NAND Memory Layout and Memory-mapped I/O ports on CX II: Difference between pages
Vogtinator (talk | contribs) (VRAM is magic) |
|||
Line 1: | Line 1: | ||
Not all parts have been discovered and researched yet, so the information on this page is not complete. | |||
==00000000 - Boot1 ROM== | |||
128kB of on-chip ROM. | |||
== | ==10000000 - SDRAM== | ||
64 MiB, managed by 0x90120000. | |||
==90000000 - General Purpose I/O (GPIO)== | |||
See [[GPIO Pins]] | |||
==90010000 - Fast timer== | |||
The same interface as 900C0000/900D0000, see [[#900D0000 - Second timer|Second timer]]. | |||
==90020000 - Serial UART== | |||
[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0183f/DDI0183.pdf PL011]. | |||
==90030000 - Unknown== | |||
Probably some kind of hash/crypto thing. | |||
==90040000 - SPI controller== | |||
FTSSP010 SPI controller connected to the LCD. | |||
==90060000 - Watchdog timer== | |||
Possibly an [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0270b/index.html ARM SP805] or compatible. | |||
==90070000 - Second Serial UART== | |||
[http://infocenter.arm.com/help/topic/com.arm.doc.ddi0183f/DDI0183.pdf PL011]. | |||
==90080000 - Unknown== | |||
Unknown. Probably an FTSSP010 as well. | |||
==90090000 - Real-Time Clock (RTC)== | |||
Similar to the [http://infocenter.arm.com/help/topic/com.arm.doc.ddi0224b/index.html ARM PrimeCell PL031], but interrupt registers are different. | |||
* 90090000 (R): Current time, increments by 1 every second. | |||
* 90090004 (R/W): Alarm value. When the time passes this, interrupt becomes active. | |||
* 90090008 (R/W): Sets the value of 90090000 (clock will not read new time until a couple seconds later). Reads last value written. | |||
* 9009000C (R/W): Interrupt mask (1-bit) | |||
* 90090010 (R/W): Masked interrupt status, reads 1 if interrupt active and mask bit is set. Write 1 to acknowledge. | |||
* 90090014 (R): Status | |||
** Bit 0: Time setting in progress | |||
** Bit 1: Alarm setting in progress | |||
** Bit 2: Interrupt acknowledgment in progress | |||
** Bit 3: Interrupt mask setting in progress | |||
==900A0000 - Miscellaneous== | |||
Seems to be similar to CX and Classic, except for the model ID at 900A0000 which is now 0x202. | |||
==900B0000 - ADC== | |||
A Faraday FTADCC010. | |||
==900C0000 - First timer== | |||
Same port structure as [[#900D0000 - Second timer|Second timer]]. | |||
==900D0000 - Second timer== | |||
Timer is a [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0271d/Babehiha.html SP804]. | |||
==900E0000 - Keypad controller== | |||
See also [[Keypads]] for information about the keypads themselves. | |||
* 900E0000 (R/W): | |||
** Bits 0-1: Scan mode | |||
*** Mode 0: Idle. | |||
*** Mode 1: Indiscriminate key detection. Data registers are not updated, but whenever any key is pressed, interrupt bit 2 is set (and cannot be cleared until the key is released). | |||
*** Mode 2: Single scan. The keypad is scanned once, and then the mode returns to 0. | |||
*** Mode 3: Continuous scan. When scanning completes, it just starts over again after a delay. | |||
** Bits 2-15: Number of APB cycles to wait before scanning each row | |||
** Bits 16-31: Number of APB cycles to wait between scans | |||
* 900E0004 (R/W): | |||
** Bits 0-7: Number of rows to read (later rows are not updated in 900E0010-900E002F, and just read as whatever they were before being disabled) | |||
** Bits 8-15: Number of columns to read (later column bits in a row are set to 1 when it is updated) | |||
* 900E0008 (R/W): Keypad interrupt status/acknowledge (3-bit). Write "1" bits to acknowledge. | |||
** Bit 0: Keypad scan complete | |||
** Bit 1: Keypad data register changed | |||
** Bit 2: Key pressed in mode 1 | |||
* 900E000C (R/W): Keypad interrupt mask (3-bit). Set each bit to 1 if the corresponding event in [900E0008] should cause an interrupt. | |||
* 900E0010-900E002F (R): Keypad data, one halfword per row. | |||
