SanDisk Sansa m200 series (v1)

[Nagasaki_Kid]

I was wondering if the method above can be used to unbrick my sansa m240

[linuxstb]

I was wondering if the method above can be used to unbrick my sansa m240

If by "above method" you mean the first thing I did (i.e. buying a new m240), then yes, that will work...

Otherwise, no.    I'm assuming that by "bricked" you mean that the firmware (which is stored on the NAND flash) refuses to run, presumably because of something corrupted on the NAND flash.  So given that the only way I have found to run code on the m240 via "usb boot mode" (which bypasses the firmware in the NAND flash) is to physically remove the flash, then there's no way to fix its contents.

Also, there is no NAND driver written yet for the m240, so even if we could access USB boot mode with the NAND still installed, we couldn't fix it.

All this also assume you have a "v1" m240.

[Nagasaki_Kid]

Sorry to have wasted your time. I guess I'll buy a second m200 hopefully another v1 and use the flash hot swap trick on anythingbutipod.com

[LambdaCalculus]

A little teaser:



The bootloader doesn't do much at this point, except run the tick counter, display GPIO values, and run a scroll test line up top.

Everyone give linuxstb a hand for his hard work!

[rickbronson]

Hi,
  I have a m240 taken apart with the NAND removed and I ran the tcctool against it.  It found the vendor id
and device id (in boot mode) but I didn't have a binary to throw at it.  Where can I get one that would
put up the simple display show in the last post?

  Thanks much.

  Rick

[linuxstb]

You need to set up a Rockbox development environment, download the latest Rockbox source code, and compile an "M240 bootloader build".

Lots of information on doing the above can be found in the Rockbox wiki - see here:

http://www.rockbox.org/twiki/bin/view/Main/DocsIndex#For_Developers

If you have questions, the best place to ask is probably on IRC (where all the devs hang out).  Or you can ask (and read!) the "Getting Started and Compiling" forum.  We should try and keep this thread on-topic to m240 development (the process of compiling Rockbox is identical for all targets and not specific to the m240).

[rickbronson]

  Okay, sorry I posted to the wrong forum.

  I've got my m230 to run the scrolling text bootloader.  The version I have contains the Telechips Soc. The normal m200 build fails though...

  Anyway, I'm new to rockbox but have a lot of experience in ARM soc Linux development.  Seems to me the next step is working on the NAND code.  Is this just a matter of porting rockbox/firmware/target/arm/tcc780x/ata-nand-tcc780x.c to rockbox/firmware/target/arm/tcc77x/ata-nand-tcc77x.c?

  I'm wondering about the other chip on the NAND daughterboard?  Mine says "SanDIsk 20 99 00090 3 0620 573162 SOC1 China".  Is this a NAND controller chip?

[cycletronic]

I don't know if any of you are aware of the sandisk forum community, but it appears that they have some useful information.  I have not searched the rockbox forums exhaustively, so I apologize if this is a repeat.  Here's a link to a thread with photos and details of the internals of a m200 series:
http://forums.sandisk.com/sansa/board/message?board.id=m200&thread.id=1687
It looks like there is a lot of other useful information in there.
I recently purchased two of these units from woot.com for $10 a piece, so I just might jump in (depending on the hardware version I get), although I have so very little time.  Boy it would be cool to have a $10 OGG player :) I'll at least listen in.  Woot does seem to sell sandisk MP3 players quite often, so if you are interested in this project, I would recommend checking it out every so often (or subscribing to their RSS feed).

[shotofadds]

Anyway, I'm new to rockbox but have a lot of experience in ARM soc Linux development. Seems to me the next step is working on the NAND code.  Is this just a matter of porting rockbox/firmware/target/arm/tcc780x/ata-nand-tcc780x.c to rockbox/firmware/target/arm/tcc77x/ata-nand-tcc77x.c?

If the SOC communicates with the NAND directly, as we've seen on the other Telechips devices we've looked at, then yes, it should "just" be a matter of a) finishing and b) porting the 78x code. But not necessarily in that order...

The 78x code is far from complete (it's read-only, and even that is unreliable) and this is currently holding back the Cowon D2 port in a big way. Since there's no hardware NAND controller, we have to do the logical<>physical block mapping ourselves, and we don't fully understand the Telechips scheme yet.

I'm wondering about the other chip on the NAND daughterboard?  Mine says "SanDIsk 20 99 00090 3 0620 573162 SOC1 China".  Is this a NAND controller chip?

Wild speculation: iirc the Sansa E200 and C200 communicate with their NAND chips via a bridge that presents the NAND as an SD card interface - so it's not unimaginable that something similar could be used here. If that's the case, the tcc78x code won't be much use, but implementation might be considerably easier.

I'd suggest dropping in to the IRC channel and looking out for linuxstb, he's done virtually all the 77x work so far.

[saratoga]

I thought the Telechips hardware was entirely documented? 

[shotofadds]

I thought the Telechips hardware was entirely documented? 

Indeed it is, and we have no problem communicating with the hardware. The problem is that the Telechips 'flash controller' is nothing more than a direct interface to the NAND chip, meaning we have to understand and deal with the logical<>physical block translation, bad blocks, ECC and wear-levelling mechasisms ourselves, in software. No small challenge, I'm sure you'll agree.

[LambdaCalculus]

No arguments here about that.

[rickbronson]

  I tried to find out what this SanDisk chip is but I really couldn't find much.  It does seem logical that it is some kind of bridge but then you wonder why they have so many pins on the daughter board.  If it was SD -> NAND then they would only need 10 or less pins.  Hmmm.

  I spent some time looking over a disassembly of their code at

http://www.efn.org/~rick/pub/SANSM200.rom.lis

  I wrote a perl script that tries to glean memory accesses (in the 080000XXX or 0x90000XXX range) from the listing.  It's output is here:

http://www.efn.org/~rick/pub/reg.access.txt

  While this technique is not perfect, it shows is that there are no accesses to the MMC/SD controller but quite a few to the NAND registers which makes me think they are using the NAND in it's raw form.

  So I guess I'll assume that it's directly connected and proceed with trying a port mentioned before.

[shotofadds]

So I guess I'll assume that it's directly connected and proceed with trying a port mentioned before.

Sounds like a good way forward, although I'd check first whether linuxstb has already looked into this as part of his Logik DAX work.

After porting the hardware register addresses you'll need to add a section to nand_get_chip_info() containing the page size, number of blocks etc for the particular NAND chip in your player. Currently only a couple of Samsung 2GB/4GB chips used in the D2 are supported.

Assuming we get that far, you'll then need to hope that the Telechips block translation scheme didn't change between the 77x and 78x SDKs. Otherwise there might be some serious detective work to do...

(btw. I'm the author of the 78x code).

[linuxstb]

I've looked a little at the NAND code, but haven't actually started work on it.  So it would be great if someone else did it...