I bricked my CMU, then recovered it - Fiat 124 Spider Forum
 21Likes
Reply
 
Thread Tools
post #1 of 14 (permalink) Old 12-06-2017, 09:53 PM Thread Starter
Junior Member
 
Doriath's Avatar
 
Join Date: Jun 2017
Location: Nashville, TN
Posts: 17
Garage
(Thread Starter)
Red face I bricked my CMU, then recovered it

I've been applying tweaks to my Spider's infotainment system, first with Ameridan's tweaks, and then eventually moving beyond his scripts and writing my own. I've got SSH access to the car's computer from the computer in my office using keys, and I've got Android Auto 1.06 installed and working great.

But getting there wasn't exactly smooth. After installing Android Auto I discovered that the CMU doesn't really have enough memory to run AA and the Navigation package at the same time, and I embarked on another set of changes focused on getting a swap file going. At the same time I also re-ran my modified copy of the SSH bringback tweak to push a new /etc /passwd. After applying those tweaks and rebooting I found myself staring at a never ending Abarth boot logo. The CMU would not boot up, even after a cold boot by holding Mute+Nav. I was left with the radio station that was last playing and nothing else. WiFi was not starting. Reading the Mazda forums shows that this has happened to more than a few people, and I was looking at somewhere between $700 and $1000 for a replacement. There was much sadness.

My first step was a post mortem of the files on the USB stick that I used to tweak. I discovered that I had accidentally added CR/LF line endings in some files despite being aware of the issue. The CMU did not appear to be booting very far at all, and I didn't think using the tweaks method would work, but I prepared a new USB stick with fixes. It was a no-go.

With USB and WiFi not working, my options were reduced to things involving removing the CMU from the dash. The CMU does have a serial port for TTY access, but the cable harness doesn't include the pins. I opted for opening up the CMU and soldering in some wire jumpers. I was then able to use PuTTY on a laptop with a USB-TTY converter to connect to the CMU. But, when I tried to login, I discovered that the only account I could use was the non-privileged user account. When I tried to login with an account I had added, it seemed to login, but then immediately logged me back out. So the account named 'user' was the only one that would work. I could see my changes, I could review the logs, but I couldn't change a thing. More sadness.

At this point I decided that it couldn't hurt any more to go all out, and I set out to try to alter the root password directly on the flash chip. I had already noticed that system stores the passwd file on a separate partition than the rest of the system, and that this partition actually resides on the SPI NOR flash chip. I pulled the CMU back out and disassembled it again. I purchased a cheap flash programmer that would work with the chip on the board and a test clip that would allow me to work with the chip without desoldering it from the board. I was able to pull the firmware off the chip, extract the partition, replace the passwd file, repack the partition, and reflash the chip.

I used linux to work with the extracted firmware. The dd command sliced up the file into three parts, allowing me to isolate the config partition, which is a SquashFS filesystem. The unsquashfs and squashfs commands are similar to unzipping and zipping. This left me with the contents of the config partition in a folder named squashfs-root, including the passwd file. I replaced this file with a new copy, this time changing the root password, and put it all back together.


Code:
dd if=firmware.bin of=part1.bin bs=1024 count=448
dd if=firmware.bin of=part2.bin bs=1024 skip=448 count=4
dd if=firmware.bin of=part3.bin bs=1024 skip=452
unsquashfs part2.bin

vi squashfs-root/passwd

mksquashfs squashfs-root newpart2.bin
dd if=part1.bin of=newfirmware.bin
dd if=newpart2.bin of=newfirmware.bin bs=1024 seek=448
dd if=part3.bin of=newfirmware.bin bs=1024 seek=452

This produced newfirmware.bin which I flashed to the chip. I then put everything back together and reinstalled the CMU into the car. I did not need to log in using the serial port at this point as replacing the passwd file allowed the system to boot. Going back and comparing files shows me it was the passwd file that I had mangled in the first place. Happiness!

I want to thank Ameridan, everybody in the Mazda AIO thread, majbthrd for these essential pages, and Ventura Technology for
detailing how to remove the CMU from the car. I hope this information can help somebody else out.
Attached Thumbnails
Click image for larger version

Name:	20171202_102739.jpg
Views:	222
Size:	230.7 KB
ID:	36962   Click image for larger version

Name:	20171202_112832.jpg
Views:	227
Size:	239.6 KB
ID:	36970   Click image for larger version

Name:	20171202_130517.jpg
Views:	184
Size:	247.8 KB
ID:	36978   Click image for larger version

Name:	20171202_130946.jpg
Views:	222
Size:	175.0 KB
ID:	36986   Click image for larger version

Name:	20171205_212625.jpg
Views:	198
Size:	209.5 KB
ID:	36994  

Click image for larger version

Name:	ScreenShot.jpg
Views:	165
Size:	316.9 KB
ID:	37002  

124 Spider Abarth 6MT Rosso Red + Brembos, Luxury Pkg
Doriath is offline  
Sponsored Links
Advertisement
 
post #2 of 14 (permalink) Old 12-06-2017, 10:54 PM
Senior Member
 
Bluejacket's Avatar
 
Join Date: Nov 2017
Posts: 153
OK, I have no idea what you were talking about. Truth be told I have trouble programming a new remote for the TV. What are the tweaks you were trying to make? The system seems OK to me.
wlcmlc and jetlag like this.
Bluejacket is offline  
post #3 of 14 (permalink) Old 12-06-2017, 11:05 PM Thread Starter
Junior Member
 
Doriath's Avatar
 
Join Date: Jun 2017
Location: Nashville, TN
Posts: 17
Garage
(Thread Starter)
There are a variety of improvements that can be made to the infotainment system. Ameridan has a great site detailing the tweaks I mentioned. You don't really need any technical expertise to apply them, if you follow his instructions. I particularly like being able to use the touchscreen while moving.

