WC1

From AsteroidOS

Galaxy Gear S2 Classic

The Gear S2 classic is a Tizen-based smartwatch released in 2015. See gsmarena for detailed specs. The codename used in Tizen and Recovery seems to be "WC1".

As the vendor kernel is very old (3.4) and there's no existing abstraction for the Tizen HAL, a mainline Linux port for this watch is being attempted instead.

Downstream sources available at https://github.com/casept/samsung-wc1-sources, as Samsung no longer hosts them.

Hardware docs

Recovery mode and flashing

Like other Samsung watches, the Gear S2 classic can either be flashed wirelessly via the NetOdin protocol, or using the regular Odin protocol by opening it up and soldering a USB cable to some internal pads. See e.g. this XDA thread for the pinout.

Note that flashing the BOOT partition with a bad kernel will result in a broken recovery and inability to use wireless download mode, so make sure you have USB connected before working on the watch.

List of peripherals and their kernel driver state

Most of the hardware in this watch seems to have drivers in the mainline kernel, especially the SoC and most of the regulators.

Samsung Gear S2 Classic
Chip Function Driver state in mainline Linux Notes
Exynos 3250 SoC Supported DTS for dev boards based on it exist
WM1831 Microphone DAC Supported
BCM4343W WLAN and BT Unsupported Infineon still maintains this chip. There's a patch for recent kernels (5.15) available on Infineon's support site. A quite complete datasheet exists here.
SENN5DDPS2 NFC Possibly supported There exists a kernel driver for 5th generation Samsung NFC chips, whether this chip is part of it is unknown.
BCM53950 Wireless charge controller Unsupported No public datasheet, Samsung code seems readable enough and quite short (~1500LoC)
ISA1000A vibrator motor controller Unsupported No datasheet, but probably only requires SoC PWM+GPIO, Samsung driver ca. 500LoC (drivers/motor/isa1000a_vibrator.c)
Unknown IC hall effect sensor, crown Unsupported Connected via I2C, Samsung driver at drivers/input/misc/sec_rotary.c, ~1300LoC
CYTMA525 touchscreen controller Supported
MAX77836 MUIC Supported downstream kernel judges jig modes based on resistor connected to this via USB
ATSAMG55G19A sensor hub unknown possibly supported via "Samsung sensor hub" driver. Sensor chips are connected to this and not the SoC directly.
Unknown (marked "OCTA") LCD controller unknown unknown

Debugging and Jigs

The device exposes a UART via the USB pads if ID is connected to GND with a 619k resistor. D+ goes to TX on the TTL adapter and D- goes to RX. VCC does not need to be connected. This works identically to other Samsung smartphones.

Connecting to the device via UART yields the following output on startup:

= 0x00
PMIC_STATUS1    = 0x27
PMIC_STATUS2    = 0x11
PMIC_OFFSRC     = 0x00
PMIC_PWRON      = 0x08
PMIC_IRQ1       = 0xc3
PMIC_IRQ2       = 0x11
PMIC_IRQ3       = 0x00
PMIC_RTC_OFFSRC = 0x00
PMIC_RTC_SMPL   = 0x23
pwm-0: stop, tcon = 0x510000
pwm-0: prescaler = 1, divider = 3
pwm-0: src clk = 50000000, prescaler = 1, div = 8
pwm-0: freq = 3125000, request freq = 25344
pwm-0: tcnt = 0x7b, tcmp = 0x79
s5p_check_reboot_mode: INFORM3 = 0 ... skip
board_ps_hold_control: state (1)
s5p_reboot_menu_is_7sec_reset
debug_level: 0x00004f4c (20300)
   pwron-ap: 0x00010000 (hard reset)
 pwron-pmic: 0x00000008 (mrst)
s5p_reboot_menu_is_7sec_reset: 7sec reset at low debug level
cmu_div:65535, div:1, src_clk:0, pixel_clk:15552000
reset_lcd by s6e36w1x01
s5p_dsim_display_config: COMMAND MODE
display id: 40, 20, 15
s5p_reboot_menu_is_7sec_reset: timeout
target reboot with swreset as workaround
s5p_restart_handler ('N':normal)

OMUIC rev = MAX14577(117)
MON: 0x65(4)
MON[0] = (4)[0x37, 0xe8]
MON[1] = (5)[0x39, 0xe8]
MON[2] = (6)[0x3a, 0xc0]
MON[3] = (7)[0x0c, 0x14]
MON[4] = (0)[0x36, 0xe8]
MON[5] = (1)[0x32, 0xfc]
MON[6] = (2)[0x18, 0x20]
MON[7] = (3)[0x0a, 0x00]
cardtype: 0x00000007
buswidth: 0x00
hstiming: 0x00
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000f11
mmc->host_caps: 0x00000f11
!!!Enter 8 Bit DDR mode.!!!
[mmc] capacity = 7634944

MODEL_NAME:{{SM-R732}}
eMMC_SERIAL_NUMBER:{{150100464A32354441008825557FC261}}


Current port state

Porting currently on hold due to lifting pins from the board, resulting in a bricked watch which can no longer be recovered via USB.