Electronics > Beginners

"Jumping" NOR Flash via another identical board

(1/3) > >>

mogue:
I'm working with the main PCB ("DM board") of a Yamaha Motif XS8. Due to my own error, the NOR Flash has been overwritten with incorrect data. This has rendered the onboard update functionality inaccessible; I'm unable to boot into the update mode in order to write the correct data. I've reached out to several authorized Yamaha repair centers as well as Yamaha themselves, and the situation is that Yamaha offers no solution to this issue: their recommendation is to replace the entire DM board (nominally $1,030 but actually unavailable).

Unwilling to give up without exhausting every conceivable solution, I am looking into any available method for rewriting the NOR Flash directly (for example via SPI). I have access to Yamaha's service manual which includes detailed circuit diagrams and part information. The specific NOR Flash chip is the Spansion S29GL512N10TFI020, part of their "S29GL-P MirrorBit Flash Family", and I have found its datasheet. My general plan is to get a hold of another Yamaha Motif XS, dump its flash, then write the contents directly to the "broken" flash. Afterward I would sell the second Motif to recoup some of the expense.

I am wondering, however, whether it might be feasible to "jump" a connection between the problem flash and a working board, in order to use the working board's update mode and a standard Yamaha update file in order to write to the problem flash on the other board. Given the working board would first have to boot into update mode via its own NOR Flash, I am uncertain whether the connection could be "switched" after boot and prior to executing the update. If possible, this would skip the step of dumping the the data from the working flash or working directly with SPI at all.

Any thoughts on whether I'm totally barking up the wrong tree would be greatly appreciated.

MosherIV:
Hi
Welcome to the forum.
You may be better off (safer) using something like a bus pirate to read the data out of a working Motif XS8, save that as a raw binary data file on the host pc driving the bus pirate.
Then use the bus pirate again to write back to the erased flash.

Edit:
Scratch that idea. The bus pirate can only do serial buses like spi and i2c. You mentioned spi but looking at the close up of the flash part on the schematic, it is a 16bit device with a full address bus and 16 bit data bus. You would need something that can read the fash device in circuit, you may have to force the host processor to stop accessing the flash by holding it in reset.

thm_w:
Could be possible, but you'd need to clip on to both flash chips, and maybe desolder/disconnect pins temporarily.

It looks like you can get a clip to make life easier, then add a flash reader and it should be possible to read out the data without desoldering the chip.

https://www.aliexpress.com/item/32556890251.html
http://www.360-clip.com/ (just for example photos)

amyk:
Alternatively, download the official firmware which appears to be at https://usa.yamaha.com/support/updates/21001_en.html , and figure out how to get a NOR flash image from it. No need to buy, possibly damage, and then try to sell another unit, although you will need a programmer.

Here's a recent example of someone trying to do this with a different piece of equipment: https://www.eevblog.com/forum/repair/worn-out-flash-memory-chip/

mogue:

--- Quote from: amyk on November 02, 2019, 02:34:50 am ---Alternatively, download the official firmware which appears to be at https://usa.yamaha.com/support/updates/21001_en.html , and figure out how to get a NOR flash image from it. No need to buy, possibly damage, and then try to sell another unit, although you will need a programmer.

Here's a recent example of someone trying to do this with a different piece of equipment: https://www.eevblog.com/forum/repair/worn-out-flash-memory-chip/

--- End quote ---
This is actually where I started and what led to my error in rendering the NOR flash unbootable; I've been trying to lay the groundwork for modifying the OS (MontaVista Linux). Unfortunately the update files are inscrutable. Binwalk gives nothing but false positives. The only structure I've been able to discern is that the same format is used for the Motif XF and the S90XS: comparing hex dumps of the update files for those two keyboards as well as two different versions of the Motif XS update reveals several consistently identical blocks of data across the four files. Working from this information, signs point strongly toward the files being encrypted (chi square distribution ranges from 225.8 to 263.91, and pi approximation error ranges from 0.00 to 0.01%). My next steps would be an attempt to pull the decryption key from the Motif XS, but that's stalled now that the thing is presently bricked.

MosherIV and thm_w, thanks also for your input. That 360-clip looks very promising.

Navigation

[0] Message Index

[#] Next page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod