2004 to 2020 Mazda 3 Forum and Mazdaspeed 3 Forums banner

61 - 80 of 94 Posts

·
Registered
Joined
·
4 Posts
Programmer Testing Clip SOP 16 ebay
ebay.com/p/Programmer-Testing-Clip-SOP-16-SOP-SOIC-16-Dip16-Pin-IC-Test-Clamp-With-Cable/2131170762

USB BIOS EEPROM SPI FLASH Programmer CH341A 24 25 series
ebay.com/itm/USB-BIOS-EEPROM-SPI-FLASH-Programmer-CH341A-24-25-series-/301443899698

program and driver: karadev.net/basto/CH341A-programmer-software-1.29/CH341A-1.29-programmer-software.zip

conntecting :
official partition name offset prior to v31 offset after v31
bootstrap 0x000000 0x000000
boot-select 0x010000 0x010000
ibc1 0x020000 0x020000
ibc2 0x040000 0x040000
nv-config 0x060000 0x060000
config 0x070000 0x070000
jci-boot-diag n/a 0x0D0000
fail-safe 0x0E0000 0x0E0000
update 0x7E0000 0x7E0000
check this for more informations : 2x4logic.com/jci-failsafe.html
how to check this and witer this,what softwer using??
 

·
Registered
Joined
·
4 Posts
official partition name offset prior to v31 offset after v31
bootstrap 0x000000 0x000000
boot-select 0x010000 0x010000
ibc1 0x020000 0x020000
ibc2 0x040000 0x040000
nv-config 0x060000 0x060000
config 0x070000 0x070000
jci-boot-diag n/a 0x0D0000
fail-safe 0x0E0000 0x0E0000
update 0x7E0000 0x7E0000
check this for more informations : 2x4logic.com/jci-failsafe.html
what softwer to usr for change it?
 

·
Registered
Joined
·
5 Posts
Hello,

I do step by step procedure using Rasberry Pi and unfortune my Mazda Connect is still died.
In my opinion everything looks good executing every command. Only message after one command do not looks clear for me and I don't know if it should be like that (attached) ...
Does anyone is able to try help me with my issue?
Hello. I have the same problem, did you manage to fix yours? Or does anyone knows how to fix it?
 

·
Registered
Joined
·
1 Posts
CMU bricked repair

Hi,

Actually, your CMU is bricked. I did the exact same thing as you where my car was turned off just after installing the failsafe package. Luckily there is a way to recover, which is not so easy to do, bit it's quiet doable if you are not afraid to unmount the CMU, open it and plug some wires.

Full explanation:
Thanks to this website: http://www.2x4logic.com it saves me a lot of time to dig on how the system works. The CMU update process is indeed very badly designed, as it has plenty of failure points where it ends with a bricked device that will not boot anymore. The easiest way to do that is by shutting the CMU off after the failsafe package installation. Basically what happens is that a small flash chip that contains the boot program has a flag on it that decides on which system it has to boot. It can either be the normal Mazda system, or the «failsafe» software. When you install the failsafe update package without the 2nd reinstall package, the flash chip boot select mode is set to boot on the ibc1 partition, which does not match the current Mazda system. This ibc1 partition is updated by the reinstall package. So it’s bricked because it cannot boot anymore.
The easiest fix here is to change the boot select value on the flash chip to boot on ibc2 (the failsafe). This is normally done by the update process, after the reinstallation package is checked for integrity. Here we are going to do it by forcing the boot. It will start the «failsafe» installation software, that will tell us that installation fails and that we can retry by putting a USB key into the car with a correct reinstallation package. Then the installation will continue and finish.

Tutorial:
Here is a step by step tutorial on how to achieve this. Be aware that It can be hard to do this if you do not understand what you are doing. But in case your CMU is bricked (black screen after a failed upgrade or so) you have nothing to loose, right? Bringing the car to a dealer will not help, they will just charge you for a full CMU replacement, and that costs a lot…

The flash chip is placed on the back of the CMU’s PCB. It’s a NOR SPI Flash. The idea is to directly connect to this chip and use a raspberry pi (that has an SPI bus) to reprogram the memory.

Required hardware:
  • A raspberry pi
  • A Programmer Test Clip SOIC16 or 6x IC Test clips (I used test clips)
  • A breadboard to do the connections
On the raspberry pi, you need to install Raspbian (Lite version is ok). From a fresh install of Rasbian, setup the pi to have SPI enabled by running:
Code:
sudo raspi-config
(enable SPI in Interfacing Options*)
sudo reboot
Install some required tools:
Code:
sudo apt-get update
sudo apt-get install build-essential libusb-1.0-0-dev libusb-dev git wget curl libpci-dev
Get a newer version of flashrom:
Code:
git clone https://github.com/flashrom/flashrom
cd flashrom
make
sync
Shut the power off of the raspberry.

