iriver E150 information

---

SOC

ATJ2135 MIPS32r2 4KEc + DSP core.

SDRAM

The device has 8MB of sdram. The chip is Zentel A2V64S40CTP-G6 or A3V64S40ETP-G6 rated at 166Mhz.

FM

My e150 4Gb unit uses module with chip marked V24230 BLK9. According to disassembly of the driver this chip seems to be LV24230LP from Sanyo. FM is connected to I2C1 bus of ATJ2135. Slave address of the tuner is 0xC0.

LCD

NAND bootloader code seems to support three different lcd types but lcm.drv driver has support for only one type which according to disassembly seems to be HX8347-D lcd controller in rgb565 mode with 16bit parallel interface.

GPIO A16 drives lcd panel reset signal.

Init sequence

cmd	value	comment
0xea	0x00
0xeb	0x20
0xec	0x0f
0xed	0xc4
0xe8	0xc4
0xe9	0xc4
0xf1	0xc4
0xf2	0xc4
0x27	0xc4
0x40	0x00	gamma block start
0x41	0x00
0x42	0x01
0x43	0x13
0x44	0x10
0x45	0x26
0x46	0x08
0x47	0x81
0x48	0x02
0x49	0x12
0x4a	0x18
0x4b	0x19
0x4c	0x14
0x50	0x19
0x51	0x2f
0x52	0x2c
0x53	0x3e
0x54	0x3f
0x55	0x3f
0x56	0x3e
0x57	0x77
0x58	0x0b
0x59	0x06
0x5a	0x07
0x5b	0x0d
0x5c	0x1d
0x5d	0xcc	gamma block end
0x1b	0x1b
0x1a	0x01
0x24	0x2f
0x25	0x57
0x23	0x86
0x18	0x36	70Hz framerate
0x19	0x01	osc enable
0x01	0x00
0x1f	0x88	+ delay ~5ms
0x1f	0x80	+ delay ~5ms
0x1f	0x90	+ delay ~5ms
0x1f	0xd0	+ delay ~5ms
0x17	0x05	16bpp
0x36	0x00
0x28	0x38	+ delay ~40ms
0x28	0x3c
0x02	0x00	col start msb
0x03	0x00	col start lsb
0x04	0x00	col end msb
0x05	0xef	col end lsb
0x06	0x00	row start msb
0x07	0x00	row start lsb
0x08	0x01	row end msb
0x09	0x3f	row end lsb

Backlight

Backlight is controlled by atj213x internal PWM generator. Leds cathodes are connected to RT9300 current sink and PWM signal from SoC is connected to EN signal of RT9300.

GPIO

Based on disassembly and checked with help of hwstub

port	bit	dir	description
GPIOA	8	IN	power (active low)
GPIOA	10	IN	hold (active low)
GPIOA	12	IN	vol+ (active low)
GPIOA	13	OUT	KEEP_ALIVE signal ?
GPIOA	16	OUT	lcd controller reset (active low)
GPIOA	26	IN	headphone detect (active low)
GPIOB	22	IN	sd card detect (active low)
GPIOB	31	IN	vol- (active high)

Other 5 control keys are connected to 4-bit LRADC.

key	LRADC4 raw value
UP	0x02
LEFT	0x04
SELECT	0x06
DOWN	0x08
RIGHT	0x0c
NOT PRESSED	0x0f

USB core

USB core seems to be CAST cusb2 or cusb2-otg IP core. Datasheet is unavailable. This IP core (but with varying synthesis options enabled) is also used in Ralink RT3883, RT3352, MT7620, RT5350 SoCs. There is linux driver relased which is some source of information. The best matching documentation source is header file from atj2127 SDK. Cypress EZ-USB FX2 SoC also uses core which bears some similarities but register map is completely different.

Currently I stepped at this android SDK from actions which has usb driver which seems to match controller in atj213x.

The usb module base address is 0x100e0000 (0xb00e0000 kseg1 address). All offsets below are in respect to this base address. Registers are 8bit wide with exception of fifos which can be accessed in 32bit chunks.

