DPF with AppoTech AX206
From ST2205u wiki
Contents |
Summary
Much of the info here is now (10/2011) out of date. If you want to get into development on these DPFs, or use them as a remote screen: there is a SVN source repository with experimental code and various tools at [1]. Also, this site [2] publishes the entire original firmware and hardware reference manual of the AX206.
- Available from DealExtreme here, or here. The latter is the best examined, and recommended. It uses a pretty decent TFT screen, however it seems to have less colours than 65k. Also, there is no guarantee that you get the exact same model from DX.
- A very cheap 320x240 DPF is available here: [3]. Identical model (but maybe little different firmware [4]. The same model seems to be around on Ebay, look for "2.4 Photo frame 16 MB", mostly from Hongkong.
- Similar to the DPF with AppoTech AX203, internally and externally.
- Uses special JPEG-based encoding for images (see ImageEncodingAx206 for more information)
To distinguish from the AX203 types, the rule of thumb (if you are not able to get hold of the USB IDs, shown below) is:
- AX206 based frames are listed with 16 mbit or 32 mbit flash, capable of taking ~107 pictures or more
- Those with 8 mbit and ~130 pictures could be likely AX203
-- Actually, it was found the above is not really true, because many sellers specify wrong flash sizes, and the image capacity varies with the firmware versions. If you get a newer model, it is likely that it has an AX206 or even AX208.
Note that DX and sellers on Ebay write MB (insinuating MegaByte) but in fact it's Megabit. So you have to divide by eight for available MegaBytes.
Software Details
- Comes loaded with DPFMate as per the AppoTech, but software version is v5.0.2.1. A copy of the software can be found here
- Screenshot of the DPFMate Software "About..." dialog box
- Dump of StartInfoUnicode.ini:
[info] UserId=User StartPic=1 UserPic=14 LangIndex=0 Language=English FirmwareVer=EDPF1.1_STANDARD_V2.0.0 FlashType=Pm25LV040 FlashSize=512 PID=0x1315 LogoStr=Welcome Titlename=DPFMate v5.0.2.1 CorpLink=http://www.buildwin.com.cn CopyRightTips=Copyright (C) 2007 AppoTech Corporation ThumbColumn=3 ThumbWidth=56 JpgQuality=90 MaxPicNum=90 JpgFormat=1 ProgressCtrl=OFF [LCD] Width=96 Height=64
Hardware Details
- Photos of the circuitry are here, here and here.
- Following the StartInfoUnicode.ini file, if the information in the file is correct, the flash chip's datasheet should be this
- It seems to be using the AX 206 chip. Datasheets here and information here.
- I have two keychains, because the first unit had a "quirk" - unit only powers on 4 or 5 times after being charged. Not sure if this problem is related to the number of times turned on, or after 5 to 10 minutes of it being turned off (or even on). However, I suspect a full battery discharge would allow me to charge the unit up, making it usable again.
Firmware and Processor Details
The firmware basically knows several operation modes:
- Boot Loader (hold MENU button while pushing the RESET button). The device will then register as HID device and create a /dev/hidraw0 device under Linux. This is described in scattered locations, so far it seems not known what data is expected to boot the device via USB.
- Standard photo frame mode: The unit will display images and not register as USB device when plugged in
- USB operation, triggered via the menu entry: The device will register as CDROM with the USB details provided below. The flash access occurs via the SCSI generic device by specific vendor commands 0xCA, 0xCB and 0xCD. This is covered in various code fragments, see Talk:DPF_with_AppoTech_AX206
Memory map
The AX206 has internal SRAM where code from external memory is loaded to. The internal SRAM bank is mapped to external memory as well as code memory, so it is internally mirrored.
XDATA (movx) CODE (movc)
0x0000-0x00ff 0x1a00-0x1aff USB FIFO
0x0200-0x02ff 0x1b00-0x1bff DATA memory (8 bit addressable)
0x0800-0x11ff 0x1000-0x19ff CODE/DATA memory
0x0000-0x0fff Mask ROM
IRQ handlers 0x1003
Apparently, a part of the USB FIFO area can be used as data memory as well, since only 144 bytes are used (2*64 + 2*8 for USB EP0 and EP1).
Firmware internals
When in standard mode, the device is booting from the SPI flash. The 'boot sector' consists of a data block with some boot information plus a jump table (see more below) and the boot code.
The loading of the code from SPI flash occurs via XDATA, but the loaded code is actually located at instruction SRAM (CODE) with offset +0x800.
Here are the most important offsets and record lengths. BE stands for Big Endian, LE for Little Endian order.
0x00[2] (BE): Code destination in XMEM 0x02[2] (BE): Code position in IMEM 0x05[3] (BE): Start of code in Flash, normally 0x220 0x23[2] (LE): Screen resolution X 0x25[2] (LE): Screen resolution Y 0x80[8] : Magic ID 'ProcTbl1' or similar 0x88[..] : Module procedure jump table
The jump table ends with the magic '-EndTbl-'
The boot code loads a few common code modules from SPI flash. These are merely three code segments at the following (CODE) addresses:
0x1003: IRQ handler 0x1280: common LCD addressing routine 0x1934: common dynamic module loader (see below)
Please speak up if the addresses vary on your DPF.
Other code segments are dynamically loaded by some modules, depending on the operation mode of the DPF.
Jump Table
Since the AX206 has only 3k of internal SRAM which is obviously used by the USB FIFO and JPEG quantization tables, mechanisms are implemented to dynamically load code modules from SPI. The jump table entries are descriptors of length 8 for each module and decode as follows:
0x00[2] (BE) : Destination load START address in XMEM 0x02[2] (BE) : Destination load END address in XMEM 0x04[3] (LE) : Source offset in flash 0x07[1] : Fill byte, unused.
Jumps to those modules within the coded are implemented using trampoline functions. For example, when a function from another module is called, the code sequence looks like:
mov a,#bank_no ; module index in table mov dptr,#target_function ; Address of function in module ljmp tramp_jmp ; Jump into dynamic loader trampoline
The number of modules varies depending on DPF model and firmware version.
Code download
Code downloading is supported with the tools from the dpfhack distribution. The necessary patches to get lcd4linux running are included in the distribution tar files found via http://tech.section5.ch/news/?p=68. They might be updated regularely, therefore please check the up to date .tgz files from the link above.
When you modify the code:
It's easy to brick your frame by overwriting the original firmware. This used to be a problem. However, the ProgSPI from [5] restores the original flash content - if you saved it! Therefore, before messing around, make a dump of the flash.
USB Details
- lsusb log:
Bus 005 Device 002: ID 1908:0102
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x1908
idProduct 0x0102
bcdDevice 2.00
iManufacturer 2 BUILDWIN
iProduct 3 Digital Photo Frame
iSerial 1 200807101900000000
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 200mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 4 DPF Mate
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Device Status: 0x0000
(Bus Powered)
- dmesg log:
usb 5-1: new full speed USB device using uhci_hcd and address 2 usb 5-1: New USB device found, idVendor=1908, idProduct=0102 usb 5-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1 usb 5-1: Product: Digital Photo Frame usb 5-1: Manufacturer: BUILDWIN usb 5-1: SerialNumber: 200807101900000000 usb 5-1: configuration #1 chosen from 1 choice Initializing USB Mass Storage driver... scsi5 : SCSI emulation for USB Mass Storage devices usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usb-storage: device found at 2 usb-storage: waiting for device to settle before scanning usb-storage: device scan complete scsi 5:0:0:0: CD-ROM buildwin Photo Frame 1.01 PQ: 0 ANSI: 2 sr1: scsi3-mmc drive: 40x/40x writer cd/rw xa/form2 cdda tray sr 5:0:0:0: Attached scsi CD-ROM sr1 sr 5:0:0:0: Attached scsi generic sg2 type 5 ISO 9660 Extensions: Microsoft Joliet Level 3 usb 5-1: reset full speed USB device using uhci_hcd and address 2
