[SOLVED] Forced "toggle" to repair bricked TV?

[oga83]

Much more easy would be to find a simple I2C compatible interface. These should be easy to find, and I don't think you need to buy a whole programmer. The BusPirate is also providing for the I2C protocol (and many others including rudimentary JTAG) compatible device

IMO, to read the full content of an I2C eeprom, Bus Pirate is not so easy to use...

What you really want is this FTDI cable based on the FT232H... (Or this.)

I already have this cable (FTDI C232HM-DDHSL-0).
For JTAG, there are software that have drivers for it.
However, for I2C and SPI, I never found any valuable utilities. In particular to read or write eeprom. I always had to use their library in my own code.
If you found something for this purpose, I'm interested

[oga83]

Using the Ethernet multi-function Interface, I've been able to read and write the micom e2prom without unsoldering it from my BD-D8900 mainboard

It is possible since all the interesting signals are protected by resistors in series. But you must make your connections on the eeprom side, not on the micom controller side
Also, there is no other chips on this I2C link (front panel, and top cover logo leds are using different I2C links); so there is no contention with anything else.
To read or write in the eeprom, the unit has to be powered on. I waited 2 minutes after boot to be sure initialization was completed (so that the micom controller would not read/write in the e2prom at the same time I would - I also checked with an oscillo that after boot the I2C link was always idle).

You can see that I have connected SDA, SCL and GND.
There is also a wire on the WP connection (wire left unconnected on the photo), because WP is driven by the micom controller (not connected to GND as it is often the case).
- To read the eeprom, leave it unconnected; this is safer .
- To write into the eeprom, you have to connect WP to GND.
The black FTDI cable at the bottom of the photo is only used to transfer the sketch and to power the Arduino board.

Happy unbricking !

microm_eeprom.png

The url http://BD-D8900-IP/read?format=0&device ... 0&size=256 yields :

Code: Select all

0000: 1E 11 00 66 72 65 01 01 3A 01 C0 00 00 00 F0 0C 42 44 2D 48 44 44 20 43 6F 6D 62 6F 00 00 FF FF ...fre..:.......BD-HDD.Combo....
0020: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF AA FF FF FF 00 00 01 07 13 0D 0C ................................
0040: 0B 08 13 0D 0C 0B FF FF FF FF FF FF FF FF FF AA FF FF FF FF FF FF FF FF FF 00 0A 16 01 09 0B 0B ................................
0060: 16 01 09 0B FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
0080: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00a0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00c0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF ................................
00e0: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 01 ................................

I've just written 1 byte of data at @e0, to check it was working with url http://BD-D8900-IP/write?device=80&addr=e0&data=55, but it can be used to write the entire memory

[juusso]

Ordered arduino uno + ethernet shield 1.1 links i attached in previuos message. Now i waiting for anyone who can confirm i marked right micom config eeprom...

[oga83]

Ordered arduino uno + ethernet shield 1.1

Sorry, I didn't see your links. Uno+Ethernet Shield is ok, but Arduino Ethernet is cheaper

[juusso]

Too late. Now waiting for items I hope i can use uno for smth else...

[oga83]

Ordered arduino uno + ethernet shield 1.1 links i attached in previuos message. Now i waiting for anyone who can confirm i marked right micom config eeprom...

Yes, it's the one

[E3V3A]

Having glanced over this thread again, it just reminded me of a couple of things.
1. The bricking (as stated herein) after reflash, seem very similar to what occurred on several of Samsungs top-of-the-line phones, like Galaxy S1 and S2. The reason was sucky eMMC hardcoded firmware, in combination with crappy eMMC settings in the Kernel. If you google for "brickbug" you'll see what I'm talking about. We should check these eMMC's in our TV's. I'm sure they use the same somewhere.
2. @juuso: When "bricked", do you get any debug (ex-link) output or other "life" at all?
3. Do we know the function of the EEPROM data (as shown above)?
4. For those of us who have a working TV, there are EEPROM erasing/resetting (whatever) code already available in filesystem. These are just scripts, AFAICR.

[juusso]

Having glanced over this thread again, it just reminded me of a couple of things.
1. The bricking (as stated herein) after reflash, seem very similar to what occurred on several of Samsungs top-of-the-line phones, like Galaxy S1 and S2. The reason was sucky eMMC hardcoded firmware, in combination with crappy eMMC settings in the Kernel. If you google for "brickbug" you'll see what I'm talking about. We should check these eMMC's in our TV's. I'm sure they use the same somewhere.

Never heard about brickbug before, but i agree, this could persist on tv`s as well as on phones. For sure we also use that praxis - if anything went wrong ant tv is bricked, we say it happened because of official firmware upgrade...

It's a GOOD thing he says that. That way, if anything goes wrong while flashing a custom ROM you can always claim it was an official update that broke your phone.

2. @juuso: When "bricked", do you get any debug (ex-link) output or other "life" at all?

I deleted logs from pc, but piece of code looks like:

Code: Select all

SAMSUNG Genoa-S Kernel
 Version : 1008 RELEASE
 Applied Last Patch Number : 0198
 SamyGO Build...
================================================================================

===========================================================
[SQUASHFS ERR] Inflate Error !! bh[2]->data
bh->data(0xc0731000 to 0xc0731fff)
1000: 68737173 c2200000 cc76824e 00000200 5e020000 01001100 c0000100 04000000 
1020: cc11583e 01000000 82cc6805 00000000 7acc6805 00000000 ffffffff ffffffff 
1040: 69d66505 00000000 1d1a6705 00000000 d47f6805 00000000 2ccc6805 00000000 
1060: 78daecbc 779c54d5 d9007cce b9f74eef bdd79d99 9dd93a3b 6d7b5f58 60591696 
1080: 2d7458aa 14416c88 8a88a002 565063d7 98c444a3 31d65812 93f82696 688c2511 
10a0: 0b51b145 8d5d130b cc9def39 f7de5986 b5917cef f7fb7d7f bcb3fb3c 67eeb9f7 
10c0: 9ef2f4d3 06618490 1e6d450c da30b9bb 67123787 d32366fa 2d90eb99 3c3063f0 
10e0: f82d370c c3f5a308 d9f8c983 439dbe36 e7b18859 06d7e886 19833575 eb2b16de
<endless code running here...>

Honestly talking, old mainboard was running custom bootloader (kernel hashes checking was patched out) and custom kernel (seen in logo...). Thats why TV won`t shutdown and performs some kind of squashfs system check with a lot and endless hex code running in debug. So TV is alive, just nogo further after kernel load. As we don`t have access to bootloader, only (possible) way is to let micom boot healthy tv partition set. Btw i haven`t forgotten your request for kernel compiling thread, bad is, that here is nothing about that, all required info has Denny (and arris69). But nowhere it is documented (yeah, bad, agree, this MUST be documented, at least in hidden forum area.)

4. For those of us who have a working TV, there are EEPROM erasing/resetting (whatever) code already available in filesystem. These are just scripts, AFAICR.

I haven`t seen code in filesystem, but service menu has some iteresting stuff like nvram reset, eeprom reset (if my memory doesn`t lie)...

[E3V3A]

Added the details of brickbug in this new thread: "Vulnerable to eMMC brickbug?"

[E3V3A]

About the EEPROM utilities (in my MST X10 based model) we have the binary /mtd_exe/EepromCleaner_X10P.

It seems that it can be called from TDM, as it contain a TDM style menu:

Code: Select all

==============================
 [ 24C256 Debug Menu ]
------------------------------
 0x01  : Read
 0x02  : Write
 0x03  : Nvram Fill Data
 0x04  : Nvram reset
 0x05  : Dump eeprom data to /mtd_rwarea/eer_dump.bin
 0x06  : Load eeprom data from /mtd_rwarea/eer_dump.bin
 0x99  : Exit Debug
Select Menu >>

The command line options are:

Code: Select all

usage   : EepromCleaner [-option]
        -c : clear eeprom to 0xFF
        -d : dump eeprom data to /mtd_rwarea/eer_dump.bin
        -l :  Load eeprom data from /mtd_rwarea/eer_dump.bin

Thus you can dump your EEPROM data to have a backup, in case they get corrupted...
The communication protocol is I2C...