BROM
From S1MP3 Wiki
Contents |
What is the BROM?
The BROM is a 8kb sized EEPROM located inside the ATJ20xx, which holds the 1st-stage bootstrap code and gets automatically executed on any power-up. Its directly addressable using the external memory bus (EMB) from address 0x00000000 upto 0x00001FFF.
Newer cores, like e.g. ACU7513, contain a 16KB BROM. Copyright tag of such a large BROM follows...
Copyright(R)2004-2005. Actions Semiconductor Co., Ltd
OS Architecture Designers & Programmers:
Gongee Zhang,Ryan Chen,Alan Zhang,Liang Chen,Vicky Wang,
Bhun Chen,Rcmai,Liming Chen,Peihao Chen,Fqliu,Ryatom Ry.
Credits To:
Embedded Software Workgroup
Power Up
When the s1mp3 device is powered up, registers/ports get set up this way...
PC = 0x0000 PORT01 = 0x00 PORT02 = 0x00 PORT05 = 0x00 ...
This causes the BROM to directly get mapped into the Z80 address space at 0x8000 - 0x9FFF. The instruction pointer gets forced to point at 0x8000 (PORT05 = 0) and the first instruction of the 1th-stage bootloader gets executed immediately.
Reading the BROM
To read out the BROM content its possible to use the earlier BROM extractor or by using s1giveio...
s1giveio v1.1 - some small debug console to access the players hardware copyright (c) 2006 wiRe - http://www.s1mp3.de/ - public domain give access to the device... found 5 busses giveio version: 1.01 use command '?' for help! -o1 0 -o2 0 -d8000 8000 C3 30 80 00 30 00 51 0C - 20 03 03 02 D6 10 51 FF ├0Ç.0.Q. ...╓.Q 8010 41 63 74 6F 73 40 41 63 - 74 69 6F 6E 73 00 00 00 Actos@Actions... 8020 47 6F 6E 67 65 65 2E 5A - 68 61 6E 67 00 00 00 00 Gongee.Zhang.... 8030 3E A2 D3 4E 3E 01 D3 04 - F3 ED 56 AF D3 27 3E 80 >ó╙N>.╙.≤φV»╙'>Ç 8040 D3 42 DB 70 F6 30 D3 70 - 3E F7 D3 05 31 00 4F 3E ╙B█p÷0╙p>≈╙.1.O> 8050 10 D3 00 21 00 81 11 00 - 40 01 00 0C ED B0 CD 13 .╙.!.ü..@...φ░═. 8060 40 A7 CA 00 00 21 00 90 - 11 00 00 01 00 0C ED B0 @º╩..!.É......φ░ 8070 31 00 01 C3 00 00 76 00 - 00 00 00 00 00 00 00 00 1..├..v.........
Explanation of the commands :
* o1 0 sets register 1 to value 0 * o2 0 sets register 2 to value 0. This makes the BROM accessible from the z80 cpu starting at address 8000 * d8000 dumps memory (as seen by the z80) starting at address 8000. You can save the BROM file to disk using the b command : b8000 4000 (to save 4000 bytes), or if you prefer a text format similar to what the d command shows, use t8000 4000.
Or you could download the BROM files from my site s1mp3.de.
BROM disassembly
For more information about the BROM content, the best way is to look at the source code. BROM from v8 device disassembled on IDA BROM from v9 device
Flashing the BROM
Currently there is no method available to directly write to the BROM (or TROM), either by software nor by hardware.
Related pages
- BLOD - the 1st stage bootloader
- BREC - the 2nd stage bootloader
- Memory map
- TROM
- wikipedia EEPROM article
- BROM extractor
