lethal so experiment at your own risk.
It's part of the SBL so if the phone is black-screen bricked (no SBL) it won't help.
Needless to say I have no idea what most of these commands do and a lot of them look lethal so experiment at your own risk.
Lol, no need to kill my phone, but if someone with a fullybricked phone or a jtag user and tries it can report what this does.
Thanks for sharing the knowledge
Anyone know what value resistor triggers recovery mode? I have entered into download mode via the 301k resistor, but the graph in the OP does not make it clear in laymens terms, lol. Is it the 255k resistor that triggers recovery mode?
No, it does turn the phone on without the power button, but it just boots up normally.
Ahh Ok, so what resistor would call up recovery mode, if any? Surely they didnt leave that mode out or did they?
I don't know, it seems clear that a lot of the names in the OP don't correspond to the actual function in this phone (e.g. RID_FM_BOOT_ON_UART is really car dock mode) so there are a lot of values to try. They don't strictly need a value for recovery mode since if you have download mode you can flash a kernel with recovery mode fairly easily, so they may have just left it out altogether.
Ok, the reason I ask is because I was thinking of manufacturing a single cable with a multi-position switch that would get me Download Mode, Recovery Mode and Straight through to the computers USB pins all in one shot, so I would not have to remove the cable (JIG) from the computer. I hate with a passion trying to push the buttons just right and so do my fingers lol. I will try every value resistor I have at my disposal to see what happens. thanks again...
I doubt that Recovery is accessible by this method, because Recovery is much higher-level, requiring elements of the OS, including a memory map. In contrast, Download is executed by the SBL at boot time, before the OS loads.
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
22We've already established that a resistor on the micro USB port can be used to force the Galaxy S into download mode, but the USB switching chip used on the phone has a lot of other capabilities that are triggered by different resistors between pin 4 and 5 of the plug.
Update 6 March 2011: Confirmed modes so far:
Desk Dock: 365K (also works with 1K)
Car Dock: 619K
In these modes audio output can be switched to pins D- and D+ of the USB port (D- is left) but this is not done by default, see this thread.
Serial port/UART: RID_FM_BOOT_OFF_UART (523K)
Read the rest of this thread for more details on using this port.
Other resistor values that also enable the serial port:
RID_AUD_DEV_TY_2 (80.07K): Doesn't switch the phone on, but produces bootlog output on the serial port when you switch it on manually. The bootlog output only starts partway through the second bootloader, rather than from the start of the primary bootloader.
UART_CABLE (150K): Same as RID_AUD_DEV_TY_2
Download mode: 301K (this thread).
Here is a list of all the resistor values, from fsa9480_i2c.h in the open source code for JPM. The resistor goes from pin 4 to pin 5 of the micro USB plug (full details on how to wire this up are in this thread). When you connect the plug with the resistor (in Froyo) you should see some messages from the fsa9480 driver in the kernel log, which you can view with the "dmesg" command.
Code:RID_USB_OTG_MODE, /* 0 0 0 0 0 GND USB OTG Mode */ RID_AUD_SEND_END_BTN, /* 0 0 0 0 1 2K Audio Send_End Button*/ RID_AUD_REMOTE_S1_BTN, /* 0 0 0 1 0 2.604K Audio Remote S1 Button */ RID_AUD_REMOTE_S2_BTN, /* 0 0 0 1 1 3.208K Audio Remote S2 Button */ RID_AUD_REMOTE_S3_BTN, /* 0 0 1 0 0 4.014K Audio Remote S3 Button */ RID_AUD_REMOTE_S4_BTN, /* 0 0 1 0 1 4.82K Audio Remote S4 Button */ RID_AUD_REMOTE_S5_BTN, /* 0 0 1 1 0 6.03K Audio Remote S5 Button */ RID_AUD_REMOTE_S6_BTN, /* 0 0 1 1 1 8.03K Audio Remote S6 Button */ RID_AUD_REMOTE_S7_BTN, /* 0 1 0 0 0 10.03K Audio Remote S7 Button */ RID_AUD_REMOTE_S8_BTN, /* 0 1 0 0 1 12.03K Audio Remote S8 Button */ RID_AUD_REMOTE_S9_BTN, /* 0 1 0 1 0 14.46K Audio Remote S9 Button */ RID_AUD_REMOTE_S10_BTN, /* 0 1 0 1 1 17.26K Audio Remote S10 Button */ RID_AUD_REMOTE_S11_BTN, /* 0 1 1 0 0 20.5K Audio Remote S11 Button */ RID_AUD_REMOTE_S12_BTN, /* 0 1 1 0 1 24.07K Audio Remote S12 Button */ RID_RESERVED_1, /* 0 1 1 1 0 28.7K Reserved Accessory #1 */ RID_RESERVED_2, /* 0 1 1 1 1 34K Reserved Accessory #2 */ RID_RESERVED_3, /* 1 0 0 0 0 40.2K Reserved Accessory #3 */ RID_RESERVED_4, /* 1 0 0 0 1 49.9K Reserved Accessory #4 */ RID_RESERVED_5, /* 1 0 0 1 0 64.9K Reserved Accessory #5 */ RID_AUD_DEV_TY_2, /* 1 0 0 1 1 80.07K Audio Device Type 2 */ RID_PHONE_PWD_DEV, /* 1 0 1 0 0 102K Phone Powered Device */ RID_TTY_CONVERTER, /* 1 0 1 0 1 121K TTY Converter */ RID_UART_CABLE, /* 1 0 1 1 0 150K UART Cable */ RID_CEA936A_TY_1, /* 1 0 1 1 1 200K CEA936A Type-1 Charger(1) */ RID_FM_BOOT_OFF_USB, /* 1 1 0 0 0 255K Factory Mode Boot OFF-USB */ RID_FM_BOOT_ON_USB, /* 1 1 0 0 1 301K Factory Mode Boot ON-USB */ RID_AUD_VDO_CABLE, /* 1 1 0 1 0 365K Audio/Video Cable */ RID_CEA936A_TY_2, /* 1 1 0 1 1 442K CEA936A Type-2 Charger(1) */ RID_FM_BOOT_OFF_UART, /* 1 1 1 0 0 523K Factory Mode Boot OFF-UART */ RID_FM_BOOT_ON_UART, /* 1 1 1 0 1 619K Factory Mode Boot ON-UART */ RID_AUD_DEV_TY_1_REMOTE, /* 1 1 1 1 0 1000.07K Audio Device Type 1 with Remote(1) */ RID_AUD_DEV_TY_1_SEND = RID_AUD_DEV_TY_1_REMOTE , /* 1 1 1 1 0 1002K Audio Device Type 1 / Only Send-End(2) */ RID_USB_MODE, /* 1 1 1 1 1 Open USB Mode, Dedicated Charger or Accessory Detach */3
I got PM'ed by a user for a feature request on the Note 2, currently by default it is compiled with:
CONFIG_MUIC_MAX77693_SUPPORT_OTG_AUDIO_DOCK=y
CONFIG_MUIC_MAX77693_SUPPORT_SMART_DOCK=y
Car dock entry is missing in the default defconfig. The S3 has none of these options checked:
# CONFIG_MUIC_MAX77693_SUPPORT_OTG_AUDIO_DOCK is not set
# CONFIG_MUIC_MAX77693_SUPPORT_SMART_DOCK is not set
# CONFIG_MUIC_MAX77693_SUPPORT_CAR_DOCK is not set
Also, keep in mind we're talking international S3, US version has different PMICs.
So here's a kernel for both devices with all the three options enabled: S3 build upon this kernel, and the N2 on this one (Almost the same).
Again, both these have:
CONFIG_MUIC_MAX77693_SUPPORT_OTG_AUDIO_DOCK=y
CONFIG_MUIC_MAX77693_SUPPORT_SMART_DOCK=y
CONFIG_MUIC_MAX77693_SUPPORT_CAR_DOCK=y
I currently have no device/dock to test this functionality other than simple OTG, so I post it here for because of the specificity of the request. If it works I will keep it for both in the stable kernels.
Edit: I have moved this functionality onto the my main kernels and you should visit the threads linked above for downloads of new versions.2Some notes about the UART:
The UART device is /dev/ttySAC2 but you need to create a device node for it as described in this file from the kernel source:
Documentation/arm/Samsung-S3C24XX/Overview.txt
So use this command (root required):
Code:mknod ttySAC2 c 204 66
The UART is switched between the MODEM (radio) and PDA (CPU) by the device /sys/devices/virtual/sec/switch/uart_sel
You can see what the current state is with this command:
Code:cat /sys/class/sec/switch/uart_sel [UART Switch] Current UART owner = PDA
You can change the state with:
Code:echo PDA> /sys/class/sec/switch/uart_sel or echo MODEM> /sys/class/sec/switch/uart_sel
You can tell when it's connected to MODEM because it will respond to AT commands, e.g.
Code:ATI0 Manufacturer: SAMSUNG Model: I9000 Revision: I9000XXJPP IMEI: ***************
The baud rate is set to 115200 at boot time, I don't know how to change it as yet.2
Yes the ttySAC2 port works fine. In some configurations the serial port that's connected to the USB pins gets switched to the MODEM after boot and you need to switch it back, like this (from a terminal command line on the phone):
echo PDA > /sys/class/sec/switch/uart_sel
echo hi>/dev/ttySAC2 (you should see "hi" on a connected serial terminal).2
It is always pins 4 & 5. The binary bits indicate the value in the ADC (Analog to Digital Converter) register on the chip, under "//CR7 : ADC Register" in the fsa9480_i2c.h file.
New posts
-
Development [ROM][A14][Pixel 7 Series] MATRIXX-v10.4.2 [GAPPS][04.19.2024]- Latest: AxxPyrtlexx20
-
