ZP100 not booting



Show first post

199 replies

Userlevel 2
What kind of cleaning are talking about hear? is just a matter of blowing compress air to rid of all the dust behind all the crevices?
yes. also electronic contacts cleaner and disconnecting/re-connecting all cables.
Userlevel 2
Hello all.
I received my play3 today. I finally got to the uart connector which is very small to solder.
i know play3 is much different than older zp units...still, kinda works similar.

i have been struggling trying to access any diags menu. it boots up so fast that i cant get it to stop.
this is what i get so far. everytime i power it up, it will get to a different point. still, non responsive with any keyboard commands.

code:

U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)

Reset Status:

CPU: e300c3, MPC8314, Rev: 12 at 250 MHz, CSB: 125 MHz
Board: Sonos Fenway
I2C: ready
DRAM: (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.

NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND :
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND : ..
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND :
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Relocate failed
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND : .........
Userlevel 2
ok. got somewhere else after hitting the h key:


code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)

Reset Status:

CPU: e300c3, MPC8314, Rev: 12 at 250 MHz, CSB: 125 MHz
Board: Sonos Fenway
I2C: ready
DRAM: (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
DRAM 32-bit Data Pattern Test AA ------------- PASSED
DRAM 32-bit Data Pattern Test 55 ------------- PASSED
DRAM Address Line Test ----------------------- PASSED
DRAM tests complete.
===================================================
PCIE0: Link
NAND: 64 MiB
Using default environment

In: serial
Out: serial
Err: serial
Net: eTSEC1
Hit any key to stop autoboot: 0
=> hhhhhhhhhhhhhhhhhhhh
Unknown command 'hhhhhhhhhhhhhhhhhhhh' - try 'help'
=>
=>
=>
=> help
? - alias for 'help'
audio - Manage Audio Modulators
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootgen - display partition's bootgen
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
buttons - Button monitoring
clocks - print clock configuration
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
ddputil - Diagnostic Data Page utility
diag - perform board diagnostics
echo - echo args to console
exit - exit script
format - erases a partition and frees all physical blocks
go - start application at address 'addr'
gpio - GPIO initialization and register access
gtm - GTM initialization and register access
help - print online help
i2s - Manage TDM/DMAC blocks
icrc32 - checksum calculation
iloop - infinite loop on address range
imd - i2c memory display
iminfo - print header information for application image
imm - i2c memory modify (auto-incrementing)
imw - memory write (fill)
inm - memory modify (constant address)
iprobe - probe to discover valid I2C chip addresses
itest - return true/false on integer compare
jffs - translates a logical offset to a physical offset
junctemp - display CPU's die temp
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
map - translates a logical block number to a physical
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing)
motion - Accelerometer monitoring
mtest - simple RAM test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
ptable - partition table commands
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
sonosboot - Boot the freshest section (or optionally the least fresh)
temp - display current temperature
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
upgrade - Upgrade a partition from a raw file
vcxo - Sweep VCXO and monitor modulator PLL lock
version - print monitor version


EDIT

ok. after spending a lot of time today, i think the NAND is fried since it will always gets stuck when doing some NAND work.

ive searched and that NAND is comercially saleable. is it worth it to try and replace it? if so, how do i program it?

code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)

Reset Status: Check Stop, External/Internal Soft, External/Internal Hard

CPU: e300c3, MPC8314, Rev: 12 at 250 MHz, CSB: 125 MHz
Board: Sonos Fenway
I2C: ready
DRAM: (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
DRAM 32-bit Data Pattern Test AA ------------- PASSED
DRAM 32-bit Data Pattern Test 55 ------------- PASSED
DRAM Address Line Test ----------------------- PASSED
DRAM tests complete.
===================================================
PCIE0: Link
NAND:
Userlevel 2
i made it again to some kind of menu. tried to load sonos fw from flash and this is what i got:

