---+!! Samsung Z5 %TOC% <br /> --- ---++ Port status | *driver* | *status* | *comments* | | LCD | %GREEN%85%%ENDCOLOR% | Screen is nicely working, also using DMA to transfer data to it. MISSING: poweroff to save battery and possibly other nice features | | Backlight | %GREEN%100%%ENDCOLOR% | Works fine so far. 19 levels. | | Buttons | %GREEN%90%%ENDCOLOR% | Keymap are to be heavily improved. Tactile buttons are working. Touchpad needs some more calibration | | Audio | %GREEN%90%%ENDCOLOR% | Still no song have been tested due to missing NAND support, but keyclicks + FM are working | | FM Radio | %GREEN%100%%ENDCOLOR% | FM Radio chip is fully working | | Recording | %RED%0%%ENDCOLOR% | Implemented but not tested / does not work | | Power Management | %ORANGE%60%%ENDCOLOR% | Support is implemented but everything has to be tested. No charging at the moment | | USB | %GREEN%100%%ENDCOLOR% | USB connection in general is working, as well as gadgets (e.g. multimedia controller) and mass storage (ram disk) | | Storage | %RED%5%%ENDCOLOR% | NAND support is still completely absent. I began some work and ID is correctly read: we can detect type and number of banks. | | Plugins | %RED%0%%ENDCOLOR% | Keymaps to be defined + testing | --- ---++ Introduction 7 tactile buttons and a touchpad (directions). Dedicated hold switch SoC: Sigmatel STMP360(B) Screen resolution: 128 x 160 (RGB) [there are 2 LCD variants, see below in the hardware section] RAM: 16 MB Radio (where present): Philips TEA5767 Nand: 1 - 2 - 4 GB splitted in various logical partitions (see under) Hardware variants: from the bootloader I understood that there are at least something like 8 HW revisions. Of course these revisions are not very different one another, but features are missing. For example my 2 Z5 have both a microphone as well as the FM radio, while the Z5 that someone took apart below has neither FM radio nor microphone. Other variants are NAND type and LCD type. SLC version --> 1 GB MLC version --> 2/4 GB <br /> --- ---++ Firmware 2 firmware updates are available here: http://www.anythingbutipod.com/forum/showthread.php?t=32690. The update is performed by placing the =Z5Update.dat file in the root of the player or the System/Data folder, depending on the current version you're player is running. This player runs Linux as well as a particular Java virtual machine! Indeed, the firmware UI is made up in Java and all the class are visible (and hacker-able :) ). Lots of interesting scripts and executable are present in the firmware. Update process With the help of the Z5 updater (recovery) application we can restore the firmware through the STMP3600 recovery mode. A updater.sb as sent to the device. This ~1,8MB file is really complex since it includes some code to load a Linux kernel with a rootfs-based recovery. Then a z5-fw.dat is sent to the user memory (through UMS) and the process of decryption + flashing begins! Z5Update.dat is a mixture of plain and encrypted bytes. | *Meaning* | *Offset* | *Length* | | Header | 0 | 0x38 | | Data | 0x38 | Size of the data | | MD5 Encrypted data | 0x38 + Size of the data | 0x10 | | *Header info* | *Offset* | *Length* | | Signature (SAMSUNG YEPP) | 0 | 0xC | | Unknown | 0xC | 0x4 | | Version | 0x10 | 0x8 | | Region Code | 0x18 | 0x4 | | Unknown (revision ?) | 0x1C | 0x4 | | Model | 0x20 | 0x14 | | Size of the data | 0x34 | 0x4 | Partitions | *Name* | *Offset* | *Length* | *Usage* | | ufd0p0 | 16 | 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) ? | | ufd0p1 | 32 | 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-1 (blk 32 ~ 47) | ? | | ufd0p2 | 48 | 16MB ( 64 blks, 1 blk = 256KB) chip-0, part-2 (blk 48 ~ 111) | ? | | ufd0p3 | 112 | 32MB ( 128 blks, 1 blk = 256KB) chip-0, part-3 (blk 112 ~ 239) | ? | | ufd0p4 | 240 | 923MB (3692 blks, 1 blk = 256KB) chip-0, part-4 (blk 240 ~ 3931) | User