Reverse engineering the Meizu players

M6

These are mostly guesses made by looking at the various debug strings in the firmware files and which addresses get accessed in those functions.

Memory

Address	Device
0x00000000	Boot ROM (50KB)
0x08000000	SDRAM (16MB)
0x22000000	SRAM (256KB)
0x24000000	NOR Flash (1MB)*

GPIO

Power system

The CPU can control its own power by sending a signal to the power manager IC. This means that during power-up it has to quickly let the power manager know it wants to keep receiving power. Using the same signal, the CPU can shut itself (and the rest of the electronics) down.

A long press on the play button (M3) or the enter button (M6) causes a quick power-down/power-up sequence, allowing the user to reset the system even when the CPU has completely crashed.

Battery charging is done completely in hardware, software can only monitor whether the charger is active or not.

I2C?

Devices connected to built-in I2C bus:

• 0x30: UDA1380 codec
• 0x34: WM8987 codec
• 0x60-0x6F: S35390 RTC

Devices connected to GPIO-based I2C bus:

• 0x22: TEA5760 FM radio

ADC

The 10-bit ADC seems to have a full range of 3.00V. The battery voltage is divided by two (through a resistive divider) before entering one of the ADC channels.