Rockbox Technical Forums

Rockbox Development => New Ports => Topic started by: travishayes89 on December 16, 2006, 05:07:39 PM

Title: SanDisk Sansa m200 series (v1)
Post by: travishayes89 on December 16, 2006, 05:07:39 PM
I don't know if it'd be possible to port RockBox to a SanDisk sans m240, but it'd be cool.

I do own one, but know nothing about the internal components, and because I just bought mine, I don't want to go ripping it up. I can tell you about what I know about it.

Specs:
1.0 GB (actually 1 billion bytes)
FM Radio tuner
Built In Microphone
Monochrome display

8 buttons (play-pause-up, repeat-down, back, forward, select, vol up, vol down, menu-power)

And a hold switch.

Well, I'll google for info and get more submitted here.
Title: Re: SanDisk Sansa m240
Post by: Bagder on December 16, 2006, 06:11:01 PM
1.0 GB (actually 1 million bytes)

That has got to be the smallest gigabyte ever seen...

(sorry, couldn't resist)
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 16, 2006, 07:06:18 PM
ahh, it's natural.

Crap, now I know why you did that. I made a typo: the Gigabyte according to Sansa is 1 billion bytes, not 1 million.  :-[

I found this on the "Anything but iPod" forums
Quote
I cracked my M250 open to see what hardware is used:

Main processor/"System on Chip" (SOC): Telechips TCC 770
www.telechips.com

Couldn't get any detailed info, their website requires a logon just to see the datasheet. Possibly because they are in the process of being sued by SigmaTel for patent infringement. I emailed asking how to get a software developer's kit, but don't expect an answer. They are not set up to sell product into the USA. Anyone have a friend in Hong Kong that would front for me in getting one ?
Anyway, here's the info I COULD find:


TCC77x Series are system LSI for digital audio player based on the ARM946E-S, ARM'sproprietary 32-bit RISC CPU core.

it can decode and encode MP3 or other types of audio/voice compression/ decompression standards by software based architechure. The on-chip USB 2.0 compliant controller enables the data transmission between a personal computer and storage device such as NAND flash, HDD, SD,MMC etc.

Applications

Portable MP3 player (WMDRM10)
Mobile MP3 phone
Juke Box (Audio & Photo)
Portable MP3 Karaoke
Digital Internet Radio Server
Electronic Dictionary
Personal Multimedia Player (Audio/Image/Video)
Multimedia Storage Device


SDK

Provides Reference Solution including H/W and S/W
Provides World-first proven JANUS DRM(WMDRM 10 - PD) Solution
Supports various Audio & Video codec
MP3 decoding/encoding
WMA decoding/encoding
OGG decoding
ADPCM decoding/encoding
JPEG decoding
MPEG4-SP decoding
Supports MSC (Mass Storage Class) & MTP (Media Transfer Protocol)
Supports Meta-data Browsing

Features

ARM946E-S CPU core (4KB cache, up to 120MHz), 0.13um process
- Core : 1.1V ~ 1.3V, I/O : 1.8V ~ 3.3V
4K bytes of internal boot ROM with various boot procedure (NAND, UART, USB, EHI) and security
64K bytes of internal SRAM for general usage
4K bytes of data TCM (Tightly Coupled Memory) for fast data access
On-chip peripherals
- USB2.0 Device / USB1.1 Host
- ECC generator for SLC and MLC NAND Flash
- General purpose 8 channel 10-bit ADC
- RTC (Real Time Clock) for battery backup
- EHI (External Host Interface) for parallel host interface
Dedicated Memory Interfaces: SD ,MMC, SLC / MLC NAND Flash , IDE I/F for HDD
Embedded 8Mbit Nor Flash ,16Mbit SDRAM, High Performance Audio Codec Options


Besides the Telechips part, here are the other main chunks of silicon:

TI TLV320AIC23B Stereo codec and headphone amp (not sure why this is needed, as the telechips supposedly has the codec built in? Maybe just for the headphone amp)

ESMT M12S16161A 1M X 16 DRAM

Flash is Samsung... I didn't bother with the chip IDs

Philips TEA5767 FM radio

and a couple I was unable to track down from the markings:

59TI
AIP

and


AZ-76
VOB

..... and, yes, I got it back together and working perfectly
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 17, 2006, 09:16:17 PM
I'm just wondering though, is there any program out there like ipodpatcher that can read the partition table of a device and process it?
Title: Re: SanDisk Sansa m240
Post by: Bagder on December 18, 2006, 02:39:09 AM
If the unit is a UMS one, you can simply dd from Linux, and use fdisk -l to get to know about the partitions.
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 19, 2006, 09:14:18 PM
One thing i've noticed, is that when i plug mine into a Ubuntu machine that I have, the "Music" folder disappears.

It shows up under MTP mode in WinXp but not MSC, something with the way Windows writes it?
Title: Re: SanDisk Sansa m240
Post by: Mad Cow on December 19, 2006, 09:15:50 PM
Maybe that folder is hidden like alot of newer players.
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 19, 2006, 09:24:59 PM
No, cause when in MTP and using Windows Explorer, I can access it cleanly.

Maybe MTP has some sort of encryption on it?
Title: Re: SanDisk Sansa m240
Post by: Llorean on December 19, 2006, 09:27:08 PM
MTP doesn't show the actual filetree. It shows whatever the firmware wants to show you, independent of whether it's hidden or not. It's still entirely possible for the file to be hidden in MSC mode, and not hidden in MTP mode. In fact, completely different sets of folders are visible on the e200 series depending on which mode you're in, but you can find the hidden ones if you're in MSC.
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 19, 2006, 09:43:02 PM
How, DOS?
Title: Re: SanDisk Sansa m240
Post by: Llorean on December 19, 2006, 09:54:21 PM
Just telling it to show hidden files and folders...
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 19, 2006, 10:06:43 PM
I have that setting set in Explorer, but it still doesn't. Maybe I'll try to find that on Ubuntu Linux. Wish me luck!
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 20, 2006, 10:15:40 PM
I actually need a ".rom" decompiler, any help here?
Title: Re: SanDisk Sansa m240
Post by: dan_a on December 21, 2006, 03:20:39 AM
Try setting up a Rockbox development environment and then doing:
arm-elf-objdump -D -m arm -b binary firmware.rom | more
where firmware.rom is the name of the .rom file
Title: Re: SanDisk Sansa m240
Post by: Bagder on December 21, 2006, 03:24:01 AM
I just wanted to point out that we have an excellent guide on how to start on a new Rockbox port:

http://www.rockbox.org/twiki/bin/view/Main/NewPort
Title: Re: SanDisk Sansa m240
Post by: travishayes89 on December 21, 2006, 01:47:58 PM
Try setting up a Rockbox development environment and then doing:
arm-elf-objdump -D -m arm -b binary firmware.rom | more
where firmware.rom is the name of the .rom file

Do you mean using "cygwin"?

Edit, cygwin's objdump doesn't recognize the sansa m240 firmware rom file.
Title: Re: SanDisk Sansa m240
Post by: Bagder on December 21, 2006, 04:41:53 PM
Quote
Do you mean using "cygwin"?

