Introduction

This is a port to a series of flash based player by Meizu (Chinese). The models are the "Mini Player" M6T1, M6TP, M6SP, M6SL, and the "Music Card" M3. There are actually two versions of M3: an earlier version using a Philips codec and a newer one using a Wolfson codec.

Hardware

Gathering information about the hardware is done by reverse engineering.

M6 SP Schematic

There are two hardware revisions for the M3 and currently it is only known that they differ in the codec used. The old revision uses UDA1380HN (similar to M6 T1/TP/SP) and the new revision (starting from 10th March 2008) uses WM8987 (similar to the M6SL). Because of this, the new M3 is sometimes called "M3SL" on Chinese forums, although the official naming is still M3. As of June 2008, there are currently no take-apart pictures of the new M3, so we can't know which hardware other than the codec has actually changed.

Also, the LCD panels on the M6 and M3 have changed a few times. Users have reported different colour tints from two different M6 units with manufacturing dates differing by only a few months. Also, using an old OF version on a new M3 or a recently repaired M3 will render the screen unusable.

Port Status

The port is in a very early stage. These are the basic tasks which need to be done (not necessary in this order).

The following rockbox drivers need to be implemented for the Meizu series:

The To Do List

Take-apart Pictures

Meizu M6 Pictures

• Back side
• QVGA Display 320X240
• The chip and memory
• Audio Codec
• Sensor

Meizu M3 Pictures

There is an article showing the internals of the M3 compared to the iPod Nano 2G: http://www.meizu.com/support/articleread.asp?articleid=446

Forums

• Rockbox.org
• Meizu Me

Firmware analysis

The firmware upgrade consists of two files: resource.bin and M6.EBN

resource.bin

This file is full of big-endian UTF-16 strings (strings -eb resource.bin). It probably contains other things like graphics.

M6.EBN

This file starts with some big-endian ARM code (arm-elf-objdump -b binary -m armv4 -EB -D M6.EBN). After 8KB there is a rar archive marker ("Rar!"). The rar file following this contains the file "Source/Blues_Dual_Lib_Data/SDRAM_SAMSUNG_DUAL/SDRAM_image.bin", which is a 1.3MB file with big-endian ARM code.

SDRAM_image.bin contains: "S5L8700 uCOSII with DOkdo FS", which seems to be μC/OS-II

This rar archive can only be created with an older version of WinRAR (http://www.meizume.com/firmware-m3/5241-m3-firmware-might-relevant-m6-too.html). Archives created using a newer version of WinRAR will brick the device. Fortunately, this is fixable using DFU (see below).

Official Frimware Strings

Firmware Upgrade

Warning: After the update the player will format itself so save your data first.

1. Hold "play" for 3 seconds to power on.
2. Connect to the computer with the USB cable
3. The computer will identify the player automatically as a removable disk
4. Download the firmware upgrade from http://en.meizu.com/
5. Decompress the downloaded file
6. Copy "M6.EBN" and "resource.bin" to the root folder of the player
7. Disconnect the player from the computer
8. Hold "play" for 3 seconds to power off
9. Hold "play" for 3 seconds to power on again
10. The screen will show: "Upgrading Software, Please wait..." and after a while the player will shut down automatically
11. Hold "play" for 3 seconds to power on. The player should now work again normally with the new firmware.

If the screen shows: "No Resource! Please Upgrade Resource Again!"

1. Connect to the computer again and copy "resource.bin" to the root of the player
2. Disconnect the player via safe disconnection
3. Hold "play" for 3 seconds to power off, then power on again and now it should work again

Recovery mode (DFU)

Meizu has implemented the DFU protocol. In DFU mode it's possible to flash and recover from a bad firmware flash. For the Meizu's you can use Samsung's DFU Tools in Windows. In Linux it's possible to use the meizu_dfu tool which can be found in the rockbox source tree under utils/meizu_dfu.

To enter DFU mode:

1. On M6 SP: Hold M and then press and hold power. On M3 and M6 SP: Hold M and then press and hold PLAY.
2. Wait 2 seconds, then connect device to USB port.
3. On M6 (both): Release the buttons. On M3: Keep M pressed but release PLAY (if you don't release PLAY the update might stop halfway, leaving the player in a state where you need to run down the battery before you can use DFU again)

To recover in DFU, 2 files must be sent. First the flash updater, then the firmware. The updater for for M6 SP and M3 is "SST39VF800.dfu", on the M6 SL it's "updateNAND_BE_070831.dfu".

DFU Procedure for M3, M6 TP, M6 SP and M6 SL

1. GET_CPU
   • send usb control out with request = 255, value = 2, index = 0, length = 63
   • should return "S5L8700 Rev.1" (for M3, M6 TP and M6 SP) or "S5L8700 Rev.2" (for M6 SL)
2. GET_CPU
   • send usb control out with request = 255, value = 2, index = 0, length = 63
   • should return "S5L8700 Rev.1" (for M3, M6 TP and M6 SP) or "S5L8700 Rev.2" (for M6 SL)
3. SEND_FILE SST39VF800^?.dfu (for M3, M6 TP and M6 SP) or updateNAND_BE_070831.dfu (for M6 SL)
   • check DFU signature at 0x20, then write file length + 16 after that (in little endian)
   • append the DFU suffix as specified in DFU specification version 1.0
     • the signature is "RON" for SST39VF800^?.dfu
     • the signature is "UFD" for updateNAND_BE_070831.dfu
   • send file in 2048-byte chunks
     • this is done by sending usb control out with request = 1, value = (incremental index from 0), index = 0, length = 2048 or whatever's left
     • after sending the request, send DFU_GETSTATUS and loop until the state == 0x05
   • send usb control out with request = 1, value = (incremental index from 0), index = 0, length = 0
4. SLEEP 1000
5. DFU_CLEAR (not for M6 SL)
   • send DFU_GETSTATUS until state == 0x08
   • send DFU_CLRSTATUS
6. GET_CPU
   • send usb control out with request = 255, value = 2, index = 0, length = 63
   • should return "S5L8700 Rev.1" (for M3, M6 TP and M6 SP) or "S5L8700 Rev.2" (for M6 SL)
7. GET_CPU (only for M6 SL)
   • send usb control out with request = 255, value = 2, index = 0, length = 63
   • should return "S5L8700 Rev.2"
8. SEND_FILE M3.EBN (for M3), M6.EBN (for M6 TP and M6 SP) or M6SL.EBN (for M6 SL)
   • check DFU signature at 0x20, then write file length + 16 after that (in little endian)
   • append the DFU suffix as specified in DFU specification version 1.0
   • send file in 2048-byte chunks
     • this is done by sending usb control out with request = 1, value = (incremental index from 0), index = 0, length = 2048 or whatever's left
     • after sending the request, send DFU_GETSTATUS and loop until the state == 0x05
   • send usb control out with request = 1, value = (incremental index from 0), index = 0, length = 0
9. DFU_DETACH
   • send DFU_DETACH with value = 0, index = 3, length = 4
   • send DFU_DOWNLOAD with value = 16, index = 3, length = 0
   • send DFU_DETACH with value = 0, index = 3, length = 4, loop 5 times

There is also an open source tool called DFU-Util for the OpenMoko project. Unfortunately, this tool does not work unmodified with Meizu players.

Here's the full DFU spec

Links

• inside the Meizu M6SL (Chinese; translated)
• inside the Meizu M3 (Chinese; translated)
• http://powerman.ucoz.ru/forum/15-193-2#3630 (Russian; translated)

• meizu_dfu.tar.bz2: meizu dfu tool for linux

Attachment	Action	Size	Date	Who	Comment
meizu_dfu.tar.bz2	manage	32.5 K	28 Aug 2008 - 05:56	WilliamPoetra	meizu dfu tool for linux