How to get access to the recovery mode of MMX in MIB2 High unit?

[jvkk]

Tried to do brand + region conversion days ago. ( AUDI+XX to VW+YY)

The MMX got bricked after I did flash the boot loader of MMX without update BCT then reboot.

I think there is security check in boot rom to ensure the validity of boot loader after invested the document of nVidia Tegra 3.

The document say CPU would be in RCM (recovery mode) under this situation and user could use USB to load correct boot loader to recovery it.

Does any one know how to get the USB port to access?
I tried to connect my PC with MIB2 High USB but it not work.

btw
Any one know how to get the newest IOC firmware (V850) of MIB2 (For the 5NA035xxx unit...)?
I want to solve following issue... or other method could be used to solve it?

[2018-08-19 05:21:42.892] [ERR]@24147 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
[2018-08-19 05:21:43.080] [MSG]@24333 (151587.0): OOcS: getHardwareSample: hwSample = 0x20
[2018-08-19 05:21:43.091] [MSG]@24344 (151587.0): OOcS: getHardwareVariant: IocVariant = 0x43
[2018-08-19 05:21:43.100] [MSG]@24351 (151587.0): OOcS: IOCBoloMode: 0, if true SYSTEM-ON will be triggered...
[2018-08-19 05:21:43.106] [MSG]@24353 (151587.0): OOcS: Upd. newSystemState: 104
[2018-08-19 05:21:43.109] [ERR]@24358 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
[2018-08-19 05:21:43.163] [ERR]@24417 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
[2018-08-19 05:21:43.205] [ERR]@24459 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
[2018-08-19 05:21:43.252] [ERR]@24507 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
[2018-08-19 05:21:43.354] [ERR]@24608 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!
[2018-08-19 05:21:43.434] [ERR]@24689 (151587.0): OOcD: received event from OnOffIPC with unknown IO-Ctrl version!

[MMI]

Hi,

What is the hardware/software numbers of the original unit and what software did you try to flash ?

Regards,

[jvkk]

It's a 8S0035xxx MU from Audi TT.
HW 040
SW 0016
IOC version App: 7384
IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MQB_TT3

I tried to manually flash it using ripped 5NA035050 firmware (Japan) with CP disable and install the UNIT on Golf.
Every thing works except audio and RVC. I thought the main cause is V850 firmware version. There are error message as original post.
Finally...
IOC version App: 7473
IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MQB

Compare to a native 5NA unit, the native one IOC version
IOC version App: 8863
IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MQB

Please let me know how to get the firmware (could it be ripped? Just prefer non-physical method...), I may pay for it if any one has newer IOC firmware.

[spyderboyant]

Did you get this sorted?

I flashed IFS-ROOT.IFS but corrupted the image. Now recovery mode only works on RCC and not MMX :-( I get the following errors in Emergency Mode:

I notice at the start of boot up it says "Is the MMX board connected and powered up?"


PL: A239 C0,14381A[2014-09-15 12:02:02],J5,PG3.0,GL-S=64(0),RAM=128,RST=9
CLK: 720/600/400 MHz (ARM/DSP/DDR)
IOC: 4533427e 7e7e7e7e 7e7e417e 7e7e7e00
fb2:ARM=8020000/2
Startup: PL_qnx_startup-jacinto5-v7_Dev_MibJ5_13372A, built 2013/09/10_12-21-17_UTC
Library: [DATE=2013/02/01-08:07:42-WEST USER=MHupfer HOST=oekan402]
Board: 0000a239.000000c0
Command: -vvvv -p2000 -x 0xc2700000,0x01900000 -x 0x86700000,0x01900000 -wb
========================================
IFS: ver.300003af (type=3)
UMEM: 08000000-0bffffff(F) 80000000-87ffffff(R)
ENV: @40312ea0 "IOC_BOOTMODE=E3B~~~~~~~A~~~~
IOC_BM_INFO=0x403129c4,0x10
HW_REV=A239 C0,0x19,J5,PG3.0
LAST_RST=0x0009
"
<8003> 39 a2 c0 00
DSPLOAD DATA: 838c0200 (512)
========================================
RAM: 128 MB
FLASH: 64 MB @0x08000000
Allocing from c2700000 for 01900000
Allocing from 86700000 for 01900000
dsp_mem_count= 00000002
delaying 2000 ms for various bugs
delaying done
in pcie_init_delay
Polling for clock
timeout on PCIE_config_pll 00009004
PCIe function is disabled
Is the MMX board connected and powered up? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
DSP: loader c674x_ipl_T08 (Jul 4 2014 13:26:39), args @838c0200 (512)
Added GPIO-callouts
CPU0: L1 Icache: 512x64

..........

