V210 Notes
From ASULUG AirPanel Wiki
ViewSonic V210 Notes
Research and Notes on the ViewSonic V210 Devices.
Contents |
V210 Hardware
- CPU: ARM/Intel PXA255 at 400Mhz (PXA255A0C400)
- RAM: 128M (4 banks 4Meg x 16 x 4 banks, CL=3 133Mhz Synchronous Dram)
- ROM: 64M Flash 4 - Intel Strata Flash Memory J3 (Intel TEL8F128 J3C150)
- Graphics: LynxEM4+ SM712G4 (Silicon Motion 712 4M) LynxEMDatabookRev1.2.pdf
- LCD AU Optonics B104SN01 (AUO072 LVDS receiver/panel Controller)
- Audio/Touch Screen controller - Wolfson Microelectronics - WM9705 AC'97 Codec with Integrated Touch Screen Controller WM9705.pdf
- Wireless minipci cards seen in units
- Xircom M3AWEB56GA in earlier units. Shows up as PCI-ISLP2 in WindowsCE. 802.11B. Does not support 802.11G or WPA security. Intersil Prism 2.5 Wavelan chipset??
- Gemtek WL-850FJB 802.11b/g in later units. Shows up as PCI-PRISM in WindowsCE. Supports 802.11B/G and WPA security. Intersil ISL3886 chip set. Build Image of choice with this card is 2.2.0067.1 to resolve problems with PRISM and WPA with some routers. Also before 2.2.0061.2 some issues with Remote desktop disconnects.
- Other Interesting chips on MB in case useful
- ITE IT8152G Advanced RISC-to-PCI Companion Chip 339031-ITE-IT8152-Story.pdf
- USB OHCI 1.0 ports on this pci bus 0000:00:01.4 id 1283:8152
- SM712G4 on this pci bus 0000:00:05.0 id 126f:0712
- wireless on this pci bus 0000:00:06.0 id 1260:3886
- CPLD: Xilinx XCR3032XL 32 Macrocell CPLD XCR3032XL
- LVDS transmitter: DS90C363AMTD Programmable LVDS transmitter 18-bit FPD Link 65Mhz DS90C363A.pdf
- Maxim Max3221 MAX3221-MAX3243.pdf
- ITE IT8152G Advanced RISC-to-PCI Companion Chip 339031-ITE-IT8152-Story.pdf
JDBG Port
The V210 has a 12 pin port connector labeled JDBG located by the mini pci wireless card.
Voltages when powered ON.
JDBG 1=3.32, 2=3.28 (when test would boot unit), 3=3.01, 4=0, 5=3.30, 6=0, 7=.95, 8=.95, 9=3.07, 10=0, 11=-5.04, 12=0 (-10.19 when hooked to com port)
JDBG pin 3 seems special, in when I had messed up my original Ground on the serial cable (had it hooked to 3 instead of 4), all seem to work as far as the console output. But it disabled the use of the Power button, Power on with Keyboard button (flash reset) and Emergency USB recovery (Power on with web key held). The keyboard and web button worked though when powered up under WinCE (power button did not), just the special function was disabled - something to do with the JDBG pin 3.
Serial Console Debug Port
There is a serial consol wired to the JDBG. The Max3221 chip R1IN, T1OUT and GND are wired to the following pins.
- JDBG - 12 (max3221 pin 8 R1IN) <--- PC com port pin 3 TxD
- JDBG - 11 (max3221 pin 14 T1OUT) ---> PC com port pin 2 RxD
- JDBG - 4 (max3221 pin 3 GND) ---- PC com port pin 5 SG
Set com port at 38400 N81 (no parity, 8 bits, 1 stop) Output from boot.
*******Beginning System Initialization******* SDCLK[1] = MemClk
MemClk = 99.53 MHz
Run Mode = 4 * MemClk
Turbo Mode = Run Mode
Mode: TURBO
Beginning SDRAM Scrub...
