Difference between revisions of "S5L8701 analysis"

From freemyipod.org
Jump to: navigation, search
(Introduction)
m (Reverted edits by Owixyze (talk) to last revision by Cmwslw)
 
(12 intermediate revisions by 6 users not shown)
Line 1: Line 1:
 +
[[File:S5L8701_bonding_wires_via_x-ray_bottom_view_2.jpg|200px|thumb|View of the bonding via X-ray]]
 +
[[File:S5L8701_top_layer_bottom_view_2.jpg|200px|thumb|View of the top layer]]
 +
[[File:S5L8701 bottom layer bot view 2.jpg|200px|thumb|View of the bottom layer]]
 
== Introduction ==
 
== Introduction ==
  
Line 6: Line 9:
 
Knowing the location of some JTAG pins could be very helpful.
 
Knowing the location of some JTAG pins could be very helpful.
  
There is an OpenOffice Calc document describing possible pinouts [http://f4eru.free.fr/8701%20pinout.ods here]. There is also [https://mail.gna.org/public/linux4nano-dev/2009-05/msg00003.html tof's mailing list post].
+
There is an OpenOffice Calc document describing possible pinouts [http://f4eru.free.fr/8701/ here]. There is also [https://mail.gna.org/public/linux4nano-dev/2009-05/msg00003.html tof's mailing list post].
  
 
== Structure of the packaging ==
 
== Structure of the packaging ==
  
 
The chip is a 226-pin TFBGA with a pitch of 0.5mm.
 
The chip is a 226-pin TFBGA with a pitch of 0.5mm.
This is the structure of a BGA package : [http://www.freepatentsonline.com/6569694-0-display.jpg BGA package]
+
This is the structure of a BGA package: [http://www.freepatentsonline.com/6569694-0-display.jpg BGA package]
  
 
The chip is glued to a small double side PCB substrate.
 
The chip is glued to a small double side PCB substrate.
the electrical current passes through :
+
the electrical current passes through:
-a pad of the chip die
+
*a pad of the chip die
-a bonding wire
+
*a bonding wire
-the top layer of the substrate
+
*the top layer of the substrate
-a via
+
*a via
-the bottom layer
+
*the bottom layer
-finally, the BGA ball
+
*finally, the BGA ball
  
The [[known datasheet]S5L8700_datasheet] shows die pad numbers that need to be correlated to ball numbers (the specified package has a different ball layout).
+
The [[S5L8700 datasheet|known datasheet]] shows die pad numbers that need to be correlated to ball numbers (the specified package has a different ball layout).
 
In order to do this, we make an analysis of the bonding and PCB.
 
In order to do this, we make an analysis of the bonding and PCB.
  
 
== Packaging analysis ==
 
== Packaging analysis ==
  
Following steps were made :  
+
Following steps were made:  
-desoldering of the IC
+
*desoldering of the IC
-removing of the balls and filler glue
+
*removing of the balls and filler glue
-X-ray picture
+
*X-ray picture
-microscope picture of the bottom layer
+
*microscope picture of the bottom layer
-removing the bottom layer and most of the substrate (by careful manual grinding)
+
*removing the bottom layer and most of the substrate (by careful manual grinding)
-microscope picture of the top layer
+
*microscope picture of the top layer
-superposition of these views, and path finding from the die to the ball
+
*superposition of these views, and path finding from the die to the ball
 
 
 
 
[[File:S5L8701_bonding_wires_via_x-ray_bottom_view_2.jpg|200px|thumb|left|View of the bonding via X-ray]]
 
[[File:S5L8701_top_layer_bottom_view_2.jpg|200px|thumb|left|View of the top layer]]
 
[[File:S5L8701 bottom layer bot view 2.jpg|200px|thumb|left|View of the bottom layer]]
 
  
 
== Guessed pinout table ==
 
== Guessed pinout table ==
  
to come soon...
+
the pinout is currently under study. See [http://f4eru.free.fr/8701/ here] for the actual status.
 +
This is not an easy part of the work, each pad has to be tested for connections all over the board (most IC's removed). See [[Nano2G HW analysis]] for further PCB analysis.

Latest revision as of 02:15, 24 November 2010

View of the bonding via X-ray
View of the top layer
View of the bottom layer

Introduction

The samsung S5L8701 is the SOC of the IN2G. This chip is supposed to be close to the 8700 used on some concurrent MP3 players.

We currently know nearly nothing about the differences of both chips, and the further evolutions. There is probably a small unencrypted boot ROM inside, which would be very useful for integrating user SW. Probably containing crypto information. Knowing the location of some JTAG pins could be very helpful.

There is an OpenOffice Calc document describing possible pinouts here. There is also tof's mailing list post.

Structure of the packaging

The chip is a 226-pin TFBGA with a pitch of 0.5mm. This is the structure of a BGA package: BGA package

The chip is glued to a small double side PCB substrate. the electrical current passes through:

  • a pad of the chip die
  • a bonding wire
  • the top layer of the substrate
  • a via
  • the bottom layer
  • finally, the BGA ball

The known datasheet shows die pad numbers that need to be correlated to ball numbers (the specified package has a different ball layout). In order to do this, we make an analysis of the bonding and PCB.

Packaging analysis

Following steps were made:

  • desoldering of the IC
  • removing of the balls and filler glue
  • X-ray picture
  • microscope picture of the bottom layer
  • removing the bottom layer and most of the substrate (by careful manual grinding)
  • microscope picture of the top layer
  • superposition of these views, and path finding from the die to the ball

Guessed pinout table

the pinout is currently under study. See here for the actual status. This is not an easy part of the work, each pad has to be tested for connections all over the board (most IC's removed). See Nano2G HW analysis for further PCB analysis.