124 Spider Abarth 6MT Rosso Red + Brembos, Luxury Pkg
Doriath is offline  
post #4 of 14 (permalink) Old 12-07-2017, 01:49 AM
Senior Member
 
Mike34's Avatar
 
Join Date: May 2017
Location: Oahu
Posts: 1,978
Garage
Wow. impressive. Glad you had the tools and aptitude to make it right! Congrats man!

Aloha Mike"Wendi" '17 124 Spider Abarth Bianco w/vinyl wrap Heritage stripe ~ 6MT, Cobalt hood lifts, RED-Forge BOV. EC Intercooler, EC V4 intake, Alfa 4C Coils, EC-tune PH1&2, Vaitrix 30psi Boost Gauge, AMSOIL and PTP Thermal blanket, Redline shifter/parking brake boots (Alcantara), Red - Vents, Anodized Scorpion oil cap, mirror covers & lip. Scorpion engine cover. Scorpion console Lid, Auto Ricambi Muffler delete w/resonators, CS Door Bushings (RED) Mishimoto tank & CarPlay
Aloha! !! !!!!
Mike34 is online now  
post #5 of 14 (permalink) Old 12-07-2017, 10:06 AM
Senior Member
 
68wooley's Avatar
 
Join Date: May 2017
Location: Aurora CO
Posts: 1,538
Garage
Lol - although I'm possibly one of the few people who understood your post, all I really got out of it was "don't try this at home folks"...

I'm suitably impressed you managed this.

2017 124 Abarth 6MT Forte Black :: Forge Recirculating BOV :: EC stuff - V4.1 Intake, Oil catch can, Intercooler :: Tork Stage 1 Tune :: PTP Turbo Blanket :: Alfa 4C Coils :: Flyin’ Miata Fox Coilovers :: Complete collection of incredibly overpriced OEM alcantara trim pieces :: Ameridan's fabulous ICE tweaks :: SoundDeadenerShowdown CLD tiles in trunk :: SigmaKore ceramic coating :: CarPlay / Android Auto upgrade :: Moss Miata door bushings :: 6UL Wheels 17*8 :: Conti ECS 215*45
68wooley is online now  
post #6 of 14 (permalink) Old 12-07-2017, 10:20 AM
Senior Member
 
GregtheBike's Avatar
 
Join Date: Jun 2017
Location: Ferndale WA
Posts: 551
Garage
could be a good cottage industry.. un-bricking Mazda guys' CMU's
jetlag likes this.

2017 124 Spider Abarth, 2014 Triumph Tiger XC, 1996 Triumph Sprint
GregtheBike is offline  
post #7 of 14 (permalink) Old 12-07-2017, 07:39 PM
Senior Member
 
Join Date: Jul 2017
Location: Grass Valley, Ca
Posts: 128
Quote:
Originally Posted by 68wooley View Post
Lol - although I'm possibly one of the few people who understood your post, all I really got out of it was "don't try this at home folks"...

I'm suitably impressed you managed this.
This is so far above my expertise level but very interesting reading and I'm glad it ended up working out for you. As for me, I did the AIO tweaks and followed Ameridan's instructions to the letter. It worked out fine and I know why Ameridan says "at your own risk".

124 Lusso, 1965 Corvette, 1968 Chevelle SS
billbonn80 is online now  
post #8 of 14 (permalink) Old 12-11-2017, 01:19 PM
Junior Member
 
DanB's Avatar
 
Join Date: Dec 2017
Location: Texas!
Posts: 16
Quote:
Originally Posted by Doriath View Post
At this point I decided that it couldn't hurt any more to go all out, and I set out to try to alter the root password directly on the flash chip. I had already noticed that system stores the passwd file on a separate partition than the rest of the system, and that this partition actually resides on the SPI NOR flash chip. I pulled the CMU back out and disassembled it again. I purchased a cheap flash programmer that would work with the chip on the board and a test clip that would allow me to work with the chip without desoldering it from the board. I was able to pull the firmware off the chip, extract the partition, replace the passwd file, repack the partition, and reflash the chip.
Brilliant! I'm guessing if someone was so inclined they could use that test clip to make a backup before screwing with it to re-flash to factory if necessary?

Also, can you show us the serial connection you soldered on the board?
DanB is offline  
post #9 of 14 (permalink) Old 04-16-2019, 11:43 AM
Junior Member
 
Join Date: Apr 2019
Posts: 1
Could you please share new firmware.bin? I need to flash my CMU, it is completely bricked.
macomeza is offline  
post #10 of 14 (permalink) Old 04-16-2019, 12:27 PM
Senior Member
 
sharkcohen's Avatar
 
Join Date: Jan 2017
Location: San Francisco Bay Area
Posts: 2,646
Garage
Quote:
Originally Posted by 68wooley View Post
Lol - although I'm possibly one of the few people who understood your post, all I really got out of it was "don't try this at home folks"...

I'm suitably impressed you managed this.
Heh, I understand this stuff, too. It is very good reading, and very impressive.

2017 FIAT 124 Spider Lusso | EC Phase 2 | EC V4 intake | EC intercooler | EC catch can | Alfa 4C coil packs | GWR RoadsterSport exhaust with SportCat | Forge wastegate actuator | GFB DV+ | PTP Lava turbo blanket | Speedhut boost and IAT gauges | Cravenspeed gauge vent pods | Continental ExtremeContact Sport | Flyin' Miata LBBK
sharkcohen is online now  
Reply

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the Fiat 124 Spider Forum forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page



Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

 
For the best viewing experience please update your browser to Google Chrome