Fun with resistors (home/car dock mode + more)

Search This thread

TheBeano

Senior Member
Jul 18, 2010
355
216
We've already established that a resistor on the micro USB port can be used to force the Galaxy S into download mode, but the USB switching chip used on the phone has a lot of other capabilities that are triggered by different resistors between pin 4 and 5 of the plug.

Update 6 March 2011: Confirmed modes so far:
Desk Dock: 365K (also works with 1K)
Car Dock: 619K
In these modes audio output can be switched to pins D- and D+ of the USB port (D- is left) but this is not done by default, see this thread.

Serial port/UART: RID_FM_BOOT_OFF_UART (523K)
Read the rest of this thread for more details on using this port.
Other resistor values that also enable the serial port:
RID_AUD_DEV_TY_2 (80.07K): Doesn't switch the phone on, but produces bootlog output on the serial port when you switch it on manually. The bootlog output only starts partway through the second bootloader, rather than from the start of the primary bootloader.
UART_CABLE (150K): Same as RID_AUD_DEV_TY_2


Download mode:
301K (this thread).

Here is a list of all the resistor values, from fsa9480_i2c.h in the open source code for JPM. The resistor goes from pin 4 to pin 5 of the micro USB plug (full details on how to wire this up are in this thread). When you connect the plug with the resistor (in Froyo) you should see some messages from the fsa9480 driver in the kernel log, which you can view with the "dmesg" command.

Code:
RID_USB_OTG_MODE,	/* 0 0 0 0 0 	GND 		USB OTG Mode              */
RID_AUD_SEND_END_BTN,	/* 0 0 0 0 1 	2K		Audio Send_End Button*/
RID_AUD_REMOTE_S1_BTN,	/* 0 0 0 1 0 	2.604K		Audio Remote S1 Button */
RID_AUD_REMOTE_S2_BTN,	/* 0 0 0 1 1 	3.208K		Audio Remote S2 Button                         */
RID_AUD_REMOTE_S3_BTN,	/* 0 0 1 0 0 	4.014K		Audio Remote S3 Button */
RID_AUD_REMOTE_S4_BTN,	/* 0 0 1 0 1 	4.82K		Audio Remote S4 Button */
RID_AUD_REMOTE_S5_BTN,	/* 0 0 1 1 0 	6.03K		Audio Remote S5 Button */
RID_AUD_REMOTE_S6_BTN,	/* 0 0 1 1 1 	8.03K		Audio Remote S6 Button */
RID_AUD_REMOTE_S7_BTN,	/* 0 1 0 0 0 	10.03K		Audio Remote S7 Button */
RID_AUD_REMOTE_S8_BTN,	/* 0 1 0 0 1 	12.03K		Audio Remote S8 Button */
RID_AUD_REMOTE_S9_BTN,	/* 0 1 0 1 0 	14.46K		Audio Remote S9 Button */
RID_AUD_REMOTE_S10_BTN,	/* 0 1 0 1 1 	17.26K		Audio Remote S10 Button */
RID_AUD_REMOTE_S11_BTN,	/* 0 1 1 0 0 	20.5K		Audio Remote S11 Button */
RID_AUD_REMOTE_S12_BTN,	/* 0 1 1 0 1 	24.07K		Audio Remote S12 Button */
RID_RESERVED_1,		/* 0 1 1 1 0 	28.7K		Reserved Accessory #1 */
RID_RESERVED_2,		/* 0 1 1 1 1 	34K 		Reserved Accessory #2 */
RID_RESERVED_3,		/* 1 0 0 0 0 	40.2K		Reserved Accessory #3 */
RID_RESERVED_4,		/* 1 0 0 0 1 	49.9K		Reserved Accessory #4 */
RID_RESERVED_5,		/* 1 0 0 1 0 	64.9K		Reserved Accessory #5 */
RID_AUD_DEV_TY_2,	/* 1 0 0 1 1 	80.07K		Audio Device Type 2 */
RID_PHONE_PWD_DEV,	/* 1 0 1 0 0 	102K		Phone Powered Device */
RID_TTY_CONVERTER,	/* 1 0 1 0 1 	121K		TTY Converter */
RID_UART_CABLE,		/* 1 0 1 1 0 	150K		UART Cable */
RID_CEA936A_TY_1,	/* 1 0 1 1 1 	200K		CEA936A Type-1 Charger(1) */
RID_FM_BOOT_OFF_USB,	/* 1 1 0 0 0 	255K		Factory Mode Boot OFF-USB */
RID_FM_BOOT_ON_USB,	/* 1 1 0 0 1 	301K		Factory Mode Boot ON-USB */
RID_AUD_VDO_CABLE,	/* 1 1 0 1 0 	365K		Audio/Video Cable */
RID_CEA936A_TY_2,	/* 1 1 0 1 1 	442K		CEA936A Type-2 Charger(1) */
RID_FM_BOOT_OFF_UART,	/* 1 1 1 0 0 	523K		Factory Mode Boot OFF-UART */
RID_FM_BOOT_ON_UART,	/* 1 1 1 0 1 	619K		Factory Mode Boot ON-UART */
RID_AUD_DEV_TY_1_REMOTE,	/* 1 1 1 1 0 	1000.07K	Audio Device Type 1 with Remote(1) */
RID_AUD_DEV_TY_1_SEND = RID_AUD_DEV_TY_1_REMOTE ,		/* 1 1 1 1 0 	1002K		Audio Device Type 1 / Only Send-End(2) */
RID_USB_MODE,		/* 1 1 1 1 1 	Open		USB Mode, Dedicated Charger or Accessory Detach */
 
