Fiat 124 Spider Forum banner

1 - 20 of 21 Posts

·
Registered
Joined
·
16 Posts
Discussion Starter #1
I've been applying tweaks to my Spider's infotainment system, first with Ameridan's tweaks, and then eventually moving beyond his scripts and writing my own. I've got SSH access to the car's computer from the computer in my office using keys, and I've got Android Auto 1.06 installed and working great.

But getting there wasn't exactly smooth. After installing Android Auto I discovered that the CMU doesn't really have enough memory to run AA and the Navigation package at the same time, and I embarked on another set of changes focused on getting a swap file going. At the same time I also re-ran my modified copy of the SSH bringback tweak to push a new /etc /passwd. After applying those tweaks and rebooting I found myself staring at a never ending Abarth boot logo. The CMU would not boot up, even after a cold boot by holding Mute+Nav. I was left with the radio station that was last playing and nothing else. WiFi was not starting. Reading the Mazda forums shows that this has happened to more than a few people, and I was looking at somewhere between $700 and $1000 for a replacement. There was much sadness.

My first step was a post mortem of the files on the USB stick that I used to tweak. I discovered that I had accidentally added CR/LF line endings in some files despite being aware of the issue. The CMU did not appear to be booting very far at all, and I didn't think using the tweaks method would work, but I prepared a new USB stick with fixes. It was a no-go.

With USB and WiFi not working, my options were reduced to things involving removing the CMU from the dash. The CMU does have a serial port for TTY access, but the cable harness doesn't include the pins. I opted for opening up the CMU and soldering in some wire jumpers. I was then able to use PuTTY on a laptop with a USB-TTY converter to connect to the CMU. But, when I tried to login, I discovered that the only account I could use was the non-privileged user account. When I tried to login with an account I had added, it seemed to login, but then immediately logged me back out. So the account named 'user' was the only one that would work. I could see my changes, I could review the logs, but I couldn't change a thing. More sadness.

At this point I decided that it couldn't hurt any more to go all out, and I set out to try to alter the root password directly on the flash chip. I had already noticed that system stores the passwd file on a separate partition than the rest of the system, and that this partition actually resides on the SPI NOR flash chip. I pulled the CMU back out and disassembled it again. I purchased a cheap flash programmer that would work with the chip on the board and a test clip that would allow me to work with the chip without desoldering it from the board. I was able to pull the firmware off the chip, extract the partition, replace the passwd file, repack the partition, and reflash the chip.

I used linux to work with the extracted firmware. The dd command sliced up the file into three parts, allowing me to isolate the config partition, which is a SquashFS filesystem. The unsquashfs and squashfs commands are similar to unzipping and zipping. This left me with the contents of the config partition in a folder named squashfs-root, including the passwd file. I replaced this file with a new copy, this time changing the root password, and put it all back together.


Code:
dd if=firmware.bin of=part1.bin bs=1024 count=448
dd if=firmware.bin of=part2.bin bs=1024 skip=448 count=4
dd if=firmware.bin of=part3.bin bs=1024 skip=452
unsquashfs part2.bin

vi squashfs-root/passwd

mksquashfs squashfs-root newpart2.bin
dd if=part1.bin of=newfirmware.bin
dd if=newpart2.bin of=newfirmware.bin bs=1024 seek=448
dd if=part3.bin of=newfirmware.bin bs=1024 seek=452

This produced newfirmware.bin which I flashed to the chip. I then put everything back together and reinstalled the CMU into the car. I did not need to log in using the serial port at this point as replacing the passwd file allowed the system to boot. Going back and comparing files shows me it was the passwd file that I had mangled in the first place. Happiness!

I want to thank Ameridan, everybody in the Mazda AIO thread, majbthrd for these essential pages, and Ventura Technology for
detailing how to remove the CMU from the car. I hope this information can help somebody else out.
 

Attachments

·
Registered
Joined
·
153 Posts
OK, I have no idea what you were talking about. Truth be told I have trouble programming a new remote for the TV. What are the tweaks you were trying to make? The system seems OK to me.
 

·
Registered
Joined
·
16 Posts
Discussion Starter #3
There are a variety of improvements that can be made to the infotainment system. Ameridan has a great site detailing the tweaks I mentioned. You don't really need any technical expertise to apply them, if you follow his instructions. I particularly like being able to use the touchscreen while moving.
 

