Home of the Squeezebox™ & Transporter® network music players.
Results 1 to 7 of 7
  1. #1
    Junior Member
    Join Date
    May 2013
    Location
    Dortmund, Germany
    Posts
    4

    Recover bricked Squeezebox Radio via RedBoot? UBI firmware images available?

    Hello!

    I am asking for help to recover a "bricked" Logitech Sqeezebox Radio. After having a Squeezebox Radio for a while and being very happy with it, I bought another one. As I want to use it without a GUI anyway, I tried my luck buying a "defective" one.

    A fast investigation showed that the radio is electrically ok. After I connected a 3,3V-USB-to-serial converter to the battery-connector I was able to see that - at least I assume - a firmware upgrade failed. Please see attached boot-log.

    I would like to restore the firmware via the "RedBoot" command line interface. If I understand wiki.slimdevices.com/index.php/Fab4_Firmware_Upgrades_and_Recovery correctly, it should be doable by TFTP. Still, I do not know how to get the UBI firmware-image, as all images at downloads.slimdevices.com/LogitechMediaServer_v7.7.2/ have a "bin" extension.

    Unfortunately, I wasn't able to fnd more information on this on the net.

    What I have: a functional Squeezebox (Firmware-Dump)? A Segger J-Link JTAG interface (Firmware-Dump?), soldering station, masters degree in electronic engineering...

    Thank you very much!

    Best regards
    Robert







    ++NAND: RCSR=54200902
    Searching for BBT table in the flash ...
    .
    Found version 1 Bbt0 at block 1023 (0x7fe0000)
    Block 0 is bad
    Block 1 is bad
    Block 45 is bad
    Block 134 is bad
    Block 135 is bad
    Block 376 is bad
    Block 378 is bad
    [...]
    Block 791 is bad
    Block 792 is bad
    Block 795 is bad
    Block 987 is bad
    Block 1018 is bad
    Block 1019 is bad
    Total bad blocks: 156
    .
    Warning: nfc_read_region(addr=0x7f40000, block=1018): skipping bad
    .
    Warning: nfc_read_region(addr=0x7f60000, block=1019): skipping bad
    ..
    Warning: nfc_read_region(addr=0x7f60000, block=1019): skipping bad
    .**Warning** FLASH configuration checksum error or invalid key
    Use 'fconfig -i' to [re]initialize database
    FEC PHY: RTL8201EL
    FEC: [ HALF_DUPLEX ] [ disconnected ] [ 10M bps ]:
    Ethernet mxc_fec: MAC address 00:04:20:ff:ff:01
    No IP info for device!
    Unrecognized chip: 0xf8!!!
    hardware reset by WDOG

    Clock input is 24 MHz
    RedBoot(tm) bootstrap and debug environment [ROMRAM]
    Non-certified release, version FSL 200904 - built 16:56:15, Jan 5 2012

    Platform: Logitech Baby (i.MX25 ) PASS 1.0 [x32 DDR]
    System type 2070 revision 7
    Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
    Copyright (C) 2003, 2004, 2005, 2006 eCosCentric Limited

    RAM: 0x00000000-0x03f00000, [0x00095250-0x03ef1000] available
    FLASH: 0x00000000 - 0x8000000, 1024 blocks of 0x00020000 bytes each.
    RedBoot> ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200
    scanning 1014 PEBs
    .................................................. ................................skipping bad block 41
    .................................................. .................................................. .................................................. ..........................skipping bad block 130
    skipping bad block 131
    .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. ..............................skipping bad block 372
    ..skipping bad block 374
    .................................................. ..................skipping bad block 409
    ..........................skipping bad block 423
    ........................................skipping bad block 444
    ................................skipping bad block 461
    ........................................skipping bad block 482
    .................................................. ..............skipping bad block 515
    ......skipping bad block 519
    skipping bad block 520
    ......skipping bad block 524
    .................................................. ........................skipping bad block 562
    ................skipping bad block 571
    skipping bad block 572
    skipping bad block 573
    skipping bad block 574
    skipping bad block 575
    skipping bad block 576
    skipping bad block 577
    skipping bad block 578
    ..skipping bad block 580
    skipping bad block 581
    skipping bad block 582
    [...]
    skipping bad block 697
    skipping bad block 698
    skipping bad block 699
    skipping bad block 700
    ..................skipping bad block 710
    .................................................. skipping bad block 736
    ................................skipping bad block 753
    ................................skipping bad block 770
    ................................skipping bad block 787
    skipping bad block 788
    ....skipping bad block 791
    .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. ................................skipping bad block 983
    .................................................. ..........scanning is finished
    the layout volume was not found
    Volume table error -22

