Hacking PXA270 internal USB HOST

[bigbop]

Although I said I wasn't going to work on this for a week or so...

After reading the chip specs on the USB host environment, I decided to look for the overcurrent sense input pin - and I found it (see attachment).

The test point is under the battery. There seems to be no testpoint for the USBHPEN (power enable) control line - probably because it's an output pin and isn't used.

The programming specs says that if this pin is HIGH then an overcurrent condition exists and the USB port is disabled. Since there is a resistance to ground of around 77K ohms on this pin, it's probably high when the unit is powered-up.

However, you can program the sense of this pin to be active low, so someone needs to write a bit-banger script to set the bit in the control register so this line becomes active low. Then i can test the interface again.

With that said - I'm on vacation for a week :approve:

[bogroca]

Hi Bigbop,

Is it possible to post somewhere some realy blow-up pictures of both sides of the full PCB (even if it gets sliced/sectionned)?
This is the only way I could help as I do not have a Mobo to take apart.

Best regards,

Bogdan

[bigbop]

Hi Bigbop,

Is it possible to post somewhere some realy blow-up pictures of both sides of the full PCB (even if it gets sliced/sectionned)?
This is the only way I could help as I do not have a Mobo to take apart.

Best regards,

Bogdan

Big pictures won't help. I already have a board that I'm tracing the circuits. But thanks for the offer.

[rohanch]

I tried to make that program for you but it's much beyond my programming skills. Sorry.

Have you tried posting on any other forums for help? XDA Developers? They have done lots of device hacking like this I think in the past.

[bigbop]

Well, I've reverted back to the X50v A02 ROM that has the OHCI driver, brought the USB host lines out to the real world, grounded the overcurrent input status line, installed Ratoc and/or DeJe's drivers and I've pretty well exhausted anything else I can think of other than installing Linux as was suggested earlier by someone.

It appears that the USB host interface might be controlled by a GPIO line from the Toshiba ASIC. I've been looking at the Asus A730 (which has a USB host interface) on the Handhelds.org site and the Toshiba ASIC is similar to the X50v's ASIC (same part # but different programming). The A730 has a USB host sense input line to the ASIC. I don't see anything like that on the X50v.

I still need someone to write a small util that can show the USB registry values in real time as I apply different inputs to the USB host data lines. I think something still needs to be enabled for this to work. I noticed that if I raise either the D+ or D- USB imputs on my laptop to +5v, an interrupt is generated and XP says there is something there but doesn't know what it is. Doing this on the Axim appears to do nothing I can see.

Has anyone used the MS PPC emulator with any X50 ROM images?

[bogroca]

Big pictures won't help. I already have a board that I'm tracing the circuits. But thanks for the offer.

Excuse my english Bigbop , I wanted to ask if you can post those blown-up pictures. Sorry again. I would then be able to trace at least what is visible on the 2 sides of the PCB. A real PCB would be the best, but is so difficult to get my hands on one...

Thanks,

Bogdan

[Bill_Todd]

Bogdan,

Like all PC boards, he Axim board is multilayer. Bigbop suggested it's an 8 layer board. Bigbop has had to painstakingly probe with a continuity checker/meter to trace the connections. Sadly, You would not be able to trace anything much from just a picture.

[bogroca]

Bogdan,

Like all PC boards, he Axim board is multilayer. Bigbop suggested it's an 8 layer board. Bigbop has had to painstakingly probe with a continuity checker/meter to trace the connections. Sadly, You would not be able to trace anything much from just a picture.

Dear Sirs,

I have to explain a little...

I am very familiar with all that is discussed here.
All I would like to get out of this entyre "pictures" issue is not to stress anybody, but to get a better view of the PCB, considering the lack of information on the matter. Belive me, I know I cannot realy accomplish much with just the pictures of it, still is the only thig that (with Bigbop help) may be available to me. Some months ago , myself, I asked this community for a broken x51v, for trying to build the schematics of it. Result=nothing, but some jokes.