* 900E0030-900E003F (R/W): Keypad GPIOs. Each register is 20 bits, with one bit per GPIO. The role of each register is unknown. | |||
* 900E0040 (R/W): Interrupt enable. Bits unknown but seems to be related to touchpad. Causes interrupt on touchpad touched. | |||
* 900E0044 (R/W): Interrupt status. Bits unknown. Write 1s to acknowledge. | |||
* 900E0048 (R/W): Unknown | |||
==90120000 - SDRAM Controller== | |||
An FTDDR3030. | |||
==90130000 - Unknown Controller for the LCD Backlight== | |||
The OS controls the LCD backlight by writing to 90130018. | |||
==90140000 - Power management== | |||
A new "Aladdin PMU" unit. Not much known. | |||
* 90140000 (R/?): Reason for waking up from low-power mode. | |||
* 90140050 (R/W): Disable bus access to peripherals. Reads will just return the last word read from anywhere in the address range, and writes will be ignored. | |||
** Bit 9: [[#C8010000 - Triple DES encryption]] | |||
** Bit 10: [[#CC000000 - SHA-256 hash generator]] | |||
** Bit 13: [[#90060000 - Watchdog timer]] (?) | |||
** Bit 26: [[#90050000 - I2C controller]] (?) | |||
* 90140050 (R/W): Disable bus access to peripherals. Reads will just return the last word read from anywhere in the address range, and writes will be ignored. | |||
==A4000000 - Internal SRAM== | |||
0x40000 bytes SRAM, managed by the controller at ?. | |||
==A8000000 - Magic VRAM== | |||
0x25800 bytes SRAM for an LCD framebuffer. | |||
It is wired up in a way that the written data is X-Y swapped and rotated, so that writing a 320x240 image with (0/0) at the top left results in a 320x320 image in the right orientation for the LCD. | |||
This means that it can't be used as generic RAM. How this mechanism works isn't known yet. | |||
==B0000000 - USB OTG/Host/Device controller (top)== | |||
An FOTG210 connected to the top USB port. | |||
==B4000000 - USB OTG/Host/Device controller (bottom)== | |||
An FOTG210 connected to the bottom USB port (dock connector). | |||
==B8000000 - SPI NAND controller== | |||
An FTSPI020 with a MICRON 1Gb flash at CS 1. | |||
==BC000000 - DMA controller== | |||
An FTDMAC020 with main SDRAM and LCD RAM (everything?) connected to AHB1. The OS uses this to copy the framebuffer into LCD RAM. | |||
==C0000000 - LCD controller== | |||
A [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0293c/index.html PL111]. | |||
==C8010000 - Triple DES encryption== | |||
Implements the [http://en.wikipedia.org/wiki/Triple_DES Triple DES encryption algorithm]. | |||
* C8010000 (R/W): Right half of block | |||
* C8010004 (R/W): Left half of block. Writing this causes the block to be encrypted/decrypted. | |||
* C8010008 (R/W): Right 32 bits of key 1 | |||
* C801000C (R/W): | |||
** Bits 0-23: Left 24 bits of key 1 | |||
** Bit 30: Set to 0 to encrypt, 1 to decrypt | |||
* C8010010 (R/W): Right 32 bits of key 2 | |||
* C8010014 (R/W): Left 24 bits of key 2 | |||
* C8010018 (R/W): Right 32 bits of key 3 | |||
* C801001C (R/W): Left 24 bits of key 3 | |||
==CC000000 - SHA-256 hash generator== | |||
Implements the [http://en.wikipedia.org/wiki/SHA_hash_functions SHA-256 hash algorithm], which is used in cryptographic signatures. | |||
* CC000000 (R): Busy if bit 0 set | |||
* CC000000 (W): Write 0x10 and then 0x0 to initialize. Write 0xA to process first block, 0xE to process subsequent blocks | |||
* CC000008 (R/W): Some sort of bus write-allow register? If a bit is set, it allows R/W access to the registers of the peripheral, if clear, R/O access only. Don't know what it's doing here, but it's here anyway. | |||
** Bit 8: [[#CC000000 - SHA-256 hash generator]] | |||
** Bit 10: ? | |||
* CC000010-CC00004F (R/W): 512-bit block | |||
* CC000060-CC00007F (R): 256-bit state | |||
==DC000000 - Interrupt controller== | |||
See [[Interrupts]]. The controller is a [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0181e/index.html PL190]. |
Revision as of 18:47, 7 March 2020
Not all parts have been discovered and researched yet, so the information on this page is not complete.