Now the raspberry pi is ready. Unmount the CMU from your car (look on youtube for video on how to do it, it’s easy), unscrew the PCB from the CMU and plug the wires from the raspberry to the flash chip like here (see attached pic) and http://www.2x4logic.com/mcbot-annotated.jpg

Turn the raspberry pi on. And check if the flash is detected:
Code:
cd flashrom
./flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=8000
This will tell if a chip is detected or not. If not your wiring is not ok. When something is detected, flashrom may tell you that multiple different chips are detected. That’s because some chips from a same manufacturer can have the same protocol. You need to read the right device model from what is written on the chip. I had a MX25L6445E. I know that some other CMU may have a different chip model. It should also work if flashrom can detect it.

Then try to read the memory and do a backup:
Code:
./flashrom -r backup-cmu.bin -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" -V -p linux_spi:dev=/dev/spidev0.0,spispeed=8000
Carefully read what flashrom is doing to check of any failure. I had to use the option -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" to select the right chip model in flashrom as it was written when using the -p option (list all detected devices)

Once you have the backup, we modify the boot-select byte inside the file
Code:
cp backup-cmu.bin cmu-mod.bin
printf '\x00' | dd of=cmu-mod.bin bs=1 seek=65536 count=1 conv=notrunc
Now it’s time to write the modified file to the flash:
Code:
./flashrom -w cmu-mod.bin -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" -V -p linux_spi:dev=/dev/spidev0.0,spispeed=8000
Read back the flash to verify it worked
Code:
./flashrom -r cmu.bin -c "MX25L6436E/MX25L6445E/MX25L6465E/MX25L6473E/MX25L6473F" -V -p linux_spi:dev=/dev/spidev0.0,spispeed=8000
Check if the file matches by verifying the checksum
Code:
sha1sum cmu.bin cmu-mod.bin
The checksum should match, if they do, the procedure is done. It’s time to unplug everything and put the CMU back in the car. The CMU should boot into the failsafe recovery system and ask you for a USB key with the reinstall package.

Good luck, and happy hacking! ;)
Raoulh..
Also did the failsafe and decided to leave the car turn it off and come back again = bricked!
So followed your instructions, bought the kit, fiddled about with the commands, and managed to tell FLASH to load again, thank you so much. I echo what lots of peoples have said on here, you saved me big time with those instructions. Managed to also upgrade to 70.00.100A too :).
Your Awesome!
Rodger
 

·
Registered
Joined
·
18 Posts
I can't remember what version was inside of my CMU before screen died. Right now I've managed to reflash it but I need to put usb with a proper version. How can I check which version is inside? Can I check it through raspbian or serial connection? If it's possible which command should I use?
 

·
Registered
Joined
·
1,649 Posts
I found 3 different options:
  1. SSH connection via usb-ethernet-adapter: Use e.g. WinSCP to browse to /jci/version.ini and copy&open it - in there are the firmware version info located. More details see this post: Stuck in an installation loop from V.59 to V.70
  2. Serial connection: Show firmware version in Putty - see details in this post: Stuck in an installation loop from V.59 to V.70
  3. Serial connection: Copy /jci/version.ini (with firmware version in it) to a FAT32 formatted usb stick to later read the file content - see details in this post: Stuck in an installation loop from V.59 to V.70
I would recommend option 3.
 

·
Registered
Joined
·
1,649 Posts
Perhaps someone (e.g. @raoulh ) can help me?
I have a dead spare CMU. I got it as defective. I do not know why its not working. It does not start at all. When powered, the display stays black. And also via serial connection there is no sign of life. I hope/thought, that I could revive it with flashing the SPI NOR chip. I got all the parts Viên Tịnh mentioned and hooked the chip up correctly (checked 3 times), as I can successfully read the chip & make a backup *.bin file. But when I try to write the value 00 as recommended by raoulh, then an error shows up: "Write operations timeout failed" (see screenshot). I use the WRITE button in the top row. Please let me know what I can try to successfully write. Thanks.

Error:
05_write_error_timeout failed.PNG
 

·
Registered
Joined
·
117 Posts
Perhaps someone (e.g. @raoulh ) can help me?
I have a dead spare CMU. I got it as defective. I do not know why its not working. It does not start at all. When powered, the display stays black. And also via serial connection there is no sign of life. I hope/thought, that I could revive it with flashing the SPI NOR chip. I got all the parts Viên Tịnh mentioned and hooked the chip up correctly (checked 3 times), as I can successfully read the chip & make a backup *.bin file. But when I try to write the value 00 as recommended by raoulh, then an error shows up: "Write operations timeout failed" (see screenshot). I use the WRITE button in the top row. Please let me know what I can try to successfully write. Thanks.

