Memory-mapped I/O ports on CX II

Not all parts have been discovered and researched yet, so the information on this page is not complete.

00000000 - Boot1 ROM

128kB of on-chip ROM.

10000000 - SDRAM

64 MiB, managed by 0x90120000.

90000000 - General Purpose I/O (GPIO)

See GPIO Pins

90010000 - Fast timer

The same interface as 900C0000/900D0000, see Second timer.

90020000 - Serial UART

PL011.

90030000 - Unknown

Probably some kind of hash/crypto thing.

90040000 - SPI controller

FTSSP010 SPI controller connected to the LCD.

90060000 - Watchdog timer

Possibly an ARM SP805 or compatible. Runs at the APB clock frequency.

90070000 - Second Serial UART

PL011.

90080000 - Cradle SPI Controller

An FTSSP010 for communicating with the EEPROM in the cradle.

90090000 - Real-Time Clock (RTC)

Similar to the ARM PrimeCell PL031, but interrupt registers are different.

• 90090000 (R): Current time, increments by 1 every second.
• 90090004 (R/W): Alarm value. When the time passes this, interrupt becomes active.
• 90090008 (R/W): Sets the value of 90090000 (clock will not read new time until a couple seconds later). Reads last value written.
• 9009000C (R/W): Interrupt mask (1-bit)
• 90090010 (R/W): Masked interrupt status, reads 1 if interrupt active and mask bit is set. Write 1 to acknowledge.
• 90090014 (R): Status
  • Bit 0: Time setting in progress
  • Bit 1: Alarm setting in progress
  • Bit 2: Interrupt acknowledgment in progress
  • Bit 3: Interrupt mask setting in progress

900A0000 - Miscellaneous

Seems to be similar to CX and Classic, except for the model ID at 900A0000 which is now 0x202.

900B0000 - ADC

A Faraday FTADCC010.

900C0000 - First timer

Same port structure as Second timer.

900D0000 - Second timer

Timer is a SP804.

900E0000 - Keypad controller

See also Keypads for information about the keypads themselves.

• 900E0000 (R/W):
  • Bits 0-1: Scan mode
    • Mode 0: Idle.
    • Mode 1: Indiscriminate key detection. Data registers are not updated, but whenever any key is pressed, interrupt bit 2 is set (and cannot be cleared until the key is released).
    • Mode 2: Single scan. The keypad is scanned once, and then the mode returns to 0.
    • Mode 3: Continuous scan. When scanning completes, it just starts over again after a delay.
  • Bits 2-15: Number of APB cycles to wait before scanning each row
  • Bits 16-31: Number of APB cycles to wait between scans
• 900E0004 (R/W):
  • Bits 0-7: Number of rows to read (later rows are not updated in 900E0010-900E002F, and just read as whatever they were before being disabled)
  • Bits 8-15: Number of columns to read (later column bits in a row are set to 1 when it is updated)
• 900E0008 (R/W): Keypad interrupt status/acknowledge (3-bit). Write "1" bits to acknowledge.
  • Bit 0: Keypad scan complete
  • Bit 1: Keypad data register changed
  • Bit 2: Key pressed in mode 1
• 900E000C (R/W): Keypad interrupt mask (3-bit). Set each bit to 1 if the corresponding event in [900E0008] should cause an interrupt.
• 900E0010-900E002F (R): Keypad data, one halfword per row.
• 900E0030-900E003F (R/W): Keypad GPIOs. Each register is 20 bits, with one bit per GPIO. The role of each register is unknown.
• 900E0040 (R/W): Interrupt enable. Bits unknown but seems to be related to touchpad. Causes interrupt on touchpad touched.
• 900E0044 (R/W): Interrupt status. Bits unknown. Write 1s to acknowledge.
• 900E0048 (R/W): Unknown

90120000 - SDRAM Controller

An FTDDR3030.

90130000 - Unknown Controller for the LCD Backlight

The OS controls the LCD backlight by writing to 90130018.

90140000 - Power management

A new "Aladdin PMU" unit. Not much known.

• 90140000 (R/?): Reason for waking up from low-power mode.
• 90140050 (R/W): Disable bus access to peripherals. Reads will just return the last word read from anywhere in the address range, and writes will be ignored.
  • Bit 9: #C8010000 - Triple DES encryption
  • Bit 10: #CC000000 - SHA-256 hash generator
  • Bit 13: #90060000 - Watchdog timer (?)
  • Bit 26: #90050000 - I2C controller (?)
• 90140050 (R/W): Disable bus access to peripherals. Reads will just return the last word read from anywhere in the address range, and writes will be ignored.

A0000000 - Boot1 ROM again

Mirror of the ROM at 0.

A4000000 - Internal SRAM

0x40000 bytes SRAM, managed by the controller at ?.

A8000000 - Magic VRAM

0x25800 bytes SRAM for an LCD framebuffer.

It is wired up in a way that the written data is X-Y swapped and rotated, so that writing a 320x240 image with (0/0) at the top left results in a 320x320 image in the right orientation for the LCD. This means that it can't be used as generic RAM. How this mechanism works isn't known yet.

B0000000 - USB OTG/Host/Device controller (top)

An FOTG210 connected to the top USB port.

B4000000 - USB OTG/Host/Device controller (bottom)

An FOTG210 connected to the bottom USB port (dock connector).

B8000000 - SPI NAND controller

An FTSPI020 with a MICRON 1Gb flash at CS 1.

BC000000 - DMA controller

An FTDMAC020 with main SDRAM and LCD RAM (everything?) connected to AHB1. The OS uses this to copy the framebuffer into LCD RAM.

C0000000 - LCD controller

A PL111.

C8010000 - Triple DES encryption

Implements the Triple DES encryption algorithm.

• C8010000 (R/W): Right half of block
• C8010004 (R/W): Left half of block. Writing this causes the block to be encrypted/decrypted.
• C8010008 (R/W): Right 32 bits of key 1
• C801000C (R/W):
  • Bits 0-23: Left 24 bits of key 1
  • Bit 30: Set to 0 to encrypt, 1 to decrypt
• C8010010 (R/W): Right 32 bits of key 2
• C8010014 (R/W): Left 24 bits of key 2
• C8010018 (R/W): Right 32 bits of key 3
• C801001C (R/W): Left 24 bits of key 3

CC000000 - SHA-256 hash generator

Implements the SHA-256 hash algorithm, which is used in cryptographic signatures.

• CC000000 (R): Busy if bit 0 set
• CC000000 (W): Write 0x10 and then 0x0 to initialize. Write 0xA to process first block, 0xE to process subsequent blocks
• CC000008 (R/W): Some sort of bus write-allow register? If a bit is set, it allows R/W access to the registers of the peripheral, if clear, R/O access only. Don't know what it's doing here, but it's here anyway.
  • Bit 8: #CC000000 - SHA-256 hash generator
  • Bit 10: ?
• CC000010-CC00004F (R/W): 512-bit block
• CC000060-CC00007F (R): 256-bit state

DC000000 - Interrupt controller

See Interrupts. The controller is a PL190.