Talk:Hardware flashing

From PS3 Developer wiki
Revision as of 04:58, 13 September 2011 by Euss (talk | contribs) (→‎Read CFI data)
Jump to navigation Jump to search

Testreport table

Board Flash Dumping Writing Remarks
COK-001 2x Samsung K9F1G08U0A-PIB0
COK-002 2x Samsung K9F1G08U0A-PIB0
SEM-001 2x Samsung K9F1G08UOB-PIB0
SEM-001 2x Samsung K9F1G08UOB-PIB0 Yes No sel99 : CECHG / SEM-001 - 1-875-384-31 - can dump both NANDs fine, have trouble writing. both with Infectus and Progskeet. Boards below CECHG / SEM-001 flash fine.
SEM-001 2x Samsung K9F1G08UOB-PIB0 Yes No delsol : SEM-001 - 1-875-384-31 - dump both NANDs fine, still not able to reflash the nands correctly. there are always differences. Tried with Infectus.
DIA-001 1x Spansion S29GL128N90TFIR2
DIA-001 1x Spansion S29GL128N90TFIR2 Yes No delsol : flasher still freeze at sector0 (A&B) dumping seems to works (A&B). Same result with and without resistors. Tried on winxp-sp2 and win7. // The best results i got was using the 9k & 100k resistors. the flash is unuseable but ProgSkeet_110819 doesen´t freeze anymore. // I have tried Teensy and NORway0.3: dumping of nor works fine, but everytime when i tried to flash, the pc loose usb-connection to Teensy
DIA-002 1x Spansion S29GL128N90TFIR2
VER-001 1x Spansion S29GL128P90TFIR2 Yes Yes kado : Downgrading 3.70 to 3.55 success with progskeet (differ ON, No special trick)
VER-001 1x Samsung K8Q2815UQB-PI4B
VER-001 1x Samsung K8Q2815UQB-PI4B Yes Yes calimba : downgrade successful with progskeet on VER-001 CECHL01 with QT port. if the program 110819 freeze you need flash first the file with the qt port.
VER-001 1x Samsung K8Q2815UQB-PI4B Yes Yes Ir0nmanNB : Used all gnds listed on the diagram. I probe progskeet_rdy with my multimeter - I get 3.3V when writing and 0.9V when frozen. When giving progskeet_rdy direct 3.3v it no longer freezes. Writing succesfull when diffential flash is checked.
VER-001 1x Samsung K8Q2815UQB-PI4B Yes Yes Ryd3R : Starting from NORway v0.4 Beta W/R fully supported ) .
VER-001 1x Spansion S29GL128P90TFIR2 Yes No toxie : tried 128k/128 , 4k/4096. writing without alt. all FF, with alt some random patterns with 00 and FF when writing all 00. Trying A/B trick, still at Programming Sector 0
VER-001 1x Spansion S29GL128N90TFIR2 Yes No ares : tried 128k/128. With normal method a lot ff and same byte match. With alternate method 00 and ff and some byte match. Without resistor trick programmer freeze programming sector 0. with 100k and 9k resistor i can write but with errors (programmer completes the write, but the dump is all 00 ff, only few byte match, this with alternatemethod). with a/b tick's programmer (version A and B ) it freeze on programming sector 0 (both with or without resistors)
DYN-001 1x Samsung K8Q2815UQB-PI4B
DYN-001 1x Spansion S29GL128P90TFIR2
DYN-001 1x Macronix MX29GL128ELT2I-90G Yes Yes Ryd3R : NORway 0.3 fully support R/W on Macronix MX29GL128ELT2I-90G.
DYN-001 1x Spansion S29GL128P90TFIR2 Yes Yes Xb0xGuru : Downgrade successful. 100k/10k resistor trick used, Winskeet 40000 used (10 September 2011, 21:14:56)
DYN-001 1x Macronix MX29GL128ELT2I-90G Yes Yes calimba : Downgrade succesfull, used progskeet.
SUR-001 1x Macronix MX29GL128ELT2I-90G Yes Yes kado : Downgrade succesfull, used newest WT-port, nor pinout same as JSD-001
JTP-001 1x Spansion S29GL128P90TFIR2
JTP-001 1x Spansion S29GL128P90TFIR2 Yes Yes drako_ : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram, with 5 grounds and settings 128K/128 (progskeet).
JTP-001 1x Spansion S29GL128P90TFIR2 Yes Yes Ryd3R : success downgrading from 3.70 to 3.55 with wiring according to JSD-001 diagram NORway v0.3 .
JSD-001 1x Spansion S29GL128P90TFIR2
JSD-001 1x Samsung K8P2716UZC-QI4D Yes Yes kado : Downgrade succesfull with special trick
JSD-001 1x Samsung K8P2716UZC-QI4D Yes Yes Ryd3R : NORway 0.3 fully support R/W on Samsung K8P2716UZC-QI4D.
JSD-001 1x Spansion S29GL128P90TFIR2 Yes Yes

kado : Downgrading 3.70 to 3.55 success with progskeet (differ ON, alter ON) NOTE: THIS BOARD HAS different lengt normally (lenght is E990)

KTE-001 1x Spansion S29GL128P90TFIR2
KTE-001 1x Macronix MX29GL128ELT2I-90G
EXA-MPLE 1x dummy Yes No example : Tried 128/128 and 4K/4096, resistor and A/B trick, always freezes on first sector

Pretesters

Users With NORway (teensy++) who maybe could do pretesting : 

Ryd3R

Users with Injectus who maybe could do some pretesting : 

ares
damox
delsol


Progskeet QT port

OLDEST: http://www.sendspace.com/file/3bz5s5 USE AT YOUR OWN RISK
OLDER: http://www.sendspace.com/file/ijr2yb USE AT YOUR OWN RISK
OLD: http://static.loping.net/private/ps3/progskeet_nand_test.zip USE AT YOUR OWN RISK

Current: http://static.loping.net/private/ps3/WinSkeet40000.zip <- Qt Port, latest one, BETA STILL 

<Ago> damox: ill add import / export soon
<Ago> for now, you can export the registry key
<Ago> HKEY_CURRENT_USER\Software\ProgSkeet\ProgSkeet\presets
<Ago> on linux and osx its file based

Resistor trickery

without pullup:    rdy ---[100kOhm]--- nor_rdy
with pullup:    3.3V---[10kOhm]---rdy---[100kOhm]----nor_rdy
   
<Xb0xGuru> <uf6667> - would the 100k help with flashing past 2048 on Samsung NORs ?
<uf6667> yes :)
<uf6667> you gotta use alternate write method: single word
<uf6667> to be sure
<uf6667> use the NEWEST FLASHER
<uf6667> posted above (Progskeet QT port)


E3 Flasher related

http://imageshack.us/f/221/coverboardfronts.jpg/

Front of E3:

  • microSD slot
    • Start button
    • Stop button
    • LED: flash fun?
    • LED:PS1 mode
    • Switch?
    • LED: CFW
    • LED: OFW
    • Switch?
    • LED: Backup
    • LED: Prog
    • Switch?
  • marking: Backup
    • LED: OB Flash
    • MicroSD
    • Switch?
    • LED: ON Flash
    • LED: PS3Flash
    • Switch?
  • marking: Prog
    • LED: Unlock
    • LED: Lock
  • ESATA Plug
  • microUSB Plug

See it all here: http://www.youtube.com/watch?v=-FJsuc_uAjc

Maximum harddrive 2.5TB according to E3 website (currently down) 

   Dual Boot 3.7OFW and 3.55CFW on same PS3
   Downgrade 3.7 to 3.55 in 5min
   16M NOR FLASH ON board
   3 save MODE, can save data in TF, NOR FLASH on board and PC HD
   1 KEY operation, simple is best
   Upgradable from TF card or PC USB
   Compatiable all device like PS3/WII/XBOX360/MP3/DVD/BD/MP4/Table PC which has NAND or NOR flash memory.
   Integrated lots of interface, perfectly extension, will have more function with future new E3 accessory.
   E3 flasher Limited version includes 8 accessory, suggested retail price $88 USD, total production run only 3000 units!


Problematic Samsung / Spansion N related

Teensy

<jevin> nikitis, want to work tonight on getting samsung support working w/ teesny?
<jevin> ive got a hack to get around the different block sizes throughout the chip: just chip erase the whole thing
<jevin> and that chip erase is actually 2 chip erases, one with a22 low and one with a22 high (internally there are 2 8MB nor dies)
<jevin> then when flashing you cant use the write buffer command (there is no buffer)
<jevin> and have to instead use slower unlocked programming
<jevin> nikitis, ive had my teensy soldered up for nearly a week in the hopefully new, emi-proof location but havent hacked up the mobo shield to make it actually fit. i should try it tonight to see if it works

Progskeet

<kado> i confirm PROGSKEET HARDWARE is STABLE than other programer (teensy,etc)
<kado> the only problem is from flasher
<kado> especially for Spansion 'N' & SAMSUNG
<kado> i tested the winskeet but still not working well for those
<eussNL> ok, did it use A22 virtual chip #CE correct in your observations kado ?
<kado> actually no euss
<eussNL> shame
<kado> all flasher should be focus on SB_tristae, reset
<eussNL> so it was low all the time (virtual chip select 1) ?
<kado> and for spansion should be focus on those + #WP
<kado> and i am sure it could be emulated by flasher it self ;)
<eussNL> sure, not a problem to change the way controllines are used
<eussNL> just need a good preset that also sets the correct writing strategy
<kado> yes
<kado> thats right
<eussNL> which reminds me, that was one thing left out in winskeet (the samsung setting needs manual setting after selecting the preset)
<kado> the secreet for spansion N is only need 0v for (tristate & reset)
<kado> and do not ever modified the RDY
<kado> RY/BY NOR is controlled by SB
<kado> hope you can make this clear eusss, and explaint to all people


Read CFI data

<Ago> guys, we need people to supply us with nor cfi data
<Ago> we're most interested in samsung
<Ago> i'm currently uploading a test version that dumps cfi
<Ago> http://static.loping.net/private/ps3/WinSkeet40000_CFI_Test3.zip
<Ago> select preset and press dump cfi on nor tab
<Ago> then send the resulting file
      
<Oliveira> CFI is a section of the PS3 flash image ?
<Oliveira> or is it the chip ID stuff ?
<Ago> no, its information about hte flash chip itself
<Ago> like how it wants to be written, erased and how big it is
<Ago> we currently do not use it at all

Offboard flashing / Replacement NOR talk

<Rogero> eussNL: about flashing a nand/NOR externally, 
         once removed from the board and into a socket, 
         will this work for sure ?
<Rogero> i mean could be done, no problems if the nand is standalone
<eussNL> this will work for sure for board originated problems.
<eussNL> that still leaves us the Samsung dualbanked issue
<eussNL> e.g. VER-001 are most likely to benefit from offboard solution
<eussNL> perpaps it is a solution to exchange the banked Samsung for the uniform one, 
         or a Spansion/Macronix - someone tried that on a VER,
         but ran into board related issues afaik
<eussNL> because reading isnt the problem, writing is - 
         so read a banked Samsung offboard, 
         and flash patched in a nonbanked/uniform one offboard and resolder
<eussNL> offboard also means no need for messing with resistor trickery
         (pullup/down´s) on control-lines (RY/BY)
<nice69> read and write externally, then re-solder the chip
   
<Xb0xGuru> right, so it's the board layout which is the problem?
<eussNL> 2 fold
<eussNL> 1) Samsung banked 2) VER-001 board
   
<Xb0xGuru> what about the DYN-001 board? Would a Spansion work on there as a replacement?
<eussNL> and if board modification is on order, it would be most likely a controlline, 
         like RY/BY, which was the target of the resistor trickery
<eussNL> DYN-001 works fine with Macronic Xb0xGuru 
<eussNL> see http://www.ps3devwiki.com/index.php?title=Talk:Hardware_flashing#Testreport_table
         for the patterns of problems
   
<eussNL> you can use others flash too, 
         the one I list there is just the one Sony used on a different version of the board.
         See http://www.ps3devwiki.com/index.php?title=Flash_%28Hardware%29#NOR 
         for all the current NORs used
         (and stay away from dualbanked and perhaps ¨N¨ serie spansion too)
<eussNL> anyhow Samsung K8P2716UZC-QI4D = uniform/nonbanked and is fastest. 
         The Macronix and Spansion are 90ns
<eussNL> Replacements for NOR have to be 
         =>128Mbit x8, 
         VCC 3V (2.7V~3.6V), 
         <=90ns, 
         56-TSOP1, pincompatible, 
        uniform/nonbanked, non OTP, non encrypted.
     	
<Xb0xGuru> I successfully transplanted a Spansion P NOR onto my DYN-001 board that had a Samsung NOR on there previously.
<kado> r u sure??
<Xb0xGuru> yes - all done
<Xb0xGuru> downgraded to 3.55 CFW.
<kado> wow thats good to know
<Xb0xGuru> flashed it initially with the original 3.70 dump and it fired up nicely too
<Xb0xGuru> Spansion P came from another DYN-001 board, if that matters

Heavily edited log. Interesting read IMO

RSOD related

<kado> i want to confirm about RSOD
<kado> my english is bad, but i want you can tell to evryone
<kado> there is 2 types of RSOD
<kado> 1.come from CFW 2.from OFW
<kado> if coused by CFW we should patch the cVTRM
<kado> and if coused by OFW we should patch the core_OS. and use the last official Core_OS
<kado> btw, i have fix this 2pcs off RSOD today
   
<kado> guys here i upload 3.55 board ver-001 (including here are OFW,CFW, service Mode dump)
<kado> its all for studying RSOD
<kado> http://www.sendspace.com/file/ywvmox
<kado> you can compare with them, if you have RSOD come from ofw 3.55

Old reference

(don't remove, not all is on mainpage)


NAND

NAND (256MB, old FAT models, needs 32 wires, 15 per NAND + GND + VCC)
2 chips: Samsung K9F1G08U0A-PIB0

FlowRebuilder v.4.1.0.0


NOR

NOR 16MB, newer FAT models + Slims
needs 44 I/O wires: 23 address lines:A0-A22 + 16 Data lines:D0-D15 + 5 control lines: CE#,OE#,WE#,RESET#,TRISTATE (optional:#RY-BY) + GND + VCC
(NB: RY/BY is optional only for Teensy, Progskeet NEED ALL controllines!)

1 chip: Spansion S29GL128N90TFIR2 or Samsung K8Q2815UQB-P14B

NOR uses 1024 byte sector, just as NAND.

(Note : PIC32 flasher for Spansion is very slow: dumping 16MB = ~15min / writing full dump = 4 hours)


Alternatives for Infectus2 and Teensy 2.0++:

Atmel AT90USB1286 datasheet

Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:Hardware_flashing&oldid=4824"