Reflashing RSMedia V2 with original firmware.

41 posts / 0 new
Last post
Helibot
Helibot's picture
Reflashing RSMedia V2 with original firmware.

Hi all,
     I have created a script and data files to allow a RSMedia-with-USBNet (also called RSMV2) to be reflashed with the original firmware. It should restore a RSMedia back to factory defaults.

You can download it from here (I tried uploading it to robocommunity but it seems too big? - always gets error Frown)

I hope that this could allow some broken RSMedias to be revived.
-If you have a RSMedia that fails to finish booting this MAY help.
-If youhave a RSMedia that behaves strangely, then restoring the original firmaware MAY help.

It will replace:

  • The default wowwee files
  • The linux system/root image
  • The default Wowwee personalities.
    (Ie this will reset the RSMedia, Butler, Billy Joe and SpaceBot personalities into RSMedia Onboard storage.)

This script CAN also replace the Linux kernel, but only do this if you REALLY need too - (see instructions.txt in the archgive for more info).

So far its been tested on my robot and by ElectronicGenuis.

It shound NOT be used on an RSMV1 (without USBNet).  (The script will check that the robot is a V2 before it reflashes anything dangerous).
  [If you have a RSMv1 then click here for a howto to restore its firmware. Or you can upgrade a RSMV1 to RSMV2 with instructions from here (but you MUST have the serial hack done).]

BTW If you want to find if the robot is RSM V1 or RSM V2 then goto Media Mode then Options menu:
RSM V2 has menu 7 = 'USB Net'
RSM V1 does not have a 'USB Net' menu

Cheers
   Helibot

FreddyA
FreddyA's picture

Hi Helibot, great job on this. I hope this gets updated on the dev kit. I'm glad you have come up with this tool, it is essential to the rsm survival.
Is it possible to flash a different start up dance routine? Or is that something the chips on the main board do?

Freddy

Helibot
Helibot's picture

Hello Freddy,
>I hope this gets updated on the dev kit
Yep, its on the todo list.

>Is it possible to flash a different start up dance routine?
>Or is that something the chips on the main board do?
I am very sure that the startup dance is controlled from the main robot board. So the media board cant really change it. It maybe possible to stop or cancel it, but noone knows what (or even if) there is a command todo this.

Cheers
Helibot

FreddyA
FreddyA's picture

Hi Helibot. So if it was possible to reflash the robot main board maybe that could be customized and even possibly the boot images?
Freddy

Helibot
Helibot's picture

Hi Freddy,
Not sure how to interperet your question? What do you mean by "boot images"? (the firmware booted at startup or the images shown on the LCD screen during booting?)
But here is some info that may help answer?
I dont think the software/image for the robot board can be reflashed , so there is no way we can chage that (and its probably custom Wowwee software so we would have no way to build it).

Regarding the images shown on the LCD at bootup. They are located in the /icons directory. And the /icons directory is part of the root file system which is contained in rfs_system_V2.cramfs (and flashed into dev/nand1 flash device by the script).
So it is possible to change the files in the rfs_system_V2.cramfs. This file is a 'cram fs' which stands for compressed ram file system. So its a bit like a zip file archive - you can extract all the files, change them and compress them back up again, then flash the new zip file. I tried this when I was trying to recover Ben from the dead. It does work...but you have to be very careful not to increase the file size to be bigger than will fit in the flash device. Let me know if you are interested in this and I can give some more details on how its done. (You will need to have a linux machine available (the redhat or ubuntu vitrual machine will work). BTW you will be able to change ANY file in the root file system this way, so you can change images,icons, startup scripts , add (or remove) linux utilities etc. Any changes you make would be permanent (and would be present with or without the SDCard) !!!!
(For example one day I hope to modify the root file system to start all the PPP networking stuff ,run a telnet server and Webserver and a replacement robot contol program......!!)
Cheers
Helibot

FreddyA
FreddyA's picture

Hi Helibot, that's exactly what I wanted to do. Change the WowWee splash and the WowWee LOADING animated gif. Also the Control, Arm and the animated Media menu. So YES! please give me more details on how to do that. I have ubuntu on vm. I hope it would be possible to place animated gif on the Control and Arm mode. I'd like to get my ppp, telnet and webserver going from the root file system asap! What do you mean by robot control program? Like the entire Linux OS, if so could you please change the awful looking audio and video players for a cool linux media player?
Anyhow, I'm looking forward to doing all this.
Cheers,
Freddy

Helibot
Helibot's picture

Hi Freddy,
I will start a new thread to give you info about modifying the root file system and answer your other questions.
(Lets keep this thread for issues with reflashing the default software)
I'll have to look up some of my old notes and try a few things to refresh my memory, so it maybe a few days.....

