[Galaxy S II Q&A, Help & Troubleshooting] E:V:A:
X-GOLD 626: Pins & Connections

In lack of understanding what is connected to BP, I decided to manually trace (almost) all baseband processor connections, from that crappy-image of the FBGA-pins and the various circuit diagrams in the SGS2 Level-3 Service Manual. That can certainly be useful, eventually. For example it confirms the following:

- Unused (?) MMC

- Problematic (?) MIPI-HSI

- 1x I2C

- 1x USB2 (eHCI)

- 1x USIF

- 1x JTAG

- 1x I2S (audio)

- 1x SIM

- Shared "RAM"

I have also included the pin-outs/connections for both the MUX (FSA9280A) and the PMIC (MAX8997). Here are the results of this work:

-------------------------------------------------------------------------------
X-GOLD 626 Pins & Signals (Service Manual "UPC300")
-------------------------------------------------------------------------------

Manually editing all pads are not necessary as the pad image already exists.
Here we only map the interface pin pads. Some of the colors shown on picture
are very hard to determine by inspection, so I have written the Hex RGB values
in addition. (There are some indication that there may be some errors in both
color coding and signal connections, so don't use this data without testing.)

- = unconnected / unknown
/ = grounded via capacitor
+ = HI
% = LO

-------------------------------------------------------------------------------
pad pad_name i_o connected description
-------------------------------------------------------------------------------

A1,A17 NC - - -
U1,U17 NC - - -
R4 NC - - -

---------------------------------------
LightBlue: --
---------------------------------------
A2 SD2_SW - +A3
A3 SD2_SW - +A2
C2 SD2_FB - +L(A2/A3) + [CP_VSD2_1.8V]
C3 VDD_VSD2 ? ?
D1 SD1_SW - +D3
D3 SD1_FB - +L(D1/E1) + [CP_VSD1]
E1 SD1_SW - +D1

---------------------------------------
TealBlue: DigRF (v3.09)
---------------------------------------
T7 DI3_TX_DAT o DI3_TX_DAT
T8 DI3_TX_DATX o DI3_TX_DATX
T9 XRESET_N o RESET_N_RF [RF-RESET!]
U7 DI3_RX_DAT i DI3_RX_DAT
U8 DI3_RX_DATX i DI3_RX_DATX
U9 SYSCLKEN o SYS_CLK_EN
U10 ALERT_N o ? [DigRFEn]

---------------------------------------
Blue: --
---------------------------------------
K10 EINT3 i GPS_CNTL
M8 EINT2 i PDA_ACTIVE
M9 EINT1 -

---------------------------------------
DarkBlue: --
---------------------------------------
H6 M1 - -
J4 M4 - HI
J5 M3 - -
J6 M2 - LO

---------------------------------------
Red: Power (+)
---------------------------------------
A4 VDD_VBAT_SD2
B11 VDD_IO18
C1 VDD_VBAT_SD1
E3 FSS
E10 VDDCORE
E12 VDDCORE_EBU
E13 VDDCORE
F3 VDD_VBAT_PMU
F15 VDD_IO18
H9 VDDCORE
J17 VDD_IO18
K8 VDD_IO18
K9 VDDCORE
K11 VDD_IO18
K14 VDDCORE
K16 VDD_MIPI
L8 VDD_MMC
N9 VPP
N11 VDD_IO18
N17 VDD_RTC
P14 VDD_USB_ANA
R8 VDDCORE
R12 VDD_PLL
R16 VDD_USBIO
T10 VDD_DIGRF
T12 VDD_SIM
T15 VDD_USB_PD
U15 VDD_IO12

---------------------------------------
MintGreen: GND (signal)
---------------------------------------
F1? VSS_SC o VSD1_GND
B1? VSS_SC2 o VSD2_GND

<lazy!>

---------------------------------------
GrassGreen: MMC
---------------------------------------
L7 MMCI1_CMD - -
M2 MMCI1_DAT_1 - -
M3 MMCI1_CLK - -
M4 MMCI1_DAT_2 - -
M5 MMCI1_DAT_0 - -
M6 MMCI1_DAT_3 - -
N5 MMCI1_CD i RTCK_CP

