I've been applying tweaks to my Spider's infotainment system, first with Ameridan's tweaks, and then eventually moving beyond his scripts and writing my own. I've got SSH access to the car's computer from the computer in my office using keys, and I've got Android Auto 1.06 installed and working great.
But getting there wasn't exactly smooth. After installing Android Auto I discovered that the CMU doesn't really have enough memory to run AA and the Navigation package at the same time, and I embarked on another set of changes focused on getting a swap file going. At the same time I also re-ran my modified copy of the SSH bringback tweak to push a new /etc /passwd. After applying those tweaks and rebooting I found myself staring at a never ending Abarth boot logo. The CMU would not boot up, even after a cold boot by holding Mute+Nav. I was left with the radio station that was last playing and nothing else. WiFi was not starting. Reading the Mazda forums shows that this has happened to more than a few people, and I was looking at somewhere between $700 and $1000 for a replacement. There was much sadness.
My first step was a post mortem of the files on the USB stick that I used to tweak. I discovered that I had accidentally added CR/LF line endings in some files despite being aware of the issue. The CMU did not appear to be booting very far at all, and I didn't think using the tweaks method would work, but I prepared a new USB stick with fixes. It was a no-go.
With USB and WiFi not working, my options were reduced to things involving removing the CMU from the dash. The CMU does have a serial port for TTY access, but the cable harness doesn't include the pins. I opted for opening up the CMU and soldering in some wire jumpers. I was then able to use PuTTY on a laptop with a USB-TTY converter to connect to the CMU. But, when I tried to login, I discovered that the only account I could use was the non-privileged user account. When I tried to login with an account I had added, it seemed to login, but then immediately logged me back out. So the account named 'user' was the only one that would work. I could see my changes, I could review the logs, but I couldn't change a thing. More sadness.
At this point I decided that it couldn't hurt any more to go all out, and I set out to try to alter the root password directly on the flash chip. I had already noticed that system stores the passwd file on a separate partition than the rest of the system, and that this partition actually resides on the SPI NOR flash chip. I pulled the CMU back out and disassembled it again. I purchased a cheap flash programmer
that would work with the chip on the board and a test clip
that would allow me to work with the chip without desoldering it from the board. I was able to pull the firmware off the chip, extract the partition, replace the passwd file, repack the partition, and reflash the chip.
I used linux to work with the extracted firmware. The dd command sliced up the file into three parts, allowing me to isolate the config partition, which is a SquashFS filesystem. The unsquashfs and squashfs commands are similar to unzipping and zipping. This left me with the contents of the config partition in a folder named squashfs-root, including the passwd file. I replaced this file with a new copy, this time changing the root password, and put it all back together.
dd if=firmware.bin of=part1.bin bs=1024 count=448
dd if=firmware.bin of=part2.bin bs=1024 skip=448 count=4
dd if=firmware.bin of=part3.bin bs=1024 skip=452
mksquashfs squashfs-root newpart2.bin
dd if=part1.bin of=newfirmware.bin
dd if=newpart2.bin of=newfirmware.bin bs=1024 seek=448
dd if=part3.bin of=newfirmware.bin bs=1024 seek=452
This produced newfirmware.bin which I flashed to the chip. I then put everything back together and reinstalled the CMU into the car. I did not need to log in using the serial port at this point as replacing the passwd file allowed the system to boot. Going back and comparing files shows me it was the passwd file that I had mangled in the first place. Happiness!
I want to thank Ameridan, everybody in the Mazda AIO thread
, majbthrd for these essential pages
, and Ventura Technology for
detailing how to remove the CMU from the car. I hope this information can help somebody else out.