Samsung YP-R0 Port Page
This port is intended to make rockbox work as an "hybrid" application, that runs on linux, but must control lot's of HW parameters by itself >
Do NOT think as this port being something like an application for Android. It's the only application running on the device at a time...
- CPU - ARM IMX37_Apollo (532MHz ARM1176JZF?-S core)
- Linux Kernel 2.6.24-2.4.2 - base (Opensource tools available : http://opensource.samsung.com/ punch in "YP-R0" in search bar!)
- Firmware Encrypted 4 Parts: MBoot,Linux,RootFS,Sysdata each encrypted and output from MounEncrypt? >> into R0.ROM, MD5 Checksum created before Encryption -> now makes sense when installing new Firmware -> Checking needs time to decrypt, decompress, split and then check md5
- Player uses Whimory FTL (according to WhimoryFTL it may be version 2.2.1)
- Uses ALSA for PCM streaming. Both playback and record are working.
- 64 MB of RAM -> about 32 free after kernel is loaded -> plenty of space for RB
- CPU frequencies (200 MHz - 400 MHz - 532 MHz easily selectable using kernel's cpufreq)
- AS3543 audio codec
- SI4709 radio device
- SC900776 "minivet device" -> controls accessories/usb/recovery mode
- Partitions mounted: /mnt/media0 -> 4/8/16 GB user storage; /mnt/media1 -> about 64 mb, to store settings and modded sysdata; /mnt/mmc -> mount point for SD card
- Other interesting block devices -> /dev/stl1, contains region code, RTC time diff, and other things. Should be even usable for most of the space (lot isn't used by R0 application)
- IMX37 has both VPU and IPU, for decoding and manipulating videos and images respectively.
For other informations, just wait I'll copy from my piratenpad page (lots of info)
The port is now near to be stable. It is usable for the everyday usage (tested since months now...). No particular HW/SW issues, just some aspects to be improved and implemented.
Original patches: http://www.rockbox.org/tracker/task/12348
(Code is now into git repo)
To compile, you need a complete arm-linux gcc toolchain. You can build it using rockboxdev.sh (takes a looong time, since glibc needs to be build as well).
|| Standard Linux framebuffer device. ~1200 FPS fullscreen
|| Works fine so far. Explore the possibility of LCD sleep during backlight off to save power
|| Keymap needs some love, but is largely OK. Multiple keypresses through GPIO module are working fine.
|| Playback seems to work rather flawlessy audio-driver wise (using standard alsalib). Volume handling is seperately implemented since alsalib doesnt offer this. For this we directly communicate with the as3543 audio codec. The same driver that SansaAMS uses is used, through ascodec API.
| FM Radio
|| FM Radio is supported using a custom kernel module. RDS is not yet implemented.
|| It is possible to record radio. AS3543 initialization works perfectly. Need to write down the ALSA recording wrapper.
| Power Management
|| Charging, voltage readout and charger status are working. We save power by using the ondemand cpu governor the Linux kernel provides. Runtime is about 25 hrs. Space for improvements?
|| We provide a early/safe USB mode in the patched firmware so the OF isn't needed. However there's no USB cable detection in Rockbox yet. Also, doing USB from within Rockbox is desirable to avoid reboots. Special care is needed to close open files before we make a connection, since the USB device cannot be exposed with open handles.
|| Storage handled by Linux. However, we need to mount the sdcard ourself (TODO)
|| All plugins should work and have a keymap. But some actually don't.
Once you get the rockbox.zip file, you need first of all to place it into the player's root folder.
After that we need to prepare the firmware to be able to run rockbox application.
- Original R0.ROM (v1.25): http://org.downloadcenter.samsung.com/downloadfile/ContentsFile.aspx?CDSite=UNI_UK&CttFileID=2494984&CDCttType=FM&ModelType=N&ModelName=YP-R0JCB&VPath=FM/201105/20110511111257194/R0_1.25.zip
- Rockbox git cloned into a folder of your choice
- Linux environment without particular dependencies, for sure you need basic dev-tools.
- Open a terminal and browse to utils/ypr0tools
- Copy the original R0.ROM file into this folder (for convenience)
- Execute the following commands from here (notice: paths may be different!)
- $ make
- $ ./unpack-firmware.sh R0.ROM /tmp/romfiles
- $ sudo ./patch-firmware.sh files /tmp/romfiles # needs sudo
- $ ./pack-firmware.sh R0.ROM /tmp/romfiles
- After that, R0.ROM is patched and can load Rockbox.
rockbox.sh is a script to put into rockbox.zip. It's a small loader script
that sets stuff up.
files/lib/modules/si4709.ko is a replacement kernel module for fm radio support,
its source code is packaged in ./si4709.7z.