Last edited:

szczeslaw

Member
Oct 24, 2006
48
32
Great stuff. Thanks man.
I wonder, what is really implemented in I9000.
For example, would it be possible, to make a remote controller for music (something like HTC RC-E100 - i've had it for my Raphael and Hero, and it was great).
Well, when i find some time, i'll try to experiment a bit with that.
 

szczeslaw

Member
Oct 24, 2006
48
32
Good job.

Makes you wonder why Samsung still hasn't released that damn dock yet.
They did, but only for America for now (at least it's listed in accessories on Samsung's US website).

Both a 1k and a 330R resistor triggered Home Dock mode for me, I see they're not on the list either.
Well, 1K didn't work for me. I'll have to find 330R (it won't be easy though, cause i have a lot of mess in tools and electronic parts, after moving to another apartement ;) ).
 

tonymy01

Senior Member
Aug 15, 2010
281
38
Sydney
It is 301K, not 330ohms(=330R) +1K. ...for the download mode I presume you are talking about?
 
Last edited:

TheBeano

Senior Member
Jul 18, 2010
355
216
Well, 1K didn't work for me. I'll have to find 330R (it won't be easy though, cause i have a lot of mess in tools and electronic parts, after moving to another apartement ;) ).

Check in the dmesg log for something like this:

Code:
<4>[15461.339356] [FSA9480] FSA9480_ReadIntRegister
<4>[15461.389352] [otg_clock_enable] clk_enable(otg_clock) OK.
<4>[15461.402600] [FSA9480] FSA9480_ProcessDevice (dev1 : 0x0, dev2 : 0x40)
<4>[15461.402707] AudioVideo
<4>[15461.402769] FSA9480_enable_spk
<6>[15461.402842] set_dock_state : 0X1
<4>[15461.423626] FSA9480_Enable_SPK --- enable

In fsa9480_i2c.c it is going through the branch where the home dock is plugged in, but the device detected is FSA9480_DEV_TY2_AV, which should be 80K, not 1K? So, more testing needed I think. :)

Also I have Alarm Clock PlusV2 installed which is the app that was triggered by this action. I did try installing the Samsung Desk Home app but it doesn't work on Froyo.
 
Last edited:

szczeslaw

Member
Oct 24, 2006
48
32
It is 301K, not 330ohms(=330R) +1K. ...for the download mode I presume you are talking about?
Well, i know a little bit about electronics (even made some devices, like power amps, devices based on microcontrollers etc.), so i know what 330R and 301K means ;)
I already got download mode working.
And right now i got home dock working to, with 1K resistor. I just didn't know, that one needs an additional app for it to work (i thought it's a system app).
 

tonymy01

Senior Member
Aug 15, 2010
281
38
Sydney
Yeah, sorry for the mix up,i am subscribed to both of the threads related to this recent discovery, and mixed them up. I am certainly interested in triggering particular modes, eg entering car to put phone bluetooth on and screen on dim always, and perhaps a basic home page for gps nav etc, and having an alarm clock mode that maybe turns off data etc. the sky is really the limit here, I can't believe samsumg isn't taking advantage of these features!
 
Question: has anybody ever actually SEEN a chip inside the I9000 labeled "FSA9480", or is it possible that the "FSA9480" is actually just IP licensed by Samsung and incorporated directly into one of their ASICs?

I ask, because I have an Epic4G. I've scrutinized the various publicized teardown photos of its board, and I have yet to find anything that looks like it might be this chip (which would almost certainly be either MLF or microBGA, 3mm x 4mm or larger, and located somewhere between the main processor and the USB port).

By the same token, does a readily-available (though not necessarily "public", if you know what I mean) datasheet for the Hummingbird and its support chips exist somewhere that documents things like how many UARTs it has, which pins they're connected to, how they're configured (baudrate, parity, mode, stopbits, input & out put registers, interrupts, etc)? As far as I can tell, Android itself has no concept of a UART, and everything in the (official Samsung) kernel that's UART-related was omitted, so there's no documentation in there.

I'm personally psyched about the existence of a UART on this phone, because it opens the door for external peripherals that are a half step above "homebrew" -- things like game controllers, folding keyboards, etc. Stuff you COULD sort of implement via bluetooth (if we ever get a kernel that knows how to do HID), but would literally cost half as much and get twice the battery life if you could skip the bluetooth and just connect via a pair of wires instead.
 

TheBeano

Senior Member
Jul 18, 2010
355
216
I ask, because I have an Epic4G. I've scrutinized the various publicized teardown photos of its board, and I have yet to find anything that looks like it might be this chip (which would almost certainly be either MLF or microBGA, 3mm x 4mm or larger, and located somewhere between the main processor and the USB port).
It's a 3x4mm UMLP, I haven't seen it described online as anything other than a discrete chip so it probably is on the board somewhere.

By the same token, does a readily-available (though not necessarily "public", if you know what I mean) datasheet for the Hummingbird and its support chips exist somewhere that documents things like how many UARTs it has, which pins they're connected to, how they're configured (baudrate, parity, mode, stopbits, input & out put registers, interrupts, etc)?

Yes, google S5PC110_EVT1_UM10 .

As far as I can tell, Android itself has no concept of a UART, and everything in the (official Samsung) kernel that's UART-related was omitted, so there's no documentation in there.

There is some UART code e.g. arch/arm/plat-s5pc1xx/dev-uart.c but it may be just for Bluetooth. There are a lot of /dev/ttySn ports, not sure what they do yet.

I'm personally psyched about the existence of a UART on this phone, because it opens the door for external peripherals that are a half step above "homebrew" -- things like game controllers, folding keyboards, etc. Stuff you COULD sort of implement via bluetooth (if we ever get a kernel that knows how to do HID), but would literally cost half as much and get twice the battery life if you could skip the bluetooth and just connect via a pair of wires instead.

The Froyo kernel does HID via Bluetooth OK, except for the Wii controller which is a not-very-conforming Bluetooth device. If the Galaxy supports USB OTG, and there is at least some detection and setup code for that, it would probably be easier to use that for wired peripherals.
 

Richthofen

Senior Member
Jul 13, 2010
387
78
In the land of the blind
The FSA9480 on Aries platform phones does not have any "clear text" etched on it.
It is located under the RF shield (same side with the baseband chip).

The chip is so tiny that it is necessary to have a scope to see the text printed on it. I found no hits with the code printed on the chip (cannot remember what was it).

The component location on Aries platform phones is U301 (schematics).
 

Richthofen

Senior Member
Jul 13, 2010
387
78
In the land of the blind
The schematics do not specify the pin numbers, but atleast video and mic of FSA9480 are left NC.
 

Attachments

  • ARIES_FSA9480.jpg
    ARIES_FSA9480.jpg
    65.3 KB · Views: 7,702

TheBeano

Senior Member
Jul 18, 2010
355
216
Thanks! So CP_D+/- are USB from the Call Processor, and AP_D+/- are USB from the Application Processor, and the IF_TXD/RXD are switched to UARTs on either the call processor or the app processor by another chip, is that correct? I'm looking at the GT-S8500 service manual which uses the same signal names.

Do you have the big block diagram for the I9000 please, that would be really useful? I would especially like to know where the BOOT_MODE and JIG signals go, and which UART on the CPU the IF_TXD/RXD gets switched to, and what does the switching. Also where VPS_L and VPS_R are coming from. Ta.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 21
    We've already established that a resistor on the micro USB port can be used to force the Galaxy S into download mode, but the USB switching chip used on the phone has a lot of other capabilities that are triggered by different resistors between pin 4 and 5 of the plug.

    Update 6 March 2011: Confirmed modes so far:
    Desk Dock: 365K (also works with 1K)
    Car Dock: 619K
    In these modes audio output can be switched to pins D- and D+ of the USB port (D- is left) but this is not done by default, see this thread.

    Serial port/UART: RID_FM_BOOT_OFF_UART (523K)
    Read the rest of this thread for more details on using this port.
    Other resistor values that also enable the serial port:
    RID_AUD_DEV_TY_2 (80.07K): Doesn't switch the phone on, but produces bootlog output on the serial port when you switch it on manually. The bootlog output only starts partway through the second bootloader, rather than from the start of the primary bootloader.
    UART_CABLE (150K): Same as RID_AUD_DEV_TY_2


    Download mode:
    301K (this thread).

    Here is a list of all the resistor values, from fsa9480_i2c.h in the open source code for JPM. The resistor goes from pin 4 to pin 5 of the micro USB plug (full details on how to wire this up are in this thread). When you connect the plug with the resistor (in Froyo) you should see some messages from the fsa9480 driver in the kernel log, which you can view with the "dmesg" command.