Let me repeat what he said, with a little emphasis added:

"Try setting up a Rockbox development environment and then doing:"

... as you will of course need an objdump built for ARM. You can do that with cygwin or otherwise, as is described fine on the rockbox site.
Title: Re: SanDisk Sansa m240
Post by: maxkelley on December 29, 2006, 12:01:08 PM
OK, I connected my Sansa m240 in MSC mode, here's fdisk -l:
Code: [Select]
Disk /dev/sda: 1016 MB, 1016856576 bytes
32 heads, 61 sectors/track, 1017 cylinders
Units = cylinders of 1952 * 512 = 999424 bytes

   Device Boot      Start         End      Blocks   Id  System
Are there any flags that will show hidden partitions or something? Also, there are two hardware revisions of this player that I have seen. One hardware revision is revision 4, the other is 1.30. The usb id's of these two are 0781:7431, and 0781:7401, respectively. I did the above fdisk listing using a revision 4 model, which has an improved (brighter) backlight and graphics (some fonts are different as well) over the revision 1.30. There are isn't really a way to tell which is which, having them side-by-side.
Code: [Select]
[18957561.368000] usb 5-7: new high speed USB device using ehci_hcd and address 25
[18957561.508000] usb 5-7: configuration #1 chosen from 1 choice
[18957561.512000] scsi20 : SCSI emulation for USB Mass Storage devices
[18957561.512000] usb-storage: device found at 25
[18957561.512000] usb-storage: waiting for device to settle before scanning
[18957566.516000] usb-storage: device scan complete
[18957566.520000]   Vendor: SanDisk   Model: Sansa m240        Rev: v4.0
[18957566.520000]   Type:   Direct-Access                      ANSI SCSI revision: 00
[18957566.544000] SCSI device sda: 1986048 512-byte hdwr sectors (1017 MB)
[18957566.544000] sda: Write Protect is off
[18957566.544000] sda: Mode Sense: 04 00 00 00
[18957566.544000] sda: assuming drive cache: write through
[18957566.564000] SCSI device sda: 1986048 512-byte hdwr sectors (1017 MB)
[18957566.564000] sda: Write Protect is off
[18957566.564000] sda: Mode Sense: 04 00 00 00
[18957566.564000] sda: assuming drive cache: write through
[18957566.564000]  sda:
[18957566.568000] sd 20:0:0:0: Attached scsi removable disk sda
[18957566.568000] sd 20:0:0:0: Attached scsi generic sg0 type 0
[18957567.968000] FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
Strange thing about it is that it runs firmware version 4.0.44A, where the latest on the Sandisk site is something like 3.0.2, where my 1.30 runs 3.2.8A. Sandisk needs to fix their firmware updates..
I hope this helps somewhat.
Edit: Ok, here's a longer lsusb with -v:
Code: [Select]
Bus 005 Device 026: ID 0781:7431 SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x7431
  bcdDevice            4.0e
  iManufacturer           1 SanDisk
  iProduct                2 SanDisk Sansa m240
  iSerial                 3 4014E30F0117B3930000000000000000
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 config1: Mass Storage only
    bmAttributes         0xc0
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              5 ms ifac 1 (SCSI::BULK_ONLY)
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered
Edit some more:
Ok, here's some more help. I got the roms from the firmware update, not sure if this will help:

American Version: http://maxkelley.be/sansaroms/SANSM200_American.rom
Asian Version: http://maxkelley.be/sansaroms/SANSM200_Asian.rom
European Version: http://maxkelley.be/sansaroms/SANSM200_European.rom
Title: Re: SanDisk Sansa m240
Post by: fiveofoh on July 02, 2007, 12:40:26 PM
Hey, sorry if I'm bringing up an old thread, but I've got an m250 (the 2GB version of the m240) and am wondering if a rockbox port would be
a) feasible
b) reasonable
I own it, and I'm willing to take it apart and mess with it, I've got decent electronics skills (and am majoring in EE/CS).  I don't have a lot of time right now, but I may in the near future, and would like to take a stab at it if it meets the two requirements above.

Edit:
After re-reading the New Ports section on the wiki, I'll add a couple things:
1) I am wiling and expecting that if anything gets done, I'll be the one doing it - I just want to know if it's worth my effort.
2) I will have access to the EE lab at college come late September, I have my own basic stuff (multimeter, soldering iron, etc) but I'm guessing there's probably a BDM/JTag emulator somewhere around the labs
3) I have tinkered with assembly, and am learning C++, hopefully C won't be too difficult to pick up
4) The Sansa m200 seems like a decent target, firmware is loaded from disk/flash, I have it.
Title: Re: SanDisk Sansa m240
Post by: Bagder on July 02, 2007, 04:43:55 PM
Quote
a) feasible

Sure, why not?

Quote
b) reasonable

Sure, why not? I don't think this target is much less reasonable than other similar targets that we already support.

Start working on a wiki page with PCB scans, figure out upgrade file format etc etc
Title: Re: SanDisk Sansa m240
Post by: fiveofoh on July 10, 2007, 11:07:06 PM
Hmm, I guess I forgot to post here...I put up a wiki page for it with scans:
http://www.rockbox.org/twiki/bin/view/Main/WebHome?topic=SansaM200Port
And whatever info I've gathered.  Kr4t05, we may be able to use yours, but I've gotten mine apart to take scans and such, so if I don't have to do anything crazy like ripping the screen off I'll probably be fine.  But thanks, I'll let you know :)
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 24, 2007, 04:53:59 AM
I would be grateful if they following questions can be answered.

1) In the fdisk -l summary of M240, there is a difference of about 17Mb between  the Disk and Units. Would I be correct in assuming this is a hidden partition where the firmware/bootloader is stored and therefore the M240 will be easy to upgrade?
2) Dan_a mentioned using arm-elf-objdump for debugging. Would I be correct in assuming that  ARM (arm-elf) will be used for this player as it is telechips based?
3) I've got Usbsnoopy installed on windows and managed to install a sniffer on another player. I haven't tried it on my M240 yet. Would I be correct in saying that it would have to get a log dump when I am trying to upgrade the firmware? Can this only be done once when the firmware is being upgraded or can I do it afterwards when the Installer is checking firmware upgrade?
4) I found a link to rom files (http://files.zefie.com/PMP/sansa/m200/firmware/), I'm sure I got link from here. I assume this is the firmware rom file that needs disassembled?


Apologies if I am totally on the wrong track here but I have no experience of reverse engineering USB devices. I would say my experience using the C language is intermediate and currently swotting up on ASM (I've got a tutorial on 80386 which will give me an idea of the language, hopefully the ARM version isn't too different?).
Title: Re: SanDisk Sansa m240
Post by: Bagder on November 24, 2007, 05:14:30 AM
1: It depends a lot on how that partition is hidden and how you acccess it etc.

2: Yes, as the CPU core in the telchips is ARM

3: Yes, but the common telechips firmware format is already "cracked". Isn't this working for the m200 series? Also, you should be able to work with this target using tcctool which thus allows you to run and test stuff on target entirely without flashing or risking to brick it etc.

4: Yes
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 24, 2007, 07:46:46 AM
Thanks for getting back to me so quickly Badger.

From my understanding of point 3, I can plug my m240 to my laptop and 'run code' right now. This will help me get my head round the embedded programming part. I've noticed there are a few current porting efforts that use the telechips so I'll look at them to get more info.

Unfortunately I need to 'walk before I can run' so please don't expect too much from myself.  If I can keep the motivation up I'll get there eventually.
Title: Re: SanDisk Sansa m240
Post by: Bagder on November 24, 2007, 05:17:48 PM
Just allow me to point out that there seems to exist two different m200 models as well, and if you're having the newer one, it seems it isn't Telechips anymore but AMS:

http://daniel.haxx.se/blog/2007/11/25/has-sandisk-gone-ams/
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 25, 2007, 10:49:49 AM
I opened up my m240 earlier on and went onto IRC. One of the chaps on IRC said he didn't recognise the chipset.

Unfortunately I only have a mobile phone to scan the player. Not sure if the resolution will be good enough.

Don't have time to do it now but will look into it tomorrow.
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 26, 2007, 05:15:26 AM
Tried using mobile phone to scan but resolution wasn't good enough.

Took details of some chips on back. The details are as follows:
-----------------------------------------
C70218301
SDTNKLAHSM-1024
CP0032854
CHINA
-----------------------------------------
20-99-00122-2
5654-6910511
SDC1
TAIWAN

From this link http://forums.rockbox.org/index.php?topic=12906.msg102855#msg102855 the c240 has similar chip markings.

There is nothing on packaging or player that says it is v2. It just says model: m240.
Title: Re: SanDisk Sansa m240
Post by: skaos on November 26, 2007, 06:16:42 AM
alsaf, which firmware version does it have? There should also be some silkscreen marking on the circuit board itself, something like "M200+ V4.1" in this photo (upper right): http://www.rockbox.org/twiki/pub/Main/SansaM200Port/m240back.jpg
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 26, 2007, 06:29:51 AM
It says SANSA M200+ v4.1 on the circuit board.

The Firmware version on machine is 4.1.08E
Title: Re: SanDisk Sansa m240
Post by: Bagder on November 26, 2007, 07:21:52 AM
That's the one I call "v2", and it uses AS3525. The same one the v200 v2 uses and most possibly also the c200 v2.

And we have no ports or any started work on Rockbox for this SoC.
Title: Re: SanDisk Sansa m240
Post by: skaos on November 26, 2007, 08:10:59 AM
Quote
That's the one I call "v2", and it uses AS3525.
Wouldn't it be better to call it m200-v4 to avoid any confusion?

I have downloaded firmware 1.3.0, 2.2.5, 4.0.44 and 4.1.08 (from http://files.zefie.com/PMP/sansa/m200/firmware/) and I would guess that there are four hardware versions as well. To my untrained eye 1.3.0 and 2.2.5 looks similar and from the RB wiki they probably use Telechips. The two latter firmware includes an "AS3525" string. I haven't found any 3.x.x firmware.
Title: Re: SanDisk Sansa m240
Post by: GodEater on November 26, 2007, 08:14:03 AM
Quote
That's the one I call "v2", and it uses AS3525.
Wouldn't it be better to call it m200-v4 to avoid any confusion?

Bagder is referring to the hardware version - not the firmware it's running.
Title: Re: SanDisk Sansa m240
Post by: skaos on November 26, 2007, 08:38:09 AM
I know - there are most likely four hardware revisions/versions of this player as discussed at abi:
http://www.anythingbutipod.com/forum/showthread.php?t=8031
http://www.anythingbutipod.com/forum/showpost.php?p=39607&postcount=2

Silkscreen markings also show v3 and v4.1 versions and I see no reason why Sandisk should use this if there weren't v1 and v2 as well:
v4.1: http://www.rockbox.org/twiki/pub/Main/SansaM200Port/m240back.jpg
v3.0: http://medlem.spray.se/trancentral/sansa1.jpg, http://medlem.spray.se/trancentral/sansa2.jpg

It seems likely that the major firmware version for many (most/all?) Sansa players are linked to hardware revisions/versions.

Anyway, this is pretty academic as long as there is no AS3525 port yet (and I guess that the developers would start with the e200-v2).
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 26, 2007, 08:43:54 AM
Apologies in advance if I'm getting above myself here.

Would I be right in saying that arm-elf can still be used with the AS3525?
Title: Re: SanDisk Sansa m240
Post by: Bagder on November 26, 2007, 09:29:27 AM
Quote
Would I be right in saying that arm-elf can still be used with the AS3525?

yes
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 26, 2007, 12:12:08 PM
Don't know if this is any use.

I used the following command on linux CLI,

dd if=/dev/sdb of=temp

Where /dev/sdb is the M240.

I ran hexedit on the output file temp. Did a search for various text strings. I found the following text

1493D0E0   6D 70 33 5F  64 65 63 6F  64 65 72 00  4A 61 6E 20  mp3_decoder.Jan
1493D0F0   32 36 20 32  30 30 37 00  31 34 3A 31  37 3A 32 38  26 2007.14:17:28
1493D100   00 63 72 5F  35 5F 30 5F  64 65 76 65  6C 6F 70 00  .cr_5_0_develop
....
...
...
149633C0   63 3A 5C 00  6D 6D 63 3A  5C 00 6D 32  30 30 70 46  c:\.mmc:\.m200pF
149633D0   69 65 6C 64  55 47 00 4D  32 30 30 50  2E 42 49 4E  ieldUG.M200P.BIN
149633E0   00 6D 32 30  30 70 53 65  6C 66 45 72  61 73 65 00  .m200pSelfErase.
149633F0   23 45 58 54  4D 33 55 00  23 45 58 54  49 4E 46 3A  #EXTM3U.#EXTINF:
14963400   00 FF FF FF  FF 6D 6D 63  3A 5C 4D 54  41 42 4C 45  .....mmc:\MTABLE
14963410   2E 53 59 53  00 00 04 08  0C 42 6C 75  65 73 00 43  .SYS...
...
...
...
149636D0   35 5F 30 5F  64 65 76 65  6C 6F 70 00  00 00 00 00  5_0_develop.....
149636E0   00 23 00 20  00 2F 00 20  00 00 00 6D  6D 63 3A 5C  .#. ./. ...mmc:\
149636F0   52 45 53 5F  49 4E 46 4F  2E 53 59 53  00 00 00 00  RES_INFO.SYS...
...
...
...
148FAE20   41 53 33 35  32 35 5F 32  5F 30 00 63  72 5F 35 5F  AS3525_2_0.cr_5_
148FAE30   30 5F 64 65  76 65 6C 6F  70 00 30 30  30 32 30 30  0_develop.000200
148FAE40   32 31 30 31  30 33 30 35  30 30 30 35  30 30 00 00  21010305000500..


