3GP problem: hard drive shutdown during boot

[felixsin]

Hello all
I am trying to revive an MMI 3GP (8R1035670G) that probably was updated badly (I suppose an attempt to update the maps).
The behavior is this: the central unit starts, appears for a few seconds, the Audi logo appear on the display but the button lights remain off, and after a few seconds, the hard drive shuts off (parks the heads).
The hard drive seems in good health: it's not tickling (as a defective hard drive) and the "sound" during boot is normal, like a healthy MMI.
In the boot log does not always appear that the disc goes off. And reading the log I don't see a reason or a particular error. It seems as if there is a timer: time passed, the hard disk starts the shutdown, end of the story. But the timer should be only working when you log in IPL.
I am attaching two different log.
36020
36019


The strange thing is that when I connect with IPL do not see the red screen (AppFPGA): the MMI display is completely off.


I tried to manually flash the firmware (fw 614), writing the memory block headers one by one (using flashit commands), but nothing change.
I also tried to install the firmware in "automatic" (deleting the FPGA and IFS-root block headers and restarting with the SD card inserted). The green screen appears and the flash process starts, but when the system should reboot (step 6/8), system reboots from the hard drive, and then after a few moments the hard freezes, as always.
36018


Questions:
1) despite the unit is 3GP from an Audi A4, the log shows FPGA_9411.
But it should be 9498 ?? Maybe I'm flashing the bad firmware?


2) where can I see (in the log) which version of firmware is currently installed?


3) this sutdown problem could be a defect of the hard drive? Is there anyone of us was able to replace a hard drive on a MMI 3GP?


Thank you all
Have a good day
Francesco

[felixsin]

Hello,
there is an update.
In IPL mode, doing a SCAN command I see a checksum error on BIOS.
And the IFS headers are named "old".


=> scan
** @0x80040000: FPGA


total size: 746512 [0x0b6410]
data: 746212 [0x0b62e4]


.FDR = PL_MMI3G_PLUS_FPGA_9411_D1_11384A
.FDU = Userinfos zu FPGA 9411_D1_4010_14lw


** @0x80100000: FPGA


total size: 746480 [0x0b63f0]
data: 746212 [0x0b62e4]


.FDR = PL_MMI3G_PLUS_FPGA_9411_D1_09422A


.FDU = Userinfos zu FPGA 9411_D1_4010_14lw


** @0x801c0000: IFS [vers.1, UCL, old EMERGENCY]


total size: 4774644 [0x48daf4]
- header: 256
- startup: 53512
- imagefs: 11606604


RAM: 11660116 [0xb1eb54]


** @0x80680000: IFS [vers.1, LZO, old APPLICATION]


total size:43559577 [0x298aa99]
- header: 256
- startup: 53512
- imagefs: 103784188


RAM: 103837700 [0x6307004]


=== DATA CHECKSUM ERROR! ===


** @0x87f00000: BIOS packet


total size: 786432 [0x0c0000]


BIOS pattern: FFFFFF7F.FFFFFFFF
App. pattern: FFFFFF7F.FFFFFFFF

=> hwconf
PVR [ff000030] = 10300700<CHIP=10,VER=30,CUT=7>
PRR [ff000044] = 250<Product=2,CUT=5>


