Hi,
I've recently acquired a ZP100 however it looks to be stuck in the boot process with a single white light flashing endlessly.
It doesn't appear responsive to holding the mute button on bootup. On powerup all of the network port light flash briefly and the connection lights are solid if wired to bridge via ethernet.
I know this is an old product and I know it is my fault for purchasing it, but is there any other reset tricks or way to update the firmware to get out of this loop?
This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
Page 4 / 8
@soyuppy Congrats!
@mrmom, the bootloader is stored in ROM on the ZP100 (one of http://www.atmel.com/devices/AT27LV512A.aspx specifically) If you aren't getting to the bootloader after connecting to the UART there is probably some other underlying problem.
If you are interested in getting a copy of the bootloader for more academic reasons you can dump it using JTAG.
@mrmom, the bootloader is stored in ROM on the ZP100 (one of http://www.atmel.com/devices/AT27LV512A.aspx specifically) If you aren't getting to the bootloader after connecting to the UART there is probably some other underlying problem.
If you are interested in getting a copy of the bootloader for more academic reasons you can dump it using JTAG.
Userlevel 2
Hello
I got to connect my raspberry pi UART (i dont have a bus pirate) to the ZP100. Im now connected and with ZP100 shell operational.
Can you please elaborate a little bit more the procedure of killing anacapad? i have tried the following commands but im still seeing several anacapad processes when i run "top"
Also, i have already downloaded the current firmware to my pc and im getting the HTTP server ready. i have a question regarding what route should i put the file on so the ZP100 can find it? what ip address should i assign to my pc and what link shoul i emulate?
Would really appreciate your help! i believe im getting closer to revive that thing!
I got to connect my raspberry pi UART (i dont have a bus pirate) to the ZP100. Im now connected and with ZP100 shell operational.
Can you please elaborate a little bit more the procedure of killing anacapad? i have tried the following commands but im still seeing several anacapad processes when i run "top"
code:
touch /var/run/stopanacapa
killall -9 anacapad
code:
top
Mem: 10224K used, 20940K free, 0K shrd, 2180K buff, 3692K cached
Load average: 1.00, 0.81, 0.40 (State: S=sleeping R=running, W=waiting)
PID USER STATUS RSS PPID %CPU %MEM COMMAND
125 root R 772 61 0.3 2.4 top
84 root D 2112 1 0.0 6.7 anacapad
61 root S 628 1 0.0 2.0 sh
55 root S 624 1 0.0 2.0 ping
53 root S 624 1 0.0 2.0 inetd
1 root S 572 0 0.0 1.8 init
58 root S 528 1 0.0 1.6 smbscand
8 root SW 0 1 0.0 0.0 mtdblock_autoba
22 root SWN 0 1 0.0 0.0 jffs2_gcd_mtd4
2 root SW 0 1 0.0 0.0 keventd
3 root SWN 0 1 0.0 0.0 ksoftirqd_CPU0
4 root SW 0 1 0.0 0.0 kswapd
5 root SW 0 1 0.0 0.0 bdflush
6 root SW 0 1 0.0 0.0 kupdated
7 root SW 0 1 0.0 0.0 mtdblockd
36 root SW 0 1 0.0 0.0 zpevtd
34 root SW 0 1 0.0 0.0 cifsoplockd
95 root Z 0 84 0.0 0.0 anacapad
Also, i have already downloaded the current firmware to my pc and im getting the HTTP server ready. i have a question regarding what route should i put the file on so the ZP100 can find it? what ip address should i assign to my pc and what link shoul i emulate?
Would really appreciate your help! i believe im getting closer to revive that thing!
Userlevel 2
Hello all.
I want to report excelent results reviving my unit. Here is my procedure.
Since i dont have a bus pirate i had to use the uart that comes in my raspberry pi. connections are pretty much the same.
i used a program called screen in order to connect to the uart:
i created the http server with abyss web server on windows and hardwired the unit with my pc. pc had a ip address of 169.254.1.2 and firewall off just in case.
emulated the download route like this:
make sure zp100 can ping the computer.
killed anacapad. had to do it several times until it showed no more processes.
ran some magic
first time, it got stuck somewhere on the way and upgrade didnt go through. i power cycled and did same procedure. here is the output.
after this, unit rebooted and got dhcp address from my router after reconnecting, it updated to my lastest running version which is 29387150MainlineAlpha.
just an advice that worked for me. run a hard reset after this on your zp100.
i will do more testing since i note that the unit behaves weird on the alpha version that im running.
thanks to all the people who has posted here. all these have help me a lot!
I want to report excelent results reviving my unit. Here is my procedure.
Since i dont have a bus pirate i had to use the uart that comes in my raspberry pi. connections are pretty much the same.
i used a program called screen in order to connect to the uart:
code:
screen /dev/ttyAMA0 38400
i created the http server with abyss web server on windows and hardwired the unit with my pc. pc had a ip address of 169.254.1.2 and firewall off just in case.
emulated the download route like this:
code:
http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd
make sure zp100 can ping the computer.
killed anacapad. had to do it several times until it showed no more processes.
code:
touch /var/run/stopanacapa
killall -9 anacapad
ran some magic
code:
cd /bin
upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27&cmin=2&cbld=80271&subm=3&rev=2®=1&serial=000E5XXXXXXX&sonosid=112XXXXXX&householdid=XXXXXXXXXXXXXXXXXX
first time, it got stuck somewhere on the way and upgrade didnt go through. i power cycled and did same procedure. here is the output.
code:
[7] + Done upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27
[6] + Done upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27
[5] + Done upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27
[4] + Done upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27
[3] + Done upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27
[2] + Done upgrade http://169.254.1.2/firmware/Gold/28.1-83251-v5.2-pcyakr-RC4/28.1-83040-1-1.upd?cmaj=27
upgrade version 28.1-83040
compatible with Sonos Zone Player submodels 0-16 revisions 0-4294967294 (any region)
compatible with hardware feature set 1d
My hardware feature set is 1
Upgrade supports all my features
\#-/Upgrade file is good
Using new partition format mode
Destination section 0 generation 5
Operating in redundant partition mode (not changing partition table)
Executing upgrade script...Checking to see if (hh.)anacapad is running...Stopping ancillary processes...
Killing udhcpc
kill: 100: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]
Killing smbscand
Killing inetd
Killing netstartd
kill: 100: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]
ok
Merged partition table flags 00000001:
0 1:0:16
1 16:16:48
2 17:64:256
3 64:320:1389
4 16:1709:48
5 17:1757:256
6 0:0:0
Writing kernel to partition 1
Writing / to partition 2
sections M16 len check 0
Executing upgrade script to do any final work...Doing post-install steps...
cp: /tmp/upgrade.log: No such file or directory
ok
(946685120)Restarting system.
Rincon boot loader version 1.0-27270(ZP) (32M SDRAM). Press 'h' for help.
SDRAM test...
Memory test iteration 0
SDRAM test complete
Attempting to autoboot from NAND device
NAND ID is 20:75
32M NAND flash (ST NAND256W3A) detected
NAND flash block 1710 is bad
Section 0 is provisionally good, kernel on partition 1, generation 5
Section 1 is provisionally good, kernel on partition 4, generation 4
Attempting to boot kernel from partition 1
after this, unit rebooted and got dhcp address from my router after reconnecting, it updated to my lastest running version which is 29387150MainlineAlpha.
just an advice that worked for me. run a hard reset after this on your zp100.
i will do more testing since i note that the unit behaves weird on the alpha version that im running.
thanks to all the people who has posted here. all these have help me a lot!
Userlevel 2
Hello.
More details about my system. Unit has been very weird lately. It associates sometimes to my system and it keeps freezing after a couple songs. It's still pingable and it has a valid ip address but sonos controller just can't find it. Also, http is not accessible.
I tried to connect again to the shell via uart but cannot get any command prompt.
I also tried to reset it. I press mute and volume up, flashes white and then flashing orange appears but won't turn to green. It will stay blinking white/orange.
sometimes after rebooting, green led will flash but wont associate agan to sonos system.
I'm running out of ideas here. 😞
More details about my system. Unit has been very weird lately. It associates sometimes to my system and it keeps freezing after a couple songs. It's still pingable and it has a valid ip address but sonos controller just can't find it. Also, http is not accessible.
I tried to connect again to the shell via uart but cannot get any command prompt.
I also tried to reset it. I press mute and volume up, flashes white and then flashing orange appears but won't turn to green. It will stay blinking white/orange.
sometimes after rebooting, green led will flash but wont associate agan to sonos system.
I'm running out of ideas here. 😞
Hi @andresmorago, is this the same unit that you revived recently? If so, have you tried running it with a version of the firmware that is not the alpha?
Userlevel 2
Yes. Same unit. The thing Is that I can no longer access either uart or regular operation of the unit. It's very unresponsive.
So, the fact that you cannot access UART is not super suprising, since the production firmware doesn't have serial access. If you are connected to the machine while booting, does the bootloader info show up?
Userlevel 2
I will try as soon as I get back from a trip
andresmorago,
Always prove that the power supply is stable before getting excited about anything else.
Always prove that the power supply is stable before getting excited about anything else.
Userlevel 2
hello again.
unit works once in a while and wont stay stable for more than a couple minutes.
i managed to downgrade it to a stable version (5.3) but still not fully responsive.
i improved my uart connections and this is what i got when i first power it on:
NAND seems to be the problem.
is there anything else i could do?
unit works once in a while and wont stay stable for more than a couple minutes.
i managed to downgrade it to a stable version (5.3) but still not fully responsive.
i improved my uart connections and this is what i got when i first power it on:
code:
Rincon boot loader version 1.0-27270(ZP) (32M SDRAM). Press 'h' for help.
SDRAM test...
Memory test iteration 0
SDRAM test complete
Attempting to autoboot from NAND device
NAND ID is 20:75
32M NAND flash (ST NAND256W3A) detected
NAND flash block 1710 is bad
Section 0 is provisionally good, kernel on partition 1, generation 7
Section 1 is provisionally good, kernel on partition 4, generation 6
Attempting to boot kernel from partition 1
NAND seems to be the problem.
is there anything else i could do?
Given the age of the units, it's not that unusual to have a couple of bad blocks. I very much doubt that is an issue. This sounds more like a power supply issue to me.
Userlevel 2
Thanks poshul.
Is there anything I could do/check with the power supply?
Is there anything I could do/check with the power supply?
andresmorago,
Measure the output voltages, and the ripple voltage. Visually inspect the traces and components. I also like to "thump" the board with an insulated tool while monitoring the voltage. An oscilloscope is very handy as a monitor. In any case, a healthy board will not respond to the thumps.
Measure the output voltages, and the ripple voltage. Visually inspect the traces and components. I also like to "thump" the board with an insulated tool while monitoring the voltage. An oscilloscope is very handy as a monitor. In any case, a healthy board will not respond to the thumps.
Userlevel 2
Measure the output voltages, and the ripple voltage. Visually inspect the traces and components. I also like to "thump" the board with an insulated tool while monitoring the voltage. An oscilloscope is very handy as a monitor. In any case, a healthy board will not respond to the thumps.
hello
im starting to think that indeed there is a voltage issue. i noticed today that the white led is kinda flickering a little bit. very weak but its there.
i monkeyd around with cables a little bit, re-powered up the unit and seems to be better.
i will clean electronic parts with a cleaner and see what happens.
Userlevel 2
24 hours and still running ok with 5.3 version.
i cleaned up electronic boards and cotacts. also i moved cables around and toggled the voltage switch several times in order to make sure that the contact was ok.
will report any news.
i cleaned up electronic boards and cotacts. also i moved cables around and toggled the voltage switch several times in order to make sure that the contact was ok.
will report any news.
Userlevel 2
reporting back. so far so good. revived unit has been stable for 2 days already and have playing music without any hiccups.
apparently, moving the cables and doing some cleaning, did the trick.
im still afraing of moving to 5.4 version...
apparently, moving the cables and doing some cleaning, did the trick.
im still afraing of moving to 5.4 version...