SDRAM Scrub Complete
Microsoft Windows CE Ethernet Bootloader Common Library Version 1.0 Built Nov 3 2004 13:41:50
DS STATE: UNDOCKED
PCI(5:0) id 8X:
PCI - AssignIntr: device: 8x function: 8x PCI_INTRREG: 8x Interrupt: 8x
PCI(6:0) id 8X:
PCI - AssignIntr: device: 8x function: 8x PCI_INTRREG: 8x Interrupt: 8x
SMI Vendor ID : 0x126F
SMI Device ID : 0x712
SMI Revision ID: 0xB0
airsync V210 Display Ver. 1.11 Nov 3 2004 13:42:42
Flash status: 0080008000800080
InitializeUpgradeData
dwImageInRam=00000000h
Failed to detect and initialize specified device.
Will try to boot from existing image in flash
System ready!
Preparing for download...
OEMLaunch: parameters...dwImageStart: 0, dwImageLength: 0, dwLaunchAddr: 0, pRomHdr: 0
Before restoring from Flash...22E8860 <= 3BFFFFF
Loading entire image into RAM B8380000 ==> A03AD000
Image load into RAM complete ! last: BA668860 ==> A2695860
Download successful! Jumping to image at physical 0xA03AD000...
Windows CE Kernel for ARM (Thumb Enabled) Built on May 3 2005 at 14:03:22
ProcessorType=02d0 Revision=6
sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800 OEMAddressTable = 803aedfc
+OEMKitlInit
Unable to initialize KITL Transports!
-OEMKitlInit
KITL Initialization Failed, No debugging support available
PCI(5:0) id 0712126F:
PCI - AssignIntr: device: 00000005 function: 00000000 PCI_INTRREG: 0000003c Interrupt: 00000100
PCI(6:0) id 38861260:
PCI - AssignIntr: device: 00000006 function: 00000000 PCI_INTRREG: 0000003c Interrupt: 1c0a0101
MDCNFG tCAS value: 2
OEMInit: Initializing the Registry library...
OEMInit: Registry library Initialized.
Sp=ffffc7cc
ms:1000
Mei::------------IOCTL_HAL_INIT_RTC
ms:2000
ms:3000
ms:4000
ms:5000
ms:6000
ms:7000
ms:8000
ms:9000
ms:10000
ms:11000
Battery PDD 1.01 Load.BATTERY_FLAG_NO_BATTERY ShowLED(4)
ms:12000
PSMFSD:DLL Process Attach
ms:13000
Sleep Abort 4 0x00000002
ms:14000
WinCE_4.2 Wavepdd_0102.dll
ms:15000
Sleep Abort 4 0x00000002
ms:16000
ms:17000
Key : DLL_PROCESS_ATTACH
GPIO Key Init
Create Key Event
DS STATE: UNDOCKED
Create Key Thread
-Key KEY Init
------------IOCTL_HAL_REQUEST_SYSINTR
Sleep Abort 4 0x00000002
ms:19000
SerMouse:: MOU_Init: Leave entry---
SMI GPEVGA: Find SMI712
StrongARM GPEVGA: VGABaseAddr @ 0x11000000
New port range is not in iospace @ 0x13E003C0
SMI IOBase Addr @ 0x 1303C0
SMI::Turn On Linear Memory Mode
mapped port range to 140000
SMI graphic chip is rev. 0xb0 with internal 4MB ram
ms:20000
-- Start Wait Mouse Event
JTAG
On the underside of the MB directly under the PCCard Eject close to the reset is labeled JTAG1. No Jack currently exist there, but looks like it is just waiting for a 10 port jack to be soldered to the foil contacts. Pins are labeled with 1 on one end and 10 on the other. 4,6,8 and 10 appear to be same as Ground.
Pin outs????
??
- TCK - JTAG1 pin 9 (found from XCR3032XL pin 26)
- TDI - JTAG1 pin 5 (found from XCR pin 1)
- TDO - JTAG1 pin 3 (found from XCR pin 32)
- TMS - JTAG1 pin 7 (found from XCR pin 7)
Flashing and Rom Image Backup
Flash reset the User area
Warning - CLEARS SETTINGS - Resets up Permanent Storage and registry to Initial settings. Hold in Reset, hold and keep holding in Keyboard button and release Reset Button when erasing flash starts. Console serial shows:
Erase Persistent Flash: dwPhysAddr: 9A780000 dwPhysLen: 28835840
DoFlashProgram: dwCurrAddr: 9A780000 dwCurrLength: 01B80000
Erasing Flash 9A780000 to 9C2FFFFF: Please wait ...
