leaptv-debrick
Debricking the LeapTV after using saveenv in u-boot (dont do that, u-boot is misconfigured!). Raspberry pi's SPI pins are used with flashrom to read the rom, combine data, and reflash.
Comments
-
on 2016-Jan-18 20:58:57 jbevren said Note that I read out /dev/mtd0 from within the LeapTV before doing any experimentation. This saved my device, and I strongly recommend backing up raw flash images before doing anything with any device. ;)
/dev/mtd0 only returns 504k of data, so I had to read the whole ROM using flashrom first, which gave me the last 8k. This was cut off with dd and concatenated with cat to rebuild a working flash image.
flashrom -p linux_spi:dev=/dev/spidev0.0 -r 2016010801.bin
dd if=2016010801.bin of=last8k.bin bs=516096 skip=1
cat mtd0 last8k.bin > rewrite.bin
flashrom -p linux_spi:dev=/dev/spidev0.0 -E
flashrom -p linux_spi:dev=/dev/spidev0.0 -w rewrite.bin
If you didn't read the image's summary, this is caused by using 'saveenv' in u-boot. U-boot puts the environment at 0x4000 in the flash chip, which holds other items that are apparently necessary for starting u-boot. -
on 2016-Jan-18 21:10:37 jbevren said I almost forgot- here's the test points I used.
leaptv rom signal color pi
tp709 pin1 /cs green 24
tp711 pin2 do yellow 21
tp900 pin3 /wp
(gnd) pin4 vss black 25
tp712 pin5 di blue 19
tp710 pin6 clk red 23
(nc) pin7 /hold
(3.3v) pin8 vcc
I powered the ROM by allowing the LeapTV to power up and fail to boot. After using the SPI device on the Raspberry pi the lines are apparently no longer tristated, so disconnecting (or possibly power cycling) is necessary to test.