Honestly, I believe that the right approach is to explore the HW avenue, fully, before we can start to think of SW.

Again, please excuse my english. I hope that my message gets across the right way ( not like my first one in this thread ).

Best regards,

Bogdan
El. Eng.

[bigbop]

Excuse my english Bigbop , I wanted to ask if you can post those blown-up pictures. Sorry again. I would then be able to trace at least what is visible on the 2 sides of the PCB. A real PCB would be the best, but is so difficult to get my hands on one...
Thanks,
Bogdan

Yes, I know what you said the first time and I will say the same again - pictures of the board will NOT help. This is at least a 6 or 8 layer board. The bottom of the board is mostly ground or power plane. The traces are inside where you can't see them. The only way to trace the board is to have one - and even that is difficult due to blind vias - hidden traces that are located only in the inner layers of the board.

I've gone as far as I can go at this time with the hardware. I found the USB host lines and have brought them out. I found the USB host overcurrent line and grounded it as it defaults to active high state. I've installed USB HID and mass storage drivers after reverting the OS back to A02, which has the OHCI driver and for which the device shows up in DEVMGR. I need a utility that can flip bits in the control registers and monitor the GPIO lines to see what the effect is.

Since I'm a hardware geek and have never really used the PPC emulator - I'm asking if there is anyone that can write a quick and dirty eVB app to do that. It needs to be able to access the USB host and GPIO control registers for read and write. All the Intel PXA270 docs are here: http://www.intel.com/design/embedded...0/techdocs.htm
and the one with the register info is here: http://www.intel.com/design/pca/appl...als/280000.htm

[bigbop]

By the way, back in post 239 http://www.aximsite.com/boards/showp...&postcount=239 I gave the link to the A02 X50v nb0 image I posted but I forgot the CRCs:

DiMa_K_A02_X50v_W2K3_ENG_nb0.crc should contain 53AF2628
DiMa_B_A02_X50v_Bootloader_nb0.crc should contain 7E9BC4A1

I've gone as far as I can go at this time with the hardware. I found the USB host lines and have brought them out. I found the USB host overcurrent line and grounded it as it defaults to active high state. I've installed USB HID and mass storage drivers after reverting the OS back to A02, which has the OHCI driver and for which the device shows up in DEVMGR. I need a utility that can flip bits in the control registers and monitor the GPIO lines to see what the effect is.

Since I'm a hardware geek and have never really used the PPC emulator - I'm asking if there is anyone that can write a quick and dirty eVB app to do that. It needs to be able to access the USB host and GPIO control registers for read and write. All the Intel PXA270 docs are here: http://www.intel.com/design/embedded...0/techdocs.htm
and the one with the register info is here: http://www.intel.com/design/pca/appl...als/280000.htm

Hi,
first of all thank you for putting so much effort into this. Like many others I have been following this thread passionately from the beginning! I know a little bit about programming, but only for scientific calculations, and I really don't know the PDA architecture so I'm afraid I can't make the program you need. Sorry! However, a member (anpaza, who hasn't been around for 2 years now) created a program called HaRET while working on porting linux to the axim. I quoted this from his webpage http://zap.eltrast.ru/:

HaRET helper project
First of all, I had to learn the PDA architecture. Having quite a lot of experience with the PC architecture (and with home computers before that), the learning process duration was just about a month. To have a better understanding of how the PDA hardware works, I wrote a small tool called HaRET - the Handheld Reverse Engineering Tool. It will allow you to connect to your PDA (via a normal telnet command) and issue different commands such as dump memory, write memory, check which GPIOs change for some period of time and so on.


I don't know if this program or a modification of it could be the solution, but otherwise he might be willing to write a specific program which gets the job done?

Wanted to help more if I could, I hope this will lead somewhere!