..........
Performing erase verification ...
Flash erasing complete.
InitializeUpgradeData
dwImageInRam=00000000h
Performing card initialization. Please wait ...
Sorry, the Card in Slot 0 is memory card.
Failed to detect and initialize specified device.
Will try to boot from existing image in flash
System ready!
Preparing for download...
OEMLaunch: parameters...dwImageStart: 0, dwImageLength: 0, dwLaunchAddr: 0, pRom
Hdr: 0
Before restoring from Flash...22E8860 <= 3BFFFFF
Loading entire image into RAM B8380000 ==> A03AD000
Image load into RAM complete ! last: BA668860 ==> A2695860
Download successful! Jumping to image at physical 0xA03AD000...
Windows CE Kernel for ARM (Thumb Enabled) Built on May 3 2005 at 14:03:22
ProcessorType=02d0 Revision=6
sp_abt=ffff5000 sp_irq=ffff2800 sp_undef=ffffc800 OEMAddressTable = 803aedfc
+OEMKitlInit
Unable to initialize KITL Transports!
-OEMKitlInit
KITL Initialization Failed, No debugging support available
PCI(5:0) id 0712126F:
PCI - AssignIntr: device: 00000005 function: 00000000 PCI_INTRREG: 0000003c Int
errupt: 00000100
PCI(6:0) id 38861260:
PCI - AssignIntr: device: 00000006 function: 00000000 PCI_INTRREG: 0000003c Int
errupt: 1c0a0101
MDCNFG tCAS value: 2
OEMInit: Initializing the Registry library...
OEMInit: Registry library Initialized.
Sp=ffffc7cc
Mei::------------IOCTL_HAL_INIT_RTC
Battery PDD 1.01 Load.BATTERY_FLAG_NO_BATTERY ShowLED(4)
WinCE_4.2 Wavepdd_0102.dll
PSMFSD:DLL Process Attach
Key : DLL_PROCESS_ATTACH
GPIO Key Init
Create Key Event
DS STATE: UNDOCKED
Create Key Thread
-Key KEY Init
------------IOCTL_HAL_REQUEST_SYSINTR
SerMouse:: MOU_Init: Leave entry---
SMI GPEVGA: Find SMI712
StrongARM GPEVGA: VGABaseAddr @ 0x11000000
New port range is not in iospace @ 0x13E003C0
SMI IOBase Addr @ 0x 1303C0
SMI::Turn On Linear Memory Mode
mapped port range to 140000
SMI graphic chip is rev. 0xb0 with internal 4MB ram
-- Start Wait Mouse Event
Emergency USB Disaster Recovery Mode Flashing Method
Requires ViewSonic USBUpdate Program. Contains a driver and a USBUpdate utility. Read the readme for information.
http://asulug.zrgtech.com/downloads/UsbUpdatev210-10-03.zip
Hold in Reset, Hold and keep holding in Web button and release Reset Button. Once says USB Disaster recovery mode - release Web button.
A typical (hum hacked image flash from valid rom built with makeb000ffrom.pl script) flash output from console debug port.
