[How-To] Rollback on old FW...

[erdem_ua]

IF problem is only mv, than you can use cp instead of it. After you can delete local backup which equals mv command.

[ji035453]

I try to rollback LE40B750U1WXXH T-CHL7DEUC-3000.2 on firmware T-CHL7DEUC-2004.1, but unsuccessfully.

See the telnet session log. Everything proceed fine, but last command /mtd_exe/rc.local ended with Segmentation fault (core dumped). TV halted with black screen, I hesitate to restart TV, because I was affraid that it can lost telnet ability. So I just repeated this procedure again, but with backup of original appdata.img and exe.img. This time the last command /mtd_exe/rc.local ended with TV restart and TV is working, but with last firmware T-CHL7DEUC-3000.2.
Is there anybody wise enough who can look into the log and help me?

Code: Select all

localhost login: root
-sh: id: not found
# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/tbml6                3.1M      3.1M         0 100% /
none                     10.0M      4.0k     10.0M   0% /dtv
/dev/tbml7              896.0k    896.0k         0 100% /mtd_boot
none                     10.0M         0     10.0M   0% /mtd_ram
/dev/stl0/14             11.0M      1.7M      9.2M  16% /mtd_rwarea
/dev/tbml10              60.0M     51.0M      8.9M  85% /mtd_exe
/dev/tbml11              28.6M     28.6M         0 100% /mtd_appdata
/dev/stl0/13            189.0M    156.9M     32.1M  83% /mtd_tlib
/dev/stl0/15             50.0M      3.5M     46.5M   7% /mtd_contents
/dev/stl0/16             87.9M      5.4M     82.5M   6% /mtd_down
/dev/stl0/12            149.0M    145.1M      3.9M  97% /mtd_wiselink
/dev/stl0/17             87.0M    176.0k     86.8M   0% /mtd_swu
/dev/sda1                 3.7G      2.3G      1.4G  63% /dtv/usb/sda1
# /mtd_boot/MicomCtrl 23
# killall -9 exeDSP
# umount /mtd_exe
# umount /mtd_appdata
# cp /dtv/usb/sda1/exe.img /mtd_swu
# bml.erase /dev/bml0/10
This program is operated over FSR based
The flash memory blocks have been erased successfully.
# bml.restore /dev/bml0/10 /mtd_swu/exe.img
+----------------------------------------------------------------------+
| bml.restore : Low-level Partition Restore Tool for NAND Flash Memory |
+----------------------------------------------------------------------+
------------------  This is confirm message  ---------------------
/********  Check your options and selected partition  ***********/
Selected Flex-OneNAND device and 10 partition
  100%
All of the flash memory units have been restored successfully
# rm /mtd_swu/exe.img
# cp /dtv/usb/sda1/appdata.img /mtd_swu
# bml.erase /dev/bml0/11
This program is operated over FSR based
The flash memory blocks have been erased successfully.
# bml.restore /dev/bml0/11 /mtd_swu/appdata.img
+----------------------------------------------------------------------+
| bml.restore : Low-level Partition Restore Tool for NAND Flash Memory |
+----------------------------------------------------------------------+
------------------  This is confirm message  ---------------------
/********  Check your options and selected partition  ***********/
Selected Flex-OneNAND device and 11 partition
  100%
All of the flash memory units have been restored successfully
# rm /mtd_swu/appdata.img
# mount -t auto /dev/tbml10 /mtd_exe
# mount -t auto /dev/tbml11 /mtd_appdata
# /mtd_exe/rc.local
##### System Execution!!! #####
~~[SSPF] [FastBoot.cpp] Initialize, FAST INIT
TDaStore Building...
TDaTuner0 Building...
TDaDemodulator0 Building...
TDaTuner1 Building...
TDaDemodulator0 Building...
TDaTuner2 Building...
TDaDemodulator1 Building...
TDaTuner Building...
TDaDemodulator Building...
TDaTuner Building...
TDaDemodulator Building...
TDaAudioAmp0 Building...
TDaAudioAmp1 Building...
TDaSystem Building...
TDaAudioProcessor Building...
TDaScaler0 Building...
TDaScaler1 Building...
TDaAnalogVideoProcessor Building...
TDaDemux 0 Building...
TDaDemux 1 Building...
TDaMpeg Building...
TDaCompProcessor Building...
TDaHdmiProcessor Building...
TDaPcProcessor Building...
TDaHdmiSwitch Building...
TDaCommonInterface Building...
TDaFeeder Building...
TDaImage Building...
TDaTeleText Building...
TDaRecorder Building...
TDaAnalogVideoSwitch Building...
TDaStore PC DDC Building...
TDaStore HDMI1 DDC Building...
TDaStore HDMI2 DDC Building...
TDaStore HDMI3 DDC Building...
TDaStore HDMI4 DDC Building...
FRCQ TDaPanel0[LCD] Building...
TDaVideoEnhancer0[LCD] Building...
TDaPanel1[PDP] Building...
TDaVideoEnhancer1[PDP] Building...
~~[SSPF] [FastBoot.cpp] Initialize, [ResetBoard] Thread_ID=0x40cab490 : CREATE
~~[SSPF] [FastBoot.cpp] ResetBoard, Called...
############## Find Factory.dat File in mtd_exe ##################

                FixedId : Nvram[94] vs File[94]

                WBId : Nvram[70] vs File[70]
=== USE BSP RESET ===
~~[SSPF] [FastBoot.cpp] ResetBoard, m_semReset.Give

                EERId : Nvram[359] vs File[359]

                FACId : Nvram[89] vs File[89]
=== Chelsea register = 0x2710360 is CHELSEA1
Calling MJPEG Init
spIMfd_Init :: ERROR  85235fff
spIPvr_Init :: ERROR  8520fff2
ID_SELECT_LCD PDP:LCD,GPIO_LCD_PDP SEL:LCD
~~[SSPF] [FastBoot.cpp] Initialize, [InitializeCiMachine] Thread_ID=0x583e5490 : CREATE
~~[SSBD] [SsBuilder.cpp] Build, Product Type : LCD !!
~~[SSBD] [SsBuilder.cpp] Build, SsStore Building
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000001, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000002, bEnable = 1
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00020000, bEnable = 1
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00040000, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000400, bEnable = 1
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00080000, bEnable = 1
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000100, bEnable = 1
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00004000, bEnable = 1
~~[SSBD] [SsBuilder.cpp] Build, SsInfo Main Window Building
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000001, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000002, bEnable = 1
~~[SSBD] [SsBuilder.cpp] Build, SsInfo Pip Window Building
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000001, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000002, bEnable = 1
~~[SSBD] [SsBuilder.cpp] Build, SsInfo Speaker Main Building
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000001, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000002, bEnable = 1
~~[SSBD] [SsBuilder.cpp] Build, SsInfo Speaker Earphone Building
~~[SSPF] [FastBoot.cpp] InitializeCiMachine, Called...
~~[SSPF] [FastBoot.cpp] InitializeCiMachine, m_semCim.Give
~~[SSBD] [SsBuilder.cpp] Build, SsPlatform Building
~~[SSBD] [SsBuilder.cpp] Build, SsFrontEnd Main Building
~~[SSBD] [SsBuilder.cpp] Build, SsFrontEnd Pip Building
~~[SSBD] [SsBuilder.cpp] Build, SsWindow Main Building
~~[SSBD] [SsBuilder.cpp] Build, SsWindow Pip Building
~~[SSBD] [SsBuilder.cpp] Build, SsPicture Building
~~[SSBD] [SsBuilder.cpp] Build, SsSound Main Building
~~[SSBD] [SsBuilder.cpp] Build, SsSound Earphone Building
~~[SSBD] [SsBuilder.cpp] Build, SsKeyInput Building
~~[SSBD] [SsBuilder.cpp] Build, SsExeFactory Building
~~[SSBD] [SsBuilder.cpp] Build, SsTvInfo Main Building
~~[SSBD] [SsBuilder.cpp] Build, SsTvInfo PIP Building
~~[SSBD] [SsBuilder.cpp] Build, SsMem Building
~~[SSBD] [SsBuilder.cpp] Build, SsEventList Building
~~[SSBD] [SsBuilder.cpp] Build, SsUartNetwork Main Building
~~[SSBD] [SsBuilder.cpp] Build, CAutoWallMount PIP Building
~~[SSBD] [SsBuilder.cpp] Build, CAutoAVControl Building
~~[SSBD] [SsBuilder.cpp] Build, CFAnet Building
~~[SSBD] [SsBuilder.cpp] Build, CCloneControl Building
~~[SSBD] [SsBuilder.cpp] Build, SsDebug Building
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000001, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000002, bEnable = 1
~~[SSBD] [SsBuilder.cpp] Build, SsInfo Recordl Window Building
~~[SSBD] [SsBuilder.cpp] Build, SsFrontEnd Recordl Building
~~[SSBD] [SsBuilder.cpp] Build, SsWindow Recordl Building
~~[SSBD] [SsBuilder.cpp] Build, SsTvInfo Recordl Building
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000001, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00000002, bEnable = 1
~~[SSBD] [SsBuilder.cpp] Build, SsInfo Scart Window Building
~~[SSBD] [SsBuilder.cpp] Build, SsFrontEnd Scart Building
~~[SSBD] [SsBuilder.cpp] Build, SsWindow Scart Building
~~[SSBD] [SsBuilder.cpp] Build, SsTvInfo Scart Building
~~[SSPF] [FastBoot.cpp] Initialize, SsExeFactory->LoadFactoryData
~~[SSPF] [FastBoot.cpp] Initialize, SsInfo.Created
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00008000, bEnable = 0
~~[SSPF] [SsInfoBase.cpp] SetFunctionState, eFunction=0x00001000, bEnable = 1
~~[SSPF] [FastBoot.cpp] Initialize, SsKeyInput.Created()
SsUartNetwork::AddElement
SsUartNetwork::AddElement
SsUartNetwork::AddElement
~~[SSPF] [FastBoot.cpp] Initialize, SsFrontEndCreateOption
~~[SSFE WINDOW_MAIN] [SsFrontEnd.cpp] Create, Set MFT_Range [32]
~~[SSFE WINDOW_MAIN] [ChannelControl.cpp] Create, Called...
~~[SSFE WINDOW_MAIN] [SourceControl.cpp] Create, Called...
~~[SSPF] [FastBoot.cpp] Initialize, m_semReset.Take
~~[SSPF] [FastBoot.cpp] Initialize, [InitializeFRC] Thread_ID=0x58e47490 : CREATE
~~[SSPF] [FastBoot.cpp] InitializeFRC, Called...
?? Model : 6, Panel Inch : 14, SubWoofer : 1
I2C ERROR: src/spII2c.c, spII2c_SubaddrWrite
[DEVI2C ERROR: drv_iic_RW_Chelsea(738)]i2c write operation failed
[DEVI2C ERROR: drv_iic_RW_Chelsea(739)]requested channel : 0
[DEVI2C ERROR: drv_iic_RW_Chelsea(740)]requested chip id : 0x4a
[DEVI2C ERROR: drv_iic_RW_Chelsea(750)]requested sub addr : 0x0
[DEVI2C ERROR: drv_iic_RW_Chelsea(757)]requested byte count : 1
FRC_INIT_TYPE -> 240HZ
FRC_M [0x1082]:0x0100 [retry:0]
FRC_M NVM STATUS ERROR
FRC_S [0x1082]:0x0100 [retry:0]
FRC_S NVM STATUS ERROR
E_FRCQ_M_REBOOT
=====================================WM8593 Sleep 0=====================================
E_FRCQ_S_REBOOT
=====================================WM8593 Sleep=====================================
Segmentation fault (core dumped)
#

[erdem_ua]

You cannot restart exeDSP via running "/mtd_exe/rc.local". If you make it, it's perfectly normal that have a crash.
You needed to restart TV.

[ji035453]

You cannot restart exeDSP via running "/mtd_exe/rc.local". If you make it, it's perfectly normal that have a crash.
You needed to restart TV.

Sorry, but did you read the first post of this thread with procedure, step by step?
You can even test it yourself:

Code: Select all

killall -9 exeDSP
/mtd_exe/rc.local

[erdem_ua]

Yes, you right. Some TV's are looks working after such an update. My TV simply doesn't works after killing exeDSP than running rc.local. Give me black screen with channel information that upside down but no image. Don't remember if there is any core dump generated but I can say TV does not working... There could be difference between B7000 vs B650. If you feel doubt about bricking, don't flash it

There is a question comes my mind now. How about alternative firmware?
We cannot switch alternative firmware via TV menus because it's blocked.
Could you try to dump alternative mtd_exe partition? Is older firmware present at that location?
If there is older firmware, we can just change partition by hand via placing PartitionSwitch_1_0 like file to /mtd_rwarea and could recover TV's without manually flashing device which is more safe than first approach I think.

[ji035453]

If I updated with backup of original 3000.2 appdata.img and exe.img whole procedure worked according the first post, but if I updated with 2004.1's appdata.img and exe.img the same procedure ended with Segmentation fault.

Some TV's are looks working after such an update. My TV simply doesn't works after killing exeDSP than running rc.local. Give me black screen with channel information that upside down but no image. Don't remember if there is any core dump generated but I can say TV does not working... There could be difference between B7000 vs B650. If you feel doubt about bricking, don't flash it

It is crucial information for me, if it is normal for some Samsung models behave as I describe - with Segmentation fault. I haven't B650, but B750. I try to avoid bricking and I am scared because no other one has problem that I described. That is the reason, that I didn't try to manually restart TV with power Off/On.

There is a question comes my mind now. How about alternative firmware?
We cannot switch alternative firmware via TV menus because it's blocked.
Could you try to dump alternative mtd_exe partition? Is older firmware present at that location?
If there is older firmware, we can just change partition by hand via placing PartitionSwitch_1_0 like file to /mtd_rwarea and could recover TV's without manually flashing device which is more safe than first approach I think.

How can I dump alternative mtd_exe partition?

[erdem_ua]

You can find it at your TV's /dev/tbml devices.
At my B650, tbml8 and tbml10 are contains mtd_exe partitions. One is real image and other is backup image.
You can use dd, cat and bml tools to copy that partition whic is already described on firmware dump article...

[ji035453]

You can find it at your TV's /dev/tbml devices.
At my B650, tbml8 and tbml10 are contains mtd_exe partitions. One is real image and other is backup image.
You can use dd, cat and bml tools to copy that partition whic is already described on firmware dump article...

Did you read my telnet session log? I have no tbml8. Does it mean, that fw 3000.2 kill this partition already?

[erdem_ua]

Yes I look some. df tool shows only mounted partitions. You needed to have /dev/tbml8 please login via telnet than

Code: Select all

cd /dev
ls

and see if you have tbml8 or not...