Dell Axim X5 hardware information collection
http://handhelds.org/moin/moin.cgi/DellAximX5
Authors:
-
Demo <cooldemo@inmail.sk>
-
Andrew Zabolotny <anpaza@mail.ru>
-
Bill DiPlacido <bimbasaari@yahoo.com>
-
Andreas Mohr <andi@lisas.de>
Disclaimer
This document has NOTHING to do with Dell Computers. The information collected here is the result of the efforts of a few people involved in the "Linux on Dell Axim X5" project. It has been collected using all available documentation from network, as well as miscellaneous tools written specifically for this (such as tester and HaRET).DMA channel state
MECR=0x2 DINT=0x0
1st column is Channel control. The rest could be found in documentation for PXA250 processors
DMA #0=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #1=0x80000000 DCMD=0x9023ca60 DSADR=0xa1fbd560 DTADR=0x40500040 DMA #2=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #3=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #4=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #5=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #6=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #7=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #8=0xa0000000 DCMD=0x6022c030 DSADR=0x40500140 DTADR=0xa1fcf000 DMA #9=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #10=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #11=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #12=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #13=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #14=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0 DMA #15=0x8 DCMD=0x0 DSADR=0x0 DTADR=0x0
DMA: Pocket PC uses at least:
-
channel #1 for Audio out
-
channel #8 for Touch screen
GPIO configuration (HaRET output)
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER ------------------+-------------------+-------------------+------------------ 0 I 1 0 FE | 21 I 1 0 | 42 I 1 1 | 63 O 0 0 1 I 1 1 | 22 O 0 0 | 43 O 1 2 | 64 I 1 0 2 I 1 0 FE | 23 O 1 0 | 44 I 1 1 | 65 I 1 0 3 I 1 0 FE | 24 O 0 0 | 45 O 1 2 | 66 I 1 0 4 I 0 0 RE | 25 I 1 0 FE | 46 I 1 2 | 67 I 1 0 5 I 1 0 | 26 O 0 0 | 47 O 0 1 | 68 I 0 0 RE FE 6 I 0 0 RE FE | 27 I 1 0 RE FE | 48 O 1 2 | 69 I 0 0 RE FE 7 I 0 0 RE | 28 I 0 1 | 49 O 1 2 | 70 I 0 0 RE FE 8 I 1 0 FE | 29 I 0 1 | 50 O 1 2 | 71 O 0 0 9 I 1 0 FE | 30 O 0 2 | 51 O 1 2 | 72 O 1 0 10 I 0 0 RE FE | 31 O 0 2 | 52 O 1 2 | 73 O 1 0 11 I 0 0 RE FE | 32 I 0 0 | 53 O 1 2 | 74 O 1 0 12 I 0 0 RE FE | 33 O 1 2 | 54 O 1 2 | 75 I 1 0 13 I 0 0 RE FE | 34 I 1 1 | 55 O 1 2 | 76 I 1 0 14 I 0 0 RE FE | 35 I 1 1 | 56 I 1 1 | 77 I 0 0 15 O 1 2 | 36 I 1 1 | 57 I 0 1 | 78 O 1 2 16 O 1 2 | 37 I 1 1 | 58 O 1 0 | 79 O 1 2 17 I 0 0 RE | 38 I 1 1 | 59 I 1 0 | 80 O 1 0 18 I 1 1 | 39 O 1 2 | 60 O 0 0 | 81 I 0 0 19 O 0 0 | 40 O 1 2 | 61 I 1 0 FE | 82 I 0 0 20 O 0 0 | 41 O 1 2 | 62 O 0 0 | 83 I 0 0
Legend:
-
D is Direction (Input or Output, GPDR)
-
S is State (pin level, GPLR)
-
A is Alternate Function number (0-3, GAFR)
-
INTERrupt status may be Rising Edge (RE) or Falling Edge (FE).
This table shows all GPIO's that have been found so far:
-
0 ~Power Switch
-
1 ~Reset switch
-
2 MediaQ 1132 interrupt
-
3 Battery latch (0 - opened, 1 - closed)
-
4 Craddle plugged in (0 - connected, 1 - not connected)
-
5 ???
-
6 SD Card inserted
-
7 CF Card inserted
-
8 PCMCIA BVD1 ???
-
9 Main Battery inserted
-
10 Record button
-
11 Calendar
-
12 Contacts
-
13 Mailbox
-
14 Home
-
15 Active Low Chip Select (nCS_1)
-
16 PWM0 output (brightness)
-
17 AC power
-
18 Ext Bus Ready (RDY)
-
19 Serial cable DCD (used to power on the MAX232-like serial converter)
-
20 ???
-
21 ???
-
22 UDC pull-up enable (0) or disable (1)
-
23 ???
-
24 ???
-
25 Power good (???)
-
26 PCMCIA related ???
-
27 ~Joy "push" button
-
28-31 AC97 Controller Unit
-
32 Touch screen "touched"
-
33 Active Low Chip Select (nCS_5)
-
34-41 FFUART
-
42-45 BTUART
-
46-47 STUART
-
48-57 Connected to PCMCIA (CompactFlash) interface
-
58 ???
-
59 Accumulator Charging (1)
-
60 Flash write enable ???
-
61 Somehow PCMCIA related ??? (BVD2?)
-
62 PCMCIA reset.
-
63 PCMCIA address bus enable (0-enable)
-
64-67 Joy directions
-
0xC == up
-
0x3 == down
-
0x9 == right
-
0x6 == left
-
0xF == no button pressed
-
Also GPIO 27 is signalized on any joystick signal change
-
68 Scroll down
-
69 Scroll push
-
70 Scroll up
-
71 MediaQ 1132 power (???)
-
72 MediaQ 1132 address bus enable (I think)
-
73 Enable LED select by MediaQ GPIO54 (1)
-
74 Enable LED select by the charger (yellow - charging in progress, green - battery full) if 1, disable if 0.
-
75,76,77 These GPIO's are used to detect the type of cradle the PDA was inserted into (all three are input):
-
001,101 - Some simple connector (just AC power ???)
-
010,100 - Serial (RS-232) connectors (2-sync cable, 4-cradle)
-
011,110 - USB connector (3-sync cable, 6-cradle)
-
80 Make MediaQ GPIO54 select between Green and Yellow LED's (0) or between Black LED (e.g. no LED's) and Yellow LED (when it is set to 1).
MediaQ 1132
-
GPIO 0 seems unused.
-
GPIO 1 (def. output 1) enables the flat panel (possibly just enables all the FP input pins).
-
GPIO 2 (def input) is the CF IREQ pin.
-
GPIO 20 (def. output 0) somehow controls the vertical scan direction. If it is 0, the image is normal, if it is 1, the image flips upside-down.
-
GPIO 21 (def. output 0) ???
-
GPIO 22 (def. not conn) if output 0 image is disabled; when output 1 image is normal.
-
GPIO 23 && 24 are amplifier enable (both?). I think GPIO23 somehow mutes the sound and GPIO4 is routed to the SHUTDOWN pin of the TPA721 amplifier. When disabling the sound GPIO23 must be set to 0 first, otherwise a loud click happens (like in WinCE). And vice versa, when enabling the sound, GPIO24 must be set first, and GPIO23 after that.
-
GPIO 25 (def. output 1) ???
-
GPIO 50 (def. input/output 1 when SD/MMC in) == SPI/SS signal
-
GPIO 51 (def. input/output 1 when SD/MMC in) == SPI/SCK signal
-
GPIO 52 (def. output 1 when SD/MMC in) == SPI/MOSI signal
-
GPIO 53 (def. input 1 when SD/MMC in) == SPI/MISO signal
-
GPIO 54: LED select: when 0, the green LED is selected (if PXA GPIO80=0) or no LED is selected (PXA GPIO80=1); when 1, the yellow LED is selected (always). The PXA GPIO73 must be set to 0 for this selector to work, otherwise its value is ignored.
-
GPIO 55 (def. unused). If this GPIO is set to IN mode, and you insert a placeholder card (like the one supplied with the Dell) this bit is 1, so it is possible that this bit is used to differentiate between a real/fake SD/MMC card (PXA GPIO6 will indicate 0 in either case).
-
GPIO 60 (unused).
-
GPIO 61 (def. input/output 0) When 1, connects a 3.3k resistor load to backup battery. This permits the voltage measurements (read over the AUX channel of WM9705) to be more meaningful. Don't set it to 1 for too long, since this discharges your backup battery.
-
GPIO 62 (def. input/output 1) ???
-
GPIO 63 (def. input/output 1) is SIR transceiver enable
-
GPIO 64 (def. input/output 1) is backlight
-
GPIO 65 (def. input/output 1) is PCMCIA (power?)
-
GPIO 66 (def. input) 0: Extended battery (3400mAh), 1: Standard battery (1400mAh).
