Main Page
From ASULUG AirPanel Wiki
Welcome to the ASULUG AirPanel Wiki
This wiki is devoted to our research both personally, and on the internet, into hacking the Viewsonic Airpanel devices. Our current work revolves around the Airpanel 100 model. Click here for all viewpanel Tech_Specs. For Viewsonic V210_Notes and V212_Notes.
Contents |
SOFTWARE AND COMPATIBILITY
It is particularly tough to find software for the 4.1 cenet os. Redgear is a compatability product that shows some promise in running newer software, especially newer versions of opera mobile, on the 4.1 cenet os but the current version 1.0 doesnt officially support the airpanel. We weren't able to run opera or get anything else which installed to run without hardlocking.
dot net
this dot net framework upgrade installs and may also help for compatibility.
VNC
found a vnc client which installs (alternate link However, I have yet to be able to get a connection going to my tightvnc server which I can confirm has ports open from the device...
java
The ce 3.0 firmware has java installed already while the 4.1 does not.
[niscom http://www.nsicom.com/] claim to have a java product for ce.net devices. Their evaluations page lists the products as specifically for 4.2 but I contacted them and they seem to believe 4.1 would work fine.. The 4.12 product installed ok but doesn't seem to run any java pages or tests. They followed up telling me to "Try to move all the DLLs from \windows\creme\bin to \windows, and the Zip files from \windows\creme\lib as well (also to \windows)" But I have not tried this yet.
Development Software
CE Development
As I understand it you need something called a BSP Board Support Package to do os builds. Googling eventually led me to the following files which may be useful to someone in building custom roms..
http://rapidshare.com/files/198291140/WINCE410-BSP-SA11X0BD.zip
http://rapidshare.com/files/198293462/cec.zip
Strong Arm Development
The Chinese have beat us at our own game... theyre as we speak getting linux running on some other Stongarm device. I found a couple great forum links on strongarm hacking which happen to be entirely in chinese. This one is translatable through google. http://www2.ourdev.cn/bbs/bbs_content_all.jsp?bbs_sn=1420850 however is too large to translate, though you can copy and paste text out of it though to be translated. Of particular interest there appears to be a very large cache of documents and other things in rar files on here that I have yet to explore...
Files mirrored below
http://rapidshare.com/files/198257437/sa1110.part1.rar
http://rapidshare.com/files/198266638/sa1110.part2.rar
http://rapidshare.com/files/198266639/sa1110.part3.rar
http://rapidshare.com/files/198266640/sa1110.part4.rar
http://rapidshare.com/files/198266642/sa1110.part5.rar
http://rapidshare.com/files/198266643/sa1110.part6.rar
One of the RAR files contained a well written powerpoint on how to install linux on the sa1110 once you have been able to JTAG to it. They used redboot as the bootloader and then went from there. Here's the Translated Powerpoint
TESTED HARDWARE LIST
Orinoco cards of model PC24E-H-FC (Part Number 014916) cards seem to work natively within Windows CE 4.1. We have successfully tested P/N: 014916/D and P/N: 014916/F
Note there are rebadged IBM's model PC24E-H-FC P/N: 015545/B that DO NOT work natively.
The Orinoco cards must be 16-bit and not 32-bit
- Most USB Flash drives will work with no problems
However Large USB flash drives (8 GB+) will sometimes lock up the CE OS when removed
Debug Port Pinout (JTAG/Serial)
We found info at the hpcfactor forums indicating the serial connector's existence and the pinouts for TX, RX, and ground on that connector.
We followed the procedure at here to find the jtag pinouts.
JTAG and Serial Pinout
-----
- -
Battery
- -
-----
11 09 07 05 03 01
12 10 08 06 04 02
pin 12 is ??
pin 11 is ???
pin 10 is RS-232 input, from your PC's TXD line
pin 9 is RS-232 FROM the device, to your PC's RXD line
pin 8 is tck
pin 7 is ntrst
pin 6 is tms
pin 5 is gnd
pin 4 is tdo
pin 3 is gnd
pin 2 is tdi
pin 1 is gnd
Serial Console Access on v100
The ce 3.10 firmwares do NOT output to console or have the debug prompt when holding the center key. The 4.1 firmwares do however.
The back panel is removed with a single screw and provides access to an debug port sans header.
We have instructions on adding an RS232 header onto your v100 board at the Header_for_Serial_on_V100 page. You'll need to do that first. After you have a header on your v100, you'll need to visit the Making_Serial_Cable_V100 page to make the serial cable.
Once you have the above completed, you'll need to attach the cable to an open serial port on your computer. Then, using your favorite terminal program, open a connection on that COM port using 38400,8,none,1,X/On-X/Off. When you reboot your machine, you should see the following:
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
pSA111Gpio pddr BF
pSA111Gpio pdr 0
pSA111Gpio pddr BF
pSA111Gpio pdr 40
Checking to ensure we're in Power State DO
Power State DO confirmed
MQGC::SetMQMode - in D0 state now ...
MQGC::SetMQMode - SameImage
SetMQPLL 2 to 40 MHz
Enable LCD output at GC1
WaitForPowerSeqOff: waited 1 cycles
MQGC::SetMQMode done!
Windows CE Ethernet Bootloader v1.06 for ViewSonic ViewPad 100 built Jul 1 2002 10:48:44
Copyright (c) 2002 Stellcom Technologies Inc.
