Fun with resistors (home/car dock mode + more)

TheBeano

Senior Member
Jul 18, 2010
355
216
0
We've already established that a resistor on the micro USB port can be used to force the Galaxy S into download mode, but the USB switching chip used on the phone has a lot of other capabilities that are triggered by different resistors between pin 4 and 5 of the plug.

Update 6 March 2011: Confirmed modes so far:
Desk Dock: 365K (also works with 1K)
Car Dock: 619K
In these modes audio output can be switched to pins D- and D+ of the USB port (D- is left) but this is not done by default, see this thread.

Serial port/UART: RID_FM_BOOT_OFF_UART (523K)
Read the rest of this thread for more details on using this port.
Other resistor values that also enable the serial port:
RID_AUD_DEV_TY_2 (80.07K): Doesn't switch the phone on, but produces bootlog output on the serial port when you switch it on manually. The bootlog output only starts partway through the second bootloader, rather than from the start of the primary bootloader.
UART_CABLE (150K): Same as RID_AUD_DEV_TY_2


Download mode:
301K (this thread).

Here is a list of all the resistor values, from fsa9480_i2c.h in the open source code for JPM. The resistor goes from pin 4 to pin 5 of the micro USB plug (full details on how to wire this up are in this thread). When you connect the plug with the resistor (in Froyo) you should see some messages from the fsa9480 driver in the kernel log, which you can view with the "dmesg" command.

Code:
RID_USB_OTG_MODE,	/* 0 0 0 0 0 	GND 		USB OTG Mode              */
RID_AUD_SEND_END_BTN,	/* 0 0 0 0 1 	2K		Audio Send_End Button*/
RID_AUD_REMOTE_S1_BTN,	/* 0 0 0 1 0 	2.604K		Audio Remote S1 Button */
RID_AUD_REMOTE_S2_BTN,	/* 0 0 0 1 1 	3.208K		Audio Remote S2 Button                         */
RID_AUD_REMOTE_S3_BTN,	/* 0 0 1 0 0 	4.014K		Audio Remote S3 Button */
RID_AUD_REMOTE_S4_BTN,	/* 0 0 1 0 1 	4.82K		Audio Remote S4 Button */
RID_AUD_REMOTE_S5_BTN,	/* 0 0 1 1 0 	6.03K		Audio Remote S5 Button */
RID_AUD_REMOTE_S6_BTN,	/* 0 0 1 1 1 	8.03K		Audio Remote S6 Button */
RID_AUD_REMOTE_S7_BTN,	/* 0 1 0 0 0 	10.03K		Audio Remote S7 Button */
RID_AUD_REMOTE_S8_BTN,	/* 0 1 0 0 1 	12.03K		Audio Remote S8 Button */
RID_AUD_REMOTE_S9_BTN,	/* 0 1 0 1 0 	14.46K		Audio Remote S9 Button */
RID_AUD_REMOTE_S10_BTN,	/* 0 1 0 1 1 	17.26K		Audio Remote S10 Button */
RID_AUD_REMOTE_S11_BTN,	/* 0 1 1 0 0 	20.5K		Audio Remote S11 Button */
RID_AUD_REMOTE_S12_BTN,	/* 0 1 1 0 1 	24.07K		Audio Remote S12 Button */
RID_RESERVED_1,		/* 0 1 1 1 0 	28.7K		Reserved Accessory #1 */
RID_RESERVED_2,		/* 0 1 1 1 1 	34K 		Reserved Accessory #2 */
RID_RESERVED_3,		/* 1 0 0 0 0 	40.2K		Reserved Accessory #3 */
RID_RESERVED_4,		/* 1 0 0 0 1 	49.9K		Reserved Accessory #4 */
RID_RESERVED_5,		/* 1 0 0 1 0 	64.9K		Reserved Accessory #5 */
RID_AUD_DEV_TY_2,	/* 1 0 0 1 1 	80.07K		Audio Device Type 2 */
RID_PHONE_PWD_DEV,	/* 1 0 1 0 0 	102K		Phone Powered Device */
RID_TTY_CONVERTER,	/* 1 0 1 0 1 	121K		TTY Converter */
RID_UART_CABLE,		/* 1 0 1 1 0 	150K		UART Cable */
RID_CEA936A_TY_1,	/* 1 0 1 1 1 	200K		CEA936A Type-1 Charger(1) */
RID_FM_BOOT_OFF_USB,	/* 1 1 0 0 0 	255K		Factory Mode Boot OFF-USB */
RID_FM_BOOT_ON_USB,	/* 1 1 0 0 1 	301K		Factory Mode Boot ON-USB */
RID_AUD_VDO_CABLE,	/* 1 1 0 1 0 	365K		Audio/Video Cable */
RID_CEA936A_TY_2,	/* 1 1 0 1 1 	442K		CEA936A Type-2 Charger(1) */
RID_FM_BOOT_OFF_UART,	/* 1 1 1 0 0 	523K		Factory Mode Boot OFF-UART */
RID_FM_BOOT_ON_UART,	/* 1 1 1 0 1 	619K		Factory Mode Boot ON-UART */
RID_AUD_DEV_TY_1_REMOTE,	/* 1 1 1 1 0 	1000.07K	Audio Device Type 1 with Remote(1) */
RID_AUD_DEV_TY_1_SEND = RID_AUD_DEV_TY_1_REMOTE ,		/* 1 1 1 1 0 	1002K		Audio Device Type 1 / Only Send-End(2) */
RID_USB_MODE,		/* 1 1 1 1 1 	Open		USB Mode, Dedicated Charger or Accessory Detach */
 