Cheers
Helibot.

FreddyA
FreddyA's picture

Hi helibot. I was having some problems where the control mode and arm mode pictures werent showing up on the lcd with or with out the sd. I thought that files might be corrupt and tried the reflashing but now I only get this far: Kernel panic!
emory: 32MB = 32MB total
Memory: 30816KB available (1023K code, 316K data, 60K init)
Dentry-cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode-cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
ttySA0 at I/O 0x206000 (irq = 29) is a MX1ADS
ttySA1 at I/O 0x207000 (irq = 23) is a MX1ADS
pty: 256 Unix98 ptys configured
DMA Initializing
block: 64 slots per queue, batch=16
PPP generic driver version 2.4.1
PPP Deflate Compression module registered
PPP BSD Compression module registered
SSFDC core support installed
MX1ADS nand I/O driver installed
SSFDC Partitions
nand0 : block 0x0000-0x0049 : "Kernel" 1184 KB direct map
nand1 : block 0x004a-0x0229 : "RootDisk" 7680 KB random map
nand2 : block 0x022a-0x04a9 : "DefaultDisk" 10240 KB random map
nand3 : block 0x04aa-0x0f5a : "UserDisk" 43792 KB random map
nand4 : block 0x0f5b-0x0f7a : "WritableDisk" 512 KB random map
nand5 : block 0x0f7b-0x0f9a : "PassDisk" 512 KB random map
MX1ADS nand flash partition definitions installed
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 2048)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NetWinder Floating Point Emulator V0.95 (c) 1998-1999 Rebel.com
found bad block 0x0 -> 0x3fc, block status 0xff, data status 0x0
[ 00 00 00 00 00 ff 00 00 00 00 00 00 00 00 00 00 ]
reserved: 0x00000000
data status: 0x00, block status: 0xff
addr1: 0x0000, addr2: 0x0000
ecc1: 0x00 0x00 0x00, ecc2: 0x00 0x00 0x00
PAGE 8520
Error: block addr field not identical 0x52fd != 0xa820
found bad block 0xf4 -> 0xcd, block status 0x0, data status 0xff
[ ff ff ff ff ff 00 11 e8 03 00 33 11 e8 30 f3 03 ]
reserved: 0xffffffff
data status: 0xff, block status: 0x00
addr1: 0xe811, addr2: 0xe811
ecc1: 0x30 0xf3 0x03, ecc2: 0x03 0x00 0x33
VFS: Mounted root (cramfs filesystem) readonly.
Freeing init memory: 60K
Warning: unable to open an initial console.
HD66770 Recycle LCD drivers 132x176 Version 0.1 installed
MXL-ADS Video Capture Module initialized
Call ssfdc_udisk_register_partition
Call usb_disk_register
USB Device mass storage interface installed
Date : 2005/01/06
Register usb_mmc_disk complete
MMC disk driver initialized
MX1ADS USB Device controller glue driver installed
Chip ID: 1b, Chip Revision: 0
MX1ADS : AC97 driver initialized.
Kernel panic: Attempted to kill init!
HD66770 Recycle LCD drivers 132x176 Version 0.1 installed
MXL-ADS Video Capture Module initialized
Call ssfdc_udisk_register_partition
Call usb_disk_register
USB Device mass storage interface installed
Date : 2005/01/06
Register usb_mmc_disk complete
MMC disk driver initialized
MX1ADS USB Device controller glue driver installed
Chip ID: 1b, Chip Revision: 0
MX1ADS : AC97 driver initialized.
Kernel panic: Attempted to kill init!

Anything I can do to recover?
Freddy

FreddyA
FreddyA's picture

HI, it gets worse. I tried to program the bootloader and used a bootloader file from an old rsmv2 dump. Problem is now I get zilch in the console when booting up. Nothing at all. Did I brick it?

Freddy

Vader
Vader's picture

Yup, you bricked it.

