Mpoos: minor touchups

2012-12-27T12:26:32Z

minor touchups

Mpoos: Initial version

2012-12-27T12:20:29Z

Initial version

New page

= Unbricking a LA46A650 =
== Symptoms ==
The following symptoms are apparent
* Power cycling 5 times and then permanently on
* Power supply capacitors are ok but were replaced anyway

Suspected bad software upgrade.

== u-boot ==
The u-boot console is accessable via the service port. See elsewhere for cable. 
Baud rate is standard 115200 8N1. 
Press and hold '''space''' to stop the reboot. Only do this after the initial 5 power cycles is complete so it doesnt reboot on you. This will stop the incessant
Enter MBL..[0001]

Enter MBL..[0001]

Initially the u-boot console produced no output to commands except for a few exceptions
* echo
* printenv
* boot
* setenv
* saveenv
All typed characters are echoed 
Test the console with
echo test
And press '''Enter''' a few times. 
Type any non whitespace character and '''Enter''' to exit the mode. 

A good idea at this time is
setenv bootdelay 1
saveenv
This will allow easier '''space''' access to u-boot when its working again.
* Note: This happens only after a power on.

=== u-boot code details ===
u-boot relocates itself to 0x85f00000 
The silent environment variable does not exist in this u-boot. 
Use '''mw 0x85f87610 0''' to unsilence the console. 
This was determined by disassembling the u-boot image from '''T-AMBDAU.exe''' update file.
* Load the image at offset 0x85f00000, SH4 processor
* Start disassembling at 0x85f00000
* There are tables after the relocation code as to where it goes next.
=== u-boot command set ===
The command set in u-boot is
<nowiki>
help
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bbm - BBM sub-system
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
diskboot- boot from IDE device
echo - echo args to console
erase - erase FLASH memory
exit - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
FGP - FlexoneNand CE Pattern Generator
go - start application at address 'addr'
help - print online help
ide - IDE sub-system
iminfo - print header information for application image
imls - list all images found in flash
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
fnw - FlexoneNand Writer
FGP - FlexoneNand CE Pattern Generator
printenv- print environment variables
protect - enable or disable FLASH write protection
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
</nowiki>
Note FGP is listed twice.
*The 1st one is actually format
*The 2nd is onwall which writes all partitions to nand flash.

=== LA46A650 TV Info ===
Some TV info...
<nowiki>
STi710x> coninfo
List of available devices:
serial 80000003 SIO stdin stdout stderr
STi710x> bdinfo
boot_params = 0x85DDFF88
memstart = 0x84000000
memsize = 0x08000000
flashstart = 0xA0000000
flashsize = 0x85DFFF88
flashoffset = 0x00044080
ethaddr = 00:01:01:01:01:01
ip_addr = 10.240.74.57
baudrate = 115200 bps

STb7109 version 3.x
PLL0 = 531 MHz
PLL1 = 360 MHz
ST40 CPU = 265 MHz
ST40 BUS = 132 MHz
ST40 PER = 66 MHz
ST231 CPU = 360 MHz
ST BUS = 180 MHz
EMI = 90 MHz
LMI = 180 MHz
STi710x> flinfo

Bank # 1: missing or unknown FLASH type
</nowiki>

=== Default Environment ===
<nowiki>
STi710x> printenv
baudrate=115200
ipaddr=10.240.74.57
netmask=255.255.255.0
gatewayip=10.240.74.1
serverip=10.240.74.106
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootdelay=0
stdin=serial
stdout=serial
stderr=serial
bootcmd=run ipconf;run hwnfconf; bbm open; bbm load kernel; bbm close; setenv bootargs mem=$memsize root=/dev/tbml6 rw rootfstype=squashfs ip=$ip nwhwconf=$nwhwnet bigphysarea=2000 stmmaceth=msglvl:1,watchdog:4000,rxsize:512 quiet; bootm 0x84100000

Environment size: 1968/131068 bytes
</nowiki>

=== Flash Programming ===
The normal flash commands dont work so don't use them. 
Also don't use the commands for flash update shown in the environment. 

The common '''bbm usb''' command doesn't work in this A series model.

