release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Wiki > Main > SamsungZ5 (compare)

Difference: SamsungZ5 (r19 vs. r18)

Samsung Z5



Introduction

7 tactile buttons and a touchpad (directions).

Dedicated hold switch

SoC: Sigmatel STMP360(B)

Screen resolution: 128 x 160 (RGB) [there are 2 LCD variants, see below in the hardware section]

RAM: 16 Mb MB

Radio (where present): Philips TEA5767

Nand: 1 - 2 - 4 GB splitted in various logical partitions (see under)

Hardware variants: from the bootloader I understood that there are at least something like 8 HW revisions. Of course these revisions are not very different one another, but features are missing. For example my 2 Z5 have both a microphone as well as the FM radio, while the Z5 that someone took apart below has neither FM radio nor microphone. Other variants are NAND type and LCD type.

SLC version --> 1 GB

MLC version --> 2/4 GB



Firmware

2 firmware updates are available here: http://www.anythingbutipod.com/forum/showthread.php?t=32690. The update is performed by placing the =Z5Update.dat file in the root of the player or the System/Data folder, depending on the current version you're player is running. This player runs Linux as well as a particular Java virtual machine! Indeed, the firmware UI is made up in Java and all the class are visible (and hacker-able smile ). Lots of interesting scripts and executable are present in the firmware.

Update process

With the help of the Z5 updater (recovery) application we can restore the firmware through the STMP3600 recovery mode. A updater.sb as sent to the device. This ~1,8MB file is really complex since it includes some code to load a Linux kernel with a rootfs-based recovery. Then a z5-fw.dat is sent to the user memory (through UMS) and the process of decryption + flashing begins!

Z5Update?.dat is a mixture of plain and encrypted bytes.

MeaningOffsetLength
Header 0 0x38
Data 0x38 Size of the data
MD5 Encrypted data 0x38 + Size of the data 0x10
Header infoOffsetLength
Signature (SAMSUNG YEPP) 0 0xC
Unknown 0xC 0x4
Version 0x10 0x8
Region Code 0x18 0x4
Unknown (revision ?) 0x1C 0x4
Model 0x20 0x14
Size of the data 0x34 0x4

Partitions

NameOffsetLengthUsage
ufd0p0 16 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) ?
ufd0p1 32 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-1 (blk 32 ~ 47) ?
ufd0p2 48 16MB ( 64 blks, 1 blk = 256KB) chip-0, part-2 (blk 48 ~ 111) ?
ufd0p3 112 32MB ( 128 blks, 1 blk = 256KB) chip-0, part-3 (blk 112 ~ 239) ?
ufd0p4 240 923MB (3692 blks, 1 blk = 256KB) chip-0, part-4 (blk 240 ~ 3931) User data
**ufdrawa 16 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) ?kernel?
**ufdrawb ? ? rootfs
**ufdrawc ? ? Oasis UI app data



Modes

To get the player to present itself as a STMP3600/Player Recovery Class device, hold the middle select button while connecting to USB from the off state.

Keep in mind that this device has a sleep mode and the only way to truly turn it off is by pressing in the reset button on the bottom. (applies to OF, not other modes!!!)



Insides

EOREX.png
EOREX.png Board4Uart.jpeg




Schematics & Stuff

YP-Z5 Schematics, Service Manual & more!

ADCChannelUsage
ADC0 Tactile Buttons
ADC1 Microphone Power?
ADC2 Touchpad AX-
ADC3 Touchpad AY-
ADC4 Touchpad AX+
ADC5 Touchpad AY+
GPIO/other pinsNameDefault State (OF)DirectionDescription / use
PSWITCH PSWITCH L I Special pin to get power button and Center button states
SSP_DATA1 B0P29? (SSP_DATA1) SDRAM_PWR N/A O Powers up the SDRAM before its actual usage
GPMI_D00 B0P10? (GPMI_D10) Boot FM_BUS mode N/A O Enables FM radio chip (power)
GPMI_D01 B0P12? (GPMI_D12) Boot USB_Detect mode N/A I  
GPMI_D02 B0P13? (GPMI_D13) ; B0P14? (some HW revisions) Boot Hold_SW mode N/A I Low: unlocked; High: unlocked
GPMI_D03 B3P12? (PWM2) Boot LCD_TP mode N/A I Identify LCD Type (2 possibilities)
GPMI_D09 B3P13? (PWM3) LCD_RD BLU_ON_LCD N/A O Enable/set backlight, see code for description of usage
GPMI_D10 B1P21? (LCD_BUSY) FM_BUS Touchpad TY- N/A 0 O Enable touchpad
GPMI_D12 B3P15? (ROTARYA) USB_Detect Touchpad TX- N/A 1 O Enable touchpad
GPMI_D13 B0P26? (SSP_CMD) Hold_SW Touchpad TY+ N/A 1 Low: O unlocked; High: unlocked Enable touchpad
PWM2 B0P25? (SSP_DETECT) LCD_TP Touchpad TX+ N/A 0 Identify O LCD Type (2 possibilities) Enable touchpad
PWM3 B0P30? (SSP_DATA2) BLU_ON_LCD FM_INT (interrupt) N/A Manage I backlight Related to radio chip; RDS package arrived or stereo indication
LCD_BUSY B1P22? (UART2_CTS) Touchpad MUTE_ON TY- 0 O Enable touchpad Disable audio output
ROTARYA B3P16? (ROTARYB) Touchpad DTV_DETECT TX- 1 N/A O I/O Enable touchpad USB_ID as pinout; might be related to some OTG feature ?
SSP_CMD B0P28?Touchpad FM_DETECT TY+ 1 N/A O I Enable touchpad High: FM present; Low: FM absent
SSP_DETECT B0P24?Touchpad NAND_TYPE TX+ 0 N/A O I Enable touchpad High: MLC; Low: SLC
SSP_DATA2 B0P27?FM_INT NAND_TYPE (interrupt) N/A I High: CS4; Low: CS2 (CHECK! Inconsistency with loader's output!)
UART2_CTS B0P31?MUTE_ON TOUCH_TYPE N/A O I High: CAP; Low: REG (?!!?)
ROTARYB DTV_DETECT N/A I/O  

Touchpad device shall be enabled via the TX/TY +/- pins. See the "Default value" in the table above.



Useful Links



UART Log

Bootloader + Some system messages log during bootup




Actual implementations

I'm working on this port and things are going fine, what is implemented so far in a "playground" code to be sent to device is:

  • Keypad (7 buttons) - needs a review since it works fine on my test device while in the good one some buttons aren't correctly read
  • Backlight - needs some care to set the maximum current to 15mA instead of 20mA to be more safe
  • Display - initializes and I can draw something
  • Hold button
  • ADC readings (also for keypad)
  • Touchpad enable



IAttachmentActionSizeDateWhoComment
Board4Uart.jpgjpgBoard4Uart.jpgmanage 800.9 K 02 Dec 2012 - 08:51LorenzoMiori? Help for the UART
YPZ5_SM.pdfpdfYPZ5_SM.pdfmanage 7989.5 K 02 Dec 2012 - 09:06LorenzoMiori? Service Manual, Schematics and more

r23 - 02 Dec 2013 - 10:57:08 - LorenzoMiori?

Revision r19 - 16 Feb 2013 - 14:19 - LorenzoMiori?
Revision r18 - 29 Dec 2012 - 23:07 - LorenzoMiori?
Copyright by the contributing authors.