Wiki > Main > SamsungYPS3 (compare)
Difference: SamsungYPS3 (r27 vs. r26)
The YP-S3 is a music player by Samsung, apparently very similar to the YP-S5. This page is a collection of information to help implement a rockbox port to this player (and similar others).
Using the DFU mode, we can send a small test program to RAM and run it.
What currently works works: (code for this needs a cleanup and is not in SVN yet):
A disassembly video can be found here: http://www.metacafe.com/watch/2075465/naked_s3_in_white/
A disassembly video of the YP-S5 (very similar to the YP-S3) can be found here: http://www.metacafe.com/watch/1958837/you_wanna_know_it_disassemble_samsung_yp_s5/
Strings from the firmware upgrade image suggest the following components:
The LCD is connected to NOR flash RAM port, plus pins P7.0 and P7.1 for reset and select.
Internal i2c bus:
The touch keys are controlled by a Melfas touch key chip.
When a key is touched, the controller pulls down P1.6, signalling that the CPU can now use P3.4 to clock in a 20-bit word from pin P1.5. The status (touched or released) of each touch key can be determined from the bits in this word.
The measured battery voltage seems to be valid only when the USB plug is inserted.
Charging can be enabled and disabled by software. The charger stops charging automatically when done. Software can monitor the charging status (charging busy or done) and configure one of two charging current settings.
This player seems to support two (yet unidentified) LCDs. The lcd type is determined by looking at pin P0.4. These LCDs seem to have similarities with the displays used in the Onda VX-747 and the Meizu M3.
The WM1800 audio codec has no publicly available documentation, but the register layout is very similar to that of other Wolfson codecs, e.g. the WM8960.
The Samsung can present itself with three different USB configurations: MTP, MSC and DFU.
In MTP mode, it presents itself as a device with three endpoints (2x bulk, 1x interrupts) additional to the mandatory control endpoint 0. The USB interface says it uses a vendor specific class, subclass and protocol. Windows recognises this as an MTP device. Vendor id (VID) and product id (PID) in this mode are 0x04E8/0x5091.
In MSC mode, it presents itself as a regular MSC device, with two "drives" (at least it does so on Linux). One of the drives contains the usual stuff like a "Music" folder, but also some interesting files in the "SYSTEM" folder (seems like debugging info). The other drive seems to contain all kinds of low-level configuration files. MSC mode can be enabled by putting a firmware update file along with a specific "config.dat" file on the player and letting it update on reboot. Vendor id (VID) and product id (PID) in this mode are 0x04E8/0x5090.
DFU mode can be entered by plugging in the USB cable, then doing a hard reset (by pressing a pin in the hole at the back of the player) and holding the power button at the same time. The screen stays dark in this mode. The player now presents itself as a DFU device, with 0 extra endpoints additional to the mandatory control endpoint 0. Vendor id (VID) and product id (PID) in this mode are 0x0419/0x0145. This is exactly the same VID/PID as the Meizu M6SL in DFU mode!
Experimentation with the meizu_dfu tool shows that the DFU upgrader program can be uploaded successfully to the YP-S3 too, so we can run a rockbox bootloader test program in RAM.
It is possible to upload a "BluesUtilNand" DFU image to the player, this DFU image allows access to the NAND memory over USB.
Interesting parts of the NAND flash data are:
The utility also allows uploading of "spare" NAND. The spare NAND blocks are much smaller than the main NAND. A possible use is meta-data for the FTL (e.g. markers, error correction data, erase/usage counters)
r29 - 01 Nov 2009 - 15:41:20 - BertrikSikkenRevision r27 - 07 Aug 2009 - 10:04 - BertrikSikken
Revision r26 - 05 Aug 2009 - 15:57 - BertrikSikken
Copyright © by the contributing authors.