From the last one, the string is exactly the same as the one in the link that Badger posted  http://daniel.haxx.se/blog/2007/11/25/has-sandisk-gone-ams/

That suggests to me that the firmware is stored on the disk?
Title: Re: SanDisk Sansa m240
Post by: LambdaCalculus on November 26, 2007, 12:27:29 PM
Yes, this looks quite useful.

Can you do two more commands on your m240?

Run fdisk -l, then lsusb -v, and make sure to pipe the outputs to a text file. Append it here when you're done.
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 26, 2007, 12:36:37 PM
This is in MSC mode. Fdisk -l is not very useful


Quote
Disk /dev/sdb: 1016 MB, 1016856576 bytes
32 heads, 61 sectors/track, 1017 cylinders
Units = cylinders of 1952 * 512 = 999424 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

This is the m240 info from lsusb - v

Quote
Bus 003 Device 006: ID 0781:7431 SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x7431
  bcdDevice            4.0e
  iManufacturer           1 SanDisk
  iProduct                2 SanDisk Sansa m240
  iSerial                 3 D910FC0A2027B4980000000000000000
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 config1: Mass Storage only
    bmAttributes         0xc0
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              5 ms ifac 1 (SCSI::BULK_ONLY)
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered
 


This is a snippet from  kern.log when the m240 gets plugged into laptop

Quote
Nov 26 18:43:59 laptop kernel: [ 1951.236000] usb 3-1: USB disconnect, address 4
Nov 26 18:51:56 laptop kernel: [ 2428.240000] usb 3-1: new high speed USB device using ehci_hcd and address 5
Nov 26 18:51:56 laptop kernel: [ 2428.380000] usb 3-1: configuration #1 chosen from 1 choice
Nov 26 18:51:56 laptop kernel: [ 2428.384000] scsi3 : SCSI emulation for USB Mass Storage devices
Nov 26 18:51:56 laptop kernel: [ 2428.384000] usb-storage: device found at 5
Nov 26 18:51:56 laptop kernel: [ 2428.384000] usb-storage: waiting for device to settle before scanning
Nov 26 18:52:01 laptop kernel: [ 2433.384000] usb-storage: device scan complete
Nov 26 18:52:01 laptop kernel: [ 2433.384000] scsi 3:0:0:0: Direct-Access     SanDisk  Sansa m240       v4.1 PQ: 0 ANSI: 0
Nov 26 18:52:01 laptop kernel: [ 2433.388000] sd 3:0:0:0: [sdb] 1986048 512-byte hardware sectors (1017 MB)
Nov 26 18:52:01 laptop kernel: [ 2433.388000] sd 3:0:0:0: [sdb] Write Protect is off
Nov 26 18:52:01 laptop kernel: [ 2433.388000] sd 3:0:0:0: [sdb] Mode Sense: 04 00 00 00
Nov 26 18:52:01 laptop kernel: [ 2433.388000] sd 3:0:0:0: [sdb] Assuming drive cache: write through
Nov 26 18:52:01 laptop kernel: [ 2433.396000] sd 3:0:0:0: [sdb] 1986048 512-byte hardware sectors (1017 MB)
Nov 26 18:52:01 laptop kernel: [ 2433.396000] sd 3:0:0:0: [sdb] Write Protect is off
Nov 26 18:52:01 laptop kernel: [ 2433.396000] sd 3:0:0:0: [sdb] Mode Sense: 04 00 00 00
Nov 26 18:52:01 laptop kernel: [ 2433.396000] sd 3:0:0:0: [sdb] Assuming drive cache: write through
Nov 26 18:52:01 laptop kernel: [ 2433.396000]  sdb:
Nov 26 18:52:01 laptop kernel: [ 2433.400000] sd 3:0:0:0: [sdb] Attached SCSI removable disk
Nov 26 18:52:01 laptop kernel: [ 2433.400000] sd 3:0:0:0: Attached scsi generic sg2 type 0
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 26, 2007, 01:43:35 PM
I think the MBR is MSWIN4.1 link: http://mirror.href.com/thestarman/asm/mbr/MSWIN41.htm

I came to this conclusion from the start of dump:

Quote
00000000   E9 00 00 4D  53 57 49 4E  34 2E 31 00  02 40 01 00  02 00 02 00  ...MSWIN4.1..@......
00000014   00 F8 7A 00  3F 00 FF 00  00 00 00 00  00 4E 1E 00  00 00 29 67  ..z.?........N....)g
00000028   45 23 01 4E  4F 20 4E 41  4D 45 20 20  20 20 46 41  54 31 36 20  E#.NO NAME    FAT16

Also found this later on in dump

Quote
14908E10   40 00 00 00  4D 53 57 49  4E 34 2E 31  00 00 00 00  @...MSWIN4.1....
14908E20   46 41 54 31  32 20 20 20  00 00 00 00  46 41 54 31  FAT12   ....FAT1
14908E30   36 20 20 20  00 00 00 00  46 41 54 33  32 20 20 20  6   ....FAT32
14908E40   00 00 00 00  6D 6D 63 3A  00 00 00 00  6D 6D 63 3A  ....mmc:....mmc:
14908E50   5C 53 61 6E  73 61 20 6D  32 2E 25 63  30 00 00 00  \Sansa m2.%c0...
14908E60   6D 6D 63 3A  00 00 00 00  2E 20 20 20  20 20 20 20  mmc:.....

It looks like theres definately two partitions on drive but when mounted on linux it only gets dispalyed as a single partition (sdb). Is it possible to mount a hidden FAT partition?
Title: Re: SanDisk Sansa m240
Post by: saratoga on November 26, 2007, 07:27:24 PM
It looks like theres definately two partitions on drive but when mounted on linux it only gets dispalyed as a single partition (sdb). Is it possible to mount a hidden FAT partition?

On the Sansa E200, you can only do this in recovery mode.  On the 200R, you cannot do it at all without modifying the firmware.  These players have software USB stacks.  Sandisk can expose whatever of the internal memory they like to the UMS driver.
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 27, 2007, 02:39:49 AM
What I be correct in saying that the porting effort can't go ahead until the partition containing the firmware can be accessed?

Based on imagination rather than experience I can only think of two options to get around this:

1) Use an alternative way of accessing the partition.
2) Finding the firmware in the datadump, amend it then DD it back to m240.

I'll have to check to see if any of the above options are actually possible.

EDIT: Either that or figure a way to get player into recovery mode if that is possible?
Title: Re: SanDisk Sansa m240
Post by: Bagder on November 27, 2007, 03:23:19 AM
Normally we want a way to get out of a bad firmware install. I'd say that's the primary thing a porter wants.

Once the firmware upgrade file format is figured out and a brave soul wants to try it, how can (s)he get back to the original one afterwards?
Title: Re: SanDisk Sansa m240
Post by: alsaf on November 27, 2007, 12:48:17 PM
From the looks of the data dump, the partition where music files can be stored and can be accessed is physically the first one on disk. After that it is the partition that contains firmware which can't be accessed.