Last edited:

szczeslaw

Member
Oct 24, 2006
48
32
0
Great stuff. Thanks man.
I wonder, what is really implemented in I9000.
For example, would it be possible, to make a remote controller for music (something like HTC RC-E100 - i've had it for my Raphael and Hero, and it was great).
Well, when i find some time, i'll try to experiment a bit with that.
 

szczeslaw

Member
Oct 24, 2006
48
32
0
Good job.

Makes you wonder why Samsung still hasn't released that damn dock yet.
They did, but only for America for now (at least it's listed in accessories on Samsung's US website).

Both a 1k and a 330R resistor triggered Home Dock mode for me, I see they're not on the list either.
Well, 1K didn't work for me. I'll have to find 330R (it won't be easy though, cause i have a lot of mess in tools and electronic parts, after moving to another apartement ;) ).
 

TheBeano

Senior Member
Jul 18, 2010
355
216
0
Well, 1K didn't work for me. I'll have to find 330R (it won't be easy though, cause i have a lot of mess in tools and electronic parts, after moving to another apartement ;) ).
Check in the dmesg log for something like this:

Code:
<4>[15461.339356] [FSA9480] FSA9480_ReadIntRegister
<4>[15461.389352] [otg_clock_enable] clk_enable(otg_clock) OK.
<4>[15461.402600] [FSA9480] FSA9480_ProcessDevice (dev1 : 0x0, dev2 : 0x40)
<4>[15461.402707] AudioVideo
<4>[15461.402769] FSA9480_enable_spk
<6>[15461.402842] set_dock_state : 0X1
<4>[15461.423626] FSA9480_Enable_SPK --- enable
In fsa9480_i2c.c it is going through the branch where the home dock is plugged in, but the device detected is FSA9480_DEV_TY2_AV, which should be 80K, not 1K? So, more testing needed I think. :)

Also I have Alarm Clock PlusV2 installed which is the app that was triggered by this action. I did try installing the Samsung Desk Home app but it doesn't work on Froyo.
 
Last edited:

szczeslaw

Member
Oct 24, 2006
48
32
0
It is 301K, not 330ohms(=330R) +1K. ...for the download mode I presume you are talking about?
Well, i know a little bit about electronics (even made some devices, like power amps, devices based on microcontrollers etc.), so i know what 330R and 301K means ;)
I already got download mode working.
And right now i got home dock working to, with 1K resistor. I just didn't know, that one needs an additional app for it to work (i thought it's a system app).
 

tonymy01

Senior Member
Aug 15, 2010
281
38
0
Sydney
Yeah, sorry for the mix up,i am subscribed to both of the threads related to this recent discovery, and mixed them up. I am certainly interested in triggering particular modes, eg entering car to put phone bluetooth on and screen on dim always, and perhaps a basic home page for gps nav etc, and having an alarm clock mode that maybe turns off data etc. the sky is really the limit here, I can't believe samsumg isn't taking advantage of these features!
 

bitbang3r

Senior Member
Mar 3, 2010
365
63
48
Broward County, FL
Question: has anybody ever actually SEEN a chip inside the I9000 labeled "FSA9480", or is it possible that the "FSA9480" is actually just IP licensed by Samsung and incorporated directly into one of their ASICs?

