23

this is a bit of a long shot but I'm hoping someone has access to the full data sheet for one of the chips listed in the title, and can tell me what combination of VBUS_IN and resistors on ID_CON will make it trigger the BOOT pin on the chip. Unfortunately Fairchild will not release the full data sheet for these chips (I have asked), and only an abbreviated version (PDF link) is available on the web.

Long story: the FSA9480 chip is used on some Samsung phones to detect various accessories using sensing resistors on the ID pin of the USB port. We've already made a lot of progress through info from the phone's Android kernel source. Now we're trying to force the phone's CPU into a boot recovery mode that will make it load an external bootloader from the serial port, and it looks like the BOOT pin on the FSA9480 might do this, but we can't figure out how to trigger it.

So far I've tried all the resistors on the known list without power connected to the USB port, and all of the resistor values that produced serial output again with power on the USB port.

Update: We're working on the theory that this schematic from the service manual shows a signal going from the FSA9480 BOOT pin to a signal named BOOT_MODE, which in any sane world would go the the application processor chip's OM5 pin. But we don't have the full schematic to prove it, and we don't have the internal details of the FSA9480 to show how that pin gets triggered. You would think it would be the resistors with BOOT_ON in their names (like RID_FM_BOOT_ON_UART), but apparently not. Or maybe it is, but the BOOT_MODE signal doesn't go to the right place. Either way the FSAx80 data sheet would confirm it.

I've reverse-engineered the startup and bootloader download code in the application processor's (Samsung S5PC110) internal ROM, and worked out that if we succeed we should see the first byte of the bootloader download protocol on the serial port. Instead we are getting the output of the primary bootloader which is being loaded from NAND, which indicates a normal boot.

TheBeano
  • 231
  • 2
  • 4
  • 1
    Post the links with spaces in them and we'll fix it for you – endolith Apr 14 '11 at 14:39
  • 1
    Two questions: How will you know you've succeeded? And also, from the datasheet it looks like the BOOT pin is connected to the baseband processor. My understanding is that this chip handles the cellular radio - not the higher functions - and that playing with it is a serious no-no as far as the FCC is concerned. What is your understanding of the connection of the BOOT pin? – AngryEE Apr 14 '11 at 16:08
  • 2
    Good updates, but in the future mark them so we know there was an update. Question the third: are you willing to crack open one of these phones and check traces to see if the signal goes to the right place? Also, question the fourth: what is the application processor? I'd like to find a datasheet. – AngryEE Apr 14 '11 at 20:41
  • Thanks for fixing the link endolith. AngryEE, thanks for your interest, I added more details to the question (last 2 paragraphs). There's a schematic fragment in the phone's service manual that shows the baseband processor and it doesn't have the BOOT_MODE signal going to it, so I'm hoping that it goes to the application processor. – TheBeano Apr 14 '11 at 20:41
  • AngryEE, yes I was on the verge of doing that last night, but looking at the board layout in the service manual it looks like you would have to unsolder the application processor to get at the processor pin, which is beyond my skills and tools. – TheBeano Apr 14 '11 at 20:46
  • @AngryEE http://www.google.com/search?q=S5PC110_EVT1_UM10 – TheBeano Apr 14 '11 at 20:49
  • 2
    Have you tried booting the phone, watching dmesg and changing the resistor values? I would try to setup a continually variable resister over the ranged needed and slowly change its value. I would expect the driver to dump mode information into dmesg. – Mark Apr 14 '11 at 23:31
  • But the bootloader download prompt most likely only shows up for a brief period while the phone is booting - then it goes away and tries normal operation. I think that they'll have to change the resistor values, then start up the phone, check, try again, etc. – AngryEE Apr 15 '11 at 12:20
  • 1
    @Mark thanks, unfortunately it only seems to register resistance changes if you unplug then reconnect the plug. I have tried the slow and painful way of setting a resistor to each value in the list. – TheBeano Apr 15 '11 at 12:30
  • 1
    @thebeano - From looking at the datasheet it seems that the chip can only have so many ways of determining that whether the cable has been unplugged. five lines isn't a whole lot to solder up relays for, and if we can identify a set of resistors that can produce any valid value then it might be possible to rig up an automated tester. – AngryEE Apr 15 '11 at 16:25
  • @AngryEE that's a good idea, I'm not sure I want it that badly though. But it may come to that. :-) – TheBeano Apr 16 '11 at 09:02
  • Let me ask the dumb question: the block diagram has a "float detect". Not sure how they'd do this without an internal pullup (ie assuming that open == 'floating'). Are you sure that you need a resistor between this pin and VBUS_IN, as opposed to a resistor between this pin and GND? I.e, a pull down instead of a pullup? What is the voltage on ID_CON? If non-zero, is it stable with a weak (100K+) pulldown? If so, then you might want to try various resistor values between it and GND. – John Lopez Apr 23 '11 at 17:11
  • Thanks, sorry I didn't phrase that very clearly, it's the combination of voltage or no voltage on VBUS_IN, and resistors between ID_CON and ground that I'm looking at. Although looking at the block diagram again perhaps I should also be looking at charger detection since that's another input to switch control. Anyway I'm building an automated tester now with a motorized potentiometer (homemade, from Lego!) to try different combinations. – TheBeano Apr 29 '11 at 08:15
  • Have you tried booting the phone with Power + Vol Down while having UART cable plugged in? – Tony Stewart EE75 Apr 09 '12 at 10:11

2 Answers2

2

check out http://forum.xda-developers.com/showthread.php?t=1206216 I have done this to my captivate and it works. I do not know about any other Galaxy S phones. You should check xda-dev for your phone as someone may have figured out how to do it on it.

DeathBySnuSnu
  • 141
  • 1
  • 6
  • A link on its own is not considered an answer, please post the information here and add a link as a reference. – Kortuk Apr 13 '12 at 01:57
0

Good morning, here you will find documentation

FSA9280

user19908
  • 1
  • 2
    That's only a 5 page 'limited datasheet', although it does contain an e-mail address to request the full datasheet that may help the OP if they haven't already tried to do that. Although if it's not posted online it may well require an NDA and/or only be available to OEMs. – PeterJ Mar 08 '13 at 10:14