I tried to connect to the serial port using a buspirate and was pretty unsuccessful. Mostly because the bootloader and machine name were too difficult to locate without access to the :1400 interface.
Are there ways to bring the ZPT28 CPU board back from an non-pingable state? Got my IP address on my PC in the same range as default on ZP100 so my :1400/status is visible.
Here is my workaround using hardware. With a unit that I was able to ping as the donor, I swapped the top CPU board with a unit that had no IP or ping ability. Once the board was swapped the unit powered, recognized and updated itself. I successfully did this 2 times, yielding 2 working ZP100s. I sliced off the working MAC address sticker on the rear and attached it to the transplant machine so I could keep my MAC addresses tidy on my network. I am VERY interested in swapping or trading 2 non IP devices for 1 working IP/ethernet/cpu ZPT28 card.
My screwdriver and assembly skills are better than my linux.
*moderators please move this to a new topic if you feel this is too far from initial BusPirate/serial port discussion
Are there ways to bring the ZPT28 CPU board back from an non-pingable state? Got my IP address on my PC in the same range as default on ZP100 so my :1400/status is visible.
Here is my workaround using hardware. With a unit that I was able to ping as the donor, I swapped the top CPU board with a unit that had no IP or ping ability. Once the board was swapped the unit powered, recognized and updated itself. I successfully did this 2 times, yielding 2 working ZP100s. I sliced off the working MAC address sticker on the rear and attached it to the transplant machine so I could keep my MAC addresses tidy on my network. I am VERY interested in swapping or trading 2 non IP devices for 1 working IP/ethernet/cpu ZPT28 card.
My screwdriver and assembly skills are better than my linux.
*moderators please move this to a new topic if you feel this is too far from initial BusPirate/serial port discussion
Userlevel 2
So I too am having these issues. I have downloaded the latest firmware and currently my system shows
Software Version 3.2-29243-diag
I am willing to purchase the buspirate but need some guidance as to where to hook it up. I have the unit mostly apart at this time and am fairly confident in being able to get this working again. Thanks in advance.
John
Software Version 3.2-29243-diag
I am willing to purchase the buspirate but need some guidance as to where to hook it up. I have the unit mostly apart at this time and am fairly confident in being able to get this working again. Thanks in advance.
John
So, I am now a pro at opening a buspirate connection in bridge, setting my computer IP to 169.254.1.x to use the same range as the default ZP100, and then pulling out my hair.
I have got bootloader on my local PC, kill ancapa and I can get it to upgrade, but then it just doesn't seem to take. I get command prompt # with no reboot or indication that it wants to stay upgraded.
Also are the http upgrade values after the upd?blahblah=xx&yadda=xxxx&var=x. . .etc specific to the machine or the upgrade? or is it just the serial, sonosid, and householdid that are machine specific?
For some reason my wife doesn't want to discuss sonos with me anymore.
I have got bootloader on my local PC, kill ancapa and I can get it to upgrade, but then it just doesn't seem to take. I get command prompt # with no reboot or indication that it wants to stay upgraded.
Also are the http upgrade values after the upd?blahblah=xx&yadda=xxxx&var=x. . .etc specific to the machine or the upgrade? or is it just the serial, sonosid, and householdid that are machine specific?
For some reason my wife doesn't want to discuss sonos with me anymore.
Userlevel 2
Connected to UART console and was able to see the boot loader message..but it seem to be stuck there. no other message show up.
"Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help."
tried pressing h repeated. no luck
This is the only line of text appearing via Putty Console thru Bus Pirate
Anyone seen or know how to get pass this?
Because of this, I cannot get thru the http://169.254.1.1:1400/status either.
"Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help."
tried pressing h repeated. no luck
This is the only line of text appearing via Putty Console thru Bus Pirate
Anyone seen or know how to get pass this?
Because of this, I cannot get thru the http://169.254.1.1:1400/status either.
Userlevel 2
I wonder if all the units have the same root password for accessing via telnet.
Seems the hash is stored in /etc/passwd as you'd expect. The hash on the unit I have is hSmFHLbnzeXIA.
Its probably salted and then hashed, so I dont know if we'll be able to recover it this way.
