Skip to content

01-hardware.md

Latest commit

 

History

History
116 lines (88 loc) · 9.42 KB

01-hardware.md

File metadata and controls

116 lines (88 loc) · 9.42 KB
Raw

Hardware

What's actually inside the Sony HAP-Z1ES / HAP-S1 chassis.

Main application SoC

NXP / Freescale i.MX6 Dual @ 1 GHz — dual ARM Cortex-A9 with NEON.

  • Part number on the board: IC101 = MCIMX6D5EYM10AC (per Sony service manual, schematic legend).
  • This is the chip that runs the Linux 3.0.35 kernel, the lighttpd HTTP server, the Python control daemon, and the Samba file server.
  • The Freescale i.MX6 family was the standard high-end embedded ARM platform circa 2013–2015 — common in industrial control, in-vehicle infotainment, and high-end set-top boxes.

There is a secondary housekeeping microcontroller on the U-COM board:

  • IC7002 = MB9AF156NPMC-G-JNE2 (Cypress / Spansion / Fujitsu, ARM Cortex-M3).
  • Drives the front panel buttons, the IR receiver, the rotary encoder, the standby power management.
  • Does not run Linux. Communicates with the i.MX6 over an internal serial link.

Audio pipeline

This is the part Sony invested in. The Linux SoC does not touch the audio sample stream after it leaves I²S — everything from there is dedicated silicon.

                                        I²S
   ┌───────────────┐    audio data     ┌───────────────────┐
   │  i.MX6 (Linux │ ──────────────────▶│  Sony FPGA        │
   │  + GStreamer  │                   │  (closed bitstream│
   │  + forza_snd) │                   │   — IC001)        │
   └───────────────┘                   └────────┬──────────┘
                                                │
                                                ▼
                                     ┌────────────────────┐
                                     │  Analog Devices    │
                                     │  SHARC DSP (IC601) │
                                     └────────┬───────────┘
                                              │
                                              ▼
                            ┌─────────────────┴─────────────────┐
                            │                                   │
                            ▼                                   ▼
                ┌────────────────────┐              ┌────────────────────┐
                │  PCM1795 (L mono)  │              │  PCM1795 (R mono)  │
                │  (Burr-Brown / TI) │              │  (Burr-Brown / TI) │
                └─────────┬──────────┘              └─────────┬──────────┘
                          │                                   │
                          ▼                                   ▼
                  ┌──────────────┐                    ┌──────────────┐
                  │ Analog L out │                    │ Analog R out │
                  └──────────────┘                    └──────────────┘
  • FPGA: an Altera part (confirmed from the Forza driver's PCI id 0x1172:0xE001), referenced in the service manual as Altera EP4CGX30 (Cyclone IV GX). It sits on the i.MX6's PCI Express bus — the SoC DMA's audio into the FPGA's FIFO — and owns the master clock domain feeding the DSPs + DACs. See the full decoded pipeline in 11-audio-path.md.
  • DSP: two DSPs, confirmed 2026-06-02 from the GPL forza_snd_driver source file names:
    • Analog Devices ADSP-21488 SHARC (adsp_21488.c) — the main audio DSP (DSEE-HX / DSD remastering likely run here).
    • Cirrus Logic CS48L10 (cdsp_cs48l10.c) — a second/"cdsp" audio DSP.
  • DACs: 2× Burr-Brown / TI PCM1795 in mono mode — one per channel. The PCM1795 is a stereo DAC; running it in mono is a luxury that improves channel separation and pushes the noise floor down.

Ethernet

  • PHY: Atheros AR8035 (10/100/1000 Mbps).
  • Two MAC addresses on the device: one for Ethernet, one for Wi-Fi. The UPnP UUID is derived from the Wi-Fi MAC.

Storage

  • Internal: 1 TB 2.5" SATA HDD (factory). Holds only data — the music library (/mnt/internal) and the SQLite metadata catalog (/data). Not the rootfs (confirmed by direct disk read 2026-06-02; see 09-disk-layout.md).
  • Maximum supported internal: 2 TB (MBR limit on Sony's firmware).
  • External: USB drives up to 4 TB — our reference HAP-Z1ES on firmware 19404R plays from storage:usb1 daily, confirmed working.
  • The OS lives on on-board flash, not the HDD (derived from the GPL linux-3.0.35 kernel config, 2026-06-03; live cat /proc/mtd will confirm offsets):
    • U-Boot + kernel on an SPI-NOR M25P32 (4 MB) (SPI0/CS1), partitioned bootloader (256 KB) + kernel.
    • rootfs on NAND (Freescale GPMI controller) — it is /dev/mtdblock2, a writable JFFS2 (root=/dev/mtdblock2 rootfstype=jffs2).
    • This is why HDD swaps don't brick the bootloader, and why factory-reset works regardless of disk state. See 06-hdd-swap.md and 10-uart-console.md.

Front panel

  • Color LCD driven by DirectFB 1.4.17 (no X11, no Wayland, direct framebuffer).
  • Rotary encoder + 6 hardware buttons (POWER, HOME, BACK, OPTIONS, MENU/PLAY, and the encoder click) handled by the U-COM Cortex-M3.
  • IR receiver for the supplied RM-ANU183 remote.

Power

  • Linear power supply with separate transformers for the analog and digital sections (HAP-Z1ES — true dual mono).
  • HAP-S1 adds an integrated amplifier: 2× LM3876 chipamps + NJW1194 electronic volume.
  • HAP-S1 headphone amp is reportedly a 400 Ω resistor on the speaker output — confirmed by Amir Majidimehr (Audio Science Review, HAP-S1 measurements thread, Feb 2019). One of the few cost-cutting decisions visible in the product.

Debug interfaces

Per the HAP-S1 service manual (manuals/sony-service-manual-hap-s1.pdf, same architecture as HAP-Z1ES):

  • JTAG: TDO, TMS, TDI, TCK pins on IC101 — present in the IC101 pin table but marked "Not used".
  • UART console: identified 2026-06-03 from the IC101 pin-function table (service manual p75–79). The Linux/U-Boot console is the i.MX6 UART1 (ttymxc0 @ 115200 8N1):
    • ball M1 = CSI0_DAT10 = console TX ("Transmit data output terminal")
    • ball M3 = CSI0_DAT11 = console RX ("Receive data input terminal")
    • (Separately, CSI0_DAT12/13 is the UART to the U-COM Cortex-M3, and CSI0_DAT14/15 to the remote-commander learning block — not the console.)
    • Boot-mode straps are hardwired for NAND boot (EIM_A18/20/21/23, EIM_RW, EIM_EB1, EIM_DA3/5/6/7). Full procedure: 10-uart-console.md.
  • SYS/MPU PROG: programming header for the U-COM Cortex-M3 (housekeeping MCU, not the application SoC).
  • SYS/JIG: factory test jig connector.

Still unprobed on real hardware: the physical test-point location on the MAIN PWB (p40) and the actual boot-log/U-Boot behaviour. The SoC-side console pins are now known (above); the remaining work is tracing CSI0_DAT10/11 to their board test points and doing the live probe — the highest-leverage hardware step remaining.

Service manual references

All four primary technical documents are preserved in manuals/ for durability:

Live mirrors for the service manuals (in case you want to grab a fresh copy from upstream): ManualsLib HAP-Z1ES, ManualsLib HAP-S1, Elektrotanya HAP-Z1ES, Elektrotanya HAP-S1. Both anti-bot, manual browser download only.

Relevant pages:

  • Block diagram: early pages of each manual.
  • Board IDs and IC list: schematic section.
  • Disassembly: dedicated section.
  • DIAG mode entry: page 25 of the HAP-S1 manual (see 05-diag-modes.md for the verified sequence).