[Hardware Hacking General] E:V:A:
Time for SGS2 Hack-Pack Update?

Some updates to the GT-I9100 Hack-Pack...

NOTE: The internal wiring of the (Sprint Epic Touch 4G) SPH-D710 is completely different from this!

I have painstakingly tried to trace down and document all chips related to the micro-usb connector on the i9100. Since that phone may be incorrectly wired as suggested, but not proved, by AdamOutler, we need to understand exactly how all the various multiplexers are affecting the USB connections. In addition, since all useful and "fun to develop for", hardware is kept secret by the manufacturing bastards, I have tried my best, with what little moldy breadcrumbs we have for documentation, to recreate and understand how that darn thing is wired.

Here are a few of my most recent findings and results.

MHL/MUX-1: FSA3200UMX (Service Manual: "U709", page 90 [Section: 8-64])

[SIZE=2]Type: 2-port HS-USB2 Switch with MHL [/SIZE]
[SIZE=2]Package: UMLP-16[/SIZE]
[SIZE=2]Label: [/SIZE]
[SIZE=2]Link: [/SIZE]
[SIZE=2]Data (brief): [/SIZE]
[SIZE=2]Data (full): http://www.fairchildsemi.com/ds/FS/FSA3200.pdf[/SIZE]
[SIZE=2]Picture: http://images.anandtech.com/galleries/1362/SGS2-4198.jpg[/SIZE]

[SIZE=2]Description: [/SIZE]

[SIZE=2]This chip is used to connect the phone with an MHL (Mobile High definition Link)[/SIZE]
[SIZE=2]cable, for full HD audio/video. [/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]pin signal i/o uUSB? svc_manual_name chip/connector?[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]1 GND[/SIZE]
[SIZE=2]2 D+ io *? USB_DP_SUB_CON (HDC703)[/SIZE]
[SIZE=2]3 D- io *? USB_DM_SUB_CON (HDC703)[/SIZE]
[SIZE=2]4 PSO % GND[/SIZE]
[SIZE=2]5 SEL1 i = SEL2 = MHL_SEL[/SIZE]
[SIZE=2]6 USB- o PMIC_DM U501:MAX8997:?[/SIZE]
[SIZE=2]7 USB+ i PMIC_DP U501:MAX8997:?[/SIZE]
[SIZE=2]8 GND[/SIZE]
[SIZE=2]9 SEL2 i = SEL1 = MHL_SEL[/SIZE]
[SIZE=2]10 MDV- io MHL_DM[/SIZE]
[SIZE=2]11 MDV+ io MHL_DP[/SIZE]
[SIZE=2]12 ID_USB i PMIC_ID U501:MAX8997:?[/SIZE]
[SIZE=2]13 ID_MDV i MHL_ID[/SIZE]
[SIZE=2]14 ID_COM i *? USB_ID_SUB_CON (HDC703)[/SIZE]
[SIZE=2]15 VBUS + ? USB_VBUS_AP_4.9V[/SIZE]
[SIZE=2]16 VCC[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]Note: Here the signals for MDV are referred to as MHDI in service manual.[/SIZE]

[SIZE=2]Since SEL1=SEL2=:SEL are hardwired, we only have:[/SIZE]
[SIZE=2]SEL=00: D+/- = USB+/- and ID_COM = ID_USB[/SIZE]
[SIZE=2]SEL=11: D+/- = MDV+/- and ID_COM = ID_MDV[/SIZE]

OTG MAX8627 (Service Manual: "U503", pg.92)

[SIZE=2]Type: OTG power-booster[/SIZE]
[SIZE=2]Package: 14-pin[/SIZE]
[SIZE=2]Label: [/SIZE]
[SIZE=2]Link: [/SIZE]
[SIZE=2]Data (brief): [/SIZE]
[SIZE=2]Data (full): http://datasheets.maxim-ic.com/en/ds/MAX8627.pdf[/SIZE]
[SIZE=2]Picture: [/SIZE]
[SIZE=2]Description: [/SIZE]

[SIZE=2]This chip is responsible for providing enough power (up 1A) to OTG devices,[/SIZE]
[SIZE=2]using the phone battery, once it receives a high on the "ON" pin-3.[/SIZE]

