The main CPU is a Samsung S5L840F SoC - see the datasheet below. It has a CalmRISC16 core, a CalmMAC24 DSP and peripherals like ADC (10 bit analog digital converter), SD Card controller, LCD controller, etc.
There is separate code and data memory, and it is not possible to write to the code memory (harvard architecture).
Code memory
0x0 (P0) - 256 kB flash memory
0x80000 (P1) - 76 kB SRAM
0x300000 (P6) - 4 kB bootrom
Data memory
0x0 (C0) - 76 kB SRAM
0x80000 (C1) - 4 kB bootrom
There are some other memory regions defined. There is also the X and Y region used by the DSP.
| GPIO_REGS+0xa4 & 20 | keylock on/off |
|---|---|
| GPIO_REGS+0x24 & 1 | power button pressed |
| GPIO_REGS+0x24 & 2 | usb connected |
| GPIO_REGS+0xa4 & 2 | keepalive (don't switch off when power button is depressed and usb disconnected) |
| GPIO_REGS+0x14 & 80 | SD Card in |
| GPIO_REGS+0x04 & 40 | SD Card write protected |
| GPIO_REGS+0x14 & 5 | LCD backlight |
| GPIO_REGS+0xa4 & 4 | If it's zero sound is distorted, but original firmware makes it zero before DAC initialization. |
The LCD is a custom made LCD by jic-group, JIC-MSGF9483 (or 9403 or 9463, I can't read the number properly). I don't know what LCD controller is used on it, but the LCD functions have succesfully been reverse engineered from the original firmware.
The power button is connected to a GPIO pin (see above). The joystick on the mp3 player is connected to an ADC
channel on the S5L840F.
There is no documentation for the ADC in the S5L840F datasheet, but the other cpu datasheet (s3cc410)
describes a similar ADC - and from this information it was easy to reverse engineer from the original firmware
the actual method of reading the ADC.
The values read from the ADC, and the corresponding key presses, are the following:
| up | 0x80-0xc0 |
|---|---|
| left | 0xc0-0x100 |
| down | 0x100-0x130 |
| right | 0x130-0x168 |
| fire | 0x290-0x300 |
| nothing pressed | ~0x3ff |
The battery is connected to an other ADC channel on the S5L840F. We can read the battery level by reading from this ADC channel. Battery levels (read from ADC) are between approximately 0x180-0x1e0.
There is an SD card controller on the S5L840F - we use that, it is well documented in the S5L840F datasheet.
The audio codec is a Texas Instruments tlv320dac23. It is connected to the S5L840F through I2C bus, it's I2C address is 0x1a. Sound is transfered through I2S bus.
I am using the toolchain found here
http://www.donat.org/archos/wiki/doku.php?id=calmrisc16_toolchain.
It cannot be compiled on 64 bit linux only on 32 bit, and compilation unfortunately doesn't work out of the box.
You can download a binary version of this toolchain, compiled by me, from the Download section
of this page.
Main CPU - S5L840F datasheet
An other CPU (not used in PD-205):S3cc410 datasheet (this pdf has info about the CalmMAC24 DSP, and the ADC)
Audio DAC - tlv320dac23 datasheet
the official Secure Digital card datasheet
My firmware sources
Read the accompanying "readme.txt" file for further information.
precompiled calmrisc toolchain
Compiled on the 32 bit Debian Etch Linux distribution.
pd-205 recovery tool for windows xp
Use this to flash my firmware to the pd-205. By default it has an image of a v1.00.17 firmware,
so you can also use this to repair a broken pd-205. Documentation included. I found this somewhere
on the internet.
If you have any questions or answers you can reach me by email ( dbalatoni remove at remove interware dot remove hu ).
(C)opyright 2007, Denes Balatoni