    Code:
    RID_USB_OTG_MODE,	/* 0 0 0 0 0 	GND 		USB OTG Mode              */
    RID_AUD_SEND_END_BTN,	/* 0 0 0 0 1 	2K		Audio Send_End Button*/
    RID_AUD_REMOTE_S1_BTN,	/* 0 0 0 1 0 	2.604K		Audio Remote S1 Button */
    RID_AUD_REMOTE_S2_BTN,	/* 0 0 0 1 1 	3.208K		Audio Remote S2 Button                         */
    RID_AUD_REMOTE_S3_BTN,	/* 0 0 1 0 0 	4.014K		Audio Remote S3 Button */
    RID_AUD_REMOTE_S4_BTN,	/* 0 0 1 0 1 	4.82K		Audio Remote S4 Button */
    RID_AUD_REMOTE_S5_BTN,	/* 0 0 1 1 0 	6.03K		Audio Remote S5 Button */
    RID_AUD_REMOTE_S6_BTN,	/* 0 0 1 1 1 	8.03K		Audio Remote S6 Button */
    RID_AUD_REMOTE_S7_BTN,	/* 0 1 0 0 0 	10.03K		Audio Remote S7 Button */
    RID_AUD_REMOTE_S8_BTN,	/* 0 1 0 0 1 	12.03K		Audio Remote S8 Button */
    RID_AUD_REMOTE_S9_BTN,	/* 0 1 0 1 0 	14.46K		Audio Remote S9 Button */
    RID_AUD_REMOTE_S10_BTN,	/* 0 1 0 1 1 	17.26K		Audio Remote S10 Button */
    RID_AUD_REMOTE_S11_BTN,	/* 0 1 1 0 0 	20.5K		Audio Remote S11 Button */
    RID_AUD_REMOTE_S12_BTN,	/* 0 1 1 0 1 	24.07K		Audio Remote S12 Button */
    RID_RESERVED_1,		/* 0 1 1 1 0 	28.7K		Reserved Accessory #1 */
    RID_RESERVED_2,		/* 0 1 1 1 1 	34K 		Reserved Accessory #2 */
    RID_RESERVED_3,		/* 1 0 0 0 0 	40.2K		Reserved Accessory #3 */
    RID_RESERVED_4,		/* 1 0 0 0 1 	49.9K		Reserved Accessory #4 */
    RID_RESERVED_5,		/* 1 0 0 1 0 	64.9K		Reserved Accessory #5 */
    RID_AUD_DEV_TY_2,	/* 1 0 0 1 1 	80.07K		Audio Device Type 2 */
    RID_PHONE_PWD_DEV,	/* 1 0 1 0 0 	102K		Phone Powered Device */
    RID_TTY_CONVERTER,	/* 1 0 1 0 1 	121K		TTY Converter */
    RID_UART_CABLE,		/* 1 0 1 1 0 	150K		UART Cable */
    RID_CEA936A_TY_1,	/* 1 0 1 1 1 	200K		CEA936A Type-1 Charger(1) */
    RID_FM_BOOT_OFF_USB,	/* 1 1 0 0 0 	255K		Factory Mode Boot OFF-USB */
    RID_FM_BOOT_ON_USB,	/* 1 1 0 0 1 	301K		Factory Mode Boot ON-USB */
    RID_AUD_VDO_CABLE,	/* 1 1 0 1 0 	365K		Audio/Video Cable */
    RID_CEA936A_TY_2,	/* 1 1 0 1 1 	442K		CEA936A Type-2 Charger(1) */
    RID_FM_BOOT_OFF_UART,	/* 1 1 1 0 0 	523K		Factory Mode Boot OFF-UART */
    RID_FM_BOOT_ON_UART,	/* 1 1 1 0 1 	619K		Factory Mode Boot ON-UART */
    RID_AUD_DEV_TY_1_REMOTE,	/* 1 1 1 1 0 	1000.07K	Audio Device Type 1 with Remote(1) */
    RID_AUD_DEV_TY_1_SEND = RID_AUD_DEV_TY_1_REMOTE ,		/* 1 1 1 1 0 	1002K		Audio Device Type 1 / Only Send-End(2) */
    RID_USB_MODE,		/* 1 1 1 1 1 	Open		USB Mode, Dedicated Charger or Accessory Detach */
    3
    Thanks, I had a quick look and they no longer use the FSA9480 chip for the USB interface, instead it looks like they use the MAX77693 chip, same as the Galaxy SIII. There is a resistor table for cable detection in the code that has the same values for the car dock etc.:
    Code:
    	ADC_DOCK_VOL_DN		= 0x0a, /* 0x01010 14.46K ohm */
    	ADC_DOCK_VOL_UP		= 0x0b, /* 0x01011 17.26K ohm */
    	ADC_DOCK_PLAY_PAUSE_KEY = 0x0d,
    	ADC_SMARTDOCK		= 0x10, /* 0x10000 40.2K ohm */
    	ADC_AUDIODOCK		= 0x12, /* 0x10010 64.9K ohm */
    	ADC_CEA936ATYPE1_CHG	= 0x17,	/* 0x10111 200K ohm */
    	ADC_JIG_USB_OFF		= 0x18, /* 0x11000 255K ohm */
    	ADC_JIG_USB_ON		= 0x19, /* 0x11001 301K ohm */
    	ADC_DESKDOCK		= 0x1a, /* 0x11010 365K ohm */
    	ADC_CEA936ATYPE2_CHG	= 0x1b, /* 0x11011 442K ohm */
    	ADC_JIG_UART_OFF	= 0x1c, /* 0x11100 523K ohm */
    	ADC_JIG_UART_ON		= 0x1d, /* 0x11101 619K ohm */
    	ADC_CARDOCK		= 0x1d, /* 0x11101 619K ohm */
    #if defined(CONFIG_MUIC_DET_JACK)
    	ADC_EARJACK		= 0x1e, /* 0x11110 1000 or 1002 ohm */

