[Hardware Hacking General] AdamOutler:
I should have elaborated a bit.... The boot loop would be good for putting the phone into a continuous boot loop where OM can be tested.

I'm looking at this bricked phone right now...

I can get it to start up by plugging it into a 619Kohm resistor, then holding the volume up button. As soon as it comes up, I believe it tries to blast some information at a high rate of speed. This is normal for our phones... See 50-51 seconds and look between my fingers to see what I'm talking about....

[youtube]GGrFAU1sig8[/youtube]

I analyzed this data using a packet sniffer called Wireshark on my desktop.

Here is a few snippets from the packet exchange.

16846	9897.011850	0.0	host	USB	GET DESCRIPTOR Response DEVICE[Malformed Packet]Frame 16846 (24 bytes on wire, 24 bytes captured)
USB URB
0000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
0010 00 02 00 00 00 00 00 00 ........

It's not USB compliant data. This is a good thing. However, what is it?

lets look at what we have available for communications from the processor.

1.3.6 CONNECTIVITY
The key features of connectivity include:
•
PCM Audio Interface
− Master mode only
−
•
16-bit mono audio interface
− Supports three port PCM interface
AC97 Audio Interface
− − 16-bit stereo (2-channel) audio
− Variable sampling rate AC97 Codec interface (48 kHz and below)
−
•
Independent channels for stereo PCM In, stereo PCM Out, and mono MIC In
Supports AC97 Full Specification
SPDIF Interface (TX only)
− − Non-Linear PCM formats such as AC3, MPEG1, and MPEG2 support
−
•
Linear PCM up to 24-bit per sample support
2x24-bit buffers that are alternately filled with data
I2S Bus Interface
− Three I2S-bus for audio-codec interface with DMA-based operation
− Serial, 8/ 16/ 24-bit per channel data transfers
− Supports I2S, MSB-justified, and LSB-justified data format
− Supports PCM 5.1 channel
− Various bit clock frequency and codec clock frequency support
o
o
−
•
16, 24, 32, 48 fs of bit clock frequency
256, 384, 512, 768 fs of codec clock
Supports one port for 5.1 channel I2S (in Audio Subsystem) and two ports for 2 channel I2S
Modem Interface
− −
•
Asynchronous direct/ indirect 16-bit SRAM-style interface
On-chip 16 KB dual-ported SRAM buffer for direct interface
I2C Bus Interface
− − Serial, 8-bit oriented and bi-directional data transfers can be made at up to 100 Kbit/s in the standard
mode
−
•
Three Multi-Master IIC-Bus
Up to 400 Kbit/s in the fast mode
ATA Controller
−
Compatible with the ATA/ATAPI-6 standard
1-10
S5PC110_UM
•
1 OVERVIEW OF S5PC110
UART
− − Supports 5-bit, 6-bit, 7-bit, or 8-bit serial data transmit/ receive
− Rx/Tx independent 256 byte FIFO for UART0, 64 byte FIFO for UART1 and 16 byte FIFO for UART2/3
− Programmable baud rate
− Supports IrDA 1.0 SIR (115.2 Kbps) mode
− Loop back mode for testing
−
•
Four UART with DMA-based or interrupt-based operation
Non-integer clock divides in Baud clock generation
USB 2.0 OTG
− Supports high-speed up to 480 Mbps
−
•
Complies with the OTG Revision 1.0a supplement to the USB 2.0
− On-chip USB transceiver
USB Host 2.0
− − Supports high-speed up to 480 Mbps
−
•
Complies with the USB Host 2.0
On-chip USB transceiver
HS-MMC/ SDIO Interface
− − SD Memory Card Protocol version 2.0 compatible
− DMA based or Interrupt based operation
− 128 word FIFO for Tx/Rx
−
•
Multimedia Card Protocol version 4.0 compatible (HS-MMC)
Four ports HS-MMC or four ports SDIO
SPI Interface
− Complies with three Serial Peripheral Interface Protocol version 2.11
− Rx/Tx independent 64-Word FIFO for SPI0 and 16-Word FIFO for SPI1
− DMA-based or interrupt-based operation

Ok, so It can't be PCM Audio, there's no audio at bootup, nor can it be AC97 or SPDIF, or I2S audio.

So what's that leave?

Modem Interface, I2C Bus Interface, ATA Controller, UART, USB 2.0 OTG, USB Host 2.0, HS-MMC/ SDIO Interface, SPI Interface, GPIO

So, lets narrow that down to items using two line communications. Serial ATA uses 4 data lines. Paralell ATA uses even more. SPI requires 4 lines. HS-MMC and SDIO require multiple data lines.

Ok, so we can guess that by the speed of transfer that it is not a modem interface.

So, that leaves a few options left....

UART - possible

USB 2.0 OTG or USB Host 2.0 -possible, however OTG is USB2 compatible and USB Host would not be transmitting for that long during startup.

GPIO - possible, however that would be very very broad... in manual starts on page 160 ends on page 268

I2C Bus Interface

js22, can you check the logic levels of the D+ and D- lines on startup to verify or disprove this? I don't have a scope here, it's at work and I'm on paternity leave. Here's some starting points for settings:

Information about UART

The Universal Asynchronous Receiver and Transmitter (UART) in S5PC110 provide four independent
asynchronous, and serial input/output (I/O) ports. All the ports operate in an interrupt-based or a DMA-based
mode. The UART generates an interrupt or a DMA request to transfer data to and from the CPU and the UART.
The UART supports bit rates up to 3Mbps. Each UART channel contains two FIFOs to receive and transmit data:
256 bytes in ch0, 64 bytes in ch1 and 16 bytes in ch2 and ch3.

Information about I2c Bus

Four channel Multi-Master, Slave I2C BUS interfaces
(one channel for general purpose, one channel for PMIC, two channel for HDMI dedicated)
• 7-bit addressing mode
• Serial, 8-bit oriented, and bidirectional data transfer
• Supports up to 100kbit/s in the Standard mode
• Supports up to 400kbit/s in the Fast mode.
• Supports master transmit, master receive, slave transmit and slave receive operation
• Supports interrupt or polling events.

Information about USB host

4.1 OVERVIEW OF USB 2.0 HOST CONTROLLER
S5PC110 supports a single port USB host interface. The key features of this interface include:
• Complies with Enhanced HCI (EHCI) Rev 1.0a and Open HCI (OHCI) Rev1.0 specifications (Both EHCI and
OHCI compatible).
• Complies with USB Rev 2.0 specification.
• Complies with USB Rev 1.1 specification.
• Supports high-speed (480 Mbps transfer) peripherals.
• Supports power management features, such as:
− Full Suspend/ Resume functionality, including Remote Wakeup
− Over-current protection on ports hooks for master clock suspension

Information about USB OTG

5.2 KEY FEATURES OF USB2.0 HS OTG
The USB2.0 HS OTG features include:
• Complies with the On-The-Go Supplement to the USB 2.0 Specification (Revision 1.0a)
• Operates in High-Speed (480 Mbps), Full-Speed (12 Mbps) and Low-Speed (1.5 Mbps, Host only) modes
• Supports UTMI+ Level 3 interface (Revision 1.0)
• Supports Session Request Protocol (SRP) and Host Negotiation Protocol (HNP)
• Supports only 32-bit data on the AHB
• 1 Control Endpoint 0 for control transfer
• 15 Device Mode programmable Endpoints
− Programmable endpoint type: Bulk, Isochronous, or Interrupt
− Programmable IN/ OUT direction
• Supports 16 Host channels
• Supports packet-based, dynamic FIFO memory allocation of 7936depths (35-bit width)

As a side note, you can see some cool stuff using *#9090# and turning on logging .... i think it may be DDMS related... It needs some formatting, I think they use charactors 0xA or 0xD for linefeed.... This is unrelated to what we need as it is android level logging.

[MED]..\..\mits\oem\oemapi\oemnet.c 620 PLMN 2 MCC 603 MNC 3 3digit 0#�OO�6Fت� [HIGH]..\..\mits\oem\oemapi\oemnet.c 632 Plmn is mismatched! 0�ii�6Fت� [HIGH]..\..\mits\oem\oemapi\oemnetcb.c 783 [Net]A5/2 Algorithm is already Ina
� �
a�=`Y_�1V1�6HD���[DISP] oem_set_batt_level : 4180V�Z�Z�6HD���[DISP] BATT : measured_value_mv=4180, AvgBattVal_mv=3956, battery_level=5���o�6HD��hxAP IPC Main Cmd = f, Sub Cmd = 5, Cmd Type = 3H�J�J�6H3�-hx��8
aY�=`�=`qU�#-i+@�����pUΈUt+Q��-t+j��������N/�/�6I9���N�����8

js22, if you could, please scope the D+ and D- when you plug your phone into a uart.