MMSELR [ff400020] = 0
BCR [ff801000] = 80000000<ENDIAN>
CS0BCR [ff802000] = 31110712<IWW=3,IWRWD=1,IWRWS=1,IWRRD=1,IWRRS=0,BST=1,SZ=3,B W=1,TYPE=2>
CS1BCR [ff802010] = 31110712<IWW=3,IWRWD=1,IWRWS=1,IWRRD=1,IWRRS=0,BST=1,SZ=3,B W=1,TYPE=2>
CS2BCR [ff802020] = 777777f0<IWW=7,IWRWD=7,IWRWS=7,IWRRD=7,IWRRS=7,BST=1,SZ=3,R DSPL,BW=7,TYPE=0>
CS3BCR [ff802030] = 777777f0<IWW=7,IWRWD=7,IWRWS=7,IWRRD=7,IWRRS=7,BST=1,SZ=3,R DSPL,BW=7,TYPE=0>
CS4BCR [ff802040] = 777777f0<IWW=7,IWRWD=7,IWRWS=7,IWRRD=7,IWRRS=7,BST=1,SZ=3,R DSPL,BW=7,TYPE=0>
CS5BCR [ff802050] = 770<IWW=0,IWRWD=0,IWRWS=0,IWRRD=0,IWRRS=0,BST=1,SZ=3,B W=7,TYPE=0>
CS6BCR [ff802060] = 770<IWW=0,IWRWD=0,IWRWS=0,IWRRD=0,IWRRS=0,BST=1,SZ=3,B W=7,TYPE=0>
CS0WCR [ff802008] = 100008<ADS=0,ADH=0,RDS=1,RDH=0,WTS=0,WTH=0,BSH=0,IW=8>
CS1WCR [ff802018] = 100008<ADS=0,ADH=0,RDS=1,RDH=0,WTS=0,WTH=0,BSH=0,IW=8>
CS2WCR [ff802028] = 7777770f<ADS=7,ADH=7,RDS=7,RDH=7,WTS=7,WTH=7,BSH=0,IW=f>
CS3WCR [ff802038] = 7777770f<ADS=7,ADH=7,RDS=7,RDH=7,WTS=7,WTH=7,BSH=0,IW=f>
CS4WCR [ff802048] = 7777770f<ADS=7,ADH=7,RDS=7,RDH=7,WTS=7,WTH=7,BSH=0,IW=f>
CS5WCR [ff802058] = 1000001<ADS=0,ADH=1,RDS=0,RDH=0,WTS=0,WTH=0,BSH=0,IW=1>
CS6WCR [ff802068] = 1000001<ADS=0,ADH=1,RDS=0,RDH=0,WTS=0,WTH=0,BSH=0,IW=1>
CS5PCR [ff802070] = f0000<SAA=0,SAB=0,PWCA=0,PWCB=0,PCIW=f,TEDA=0,TEDB=0,TEH A=0,TEHB=0>
CS6PCR [ff802080] = 77000000<SAA=7,SAB=7,PWCA=0,PWCB=0,PCIW=0,TEDA=0,TEDB=0,TEH A=0,TEHB=0>


DBEN [fe800010] = 1
DBCONF [fe800020] = e30002<SPLIT=e3,BASFT=0,BWIDTH=2>
DBTR0 [fe800030] = 50a3403<CL=5,TRAS=a,TRFC=34,TRCD=3>
DBTR1 [fe800034] = 30203<TRP=3,TRRD=2,TWR=3>
DBTR2 [fe800038] = 10e0307<TRPT=1,TRC=e,RDWR=3,WRRD=7>
DBRFCNT0 [fe800040] = 10000<ARFEN>
DBRFCNT1 [fe800044] = 405
DBRFCNT2 [fe800048] = fe00fe<LV1TH=fe,LV0TH=fe>
DBRFSTS [fe80004c] = 0
DBDICODTOCD [fe800054] = 60907<DIC_DQ,DIC_CK,ODTEN=1,T_ODT=1>


FRQMR1 [ffc80014] = 133735fa<IFST=1,UFST=3,SFST=3,BFST=7,MFST=3,S2FST=5,S3FST=f ,PFST=a>
PLLCR [ffc80024] = 0
MSTPCR0 [ffc80030] = 0
MSTPCR1 [ffc80034] = 0


PACR [ffe70000] = 0
PBCR [ffe70002] = 0
PCCR [ffe70004] = 0
PDCR [ffe70006] = 0
PECR [ffe70008] = 0
PFCR [ffe7000a] = 0
PGCR [ffe7000c] = 0
PHCR [ffe7000e] = c2f0
PJCR [ffe70010] = fffd
PKCR [ffe70012] = 5f7e
PLCR [ffe70014] = a7ff
PMCR [ffe70016] = ffff
PNCR [ffe70018] = ffff
PPCR [ffe7001a] = 0
PQCR [ffe7001c] = 0
PRCR [ffe7001e] = 0
PEPUPR [ffe70048] = f6
PHPUPR [ffe7004e] = de
PJPUPR [ffe70050] = ff
PKPUPR [ffe70052] = 3f
PLPUPR [ffe70054] = ff
PMPUPR [ffe70056] = ff
PNPUPR [ffe70058] = ff
PPUPR1 [ffe70060] = fffb
PPUPR2 [ffe70062] = ffff
P1MSELR [ffe70080] = 0
P2MSELR [ffe70082] = 0

=> qinfo
PLABEL=PL_qnx_ipl-3g_9308-sh7785_08253A
USER=BAchauer
HOST=OEKAN22I
DATE=2008/06/18_15-16-25_UTC
QNX_VERSION=630
QNX_LABEL=RL_qnx_os_630SP2_PSP10_08235A
GCC_VERSION=3.4.4
CPU=sh

=> pci
s:f:b vid did mapping type
0:0:0 10ee 9411 c0000000 MEM
1:0:0 10de 0187 d7000000 MEM
1:0:1 10de 0187 d8000000 MEM prefetchable
2:0:0 1131 1561 d63ff000 MEM
2:1:0 1131 1561 d63fe000 MEM
2:2:0 1131 1562 d63fd000 MEM
4:0:0 104c 9065 d6400000 MEM prefetchable
4:0:1 104c 9065 d6800000 MEM
4:0:2 104c 9065 001ff000 I/O

[Tschako]

The checksum error in the IFS area is normal in all 3GP Units! It starts at 0x680000, not at 0x780000 as the old 3G IFS.
The statement "old" for IFS and emgIFS A standard issue is and is not A failure Status. You have to Bring the MOST bus Online to Keep Alive the unit. Otherwise it will shutdown after a few seconds. Thats normal. Put A Gateway to the MOST to Keep Awaken or put it in the car bus system ...

The unit boots from the internal flash memory, not from the HDD. Put the HDD away, to be sure. The unit notes a HDD error and starts up noprmaly, but without navigation.
The HDD holds only the Map, Mediadisk and Backup files

[felixsin]

It's strange because it was connected to the car bus system. All cables were connected, and the car bus system is ok because it mounts a 3GP unit (8R1035666, without SIM slot).
Maybe the MOST connector is faulty?
How can I check if the optical ports are working?
Thank you for your help and also for informations about the hdd!
Bye

[felixsin]

Hi all
I tried to boot without HDD and DVD.
System connected to MOST.

36405
36406

As you can see in the log, MMI don't complete the boot.
The display is completely black and shows only the Audi logo for 2 seconds at start (as before).

From the inside of MMI, I see sometimes a little red light inside the MOST port, but I don't know if it is the signal emitted by my car (IN) or the signal emitted by the 3GP (OUT).

Any suggestion?
Thanks to all

364073640836409

[Tschako]

Have you tried to disconnect only the HDD and stay connected the DVD drive? Thats importand!

And for a 3GP Unit, you have to erase the header, which starts at 680000 hex:

try the command "flashit -a 680000 -e 1000" to erase the whole ifs-root header!

The red LED lights at the MOST is normal!

[felixsin]

Thank you Tschako!
Just to be sure that I will do exactly what you suggest:
1) I will reconnect the DVD (I will leave the HDD disconnected)
2) I will delete the header at 680000hex with "flashit -a 680000 -e 1000"
3) I will delete also the FPGA header with "flashit -a 40000 -e 1000"
4) then I will restart MMI with the 614 firmware on SD1, to reflash the MMI.
(I'm trying to flash the 614 firmware, but don't know which is the version of firmware originally written on the MMI)

But do you know why I don't see the red FPGA screen when I enter the IPL mode?