Regardless, I got 2 ZP100s from ebay which were both non-functional when I got them.
Thanks to the advice in this thread, learned that the one is failing the SDRAM check, and giving up on autoboot. Manually booting it via the bootloader console is enough to get it alive, updated to current firmware, and it links to my Sonosnet and plays music. I suspect replacing the ISSI IS42S16800B-7TI SDRAM chip on the board will make it autoboot once more.
The other was a 3.2.whatever-diag firmwared unit, coming up on 169.254.1.1, with telnet open. Breaking in as root via the UART console let me set its IP to a routable one on my network and get it updated and playing music too. Its dmesg is still showing a bunch of "Empty flash at..." and "Data CRC failed..." messages. It was having issues where after a couple hours of runtime on the diag firmware, it wouldn't boot anymore. Few hours of cooldown would get it running again. I'm currently running it for a few hours to see if the fail to boot comes back.
Seems the hash is stored in /etc/passwd as you'd expect. The hash on the unit I have is hSmFHLbnzeXIA.
Its probably salted and then hashed, so I dont know if we'll be able to recover it this way.
Regardless, I got 2 ZP100s from ebay which were both non-functional when I got them.
Thanks to the advice in this thread, learned that the one is failing the SDRAM check, and giving up on autoboot. Manually booting it via the bootloader console is enough to get it alive, updated to current firmware, and it links to my Sonosnet and plays music. I suspect replacing the ISSI IS42S16800B-7TI SDRAM chip on the board will make it autoboot once more.
The other was a 3.2.whatever-diag firmwared unit, coming up on 169.254.1.1, with telnet open. Breaking in as root via the UART console let me set its IP to a routable one on my network and get it updated and playing music too. Its dmesg is still showing a bunch of "Empty flash at..." and "Data CRC failed..." messages. It was having issues where after a couple hours of runtime on the diag firmware, it wouldn't boot anymore. Few hours of cooldown would get it running again. I'm currently running it for a few hours to see if the fail to boot comes back.
@soyuppy: If you've successfully upgraded to a non diagnostic firmware the post-boot console goes away. I'd check to see if you can add the unit to your network now as normal. As for pressing 'h' to get the help info, you need to do that immediately as the machine boots, otherwise it continues on to autoboot.
@mrmom: Do you get any errors during the attempted update, or does it just silently fail?
@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.
@mrmom: Do you get any errors during the attempted update, or does it just silently fail?
@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.
Userlevel 2
@mrmom: Do you get any errors during the attempted update, or does it just silently fail?
@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.
While I agree with you that it likely is salted -- and therefore difficult to recover, and while I agree that Sonos probably wouldn't be a fan of the password being published, I also think there's little they can do about it. Additionally, we still don't know what the magic is to turn on the telnet daemon on a production firmwared box. Therefore, it would really only be useful to updating firmware on 3.2.whatever-diag firmwared boxes without opening the chassis to get to the serial port.
Lots of case law on gaining root access to devices you own -- see Android cell phones in particular.
So my one unit is failing the RAM check at a single address (but once you force it past that via the serial console, its been running now for some 24hours without issue).
The other is cold booting fine normally, but seems to fail to boot when its warm and you power cycle it. I'm wondering if its RAM chip has a temperature dependent fault the other way, where it fails when warm. Serial console when its warm seems to show a bagload of RAM check failure locations, and yet forcing it past there seems to yield a working unit.
I have a RAM chip (ISSI IS42S16800A-7TL) ordered on ebay to replace the one that wont boot on its own. I guess I should order another one for the temperature failing one.
What's interesting is that these two units are rather different. They contain different WiFi cards, and the PCBs inside are different colors. The -diag firmwared unit has blue solder mask on its PCBs, and the RAM failure one has green. Also, they have small differences on chip part numbers (RAM chips for example, are ISSI IS42S16800A-7TL, and ISSI IS42S16800B-7TL on the two boards)
Userlevel 2
Hello all,
its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.
Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.
its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.
Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.
Userlevel 2
For what its worth: I've managed to get the password back from that hash I posted a couple days ago.
Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.
I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.
Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.
I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.
Page 4 / 8
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.