Greetings,
Thomas

[bigbop]

Hi,
first of all thank you for putting so much effort into this. Like many others I have been following this thread passionately from the beginning! I know a little bit about programming, but only for scientific calculations, and I really don't know the PDA architecture so I'm afraid I can't make the program you need. Sorry! However, a member (anpaza, who hasn't been around for 2 years now) created a program called HaRET while working on porting linux to the axim. I quoted this from his webpage http://zap.eltrast.ru/:

HaRET helper project
First of all, I had to learn the PDA architecture. Having quite a lot of experience with the PC architecture (and with home computers before that), the learning process duration was just about a month. To have a better understanding of how the PDA hardware works, I wrote a small tool called HaRET - the Handheld Reverse Engineering Tool. It will allow you to connect to your PDA (via a normal telnet command) and issue different commands such as dump memory, write memory, check which GPIOs change for some period of time and so on.


I don't know if this program or a modification of it could be the solution, but otherwise he might be willing to write a specific program which gets the job done?

Wanted to help more if I could, I hope this will lead somewhere!

Greetings,
Thomas

Whoa! Thanks for the info. You know, I've heard of this before as I'm on the handhelds.org site alot, but it just didn't click
I've grabbed a copy and all the docs I can find for it and I'll play with it.:approve:

[bigbop]

I just had a look at the motherboard for the LOOX 720 and it appears that HTC did a little re-use. The upper area of the PCB has the BT, Audio and WiFi circuits in the exact same locations and they are laid out the same as on the X50/X51.

In fact, there are even schematics of the BT and WiFi circuits on the Loox Wiki.

So, what does this have to do with the USB host on the X50/X51? Well, the Loox 720 has a USB host interface that you can access from its sync connector. The 720 also runs WM2003 and uses an Intel PXA272 uP which is basically the same as the PXA270 found in the X50/X51. If you look hard enough at the axim and loox boards, you'll also see 2 similar Xilinx logic array chips.

Looking over the 720 PCB photo, I didn't see any special USB host chips, so I'm assuming that HTC is using the PXA272 USB host interface for that and not the USB-OTG interface as there is a separate USB client interface on the sync connector as well.

The ROM for the 720 can be found here: http://www.opendrivers.com/freedownl...-download.html as the Siemens site appears to be down.

The 720 schematics and board photos can be found here: http://linuxloox.oktava.info/index.php/Schematics . Also have a look at the main page of this website for more info.

What's also interesting is the JTAG interface. Both the 720 and the X50/X51 boards have a similar edge connector for test points, so again I'm speculating that there are JTAG points for the CPU and the Xilinx chips.

Oh, when you're looking at the WiFi schematic, you will notice the NVram that stores the MAC address and other data. It's programmed on the board via the 3 test points shown on the diagram - just in case you want to change the MAC of your PDA.

[bigbop]

In answering another post about what pins 5 & 6 enable when grounded (pin 7 supplies +3v), I just realised that one of them may enable the USB host, so I'll be playing with those pins shortly.

If anyone can take the Loox 720 ROM image (it's NOT encrypted) and pull it apart for the usb.dll, ohci.dll and any other USB host driver stuff that might be in there, that would be great.

Thanks!

BTW, I just discovered the HTC codename during development of the Axim was Colorado

[bigbop]

In answering another post about what pins 5 & 6 enable when grounded (pin 7 supplies +3v), I just realised that one of them may enable the USB host, so I'll be playing with those pins shortly.

If anyone can take the Loox 720 ROM image (it's NOT encrypted) and pull it apart for the usb.dll, ohci.dll and any other USB host driver stuff that might be in there, that would be great.

OK, I pulled the Loox 720 ROM apart using the dumprom utility from the XDA folks. I now have the dll files I need and will play with them if they are not XIP locked.

I compared the X50v A02 ROM modules to the 720 ROM modules and they just about lined up except for device specific stuff like the Wifi, camera and USB Host drivers. Both devices are PXA27x devices running WM2003SE so hopefully I can reuse the USB host dlls on the X50v.