dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > IriverE150Info

iriver E150 information


ATJ2135 MIPS32r2 4KEc + DSP core.


The device has 8MB of sdram. The chip is Zentel A2V64S40CTP-G6 or A3V64S40ETP-G6 rated at 166Mhz.


My e150 4Gb unit uses module with chip marked V24230 BLK9. According to disassembly of the driver this chip seems to be LV24230LP from Sanyo. FM is connected to I2C1 bus of ATJ2135. Slave address of the tuner is 0xC0.


NAND bootloader code seems to support three different lcd types but lcm.drv driver has support for only one type which according to disassembly seems to be HX8347-D lcd controller in rgb565 mode with 16bit parallel interface.

GPIO A16 drives lcd panel reset signal.

Init sequence
cmd value comment
0xea 0x00  
0xeb 0x20  
0xec 0x0f  
0xed 0xc4  
0xe8 0xc4  
0xe9 0xc4  
0xf1 0xc4  
0xf2 0xc4  
0x27 0xc4  
0x40 0x00 gamma block start
0x41 0x00  
0x42 0x01  
0x43 0x13  
0x44 0x10  
0x45 0x26  
0x46 0x08  
0x47 0x81  
0x48 0x02  
0x49 0x12  
0x4a 0x18  
0x4b 0x19  
0x4c 0x14  
0x50 0x19  
0x51 0x2f  
0x52 0x2c  
0x53 0x3e  
0x54 0x3f  
0x55 0x3f  
0x56 0x3e  
0x57 0x77  
0x58 0x0b  
0x59 0x06  
0x5a 0x07  
0x5b 0x0d  
0x5c 0x1d  
0x5d 0xcc gamma block end
0x1b 0x1b  
0x1a 0x01  
0x24 0x2f  
0x25 0x57  
0x23 0x86  
0x18 0x36 70Hz framerate
0x19 0x01 osc enable
0x01 0x00  
0x1f 0x88 + delay ~5ms
0x1f 0x80 + delay ~5ms
0x1f 0x90 + delay ~5ms
0x1f 0xd0 + delay ~5ms
0x17 0x05 16bpp
0x36 0x00  
0x28 0x38 + delay ~40ms
0x28 0x3c  
0x02 0x00 col start msb
0x03 0x00 col start lsb
0x04 0x00 col end msb
0x05 0xef col end lsb
0x06 0x00 row start msb
0x07 0x00 row start lsb
0x08 0x01 row end msb
0x09 0x3f row end lsb


Backlight is controlled by atj213x internal PWM generator. Leds cathodes are connected to RT9300 current sink and PWM signal from SoC is connected to EN signal of RT9300.


Based on disassembly and checked with help of hwstub

port bit dir description
GPIOA 8 IN power (active low)
GPIOA 10 IN hold (active low)
GPIOA 12 IN vol+ (active low)
GPIOA 16 OUT lcd controller reset (active low)
GPIOA 26 IN headphone detect (active low)
GPIOB 22 IN sd card detect (active low)
GPIOB 31 IN vol- (active high)

Other 5 control keys are connected to 4-bit LRADC.

key LRADC4 raw value
UP 0x02
LEFT 0x04
DOWN 0x08
RIGHT 0x0c

USB core

USB core seems to be CAST cusb2 or cusb2-otg IP core. Datasheet is unavailable. This IP core (but with varying synthesis options enabled) is also used in Ralink RT3883, RT3352, MT7620, RT5350 SoCs. There is linux driver relased which is some source of information. The best matching documentation source is header file from atj2127 SDK. Cypress EZ-USB FX2 SoC also uses core which bears some similarities but register map is completely different.

Currently I stepped at this android SDK from actions which has usb driver which seems to match controller in atj213x.

The usb module base address is 0x100e0000 (0xb00e0000 kseg1 address). All offsets below are in respect to this base address. Registers are 8bit wide with exception of fifos which can be accessed in 32bit chunks.