code:
=> sonosboot
nand_read_sonos: flash read error -74, retlen 16384
Error reading partition table from flash, using default
both sections readable, bootgen-0 3, bootgen-1 2
section 0 selected
verifying section 0...check: page2048 (logicalBlock 11, physicalBlock 40 )is not readable

verification error with section 0, trying other section...check: page28672 (logicalBlock C41, physicalBlock 380 )is not readable

both sections are bad, abort
problem reading sections...attempting to boot section 0 anyway
booting section 0
nand_read_sonos: flash read error -74, retlen 16384
Error reading kernel from flash, abort
=>
=>
Userlevel 2
i made it again to some kind of menu. tried to load sonos fw from flash and this is what i got:

code:
=> sonosboot
nand_read_sonos: flash read error -74, retlen 16384
Error reading partition table from flash, using default
both sections readable, bootgen-0 3, bootgen-1 2
section 0 selected
verifying section 0...check: page2048 (logicalBlock 11, physicalBlock 40 )is not readable

verification error with section 0, trying other section...check: page28672 (logicalBlock C41, physicalBlock 380 )is not readable

both sections are bad, abort
problem reading sections...attempting to boot section 0 anyway
booting section 0
nand_read_sonos: flash read error -74, retlen 16384
Error reading kernel from flash, abort
=>
=>

Replacing the NAND chip may be the easy part provided that you know how to work in removing and replacing chip on circuit board.

But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.

Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
Userlevel 2
thanks.
indeed, soldering the new nand would be the easiest part.
eventhough i would feel comfortable working with JTAG, getting the kernel stored in the new chip will be tricky since noone has it.



Replacing the NAND chip may be the easy part provided that you know how to work in removing and replacing chip on circuit board.

But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.

Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
Userlevel 2
Haven't received the chip from China yet. Replacement, well, there's certainly a technique to replacing a 54 pin SMT chip.

upon further inspection, the chip, IS42S16800B-7T is a 16MB capacity only...and UART console show a 32M SDRAM config which mean there must be 2 chips. And this confirm by inspecting the board, there are 2 chips mount top/bottom joining together onto the board. So that mean we have to remove/replace both chips on top and bottom board!!!
Userlevel 2
Well, I have a couple of these ZP100s that do exactly as this thread describes... At first I was oh well, but after searching I found this forum. I now have a bus pirate on the way and I have a great hope that I'll get the ZPs working... Thanks to all that have made this information available... Hopefully, with a this great information The ZPs will be up running in short time once the bus pirate is received...

Wish me luck...

😉
Userlevel 2
Ok. So the one that I repaired is still going strong without issue. A buddy of mine bought two of them and one had a diag firmware.....got the newest firmware on that one easy. The second already was on the network. The one with Diag firmware will pair with the system but upon playing music will go orange light then white then orange. If you continue to hit the mute music will play for a second. The light means fault......is there a way to find the fault or clear it? The second unit will not pair at all. Any ideas?
Userlevel 2
Nobody has any idea's? I am going to take the one with faults completely down and reassemble this weekend. We will see if that makes any difference.
Userlevel 1
Badge
@soyuppy: If you've successfully upgraded to a non diagnostic firmware the post-boot console goes away. I'd check to see if you can add the unit to your network now as normal. As for pressing 'h' to get the help info, you need to do that immediately as the machine boots, otherwise it continues on to autoboot.

@mrmom: Do you get any errors during the attempted update, or does it just silently fail?

@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.


@ poshul: I am getting silent fails on all the devices I have left to convert.
Userlevel 2
Badge
@johnBCW: You are correct that those light patterns signal a fault. Unfortunately tracking down the fault is really tricky. Do you get the fault when playing music with no speakers attached? How about when attached to powered speakers?

@mrmom: I don't really have a good suggestion for you on that one. Make sure that the update command is correct, and that the image you are flashing is valid. Sorry.
Userlevel 2
So I finally received my RAM chip from China. Brought it in to the office where I have access to decently high-end solder rework gear.

As far as technique for replacing the RAM chip, I did the following:

Start with a new X-Acto blade, and carefully cut the 54 legs off of the RAM chip on the board. I tried to cut mostly in a plane parallel to the PCB, to avoid damaging the board, the pads, or the other nearby components. Once all 54 pins have been carefully cut, the body of the RAM chip (the ISSI IS42S16800A-7TL chip, in my case) will simply lift off the board, leaving behind its legs soldered to the pads.

Then, using a desoldering wick, carefully remove the pins and solder from the pads, taking great caution to not apply too much heat or force and delaminate the pads from the PCB.

Then, apply some flux to the pads, and carefully solder in the new chip.

I have never soldered SMT components this large before, but I do have a reasonable amount of experience with a soldering iron.

The unit I repaired was exhibiting prior to the repair with a symptom of fail to boot, flashing white light forever. Not responsive to factory resetting. The UART port was showing that it was failing the SDRAM check at the same address every time. Prior to the repair, I was able to get the unit to boot by manually issuing the command from the bootloader to ignore the SDRAM failure and boot anyway. The unit was otherwise operational.

I have not yet returned home to where I can test for full operation, but powering the unit up at the office seems to show it successfully autobooting and searching for my household to connect itself to.
Userlevel 2
Thanks for the tip on using X-acto blade.
so you replace both SDRAM chips that is mounted on both side of the boards?
Which chip did you get from e-bay? I see a lot but can't find one with exact match on the spec.
Userlevel 2
Huh. I hadn't noticed there was a second ISSI SDRAM chip on the bottom of the board. How about that.

I only changed the one on the top (ie. immediately adjacent to the large square microcontroller about 1.25" square).

This unit seems to be behaving now, so perhaps I got lucky. It was reporting its failures only at a single address, regardless of being warm or cold, so I suspect the RAM chip had gone bad at one particular address (on one of the two chips) and it seems I guessed correctly.

My other unit boots fine from a cold start, but when its warm it starts having RAM errors at a large number of seemingly random addresses. I should try reflowing the solder on all the pins of the two SDRAM chips and maybe that problem goes away.

This is the ebay part I purchased: http://www.ebay.ca/itm/271853110458?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT

It seems that there are a number of compatible chips (I have two ZP100s and they had different chips in them from the factory, one had ISSI IS42S16800A-7TL, and the other had ISSI IS42S16800B-7TL).

Looking around online, it seems both of these have been obsoleted for some time. ISSI still sells a IS42S16800F-7TL which appears to have the same or very similar specs and is easily obtained from your favourite electronics suppliers. Mouser and Digikey both show stock for around $5/chip. I suspect it is a pin compatible upgrade, but YMMV.
Userlevel 2
It does the same thing even without speakers plugged into the device.
Userlevel 2
First - thanks to everyone for leading the way and helping others figure out how to revive these zp100's.

I have a few of these with the diag firmware and will be receiving a bus pirate tomorrow. My confidence level coming into this is mildly enthusiastic 😮 but I want to clear some things up if possible.

Firmware files - do I need to download a new fw for each individual box, or can I just rename the file to the appropriate s/n per box?

UART - any specific tips or things to watch out for when using the bus pirate? I haven't used anything like this for at least 10yrs, and even then it was a prebuilt JTAG device which was idiot proof. Don't be shy - the clearer and easier to follow the better :D

Box cleaning - I've seen some have had good luck cleaning up the boards and internals, and reconnecting the cables. Are you taking everything possible apart? Concentrating on the main board/network area? Specific things I should be looking for? Any thoughts on pulling the main board and attempting to reflow the solder with a heatgun or oven (some hardware faulty devices do well with this like video game consoles)?

