Watchdogs and MICOM on A series(SH4)

There is abundant use of watchdogs/timeouts in LE46A956. I'm not sure if it is because of "quality" of firmware or it is an anti-hacking measure.

Micom microcontroller

Micom is a microcontroller responsible for receiving commands from an infrared remote control, switching main power supply on and off, resetting main SH4 CPU and so on. It also works as a watchdog.

Micom control from linux command line

Use

/mtd_boot/MicomCtrl

or

/lib/modules/MicomCtrl

to send commands to Micom. If the main tv process exeDSP is active, a collision between MicomCtrl and exeDSP command can happen - you can repeat MicomCtrl several times to ensure the command is accepted.

Micom control from U-Boot

umicom.img is a standalone U-Boot application for sending commands to Micom. It was tested on LE46A956 with fw T-RBYDEUC 1013.1. It should work on all models with T-RBYDEUC software a might run also on other SH4 models. Grab latest version and source from download area.

Export the image from a nfs server or set up a tftp server. Lets suppose we have umicom.img on a linux host in directory /home/samygo/

sudo exportfs ip_of_your_tv:/home/samygo

At TV U-Boot prompt enter:

nfs 84300000 ip_of_your_linux_host:/home/samygo/umicom.img;bootm

umicom.img is position independent code, so you can change address 84300000 to any suitable place in RAM. Then you have to start umicom by U-Boot command go with load addres + 0x40

nfs 84000000 ip_of_your_linux_host:/home/samygo/umicom.img;go 84000040

Loading umicom.img over nfs:

STi710x> nfs 84300000 192.168.0.1:/home/samygo/umicom.img
Using MAC Address 00:xx:xx:xx:xx:xx
STMAC: SMSC LAN8700 found
File transfer via NFS from server 192.168.0.1; our IP address is 192.168.0.10
Filename '/home/samygo/umicom.img'.
Load address: 0x84300000
Loading: ##############
done
Bytes transferred = 70548 (11394 hex)

umicom.img without parameters switch off Micom watchdogs and reset silent flag. Power LED starts quickly flashing to indicate that communication works. A short help is printed:

STi710x> bootm
## Booting image at 84300000 ...
   Image Name:   micom watchdog killer 1.0
   Image Type:   SH-4 Linux Standalone Program (uncompressed)
   Data Size:    70484 Bytes = 68.8 kB
   Load Address: 84300040
   Entry Point:  84300040
OK
=== www.SamyGO.tv === umicom.img 1.0 === micom watchdog killer ===
http://wiki.samygo.tv/index.php5?title=Watchdogs_and_MICOM_on_A_series(SH4)
micom via AsyncSerialController0, 0xb8030000
 baud rate set to 9600 Bd
pll1 config is 0x91d02 (391500 kHz), serial console baud divisor 1234
baud divisor for micom 637
 ff ff d0 00 00 00 00 00 d0 ...msg 'Set Sw Pvcc' sent
 ff ff e8 01 00 00 00 00 e9 ...msg 'App Init Ok' sent
 ff ff 17 00 00 00 00 00 17 ...msg 'Watchdog Disable' sent
 ff ff e3 03 00 00 00 00 e6 ...power LED quickly blinking
Use:
 go 84300040 e  ....enable watchdog
 go 84300040 d  ....disable watchdog
 go 84300040 18  ...switch off the TV
 go 84300040 29  ...power cycle reboot
 go 84300040 143  ..reset
 go 84300040 ram  ..presence test of RAM
 go 84300040 ovc [ndiv [mdiv [pexp]]] ..overclock ClkGenA PLL1

Example of command, switching TV off

STi710x> go 84300040 18
## Starting application at 0x84300040 ...
 ff ff 12 00 00 00 00 00 12 ...msg sent

## Application terminated, rc = 0x1

Early boot timeout

In the first 14 seconds since boot start Micom expects command Set_Sw_Pvcc (208). exeDSP sends it normally. If you don't want to or can't run exeDSP, use

/mtd_boot/MicomCtrl 208

If this command is not given in time, TV reboots 6 times and after that this watchdog deactivates itself.

Boot finished OK timeout

Micom expects command SetAppInitOk in 60 seconds from boot start otherwise it reboots.

/mtd_boot/MicomCtrl 232 1

Micom periodic watchdog

Periodic WD is disabled in boot time. exeDSP always enables WD during startup and then periodically sends alive message. Timeout is 40 seconds. Commands:

/mtd_boot/MicomCtrl 22      # watchdog enable
/mtd_boot/MicomCtrl 23      # watchdog disable
/mtd_boot/MicomCtrl 24      # alive message

/mtd_boot/MicomCtrl 133 1/0 # watchdog on/off
/mtd_boot/MicomCtrl 135     # get watchdog on/off
hexdump -v -n 9 -e '/1 "%02x "' /dev/ttyAS2 # reads reply packet from serial line

Linux kernel watchdog

Software watchdog with 30 second timeout and /proc/watchdog interface. /proc/watchdog is periodically written from exeDSP internal watchdog thread.

exeDSP internal watchdog

One thread of exeDSP periodically checks the other important threads and if one does not respond, reboots the TV. Watchdog thread can be disabled writing nonzero to address 0x2091164. If the watchdog thread is disabled, /proc/watchdog is not synced anymore.

Other Micom commands

/mtd_boot/MicomCtrl 18      # power off
/mtd_boot/MicomCtrl 29      # system restart (cycles main power off and on)
/mtd_boot/MicomCtrl 143     # CPU reset (TV screen is shifted because GPU is not properly initialized)

/mtd_boot/MicomCtrl 227 0-4 # power LED control 0..off, 1/2/3..slow/medium/fast flashing, 4..on