Welcome to QNX Neutrino 6.5.0 on J5 - Harman/Becker Audi MIB - Emergency DEV-Emergency_rcc_2_B1-15031B
______ _______________
/ ____/____ ___ ___ _________ ____ ____ _______ __ / _/ ____/ ___/
/ __/ / __ __ \/ _ \/ ___/ __ / _ \/ __ \/ ___/ / / / / // /_ \__ \
/ /___ / / / / / / __/ / / /_/ / __/ / / / /__ /_/ / _/ // __/ ___/ /
/_____//_/ /_/ /_/\___/_/ \__, /\___/_/ /_/\___/\__, / /___/_/ /____/
/___/ /___/
Starting devf-generic...
...devf-generic done.

................
Starting MIBEmergency... <<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Password:copy_script is running
blanking 8192 bytes of stack memory at 0x7e000
max=0x2000, min = 0x1000 (0x7e000->0x7f000)
blanking 16384 bytes of stack memory at 0xfc000

.......................................

EmergencyApp-MIB: version 30.943, date of build 12.01.2015 <<<<<<<<<<<<<<
IPC watchdog is DISABLED
The TransactionImage for the application is valid!
Emergency application will do nothing!
result of running command stop_efs_driver.sh is 0
ECC mode is enabled
HBpersistence is available!
Display: BGColor normal
Display: Version 30.943
Display: Info1Text TransactionImage is valid!
ERROR: /net/mmx/ramdisk/eassist doesn't exist <<<<<<<<<<<<<<<<<<
Failed to output BGColor normal


ERROR: /net/mmx/ramdisk/eassist doesn't exist <<<<<<<<<<<<<<<
Failed to output Version 30.943


ERROR: /net/mmx/ramdisk/eassist doesn't exist <<<<<<<<<<<<<<<<<<<<
Failed to output Info1Text TransactionImage is valid!


sendIPCData WD 0
OnOff: Process IPC event HWsample 32 WD 0 (Interfaces IOC 0x31 Jacinto 0x31)
IOC Variant:= BOLOTYPE_MIB2_MQB + APPLTYPE_MIB2_MLB_EVO


Login incorrect
login: root
Password:
___ _ _ __ __ ___ _____
/ |_ _ __| (_) | \/ |_ _| _ \
/ /| | | | |/ _ | | | |\/| || || |_)_/
/ __ | |_| | (_| | | | | | || || |_) \
/_/ |_|__,__|\__,_|_| |_| |_|___|_____/


/ >

[spyderboyant]

forgot to mention mine is a MIB2 High

Note: I ran from Recovery mode "flashit -a 54000 e 1000" to delete the corrupted IFS-ROOT.IFS header to FORCE the EmergencyMIB mode to see whether I could load the IFS-ROOT.IFS from SDcard but this didnt work either as there are no mounts for the SD card (they reside under net/MMX :-( ).. Because EmergencyMIB mode fails, it goes back into the EmergencyIFS.

Prior to this I was still getting those MMX errors... ie "Is the MMX board connected and powered up?" and "ERROR: /net/mmx/ramdisk/eassist doesn't exist"

When connecting to the ESO pins I get the following output:

/ > <.STARTUP>
<cpu>: nVidia Quickboot 17.27.13 (Build Jul 2 2015)
<cpu>: modified by e.Solutions GmbH
<cpu>: Loading stage 2 primary bootloader...
<cpu>: Stage2 loaded
<cpu>: Primary partion invalid, trying to boot from recovery image
<cpu>: Failed to boot recovery image!
<cpu>: No bootable kernel image found, giving up

[MMI]

Hi, looks like MMX is dead.

1 solution, desolder Flash from MMX board and write backup from dump, these emergency update files for MMX are not available for Q7 units. After that you can use fw update to update unit for the right version.

Mind the region/version else you might get stuck with "can not read meta info" errors

While in emergency if you have the good version ifs root you can also write that back and then after repair of MMX you can do a normal firmware update.

Regards,

regards,

[spyderboyant]

thanks for the info. I will be keeping the region the same. It was flashed to the last version FW 976 of the NVidia MIB2 (next version was Qualcomm)

Have you seen an MMX board die before?

I cannot believe this happened. Was working 100% until I telnet to the unit and ran "flashit -a 54000 f ifs-root.ifs" - I missed the "-d" argument to reset the bits and hence corrupted the image.

/net/rcc/usr/bin/flashit -a 540000 -f ifs-root.ifs (which I FTP from update SD card - same FW version as on car"
*** programming ...
*** verifying ... flashit: FAILED!!!

I didn't think anything of it as it was the same ifs-root.ifs image as was on the NOR. I didn't realise you need to use -d with NOR to reset bits before flashing :-(

Next day screen popped up, was black and everything was dead. As MIB2 not loading, no CAN messages to screen to lower :-(

I tried to connect RS232 to the TTL ports on my desk until I realised I needed a TTL 3.3V to USB converter card, not a USB to RS232 cable. That couldn't have killed the MMX as those pins are only for RCC from my knowledge and thats still working.

So I will need to repair/replace the MMX board?

Could it be V850 chip?

[MMI]

Hi,

Yes, MMX boards die, for sure. You mention that these MMX problems where there even before you try to flash the IFS root.

By this command it can't work, just put it back in emergency and flash again, also you need to put the address of the file in your command.

Like I told you, i think problem is in MMX board, take flash off, repair the flash content and flash IFS-root, you will mostlikely be good to go.


regards,

[spyderboyant]

Hi, the problem only started after I flashed IFS root.... Everything was working 100%

Would this make sense? I telneted to the MIB2... this means I am in the MMX space correct? I then went to where the flashit tool is (/net/rcc/usr/bin/flashit). I tried to FTP the ifs-root.ifs to this folder from my laptop but I couldn't. So I went back to original mount and in the ./tmp folder I FTP/d the ifs-root.ifs.

From the ./tmp folder I ran:

/net/rcc/usr/bin/flashit -a 540000 -f ifs-root.ifs (no "-d")
*** programming ...
*** verifying ... flashit: FAILED!!!

Did this FLASH the memory on the MMX?

[spyderboyant]

no chance a USB stick would work? This is what I see when its trying to boot EmergencyMIB

We assume production mode is not active
Display: Info3Text Try medium USB
Try medium USB
ERROR: /net/mmx/ramdisk/eassist doesn't exist
Failed to output Info3Text Try medium USB

[MMI]

Hi,

Yes if this was the exact command you flashed the MMX. So only solution is what i gave you.

Or send it somewhere to get fixed ....

This USB is after SD card etc. You don't have the required files to update this in that way, only HB will have them.

With kind regards,

[johnson]

Hi,
i'm looking for the JTAG pinouts on the two PCI Express like connectors of MIB2 High units.

[spyderboyant]

Maybe need a JTAGulator.... brute force pins to find it (1.3v)... Definitely won't be the same as the MMI3G+. You will need to power it up though...

[congo]

Have you seen an MMX board die before?
I cannot believe this happened. Was working 100% until I telnet to the unit and ran "flashit -a 54000 f ifs-root.ifs" - I missed the "-d" argument to reset the bits and hence corrupted the image.
/net/rcc/usr/bin/flashit -a 540000 -f ifs-root.ifs (which I FTP from update SD card - same FW version as on car"
*** programming ...
*** verifying ... flashit: FAILED!!!
Could it be V850 chip?

I've seen some MMX bad boards Most was bad nor.
that flashit , did you run it in eso console or rcc?
V850 is not the problem here.

[spyderboyant]

I've seen some MMX bad boards Most was bad nor.
that flashit , did you run it in eso console or rcc?
V850 is not the problem here.

MMX... I killed it because I thought I was on RCC :-(

Time to remove NOR and fix up and re-flash

[congo]

I hope you have a backup of that as you cant put just any image.
There is a check in bootloader and some of the images are hardware dependent and will simply not boot.

[spyderboyant]

I hope you have a backup of that as you cant put just any image.
There is a check in bootloader and some of the images are hardware dependent and will simply not boot.

I am going to grab the damaged image and put back the .img that I screwed up.... bootloader seems ok..

[johnson]

Is there a way to backup the NOR without removing ?

[spyderboyant]

Is there a way to backup the NOR without removing ?

yes. You need "root" access. Then you can use the QNX commands "dd" or "cat" to copy to the SDCard or USB key. If no root, only other way is JTAG...

[johnson]

I am currently analyzing the BCT and boot loader. But I need other examples.
If someone would like to help please upload the following on mega.nz or similar:
- a dump of fs0 from MMX (cat /dev/fs0> /fs/sda0/fs0) packed with 7z
- Short description: train, version, part number
- output of: for i in `ls /dev/nvsku/`;do echo -n "$i: "; cat /dev/nvsku/$i; echo ; done

Otherwise also by PM.