Rockbox Technical Forums

Rockbox Development => New Ports => Topic started by: saioke on September 11, 2007, 11:03:30 PM

Title: Sandisk C100 series
Post by: saioke on September 11, 2007, 11:03:30 PM
hey everyone... im just wondering if rockbox plans on supporting the sandisk c140 model?
Title: Re: Sandisk C100 series
Post by: tarsius on October 25, 2007, 01:39:52 AM
For a while I have been looking for a copy of the Sansa c140 firmware so I could observe the updating process and hopefully do something simple such as swap two characters in a menu string to see if it would produce the desired result.  No luck (until today) finding the firmware because there have been no updates released on the SanDisk website.

I've also attempted to open my c140, but it was not a simple matter of unscrewing.  In the past I was afraid of breaking it, but now I am prepared to flush the investment down the toilet if something goes wrong... I'll chalk it up to an educational expense.

Now that I have the firmware, I'd like to start a port to the Sansa c100 series, but this will be my first reverse engineering project.  I have a background in software, computer engineering, and to a lesser extent, electrical engineering, so this will hopefully be a do-able task if time permits.  I'll follow the NewPort wiki page--hopefully I'll post hardware photos soon.

Question:  Does anyone already know what CPU is inside the c100 series?  I've searched everywhere to no avail, but hopefully we'll know very soon...

Steve
Title: Re: Sandisk C100 series
Post by: tarsius on October 25, 2007, 02:07:53 AM
Answer:  The c100 series uses the Telechips TCC76x or TCC77x (http://www.rockbox.org/twiki/bin/view/Main/TelechipsInfo)
Title: Re: Sandisk C100 series
Post by: skaos on October 25, 2007, 04:01:38 PM
From http://www.experts-exchange.com/Other/Miscellaneous/Q_22591475.html:

Finally I was able to dissasemble the MP3 Player. The first part that needs to be removed is the front cover, it has like 3 plastic snaps on each side. Ones this was removed there were 4 screws to remove and that was it. It's pretty simple once you know what piece to remove first.
Title: Re: Sandisk C100 series
Post by: Bagder on October 25, 2007, 04:37:27 PM
It being a Telechips, it should be worthwhile to check what particular chip it is and then see if you can do the usb-boot "trick" with tcctool as discussed in the cowon d2 thread in this forum.

We also know how to generate the checksums for the firmware images etc, and they are otherwise unencrypted so they usually are rather "easy" to disassemble. If you have the firmware image in a file that is.
Title: Re: Sandisk C100 series
Post by: tarsius on October 26, 2007, 05:18:56 AM
skaos: Thanks for the tip... I'll open it up soon.  btw: what is the attraction to experts-exchange?  I'm always frustrated to when google links me to their site and I'm not sure why it would be worth paying to use a forum or profitable to answer questions on a forum.

Bagder:  Thanks--I'm going to read more about the tcctool trick (http://forums.rockbox.org/index.php?topic=10164.msg100834)... I glanced through and saw there was some significance to the USB device ids, so for reference, my c140 has ids 140e:b021 (vendor:product) when attached in recovery mode (holding the middle "select" button while plugging in the USB cable), which appears to be a good thing.

Also, when attached in recovery mode, it is detected as "TCC77x_USB" and this website (http://forum.mp3store.pl/index.php?showtopic=14695&mode=threaded) indicates the CPU is a TCC770, so the TCC770 looks like a safe bet.

If the above website can be trusted, it also lists the following data:
Quote
Telechips TCC 77x (ARM946 120 MHz +DSP) technologia 13 mikronowa

    * iAUDIO U3 >> Telechips TCC770 + codec Cirrus Logic CS42L51
    * Cowon iAUDIO F2 > Telechips TCC773 ((codec zintegrowany >codec Wolfson WM8731L )
    * Cowon iAUDIO 6 > Telechips TCC771L (codec zintegrowany >codec Wolfson WM8731L )
    * Cowon iAUDIO 7 > Telechips TCC771L (codec zintegrowany >codec Wolfson WM8731L )
    * Cowon iAUDIO T2 > Telechips TCC772S + Wolfson WM8731LS
    * LG-FM 20 > TCC771L ((codec zintegrowany >codec Wolfson WM8731L )
    * LG-FM 30 > TCC771L
    * LG-FM 33 > TCC771L
    * Logik DAX > Telechips TCC773 ((codec zintegrowany >codec Wolfson WM8731L )
    * Teclast T29 > TCC 770 + Wolfson WM8750 (player ten w Polsce sprzedawany jest pod markÄ… VTec PRO MP640)
    * Sandisk Sansa M-240-M 260 > TCC770 + codec Texas Instruments TI TLV320AIC23B
    * Sandisk Sansa C-140-C150 > TCC770 + codec Texas Instruments TI TLV320AIC23B (http://focus.ti.com/docs/prod/folders/print/tlv320aic23b.html)
    * Samsung YP-K5 > TCC770 + Wolfson WM8956
    * Samsung YP-K3 > TCC771L ( chip zintegrowany razem z codeciem Wolfson WM8731 L)
    * iBead 700 > TCC770 + Wolfson WM8750
    * VTec PRO MP640 > TCC770 + Wolfson WM8750 ( patrz Teclast T29 )

