D series SoC eeprom research

[juusso]

After successful repair of bricked mainboard, i couldn`t stop and decide to do some research on dumps of SoC eeprom, using Ethernet multi-function Interface.

Some preparation to make free from needs to open back panel of TV frequently:

SpoilerShow

CameraZOOM-20130114093752924.jpg

CameraZOOM-20130114111117631.jpg

So now no more needs to read micom config or SoC eeprom while family is watching TV.

Here is my initial dump, perhaps anyone finds something useful here...

eeprom_d6750.zip

First what i did - naturally, i played with factory menu values. Some blocks of bytes being changed after every reboot, but here are some "static" addresses for Factory menu. For example:

Code: Select all

Extended Service Menu enabled 0xCADF: 00=not enabled, 0D=enabled
rs232: 0x51D0: 00=debug, 01=UART , 02=Logic
Watchdog: 0x51D1: 00=off, 01=on
FaNet: 0x51D7: 00=off, 01=on
OTN:   0x55E1: 00=off, 01=on
DimmType: 0x559A: 00=int, 01=ext, 02=err
LVDS Format: 0x559B: 00=PDP, 01=JEIDA, 02=VESA 
AutoPower: 0x559C: 00=Always On, 01=Always Off, 02=LastPower
Language_Arabic: 0x3E29: 0D=EU, 0E=Turkey, 0C=US <and so on...>

To be updated. Any ideas what else to check? Do we need all those addresses of factory menu at all or no need to waste time for that?

[juusso]

For example (i use static IP for interface), if we have bricked TV and our rs232 is not "debug", or service menu for some reasons is not accessible in normal way, to have rs232 jack switched to debug is enough to write 00 at address 51D0:

Code: Select all

http://192.168.1.208/write?device=80&addr=51D0&data=00

power off TV to standby (necessary! or unplug if you want) and after power on we have console output on ExLink cable and proper Service menu value.

[sbav1]

For example (i use static IP for interface), if we have bricked TV and our rs232 is not "debug", or service menu for some reasons is not accessible in normal way, to have rs232 jack switched to debug is enough to write 00 at address 51D0:

I have to say it's a little bit surprising for me (because UART port analog multiplexer on your mainboard is clearly controlled by 2 Micom GPIO pins, and not directly by SoC - so I'd rather expect rs232 setting to be stored in Micom EEPROM, not in the SoC EEPROM). AFAIRC, it was like that in B-Series (at least in B650). Interestring.. I find such behaviour kinda hard to explain; perhaps:
- in more recent (C/D/E ?) series this setting is stored in both (Micom & SoC) EEPROMs,
- maybe each time exeDSP starts, it checks if both settings are in sync, and if not, it overwrites Micom EEPROM setting (by issuing proper Micom UART command - SoC doesn't have direct access to Micom EEPROM) with current value from SoC EEPROM??

After the SoC EEPROM rs232 setting change & 1st power on, did you get all serial console messages instantly (including "onboot .." string etc.), or maybe serial console output was silent before exeDSP start?

[prairie]

To be updated. Any ideas what else to check? Do we need all those addresses of factory menu at all or no need to waste time for that?

How about "PVR Support" in Control->sub-options ?

[juusso]

After the SoC EEPROM rs232 setting change & 1st power on, did you get all serial console messages instantly (including "onboot .." string etc.), or maybe serial console output was silent before exeDSP start?

Just now noticed, last scenario - console is silent until exeDSP starts. And vice versa: changing value to 01, result: debug output until exeDSP start and then - silence. Next standby - silense from the start of TV.

Edit: Yes!
Test 1. Initial SM value rs232 uart (0x51D0: 01), micom`s 0x05: 00. After reboot, debug until and exeDSP start, address 0x05 on micom config eeprom has been changed to 01, debug gone. Now i changed 0x05 to 00 and after standby (restart) got debug on ExLink until exeDSP started, then - silence. Checked micom config at address 0x05 again, value has been changed to 01 (synced to SoC`s eeprom`s value. 0x51D0: 01, 0x05: 01)
Test 2. Initial SM value rs232 debug (0x51D0: 00). Rebooting and on 0x05 we see 01 (no debug on ExLink), after exeDSP start (debug come), value on 0x05 changed to 00. Reboot again - full debug from the moment of power on, values 0x51D0: 00, 0x05: 00.

- in more recent (C/D/E ?) series this setting is stored in both (Micom & SoC) EEPROMs,

Yes, this is it. My test above just confirmed that!

How about "PVR Support" in Control->sub-options ?

This option is greyed out even on Extended SM enabled and Advanced on (0000). No value there and don`t have clue how to change this.

[hedak]

Hallo EEPROM researcher,

although this thread is a little old, i will ask this single question here cause it just belongs here:

How did you power the SoC eeprom (TV in standby/TV turned on/externally soldered/externally unsoldered)?
(On the picture in the first post I can see 4 wires soldered to the board so it should not needed to be unsoldered, but I just want to be sure)

I will create a new thread if I got the watchdog disabled this way on my (by me) bricked C7700.

THX in advance

[juusso]

I just connected arduino interface to required pins and powered up tv

But you can desolder it and use wilem`s programmer for example...

[hedak]

Wow, that was quick!

My problem is that TV restarts every 20 seconds... But that should be enough time to do one dump and later change one bit. I just hope the offsets dont differ :/
I really don't want to desolder it, before doing at least one dump (I learned when modifying my PS3 )

I'm using Teensy++ 2.0 with USB transmission (instead of Ethernet) and modified the sketch given here: http://wiki.samygo.tv/index.php5/Ethern ... fig_Eeprom. I could upload the code if it works

[juusso]

yes, sure, is welcome. Also dumps of soc and micom eeproms as well

[hedak]

Today's status report:

I disassembled the TV the first time and looked for the EEPROM. I finally found it on the backside of the main PCB - its a AT24C512B. I soldered wires on its VCC and GND to check operationg voltage: 3.3V (its only powered when TV is active). BTW my TV resets itself after 6.5 seconds. I really hope this is caused by the watchdog... Tomorrow or on sunday i will solder I?C wires on it and try to dump the EEPROM.

One question I came across when reading the EEPROM datasheet: What to do with WP when I want to write to the EEPROM (pull it to GND/leave untouched) later?