PMP-100 Firmware


INTRODUCTION

This page is dedicated to information on the internal operation of the iRiver PMP-100 (PMP-120, PMP-140) line of products. The goal is to create a full GPL replacement firmware for these devices. The information on this page is accurate as far as I know. All information has been obtained via iRiver press releases/websites, Websites of companies who have provided hardware or software for the PMP, and by inspecting the firmware images that have been released. I provide absolutely no guaranty that any of this information is correct. In fact I'm sure some if it is wrong. As of this writting, I have never used, held or even seen a PMP device in person. If you have any information that I missed, Please contact me (slimscsi-at-gmail-dot-com). I am in no way associated with iRiver or any other company that I mention on this site.

TODO

I have a lot more information on the firmware, I just need the time to update it.
Create a document repository for all third party whitepapers.

PMP Hardware

The PMP is based on the Texas Instruments DM270 IC. This chip uses an ARM7 (MMU less) 32bit 80MHz (i Think) processor. All A/V decoding is perfromed by the DM270 Hardware. Creating custom firmware will require that Documentation for interfacing with these codecs. It may be possible to add new codecs to the programable DM270 (anyone have info on this?). If not, the 80MHz RISC processor should be enough to decode most audio codecs. Additional video codecs are unlikely.
Processor TI DM270 (80MHz ARM7)
Memory 64MByte Ram (not sure if this is correct, but thats what is hard coded into rrload)
Storage 32Mbits (4MByte) flash / 20-40 GByte spining disk
Display 3.5' 320x240 24bit color display


PMP Software

Listed are software packages currently used by the PMP. In the process of writing a GPL firmware, some of these packages will be replaced with open source and/or custom written packages.
Package Version Licenses Notes
rrload Unknown not exactly GPL rrload was written/GPL'd by a linux company name RidgeRun (hence rr). RidgeRun was purchased by Cadenux. Cadenux continued to develop rrload including porting it to the DM270. These improvements were not folded back into the GPL'd source. Unfortunately for us, this is not a violation of the GPL.
uClinux kernel GPL Was compiled with gcc version 2.96 20000110 (experimental). It may be necessary to keep our development under this version of gcc to keep compatibility.
romfs Unknown GPL romfs is pretty good for this type of device. I will likely keep using it.
tinylogin Unknown GPL
busybox Unknown GPL
mserv Unknown GPL
XFLAT Unknown Commercial XFLAT is a system developed by Cadenux for dynamic linking of libs in uClinux. We should not need it. FLAT/XIP should be good enough (XFLAT is cool for commercial apps because it allows linking to LGPL code from a commercial app)


PMP Boot Process

Upon Reset (or power on) the PMP starts executing instructions at the memory address pointed to by the reset vector. This address is mapped to the flash chip. The first piece of software that executes is rrload. rrload copies the uClinux kernel, and the romfs image into ram and sets the Instruction Pointer (IP) to the entry point of the kernel. At this point, the kernel takes over, mounts the romfs image and executes the UI program. By connecting to a UART port on the PMP, we may be able to interrupt rrload (by holding [ENTER] in a terminal) while powering on the PMP. Once interrupted, rrload will display its menu (VIA the terminal, not on th PMP screen). From here we can upload custom kernels/filesystems for testing without the risk of perminant dammage.

Reverse engineering the firmware

As of this writing (November-23-2004) iRiver has had three revisions of the PMP firmware
Version Release Date   Strings
1.XX Release Shipped with the first PMP units N/A
1.25 Unknown Download Strings
2.01 Nov-19-2004 Download Strings
The firmware is a complete 32MBit images preceided with a 16 byte header. The first two bytes of the header indicate the firmware version. The rest is likely some sort of checksum. I have a lot more info on the firmware. I just need to time to type it up.

FAQs

Got any? email me (slimscsi-at-gmail-dot-com)

Releated Links

I have a lot more links. I just need to time to type it up.
iRiver
DM270 @ TI
DM270 BSP
Internal images of the PMP-140
unoffical iRiver Message boards
Ingenient