Disaster recovery mode set System ready! Preparing for download... Got H_READY_TO_SEND_IMAGE_ID dwStartAddr: 98380000 ****** Downloading operating system image for FLASH target ****** 0 start=0x98380000 len=0x22E8860 Send D_READY_TO_ERASE_FLASH_ID FlashErase: Spread across banks DoFlashProgram: dwCurrAddr: 98380000 dwCurrLength: 01F80000 Erasing Flash 98380000 to 9A2FFFFF: Please wait ... ................................................... Performing erase verification ... Flash erasing complete. DoFlashProgram: dwCurrAddr: 9A300000 dwCurrLength: 01F80000 Erasing Flash 9A300000 to 9C27FFFF: Please wait ... .................................................... Performing erase verification ... Flash erasing complete. FlashErase: Spread across banks DoFlashProgram: dwCurrAddr: 98380000 dwCurrLength: 01F80000 Now programming Flash ... ........................................................... Comparing Flash vs RAM image ... Flash programmed successfully! DoFlashProgram: dwCurrAddr: 9A300000 dwCurrLength: 01F80000 Now programming Flash ... ........................................................... Comparing Flash vs RAM image ... Flash programmed successfully! DoFlashProgram: dwCurrAddr: 9A780000 dwCurrLength: 01B80000 Erasing Flash 9A780000 to 9C2FFFFF: Please wait ... ............................................................ Performing erase verification ... Flash erasing complete. Found pTOC signature. ROMHDR at Address 98380044h RomHdr.ulRAMStart=826A0000h RomHdr.physfirst=803AD000h. OEMLaunch: parameters...dwImageStart: 98380000, dwImageLength: 22E8860, dwLaunchAddr: 98381000, pRomHdr: 80391648 DoFlashProgram: dwCurrAddr: 98340000 dwCurrLength: 00040000 Erasing Flash 98340000 to 9837FFFF: Please wait ... .. Performing erase verification ... Flash erasing complete. Before restoring from Flash...22E8860 <= 3BFFFFF Download successful! Jumping to image at physical 0xA03AD000... (NORMAL BOOT STUFF FOLLOWS - DID NOT INCLUDE THE BOOT UP)
Using hidden ap210test to flash
I personally have had no luck using the hidden \Windows\ap210test.exe utility and USB flash drives to update the NK. May depend on the usb flash drive - but for me every one I've tried - it craps out during the read on usb flash drives.
It works very good using a PCMCIA CF sleeve and a Compact Flash card. And now is my prefer flash method - as I'm not tied to finding a Windows computer and sync cable.
Put Flash NK file named what ever you want on the compact flash card (fat/dos file system). Plug the compact flash card in to the PCMCIA CF sleeve. Use Start->Programs->Windows Explorer and unset all View->Options to see hidden files and folders - just uncheck all options.
Browse to Windows folder and look for app called ap210test and open it. Click Update NK and find your NK flash image in \External Storage
Will pull the image into memory and then boot and do the flash operations. After quite a while of flashing will reboot when finished. The Compact flash card can be removed when it first reboots and the flash operations begin.
Backup of Rom
Backing up rom - likely many methods. XDA utils is easy enough using pmemdump - but requires a Windows PC with MS ActiveSync.
http://wiki.xda-developers.com/index.php?pagename=XdaUtils
Haret might be another method.
http://www.handhelds.org/moin/moin.cgi/HaRET
Boot rom from flash point of view is 0x98300000, Wince rom is at 0x98380000.
Dumping boot area of rom:
pmemdump 0x98300000 0x00040000 v210_bootrom.raw
Dumping wince area of rom:
pmemdump 0x98380000 0x02400000 v210_2.2.0061.2.raw
Building flash b000ff bin images
I'm working on cleaning up my instructions...
For now look for v210 rom dump in the following page 2 of this thread.
http://forum.xda-developers.com/showthread.php?t=386853&page=2
V210 Flash bin (B000FF) images
ViewSonic V210 distributed older boot image
http://asulug.zrgtech.com/downloads/v210_eboot105.zip
V210 boot image (Built from rom backup of a 3w unit)
http://asulug.zrgtech.com/downloads/v210_3w_boot.zip
V210 NK images (note these were all built from v210 rom backups) (do not use with v210x)
2.2.0039.0 http://asulug.zrgtech.com/downloads/v210_1w_2.2.0039.0.zip
2.2.0047.0 http://asulug.zrgtech.com/downloads/v210_1w_2.2.0047.0.zip
2.2.0061.2 http://asulug.zrgtech.com/downloads/v210_2.2.0061.2_wince.zip
2.2.0067.1 http://asulug.zrgtech.com/downloads/v210_2.2.0067.1_wince.zip
(Web button does not bring up the Internet Explore on this 2.2.0067.1 version)
V210x (Only for v210x)
2.5.0069.0 http://asulug.zrgtech.com/downloads/v210x_2.5.0069.0_nk.zip
Linux Stuff
links for images and Ubuntu 9.04 tar files - 10/26/2009
If you have a ViewSonic V210x and don't mind doing some testing to get v210x support, contact me: 
vs_v210 MACH_VS_V210 VS_V210 2252
Current progress as of 10/26/2009 on linux v210 port
Working
- boots up and works from console.
