Home

Welcome to the project WIKI.

My blog posts about this hardware: http://smallhacks.wordpress.com/tag/mci730/.

GPL sources from Philips: https://sourceforge.net/projects/mci73012src/files/GPL_SRC/

Mplayer 1.1 binary package: https://sourceforge.net/projects/mci73012src/files/mci_soft/

Hardware description

Name	Description
System board	VT8610 SoC
CPU	ARM926EJ-Sid(wb) rev 5 (v5l), CPU architecture: 5TEJ, VIA-VT8610 hardware, probably running on 150Mhz (see cat /proc/cpufreq and /proc/sys/cpu/0/speed*)
LCD	VT8430(?) 320x240, with framebuffer driver, could be used as /dev/fb0
FM Radio	Si4705-B20-GM/GU product page and Si47xx Programming Guide, managed with I2C, RDS on /dev/input/event2
Sound	WM8978 chip. Playback is implemented via OSS interface (/dev/dsp). Volume control and sound routing is implemented with direct I2C commands.
Remote control	handled by event0 and kbd, possible to read with cat /dev/input/event0
CDROM	Something on I2C bus. Probably only managed by firmware, sound directly routed to the amplifier. It is not seen as standard Linux cd.
Power button	/dev/input0 "Soft" power switch, controlled by firmware
Power led	Probably /sys/devices/system/leds/leds0/event, no luck with turning it on or off, may be gpio controlled
GPIO ports	A lot of GPIO exported by kernel to /proc/vt8500/registers/. No documentation found, but firmware using at least some of them to control device. Last byte on GPIO_005C - LCD brightness control, GPIO_0044 - sound related.
USB ports	2 USB 2.0 ports available, one is connected to the internal WIFI card and another one is available on front.
WIFI Card	Internally connected USB VT6656 card with non GPL driver loaded as module vntwusb.ko + modified wpa_supplicant. On my tests it works very unstable. Link to driver and build instruction
Memory	128Mb with 112Mb available to the kernel. No idea where are other 16Mb.
Ethernet	100Mb Ethernet VT6105/VT6106S connected to PCI (1106:3104)
i2c bus	exported /dev/i2c/0, opened by firmware
Flash memory	available as /dev/mtd*, seems to be 24Mb total size. Flash chip connected on SPI bus.
Serial ports	Kernel cmdline contains console=ttyS0,115200n8, no /dev/ nodes found
Touch screen	VT8500-TS, handled by mouse0 and event3

Software overview

Name	Description
Kernel	Linux (none) 2.6.10_dev-VT8610 #295 Wed Oct 13 11:48:35 CST 2010 armv5tejl unknown, boot args are "mem=112M root=/dev/mtdblock0 noinitrd ro rootfstype=cramfs console=ttyS0,115200n8 lpj=750000 lcdid=0 lcdbpp=24 lcdon=1 quiet"
User Interface	mgfxclient - something closed source by MediaBolic
WIFI driver	non GPL by via, mounted to /tmp/wifi, buggy
OS	based on MontaVista(R) Linux(R) Professional Edition 4.0 (0501140), also motd contains "Welcome to VIA(R) Linux(R) Environment"
Compiler	arm_v5t_le-gcc (GCC) 3.4.3 (MontaVista 3.4.3-25.0.30.0501131 2005-07-23)

Flash layout

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00c50000 00010000 "filesystem"
mtd1: 00280000 00010000 "mini_filesystem"
mtd2: 00180000 00010000 "mini_kernel"
mtd3: 00400000 00010000 "font_lib"
mtd4: 00050000 00010000 "sysconf"
mtd5: 00170000 00010000 "kernel"
mtd6: 00180000 00010000 "wifi"
mtd7: 00010000 00010000 "ECD_key"
mtd8: 00030000 00010000 "uboot"
mtd9: 00010000 00010000 "uboot var1"
mtd10: 00010000 00010000 "uboot var2"
mtd11: 00010000 00010000 "vload"

Dev	Size	FS Type	Description
mtd0	12910592 bytes, 12.3 MiB	cramfs	rootfs, including vendor software
mtd1	2621440 bytes, 2.5 MiB	cramfs	mini fs, used by updater
mtd2	1572864 bytes, 1.5 MiB	u-boot uImage	mini kernel, used by updater, kernel image
mtd3	4194304 bytes, 4.0 MiB	cramfs	TTF font (mb.ttf) used by vendor software
mtd4	327680 bytes, 320.0 KiB	jffs2	filesystem with local settings, mounted to /usr/local/etc
mtd5	1507328 bytes, 1.4 MiB	u-boot uImage	primary kernel image
mtd6	1572864 bytes, 1.5 MiB	cramfs	WIFI module + tools
mtd7	65536 bytes, 64.0 KiB	cramfs	Contain device key, used by vendor software. Format is not yet known, but some fields are self explained: mac_address,unknown_based_on_mac,unknown_decimal,model_name, unknown_hex, unknown_hex, registration_number
mtd8	196608 bytes, 192.0 KiB	binary	U-BOOT loader
mtd9	65536 bytes, 64.0 KiB	binary	U-BOOT variables
mtd10	65536 bytes, 64.0 KiB	binary	U-BOOT variables
mtd11	65536 bytes, 64.0 KiB	binary	vload, loader (?), contains text "VLOAD VER117 CPU300 DDR2 433 16BIT DIV2 DIS2"

