Corel Netwinder Memory Map-7C00
IDE I/O space
| Address | Name | Width | Meaning |
| 7C00.01F0 | | b[8] | IDE
you can do word and dword access to 01F0 for data transfer |
| 7C00.0000,2,4,6 | | b[4] | DMA base and current address (4 channels)
read or write this address twice to set the 16 bit value |
| 7C00.0001,3,5,7 | | b[4] | DMA base and current count (4 channels)
read or write this address twict to get/set the 16 bit value |
| 7C00.0008 | | b (write) | DMA command
4=controller enable
0x10=rotating scheme
0x40=DRQ active low
0x80=DACK active hi |
| 7C00.0008 | | b (read) | DMA status
1=channel 0 terminal count
2=channel 1 terminal count
4=channel 2 terminal count
8=channel 3 terminal count
0x10=channel 0 request
0x20=channel 1 request
0x40=channel 2 request
0x80=channel 3 request |
| 7C00.0009 | | b (write) | DMA control
0,1,2,3=channel select
4=set request |
| 7C00.000A | | b (write) | DMA mask register
0,1,2,3=channel select
4=set mask bit |
| 7C00.000B | | b (write) | DMA mode register
0,1,2,3=channel select
transfer type: 4=write, 8=read
0x10=auto-initialize
0x20=decrement address
transfer mode:0=demand, 0x40=single, 0x80=block, 0xC0=cascade |
| 7C00.000C | | b (write) | clear the toggle address bit for 7C030000 & 7C030001 |
| 7C00.000D | | b (write) | DMA hardware reset |
| 7C00.000E | | b (write) | DMA clear all mask bits |
| 7C00.000F | | b (write) | DMA set maks bits
1,2,4,8 for channels 0,1,2,3 |
| 7C00.0087, 83, 81,82 | | b | DMA page registers
8 bits that set the ISA address bits A23:16 |
| 7C00.040B | | b | DMA extended mode
0,1,2,3=select channel
timing:0=compatible, 0x10=A type, 0x20-B type, 0x30=F type |
| 7C00.0020 | ICW1 | b (write) (first write) | Irq Controller command (ICW1)
0x10 selects this register (ICW1), use 0 for the others
default is ok |
| 7C00.0020 | OCW2 | b (write) (same addr) | Irq controller command (OCW2)
irq rotate modes |
| 7C00.0020 | OCW2 | b (write) (same addr) | Irq controller command (OCW2)
8 selects this register
spcial mask mode, poll mode |
| 7C00.0021 | ICW2 | b (write) | Irq init command (ICW2)
8-0xF8 sets high bits of interrupt vector |
| 7C00.0021 | ICW3 | b (write) (same addr) | Irq init command (ICW3)
0-7 sets the link from Irq controller 2 into Irq controller 1 |
| 7C00.0021 | ICW4 | b (write) (same addr) | Irq init command (ICW4)
buffer and nest modes |
| 7C00.0021 | OCW1 | b (write) (same addr) | Irq control reg (OCW1) (all further writes)
a 1 in a bit position masks that irq channel |
| 7C00.04D0 | | b (write) | Irq edge/level control
a 1 in a bit position means level sensitve
a 0 means edge sensitive |
Timers
| Address | Name | Width | Meaning |
| 7C00.0040,41,42 | | b (read twice) | Counter values
read/write the low-then-high bytes of the 16 bit timers 0,1,2 |
| 7C00.0040,41,42 | | b (read back) | Counter status
1=BCD count, 0=binary count
0xE reads back the mode selection bits
0x30 reads back the read/write selection status
0x80 reads back the OUT pin |
| 7C00.0043 | | b (write) | Counter control (common to all three)
1=BCD count
0=count to end, 2=harware-retrigger one-shot, 4=rate generator, 6=square wave gen, 8=software-triggered strobe, 0xA=hardware triggered strobe
0=counter latch, 0x10=read write LSB in 7C03004x, 0x20=read/write MSB in 7C03004x, 0x30-read/write LSB then MSB in 7X03004x
