LPC2103-based Digital Photo Frame ================================= .. image:: pics/lpc2103_dpf1.jpg It seems there are quite a few 3.5 inch photo frames advertised as having the NXP LPC2103 ARM7 CPU coupled with a SSD1928 graphics CPU. I decided to get hold of one to look into potential for use with the Edimax router. This is what I found from the 'no-name' DPF I got off Ebay. I presume other NXP-based photo frames will have similar architectures. In particular there is one from `Ebuyer `_ also with NXPLPC2103. CPU --- CPU is an LPC2103 ARM7-based MCU. On my model this is clocked at 12MHz, so internally runs at 48MHz. Display controller ------------------ The SSD1928 is a fairly advanced display controller. It has a 2D graphics engine featuring panning, scrolling, rotation, line, rectangle and ellipse drawing. There are bit block transfers, and a hardware JPEG engine. The controller supports up to 320x240 in 32-bit colour. As a bonus you also get 256K of SRAM, and an SD card reader. Data sheet is available from the manufacturer on request (I didn't have any trouble getting it sent to me even though I didn't say I was a company). Any probs, send me a mail and I'll email it to you. .. image:: pics/lpc2103_dpf.jpg Real time clock --------------- There appears to be board space for a RTC button cell. LPC2103 has a RTC on board, so presumably by adding the appropriate components you can have a fully featured RTC. Debug connector --------------- Any hacks of the device will have to be through the 20-pin header on the main board, unfortunately it is not standard 0.1 inch pitch but 2mm pitch, so you'll need to buy the right size header or make an adaptor. .. image:: pics/lpc2103_dpf6.jpg Pinout is as follows:: 1: +3.3v supply (specifically vref on the JTAG, but same as supply). 2: +3.3v supply 3: 10k pull-up, ~TRST 4: GND 5: 10k pull-up, TDI 6: GND 7: 10k pull-up, TMS 8: GND 9: 10k pull-down, TCK 10: GND 11: 10k pull-down, RTCK 12: GND 13: 10k pull-up, TDO 14: GND 15: 10k pull-up, ~RST 16: GND 17: 10k pull-down, DBGRQ 18: GND 19: 10k pull-down, DBGACK 20: GND DBGRQ and DBGACK are rarely brought out to physical pins on ARM devices. It seems they are not connected to any LPC2103 pins, so are unused. This is actually a standard ARM JTAG pin-out and you can use a standard Macgraigor wiggler clone such as the one available from Jabs Place: http://jabsplace.co.uk/shop/index.php?main_page=product_info&cPath=18&products_id=117. Backing up/changing the firmware -------------------------------- Under Linux, OpenOCD can be used. Install the latest OpenOcd version from http://openocd.berlios.de/web/. Be sure to follow the config instructions to ensure support for parallel port JTAG. As root, you need parport modules:: modprobe parport modprobe parport_pc modprobe ppdev chmod 777 /dev/parport0 Now you can do the rest as a normal user. You can use `this config file `_:: arm@bomba:~$ openocd -f lpc2103_openocd_wig.cfg & [1] 2355 Open On-Chip Debugger 1.0 (2008-03-29-00:11) svn:526 $URL: svn://svn.berlios.de/openocd/trunk/src/openocd.c $ Info: jtag.c:1328 jtag_examine_chain(): JTAG device found: 0x4f1f0f0f (Manufacturer: 0x787, Part: 0xf1f0, Version: 0x4) With that lot running in the background you can telnet into the OpenOCD command interpreter and dump the firmware for a backup:: arm@bomba:~$ telnet localhost 4444 Trying 127.0.0.1... Info: server.c:97 add_connection(): accepting 'telnet' connection from 0 Connected to localhost. Escape character is '^]'. Open On-Chip Debugger > dump_image firmware.bin 0 0x8000 dumped 32768 byte in 5.330469s Disassembly ----------- Obtain the GNU tools from http://www.gnuarm.com. The latest Linux binary toolchain release I found was `gcc 3.4.3 `_. With the aid of arm-elf-objdump you can get a disassembly:: arm-elf-objdump -D --target=binary -marm firmware.bin firmware.bin: file format binary Disassembly of section .data: 00000000 <.data>: 0: e59f4034 ldr r4, [pc, #52] ; 0x3c 4: e3a05002 mov r5, #2 ; 0x2 8: e5845000 str r5, [r4] c: e3a05003 mov r5, #3 ; 0x3 10: e5845004 str r5, [r4, #4] 14: e59f201c ldr r2, [pc, #28] ; 0x38 18: e3a03000 mov r3, #0 ; 0x0 1c: e1020093 swp r0, r3, [r2] 20: e2822028 add r2, r2, #40 ; 0x28 24: e1021093 swp r1, r3, [r2] Console output -------------- For debugging purposes, the pins of one of the LPC2103 UARTs (UART0) are available on two test pads as shown below. .. image:: pics/lpc2103_test_uart.jpg The pads are only 1mm diameter, but with a good soldering iron it should be possible to connect something to them. Unfortunately, these pins are also used for the data connection to the SSD1928, so cannot be used while accessing the graphics controller. SSD1928 Addressing mode ----------------------- .. image:: pics/lpc2103_tracks.jpg Some of the interconnections with the LPC2103 have been established visually:: SSD ARM === === M/R# -> GND WE1# -> GND WE0# -> P0.21 For 8080, WE# RD/WR# -> GND RD# -> P0.16 CS# -> P0.23 D/C# -> P0.24 DB0:15 -> P0.0:15 RESET# -> P0.25 PLL_DIS-> GND 8080 16-bit indirect addressing is therefore configured. There are 16 data/address lines, CS# (chip select), RD# (read strobe), WR# (write strobe) and D/C# (data/command select, pin 47).