The bootloader you used (presumably from the RSMFirmwareDump script) would have had the extra garbage data in the header. It's still recoverable though, but you'll have to do the bootstrap trick. Helibot or Nocturnal should be able to give you guidance on that.

I noticed you have "Warning: unable to open an initial console." in your boot output, which happens to be the one I always get when I make dodgy custom firmwares (and is caused by the /dev/console device node missing). In any case this can be resolved by reflashing a good image.

FreddyA
FreddyA's picture

Thanks Vader for the good news. I did use a bootloader from a older firmware dump. Before I did that is when I got that warning. I remember Helibot soldering a jumper wire to fix his so I'm a bit ok and with patience everything will turn out. I hope

Freddy

Helibot
Helibot's picture

Hi Freddy, Just saw your posts...bummer. But I think I can help. (Had a bit of a heart attack though....went to look up my RSMedia notes file and it had gone!! (Finially discovered I had accidentially moved it to another directory -phew!! Did have a backup from end of last year though!) Anyway - onto the info you want.....

I will email you the two files needed soon.
(I am assuming that your robot was a RSMV2- let me know if its not)

You will need to locate the jumper J15 on the Media board.

Summary of the process

  • Solder the bootstrap pin on J15 (or solder on wires and a switch or solder on wires and pins and use a jumper)
  • Boot robot at 57600 and type 'a'. Response is ':'
  • Send a runnable bootloader file to the serial port
  • Change to 115200 and press a key - should get a menu
  • Choose '0' programming menu
  • Choose '0' program bootloader
  • Use USB to transfer the RSMV2 bootloader image (yes I did mean USB)
  • Bootloader should be flashed
  • Reboot robot and boot normally or press any key to enter bootloader (if other sections need reflashing)

My notes from when I did it:

Can try a bootstrap
Need to ground BOOT0 pin goes to silkscreen J15

Soldered link at j15
Powering up with Teraterm set 57600 will allow autoboard of 'a' or 'A' to work.
Robot responds with ':'
Use Teraterm 'File:SendFile' to send 'b-record files' to the board. NOTE needed to specify 20ms delay/line in Terraterm. Also ticked 'binary' in sendfile dialog.
Cant autobaud at 115200 :-(
Send file named Boot_b.txt
Wait for send window to disappear , Then press any key, then change to 115200
(May have todo Control:reset terminal from teraterm.)
You should now see a menu
-+= Main Menu =+-
0. Programming Menu
1. Boot Menu
2. Memory Menu
3. Other Options
4. Boot
   Please enter selection -> 0

-+= Main Menu =+-
0. Program Bootloader
1. Program Kernel
2. Program Root-Disk
3. Program System-Disk
4. Program New Logo
5. Program All
6. Return to Main Menu
   Please enter selection -> 0

USB drive ready for transfer.
(Connect USB cable to PC , Use file boot.bin to place in the newly created Windows removeable Disk drive, then eject Drive in windows and file is flashed.)

File transfer completed.

File Size : 0x00004000
Erasing EEPROM... Complete.
Copying Bootloader from RAM to Flash... Done.
Verifying Bootloader...
Error at 0x10004001 RAM = 0x00 EEPROM = 0xFF
Verify Complete...
-+= Main Menu =+-

<**Freddy Note -the bit above 'Error at 0x10004001 RAM' - you probably wont see that**>

Remove the J15 bootstrap link
Set serial port back to 115200 and reboot the robot. (Cross fingers and toes and pray to the god of technology ) and hope he comes back to life.

Now the disclaimer.... My notes were quite a bit out of order, cos I was workimg it all out as I went, but i am pretty sure the above will work for you. Let me know if it doesnt!

Next I have to send you the right files - again I had quite a few versions, but I am pretty sure I have found the right ones!

Cheers
   Helibot

FreddyA
FreddyA's picture

Hi helibot, everything turned out like you said xcept the results haha.
When it boots I get the static wowwee on the lcd but no "loading" like the v2 does and hangs there. Heres what i see in console:

MXL Bootloader for RSmedia (2006-09-12)

Manufacture ID:00C2

Device ID:22BA
Press any key for alternate boot-up options ... 00

Copying kernel from Nand Flash to RAM ...
Manu ID =000000EC Device ID =00000076 Block count =00001000
scan block finished
Booting kernel ...

there it stops and hangs forever.
Progress though thats good from being briked

Freddy.