[SIZE=2]"The MAX8627 step-up converter is a high-efficiency, low-quiescent current, [/SIZE]
[SIZE=2]synchronous boost converter with True Shutdown™ and inrush current limiting. [/SIZE]
[SIZE=2]The MAX8627 generates any boosted output voltage from 3V to 5V from either a [/SIZE]
[SIZE=2]2-cell NiMH/NiCd or a single-cell Li+/Li polymer battery.[/SIZE]

[SIZE=2]Quiescent current is only 20µA (typ), and at light loads the converter pulses [/SIZE]
[SIZE=2]only as needed for best efficiency. At higher loads, PWM mode maintains fixed [/SIZE]
[SIZE=2]1MHz operation for lowest noise and ripple.[/SIZE]

[SIZE=2]The MAX8627 includes an internal soft-start to limit inrush current to a [/SIZE]
[SIZE=2]maximum of 500mA. Additional features include True Shutdown, internal [/SIZE]
[SIZE=2]compensation, and adjustable current limit. The MAX8627 is available in a tiny [/SIZE]
[SIZE=2]3mm x 3mm TDFN package and is ideal for use in handheld devices such as DSCs, [/SIZE]
[SIZE=2]PDAs, and smartphones."[/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]pin signal i/o chip/connector?[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]1 GND PGND[/SIZE]
[SIZE=2]2 FB % [/SIZE]
[SIZE=2]3 ON USB_OTG_EN [/SIZE]
[SIZE=2]4 BATT V_BAT[/SIZE]
[SIZE=2]5 BATT V_BAT [/SIZE]
[SIZE=2]6 POUT V_BUS_5V [/SIZE]
[SIZE=2]7 POUT V_BUS_5V [/SIZE]

[SIZE=2]8 LX V_BAT[/SIZE]
[SIZE=2]9 LX V_BAT[/SIZE]
[SIZE=2]10 PG PGND[/SIZE]
[SIZE=2]11 PG PGND[/SIZE]
[SIZE=2]12 AGND GND[/SIZE]
[SIZE=2]13 ILIM % [/SIZE]
[SIZE=2]14 OUTS V_BUS_5V[/SIZE]

Charger: ? (Service Manual: "U504", Service Manual, pg.37)

[SIZE=2]Type: Charging chip[/SIZE]
[SIZE=2]Package: 10 pin[/SIZE]
[SIZE=2]Label: "ADDO T**" (18?)[/SIZE]

[SIZE=2]Some kind of charging or boost chip.... Perhaps MAX 17042 ??[/SIZE]
[SIZE=2]https://github.com/coolbho3k/android-omap-tuna/blob/android-omap-tuna-3.0-mr0/drivers/power/max17042_battery.c[/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]pin name i/o path/connection[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]1 VIN [/SIZE]
[SIZE=2]2 ISET o CHG_CUR_M[/SIZE]
[SIZE=2]3 GND [/SIZE]
[SIZE=2]4 LDO V_BUS_LDO_5V[/SIZE]
[SIZE=2]5 IEOC GND[/SIZE]
[SIZE=2]6 EN|SET i CHG_EN ("Q500")[/SIZE]

[SIZE=2]7 GND [/SIZE]
[SIZE=2]8 CHGSB o CHG_ING_IN[/SIZE]
[SIZE=2]9 PGB o TA_nCONNECTED[/SIZE]
[SIZE=2]10 BATT V_BAT[/SIZE]
[SIZE=2]11 GND [/SIZE]
[SIZE=2]12 ??? [/SIZE]

And here is the Silicon Image MHL Transmitter chip, so now you can soon build your own MHL, mUSB-to-HDMI cable! (Just hook it up to a SiI9292.)

MHL: SiI9244B0 (Service Manual: "U708", Service Manual, pg.90,99)

[SIZE=2]Type: MHL transmitter for HD Audio/Video[/SIZE]
[SIZE=2]Package: 49-ball VFBGA (3.5 mm x 3.5 mm)[/SIZE]
[SIZE=2]Label: ~"9244B0"[/SIZE]
[SIZE=2]Link: http://www.siliconimage.com/docs/SiI9244%20PB_02-23-2011%20FINAL.3.pdf[/SIZE]
[SIZE=2]Data (brief): http://www.semiconductorstore.com/pdf/newsite/SiliconImage/SiI9244_DB.pdf[/SIZE]
[SIZE=2]Data (full): [/SIZE]

[SIZE=2]Derscription: http://www.siliconimage.com/news/releasedetails.aspx?id=617[/SIZE]

[SIZE=2]This is the MHL Transmitter, that is used to transmit HD (1080p) Audio/Video[/SIZE]
[SIZE=2]through the mUSB port. [/SIZE]

[SIZE=2]"The SiI9244 is an MHL transmitter for HD video and audio designed for [/SIZE]
[SIZE=2]power-sensitive consumer electronics devices such as mobile phones, digital [/SIZE]
[SIZE=2]cameras, portable media players and HD camcorders. Eliminating the need for an [/SIZE]
[SIZE=2]extra connector, the SiI9244 enables a cost-effective, low-pin count [/SIZE]
[SIZE=2]connectivity solution for the delivery of HD content."[/SIZE]

[SIZE=2]Pictures:[/SIZE]

[SIZE=2]SGS2 details:[/SIZE]
[SIZE=2]http://www.anandtech.com/print/4686[/SIZE]

[SIZE=2]For other chips on the SGS2 (Sprint Epic Touch 4G) SPH-D710:[/SIZE]
[SIZE=2]http://www.techrepublic.com/blog/itdojo/galaxy-s-ii-sprint-epic-4g-touch-teardown-samsung-exynos-processor-and-no-nfc/2945[/SIZE]
[SIZE=2]Silicon Image 9244 MHL transmitter:[/SIZE]
[SIZE=2]http://www.techrepublic.com/photos/cracking-open-the-samsung-galaxy-s-ii-sprint-epic-4g-touch/6305124?seq=54[/SIZE]

[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]Ball Name io Function Connection[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]A1 RSVDL [/SIZE]
[SIZE=2]A2 VDDQ GND [/SIZE]
[SIZE=2]A3 MHL_D io MHL:Data ?? U709:FSA3200:10 MHL_DM[/SIZE]
[SIZE=2]A4 MHL_DB io MHL:Data ?? U709:FSA3200:11 MHL_DP [/SIZE]
[SIZE=2]A5 - [/SIZE]
[SIZE=2]A6 - [/SIZE]
[SIZE=2]A7 CBUS_ID i MHL:BUS_ID(CEC||chip)? ?? U709:FSA3200:13 MHL_ID [/SIZE]

[SIZE=2]B1 RSVDL [/SIZE]
[SIZE=2]B2 RSVDL [/SIZE]
[SIZE=2]B3 RSVDL [/SIZE]
[SIZE=2]B4 GND [/SIZE]
[SIZE=2]B5 AVCC33 Vcc 3.3V[/SIZE]
[SIZE=2]B6 USB_ID io USB_ID ?? U709:FSA3200:9 MHL_SEL [/SIZE]
[SIZE=2]B7 RSVDL [/SIZE]

[SIZE=2]C1 CSCL i chip:SCL (CEC) [/SIZE]
[SIZE=2]C2 RSVDL [/SIZE]
[SIZE=2]C3 WAKE_UP i MHL:WAKE-UP [/SIZE]
[SIZE=2]C4 AVCC12 Vcc 1.2V[/SIZE]
[SIZE=2]C5 GND[/SIZE]
[SIZE=2]C6 V_SENSE i MHL:VSENSE [/SIZE]
[SIZE=2]C7 INT o chip:INT [/SIZE]

[SIZE=2]D1 CSDA io chip:SDA (CEC) [/SIZE]
[SIZE=2]D2 RSVDL [/SIZE]
[SIZE=2]D3 GND[/SIZE]
[SIZE=2]D4 IOVCC18 Vcc 1.8V[/SIZE]
[SIZE=2]D5 CVCC12 Vcc 1.2V[/SIZE]
[SIZE=2]D6 CI2CA i chip:I2C (audio) [/SIZE]
[SIZE=2]D7 RESET_N i chip:RESET_N [/SIZE]