    RedBoot> ubi load -b 0x100000 kernel%{os_backup}
    No volume 'kernel' found
    RedBoot> exec -c %{os_cmdline}Warning: invalid entry address but still continue ...
    entry=0x80008000, target=0x80008000
    Base address unknown - use "-b" option
    RedBoot>

  2. #2
    Senior Member toby10's Avatar
    Join Date
    Jul 2007
    Location
    USA (home of the bottomless credit card)
    Posts
    9,225
    Long shot, but you might get lucky with a Firmware Rollback (though probably won't work with a corrupt/partial firmware it is currently operating on).
    Heck, worth a shot.

    Radio FW Roll Back (will only be rolled back one version) =
    1) Turn Radio off: Press & hold the power button till you see ôGoodbyeö
    2) Turn back on: Press & hold REW and PWR buttons simultaneously

  3. #3
    Junior Member
    Join Date
    May 2013
    Location
    Dortmund, Germany
    Posts
    4
    Hello Toby,

    thank you very much for your answer!

    I think there is not OS/driver to make the screen tell me "Goodbye" and to revert any firmware - but anyway - I tried it several times hoping that the mentioned buttons are somewhat hardwired to the bootloader and can trigger something.

    No luck. :-(

    Can't somebody tell me how to obtain a UBI image for Squeezebox Radio?

    Best regards,
    Robert

  4. #4
    Senior Member
    Join Date
    Aug 2012
    Location
    Austria
    Posts
    923
    Quote Originally Posted by rbudde View Post
    Can't somebody tell me how to obtain a UBI image for Squeezebox Radio?
    Have you checked if the bin files actually are the ubi images, or do you just assume they aren't because of the extension?

  5. #5
    Junior Member
    Join Date
    May 2013
    Location
    Dortmund, Germany
    Posts
    4
    Quote Originally Posted by Roland0 View Post
    Have you checked if the bin files actually are the ubi images, or do you just assume they aren't because of the extension?
    Hi Roland,

    I did not check because I don't know how to do that. But my guess is, that I at least need the information to what address I need to write the image (no matter if img or ubi) using RedBoot.

    I was hoping for some people experienced with actual firmware development. I guess when testing beta-firmwares it sometimes happens that the box gets "bricked" on such a low level and there is some knowledge to put it back to life.

    Best regards
    Robert

  6. #6
    Senior Member
    Join Date
    Aug 2012
    Location
    Austria
    Posts
    923
    Quote Originally Posted by rbudde View Post
    I did not check because I don't know how to do that. But my guess is, that I at least need the information to what address I need to write the image (no matter if img or ubi) using RedBoot.
    I'd try mounting it - if it works, it's an UBI image. See here on how to do this.

    Address seems to be always 0x100000 (probably - suggested by the boot log and the wiki page)

    I was hoping for some people experienced with actual firmware development. I guess when testing beta-firmwares it sometimes happens that the box gets "bricked" on such a low level and there is some knowledge to put it back to life.
    Can't help you there, sorry
    Last edited by Roland0; 2013-05-23 at 08:14.
    Various SW: Web Interface | Playlist Editor / Generator | Music Classification | Similar Music | Announce | EventTrigger | LMSlib2go | ...
    Various HowTos: build a self-contained LMS | Bluetooth/ALSA | Control LMS with any device | ...

  7. #7
    Junior Member
    Join Date
    Feb 2015
    Posts
    1

    Radio still bricked?

    Quote Originally Posted by rbudde View Post
    I am asking for help to recover a "bricked" Logitech Sqeezebox Radio. After having a Squeezebox Radio for a while and being very happy with it, I bought another one. As I want to use it without a GUI anyway, I tried my luck buying a "defective" one.
    Did you have any chance to recover your device? If not, do you still have it and are interested in it?

    Best regards
    Uwe

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •