Samsung A 6 Series (sh4 CPU) Unbricking


From SamyGO
Revision as of 12:26, 27 December 2012 by Mpoos (talk | contribs) (minor touchups)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Unbricking a LA46A650

Disclaimer: You can irrevokably brick your TV if you do the wrong thing.
No responsibility is assumed if the guide is followed.
not that your TV is usable anyway ;-)

Symptoms

The following symptoms are apparent

  • Power cycling 5 times and then permanently on
  • Power supply capacitors are ok but were replaced anyway

Suspected bad software upgrade.

u-boot

The u-boot console is accessable via the service port. See elsewhere for cable.
Baud rate is standard 115200 8N1.
Press and hold space to stop the reboot. Only do this after the initial 5 power cycles is complete so it doesnt reboot on you. This will stop the incessant 

Enter MBL..[0001]

Enter MBL..[0001]

Initially the u-boot console produced no output to commands except for a few exceptions

  • echo
  • printenv
  • boot
  • setenv
  • saveenv

All typed characters are echoed
Test the console with 

echo test

And press Enter a few times.
Type any non whitespace character and Enter to exit the mode.

A good idea at this time is 

setenv bootdelay 1
saveenv

This will allow easier space access to u-boot when its working again.

  • Note: This happens only after a power on.

u-boot code details

u-boot relocates itself to 0x85f00000
The silent environment variable does not exist in this u-boot.
Use mw 0x85f87610 0 to unsilence the console.

This was determined by disassembling the u-boot image from T-AMBDAU.exe update file.

  • Load the image at offset 0x85f00000, SH4 processor
  • Start disassembling at 0x85f00000
  • There are tables after the relocation code as to where it goes next.

u-boot command set

The command set in u-boot is 

help
?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base    - print or set address offset
bbm   - BBM sub-system
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
diskboot- boot from IDE device
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
ext2load- load binary file from a Ext2 filesystem
ext2ls- list files in a directory (default /)
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
flinfo  - print FLASH memory information
FGP    - FlexoneNand CE Pattern Generator
go      - start application at address 'addr'
help    - print online help
ide     - IDE sub-system
iminfo  - print header information for application image
imls    - list all images found in flash
itest	- return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing)
mtest   - simple RAM test
mw      - memory write (fill)
nm      - memory modify (constant address)
fnw    - FlexoneNand Writer
FGP    - FlexoneNand CE Pattern Generator
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version

Note FGP is listed twice.

  • The 1st one is actually format
  • The 2nd is onwall which writes all partitions to nand flash.

LA46A650 TV Info

Some TV info... 

STi710x> coninfo
List of available devices:
serial   80000003 SIO stdin stdout stderr 
STi710x> bdinfo
boot_params = 0x85DDFF88
memstart    = 0x84000000
memsize     = 0x08000000
flashstart  = 0xA0000000
flashsize   = 0x85DFFF88
flashoffset = 0x00044080
ethaddr     = 00:01:01:01:01:01
ip_addr     = 10.240.74.57
baudrate    = 115200 bps

STb7109 version 3.x
PLL0      = 531 MHz
PLL1      = 360 MHz
ST40  CPU = 265 MHz
ST40  BUS = 132 MHz
ST40  PER = 66 MHz
ST231 CPU = 360 MHz
ST BUS    = 180 MHz
EMI       = 90 MHz
LMI       = 180 MHz
STi710x> flinfo

Bank # 1: missing or unknown FLASH type

Default Environment

STi710x> printenv
baudrate=115200
ipaddr=10.240.74.57
netmask=255.255.255.0
gatewayip=10.240.74.1
serverip=10.240.74.106
ethaddr=00:04:67:FF:FF:0F
nfsserver=192.168.10.200
nfsrootdir=/data/Samsung/rootfs/rfs
bigphys=2000
memsize=84M
board=stb7100ref_27
monitor_base=0xA0000000
monitor_len=0x00020000
monitor_sec=1:0-8
env_sec=1:9-10
cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec
kernel_base=0xA0040000
kernel_len=0x00200000
kernel_sec=1:11-42
cramfs_base=0xA0240000
cramfs_sec=1:43-90
cramfs_len=0x00300000
load_addr=0x84000000
updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec
updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec
updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec
ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off 
nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp 
hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr 
nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512
cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet
testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr 
verify=n
bootdelay=0
stdin=serial
stdout=serial
stderr=serial
bootcmd=run ipconf;run hwnfconf; bbm open; bbm load kernel; bbm close; setenv bootargs mem=$memsize root=/dev/tbml6 rw rootfstype=squashfs ip=$ip nwhwconf=$nwhwnet bigphysarea=2000 stmmaceth=msglvl:1,watchdog:4000,rxsize:512 quiet; bootm 0x84100000 

Environment size: 1968/131068 bytes

Flash Programming

The normal flash commands dont work so don't use them.
Also don't use the commands for flash update shown in the environment.

The common bbm usb command doesn't work in this A series model.

There is an onw command (in help it shows as fnw) but that wont work. use 

help onw
onw  
    - FlexoneNand Writer
MBL    ADDRESS : 0x87400000
U-BOOT ADDRESS : 0x87500000
KERNEL ADDRESS : 0x87600000
ROOTFS ADDRESS : 0x87A00000

To get the address of the image it will use to write the nand flash partition.
There are addresses for the other partitions but they are not shown anywhere.
The full list is 

1     MBL    ADDRESS : 0x87400000
2     U-BOOT ADDRESS : 0x87500000
3     U-Boot param data - not writable
4     KERNEL ADDRESS : 0x87600000
5     ROOTFS ADDRESS : 0x87A00000
6     BOOTIMG ADDRESS : 0x88200000
7     EXEDATA ADDRESS : 0x88A00000
8     APPDATA ADDRESS : 0x90A00000
9     UNKNOWN ADDRESS : 0x91600000

bbm show partition

bbm show partition works but the format is different. 

STi710x> bbm show partition
<< PARTITION INFORMATION >>
 id        : Boot Loader (0x1)
 attr      : RW (0x1)
 first_blk    : 0
 no_blks : 1
  ---------------------  
 id        : u-boot (0x2)
 attr      : RW (0x1)
 first_blk    : 1
 no_blks : 3
  ---------------------  
 id        : u-boot parmeter (0x5)
 attr      : RW (0x1)
 first_blk    : 4
 no_blks : 1
  ---------------------  
 id        : User Defined (0x4)
 attr      : RW (0x1)
 first_blk    : 5
 no_blks : 2
  ---------------------  
 id        : KERNEL (0x3)
 attr      : RW (0x1)
 first_blk    : 7
 no_blks : 24
  ---------------------  
 id        : CRAMFS (0x8)
 attr      : RW (0x1)
 first_blk    : 31
 no_blks : 36
  ---------------------  
 id        : RFS (0x9)
 attr      : RW (0x1)
 first_blk    : 67
 no_blks : 80
  ---------------------  
 id        : User Defined (0xa)
 attr      : RW (0x1)
 first_blk    : 147
 no_blks : 92
  ---------------------  
 id        : User Defined (0xb)
 attr      : RW (0x1)
 first_blk    : 239
 no_blks : 40
  ---------------------  
 id        : User Defined (0xc)
 attr      : RW (0x1)
 first_blk    : 279
 no_blks : 92
  ---------------------  
 id        : User Defined (0xd)
 first_blk    : 371
 no_blks : 40
  ---------------------  
 id        : User Defined (0xe)
 attr      : RW (0x1)
 first_blk    : 411
 no_blks : 36
  ---------------------  
 id        : User Defined (0xf)
 attr      : RW (0x1)
 first_blk    : 447
 no_blks : 48
  ---------------------

Checking the kernel partition

This is the only partition that can be checked 

bbm open
bbm load kernel
bbm close
iminfo 0x84000000

This will show a bad CRC if it is the problem partition.
Unfortunately the other partitions are not loadable under u-boot

Unbricking procedure

If you get this far, u-boot is working with full console access.

Load image for corrupt partition

Load the kernel to 0x87600000 using 

fatload usb 1 0x87600000 /vmlinux.ub

or if your USB Flash Drive is not working for you 

loadb 0x87600000

and use kermit protocol to send the file over the Service Port connection.

Write the image into NAND Flash

next run onw to get the writer menu. I selected 4 to update the kernel 

STi710x> onw
[ONW:   ] Bootloader already formated BML

 ---------------- Sub Menu -------------
   Update select partition            
  1 : MBL Bootloader partition    
  2 : u-boot partitionn               
  4 : kernel image partition          
  5 : rootfs image partition          
  6 : boot image partition          
  7 : exeDSP image partition          
  8 : appdata image partition          
  x : go Main menu                    
 ---------------------------------------
 ##  Number of Partition : 13

 ##  Select a partition : [ONW:   ]  Erase Blocks  : 000004008012016020025029033037041045050054058062066070075079083087091095[ONW:   ]  +-----------------------+[ONW:   ]  | IMAGE ERASE FINISHED! |[ONW:   ]  +-----------------------+[ONW:   ]  Write Blocks  : 000001002003004005006007008009010011012013014015016017018019020021022023024025026027028029030031032033034035036037038039040041042043044045046047048049050051052053054055056057058059060061062063064065066067068069070071072073074075076077078079080081082083084085086087088089090091092093094095096097098099100[ONW:   ]  +-----------------------+[ONW:   ]  | IMAGE WRITE FINISHED! |[ONW:   ]  +-----------------------+
Completed Update Image ? (y/n)

Reboot!Enter MBL..[0001]

Results

After the reboot, it all sprang into life.
A full usb software update in the conventional may be warranted to get everything up to scratch.

Retrieved from "http://wiki.samygo.tv/index.php?title=Samsung_A_6_Series_(sh4_CPU)_Unbricking&oldid=3369"