Fiio X3 Gen2

---

Overview

This is the page for the Fiio X3 gen2 port. This player shares some similarity with the FiioX1. For the first generation of this player, refer to FiioX3.

Port Status

See FiioX3Gen2Port

Main Features

• Capacities: 128M internal Flash
• TFT screen (320 x 240, 30 FPS) LCD screen
• Headphone output
• Lineout/spdif output
• 24-bit/192KHz DAC + amplifier
• Hi-speed micro-USB 2.0 port
• Expandable microSD card slot and microSDHC card slot

Recovery mode

The JZ4760 chip has a usb recovery mode documented in the datasheet. The Fiio X1 can be put in this mode by the following procedure:

• Turn off the device
• Push the select button
• While holding the select button down, plug in the USB cable
• The screen will stay black and the device will then register itself as a Ingenic device: 601a:470 Ingenic Semiconductor Ltd.

When in recovery mode, the device uses a custom protocol documented in the datasheet. There is a tool in the rockbox repository to send commands to the device.

Boot Procedure

On boot, the cpu will either enter recovery mode or boot from the NAND. When booting from NAND, the CPU will load 8KB of code to the cache and execute them (see bootloader_stage1.bin attached to this page). This first bootloader (IPL) initializes the RAM and loads a secondary bootloader (SPL) at 0x80600000. The SPL is at offset 0x400 (in pages, or 2MiB in bytes). The SPL initializes the LCD and displays an animation while loading the main firmware. Early analysis of the SPL suggest it can flash the firmware from SD even if the main firmware is dead, by holding the shortcut button (top left) when booting, so the device can be easily unbricked (in theory). The bootloader also has a "factory" boot where a file called x3ii.bin is loaded from the SD card and executed.

Factory boot

By holding the upper left button of the X keygroup, the device will enter recovery mode and check for x3ii.bin. If this file exists, it will load it to memory, unscramble it (using the same scrambling algorithm as for FiioFirmware sys.bin) and run it at address 0x80001000.

Upgrade procedure

By holding the upper left button of the X keygroup, the device will enter recovery mode and check for x3ii.fw to perform an upgrade. The file must use the FiioFirmware format. The exact way the upgrade procedure works is unclear.

Flash format

The first 2MB are reserved for the IPL, containing many copies of it, as described in the datasheet. The SPL is at 2MiB and of size 1MiB. More investigation are needed to understand the structure of the flash file system and how does it compare to the upgrade file.

Firmware Files

See FiioFirmware for an analysis of the Fiio firmware format.

Components

• Ingenic JZ4760B: basically a JZ4760 with a few modifications. See IngenicJz47xx
• unknown LCD
• Cirrus Logic CS4398: DAC 24-bit/292kHz
• 2x Hynix H5PS1G63EFR: 1Gb DDR2 gives 256MB RAM
• OPA1642: pre-amplifier
• OPA1642+LMH6643: headphone amplifier
• NJW1194: volume/tone control
• AXP192: PMU
• SA2000: dual crystal oscillator
• HFD4/5-S1: relay

PCB Scans

-- AmauryPouly - 15 Apr 2016