How to get access to the recovery mode of MMX in MIB2 High unit?
Добро пожаловать на Turbo Quattro.
Показано с 1 по 19 из 19
  1. #1
    Новичок
    Регистрация
    05.01.2018
    Сообщений
    10

    По умолчанию How to get access to the recovery mode of MMX in MIB2 High unit?

    Tried to do brand + region conversion days ago. ( AUDI+XX to VW+YY)

    The MMX got bricked after I did flash the boot loader of MMX without update BCT then reboot.

    I think there is security check in boot rom to ensure the validity of boot loader after invested the document of nVidia Tegra 3.

    The document say CPU would be in RCM (recovery mode) under this situation and user could use USB to load correct boot loader to recovery it.

    Does any one know how to get the USB port to access?
    I tried to connect my PC with MIB2 High USB but it not work.

    btw
    Any one know how to get the newest IOC firmware (V850) of MIB2 (For the 5NA035xxx unit...)?
    I want to solve following issue... or other method could be used to solve it?

    [2018-08-19 05:21:42.892] [ERR]@24147 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    [2018-08-19 05:21:43.080] [MSG]@24333 (151587.0): OOcS: getHardwareSample: hwSample = 0x20
    [2018-08-19 05:21:43.091] [MSG]@24344 (151587.0): OOcS: getHardwareVariant: IocVariant = 0x43
    [2018-08-19 05:21:43.100] [MSG]@24351 (151587.0): OOcS: IOCBoloMode: 0, if true SYSTEM-ON will be triggered...
    [2018-08-19 05:21:43.106] [MSG]@24353 (151587.0): OOcS: Upd. newSystemState: 104
    [2018-08-19 05:21:43.109] [ERR]@24358 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    [2018-08-19 05:21:43.163] [ERR]@24417 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    [2018-08-19 05:21:43.205] [ERR]@24459 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    [2018-08-19 05:21:43.252] [ERR]@24507 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    [2018-08-19 05:21:43.354] [ERR]@24608 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    [2018-08-19 05:21:43.434] [ERR]@24689 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
    Последний раз редактировалось jvkk; 24.08.2018 в 11:52.

  2. #2
    Пользователь
    Регистрация
    03.02.2015
    Адрес
    Belgium
    Сообщений
    30

    По умолчанию

    Hi,

    What is the hardware/software numbers of the original unit and what software did you try to flash ?

    Regards,

  3. #3
    Новичок
    Регистрация
    05.01.2018
    Сообщений
    10

    По умолчанию

    It's a 8S0035xxx MU from Audi TT.
    HW 040
    SW 0016
    IOC version App: 7384
    IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MQB_TT3

    I tried to manually flash it using ripped 5NA035050 firmware (Japan) with CP disable and install the UNIT on Golf.
    Every thing works except audio and RVC. I thought the main cause is V850 firmware version. There are error message as original post.
    Finally...
    IOC version App: 7473
    IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MQB

    Compare to a native 5NA unit, the native one IOC version
    IOC version App: 8863
    IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MQB

    Please let me know how to get the firmware (could it be ripped? Just prefer non-physical method...), I may pay for it if any one has newer IOC firmware.

  4. #4

    По умолчанию

    Did you get this sorted?

    I flashed IFS-ROOT.IFS but corrupted the image. Now recovery mode only works on RCC and not MMX :-( I get the following errors in Emergency Mode:

    I notice at the start of boot up it says "Is the MMX board connected and powered up?"


    PL: A239 C0,14381A[2014-09-15 12:02:02],J5,PG3.0,GL-S=64(0),RAM=128,RST=9
    CLK: 720/600/400 MHz (ARM/DSP/DDR)
    IOC: 4533427e 7e7e7e7e 7e7e417e 7e7e7e00
    fb2:ARM=8020000/2
    Startup: PL_qnx_startup-jacinto5-v7_Dev_MibJ5_13372A, built 2013/09/10_12-21-17_UTC
    Library: [DATE=2013/02/01-08:07:42-WEST USER=MHupfer HOST=oekan402]
    Board: 0000a239.000000c0
    Command: -vvvv -p2000 -x 0xc2700000,0x01900000 -x 0x86700000,0x01900000 -wb
    ========================================
    IFS: ver.300003af (type=3)
    UMEM: 08000000-0bffffff(F) 80000000-87ffffff(R)
    ENV: @40312ea0 "IOC_BOOTMODE=E3B~~~~~~~A~~~~
    IOC_BM_INFO=0x403129c4,0x10
    HW_REV=A239 C0,0x19,J5,PG3.0
    LAST_RST=0x0009
    "
    <8003> 39 a2 c0 00
    DSPLOAD DATA: 838c0200 (512)
    ========================================
    RAM: 128 MB
    FLASH: 64 MB @0x08000000
    Allocing from c2700000 for 01900000
    Allocing from 86700000 for 01900000
    dsp_mem_count= 00000002
    delaying 2000 ms for various bugs
    delaying done
    in pcie_init_delay
    Polling for clock
    timeout on PCIE_config_pll 00009004
    PCIe function is disabled
    Is the MMX board connected and powered up? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
    DSP: loader c674x_ipl_T08 (Jul 4 2014 13:26:39), args @838c0200 (512)
    Added GPIO-callouts
    CPU0: L1 Icache: 512x64

    ..........