NE2000 Boot Loader, Version 4.5n
Stack=8C067F9Ch
Flag 1=00000000h
Flag 1=00000000h
DRIVER_GLOBALS AC021000h
DRIVER_GLOBALS->misc AC021300h
DRIVER_GLOBALS->misc.webUpdateMagic AC02131Ch
Testing magic number DFDFFFFEh
webUpdateMemPointer FFEF7F7Fh
No CF Card Present, check for valid CE image in Flash
+ Boot Monitor
Prepare to Launch CE !!
Trying to find CE image in FLASH.
Auto Launch of Flash image
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
Windows CE Kernel for ARM Built on Feb 12 2003 at 15:37:33
ProcessorType=0b11 Revision=9
sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800
WinCE 4.1 kern_0100.exe
Hard Reset Detected. Forcing Cold Boot.
Initialize timer used for delays in the HAL
InitClock...
Initialize driver globals area...
Clear pending interrupts...
enabling serial port timeout interrupt (OSMR2)
OEM Init: Initializing the Registry library...
OEM Init: Registry library initialized.
Firmware Init Done.
Sp=ffffc7d0
IPSM Start = 0x1e80000
IPSM Length= 0x180000
IPSM Start = 0x1e80000
IPSM Length= 0x180000
WinCE 4.1 PCMCIA_0200_beta.dll (Xpilot's PDD & 4.1's MDD)
WinCE 4.0 Audio_0101.dll
OHCIPddInit trying to init object
OHCIPdd Init Interface Reset done +
OHCIPdd Init OHCI CreateOBject +
Scanning Installed Providers
Installing Layered Providers
Installed over Windows CE MS Tcpip [UDP/IPv6].
Installed over Windows CE MS Tcpip [UDP/IPv6].
Installed over Windows CE MS Tcpip [TCP/IPv6].
Installed over Windows CE MS Tcpip [TCP/IPv6].
Installed over Windows CE MS Tcpip [UDP/IP].
Installed over Windows CE MS Tcpip [UDP/IP].
Installed over Windows CE MS Tcpip [TCP/IP].
Installed over Windows CE MS Tcpip [TCP/IP].
Can't Reorder under CEPreparing To Reoder Installed Chains
WinCE 4.1 PwrButton_0101.dll
WinCE 4.1 mq200drv_0102.dll ...
WinCE 4.1 KbdMSEngUS1_0101-2.dll
KB reset
KeybdFound.
MouseFound.
WinCE 4.0 Touch_0400.dll
WinCE 4.1 -App- SetTime_0100.exe by Will
Year: 2003, Month: 5, Day: 9, DayOfWeek: 5, Hour: 0, Minute: 0, second: 0, Milliseconds: 0
LaunchPro_0300 has executed
No calibration data, attempting to calibrate.
Calling routine TouchCalibrate().
No calibration data, attempting to calibrate.
Calling routine TouchCalibrate().
DEBUG CONSOLE
The real win here, however, was holding the center button during boot which provided a menu of options to choose from:
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
pSA111Gpio pddr BF
pSA111Gpio pdr 0
pSA111Gpio pddr BF
pSA111Gpio pdr 41
Checking to ensure we're in Power State DO
Power State DO confirmed
MQGC::SetMQMode - in D0 state now ...
MQGC::SetMQMode - SameImage
SetMQPLL 2 to 40 MHz
Enable LCD output at GC1
WaitForPowerSeqOff: waited 1 cycles
MQGC::SetMQMode done!
Windows CE Ethernet Bootloader v1.06 for ViewSonic ViewPad 100 built Jul 1 2002 10:48:44
Copyright (c) 2002 Stellcom Technologies Inc.
NE2000 Boot Loader, Version 4.5n
Stack=8C067F9Ch
Flag 1=00000000h
Flag 1=00000000h
DRIVER_GLOBALS AC021000h
DRIVER_GLOBALS->misc AC021300h
DRIVER_GLOBALS->misc.webUpdateMagic AC02131Ch
Testing magic number DFDFFFFEh
webUpdateMemPointer FFEF7F7Fh
No CF Card Present, check for valid CE image in Flash
+ Boot Monitor
Center Button is Pressed
Ethernet Boot Loader Configuration:
D) Download Image Now
L) Launch Existing Flash Image
M) Invoke Mini-Monitor
U) Write UUID to Flash
Enter your selection: d
memset(0x8C09C000,0x000000FF,0x02000000)
PCMCIA misc.EbootDevice =255
Booting PCMCIA Lan Card on ViewPad 100 Board...
No supported PCMCIA card detected
Determining type of card at address 0xFFFFFFFF
+EDBG:NE2000Init
EDBG:NE2000Init using I/O range at 0xB8000300
EDBG:NE2000Init:HWInit failed to read cmd reg
-EDBG:NE2000Init
Failed to initialize NE2000 Ethernet board 1
Invalid Ethernet address read from NE2000 board
! Fatal error in Ethernet Bootloader, halting...
