FORD TRAVELPILOT OMAP5948+S29GL256N(BGA) how to read external flash

[zzz28]

Please help, how to read Segger J-link EDU jtag flasher this Blaupunkt motherboard?
I can connect omap5948, Core ID: 0x0692602F, but flash ID:0xAAAAAAAA.
Should the project file OMAP5948 (.jflash).
Someone can help me?

THX!

[kappa1]

Hi post your serial an p/n here or picture

[zzz28]

8M5T 18K931 HD
7 612 300 566
3A056699046694

[PremierD]

8075 .... maybe lol

[zzz28]

Yes, 8075.....I can! :burnout:
but please help how to read external flash!!!!!!!

[jarecki55]

whay you need external flash

[Faraday]

martech can read OMAP



http://www.digital-kaos.co.uk/forums/attachment.php?attachmentid=309515&stc=1

[simaservis1108]

Sometimes not possible to read because flash solder is bad.Unsolder and read...

[zalupentiy]

This units have other problems.
There broken some chips...
Problem are solved. Flash file will not help you.

[tehnosoftex]

This units have other problems.
There broken some chips...
Problem are solved. Flash file will not help you.
And what are these problems? Ive seen several units which didn't start any more, and if I heat up the flash and I power up the unit while the flash is still hot the unit start and run ok. If I remove the power , and apply again when the bga is could the unit is dead again.
I think the flash can be read with jlink but need a proper project. Ive tried to make a project and manage to read only some blocks of flash but the program is disconnecting often. I manage to read and write the flash with a programmer used for jailbreak the PS3, progskeet, but need allot of wires to connect.

[zzz28]

radio will not turn on, heating this flash and radio perfect.
reballing this bga flash, one month and the same error.
this flash internal error, not balls error.
i think a solution would be a new flash memory, reading orig dump, replaced flash memory and writing flash data.
i have progskeet programmer, but it must be connected to the A23 address? only addresses A0-A22!

[clydey]

radio will not turn on, heating this flash and radio perfect.
reballing this bga flash, one month and the same error.
this flash internal error, not balls error.
i think a solution would be a new flash memory, reading orig dump, replaced flash memory and writing flash data.
i have progskeet programmer, but it must be connected to the A23 address? only addresses A0-A22!
not familiar but a0-a22 = 23 addresses cheers

[zalupentiy]

Correct way. Need change 3 chips.

[zzz28]

not familiar but a0-a22 = 23 addresses cheers

Please look at S29GL datasheet!

S29GL128 A0-A22
S29GL256 A0-A23
S29GL512 A0-A24

A0-A23 = 24 !!!

progskeet how to program?

[zzz28]

I READING FLASH MEMORY JTAG (JLINK) !!!! :burnout:

[tehnosoftex]

I use A0-A22 but I make 2 readings. One with A23 at grround and second with A23 at 3.3v. Can you post the omap jlink project?

[tehnosoftex]

Correct way. Need change 3 chips.

Can you tell what chips need to be changed?

[sashxxx]

I READING FLASH MEMORY JTAG (JLINK) !!!! :burnout:


Hi,
How did you conect and read OMAP5948+S29GL256N(BGA), can you share any info or pictures? I also have J-link
Thanks

[sashxxx]

any idea???

[nic2015]

I READING FLASH MEMORY JTAG (JLINK) !!!! :burnout:

I also interested in this question... read OMAP5948+S29GL256N(BGA) -- J-link. I can't read the memory...

[nic2015]

I also interested in this question... read OMAP5948+S29GL256N(BGA) -- J-link. I can't read the memory...

Yes and I read... FLASH MEMORY JTAG

[sashxxx]

any idea how to do it?

[OliveGarden]

Hello,

I have a problem with my 8S7T 18K931 AD (Travelpilot FX) Unit. I had removed the SPANSION S29GL256N... BGA Flash Chip for reading a dump but after soldering it back, the UNIT doesn't start.

Is there a security area at the chip which can only be read via JTAG and doesn't extern?
I do BGA soldering and so on for so many years now but I can't explain why the Unit doesn't start after putting back the chip.

Has anyone a dump for it?
Thanks a lot.






Best Regards,

[Carlos07]

Friends,
I have problems to connect OMAP5948GXF with J-link. I tried various configuration settings in J-flash v5.12, but every time i have error when try connect to target: ''CPU-TAP not found in JTAG chain''. Many times I have checked right JTAG connection to board and 3.3V to VTref from board I applied to.


Maybe someone have project file (*.jflash) with right configuration?


Ford Travelpilot
8M5T 18K931 GD
7 612 300 546
3A054699185187

Thanks!368493

[smoggy]

Friends,
I have problems to connect OMAP5948GXF with J-link. I tried various configuration settings in J-flash v5.12, but every time i have error when try connect to target: ''CPU-TAP not found in JTAG chain''. Many times I have checked right JTAG connection to board and 3.3V to VTref from board I applied to.


Maybe someone have project file (*.jflash) with right configuration?


Ford Travelpilot
8M5T 18K931 GD
7 612 300 546
3A054699185187

Thanks!368493

if you require code try 8409

[Carlos07]

Thank you smoggy, this is right code!
But i have other problem, unit can't turn on, and i need replace Spansion bga memory chip, but before doing this i need download full dump from it.

[shorttrader]

And what are these problems? Ive seen several units which didn't start any more, and if I heat up the flash and I power up the unit while the flash is still hot the unit start and run ok. If I remove the power , and apply again when the bga is could the unit is dead again.
I think the flash can be read with jlink but need a proper project. Ive tried to make a project and manage to read only some blocks of flash but the program is disconnecting often. I manage to read and write the flash with a programmer used for jailbreak the PS3, progskeet, but need allot of wires to connect.

I have purchased new GL256N Chips now. But I did not have the original Dump from this chip. Can somebody sell a dump to me?

[shorttrader]

Code for Ford FX

Hi have a ford fx navi bought from ebay. But no code can somebody help me

8v4t 18k931 af
881 c7e3a0594 9 9145762

Thanks

[shooting]

Code for Ford FX

Hi have a ford fx navi bought from ebay. But no code can somebody help me

8v4t 18k931 af
881 c7e3a0594 9 9145762

Thanks

Your code is 6666

wbr

[shorttrader]

Your code is 6666

wbr

WOW - thats great. Works fine. But system is faulty. no navi can turned on no radio. I think there is something else worse. ~~~~

Thanks for your fast help

Do u know what there can be wrong too?? I can switch on. enter code but not more. display on. CD rotating but no sound etc.

[pracant4015]

Maybe someone have project file (*.jflash) with right configuration?
My Omap does not connect with J-link

[damtor]

I READING FLASH MEMORY JTAG (JLINK) !!!! :burnout:
How did you read vith JLINK? Share project (.jflash) please.

[ArnisAAA]

Correct way. Need change 3 chips.

Hi,
Could you please tell me which chips I should replase?

[rtr989]

I READING FLASH MEMORY JTAG (JLINK) !!!! :burnout:
Hi!
Can you explane how you read it with J-Link?

[alexandr1966]

Hi! Anyone have J-Link project for OMAP5948+S29GL256N reading?

[Philler]

need solution too!

[rebello]

I READING FLASH MEMORY JTAG (JLINK) !!!! :burnout:
Hi, i was not able to download this attachment. Don't know why.
Could you send it by email/pn?

[rebello]

For Segger J-LINK try this http://forum.segger.com/index.php?page=Attachment&attachmentID=1905&h=b073d23ca3b9746912216820610be51da275525a
seen on this thread http://forum.segger.com/index.php?page=Thread&threadID=4409

[madymax]

does this JlinkScript worked for anybody?

[rebello]

No, i guess it's really complicated because this OMAP is not publicity available, nor information/documentation about it.
There are two ways to get content of Flash (maybe from the EEPROM also) via JTAG:

One is to "inject" some code which access the Flash content and sends the bytes back through JTAG channel. Therefore an experienced user must write a program which is small enough to fit into the OMAPs own RAM (not the external one) and use JTAG to transfer this code from the computer to the RAM of the OMAP CPU (ARM7-based) and execute it there.

Another method would be to controll the IO-Pins of the OMAP, which are more or less directly connected to the S29 flash chip, and simulate what's needed to read bytes. Therefore one needs to know which bits of the boundary-scan register controll what port and it's direction. Then one can emulate access by setting the IO-lines of the flash to read a specific address, read the data and send it back via JTAG. It implies many JTAG calls per Byte, so its possibly very slooow. I got schematic to know which is connected where. For this, there needs to be a way to halt the CPU that normal code does not execute and interfere with the JTAG-commands to set/get the IO-pins.

My knowlegde of JTAG is not so deep to know what exactly to do, but i would help. I got SEGGER JLINK and also USB-Blaster and of course a radio to test ;-)

[petronijul]

if need OMAP jflash

[rebello]

Hey chaps, i've got news on this! After many many hours of reverse engineering the board and testing i managed to find a way to read the whole flash in one run!

The problem i found is, that after setting the ARM CPU inside the OMAP to HALT, which is needed to do any JTAG commands, it will be reset after about 20 seconds.
The reason for this is the V850 processor on the board, which seems to act like a watchdog. It "probes" the application on the OMAP5948 constantly and raise an MPU_RESET line of the OMAP after that time. This is because the application on the OMAP is also halted, when the CPU is halted (logical, eh?).

Now, the trick is to prevent this, and you can download by JTAG as long as you want :-)
First, i ended up in removing some parts from the mainboard, but as i traced down the wires if find that the developers also include an easy way to do the same. There is a transistor which will force the signal to LOW and therefore the V850 cannot raise the level to HIGH to force an reset. The base of this transistor lead to pin 13 of the spare connector pads next to the orange Micromatch connector on the lower side of the board. One can simply connect this pin to GND (which is at pin 3, for example). To simply make a bridge (or use a switch) vom pin 3 to 13 and HERE YOU GO :-)

587917

This can be used for FX, NX and MCA, and i guess for any other compatible Bosch boards, linke RNS for VW and Nissan or Opel.

Now i'm working on a way to reflash the mainboard. Here i get into issues, but this is another story...

Have fun!

P.S.: I always interessted in sharing knowledge about these satnavs in any way. So please feel free to contact me :-)

[simaservis1108]

Yes,connect V850 pin FLMD0 to GND,and you can work as long as you want.

[rebello]

Right. If i understand the v850 docs right, this pin is usually used for programming the internal flash of the chip, and here it is used as a simple IO port.

When i try to erase the flash using Segger JFlash, i get aborts. It will do, but i can't erase more than a couple of sectors at once (e.g. 20-40 max.). This is regardless if i use this V850_DISABLE pin we talked about or not. So there must be something to also be done to make this go in one step. Same is true for programming after erasing.

Another thing is, that the first and last sector seems to be write protected. I did not encounter any problems, but it makes me curious. The first secotr contains the bootloader, as you can find excactly the same data in the file "boot.bin" on the update CD for the radio. So i guess the flash gets somehow unsecured by the updater. The S29GL could use a 64 Bit password for this.

I've tested on several board of different types and some of them deny to write sectors in the middel somewhere also. Maybe this is because of bad soldering of the flashes (need reflow?) or maybe the flash is simply broken and needs to be teplaced?!

[rebello]

Yes,connect V850 pin FLMD0 to GND,and you can work as long as you want.
Close, but not really true. The mentioned /SEL line from me, is not connected to FLMD0 but to an input port of the V850 radio processor.

FLMD0 low is used on V850 to enter flash programming model and this implies that the application on the chip is not running. I did not try it, but maybe it has the same effect. What needs to be repsected tis the üower management of the board, Maybe it would not work and not power the HMI, Flash, SDRAM if the radioproc does not run at least a little portion of its application.

But anyway, i am still looking for somebody who is willing and able to reverse engineer the boot of the OMAP.

[pp40]

Did you see this description
https://mk4-wiki.denkdose.de/artikel/nav_common/mainboard_service_connectors

[rebello]

Did you see this description
https://mk4-wiki.denkdose.de/artikel/nav_common/mainboard_service_connectors
Thanks for pointing back to my own Wiki ;-)

I did a lot since the time i asked here for help. Think now my site holds the most information about those devices, even a free Ford Radio PIN code calculator. Besides the wiki i also run an own forum handling device hacking, but that's another story...

[pp40]

I have the problem with radio Travelpiot FX my Ford's
I tried to reflow a flash bga with flux , I tried a little move it , after that the power on when radio is hot . The radio has worked good . When I it off after few minutes it is same condition . Radio do not power on.
I used the Jlink with jtag to read S29GL256 chip . I have the file .bin from my radio . I soldered another flash but do not can write my .BIN
It is new solution for me with Jlink , that is interesting solution . I thought that is a easy way but are complications . Can you help me write .BIN using Jlink or I have to programm a chip with my TNM5000 programmer .
693323

[rebello]

Did you read this? https://mk4-wiki.denkdose.de/artikel/nav_fx/fx_startet_nicht_mehr
Then you would know that this problem is about the RAMs and not the Flash. The reason why it seem to work is just because you applied heat to the RAM chips, which brings them up shortly. You need to swob those.
In order to flash the device firmware back you should follow this tutorial https://mk4-wiki.denkdose.de/artikel/nav_common/jtag_readout_mainboard_flash
You need some special settigs for JFlash to disable the watchdogs and raise an IO signal to disable write-protection of the lower Flash banks. I worked this all out and described it there. This should work to program your new flash, but beware that your initial problem is only solveable by replacing the RAMs!
Good luck!

[pp40]

Thanks for very quickly reply . Your tutorial is helpful . I studied it many times . I will take your advice and replace the RAMs . 693975

[TRISIEN]

I need a Ford radio code thank you very much

[Mankyro]

I need a Ford radio code thank you very much
Foto bad..........

[TRISIEN]

8V4T 18K931 AF
881 C7E3A0594 8 8324682
7 612 300 594
THANKS

[Mankyro]

8V4T 18K931 AF
881 C7E3A0594 8 8324682
7 612 300 594
THANKS
.........2649

[TRISIEN]

8V4T 18K931 AF
881 C7E3A0594 8 8324682
7 612 300 594
THANKS



.........2649
thanks woork

[pietrak]

if still need project files.....

pass pm + thanks

[pietrak]

also if someone need in zip 2x dump from s29gl064 from screen board
pass pm+thanks

[JerryGrass]

Hi pp40
Have you managed to solve the problem with writing .bin file to the new flash chip using J-Link?

[mantasel]

also if someone need in zip 2x dump from s29gl064 from screen board
pass pm+thanks
Hello, please pass, PM ;) thanks!!