U-BOOT bootloader (for MStar and Saturn based models)
- Start terminal emulation program, and connect to tv's serial console at 115200 baudrate.
- Keep hitting the 'ESC' key (or you may try 'ENTER' instead) while powering on the tv pressing 'POWER' button on remote control until you see a "mstar #" or "saturn7 #" shell prompt (this is the u-boot bootloader shell).
- Hit enter to clear the former keypresses. You will maybe get an error about it, just ignore.
Changing eDebugMode on Saturn 6
eDebugMode could have following values:
0 - DEBUG
1 - EVENT
2 - RELEASE
to change it:
- Switch on TV
- Start terminal emulation program and connect to TV's serial console at 115200 baudrate.
- Enter debug menu.
- Type sh & press Enter.
At lgsw# prompt:
1 Type cd /mnt/lg/models
2 Type vi RELEASE.cfg & press Enter.
3 Move down to eDebugMode,EVENT.
4 Press l-button til you come to E in EVENT.
5 Now type cwRELEASE.
6 Save changes & exit vi.
Type sync & press Enter. Voila!
CFE bootloader (for Broadcom based models)
With the latest tv models (that uses broadcom chipset) LG introduced a new bootloader namely CFE (common firmware environment). It was originally designed by broadcom itself (see http://www.broadcom.com/support/communications_processors/downloads.php for original sources) and then modified by LG for their requirements. The following documentation is also included in the original source package that is available at broadcom site: http://xinu.mscs.mu.edu/wiki/images/3/39/Cfe-broadcom.pdf
Enter CFE shell
You can enter the tv's CFE bootloader shell with the following procedure:
- check / modify the Debug status option in IN_START service menu.
- standby tv
- serial connect to tv with this connection parameters: 115200, 8N1
- press and hold the ` key (ascii code = 0x60) (or CTRL+C in some Brazilian 2009 models) on serial console
- power on tv via remote control
After that you should see the CFE prompt.
First connection prompt
On first connection to CFE (when you've got TV connected using Ethernet cable) you will be prompted with simmilar output:
100 MB Full-Duplex (auto-neg) You should set IP address tru nset command! >>Input '-' to remove value<< netDev : eth0 - NET_SIPADDR Address : no => - NET_TIPADDR Address : no => - NET_IPADDR Address : no => - NET_NETMASK Address : no => - NET_GATEWAY Address : no =>  Skip delay. LVDS data out ~ Inv On (more 12214) ursa3 324f: 11 ursa3 3250: 22 ursa3 3252: 33 ursa3 3253: 44 ursa3 3276: 55 ursa3 3277: 66 ursa3 324a: 77 ursa3 324c: 88  turn on INV 0  INV On  BootSplash End  turn off Nand WP 0 bcm35xx >
It stops on every "no =>" message. CFE asks here for network setup by user:
NET_SIPADDR Address <- NFS server IP address - choose yours PC address here as it might be useful later NET_TIPADDR Address <- TFTP server IP address - as above NET_IPADDR Address <- TV IP address NET_NETMASK Address <- Network Mask NET_GATEWAY Address <- Gateway - choose yours router IP address
You wont be asked about these values on next connections but you'll get:
bcm35xx > help Available commands: uncecc nand uncorrectable ecc check util in mtdutils checkecc nand ecc check util in mtdutils bitflip nand bitflip check util in mtdutils nandwrite nandwrite in mtdutils nanddump nanddump in mtdutils eraseall eraseall in mtdutils swu update all pak files nvmdbg eeprom test progrm reboot BCM system Reboot reset BCM system Reboot lgifcfg LG ifconfig misc misc. test function pboot LG cp2ram Function cp2ram LG cp2ram Function load LG load Function mtdinfo LG Flash MTD Info Function nand LG Nand Flash Function bbm LG Nand Flash Bad Block Management usbpwr USB Power Mode setting locktime Lock Detect Time Setting panictime Panic Time Setting usrinit User Init Call On/Off ethnum Ethernet port select lpj Set loops per jiffy[lpj] splash Splash On/Off dhcp DHCP Mode On/Off print Kernel and application print on /off flag auto LG Program Auto boot command nfs Set / Get NFS path memsz Set App. memory Size ver show boot version nnset System Network Default Setting nset System Network Setting flwr CFE Flash write remhist remove Down List ls Down Load List display sto LG Style Boot boot LG Style Boot info Show CFE configuration information loop Loop a command mac Program MAC addresses. macprog Program MAC addresses. macprog2 Program a specific MAC address. flash Update a flash memory device memtest Test memory. f Fill contents of memory. e Modify contents of memory. d Dump memory. u Disassemble instructions. batch Load a batch file into memory and execute it go Start a previously loaded program. orgload Load an executable file into memory without executing it save Save a region of memory to a remote file via TFTP orgboot Load an executable file into memory and execute it ping Ping a remote IP host. ifconfig Configure the Ethernet interface sleep Sleep for specified milliseconds. waitusb Wait for USB device to be installed. show heap Display information about CFE's heap show memory Display the system physical memory map. show devices Display information about the installed devices. unsetenv Delete an environment variable. printenv Display the environment variables setenv Set an environment variable. help Obtain help for CFE commands
This document http://dslab.lzu.edu.cn:8080/docs/2006summerschool/team1/teama/Documentation/lichanjuan/cfe.pdf can help to understand some of the common CFE command's and it's argument's
Switch to backup partitions
In case something went wrong with a firmware update and tv is not booting anymore it may be possible to switch back to the backup firmware that is stored in tv manually. This can be done by using the 'mtdinfo' command:
bcm35xx > mtdinfo load mtdinfo ...... load_mtdinfo magic =20091110 MTD Partition Information ---------------------------------- GET_PARTITION_NUM() = 40  "boot" : 0x00000000-0x000c0000 (0x000c0000) FM__ : boot.bin(0x54e24) - 1 : (U/V)  "mtdinfo" : 0x000c0000-0x00100000 (0x00040000) FM__ : MTD.INFO(0x15f0) - 50598657 : (U/V)  "crc32info" : 0x00100000-0x00140000 (0x00040000) FM__ : CRC32.INFO(0x100) - 50598657 : (U/V)  "rootfs" : 0x00140000-0x00440000 (0x00300000) _M__ : rootfs.squashfs(0x19a000) - 1 : (U/V) .  "lgapp" : 0x0ef80000-0x0ff80000 (0x01000000) ____ : lgapp.lzo(0x8a9960) - 52433409 : (U/V) .  "lgapp" : 0x00840000-0x01840000 (0x01000000) _M__ : lgapp.lzo(0x98b4eb) - 50598657 : (u/V) . A. Add flash partition E. Edit flash partition R. Remove flash partition W. sWap flash partition D. Default L. Load S. Save Q. Exit
You may notice that some of the partitions are named equal ('lgapp' in this example). These ones are backed up while firmware upgrade. So by swapping them with the 'W. sWap flash partition' command you can restore the firmware version before the last (unsuccessful) update. After swapping all doubled partitition pairs you must do 'Save' and 'Exit' and then reboot tv.
With shell command 'print on' it's possible to activate excessive logging while boot loader stage and kernel startup. Here is an example log from an PK950: Broadcom model boot log