Recovering a dead MMI 3G unit

By Keldo Gliana — Q2 2014 — Version 2

Document Summary:
If you’re reading this document because you have probably had unsuccessful firmware upgrade and you have
killed your MMI 3G or 3G Plus unit, it probably doesn’t start at all or just comes up with a black screen,
you also get no background light on button control panel.

Purpose:
The purpose of this document is to help you attempt to recover the dead MMI unit, by accessing the unit
RS232 terminal communication. If required you can also use the ‘zmodem’ or IPL (Initial Program Load)
techniques to push the OS image back into the MMI’s flash.

Scope:
All information in this document refer to the MMI 3G 9307/9308. However, in theory all other MMI
variants should be the same... but use at your own risk.

1. Open MMI unit by unscrewing all the screws at top and Dottom
2. Opening the top cover

3. Remove the hard drive

There is a small pin that holds the drive, just gently push in the clip
(where the arrow is pointing in the above picture) and the drive should pop out.

1IPage
4. Remove the flexi cable that comes from the front panel (blue end).
5. If you haven’t done so already, flip the unit up-side-down, and remove the two screws
that hold facia panel, see below:

6. Now go ahead and remove the facia panel.

7. By now you should be at the stage shown above, if not, make your way to achieve it.
8. Now go ahead and remove the motherboard. You will have two tabs to push in to release
the motherDoard (they secure the front of the Doard), also try to avoid misplacing thermal
pastes.
9. The motherboard is out, and it looks like this:

We’re interested in the connector highlighted in the above picture

 10. Eitner find yourself one of these Card Edge Slot Con sectors:
Card Edge PCB slot connectorCard Edge connector for ribbon cable Card Edge IDC connector

OR
Do things the cheap and ugly way by soldering wires directly to the board. The choice is yours but you must
follow the schematics below, so let’s identify which side is which:

This is TOP:

This is BOTTOM:

"s(6

Please note: In German, it was once common practice to label the Bestuckungsseite (assembly side) with BS, and the
L”otseite (solder side) with LS. Fortunately this is no longer appropriate as technical environment where English is more
common, the abbreviation “BS” may be misunderstood as “bottom side”! We therefore recommend a uniform inscription
using TOP and BOTTOM to indicate the upper and lower sides.

Function Pin
RxD Top — Pin S
TxD Bottom — Pin S
Ground Bottom — Pin 10

If you don’t have a computer with COM port (RS232) you will need a good quality USB4 UART adapter that has
FT232RL Chip, I recommend something like this:

OR
 The main thing to remember is connect the MMI’s RxD and TxD in mirrored way when connecting to your RS232
adapter\cable, this to allow mouth to ear type of communication. More importantly, you need to make a switch in the
circuit to block the RxD channel on the MMI. This is required for IPL procedure, something like this:

Normal Status hnl zc IPL Status nnI zs

11. Configure your COM port with the following settings:

Port: 1— 4 (just to simplify things)
Speed: 115200 for unit variant 9303, 9304 and others. (9302 max speed has to be 57600)
Data bits: 8
Stop bits: 1
Parity: none
Flow control: XON / XOFF

12. Get yourself a good terminal application such as TeraTerm v3.13

13. Connect it all up and start Trouoleshooting:

If the unit MMI is not completely dead then try to troubleshoot before you try to perform IPL flashing:
1. Restart MMI using the 3 reboot buttons.
2. At this stage the Terminal Window may be empty, but you can press «Enter» and a prompt should
appear " => "
Now you can run your commands recover, your commands will depend on what it needs:
I PL: Audi 3G 9308 ( SH7785) / CNX 6. 3. 0 [ PL qnx i pl - 3g 9308- s h7785 08253A, bui 1 1 2008/ 06/ 18 15- 16- 25 UTC]
CPU: SH778 5 ( >= 5t h c ut , cI k rrod e 20. 4x LDR) , 792M-tz
RAM 512 M3 ( pr obed, LBCCNF=e 30002)
FLASH: Spans i on S29GL 512N ( 32bi t ) . 512 sect or s x 256K
FPGA: PL M\/I 3G FPGA 9308 D1 09324 A ( Orrs)
Ent er i ng"CLI , ty pe '?' or ' heI p' f or hel p
=> hel p
? - al i as f or ' hel p'
bc onf - di s pl ay boot rrB nager c onf i gur aI i on
bi os - s t ar t BI CG
boot - boot i rrage i n rre rror y/ f I as h
di ag p1j - di agnos t i c f or t he PLL1 cI oc k j i t t er pr obI em
downI"oad - downI oad I FS over ser i al I i ne ( sendnt o pr ot ocol )
echo - ec ho ar gs
f pga - I oad FPGA f r om i rrage i n rrerror y/ f I ash
go - j urrp t o ' addr '
hel p - pr i nt onI i ne hel p
hv\conf - durrp har dwar e conf i gur at i on
rrd - rrerror y di s pl ay
rre rrper f - rrerro r y per f or rran ce t est ( benc hrra r k )
rrerrt est - rrerro r y t es t
rrt - al i as f or ' rrerrt est '
pci - I i s t s pci dev i c es
qi nf o - di s pl ay CNX bui I d i nf or rrat i on
r s updat e - quer y r ead s hi f t er updat e rrode ( \/\or k ar ound f or SH7785 I i rri t at i on #48)
r z - al i as f or ' z rroden1
sc an - s c an f I as h f or i rrages ( FPGA, I FS, BI C6 pac k et )
ver s i on - pr i nt pr og r am ver s i on
zrrod em - downI oad I FS or FPGA ov er ser i aI I i ne ( Z- f\/bd em pr ot ocol )
=> boot 780000
s t ar t i ng i rrag e @0780000
St ar t up: , bui I t 2011/ 07/ 19 09- 41- 26 UTC
RAM : 128 f\/B @x 08000000 "
RAM . 128 f\/B @x 40000000
NVRAM 28 f\/B @x 5e400000
RAM . 228 UB @x 50000000
FLASH: 128 M3 @x 00000000
Sy s t em pa ge at phys: 0800a000 user : 0800a000 k er n: 8800a000
St ar t i ng next pr ogr am at v 8804aae0
VG'I c orre CNX6. 3. 2 ( CNXLabel RL_qnx_os_632_PSP3_08041A) - Har rran/ Bec ker MVI 3G Bui I d 9307/ 08 D1-1238 SA
 14. Understanding what stuff in Terminal mean:
When MMI loads after a reboot it goes into boot mode and tries to search the memory header for ifs-root
and fpga, when these are not found then it triggers itself into Emergency Firmware update. The Terminal
window should provide you enough information to learn what stage you have reached and where to begin
your troubleshooting, a line similar to the one highlighted below is a good example:

s t ar t i ng i rrag e @80000
St ar t up: , bui I t 2011/ 07/ 19 09- 41- 26 UTC
RAM 128 f\/B @x 08000000 "
RAM 128 fVB @x 40000000
WS 28 NB @x 5e400000
RAM . 228 fVB @x 50000000
FLASH: 128 MW @x 00000000
I PL: Audi 3G 9308 ( SH7785) / CNX 6. 3. 0 [ PL qnx i pl - 3g 9308- s h7785 08253A, bui 1 1 2008/ 06/ 18 15- 16- 25 UTC]
CPU: SH7785 ( >= 5t h c ut , cI k rrode 20. 4x ) , 792M-Iz "
RAM 512 M3 ( pr obed, LBCCNF=e 30002)
FLASH: Spans i on S29GL 512N ( 32bi t ) . 512 sect or s x 256K
FPT PL_M\1 3G_FPG _9308_D1_09324A ( 0rrs)

d- f as hi oned rrar k f ound on I FS @x1c0000: . zer o=0x3000001 e

d- f as hi oned rrar k f ound on I FS @x680000: . zer o=0x 10000000
s t ar I i ng i rrag e @80000
St ar t up: bui I t 2011/ 07/ 19 09- 41- 26 UTC
RAM 128 f\/B @x 08000000 "
RAM 128 f\/B @x 40000000
WS 28 f\/B @x 5e400000
RAM . 228 fVB @x 50000000
FLASH: 128 M3 @x 00000000
Fai I