Enter your selection: m
Monitor For ViewSonic ViewPad using Intel SA-1110 Platform @ 206MHz
Commands -- Help
h -- This menu
e -- Exit this Monitor and Enter Bootloader
r -- Read loopCount times @address+increment
w data -- Write data loopCount times @address+increment
a address -- Set address for r/w/rucb/wucb
l loopCount -- Set loop count
i increment -- Set increment
s [byte,word,long,sn] -- Set byte word or dword mode or serial num
t [ram] -- Test Specific function
D 0x8C067EEC 1 1 >h
Monitor For ViewSonic ViewPad using Intel SA-1110 Platform @ 206MHz
Commands -- Help
h -- This menu
e -- Exit this Monitor and Enter Bootloader
r -- Read loopCount times @address+increment
w data -- Write data loopCount times @address+increment
a address -- Set address for r/w/rucb/wucb
l loopCount -- Set loop count
i increment -- Set increment
s [byte,word,long,sn] -- Set byte word or dword mode or serial num
t [ram] -- Test Specific function
LONG:0x8C067EEC 1 1 >e
Enter your selection: m
Monitor For ViewSonic ViewPad using Intel SA-1110 Platform @ 206MHz
Commands -- Help
h -- This menu
e -- Exit this Monitor and Enter Bootloader
r -- Read loopCount times @address+increment
w data -- Write data loopCount times @address+increment
a address -- Set address for r/w/rucb/wucb
l loopCount -- Set loop count
i increment -- Set increment
s [byte,word,long,sn] -- Set byte word or dword mode or serial num
t [ram] -- Test Specific function
D 0x8C067EEC 1 1 >t 0
LONG:0x8C067EEC 1 1 >t 1
LONG:0x8C067EEC 1 1 >e
Enter your selection: l
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
Windows CE Kernel for ARM Built on Feb 12 2003 at 15:37:33
ProcessorType=0b11 Revision=9
sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800
WinCE 4.1 kern_0100.exe
Initialize timer used for delays in the HAL
InitClock...
Initialize driver globals area...
Clear pending interrupts...
enabling serial port timeout interrupt (OSMR2)
OEM Init: Initializing the Registry library...
OEM Init: Registry library initialized.
Firmware Init Done.
Sp=ffffc7d0
IPSM Start = 0x1e80000
IPSM Length= 0x180000
IPSM Start = 0x1e80000
IPSM Length= 0x180000
WinCE 4.1 PCMCIA_0200_beta.dll (Xpilot's PDD & 4.1's MDD)
WinCE 4.0 Audio_0101.dll
OHCIPddInit trying to init object
OHCIPdd Init Interface Reset done +
OHCIPdd Init OHCI CreateOBject +
Scanning Installed Providers
Installing Layered Providers
Installed over Windows CE MS Tcpip [UDP/IPv6].
Installed over Windows CE MS Tcpip [UDP/IPv6].
Installed over Windows CE MS Tcpip [TCP/IPv6].
Installed over Windows CE MS Tcpip [TCP/IPv6].
Installed over Windows CE MS Tcpip [UDP/IP].
Installed over Windows CE MS Tcpip [UDP/IP].
Installed over Windows CE MS Tcpip [TCP/IP].
Installed over Windows CE MS Tcpip [TCP/IP].
Can't Reorder under CEPreparing To Reoder Installed Chains
WinCE 4.1 PwrButton_0101.dll
WinCE 4.1 mq200drv_0102.dll ...
WinCE 4.1 KbdMSEngUS1_0101-2.dll
KB reset
KeybdFound.
MouseFound.
WinCE 4.0 Touch_0400.dll
WinCE 4.1 -App- SetTime_0100.exe by Will
Year: 2003, Month: 5, Day: 9, DayOfWeek: 5, Hour: 0, Minute: 0, second: 0, Milliseconds: 0
LaunchPro_0300 has executed
No calibration data, attempting to calibrate.
Calling routine TouchCalibrate().
No calibration data, attempting to calibrate.
Calling routine TouchCalibrate().
**HALPlatformStr : HPC**HALPlatformStr : HPCKB reset
**HALPlatformStr : HPC**HALPlatformStr : HPCMQGC::SetMQMode - SameImage
SetMQPLL 2 to 40 MHz
Enable LCD output at GC1
WaitForPowerSeqOff: waited 1 cycles
MQGC::SetMQMode done!
Console output from legitimate ROM Flash
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
pSA111Gpio pddr B9
pSA111Gpio pdr 1
pSA111Gpio pddr B9
pSA111Gpio pdr 40
Checking to ensure we're in Power State DO
Power State DO confirmed
MQGC::SetMQMode - in D0 state now ...
MQGC::SetMQMode - SameImage
SetMQPLL 2 to 40 MHz
Enable LCD output at GC1
WaitForPowerSeqOff: waited 1 cycles
MQGC::SetMQMode done!
Windows CE Ethernet Bootloader v1.06 for ViewSonic ViewPad 100 built Jul 1 2002 10:48:44
Copyright (c) 2002 Stellcom Technologies Inc.
NE2000 Boot Loader, Version 4.5n
Stack=8C067F9Ch
Flag 1=00000000h
Flag 1=00000000h
DRIVER_GLOBALS AC021000h
DRIVER_GLOBALS->misc AC021300h
DRIVER_GLOBALS->misc.webUpdateMagic AC02131Ch
Testing magic number 3EFED3FBh
webUpdateMemPointer B76FF5DFh
power Slot 1 3.3v =0000000Bh
SLOT1 is attribute space
CF CARD FOUND, CALL ATA DISK INIT CODE!!
