Surfans F20 "NAND open error"

[amachronic]

I've made a new bootloader release which includes the changes in the "v7" bootloader. Now both old and new Surfans/Hifiwalker variants are supported by the same bootloader.

The new version is linked on the wiki, or download here.

[kaas]

Getting a 404 on that link.

[amachronic]

Thanks, the links are fixed now.

[Richard42]

Hello all. I just bought a Surfans F20 on amazon and a 512GB sandisk ultra card to store my whole music collection to take on trips.  The default player is okay for me except I found that whenever I jump to another song it makes 2 very loud clicks in between the songs. That's not a very good feature for a "hi-fi" music player. I contacted Surfans tech support and they suggested it is a problem with the microsd card. I tested with the 32GB card that came with the player, and what do you know it doesn't make the clicks when switching between songs. So they're going to blame my 512GB card and say it's not compatible, but I'm a computer engineer and I understand that this card is really just uncovering some latent defect in their crappy software and it's not really incompatible.

So this is how I discovered RockBox. The OEM player says that it's version number is "2.3" which is interesting because this number is not mentioned anywhere in the RockBox documentation regarding the F20. I used the RockBox Utility software and tried to do a hosted installation, but the firmware update never worked. Each time I tried, it just switched between a black screen and the Surfans logo screen a couple of times and then booted back into the OEM player. I tried with the patched UPT files from the RockBox Utility program, and also with the unpatched UPT files for the F20 v2.2, v2.5, and v2.7 firmware files linked on the rockbox wiki, and none of them worked.

So then I went the native route. I can run the boot loader with the jztool program in USB boot mode, and I can run the rockbox software directly from the bootloader, so if I could flash the boot loader I think I would be good to go.  But whenever I try to make a backup of the OEM bootloader, I get the dreaded NAND open error.  Apparently the player that I bought has yet another different flash chip. Here is the output of the debug flash_info.txt that I get from the bootloader tool:

readID opcode  = FF E5 71 E5
readID address = E5 71 E5 71
readID dummy   = E5 71 E5 71
sfc params0  = 06 05 04 03
sfc params1  = 02 55 AA 55
sfc params2  = 00 44 02 02
sfc params3  = A4 2F 00 00

I tried the flash_onfi_info as well but that failed.  Can somebody help me get this working?

[amachronic]

That's supposedly a Dosilicon DS35x1GAxxx. Test bootloader with support for it available here:
https://drive.google.com/drive/folders/1lxDGJD1XobsJtSd8Ajnh4MT8tXAJ8lpW

Try ONFI info & bootloader backup and post them here, I can sanity check them. If you're confident that it's working you can go ahead and do an install, but I'd advise taking a full flash dump beforehand (and make sure it looks reasonable...) in case things go wrong.

EDIT: I updated the wiki with some info on what the flash contents should look like. Should be helpful if you're inclined to check the dumps yourself.

[Richard42]

That is awesome, thank you very much.  It worked, I was able to get the flash dump (attached), and the flash_onfi_info:

signature = 03040506
revision = 5502
manufacturer = ""
device model = ""
JEDEC mf. id = 00
data bytes per page = 0
spare bytes per page = 0
pages per block = 0
blocks per lun = 0
number of luns = 0
bits per cell = 0
max bad blocks = 0
block endurance = 0
programs per page = 0
page program time = 0
block erase time = 0
page read time = 0

The dumped ROM looks reasonable to me.  From your description on the wiki, the SPL header looks good.  The partition table looks different from your example but it doesn't appear corrupted. I ought to be more familiar than I am with MIPS assembly language, as I've been working on this N64 emulator for many years (though not recently).  The reverse engineering that you and other RockBox devs have done with these little music players is really impressive.

Let me know if you agree that the dump looks good and I'll attempt to flash it with the boot room you gave above.

[amachronic]

Looks good to me. Should be safe to flash that bootloader.

The ONFI dump didn't work but that's not a problem - it has no use except debugging.

The partition table looks like an expanded version that includes a list of supported flash chips. Maybe it's worth tracking them down and adding support ahead of time.

[Richard42]

Alright, I flashed the boot loader and it works! Thanks; you saved me from returning this player to Amazon. The RockBox player has no problems with the 512GB card and boots faster. This is a very cool project.

[kaas]

Some bad news and some good: had to go back from the native port to the hosted because the native was unstable (it would regularly stop playing, display "unkwn artist" "unkwn track" instead of the correct file, and I think also corrupt files on the SD card (at least, after it had crashed on a file it would then likely crash again on that same file)). I was otherwise happy with the native port because it didn't have the issue I have with the hosted port, where loading the file browser for the first time after boot takes about 10 seconds (I think this is related to using a 80% full 512gb sd card).
So I did a clean install of the hosted port with the latest 2.7 pre-patched image from the wiki, and now line out works! Many thanks to all who worked on supporting the v2.7 players.

