I've seen multiple blog posts of people getting around the U-Boot bootdelay 0 environment variable to get to the U-Boot CLI. An example is here. The general process, as I understand it, is:
- Desolder/short flash chip so U-Boot cannot access it
- Power on device
U-Boot can't find flash chip and drops to CLI
eth1 up eth0, eth1 Qualcomm Atheros SPI NAND Driver, Version 0.1 (c) 2014 Qualcomm Atheros Inc. ath_spi_nand_ecc: Couldn't enable internal ECC Setting 0x181162c0 to 0x3061a100 Hit any key to stop autoboot: 0 ** Device 0 not available ath>
Change bootdelay to non-zero value:
ath> setenv bootdelay 3 ath> saveenv Saving Environment to Flash... Protect off 9F040000 ... 9F04FFFF Un-Protecting sectors 4..4 in bank 1 Un-Protected 1 sectors Protect off 9F050000 ... 9F05FFFF Un-Protecting sectors 5..5 in bank 1 Un-Protected 1 sectors Erasing Flash... 9F050000 ... 9F05FFFF ...Erasing flash... First 0x5 last 0x5 sector size 0x10000 5 Erased 1 sectors Writing to Flash... 9F050005 ... 9F060000 ...write addr: 9f050000 write addr: 9f040004 done Protecting sectors 5..5 in bank 1 Protected 1 sectors Protecting sectors 4..4 in bank 1 Protected 1 sectors ath>
- Power off device and reconnect flash chip.
As far as I know, U-Boot and its environment variables reside in flash. If the flash chip is disconnected from the CPU, how is U-Boot even loaded, and how can the bootdelay variable be saved in persistent storage?