data | | **ufdrawa | 16 | 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) | ?kernel? | | **ufdrawb | ? | ? | rootfs | | **ufdrawc | ? | ? | Oasis UI app data | <br /> --- ---++ Modes To get the player to present itself as a STMP3600/Player Recovery Class device, hold the middle select button while connecting to USB from the off state. Keep in mind that this device has a sleep mode and the only way to truly turn it off is by pressing in the reset button on the bottom. (applies to OF, not other modes!!!) <br /> --- ---++ Insides * SOC = STMP3650 (see SigmaTelSTMP3xxx or STMP37xxChips) * NAND = K9K8G08UOM 4G x 8 Bit NAND flash memory * LCD-TFT = lte182qq-f03-v2.2 OR OPFPCTO422-V1.3 [NOTE: there are 2 types of LCD, we implement both of them but I could only test the first one...] * BACKLIGHT = AAT3151 [datasheet available] * SDRAM = 16MB (128Mbit) Mobile SDRAM EOREX em488m1644vba-756 (http://www.datasheets.org.uk/pdf/1328385.pdf) [[%ATTACHURLPATH%/back.png][<img src="%ATTACHURLPATH%/back.png" alt="EOREX.png" width='245' />]] <br /> <img src="%ATTACHURLPATH%/EOREX.png" alt="EOREX.png" width='245' height='240' /> <img src="%ATTACHURLPATH%/Board4Uart.jpg" alt="Board4Uart.jpeg" width='1000' height='540' /> <br /> <br /> --- ---++ Schematics & Stuff [[https://www.dropbox.com/s/924od03qwqtywzt/YPZ5_SM.pdf][YP-Z5 Schematics, Service Manual & more!]] | *ADCChannel* | *Usage* | | ADC0 | Tactile Buttons | | ADC1 | Microphone Power? | | ADC2 | Touchpad AX- | | ADC3 | Touchpad AY- | | ADC4 | Touchpad AX+ | | ADC5 | Touchpad AY+ | | *GPIO/other pins* | *Name* | *Default State (OF)* | *Direction* | *Description / use* | | PSWITCH | PSWITCH | L | I | Special pin to get power button and Center button states | | B0P29 (SSP_DATA1) | SDRAM_PWR | N/A | O | Powers up the SDRAM before its actual usage | | B0P10 (GPMI_D10) | FM_BUS | N/A | O | Enables FM radio chip (power) | | B0P12 (GPMI_D12) | USB_Detect | N/A | I | | | B0P13 (GPMI_D13) ; B0P14 (some HW revisions) | Hold_SW | N/A | I | Low: unlocked; High: unlocked | | B3P12 (PWM2) | LCD_TP | N/A | I | Identify LCD Type (2 possibilities) | | B3P13 (PWM3) | BLU_ON_LCD | N/A | O |Enable/set backlight, see code for description of usage | | B1P21 (LCD_BUSY) | Touchpad TY- | 0 | O | Enable touchpad | | B3P15 (ROTARYA) | Touchpad TX- | 1 | O | Enable touchpad | | B0P26 (SSP_CMD) | Touchpad TY+ | 1 | O | Enable touchpad | | B0P25 (SSP_DETECT) | Touchpad TX+ | 0 | O | Enable touchpad | | B0P30 (SSP_DATA2) | FM_INT (interrupt) | N/A | I | Related to radio chip; RDS package arrived or stereo indication | | B1P22 (UART2_CTS) | MUTE_ON | 0 | O | Disable audio output | | B3P16 (ROTARYB) | DTV_DETECT | N/A | I/O | USB_ID as pinout; might be related to some OTG feature ? | | B0P28 | FM_DETECT | N/A | I | High: FM present; Low: FM absent | | B0P24 | NAND_TYPE | N/A | I | High: MLC; Low: SLC | | B0P27 | NAND_TYPE | N/A | I | High: CS4; Low: CS2 (CHECK! Inconsistency with loader's output!) | | B0P31 | TOUCH_TYPE | N/A | I | High: CAP; Low: REG (?!!?) | Touchpad device shall be enabled via the TX/TY +/- pins. See the "Default value" in the table above. <br /> --- ---++ Useful Links * SigmaTelSTMP3xxx --- --- ---++ UART Log [[http://pastebin.com/zVxFXFHL][Bootloader + Some system messages log during bootup]] --- <br /> --- ---++ Actual implementations I'm working on this port and things are going fine, what is implemented so far in a "playground" code to be sent to device is: * Keypad (7 buttons) * Backlight * Display (both LCD types are working fine) * Hold button * ADC readings * Touchpad enable * SDRAM <br/> --- * [[%ATTACHURL%/YPZ5_SM.pdf][YPZ5_SM.pdf]]: Service Manual, Schematics and more
02 Dec 2012 - 08:51
Help for the UART
02 Dec 2012 - 09:06
Service Manual, Schematics and more
ore topic actions
r23 - 02 Dec 2013 - 10:57:08 -
Copyright © by the contributing authors.