Getting access to u-boot (SH4)

Follow below steps to get access to the bootloader of your device. This page is modified copy of Getting access to uBoot as there are some important differences for A series models with SH4. Tested on T-RBYDEUC firmware

Prior to boot-process

1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future

• Switch off the TV
• Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
• Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
• Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | STi | MTK | Logic ] )

Setting Watchdog off does not seem to work on this model.

2. Make or buy Service Cable - ExLink

Terminal Connection Parameters

• Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):

Baudrate: 115200
Data bits: 8
Parity: none
Stop bits: 1
Flow Control: none

During the boot-process

• TV is just switched on or rebooting
• Press and hold space
• If you're lucky, you'll see prompt

Enter MBL..[0001]
_ShadowOS.


Board: STb7109


*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz  (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM:  128 MB
In:    serial
Out:   serial
Err:   serial
Net:   Using MAC Address 00:xx:xx:xx:xx:xx
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot:  0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

If you need more time to configure U-Boot environment or to reflash bricked TV, use umicom.img to disable and enable the watchdog. See Watchdogs and MICOM on A series(SH4).

Entering U-Boot prompt needs good timing because original setting of parameter bootdelay=0 means that U-Boot does not wait for keyboard.

U-Boot silent mode

If Ex-link interface have not been set to "STi" in service menu, U-Boot is in silent mode. You can type commands, see line editing. Commands work however any output of them is suppressed completely. Also help command does not print anything.

If you desperately need access to U-Boot and you cannot make changes in service menu e.g. because the TV does not boot, reset silent flag directly in the RAM:

mw 86149a18 3

The address is valid ONLY for the U-Boot version shown above. Running umicom.img also resets silent flag. See also Samsung A 6 Series (sh4 CPU) Unbricking

Changes to environment

BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING

You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:

setenv bootdelay 1
saveenv

If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter. You can directly load kernel by pasting the command

bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change

setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

Command saveenv always hangs in this version of U-Boot, however environment is saved correctly. Make sure that watchdog is enabled before starting saveenv. See also [discussion]

U-Boot commands

?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bbm   - BBM sub-system
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp	- boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp	- invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
flinfo  - print FLASH memory information
fnw    - FlexoneNand Writer
go      - start application at address 'addr'
help    - print online help
ide     - IDE sub-system
iminfo  - print header information for application image
imls    - list all images found in flash
itest	- return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs	- boot image via network using NFS protocol
nm      - memory modify (constant address)
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version

Original U-Boot environment

bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000