Bye and many many thanks!!!

[Tschako]

The reason for the "green screen" in the emg recovery mode ist quit simple: you have entered the "Developer Mode command" befor.

lets see your log:

******** DeveloperMode is on ******************************
Disabling IOC watchdog

There was a file written on the efs-persist image to stay in dev mode until the machine starts ok.
Thats not a problem. The emg-recovery will work fine, normally.

Try it with the correct firmware for your MU 9498 machine in the EU: K0767 in SD-Slot!

[felixsin]

Hello Tschako, I've tried as suggested.
Reconnected the DVD, started in IPL mode, deleted headers and installed the 767 fw from the SD.

36425
36426
36427

But as you can read in the logs, there are no steps forward :-(
I reconnected also the HDD, but no luck.

Do you have other suggestions?
Thank you for your support!!!
See you soon
Francesco

[felixsin]

Hello all
anyone has an idea about how to rebirth my MMI?
Thank you

[Tschako]

Start the emg-ifs with "boot 1c0000" then wait until complete startup of the emg app. Then type "mount" and send us the log.

Maybe, the efs-persist flash partition is damaged... then you have to rewrite the partition...

[felixsin]

Thank you, I will try tomorrow.
But just in case, is there a efs-persist image inside the SD that I can flash?
What would be the command?
See you soon

[Tschako]

The image file "efs-persist.efs" is not available via the Firmware SD Update files.
You have to extract it, from another, fully functional main unit with the following command:

"cat /dev/fs0p3 > /fs/sd0/backup/flashdump/fs0p3_efs-persist.bin" this command is for the 1st SD Slot of the Unit.
Put it in a well known SD Flash routine you´ll find here in the forum.

Now you have the flashdump image of the efs-persist partition (fs0p3), to flash it on the broken unit as descriped above:

use the command "flashit -a -d 6200000 -f /mnt/sdcard10t11/efs-persist.efs" to bring the image in the flash of your broken unit.

[felixsin]

To extract the efs-persist image, the only main unit I have is a 3GP "666" (8R1035666): it's on my car.
I have read (on another post by you, this (http://turbo-quattro.com/showthread.php?14458-%D0%B2%D0%BE%D1%81%D1%82%D0%B0%D0%BD%D0%BE%D0%B2%D 0%BB%D0%B5%D0%BD%D0%B8%D0%B5-%D0%BF%D0%BE%D0%B2%D1%80%D0%B5%D0%B6%D0%B4%D0%B5%D 0%BD%D0%BD%D1%8B%D1%85-%D0%B3%D0%BE%D0%BB%D0%BE%D0%B2-damage-head-unit-repair&p=440984&viewfull=1#post440984)) that it's possible to use a script on a SD card.

Can you tell me how to create the SD card and how to launch the script? (I'm sorry but I never created or used a script)
Then I will find the copy of the efs-persist in the SD?

Thank you!!

[Tschako]

Take any SD Script from this forum (seek) and hold the base script (run.sh), the copie_scr.sh and the dirs "screens" and "util", erase in the "run.sh" the original function call of the script and then put this command in it:

"cat /dev/fs0p3 > /fs/sd0/efs-persist.efs"

after that, youll find the file in the root of the SD

[felixsin]

Perfect! Backup done!
I created the SD with the script, and just to be sure that the SD path was correct, I modified in:
cat /dev/fs0p3 > $dstPath/efs-persist.efs

I understand why the efs-persist image is not shareable: it's full of semi-personal data (addresses, name of paired phones, address book, ecc.)

Now I have to reflash the dead mmi.
I will let you know tonight.

Thank you!!

[felixsin]

Hallo, bad news :-(
Reflashing of efs-persist was vain.

I succesfully flashed using the backup I done this morning from my 3GP version 666.
Then I restarted, waited the complete boot and after a minute I restarted. I boot/restarded a couple of times.
But the main unit is still broken: it starts booting, but after 40 seconds it stops. (with or without the HDD is the same)
This is the boot log after reflashing the efs-persist on the unit.
36521
36522

These are the "mount" and "df" query before/after flashing the efs-persist:

This is BEFORE flashing:

# mount
/dev/fs1p3 on /mnt/efs-persist type flash
/dev/fs1p2 on /mnt/efs-system type flash
/dev/fs1p1 on /mnt/efs-extended type flash
# df
/dev/fs1p3 58880 3153 55726 6% /mnt/efs-persist
/dev/fs1p2 75264 72070 3193 96% /mnt/efs-system
/dev/fs1p1 24064 11 24052 1% /mnt/efs-extende
/dev/hd0 2088387 2088387 0 100% /dev/hd0t187.4
/dev/hd0 4273227 4273227 0 100% /dev/hd0t187.3
/dev/hd0 353367 353367 0 100% /dev/hd0t187.2
/dev/hd0 337302 337302 0 100% /dev/hd0t187.1
/dev/hd0 10490382 10490382 0 100% /dev/hd0t187
/dev/hd0 2136645 2136645 0 100% /dev/hd0t79
/dev/hd0 39857265 39857265 0 100% /dev/hd0t78
/dev/hd0 57673287 57673287 0 100% /dev/hd0t77
/dev/hd0 117210240 117210240 0 100%
/dev/cd0 0 0 0 100%
#

This is AFTER flashing:

# mount
/dev/fs1p3 on /mnt/efs-persist type flash
/dev/fs1p2 on /mnt/efs-system type flash
/dev/fs1p1 on /mnt/efs-extended type flash
# df
/dev/fs1p3 58880 3846 55033 7% /mnt/efs-persist
/dev/fs1p2 75264 72070 3193 96% /mnt/efs-system
/dev/fs1p1 24064 11 24052 1% /mnt/efs-extende
/dev/hd0 2088387 2088387 0 100% /dev/hd0t187.4
/dev/hd0 4273227 4273227 0 100% /dev/hd0t187.3
/dev/hd0 353367 353367 0 100% /dev/hd0t187.2
/dev/hd0 337302 337302 0 100% /dev/hd0t187.1
/dev/hd0 10490382 10490382 0 100% /dev/hd0t187
/dev/hd0 2136645 2136645 0 100% /dev/hd0t79
/dev/hd0 39857265 39857265 0 100% /dev/hd0t78
/dev/hd0 57673287 57673287 0 100% /dev/hd0t77
/dev/hd0 117210240 117210240 0 100%
/dev/cd0 0 0 0 100%



Now I leave for 3 weeks for a trip: see you soon, but I will read sometimes the forum.
The broken MMI will be my first thought at my arrival.
Thank you all (Tschako over all) for your support!

[mr.jonny83]

Hello

I try to fixed a bricked Main Unit.
The Unit have the PartNumber 8R1035666.

I think the Image fs0p3 efs-persist.efs is broken.

If I start the Unit in normal Mode or in IPL Mode




the unit boots first quite normal,
but then runs the here all the time down

37099


I tried to manually flash the firmware (fw 767), writing the memory block headers one by one (using flashit commands), but nothing change.
I also tried to install the firmware in "automatic" (deleting the FPGA and IFS-root block headers and restarting with the SD card inserted). The green screen appears and the flash process starts, then it stoped by erase and do nothing!!

I have extract a efs.persist.efs image from a funcionally unit.

I have try to flash the efs-persist image but if i go to emg app with the command boot 1c0000
the unit boots at first, but after

SWDL: Starting EFS driver (automount)
result of running command start_efs_driver.sh is 0

came this failure (see picture top)

I can not start to reflash the efs.persist image because this failure

Sorry for my bad english:rolleyes:

[mr.jonny83]

I have successfully flash the efs-persist.efs image!

than i reboot the unit and start the automatic mode to reflash the unit.
In the green screen start the unit to erase the ifs.root.
but the programm process is always canceled.

then i start to reflash the memory block headers one by one.
every flash command was successfull, with "erase" , "programming" , "verifying"

but after the reboot the unit still not running!
I can see in the screen the message " Component Protection" but its very dark.
And the Controller has no function.

I have no connection with VCDS to adress 5F:mad:

Here is a Log from the Unit
37193




the unit still have an error due fs0p3


can someone help me??

[Tschako]

The unit reports a failure in the fs0p3 (efs-persist) partition of the flash memory.
There was a self repair routine startet, but it looks like unfixable problems in it.
Start the memory test in the ipl to verify the memory. Maybe there are some defectives in the flash area.
In that case, there is no handy way repair, only by exchange of the flash memory, but for this you need special SMD equipment and the chips itselfs.

[mr.jonny83]

At first thank you Tschako!!

Oh bad News but that's what i tought.:(

If I manage to change the flash memory, how can I flash the Chip?
Can I make a complete Backup from flash memory, from a working Unit?
Than only flash the new chip with the Backup?

I don't know how I can flash the IPL Image.
Because without the IPL, I think I have no communication between the Unit and the Terminal!

Need I a special cable or software to connect with the Unit?

And that the right flash memory ( Spansion S29GL512N )?

sorry for the many questions, but i'm new in this area.
It's a new Hobby:D

[trawqu]

Hello
can you give working script for this

THX

[trawqu]

Take any SD Script from this forum (seek) and hold the base script (run.sh), the copie_scr.sh and the dirs "screens" and "util", erase in the "run.sh" the original function call of the script and then put this command in it:

"cat /dev/fs0p3 > /fs/sd0/efs-persist.efs"

after that, youll find the file in the root of the SD
Heloo
If is not problem can you upload workin script for this solution ?

THX

[Tschako]

This script captures the efs-persist image from a good working main unit to the SD Card.
Than you can flash it to a unit with defective persist partition in the flash memory.

Keep in mind: It makes no sense to capture a defective image for repair.

Thats a script (run.sh) for it:


#!/bin/ksh
sdcard=`ls /mnt|grep sdcard.*t`
echo Using card $sdcard
dstPath=/mnt/$sdcard
mount -u $dstPath
echo remounted for full access
$dstPath/utils/showScreen $dstPath/screens/scriptStart.png
rm -f $dstPath/.done
echo started > $dstPath/.started
echo Copying efs-persist image to $dstPath


cat /dev/fs0p3 > $dstPath/efs-persist.efs


$dstPath/utils/showScreen $dstPath/screens/scriptDone.png
echo done > $dstPath/.done
rm -f $dstPath/.started


Attention: Some units use fs1p3 as mount ID for persist partition.
Then use this command instead:

cat /dev/fs1p3 > $dstPath/efs-persist.efs

Good Luck!
Tschako

[trawqu]

This script captures the efs-persist image from a good working main unit to the SD Card.
Than you can flash it to a unit with defective persist partition in the flash memory.

Keep in mind: It makes no sense to capture a defective image for repair.

Thats a script (run.sh) for it:


#!/bin/ksh
sdcard=`ls /mnt|grep sdcard.*t`
echo Using card $sdcard
dstPath=/mnt/$sdcard
mount -u $dstPath
echo remounted for full access
$dstPath/utils/showScreen $dstPath/screens/scriptStart.png
rm -f $dstPath/.done
echo started > $dstPath/.started
echo Copying efs-persist image to $dstPath


cat /dev/fs0p3 > $dstPath/efs-persist.efs


$dstPath/utils/showScreen $dstPath/screens/scriptDone.png
echo done > $dstPath/.done
rm -f $dstPath/.started


Attention: Some units use fs1p3 as mount ID for persist partition.
Then use this command instead:

cat /dev/fs1p3 > $dstPath/efs-persist.efs

Good Luck!
Tschako



Thank you so much.
This time I soldering new BGA it working too. Nex time I'll use this metod