I've tried updating my c140 with the firmware updater (bottom of http://en.wikibooks.org/wiki/Sandisk_Sansa_MP3_players/c100), but the program's "Update" bottom remains inactive even though I connected the player in recovery mode according to the instructions.  I'm running Vista Home Premium, which may be causing the problem.  I also tried to run it from virtualized XP Professional (http://www.virtualbox.org/), but I could not get the VirtualBox's USB Controller to properly communicate with the "TCC77x_USB".  Can anyone else out there try the firmware update from Vista and/or XP?

Question: In general, do mp3 players (particularly SanDisk players) prevent you from updating to a previous firmware version or to the same version?

Next, I disassembled the "player.rom" firmware file using arm-eabi-objdump.exe from devKitARM (http://www.devkitpro.org/) executing
"arm-eabi-objdump -D --target binary -marm player.rom > disasm.txt" to produce the output "disasm.txt"
I browsed the code briefly and observed that it more or less matches the "Dual CRC" format (http://www.rockbox.org/twiki/bin/view/Main/TelechipsInfo)
Code: [Select]
       0: e59ff390 ldr pc, [pc, #912] ; 0x398          <--Location of firmware begin address
       4: ffff0106 undefined instruction 0xffff0106
       8: 3a726556 bcc 0x1c99568                   ;  Data is ASCII "Ver:"
       c: 31373030 teqcc r7, r0, lsr r0               ;  Data is ASCII "0071"
      10: 2cbcbcb7 ldccs 12, cr11, [ip], #732      ;  CRC
      14: 00000000 andeq r0, r0, r0
      18: 8b803d18 blhi 0xfe00f480                 ; CRC
      1c: 0011d008 andeqs sp, r1, r8                 ; Length of firmware = 1167368
      ....
      60: eb000084 bl 0x278                  ;<-- Beginning of firmware ...
      64: eb00005c bl 0x1dc
      68: eb000042 bl 0x178
      ....
      398: 20000060 andcs r0, r0, r0, rrx    ;<-- Firmware begins at 0x20000060
**Note that 0x4 - 0x1c and 0x398 is data, so the corresponding instructions are nonsense.

Steve
Title: Re: Sandisk C100 series
Post by: linuxstb on October 27, 2007, 04:03:48 AM
tarsius,

Have you investigated the UAC (User Access Control) settings?  IIUC, that prevents applications talking directly to hardware, even when running them as Administrator.  You could either disable UAC completely, or try and configure it to give the FW updater the appropriate permissions.  google should help.

Based on your info, I've added initial support for the C100 to tcctool.  But I don't know what the value of "SDCFG" should be.   Ideally, I need someone who can successfully use the FW updater in Windows to use a USB sniffing tool to create a log of the USB traffic during such a firmware update.  I've used usbsnoop for this.

And yes, the C100 firmware definitely looks like a TCC77x device, so the work being done on other TCC77x devices will be a lot of help towards a C100 port.
Title: Re: Sandisk C100 series
Post by: tarsius on October 27, 2007, 07:30:58 AM
For reference, I couldn't get the firmware updater to run even with UAC turned off, but I did update the c140 firmware on an XP box.  It looks like the SDCFG is 0x42E97010 as shown in the screenshot.  I'll send you the log too, if you need it.

To answer my question in the my previous port, you can use the updater more than once (i did it twice)... although the tcctool will keep that from being important.

I read about the tcctool in the Cowon D2 thread, browsed the tcctool (http://svn.rockbox.org/viewvc.cgi/trunk/tools/telechips.c?view=markup) and telechips CRC code (http://svn.rockbox.org/viewvc.cgi/trunk/tools/telechips.c?view=markup), and read some background RockBox info.  My next steps will be to get a linux partition set up and checkout the RockBox code, and take apart my c140 sometime soon.  I'll test out the tcctool and if it works, we start writing a bootloader/figuring out how to communicate with the electronics, right?

Steve
Title: Re: Sandisk C100 series
Post by: tarsius on October 28, 2007, 10:31:54 PM
New Sansa c100 wiki page: http://www.rockbox.org/twiki/bin/view/Main/SansaC100Port

I opened up my c140 and took some pictures of the inside.  Warning to anyone thinking of opening a c100 series player:  you cannot do it gently and it left my player looking like a dog chewed on it.  If you do want to get inside, first find a flathead screwdriver or dull razor blade (something with a very fine, flat tip) and wedge it between the BLACK, TOP plastic cover and the MIDDLE SILVER "layer".  Be very careful to pry at SEVEN places where the tabs (extending from the silver layer to the black) are located.  If you shove your tool in too far and miss the tabs, it's very likely you'll break off a delicate surface-mount component... It's a miracle I didn't break anything.  There are SIX large tabs along the length of the player, three on each side, and a SEVENTH, very tiny tab just above the I/O connector.  After you pop the black plastic plate off of the top, you'll see four little screws at the corners of the circuit board... removing these allows you to remove the silvery-goldish plastic backing plate.  When you remove the backing plate, be careful with the battery spring... it's connected to the circuit board, but it protrudes through the black and you must gently push it out.

The following photos are posted on the wiki page:
1) Looking inside the player after removing the black cover.
2) A shot of the text on the display.
3) A view of the player with the silvery-goldish backing removed
4) Text on the three major chips inside
5) View of the smaller circuit board that I'm afraid to remove
6) Close-up of the smaller circuit board... **Note the pins from an additional chip on this board.

I've been trying to install Linux on my laptop (HP tx1000... known for Linux issues), but so far it's not working. I'm going to keep pursuing that because I'm also having trouble getting VirtualBox'd Ubuntu to recognize my Sansa in recovery mode.

Steve
Title: Re: Sandisk C100 series
Post by: ParallaX on March 18, 2008, 06:26:13 PM
Ideally, I need someone who can successfully use the FW updater in Windows to use a USB sniffing tool to create a log of the USB traffic during such a firmware update.

maybe this info will help? :

Code: [Select]
[ROM File]
File Name=player.rom
[NOR Vendor]
Target Address=1879048192
[Write Target]
Media=1
[FW_DN]
Version=1.0.5A
Harp Version=2.0.5A
Company=Telechips.Inc
[DUMP File]
NOR Dump File=mem.INI
NOR Dump Size=0
[Writer PGM]
File Name=
Default Use=1
[Option]
CheckSum=1
File Name=1
Format=0
Font Writing=1
Font File name=
Serial Number=0
Serial File Name=
Serial Count=1
Hidden Area Size=6083
Download Sample File=0
Sample File Path=
Font File Path=c:\windows\temp\sansa\firmware
Customer Number=0
PC Number=0
[SERIALNUM]
File Name=
[Auto Writing]
Enable=0
[SDRAM Information]
SDRAM Size=1
[Hidden Area Map]
Total Fragment=6
F0 Start=0
F0 Name=770Font_.TCC
F1 Start=5376
F1 Name=UNICP437.TBL
F2 Start=5380
F2 Name=UNICP932.TBL
F3 Start=5512
F3 Name=UNICP936.TBL
F4 Start=5709
F4 Name=UNICP949.TBL
F5 Start=5929
F5 Name=UNICP950.TBL

this is configuration .ini file used by FW updater.
Title: Re: Sandisk C100 series
Post by: zivan56 on March 19, 2008, 03:31:28 PM

Hmm,
1879048192 = 0x70000000 (which is different from the other c100 listed in tcctool as 0x42e97010).  Perhaps this is for another version of the c100?  You can try sending the player.rom with tcctool and see if the player starts up using the above addresses.  Of course you need to find out how to get into telechips usb boot more.
Title: Re: Sandisk C100 series
Post by: Davide-NYC on March 21, 2008, 12:29:30 AM
I just bought a Sansa C140 super cheap and tore it apart.

I scanned the PCBs and posted the images on the wiki:
http://www.rockbox.org/twiki/bin/view/Main/SansaC100Port

If a developer wants the board just send me a PM and I'll send you the hardware. Well, whatever is left of it anyway.  ;)  Gone.

Tarsius: Sorry, I supplanted your pics. They are still attached to the page, just hidden. I think the devs find large PCB scans more useful.
Title: Re: Sandisk C100 series
Post by: linuxstb on April 29, 2008, 03:21:45 AM
tarsius,

Are you still interested in working on this port?

I'm working on ports to the Logik DAX and Sansa M200, which are both very similar to each other (and to the C100).  Both my devices have the same LCD and controller (a 128x64 mono LCD), so the first step in porting to the C100 will be to get an LCD driver working.  After that, most of the code I'm writing will work "as-is" on the C100.