DownloadAndFlashBIN: EBOOT.BIN startCluster = 7F, fileSize = 1604F
ProcessBinFileBuffer: dwPhysStart = 8C078000, dwPhysLen = 17CC8
Offset is FFFDC000
Record: Addr 8C078000, Len 00000004, checksum 000001EB
Record: Addr 8C078040, Len 00000008, checksum 000002E4
Record: Addr 8C079000, Len 00011D0C, checksum 0070A054
Record: Addr 8C08B000, Len 00000600, checksum 0001821B
Record: Addr 8C08C000, Len 00003C44, checksum 0017DAB0
Record: Addr 8C08FC44, Len 00000054, checksum 00000C21
Record: Addr 8C08FC98, Len 00000030, checksum 00000DED
Record: Addr 00000000, Len 8C079000, checksum 00000000
End of image. Launch address = 8C079000h
FlashWrite: Phys Start: 80000000h, Phys Len 00017CC8h
FlashWrite: dwStartBlock 0, dwEndBlock 0, dwFirstBlockOffset 00000000h
Flash Unlock Block 0 - Done
Flash Erase 0 - Done
Writing 97480 bytes to flash at 0xA0000000
Flash Write: 1%
Flash Write: 2%
Flash Write: 3%
Flash Write: 4%
Flash Write: 5%
Flash Write: 6%
Flash Write: 7%
Flash Write: 8%
Flash Write: 9%
Flash Write: 10%
Flash Write: 11%
Flash Write: 12%
Flash Write: 13%
Flash Write: 14%
Flash Write: 15%
Flash Write: 16%
Flash Write: 17%
Flash Write: 18%
Flash Write: 19%
Flash Write: 20%
Flash Write: 21%
Flash Write: 22%
Flash Write: 23%
Flash Write: 24%
Flash Write: 25%
Flash Write: 26%
Flash Write: 27%
Flash Write: 28%
Flash Write: 29%
Flash Write: 30%
Flash Write: 31%
Flash Write: 32%
Flash Write: 33%
Flash Write: 34%
Flash Write: 35%
Flash Write: 36%
Flash Write: 37%
Flash Write: 38%
Flash Write: 39%
Flash Write: 40%
Flash Write: 41%
Flash Write: 42%
Flash Write: 43%
Flash Write: 44%
Flash Write: 45%
Flash Write: 46%
Flash Write: 47%
Flash Write: 48%
Flash Write: 49%
Flash Write: 50%
Flash Write: 51%
Flash Write: 52%
Flash Write: 53%
Flash Write: 54%
Flash Write: 55%
Flash Write: 56%
Flash Write: 57%
Flash Write: 58%
Flash Write: 59%
Flash Write: 60%
Flash Write: 61%
Flash Write: 62%
Flash Write: 63%
Flash Write: 64%
Flash Write: 65%
Flash Write: 66%
Flash Write: 67%
Flash Write: 68%
Flash Write: 69%
Flash Write: 70%
Flash Write: 71%
Flash Write: 72%
Flash Write: 73%
Flash Write: 74%
Flash Write: 75%
Flash Write: 76%
Flash Write: 77%
Flash Write: 78%
Flash Write: 79%
Flash Write: 80%
Flash Write: 81%
Flash Write: 82%
Flash Write: 83%
Flash Write: 84%
Flash Write: 85%
Flash Write: 86%
Flash Write: 87%
Flash Write: 88%
Flash Write: 89%
Flash Write: 90%
Flash Write: 91%
Flash Write: 92%
Flash Write: 93%
Flash Write: 94%
Flash Write: 95%
Flash Write: 96%
Flash Write: 97%
Flash Write: 98%
Flash Write: 99%
Flash Write: 100%
Flash Write: 100%
Verifying Flash Data - Done
Flash Lock Block 0 - Done
FILE_DIAG_BIN download/flash failed
FILE_DIAG_NB0 download/flash failed
DownloadAndFlashBIN: NK.BIN startCluster = 2, fileSize = 13DFEA3
ProcessBinFileBuffer: dwPhysStart = 80080000, dwPhysLen = 13ED868
Offset is F3FE4000
Record: Addr 80080000, Len 00000004, checksum 000001EB
Record: Addr 80080040, Len 00000008, checksum 000002B1
Record: Addr 80081000, Len 0003AFF0, checksum 0178699A
Record: Addr 800BC000, Len 0014600C, checksum 0817807B
Record: Addr 80203000, Len 00036134, checksum 014BD3C9
Record: Addr 8023A000, Len 000F317C, checksum 05EE34C2
Record: Addr 8032E000, Len 0003F07C, checksum 017E098A
Record: Addr 8036E000, Len 0000AF9C, checksum 0042CCAC
Record: Addr 80378F9C, Len 00000054, checksum 00001C51
Record: Addr 80378FF0, Len 0007E014, checksum 03013BD9
Record: Addr 803F8000, Len 000031C4, checksum 00132D13
Record: Addr 803FC000, Len 000151A8, checksum 0085F751
Record: Addr 80412000, Len 0012C1E0, checksum 07589C2F
Record: Addr 8053F000, Len 000441D4, checksum 01A9AD4F
Record: Addr 80584000, Len 00021F94, checksum 00D024DC
