Actions ATJ213x Series

Information

This is multimedia SoC based on MIPS 4kEc core (clocked up to 180 MHz) and 24bit DSP with instruction set compatible with ADSP-218x (with some extensions mainly to deal with 24bit data). DSP seems to be clocked up to 96MHz. Data exchange between this two cores can be done through integrated static ram which can be mapped into DSP or MIPS address space domain. There is also dedicated exchange interface (HIP) which can be used to communicate. From reverse engineering it seems that HIP is used only for messaging and synchronization where shared sram is used for actual data exchange. MIPS core provides cache and MMU units. Other than this there is standard set of peripherials including NAND, SDRAM, SD, I2C, UART, LCDIF, ADC, USB 2.0, DAC, PMU. There are two members of this family known - ATJ2135 and ATJ2137 but we don't know how this two are related. The firmware is scrambled and the work to reverse engineer the algorithm has been done - see ATJ213xFirmware for more info.

Forcing flash fault by shorting nand I/O lines and connecting USB switches device into sort of recovery mode (tested on Iriver e150):

Bus 001 Device 051: ID 10d6:ff96 Actions Semiconductor Co., Ltd 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x10d6 Actions Semiconductor Co., Ltd
  idProduct          0xff96 
  bcdDevice            1.00
  iManufacturer           0 
  iProduct                0 
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              300mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)