Dave.
Title: Re: Sandisk C100 series
Post by: tarsius on April 29, 2008, 03:58:11 AM
I haven't abandoned it, but I don't have any time for it right now.  I'm hoping to continue when the semester ends.
Title: Re: Sandisk C100 series
Post by: MarcGuay on May 07, 2008, 08:06:59 PM
Hi folks,

I picked up a c150 for cheap the other day and have started poking around.  Some things I've come across that may already be known but are not explicitly mentionned either in this thread or on the port page:

1)  To access USB boot mode/Recovery mode, connect the player with the select (center) button pressed.

2)  There is a "Production Test Mode" that is accessed when the lower-volume (the leftwards one) and the "options" button (the bottom button on the circle) are held while menu is pressed for several seconds.  If we could extract and decompile the code from this mode it would provide all of the basics required to talk to the buttons, LCD, USB, etc.

3)  I tried to update my firmware using the updater available from wikibooks.org using Windows XP with admin rights, and it failed.  The current firmware on my player is 2.0.007A.  I have a feeling, based on this and an obtuse comment I found on ABI, that the firmwares which start with 1 are for the c140 and those starting with 2 are for the c150, which leads me to wonder if this implies that the hardware is different...?  (Edit:  Both of the firmware's have ASCII mentions of both the c140 and c150 so maybe I'm on the wrong track here.  Though it's strange that I can't roll back the firmware.)  Perhaps I'll crack mine open and compare it with the scans in the wiki.  I have found a copy of v2.0.008A, which I'm tempted to try and upgrade to using either tcctool or the Sansa Firmware Updater, but I'd like to back it up first.  Which leads me to...

4)  I found a Telechips service program here:  http://www.qumo.ru/programms/QUMO_SENSO_Service_programm.zip, which seems like it could be extremely useful either as a tool or simply something to learn from.  I tried to extract the firmware ROM from my device to back it up but I don't believe it is capable of recognizing my device.  I played with it rather gently and managed to extract some data but I don't believe it to be the proper ROM file.

I'm around, and am pretty keen on getting dirty with this, any advice is welcome.  In regards to writing LCD drivers, any advice on where to begin with something like this?  Is it necessary to find out the model of the screen and obtain a datasheet for it?

Title: Re: Sandisk C100 series
Post by: shotofadds on May 08, 2008, 05:31:20 AM
Marc,

On other Telechips devices, uploading a firmware file (.bin) using tcctool just runs that firmware from RAM, so nothing is flashed to the device. It should be safe to 'preview' firmware updates in this way.

I can't have a look at that service program right now, as .ru domains are blocked here (but I suspect it's the same FWDN program that has cropped up elsewhere).
Title: Re: Sandisk C100 series
Post by: MarcGuay on May 08, 2008, 08:33:46 PM
Howdy,

So I successfully uploaded v2.0.008A using tcctool and it ran fine, then I rebooted back into v2.0.007A.  I tried the same procedure using v1.0.005a and first it tried to connect in MTP mode (presumably the default setting), then upon unplugging I was presented with a firmware interface without strings.  All of the images displayed fine, but no words were present in the menus, etc.  I read about this on one of the many forums I scanned today, so they must have changed something between the v1 and v2 versions that doesn't gel well when you switch versions.  Anyway, this is probably unrelated to porting.

As for the FWDN program, shotofadds, I think you're right, it's the same program that's been around for a bit.  I'm going to see if it can be used to extract the Production Test Mode code from the player, though I have no idea even where to begin.  I've got some reading about memory to do.  Update:  The production test mode strings exist in the player.rom file so presumably the code lives there as well. 

Oh, and I also read that, at least with the v2 firmwares, they made it possible to perform a firmware upgrade simply by placing the "player.rom" file in the root directory in MSC mode and unplugging the unit, but have yet to try it myself because I want to see if I can preserve the 2.0.007A firmware I have on there first.  Update:  I found the string "UPDATE F/W?" in the .rom file and figured it was safe to try this update method, and indeed, placing a player.rom file in the root and rebooting is a method of loading code to the device.  Again, no idea how if this is relevent to porting.

As for the LCD, I've disassembled the firmware in the same fashion that tarsius had and can't really make heads or tails of it, but will skim through it and see if I can find anything. 

Title: Re: Sandisk C100 series
Post by: shotofadds on May 09, 2008, 05:30:40 AM
Oh, and I also read that, at least with the v2 firmwares, they made it possible to perform a firmware upgrade simply by placing the "player.rom" file in the root directory in MSC mode and unplugging the unit, but have yet to try it myself because I want to see if I can preserve the 2.0.007A firmware I have on there first.  Update:  I found the string "UPDATE F/W?" in the .rom file and figured it was safe to try this update method, and indeed, placing a player.rom file in the root and rebooting is a method of loading code to the device.  Again, no idea how if this is relevent to porting.

