Fiio X5-2

[232tomas232]

Good afternoon, everyone.
My Fiio x5-2 stopped turning on. The screen does not turn on and the PC does not detect the player. Apparently something happened with the firmware, the secondary loader or the memory chip itself. The user manual for this player suggests disaster recovery via a SD card. But this way doesn't work, because there is no power at the card slot, but stabilizer, which should provide power for this slot, doesn't work.
At the input of the stabilizer there is power but no EN signal. Because of the dense layout and the many interlayer transitions I was not able to trace the source of this signal. I assumed that this signal should come from the CPU. I was able to check the functionality of the CPU by forcing the CPU to restart in the USB recovery mode, which is listed in the documentation of the CPU. I also managed to find a suitable version of the USB burning tool, which has a configuration for jz4760b, but I could not find the firmware which could be used for recovery through this program. I asked Fiio for help. But they turned me down, they think I want the source code of the firmware from them)
I don't fully understand the startup structure of the processor. If the memory chip was faulty, I would be able to run the recovery from the SD card. I don't understand at what stage of the startup the problem occurs.
Since this forum has already worked with players of this line Fiio X serias(jz4760b) perhaps you can help me in some way?
Maybe someone has already encountered this problem or can tell me how to dump the firmware from a working device?
Thank you for your feedback.

[amachronic]

I did the port of Rockbox to the Fiio M3K. They're X1000-based and it's very similar to the JZ4760(B), so fortunately I know the boot process pretty well. You should double check with the JZ4760 manual though.

• CPU starts executing the boot ROM after reset (mapped at standard MIPS reset vector).
• ROM loads the SPL from USB, flash, or SD.
• SPL is a sort of pre-bootloader responsible for initializing DRAM and loading the 2nd stage binary -- which will be either a full bootloader like U-boot or directly loading a kernel.

Normally the boot ROM decides what to boot by looking at the state of certain GPIOs. These would probably be hardwired to boot from flash, but usually there's a button you can press to enter USB boot mode. If the default boot option is unusable -- the SPL header is missing, CRC check fails, etc. -- the ROM can fall back to trying other boot modes. Normally that will be SD or USB.

I'm not sure what you mean by "running recovery from the SD card". Are you trying to run the SPL from the SD card (bypassing flash) or are you trying to run the OF recovery to reflash the firmware?

If the latter -- that will require a working SPL and firmware. Eg. on the M3K, there is a secondary Linux kernel with built-in initrd that takes care of firmware updates. If any part of that chain is broken then OF's update and recovery methods will fail.

If you are going for direct SPL boot -- the main problem with SD boot is that if the PMIC doesn't start up in a suitable configuration, the voltage regulator supplying the SD bus might not be enabled. This is a problem on the FiiO M3K for example. The boot ROM has no way to turn the regulator on; you need a working SPL to do that... which makes SD boot impossible. It sounds like this is what's happening on your player.

Seeing as you have access to USB boot mode and Ingenic's burn tool, vitt13 posted a guide to reflashing some FiiOs with the burn tool, maybe that would help you. I've never used the burn tool myself, though.

Rockbox has a usbboot tool for accessing USB boot mode (see utils/ingenic_tools) but it's not of much use unless you have a suitable SPL and 2nd stage binary. They exist for the X1000, but not for the JZ4760, since RB's JZ4760 ports piggyback off the original firmware and don't have an SPL of their own.

[232tomas232]

By running the recovery from the SD card, I meant the way that Fiio suggests.
C.Firmware update
experience; not updating to the latest firmware version will not affect the current operation of the unit.
The unit supports firmware updates through update files loaded on micro SD cards.
To check the current firmware version:
From the main menu, go to System Settings->About X5 to find out the current firmware version loaded in the X5.
the current firmware version loaded in your X5.
-The firmware update requires a micro SD card formatted in FAT32. This can be obtained
by formatting the card using the built-in format function of the X5 (System Settings->Format).
WARNING: all data and music on the card will be deleted during formatting.
-The firmware update should not affect the data on the micro SD card (except for formatting, see above).
except necessary formatting, see above). Nevertheless, please back up all important data on the memory card for protection
against accidents.
-Make sure the X5 is sufficiently charged (preferably fully charged) for the update process to
to avoid a power outage during the update process;
-Do not use any other buttons or dials on the player during the update process.
-If the update process fails, hold down the power button for 6 seconds to forcibly turn off and
If the update process failed, hold down the power button for 6 seconds to turn it off forcibly and turn it back on in update mode to resume the update.
A brief description of the firmware update procedure using a micro SD card:
1.Copy the X5II.fw file provided by FiiO to the root directory of the micro SD card in FAT32 format.
format;
2.Turn off the X5 and insert the card into slot 1 (left slot) of the micro SD card X5 (if it is not already)
not already inserted);
3.Hold down the power button while holding down the shortcut key (the upper left key of the X key group) to
X5 in firmware update mode. The following firmware update dialogs will appear
and the player will automatically reboot after the update is completed.

But this mode does not work as I described earlier. If based on your words it turns out that the firmware itself is damaged or the second level boot loader(turning on the screen, powering the SD card and all external sources). Only start recovery from usb mode (firmware) works, so it turns out that the first level boot loader works. A recovery mode from the card does not work because the second level boot loader (firmware) is faulty.
I found a rebuild tool for jz4760b processor which I think is suitable for this application. USB burning tool from ingenic. This is the program xduuo uses to flash the X10 via pc. But the problem is i don't have the right firmware version for this program. As i understand i need non-packaged firmware (kernel, system and so on). I contacted fio with this, but they don't want to help me.
I assume that the update files from fiio do not carry all of the system files (maybe there is no second level boot loader). Maybe there are some options to dump the firmware from a working device? There is also a possibility that there is a problem with the memory chip. I ordered a UART adapter to see the startup log.
I'm not dealing with reverse engineering, linux systems or terminals before. I don't know what further steps to take to solve the problem.

amachronic thank you for bringing my problem to your attention.

[amachronic]

By running the recovery from the SD card, I meant the way that Fiio suggests.

Thank you, that clarifies things.

Only start recovery from usb mode (firmware) works, so it turns out that the first level boot loader works.

Yes: this is the boot ROM, it's hardwired in the CPU and can't break.

A recovery mode from the card does not work because the second level boot loader (firmware) is faulty.

This means either the SPL (1st stage) or the main bootloader / kernel (2nd stage+) is broken. Or, your entire flash chip is broken.

I found a rebuild tool for jz4760b processor which I think is suitable for this application. USB burning tool from ingenic. This is the program xduuo uses to flash the X10 via pc. But the problem is i don't have the right firmware version for this program.

Yeah, I know about it but I have never used it. I believe vitt13 asked Fiio and got them to send the needed firmware and configuration files. You could try asking Fiio again; otherwise you may be able to assemble a config by hand if you can get a hold of the firmware files you need.

I assume that the update files from fiio do not carry all of the system files (maybe there is no second level boot loader).

This is not always true: IIRC the M3K firmware shipped with the SPL and all kernels. If you post a link to the update file I can check if they are there.

Maybe there are some options to dump the firmware from a working device?

In theory it can be done, but Rockbox has no tools for this (at least for the JZ4760). Maybe the Ingenic burn tool supports dumping the flash? I'm not sure if any open source-tools exist.

[232tomas232]

This means either the SPL (1st stage) or the main bootloader / kernel (2nd stage+) is broken. Or, your entire flash chip is broken.

The only way for me to pinpoint the exact cause of the boot failure is the uart adapter. I hope it will help me with this. I assume that the putty terminal will be enough for me to see the loading log when the player starts.

Yeah, I know about it but I have never used it. I believe vitt13 asked Fiio and got them to send the needed firmware and configuration files. You could try asking Fiio again; otherwise you may be able to assemble a config by hand if you can get a hold of the firmware files you need.

I contacted Fiio(had-fi,facebook,mailbox). Maybe my English is not good enough and they didn't understand me correctly. They thought I was asking them for the source code of the firmware and rejected me. How to make a correct request?)
What files will I need to build the configuration by myself?
Is there anything else I can do to determine the problem?
https://drive.google.com/file/d/1-eX0drMHmCNf_ModUYReSkhHerXZpEmM/view?usp=share_link

I am attaching one of the firmware files.

[vitt13]

Maybe there are some options to dump the firmware from a working device?

In theory it can be done, but Rockbox has no tools for this (at least for the JZ4760). Maybe the Ingenic burn tool supports dumping the flash? I'm not sure if any open source-tools exist.

It seems that X5II.fw is https://www.rockbox.org/wiki/FiioFirmware and as I understand that X5II.fw does not contain bootloader.
I guess AmauryPouly got NAND dump from devices. His Wiki pages have attached dumps
https://www.rockbox.org/wiki/FiioX1
https://www.rockbox.org/wiki/FiioX3Gen2
additionally https://www.rockbox.org/wiki/XDuooX3
has some description of 'recovery mode'

Recovery mode

The JZ4760 chip has a usb recovery mode documented in the datasheet. The xDuoo X3 can be put in this mode by the following procedure:

    Turn off the device
    Push the ESC/Home button
    While holding the ESC/Home button down, plug in the USB cable
    The screen will stay black and the device will then register itself as a Ingenic device: 601a:4760 Ingenic Semiconductor Ltd.

When in recovery mode, the device uses a custom protocol documented in the datasheet. There is a tool in the rockbox repository to send commands to the device.

Ingenic Windows 32 and 64-bit drivers for the device in recovery mode can be found in this archive: ftp://ftp.ingenic.cn/DevSupport/Tools/USBBurner/USBBurnTool_V1.6.0.rar. We have tools to interact with the recovery mode of the ingenic: see utils/jz4740_tools/jz4740_usbtool.c and utils/hwstub/ in our repository.

[232tomas232]

here is what uart outputs
IPL: Serial ok Time:Nov  2 2015 11:35:48


DDR INIT ERROR: can't find a suitable mask delay.

as expected, the problem with the memory chip (

[vitt13]

It seems there is IPL and SPL dumper tool for jz4760b under
/utils/hwstub/tools/lua/fiiox3ii.lua
and probably needs to change nand config for installed Fidelix fmn1sd5tbs.
But 'hwstub' has to be compiled from source code under Linux. Is it possible to make build for Windows?

[Bilgus]

Likely unless someone has gone through the source prior you would be better off using a Linux VM rather than spending time trying to compile in windows

[232tomas232]

It seems there is IPL and SPL dumper tool for jz4760b under
/utils/hwstub/tools/lua/fiiox3ii.lua
and probably needs to change nand config for installed Fidelix fmn1sd5tbs.
But 'hwstub' has to be compiled from source code under Linux. Is it possible to make build for Windows?

how do you think.  Does this error indicate a problem in the area of ​​soldering the memory chip or a problem with the markup?

[vitt13]

Edit: the installed IC Fidelix FMN1SD5TBS (FiiO X5II) has same NAND bus width (x16) as in FiiO X3II nand-related lua files.
FMN1SD5TBS-50IB SLC 1Gb x16  LPDDR1 512Mb x32
FMN1SD5SBS-50IC SLC 1Gb x16  LPDDR1 512Mb x16
FMN1SD5SBS-50IA SLC 1Gb x16  LPDDR1 512Mb x16
So it's close to https://www.rockbox.org/wiki/FiioX1 hw v2