---------------------------------------
WhiteGreen: HSI (MIPI)
---------------------------------------
L11 MIPI_HSI_TX_FLG - -
L13 MIPI_HSI_RX_RDY - -
M13 MIPI_HSI_TX_WAKE - -
[COLOR=DarkRed]M14 MIPI_HSI_RX_FLG i CP_RXD_1.8V --> PMIC:G3(18TNC2) -[?]-> AP:CP_RXD (?:?) --> UART3?: XXnn (check!)[/COLOR]
M15 MIPI_HSI_TX_RDY - -
N12 MIPI_HSI_TX_DATA - -
[COLOR=DarkRed]N13 MIPI_HSI_RX_DATA o CP_TXD_1.8V --> PMIC:G5(18RNC1) -[?]-> AP:CP_TXD (?:?) --> UART3?: XXnn (check!)[/COLOR]
P13 MIPI_HSI_RX_WAKE - -

---------------------------------------
LightGreen: ETM11
---------------------------------------
K1 ETM11_TRACEPKT7 - -
K5 ETM11_TRACEPKT4 - -
K7 ETM11_TRACECLK - -
L1 ETM11_TRACEPKT1 - -
L2 ETM11_TRACEPKT3 - -
L4 ETM11_TRACEPKT2 - -
L5 ETM11_TRACEPKT6 - -
L9 ETM11_TRACEPKT5 - -
M1 ETM11_TRACEPKT0 - -

---------------------------------------
DarkOrange: --
---------------------------------------
B6 DSP_AUDIO_IN1 i IPC_HOST_WAKEUP
D4 ANAMON - -
K4 TM_EN - -
P7 HW_MON2 i HW_MON2
R6 HW_MON1 i HW_MON1
T5 TRIG_IN i TRIG_IN

---------------------------------------
BrightOrange: I2S
---------------------------------------
N1 I2S2_CLK0 o REC_PCM_CLK
N2 I2S2_CLK1 o PHONE_ACTIVE
P1 I2S2_RX i REC_PCM_OUT --> Audio Codec?
P2 I2S2_TX o REC_PCM_IN --> Audio Codec?
R1 I2S2_WA0 o REC_PCM_SYNC
R2 I2S2_WA1 o GPS_CLK_EN

---------------------------------------
OrangePink: USIF
---------------------------------------
T1 USIF1_SCLK i IPC_SLAVE_WAKEUP
[COLOR=DarkRed]T2 USIF1_RXD_MRST i AP_FLM_TXD --> PMIC:K3(18T2) -[?]-> AP_FLM_TXD_2.8V (XUTXD_3:A27) --> UART3: XXnn (check!)
T3 USIF1_TXD_MTSR o AP_FLM_RXD --> PMIC:J4(18R1) -[?]-> AP_FLM_RXD_2.8V (XURXD_3:H27) --> UART3: XXnn (check!)[/COLOR]
U2 USIF1_CTS_N - -
U3 USIF1_RTS_N i ACTIVE_STATE_HSIC

---------------------------------------
LightPurple: JTAG
---------------------------------------
T4 TRST_N o TRST_N_CP
T6 TCK o TCK_CP
U4 TDO o TDO_CP
U5 TDI i TDI_CP
U6 TMS o TMS_CP

---------------------------------------
Purple: USB-2
---------------------------------------
N16 USB_ID - -
P16 VBUS ? USB_VBUS_CP_4.9V
P17 USB_TEST - -
R17 USB_DMINUS i CP_D- --> uUSB switch: FSA9280A (RxD:6)
T16 USB_TUNE - [4.02K]-->GND
T17 USB_DPLUS i CP_D+ --> uUSB switch: FSA9280A (TxD:5)
U12 HSIC_USB_STRB i HSIC_STROBE1
U13 HSIC_USB_DATA i HSIC_DATA1

---------------------------------------
DarkPurple: --
---------------------------------------
F7 TRIG_B ? ?
H2 ON1 i CP_ON
J2 ON2_N - -
K3 REF_CLK_EN o REF_CLK_EN
N4 T_OUT0 - -
P3 T_OUT1 - -

---------------------------------------
FunkyTeal1 (#72FFD2): --
---------------------------------------
J3 RESET_PWRDWN_N i CP_PMU_RST_OR [RESET: Modem, PMIC, RF] !!
K2 RESET_BB_N i RESET_REQ_N
R5 RESET2_N - "RESET300"

---------------------------------------
FunkyTeal2 (#56FFB2) XTAL/CLOCK
---------------------------------------
L17 F32K - (xtal-1)
M17 OSC32K - (xtal-1)
N8 CLKOUT0 o XTAL_26MHZ_CP ??
P12 SYS_CLK i SYS_CLK_26M
P10 CLKOUT2 - [TP315]

---------------------------------------
BlueWhite: SIM
---------------------------------------
T11 DMINUS - -
T13 CC_IO i/o SIM_IO
T14 CC_RST o SIM_RST
U11 DPLUS - -
U14 CC_CLK o SIM_CLK

---------------------------------------
BrightYellow: ??
---------------------------------------
A5 VPLL - VPLL_1.2V
B4 VIO_12
C4 VUSB_PD
F2 VUSB_ANA /
F4 VRTC
G1 VSIM
G2 VPMU /
H1 VUSB_IO
J1 VREF

/ = grounded via capacitor

---------------------------------------
Yellow: RAM-BUS
---------------------------------------
[check pin colors!]

(See schematic on page 41 in service manual.)

<lazy!>

J16 MEM_A_16 o SPEECH_PCM_CLK
H16 MEM_A_17 o CP_DUMP_INT
J15 MEM_A_18 i SPEECH_PCM_IN_CP
G15 MEM_A_19 o SPEECH_PCM_OUT_CP
E15? MEM_A_20 o SPEECH_PCM_SYNC
D16 MEM_A_21 o 2MIC_RST_CP
C16 MEM_A_22 o 2MIC_WAKE_CP
B16 MEM_A_23 o 2MIC_EN_CP

A12? MEM_SC0_N o SD_DQM0
F16? MEM_SC1_N o SD_DQM1
B10? MEM_SC2_N o SD_DQS0
G16? MEM_SC3_N o SD_DQS1

G14 MEM_BE0_N - -
G13 MEM_BE1_N o SUSPEND_REQUEST_HSIC

? MEM_BFCLKO_0 - -
? MEM_BFCLKO_1 o SD_nCLK
? MEM_?_N o SD_CS
? MEM_?_N o SD_CAS
? MEM_?_N o SD_RAS
? MEM_?_N o MEM_WE
? MEM_?_N o SD_CKE
? MEM_?_N o SD_CLK

K17 MEM_WAIT_N - -

---------------------------------------
Grey: undocumented and/or unconnected ?
---------------------------------------

<lazy!>

-------------------------------------------------------------------------------
MUX: FSA9280A (Service Manual: "U709", page 68 [Section: 8-67])
-------------------------------------------------------------------------------
1 GND
2 D+ io USB_DP_CON
3 D- io USB_DM_CON
4 PSO - GND
5 SEL1 i SEL2 + MHL_SEL
6 USB- o PMIC_DM
7 USB+ i PMIC_DP
8 GND
9 SEL2 i SEL1 + MHL_SEL
10 MHDI- io MHL_DM
11 MHDI+ io MHL_DP
12 IDUSB i PMIC_ID
13 IDMHDI i MHL_ID
14 IDCOM i USB_ID_SUB_CON
15 VBUS + USB_VBUS_AP_4.9V
16 VCC

-------------------------------------------------------------------------------
PMIC: MAX8997 (Service Manual: "U501")
-------------------------------------------------------------------------------
The PMIC solution MAX8997 integrates seven highly efficient step-down
converters, 21 low-dropout linear regulators (LDOs), battery charger,
micro USB interface, real-time clock (RTC) with alarms, tactile-feedback
motor driver, camera flash LED driver, 12 general-purpose I/Os (GPIOs),
and I2C interface for programming.

The signals we are interested in are:

Modem UPC300:
T2 USIF1_RXD_MRST i AP_FLM_TXD --> PMIC:K3(18T2) -[?]-> AP_FLM_TXD_2.8V (XUTXD_3:A27) --> UART3: XXnn (check!)
T3 USIF1_TXD_MTSR o AP_FLM_RXD --> PMIC:J4(18R1) -[?]-> AP_FLM_RXD_2.8V (XURXD_3:H27) --> UART3: XXnn (check!)

M14 MIPI_HSI_RX_FLG i CP_RXD_1.8V --> PMIC:G3(18TNC2) -[?]-> AP:CP_RXD (?:?) --> UART3?: XXnn (check!)
N13 MIPI_HSI_RX_DATA o CP_TXD_1.8V --> PMIC:G5(18RNC1) -[?]-> AP:CP_TXD (?:?) --> UART3?: XXnn (check!)

A few of the MAX8997 pins are:

J4 18R1 i AP_FLM_RXD (BP)
K3 18T2 o AP_FLM_TXD (BP)
G4 28T1 o AP_FLM_RXD_2.8V (AP)?
L4 28R2 i AP_FLM_TXD_2.8V (AP)?

