BROM

From S1MP3 Wiki
Jump to: navigation, search

What is the BROM?

The BROM is a 8kb sized EEPROM located inside the ATJ20xx, which holds the 1st-stage bootstrap code and gets automatically executed on any power-up. Its directly addressable using the external memory bus (EMB) from address 0x00000000 upto 0x00001FFF.

Newer cores, like e.g. ACU7513, contain a 16KB BROM. Copyright tag of such a large BROM follows...

Copyright(R)2004-2005. Actions Semiconductor Co., Ltd
OS Architecture Designers & Programmers:
    Gongee Zhang,Ryan Chen,Alan Zhang,Liang Chen,Vicky Wang,
    Bhun Chen,Rcmai,Liming Chen,Peihao Chen,Fqliu,Ryatom Ry.
Credits To:
    Embedded Software Workgroup

Power Up

When the s1mp3 device is powered up, registers/ports get set up this way...

PC = 0x0000
PORT01 = 0x00
PORT02 = 0x00
PORT05 = 0x00
...

This causes the BROM to directly get mapped into the Z80 address space at 0x8000 - 0x9FFF. The instruction pointer gets forced to point at 0x8000 (PORT05 = 0) and the first instruction of the 1th-stage bootloader gets executed immediately.

Reading the BROM

To read out the BROM content its possible to use the earlier BROM extractor or by using s1giveio...

s1giveio v1.1 - some small debug console to access the players hardware
copyright (c) 2006 wiRe         - http://www.s1mp3.de/ - public domain

give access to the device...
found 5 busses
giveio version: 1.01
use command '?' for help!

-o1 0

-o2 0

-d8000
8000    C3 30 80 00 30 00 51 0C - 20 03 03 02 D6 10 51 FF     ├0Ç.0.Q. ...╓.Q 
8010    41 63 74 6F 73 40 41 63 - 74 69 6F 6E 73 00 00 00     Actos@Actions...
8020    47 6F 6E 67 65 65 2E 5A - 68 61 6E 67 00 00 00 00     Gongee.Zhang....
8030    3E A2 D3 4E 3E 01 D3 04 - F3 ED 56 AF D3 27 3E 80     >ó╙N>.╙.≤φV»╙'>Ç
8040    D3 42 DB 70 F6 30 D3 70 - 3E F7 D3 05 31 00 4F 3E     ╙B█p÷0╙p>≈╙.1.O>
8050    10 D3 00 21 00 81 11 00 - 40 01 00 0C ED B0 CD 13     .╙.!.ü..@...φ░═.
8060    40 A7 CA 00 00 21 00 90 - 11 00 00 01 00 0C ED B0     @º╩..!.É......φ░
8070    31 00 01 C3 00 00 76 00 - 00 00 00 00 00 00 00 00     1..├..v.........

Explanation of the commands :

* o1 0 sets register 1 to value 0
* o2 0 sets register 2 to value 0. This makes the BROM accessible from the z80 cpu starting at address 8000
* d8000 dumps memory (as seen by the z80) starting at address 8000. You can save the BROM file to disk using the b command : b8000 4000 (to save 4000 bytes), or if you prefer a text format similar to what the d command shows, use t8000 4000.

Or you could download the BROM files from my site s1mp3.de.

BROM disassembly

For more information about the BROM content, the best way is to look at the source code.

Version history

It is not sure wether the BROM can be updated separately from the chip. It may be a mask ROM that's written as part of the manufacturing process, or an EEPROM that's somehow programmed later on.

For V9 devices, the BROM has what looks like a BCD encoded date in the header. This can be used to track changes accross versions.

  • 2003-03-02

(unknown origin, from BLOD page).

String in the header is "Actos@Actions" - "Gongee Zhang"

  • 2005-12-40

ROM extracted from a CTW500 chip.

ATJ2093H may use the same ?

String in the header says "Actos@Actions" - "FW Team"

TODO other differences with 2003-02-02 ?

  • 2006-04-20

Extracted from ACU7513.

Most notable change is empty areas are filled with 0xFF instead of 0x00 bytes.

Some small changes are done to the ADFU code as well :

  • Write 0xD9 to the DC-DC (0x4F) register when entering ADFU mode removed,
  • usb handling around dev_get_desc (descriptor management) checks a bit in IO port 0xAD (Serial LCM) and send a different packet depending on the result. Packet has a different size (12 instead of 20 bytes).
  • 2006-08-14

Extracted from AK1025.

String in the header is now "Actos@Artek" - "FW Team".

Word before date changes from 8888 to 660C.

No other changes.

Flashing the BROM

Currently there is no method available to directly write to the BROM (or TROM), either by software nor by hardware.

Related pages