Enter to TV with Ex-Link on 3000.2 FW

[erdem_ua]

For enable serial access, you needed to revert back your linux kernel image too.
And your Utility Partition is also deleted (tbml4)...

[juusso]

It seems to be more dangerous...
If the procedure is like previous, i will do it. Now i need just missing partitions dumps. Could You help me? Is it important the version of firmware, or it is the same for all b series tv?

[erdem_ua]

Nop. Since you have working u-boot, it's not dangerous anymore. If you delete your TV Linux kernel completely, you can boot your TV from usb flash
Linux image has samsung's original code. So we cannot share it. Perhaps you can use kernel image partition (I forgot which partition is linux kernel image, is it tbml3? ) from your backup (you take backup, right?) or you might borrow from your friend...

You could also prepare new kernel from SamyGO Open embedded SVN...

[juusso]

No, i didn`t make backup before i instaled 3000.2. I made it just after downgrade (what a pity). Thank You anyway

...I forgot which partition is linux kernel image, is it tbml3...

Could You remember which exactly partitions do i need?

...You could also prepare new kernel from SamyGO Open embedded SVN...

I have ubuntu server 10.4 x64 mashine runing. I tried setup SamyGO Open embedded SVN as in wiki. Installation was OK. Now i try run bitbake and i get this error:

Code: Select all

user@www:~/samygo/oe/trunk$ bitbake externalboot-base
/usr/lib/pymodules/python2.6/bb/COW.py:29: DeprecationWarning: the sets module is deprecated
  import types, sets
ERROR: Please set the 'PERSISTENT_DIR' or 'CACHE' variable.

manual export theese directories is w/o result.

p.s. Oh, i`m stupid... There is on the wiki

Code: Select all

  T-CHL5DSEUC, T-CHL5DEUC and T-CHU7DEUC

    * BOOTLOADER_DEVICE=/dev/bml0/2
    * FNW_DEVICE=/dev/bml0/4
    * KERNEL_DEVICE=/dev/bml0/5
    * RFS_DEVICE=/dev/bml0/6
    * BOOT_DEVICE=/dev/bml0/7 

I need then KERNEL_DEVICE=/dev/bml0/5 and what does it mean "utility partition"? What about /dev/bml0/3?

[juusso]

Success!

After tbml4 and tbml5 were rewritten - i can enter to TOP debug menu!
Topick is to change to [SOLVED] finaly! This information should be added to wiki i think

There are difference between partitions tbml6 and tbml7 and good ones from another TV, i have not decided yet if i need to rewrite these too.
One thing is not well: on terminal window i get continous error running:

Code: Select all

~~[Sub System Error] ChannelLnaMonitor.cpp:t_Monitor():141  - TD ERROR [0x80000000] !!!
 
 
 
        >>[ERR:TDiTuner.cpp] GetLnaStatus():91 Null Fuction Call !!!Must Check Implementation Code...
 
 
~~[Sub System Error] ChannelLnaMonitor.cpp:t_Monitor():141  - TD ERROR [0x80000000] !!!
 
 
 
        >>[ERR:TDiTuner.cpp] GetLnaStatus():91 Null Fuction Call !!!Must Check Implementation Code...
 
 
~~[Sub System Error] ChannelLnaMonitor.cpp:t_Monitor():141  - TD ERROR [0x80000000] !!!

i can`t focus input line, it always is gone somewhere, but it accepts commands well (its difficult to see what to type when this error always runs on the screen). Could this error come becouse i haven`t rewrite other partitions?

Btw, tbml1(not empty) and tbml3(empty) are identical to healthy TVs partitions.

[erdem_ua]

I don't know why those lines appears on your TV weird...
Hey,does any of member know something about it?

[juusso]

Go to my next post

[juusso]

Some Experience
by restoring deleted partitions

I made some experiments on my own TV.
1. tbml0/2 (u-boot) partition was erased and to confirm that, the dump after was made - here were only zeros. After TV reboot - no u-boot was found.
2. I remade tbml2 dump from working TV (empty bytes (ff ff) were removed from the end of the file with help of HEX editor)
3. The dump file was renamed to u-boot.bin and placed to USB/T-CHL7DEUC/image folder.
Basis for investigations was T-CHL7DEUC 2005.0 firmware upgrade file for LE40B653T5WXBT. I deleted exe.img, appdata.img and validinfo.txt from USB flash disk. The USB file structure was like:

Code: Select all

USB
--T-CHL7DEUC
----crc
----ddcmp
----MicomCtrl
----rc.local
----run.sh.enc
-----------image
---------------info.txt
---------------serial_temp
---------------u-boot.bin
---------------version_info.txt

4. USB was plugged in, TV asked for firmware upgrade. OK was pressed. Upgrade process was very short and without any errors.
5. After TV reboot i was able to enter to u-boot menu by pressing

Code: Select all

shift + "`"

I think this info can be helpful for safe restoring deleted partitions after reverting back from the latest firmware.