Once again great thread and thanks to those pioneering the way! I'll be sure to update how things go, and try to snap a pic or screenshot along the way to help those in the future.
Userlevel 2
Looks like I have an empty NAND flash... anybody know the password for programming?
Userlevel 2
Guys thanks for all your help! Through the aide of this thread I was able to get 7.5 out of 10 of the Sonos zp100 I purchased on eBay working. I say 7.5 because I was able to get the logic board fixed on one that still have a problem with the amp 😉.

I used a Raspberry Pi to host the web server and perform all the UART commands. If someone would put together an image it could save people hours of messing with that part of the repair.

Thanks again!
Userlevel 2
Hi all.

I've been following this thread for awhile in hopes of getting this one ZP90 I have back to life. To make the long story short, I've managed to get the UART interface connected and visibly witnessed the Sonos going through the whole bootloader process until it hands off to the OS. I also took some ideas from this thread and through a direct Ethernet connection to my PC using the 169.254.xxx.xxx IP address, was able to connect to the diagnostic pages of the Sonos. For fun, at that point I enabled Wifi on my PC and to my amazement the ZP90 grabbed an IP address in my local network range and I could add the ZP90 to my existing Sonos system and update the firmware.

That's where the good news ends. For whatever reason, port one on the back of this Sonos is the only one I can connect to and it's acting very odd at best. With nothing connected it acts as if there is something there and happily blinks away. Port two seems to emulate port one (although there's no connection lights until something is actually connected to it), which doesn't surprise me, although I can't access any of the HTTP diagnostic pages through this port. If I connect the Sonos directly to my network, everything freaks out and looking at Wireshark, there seems to be a ton of traffic and a whole lot of STP errors. At the same time, my Sonos system basically crumbles and my WiFi goes to hell. Sounds to me like I have a unique firmware looking for something that doesn't exist, because as soon as I connect it back up to my PC directly using the 169.254.xxx.xxx IP and use the WiFi, the unit is completely happy. Unfortunately none of the diagnostic screens offer any indication of an out of the ordinary configuration on the eth0 ports, so I'm at a loss.

Anybody have any ideas?

Thanks
Userlevel 2
Badge
@diw4321 It sounds like there is something wrong with the ethernet controller. If I had to take a guess I'd suspect that the two ethernet ports have become bridged internally somehow, causing a STP cascade when it connects to the Sonosnet, and tries to determine the correct topology.

My wild guess would be that the unit got hit by a surge through one of the ethernet ports. If you've already got the thing open, I'd check to see if there is any visible evidence of electrical damage (charred component, melty smell, etc). If correct, you might be able to restore functionality to one of the ports by figuring out where they are shorted, and repairing the connection.

@ecsherwo: The "program" option in the bootloader is misleading at best, what it does is wipe the flash and then try to load an image from RAM, as far as I know, no-one outside of Sonos knows how to load an image to RAM, so the most you are gonna do is wipe the chip again. If you are really adventurous and know some JTAG you can hook up a highspeed JTAG board to the unit and dump/load an image dumped off a working unit.
Userlevel 2
@poshul thanks for the advice. If there's something wrong with the controller it's not obvious, there's nothing to indicate a surge (smell or visual) and nothing looks modified. It really seems like a software thing to me, like someone has programmed it to act this way.
Userlevel 2
Badge
Weird. You mention that you updated the firmware, what is the current version as displayed in ZP-IP-ADDR:1400/status/jffs/upgrade.log and what was the previous version from :1400/status/jffs/upgrade_prev.log ? Also is there anything at :1400/SLASH/ ? Also also, can you post the contents of :1400/status/enetports ?

With the way that firmware updates work I'd be suprised if this sort of diagnostic software setting survived. Can you try factory resetting the unit to see if the behaviour persists?
Userlevel 2
Thanks again for looking into this. Here's the three files. I couldn't even find :1400/SLASH/ ?

contents of /jffs/upgrade.log
Upgrade url is-c --sonosid xxx --householdid HHID_xxx http://update-firmware.sonos.com/firmware/Gold/28.1-86173-v5.3.2-tshhkh-SP2/^28.1-86173
URL is http://update-firmware.sonos.com/firmware/Gold/28.1-86173-v5.3.2-tshhkh-SP2/28.1-86173-1-1.upd?cmaj=14&cmin=5&cbld=40190&subm=16&rev=4®=2&serial=xxx&sonosid=xxx&householdid=HHID_xxx
client-server mode: listening on port 4444
waiting for connection from HH...
accepted connection from 10.5.2.127
readCommand() - read HELLO?version=28.1-86140
readCommand() - read DOWNLOAD
starting op DOWNLOAD
upgrade version 28.1-86173
compatible with Sonos Zone Player submodels 0-16 revisions 0-4294967294 (any region)
compatible with hardware feature set 1d
My hardware feature set is c
Upgrade supports all my features
Upgrade file is good
readCommand() - read FLASHWRITE
starting op FLASHWRITE
Using new partition format mode
Destination section 1 generation 6
Operating in redundant partition mode (not changing partition table)
Executing upgrade script...Checking to see if (hh.)anacapad is running...Stopping ancillary processes...
Killing udhcpc
Killing smbscand
Killing inetd
kill: 100: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]
Killing netstartd
ok
Merged partition table flags 00000001:
0 1:0:16
1 16:16:48
2 17:64:256
3 64:320:1389
4 16:1709:48
5 17:1757:256
6 0:0:0
Writing kernel to partition 4
Writing / to partition 5
sections M16 len check 0
Executing upgrade script to do any final work...Doing post-install steps...

contents of /jffs/upgrade_prev.log
Upgrade url is-c --sonosid xxx --householdid HHID_xxx http://update.sonos.com/firmware/Gold/v3.4-Crosby/^14.5-40190
URL is http://update.sonos.com/firmware/Gold/v3.4-Crosby/14.5-40190-1-1.upd?cmaj=14&cmin=4&cbld=33290&subm=16&rev=4®=2&serial=xxx&sonosid=xxx&householdid=HHID_xxx
client-server mode: listening on port 4444
waiting for connection from HH...
accepted connection from 192.168.1.91
readCommand() - read HELLO?version=14.5-40190
readCommand() - read DOWNLOAD
starting op DOWNLOAD
upgrade version 14.5-40190
compatible with Sonos Zone Player submodels 0-4294967294 revisions 0-4294967294 (any region)
compatible with hardware feature set 1d
My hardware feature set is c
Upgrade supports all my features
Upgrade file is good
readCommand() - read FLASHWRITE
starting op FLASHWRITE
Using new partition format mode
Destination section 0 generation 5
Operating in redundant partition mode (not changing partition table)
Executing upgrade script...Checking to see if (hh.)anacapad is running...Stopping ancillary processes...
kill: 96: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]
kill: 96: Usage: kill [-s sigspec | -signum | -sigspec] [pid | job]... or
kill -l [exitstatus]
ok
Merged partition table flags 00000001:
0 1:0:16
1 16:16:48
2 17:64:256
3 64:320:1389
4 16:1709:48
5 17:1757:256
6 0:0:0
Writing kernel to partition 1
Writing / to partition 2
sections M16 len check 0
Executing upgrade script to do any final work...Doing post-install steps...

Port Link Speed
0 1 100FD
1 0 0

I tried a factory reset and it changed nothing. One other interesting point to note:
Once I get the Sonos added to the system, if I unplug the Ethernet cable from the Sonos, the lights turn off, but about 1 second later they turn back on without any cable connected. At this point if I reconnect my Ethernet cable to the Sonos, I can't get to it at all without a full restart.

Thanks for your help
Userlevel 2
So has anyone had any luck reviving a no audio out zp100? I've had a couple of these I've tried with no luck. They both originally had the amps blown (literally burnt the VCC legs off the IC's). I've replaced the amps and the audio controller IC but no luck. They appear to play but get no sound. Tried to use the line in also but that didn't work either. If no one has any other ideas it appears the TI DSP IC is my next try.

Reply