Modifying the bootloader

[dynamic1969]

I am opening this thread to start discussions and fact finding as to how we can alter the bootloader.
Older LExxAXXXX models apparently allowed to interrupt the bootloader by hitting space during the start-up process.

My attempts so far have not yet been successful to interrupt the bootloader on a UXxxB70xx.

Let's start the discussion on this topic here and see that we get our TVs to boot alternative images soon.

Regards
dynamic

[arris69]

hi,
next time i will make some experiments with bootloader and kenrnel
but to make later work easier and make a packaging/update system
i need some infos about different hardware.

full model name:
(sticker on tv)

installed software wersion:
via telnet:
cat /mtd_rwarea/Version.0
cat /mtd_rwarea/Version.1
or via tv:
menu -> ? -> Software-Update (in this case pls the firmware folder name too, like T-CHU7DEUC)

most important, machineinfo:
via telnet:
cat /proc/cpuinfo | grep Hard
cat /proc/version

as an examle:
ModelCode: UE40B7020WWXXC
cat /mtd_rwarea/Version.0
SWU_T-CHU7DEUC_000104_I02_EK000DK000_000101
cat /mtd_rwarea/Version.1
SWU_T-CHU7DEUC_002008_I02_EK000DK000_090816
cat /proc/cpuinfo | grep Hard
Hardware : Samsung-SDP83 Eval. Board(64bit 512MB)
cat /proc/version
[26_2G_64_512] Linux version 2.6.18_SELP-ARM (ksh921@sp) (gcc version 4.2.0 20070514 (GPL2) (SELP 4.2.0-3.0.5.custom 2007-10-31(14:53))) #73 PREEMPT Tue Mar 1008:54:07 KST 2009

tnx
arris

ps: you see most information also in service menu (Info - Menu - Mute - Power)

[dynamic1969]

Below the desired information.

Code: Select all

Model Code: UE46B7000WWXXU
# cat /mtd_rwarea/Version.0
SWU_T-CHU7DEUC_002008_I02_EK000DK000_090814#
# cat /mtd_rwarea/Version.1
cat: /mtd_rwarea/Version.1: No such file or directory
# cat /proc/cpuinfo | grep Hard
Hardware        : Samsung-SDP83 Eval. Board(64bit 512MB)
# cat /proc/version
[27_2G_64_512] Linux version 2.6.18_SELP-ARM (ksh921@sp) (gcc version 4.2.0 20070514 (GPL2) (SELP 4.2.0-3.0.5.custom 2007-10-31(14:53))) #79 PREEMPT Thu Mar 12 11:15:31 KST 2009

Have you already managed to interrupt the bootloader ?

Regards
dynamic

[arris69]

Below the desired information.
...

Have you already managed to interrupt the bootloader ?

Regards
dynamic

no, not yet.
but the sources says the bootloader has a menu, network boot capability and a debug interface (JadeTarget),
some kind of firmware update functions (for rescue cases?)
the question is what is realy enabled?
may the debug port is the unknown 3-pin connector on the board (photo in avs-forum).

may some u-boot specialists here?

arris

[erdem_ua]

I think we can listen this port via Bus Pirate device. It supports some protocols together.
Do you know which protocols use 3 wire interface? It could be I2C, (1 clock + 1 data + 1 ground = 3 )

My TV model code is LE40B650T2WXXH too.

[arris69]

I think we can listen this port via Bus Pirate device. It supports some protocols together.
Do you know which protocols use 3 wire interface? It could be I2C, (1 clock + 1 data + 1 ground = 3 )

My TV model code is LE40B650T2WXXH too.

for me it looks like the outside serial port (stereo plug)
may you like take a look at uboot/board/sdp/leonid/ directory from http://www.samsung.com/global/opensourc ... t_b650.tgz
in JadeTarget.c: if(jadeDebugInit(DPRO_DEVICE,115200) -> i guess it is a serialport
for the protocol: Dprotocol.h & DprotocolNoOs.c may JCommand.h etc.

there is also a JadeTarget binary programm on the tv

Code: Select all

cd /mtd_exe
./JadeTarget

i think this enable the debug port, the tv shut off and on again (go off after few minutes and switch on again, looks like a
reboot after timeout).

friday i made a rs323 cable and a quick test -> was ok saw login on serial as i conneted via telnet.

what i forgot to check the boot commandline as i started the tv in service mode (Info - Menu - Mute - Power)

Code: Select all

cat /proc/cmdline

(in servicemode telnet was active too, may we can figure out why exeDSP know that we pushed the buttons before switch on)

arris

[erdem_ua]

(in servicemode telnet was active too, may we can figure out why exeDSP know that we pushed the buttons before switch on)
arris

If unknown 3 pin connector is a serial port too. Whats the point to put 2 serial port to TV that makes same job? Or Is there a any difference on bootlogs / debug outputs?

[arris69]

If unknown 3 pin connector is a serial port too. Whats the point to put 2 serial port to TV that makes same job? Or Is there a any difference on bootlogs / debug outputs?

may a serial controller is cheaper than a jtag interface, just samsung knows, i _guess_ it is a serialport,
may it is some other

but i think the communication to the exeDSP is possible over serial devices.
take look to the open files:
http://linux.zsolttech.com/Samsung/Deve ... -files.txt
lot apps use ttyS1, for what?

arris

[dynamic1969]

i think this enable the debug port, the tv shut off and on again (go off after few minutes and switch on again, looks like a
reboot after timeout).

My guess is, that exeDSP stops after a certain time when the debug-port is enabled, right ? This would also explain the automatic reboot, as a watchdog is monitoring the presence of exeDSP and rebooting, if exeDSP is absent.

In any case, I believe that you should be able to prevent the reboot, by entering

Code: Select all

/mtd_boot/MicomCtrl 23

before you enable the debug port.

Regards
dynamic