[HT-E4200] Loader problem

[gutmaj]

I got second hand Samsung HT-E4200 not fully operable after firmware flashing (probably corrupted flashing, what I've learned from the 1st owner). I'm looking for help or advice how to troubleshoot it further. But let start from the beginning:

Problem Statement: Unit boots after power-on (from both from panel as well from remote controller) to initial screen as normal, but at the end of the pop-up window "Please close the tray" shows up, although the tray is closed. Deck/loader is not operable (no reaction to play, stop, eject requests both from front panel neither remote controller). This pop-up prevents going to any menu options including firmware update. On Front display "OPEN" is shown. When power-off is triggered (both front panel or RC) screen shuts off, but "OFF" is continuously shown on front display.

Device Info: ]Model: HTE4200ZF; Remote Controller: AH59-02350A; Audio: 2.1, SPDIF In; Video: 1x HDMi, 1x Composite; USB: 2x Port (1x front, 1x rear), Ethernet LAN; Options: FM Tuner; Main SoC: Samsung? Firenze SPD1004 (IC29); MiCom: Sanyo LC87F5WC8A (IC23); Loader/deck/OPU: Sunext SC7300 (IC2);

Troubleshooting Status:
[*] Obtained Service Manual for this unit - google is your friend
[*] Serial console to main SoC connected
[*] Cannot get access to U-BOOT by pressing <SHIFT> + <~>
[*] Possible to see system log which shows that firmware on SoC is secure boot verified

Code: Select all

Secure boot for kernel: success: 3386528-1541.
...
[CIP_KERNEL] >>> (/bin/authuld) file is successfully authenticated <<<
 ...
[CIP_KERNEL] Success!! Authuld is successfully completed.

[*] MiCom firmware looks okay while it controls power rails, receives RC keys and front panel buttons, VFD display works too
[*] Can see in system log that unit reacts to front panel buttons, RC buttons, USB device (pendrive detected)
[*] System log overwhelm with errors 22 from loader suggesting this sub-circuit isn't working properly

Code: Select all

...
[InitLoaderModule] Thread_ID=0x40207450 : CREATE
cdrom mod ld
sr_mod mod ld
sd_mod mod ld
libata mod ld
...
m_semInsLoaderModules.Take
[LoaderHal_Create] : Create the loader
LoaderCreate() -- enter!
...
ata1: softreset failed (device not ready)
ata1: softreset failed (device not ready)
ata1: softreset failed (device not ready)
ata1: softreset failed (device not ready)
ata1: reset failed, giving up
m_semLoadATAModules.Give
...
errno : 6(No such device or address)  [BdsBDSystemLoaderCtrl.cpp][Create][1303]	LoaderCreate() --FAILED 
...
errno : 22(Invalid argument)  [BdsBDSystemLoaderInfo.cpp][GetStatus][440]	LoaderGetStatus() --FAILED 
errno : 22(Invalid argument)  [BdsBDSystemLoaderInfo.cpp][GetStatus][440]	LoaderGetStatus() --FAILED 
errno : 22(Invalid argument)  [BdsBDSystemLoaderInfo.cpp][GetStatus][440]	LoaderGetStatus() --FAILED 
errno : 22(Invalid argument)  [BdsBDSystemLoaderInfo.cpp][GetStatus][440]	LoaderGetStatus() --FAILED 

[*] I'm able to get into Top Debug Menu and access sub-menus however it is difficult due to error 22 flooding the system log

Code: Select all

====================================
      [ TOP Debug Menu]   
------------------------------------
  2  : Platform Print Setting       
  4  : Oss Print Debug level        
  5  : Sdal Print Setting           
  6  : Sdal Trace Setting           
  10 : OSS Debugger                 
  11 : TD Debug                     
  21 : Louvre Print Setting         
------------------------------------
  30 : Arts Debug 		            
------------------------------------
  60 : MediaLink Debug              
-----------------------------------
  99 : Exit                         
====================================
DBG>

[gutmaj]

Hypothesis: Based on above mentioned system log errors and fact that deck seems not to react at all (no spindle, no optical pick-up unit movement, no tray open/close) I suspect problem is with he loader sub-system where Sunext's SC7300 single chip optical drive device IC is main component connected to main SoC over SATA interface which looks not responsive in the system log. There is no much info in the net for this IC - will need community help with further investigation (see questions below). Here are further investigation path (any comments and/or more ideas welcome):
(1) Power rails problem all five power rails verified and okay (FE_12V_PW, FE5.0V_PW, FE3.3V_PW, FE1.2V_PW, BLD12V_PW)
(2) Wrong deck open/close signals both OPEN and CLOSE signal reacts correctly upon manual try move in/out (both signals are active low accordingly)
(3) Corrupted loader flash image (16Mbit, SPI) [UPDATE: 2024/Jan/20] Bingo! I've reprogram off-board the loader flash memory (IC1: Winbond W25Q16BVSSIG) and device has started without flooding loader errors in system log. The tray was operable from remote controller, front panel as well from TDM. Unfortunately after power-off/on cycle problem reappear, and loader doesn't react on any action, the system log is flooded again with loader errors. I suspect there is a copy of the loader image somewhere else in eMMC and system overwrote it.
(4) Faulty ICs or other components in loader sub-system

Questions/Requests:
[Q1] Looking for more info on SC7300 IC
[Q2] There is serial console for loader ICs in my unit. Does anyone know what is its speed, what data, logs can be capture there?
[Q3] Where to find loader flash image? [UPDATE 2024/Jan/20] Finally I've decrypted, de-xor genuine and unsquased firmware package download from Smasung's support web page. The loader images are stored in root folder of exe.img. These files are 512kB long and when you parse them with strings utility you will find plenty of plain text information suggesting it is loader firmware. Additionally I've read out partitions.txt which describes partitions on eMMC and it looks there are ones which supposed to store loader images too - that's probably causing problem with overwriting serial flash after power-off/on cycle
[Q4] Is there any way to trigger firmware update from TDM on my device?
[Q5] How to stop system log dump on serial console and get access to Linux command line?
[Q6] Any hints how to get into u-boot at the beginning of power-up?

[UPDATE 2024/Jan/20] eMMC memory partition scheme as per partitions.txt retrieved from exe.img (B-FIRHT7WWC 1015.1)

Code: Select all

partitionID	flash_device_name	flash_device_size	flash_image_name	flash_device_type	flash_upgrade_type	flash_partition_map	flash_mount_path	default_block_size	flash_format_option	flash_mount_option
0	/dev/mmcblk0	524288	onboot.bin	MLC	NONE	BOOTLOADER0	NONE	524288	NONE	NONE
1	/dev/mmcblk0p1	524288	u-boot.bin	MLC	NONE	BOOTLOADER1	NONE	524288	NONE	NONE
2	/dev/mmcblk0p2	1048576	boot_image.raw	MLC	NONE	CONTENT1	NONE	524288	NONE	NONE
3	/dev/mmcblk0p3	6291456	Image	MLC	USER	KERNEL0	NONE	524288	NONE	NONE
4	/dev/mmcblk0p4	0	ex_partition	MLC	NONE	NONE	NONE	524288	NONE	NONE
5	/dev/mmcblk0p5	4718592	rootfs.img	MLC	USER	RFS0	NONE	524288	NONE	NONE
6	/dev/mmcblk0p6	6291456	Image	MLC	USER	KERNEL1	NONE	524288	NONE	NONE
7	/dev/mmcblk0p7	4718592	rootfs.img	MLC	USER	RFS1	NONE	524288	NONE	NONE
8	/dev/mmcblk0p8	8192	sign0.bin	MLC	NONE	SECUREMAC0	NONE	524288	NONE	NONE
9	/dev/mmcblk0p9	8192	sign1.bin	MLC	NONE	SECUREMAC1	NONE	524288	NONE	NONE
10	/dev/mmcblk0p10	8192	NONE	MLC	NONE	NONE	NONE	524288	NONE	NONE
11	/dev/mmcblk0p11	8192	NONE	MLC	NONE	NONE	NONE	524288	NONE	NONE
12	/dev/mmcblk0p12	31457280	NONE	MLC	OTHER	NONE	/mtd_rwarea	524288	NONE	NONE
13	/dev/mmcblk0p13	146800640	exe.img	MLC	USER	EXE0	/mtd_exe	524288	NONE	-t_squashfs
14	/dev/mmcblk0p14	146800640	exe.img	MLC	USER	EXE1	/mtd_exe	524288	NONE	-t_squashfs
15	/dev/mmcblk0p15	136314880	rocommon.img	MLC	OTHER	CONTENT0	/mtd_rocommon	524288	NONE	-t_squashfs
16	/dev/mmcblk0p16	1048576	Loader_HL_E5500.bin	MLC	NONE	NONE	NONE	524288	NONE	NONE
17	/dev/mmcblk0p17	1048576	Loader_HL_E7500.bin	MLC	NONE	NONE	NONE	524288	NONE	NONE
18	/dev/mmcblk0p18	1048576	Loader_HL_E8200.bin	MLC	NONE	NONE	NONE	524288	NONE	NONE
19	/dev/mmcblk0p19	1048576	Loader_HL_ES8200.bin	MLC	NONE	NONE	NONE	524288	NONE	NONE
20	/dev/mmcblk0p20	1048576	NONE	MLC	NONE	NONE	NONE	524288	NONE	NONE
21	/dev/mmcblk0p21	1048576	NONE	MLC	NONE	NONE	NONE	524288	NONE	NONE
22	/dev/mmcblk0p22	6291456	NONE	MLC	NONE	NONE	/mtd_drmregion_a	524288	-S_1024-s_1	-t_rfs
23	/dev/mmcblk0p23	6291456	psadata.img	MLC	OTHER	RESERVE0	/mtd_drmregion_b	524288	-S_1024-s_1	-t_rfs
24	/dev/mmcblk0p24	367001600	NONE	MLC	NONE	NONE	NONE	524288	NONE	NONE
25	/dev/mmcblk0p25	1073741824	NONE	MLC	NONE	NONE	/mtd_rwbdjava	524288	NONE	NONE
26	/dev/mmcblk0p26	31457280	NONE	MLC	NONE	NONE	/mtd_contents	524288	NONE	NONE
27	/dev/mmcblk0p27	24403968	NONE	MLC	NONE	NONE	/tmp/app_log	524288	NONE	NONE