·
Premium Member
Joined
·
2,306 Posts
Wow. impressive. Glad you had the tools and aptitude to make it right! Congrats man!
 

·
Registered
Joined
·
1,991 Posts
Lol - although I'm possibly one of the few people who understood your post, all I really got out of it was "don't try this at home folks"...:D

I'm suitably impressed you managed this.
 

·
Registered
Joined
·
132 Posts
Lol - although I'm possibly one of the few people who understood your post, all I really got out of it was "don't try this at home folks"...:D

I'm suitably impressed you managed this.
This is so far above my expertise level but very interesting reading and I'm glad it ended up working out for you. As for me, I did the AIO tweaks and followed Ameridan's instructions to the letter. It worked out fine and I know why Ameridan says "at your own risk".
 

·
Registered
2019 Clasica
Joined
·
63 Posts
At this point I decided that it couldn't hurt any more to go all out, and I set out to try to alter the root password directly on the flash chip. I had already noticed that system stores the passwd file on a separate partition than the rest of the system, and that this partition actually resides on the SPI NOR flash chip. I pulled the CMU back out and disassembled it again. I purchased a cheap flash programmer that would work with the chip on the board and a test clip that would allow me to work with the chip without desoldering it from the board. I was able to pull the firmware off the chip, extract the partition, replace the passwd file, repack the partition, and reflash the chip.
Brilliant! I'm guessing if someone was so inclined they could use that test clip to make a backup before screwing with it to re-flash to factory if necessary?

Also, can you show us the serial connection you soldered on the board?
 

·
Registered
Joined
·
3,504 Posts
Lol - although I'm possibly one of the few people who understood your post, all I really got out of it was "don't try this at home folks"...:D

I'm suitably impressed you managed this.
Heh, I understand this stuff, too. It is very good reading, and very impressive.
 

·
Registered
Joined
·
793 Posts
Heh, I understand this stuff, too. It is very good reading, and very impressive.
Yeah, I'm an IT Manager so I was getting what he was putting down. But still...not what I want to be doing on my Spider. Fortunately I've been lucky enough to apply Ameridan's tweaks without needing to resort to a putty session. :rolleyes:
 

·
Registered
Joined
·
1,185 Posts
Re-resurrecting this thread, I had a bricked CMU after some reckless installation/updates of tweaks (one of the problems with being on the bleeding edge) in preparation for CarPlay. I didn't need to resort to any serial connections but just (sic) flash the EEPROM/Flash/PROM.

I was stuck in a boot-loop - actually stuck at the Mazda logo after upgrading to V70 firmaware.

The information, here, really helped. If you are stuck in a boot-loop/lock, and even replacing the tweak files to the original (which I did to no avail) this is your second to last resort. The last resort is about $1000 on a new/replacement CMU (used ones in an unknown state may be had for cheaper).

1. Purchase both the CH341A programmer board and the PROM test clip as linked in the original post;
2. Download the CH341A drivers and programming tool;
3. Make sure you have the .UP files on a USB drive;
4. Dissassemble the dash as if replacing the USB hub (see the android/carplay post here);
4a. You do not need to take apart the lower console to get access to the CMU;
5. With the CMU/screen out, you can disconnect the two connectors to the LCD screen, and unbolt (3 screws) the screen (removing the screen may not be necessary, but you may not want to handle it too much, to avoid potential marking or damage), and 2 screws for the rear bracket;
6. Remove the bottom panel of the CMU using a torx wrench (T20);
7. Connect the test clip to the PROM chip, clearly visible (*);
8. Connect the other end of the test clip to the CH341A USB board (*);
9. Plug the USB board into your computer (I used Windows 10 Professional);
10. Read the PROM contents, and save them as a .bin file;
11. Verify the PROM with what has been read;
12. change byte at offset 0x0010000 from FF to 00;
13. Optionally, save this 'new' file;
14. Write the contents to the PROM - this takes longer (about 5 minutes or so) to write than read;
15. Disconnect from the PROM;
16. Take the CMU back to the car, reassemble screen onto it, and connect back to car;
17. Turning the car on will/should show an 'update failure' on the screen, and wait for you to insert the USB with the update files;
18. Insert the USB, it should autodetect the .up files and go into the standard firmware update (about 20-30 minutes).