Error:
View attachment 279882
Need to erase before write, so first do ERASE then WRITE and last VERIFY.
 

·
Registered
Joined
·
1,649 Posts
Thanks. Good to know, as its the 1st time I use this tool. But even if I erase successfully (and did the blank check successfully), I can neither write directly nor can I open&write the "bin-file" with the previously patched value "00". I always get the same write error shown in the screenshot of my previous post. Any other idea?

I tried:
a) read -> erase -> blank -> write (always with value 00 at line 10000) = unsuccessful
b) read -> erase -> write = unsuccessful
c) read -> erase -> open (bin file with value 00) -> write = unsuccessful
d) read -> erase -> blank -> read (all values are still FF) -> write = unsuccessful
e) verify (status: chip main memory are blank) -> open (bin file with value 00) -> write = unsuccessful
f) open (bin file with original value FF) -> write = 100% and then no error message, so I guess it was successful, even if thats not what I want to achieve - so basically the write function might work.

The connection schema/pattern shown in post#16 is the view from the top to the CH341 programmer, right? So the connections should look like this (I added red/blue lines just as example).
vien tinh _ PhPIbi5_connection ways.png

My chip is the same as shown in this thread:
01_version of chip.PNG
...and I installed the 64bit drivers, as at my Win10 64bit the linked 32bit drivers could not be installed. Source: karadev.net/basto/CH341A-programmer-software-1.29/ -> ZIP File PAR 2.2
 

·
Registered
Joined
·
1,649 Posts
After 2 more reconnects and the re-installation of drivers and using CH341A Programmer Version 1.34 (before 1.29) I could finally write value 00 to line 10000. But still the display stays black after connecting the cmu (and its not booting). Any idea how to proceed? Any other values I can change? Anything else I can do? Is there another process?
 

·
Registered
Joined
·
117 Posts
I've done it for a friend, same programmer and this Test Clip and it worked fine, I also used a boot file from this user here and it booted, I think is ver 51.00.300 NA. Hopefully you saved the file you'd read, could you posted here? Maybe CMU has more issues than a booting problem.
 

·
Registered
Joined
·
1,649 Posts
Thanks again. I erased the chip, opened your/macomeza`s linked file above, wrote & verified it to the chip, but the cmu is still dead. No sign of life, when connected. Display is still black and serial access does not show any text flying by - just a non moving green square. Please find attached my original *.bin-file, which I read/saved/backupped before doing changes: Downloadlink
Correct, as I do not know the origin of the brick/how it got bricked, it also could be e.g. a hardware issue or something else. I already checked the wiring, but my usually installed cx-5 CMU has the same wiring as this bricked mx-5/miata CMU.

I use nearly the same test clip as you:
20201230_003132.jpg

PS: And I emailed with Vien Tinh, but he knew exactly how he bricked his cmu back then and he manually fixed it by copying the hex values of the failsafe firmware files to the correct offset section at the cmu chip and this worked for him. I also tried this, but unfortunately without success.
 

·
Registered
Joined
·
117 Posts
Sorry Tristan but that file you posted is empty, all FF's, maybe that's your problem, read back the rescue.bin you just programmed and compare to the original file. Rescue.bin Hash MD5 is: 688b34e65e2d24fae62887dadf0b5a90.
 

·
Registered
Joined
·
117 Posts
16 pin Clip I bought came with a small adapter PCB with correct wiring like this post: TEST CLIP. Also get yourself a Hex editor its very useful to compare files search, calculate checksums etc.
 

·
Registered
Joined
·
1,649 Posts
Damn, this was the only backup I had. I did not check, if its empty or values written to it. Obviously the CH341 Programmer Tool showed me that reading was possible and it stored a file (but empty). That`s why I assumed my connection was ok. But it seems that the clip was not attached correctly to the chip. So I have no original backup anymore :-(

I now have HxD as HEX Editor.

I correctly flashed the rescue.bin (without any changes) and the cmu is still dead and no signs of life via putty/serial access visible - same after I changed the value FF to 00 in line 010000 -> cmu is still dead. I guess the issue is not the SPI NOR chip, but another hardware failure?

Thanks a lot craz for all the help & info!
 

·
Registered
Joined
·
1,649 Posts
I have a second CMU here with 70.00.352 EU on it (working). I made a backup of its SPI NOR chip and copied it to the dead CMU. The CMU still keeps playing dead (no display/no serial activity). Same result when I patched the value 00 to line 10000 to this backup. Please find these two files attached:
So I guess this CMU is really dead and can not be revived via SPI NOR flashing.
 

·
Registered
Joined
·
117 Posts
Bummer!! I was afraid it was more than a bricked boot loader, now you have a good backup for your bench CMU just in case...
 
61 - 80 of 94 Posts
Top