Ok, looks like you can upgrade the firmware in the same way as other Telechips players. On the D2 we use this to flash a patched version of the original firmware, which is used to dual-boot with the Rockbox bootloader. But, during initial development there's no need to flash anything and tcctool should be sufficient.

Given that most of the C100 hardware looks pretty much identical to the M200 (v1), the most important thing now is to identify the LCD model and try to write a driver for it. Good luck!
Title: Re: Sandisk C100 series
Post by: MarcGuay on May 09, 2008, 09:05:25 AM
This is the only marking I could find on the LCD in the scans.  I searched for every possible combination of letters & numbers it could be and came up empty, but maybe someone else has a clue.  It's on the bottom of the LCD in the "flipped away" scan in the wiki.
Title: Re: Sandisk C100 series
Post by: B@SS on May 14, 2008, 03:51:43 PM
If this help
On the front of screen
GPM580B0 0603
A-NB650218.50.N1 -1
Mark on the plastic thing around the screen
EV-BL-0130
65-04535
Title: Re: Sandisk C100 series
Post by: MarcGuay on May 20, 2008, 09:39:35 AM
Progress?

I've found the main functions relating to the Production Test Mode, as well as all of its glorious spelling mistakes.  When the LCD test is run, it displays fullscreen red, then green, then blue, etc, while waiting for a buttonpress inbetween.  I've modified what I believed to be the code for the colour red and sent the new player.rom file to the RAM using tcctool and it showed green instead, so my bumbling through the code isn't totally a wild goose chase.  But I've reached a bit of standstill due to lack of knowledge concerning ARM assembler language and am hoping that someone could point me in the right direction. 

Basically, what happens for each colour is this:
Code: [Select]
MOV     R0, #COLOUR
BL      disp_solid_colour_R0   ; I've name it this because it only seems to be run in these cases.
MOV     R0, #1
BL      lcd_subroutine2  ; This is a widely used subroutine that seems related to the LCD.

Where COLOUR is:

0xF800 = red
0x07E0 = green
0x001F = blue

Also, whenever strings are displayed on the LCD the follow command is used:

Code: [Select]
ADR     R2, StringName

I suppose my main issue is that I don't really understand where R2 and R0 are located or pointing to.  I believe these are flexible variables that are constantly changing, so do I try and find the last known definition?  Word to the wise:  Teaching yourself is difficult, go to school.
Title: Re: Sandisk C100 series
Post by: tarsius on May 20, 2008, 10:07:13 AM
R0, R1, R2, ..., R15 are 32-bit registers within the processor.

Depending on your background with assembly languages, you might find it useful to refer directly to an ARM manual, like this one:

http://www.eecs.umich.edu/~panalyzer/pdfs/ARM_doc.pdf

or to a tutorial like this:

http://www.heyrick.co.uk/assembler/

Everything will come into focus after spending a bit of time working with it.
Title: Re: Sandisk C100 series
Post by: MarcGuay on May 26, 2008, 07:42:21 AM
Slow and steady wins the race?

The buttons are in GPIO-A (0x80000300).  When the 0x10000000 bit is NOT set, the menu button is pressed, and when the 0x01000000 bit is NOT set, the select button is pressed.  As for the LCD, it seems that all roads point towards address 0x203F2704 (which the TCC77X manual indicates as: "0x20000000 ~ 0x2FFFFFFF - Assigned to SDRAM initially"). 

And that's it for now.  Thanks for the links by the way, tarsius, the first one was particularly helpful in getting a grip on a few things.  I'm starting to realize how helpful a datasheet for the LCD controller would be in doing this.
Title: Re: Sandisk C100 series
Post by: MarcGuay on May 30, 2008, 02:31:18 PM
The TCC77X manual indicates that external IDE devices (which I presume includes the LCD) are assigned the 0x50000000 - 0x5FFFFFFF range, and taking a look at the working driver for the m200 & Logik DAX, these are indeed the addresses it uses.

Is it possible that in the c200 firmware 0x203F2704 (see previous post) has been reassigned at some point to the LCD controller or am I barking up the wrong tree?  The firmware contains no instances of data being moved to memory addresses in the 0x50000000 range at all.  Anyone have advice on where to look next?  Maybe trace back and see if 0x203F2704 has been re-defined?
Title: Re: Sandisk C100 series
Post by: linuxstb on May 30, 2008, 03:38:26 PM
Reading through my notes of my disassembly of the Logik DAX's firmware, it seems there was a "lcd init" type function that calculated the base address of the LCD controller (what I call LCD_BASE in the DAX/M200 driver in Rockbox) - i.e. 0x50000000.

This function took the value 0x5 in R1, and then did a "lsl #28" to shift it to 0x50000000, and then stored it in a memory location (in the DAX's firmware, it was 0x201969ac).

Looking through the C100's firmware, it seems to have a very similar function (entry point at 0x32074), and 0x203f2704 + 0x0c is the location that "LCD_BASE" is written to (at the end of that function).

The function at 0x32100 appears to be the "lcd_cmd" function - this is using the value stored at 0x203f2704 + 0x0c

0x322f4 appears to be performing the main LCD init - and it appears to be very similar to the C200's LCD init function - see firmware/target/arm/sandisk/sansa-c200/lcd-c200.c

This would make 0x38f3c some kind of delay function, but I don't understand it...

Hope that helps ;)



EDIT: I've been investigating a little more, and have started writing the c100 LCD driver, which I'm attaching here.  This is based on the C200 driver, and all I've implemented so far is the lcd_device_init, lcd_send_command and lcd_send_data functions.  These are based on my disassembly of the C100's OF.  The delay function being called after most commands appears to be specifying the delay in 5ms ticks, so I've converted these to calls to the Rockbox sleep() function.

I haven't even tried to compile it though, and it could benefit from being double-checked against the OF.

The next step would be to implement the lcd_update_rect function to try and display things on the LCD.
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 12, 2008, 12:00:12 PM
Alrighty, I've got "things" displaying on the LCD, but I can't figure out two of the GPIO inits, so it's basically a bunch of moving garbage.  The difficulty is in translating these lines of asm, which define GPIOD and GPIOD_FUNC, respectively:

Code: [Select]
ADD     R2, R0, #0x338          ; R2 = 0x80000338 = GPIOD_FUNC
LDR     R3, [R2]                      ; R3 = current val of GPIOD_FUNC
ORR     R3, R3, #2                 ; R3 = or
STR     R3, [R2]                      ;  Store R3 in GPIOD_FUNC
Code: [Select]
ADD     R1, R0, #0x330      ; R1 = GPIOD Data Register
LDR     R3, [R1] ;                ; R3 = current val of GPIOD
ORR     R3, R3, #0xC0        ; R3 = or
STR     R3, [R1]                   ;  Store R3 in GPIOD

The notes are just me trying to figure out what's going on.  Am I right to think that the second line is using the current value of GPIO_D as part of the calculation? 

This is what I have so far for the gpio_init function, it shares a lot with the LogikDAX:
Code: [Select]
    GPIOA_FUNC = 0;
    GPIOB_FUNC = 0x16A3;
    GPIOC_FUNC = 1;
    GPIOD_FUNC = 2; /* ? */
    GPIOE_FUNC = 0;

    GPIOA_DIR = 0xFFFF0E00;   /* 0 - 0xF200 */
    GPIOB_DIR = 0x6FFFF;
    GPIOC_DIR = 0x03FFFFFF;
    GPIOD_DIR = 0x3F7;
    GPIOE_DIR = 0x9B;
   
    GPIOA = 0x1080;
    GPIOB = 0;
    GPIOC = 0;
    GPIOD = 0xc0; /* ? */
    GPIOE = 0x9B;
Title: Re: Sandisk C100 series
Post by: lowlight on June 12, 2008, 12:16:52 PM

Code: [Select]
ADD     R2, R0, #0x338          ; R2 = 0x80000338 = GPIOD_FUNC
LDR     R3, [R2]                      ; R3 = current val of GPIOD_FUNC
ORR     R3, R3, #2                 ; R3 = or
STR     R3, [R2]                      ;  Store R3 in GPIOD_FUNC

Code: [Select]
ADD     R1, R0, #0x330      ; R1 = GPIOD Data Register
LDR     R3, [R1] ;                ; R3 = current val of GPIOD
ORR     R3, R3, #0xC0        ; R3 = or
STR     R3, [R1]                   ;  Store R3 in GPIOD


That's

GPIOD_FUNC |= 2

and

GPIOD |= 0xc0
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 12, 2008, 12:39:14 PM
Thanks lowlight, makes perfect sense.  I guess the fact that this is the initialization of the GPIOs made me wonder what the current value could be besides zero...?  Unfortunately, the display outputs the same nonsense using these values.  Time to look over lcd_update_rect()...
Title: Re: Sandisk C100 series
Post by: linuxstb on June 12, 2008, 04:44:18 PM
Comparing your inits with the OF, I see one mistake - GPIOA should be set to 0x80, not 0x1080.  Everything else looks right though (with lowlight's changes).