00000000 - Boot1 ROM
128kB of on-chip ROM.
10000000 - SDRAM
64 MiB, managed by 0x90120000.
90000000 - General Purpose I/O (GPIO)
See GPIO Pins
90010000 - Fast timer
The same interface as 900C0000/900D0000, see Second timer.
90020000 - Serial UART
90030000 - Unknown
Probably some kind of hash/crypto thing.
90040000 - SPI controller
FTSSP010 SPI controller connected to the LCD.
90060000 - Watchdog timer
Possibly an ARM SP805 or compatible.
90070000 - Second Serial UART
90080000 - Unknown
Unknown. Probably an FTSSP010 as well.
90090000 - Real-Time Clock (RTC)
Similar to the ARM PrimeCell PL031, but interrupt registers are different.
- 90090000 (R): Current time, increments by 1 every second.
- 90090004 (R/W): Alarm value. When the time passes this, interrupt becomes active.
- 90090008 (R/W): Sets the value of 90090000 (clock will not read new time until a couple seconds later). Reads last value written.
- 9009000C (R/W): Interrupt mask (1-bit)
- 90090010 (R/W): Masked interrupt status, reads 1 if interrupt active and mask bit is set. Write 1 to acknowledge.
- 90090014 (R): Status
- Bit 0: Time setting in progress
- Bit 1: Alarm setting in progress
- Bit 2: Interrupt acknowledgment in progress
- Bit 3: Interrupt mask setting in progress
900A0000 - Miscellaneous
Seems to be similar to CX and Classic, except for the model ID at 900A0000 which is now 0x202.
900B0000 - ADC
A Faraday FTADCC010.
900C0000 - First timer
Same port structure as Second timer.
900D0000 - Second timer
Timer is a SP804.
900E0000 - Keypad controller
See also Keypads for information about the keypads themselves.
- 900E0000 (R/W):
- Bits 0-1: Scan mode
- Mode 0: Idle.
- Mode 1: Indiscriminate key detection. Data registers are not updated, but whenever any key is pressed, interrupt bit 2 is set (and cannot be cleared until the key is released).
- Mode 2: Single scan. The keypad is scanned once, and then the mode returns to 0.
- Mode 3: Continuous scan. When scanning completes, it just starts over again after a delay.
- Bits 2-15: Number of APB cycles to wait before scanning each row
- Bits 16-31: Number of APB cycles to wait between scans
- Bits 0-1: Scan mode
- 900E0004 (R/W):
- Bits 0-7: Number of rows to read (later rows are not updated in 900E0010-900E002F, and just read as whatever they were before being disabled)
- Bits 8-15: Number of columns to read (later column bits in a row are set to 1 when it is updated)
- 900E0008 (R/W): Keypad interrupt status/acknowledge (3-bit). Write "1" bits to acknowledge.
