dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > SamsungYPR0 (r26)

Samsung YP-R0 Port Page

This port is intended to make rockbox work as an "hybrid" application, that runs on linux, but must control lot's of HW parameters by itself >

Player Info

  1. CPU - ARM IMX37_Apollo (532MHz ARM1176JZF?-S core)
  2. Linux Kernel 2.6.24-2.4.2 - base (Opensource tools available : punch in "YP-R0" in search bar!)
  3. Firmware Encrypted 4 Parts: MBoot,Linux,RootFS,Sysdata each encrypted and output from MounEncrypt? >> into R0.ROM, MD5 Checksum created before Encryption -> now makes sense when installing new Firmware -> Checking needs time to decrypt, decompress, split and then check md5
  4. Player uses Whimory FTL (according to WhimoryFTL it may be version 2.2.1)
  5. Uses ALSA (so for audio data management we exploit it, for audio volume control we need to make as3543 work.)
  6. 64 MB of RAM -> about 32 free after kernel is loaded -> plenty of space for RB
  7. CPU frequencies (200 MHz - 400 MHz - 532 MHz easily selectable using kernel's cpufreq)
  8. AS3543 audio codec
  9. SI4709 radio device
  10. SC900776 "minivet device" -> controls accessories/usb/recovery mode(to be used with non-public samsung tools)
  11. Partitions mounted: /mnt/media0 -> 4/8/16 GB user storage; /mnt/media1 -> about 64 mb, to store settings and modded sysdata; /mnt/mmc -> mount point for SD card
  12. Other interesting block devices -> /dev/stl1, contains region code, RTC time diff, and other things. Should be even usable for most of the space (lot isn't used by R0 application)
  13. IMX37 has both VPU and IPU, for decoding and manipulating videos and images respectively.

For other informations, just wait I'll copy from my piratenpad page (lots of info)

Port Status

The current code can be found on Flyspray. It's basically very stable and ready for an initial commit:

To compile, you need a complete arm-linux gcc toolchain. You can build it using (takes a looong time, since glibc needs to be build as well).

driver status comments
LCD 100% Standard Linux framebuffer device. ~1200 FPS fullscreen
Backlight 100% Works fine so far. Explore the possibility of LCD sleep during backlight off to save power
Buttons 95% Keymap needs some love, but is largely OK. Multiple keypresses through GPIO module are working fine.
Audio 100% Playback seems to work rather flawlessy audio-driver wise (using standard alsalib). Volume handling is seperately implemented since alsalib doesnt offer this. For this we directly communicate with the as3543 audio codec. The same driver that SansaAMS uses is used, through ascodec API.
FM Radio 75% FM Radio is supported using a custom kernel module. RDS is not yet implemented.
Power Management 90% Charging, voltage readout and charger status are working. We save power by using the ondemand cpu governor the Linux kernel provides. Runtime is about 25 hrs. Space for improvements?
USB 50% We provide a early/safe USB mode in the patched firmware so the OF isn't needed. However there's no USB cable detection in Rockbox yet. Also, doing USB from within Rockbox is desirable to avoid reboots. Special care is needed to close open files before we make a connection, since the USB device cannot be exposed with open handles.
Storage 50% Storage handled by Linux. However, we need to mount the sdcard ourself (TODO)
Plugins 90% All plugins should work and have a keymap. But some actually don't.


(Right-click, View Image for a more detailed resolution)

You can find here a nice tutorial: [thanks to lebellium]


/> comparison.jpg /> comparison.jpg


Here ( you can find the RockBox porting thread and the modded firmware. [If that's spam/issue, just remove the link even without saying me that wink ]

Firmware structure

This player is based on linux. So, let's have a quick look at what is done at startup. When you turn the device on, MBoot (the bootloader) pushes some raw data to the screen: the Samsung logo. This can be easily found in the mboot binary. It's raw data. Then, linux kernel is loaded with the following parameters

noinitrd console=ttymxc0 root=/dev/bml2 rw rootfstype=cramfs

As you can see, ttymxc0 is the UART console (on IMX37) and /dev/bml2 is the block device that contains the cramfs (with all linux stuff + OF application executable and libs)

Once kernel is loaded, some Samsung modules are loaded, such as keypad handler and so on, and then application is launch.

