Reverse engineering the Meizu players

M6

The main component of the M6 is the S5L8700. datasheet.

These are mostly guesses made by looking at the various debug strings in the firmware files and which addresses get accessed in those functions.

Memory

Address	Device
0x00000000	Boot ROM (50KB)
0x08000000	SDRAM (16MB)
0x22000000	SRAM (256KB)
0x24000000	NOR Flash (1MB)*

*not in the M6SL

In DFU mode code gets loaded to 0x22000000 on M6SL, and to 0x22020000 on the other players

GPIO

(nc) means not connected.

Power system

The CPU can control its own power by sending a signal to the power manager IC. This means that during power-up it has to quickly let the power manager know it wants to keep receiving power. Using the same signal, the CPU can shut itself (and the rest of the electronics) down.

A long press on the play button (M3) or the enter button (M6) causes a quick power-down/power-up sequence, allowing the user to reset the system even when the CPU has completely crashed.

Battery charging is done completely in hardware, software can only monitor whether the charger is active or not.

I2C?

• 0x30: UDA1380 codec
• 0x34: WM8987 codec
• 0x60-0x6F: S35390 RTC

• 0x22: TEA5760 FM radio

ADC

The 10-bit ADC seems to have a full range of 3.00V. The battery voltage is divided by two (through a resistive divider) before entering one of the ADC channels.