U-Boot env content

# ./fw_printenv 
baudrate=115200
loadaddr=0x02000000
show_info=1
rootfs_size=c44000
bootfile=uzImage_16M.bin
filesize=c34000
fileaddr=0
gpio4_set_in=mw 0xd811003c 0
miniboot=bootm fea80000
normalboot=bootm ffca0000
up_flag_de_sw=if itest.b *0xd8130038 != 0;then run miniboot;fi
up_flag_de_hw=if bittest 0xd811007c 4;then ;else run miniboot;fi
bootdelay=1
bl_on=mw.l d8110040 01000000 1 ; mw.l d8110020 01000000 1
bl_normal=mw.l d811005c 00000042 1 ; mw.l d811003c 000000c3 1
bl_dim=mw.l d811005c 00000082 1 ; mw.l d811003c 000000c3 1
bl_off=mw.l d8110040 00000000 1 ; mw.l d8110020 00000000 1
bl_up=run bl_dim;run bl_on;mw.l 0xd8130030 1 1
coldboot_test=if itest.b *0xd8130030 != 0;then ;else run bl_up;fi
gatewayip=10.1.1.254
netmask=255.255.255.0
bootargs=mem=112M root=/dev/mtdblock0 noinitrd ro rootfstype=cramfs console=ttyS0,115200n8 lpj=750000 lcdid=0 lcdbpp=24 lcdon=1 quiet
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.1.4_Magellan (Feb 26 2010 - 18:21:02)
ipaddr=10.1.1.101
serverip=10.1.1.1
ethaddr=<STRIP>
fwupg_test=if test -n $customerkey ; then if test.s $customerkey = 1; then mw.b d8130038 1;run miniboot; fi; fi
bootcmd=run coldboot_test;run fwupg_test;run up_flag_de_hw;run up_flag_de_sw;run normalboot
customerkey=0

Dmesg on boot

dmesg

[dmesg]

I2C devices

# ./i2cdetect -y 0

     0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- -- -- -- -- -- 
10: -- 11 -- -- -- -- -- -- 18 -- 1a -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --

0x1A - WM8978 (Sound card)
0x11 - Si4705-B20-GM/GU FM Radio.
0x18 - CD, managed by firmware

Inputs

/dev/input/event0 - Philips Remote Controller and keys
/dev/input/event1 - Headphones detector
/dev/input/event2 - FM-RDS update interrupt. RDS is fetched with i2c commands
/dev/input/event3 - LCD Touch-pad

PCI Bus device list

# ./lspci -v -i ./pci.ids.gz 
00:01.0 IDE interface: VIA Technologies, Inc. Device 1359 (prog-if 8f [Master SecP SecO PriP PriO])
        Subsystem: VIA Technologies, Inc. Device 1358
        Flags: bus master, medium devsel, latency 32, IRQ 3
        I/O ports at d8008100 [size=8]
        I/O ports at d8008144 [size=4]
        I/O ports at d8008180 [size=16]

00:02.0 Ethernet controller: VIA Technologies, Inc. VT6105/VT6106S [Rhine-III] (rev 84)
        Subsystem: VIA Technologies, Inc. Device 0106
        Flags: bus master, medium devsel, latency 64, IRQ 10
        I/O ports at d8004000 [size=256]
        Memory at d8004000 (32-bit, non-prefetchable) [size=256]
        Kernel driver in use: rhinefet

00:04.0 USB controller: VIA Technologies, Inc. USB 2.0 (rev 90) (prog-if 20 [EHCI])
        Subsystem: VIA Technologies, Inc. USB 2.0
        Flags: bus master, medium devsel, latency 22, IRQ 43
        Memory at d8007900 (32-bit, non-prefetchable) [size=256]
        Kernel driver in use: ehci_hcd

00:05.0 USB controller: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller (rev 90) (prog-if 00 [UHCI])
        Subsystem: VIA Technologies, Inc. VT82xxxxx UHCI USB 1.1 Controller
        Flags: medium devsel, IRQ 43
        I/O ports at d8007b00 [disabled] [size=32]