Recover bricked Squeezebox Radio via RedBoot? UBI firmware images available?

[rbudde]

Hello!

I am asking for help to recover a "bricked" Logitech Sqeezebox Radio. After having a Squeezebox Radio for a while and being very happy with it, I bought another one. As I want to use it without a GUI anyway, I tried my luck buying a "defective" one.

A fast investigation showed that the radio is electrically ok. After I connected a 3,3V-USB-to-serial converter to the battery-connector I was able to see that - at least I assume - a firmware upgrade failed. Please see attached boot-log.

I would like to restore the firmware via the "RedBoot" command line interface. If I understand wiki.slimdevices.com/index.php/Fab4_Firmware_Upgrades_and_Recovery correctly, it should be doable by TFTP. Still, I do not know how to get the UBI firmware-image, as all images at downloads.slimdevices.com/LogitechMediaServer_v7.7.2/ have a "bin" extension.

Unfortunately, I wasn't able to fnd more information on this on the net.

What I have: a functional Squeezebox (Firmware-Dump)? A Segger J-Link JTAG interface (Firmware-Dump?), soldering station, masters degree in electronic engineering...

Thank you very much!

Best regards
Robert







++NAND: RCSR=54200902
Searching for BBT table in the flash ...
.
Found version 1 Bbt0 at block 1023 (0x7fe0000)
Block 0 is bad
Block 1 is bad
Block 45 is bad
Block 134 is bad
Block 135 is bad
Block 376 is bad
Block 378 is bad
[...]
Block 791 is bad
Block 792 is bad
Block 795 is bad
Block 987 is bad
Block 1018 is bad
Block 1019 is bad
Total bad blocks: 156
.
Warning: nfc_read_region(addr=0x7f40000, block=1018): skipping bad
.
Warning: nfc_read_region(addr=0x7f60000, block=1019): skipping bad
..
Warning: nfc_read_region(addr=0x7f60000, block=1019): skipping bad
.**Warning** FLASH configuration checksum error or invalid key
Use 'fconfig -i' to [re]initialize database
FEC PHY: RTL8201EL
FEC: [ HALF_DUPLEX ] [ disconnected ] [ 10M bps ]:
Ethernet mxc_fec: MAC address 00:04:20:ff:ff:01
No IP info for device!
Unrecognized chip: 0xf8!!!
hardware reset by WDOG

Clock input is 24 MHz
RedBoot(tm) bootstrap and debug environment [ROMRAM]
Non-certified release, version FSL 200904 - built 16:56:15, Jan 5 2012

Platform: Logitech Baby (i.MX25 ) PASS 1.0 [x32 DDR]
System type 2070 revision 7
Copyright (C) 2000, 2001, 2002, 2003, 2004 Red Hat, Inc.
Copyright (C) 2003, 2004, 2005, 2006 eCosCentric Limited

RAM: 0x00000000-0x03f00000, [0x00095250-0x03ef1000] available
FLASH: 0x00000000 - 0x8000000, 1024 blocks of 0x00020000 bytes each.
RedBoot> ubi attach -f 0x80000 -l 0x07EC0000 -w 0x800 -e 0x20000 -s 0x200
scanning 1014 PEBs
.................................................. ................................skipping bad block 41
.................................................. .................................................. .................................................. ..........................skipping bad block 130
skipping bad block 131
.................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. ..............................skipping bad block 372
..skipping bad block 374
.................................................. ..................skipping bad block 409
..........................skipping bad block 423
........................................skipping bad block 444
................................skipping bad block 461
........................................skipping bad block 482
.................................................. ..............skipping bad block 515
......skipping bad block 519
skipping bad block 520
......skipping bad block 524
.................................................. ........................skipping bad block 562
................skipping bad block 571
skipping bad block 572
skipping bad block 573
skipping bad block 574
skipping bad block 575
skipping bad block 576
skipping bad block 577
skipping bad block 578
..skipping bad block 580
skipping bad block 581
skipping bad block 582
[...]
skipping bad block 697
skipping bad block 698
skipping bad block 699
skipping bad block 700
..................skipping bad block 710
.................................................. skipping bad block 736
................................skipping bad block 753
................................skipping bad block 770
................................skipping bad block 787
skipping bad block 788
....skipping bad block 791
.................................................. .................................................. .................................................. .................................................. .................................................. .................................................. .................................................. ................................skipping bad block 983
.................................................. ..........scanning is finished
the layout volume was not found
Volume table error -22

RedBoot> ubi load -b 0x100000 kernel%{os_backup}
No volume 'kernel' found
RedBoot> exec -c %{os_cmdline}Warning: invalid entry address but still continue ...
entry=0x80008000, target=0x80008000
Base address unknown - use "-b" option
RedBoot>

[toby10]

Long shot, but you might get lucky with a Firmware Rollback (though probably won't work with a corrupt/partial firmware it is currently operating on).
Heck, worth a shot.

Radio FW Roll Back (will only be rolled back one version) =
1) Turn Radio off: Press & hold the power button till you see “Goodbye”
2) Turn back on: Press & hold REW and PWR buttons simultaneously

[rbudde]

Hello Toby,

thank you very much for your answer!

I think there is not OS/driver to make the screen tell me "Goodbye" and to revert any firmware - but anyway - I tried it several times hoping that the mentioned buttons are somewhat hardwired to the bootloader and can trigger something.

No luck. :-(

Can't somebody tell me how to obtain a UBI image for Squeezebox Radio?

Best regards,
Robert

[Roland0]

Can't somebody tell me how to obtain a UBI image for Squeezebox Radio?

Have you checked if the bin files actually are the ubi images, or do you just assume they aren't because of the extension?

[rbudde]

Have you checked if the bin files actually are the ubi images, or do you just assume they aren't because of the extension?

Hi Roland,

I did not check because I don't know how to do that. But my guess is, that I at least need the information to what address I need to write the image (no matter if img or ubi) using RedBoot.

I was hoping for some people experienced with actual firmware development. I guess when testing beta-firmwares it sometimes happens that the box gets "bricked" on such a low level and there is some knowledge to put it back to life.

Best regards
Robert

[Roland0]

I did not check because I don't know how to do that. But my guess is, that I at least need the information to what address I need to write the image (no matter if img or ubi) using RedBoot.

I'd try mounting it - if it works, it's an UBI image. See here on how to do this.

Address seems to be always 0x100000 (probably - suggested by the boot log and the wiki page)

I was hoping for some people experienced with actual firmware development. I guess when testing beta-firmwares it sometimes happens that the box gets "bricked" on such a low level and there is some knowledge to put it back to life.

Can't help you there, sorry

[ukl]

I am asking for help to recover a "bricked" Logitech Sqeezebox Radio. After having a Squeezebox Radio for a while and being very happy with it, I bought another one. As I want to use it without a GUI anyway, I tried my luck buying a "defective" one.

Did you have any chance to recover your device? If not, do you still have it and are interested in it?

Best regards
Uwe