[SIZE=2]E1 DSDA io HDMI:SDA (DDC) [/SIZE]
[SIZE=2]E2 GND[/SIZE]
[SIZE=2]E3 IO_VCC18 Vcc 1.8V[/SIZE]
[SIZE=2]E4 CVCC12 Vcc 1.2V[/SIZE]
[SIZE=2]E5 AVCC33 Vcc 3.3V[/SIZE]
[SIZE=2]E6 AVCC12 Vcc 1.2V[/SIZE]
[SIZE=2]E7 GND[/SIZE]

[SIZE=2]F1 RX2_P i HDMI#2 + HD_TX2+[/SIZE]
[SIZE=2]F2 GND[/SIZE]
[SIZE=2]F3 RPWR i HDMI:POWER [/SIZE]
[SIZE=2]F4 DSCL i HDMI:SCL (DDC) [/SIZE]
[SIZE=2]F5 AVCC12 Vcc 1.2V[/SIZE]
[SIZE=2]F6 GND[/SIZE]
[SIZE=2]F7 HPD o HDMI:PD (?power down?) [/SIZE]

[SIZE=2]G1 RX2_N i HDMI#2 - HD_TX2-[/SIZE]
[SIZE=2]G2 RX1_P i HDMI#1 + HD_TX1+[/SIZE]
[SIZE=2]G3 RX1_N i HDMI#1 - HD_TX1-[/SIZE]
[SIZE=2]G4 RX0_P i HDMI#0 + HD_TX0+[/SIZE]
[SIZE=2]G5 RX0_N i HDMI#0 - HD_TX0-[/SIZE]
[SIZE=2]G6 RXC_P i HDMI:Clock? + HD_TXC+ [/SIZE]
[SIZE=2]G7 RXC_N i HDMI:Clock? - HD_TXC-[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]RXn = HDMI Data Channel n (+/-)[/SIZE]
[SIZE=2]RSVDL = Reserved Low (tie to ground)[/SIZE]
[SIZE=2]RSVDH = Reserved Hi[/SIZE]

[SIZE=2]SCL = I2C Serial Clock [/SIZE]
[SIZE=2]SDA = I2C Serial Data Line [/SIZE]
[SIZE=2]CEC = Consumer Electronics Control (Anynet/AV.link) http://en.wikipedia.org/wiki/HDMI#CEC[/SIZE]
[SIZE=2]DCC = Display Control Channel http://en.wikipedia.org/wiki/Display_Control_Channel[/SIZE]
[SIZE=2]DDC = Display Data Channel http://en.wikipedia.org/wiki/Display_Data_Channel[/SIZE]

[SIZE=2]NOTE-1: A name prefixed with "A*" is for audio, while "C*" is for chip/control.[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]

PMIC: MAX8997 (Service Manual: "U501", pg.95)

[SIZE=2]Type: Power Management IC[/SIZE]
[SIZE=2]Package: 169-bump WLP[/SIZE]
[SIZE=2]Label: [/SIZE]
[SIZE=2]Link: http://para.maxim-ic.com/en/results.mvp?fam=pmic[/SIZE]
[SIZE=2]Data (brief): [/SIZE]
[SIZE=2]Data (full): [/SIZE]
[SIZE=2]Closest Match: MAX8958[/SIZE]

[SIZE=2]Derscription: [/SIZE]

[SIZE=2]"The PMIC solution MAX8997 integrates seven highly efficient step-down [/SIZE]
[SIZE=2]converters, 21 low-dropout linear regulators (LDOs), battery charger, micro [/SIZE]
[SIZE=2]USB interface, real-time clock (RTC) with alarms, tactile-feedback motor [/SIZE]
[SIZE=2]driver, camera flash LED driver, 12 general-purpose I/Os (GPIOs), and I2C [/SIZE]
[SIZE=2]interface for programming. It also includes Maxim’s proprietary ModelGauge™ [/SIZE]
[SIZE=2]power-management technology (MAX17040–MAX17043)."[/SIZE]

[SIZE=2]The signals we are interested in are:[/SIZE]

