AK1025 Port Dump

From S1MP3 Wiki

Jump to: navigation, search

Here is a port dump of the AK1025, helpful for reverse engineering. The ATJ2091 seems to be the same as AK1025, so it might be useful for that too. These are the semi-default values (pin shorting -> adfu -> s1giveio might modify them).

Ports we don't know about
Ports we don't know about, and their values change after a second read.
Ports we don't know about, abd thir values change after some more reads
Ports we don't know about, and their values change after a second boot
Ports that we know about (with links, or explained under the table)
Not registers, or write-only registers - writing, and then reading back doesn't result in the value written
addr0x*00x*10x*20x*30x*40x*50x*60x*70x*80x*90x*A0x*B0x*C0x*D0x*E0x*F
0x0* 10 00 00 F7 01 F7 84 82 41 1D [4] 06 [4] 31 2C 6C 18 06 [4]
0x1* A6 06 00 00 [6] 8F DF D3 1A 02 [4] D8 D6 69 03 06 [4] 54 2C
0x2* 00 00 [4] 1A CE 31 00 00 04 00 D4 [2] FF 04 [2] 4D 7B 01 A3 [4]
0x3* 00 00 00 00 00 00 00 00 00 40 14 A7 [6] 45 00 [6] FC 00 [6]
0x4* C5 [6] 00 [4] 08 04 [4] 80 [4] 00 48 82 00 00 00 00 00 00 00 [1] D5
0x5* 00 00 40 07 82 90 09 03 01 81 08 12 1A 00 00 82
0x6* 00 00 00 00 00 00 00 2B 00 13 07 00 00 00 00 00
0x7* 03 00 00 00 58 [6] 00 78 A8 18 01 [4] 00 00 00 10 [4] FE [4] 01 [4]
0x8* 03 [5] 00 78 78 78 05 07 40 [5] 00 [5] 00 00 [6] 42 81 78 78 78
0x9* 78 78 78 78 78 78 78 78 78 00 83 00 D1 F0 78 5D
0xA* 00 00 00 00 00 [4] 00 00 00 F8 [4] 00 [4] 28 CB 30 24 [4,7] 80 11
0xB* 91 85 78 78 78 78 78 78 78 78 78 78 78 40 [4] 05 [4] 42 [4]
0xC* 65 [6] 00 D9 1F DC 6B 91 FB F5 40 B6 D1 63 BE EB 1A [2]
0xD* C0 [4] 78 78 03 05 00 55 00 [4] FF 01 [4] 78 78 78 3E 00 [4] 29
0xE* 00 [4] 78 40 [4] 01 40 [6] 00 [4] 00 00 78 78 78 00 [4] 00 78 09 [3] 00 [3]
0xF* 00 [3] 00 [3] 00 [3] 80 [3] 07 [3] 00 00 00 00 [3] 00 [3] 00 [3] 00 00 00 00 [3] 00 [3]

Contents

[1] Watchdog

port 0x4e is the watchdog, unchanged from the atj2085

[2] Unknown nand-related ports

Ports 0x29, 0x2B, 0xCF are nand-related, but we don't know yet their exact meaning. More details on the NAND controller page port 0x29: writeing ff will read back 4f. writeing 00 will read back 40. So the register looks like 0100WWWW.

[3] GPIO ports

  • 0xee GPOA data output register ** i have no idea what the MFP select part means in the atj2085, or if it is the same in this chip
  • 0xef GPIOB_CONFIG_REG
  • 0xf0 GPIOB_OUTPUT_ENABLE_REG
  • 0xf1 GPIOB_INPUT_ENABLE_REG
  • 0xf2 GPIOB_DATA_REG
  • 0xf3 GPIOC_IO_ENABLE_REG
  • 0xf4 GPIOC_DATA_REG
  • 0xf8 = gpio_e_output_enable, 0xf9 = input enable, 0xfa = data. The AK1025 doesn't have such pins, but the atj2093 does.
  • 0xfe and 0xff are gpio_g registers on the atj2085. These pins don't exist on the AK1025, and are probably unused.

[4] Writing values and reading them back

The values that change could be actual configuration parameters. The bits that don't change are probably flags to be read or just unused bits. 