Record: Addr 805A5F94, Len 00000054, checksum 00001459
Record: Addr 805A5FE8, Len 000F507C, checksum 0603C872
Record: Addr 8069C000, Len 00076FE0, checksum 02E77E95
Record: Addr 80713000, Len 0003A194, checksum 017F4C71
Record: Addr 8074E000, Len 00369FE8, checksum 147B2933
Record: Addr 80AB8000, Len 00067FA4, checksum 02765E7A
Record: Addr 80B1FFA4, Len 00000054, checksum 000016B4
Record: Addr 80B20000, Len 00006F98, checksum 00249760
Record: Addr 80B26F98, Len 00000054, checksum 00001825
Record: Addr 80B26FEC, Len 0006EFF0, checksum 026D5B58
Record: Addr 80B96000, Len 00013200, checksum 00CD0723
Record: Addr 80BAA000, Len 0000314C, checksum 001219BA
Record: Addr 80BAE000, Len 00002574, checksum 000CE080
Record: Addr 80BB1000, Len 008B9E2C, checksum 358C9F4D
Record: Addr 8146AE2C, Len 00000054, checksum 00000E6E
Record: Addr 8146AE80, Len 000029E8, checksum 000DDCBF
Record: Addr 00000000, Len 80081000, checksum 00000000
End of image. Launch address = 80081000h
FlashWrite: Phys Start: 80080000h, Phys Len 013ED868h
FlashWrite: dwStartBlock 2, dwEndBlock 127, dwFirstBlockOffset 00000000h
Flash Unlock Block 2
Flash Unlock Block 3
Flash Unlock Block 4
Flash Unlock Block 5
Flash Unlock Block 6
Flash Unlock Block 7
Flash Unlock Block 8
Flash Unlock Block 9
Flash Unlock Block A
Flash Unlock Block B
Flash Unlock Block C
Flash Unlock Block D
Flash Unlock Block E
Flash Unlock Block F
Flash Unlock Block 10
Flash Unlock Block 11
Flash Unlock Block 12
Flash Unlock Block 13
Flash Unlock Block 14
Flash Unlock Block 15
Flash Unlock Block 16
Flash Unlock Block 17
Flash Unlock Block 18
Flash Unlock Block 19
Flash Unlock Block 1A
Flash Unlock Block 1B
Flash Unlock Block 1C
Flash Unlock Block 1D
Flash Unlock Block 1E
Flash Unlock Block 1F
Flash Unlock Block 20
Flash Unlock Block 21
Flash Unlock Block 22
Flash Unlock Block 23
Flash Unlock Block 24
Flash Unlock Block 25
Flash Unlock Block 26
Flash Unlock Block 27
Flash Unlock Block 28
Flash Unlock Block 29
Flash Unlock Block 2A
Flash Unlock Block 2B
Flash Unlock Block 2C
Flash Unlock Block 2D
Flash Unlock Block 2E
Flash Unlock Block 2F
Flash Unlock Block 30
Flash Unlock Block 31
Flash Unlock Block 32
Flash Unlock Block 33
Flash Unlock Block 34
Flash Unlock Block 35
Flash Unlock Block 36
Flash Unlock Block 37
Flash Unlock Block 38
Flash Unlock Block 39
Flash Unlock Block 3A
Flash Unlock Block 3B
Flash Unlock Block 3C
Flash Unlock Block 3D
Flash Unlock Block 3E
Flash Unlock Block 3F
Flash Unlock Block 40
Flash Unlock Block 41
Flash Unlock Block 42
Flash Unlock Block 43
Flash Unlock Block 44
Flash Unlock Block 45
Flash Unlock Block 46
Flash Unlock Block 47
Flash Unlock Block 48
Flash Unlock Block 49
Flash Unlock Block 4A
Flash Unlock Block 4B
Flash Unlock Block 4C
Flash Unlock Block 4D
Flash Unlock Block 4E
Flash Unlock Block 4F
Flash Unlock Block 50
Flash Unlock Block 51
Flash Unlock Block 52
Flash Unlock Block 53
Flash Unlock Block 54
Flash Unlock Block 55
Flash Unlock Block 56
Flash Unlock Block 57
Flash Unlock Block 58
Flash Unlock Block 59
Flash Unlock Block 5A
Flash Unlock Block 5B
Flash Unlock Block 5C
Flash Unlock Block 5D
Flash Unlock Block 5E
Flash Unlock Block 5F
Flash Unlock Block 60
Flash Unlock Block 61
Flash Unlock Block 62
Flash Unlock Block 63
Flash Unlock Block 64
Flash Unlock Block 65
Flash Unlock Block 66
Flash Unlock Block 67
Flash Unlock Block 68
Flash Unlock Block 69
Flash Unlock Block 6A
Flash Unlock Block 6B
Flash Unlock Block 6C
Flash Unlock Block 6D
Flash Unlock Block 6E
Flash Unlock Block 6F
Flash Unlock Block 70
Flash Unlock Block 71
Flash Unlock Block 72
Flash Unlock Block 73
Flash Unlock Block 74
Flash Unlock Block 75
Flash Unlock Block 76
Flash Unlock Block 77
Flash Unlock Block 78
Flash Unlock Block 79
Flash Unlock Block 7A
Flash Unlock Block 7B
Flash Unlock Block 7C
Flash Unlock Block 7D
Flash Unlock Block 7E
Flash Unlock Block 7F - Done
Flash Erase 2
Flash Erase 3
Flash Erase 4
Flash Erase 5
Flash Erase 6
Flash Erase 7
Flash Erase 8
Flash Erase 9
Flash Erase A
Flash Erase B
Flash Erase C
Flash Erase D
Flash Erase E
Flash Erase F
Flash Erase 10
Flash Erase 11
Flash Erase 12
Flash Erase 13
Flash Erase 14
Flash Erase 15
Flash Erase 16
Flash Erase 17
Flash Erase 18
Flash Erase 19
Flash Erase 1A
Flash Erase 1B
Flash Erase 1C
Flash Erase 1D
Flash Erase 1E
Flash Erase 1F
Flash Erase 20
Flash Erase 21
Flash Erase 22
Flash Erase 23
Flash Erase 24
Flash Erase 25
Flash Erase 26
Flash Erase 27
Flash Erase 28
Flash Erase 29
Flash Erase 2A
Flash Erase 2B
Flash Erase 2C
Flash Erase 2D
Flash Erase 2E
Flash Erase 2F
Flash Erase 30
Flash Erase 31
Flash Erase 32
Flash Erase 33
Flash Erase 34
Flash Erase 35
Flash Erase 36
Flash Erase 37
Flash Erase 38
Flash Erase 39
Flash Erase 3A
Flash Erase 3B
Flash Erase 3C
Flash Erase 3D
Flash Erase 3E
Flash Erase 3F
Flash Erase 40
Flash Erase 41
Flash Erase 42
Flash Erase 43
Flash Erase 44
Flash Erase 45
Flash Erase 46
Flash Erase 47
Flash Erase 48
Flash Erase 49
Flash Erase 4A
Flash Erase 4B
Flash Erase 4C
Flash Erase 4D
Flash Erase 4E
Flash Erase 4F
Flash Erase 50
Flash Erase 51
Flash Erase 52
Flash Erase 53
Flash Erase 54
Flash Erase 55
Flash Erase 56
Flash Erase 57
Flash Erase 58
Flash Erase 59
Flash Erase 5A
Flash Erase 5B
Flash Erase 5C
Flash Erase 5D
Flash Erase 5E
Flash Erase 5F
Flash Erase 60
Flash Erase 61
Flash Erase 62
Flash Erase 63
Flash Erase 64
Flash Erase 65
Flash Erase 66
Flash Erase 67
Flash Erase 68
Flash Erase 69
Flash Erase 6A
Flash Erase 6B
Flash Erase 6C
Flash Erase 6D
Flash Erase 6E
Flash Erase 6F
Flash Erase 70
Flash Erase 71
Flash Erase 72
Flash Erase 73
Flash Erase 74
Flash Erase 75
Flash Erase 76
Flash Erase 77
Flash Erase 78
Flash Erase 79
Flash Erase 7A
Flash Erase 7B
Flash Erase 7C
Flash Erase 7D
Flash Erase 7E
Flash Erase 7F - Done
Writing 20895848 bytes to flash at 0xA0080000
Flash Write: 1%
Flash Write: 2%
Flash Write: 3%
Flash Write: 4%
Flash Write: 5%
Flash Write: 6%
Flash Write: 7%
Flash Write: 8%
Flash Write: 9%
Flash Write: 10%
Flash Write: 11%
Flash Write: 12%
Flash Write: 13%
Flash Write: 14%
Flash Write: 15%
Flash Write: 16%
Flash Write: 17%
Flash Write: 18%
Flash Write: 19%
Flash Write: 20%
Flash Write: 21%
Flash Write: 22%
Flash Write: 23%
Flash Write: 24%
Flash Write: 25%
Flash Write: 26%
Flash Write: 27%
Flash Write: 28%
Flash Write: 29%
Flash Write: 30%
Flash Write: 31%
Flash Write: 32%
Flash Write: 33%
Flash Write: 34%
Flash Write: 35%
Flash Write: 36%
Flash Write: 37%
Flash Write: 38%
Flash Write: 39%
Flash Write: 40%
Flash Write: 41%
Flash Write: 42%
Flash Write: 43%
Flash Write: 44%
Flash Write: 45%
Flash Write: 46%
Flash Write: 47%
Flash Write: 48%
Flash Write: 49%
Flash Write: 50%
Flash Write: 51%
Flash Write: 52%
Flash Write: 53%
Flash Write: 54%
Flash Write: 55%
Flash Write: 56%
Flash Write: 57%
Flash Write: 58%
Flash Write: 59%
Flash Write: 60%
Flash Write: 61%
Flash Write: 62%
Flash Write: 63%
Flash Write: 64%
Flash Write: 65%
Flash Write: 66%
Flash Write: 67%
Flash Write: 68%
Flash Write: 69%
Flash Write: 70%
Flash Write: 71%
Flash Write: 72%
Flash Write: 73%
Flash Write: 74%
Flash Write: 75%
Flash Write: 76%
Flash Write: 77%
Flash Write: 78%
Flash Write: 79%
Flash Write: 80%
Flash Write: 81%
Flash Write: 82%
Flash Write: 83%
Flash Write: 84%
Flash Write: 85%
Flash Write: 86%
Flash Write: 87%
Flash Write: 88%
Flash Write: 89%
Flash Write: 90%
Flash Write: 91%
Flash Write: 92%
Flash Write: 93%