MBoot has another important task: if R0.ROM is copied in the nand (precisely /dev/stl3 mounted as /mnt/media0), then the update process is started. It consists in a firmware checking stage (where CRC's are checked; lebellium told me if that fails device is anyway bricked because R0.ROM is not deleted :S) and then the real flashing. I still don't know how this flashing works but basically is a raw copy from the decrypted rom data to the storages. Firmware is composed by:

  1. MBoot: bootloader, manages startup + device update and launches kernel
  2. zImage: compressed (or as I tested, also uncompressed) kernel image
  3. cramfs-fsl: image of a normal cramfs filesystem. Easy to unpack and repack through linux.
  4. SysData: contains resources stuff for OF application. It is mounted at /mnt/media1/Sysdata. If you extract it using a tool developed by user, you are able to see the content, modify it and repack it once again. Through safe mode of my modded firmware you can copy this content directly to media1/sysdata editing it in this folder. New resources will load instead of the "flashed" one wink

Software related interesting facts

Samsung uses a filesystem layer: RFS. Documentation is public available, source not but I found them on a chinese site hehe link:

Link about RFS used by the player:

Setting cpu to 200 MHz, using default application you will hear scratches while playing WITH backlight off. Interesting is that, if you set the backlight to stay on and you create a script that manages it instead of the OF app, you will not hear these scratches, thus:

  1. There is a low power mode somewhere
  2. Screen sleep produces that

Original software is full of bugs everywhere

Bricked device

Basically without Samsung tools there is nothing to do. I could do a usb sniffing while flashing the firmware, but I have no clue how to do it and moreover I use to flash it through VirtualBox?'ed windows xp as my host machine has linux.

(to be completed with information about original tool + using freescale tool + necessary samsung files + cable with resistor)

TODOs and ideas

  1. Power management: we have AS3543 codec and battery voltage is read through it's ADC device. So should be quite easy to use the already written driver for other devices...
  • Full charge is done at about 4.200 V w. cable inserted
  • Full charge is done at about 4.150 V w/o cable inserted
  • OF shuts down at 3.450 volts
  1. Radio: RDS is still to be implemented.
  2. USB: easy to make a connection using kernel tools. Easy to detect if cable is inserted or not (using minird program from a script, implementing them throug ioctls in rockbox, /dev/minivet, source for it are available in kernel). Also if only charger cable is inserted is easy to understand. Basically reading a particular register of this device (0xa) , you get a numeric value that identifies if a charger, usb cable, etc is connected
  3. SD CARD: implement a way of controlling SD card mount/unmount, considering caching (hot swap)


  1. using Samsung Opensource Tools, able to create new R0.ROM BOTH encryption and decryption are working
  2. stuck on Bootloader: MBoot.bin is needed which gives me troubles to integrate a different bootloader
  3. drivers for Player should all be there
  4. Final Problem: Bootloader - best would be to reverse engineer Encryption to get the original content of R0.ROM (v1.10) and work with this version as its most stable. Opensource Kit from Samsung ships with YP-R1 ROM which differs from R0
  5. I was able to decrypt firmware again its basically XOR, thanks to JeanLouis? which was restated at -> Next Step is to poke around until I am able to share rootfs and all other partions with USB (is done in the modded firmware - "Safe Mode")
  6. RootFS? partion is now mountable unfortunately not what I expected but still something to look into
  7. SysData.bin: there is a packer/unpacker. Cmd line version is both linux/windows. GUI version is unfortunately only for windowds, but that's not an issue, as we can mod it on the fly using "Safe Mode"
  8. MBoot.bin looks promising in Hexeditor
  9. it should be possible to abuse Mboot.bin to boot rockbox, I will compile with the hardware i already know, create a zImage as well es cramfs which is mandetory if we use regular firmware check and build a new firmware cloaked as Samsungs Firmware this means loss of original firmware


  1. Some plugins, especially after sdl removal, crash.
r26 - 29 May 2012 - 09:23:51 - ThomasMartitz

Parents: WebHome
Copyright by the contributing authors.