I ask, because I have an Epic4G. I've scrutinized the various publicized teardown photos of its board, and I have yet to find anything that looks like it might be this chip (which would almost certainly be either MLF or microBGA, 3mm x 4mm or larger, and located somewhere between the main processor and the USB port).

By the same token, does a readily-available (though not necessarily "public", if you know what I mean) datasheet for the Hummingbird and its support chips exist somewhere that documents things like how many UARTs it has, which pins they're connected to, how they're configured (baudrate, parity, mode, stopbits, input & out put registers, interrupts, etc)? As far as I can tell, Android itself has no concept of a UART, and everything in the (official Samsung) kernel that's UART-related was omitted, so there's no documentation in there.

I'm personally psyched about the existence of a UART on this phone, because it opens the door for external peripherals that are a half step above "homebrew" -- things like game controllers, folding keyboards, etc. Stuff you COULD sort of implement via bluetooth (if we ever get a kernel that knows how to do HID), but would literally cost half as much and get twice the battery life if you could skip the bluetooth and just connect via a pair of wires instead.
 

TheBeano

Senior Member
Jul 18, 2010
355
216
0
I ask, because I have an Epic4G. I've scrutinized the various publicized teardown photos of its board, and I have yet to find anything that looks like it might be this chip (which would almost certainly be either MLF or microBGA, 3mm x 4mm or larger, and located somewhere between the main processor and the USB port).
It's a 3x4mm UMLP, I haven't seen it described online as anything other than a discrete chip so it probably is on the board somewhere.

By the same token, does a readily-available (though not necessarily "public", if you know what I mean) datasheet for the Hummingbird and its support chips exist somewhere that documents things like how many UARTs it has, which pins they're connected to, how they're configured (baudrate, parity, mode, stopbits, input & out put registers, interrupts, etc)?
Yes, google S5PC110_EVT1_UM10 .

As far as I can tell, Android itself has no concept of a UART, and everything in the (official Samsung) kernel that's UART-related was omitted, so there's no documentation in there.
There is some UART code e.g. arch/arm/plat-s5pc1xx/dev-uart.c but it may be just for Bluetooth. There are a lot of /dev/ttySn ports, not sure what they do yet.

I'm personally psyched about the existence of a UART on this phone, because it opens the door for external peripherals that are a half step above "homebrew" -- things like game controllers, folding keyboards, etc. Stuff you COULD sort of implement via bluetooth (if we ever get a kernel that knows how to do HID), but would literally cost half as much and get twice the battery life if you could skip the bluetooth and just connect via a pair of wires instead.
The Froyo kernel does HID via Bluetooth OK, except for the Wii controller which is a not-very-conforming Bluetooth device. If the Galaxy supports USB OTG, and there is at least some detection and setup code for that, it would probably be easier to use that for wired peripherals.
 

Richthofen

Senior Member
Jul 13, 2010
387
78
0
In the land of the blind
The FSA9480 on Aries platform phones does not have any "clear text" etched on it.
It is located under the RF shield (same side with the baseband chip).

The chip is so tiny that it is necessary to have a scope to see the text printed on it. I found no hits with the code printed on the chip (cannot remember what was it).

The component location on Aries platform phones is U301 (schematics).
 

TheBeano

Senior Member
Jul 18, 2010
355
216
0
Thanks! So CP_D+/- are USB from the Call Processor, and AP_D+/- are USB from the Application Processor, and the IF_TXD/RXD are switched to UARTs on either the call processor or the app processor by another chip, is that correct? I'm looking at the GT-S8500 service manual which uses the same signal names.

Do you have the big block diagram for the I9000 please, that would be really useful? I would especially like to know where the BOOT_MODE and JIG signals go, and which UART on the CPU the IF_TXD/RXD gets switched to, and what does the switching. Also where VPS_L and VPS_R are coming from. Ta.
 
Last edited: