The Samsung SGH-i900 Omnia is a 3.5G cellphone

Samsung sells the Omnia with Windows Mobile pre-installed, but has shown a prototype running a LiMo? stack at Mobile World Congress 2009.

Furthermore, the community has already demonstrated an initial haret-based boot of a Linux-kernel including framebuffer support.

As it seems, a lot of information is known about this device, mainly due to leaked service manuals.

Hardware specs

• Application Processor: 624MHz Marvell PXA312, probably a PXA310 with NAND (256MB) + DDR (128MB) in one package
• GSM/UMTS Modem: Qualcomm MSM6281, interfaced via dual-ported RAM
• Wifi: Marvell 8686 (SDIO on mmc2)
• Bluetooth: CSR 41814 (BTUART?)
• 8/16 GB external SD flash (on mmc1)
• Audio Codec / Touchscreen: Wolfson WM9713
• Screen: 240x400 pixels, 3.2"
• 5MP Sony IMX034 camera with LED flash
• Bosch Sensortec BMA020 Accelerometer
• Ambient light sensor

Kernel Status

• http://git.gnufiish.org/?p=sgh-i900.git;a=summary
• Booting from haret works
• Framebuffer works
• Booting into a rootfs on microSD card (mmc0) works
• No USB device for usb ethernet yet

Haret

• http://www.handhelds.org/moin/moin.cgi/HaRET
• For know we use PXA27x as arch for the omnia
• Som ongoing work for PXA3xx support: http://www.handhelds.org/hypermail/haret/current/1860.html

Some Android kernel booting

http://forum.xda-developers.com/showthread.php?t=431329

Teardown

http://www.phonewreck.com/2009/05/18/samsung-omnia-i910-review-and-teardown/

http://www.phonewreck.com/wiki/index.php?title=Samsung_Omnia_i910

Service Manual

http://www.palmpc.cz/soubory/1229854/SGH_i900_service_manual.pdf

Information about individual components

• PXA31x System-on-a-Chip
  • http://www.marvell.com/products/cellular/application/PXA3xx_series.jsp

• U303: LTC4078 Li-Ion Charger
  • http://www.linear.com/pc/productDetail.jsp?navId=H0,C1,C1003,C1037,C1078,C1088,P38953
  • http://www.linear.com/pc/downloadDocument.do?navId=H0,C1,C1003,C1037,C1078,C1088,P38953,D25484

• UCD402: Wolfson WM9713 Audio Codec
  • http://www.wolfsonmicro.com/products/WM9713/
  • http://www.wolfsonmicro.com/uploads/documents/en/WM9713.pdf

• U400: Vishay DG2011 Silgne SPDT Analog Switch
  • http://www.vishay.com/analog-switches/list/product-70102/
  • http://www.vishay.com/doc?70102

• U408: MAX4744 Clickless Audio Dual SPDT Switch
  • http://www.maxim-ic.com/quick_view2.cfm/qv_pk/5184/t/do
  • http://www.maxim-ic.com/reliability/dallas/MAX4744.pdf

• U500: Rohm BD6086GU LED Driver
  • http://www.rohm.com/products/databook/driver/pdf/bd6086gu-e.pdf

• U506: AnalogICTech AAT1270: high-current boost converter
  • http://www.analogictech.com/products/ProductDisplay.aspx?DepartmentID=70&Productid=225
  • http://www.analogictech.com/products/digitalfiles/AAT1270.pdf

• U507: Maxim MAX1237EUA-TG104 ADC
  • http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3271
  • http://datasheets.maxim-ic.com/en/ds/MAX1236-MAX1239M.pdf

• U509: Micrel MIC5335-MGYMT LDO

• U511: MAX8640YEXT12 500mA 2MHz step-down DC/DC converter
  • http://www.maxim-ic.com/quick_view2.cfm/qv_pk/5281
  • http://datasheets.maxim-ic.com/en/ds/MAX8640Y-MAX8640Z.pdf

• U512: Micrel MIC5335-MMYMT LDO

• U601: Micrel MIC5330: Dual 400mA uCap ULDO
  • http://www.micrel.com/page.do?page=/product-info/products/mic5330.jsp
  • http://www.micrel.com/_PDF/mic5330.pdf

• U603: USB3319 Hi-Speed USB Transceiver
  • http://www.smsc.com/main/catalog/usb331x.html
  • http://www.smsc.com/main/datasheets/3319db.pdf

• UCD604: ISE2200 TV Encoder
  • http://www.myungmin.com/products/encoder_ISE2200.php

• U605: Maxim MAX8660 Power Management
  • http://www.maxim-ic.com/quick_view2.cfm/qv_pk/5146/t/al
  • http://datasheets.maxim-ic.com/en/ds/MAX8660-MAX8661.pdf

• U608: Fairchild NC7WP08L8X (AND Gate)
  • http://www.fairchildsemi.com/pf/NC/NC7WP08.html
  • http://www.fairchildsemi.com/ds/NC/NC7WP08.pdf

Si4703 FM Tuner

• Component U405
• http://www.electrosnab.ru/silabs/pdf/Si/Si4702-03_short.pdf
• RDS/RDBS variant?
• Suspected on I2C
• Ongoing driver work in the gnufiish git
• Power GPIOs?

Bluetooth CSR 41814

• Same as M800
• On which UART?
• Power GPIOs?
• Bluetooth on:

  004.969    GPIOS    GPLR0: GPIO3(3)=1
  005.118    GPIOS    GPLR2: GPIO76(76)=1
  005.422    GPIOS    GPLR2: GPIO84(84)=0
  005.426    GPIOS    GPLR2: GPIO84(84)=1
  [Tons of GPIO84 off/on toogle]
  008.242    GPIOS    GPLR1: GPIO48(48)=0
  008.242    GPIOS    GPLR2: GPIO71(71)=1
  008.276    GPIOS    GPLR2: GPIO84(84)=0
  008.280    GPIOS    GPLR2: GPIO84(84)=1
  008.287    GPIOS    GPLR2: GPIO84(84)=0
  008.383    GPIOS    GPLR1: GPIO48(48)=1
  008.383    GPIOS    GPLR2: GPIO71(71)=0 GPIO84(84)=1
  010.506    GPIOS    GPLR2: GPIO84(84)=0
  010.508    GPIOS    GPLR2: GPIO84(84)=1
  

• Bluetooth off:

  081.778    GPIOS    GPLR2: GPIO84(84)=0
  081.795    GPIOS    GPLR2: GPIO84(84)=1
  082.578    GPIOS    GPLR0: GPIO3(3)=0
  082.578    GPIOS    GPLR2: GPIO76(76)=0
  082.597    GPIOS    GPLR1: GPIO48(48)=0
  082.597    GPIOS    GPLR2: GPIO71(71)=1
  083.598    GPIOS    GPLR1: GPIO48(48)=1
  083.598    GPIOS    GPLR2: GPIO71(71)=0
  

Wifi Marvell 8686

• SDIO on mmc2
• Power GPIOs?
• Wifi on:

  017.827    GPIOS    GPLR0: GPIO3(3)=1
  017.844    GPIOS    GPLR0: GPIO16(16)=1
  017.844    GPIOS    GPLR3: GPIO104(104)=1 GPIO118(118)=1
  017.860    GPIOS    GPLR0: GPIO8(8)=1 GPIO16(16)=0
  017.917    GPIOS    GPLR0: GPIO9(9)=1
  017.917    GPIOS    GPLR1: GPIO48(48)=0
  023.032    GPIOS    GPLR2: GPIO89(89)=0
  

• Wifi off:

  043.160    GPIOS    GPLR0: GPIO8(8)=0
  043.160    GPIOS    GPLR3: GPIO104(104)=0 GPIO118(118)=0
  043.163    GPIOS    GPLR0: GPIO9(9)=1
  043.163    GPIOS    GPLR1: GPIO48(48)=0
  043.168    GPIOS    GPLR0: GPIO3(3)=0
  044.164    GPIOS    GPLR0: GPIO9(9)=0
  044.164    GPIOS    GPLR1: GPIO48(48)=1
  

8/16 GB SD Flash

• On mmc1
• Already detected from mainline

Audio Codec / Touchscreen Wolfson WM9713

• Driver already mainline
• Which GPIO?

Screen: 240x400 pixels, 3.2"

• Framebuffer timings known and already working

GSM/UMTS Modem: Qualcomm MSM6281

• Connected to to Cypress 16Kbyte (128Kbit) dual port ram
• Power GPIOs?
• Memory address?
• Phone on:

  003.651    GPIOS    GPLR2: GPIO81(81)=1
  003.802    GPIOS    GPLR3: GPIO107(107)=1
  004.206    GPIOS    GPLR2: GPIO81(81)=0
  009.051    GPIOS    GPLR3: GPIO106(106)=1
  

• Phone off:

  037.879    GPIOS    GPLR3: GPIO106(106)=0
  038.386    GPIOS    GPLR3: GPIO107(107)=0
  

GPIOs

• Default settings

  Beginning memory tracing.
  Watching GPIOS(00): Addr a8e00000(@40e00000)
  Watching GPIOS(01): Addr a8e00004(@40e00004)
  Watching GPIOS(02): Addr a8e00008(@40e00008)
  Watching GPIOS(03): Addr a8e00100(@40e00100)
  Watching GPIOS(04): Addr a8e0000c(@40e0000c)
  Watching GPIOS(05): Addr a8e00010(@40e00010)
  Watching GPIOS(06): Addr a8e00014(@40e00014)
  Watching GPIOS(07): Addr a8e0010c(@40e0010c)
  Watching GPIOS(08): Addr a8e00054(@40e00054)
  Watching GPIOS(09): Addr a8e00058(@40e00058)
  Watching GPIOS(10): Addr a8e0005c(@40e0005c)
  Watching GPIOS(11): Addr a8e00060(@40e00060)
  Watching GPIOS(12): Addr a8e00064(@40e00064)
  Watching GPIOS(13): Addr a8e00068(@40e00068)
  Watching GPIOS(14): Addr a8e0006c(@40e0006c)
  Watching GPIOS(15): Addr a8e00070(@40e00070)
  000.000    GPIOS    GPLR0=05101084: GPIO2=1 GPIO7=1 GPIO12=1 GPIO20=1 GPIO24=1 GPIO26=1
  000.000    GPIOS    GPLR1=00010000: GPIO48=1
  000.000    GPIOS    GPLR2=007c0040: GPIO70=1 GPIO82=1 GPIO83=1 GPIO84=1 GPIO85=1 GPIO86=1
  000.000    GPIOS    GPLR3=40801cd0: GPIO100=1 GPIO102=1 GPIO103=1 GPIO106=1 GPIO107=1 GPIO108=1 GPIO119=1 GPIO126=1
  000.000    GPIOS    GPDR0=3d2bd68c: GPIO2=1 GPIO3=1 GPIO7=1 GPIO9=1 GPIO10=1 GPIO12=1 GPIO14=1 GPIO15=1 GPIO16=1 GPIO17=1 GPIO19=1 GPIO21=1 GPIO24=1 GPIO26=1 GPIO27=1 GPIO28=1 GPIO29=1
  000.000    GPIOS    GPDR1=fffb8040: GPIO38=1 GPIO47=1 GPIO48=1 GPIO49=1 GPIO51=1 GPIO52=1 GPIO53=1 GPIO54=1 GPIO55=1 GPIO56=1 GPIO57=1 GPIO58=1 GPIO59=1 GPIO60=1 GPIO61=1 GPIO62=1 GPIO63=1
  000.000    GPIOS    GPDR2=bceadfbf: GPIO64=1 GPIO65=1 GPIO66=1 GPIO67=1 GPIO68=1 GPIO69=1 GPIO71=1 GPIO72=1 GPIO73=1 GPIO74=1 GPIO75=1 GPIO76=1 GPIO78=1 GPIO79=1 GPIO81=1 GPIO83=1 GPIO85=1 GPIO86=1 GPIO87=1 GPIO90=1 GPIO91=1 GPIO92=1 GPIO93=1 GPIO95=1
  000.000    GPIOS    GPDR3=dec1a17b: GPIO96=1 GPIO97=1 GPIO99=1 GPIO100=1 GPIO101=1 GPIO102=1 GPIO104=1 GPIO109=1 GPIO111=1 GPIO112=1 GPIO118=1 GPIO119=1 GPIO121=1 GPIO122=1 GPIO123=1 GPIO124=1 GPIO126=1 GPIO127=1
  000.000    GPIOS  GAFR0_L=00000000:
  000.000    GPIOS  GAFR0_U=00000000:
  000.000    GPIOS  GAFR1_L=00000000:
  000.000    GPIOS  GAFR1_U=00000000:
  000.000    GPIOS  GAFR2_L=00000000:
  000.000    GPIOS  GAFR2_U=00000000:
  000.000    GPIOS  GAFR3_L=00000000:
  000.000    GPIOS  GAFR3_U=00000000:
  

• GPLR0: GPIO17(17) Audio related
• GPLR0: GPIO20(20) Ambient sensor or accellerometer related
• GPLR0: GPIO23(23) Touchscreen (press=1, release=0)
• GPLR2: GPIO70(70) GPS related ??
• GPLR2: GPIO79(79) Flash light (Vibrator??)
• GPLR3: GPIO125(125) Accelerometer related

Camera Sony IMX034

• Camera (back) on:

  022.678    GPIOS    GPLR0: GPIO0(0)=1
  022.678    GPIOS    GPLR1: GPIO47(47)=1 GPIO53(53)=1
  022.678    GPIOS    GPLR2: GPIO90(90)=1
  022.678    GPIOS    GPDR3: GPIO127(255)=0
  

• Camera (back) off:

  041.157    GPIOS    GPLR2: GPIO79(79)=1
  041.289    GPIOS    GPLR2: GPIO79(79)=0
  041.384    GPIOS    GPLR0: GPIO0(0)=0
  041.384    GPIOS    GPLR1: GPIO47(47)=0 GPIO53(53)=0
  041.384    GPIOS    GPLR2: GPIO90(90)=0
  041.384    GPIOS    GPDR3: GPIO127(255)=1
  

Vibrator

Vibrator on (Incoing call with vibration on):

016.683    GPIOS    GPLR0: GPIO9(9)=1
016.683    GPIOS    GPLR1: GPIO48(48)=0
016.976    GPIOS    GPLR2: GPIO79(79)=1
017.149    GPIOS    GPLR0: GPIO9(9)=0
017.149    GPIOS    GPLR1: GPIO48(48)=1
017.504    GPIOS    GPLR0: GPIO9(9)=1
017.504    GPIOS    GPLR1: GPIO48(48)=0
017.743    GPIOS    GPLR0: GPIO9(9)=0
017.743    GPIOS    GPLR1: GPIO48(48)=1
020.311    GPIOS    GPLR2: GPIO79(79)=0
022.157    GPIOS    GPLR2: GPIO79(79)=1
023.121    GPIOS    GPLR2: GPIO79(79)=0

• Vibrator off (Incoing call with vibration off):

  017.425    GPIOS    GPLR0: GPIO9(9)=1
  017.425    GPIOS    GPLR1: GPIO48(48)=0
  017.756    GPIOS    GPLR0: GPIO9(9)=0
  017.756    GPIOS    GPLR1: GPIO48(48)=1
  018.056    GPIOS    GPLR0: GPIO9(9)=1
  018.056    GPIOS    GPLR1: GPIO48(48)=0
  018.293    GPIOS    GPLR0: GPIO9(9)=0
  018.293    GPIOS    GPLR1: GPIO48(48)=1
  

Bosch Sensortec BMA020 Accelerometer

• On SPI?

Ambient Light Sensor

• Chip unknown

JTAG pinout

There's an 8-pin connector CN601 underneath the LCD FPCB connector with the following pinout (thanks to plvt_florian):

• 1: VCC 3.3V
• 2: nTRST
• 3: TDI
• 4: TMS
• 5: TCK
• 6: TDO
• 7: nRST
• 8: GND