(*) Using the PROMmer:

Look carefully at the CH341A software and the image in the original post: the left most pins of the ZIF (Zero Insertion Force) socket are used, not the full 16 pins. The cable (or the CH341A, I can't recall) come with an additional board with a 16 to 8 pin converter. The pin layout on that board converts, correctly, the 16 pins on the PROM and the 8 pins required for programming.

If you get it wrong (orientation, etc.) it simply doesn't work, but doesn't damage anything. The 'detect' button in the CH341A programming software should show the identified MXIC chip - but the wrong model. The correct chip - as shown in the original post - is the MX25L6445E (it's printed on the PROM).

(I spent a lot of time trying to get this lot to work - eventually found that the ZIF socket on my CH341A board was not soldered correctly, and had to frankenstein something together).

As far as obtaining the CH341A programming software, you might need to hit up some dubious Russian/Chinese web sites. It took me a while to find the software which both worked and seemed to be the least 'unreputable' site. It needs to look like the image in the OP, but there are a couple of other applications which may work.

As a final note, this whole experience can be quite nerve wracking - just remember, at this point, you would only do this with a bricked CMU with no other avenue of recovery, so have very little to loose (except about a grand on a new CMU).

Also note that I am, actually, an engineer with the motto "If it ain't broke, you haven't f****d with it enough".
 

·
Registered
Joined
·
62 Posts
Re-resurrecting this thread, I had a bricked CMU after some reckless installation/updates of tweaks (one of the problems with being on the bleeding edge) in preparation for CarPlay. I didn't need to resort to any serial connections but just (sic) flash the EEPROM/Flash/PROM.

I was stuck in a boot-loop - actually stuck at the Mazda logo after upgrading to V70 firmaware.

The information, here, really helped. If you are stuck in a boot-loop/lock, and even replacing the tweak files to the original (which I did to no avail) this is your second to last resort. The last resort is about $1000 on a new/replacement CMU (used ones in an unknown state may be had for cheaper).

1. Purchase both the CH341A programmer board and the PROM test clip as linked in the original post;
2. Download the CH341A drivers and programming tool;
3. Make sure you have the .UP files on a USB drive;
4. Dissassemble the dash as if replacing the USB hub (see the android/carplay post here);
4a. You do not need to take apart the lower console to get access to the CMU;
5. With the CMU/screen out, you can disconnect the two connectors to the LCD screen, and unbolt (3 screws) the screen (removing the screen may not be necessary, but you may not want to handle it too much, to avoid potential marking or damage), and 2 screws for the rear bracket;
6. Remove the bottom panel of the CMU using a torx wrench (T20);
7. Connect the test clip to the PROM chip, clearly visible (*);
8. Connect the other end of the test clip to the CH341A USB board (*);
9. Plug the USB board into your computer (I used Windows 10 Professional);
10. Read the PROM contents, and save them as a .bin file;
11. Verify the PROM with what has been read;
12. change byte at offset 0x0010000 from FF to 00;
13. Optionally, save this 'new' file;
14. Write the contents to the PROM - this takes longer (about 5 minutes or so) to write than read;
15. Disconnect from the PROM;
16. Take the CMU back to the car, reassemble screen onto it, and connect back to car;
17. Turning the car on will/should show an 'update failure' on the screen, and wait for you to insert the USB with the update files;
18. Insert the USB, it should autodetect the .up files and go into the standard firmware update (about 20-30 minutes).

(*) Using the PROMmer:

Look carefully at the CH341A software and the image in the original post: the left most pins of the ZIF (Zero Insertion Force) socket are used, not the full 16 pins. The cable (or the CH341A, I can't recall) come with an additional board with a 16 to 8 pin converter. The pin layout on that board converts, correctly, the 16 pins on the PROM and the 8 pins required for programming.

If you get it wrong (orientation, etc.) it simply doesn't work, but doesn't damage anything. The 'detect' button in the CH341A programming software should show the identified MXIC chip - but the wrong model. The correct chip - as shown in the original post - is the MX25L6445E (it's printed on the PROM).

(I spent a lot of time trying to get this lot to work - eventually found that the ZIF socket on my CH341A board was not soldered correctly, and had to frankenstein something together).

As far as obtaining the CH341A programming software, you might need to hit up some dubious Russian/Chinese web sites. It took me a while to find the software which both worked and seemed to be the least 'unreputable' site. It needs to look like the image in the OP, but there are a couple of other applications which may work.

As a final note, this whole experience can be quite nerve wracking - just remember, at this point, you would only do this with a bricked CMU with no other avenue of recovery, so have very little to loose (except about a grand on a new CMU).

Also note that I am, actually, an engineer with the motto "If it ain't broke, you haven't f****d with it enough".
Engineer's Creed!
Of course that goes along with always wanting to improve things.
 

·
Registered
Joined
·
20 Posts
I notice a speedometer option as one of the tweaks. I did not notice a boost option (and CTRL+F on the tweaks page did not find "boost"). Is there any sort of contraption that could wireless or otherwise somehow communicate the real time, real boost PSI / info to the Linux and the infotainment program put it onto the infotainment screen as, at least, the PSI number, or at best, a graphical gauge akin to the coolant temperature and fuel level displays that ~masquerade as dash gauges? I know of the physical PSI gauges, but losing an air vent to a physical boost gauge seems drastic for a number that, for me, is essentially just infotainment, and I honestly can't understand why Fiat didn't already go the "boost PSI as infotainment" route. Tire PSI could be good infotainment too, though of course that number is truly of importance for all drivers. Tire PSIs would defintiely be an improvement over the idiot-butt light, and those PSIs are already being broadcast.
 

·
Premium Member
Joined
·
1,422 Posts
I notice a speedometer option as one of the tweaks. I did not notice a boost option (and CTRL+F on the tweaks page did not find "boost"). Is there any sort of contraption that could wireless or otherwise somehow communicate the real time, real boost PSI / info to the Linux and the infotainment program put it onto the infotainment screen as, at least, the PSI number, or at best, a graphical gauge akin to the coolant temperature and fuel level displays that ~masquerade as dash gauges? I know of the physical PSI gauges, but losing an air vent to a physical boost gauge seems drastic for a number that, for me, is essentially just infotainment, and I honestly can't understand why Fiat didn't already go the "boost PSI as infotainment" route. Tire PSI could be good infotainment too, though of course that number is truly of importance for all drivers. Tire PSIs would defintiely be an improvement over the idiot-butt light, and those PSIs are already being broadcast.
You don't lose the air vent... you install a ring behind the front trim of the air vent next to the steering wheel (either side), and attached to that inserted ring is another ring (vertically above the vent) that holds the boost gauge you choose to install. It works well, and does what I need. The metal ring that mounts behind the vent bezel does not block the vent in any way. I think it looks okay as well, but the key thing is, now I have a boost gauge.

Maybe see if you can pull boost data via the OBD port and then display it on the infotainment screen by running something like Torque on your phone and Android Auto to display it to the infortainment system. But, aside from the pain in doing that, I suspect the lag in data display would make it less than useful. Once you start digging into some of the history of the tweaks (primarily the speedo app versions) you'll see that this is a problem with other data that's gleaned from the CMU. I personally gave up on getting this information displayed in any other form, and opted for a defi boost gauge installed in a vent bezel mount.

My take on it is that this all stems from the fact that our car's interior and electronics is basically Mazda, and since they use NA engines, there's no accomodation for a boost gauge or display of boost data. The 500 Abarths (and I think later models that were fitted with turbos) had a stock boost gauge, but that's because they were Fiat product in entirety.

I hope you find a solution you like that works for you, because, yes.... the car should have a boost gauge. :)
 

·
Registered
Joined
·
3 Posts
Hi guys!
I'm from Vietnam!
I've a problem with my CMU 59.00.545 4A N, I updated to v70 without running fail-safe. I have flashed spi nor using CH341A and test clip at 0x01000 from FF to 00 but CMU reboots continuously in 45 seconds. Can you help me?
 

·
Registered
Joined
·
20 Posts
thanks i got a Vaitrix 30psi gauge to go in whenever i add the EC turbo that's currently sitting in the garage going "c'mon dude, i am just sitting here, get to work!"
 
1 - 20 of 21 Posts
Top