Have you managed to work out which pin (if any) is the backlight control?
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 12, 2008, 07:20:21 PM
Thanks for pointing out the error, I caught it myself shortly after posting, and recompiling provides the same results.

As for the backlight pin, I went hunting through the gpio_init bit-by-bit and came up with the following:

Setting GPIOB_FUNC to 0x14A3, 0x16A1 or 0x16A2 = No display, while 0x1683 = backlight on but nothing displayed.  I just realized that in order to get the build to compile I set the LCD_DEPTH to 1 in the c100 config file, figuring it would be fine for debugging purposes, but perhaps it's naive/stupid to think it wouldn't have a larger effect? 

Up:  I've got it compiling as a colour target with the same results, except now it's junk in brilliant 16-bit colour!
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 16, 2008, 02:32:45 PM
Shotofadds:

Here are the 2 files you requested in IRC:

Title: Re: Sandisk C100 series
Post by: shotofadds on June 16, 2008, 03:17:25 PM
I'm not really sure what to suggest, other than trying to confirm that the initialisation sequence and lcd_send_data() etc that you're using are the same as the OF uses.

Can you describe the on-screen result in a little more detail? What do you see if you modify the bootloader to just display a whole screen of, say red?
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 16, 2008, 08:02:35 PM
So after poking around for a while looking for differences between the OF and RB, I finally decided to try running a "make clean" to see if some old stuff was jamming up the works, and yeehaw!, I've got the debug screen displaying legibly.  The only problem is that it's offset by about a third from the top by magic rainbow junk.  Will mess around more tomorrow...
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 17, 2008, 02:47:57 PM
The current state of affairs is attached.  It's strange how the "Count" field is at the top and not the bottom.  I put the "X" after "Btn" to verify I was messing with the right file.  The scrolling line does not appear at all. 

Edit:  Alrighty, it's just that the text is looping around to the top if it doesn't fit the screen.  Commenting everything out but the scrolling line displays it fine.  So it's just a matter of finding out where and why it's displaying everything offset like that.
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 17, 2008, 08:41:13 PM
The display has been corrected.  Credit goes to amiconn for spotting the unneeded offset leftover from the c200.  I've posted the results of button-press tests here: http://www.rockbox.org/twiki/bin/view/Main/SansaC100Port#GPIOA_Pins.  I thought I'd see if I can find the shutdown routine and try to implement it next... Or perhaps it would make more sense to explore the ADC and get the button specifics down?
Title: Re: Sandisk C100 series
Post by: LambdaCalculus on June 18, 2008, 10:23:22 AM
Or perhaps it would make more sense to explore the ADC and get the button specifics down?

Sure, the ADC should hold what you're looking for. I'm going to do the same for the m200 (although I'm swapping with shotofadds so he can have my NAND one :)).

I might pick up a c100 if I can find one for dirt cheap and start pitching in a little bit here as well.
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 18, 2008, 10:26:53 AM
Unfortunately, I couldn't see any significant changes in the ADC readings while pressing buttons.  But I just remembered that Production Test Mode is triggered on boot when the volume-down and circle-down buttons are held, so the boot sequence must have a button check which would uncover the difference between vol-up and vol-down.
Title: Re: Sandisk C100 series
Post by: lowlight on June 18, 2008, 02:28:44 PM
I have a c100, but never got around the messing with it. However, MarcGuay's recent success gave me some motivation.  Here's what I found during lunch: in the OF, there's a key test that goes something like this...

Code: [Select]
GPIOA |= 0x4;
GPIOA &= ~0x8;
i=20; while (i--);
if (GPIOA & 0x10) btn |= BUTTON_PLAY; /* up */
if (GPIOA & 0x20) btn |= BUTTON_RIGHT;
if (GPIOA & 0x40) btn |= BUTTON_LEFT;

GPIOA |= 0x8;
GPIOA &= ~0x4;
i=20; while (i--);
if (GPIOA & 0x10) btn |= BUTTON_VOL_UP;
if (GPIOA & 0x20) btn |= BUTTON_VOL_DN;
if (GPIOA & 0x40) btn |= BUTTON_AB; /* down */

if (GPIOA & 0x100) btn |= BUTTON_MENU; /* power */
if (GPIOA & 0x80) btn |= BUTTON_STOP; /* select */
if (GPIOA & 0x2) btn |= BUTTON_HOLD;
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 18, 2008, 04:26:50 PM
Wow, nothing like working with bits to make you feel dumb.