Few days later made another tests with T-CHL7DEUC 3000.2 firmware upgrade file on my TV. I upgraded my TV with T-CHL7DEUC_3000.2_step1.exe firmware. As i`ve expected bml2, bml4 were deleted and bml5 was changed by install process of this firmware.

I tried to add u-boot.bin, fnw.bin and Image to step1 USB upgrade file, but after upgrade i got all these partitions changed (no success)

Then i attached 3001.1_step2 upgrade USB(as is, all files were placed by installer) to TV and after TV noticed about new FW upgrade, i disconnected USB, deleted not required files, added theese three images (u-boot.bin, fnw.bin and Image). USB structure was like:

Code: Select all

T-CHL7DEUC
    ----image
    --------info.txt
    --------major_version
    --------minor_version
    --------version_info.txt
    --------u-boot.bin
    --------fnw.bin
    --------Image

After re-insertion of USB OK was pressed. Upgrade process was broken on about 60-70% and nothing was restored.
On ExLink log i got:

Code: Select all

Source : 5120  Window Type : 0  Back End Decoder Type : 4
ICPCFlashDevice  read size error : return size(524288)
ICPCFlashDevice  read size error : m_size = 0
errno = 0
ICPCFlashDevice  read size error : return size(524288)
ICPCFlashDevice  read size error : m_size = 0
errno = 0
sd 5:0:0:0: rejecting I/O to device being removed
Buffer I/O error on device sda1, logical block 15514
[DEV_USB    ] [bool CUsbEventService::SendEvent(int, int, int)] In... sdndMessageType:1394000   param1:45782088   param2:0
 
MESSAGE_USB_DISCONNECTED
sda: assuming drive cache: write through
sda: assuming drive cache: write through
FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[DEV_USB    ] [bool CUsbEventService::SendEvent(int, int, int)] In... sdndMessageType:1394000   param1:47289288   param2:0
 
[ROSE_ERROR ] [BackupUsbInfo:458] No More Data...
MESSAGE_USB_CONNECTED
&&&&&&&&&&&&&&&&& USB node ID = 0
==> Add Partition (0, 0, USB Flash Drive)
>>>@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
The Size of USB Device List (App) = 1
        Device Type = MSC Device
        Device ID = 0
        Device model = USB Flash Drive
        Device vendor = A-DATA
                Partition ID = 0
                Partition Path = /dtv/usb/sda1
                Partition FS = vfat
                Partition Serial = 8f619540c6063d
                Partition Devpath = 1
                Partition Lun = 0
                Capacity = [3935616/3936220]
                Storage ID = 0x0
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@<<<
 
 
fsrerase /dev/bml0/8
This program is operated over FSR based
The flash memory blocks have been erased successfully.

I deleted Image and repeated the test again. In this case upgrade process was successful, after reboot i got u-boot working and tbml4 was restored too. Few more tests were made but it didn`t help to restore kernel (Image). I tried to delete files from USB directly via telnet (to avoid re-insertion of USB), but always i got the same - with Image (alone or with u-boot.bin and fnw.bin) TV upgrade process broke. In all cases the bml0/8 partition was deleted on the beginning of upgrade (i didn`t notice this on the same tests on 2005.0 firmware).
The log was the same:

Code: Select all

Source : 5120  Window Type : 0  Back End Decoder Type : 4
ICPCFlashDevice  read size error : return size(524288)
ICPCFlashDevice  read size error : m_size = 0
errno = 0
ICPCFlashDevice  read size error : return size(524288)
ICPCFlashDevice  read size error : m_size = 0
errno = 0
fsrerase /dev/bml0/8
This program is operated over FSR based
The flash memory blocks have been erased successfully.

So no TOP debug menu until kernel image is restored. I flashed it by hand and i got another strange issue: TOP debug menu was available, but i got the console only by pressing ctrl+c. Not by entering 0x04 on TD debug menu:

Code: Select all

==============================
 [ TD Debug Menu ]
------------------------------
 0x01  : TDc Debug
 0x02  : TDi Debug
 
 0x03  : SDAL Debug
 0x04  : spI Debug
 0x05  : Sequence Test
------------------------------
 0xFF  : Exit Debug
------------------------------
TD>: 0x04
 
==============================
 [ TD Debug Menu ]
------------------------------
 0x01  : TDc Debug
 0x02  : TDi Debug
 
 0x03  : SDAL Debug
 0x04  : spI Debug
 0x05  : Sequence Test
------------------------------
 0xFF  : Exit Debug
------------------------------
TD>:

After restoring 2005.0 firmware everything was fine and this issue is gone. The february exe.DSP blocks console on TDM (but not by ctrl+c)

Any ideas?


How about
It would be great to make some rescue firmware upgrade set,that restores deleted partitions and in the same time disables watchdog (if it is ON) and sets debug option on ServiceMenu to have access via Ex-Link cable. Any suggestions?

[arris69]

...

How about
It would be great to make some rescue firmware upgrade set,that restores deleted partitions and in the same time disables watchdog (if it is ON) and sets debug option on ServiceMenu to have access via Ex-Link cable. Any suggestions?

question: its safe to update the tv with self compiled kernel ( aquadran ) (answered my self, its safe. this is the correct method to make a kernel flash Image from u[z]Image)

so may like this (image generation for openembedded):

Code: Select all

rootfs_postprocess() {
                install -d ${IMAGE_ROOTFS}/${MACHINE}/image
                # redistribute crc ddcmp MicomCtrl ? (MicomCtrl from svn?)
                # create partitions
                for i in u-boot.bin uboot_env.bin fnw.bin Image ; do
                        oenote "create $i"
                done
                # dd if=/dev/zero bs=1 count=${UBOOT_MAXSIZE} | tr '\0' '\377' > ${IMAGE_ROOTFS}/${MACHINE}/image/u-boot.bin
                # dd if=${DEPLOY_DIR_IMAGE}/${UBOOT_SYMLINK} of=${IMAGE_ROOTFS}/${MACHINE}/image/u-boot.bin conv=notrunc
                dd if=/dev/zero bs=1 count=${KERNEL_IMAGE_MAXSIZE} | tr '\0' '\377' > ${IMAGE_ROOTFS}/${MACHINE}/image/Image
                # original uImage has no comment (mkimage -n flag)? can we compress the kernel?
                dd if=${IMAGE_ROOTFS}/boot/uImage-2.6.18_SELP-ARM of=${IMAGE_ROOTFS}/${MACHINE}/image/Image bs=64 skip=1 conv=notrunc

                # do the work for info.txt          serial_temp       validinfo.txt     version_info.txt
                # some CIP has major_version minor_version
                # image/validinfo.txt
                # cksfv -b ${IMAGE_ROOTFS}/${MACHINE}/image/*.bin -b ${IMAGE_ROOTFS}/${MACHINE}/image/Image > \
                # ${IMAGE_ROOTFS}/${MACHINE}/image/validinfo.txt
                cksfv -b ${IMAGE_ROOTFS}/${MACHINE}/image/Image > ${IMAGE_ROOTFS}/${MACHINE}/image/validinfo.txt
                
                # image/serial_temp -> 2009.0
                echo "${FW_VER}" > ${IMAGE_ROOTFS}/${MACHINE}/image/serial_temp
                printf "%s" ${FW_VER} > ${IMAGE_ROOTFS}/${MACHINE}/image/minor_version
                echo "${FW_MAJO}" > ${IMAGE_ROOTFS}/${MACHINE}/image/major_version
                
                # image/info.txt -> T-CHL5DEUC 2009.0
                echo "${MACHINE} ${FW_VER}" > ${IMAGE_ROOTFS}/${MACHINE}/image/info.txt
                
                # image/version_info.txt -> SWU_T-CHL5DEUC_002009_I02_ES000DS000_100126
                echo "SWU_${MACHINE}_${FW_MAJO}_I02_ES000DS000_100126" > ${IMAGE_ROOTFS}/${MACHINE}/image/version_info.txt
}

[juusso]

I know why i haven`t got all partitions restored on 3000.2 and upgrade process broke - i have restored u-boot, fnw, kernel before i made these tests (how without insurance?). And after reinsertion of modified usb with images - upgrade process was not made because of no to upgrade required images on USB! Images on usb not differed from partitions on TV! It is now confirmed - if the partition restoration process is going on the first time (no try to restore missing partitions before) - everything is ok. If there is at least one (or more) of three images on USB, whitch were restored before - upgrade process bricks. If all images differs from partitions on TV, restoration will go without errors!

Another thing: kernel image (Image) is changed by installation process of februar firmware. Only one bit (compared february and not february dumps of tbml5) is changed. From 01 (can enter to top debug menu) to 00(cannot enter to top debug menu). The ability to enter to top debug menu is fully depending from this one bit in kernel. In T-CHL7DEUC TVs it is 0x0015c174 offset, in T-CHU7DEUC it is on 0x0015c174 too. I thing place is not important, may vary, but if you will search for hex code (hex byte):

Code: Select all

 60 1E 9F E5 00 30 A0 E3 00 30 82 E5

you will find right place next to this code (should be 00). (Here isn`t such hex code in whole kernel)
If tmbl4 is deleted, but right kernel is flashed, it is possible to enter to TDM. I don`t know actualy what fnw.bin does.

So i dont think we need to compile new kernel for enabling TOP debug menu. Its enough to patch it (is it possible to change this bit by "game" from content library?) like exe.img was patched by patcher! What do you think?