LPC2103-based Digital Photo Frame

It seems there are quite a few 3.5 inch photo frames advertised as having the NXP LPC2103 ARM7 CPU coupled with a SSD1928 graphics CPU. I decided to get hold of one to look into potential for use with the Edimax router. This is what I found from the 'no-name' DPF I got off Ebay. I presume other NXP-based photo frames will have similar architectures. In particular there is one from Ebuyer also with NXPLPC2103.

CPU

CPU is an LPC2103 ARM7-based MCU. On my model this is clocked at 12MHz, so internally runs at 48MHz.

Display controller

The SSD1928 is a fairly advanced display controller. It has a 2D graphics engine featuring panning, scrolling, rotation, line, rectangle and ellipse drawing. There are bit block transfers, and a hardware JPEG engine. The controller supports up to 320x240 in 32-bit colour. As a bonus you also get 256K of SRAM, and an SD card reader. Data sheet is available from the manufacturer on request (I didn't have any trouble getting it sent to me even though I didn't say I was a company). Any probs, send me a mail and I'll email it to you.

Real time clock

There appears to be board space for a RTC button cell. LPC2103 has a RTC on board, so presumably by adding the appropriate components you can have a fully featured RTC.

Debug connector

Any hacks of the device will have to be through the 20-pin header on the main board, unfortunately it is not standard 0.1 inch pitch but 2mm pitch, so you'll need to buy the right size header or make an adaptor.

Pinout is as follows:

1:  +3.3v supply (specifically vref on the JTAG, but same as supply).
2:  +3.3v supply
3:  10k pull-up,  ~TRST
4:  GND
5:  10k pull-up,  TDI
6:  GND
7:  10k pull-up,  TMS
8:  GND
9:  10k pull-down,  TCK
10: GND
11: 10k pull-down,  RTCK
12: GND
13: 10k pull-up,  TDO
14: GND
15: 10k pull-up,  ~RST
16: GND
17: 10k pull-down, DBGRQ
18: GND
19: 10k pull-down, DBGACK
20: GND

DBGRQ and DBGACK are rarely brought out to physical pins on ARM devices. It seems they are not connected to any LPC2103 pins, so are unused. This is actually a standard ARM JTAG pin-out and you can use a standard Macgraigor wiggler clone such as the one available from Jabs Place: http://jabsplace.co.uk/shop/index.php?main_page=product_info&cPath=18&products_id=117.

Backing up/changing the firmware

Under Linux, OpenOCD can be used. Install the latest OpenOcd version from http://openocd.berlios.de/web/. Be sure to follow the config instructions to ensure support for parallel port JTAG.

As root, you need parport modules:

modprobe parport
modprobe parport_pc
modprobe ppdev
chmod 777 /dev/parport0

Now you can do the rest as a normal user. You can use this config file:

arm@bomba:~$ openocd -f lpc2103_openocd_wig.cfg &
[1] 2355
Open On-Chip Debugger 1.0 (2008-03-29-00:11) svn:526
$URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $
Info:    jtag.c:1328 jtag_examine_chain(): JTAG device found: 0x4f1f0f0f (Manufacturer: 0x787, Part: 0xf1f0, Version: 0x4)

With that lot running in the background you can telnet into the OpenOCD command interpreter and dump the firmware for a backup:

arm@bomba:~$ telnet localhost 4444
Trying 127.0.0.1...
Info:    server.c:97 add_connection(): accepting 'telnet' connection from 0
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> dump_image firmware.bin 0 0x8000
dumped 32768 byte in 5.330469s

Disassembly

Obtain the GNU tools from http://www.gnuarm.com. The latest Linux binary toolchain release I found was gcc 3.4.3. With the aid of arm-elf-objdump you can get a disassembly:

arm-elf-objdump -D --target=binary -marm firmware.bin

firmware.bin:     file format binary

Disassembly of section .data:

00000000 <.data>:
       0:       e59f4034        ldr     r4, [pc, #52]   ; 0x3c
       4:       e3a05002        mov     r5, #2  ; 0x2
       8:       e5845000        str     r5, [r4]
       c:       e3a05003        mov     r5, #3  ; 0x3
      10:       e5845004        str     r5, [r4, #4]
      14:       e59f201c        ldr     r2, [pc, #28]   ; 0x38
      18:       e3a03000        mov     r3, #0  ; 0x0
      1c:       e1020093        swp     r0, r3, [r2]
      20:       e2822028        add     r2, r2, #40     ; 0x28
      24:       e1021093        swp     r1, r3, [r2]
<snip>

Console output

For debugging purposes, the pins of one of the LPC2103 UARTs (UART0) are available on two test pads as shown below.

The pads are only 1mm diameter, but with a good soldering iron it should be possible to connect something to them. Unfortunately, these pins are also used for the data connection to the SSD1928, so cannot be used while accessing the graphics controller.

SSD1928 Addressing mode

Some of the interconnections with the LPC2103 have been established visually:

SSD       ARM
===       ===
M/R#   -> GND
WE1#   -> GND
WE0#   -> P0.21   For 8080, WE#
RD/WR# -> GND
RD#    -> P0.16
CS#    -> P0.23
D/C#   -> P0.24
DB0:15 -> P0.0:15
RESET# -> P0.25
PLL_DIS-> GND

8080 16-bit indirect addressing is therefore configured. There are 16 data/address lines, CS# (chip select), RD# (read strobe), WR# (write strobe) and D/C# (data/command select, pin 47).