According to the link on the MSWIN4.1 Boot Record in previous thread, the boot sector starts with 52 52 61 41 and ends with AA55.

As seen from the following extract from the dump, the boot sector is on the second partition.

Quote
14904E70   02 F0 FE FD  2A 1C 69 46  07 98 00 F0  6F FF 00 28  ....*.iF....o..(
14904E80   00 D1 E5 62  68 46 02 F0  0B FE 01 20  E4 E7 00 00  ...bhF..... ....
14904E90   55 AA 00 00  52 52 61 41  72 72 41 61  00 00 55 AA  U...RRaArrAa..U.

149084C0   B1 F9 00 28  03 DA 20 1C  FF F7 86 F8  51 E6 20 1C  ...(.. .....Q. .
149084D0   FF F7 82 F8  00 20 4E E6  F0 FF 00 00  88 DF 00 00  ..... N.........
149084E0   F4 0F 00 00  67 45 23 01  55 AA 00 00  FF FF FF 0F  ....gE#.U.......

I'm not sure if the M200 series has a recovery mode. Will have to do a google and post for a few related forums.

Edit:

From the below link it looks like the M200 series does not have a recovery mode. Not exactly from the horses mouth but the explanation is plausible.

http://www.anythingbutipod.com/forum/showthread.php?t=6530&highlight=recovery
Title: Re: SanDisk Sansa m240
Post by: alsaf on December 03, 2007, 03:25:20 PM
Apologies for repeating what other posters have said (and stating the obvious) but it looks like the next step in this port is to try and update the firmware to expose the second partition. I wouldn't know how to even start doing this, yet.

Is anybody currently working on this port? Although I am only poking about with the player and learning as I go, I want to at least try to do something constructive to get the port moving on rather than repeating something that's already done or is being worked on.
Title: Re: SanDisk Sansa m240
Post by: linuxstb on April 27, 2008, 05:17:27 AM
I bought a Sansa M260 (v1) a couple of weeks ago - for 20 GBP from here:

http://www.bigpockets.co.uk/product.php?lang=&product=SANDISK044

(they still have some in stock).

It seems to be extremely similar to the Logik DAX player I'm (slowly) in the progress of porting Rockbox to.  It has the same family (tcc77x) of SoC and is using the same LCD controller (SSD1815) to drive a 128x64 mono LCD.

The tcc77x has a USB boot mode, but I couldn't find a way to enter this mode via key combinations whilst booting.  So I used the same trick that worked on my Logik DAX - I removed the NAND module from the motherboard - not being able to find the NAND module causes the tcc77x to default to USB boot mode.

Once I did this, I could use tcctool (the -d c100 option worked) to transfer and run some test code compiled for the Logik DAX - and it worked, including the LCD driver.

The M260's backlight is connected to a different GPIO pin, but a search of an original firmware disassembly and some luck found that - pin 0x40 on GPIOA.

My logik DAX port is still in the very early stages (I have a basic bootloader build working, with a working LCD driver capable of displaying debugging info on the screen), so this is all I can do on the M260 as well.

But as I work on the DAX, I'll be trying to keep the M260 version in sync.
Title: Re: SanDisk Sansa m240
Post by: Nagasaki_Kid on May 17, 2008, 08:43:47 PM
I was wondering if the method above can be used to unbrick my sansa m240
Title: Re: SanDisk Sansa m240
Post by: linuxstb on May 17, 2008, 08:56:01 PM
I was wondering if the method above can be used to unbrick my sansa m240

If by "above method" you mean the first thing I did (i.e. buying a new m240), then yes, that will work...

Otherwise, no.    I'm assuming that by "bricked" you mean that the firmware (which is stored on the NAND flash) refuses to run, presumably because of something corrupted on the NAND flash.  So given that the only way I have found to run code on the m240 via "usb boot mode" (which bypasses the firmware in the NAND flash) is to physically remove the flash, then there's no way to fix its contents.

Also, there is no NAND driver written yet for the m240, so even if we could access USB boot mode with the NAND still installed, we couldn't fix it.

All this also assume you have a "v1" m240.
Title: Re: SanDisk Sansa m240
Post by: Nagasaki_Kid on May 18, 2008, 05:37:04 PM
Sorry to have wasted your time. I guess I'll buy a second m200 hopefully another v1 and use the flash hot swap trick on anythingbutipod.com
Title: Re: SanDisk Sansa m240
Post by: LambdaCalculus on May 20, 2008, 08:01:23 AM
A little teaser:

(http://farm3.static.flickr.com/2280/2506932664_4c2819aa15.jpg?v=0)

The bootloader doesn't do much at this point, except run the tick counter, display GPIO values, and run a scroll test line up top.

Everyone give linuxstb a hand for his hard work! :)
Title: Re: SanDisk Sansa m240
Post by: rickbronson on May 27, 2008, 01:58:00 AM
Hi,
  I have a m240 taken apart with the NAND removed and I ran the tcctool against it.  It found the vendor id
and device id (in boot mode) but I didn't have a binary to throw at it.  Where can I get one that would
put up the simple display show in the last post?

  Thanks much.

  Rick
Title: Re: SanDisk Sansa m240
Post by: linuxstb on May 27, 2008, 02:58:56 AM
You need to set up a Rockbox development environment, download the latest Rockbox source code, and compile an "M240 bootloader build".

Lots of information on doing the above can be found in the Rockbox wiki - see here:

http://www.rockbox.org/twiki/bin/view/Main/DocsIndex#For_Developers

If you have questions, the best place to ask is probably on IRC (where all the devs hang out).  Or you can ask (and read!) the "Getting Started and Compiling" forum.  We should try and keep this thread on-topic to m240 development (the process of compiling Rockbox is identical for all targets and not specific to the m240).
Title: Re: SanDisk Sansa m240
Post by: rickbronson on May 28, 2008, 03:41:38 PM
  Okay, sorry I posted to the wrong forum.

  I've got my m230 to run the scrolling text bootloader.  The version I have contains the Telechips Soc. The normal m200 build fails though...

  Anyway, I'm new to rockbox but have a lot of experience in ARM soc Linux development.  Seems to me the next step is working on the NAND code.  Is this just a matter of porting rockbox/firmware/target/arm/tcc780x/ata-nand-tcc780x.c to rockbox/firmware/target/arm/tcc77x/ata-nand-tcc77x.c?

  I'm wondering about the other chip on the NAND daughterboard?  Mine says "SanDIsk 20 99 00090 3 0620 573162 SOC1 China".  Is this a NAND controller chip?
Title: Re: SanDisk Sansa m240
Post by: cycletronic on May 28, 2008, 09:00:43 PM
I don't know if any of you are aware of the sandisk forum community, but it appears that they have some useful information.  I have not searched the rockbox forums exhaustively, so I apologize if this is a repeat.  Here's a link to a thread with photos and details of the internals of a m200 series:
http://forums.sandisk.com/sansa/board/message?board.id=m200&thread.id=1687
It looks like there is a lot of other useful information in there.
I recently purchased two of these units from woot.com for $10 a piece, so I just might jump in (depending on the hardware version I get), although I have so very little time.  Boy it would be cool to have a $10 OGG player :) I'll at least listen in.  Woot does seem to sell sandisk MP3 players quite often, so if you are interested in this project, I would recommend checking it out every so often (or subscribing to their RSS feed).
Title: Re: SanDisk Sansa m240
Post by: shotofadds on May 29, 2008, 05:41:45 AM
Anyway, I'm new to rockbox but have a lot of experience in ARM soc Linux development. Seems to me the next step is working on the NAND code.  Is this just a matter of porting rockbox/firmware/target/arm/tcc780x/ata-nand-tcc780x.c to rockbox/firmware/target/arm/tcc77x/ata-nand-tcc77x.c?