How to read the above example: in short it says the MMI failed to start when it was attempting address
the launch image 0h680000, and that’s the problem as a good IFS should be located at the address
0h780000. So an easy fix for this would be to boot the unit with command:
boot 780000
An incident like this may occur due to the fact the MMI was flashed with a custom firmware that had IFS
from the address 0h680000 and it was all working well, but at a later stage it was re-flashed with
another firmware that had IFS 0h780000 address. So the shifting never occurred correctly, thus it killed
the unit.
If the unit happens to get fix by booting it with address boot 780000 then a permanent fix may be applied
with command:
flashit —a 0x680000 —e 1000

15. What is the oest shortcut to recover?

It’s absolutely essential to try to bring up the unit to Emergency Firmware update mode, with no or a
very minimal flashing works. It’s known that the majority of MMI units to have 128MB on board flash
card, the utilisation of this storage is used as below:

1. 0x00000000 IPL 63264 262144 256kb

2. 0x00040000 FPGA 746472 786432 768 kb
3. 0x00100000 FPGA EMERGENCY 746472 786432 768 kb
4. 0x001C0000 IFS EMERGENCY 4,666,284 6,029,312 5888kb (SMB)
5. 0x00780000 IFS - ROOT 36866456 50855936 49664kb (48MB)
6. 0x03800000 EFS EXTEND 23,068,672 58,720,256 57344kb (56MB)
7. 0x04E00000 EFS SYSTEM 20971520 20971520 20480kb (20MB)
8. 0x06200000 EFS PERSISTENCE 30,408,704 31,457,280 29696kb (29MB)
9. 0x07f00000 BIOS
10. 0x08000000 END OF FLASH

So if the integrity of Emergency Firmware update on the flash is healthy then you should always try to
boot into it first. To do this, boot the system from the address 1c0000 by running the following
command:
boot 1c0000
 After you run the above command you will need to insert firmware SD card into the MMI unit, make sure
the firmware is designed for this particular unit. If it all works well you will see something similar to this in
your Terminal Windows:
ng1case
s't ab 01c 0000
t uP q ogoo o sh778 5_08362 A, bui I t 2008/ 09/ 02_07- 53- 12_UTC
6v
S a’ pph 0800a000 k er n: 8800 a000
LA! FI Fl ex 80g ou6g4o

