Getting access to u-boot (SH4)
Follow below steps to get access to the bootloader of your device. This page is modified copy of Getting access to u-boot as there are some important differences for A series models with SH4. Tested on T-RBYDEUC firmware
Contents
Prior to boot-process
1. Settings in Service menu are set before TV broke - do it now, if your TV isn`t broken - insurance for future
- Switch off the TV
- Enter Service Menu ( quickly push [INFO] [MENU] [MUTE] [POWER] on your remote control )
- Enable Advanced Menu ( navigate to Advanced, enter 0-0-0-0 )
- Change setting for your Ex-link interface to "STi" ( Advanced -> Adjust -> UART Select --> [ W.Mount | STi | MTK | Logic ] )
Setting Watchdog off does not seem to work on this model.
2. Make or buy Service Cable - ExLink
Terminal Connection Parameters
- Connect Ex-link and use following connection parameters with your terminal-client ( e.g. Kermit, Hyper Therminal or ZOC Terminal ):
Baudrate: 115200 Data bits: 8 Parity: none Stop bits: 1 Flow Control: none
During the boot-process
- TV is just switched on or rebooting
- Press and hold space
- If you're lucky, you'll see prompt
Enter MBL..[0001] _ShadowOS. Board: STb7109 *** Samsung U-Boot 1.1.2 (FlexOneNand) VER : 0029 - 195MHz (Jul 31 2008 - 12:49:44) - st2.0-14 *** DRAM: 128 MB In: serial Out: serial Err: serial Net: Using MAC Address 00:12:FB:1A:15:03 STMAC: SMSC LAN8700 found eeprom = 0 Hit any key to stop autoboot: 0 STi710x>
If you see just first two lines, you have not set Ex-link interface to "STi".
As there is no known way to switch watchdog off permanently on this model, you have only 14 seconds until watchdog reboots. After 5 consecutive reboots watchdog prolong the time to 1 minute. See Watchdogs and MICOM on A series(SH4).
Entering u-boot prompt needs good timing because original setting of parameter bootdelay=0 means that u-boot does not wait for keyboard.
Changes to environment
BE VERY CAREFUL AND ABSOLUTELY SURE YOU KNOW WHAT YOU ARE DOING
You can change bootdelay to 1 second to be sure you'll catch the prompt. Paste from clipboard command:
setenv bootdelay 1 saveenv
If you set long bootdelay, TV reboots 5 times until starts or you have to start boot manually.
To use serial console for linux at 115200 Baud you have to eliminate crippling of linux serial driver: add "yongsik" parameter. You can directly load kernel by pasting the command
bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000 quiet yongsik; bootm 0x84100000
Or you can save the change
setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rootfstype=squashfs bigphysarea=2000 quiet yongsik setenv bootcmd "bbm load kernel;bbm close;bootm 0x84100000" saveenv
See also [discussion]
Debug Menu
Let serial line calm down from huge boot messages and type
debug [ Enter ]
u-boot commands
? - alias for 'help' askenv - get environment variables from stdin autoscr - run script from memory base - print or set address offset bbm - BBM sub-system bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation dhcp - invoke DHCP client to obtain IP/boot params diskboot- boot from IDE device echo - echo args to console erase - erase FLASH memory exit - exit script ext2load- load binary file from a Ext2 filesystem ext2ls- list files in a directory (default /) fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) flinfo - print FLASH memory information fnw - FlexoneNand Writer go - start application at address 'addr' help - print online help ide - IDE sub-system iminfo - print header information for application image imls - list all images found in flash itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time test - minimal test like /bin/sh tftpboot- boot image via network using TFTP protocol usb - USB sub-system usbboot - boot from USB device version - print monitor version
Original u-boot environment
bootdelay=0 baudrate=115200 ipaddr=192.168.10.120 netmask=255.255.255.0 gatewayip=192.168.10.1 serverip=192.168.10.200 ethaddr=00:04:67:FF:FF:0F nfsserver=192.168.10.200 nfsrootdir=/data/Samsung/rootfs/rfs bigphys=2000 memsize=84M board=stb7100ref_27 monitor_base=0xA0000000 monitor_len=0x00020000 monitor_sec=1:0-8 env_sec=1:9-10 cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec kernel_base=0xA0040000 kernel_len=0x00200000 kernel_sec=1:11-42 cramfs_base=0xA0240000 cramfs_sec=1:43-90 cramfs_len=0x00300000 load_addr=0x84000000 updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$ bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr verify=n bootcmd=bbm load kernel; bbm close; setenv bootargs console=ttyAS0,115200 mem=$memsize root=/dev/tfsr6 rw rootfstype=squashfs bigphysarea=2000,watchdog:4000,rxsize:512 quiet; bootm 0x84100000