There is an onw command (in help it shows as fnw) but that wont work.
use
<nowiki>help onw
onw
- FlexoneNand Writer
MBL ADDRESS : 0x87400000
U-BOOT ADDRESS : 0x87500000
KERNEL ADDRESS : 0x87600000
ROOTFS ADDRESS : 0x87A00000
</nowiki>

To get the address of the image it will use to write the nand flash partition. 
There are addresses for the other partitions but they are not shown anywhere. 
The full list is
<nowiki>
1 MBL ADDRESS : 0x87400000
2 U-BOOT ADDRESS : 0x87500000
3 U-Boot param data - not writable
4 KERNEL ADDRESS : 0x87600000
5 ROOTFS ADDRESS : 0x87A00000
6 BOOTIMG ADDRESS : 0x88200000
7 EXEDATA ADDRESS : 0x88A00000
8 APPDATA ADDRESS : 0x90A00000
9 UNKNOWN ADDRESS : 0x91600000
</nowiki>

=== bbm show partition ===
bbm show partition works but the format is different.

<nowiki>STi710x> bbm show partition
<< PARTITION INFORMATION >>
id : Boot Loader (0x1)
attr : RW (0x1)
first_blk : 0
no_blks : 1
---------------------
id : u-boot (0x2)
attr : RW (0x1)
first_blk : 1
no_blks : 3
---------------------
id : u-boot parmeter (0x5)
attr : RW (0x1)
first_blk : 4
no_blks : 1
---------------------
id : User Defined (0x4)
attr : RW (0x1)
first_blk : 5
no_blks : 2
---------------------
id : KERNEL (0x3)
attr : RW (0x1)
first_blk : 7
no_blks : 24
---------------------
id : CRAMFS (0x8)
attr : RW (0x1)
first_blk : 31
no_blks : 36
---------------------
id : RFS (0x9)
attr : RW (0x1)
first_blk : 67
no_blks : 80
---------------------
id : User Defined (0xa)
attr : RW (0x1)
first_blk : 147
no_blks : 92
---------------------
id : User Defined (0xb)
attr : RW (0x1)
first_blk : 239
no_blks : 40
---------------------
id : User Defined (0xc)
attr : RW (0x1)
first_blk : 279
no_blks : 92
---------------------
id : User Defined (0xd)
first_blk : 371
no_blks : 40
---------------------
id : User Defined (0xe)
attr : RW (0x1)
first_blk : 411
no_blks : 36
---------------------
id : User Defined (0xf)
attr : RW (0x1)
first_blk : 447
no_blks : 48
---------------------
</nowiki>

== Unbricking procedure ==
If you get this far, u-boot is working with full console access.

=== Load image for corrupt partition ===
Load the kernel to 0x87600000 using
<nowiki>fatload usb 1 0x87600000 /vmlinux.ub</nowiki>
or if your USB Flash Drive is not working for you
<nowiki>loadb 0x87600000</nowiki>
and use kermit protocol to send the file over the Service Port connection.

=== Write the image into NAND Flash ===
next run onw to get the writer menu. I selected 4 to update the kernel

<nowiki>
STi710x> onw
[ONW: ] Bootloader already formated BML

---------------- Sub Menu -------------
Update select partition
1 : MBL Bootloader partition
2 : u-boot partitionn
4 : kernel image partition
5 : rootfs image partition
6 : boot image partition
7 : exeDSP image partition
8 : appdata image partition
x : go Main menu
---------------------------------------
## Number of Partition : 13

## Select a partition : [ONW: ] Erase Blocks : 000004008012016020025029033037041045050054058062066070075079083087091095[ONW: ] +-----------------------+[ONW: ] | IMAGE ERASE FINISHED! |[ONW: ] +-----------------------+[ONW: ] Write Blocks : 000001002003004005006007008009010011012013014015016017018019020021022023024025026027028029030031032033034035036037038039040041042043044045046047048049050051052053054055056057058059060061062063064065066067068069070071072073074075076077078079080081082083084085086087088089090091092093094095096097098099100[ONW: ] +-----------------------+[ONW: ] | IMAGE WRITE FINISHED! |[ONW: ] +-----------------------+
Completed Update Image ? (y/n)

Reboot!Enter MBL..[0001]

</nowiki>

=== Results ===
After the reboot, it all sprang into life. 
A full usb software update in the conventional may be warranted to get everything up to scratch.

@@ Line 1: / Line 1: @@
 = Unbricking a LA46A650 =
 == Symptoms ==
 The following symptoms are apparent
@@ Line 280: / Line 283: @@
    ---------------------
 </nowiki>
 == Unbricking procedure ==

Samsung A 6 Series (sh4 CPU) Unbricking - Revision history

Mpoos: minor touchups

Mpoos: Initial version