Internals (and disassembly)
(Right-click, View Image for a more detailed resolution)
You can find here a nice tutorial: http://www.anythingbutipod.com/forum/showthread.php?t=64397
[thanks to lebellium]
) you can find the RockBox
porting thread and the modded firmware.
[If that's spam/issue, just remove the link even without saying me that
This player is based on linux. So, let's have a quick look at what is done at startup. When you turn the device on, MBoot (the bootloader) pushes some raw data to the screen: the Samsung logo. This can be easily found in the mboot binary. It's raw data. Then, linux kernel is loaded with the following parameters
noinitrd console=ttymxc0 root=/dev/bml2 rw rootfstype=cramfs
As you can see, ttymxc0 is the UART console (on IMX37) and /dev/bml2 is the block device that contains the cramfs (with all linux stuff + OF application executable and libs)
Once kernel is loaded, some Samsung modules are loaded, such as keypad handler and so on, and then application is launch.
MBoot has another important task: if R0.ROM is copied in the nand (precisely /dev/stl3 mounted as /mnt/media0), then the update process is started.
It consists in a firmware checking stage (where CRC's are checked; lebellium told me if that fails device is anyway bricked because R0.ROM is not deleted :S) and then the real flashing.
I still don't know how this flashing works but basically is a raw copy from the decrypted rom data to the storages.
Firmware is composed by:
- MBoot: bootloader, manages startup + device update and launches kernel
- zImage: compressed (or as I tested, also uncompressed) kernel image
- cramfs-fsl: image of a normal cramfs filesystem. Easy to unpack and repack through linux.
- SysData: contains resources stuff for OF application. It is mounted at /mnt/media1/Sysdata. If you extract it using a tool developed by user, you are able to see the content, modify it and repack it once again. Through safe mode of my modded firmware you can copy this content directly to media1/sysdata editing it in this folder. New resources will load instead of the "flashed" one
Software related interesting facts
Samsung uses a filesystem layer: RFS. Documentation is public available, source not but I found them on a chinese site hehe link: http://dl.dropbox.com/u/38710278/904147731rfs_fs.zip
Link about RFS used by the player: http://www.samsung.com/global/business/semiconductor/products/flash/downloads/RFS_130_Porting_Guide.pdf
Setting cpu to 200 MHz, using default application you will hear scratches while playing WITH backlight off. Interesting is that, if you set the backlight to stay on and you create a script that manages it instead of the OF app, you will not hear these scratches, thus:
- There is a low power mode somewhere
- Screen sleep produces that
Original software is full of bugs everywhere
The Samsung tool has been leaked, more information below. I have used this tool lots of times and its 100% safe (even disconnecting cable during the process isn't a problem!!!)
TODOs and ideas
- Radio: RDS is still to be implemented.
- USB: easy to make a connection using kernel tools. Easy to detect if cable is inserted or not (using minird program from a script, implementing them throug ioctls in rockbox, /dev/minivet, source for it are available in kernel). Also if only charger cable is inserted is easy to understand. Basically reading a particular register of this device (0xa) , you get a numeric value that identifies if a charger, usb cable, etc is connected
- SD CARD: implement a way of controlling SD card mount/unmount, considering caching (hot swap)
- Radio can be recorded: implement ALSA wrapper for that.
- using Samsung Opensource Tools, able to create new R0.ROM BOTH encryption and decryption are working
- I was able to decrypt firmware again its basically XOR, thanks to JeanLouis? which was restated at http://anythingbutipod.com/forum/showthread.php?t=54481&page=2 -> Next Step is to poke around until I am able to share rootfs and all other partions with USB (is done in the modded firmware - "Safe Mode")
- RootFS? partion is now mountable unfortunately not what I expected but still something to look into
- SysData.bin: there is a packer/unpacker. Cmd line version is both linux/windows. GUI version is unfortunately only for windowds, but that's not an issue, as we can mod it on the fly using "Safe Mode"
- MBoot.bin looks promising in Hexeditor
- it should be possible to abuse Mboot.bin to boot rockbox, I will compile with the hardware i already know, create a zImage as well es cramfs which is mandetory if we use regular firmware check and build a new firmware cloaked as Samsungs Firmware this means loss of original firmware
- Doom game doesn't work.
- Cube demo plugin makes the application to quit --> see the quit function, may interfere with another quit function!
- Rare crashes when pressing a button while backlight is off
Copyright © by the contributing authors.