LCD
Axim X5 uses the MediaQ 1132 chip to control LCD. A fully functional driver to control backlight, brightness and contrast has been written specifically for Dell Axim X5.FRAME BUFFER
Frame buffer is statically mapped to physical address 0x14000000, it uses 16 bit format and its resolution is 240x320 pixels. PocketPC sets framebuffer start address + 0x2000 (e.g. 0x14002000 or 0x14042000 depending whether you want synced or unsynced access - see mq1132 docs).BACKLIGHT
Controlled by Pulse Width Modulator #0 on PXA. The brightness (range 0..1) == PWM_PWDUTY0/PWM_PERVAL0. PWM_PERVAL0 is 254 in Windows, so you have 254 gradations of brightness. In Linux you have 1023.UART
Normal UART available is fully documented in 278522-001.pdf. FIR has not been tested yet, but should work with the pxa_ir driver. The IR tranceiver is enabled via GPIO63 on MediaQ 1132 chip.USB
There is a USB Device Controller built-in into the PXA but it is not used. Instead, Axim uses the UDC that is built into the MediaQ chip. This means we'll have to write an UDC driver for MediaQ (doh). MediaQ 1132 contains a USB host (OHCI compatible) and it is rumoured that the outputs are available on the bottom connector, thus it is possible to modify the OHCI driver so that it works with MQ1132. This would mean that you will be able to connect any USB device (say, a 20GB portable HDD or a scanner) to your Dell (which PocketPC isn't able to do).USB cradle insertion process:
-
GPIO[17] changes to 0 - power related
-
GPIO[59] changes to 1 - power related
-
GPIO[4] changes to 0
-
GPIO[75-77] are set according to cradle type
-
GPIO[22] changes to 0
USB cradle removal process:
-
GPIO[4] changes to 1
-
GPIO[59] changes to 0 - power related
-
GPIO[75-77] changes to 111
-
GPIO[17] changes to 1 - power related
-
GPIO[22] changes to 1
Update: A driver has been written to drive the UDC. At least the g_ether gadget driver works fine with it (1.5 to 2 times faster than in WinCE! 500k/s PC->PDA and 375k/s PDA->PC).
PCMCIA/CF
All stuff that can be found in 278522-001.pdf (PXA250) and/or 27869301.pdf (PXA255) is valid also for Dell Axim.
PCMCIA/CF insertion process:
-
GPLR[7] changed to 0
-
[a noticeable delay]
-
GPLR[8] changed to 1
-
GPLR[26] changed to 0
-
GPLR[57] changed to 0
-
GPLR[61] changed to 1
-
GPLR[63] changed to 0
PCMCIA/CF removal process:
-
GPLR[7] changed to 1
-
GPLR[8] changed to 0
-
GPLR[26] changed to 1
-
GPLR[57] changed to 1
-
GPLR[61] changed to 0
-
GPLR[63] changed to 1
Interrup requests from CF cards are routed through MediaQ chip GPIO2. This is a level-triggered interrupt, thus after you process one interrupt you must disable and then re-enable that specific interrupt in order to get next one.
SD/MMC
It looks like these cards are handled in SPI mode (a four-wire interface) via the MediaQ chip (hell knows why, PXA2xx has a built-in MMC controller). When a SD card is inserted, MediaQ register SP00R bits 0-1 are set to <code>01</code> (this enables GPIO 50-53 to act in SPI mode). Also the pull-up registers for GPIO50-53 are activated.Touchscreen
Touchscreen is controlled by wm9705 AC97 codec. For some reason the Y channel readings are very noisy.Battery
The main battery voltage is measured via the BMON input of the wm9705 codec. The battery capacity is either 1400mA<em>h and 3400mA</em>h. Battery capacity is detected via MediaQ GPIO66 pin: if it's 1, it s a 1400mA*h battery; if it is 0, its the <code>extended</code> battery.Sound
Dell Axim uses the wm9705 audio codec. Amplifier power is controlled by GPIO23 & GPIO24 on MediaQ 1132:-
If both GPIO23/24 are set to output 1 (CC03R = ?aa?????), amplifier is enabled.
-
If they are both 0 (?22?????), it is powered off.
I'm not sure what every GPIO apart does. Also a TPA721 amplifier is used (datasheet can be downloaded from the Internet) but it is not important from programmer point of view since it is completely invisible to software.
Flashing the ROM
If you press "Contacts" and press the "Scroll" lever right down until it clicks, then press Reset, then release Reset but keep Contacts and Scroll Push for at least 10 seconds!) you'll get this (provided you have a CompactFlash storage card inserted into the slot): LCD initialized Ok.!!
P25 EBoot Ver. xxxxx
SDRAM 64MB Cleared!
Dell Axim X5
Hardware Device ID
xxxxxxxxxxxxxxxxxx
Manufacturer Code
xxxxxxxxxxxxxxxxxx
UUID Method1 Variant = 8
UUID Method1 Version = 1
CF card detected!
Init CF card ok!
Determining Card Type....
Storage Card Found!
Load Image From CF Disk....
!! PLEASE DO NOT TURN OFF !!
No matching *.IMG file found!
If you don't have a CompactFlash card in slot, you'll enter the Diagnostic tool which is not too interesting from our point of view
So replacing WinCE with Linux in ROM is just a matter of time now.
It also means you dont have to fear to brick your Axim with an incorrect ROM; you always can re-flash it with a correct image (well, I haven't tried it but should be true :-).
-
-- AndreasMohr - huh? Why should this be true?? I'd rather say that this is an initial flasher routine <em>within</em> the normal flash image - in other words if you flash a different image with it and that new image turns out to be toast, then your device WILL be bricked since this flash helper is gone, too. Besides, what do you think "!! PLEASE DO NOT TURN OFF !!" would be for other than warning about this fatal danger?? Time for some good JTAG tricks then, methinks...
-- AndrewZabolotny - this is true since the IMG file has a tag indicating whether it's a bootloader IMG file (256K), a WinCE image file or other kinds (don't remember now which exactly). So when flashing wince it won't touch the bootloader. The warning is just for people not knowing the magic key combination
JTAG
Intro We need to find out the exact JTAG connection, as it's not available from Dell. A Dell guy named Gary (Lerhaupt? http://www.lerhaupt.com/foo/archives/2003_06.html) has been able to connect JTAG to Axim, according to #handhelds.org logs, so it IS possible. However of course I'm sure he won't (be able to) tell us...Philipp Blundell has one Axim with desoldered CPU - he just needs to trace the lines to JTAG pins but didn't find the time yet...
Marcel Telka said that the TDO pin might actually be the yellow (gold) pad between PXA and crystal (near the corner of the XTAL) of the picture at
this place
Sounds likely that some pads there are JTAG (after all the JTAG balls are in the upper area of the middle line of the PXA255).
The actual test points
These test points have NOT been functionally verified yet, so they might still be (partially) incorrect!
AndreasMohr, 040425: In fact I tried to do a JTAG connection recently, but I was UNSUCCESSFUL (JTAG Tools "detect" didn't find anything, whereas it works with my JTAG-capable Access Point), and one cause of that might be voltage potential differences between PC power supply and Axim PS. I should try to implement an opto-coupled version of my JTAG adapter sometime...But OTOH it might very well be that we have errors in our JTAG pin list below.
So whatever you intend to do with the information below, do it CAREFULLY!
Suspected/measured JTAG pins (balls) on the PXA255 are:
-
nTRST (H11): on the back side, between battery connector and CF socket, test point just north-east of the third battery contact.
-
TCK (H12): on the back side, test point connected to 4 resistors near RN509 (at 3rd resistor) (WRONG!? See below...)
-
TMS (H13): the test point just to the left of nTRST, almost due north from the battery contact
-
TDI (H15): on the front side, the second test point (from the left) of a group of 4 test points just above the LCD connector, between the connector pins and the leftmost of the two LV245s
-
TDO (H16): on the front side, at right lower side of big quartz housing just above PXA255
Annotated pictures of the JTAG test points on Axim PCB back and front side can be found
here (back) and
also here (front)
[autumn 2004] Phil Blundell now told me that TCK is most likely wrong:
<pb_> oh ho! TCK seems to be wrong.
> pb_: really??? hmm. would be useful to know the correct pin
<pb_> AndiM: on your picture, you have TCK on the TP directly south of RN509.
But it appears that it's actually the TP a little way northwest of that, below
the second of the four chip resistors (counting from the right)
I haven't had the time to test it yet (my desktop PC died, and I didn't want to use my notebook parallel port, and I got my first job and moved homes, so this had to wait way too long)
How we did it
Thanks to the help of Philip Blundell (pin measurements on desoldered device) we were able to find out the JTAG pins on the Axim (using my special measurement method to close in on potential candidates first). Greg Gilbert's generous donation of a sacrificial Axim made this possible.Philipp just checked the pins I suspected below, and it seems he had great success! (the only JTAG pin not identified yet is TDI)
Unfortunately most of his pins don't correlate with what I measured.
AndreasMohr, 0402xx: In order to find out the test points leading to JTAG balls, I used a very small conductive wire, moved it under the PXA255 to one ball line which contains some JTAG related balls, made sure to keep the wire as much as possible in contact with all balls of that ball line (by pulling the wire tightly), then tried to do some resistance measurement against various test points nearby.
When I got a winner (multimeter beeps), then I wrote down some note and then tried to verify later whether it actually is one of the JTAG pins by cross correlating with the 90 degree oriented ball line which also has that JTAG ball we suspect to be the one...
Unfortunately I wasn't able to identify too many JTAG test points that way...
Sure sounded much better than killing a whole Axim by de-microwaving a whole PXA255 Axim PCB, but it didn't help much.