- Bit 0: Keypad scan complete
- Bit 1: Keypad data register changed
- Bit 2: Key pressed in mode 1
- 900E000C (R/W): Keypad interrupt mask (3-bit). Set each bit to 1 if the corresponding event in [900E0008] should cause an interrupt.
- 900E0010-900E002F (R): Keypad data, one halfword per row.
- 900E0030-900E003F (R/W): Keypad GPIOs. Each register is 20 bits, with one bit per GPIO. The role of each register is unknown.
- 900E0040 (R/W): Interrupt enable. Bits unknown but seems to be related to touchpad. Causes interrupt on touchpad touched.
- 900E0044 (R/W): Interrupt status. Bits unknown. Write 1s to acknowledge.
- 900E0048 (R/W): Unknown
90120000 - SDRAM Controller
An FTDDR3030.
90130000 - Unknown Controller for the LCD Backlight
The OS controls the LCD backlight by writing to 90130018.
90140000 - Power management
A new "Aladdin PMU" unit. Not much known.
- 90140000 (R/?): Reason for waking up from low-power mode.
- 90140050 (R/W): Disable bus access to peripherals. Reads will just return the last word read from anywhere in the address range, and writes will be ignored.
- Bit 9: #C8010000 - Triple DES encryption
- Bit 10: #CC000000 - SHA-256 hash generator
- Bit 13: #90060000 - Watchdog timer (?)
- Bit 26: #90050000 - I2C controller (?)
- 90140050 (R/W): Disable bus access to peripherals. Reads will just return the last word read from anywhere in the address range, and writes will be ignored.
A4000000 - Internal SRAM
0x40000 bytes SRAM, managed by the controller at ?.
A8000000 - Magic VRAM
0x25800 bytes SRAM for an LCD framebuffer.
It is wired up in a way that the written data is X-Y swapped and rotated, so that writing a 320x240 image with (0/0) at the top left results in a 320x320 image in the right orientation for the LCD. This means that it can't be used as generic RAM. How this mechanism works isn't known yet.
B0000000 - USB OTG/Host/Device controller (top)
An FOTG210 connected to the top USB port.
B4000000 - USB OTG/Host/Device controller (bottom)
An FOTG210 connected to the bottom USB port (dock connector).
B8000000 - SPI NAND controller
An FTSPI020 with a MICRON 1Gb flash at CS 1.
BC000000 - DMA controller
An FTDMAC020 with main SDRAM and LCD RAM (everything?) connected to AHB1. The OS uses this to copy the framebuffer into LCD RAM.
C0000000 - LCD controller
A PL111.
C8010000 - Triple DES encryption
Implements the Triple DES encryption algorithm.
- C8010000 (R/W): Right half of block
- C8010004 (R/W): Left half of block. Writing this causes the block to be encrypted/decrypted.
- C8010008 (R/W): Right 32 bits of key 1
- C801000C (R/W):
- Bits 0-23: Left 24 bits of key 1
- Bit 30: Set to 0 to encrypt, 1 to decrypt
- C8010010 (R/W): Right 32 bits of key 2
- C8010014 (R/W): Left 24 bits of key 2
- C8010018 (R/W): Right 32 bits of key 3
- C801001C (R/W): Left 24 bits of key 3
CC000000 - SHA-256 hash generator
Implements the SHA-256 hash algorithm, which is used in cryptographic signatures.
- CC000000 (R): Busy if bit 0 set
- CC000000 (W): Write 0x10 and then 0x0 to initialize. Write 0xA to process first block, 0xE to process subsequent blocks
- CC000008 (R/W): Some sort of bus write-allow register? If a bit is set, it allows R/W access to the registers of the peripheral, if clear, R/O access only. Don't know what it's doing here, but it's here anyway.
- Bit 8: #CC000000 - SHA-256 hash generator
- Bit 10: ?
- CC000010-CC00004F (R/W): 512-bit block
- CC000060-CC00007F (R): 256-bit state
DC000000 - Interrupt controller
See Interrupts. The controller is a PL190.