[SIZE=2]Modem UPC300:[/SIZE]
[SIZE=2]T2 USIF1_RXD_MRST i AP_FLM_TXD --> PMIC:K3(18T2) -[?]-> AP_FLM_TXD_2.8V (XUTXD_3:A27) --> UART3: XXnn (check!)[/SIZE]
[SIZE=2]T3 USIF1_TXD_MTSR o AP_FLM_RXD --> PMIC:J4(18R1) -[?]-> AP_FLM_RXD_2.8V (XURXD_3:H27) --> UART3: XXnn (check!)[/SIZE]

[SIZE=2]M14 MIPI_HSI_RX_FLG i CP_RXD_1.8V --> PMIC:G3(18TNC2) -[?]-> AP:CP_RXD (?:?) --> UART3?: XXnn (check!)[/SIZE]
[SIZE=2]N13 MIPI_HSI_RX_DATA o CP_TXD_1.8V --> PMIC:G5(18RNC1) -[?]-> AP:CP_TXD (?:?) --> UART3?: XXnn (check!)[/SIZE]

[SIZE=2]A few of the MAX8997 pins are:[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]Ball Name io Function svc_man_name Path/Connection[/SIZE]
[SIZE=2]-------------------------------------------------------------------------------[/SIZE]
[SIZE=2]J4 18R1 i AP_FLM_RXD (BP)[/SIZE]
[SIZE=2]K3 18T2 o AP_FLM_TXD (BP)[/SIZE]
[SIZE=2]G4 28T1 o AP_FLM_RXD_2.8V (AP)?[/SIZE]
[SIZE=2]L4 28R2 i AP_FLM_TXD_2.8V (AP)?[/SIZE]

[SIZE=2]G5 18RNC1 i CP_TXD_1.8V (BP)[/SIZE]
[SIZE=2]G3 18TNC2 o CP_RXD_1.8V (BP)[/SIZE]
[SIZE=2]H4 28TNO2 o ??CP_TXD (AP) UART3??[/SIZE]
[SIZE=2]H6 28RNO1 ? ??CP_RXD (AP) UART3??[/SIZE]

[SIZE=2]? ? A/S1 o AP_RXD (AP) UART2 mysterious, perhaps doesn't exsist[/SIZE]
[SIZE=2]? ? A/S1 i AP_TXD (AP) UART2 mysterious, perhaps doesn't exsist[/SIZE]
[SIZE=2]K4 28RCOM2 A/S1 i IF_RXD MUX[/SIZE]
[SIZE=2]H5 28TCOM1 A/S1 o IF_TXD MUX[/SIZE]

[SIZE=2]G1 DN1 io PMIC_DP U709:FSA3200:7[/SIZE]
[SIZE=2]H1 DP2 io PMIC_DM U709:FSA3200:6[/SIZE]
[SIZE=2]L1/L2? ? ? PMIC_ID U709:FSA3200:12[/SIZE]

[SIZE=2]G6 CB USB select?[/SIZE]

[SIZE=2]J1 COMN1[/SIZE]
[SIZE=2]K1 COMP2 Step-Up Compensation Node for OUT2 Step-Up Converter[/SIZE]
[SIZE=2]D5 COMP [/SIZE]

[SIZE=2]L1 UID [/SIZE]
[SIZE=2]L2 IDB [/SIZE]
[SIZE=2]L3 BOOT [/SIZE]

[SIZE=2]H3 UT1 [/SIZE]
[SIZE=2]J3 UR2 [/SIZE]

[SIZE=2]H2 SL1 [/SIZE]
[SIZE=2]J2 SR2 [/SIZE]

[SIZE=2]E5 PWRON Baseband Wakeup ?[/SIZE]
[SIZE=2]E6 JIGON[/SIZE]
[SIZE=2]E7 SCL i I2C SCL[/SIZE]
[SIZE=2]F7 SDA i I2C SDA[/SIZE]

[SIZE=2]K2 MIC_USB[/SIZE]

However, there are a few questions I have not been able to resolve. I really need help with this! They are:

Where is the other USB "switch" chip, as shown in the block diagram below?

What is U504 doing?

What are the other pins (not labelled above) on the PMIC (U501) doing?

​