Flash Write: 94%
Flash Write: 95%
Flash Write: 96%
Flash Write: 97%
Flash Write: 98%
Flash Write: 99%
Flash Write: 100%
Flash Write: 100%
Verifying Flash Data - Done
Flash Lock Block 2
Flash Lock Block 3
Flash Lock Block 4
Flash Lock Block 5
Flash Lock Block 6
Flash Lock Block 7
Flash Lock Block 8
Flash Lock Block 9
Flash Lock Block A
Flash Lock Block B
Flash Lock Block C
Flash Lock Block D
Flash Lock Block E
Flash Lock Block F
Flash Lock Block 10
Flash Lock Block 11
Flash Lock Block 12
Flash Lock Block 13
Flash Lock Block 14
Flash Lock Block 15
Flash Lock Block 16
Flash Lock Block 17
Flash Lock Block 18
Flash Lock Block 19
Flash Lock Block 1A
Flash Lock Block 1B
Flash Lock Block 1C
Flash Lock Block 1D
Flash Lock Block 1E
Flash Lock Block 1F
Flash Lock Block 20
Flash Lock Block 21
Flash Lock Block 22
Flash Lock Block 23
Flash Lock Block 24
Flash Lock Block 25
Flash Lock Block 26
Flash Lock Block 27
Flash Lock Block 28
Flash Lock Block 29
Flash Lock Block 2A
Flash Lock Block 2B
Flash Lock Block 2C
Flash Lock Block 2D
Flash Lock Block 2E
Flash Lock Block 2F
Flash Lock Block 30
Flash Lock Block 31
Flash Lock Block 32
Flash Lock Block 33
Flash Lock Block 34
Flash Lock Block 35
Flash Lock Block 36
Flash Lock Block 37
Flash Lock Block 38
Flash Lock Block 39
Flash Lock Block 3A
Flash Lock Block 3B
Flash Lock Block 3C
Flash Lock Block 3D
Flash Lock Block 3E
Flash Lock Block 3F
Flash Lock Block 40
Flash Lock Block 41
Flash Lock Block 42
Flash Lock Block 43
Flash Lock Block 44
Flash Lock Block 45
Flash Lock Block 46
Flash Lock Block 47
Flash Lock Block 48
Flash Lock Block 49
Flash Lock Block 4A
Flash Lock Block 4B
Flash Lock Block 4C
Flash Lock Block 4D
Flash Lock Block 4E
Flash Lock Block 4F
Flash Lock Block 50
Flash Lock Block 51
Flash Lock Block 52
Flash Lock Block 53
Flash Lock Block 54
Flash Lock Block 55
Flash Lock Block 56
Flash Lock Block 57
Flash Lock Block 58
Flash Lock Block 59
Flash Lock Block 5A
Flash Lock Block 5B
Flash Lock Block 5C
Flash Lock Block 5D
Flash Lock Block 5E
Flash Lock Block 5F
Flash Lock Block 60
Flash Lock Block 61
Flash Lock Block 62
Flash Lock Block 63
Flash Lock Block 64
Flash Lock Block 65
Flash Lock Block 66
Flash Lock Block 67
Flash Lock Block 68
Flash Lock Block 69
Flash Lock Block 6A
Flash Lock Block 6B
Flash Lock Block 6C
Flash Lock Block 6D
Flash Lock Block 6E
Flash Lock Block 6F
Flash Lock Block 70
Flash Lock Block 71
Flash Lock Block 72
Flash Lock Block 73
Flash Lock Block 74
Flash Lock Block 75
Flash Lock Block 76
Flash Lock Block 77
Flash Lock Block 78
Flash Lock Block 79
Flash Lock Block 7A
Flash Lock Block 7B
Flash Lock Block 7C
Flash Lock Block 7D
Flash Lock Block 7E
Flash Lock Block 7F - Done
FILE_NK0_BIN download/flash failed
NK1.BIN download/flash failed
The unit will be reset. Please remove the CF card and press the right-arrow button
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
pSA111Gpio pddr B9
pSA111Gpio pdr 0
pSA111Gpio pddr B9
pSA111Gpio pdr 40
Checking to ensure we're in Power State DO
Power State DO confirmed
MQGC::SetMQMode - in D0 state now ...
MQGC::SetMQMode - SameImage
SetMQPLL 2 to 40 MHz
Enable LCD output at GC1
WaitForPowerSeqOff: waited 1 cycles
MQGC::SetMQMode done!
Windows CE Ethernet Bootloader v1.06 for ViewSonic ViewPad 100 built Jul 1 2002 10:48:44
Copyright (c) 2002 Stellcom Technologies Inc.
NE2000 Boot Loader, Version 4.5n
Stack=8C067F9Ch
Flag 1=00000000h
Flag 1=00000000h
DRIVER_GLOBALS AC021000h
DRIVER_GLOBALS->misc AC021300h
DRIVER_GLOBALS->misc.webUpdateMagic AC02131Ch
Testing magic number 3EFED3FBh
webUpdateMemPointer B76FF5DFh
No CF Card Present, check for valid CE image in Flash
+ Boot Monitor
Prepare to Launch CE !!
Trying to find CE image in FLASH.
Auto Launch of Flash image
******************************************************
******************************************************
******************************************************
******************************************************
******************************************************
OEMInitDebugSerial using SP1
Windows CE Kernel for ARM Built on Aug 20 2002 at 14:32:23
ProcessorType=0b11 Revision=9
sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800
WinCE 4.1 kern_0100.exe
Initialize timer used for delays in the HAL
InitClock...
Initialize driver globals area...
Clear pending interrupts...
enabling serial port timeout interrupt (OSMR2)
OEM Init: Initializing the Registry library...
OEM Init: Registry library initialized.
Firmware Init Done.
Sp=ffffc7d0
IPSM Start = 0x1600000
IPSM Length= 0xa00000
IPSM Start = 0x1600000
IPSM Length= 0xa00000
IPSM Start = 0x1600000
IPSM Length= 0xa00000
IPSM Start = 0x1600000
IPSM Length= 0xa00000
WinCE 4.1 PCMCIA_0200_beta.dll (Xpilot's PDD & 4.1's MDD)
WinCE 4.0 Audio_0101.dll
OHCIPddInit trying to init object
OHCIPdd Init Interface Reset done +
OHCIPdd Init OHCI CreateOBject +
Scanning Installed Providers
Installing Layered Providers
Installed over Windows CE MS Tcpip [UDP/IPv6].
Installed over Windows CE MS Tcpip [UDP/IPv6].
Installed over Windows CE MS Tcpip [TCP/IPv6].
Installed over Windows CE MS Tcpip [TCP/IPv6].
Installed over Windows CE MS Tcpip [UDP/IP].
Installed over Windows CE MS Tcpip [UDP/IP].
Installed over Windows CE MS Tcpip [TCP/IP].
Installed over Windows CE MS Tcpip [TCP/IP].
Can't Reorder under CEPreparing To Reoder Installed Chains
WinCE 4.1 PwrButton_0101.dll
WinCE 4.1 mq200drv_0102.dll ...
WinCE 4.1 KbdMSEngUS1_0101.dll
WinCE 4.0 Touch_0400.dll
WinCE 4.1 -App- SetTime_0100.exe by Will
Year: 2002, Month: 6, Day: 1, DayOfWeek: 6, Hour: 0, Minute: 0, second: 0, Milliseconds: 0
LaunchPro_0300 has executed
No calibration data, attempting to calibrate.
Calling routine TouchCalibrate().
No calibration data, attempting to calibrate.
Calling routine TouchCalibrate().
More information on how to hack the AirPanel v150 can be found at AiboHack.
JTAG Access
In order to flash without a bootloader wed like to use jtag. In order to use jtag you must locate the jtag points. From the strongarm developers manual found here we know:
- ntrst-test interface reset internal pull down must be driven high to enable jtag if unconnected jtag disabled pin b4
- tdi-input internal pull up resistor pin a5
- tdo-output no internal pull up pin b5
- tms-test interface mode select pin c6
- tck-test interface reference clock internal pull down bga pad pin c5
This allowed us to create the Debug_Port_Pinout_.28JTAG.2FSerial.29
The next step is building a jtag cable. I found some possibly interesting info on that at http://www.sparkfun.com/commerce/product_info.php?products_id=275 http://www.olimex.com/dev/images/arm-jtag-layout.gif and http://www.olimex.com/dev/arm-jtag.html
FLASHING/READING FROM CF CARD
The card will need to be partitioned and formatted to fat 16. We have tested cards up to 2gb in size with no problem. The main issue is setting the parition to be active and therefore bootable. The easiest way to do this thus far appears to be using this set of software and directions. You'll want to grab the hp software and the dos boot stuff. The dos boot stuff isnt necessary except for tricking the hp software into setting your parition bootable. Once it has been formatted you can remove the dos files from the cf card.
Interesting misc fact, if you swap the flash chip found in the back next to the battery with another unit, its like flashing your unit as all rom and ram is apparently on this chip. I had a 3.0 device and a chip from a 4.1. When I put the 4.1 in the 3.0 device my windows ce AND bootloader changed to the updated version.
REDBOOT
We know very little at this point about the way to flash the onboard rom. Ideally wed like to install redboot there instead of the current debugger and bootloader as this could allow us to boot linux or other embedded oses. There exists some packaged redboot bins here built specifically for the strongarm hardware but we're not sure how to flash them onto the device, either through the existing flasher or by manually flashing the chip somehow... The packaged bins don't seem to be accepted by the existing flashing utility. They're recognized as bins but some sort of crc check occurs and they are ignored...
Redboot must be initially installed through a JTAG interface. Once installed, it will support CF ethernet and the serial port as access for data. More information is available about Recompiling Redboot. Once Redboot has been installed, you can proceed onto Installing OS.
FUTURE/CURRENT WORK
(you can help!)
- build a redboot image for our processor and making sure it has serial drivers
- figure out how to ethernet boot, flash firmware
- attempt jtag flash somehow, first of known good firmware, then redboot
- find platform builder ce 4.1 or 4.2 and use the board service pack to attempt to build custom ce firmewares
- finding natively compatible wireless cards and other devices or working drivers
- finding compatible software to run on the ce.net os
- clean up this wiki page
