The pinout for the chip seems kind of useless to me as the chip covers the connections, but there must be alternate test points. In the image of the chips the left one is the primary and has traces going to the cpu. now I am going to assume that these traces also can be used to read and write the chip as the cpu can. I looked at the traces going to the cpu and there are test points for each trace.
If Anyone send care to elaborate on some specifics like alternate point I would greatly appreciate it
Unless someone else knows diferent i guess this could be the information for applying ecc.
i am just trying to piece things together.
if there is an issue with me posting please let me know, posting helps me keep important info in one place.
- Official SamyGO Developer
- Posts: 1700
- Joined: Fri Oct 02, 2009 8:52 am
- Location: Austria/Vienna (no Kangaroos here)
OneNAND flashing by itself is a little bit tricky (using it's primary built-in parallel interface, covered in detail in datasheet). I think you'll need to desolder the OneNAND (BGA) chip to gain access to all needed pads/pins (I really doubt all pins required are accessible as test pads on the B8500 mainboard; it's certainly not a case for any "lesser" B-series models mainboards I've ever seen). Doable, but (at best): a lot of work. Most likely not worth it. ECC/bad blocks management makes it even more tricky (i.e. you can't simply clone OneNAND contents from another/similar device at raw level; it's slightly more complicated than that).
OneNAND flashing via JTAG interface: AFAIK, for Samsung B-series, it's still (almost) completely uncharted territory; I'm quite sure it's theoretically possible to re-program OneNAND using JTAG (e.g. via boundary scan method) on B-series TV SoCs. Problem is: nobody knows exactly how (not counting some unnamed Samsung engineers: probably 5-7 people in total..). Figuring it out from scratch may take weeks/months and some additional bricks . Again: a lot of work, no success guarantee.
Alternative methods/access points/angles of attack: there are some promising (?) mysteries remain unsolved . For example: on PCB "solder" side, for each OneNAND in great many Samsung B/C/D TV models, there are typically two mysterious test pads located directly below the OneNAND chip.. Alternative (not mentioned in any datasheet) OneNAND serial interface, perhaps? Not very likely, IMO, but who knows..
It's no big deal see you for dinnerthe tv is down as I have ordered 2 more boards. One to experiment with.
I am working on rewriting a nand reader and writer for this chip.
I am only doing this for fun . This will be a repeatable method when I finish and I hope I can get it in the wiki.
I really hope you get success! The jtaging, direct NAND flashing are here almost uninvented territories...kpkev wrote: I am only doing this for fun . This will be a repeatable method when I finish and I hope I can get it in the wiki.
is there any way to start the other fw . i never flashed bml0_08.
Or it is enough to patch this one byte and TV starts to previous original firmware. The brick is due some RFS records because i used mount -o loop for edit image file (yes, yes, i know, my fault). If the unsquash/edit/squash/flash procedure was used, then this would not happened. Copying the code of bml0/8 to bml0/10 could make some good result as well...
Last bumped by juusso on Sun Nov 09, 2014 11:02 am.