		Dell Axim X5 hardware information collection

Authors:	Demo <cooldemo@inmail.sk>
		Andrew Zabolotny <anpaza@mail.ru>
		Andreas Mohr <andi@lisas.de>

Warning:	This document has NOTHING to do with Dell computers, so
		do not send them any e-mails :-)

This table shows data gained by small program available at
http://cooldemo.miesto.sk/tester1.exe. It saves DMA & GPIO config and reports
any change on GPIOs with alt. function set to 0.

Warning	after tapping onto file, the program collects changes on GPIO for 10
seconds (so it may seem that it does not work! afterwards there is Hello World!
text on screen. Use a taskmgr or a similar program to end this task otherwise
it will still remain running!

You also may give a try to HaRET (Handheld Reverse Engineering Tool). It can
be found at http://www.ozerki.net/homepage/zap/... It is a lot more powerful
than tester1, has a built-in scripting language, can load and run Linux and
last but not least, allows you to dig the hardware internals interactively
from your PC (by using a TCP connection).

MECR=0x2
DINT=0x0

1st collumn is Channel control. The rest could be found in documentation for PXA250 processors

DMA #0=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #1=0x80000000	DCMD=0x9023ca60	DSADR=0xa1fbd560	DTADR=0x40500040
DMA #2=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #3=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #4=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #5=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #6=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #7=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #8=0xa0000000	DCMD=0x6022c030	DSADR=0x40500140	DTADR=0xa1fcf000
DMA #9=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #10=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #11=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #12=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #13=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #14=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0
DMA #15=0x8		DCMD=0x0	DSADR=0x0		DTADR=0x0


DMA:
	Pocket PC uses at least:
	channel #1 for Audio out
	channel #8 for Touch screen


              --- GPIO configuration (HaRET output) ---

GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
  0   I 1 0    FE |  21   I 1 0       |  42   I 1 1       |  63   O 0 0
  1   I 1 1       |  22   O 0 0       |  43   O 1 2       |  64   I 1 0
  2   I 1 0    FE |  23   O 1 0       |  44   I 1 1       |  65   I 1 0
  3   I 1 0    FE |  24   O 0 0       |  45   O 1 2       |  66   I 1 0
  4   I 0 0 RE    |  25   I 1 0    FE |  46   I 1 2       |  67   I 1 0
  5   I 1 0       |  26   O 0 0       |  47   O 0 1       |  68   I 0 0 RE FE
  6   I 0 0 RE FE |  27   I 1 0 RE FE |  48   O 1 2       |  69   I 0 0 RE FE
  7   I 0 0 RE    |  28   I 0 1       |  49   O 1 2       |  70   I 0 0 RE FE
  8   I 1 0    FE |  29   I 0 1       |  50   O 1 2       |  71   O 0 0
  9   I 1 0    FE |  30   O 0 2       |  51   O 1 2       |  72   O 1 0
 10   I 0 0 RE FE |  31   O 0 2       |  52   O 1 2       |  73   O 1 0
 11   I 0 0 RE FE |  32   I 0 0       |  53   O 1 2       |  74   O 1 0
 12   I 0 0 RE FE |  33   O 1 2       |  54   O 1 2       |  75   I 1 0
 13   I 0 0 RE FE |  34   I 1 1       |  55   O 1 2       |  76   I 1 0
 14   I 0 0 RE FE |  35   I 1 1       |  56   I 1 1       |  77   I 0 0
 15   O 1 2       |  36   I 1 1       |  57   I 0 1       |  78   O 1 2
 16   O 1 2       |  37   I 1 1       |  58   O 1 0       |  79   O 1 2
 17   I 0 0 RE    |  38   I 1 1       |  59   I 1 0       |  80   O 1 0
 18   I 1 1       |  39   O 1 2       |  60   O 0 0       |  81   I 0 0
 19   O 0 0       |  40   O 1 2       |  61   I 1 0    FE |  82   I 0 0
 20   O 0 0       |  41   O 1 2       |  62   O 0 0       |  83   I 0 0

Legend:
              D is Direction (Input or Output, GPDR)
              S is State (pin level, GPLR)
              A is Alternate Function number (0-3, GAFR)
              INTERrupt status maybe Rising Edge (RE) or Falling Edge (FE).


This table shows all GPIOs that I was able to find and are not set as
alternate function:

0 	~Power Switch
1	~Reset switch
2	MediaQ 1132 interrupt
3	Batery latch (0 - opened, 1 - closed)
4	Craddle plugged in (0 - connected, 1 - not connected)
5	???
6	SD Card inserted
7	CF Card inserted
8	PCMCIA BVD1 ???
9	Main Battery inserted
10	Record button
11	Calendar
12	Contacts
13	Mailbox
14	Home
15	Active Low Chip Select (nCS_1)
16	PWM0 output (brightness)
17	AC power
18	Ext Bus Ready (RDY)
19	Serial cable DCD (used to power on the MAX232-like serial converter)
20	???
21	???
22	UDC pull-up enable (0) or disable (1)
23	???
24	???
25	Power good (???)
26	PCMCIA related ???
27	~Joy "push" button
28-31	AC97 Controller Unit
32	Touch screen "touched"
33	Active Low Chip Select (nCS_5)
34	FFUART RXD
35	FFUART CTS
36	FFUART DCD
37	FFUART DSR
38	FFUART RING
39	FFUART TXD
40	FFUART DTR
41	FFUART RTS
42	BTUART RXD
43	BTUART TXD
44	BTUART CTS
45	BTUART RTS
46	STDUART RXD
47	STDUART TXD
48-57	Connected to PCMCIA (CompactFlash) interface
58	???
59	Accumulator Charging (1)
60	Flash write enable ???
61	Somehow PCMCIA related ??? (BVD2?)
62	PCMCIA reset.
63	PCMCIA address bus enable (0-enable)
64-67	Joy directions
	0xC == up
	0x3 == down
	0x9 == right
	0x6 == left
	0xF == no button pressed
	WARNING also #27 is signalized
68	Scroll down
69	Scroll push
70	Scroll up
71      MediaQ 1132 power (???)
72	MediaQ 1132 address bus enable (I think)
73	??? (output 1 by default)
74	LED power (on power button)
75,76,77
	These GPIOs are used to detect the type of craddle the PDA was
	inserted into (all three are input):
	    001,101 - Some simple connector (just AC power ???)
	    010,100 - Serial (RS-232) connector
	    011,110 - USB connector
80	???


One of those chargings is probably charged and other charger plugged.


PCMCIA/CF:
	All stuff that can be found in 278522-001.pdf (PXA250) and/or
	27869301.pdf (PXA255) is valid also for Dell Axim.

	PCMCIA/CF insertion process:
		GPLR[7] changed to 0
		[a noticeable delay]
		GPLR[8] changed to 1
		GPLR[26] changed to 0
		GPLR[57] changed to 0
		GPLR[61] changed to 1
		GPLR[63] changed to 0

	PCMCIA/CF removal process:
		GPLR[7] changed to 1
		GPLR[8] changed to 0
		GPLR[26] changed to 1
		GPLR[57] changed to 1
		GPLR[61] changed to 0
		GPLR[63] changed to 1

Interrup requests from CF cards are routed through MediaQ chip GPIO2. This is
a level-triggered interrupt, thus after you proceed one interrupt you must
disable and then re-enable that specific interrupt in order to get next one.

SD/MMC:
	It looks like these cards are handled in SPI mode (a four-wire
	interface) via the MediaQ chip (hell knows why, PXA2xx has a built-in
	MMC controller). When a SD card is inserted, MediaQ register SP00R
	bits 0-1 are set to '01' (this enables GPIO 50-53 to act in SPI mode).
	Also the pull-up registers for GPIO50-53 are activated.

MediaQ 1132:
	GPIO 0 seems unused.
	GPIO 1 (def. output 1) enables the flat panel (possibly just enables
	    all the FP input pins, but maybe it's a global 'power switch').
	GPIO 2 (def input) is the CF IREQ pin.
	GPIO 20 (def. output 0) somehow controls the vertical scan direction.
	    If it is 0, the image is 'normal', if it is 1, the image flips
	    upside-down.
	GPIO 21 (def. output 0) ???
	GPIO 22 (def. not conn) if output 0 image is disabled; when output 1
	    image is normal.
	GPIO 23 && 24 are amplifier enable (both?)
	GPIO 25 (def. output 1) ???
	GPIO 50 (def. input/output 1 when SD/MMC in) == SPI/SS signal
	GPIO 51 (def. input/output 1 when SD/MMC in) == SPI/SCK signal
	GPIO 52 (def. output 1 when SD/MMC in) == SPI/MOSI signal
	GPIO 53 (def. input 1 when SD/MMC in) == SPI/MISO signal
	GPIO 54 (def. input/output 0) ???
	GPIO 55 (def. input 0 when SD/MMC in). If you insert a placeholder
	    card (like the one supplied with the Dell) this bit is 1, so
	    I suppose this bit is used to differentiate between a
	    real/fake card (PXA GPIO6 will indicate 0 in either case).
	GPIO 61 (def. input/output 0) ??? If you output a '1', backlight
	    disables and I wasn't able to enable it back.
	GPIO 62 (def. input/output 1) ???
	GPIO 63 (def. input/output 1) is SIR transceiver enable
	GPIO 64 (def. input/output 1) is backlight
	GPIO 65 (def. input/output 1) is PCMCIA (power?)
	GPIO 66 (def. input, reads 1) ???

LCD:
	Axim uses the MediaQ 1132 chip to control LCD.

FRAME BUFFER:
	Frame buffer is statically mapped to physical address 0x14000000,
        it uses 16 bit format and its resolution is 240x320 pixels. PocketPC
        sets framebuffer start address + 0x2000 (e.g. 0x14002000 or 0x14042000
        depending whether you want synced or unsynced access - see mq1132 docs).

BACKLIGHT:
	Controlled by Pulse Width Modulator #0 on PXA.
	The brighness (range 0..1) == PWM_PWDUTY0/PWM_PERVAL0.
	PWM_PERVAL0 is 254 in Windows.

UART:
	Normal UART available is fully documented in 278522-001.pdf.
	FIR has not been tested yet, but should work with the pxa_ir driver.
	The IR tranceiver is enabled via GPIO63 on MediaQ 1132 chip.

USB:	There is a USB Device Controller built-in into the PXA but it is not
	used. Instead, Axim uses the UDC that is built into the MediaQ chip.
	This means we'll have to write an UDC driver for MediaQ (doh).

	MediaQ 1132 contains a USB host (OHCI compatible) and it is
	rumoured that the outputs are available on the bottom connector,
	thus it is possible to modify the OHCI driver so that it works with
	MQ1132. This would mean that you will be able to connect any USB device
        (say, a 20GB portable HDD or a scanner) to your Dell (which
        PocketPC isn't able to do).

	USB craddle insertion process:
		GPIO[17] changes to 0 \ power
		GPIO[59] changes to 1 / related
		GPIO[4] changes to 0
		GPIO[75-77] are set according to craddle type
		GPIO[22] changes to 0

	USB craddle removal process:
		GPIO[4] changes to 1
		GPIO[59] changes to 0 - power related
		GPIO[75-77] changes to 111
		GPIO[17] changes to 1 - power related
		GPIO[22] changes to 1

Touchscreen & battery:
	Touchscreen and battery is controlled by wm9705 AC97 codec.

Sound:
	Dell Axim uses the wm9705 audio codec. Amplifier power is controlled
	by GPIO23 & GPIO24 on MediaQ 1132:
	If both GPIO23/24 are set to output 1 (CC03R = ?aa?????), amplifier
	is enabled. If they are both 0 (?22?????), it is powered off.
	I'm not sure what every GPIO apart does.
	Also a TPA721 amplifier is used (datasheet can be downloaded from the
	Internet) but it is not important from programmer point of view since
	it is completely invisible to software.

Note:	All abriviations used can be found in document 278522-001.pdf
	from intel.com

Flashing the ROM:
	If you press "Contacts" and press the "Scroll" lever right down until
	it clicks, then press Reset, then release Reset but keep Contacts and
	Scroll Push for at least 10 seconds!) you'll get this (provided you
	have a CompactFlash storage card inserted into the slot):

        LCD initialized Ok.!!
        P25 EBoot Ver. xxxxx
        SDRAM 64MB Cleared!
        Dell Axim X5
        Hardware Device ID
        xxxxxxxxxxxxxxxxxx
        Manufacturer Code
        xxxxxxxxxxxxxxxxxx
        UUID Method1 Variant = 8
        UUID Method1 Version = 1
        CF card detected!
        Init CF card ok!
        Determining Card Type....
        Storage Card Found!
        Load Image From CF Disk....
        !! PLEASE DO NOT TURN OFF !!
        No matching *.IMG file found!

	If you don't have a CompactFlash card in slot, you'll enter the
	Diagnostic tool which is not too interesting from our point of view :)

	So replacing Windows with Linux in ROM is just a matter of time now :-)
        It also means you dont have to fear to brick your Axim with an
        incorrect ROM; you always can re-flash it with a correct image
        (well, I haven't tried it but should be true :-)

	[huh? Why should this be true?? I'd rather say that this is an
	initial flasher routine *within* the normal flash image - in other
	words if you flash a different image with it and that new image
	turns out to be toast, then your device WILL be bricked since
	this flash helper is gone, too.
	Besides, what do you think "!! PLEASE DO NOT TURN OFF !!" would be for
	other than warning about this fatal danger??
	Time for some good JTAG tricks then, methinks... :-)]

	[this is true since the IMG file has a tag indicating whether it's a
	bootloader IMG file (256K), a WinCE image file or other kinds (don't
	remember now which exactly). So when flashing wince it won't touch
	the bootloader. The warning is just for people not knowing the
	magic key combination]