[Octso]

Hey there, new owner of a Surfans F20 (fw 2.7). I am having the same issues that have been described here by other users previously, where I can't backup the bootloader during the native port install. Host port has been working fine, but I'd want to give the native port a go due to some issues in the host port with lastfm scrobbler and panic modes.

I am unable to create a flash_onfi_info dump, but the contents of flash_info are the following in case they can be of any help

Code: [Select]

readID opcode  = FF C9 51 C8
readID address = C8 51 C8 51
readID dummy   = C8 51 C8 51
sfc params0  = 06 05 04 03
sfc params1  = 02 55 AA 55
sfc params2  = 00 2B 02 02
sfc params3  = B4 2F 00 00

I was wondering if this is another instance of a device with a different chip. I have tried the bootloader in the wiki and all (if not most) of the bootloaders shared in this thread and I always get the NAND error during the bootloader backup...

Anyone got any pointers for how to get this working?

[amachronic]

It's a new NAND device (GD5F1GQ5xExx). It's nearly identical to the GD5F1GQ4xExx which is already supported. Try this bootloader, you should be able to get a backup with it. Either check the backup with hexdump yourself, or post it here and I'll check it, just to make sure it looks sane before you go doing any destructive operations.

bootloader-erosq-GD5F1GQ5xExx.zip

[Octso]

It's a new NAND device (GD5F1GQ5xExx). It's nearly identical to the GD5F1GQ4xExx which is already supported. Try this bootloader, you should be able to get a backup with it. Either check the backup with hexdump yourself, or post it here and I'll check it, just to make sure it looks sane before you go doing any destructive operations.

bootloader-erosq-GD5F1GQ5xExx.zip

Thank you for answering so swiftly!

I am now able to make the backup and get the flash_onfi_info dump, which looks identical to one in the previous page of this thread

Code: [Select]

signature = FFFFFFFF
revision = FFFF
manufacturer = "ÿÿÿÿÿÿÿÿÿÿÿÿ"
device model = "ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ"
JEDEC mf. id = FF
data bytes per page = 4294967295
spare bytes per page = 65535
pages per block = 4294967295
blocks per lun = 4294967295
number of luns = 255
bits per cell = 255
max bad blocks = 65535
block endurance = 65535
programs per page = 255
page program time = 65535
block erase time = 65535
page read time = 65535

I have checked the .bin hexdump and it does resemble what is mentioned in the Ingenic X1000 wiki, but if you could double check just to be sure, that would be amazing

[amachronic]

It looks good to me, you should be safe to flash the Rockbox bootloader.

[mxl]

Hey! Looks like I've got yet another different flash chip. Would someone be willing to help me?

Info: Surfans F20, firmware version 2.7. Using the provided bootloader (version 221029) with jztool succeeds but the flash is unreadable ("NAND open error"). Running RockBox without flashing the bootloader works fine.

Here's the flash_info.txt:

Code: [Select]

readID opcode  = FF C8 51 C8
readID address = C8 51 C8 51
readID dummy   = C8 51 C8 51
sfc params0  = 06 05 04 03
sfc params1  = 02 55 AA 55
sfc params2  = 00 2B 02 02
sfc params3  = B4 2F 00 00
This looks nearly identical to the result from #54 except for the second byte in "readID opcode" so I went ahead and tried the GD5F1GQ5xExx bootloader. Indeed I can get the flash_onfi_info.txt from that:

Code: [Select]

signature = FFFFFFFF
revision = FFFF
manufacturer = "ÿÿÿÿÿÿÿÿÿÿÿÿ"
device model = "ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ"
JEDEC mf. id = FF
data bytes per page = 4294967295
spare bytes per page = 65535
pages per block = 4294967295
blocks per lun = 4294967295
number of luns = 255
bits per cell = 255
max bad blocks = 65535
block endurance = 65535
programs per page = 255
page program time = 65535
block erase time = 65535
page read time = 65535
And a dump of the bootloader is uploaded here: https://drive.google.com/file/d/1SJYx_1-k-rohSZB975wPYFB99gObhx-B/view?usp=sharing , does it look reasonable?

[amachronic]

And a dump of the bootloader is uploaded here: https://drive.google.com/file/d/1SJYx_1-k-rohSZB975wPYFB99gObhx-B/view?usp=sharing , does it look reasonable?

Yep, it seems ok.