FreddyA
FreddyA's picture

Hi helibot, everything turned out like you said xcept the results haha.
When it boots I get the static wowwee on the lcd but no "loading" like the v2 does and hangs there. Heres what i see in console:

MXL Bootloader for RSmedia (2006-09-12)

Manufacture ID:00C2

Device ID:22BA
Press any key for alternate boot-up options ... 00

Copying kernel from Nand Flash to RAM ...
Manu ID =000000EC Device ID =00000076 Block count =00001000
scan block finished
Booting kernel ...

there it stops and hangs forever.
Progress though thats good from being briked

Freddy.

Helibot
Helibot's picture

Hi Freddy,
Ok, its good progress , but not great!!

It could be that the kernel image is missing or corrupted. But since you said it was previously booting the kernel then failing , I will take the other option and guess .....that I gave you the wrond file!! - I may have given you the RSMV1 bootloader instead :-(.
I cant confirm that 100% until I get home (I'm at work at the moment). But if you want to recover you could now use the instructions in "UpgradeRSMV1toRSMV2". I think you have done this before right? So try steps 2,3,4 to reflash and rerun the new bootloader (This time use the bootloader image from the archive!!). I think this will get you working, but if it still doesnt boot then continue to steps 5 onwards (and reflash everything!!).

Cheers
Helibot

FreddyA
FreddyA's picture

Hi Helibot. i was about to start the flash when I noticed it said 16mb but my rs media is 32mb will it be ok still to use that bootloader?

Freddy

Vader
Vader's picture

The 16mb bootloader will probably work (since the original v1 one does), but only 16mb of memory will be available to the kernel. Since you have a 32mb bootloader dump you can just strip the extra data from it and flash that on instead.

After taking a quick look, the first 65536 bytes (on the v1 bootloader anyway) are just junk FFs that can be removed with a hex editor.

The actual executable code starts like this:
9C 10 9F E5 9C 30 9F E5 00 30 81 E5 81 36 A0 E3

So just remove anything before that and give it a go. If you're unsure what to do, just send me a dump and I'll do it for you.

Update: I have supposedly fixed Freddy's bootloader dump and sent it to him.

Helibot
Helibot's picture

Hi Freddy,

The RSMV1 bootloader outputs "MXL Bootloader for RSmedia (2006-09-12)"
The RSMV2 bootloader outputs "MXL Bootloader for RSmedia 16MB (2007-02-09)"
(I am not sure what the 16M refers to RAM or Bootloader or kernel size?)
Either bootloader can be put onto any RSMedia - they will both run OK.
BUT The RSMV2 version will create different size partitions when Option 3 Init Nand Falsh is run. It may also flash images to different locations in flash memory.

So you should use RSMV2 version in your robot (assuming he was previously a RSMV2 robot). So if your robot is showing "MXL Bootloader for RSmedia 16MB (2007-02-09)"
then you have the correct one Smile

 There is definitely a good RSMV2 bootloader image in the "UpgradeRSMV1toRSMV2" archive (which you can get from here ) File is called rsmv2_firmware/bootloader_RSMV2_16M.

 What Vader did in stripping of the FFs should also work OK.

Cheers
   Helibot

Vader
Vader's picture

Helibot said: Hi Freddy, The RSMV1 bootloader outputs "MXL Bootloader for RSmedia (2006-09-12)" The RSMV2 bootloader outputs "MXL Bootloader for RSmedia 16MB (2007-02-09)" (I am not sure what the 16M refers to RAM or Bootloader or kernel size?) Either bootloader can be put onto any RSMedia - they will both run OK. BUT The RSMV2 version will create different size partitions when Option 3 Init Nand Falsh is run. It may also flash images to different locations in flash memory. So you should use RSMV2 version in your robot (assuming he was previously a RSMV2 robot). So if your robot is showing "MXL Bootloader for RSmedia 16MB (2007-02-09)" then you have the correct one Smile  There is definitely a good RSMV2 bootloader image in the "UpgradeRSMV1toRSMV2" archive (which you can get from here ) File is called rsmv2_firmware/bootloader_RSMV2_16M.  What Vader did in stripping of the FFs should also work OK. Cheers    Helibot

16MB refers to the RAM size, newer revisions of the RS Media (most of the USA Models) have 32 MB of RAM.

