View source for Samsung A 6 Series (sh4 CPU) Unbricking

= Unbricking a LA46A650 =
Disclaimer: You can irrevokably brick your TV if you do the wrong thing.<br>
No responsibility is assumed if the guide is followed.<br>
''not that your TV is usable anyway ;-)''
== Symptoms ==
The following symptoms are apparent
* Power cycling 5 times and then permanently on
* Power supply capacitors are ok but were replaced anyway

Suspected bad software upgrade.

== u-boot ==
The u-boot console is accessable via the service port. See elsewhere for cable.<br>
Baud rate is standard 115200 8N1.<br>
Press and hold '''space''' to stop the reboot. Only do this after the initial 5 power cycles is complete so it doesnt reboot on you. This will stop the incessant
 Enter MBL..[0001]
 
 Enter MBL..[0001]
 
Initially the u-boot console produced no output to commands except for a few exceptions
* echo
* printenv
* boot
* setenv
* saveenv
All typed characters are echoed<br>
Test the console with 
 echo test
And press '''Enter''' a few times.<br>
Type any non whitespace character and '''Enter''' to exit the mode.<br>

A good idea at this time is
 setenv bootdelay 1
 saveenv
This will allow easier '''space''' access to u-boot when its working again.
* Note: This happens only after a power on.

=== u-boot code details ===
u-boot relocates itself to 0x85f00000<br>
The silent environment variable does not exist in this u-boot.<br>
Use '''mw 0x85f87610 0''' to unsilence the console.<br><br>
This was determined by disassembling the u-boot image from '''T-AMBDAU.exe''' update file.
* Load the image at offset 0x85f00000, SH4 processor
* Start disassembling at 0x85f00000
* There are tables after the relocation code as to where it goes next.
=== u-boot command set ===
The command set in u-boot is
 <nowiki>
help
?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bbm   - BBM sub-system
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
diskboot- boot from IDE device
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
flinfo  - print FLASH memory information
FGP    - FlexoneNand CE Pattern Generator
go      - start application at address 'addr'
help    - print online help
ide     - IDE sub-system
iminfo  - print header information for application image
imls    - list all images found in flash
itest	- return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
fnw    - FlexoneNand Writer
FGP    - FlexoneNand CE Pattern Generator
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version
</nowiki>
Note FGP is listed twice.
*The 1st one is actually format
*The 2nd is onwall which writes all partitions to nand flash.

=== LA46A650 TV Info ===
Some TV info...
 <nowiki>
STi710x> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr 
STi710x> bdinfo
boot_params = 0x85DDFF88
memstart    = 0x84000000
memsize     = 0x08000000
flashstart  = 0xA0000000
flashsize   = 0x85DFFF88
flashoffset = 0x00044080
ethaddr     = 00:01:01:01:01:01
ip_addr     = 10.240.74.57
baudrate    = 115200 bps

STb7109 version 3.x
PLL0      = 531 MHz
PLL1      = 360 MHz
ST40  CPU = 265 MHz
ST40  BUS = 132 MHz
ST40  PER = 66 MHz
ST231 CPU = 360 MHz
ST BUS    = 180 MHz
EMI       = 90 MHz
LMI       = 180 MHz
STi710x> flinfo

Bank # 1: missing or unknown FLASH type
</nowiki>

=== Default Environment ===
 <nowiki>
STi710x> printenv
baudrate=115200
ipaddr=10.240.74.57
netmask=255.255.255.0
gatewayip=10.240.74.1
serverip=10.240.74.106
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off 
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp 
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr 
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr 
verify=n
bootdelay=0
stdin=serial
stdout=serial
stderr=serial
bootcmd=run ipconf;run hwnfconf; bbm open; bbm load kernel; bbm close; setenv bootargs mem=$memsize root=/dev/tbml6 rw rootfstype=squashfs ip=$ip nwhwconf=$nwhwnet bigphysarea=2000 stmmaceth=msglvl:1,watchdog:4000,rxsize:512 quiet; bootm 0x84100000 

Environment size: 1968/131068 bytes
</nowiki>

=== Flash Programming ===
The normal flash commands dont work so don't use them.<br>
Also don't use the commands for flash update shown in the environment.<br>

The common '''bbm usb''' command doesn't work in this A series model.

There is an onw command (in help it shows as fnw) but that wont work.
use 
 <nowiki>help onw
onw  
    - FlexoneNand Writer
MBL    ADDRESS : 0x87400000
U-BOOT ADDRESS : 0x87500000
KERNEL ADDRESS : 0x87600000
ROOTFS ADDRESS : 0x87A00000
</nowiki>

To get the address of the image it will use to write the nand flash partition.<br>
There are addresses for the other partitions but they are not shown anywhere.<br>
The full list is
 <nowiki>
1     MBL    ADDRESS : 0x87400000
2     U-BOOT ADDRESS : 0x87500000
3     U-Boot param data - not writable
4     KERNEL ADDRESS : 0x87600000
5     ROOTFS ADDRESS : 0x87A00000
6     BOOTIMG ADDRESS : 0x88200000
7     EXEDATA ADDRESS : 0x88A00000
8     APPDATA ADDRESS : 0x90A00000
9     UNKNOWN ADDRESS : 0x91600000
</nowiki>

=== bbm show partition ===
bbm show partition works but the format is different.

 <nowiki>STi710x> bbm show partition
<< PARTITION INFORMATION >>
 id        : Boot Loader (0x1)
 attr      : RW (0x1)
 first_blk    : 0
 no_blks : 1
  ---------------------  
 id        : u-boot (0x2)
 attr      : RW (0x1)
 first_blk    : 1
 no_blks : 3
  ---------------------  
 id        : u-boot parmeter (0x5)
 attr      : RW (0x1)
 first_blk    : 4
 no_blks : 1
  ---------------------  
 id        : User Defined (0x4)
 attr      : RW (0x1)
 first_blk    : 5
 no_blks : 2
  ---------------------  
 id        : KERNEL (0x3)
 attr      : RW (0x1)
 first_blk    : 7
 no_blks : 24
  ---------------------  
 id        : CRAMFS (0x8)
 attr      : RW (0x1)
 first_blk    : 31
 no_blks : 36
  ---------------------  
 id        : RFS (0x9)
 attr      : RW (0x1)
 first_blk    : 67
 no_blks : 80
  ---------------------  
 id        : User Defined (0xa)
 attr      : RW (0x1)
 first_blk    : 147
 no_blks : 92
  ---------------------  
 id        : User Defined (0xb)
 attr      : RW (0x1)
 first_blk    : 239
 no_blks : 40
  ---------------------  
 id        : User Defined (0xc)
 attr      : RW (0x1)
 first_blk    : 279
 no_blks : 92
  ---------------------  
 id        : User Defined (0xd)
 first_blk    : 371
 no_blks : 40
  ---------------------  
 id        : User Defined (0xe)
 attr      : RW (0x1)
 first_blk    : 411
 no_blks : 36
  ---------------------  
 id        : User Defined (0xf)
 attr      : RW (0x1)
 first_blk    : 447
 no_blks : 48
  ---------------------  
</nowiki>

=== Checking the kernel partition ===
This is the only partition that can be checked
 bbm open
 bbm load kernel
 bbm close
 iminfo 0x84000000
This will show a bad CRC if it is the problem partition.<br>
Unfortunately the other partitions are not loadable under u-boot

== Unbricking procedure ==
If you get this far, u-boot is working with full console access.

=== Load image for corrupt partition ===
Load the kernel to 0x87600000 using 
 <nowiki>fatload usb 1 0x87600000 /vmlinux.ub</nowiki>
or if your USB Flash Drive is not working for you
 <nowiki>loadb 0x87600000</nowiki>
and use kermit protocol to send the file over the Service Port connection.

=== Write the image into NAND Flash ===
next run onw to get the writer menu. I selected 4 to update the kernel

 <nowiki>
STi710x> onw
[ONW:   ] Bootloader already formated BML

 ---------------- Sub Menu -------------
   Update select partition            
  1 : MBL Bootloader partition    
  2 : u-boot partitionn               
  4 : kernel image partition          
  5 : rootfs image partition          
  6 : boot image partition          
  7 : exeDSP image partition          
  8 : appdata image partition          
  x : go Main menu                    
 ---------------------------------------
 ##  Number of Partition : 13

 ##  Select a partition : [ONW:   ]  Erase Blocks  : 000004008012016020025029033037041045050054058062066070075079083087091095[ONW:   ]  +-----------------------+[ONW:   ]  | IMAGE ERASE FINISHED! |[ONW:   ]  +-----------------------+[ONW:   ]  Write Blocks  : 000001002003004005006007008009010011012013014015016017018019020021022023024025026027028029030031032033034035036037038039040041042043044045046047048049050051052053054055056057058059060061062063064065066067068069070071072073074075076077078079080081082083084085086087088089090091092093094095096097098099100[ONW:   ]  +-----------------------+[ONW:   ]  | IMAGE WRITE FINISHED! |[ONW:   ]  +-----------------------+
Completed Update Image ? (y/n)

Reboot!Enter MBL..[0001]

</nowiki>

=== Results ===
After the reboot, it all sprang into life.<br>
A full usb software update in the conventional may be warranted to get everything up to scratch.