 Port 0x09: '''WW0WWWWW''' (writing FF will read back DF. Writing 00 will read back 00)
 Port 0x0A: '''00000WWW''' (writing FF will read back 07. Writing 00 will read back 00)
 Port 0x0F: '''00000WWW''' (writing FF will read back 07. Writing 00 will read back 00)
 Port 0x18: '''00000WWW''' (writing FF will read back 07. Writing 00 will read back 00)
 Port 0x1D: '''00000WWW''' (writing FF will read back 07. Writing 00 will read back 00)
 Port 0x21: '''WWWWWWW0''' (writing FF will read back FE. Writing 00 will read back 00)
 Port 0x2F: '''1010WWWW''' (writing FF will read back AF. Writing 00 will read back A0)
 Port 0x41: '''WWWW0000''' (writing FF will read back F0. Writing 00 will read back 00)
 Port 0x43: '''WWW00WW0''' (writing FF will read back E6. Writing 00 will read back 00)
 Port 0x44: '''WW000000''' (writing FF will read back C0. Writing 00 will read back 00)
 Port 0x79: '''WW0000W1''' (writing FF will read back C3. Writing 00 will read back 10)
 Port 0x7D: '''WWWW00W0''' (writing FF will read back F2. Writing 00 will read back 00)
 Port 0x7E: '''WW0WWW0W''' (writing FF will read back DD. Writing 00 will read back 00)
 Port 0x7F: '''10000001''' (writing any byte value at all makes this port read back 81)
 Port 0xA4: '''000WWWWW''' (writing FF will read back 1F. Writing 00 will read back 00)
 Port 0xA8: '''WWWWWW00''' (writing FF will read back FC. Writing 00 will read back 00)
 Port 0xA9: '''WW010000''' (writing FF will read back D0. Writing 00 will read back 10)
 Port 0xAD: '''W01001WW''' (writing FF will read back A7. Writing 00 will read back 24)
 Port 0xBD: '''WW0W000W''' (writing FF will read back D1. Writing 00 will read back 00)
 Port 0xBE: '''WW000WWW''' (writing FF will read back C7. Writing 00 will read back 00)
 Port 0xBF: '''01WWW01W''' (writing FF will read back 7B. Writing 00 will read back 42)
 Port 0xD0: '''WWWWWW00''' (writing FF will read back FC. Writing 00 will read back 00)
 Port 0xD7: '''WW0W0WWW''' (writing FF will read back D7. Writing 00 will read back 00)
 Port 0xD9: '''000000WW''' (writing FF will read back 03. Writing 00 will read back 00)
 Port 0xDE: '''000W0000''' (writing FF will read back 10. Writing 00 will read back 00)
 Port 0xE0: '''W0WWWWW0''' (writing FF will read back BE. Writing 00 will read back 00)
 Port 0xE2: '''01WWWWWW''' (writing FF will read back 7F. Writing 00 will read back 40)
 Port 0xE5: '''00W0000W''' (writing FF will read back 21. Writing 00 will read back 00)
 Port 0xEB: '''00W00WWW''' (writing FF will read back 27. Writing 00 will read back 00)
  • Most ports that have not been marked in any way are WWWWWWWW

[5] DAC registers

  • 0x88 setting/clearing this register's top 2 bits will make the same noise as setting the ATJ2085's Internal DAC Analog Control Register.
  • 0x80 seems to have the same default value as the "DAC Control Register" has on the ATJ2085. Which is also on address 0x80.
  • 0x87 seems to be the volume control register (same default value, and some noise appears when modified, so it's definitely DAC related)

Info about the DAC here: http://wiki.s1mp3.org/DAC

[6] Wierd stuff

  • writing anything to 0x8A kills s1giveio - could be usb, or otherwise something essential for operation
  • port 0x74: has a period of 8 bytes
  • port 0xc0: has a period of 16 bytes
  • port 0xe4: has a period of 16 bytes
  • port 0x40: writing 0 to the most significant bit of this register will kill s1giveio. Can't write zero to bit 6.
    • I've found that the ADFU code sets this bit right after it knows usb is working, but before sending any data. Its labelled as the HFC register on the atj2085 port map (in the PLL section). My theory is that it enables the clock source for the usb controller. --phire 01:07, 25 November 2008 (UTC)
  • port 0x3b: sometimes has a period of 4 bytes.
  • port 0x3d: writing 1 to the msb will set gpiob2 to low (regardless of the gpiob output enable and data registers) in other words, wierd things happen to gpiob when this register is used.
  • port 0x3f: writing 0xff to this register will make s1giveio die. Many other values don't cause problems (like 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x77, 0x88, 0x55)
  • port 0x13: setting the LSB will kill s1giveio
    • Not surprising, that probably starts the DMA. Who knows what it overwrites... --phire 03:44, 24 November 2008 (UTC)

[7] Extra USB related port

  • bit 3 of port 0xad should be set when the player is connected to a usb 1.1 host.

Magic values

78 seems to be a magic value in my ak1025 for non-existent/write-only registers. In my atj2085 this doesn't happen. in other chips other magic values could be used...

Retrieved from "http://wiki.s1mp3.org/AK1025_Port_Dump"
Personal tools
about this site
Advertisement