    But there are a lot of conditional compile settings e.g.
    #if !defined(CONFIG_MUIC_MAX77693_SUPPORT_CAR_DOCK)

    So they may have compiled it without this activated for the Note 2. Possibly the SGS III forums have more info?
    I got PM'ed by a user for a feature request on the Note 2, currently by default it is compiled with:

    CONFIG_MUIC_MAX77693_SUPPORT_OTG_AUDIO_DOCK=y
    CONFIG_MUIC_MAX77693_SUPPORT_SMART_DOCK=y

    Car dock entry is missing in the default defconfig. The S3 has none of these options checked:

    # CONFIG_MUIC_MAX77693_SUPPORT_OTG_AUDIO_DOCK is not set
    # CONFIG_MUIC_MAX77693_SUPPORT_SMART_DOCK is not set
    # CONFIG_MUIC_MAX77693_SUPPORT_CAR_DOCK is not set

    Also, keep in mind we're talking international S3, US version has different PMICs.

    So here's a kernel for both devices with all the three options enabled: S3 build upon this kernel, and the N2 on this one (Almost the same).

    Again, both these have:

    CONFIG_MUIC_MAX77693_SUPPORT_OTG_AUDIO_DOCK=y
    CONFIG_MUIC_MAX77693_SUPPORT_SMART_DOCK=y
    CONFIG_MUIC_MAX77693_SUPPORT_CAR_DOCK=y

    I currently have no device/dock to test this functionality other than simple OTG, so I post it here for because of the specificity of the request. If it works I will keep it for both in the stable kernels.

    Edit: I have moved this functionality onto the my main kernels and you should visit the threads linked above for downloads of new versions.
    2
    Some notes about the UART:

    The UART device is /dev/ttySAC2 but you need to create a device node for it as described in this file from the kernel source:
    Documentation/arm/Samsung-S3C24XX/Overview.txt

    So use this command (root required):
    Code:
    mknod ttySAC2 c 204 66

    The UART is switched between the MODEM (radio) and PDA (CPU) by the device /sys/devices/virtual/sec/switch/uart_sel

    You can see what the current state is with this command:
    Code:
    cat /sys/class/sec/switch/uart_sel
        [UART Switch] Current UART owner = PDA

    You can change the state with:
    Code:
       echo PDA> /sys/class/sec/switch/uart_sel
    or
       echo MODEM> /sys/class/sec/switch/uart_sel

    You can tell when it's connected to MODEM because it will respond to AT commands, e.g.
    Code:
    ATI0
     Manufacturer: SAMSUNG
    
     Model: I9000
    
     Revision: I9000XXJPP
    
     IMEI: ***************

    The baud rate is set to 115200 at boot time, I don't know how to change it as yet.
    2
    Hi! After modding USB port to behave as UART, is it possible to use this port for custom data and not just for debug output? For instance, I would like to open ttySAC2 port with putty and enter some text which would then be transferred to my PC.
    Yes the ttySAC2 port works fine. In some configurations the serial port that's connected to the USB pins gets switched to the MODEM after boot and you need to switch it back, like this (from a terminal command line on the phone):

    echo PDA > /sys/class/sec/switch/uart_sel
    echo hi>/dev/ttySAC2 (you should see "hi" on a connected serial terminal).
    2
    Noob question but on the list of resistor values does the */11101 indicate the usb pins to connect? or is it always 4 and 5?
    It is always pins 4 & 5. The binary bits indicate the value in the ADC (Analog to Digital Converter) register on the chip, under "//CR7 : ADC Register" in the fsa9480_i2c.h file.