Samsung A 6 Series (sh4 CPU) Unbricking
Unbricking a LA46A650
Disclaimer: You can irrevokably brick your TV if you do the wrong thing.
No responsibility is assumed if the guide is followed.
not that your TV is usable anyway ;-)
Symptoms
The following symptoms are apparent
- Power cycling 5 times and then permanently on
- Power supply capacitors are ok but were replaced anyway
Suspected bad software upgrade.
u-boot
The u-boot console is accessable via the service port. See elsewhere for cable.
Baud rate is standard 115200 8N1.
Press and hold space to stop the reboot. Only do this after the initial 5 power cycles is complete so it doesnt reboot on you. This will stop the incessant
Enter MBL..[0001] Enter MBL..[0001]
Initially the u-boot console produced no output to commands except for a few exceptions
- echo
- printenv
- boot
- setenv
- saveenv
All typed characters are echoed
Test the console with
echo test
And press Enter a few times.
Type any non whitespace character and Enter to exit the mode.
A good idea at this time is
setenv bootdelay 1 saveenv
This will allow easier space access to u-boot when its working again.
- Note: This happens only after a power on.
u-boot code details
u-boot relocates itself to 0x85f00000
The silent environment variable does not exist in this u-boot.
Use mw 0x85f87610 0 to unsilence the console.
This was determined by disassembling the u-boot image from T-AMBDAU.exe update file.
- Load the image at offset 0x85f00000, SH4 processor
- Start disassembling at 0x85f00000
- There are tables after the relocation code as to where it goes next.
u-boot command set
The command set in u-boot is
help ? - alias for 'help' askenv - get environment variables from stdin autoscr - run script from memory base - print or set address offset bbm - BBM sub-system bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation diskboot- boot from IDE device echo - echo args to console erase - erase FLASH memory exit - exit script ext2load- load binary file from a Ext2 filesystem ext2ls- list files in a directory (default /) fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) flinfo - print FLASH memory information FGP - FlexoneNand CE Pattern Generator go - start application at address 'addr' help - print online help ide - IDE sub-system iminfo - print header information for application image imls - list all images found in flash itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nm - memory modify (constant address) fnw - FlexoneNand Writer FGP - FlexoneNand CE Pattern Generator printenv- print environment variables protect - enable or disable FLASH write protection reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time test - minimal test like /bin/sh usb - USB sub-system usbboot - boot from USB device version - print monitor version
Note FGP is listed twice.
- The 1st one is actually format
- The 2nd is onwall which writes all partitions to nand flash.
LA46A650 TV Info
Some TV info...
STi710x> coninfo List of available devices: serial 80000003 SIO stdin stdout stderr STi710x> bdinfo boot_params = 0x85DDFF88 memstart = 0x84000000 memsize = 0x08000000 flashstart = 0xA0000000 flashsize = 0x85DFFF88 flashoffset = 0x00044080 ethaddr = 00:01:01:01:01:01 ip_addr = 10.240.74.57 baudrate = 115200 bps STb7109 version 3.x PLL0 = 531 MHz PLL1 = 360 MHz ST40 CPU = 265 MHz ST40 BUS = 132 MHz ST40 PER = 66 MHz ST231 CPU = 360 MHz ST BUS = 180 MHz EMI = 90 MHz LMI = 180 MHz STi710x> flinfo Bank # 1: missing or unknown FLASH type
Default Environment
STi710x> printenv baudrate=115200 ipaddr=10.240.74.57 netmask=255.255.255.0 gatewayip=10.240.74.1 serverip=10.240.74.106 ethaddr=00:04:67:FF:FF:0F nfsserver=192.168.10.200 nfsrootdir=/data/Samsung/rootfs/rfs bigphys=2000 memsize=84M board=stb7100ref_27 monitor_base=0xA0000000 monitor_len=0x00020000 monitor_sec=1:0-8 env_sec=1:9-10 cleanenv=protect off $env_sec;erase $env_sec;protect on $env_sec kernel_base=0xA0040000 kernel_len=0x00200000 kernel_sec=1:11-42 cramfs_base=0xA0240000 cramfs_sec=1:43-90 cramfs_len=0x00300000 load_addr=0x84000000 updatebootrom=protect off $monitor_sec;erase $monitor_sec;tftp $load_addr u-boot.bin;cp.b $load_addr $monitor_base $monitor_len;protect on $monitor_sec updatelinux=protect off $kernel_sec;erase $kernel_sec;tftp $load_addr vmlinux.ub;cp.b $load_addr $kernel_base $kernel_len;protect on $kernel_sec updaterfs=protect off $cramfs_sec;erase $cramfs_sec;tftp $load_addr rfs.cramfs;cp.b $load_addr $cramfs_base $cramfs_len;protect on $cramfs_sec ipconf=set ip $ipaddr::$gatewayip:$netmask:stb7109::off nfsconf=set nfsroot $nfsserver:$nfsrootdir,nfsvers=2,rsize=4096,wsize=8192,tcp hwnfconf=set nwhwnet device:eth0,hwaddr:$ethaddr nfsbootargs=run ipconf;run nfsconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/nfs rw nfsroot=$nfsroot ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 cramfsbootargs=run ipconf;run hwnfconf;set bootargs console=ttyAS0,115200 mem=$memsize root=/dev/mtdblock2 rw rootfstype=cramfs ip=$ip nwhwconf=$nwhwnet bigphysarea=$bigphys stmmaceth=msglvl:0,watchdog:4000,rxsize:512 quiet testlinux=tftp $load_addr vmlinux.ub; bootm $load_addr verify=n bootdelay=0 stdin=serial stdout=serial stderr=serial bootcmd=run ipconf;run hwnfconf; bbm open; bbm load kernel; bbm close; setenv bootargs mem=$memsize root=/dev/tbml6 rw rootfstype=squashfs ip=$ip nwhwconf=$nwhwnet bigphysarea=2000 stmmaceth=msglvl:1,watchdog:4000,rxsize:512 quiet; bootm 0x84100000 Environment size: 1968/131068 bytes
Flash Programming
The normal flash commands dont work so don't use them.
Also don't use the commands for flash update shown in the environment.
The common bbm usb command doesn't work in this A series model.
There is an onw command (in help it shows as fnw) but that wont work. use
help onw
onw
- FlexoneNand Writer
MBL ADDRESS : 0x87400000
U-BOOT ADDRESS : 0x87500000
KERNEL ADDRESS : 0x87600000
ROOTFS ADDRESS : 0x87A00000
To get the address of the image it will use to write the nand flash partition.
There are addresses for the other partitions but they are not shown anywhere.
The full list is
1 MBL ADDRESS : 0x87400000 2 U-BOOT ADDRESS : 0x87500000 3 U-Boot param data - not writable 4 KERNEL ADDRESS : 0x87600000 5 ROOTFS ADDRESS : 0x87A00000 6 BOOTIMG ADDRESS : 0x88200000 7 EXEDATA ADDRESS : 0x88A00000 8 APPDATA ADDRESS : 0x90A00000 9 UNKNOWN ADDRESS : 0x91600000
bbm show partition
bbm show partition works but the format is different.
STi710x> bbm show partition << PARTITION INFORMATION >> id : Boot Loader (0x1) attr : RW (0x1) first_blk : 0 no_blks : 1 --------------------- id : u-boot (0x2) attr : RW (0x1) first_blk : 1 no_blks : 3 --------------------- id : u-boot parmeter (0x5) attr : RW (0x1) first_blk : 4 no_blks : 1 --------------------- id : User Defined (0x4) attr : RW (0x1) first_blk : 5 no_blks : 2 --------------------- id : KERNEL (0x3) attr : RW (0x1) first_blk : 7 no_blks : 24 --------------------- id : CRAMFS (0x8) attr : RW (0x1) first_blk : 31 no_blks : 36 --------------------- id : RFS (0x9) attr : RW (0x1) first_blk : 67 no_blks : 80 --------------------- id : User Defined (0xa) attr : RW (0x1) first_blk : 147 no_blks : 92 --------------------- id : User Defined (0xb) attr : RW (0x1) first_blk : 239 no_blks : 40 --------------------- id : User Defined (0xc) attr : RW (0x1) first_blk : 279 no_blks : 92 --------------------- id : User Defined (0xd) first_blk : 371 no_blks : 40 --------------------- id : User Defined (0xe) attr : RW (0x1) first_blk : 411 no_blks : 36 --------------------- id : User Defined (0xf) attr : RW (0x1) first_blk : 447 no_blks : 48 ---------------------
Checking the kernel partition
This is the only partition that can be checked
bbm open bbm load kernel bbm close iminfo 0x84000000
This will show a bad CRC if it is the problem partition.
Unfortunately the other partitions are not loadable under u-boot
Unbricking procedure
If you get this far, u-boot is working with full console access.
Load image for corrupt partition
Load the kernel to 0x87600000 using
fatload usb 1 0x87600000 /vmlinux.ub
or if your USB Flash Drive is not working for you
loadb 0x87600000
and use kermit protocol to send the file over the Service Port connection.
Write the image into NAND Flash
next run onw to get the writer menu. I selected 4 to update the kernel
STi710x> onw [ONW: ] Bootloader already formated BML ---------------- Sub Menu ------------- Update select partition 1 : MBL Bootloader partition 2 : u-boot partitionn 4 : kernel image partition 5 : rootfs image partition 6 : boot image partition 7 : exeDSP image partition 8 : appdata image partition x : go Main menu --------------------------------------- ## Number of Partition : 13 ## Select a partition : [ONW: ] Erase Blocks : 000004008012016020025029033037041045050054058062066070075079083087091095[ONW: ] +-----------------------+[ONW: ] | IMAGE ERASE FINISHED! |[ONW: ] +-----------------------+[ONW: ] Write Blocks : 000001002003004005006007008009010011012013014015016017018019020021022023024025026027028029030031032033034035036037038039040041042043044045046047048049050051052053054055056057058059060061062063064065066067068069070071072073074075076077078079080081082083084085086087088089090091092093094095096097098099100[ONW: ] +-----------------------+[ONW: ] | IMAGE WRITE FINISHED! |[ONW: ] +-----------------------+ Completed Update Image ? (y/n) Reboot!Enter MBL..[0001]
Results
After the reboot, it all sprang into life.
A full usb software update in the conventional may be warranted to get everything up to scratch.
