Sansa Fuze+

---

Overview

This is the page for the Sansa Fuze+ rockbox port

Port Status

See SansaFuzePlusPort

Main Features

• Capacities: 4GB, 8GB, 16GB
• 2.4" bright QVGA screen (320 x 240, 30 FPS) LCD screen
• Handle Audio, Video and Photo
• Digital FM Tuner with pause and record functions
• Hi-speed micro-USB 2.0 port
• Expandable microSD card slot and microSDHC card slot

Firmware & Upgrade

There are two upgrade methods:

• Rockbox Utility (not availlable yet) will ask you to provide an original firmware from Sansa's forum. You may go to the manual download method to obtain this file.

• Windows people can download and install Sansa Firmware Updater (available here). It checks for a new firmware version, downloads and will then install it on your player if mounted.

• You may also manually download the firmware (available here) if you don't do Microsoft. Unzip the file and copy the firmware file to the root of the player, unmount it and then unplug the player to launch the upgrade process

• The format used by the firmware is sb file format (SbFileFormat).

• Some information about the firmware can be found on a dedicated wiki page (SansaFuzePlusFirmware)

Recovery mode

The i.MX233 chip has a usb recovery mode partly documented in the datasheet. The Fuze+ can be put in this mode by the following procedure: * Turn off the device * Push the volume up button * While holding the volume up button down, plug in the USB cable * The screen will stay black and the device will then register itself as a HID device: 066f:3780 (Sigmatel, Inc.) ROM Recovery

When in recovery mode, the device uses the BLTC protocol for which we do not have documentation. However the imx_hid_recovery tool is in the SVN is capable of uploading a firmware file in the SbFileFormat based on some reverse-engineering we did.

PCB Scans

Components

• Flash memory: SanDisk SDIN4C2?-16G. This is a SanDisk iNAND eMMC I/F 4.3 with extended features. It is a standard eMMC flash although a datasheet for this precise chip (or for the 4.41 version of it) can be found on Google.
• Ram Memory: EDD51163DBH?-6ELS-F - 512M bits DDR Mobile RAM¢â WTR (Wide Temperature Range), Low Power Function - Elpida Memory. Datasheet here
• The square chip marked 319 is an Si4703 rev C with firmware revision 19. Rockbox already has a driver for this tuner.
• ATMLH020/64C is the Atmel 2-wire serial EEPROM type AT24C64C? (8 kByte)
• The OF has support for two kinds of LCD controllers. The LCDs should report ID code 9325 or 7783. The 9325 could match the ili9325 from ilitek and the 7783 could match st7783 from sitronix. The former has a datasheet available on the web and the second has a datasheet for st7781 which should be pretty close.

• It uses the A4 revision of the STMP3780 family, not the A5 revision, which basically has an updated ROM that fixes some microSD issues and slow boot times. See: here. It is possible that there are Fuze+'s out there using the new revision, however it shouldn't make a difference to the ability to port Rockbox.
• It looks like this Development Board uses a rebranded STMP378x chip. See here
• The Atmel AT24C64C (see here) I2C EEPROM contains a bootloader, because it matches the requirements (address 0xA0) for the I2C boot mode mentioned in the i.MX233 document. I dumped its content and its mostly a stub except that it changes the boot mode to SSP2 (which is the internal eMMC).
• The Touchpad is sourced from Synaptics. These documents may help: http://www.synaptics.com/developers/archive. The code actually suggests that it uses the RMI protocol, of which the manual can be find here: http://www.synaptics.com/developers/manuals

Pins

Here is a list of all the pins used by the OF. Pins are of form BxPyy where x is the bank and yy the number within the bank. Direction only applies to GPIO.