If the SOC communicates with the NAND directly, as we've seen on the other Telechips devices we've looked at, then yes, it should "just" be a matter of a) finishing and b) porting the 78x code. But not necessarily in that order... ;)

The 78x code is far from complete (it's read-only, and even that is unreliable) and this is currently holding back the Cowon D2 port in a big way. Since there's no hardware NAND controller, we have to do the logical<>physical block mapping ourselves, and we don't fully understand the Telechips scheme yet.

I'm wondering about the other chip on the NAND daughterboard?  Mine says "SanDIsk 20 99 00090 3 0620 573162 SOC1 China".  Is this a NAND controller chip?

Wild speculation: iirc the Sansa E200 and C200 communicate with their NAND chips via a bridge that presents the NAND as an SD card interface - so it's not unimaginable that something similar could be used here. If that's the case, the tcc78x code won't be much use, but implementation might be considerably easier.

I'd suggest dropping in to the IRC channel and looking out for linuxstb, he's done virtually all the 77x work so far.
Title: Re: SanDisk Sansa m240
Post by: saratoga on May 29, 2008, 10:05:23 AM
I thought the Telechips hardware was entirely documented? 
Title: Re: SanDisk Sansa m240
Post by: shotofadds on May 29, 2008, 10:19:06 AM
I thought the Telechips hardware was entirely documented? 

Indeed it is, and we have no problem communicating with the hardware. The problem is that the Telechips 'flash controller' is nothing more than a direct interface to the NAND chip, meaning we have to understand and deal with the logical<>physical block translation, bad blocks, ECC and wear-levelling mechasisms ourselves, in software. No small challenge, I'm sure you'll agree. :P
Title: Re: SanDisk Sansa m240
Post by: LambdaCalculus on May 29, 2008, 11:27:06 AM
No arguments here about that. :)
Title: Re: SanDisk Sansa m240
Post by: rickbronson on May 29, 2008, 02:49:08 PM
  I tried to find out what this SanDisk chip is but I really couldn't find much.  It does seem logical that it is some kind of bridge but then you wonder why they have so many pins on the daughter board.  If it was SD -> NAND then they would only need 10 or less pins.  Hmmm.

  I spent some time looking over a disassembly of their code at

http://www.efn.org/~rick/pub/SANSM200.rom.lis

  I wrote a perl script that tries to glean memory accesses (in the 080000XXX or 0x90000XXX range) from the listing.  It's output is here:

http://www.efn.org/~rick/pub/reg.access.txt

  While this technique is not perfect, it shows is that there are no accesses to the MMC/SD controller but quite a few to the NAND registers which makes me think they are using the NAND in it's raw form.

  So I guess I'll assume that it's directly connected and proceed with trying a port mentioned before.
Title: Re: SanDisk Sansa m240
Post by: shotofadds on May 30, 2008, 04:20:38 AM
So I guess I'll assume that it's directly connected and proceed with trying a port mentioned before.
Sounds like a good way forward, although I'd check first whether linuxstb has already looked into this as part of his Logik DAX work.

After porting the hardware register addresses you'll need to add a section to nand_get_chip_info() containing the page size, number of blocks etc for the particular NAND chip in your player. Currently only a couple of Samsung 2GB/4GB chips used in the D2 are supported.

Assuming we get that far, you'll then need to hope that the Telechips block translation scheme didn't change between the 77x and 78x SDKs. Otherwise there might be some serious detective work to do...

(btw. I'm the author of the 78x code).
Title: Re: SanDisk Sansa m240
Post by: linuxstb on May 30, 2008, 04:49:41 AM
I've looked a little at the NAND code, but haven't actually started work on it.  So it would be great if someone else did it... ;)
Title: Re: SanDisk Sansa m240
Post by: shotofadds on June 01, 2008, 10:04:28 AM
I've now got a 512Mb M230 in the post (hopefully it's a v1), in the hope that working out the NAND translation scheme might be easier/quicker with only 1/8th of the data to wade around in compared to the 4Gb D2.

But, in order to do this I need a way to run tcctool with the NAND attached. Any bright ideas?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: skaos on June 01, 2008, 11:11:34 AM
Is this any help:
http://forums.sandisk.com/sansa/board/message?board.id=m200&thread.id=1501
http://anythingbutipod.com/forum/showthread.php?t=20366
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on June 01, 2008, 12:34:39 PM
Well, those threads seem to suggest the daughterboard can be "hotswapped" without damaging the player, but that seems rather risky to me! :o

If that really is the case (and if there really is no other way to enter USB-boot mode) then I suppose it could be an avenue to explore. Eg. boot using tcctool with the NAND unplugged, loop for a while until the NAND board is plugged in, etc.

It'd be quite far from an ideal development environment, of course...
Title: Re: SanDisk Sansa m200 series (v1)
Post by: rickbronson on June 04, 2008, 06:03:09 PM
For what it's worth, I"ve "hot swapped" the NAND daughter board at least a 100 times and it still works.  You actually don't have to fully engage the connector to get it to work, just apply some pressure (squeeze the two boards together) gently.  Because snapping it totally on and off is a pain.

  I tried porting tcc780x to tcc77x and the correspoinding NAND file but I don't seem to be able to get the NAND id's from the chip.  Looking at the disassembled code I thought the chip enables might be on GPIOE bits 0x30 so I tried those in all 4 states but still nothing.  I've been thinking of alternatives...

  Why can't I load SANSM200.rom with tcctool?  It seems like it should work but I don't get anything.

  If I use the crc code routine snippit in TCC77X.pdf on  SANSM200.rom I don't get the correct CRC at offset 0x10.  Any ideas on this?

  Is it true that if I put SANSM200.rom in the root partition it will perform an upgrade?  I tried this and when I booted it with a half dead battery it said "Cannot perform upgrade with dead battery" and proceeded to delete the file.  I'm thinking of trying this on a fresh battery and a modified SANSM200.rom.

