Samsung Z5
Port status
As of Git commit 786d06742a, this port has been removed from the main codebase. This page will remain for historical purposes.
Introduction
7 tactile buttons and a touchpad (directions).
Dedicated hold switch
SoC: Sigmatel STMP360(B)
Screen resolution: 128 x 160 (RGB) [there are 2 LCD variants, see below in the hardware section]
RAM: 16 MB
Radio (where present): Philips TEA5767
Nand: 1 - 2 - 4 GB splitted in various logical partitions (see under)
Hardware variants: from the bootloader I understood that there are at least something like 8 HW revisions. Of course these revisions are not very different one another, but features are missing. For example my 2 Z5 have both a microphone as well as the FM radio, while the Z5 that someone took apart below has neither FM radio nor microphone. Other variants are NAND type and LCD type.
SLC version --> 1 GB
MLC version --> 2/4 GB
Firmware
2 firmware updates are available here:
http://www.anythingbutipod.com/forum/showthread.php?t=32690. The update is performed by placing the =Z5Update.dat file in the root of the player or the System/Data folder, depending on the current version you're player is running.
This player runs Linux as well as a particular Java virtual machine! Indeed, the firmware UI is made up in Java and all the class are visible (and hacker-able
). Lots of interesting scripts and executable are present in the firmware.
Update process
With the help of the Z5 updater (recovery) application we can restore the firmware through the STMP3600 recovery mode.
A updater.sb as sent to the device. This ~1,8MB file is really complex since it includes some code to load a Linux kernel with a rootfs-based recovery.
Then a z5-fw.dat is sent to the user memory (through UMS) and the process of decryption + flashing begins!
Z5Update.dat is a mixture of plain and encrypted bytes.
| Meaning |
Offset |
Length |
| Header |
0 |
0x38 |
| Data |
0x38 |
Size of the data |
| MD5 Encrypted data |
0x38 + Size of the data |
0x10 |
| Header info |
Offset |
Length |
| Signature (SAMSUNG YEPP) |
0 |
0xC |
| Unknown |
0xC |
0x4 |
| Version |
0x10 |
0x8 |
| Region Code |
0x18 |
0x4 |
| Unknown (revision ?) |
0x1C |
0x4 |
| Model |
0x20 |
0x14 |
| Size of the data |
0x34 |
0x4 |
Partitions
| Name |
Offset |
Length |
Usage |
| ufd0p0 |
16 |
4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) ? |
| ufd0p1 |
32 |
4MB ( 16 blks, 1 blk = 256KB) chip-0, part-1 (blk 32 ~ 47) |
? |
| ufd0p2 |
48 |
16MB ( 64 blks, 1 blk = 256KB) chip-0, part-2 (blk 48 ~ 111) |
? |
| ufd0p3 |
112 |
32MB ( 128 blks, 1 blk = 256KB) chip-0, part-3 (blk 112 ~ 239) |
? |
| ufd0p4 |
240 |
923MB (3692 blks, 1 blk = 256KB) chip-0, part-4 (blk 240 ~ 3931) |
User data |
| **ufdrawa |
16 |
4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) |
?kernel? |
| **ufdrawb |
? |
? |
rootfs |
| **ufdrawc |
? |
? |
Oasis UI app data |
Modes
To get the player to present itself as a STMP3600/Player Recovery Class device, hold the middle select button while connecting to USB from the off state.
Keep in mind that this device has a sleep mode and the only way to truly turn it off is by pressing in the reset button on the bottom. (applies to OF, not other modes!!!)
Insides
Schematics & Stuff
YP-Z5 Schematics, Service Manual & more!
| ADCChannel |
Usage |
| ADC0 |
Tactile Buttons |
| ADC1 |
Microphone Power? |
| ADC2 |
Touchpad AX- |
| ADC3 |
Touchpad AY- |
| ADC4 |
Touchpad AX+ |
| ADC5 |
Touchpad AY+ |
| GPIO/other pins |
Name |
Default State (OF) |
Direction |
Description / use |
| PSWITCH |
PSWITCH |
L |
I |
Special pin to get power button and Center button states |
| B0P29 (SSP_DATA1) |
SDRAM_PWR |
N/A |
O |
Powers up the SDRAM before its actual usage |
| B0P10 (GPMI_D10) |
FM_BUS |
N/A |
O |
Enables FM radio chip (power) |
| B0P12 (GPMI_D12) |
USB_Detect |
N/A |
I |
|
| B0P13 (GPMI_D13) ; B0P14 (some HW revisions) |
Hold_SW |
N/A |
I |
Low: unlocked; High: unlocked |
| B3P12 (PWM2) |
LCD_TP |
N/A |
I |
Identify LCD Type (2 possibilities) |
| B3P13 (PWM3) |
BLU_ON_LCD |
N/A |
O |
Enable/set backlight, see code for description of usage |
| B1P21 (LCD_BUSY) |
Touchpad TY- |
0 |
O |
Enable touchpad |
| B3P15 (ROTARYA) |
Touchpad TX- |
1 |
O |
Enable touchpad |
| B0P26 (SSP_CMD) |
Touchpad TY+ |
1 |
O |
Enable touchpad |
| B0P25 (SSP_DETECT) |
Touchpad TX+ |
0 |
O |
Enable touchpad |
| B0P30 (SSP_DATA2) |
FM_INT (interrupt) |
N/A |
I |
Related to radio chip; RDS package arrived or stereo indication |
| B1P22 (UART2_CTS) |
MUTE_ON |
0 |
O |
Disable audio output |
| B3P16 (ROTARYB) |
DTV_DETECT |
N/A |
I/O |
USB_ID as pinout; might be related to some OTG feature ? |
| B0P28 |
FM_DETECT |
N/A |
I |
High: FM present; Low: FM absent |
| B0P24 |
NAND_TYPE |
N/A |
I |
High: MLC; Low: SLC |
| B0P27 |
NAND_TYPE |
N/A |
I |
High: CS4; Low: CS2 (CHECK! Inconsistency with loader's output!) |
| B0P31 |
TOUCH_TYPE |
N/A |
I |
High: CAP; Low: REG (?!!?) |
Touchpad device shall be enabled via the TX/TY +/- pins. See the "Default value" in the table above.
Useful Links
UART Log
Bootloader + Some system messages log during bootup
Actual implementations
I'm working on this port and things are going fine, what is implemented so far in a "playground" code to be sent to device is:
- Keypad (7 buttons)
- Backlight
- Display (both LCD types are working fine)
- Hold button
- ADC readings
- Touchpad enable
- SDRAM
Copyright © by the contributing authors.
