Creative Zen X-Fi2
Overview
This is the page for the Creative Zen X-Fi2 device.
Hardware
The Creative Zen X-Fi2 features a resistive touch screen with 3 hardware buttons: power, select and reset. The following chips can be found on the PCB:
- STMP3780 (see SigmaTelSTMP3xxx), see the SansaFuzePlus page for more information (it's the same SoC, also called i.MX 233)
- one or more Hynix
H27UCG8UDMYR? flash chips (see Hynix part decoder)
- one STFM1000 fm tuner chip, there is no available datasheet due to a patent but the freescale i.MX linux source code has a driver for it (search for stfm1000 linux on google). The product brief can be found on Freescale website
- one Hynix
H5M851620FA? 64Mb Mobile DDR (see Hynix part decoder)
- the LCD controller seems to be (or be compatible with) the Renesas R61509 for which the datasheet is available here
- a very hard to read chip marked 263 7x60, which is probably a Freescale MMA7660FC? 3-Axis Accelerometer, the datasheet can be found here
Variants
It seems from the OF analysis that there are two variants of the hardware. One would use raw NAND as internal storage and the other would use SD/eMMC. This is still to be confirmed.
PCB Scans

Pins
Here is a list of all the pins used by the OF. Pins are of form BxPyy where x is the bank and yy the number within the bank. Direction only applies to GPIO.
| Pin | Dir | Comment |
|---|
| B0P10 | IN | Acceleretor INT line |
| B0P11 | IN | Power button (active low) |
| B0P12 | OUT | Unknown use |
| B0P14 | IN | Select button (active low) |
| B0P{30,31} | | I2C lines |
| B1P{00-17} | lcd_d{0-17} | |
| B1P18 | lcd_reset | |
| B1P19 | lcd_rs | |
| B1P20 | lcd_wr | |
| B1P21 | lcd_cs | |
| B1P22 | lcd_dotclk | unused? |
| B1P23 | lcd_enable | |
| B1P24 | lcd_vsync | unused? |
| B1P25 | lcd_vsync | unused? |
| B1P26 | IN | Unknown use, seems to be related to USB charging |
| B1P29 | OUT | SD Power / Chip enable |
| B1P30 | pwm2 | Backlight |
| B2P00 | ssp1_cmd | |
| B2P01 | ssp1_det | SD detect |
| B2P0{2-5} | ssp1_d{0-3} | |
| B2P06 | ssp1_sck | |
| B2P07 | IN | Jack detection |
Vendor-Specific SCSI
When See plugged in UMS mode, the Creative Zen X-Fi2 support a number of vendor-specific SCSI commands used to identify and upgrade it. The following table summarizes those command. Some might apply to other devices of the Creative ZEN family. SigmaTelScsi
The CDB (Command Data Block) always start with 0xC0 for read transfers and 0xC1 for write transfers. The second byte of the CDB is the actual command and the third byte is the type (when it applies).
| Command | RW | Cmd | Type | Extra | Comment |
|---|
| GET PROTOCOL VERSION | C0 | 00 | 00 | | Returns the protocol versions as 2 bytes: first is major, second is minor |
| GET LOGICAL MEDIA INFO | C0 | 02 | 09 | | Returns on byte: either 0 or 1 with unknown meaning |
| GET LOGICAL TABLE | C0 | 05 | XX | | Returns 2+XX*11 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 00 | Has extra byte in CDB[3]. Returns 4 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 01 | Has extra byte in CDB[3]. Returns 4 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 02 | Has extra byte in CDB[3]. Returns 8 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 03 | Has extra byte in CDB[3]. Returns 4 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 04 | Has extra byte in CDB[3]. Returns 8 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 05 | Has extra byte in CDB[3]. Returns 4 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 06 | Has extra byte in CDB[3]. Returns 1 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 07 | Has extra byte in CDB[3]. Returns 52 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 08 | Has extra byte in CDB[3]. Returns 52 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 09 | Has extra byte in CDB[3]. Returns 1 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 0A | Has extra byte in CDB[3]. Returns 2 bytes |
| GET LOGICAL DRIVER INFO | C0 | 12 | XX | 0B | Has extra byte in CDB[3]. Returns any number of bytes |
| GET CHIP MAJOR REV ID | C0 | 30 | 00 | | Returns two bytes. |
| GET CHIP SERIAL NUMBER | C0 | 32 | 00 | | Returns two bytes (length ?) |
| GET CHIP SERIAL NUMBER | C0 | 32 | 01 | | Returns actual serial number ? |
| GET ROM REV ID | C0 | 37 | 00 | | Returns the rom revision as 2 bytes |
| GET DEVICE INFO | C0 | 45 | 00 | | Returns four bytes |
| GET DEVICE INFO | C0 | 45 | 01 | | Returns four bytes |
| CHIP RESET | C1 | 31 | 00 | | Reset the device |
| ERASE LOGICAL MEDIA | C1 | 07 | XX | | Erase a logical media XX |
| ERASE LOGICAL DRIVE | C1 | 2F | XX | | Erase a logical drive XX |
| RESET TO RECOVERY | C1 | 42 | 00 | | Reset to recovery mode |
| RESET TO UPDATER | C1 | 44 | XX | YY ZZ UU | Reset to updater. |
-- AmauryPouly - 08 Dec 2011
Copyright © by the contributing authors.