- serial console
- FrameBuffer (panel screen sm712) console (v210) - not v210x
- USB ports. flash drives, keyboard,mouse etc...
- can boot linux with a fat boot with haret, and ext3 root file system partition.
- Some problems with usb flash drives and large files - unreliable - some issue with it8152 bridge and linux
- PCMCIA with CF card (can boot linux with haret and root file system partition).
- Most reliable boot method - and fastest
- PCI it8152g companion chip (PCI Support)
- via pci - LynxEM4+ (sm712) Frame buffer works (modified driver) v210
- some event keys defined www, keyboard, power
- touch screen works - needs more tweaking - sometimes erratic on stop/start pen movements.
- backlight works and is controllable.
- panel pointer mouse works.
- audio sound works.
- wireless with isl2 card - Intersil Prism 2.5 Wavelan (older stock card) works great
- wireless prism card (gemtek wl-850fjb) p54pci now working
- p54pci driver patched to fix dma problems and other stall conditions
- still some boot issue occurring one in 20 boots causing a skb_over_panic only during driver init.
- Ubuntu 9.04 jaunty armel root fs working great.
Not working yet
- Need v210x for video testing with 1024x768 screen
- Power management stuff (smart battery via I2C)
- rom chip support and resources.
- more that I don't know yet.
GPIO / IRQ haret explores
Unorganized and in early stages of discovery
spamming gpio at idle: 13 14 28 29 30 31 86 87 88 16 when screen on spamming irqs at idle: 10 26 34 Serial console dbg: (FFUART GPIO configuration mfp-pxa25x.h) console output produces changes on this pin. GPIOS 39 Out TXD Typing/sending stuff in terminal/debug console produces changes on this pin GPIOS 34 In RXD Keyboard button: GPIOS 7 IRQS GEDR0: GPIO7(39) web button: GPIOS 8 IRQS GEDR0: GPIO8(40) pointer control, button clicks: (BTUART) GPIOS 42 IRQS ICIP: BTUART(21) touch screen: GPIOS 9 IRQ5 ICIP: TMR1(27) also IRQ5 ICIP: DMA(25) back light or video: setlcd 4 (off) GPIOS 32=0 GPIOS 69=0 setlcd 1 (on) GPIOS 16 continuous changes GPIOS 32=1 GPIOS 69=1 setlcd 3 (suspend) GPIOS(32)=0 GPIOS(69)=0 setlcd 2 (standby) No affect unless off from suspend state to off (setlcd 3 setlcd 4) none Power button cycle: GPIOS 0 = 1 GPIOS 69 = 0 GPIOS 0 = 0 GPIOS 69 = 1 leds: Power LED nledset 0 n GPIOS 58 (on) (green) nledset 1 n GPIOS 59 = 1 (on) (this is amber if 58 is off) and yellow green if 58 on. wireless led nledset 2 n GPIOS 60 = 1 (on) (green) nledset 3 n GPIOS 61 = 1 (on) this is amber if 60 off) and yellow green if 60 on. sound: IRQS ICIP: DMA(25) usb: dock: undocking GPIOS 6=0 GPIOS 12=1 GPIOS 23=0 GPIOS 73=0 74=1 IRQS GEDR0: GPIO12(44) docking GPIOS 12=0 GPIOS 23=1 GPIOS 73=1 74=0 GPIOS 6=1 IRQS GEDR0: GPIO12(44) PCMCIA: insert: GPIOS 22=0 IRQS GEDR0 GPIO22(54) eject: GPIOS 22=1 IRQS GEDR0 GPIO22(54) phone jack: No GPIOS or IRQS seen during plug and unplug. Battery: Plug/unplug - no change to non-spamming GPIOS or IRQS