offset register name descritpion
0x00 OUT0BC ep0 OUT byte count
0x01 IN0BC ep0 IN byte count
0x02 EP0CS bit3 - OUT_BUSY, bit2 - IN_BUSY, bit1 - NAK (writing 1 clears), bit0 - STALL
0x08 OUT1BCL  
0x09 OUT1BCH  
0x0a OUT1CON bit7 - EP_ENABLE, bit6 - STALL, bit<3:2> - EP_TYPE (0b00 - reserved, 0b01 - isochronous, 0b10 - bulk, 0b11 - interrupt), bit<1:0> - number of subfifos (0b00 - single, 0b01 - double, 0b10 - triple, 0b11 - quad)
0x0b OUT1CS bit4 - auto, bit3 - npack1, bit2 - npack0, bit1 - BUSY, bit0 - ERROR
0x0c IN1BCL  
0x0d IN1BCH  
0x0e IN1CON  
0x0f IN1CS  
0x10 OUT2BCL wild guess
0x11 OUT2BCH wild guess
0x12 OUT2CON from ralink source
0x13 OUT2CS wild guess
0x14 IN2BCL ep2 IN byte count LSB - write last
0x15 IN2BCH ep2 IN byte count MSB
0x16 IN2CON see OUT1CON description
0x17 IN2CS see OUT1CS description
0x84 FIFO1DAT ep1 fifo, access 32bit wide
0x88 FIFO2DAT ep2 fifo, access 32bit wide
0x100 EP0INDAT ep0 IN data buffer (0x40 bytes wide)
0x140 EP0OUTDAT ep0 OUT data buffer (0x40 bytes wide)
0x180 SETUPDAT setup packet data (8 bytes wide)
0x188 IN04IRQ bit<2:0> epX in irq flag
0x18a OUT04IRQ bit<2:0> epX out irq flag
0x18c USBIRQ general usb core irq flags: bit5 - HS_MODE enter high speed operation, bit4 - USB_RESET, bit3 - USB_SUSPEND, bit2 - SETUP_TOKEN, bit1 - SOF, bit0 - SETUP_DATA Writing respective bit as 1 clears flag
0x194 IN04IEN ep IN interrupt enable: bits<0:2> epX in irq enable
0x196 OUT04IEN ep OUT interrupt enable: bits<0:2> epX out irq enable
0x198 USBIEN general usb irq enable. see USBIRQ description for bits meaning
0x1a0 IVECT vectored interrupt offset 0x00 - SETUP_DATA, 0x10 - USB_RESET, 0x14 - HS_MODE, 0x28 - BULK, 0xd8 - OTG_IDLE
0x1a2 ENDPRST bit6 - fifo reset, bit5 - toggle reset, bit4 - in/out flag (1 for IN ep), bit<0:3> ep num
0x1a3 USBCS bit6 - usb soft disconnect
0x1a4 UNKNOWN 16bit register
0x1a8 FIFOCTRL bit7 - unknown, bit5 - auto mode (dma), bit4 - in/out flag (1 for IN ep), bit<0:2> ep num
0x1bc OTGIRQ bit4 - peripherial, bit3 - vbuserr, bit2 - locksoft, bit1 - srp detect, bit0 - OTG_IDLE
0x1bd USBSTATE  
0x1be OTGCTRL  
0x1bf OTGSTATUS bit6, bit2 - usb cable connected if both set
0x1c0 OTGIEN OTG irq enable
0x1e2 HCIN1MAXPCKL ep1 IN max packet size LSB (set by core)
0x1e3 HCIN1MAXPCKH ep1 IN max packet size MSB (set by core)
0x1e4 HCIN2MAXPCKL ep2 IN max packet size LSB (from atj2127)
0x1e5 HCIN2MAXPCKH ep2 IN max packet size MSB (from atj2127)
0x304 OUT1STADDR ep1 OUT fifo start pointer in internal buffer
0x308 OUT2STADDR ep2 OUT fifo start pointer in internal buffer (from atj2127)
0x344 IN1STADDR ep1 IN fifo start pointer in internal buffer (from atj2127)
0x348 IN2STADDR ep2 IN fifo start pointer in internal buffer
0x3e2 HCOUT1MAXPCKL ep1 OUT max packet size LSB (atj2127)
0x3e3 HCOUT1MAXPCKH ep1 OUT max packet size MSB (atj2127)
0x3e4 HCOUT2MAXPCKL ep2 OUT max packet size LSB (set by core)
0x3e5 HCOUT2MAXPCKH ep2 OUT max packet size MSB (set by core)
0x400 USBEIRQ bit7 - usb irq, bit6 - wakeup irq, bit5 - resume irq, bit4 - connect/disconnect irq, bit3 - usbien, bit2 - wakeupien, bit1 - resumeien, bit0 - conndisconnien
0x401 OTGESTA  
0x402 HCINCTRL  
0x404 USBERESET ???
0x408 VDCTRL phy related
0x409 VDSTAT phy related
0x40c DMAEPSEL select epX for dma operation 0b00 - ?, 0b01 - ep1 IN, 0b11 - ep1 OUT, 0b0100 - ep2 IN, 0b1100 - ep2 OUT


There are total of 8 dma channels. Channels 0-3 utilize regular AHB bus, channels 4-7 use separate 'special' bus. DMA section of the datasheet doesn't mention peripheral select bits in mode registers. According to ds there are 6 'special' peripherals: SDRAM, IRAM, NAND, SD, OTG, LCM. DAC and ADC use regular AHB/APB bus. Here are my findings based on disassembly and other sources.

DTRG and STRG meaning
0x06 DAC
0x07 ADC
0x10 SDRAM
0x11 IRAM
0x14 NAND
0x16 SD
0x17 OTG
0x18 LCM


For now I am exploring the hardware. I can run small snippets of code, poke here and there.

  • adfuload can be used to upload code for execution
  • interrupts work
  • timers and watchdog work
  • backlight is working
  • basic lcd support
  • support for USB control transfers
  • hwstub works

I Attachment Action Size Date Who Comment
ANLv24230S00ENG_Program_guid.pdfpdf ANLv24230S00ENG_Program_guid.pdf manage 553.8 K 31 Aug 2017 - 21:29 MarcinBukat LV24230 Application Note
HX8347-D_DS_T_v02_090324.pdfpdf HX8347-D_DS_T_v02_090324.pdf manage 4564.7 K 10 Oct 2014 - 08:50 MarcinBukat  
HX8347-G_DS_T_preliminary_v01_100203.pdfpdf HX8347-G_DS_T_preliminary_v01_100203.pdf manage 9354.5 K 15 Nov 2013 - 09:41 MarcinBukat  
LV24230LP.pdfpdf LV24230LP.pdf manage 133.9 K 29 Aug 2017 - 13:21 MarcinBukat  
Shematic_Iriver_E150.rarrar Shematic_Iriver_E150.rar manage 268.1 K 17 May 2011 - 14:14 MichaelGiacomelli copied from TargetStatus wiki page
r32 - 02 Apr 2021 - 20:46:06 - UnknownUser

Copyright © by the contributing authors.