Skip to content

Instantly share code, notes, and snippets.

@dogtopus
Last active September 28, 2025 16:20
Show Gist options
  • Save dogtopus/0e6a3b09eb1fd174340b57e620b95309 to your computer and use it in GitHub Desktop.
Save dogtopus/0e6a3b09eb1fd174340b57e620b95309 to your computer and use it in GitHub Desktop.
Pocket Challenge stuff

Pocket Challenge (JA734) System Config

Nuvoton Stuff

Memory Layout

  • 0x00000000 - 0x00100000 - (v) SRAM region mirrored by TLB
    • 0x00000000 - 0x00002000 - SRAM mirror
  • 0x80000000 - 0x82000000 - (v, p) 32MiB SDRAM
    • 0x80000000 - 0x81d00000 - OS + BSS (kernel and system heap)
    • 0x81d00000 - 0x82000000 - Reserved area (VRAM, TLB, etc.)
  • 0xb0000000 - 0xc0000000 - (v, p) MMIO (see W55FA93_reg.h)
  • 0xff000000 - 0xff002000 - (p) 8KiB SRAM (probably inaccessible directly after OS enables MMU)
  • 0xffff0000 - 0xffff4000 - (p) BootROM (?, probably inaccessible directly after OS enables MMU)

v - virtual memory (accessible after TLB is enabled), p - physical memory

Bootloader

Stage 0 (boot ROM)

Probably just standard Nuvoton stuff. It'd be great if we can dump it but this is probably not really necessary for a simple emulator (assuming that it doesn't do too much initialization work that the rest of the OS cares about).

Stage 1

Legacy N32905 boot header can be found at the sector 1 of the SD card. The boot header seemingly asks the boot ROM to load 0x10000 bytes to 0x80a00000 (only the first 0x4000 bytes seems to be the actual stage 1 though).

Stage 2

Stage 1 reinitializes the SD card and loads 0x80000 bytes from sector 33 to 0x80c00000. This then loads the kernel from the 1MiB mark on the SD card to 0x80000000 and finally boots it.

Pinctrl

Function Selection

  • GPIO: 0b00
  • Port A UART1: 0b11
  • Port E SD: 0b10

Board Config

Pin Function Description
A3 GPIO VBAT comparator out? (bootloader immediately powers the system off if it's 0)
A10-A11 UART1 UART debug output (bootloader only)
E2-E7 SD0 eSD

Bootloader Poweroff Sequence

RTC_FCR[2:] = 0b10
RTC_PWRON[20:16] = 0b0000
RTC_PWRON[1:] = 0b0
AHBCLK[:] = 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment