iRiver iFP 7XX Hardware Specs

I have not updated this page for a long time and in the meantime I learned much more about the player. Recently Philips has released a detailed datasheet for the LPC2880 chip, which is very similar to PNX0101. Please look at PhilipsPNX0101 for info.

Please also look at IriverIfp7XXHardwareComponents.

Emulator

I am writing the player emulator. The current version is available at http://www.mimuw.edu.pl/~tmal/rockbox/. It emulates the hardware described below, features a simple ncurses user interface and the possibility to be a GDB target.

Initialization

Many things such as location of different kinds of memory in the address space is probably not hardwired, but is set by software during initialization. However, it is impossible to figure out the meaning of values written to registers during initialization having only one example of code. Analysis of other PNX0101 based players firmware or experiments with the real hardware could let us find out some information, but I do not suppose it is required, since Rockbox can be run by the original firmware after it initializes the hardware.

Program Flash

PNX0101 has 512 kB of embedded program flash ROM. It is located in the range 0x800000-0x87ffff. The first part of the firmware is stored there. The second one is stored in the external flash ROM. The external flash ROM is probably SST39LF800A (8 Mbit), although the firmware can autodetect chips with manufacturer's ID 0xbf and device ID 0x2780, 0x2781 or 0x2782. Code from that chip is visible in the range 0xa00000-0xafffff, although for purposes other than program execution the chip is accessed at addresses 0x20000000-0x200fffff. Notice that addresses in the chip data sheet are addresses of 16-bit words, not bytes, so in order to set the address 0x5555 on chip's A14-A0 pins one has to access the address 0x2000aaaa and respectively 0x20005554 for 0x2aaa.

The external flash ROM is also used to store player's settings.

RAM

The internal PNX0101 64 kBytes of SRAM is located at 0x400000. It is also visible at the address 0, so exception vectors can be stored there. There is also most probably 1 MB of RAM at 0x24000000. The original firmware uses lower 512 kB of it. It is possible to write a value to the upper half and read it back, but I am not yet sure if those halves are not the same memory mapped twice. There is no more RAM in the following area. The USB chip is located at 0x24100000 and accessing the address 0x24200000 causes the player to freeze (perhaps simply causes an exception).

Speed

I have successfully decoded a piece of music in Ogg Vorbis format using the original firmware running in my emulator. This proves that it is possible to decode Ogg Vorbis files without using the EPIC DSP core.

I tried to estimate the CPU speed. I run a simple loop in Rockbox:

    int i = 0;
    int t = current_tick + HZ;
    while (1)
    {
        int c = *((volatile int *)&current_tick);
        if (TIME_BEFORE(t, c))
            break;
        i++;
    }
    return i;

The loop compiled to the following code:

l: ldr     r3, [r1]
   rsb     r3, r3, r2
   cmp     r3, #0
   addge   r0, r0, #1
   movlt   pc, lr
   b       l

When I run this loop from the external RAM it executed about 260 000 times per second. When I run it from the internal RAM it executed about 1 600 000 times per second. It does not seem much to me, I suppose there is a way to increase the CPU frequency. After the original firmware opens a file and before it starts to play it performs some accesses to the unknown parts of the hardware. Switching to a higher CPU frequency may be among them.

The above experiment also suggests that when a code is run from the external RAM it is not cached. Finding a way to turn on caching in the external RAM may be difficult, since the original firmware does not run any code from that memory and therefore does not need fast execution from there. On the other hand, even the original firmware executes some speed critical parts of the Ogg Vorbis decoder from the internal RAM.

General Purpose Input/Output

The PNX0101 seems to have about 8 general purpose input/output ports. The exact number of ports, the number of bits in each port and connections between them and the chip pins are not known. Some of bits may be used for internal purposes only and therefore their purpose may be not so general. Each port registers are located in the range 0x80003000 + n * 0x40 to 0x8000303f + n * 0x40, where n is the number of the port (from 0 to 7).

In the following description base will be 0x80003000 + n * 0x40. Reading from base returns the port state. Writing a value to base + 0x14 sets to 1 those port bits, whose corresponding bits in the value are 1, leaving other unchanged. Similarly, writing a value to base + 0x18 sets to 0 those port bits, whose corresponding bits in the value are 1. Registers base + 0x24 and base + 0x28 probably set ports directions. Writing a value to base + 0x24 sets to be outputs those bits whose corresponding bits in the value are 1 and writing to base + 0x28 sets those bits to be inputs.

