Getting access to u-boot (SH4)

Follow below steps to get access to the bootloader of your device. This page is modified copy of Getting access to u-boot as there are some important differences for A series models with SH4. Tested on T-RBYDEUC firmware

Prior to boot-process

1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future

• Switch off the TV
• Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
• Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
• Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | STi | MTK | Logic ] )

Setting Watchdog off does not seem to work on this model.

2. Make or buy Service Cable - ExLink

Terminal Connection Parameters

• Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):

Baudrate: 115200
Data bits: 8
Parity: none
Stop bits: 1
Flow Control: none

During the boot-process

• TV is just switched on or rebooting
• Press and hold space
• If you're lucky, you'll see prompt

Enter MBL..[0001]
_ShadowOS.


Board: STb7109


*** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz  (Jul 31 2008 - 12:49:44) - st2.0-14 ***

DRAM:  128 MB
In:    serial
Out:   serial
Err:   serial
Net:   Using MAC Address 00:12:FB:1A:15:03
STMAC: SMSC LAN8700 found
eeprom = 0
Hit any key to stop autoboot:  0
STi710x>

If you see just first two lines, you have not set Ex-link interface to "STi".

As there is no known way to switch watchdog off on this model, you have only 14 seconds until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute.

Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.

Changes to environment

BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT ARE DOING

You can change bootdelay to 1 second to be sure you'll catch it. Paste from clipboard command:

setenv bootdelay 1
saveenv

If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.

To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter. You can directly load kernel by pasting the command

bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000

Or you can save the change

setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik
setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000"
saveenv

See also [discussion]

Debug Menu

Let serial line calm down from huge boot messages and type

debug [ Enter ]

u-boot commands

?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bbm   - BBM sub-system
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp	- boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp	- invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
flinfo  - print FLASH memory information
fnw    - FlexoneNand Writer
go      - start application at address 'addr'
help    - print online help
ide     - IDE sub-system
iminfo  - print header information for application image
imls    - list all images found in flash
itest	- return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nfs	- boot image via network using NFS protocol
nm      - memory modify (constant address)
ping	- send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version

Original u-boot environment

bootdelay=0
baudrate=115200
ipaddr=192.168.10.120
netmask=255.255.255.0
gatewayip=192.168.10.1
serverip=192.168.10.200
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$
bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr
verify=n
bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000