Pin	Use/GPIO Dir	Comment
B0P0{0-7}	ssp2_d{0-7}
B0P08	OUT	SD Power / Chip Enable
B0P09	OUT	Set on power off. Needed to do a "clean" power down. Exact use unknown.
B0P10	IN	Used by the OF to monitor SD change between boots. OF refers to it as "SD_CHANGE". Hardware sets this to one on SD removal. Cleared by a clean power down.
B0P20	ssp2_cmd
B0P24	ssp2_sck
B0P26	OUT	Touchpad Power
B0P27	IN	Touchpad ATTN line
B0P29	OUT	Tuner Power
B0P{30,31}		Touchpad I2C lines
B1P{00-17}	lcd_d{0-17}
B1P18	lcd_reset
B1P19	lcd_rs
B1P20	lcd_wr
B1P21	lcd_cs
B1P22	IN/OUT	Tuner I2C SCL
B1P23	lcd_enable
B1P24	IN/OUT	Tuner I2C SDA
B1P25	lcd_vsync	unused?
B1P{26,27}	duart_{rx,tx}	Debug uart pins
B1P28	OUT	Backlight control line
B1P29	OUT	eMMC Power / Chip Enable
B1P30	IN	Volume down button
B2P00	ssp1_cmd
B2P01	ssp1_det	SD detect
B2P0{2-5}	ssp1_d{0-3}
B2P06	ssp1_sck
B2P27	IN	tuner GPIO2 (SCT/RDS)

Mysteries

Here is a list of unsolved mysteries about the Fuze+

Touchpad crazyness

Sometimes the touchpad will go crazy and report wrong or false touches. The only way to recover is to shutdown and reboot. There is a way to reset the touchpad but without a way to detect that the touchpad is mad, this is useless.

Backlight flickering

Sometimes the backlight will flicker on every touchpad touch or just randomly. Experiments suggest that it happen when VDDIO is wrong set to 3V instead of 3.3V. The situation is further confusing because then VDDIO is configured for 3.3V but the LRADC reports 3V meaning that the hardware somehow doesn't keep manage to keep the good voltage.

Unknown ADC Channel

The Fuze+ OF monitors the LRADC channel 2 but the code is so intricate that I'm unable to determine its use. The code suggests that it is resistor divided from VDDIO. However, experiments haven't shown any value different from VDDIO yet, making it unlikely that it charging currennt, temprature or anything physical. The channel readout can be found in the debug menu, under the third screen of HW info.

Malfunctioning internal storage

Some Fuze+ suffered from what looks like a hardware failure of the internal storage. Two situations have been encountered:

• dead storage: the device won't boot except in recovery mode
• read-only storage: the device will boot but all writes to the storage will be ignored (although reported as successfull)

It is not clear if it is related to Rockbox or not since some users suffered from it using the OF only.

lsusb

Here are the result of both lsusb -t and lsusb -v commands:

• lsusb -v

Bus 001 Device 006: ID 0781:74e0 SanDisk Corp. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x74e0 
  bcdDevice            0.01
  iManufacturer           1 SanDisk
  iProduct                2 Sansa Fuze+
  iSerial                 5 0000000100001C150002DCDF27F55C15
  bNumConfigurations      2
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           39
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          3 USB/MSC LCD Player
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              4 USB/MSC LCD Player
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval              16
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           39
    bNumInterfaces          1
    bConfigurationValue     2
    iConfiguration          3 USB/MSC LCD Player
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              4 USB/MSC LCD Player
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval              16
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      2
Device Status:     0x0000
  (Bus Powered)

• lsusb -t

lsusb -t -d 0781:74e0
Bus#  5
`-Dev#   1 Vendor 0x1d6b Product 0x0001
Bus#  4
`-Dev#   1 Vendor 0x1d6b Product 0x0001
Bus#  3
`-Dev#   1 Vendor 0x1d6b Product 0x0001
Bus#  2
`-Dev#   1 Vendor 0x1d6b Product 0x0001
  `-Dev#   4 Vendor 0x1532 Product 0x000c
Bus#  1
`-Dev#   1 Vendor 0x1d6b Product 0x0002
  `-Dev#   6 Vendor 0x0781 Product 0x74e0