offset	register name	descritpion
0x00	OUT0BC	ep0 OUT byte count
0x01	IN0BC	ep0 IN byte count
0x02	EP0CS	bit3 - OUT_BUSY, bit2 - IN_BUSY, bit1 - NAK (writing 1 clears), bit0 - STALL
0x08	OUT1BCL
0x09	OUT1BCH
0x0a	OUT1CON	bit7 - EP_ENABLE, bit6 - STALL, bit<3:2> - EP_TYPE (0b00 - reserved, 0b01 - isochronous, 0b10 - bulk, 0b11 - interrupt), bit<1:0> - number of subfifos (0b00 - single, 0b01 - double, 0b10 - triple, 0b11 - quad)
0x0b	OUT1CS	bit4 - auto, bit3 - npack1, bit2 - npack0, bit1 - BUSY, bit0 - ERROR
0x0c	IN1BCL
0x0d	IN1BCH
0x0e	IN1CON
0x0f	IN1CS
0x10	OUT2BCL	wild guess
0x11	OUT2BCH	wild guess
0x12	OUT2CON	from ralink source
0x13	OUT2CS	wild guess
0x14	IN2BCL	ep2 IN byte count LSB - write last
0x15	IN2BCH	ep2 IN byte count MSB
0x16	IN2CON	see OUT1CON description
0x17	IN2CS	see OUT1CS description
0x84	FIFO1DAT	ep1 fifo, access 32bit wide
0x88	FIFO2DAT	ep2 fifo, access 32bit wide
0x100	EP0INDAT	ep0 IN data buffer (0x40 bytes wide)
0x140	EP0OUTDAT	ep0 OUT data buffer (0x40 bytes wide)
0x180	SETUPDAT	setup packet data (8 bytes wide)
0x188	IN04IRQ	bit<2:0> epX in irq flag
0x18a	OUT04IRQ	bit<2:0> epX out irq flag
0x18c	USBIRQ	general usb core irq flags: bit5 - HS_MODE enter high speed operation, bit4 - USB_RESET, bit3 - USB_SUSPEND, bit2 - SETUP_TOKEN, bit1 - SOF, bit0 - SETUP_DATA Writing respective bit as 1 clears flag
0x194	IN04IEN	ep IN interrupt enable: bits<0:2> epX in irq enable
0x196	OUT04IEN	ep OUT interrupt enable: bits<0:2> epX out irq enable
0x198	USBIEN	general usb irq enable. see USBIRQ description for bits meaning
0x1a0	IVECT	vectored interrupt offset 0x00 - SETUP_DATA, 0x10 - USB_RESET, 0x14 - HS_MODE, 0x28 - BULK, 0xd8 - OTG_IDLE
0x1a2	ENDPRST	bit6 - fifo reset, bit5 - toggle reset, bit4 - in/out flag (1 for IN ep), bit<0:3> ep num
0x1a3	USBCS	bit6 - usb soft disconnect
0x1a4	UNKNOWN	16bit register
0x1a7	USBCLKGATE
0x1a8	FIFOCTRL	bit7 - unknown, bit5 - auto mode (dma), bit4 - in/out flag (1 for IN ep), bit<0:2> ep num
0x1bc	OTGIRQ	bit4 - peripherial, bit3 - vbuserr, bit2 - locksoft, bit1 - srp detect, bit0 - OTG_IDLE
0x1bd	USBSTATE
0x1be	OTGCTRL
0x1bf	OTGSTATUS	bit6, bit2 - usb cable connected if both set
0x1c0	OTGIEN	OTG irq enable
0x1e2	HCIN1MAXPCKL	ep1 IN max packet size LSB (set by core)
0x1e3	HCIN1MAXPCKH	ep1 IN max packet size MSB (set by core)
0x1e4	HCIN2MAXPCKL	ep2 IN max packet size LSB (from atj2127)
0x1e5	HCIN2MAXPCKH	ep2 IN max packet size MSB (from atj2127)
0x304	OUT1STADDR	ep1 OUT fifo start pointer in internal buffer
0x308	OUT2STADDR	ep2 OUT fifo start pointer in internal buffer (from atj2127)
0x344	IN1STADDR	ep1 IN fifo start pointer in internal buffer (from atj2127)
0x348	IN2STADDR	ep2 IN fifo start pointer in internal buffer
0x3e2	HCOUT1MAXPCKL	ep1 OUT max packet size LSB (atj2127)
0x3e3	HCOUT1MAXPCKH	ep1 OUT max packet size MSB (atj2127)
0x3e4	HCOUT2MAXPCKL	ep2 OUT max packet size LSB (set by core)
0x3e5	HCOUT2MAXPCKH	ep2 OUT max packet size MSB (set by core)
0x400	USBEIRQ	bit7 - usb irq, bit6 - wakeup irq, bit5 - resume irq, bit4 - connect/disconnect irq, bit3 - usbien, bit2 - wakeupien, bit1 - resumeien, bit0 - conndisconnien
0x401	OTGESTA
0x402	HCINCTRL
0x404	USBERESET	???
0x408	VDCTRL	phy related
0x409	VDSTAT	phy related
0x40a	OTGTSTCTRL
0x40c	DMAEPSEL	select epX for dma operation 0b00 - ?, 0b01 - ep1 IN, 0b11 - ep1 OUT, 0b0100 - ep2 IN, 0b1100 - ep2 OUT

DMA

There are total of 8 dma channels. Channels 0-3 utilize regular AHB bus, channels 4-7 use separate 'special' bus. DMA section of the datasheet doesn't mention peripheral select bits in mode registers. According to ds there are 6 'special' peripherals: SDRAM, IRAM, NAND, SD, OTG, LCM. DAC and ADC use regular AHB/APB bus. Here are my findings based on disassembly and other sources.

DTRG and STRG	meaning
0x06	DAC
0x07	ADC
0x10	SDRAM
0x11	IRAM
0x14	NAND
0x16	SD
0x17	OTG
0x18	LCM

Status

For now I am exploring the hardware. I can run small snippets of code, poke here and there.

• adfuload can be used to upload code for execution
• interrupts work
• timers and watchdog work
• backlight is working
• basic lcd support
• support for USB control transfers
• hwstub works