---+!! Actions ATJ213x Series ---++ Information This is multimedia SoC based on MIPS 4kEc core (clocked up to 180 MHz) and 24bit DSP with instruction set compatible with ADSP-218x (with some extensions mainly to deal with 24bit data). DSP seems to be clocked up to 96MHz. Data exchange between this two cores can be done through integrated static ram which can be mapped into DSP or MIPS address space domain. There is also dedicated exchange interface (HIP) which can be used to communicate. From reverse engineering it seems that HIP is used only for messaging and synchronization where shared sram is used for actual data exchange. MIPS core provides cache and MMU units. Other than this there is standard set of peripherials including NAND, SDRAM, SD, I2C, UART, LCDIF, ADC, USB 2.0, DAC, PMU. There are two members of this family known - ATJ2135 and ATJ2137 but we don't know how this two are related. The firmware is scrambled and the work to reverse engineer the algorithm has been done - see [[ATJ213xFirmware][ATJ213xFirmware]] for more info. Forcing flash fault by shorting nand I/O lines and connecting USB switches device into sort of recovery mode (tested on Iriver e150): <verbatim> Bus 001 Device 051: ID 10d6:ff96 Actions Semiconductor Co., Ltd Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x10d6 Actions Semiconductor Co., Ltd idProduct 0xff96 bcdDevice 1.00 iManufacturer 0 iProduct 0 iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 32 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 300mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 255 Vendor Specific Subclass bInterfaceProtocol 255 Vendor Specific Protocol iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered) </verbatim>
ore topic actions
r4 - 07 Nov 2015 - 00:19:29 -
Copyright © by the contributing authors.