G5 18RNC1 i CP_TXD_1.8V (BP)
G3 18TNC2 o CP_RXD_1.8V (BP)
H4 28TNO2 o ??CP_TXD (AP) UART3??
H6 28RNO1 ? ??CP_RXD (AP) UART3??

? ? A/S1 o AP_RXD (AP) UART2 mysterious, perhaps doesn't exsist
? ? A/S1 i AP_TXD (AP) UART2 mysterious, perhaps doesn't exsist
K4 28RCOM2 A/S1 i IF_RXD MUX
H5 28TCOM1 A/S1 o IF_TXD MUX

B11:MDP?/DN1:G1 io PMIC_DP MUX perhaps doesn't exsist
B10:MDN?/DP2:H1 io PMIC_DM MUX perhaps doesn't exsist
K2:MIC_USB

(A) I then had a look at the MUX (Fairchild FSA9280A) chip datasheet (part of that hack-kit), and reading about it. From what I understand today, is that the mux has 2 types of USB ports (in addition to the I2S ones). One is a FS (Full Speed) USB/UART and the other is a HS (High Speed) USB [eHCI]. Now, intuition tell me, it is most likely (for practical reasons) that the AP is connected to the HS-USB (eHCI) mux-port, while the BP (USB port) is connected to the FS-USB/UART mux-port. Although it may be the other way around. In any case, I don't think it's possible to use the mux as a loopback device, in order to communicate: AP<-->MUX<-->BP, but who knows!

(B) I also found that the BP's MIPI-HSI (pins N13,M14) interface is connected through the PMIC level converter to the AP. However, according to Infineons product presentation (here) about their MIPI-HSI protocol, they say you also need to connect the READY pin. This pin is NOT connected, according to the Service Manual's schematics. In addition, only the HSI-RX pins are connected, which seem to imply that the BP can only receive data/commands from AP using this transport. So if this is actually the case, either:

a) The Service Manual Schematic is wrong.

b) The PCB layout is (wired) wrong. ==> No Serial

c) The BP is programmed to use another signal as a substitute for READY (MIPI_HSI_RX_RDY).

d) Infineon specifications of MIPI-HSI are unclear or outdated.

Any of these seem equally likely, given the poor quality control record of Samsung.

(C) There is another BP connection via USIF (Universal Serial InterFace), that is shown on the schamatics, but it uses the same signals as the HSI-->PMIC. This obviously can't be right and contradicts everything in (B), unless it is actually connected directly to the AP...somehow and somewhere else... [So if some hardware savvy savior would like to trace these out, that would indeed be great!]

(D) So now we believe the following:

1) The uUSB (PC connection) can talk directly to either BP or AP.

2) The AP can "communicate" with BP via:

i) IPC [2-way]
ii) AP:UART(3?)-->PMIC-->BP [perhaps only 1-way?]
iii) AP:HS-USB<-->MUX<-->BP:FS-USB [2-way]
iv) AP:??? <--> BP:USIF ??? [2-way?]

(E) So when we connect (via uUSB) an external vt100 terminal emulator, and send "AT" commands. We are actually doing one, or a combination of the following:

1) Sending BP ATC:
a) TX: uUSB --> DataRouter (drexe) --> IPC --> BP
b) TX: uUSB --> DataRouter (drexe) --> AP:? --> PMIC --> BP:USIF
c) TX: uUSB --> DataRouter (drexe) --> AP:? --> PMIC? --> BP:MIPI-HSI
d) TX: uUSB --> BP:USB2
(driver handled by adb & special PC driver software)

2) Receiving BP ATC response:
a) RX: BP --> IPC --> DataRouter --> uUSB
b) RX: BP:USIF --> PMIC --> AP:? --> DataRouter --> uUSB
c) RX: BP:MIPI-HSI --> PMIC? --> AP:? --> DataRouter --> uUSB
d) RX: BP:USB2 --> uUSB

NOTE: Any connection with uUSB is through the MUX.

But there is nothing that says you have to send and receive on the same interface. In fact some of the E/DataRouter logcat entries seem to imply that sending and receiveing interfaces are different. Especially when playing with the *#7284# (PhoneUtil) USB/UART switch for the MODEM. Or sending certain service test mode AT commands.

(F) I now have much more clear picture of how Infineon's own PhoneTool works. It's basically a GUI-fied command wrapper for sending special ATC's to the handset, doing all the tuning, testing and programming! :D This include how to put the phone in various Radio-more/less test modes. This is also most likely a widespread tool used with most of the Infineon X-GOLD (XMM) BP line.

Images: Courtesy Anandtech