0=select timer 0, 0x40=select timer 1, 0x80=select timer 2, 0xC0=select Counter Status readback |
| 7C00.007B | | s | Bios timer
a value written here will be decremented on every BCLK until 0 |
Misc
| Address | Width | Meaning |
| 7C00.0061 this looks incorrect! | b | NMI status/control
1=timer 2 enable
2=speaker enable
4=SERR NMI enable
8=IOCHK NMI enable
0x10=refresh on ISA bus
0x20=timer 2 output
0x40=IOCHK status
0x80=SERR status |
| 7C00.0070 | b | RTC address
0-0x7E=RTC address
0x80=NMI enable |
| 7C00.0071 | b | RTC data
first, set the RTC address (7C00.0070), then read/write the data (7C00.0071) |
| 7C00.0810 | b (write) | RTC CMOS RAM Proect 1
write this to block any writes to 0x20-0x2F of RTC space |
| 7C00.0812 | b (write) | RTC CMOS RAM Protect 2
write this to block any writes to 0x30-0x3F of RTC space |
Super I/O Space
| Address | Name | Width | Meaning |
| 7C00.0378 | | b | Parallel port data |
| 7C00.0379 | | b (read) | Parallel port print status
1=timeout
8=error-
0x10=select
0x20=paper jam
0x40=ack-
0x80=busy- |
| 7C00.037A | | b (write) | Parallel port control
1=strobe
2=auto feed
4=init-
8=select in
0x10=irq enable
0x20=set data direction to 'in' |
| 7C00.037A | | b (read) | Parallel port control swapper |
| 7C00.037B | | b | EPP address port |
| 7C00.037C-F | | b[4] | EPP dataports 0-3 |
| 7C00.03F8 | BLL/BHL | b | UART divisor register; ! counts down from 24 MHz !
Note: the other UART is at 7C00.02F8 |
| 7C00.03F8 | RBR/TBR | b | UART data reg: reads the rx byte, writes the tx byte |
| 7C00.03F9 | ICR | b | UART Irq control
1=rx data irq enable
2=tx buffer irq enable
4=rx status irq enable
8=handshake status irq enable |
| 7C00.03FA | ISR | b (read) | UART Irq status
1=no irq pending, 0=irq pending
6=UART rx status, error bit set
4=rx data ready or FIFO nearly full
0xC=tx FIFO ready and waiting (timout occurred)
2=tx buffer ready
0=handshake status changed
0xC0=FIFO's enabled |
| 7C00.03FA | UFR | b (write) | UART Fifo control
1=fifo enable
2=reset rx fifo
4=reset tx fifo
8=DMA mode select
0,0x40,0x80,0xC0 sets FIFO fill threshold |
| 7C00.03FB | UCR | b | UART control reg
0=5 bit, 1=6 bit, 2=7 bit,3=8 bit data
4=two stop bits
8=enable parity
0x10=even parity
0x20=fixed parity
0x40=inhibit tx
0x80=enable access to baud-divisor |
| 7C00.03FC | HCR | b | UART handshake control
1=DTR set
2=RTS set
4=loopback enabled
8=Irq enabled
0x10=internal loopback enabled |
| 7C00.03FD | USR | b | UART status reg
1=rx data ready
2=overrun
4=parity error
8=no stop bit error
0x10=silent byte detect
0x20=tx buffer empty
0x40=tx empty
0x80=rx fifo error
any read clears the bits |
| 7C00.03FE | HSR | b | UART handshake status
1=CTS changed
2=DSR changed
4=RI falling edge
8=DCD changed
0x10=CTS sense
0x20=DSR sense
0x40=RI sense
0x80=DCD sense |
| 7C00.03FF | UDR | b | UART user register |
| 7C00.0370 | | b | Super IO config register
write 0x87 twice to wake it up
write ext-config-register number
write 0xAA to lock it |
| 7C00.0371 | | b | ext-config-register data |
Misc IO
Several IO points are accessed through the "general purpose" pins on the superIO chip. We have programmed these registers to be at 0x330-0x33f in the IO space.
| Physical Address | Virtual Address | Width | Meaning |
| 7c00.0330 | E000.0330 (io: 330) | 16b | Misc IO registers |
| | | | |
| | 338 | b write | 0x80=turns on the red power LED
0x20=clock to serial register; data should be valid on rising edge
0x10=data to serial register
8=done signal to 5204 Xilinx (modem PCI control chip)
4=fan on; when tri-stated, fan is on by default
2=green power LED |
| | 338 | b read | 1=do-it button is pushed |
| | 33a | b | 1=copy data from serial register to output pins: set to 1, then set to 0 |
The "serial register" mentioned above is an external 4 bit register which holds:
first-shifted-bit=reset the termerature chip
second-shifted-bit=enable the mono speaker (0 to mute the speaker)
third-shifted-bit=enable flash write
last-shifted-bit=turn on front panel green LED
Ext-config-register
| Register (at 7C00.0370) | Width | Data (at 7C00.0371) |
| 2 | b | CR02
1=soft reset |
| 7 | b | CR07
logical device number
write this number, and then program CR30-CR71
0=FDC (we don't use this)
1=parallel
2=serialUART
3=consoleUART
4=RTC
5=keyboard
6=IR
7=aux i/o
8=aux i/o |
| 20 | b (read) | CR20 device id
assert(id==0x97) |
| 21 | b (read) | CR21 rev
assert(rev==0x71) |
| 22 | b | CR22 section power down
1=floppy power up
4=IR power up
8=parallel power up
0x10=serialUART power up
0x20=consoleUART power up |
| 23 | b | CR23 auto-power-down
0=power on, 1=stop clock incl PLL's, 2=standby for auto-power-down, 4=stop clock PLLs running
0x10-0x38=timeout to auto-power-down |
| 24 | b | CR24 PnP modes
use default |
| 25 | b | CR25
1-0x40 set TRI mode ?? |
| 26 | b | CR26
1=disable consoleUART legacy irq mode
2=disable serialUART legacy irq mode
4=disable parallel legacy irq mode
0x20=lock config registers |
| 28 | b | CR28
0=parallel port normal, 5=parallel port acts as FDC
0x10=enable irq sharing |
| 29 | b | CR29
PnP id setting |
| 2A | b | CR2A option pin assignments
0=pin 3S1 is DRVDEN, 1=pin is GP10, 2=pin is 8042 p12, 3=pin is DSRC-
0=pin 39S1 is IRRXH, 4=pin is IRSL0, 8=pin is GP25, 0xC=pin is CTSC-
0=pin 40S1 is CIRRX, 0x10=pin is GP24, 0x20=pin is 8042 p13
also pins 56S and 57S |
| 2B | b | CR2B more option pin assignments |
| 2C | b | CR2C more option pin assignments |
| 30 | b | CR30 section enable
1=activate this device |
| 31 | b | CR31
1=enable i/o read
2=enable i/o decoding |
| 60, 61 | b | CR60, CR61 address
set i/o address, from 0x100...0xFF8, CR60 is high byte
use defaults |
| 70 | b | CR70 interrupt control
0-0xF selects interrupt channel |
| 71 | b | CR71 interrupt control
1=level trigger, 0=edge trigger |
| 74 | b | CR74 DMA select
0-3 selects DMA channel (parallel, IR only) |
| F0 | b | CRF0 clock select
parallel:
4=standard printer port, 0=SPP mode, 1=EPP/SPP mode, 2=ECP mode, 3=ECP/EPP mode, 5=EPP/SPP mode, 7=ECP/EPP mode
UARTs:
0=clock source is 1.8MHz, 1=clock source is 2MHz, 2=clock source is 24MHz, 3=clock source is 14.8MHz
RTC:
1=lock ram 80-9F
2=lock ram A0-BF
4=lock ram C0-DF
8=lock ram E0-FF
0x10=select bank 1 of ram, 0x20=select bank 2 of ram
KBC:
1=kb reset speed up
0=kb clk is 6MHz, 0x40=kb clk is 8MHz, 0x80=kb clk is 12MHz, 0xC0=kb clk is 16MHz
IR:
1=enable IR bank selection
2=append hardware CRC in FIR mode
4=add 4 char delay during turn-around
8=add 4 char delay during turn-around |
RTC data reg's
| Register (at 7C00.0070) | Width | Data (at 7c00.0071) |
| 0-9 | b[10] | RTC (bank 0)
seconds, seconds alarm, minutes, minutes alarm, hours, hours alarm, day-of-week, day-of-month, month, year |
| A | b | RTC control (bank 0)
0=no irq, 1=4ms irq, 2=8ms irq, 7=2ms irq, 0xB=31.24ms irq, 0xC=62.5ms, 0xD=125ms, 0xE=250ms, 0xF=500ms
0x80=update in progress |
| B | b | RTC control (bank 0)
1=daylight savings
2=set 24 hour mode
4=use binary mode for time
0x10=enable update-flag
0x20=enable alarm
0x40=enable periodic interupt
0x80=disable timer updates |
| C | b | RTC status (bank 0) |
| D | b | RTC status (bank 0)
0x80=ram and time are valid |
| E-7F | b[72] | RTC user ram (bank 0) |
| 80-F7 | b | see W83977AF manual |
Super IO (cont'd)
The SuperIO contains a separate microprocessor controlling the keyboard and mouse. Communications to/from it are through this narrow portal....
| Virtual Address | Width | Meaning |
| e000.0060 | b | Keyboard controller
input/output buffer |
| e000.0064 | b(write) | Keyboard command
20=read command
60=write command
A4=test password
A5=load password
A6=enable password
A7=disable mouse
A8=enable mouse
A9,AB=interface test
AA=self test
AD=disable keyboard
AE=enable keyboard |
| e000.0064 | b(read) | Keyboard status
1=output buffer full
2=input buffer full
8=command byte
0x10=no inhibit
0x20=mouse output buffer full
0x40=timout error
0x80=parity error |
Sound
There are many "mixer" type functions which can be programmed in the sound chip; please refer to the data sheet.
| Virtual Address | Width | Meaning |
| E000.0250 (io: 250) | 16b | Wave Artist sound device |
| 250 | b | command register
some commands: 0=get id; 0x10=set input format; 0x11=set input channel.....up to 0x29 |
| 251 | b read | 0x20=phone present & offhook
0x10=handset inserted
1=joystick timer finished; front panel slider is connected to joystick port |
| 251 | b write | init joystick timer |
| 252 | b | data register |
| 254 | b | control register
0x80=cmd write irq enable
0x40=cmd read irq enable
0x20=data write irq enable
0x10=data read irq enable
8=reset
4=dma1 irq enable
2=dma0 irq enable
1=int ack |
| 255 | b | status register
0x80=cmd write ready
0x40=cmd read full
0x20=data write ready
0x10=data read full
8=irq
4=dma1
2=dma0 |
| 25c | b | interrupt status |
Ether10
This is a NE2000 clone, with some extensions in Bank3.
| Virtual Address | Width | Meaning |
| e000.0300 | b | command register
2=run, 1=stop controller
4=send packet
8=remote read, 0x10=remote write, 0x18=send packet,0x20=remoteDMA complete/abort
0,0x40,0x80,0xC0 sets the register bank |
| Bank 0 |
| e000.0301 | b (read) | DMA address lo
these two registers can be read to get the current local DMA address |
| e000.0301 | b (write) | page start
the Page Start register sets the start page address of the receive buffer ring. |
| e000.0302 | b (read) | DMA address hi |
| e000.0302 | b (write) | page end
the Page Stop register sets the stop page address of the receive buffer ring. |
| e000.0303 | b | boundary pointer
this register is used to prevent overwrite of the receive buffer ring; it is typically used as a pointer indicating the last receive buffer page the host has read. |
| e000.0304 | b (read) | tx status
1=tx complete ok
4=collision
8=abort due to collisions
0x10=carrier lost
0x40=heartbeat miss
0x80=late collision |
| e000.0304 | b (write) | tx page start
this register sets the start page address of the packet to the transmitted. |
| e000.0305 | b (read) | collision count
the register records the number of collisions a node experiences during a packet transmission. |
| e000.0305 | b (write) | tx byte count lo
these two registers set the byte counts of the packet to be transmitted. |
| e000.0306 | b (read) | FIFO data
this register allows the host to examine the contents of the FIFO after loopback. |
| e000.0306 | b (write) | tx byte count hi |
| e000.0307 | b | irq status
1=rx data ready ok
2=tx data sent ok
4=rx data with error
8=tx data with error
0x10=rx data overflow
0x20=tally count overflow
0x40=remoteDMA done
0x80=reset state |
| e000.0308 | b (read) | DMA address lo
these two registers contain the current address of remote DMA. |
| e000.0308 | b (write) | remote start address lo
these two registers set the start address of remote DMA. |
| e000.0309 | b (read) | DMA address hi |
| e000.0309 | b (write) | remote start address hi |
| e000.030A | b (write) | remote byte count lo
these two registers set the data byte counts of remote DMA. |
| e000.030B | b (write) | remote byte count hi |
| e000.030C | b (read) | rx status
1=rx data ok
2=crc error
4=framing error
0x10=missed packet
0x20=broadcast or multicast rx
0x40=in monitor mode
0x80=collision detected |
| e000.030C | b (write) | rx config
1=accept bad packets
2=accept short packets (64 bytes)
4=accept broadcast
8=accept multicast
0x10=accept all addresses
0x20=monitor mode; packets not saved in ram |
| e000.030D | b (read) | frame align error count |
| e000.030D | b (write) | tx config
1=inhibit CRC append
0=normal, 2=int. loopback, 4=extern loopback
8=auto transmit disable
0x10=collisiton offset enable |
| e000.030E | b (read) | crc error count |
| e000.030E | b (write) | data config register
1=read Ether10 chip word wide
2=byte order
8=disable loopback mode
0x10=auto initialize send packet
0x20-0x60=FIFO thresh |
| e000.030F | b (read) | missed packet error count |
| e000.030F | b (write) | irq mask |
| Bank 1 |
| e000.0301-6 | b[5] | physical address
tthese registers contain my Ethernet node address and are used to compare the destination address of incoming packets for acceptation or rejection. |
| e000.0307 | b | current page
this register points to the page address of the first receive buffer page to be used for packet reception. |
| e000.0308-F | b[8] | multicast address
these registers provide filtering bits of multicast addresses hashed by the CRC logic. |
| Bank 2 |
| e000.0301 | b (read) | page start |
| e000.0301 | b (write) | current DMA addr 0 |
| e000.0302 | b (read) | page stop |
| e000.0302 | b (write) | current DMA addr 1 |
| e000.0303 | b | remote next packet pointer |
| e000.0304 | b (read) | tx page start address |
| e000.0305 | b | local next packet pointer |
| e000.0306 | b | address counter hi |
| e000.0307 | b | address counter lo |
| e000.030C | b (read) | rx config |
| e000.030D | b | tx config |
| e000.030E | b (read) | data config |
| e000.030F | b (read) | irq mask |
| Bank 3 |
| e000.030A | b | hardware config register
0=UTP/twisted pair, 3=UTP/twisted pair with "quiet" signals
4=link ok
0x10=fast ram installed |
| all banks |
| e000.0310-7 | b[8] | data buffer (nominally "remote DMA") |
| e000.0318 | b (read) | resets the Ether10 chip |
Top level of memory map