So my GPIOA testing showed this:

1111000000000100 (F004) 0x4 - Volume Up/Down & A-B Repeat/Down Button
1111000000001000 (F008) 0x8 - Left/Up/Right Directions

And it seems that the key test is checking the bits in bold, which as far as I can tell never change.  There's a line in the OF before the first 2 IF chunks that goes like this:

Code: [Select]
AND     R0, R0, #0x70
Which I believe is just saying "throw out all the bits except those we're about to check", again, the ones that never change.  So where is the OF deriving the uniqueness from?
Title: Re: Sandisk C100 series
Post by: lowlight on June 18, 2008, 05:50:57 PM
I'm guessing that the key lies in setting/clearing those two bits
Code: [Select]
GPIOA |= 0x4;
GPIOA &= ~0x8;
and
Code: [Select]
GPIOA |= 0x8;
GPIOA &= ~0x4;

before checking the other bits.
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 19, 2008, 10:50:19 AM
Found it.

Code: [Select]
GPIOA_DIR |= 0xC
was done at the beginning of the key test and adding that to the button_read_device routine (along with the code lowlight posted) gets all the buttons to read correctly!  Psyched.

Any ideas why that pin wasn't switched on during the GPIO init?  I added it there and it works that way as well.  Curious.

I'll try to post a patch to the tracker soon so other people can mess around.

Edit:  I see, there's a button_init_device() routine and that's where it belongs.
Title: Re: Sandisk C100 series
Post by: MarcGuay on June 19, 2008, 06:15:29 PM
Have you managed to work out which pin (if any) is the backlight control?

Just found it.  Setting GPIOE 0x2 to zero turns off the backlight.


And here's the patch which adds the c100 as a target:

http://www.rockbox.org/tracker/task/9106
Title: Re: Sandisk C100 series
Post by: MarcGuay on July 09, 2008, 07:50:47 PM
lowlight:  If you're interested in looking at a v1 firmware file, there's a link on the port page to an installer for 1.0005a, and may I ask what lines of the code you're looking at for NAND information?
Title: Re: Sandisk C100 series
Post by: MarcGuay on July 09, 2008, 10:37:57 PM
I just came across a vague comment in the ABI c100 review comments that insinuates that the c140 and c150 had different firmware versions.

http://www.anythingbutipod.com/archives/2006/03/sandisk-sansa-c100-series-review.php#comment-415125

This would explain why I have problems when trying to downgrade my c150 to v1.  I don't know how seriously to take these people's comments but someone claims to have bricked their device by trying to upgrade their c140 to v2.  Of course, we can always use tcctool to test different versions harmlessly.  The v1 firmware on the c150 provides an interface free of strings (I feel like I've mentionned this before, but maybe now it has more significance).  It remains a mystery why lowlight's reversed v2 NAND code works on the c140 and not the c150, however, and leads me to believe that they are unrelated issues.

For those not following IRC and Flyspray, here's a link to the other half of this:
http://www.rockbox.org/tracker/task/9096

Title: Re: Sandisk C100 series
Post by: MarcGuay on July 22, 2008, 09:20:28 PM
It looks as though the c150, or at least the one I have, has a few hardware differences from the c140.  I've posted a new picture of the front of the board here: http://www.rockbox.org/twiki/bin/view/Main/SansaC100Port, and am currently trying to find a way to get at the rest of it without totally trashing the thing.

---

Alrighty, it looks as though there are two versions of the c100 series as well - one with a regular NAND flash interface and one like the v3 m200s and e200/c200 v1s with the bonus chip acting as an SD interface. 
Title: Re: Sandisk C100 series
Post by: shotofadds on July 23, 2008, 04:14:25 AM
Alrighty, it looks as though there are two versions of the c100 series as well - one with a regular NAND flash interface and one like the v3 m200s and e200/c200 v1s with the bonus chip acting as an SD interface. 
Yes, the presence of that SanDisk 'SDC1' chip on the C150 strongly suggests it's using the same architecture as 'HARP'-type M200s (hence why you can't read the NAND Ids directly).

AIUI you'll need an SD-card driver to be able to read/write the internal flash on that device (as per the E200s and C200s). You could talk to preglow, he's been working on an SD driver for TCC78x which should be pretty similar.
Title: Re: Sandisk C100 series
Post by: MarcGuay on July 23, 2008, 02:50:45 PM
Given that the c100 (v2? v1.01? HARP? arrr!) seems to use the same SD controller/bridge and Flash memory chips as the e200 and c200 shouldn't it be a rather simple adaptation of that existing code?  Or does the fact that one is PP and one Telechips change the game completely?  Will investigate more now and jump on IRC later (don't have access from work).
Title: Re: Sandisk C100 series
Post by: shotofadds on July 23, 2008, 03:36:07 PM
Or does the fact that one is PP and one Telechips change the game completely?

You said it.  ;)