  One last thought - anyone know anything about a serial port (UART) output available?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: skaos on June 04, 2008, 06:43:26 PM
Serial port - does datasheets for tcc760 and tcc780 help:
http://files.myopera.com/ch%D0%B5t/files/1TCC76xRev0[1].05.rar 
http://www.telechips.com/kor/inc/download3.asp?file_gbn=D&board_id=122&file_url=/webupload/data_board&file_name=TCC780_DataSheet_r0.09.pdf
Title: Re: SanDisk Sansa m240
Post by: shotofadds on June 05, 2008, 02:20:31 PM
Wild speculation: iirc the Sansa E200 and C200 communicate with their NAND chips via a bridge that presents the NAND as an SD card interface - so it's not unimaginable that something similar could be used here. If that's the case, the tcc78x code won't be much use, but implementation might be considerably easier.
Well, my M230 arrived today and it is indeed a Telechips version. That's where the good news ends, from my point of view at least. It has "Revision 3.0 (HARP)" marked on the circuit board, and has the same SanDisk controller chip on the daughterboard that you saw.

I have a strong suspicion that this is a TriFlash interface, as seen on the E200/C200. That would explain why you can't read the NAND chip id...
Title: Re: SanDisk Sansa m200 series (v1)
Post by: LambdaCalculus on June 05, 2008, 02:29:13 PM
TriFlash? Hmmm...

shotofadds, what would happen if (and I know it may not work, but it's worth a shot) we tried using code from the e200/c200 for reading the flash on the m200?

I know it's probably not going to work and sounds completely wrong, but it's just an idea.
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on June 05, 2008, 02:44:54 PM
shotofadds, what would happen if (and I know it may not work, but it's worth a shot) we tried using code from the e200/c200 for reading the flash on the m200?

That would be much closer than trying to port the 78x NAND code. AIUI it's essentially an SD card interface. And preglow is working on a Telechips SD driver...

But still, there goes my plan of using this device to give me some clues about the Telechips NAND translation scheme (to help out with the D2 port). Unless someone wants to swap a "Revision 2.0 (NAND)" for my revision 3.0?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: LambdaCalculus on June 05, 2008, 02:59:14 PM
Where's the revision marking located on the m200 mainboard?

Also, the flash chip on my m240 has the following markings on it:

SAMSUNG 546
K9K8G08UOM
            PC80

The OF is v2.2.5A.

EDIT: Mine is a Revision 1.0 (SLC) mainboard.

EDIT 2: Oops, must've accidentally damaged something on the LCD, because now there are a couple of columns of dead pixels appearing on the screen.

EDIT 3: If it catches anyone's interest, I'm attaching the CONFIG.TCC file from my m240. Opening it up in Notepad2 reveals a TELECHIPS.DAT string, then quite a few blocks like "NUL", "ETX", "FF", and more. Wonder if anything's hidden in it?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on June 05, 2008, 03:43:18 PM
Does it say NAND in big letters above it, like here: http://forums.sandisk.com/sansa/board/message?board.id=m200&thread.id=1687 ?

Mine says HARP there instead...

I reckon the revision 1/2 hardware accesses the NAND directly, and rev.3 goes through this bridge chip. Does yours have an extra SanDisk branded chip on the daughterboard?

I guess we'd need several M200 ports based on hardware revision: v1/2 (NAND), v3 (HARP), v4 (AMS SoC).

Unfortunately the only reason I bought this was to look at the NAND, but I have the wrong hardware revision. :-[
Title: Re: SanDisk Sansa m200 series (v1)
Post by: LambdaCalculus on June 05, 2008, 03:48:46 PM
No, mine doesn't say anything above the revision.

Also, there's no extra chip on the daughterboard; only the Samsung chip is there.

So it looks like I have one that does indeed access the NAND directly.
Title: Re: SanDisk Sansa m200 series (v1)
Post by: rickbronson on June 05, 2008, 05:24:19 PM
  Oops, on a previous post I mentioned that there were no accesses of the SD/MMC addresses in the disassembled SANSM200.rom.  Well, I had the wrong version of SANSM200.rom! Once I got the 3.2.8A version here:

http://mp3support.sandisk.com/sansa/Firmware/M200/3/A/SansaM200A3_2_8.txt

  and disassembled it, it does indeed access the SD/MMC range (eg 0x90000104).  Oddly enough it still accesses the NAND registers (like 0x90000050).  So I think earlier statements about the extra chip on the daughter board being a SD/NAND bridge are probably correct.  I wonder if this chip could be:

http://www.sandisk.com/Assets/File/OEM/Manuals/ProdManiNANDAbr1.1.pdf

  Some of the above may explain why people have bricked their units by forcing to a wrong version of software as reported on anythingbutipod.

  I did spend some time looking for a serial port by toggling the serial TX pins in the bootloader and then probing for a certain HZ signal on various pads on the board but no luck.


  Rick
Title: Re: SanDisk Sansa m200 series (v1)
Post by: scorche on June 07, 2008, 07:25:44 PM
I have been looking at the porting effort as well and recently purchased 3 m240s on woot as they were cheap enough and so I will have some to pass out at DCE if anyone wants them.  I ended up with 1 v2 and 2 v1s.

I opened them up to see if I had one to trade with shotofadds as these devices are for others anyway, but sadly it seems that both of my v1s are HARP as well.  :-\
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on June 08, 2008, 11:20:29 AM
I opened them up to see if I had one to trade with shotofadds as these devices are for others anyway, but sadly it seems that both of my v1s are HARP as well.  :-\

HARP isn't necessarily a bad thing (in fact, if it really is an SD interface as per E200/C200 it potentially makes an M200 port much easier). But it doesn't help me figure out the Telechips NAND driver.  :(
Title: Re: SanDisk Sansa m200 series (v1)
Post by: scorche on June 11, 2008, 03:39:02 PM
HARP isn't necessarily a bad thing...But it doesn't help me figure out the Telechips NAND driver.  :(

Which is what I was going for there. ;)
Title: Re: SanDisk Sansa m200 series (v1)
Post by: LambdaCalculus on June 11, 2008, 03:42:39 PM
Mine is a NAND based... anyone want to trade?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: rickbronson on June 12, 2008, 12:29:43 PM
  I've been thinking about this SD NAND bridge.  There must be a way to disable the bridge because the TCC770 needs to be able to talk with the NAND directly when it boots.  There is no way the TCC770 can boot via SD (that I can tell).  So it must be doing this upon boot:

1. SD bridge is wired to NAND and TCC770 is wired to NAND.
2. Upon boot SD bridge tristates output to NAND.
3. TCC770 boots and boots from NAND via direct connection.
4a. Booted software (HARP) detects presence of SD bridge and tristates NAND direct connection and uses SD bridge only.
4b. Booted software (pre HARP) detects no SD bridge and continues to use NAND direct connection.

  Make sense?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: LambdaCalculus on June 12, 2008, 12:43:11 PM
Very interesting. :) I think the next step now is find some way of monitoring the boot sequence of a NAND and HARP m200, and comparing the results.

I'll try and see if the OF brings up any juicy info.
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on June 12, 2008, 12:54:43 PM
  I've been thinking about this SD NAND bridge.  There must be a way to disable the bridge because the TCC770 needs to be able to talk with the NAND directly when it boots.  There is no way the TCC770 can boot via SD (that I can tell).

It's a possibility, sure. Although for this to work, the bridge would have to be disabled at reset as I doubt there's any hardware-specific code in the TCC770 boot ROM.

But in that case, the experiment to read the NAND chip id should have been successful....  maybe I'll have a go if/when I get some time next week.

Very interesting. :) I think the next step now is find some way of monitoring the boot sequence of a NAND and HARP m200, and comparing the results.

Might be a good idea to look for differences in the startup code between the v1/2/3.xx firmwares?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: LambdaCalculus on June 12, 2008, 01:02:01 PM
Might be a good idea to look for differences in the startup code between the v1/2/3.xx firmwares?

A very good idea indeed, shotofadds. I'll try and look for the firmware updaters for each version. I'll let you know if I find anything.
Title: Re: SanDisk Sansa m200 series (v1)
Post by: rickbronson on June 12, 2008, 02:08:16 PM
  I thought it would be a good idea to be able to read registers on running Sansa firmware so I wrote a c program that overlays code in the SANSM200.rom image then calculates the CRC and makes a new SANSM200.rom.  This file is then put on a m230 in the root directory, when the USB cable is pulled it does a firmware update (but only if the battery is very fresh!).  I found the tiny subroutine that runs when the "Information" menu is brought up.  The program that I overlayed prints one different register each time you go out of, then into "Information".  Here are some interesting register values:

   .word   0x80000300    //   GDATA_A   got: 00005fef
   .word   0x80000304    //   GIOCON_A  got: 00000070
   .word   0x80000308    //   GSEL_A    got: 00000080
   .word   0x80000310    //   GDATA_B   got: 003a0f5c
   .word   0x80000314    //   GIOCON_B  got: 002cfca3
   .word   0x80000318    //   GSEL_B    got: 000012a3
   .word   0x80000320    //   GDATA_C   got: 02000000
   .word   0x80000324    //   GIOCON_C  got: 03ffffff
   .word   0x80000328    //   GSEL_C    got: 00000001
   .word   0x80000330    //   GDATA_D   got: 000000d0
   .word   0x80000334    //   GIOCON_D  got: 00000030
   .word   0x80000338    //   GSEL_D    got: 00000002
   .word   0x80000340    //   GDATA_E   got: 00000000
   .word   0x80000344    //   GIOCON_E  got: 000000ff
   .word   0x80000348    //   GSEL_E    got: 00000000
   .word   0x90000050    //   NFC_CTRL  got: 00f00131
   .word   0x9000012C    //   SDIDCTRL  got: 00001494
   .word   0x90000130    //   SDISTAT   got: 01604080
   

  Anyone have any other register (or anywhere in the whole memory space) they are interested in?

Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on June 18, 2008, 12:00:17 PM
I wrote some code that attempts to read the NAND chip id, which I've put on the tracker as FS#9096. On my rev.3 m230 this displays NAND id 0x0 0x0... as if no chip were present, but on the rev.1 or C100 it seems to cause a freeze instead. Anyone want to take a look?

I don't think I've mentioned it here or the wiki yet, but there are a set of pins which control the boot mode. They're just to the right of the LCD and are marked "NAND", "BANK1", "BANK2", "TRI-F" and "USB". Of these only "TRI-F" is connected on my rev.3.

If the "USB" pins are connected when inserting the USB cable, the device will boot into USB-boot mode, which is nice. :)
Title: Re: SanDisk Sansa m200 series (v1)
Post by: rickbronson on June 27, 2008, 12:32:52 PM
shotofadds,

  This is what I got when I tried to get nand id's, all zeros.  Yesterday I tried setting all of the GPIO and NAND registers to what they are in the running product but still didn't get anything. 

  On a different subject, one thing I found that made me curious is this register:

   .word   0x80000364    //   BM        got: 00000013

  This tells me that the tcc770 is booting off of EEPROM.  Anyone know anything about this?  If this is true then the tcc770 may be going right from EEPROM to SD in the boot process and the NAND may not be tied directly to the tcc770.  I looked at the board and did see a  10 pin part marked "SCTI AIP" that could be a EEPROM

  Rick
Title: Re: SanDisk Sansa m200 series (v1)
Post by: atomikpunk on July 07, 2008, 08:50:56 PM
Hi guys,

sorry to spam your thread but I'm currently working on the sansa v2 port and I bought an m230 off ebay. Unfortunately it is one with the v.2.2.5 firmware, so it is a "v1 hardware". I'm interested in trading this one for a "hardware v2" one, that is one with a v.4.x.y firmware. I really don't care the flash size and I understand that mine is only 512Mb, but for rockbox development, it doesn't matter.

So if anyone reading that thread is willing to trade, please contact me via personal message...

Thanks and good luck with the v1 port (which seems to go smoothly as I can see)!
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on July 18, 2008, 09:47:16 AM
A quick update on current progress, for NAND M200s at least:

The TCC780x (D2) NAND driver has had a few tweaks applied and now also runs on TCC77x, as ata-nand-telechips.c. With current SVN it's possible to call ata_init() from the bootloader and read sectors with some degree of success. If you're lucky (and you've enabled HAVE_FAT16SUPPORT) it may even successfully mount the partition.

The logical/physical block translation scheme appears to be almost identical to the D2, but the current implementation is not perfect, so incorrect data is sometimes/often returned. From what I've seen so far, these kind of errors seem to occur more frequently on the m200 than the d2.

To try and investigate further, I've written a quick-n-dirty Windows program to write raw sectors with known values to the M200 UMS volume, and some Rockbox code to read/verify those using the NAND driver. The first test successfully read the first 16Mb with no apparent errors. I'll try to do some further tests to track down the remaining problem(s) in the next week or two, but no promises...

  This tells me that the tcc770 is booting off of EEPROM.  Anyone know anything about this?  If this is true then the tcc770 may be going right from EEPROM to SD in the boot process and the NAND may not be tied directly to the tcc770.  I looked at the board and did see a  10 pin part marked "SCTI AIP" that could be a EEPROM

Sorry, I hadn't seen your post until now. That certainly goes a long way to explaining how those HARP versions might boot. I'm not really that familiar with the various boot modes available - does the datasheet give any clues as to how you might read data from that chip?
Title: Re: SanDisk Sansa m200 series (v1)
Post by: shotofadds on November 06, 2008, 07:05:30 PM
Time for a quick update...

Thanks to some sterling USB work by vitja and gevaerts, I've been able to dump enough raw NAND data from my M200 (harware revision v2) to the PC to be able to perform some useful analysis. I /think/ I now understand the FTL well enough to produce a reliable read-only Rockbox driver (the results of some initial PC-based tests run look encouraging).

The bad, but somewhat expected, news is that this seems to be using a slightly different FTL scheme to the D2 (and iAudio 7?). It's very likely the Logik DAX and C100 use this scheme, though.

The two schemes can probably be runtime-detected, but it'll likely work out easier to split the driver into a common raw NAND access layer (the existing ata-nand-telechips.c?) with separate ftl-v1 and ftl-v2 layers selected at build time, depending on the model.

I hope to find enough time at the weekend to update the Rockbox driver and do some testing on the device. Wish me luck!  ;D