If the 16 MB V2 bootloader is used then it will boot the kernel with "root=/dev/mtdblock/2 rw mem=16M" instead of "root=/dev/mtdblock/2 rw mem=32M", making half of the RAM invisible to the kernel.

FreddyA
FreddyA's picture

Hi guys. Good news all around. When I did the bootstrap mode (thanks helibot) I used the 32mb bootloader from the original dump from the robot (thanks Vader) and then from there everything went smooth with the rest of the nands. I didnt have the javakey but I can play the games and install new ones. Did try the v1 2 v2 upgrade sd rsupdate to fix "loose ends" but that didnt work I guess that file isnt updated yet since last Gerber had the halt at expected "then" but everything seems ok so far. I appreciate the help and patience in the revival of my RSMV3D and will post a vid of all his hacks and mods soon.

gerber
gerber's picture

Hi Freddy

So glad you got the robot working again.

Helibot
Helibot's picture

Vader said: 16MB refers to the RAM size, newer revisions of the RS Media (most of the USA Models) have 32 MB of RAM. If the 16 MB V2 bootloader is used then it will boot the kernel with "root=/dev/mtdblock/2 rw mem=16M" instead of "root=/dev/mtdblock/2 rw mem=32M", making half of the RAM invisible to the kernel.

Thanks for clarifying Vader. Now that you reminded me I do recall that it was related to kernel boot memory size.

Helibot
Helibot's picture

Hi Freddy,
Great , glad you got him going :-)

But I am a bit confused. Is what I said before correct?
The RSMV1 bootloader outputs "MXL Bootloader for RSmedia (2006-09-12)"
The RSMV2 bootloader outputs "MXL Bootloader for RSmedia 16MB (2007-02-09)"

Sounds like there is a 3rd bootloader version for RVMV2 32MB? Is this right?

Freddy, What does your bootloader say now?

If its different can you email me a copy as well (so if anyone asks in the future I can send them the right file!!)
Also I wonder what happens if its used in original RSMV1 HW? (I wonder if there is actually less physical RAM in RSMV1 bots or is it just the RAM is partitioned differently?)

Cheers
Helibot

FreddyA
FreddyA's picture

Hi helibot, now my rsm says mxl bootloader for rsmedia 32mb and I will email that to you. hope it helps in some way. BTW I do see some solder jumpers on the media board say 32 and 64 only 32mb are soldered.
Freddy

Vader
Vader's picture

Helibot said: I wonder if there is actually less physical RAM in RSMV1 bots or is it just the RAM is partitioned differently?

From what I'm aware there is actaully less physical RAM. There are a couple of jumpers on the media board which allow you to switch between RAM configs (of course, the 32 MB config will only work if you have 32 MB of RAM in the hardware).

Helibot said: Sounds like there is a 3rd bootloader version for RVMV2 32MB? Is this right?

Yes, "MXL Bootloader for RSmedia 32MB (2006-12-01)"

Shado42
Shado42's picture

Hi Freddy. Thanks for replying to the PM. Basically I have got into the same problem as you were I don't get anything in the console. I have bridged J15 and can get Teraterm to respond with ':' so I assume now I need the file Boot_b.txt to load the bootstrap and the correct bootloader .bin file to program board?

My RS Media is a V1 with 16MB and I would like to try and get it updated to V2. I would be grateful for any help!

FreddyA
FreddyA's picture

Hi Shado42, download the v1 to v2 upgrade files helibot made http://api.viglink.com/api/click?format=go&drKey=1148&loc=http%3A%2F%2Fw... should have all the files needed.

Freddy

Shado42
Shado42's picture

Thanks Freddy but I have already looked through the files in that zip but cannot see the Boot_b.txt to load into memory to get the options to flash the bootloader. Also Helibots notes refer to 'boot.bin' so I am not quite sure which bootloader file I need to flash.

FreddyA
FreddyA's picture

Double Post

FreddyA
FreddyA's picture

OK, I searched high and low for those files with no luck yet. I can't really remember using those files but obviously I must have to get my rsm unbriked. maybe Helibot or Vader will jump in to sort out the files and steps to get your rsm up and running again.. Meanwhile Ill keep looking for those files.

Shado42
Shado42's picture

It seems that Helibot sent you the files so hopfully he may still be looking at these forums. Thanks for helping.

Pages