SanDisk Sansa m200 series (v1)

[shotofadds]

I've now got a 512Mb M230 in the post (hopefully it's a v1), in the hope that working out the NAND translation scheme might be easier/quicker with only 1/8th of the data to wade around in compared to the 4Gb D2.

But, in order to do this I need a way to run tcctool with the NAND attached. Any bright ideas?

[skaos]

Is this any help:
http://forums.sandisk.com/sansa/board/message?board.id=m200&thread.id=1501
http://anythingbutipod.com/forum/showthread.php?t=20366

[shotofadds]

Well, those threads seem to suggest the daughterboard can be "hotswapped" without damaging the player, but that seems rather risky to me!

If that really is the case (and if there really is no other way to enter USB-boot mode) then I suppose it could be an avenue to explore. Eg. boot using tcctool with the NAND unplugged, loop for a while until the NAND board is plugged in, etc.

It'd be quite far from an ideal development environment, of course...

[rickbronson]

For what it's worth, I"ve "hot swapped" the NAND daughter board at least a 100 times and it still works.  You actually don't have to fully engage the connector to get it to work, just apply some pressure (squeeze the two boards together) gently.  Because snapping it totally on and off is a pain.

  I tried porting tcc780x to tcc77x and the correspoinding NAND file but I don't seem to be able to get the NAND id's from the chip.  Looking at the disassembled code I thought the chip enables might be on GPIOE bits 0x30 so I tried those in all 4 states but still nothing.  I've been thinking of alternatives...

  Why can't I load SANSM200.rom with tcctool?  It seems like it should work but I don't get anything.

  If I use the crc code routine snippit in TCC77X.pdf on  SANSM200.rom I don't get the correct CRC at offset 0x10.  Any ideas on this?

  Is it true that if I put SANSM200.rom in the root partition it will perform an upgrade?  I tried this and when I booted it with a half dead battery it said "Cannot perform upgrade with dead battery" and proceeded to delete the file.  I'm thinking of trying this on a fresh battery and a modified SANSM200.rom.

  One last thought - anyone know anything about a serial port (UART) output available?

[skaos]

Serial port - does datasheets for tcc760 and tcc780 help:
http://files.myopera.com/ch%D0%B5t/files/1TCC76xRev0[1].05.rar 
http://www.telechips.com/kor/inc/download3.asp?file_gbn=D&board_id=122&file_url=/webupload/data_board&file_name=TCC780_DataSheet_r0.09.pdf

[shotofadds]

Wild speculation: iirc the Sansa E200 and C200 communicate with their NAND chips via a bridge that presents the NAND as an SD card interface - so it's not unimaginable that something similar could be used here. If that's the case, the tcc78x code won't be much use, but implementation might be considerably easier.

Well, my M230 arrived today and it is indeed a Telechips version. That's where the good news ends, from my point of view at least. It has "Revision 3.0 (HARP)" marked on the circuit board, and has the same SanDisk controller chip on the daughterboard that you saw.

I have a strong suspicion that this is a TriFlash interface, as seen on the E200/C200. That would explain why you can't read the NAND chip id...

[LambdaCalculus]

TriFlash? Hmmm...

shotofadds, what would happen if (and I know it may not work, but it's worth a shot) we tried using code from the e200/c200 for reading the flash on the m200?

I know it's probably not going to work and sounds completely wrong, but it's just an idea.

[shotofadds]

shotofadds, what would happen if (and I know it may not work, but it's worth a shot) we tried using code from the e200/c200 for reading the flash on the m200?

That would be much closer than trying to port the 78x NAND code. AIUI it's essentially an SD card interface. And preglow is working on a Telechips SD driver...

But still, there goes my plan of using this device to give me some clues about the Telechips NAND translation scheme (to help out with the D2 port). Unless someone wants to swap a "Revision 2.0 (NAND)" for my revision 3.0?

[LambdaCalculus]

Where's the revision marking located on the m200 mainboard?

Also, the flash chip on my m240 has the following markings on it:

SAMSUNG 546
K9K8G08UOM
            PC80

The OF is v2.2.5A.

EDIT: Mine is a Revision 1.0 (SLC) mainboard.

EDIT 2: Oops, must've accidentally damaged something on the LCD, because now there are a couple of columns of dead pixels appearing on the screen.

EDIT 3: If it catches anyone's interest, I'm attaching the CONFIG.TCC file from my m240. Opening it up in Notepad2 reveals a TELECHIPS.DAT string, then quite a few blocks like "NUL", "ETX", "FF", and more. Wonder if anything's hidden in it?

[shotofadds]

Does it say NAND in big letters above it, like here: http://forums.sandisk.com/sansa/board/message?board.id=m200&thread.id=1687 ?

Mine says HARP there instead...

I reckon the revision 1/2 hardware accesses the NAND directly, and rev.3 goes through this bridge chip. Does yours have an extra SanDisk branded chip on the daughterboard?

I guess we'd need several M200 ports based on hardware revision: v1/2 (NAND), v3 (HARP), v4 (AMS SoC).

Unfortunately the only reason I bought this was to look at the NAND, but I have the wrong hardware revision.

[LambdaCalculus]

No, mine doesn't say anything above the revision.

Also, there's no extra chip on the daughterboard; only the Samsung chip is there.

So it looks like I have one that does indeed access the NAND directly.

[rickbronson]

  Oops, on a previous post I mentioned that there were no accesses of the SD/MMC addresses in the disassembled SANSM200.rom.  Well, I had the wrong version of SANSM200.rom! Once I got the 3.2.8A version here:

http://mp3support.sandisk.com/sansa/Firmware/M200/3/A/SansaM200A3_2_8.txt

  and disassembled it, it does indeed access the SD/MMC range (eg 0x90000104).  Oddly enough it still accesses the NAND registers (like 0x90000050).  So I think earlier statements about the extra chip on the daughter board being a SD/NAND bridge are probably correct.  I wonder if this chip could be:

http://www.sandisk.com/Assets/File/OEM/Manuals/ProdManiNANDAbr1.1.pdf

  Some of the above may explain why people have bricked their units by forcing to a wrong version of software as reported on anythingbutipod.

  I did spend some time looking for a serial port by toggling the serial TX pins in the bootloader and then probing for a certain HZ signal on various pads on the board but no luck.


  Rick

[scorche]

I have been looking at the porting effort as well and recently purchased 3 m240s on woot as they were cheap enough and so I will have some to pass out at DCE if anyone wants them.  I ended up with 1 v2 and 2 v1s.

I opened them up to see if I had one to trade with shotofadds as these devices are for others anyway, but sadly it seems that both of my v1s are HARP as well. 

[shotofadds]

I opened them up to see if I had one to trade with shotofadds as these devices are for others anyway, but sadly it seems that both of my v1s are HARP as well. 

HARP isn't necessarily a bad thing (in fact, if it really is an SD interface as per E200/C200 it potentially makes an M200 port much easier). But it doesn't help me figure out the Telechips NAND driver. 

[scorche]

HARP isn't necessarily a bad thing...But it doesn't help me figure out the Telechips NAND driver. 

Which is what I was going for there.