Damaged Samsung BD-P1620 after firmware upgrade

Piorun

Standard Member
Joined
Mar 16, 2010
Messages
30
Reaction score
4
Points
4
I bought two damaged players on eBay and I'm trying to fix them (display is showing "LOAD").

I expected that main PCB should be BD-P1620, however there is a BD-P3600 (on NAND is label BD-P1620A and no SATA port installed).

Is this OK or I bought fake hardware.

Which firmware version I should use - for DB-P3600 or DB-P1620 or DB-P1620A ?

************ Edit: several hours later ***********

I connected serial console, boot loader is running, but I don't have any idea how to extract firmware from RUF file and run it ?
Code:
BCM74430010
Setting NAND Params

CFE starting from ROM
SoooooooooooooR

Starting code in RAM
Before:
Secure Boot is enabled.
Public Key Index = 0.
Market ID = 0.
Epoch = 0.

Programming OTP bits.
Pub key index is programmed
Market ID is programmed
Epoch is programmed
Enable bit is programmed

After:
Secure Boot is enabled.
Public Key Index = 0.
Market ID = 0.
Epoch = 0.

Booting Secured CFE...


BCM97601 B0-BSEC  CFE v2.1.12 (CFE core v2.1, BSP_REV 12), Endian Mode: Little
Build Date: Tue May 19 14:46:23 KST 2009 ([email protected])
Copyright (C) Broadcom Corporation.



DDR                        : Bank0:128MB@400MHz | Bank1:256MB@400MHz
NAND Boot                  : FlashSize 64MB on CS0, BlkSize 16KB, PgSize 512B
NAND vendor timing         : 20762076 ST NAND512W3A SLC  t1(32622226) t2(676)

Macrovision is enabled

Display splash screen
Using valid user input parameters - Resolution 480p on Component
[ Default Video ] :  Current Video Output : Component @ Resolution : 480p
Loading NTSC SD image only to 0x027f4800 size 691200 bytes
Reading flash0.splash to V:0xa27f4800 from offset 0 len 691200
Copying NTSC SD image to 0x02400000 size 691200 bytes
Done displaying splash screen
Reading flash0.splash to V:0xa2fadc00 from offset 691200 len 44
Wav audio not found
Trying to load audio splash from offset: 0xa8c00, result: -1
Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock2 conso                                                                                    le=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console ro
Loading: 0x80008000/4440608 0x80444220/289920
 Not a secure elf image, cannot load/boot !!!!
Entry address is 0x00000000
CFE> ?
Invalid command: "?"
Available commands: info, splashsd, splash, loop, dir, macprog, macprog2, flashmarkbb, flasherase, flasheeprom, flash, memtest, f, e,                                d, u, reboot, batch, go, load, save, boot, ping, ifconfig, sleep, show, unsetenv, printenv, setenv, help

*** command status = -1
CFE>
 
Last edited:
Sorry I can offer no solution to your problem - although I'm having exactly the same problem with a BD-P1620 bought from ebay.

As soon as I upgraded the firmware the word LOAD appears, and I either get a distorted boot screen, or nothing at all.

On further inspection I've also found the main PCB is marked BD-P3600 and not BD-P1620 - so assume I've unknowingly bricked the player by installing the wrong firmware version. This might of been a good thing to mention on the ebay item description grrrr :mad:

Anyway back to the point - how exactly are you connecting to the player? I've used a serial console to connect & upgrade/downgrade nokia firewalls before - but that was quite a few years ago now.

.............my next plan is to replace the PCB
 
>PCB is marked BD-P3600 and not BD-P1620 - so assume I've unknowingly bricked the player by installing the wrong firmware version.
I think there are two versions of BD-P1620 player
BD-P1620 on PCB BD-P1620
BD-P1620A on PCB BD-3600 (with limited by firmware functionality)

>how exactly are you connecting to the player?
There is a OPUCN1 connector (15 Pins)
Code:
OPUCN1 pinouts:
|1 3 5.....13  15|
 \2 ..........14/

1 TX
3 RX
13 3.3V
15 GND

COM : 115200,n,8,1 and you have to use TTL -> RS232 converter

>.............my next plan is to replace the PCB
PCB perhaps is fine, you need to download right vmlinux.gz kernel.

My player has one bad row in flash - this is the reason why CFE boot loader can't check firmware signature.

If you will able to connect console, pls send to me flash_nand dump. I will try to merge both images to obtain valid vmlinux-secure-signed.gz file:

Code:
configure TFTP server and ENABLE write (like tftpd32.exer)
CFE>ifconfig ... <- set IP, mask - 'help ipconfig'
CFE>save 192.168.x.y:flush_dump 0x1fc00000 0x4000000
 
Last edited:
I did small step forward, I got shell:

Code:
# uname -a
Linux (none) 2.6.24.7_446-uclibc-brcm #3 Tue Dec 1 00:42:53 EST 2009 7601 unknown
 
# cat /proc/cpuinfo
system type             : BCM97xxx Settop Platform
processor               : 0
cpu model               : MIPS 24K V7.12
cpu MHz                 : 334.84
BogoMIPS                : 334.84    ( udelay_val : 167424  HZ = 1000 )
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 64
extra interrupt vector  : yes
hardware watchpoint     : yes
ASEs implemented        : mips16
shadow register sets    : 1
VCED exceptions         : not available
VCEI exceptions         : not available
 
## cat /proc/hwinfo
CFE_BOARDNAME:                  BCM97601 B0-BSEC
CFE Version Magic Number:       0x0002010c
CFE SUN_TOP_CTRL_PROD_REVISION: 0x74430010
Flash Type:                     NAND
Number of Flash Partitions:     12
-   Partition 0: Name: flash0.cfe, Base 0x00000000, Offset 0x00000000, Size 0x00180000
-   Partition 1: Name: flash0.kernel, Base 0x00000000, Offset 0x00180000, Size 0x00500000
-   Partition 2: Name: flash0.rootfs, Base 0x00000000, Offset 0x00680000, Size 0x02800000
-   Partition 3: Name: flash0.pstor, Base 0x00000000, Offset 0x02e80000, Size 0x007fc000
-   Partition 4: Name: flash0.splash, Base 0x00000000, Offset 0x0367c000, Size 0x00140000
-   Partition 5: Name: flash0.drmregion, Base 0x00000000, Offset 0x037bc000, Size 0x00020000
-   Partition 6: Name: flash0.rawnvr, Base 0x00000000, Offset 0x037dc000, Size 0x000c0000
-   Partition 7: Name: flash0.macadr, Base 0x00000000, Offset 0x0389c000, Size 0x00004000
-   Partition 8: Name: flash0.nvram, Base 0x00000000, Offset 0x038a0000, Size 0x00020000
-   Partition 9: Name: flash0.swap, Base 0x00000000, Offset 0x038c0000, Size 0x00640000
-   Partition 10: Name: flash0.bbt, Base 0x00000000, Offset 0x03f00000, Size 0x00100000
-   Partition 11: Name: flash1.all, Base 0x00000000, Offset 0x00000000, Size 0x04000000
 
Number of UARTS:                1
-   UART 0: Channel 0, Base_Address 0xb0400b00, Divisor 0x0000002c, Baud_Rate 0x0001c200, Data_Length 8, StopBits_Flag 0
DDR Bank 0 Size (MB):           128
DDR Bank 1 Size (MB):           256
Number of Ethernet controllers: 1
-   Enet Controller 0: MAC Address 0x00 23 99 xx xx xx
I use kernell from Momitsu player (same Broadcom BCM97xxx procesor) - usefully only for boot, this image can't play BR/CD

There are tools to manipulate nand memory: /bin/nanddump and /bin/nandwrite.
I'm still looking for volunteer who can connect rs232 console to do kernel dump.
This can be first step to create BR region free image.
 
Last edited:
I also have one of these players and am keen to fix it,
what is a OPUCN1 does it have another name, how do you buy the relevant connector to rs232 port
 
The name are: OPUCN1 - board BD-P3600 or UCON1 for board BD-P1600
You need to use standard RS-232 -> TTL converter (MAX 232)
 
Last edited:
Ok, I my convertor, its has four pins, I have placed it on the card and set up hyper terminal to connect... i am not seeing any text.
 
Ok, I my convertor, its has four pins, I have placed it on the card and set up hyper terminal to connect... i am not seeing any text.

Do you have a splash screen on TV (bluish background)
if not -> bootloader doesn't start so you have hardware problem or bootlader is demaged - I don't have idea how to fix it

if yes -> check converter
disconnect pins 1 and 3 and connect them together, in terminal window echo should works (you will see what you type)
 
I connected serial console, boot loader is running, but I don't have any idea how to extract firmware from RUF file and run it ?

@PIORUN:

My Samsung BD-P1600 blu-ray player only displays "LOAD" after a failed firmware update. Nothing else works.

I'm also trying to find a solution.

From your description, does my player have a damaged kernel or CFE bootloader?...Is this stored in the Broadcom chip? or in the NAND?

Do you know how to program the NAND with a damaged bootloader?

I think we can obtain the correct firmware file for our players directly from the RUF file...

These Samsung blu-ray players use a Broadcom chipset. The Broadcom processor uses MIPS processor code.

The RUF firmware file from Samsung website is just a compiled version of MIPS code (MIPS32). I don't think it's encrypted.

Since the RUF file is actually a MIPS32 memory dump file, you can use a MIPS disassembler to extract the RAW firmware. I think there are free MIPS "disassembler" programs on the internet, but I have not extracted the firmware yet.

I can build an RS232-TTL converter to connect to the serial console, but I need help:

1) What serial program did you use?
2) What COMMANDS you use? I don't know how to interact with the CFE using serial console?
3) What commands can we use to read/write the firmware?

I look forward to your reply.
 
> my player have a damaged kernel or CFE bootloader?
>Is this stored in the Broadcom chip? or in the NAND?
NAND

>I think we can obtain the correct firmware file for our
>players directly from the RUF file...
RUF file is encrypted ...

>1) What serial program did you use?
any :) (I use putty.exe)

>2) What COMMANDS you use? I don't know how to interact with the CFE using serial console?
CFE>HELP

Here are: kernell, rootfs, and short instruction how to boot player.
Update: 150316
RecoveryFlash_SamsungBDP1620A_MainBoard3600.zip - Rapidu.net
RecoveryFlash_SamsungBDP1620_MainBoard1600.zip - Rapidu.net

Скачать файл RecoveryFlash_SamsungBDP1620_MainBoard1600.zip. Скачать бесплатно и без регистрации с TurboBit.net
Скачать файл RecoveryFlash_SamsungBDP1620A_MainBoard3600.zip. Скачать бесплатно и без регистрации с TurboBit.net
 
Last edited:
@ PIORUN:

Thanks for sharing the recovery flash for your player.

I have a few more questions:

1) My player shows only LOAD... Do you know what partition is corrupt? kernel or rootfs?

2) Is partition "mtd10" a duplicate copy of all other partitions combined, just stored in a different offset in the NAND?

Can I extract each partition separately and then compare (for example) partition "mtd1" (kernel) with partition "mtd10" (all) offset 0x00180000 to 0x00680000?

Will this show my problem? then I can check "mtd2" the same way? If yes, then can I extract the good version from "mtd10" and replace my damaged one in "mtd1" ? Unless"mtd10" is damaged also?

3) Your player is BD-P1620 or BD-P1620A but mine is BD-P1600.. Can I use your kernel and rootfs or will there be problem?

4) What are the commands to extract/dump each partition from the NAND? Is it "nanddump"? I assume the command will store the dump on the NFS, and then I would need to transfer the file to my computer?

5) Is the nandwrite command part of the rootfs_XXXX.tgz file?

Sorry for all the questions. Thanks for your help.
 
>1) My player shows only LOAD... Do you know what partition is corrupt? kernel or rootfs?
You have to send log from console ..

>2) Is partition "mtd10" a duplicate copy of all other partitions combined, just stored in a different offset in the NAND?
this is not a COPY - raw NAND

>Can I extract each partition separately and then compare (for example) partition "mtd1" (kernel) with partition "mtd10" (all) offset 0x00180000 to 0x00680000?
I hope (I didn't test it)

>3) Your player is BD-P1620 or BD-P1620A but mine is BD-P1600.. Can I use your kernel and rootfs or will there be problem?
AFAIK BD-1600 has the same MB/CPU like BD-P1620

>4) What are the commands to extract/dump each partition from the NAND? Is it "nanddump"? I assume the command will store the dump on the NFS, and then I would need to transfer the file to my computer?
yes

>5) Is the nandwrite command part of the rootfs_XXXX.tgz file?
this is unsquashed rootfs (mtd2)
 
english plz :confused:

did you get it to work? if so, did you crack the region?
 
Piorun,

I am trying to unbrick my BD-P1600, when it boots, this is what it reads:


BCM74430010
Setting NAND Params
CFE starting from ROM
SoooooooooooooR
Starting code in RAM
Before:
Secure Boot is enabled.
Public Key Index = 0.
Market ID = 0.
Epoch = 0.
Programming OTP bits.
Pub key index is programmed
Market ID is programmed
Epoch is programmed
Enable bit is programmed
After:
Secure Boot is enabled.
Public Key Index = 0.
Market ID = 0.
Epoch = 0.
Booting Secured CFE...

BCM97601 B0-BSEC CFE v2.1.16 (CFE core v2.1, BSP_REV 16), Endian Mode: Little
Build Date: Thu Jun 4 13:52:15 KST 2009 ([email protected])
Copyright (C) Broadcom Corporation.

DDR : Bank0:128MB@400MHz | Bank1:256MB@400MHz
NAND Boot : FlashSize 64MB on CS0, BlkSize 16KB, PgSize 512B
NAND vendor timing : 20762076 ST NAND512W3A SLC t1(43535224) t2(80000b78)
Macrovision is enabled
Display splash screen
Using valid user input parameters - Resolution 480p on Component
[ Default Video ] : Current Video Output : Component @ Resolution : 480p
Loading NTSC SD image only to 0x027f4800 size 691200 bytes
Reading flash0.splash to V:0xa27f4800 from offset 0 len 691200
Done displaying splash screen
Reading flash0.splash to V:0xa2fadc00 from offset 691200 len 44
done....Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console ro
Loading: 0x80008000/4694560 0x80482220/294208
Not a secure elf image, cannot load/boot !!!!
Entry address is 0x00000000
CFE>



If I CTRL - C during boot it gives me:

Automatic startup canceled via Ctrl-C
CFE>


At this point I am trying to follow your instructions, I can set the IP address, but then I don't understand where you are executing the dumping rootfs and kernel.... ie from what program? I am using PUTTY and trying to use OpenTFTP Server.

Anytime I execute:

boot -elf -z -tftp 192.168.10.77:kernel.gz

It tells me:

Loader:elf Filesys:tftp Dev:(null) File:192.168.10.77:kernel.gz Options:(null)
Loading: Failed.
Could not load kernel.gz: File not found
*** command status = -18


Any help would be appreciated.

Thanks!
 
>Loading: 0x80008000/4694560 0x80482220/294208
>Not a secure elf image, cannot load/boot !!!!
Unfortunately I don't have kernel/rootfs_dump for BD-P1600, however you could try BD-P1620 – the same mother board …
Code:
[URL="http://rapidshare.com/files/429938601/RecoveryFlash_SamsungBDP1620_MainBoard1600.zip"][COLOR=#000000]http://rapidshare.com/files/42993860...nBoard1600.zip[/COLOR][/URL]


>boot -elf -z -tftp 192.168.10.77:kernel.gz
192.168.10.77 - sever wih TFTPD / OpenTFTPD ...
kernel.gz - this file must be in TFTD /root_share_dir
 
the player is a BD-P1600 w/3600 board.

1.)You have serial connection between Comp and BDP?

2.)You have Ethernet connection between Comp and BDP?

From what terminal do you use the "nandwrite" command?

Thanks
 
When I enter the following at CFE>

splashsd -480p;boot -elf -z flash0.kernel: 'root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=n BAPP_OUT=/dev/console single ro'

I get:

Display splash screen
Using valid user input parameters - Resolution 480p on Component
[ Default Video ] : Current Video Output : Component @ Resolution : 480p
Loading NTSC SD image only to 0x027f4800 size 691200 bytes
Reading flash0.splash to V:0xa27f4800 from offset 0 len 691200
Done displaying splash screen
Reading flash0.splash to V:0xa2fadc00 from offset 691200 len 44
done....Loader:elf Filesys:raw Dev:flash0.kernel File: Options:root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=n BAPP_OUT=/dev/console single ro
Loading: 0x80008000/4694560 0x80482220/294208
Not a secure elf image, cannot load/boot !!!!
Entry address is 0x00000000
*** command status = 0
CFE>


No Shell...

Any tips?
 
When I enter the following at CFE>

splashsd -480p;boot -elf -z flash0.kernel: 'root=/dev/romblock2 console=0,115200n8 BDVD_BOOT_AUTOSTART=n BAPP_OUT=/dev/console single ro'

Loading: 0x80008000/4694560 0x80482220/294208
Not a secure elf image, cannot load/boot !!!!
?
You have to load kernel from net instead of /dev/romblock2, check readme ....boot -elf -z -tftp server_ip:kernel.gz
 
So close!

Turns out an issue with my Windows7 firewall, when I switched to XP computer, now can get to point where it is looking for Root-NFS, but errors out.

What do you use for NFS server?
 
The TFTP file transfer continuously errors out when trying to boot the kernel.gz, error is that file size is too big, that memmory is full on BD-P1600. I tested with 0kb file named kernel.gz, was able to transfer file. Any suggestions? clear flash?

Thanks in advance
 
the CFE hangs at this spot:

CFE> ifconfig eth0 -addr=192.168.10.78 -mask=255.255.255.0 -gw=192.168.10.2 -dns =192.168.10.2
100 MB Full-Duplex (auto-neg)
Device eth0: hwaddr 00-23-99-23-A5-50, ipaddr 192.168.10.78, mask 255.255.255.0
gateway 192.168.10.2, nameserver 192.168.10.2
*** command status = 0
CFE> boot -elf -z -tftp 192.168.10.77:kernel.gz "ip=192.168.10.78:192.168.10.2:1 92.168.10.2:255.255.255.0:bdp::eek:ff root=/dev/nfs ro nfsroot=192.168.10.77:/bdp/1 620 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console rw"
Loader:elf Filesys:tftp Dev:eth0 File:192.168.10.77:kernel.gz Options:ip=192.168.10.78:192.168.10.2:192.168.10.2:255.255.255.0:bdp::eek:ff root=/dev/nfs ro nfsroot=192.168.10.77:/bdp/1620 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console rw
Loading: 0x80008000/4694560 0x80482220/294208
Successfully loaded secure elf image....
Entry address is 0x80322450
Closing network.
Starting program at 0x80322450

[4294667.296000] -- DDR Bank 0: 128 MB
[4294667.296000] -- DDR Bank 1: 256 MB
[4294667.296000] Linux version 2.6.24.7_257-uclibc-brcm (
root@monster) (gcc version 4.2.0 20070124 (prerelease) - BRCM 9ts-20080702) #5 Thu Mar 11 18:40:18 KST 2010
[4294667.296000] Kernel command line: ip=192.168.10.78:192.168.10.2:192.168.10.2:255.255.255.0:bdp::eek:ff root=/dev/nfs ro nfsroot=192.168.10.77:/bdp/1620 console=0,115200n8 BDVD_BOOT_AUTOSTART=y BAPP_OUT=/dev/console rw
[4294667.361000] DIGSIG: no valid key, digsig security disabled
[4294667.364000] registering PCI controller with io_map_base unset
[4294667.365000] registering PCI controller with io_map_base unset
[4294667.367000] PCI: Failed to allocate mem resource #6:20000@b0520000 for 0000:01:00.0
[4294667.389000] Driver 'sd' needs updating - please use bus_type methods
[4294667.395000] Driver 'sr' needs updating - please use bus_type methods
[4294668.181000] scsi 0:0:0:0: CD-ROM SAMSUNG SPE-230S 1.06 PQ: 0 ANSI: 5
[4294668.197000] sr 0:0:0:0: Attached scsi generic sg0 type 5
[4294668.203000] brcmnand_probe: Found SLC device ST NUMONYX_NAND512W3A
[4294668.210000] ISR_isr: Lost interrupt
[4294668.214000] brcmnand_scan : This driver is performing physical to logical mapping [XOR with 0x1FC00000]
[4294668.225000] Creating 11 MTD partitions on "bcm7xxx-nand.0":
[4294669.053000] IP-Config: Complete:
[4294669.056000] device=eth0, addr=192.168.10.78, mask=255.255.255.0, gw=192.168.10.2,
[4294669.065000] host=bdp, domain=, nis-domain=(none),
[4294669.070000] bootserver=192.168.10.2, rootserver=192.168.10.77, rootpath=
[4294669.078000] Looking up port of RPC 100003/2 on 192.168.10.77
[4294670.053000] eth0 Link UP.
[4294670.117000] Looking up port of RPC 100005/1 on 192.168.10.77



tftp log file states this:

2010-12-15 16:06:14,767 [3] INFO TFTPServer.Service.PacketParser.RequestPacket - Received request packet, file name: kernel.gz, transfer mode: binary, block size: , tsize: , timeout:
2010-12-15 16:06:14,767 [6] INFO TFTPServer.Service.ConnectionPool - Beginning processing GET request from 192.168.10.78:1973, file name: kernel.gz, transfer mode: binary,
2010-12-15 16:06:16,640 [3] INFO TFTPServer.Service.PacketParser.ErrorPacket - <log4net.Error>Exception during StringFormat: Input string was not in a correct format. <format>Received error packet, code: {0}, message: {1w}.</format><args>{Disk full or allocation exceeded, transfer cancelled}</args></log4net.Error>
2010-12-15 16:06:16,640 [3] INFO TFTPServer.Service.TransmissionGet - Received error packet, tearing down connection. Error code: Disk full or allocation exceeded, message: transfer cancelled
 
What is this post about? Can we all get into the BDP and try to fix errors? Sorry, for this noob question.
 

The latest video from AVForums

Is Home Theater DEAD in 2024?
Subscribe to our YouTube channel
Back
Top Bottom