Port bits functions

Port	Bit	Function
1	8	some output
1	9	some output
1	10	some input
1	11	some output
1	16	LCD power (or just enable) (1 - on)
1	19	some output
2	0	power (0 - on)
2	1	some input
3	0	backlight (1 - on)
3	2	some output
3	6	some output
5	1	second data flash CE pin
5	2	0 if HOLD switch is "on", otherwise 1
5	3	fourth data flash CE pin
5	4	third data flash CE pin
5	5	first data flash CE pin
6	0	SDA line of RTC I2C interface
6	1	SCL line of RTC I2C interface
6	3	READY/BUSY pin of the data flash
7	0	1 if connected to USB, otherwise 0

Data Flash

The firmware supports up to 4 data flash chips. They are K9K2G08U0M (256M x 8bit) or similar. The firmware probably can use chips with device IDs 0xda, 0x76, 0x73, 0x75, 0x79, 0xdc or 0xf1.

Once one of the chips is selected by setting its CE pin to 0, it can be accessed through the following registers:

Address	Function
0x28000000	Data read/write
0x28000004	Command write
0x28000008	Address write

Interrupts

IRQ controller registers are located at 0x80300000. They are accessed in an interesting way. To read a register the original firmware reads the register twice and checks if two readings gave the same result. If not it repeats the operation. When writing, the firmware checks if two consecutive readings give the same result and additionaly if the result satisfies some condition. The condition depends on a register.

There are 28 sources of interrupts numbered from 1 to 28. The original firmware uses only few of them. When an interrupt occurs bits 3-31 of 0x80300100 contain the number of the interrupt. Each interrupt has a controlling register at 0x80300400 + n * 4.

Interrupt number 5 is a timer interrupt. Interrupt number 28 comes from the audio output when more audio data is needed.

Timers

There is some kind of timer at 0x80020000. The register at 0x80020000 stores its period. Frequency of timer is probably 3 MHz / period.

There is also a watchdog. It can be disabled by writing 0 to 0x80002804. Servicing a watchdog is probably a following sequence of operations: write 0 to 0x80002804, write 0 to 0x80002808, write 1 to 0x80002804.

A/D Converter

The A/D converter described here is used to get state of the keys and to measure battery voltage. It is not known if this is also the audio A/D converter.

The least significant 10 bits of the register at 0x80002400 contain the state of most of the buttons:

Values	Key
0..0x40	LEFT
0x41..0xc6	RIGHT
0xc7..0x150	SELECT (joystick)
0x151..0x1d6	UP
0x1d7..0x267	DOWN
0x268..0x2f8	A->B
0x2f9..0x35c	RECORD

The register at 0x80002404 contains the battery voltage.

The register at 0x80002408 contains the state of the PLAY button. If its 10 least significant bits are less than or equal 0x64, then the button is pressed.

There also seem to be one more ADC channel which value is available at the address 0x80002410. It is not known what is connected to it.

When the original firmware wants to read a value, it writes 0xa to 0x80002420, waits until bit 4 at the address 0x82002420 becomes 1 and reads the value from one of the registers described in previous paragraphs.

LCD Screen

The LCD screen is similar to TL032S, but not identical. The commands sent by the firmware to the LCD screen make sense for this type of screen, however before writing to the LCD, the firmware waits until two least significant bits of the status are 1. In TL032S those bits are always 0.

Display status can be read from the register at 0x80104008, data are written to 0x80104030 and commands are written to 0x80104020.

I2C Interfaces

PNX0101 has an integrated I2C interface. I have not analysed it in detail yet. Its registers are located at 0x80020800. 0x80020800 is data register. 0x80020804 is some kind of status register.

There is also another I2C (or similar) interface implemented using two GPIO ports. It is used to control an RTC chip. The RTC chip is probably PCF8563.

Power Management

Two GPIO ports has been identified responsible for power management. Writing 0 to bit 0 of port 2 switches the power off. Setting bit 16 of port 1 to 1 switches off the LCD screen.

When the power is switched off without writing 1 to bit 16 of port 1 the LCD seems to be switched off not smoothly. It displays some noises for a moment. The same effect can be observed when the battery is removed when the player is on.

FM Tuner

The FM tuner is most probably TEA5767HN. It is connected to the integrated I2C interface.

USB interface

Iriver iFP-790 uses ISP1582 USB peripheral controller. Unlike other players to which Rockbox is being ported, this chip does not implement the protocol layer of USB communication. It has to be done in firmware.

The ISP1582 is located at address 0x24100000.

Things to be found out

• audio output
• power management
• audio input