    Welcome to QNX Neutrino 6.5.0 on J5 - Harman/Becker Audi MIB - Emergency DEV-Emergency_rcc_2_B1-15031B
    ______ _______________
    / ____/____ ___ ___ _________ ____ ____ _______ __ / _/ ____/ ___/
    / __/ / __ __ \/ _ \/ ___/ __ / _ \/ __ \/ ___/ / / / / // /_ \__ \
    / /___ / / / / / / __/ / / /_/ / __/ / / / /__ /_/ / _/ // __/ ___/ /
    /_____//_/ /_/ /_/\___/_/ \__, /\___/_/ /_/\___/\__, / /___/_/ /____/
    /___/ /___/
    Starting devf-generic...
    ...devf-generic done.

    ................
    Starting MIBEmergency... <<<<<<<<<<<<<<<<<<<<<<<<<<<<<
    Password:copy_script is running
    blanking 8192 bytes of stack memory at 0x7e000
    max=0x2000, min = 0x1000 (0x7e000->0x7f000)
    blanking 16384 bytes of stack memory at 0xfc000

    .......................................

    EmergencyApp-MIB: version 30.943, date of build 12.01.2015 <<<<<<<<<<<<<<
    IPC watchdog is DISABLED
    The TransactionImage for the application is valid!
    Emergency application will do nothing!
    result of running command stop_efs_driver.sh is 0
    ECC mode is enabled
    HBpersistence is available!
    Display: BGColor normal
    Display: Version 30.943
    Display: Info1Text TransactionImage is valid!
    ERROR: /net/mmx/ramdisk/eassist doesn't exist <<<<<<<<<<<<<<<<<<
    Failed to output BGColor normal


    ERROR: /net/mmx/ramdisk/eassist doesn't exist <<<<<<<<<<<<<<<
    Failed to output Version 30.943


    ERROR: /net/mmx/ramdisk/eassist doesn't exist <<<<<<<<<<<<<<<<<<<<
    Failed to output Info1Text TransactionImage is valid!


    sendIPCData WD 0
    OnOff: Process IPC event HWsample 32 WD 0 (Interfaces IOC 0x31 Jacinto 0x31)
    IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MLB_EVO


    Login incorrect
    login: root
    Password:
    ___ _ _ __ __ ___ _____
    / |_ _ __| (_) | \/ |_ _| _ \
    / /| | | | |/ _ | | | |\/| || || |_)_/
    / __ | |_| | (_| | | | | | || || |_) \
    /_/ |_|__,__|\__,_|_| |_| |_|___|_____/


    / >

  5. #5

    По умолчанию

    forgot to mention mine is a MIB2 High - 4M0 035 041

    Note: I ran from Recovery mode "flashit -a 54000 e 1000" to delete the corrupted IFS-ROOT.IFS header to FORCE the EmergencyMIB mode to see whether I could load the IFS-ROOT.IFS from SDcard but this didnt work either as there are no mounts for the SD card (they reside under net/MMX :-( ).. Because EmergencyMIB mode fails, it goes back into the EmergencyIFS.

    Prior to this I was still getting those MMX errors... ie "Is the MMX board connected and powered up?" and "ERROR: /net/mmx/ramdisk/eassist doesn't exist"

    When connecting to the ESO pins I get the following output:

    / > <.STARTUP>
    <cpu>: nVidia Quickboot 17.27.13 (Build Jul 2 2015)
    <cpu>: modified by e.Solutions GmbH
    <cpu>: Loading stage 2 primary bootloader...
    <cpu>: Stage2 loaded
    <cpu>: Primary partion invalid, trying to boot from recovery image
    <cpu>: Failed to boot recovery image!
    <cpu>: No bootable kernel image found, giving up

  6. #6
    Пользователь
    Регистрация
    03.02.2015
    Адрес
    Belgium
    Сообщений
    30

    По умолчанию

    Hi, looks like MMX is dead.

    1 solution, desolder Flash from MMX board and write backup from dump, these emergency update files for MMX are not available for Q7 units. After that you can use fw update to update unit for the right version.

    Mind the region/version else you might get stuck with "can not read meta info" errors

    While in emergency if you have the good version ifs root you can also write that back and then after repair of MMX you can do a normal firmware update.

    Regards,

    regards,

  7. #7

    По умолчанию

    thanks for the info. I will be keeping the region the same. It was flashed to the last version FW 976 of the NVidia MIB2 (next version was Qualcomm)

    Have you seen an MMX board die before?

    I cannot believe this happened. Was working 100% until I telnet to the unit and ran "flashit -a 54000 f ifs-root.ifs" - I missed the "-d" argument to reset the bits and hence corrupted the image.

    /net/rcc/usr/bin/flashit -a 540000 -f ifs-root.ifs (which I FTP from update SD card - same FW version as on car"
    *** programming ...
    *** verifying ... flashit: FAILED!!!

    I didn't think anything of it as it was the same ifs-root.ifs image as was on the NOR. I didn't realise you need to use -d with NOR to reset bits before flashing :-(

    Next day screen popped up, was black and everything was dead. As MIB2 not loading, no CAN messages to screen to lower :-(

    I tried to connect RS232 to the TTL ports on my desk until I realised I needed a TTL 3.3V to USB converter card, not a USB to RS232 cable. That couldn't have killed the MMX as those pins are only for RCC from my knowledge and thats still working.

    So I will need to repair/replace the MMX board?

    Could it be V850 chip?

  8. #8
    Пользователь
    Регистрация
    03.02.2015
    Адрес
    Belgium
    Сообщений
    30

    По умолчанию

    Hi,

    Yes, MMX boards die, for sure. You mention that these MMX problems where there even before you try to flash the IFS root.

    By this command it can't work, just put it back in emergency and flash again, also you need to put the address of the file in your command.

    Like I told you, i think problem is in MMX board, take flash off, repair the flash content and flash IFS-root, you will mostlikely be good to go.


    regards,

  9. #9

    По умолчанию

    Hi, the problem only started after I flashed IFS root.... Everything was working 100%

    Would this make sense? I telneted to the MIB2... this means I am in the MMX space correct? I then went to where the flashit tool is (/net/rcc/usr/bin/flashit). I tried to FTP the ifs-root.ifs to this folder from my laptop but I couldn't. So I went back to original mount and in the ./tmp folder I FTP/d the ifs-root.ifs.

    From the ./tmp folder I ran:

    /net/rcc/usr/bin/flashit -a 540000 -f ifs-root.ifs (no "-d")
    *** programming ...
    *** verifying ... flashit: FAILED!!!

    Did this FLASH the memory on the MMX?

  10. #10

    По умолчанию

    no chance a USB stick would work? This is what I see when its trying to boot EmergencyMIB

    We assume production mode is not active
    Display: Info3Text Try medium USB
    Try medium USB
    ERROR: /net/mmx/ramdisk/eassist doesn't exist
    Failed to output Info3Text Try medium USB

  11. #11
    Пользователь
    Регистрация
    03.02.2015
    Адрес
    Belgium
    Сообщений
    30

    По умолчанию

    Hi,

    Yes if this was the exact command you flashed the MMX. So only solution is what i gave you.

    Or send it somewhere to get fixed ....

    This USB is after SD card etc. You don't have the required files to update this in that way, only HB will have them.

    With kind regards,

  12. #12

    По умолчанию

    Hi,
    i'm looking for the JTAG pinouts on the two PCI Express like connectors of MIB2 High units.
    Изображения Изображения

  13. #13

    По умолчанию

    Maybe need a JTAGulator.... brute force pins to find it (1.3v)... Definitely won't be the same as the MMI3G+. You will need to power it up though...

  14. #14
    Пользователь
    Регистрация
    11.03.2016
    Сообщений
    99

    По умолчанию

    Цитата Сообщение от spyderboyant Посмотреть сообщение
    Have you seen an MMX board die before?
    I cannot believe this happened. Was working 100% until I telnet to the unit and ran "flashit -a 54000 f ifs-root.ifs" - I missed the "-d" argument to reset the bits and hence corrupted the image.
    /net/rcc/usr/bin/flashit -a 540000 -f ifs-root.ifs (which I FTP from update SD card - same FW version as on car"
    *** programming ...
    *** verifying ... flashit: FAILED!!!
    Could it be V850 chip?
    I've seen some MMX bad boards Most was bad nor.
    that flashit , did you run it in eso console or rcc?
    V850 is not the problem here.

  15. #15

    По умолчанию

    Цитата Сообщение от congo Посмотреть сообщение
    I've seen some MMX bad boards Most was bad nor.
    that flashit , did you run it in eso console or rcc?
    V850 is not the problem here.
    MMX... I killed it because I thought I was on RCC :-(

    Time to remove NOR and fix up and re-flash

  16. #16
    Пользователь
    Регистрация
    11.03.2016
    Сообщений
    99

    По умолчанию

    I hope you have a backup of that as you cant put just any image.
    There is a check in bootloader and some of the images are hardware dependent and will simply not boot.

  17. #17

    По умолчанию

    Цитата Сообщение от congo Посмотреть сообщение
    I hope you have a backup of that as you cant put just any image.
    There is a check in bootloader and some of the images are hardware dependent and will simply not boot.
    I am going to grab the damaged image and put back the .img that I screwed up.... bootloader seems ok..

  18. #18

    По умолчанию

    Is there a way to backup the NOR without removing ?

  19. #19

    По умолчанию

    Цитата Сообщение от johnson Посмотреть сообщение
    Is there a way to backup the NOR without removing ?
    yes. You need "root" access. Then you can use the QNX commands "dd" or "cat" to copy to the SDCard or USB key. If no root, only other way is JTAG...

 

 

Ваши права

  • Вы не можете создавать новые темы
  • Вы не можете отвечать в темах
  • Вы не можете прикреплять вложения
  • Вы не можете редактировать свои сообщения
  •  
Back to top