\/éI c orre t o ChIX 6. 3. 2 ( RL qnx os 632 PSP3 08124A) M\1 3G Au di Ef\/ERGENCY SETUP 9308 D1 09431 A
s t ar t i ng pc i dr i v er
* * * i ni t FPGA r egi st er s * * * s t ar t i ng dev- i pc f or I CC
i ni t i aI i ze I PC D i v er
s t ar t i ng net v\or k dr i v er
spd i ver - set up devi ce / dev/ carr0 si :f ‹ ng deap-
t a! ge0=0 I un*08) - FJ - TEN DVD- RCM DV- 05FT2 Rev: 1B20 Pat h=1 - XI LI NX M\/I 3G 8
t ar get =1 I un=0 Di r ect Ac cess( 0) - TCbHI BA k/K4 050 GB Rev: TG10 s t ar t i ng f I as h dr i v er
s t ar t i ng SDCar d dr i ver
LhabI e t o acc es s " / dev/ i o- net / en5" ( 2)
st ar t i ng wi t h no net v\or k dr i v er
Errer gency I FS i s s t ar t ed. Errer gency app I r i es t o r es t or e t he appl i c at i on. 49169 r unni ng / usr / bi n/ dev g- NVTI RM
Q\/A i s â s abl ed
drra di s abI ed, i nt er r upt t hr ead pr i or i t y = 100 49171 r unni ng / sbi n/ i o- rred i a- nv i di a
49172 r unni ng / usr / sbi n/ i o- di s pl ay
49173 r unni ng / us r / apps/ MVI 3GErrer gencyApp
Errer gency s hel I st ar t ed , f i x y our s y s t em and r es t ar t agai n di s c pl ay er i ni t . I N
nv i di a r ender rranager i ni t . I N
I Nv rrRend er f\/b nager . . Get Nv rrRend er Manager ( &pRender Mana ger ) ; er = pRender fVb nager - >I ni t ( oConf i g) ;
# App FPC-A val i d 1
Errer genc y FPGA v al i d 1 s abl i ng I CC wat c hdog
Errer gencyAp p- MVI 3G v er s i on 22. 30. 1642, dat e of bui I d 14. 10. 2009
<- - A LDT K’ERE TEXT I HAVE TRI MVED HERE - - >
” * Eev el oper fVbde i s of f ! ! ! ! * *
* The sy s t em wi I I shut dov\ri s oon! * *
* DO LOF FLASH W TH SCRI PTS I N THI S k/EDE! ! ! * *
* You c an en abl e Dev el oper fVbde I i ke t hi s: * *
* ec ho durrrry > / FBper si s t enc e/ Dev el oper Nbde * *
Set E\ s pl ayst at us t o 2
ChO fpr ocess I PC event H\/'â arrpl e 209 H\/¥'ar i ant 7 Fi nal Sh ut down 0 Enabl i ng I CC v\at chdog
I ni t i at e shut down ( af t er BEM t i rreout )
CnO f : pr ocess I PC event H\/'é arrpl e 209 H\/¥’ar i ant 7 Fi nal Shut down 0

Somewhere towards the end, before you see Enabling IOC watchdog text, the MMI display turns red, with
the
words, everything is in order, MMI copies few files and then it’s switched off automatically.

If the firmware is copied successfully back from SD into the flash, then you’re done... your MMI is back alive.

Sometimes the time of 60 seconds given to perform a certain process is too short, if you need to extend
this just run the following command:
echo dummy > /HBpersistence/DeveloperMode
 16. How to flash certain images from a source such as SD card?
If you know what you’re doing then you probably realised that it’s best to only flash the missing images, for
example to flash ifs-root.ifs from SD card, you would use the following command:
flashit 0x00680000 -a -f / mnt/sdcard10t11/ifs-root.ifs
More syntaxes on flashit are listed below:
-a address start address in hex the file should be flashed to
-d if set, all necessary sectors will be erased
-e size erase size number of bytes
-f file name of the file to be flashed
-I step [obsolete / not supported: stepwidth of progress procentage]
-p device path to raw flash device (default: / dev/fs0; NAND is / dev/etfs1)
-x do not verify data written
-v increase verbosity

17. If the unit MMI is completely dead then you will need to initiate IPL process:
a. Turn on adapter’s switch (or somehow connect MMI’s RxD to Adapter’s ground)
b. Restart MMI using the 3 reboot buttons.
c. Turn off Adapter’s switch (remove the connection between MMI’s RxD and ground)
d. MMI will now go into boot mode IPL.

Please note that IPL is always at address 0 and it only receives data when MMI’s RxD
terminal port is connected to GND port at the reboot. Otherwise MMI searches the
memory header for ifs-root and fpga, when these are not found then it triggers MMI unit
into Emergency Firmware update.

If IFS emergency is completely dead, the MMI screen will remain black. When that happens you will get ‘#’
prompt in the terminal window. Form here you will need to delete header FPGA by running command:
flashit-a 40000 -e in 1000
The above command will erase the FPGA image, and on the next MMI reboot the unit is forced into
disaster recovery mode, this will enable IPL process to begin. Now you will be required to push a small
version of QNX ifs image in order to boot it

I have put this document together from collecting a lot of information from many different online forums;
PM conversations, offline notes, hands-on experience with aim to help you recover your bricked MMI and I
hope it helps.

END OF DOCUMENT