Hi everyone and happy new year!

A couple of days ago (the new year's eve ) I had the frustrating experience of bricking my MZD Connect CMU , getting a permanent black screen, while trying to update the firmware from v56.00.513 to v70.00.100, due to a failure during the failsafe step, because I left the Mazda AIO Tweaks installed before proceeding with the update.

I eventually managed to resurrect my CMU, to upgrade to the latest firmware and even (as a bonus) to install the retrofit kit for Apple CarPlay/Android Auto with complete success , but it didn't come without some difficulties, especially to collect every piece of information needed to arrive to the final solution.

As many say on the web and throughout the forum unbricking a dead Mazda CMU it's a completely simple and doable DIY process, that can save you a bunch (1000~€), but at the same time it cannot be completely easy and straightforward when you know nothing of electronics, especially when it comes to buy some crappy cheap programming devices from the web where no accurate specification is given, and seldomly you manage to perfectly replicate the setup of a forum or a blog post.

For those of you that want to know every single detailed step-by-step information on how to resurrect a dead CMU, upgrade the firmware and how to install a retrofit kit, I will explain everything about my adventures here below.


1) Resurrecting a dead Mzd Connect CMU in case of failed failsafe installation:

CONTEXT:
The Mazda connect operating system is distributed on 2 chips:

1. The failsafe is stored on a SPI NOR Flash memory of 8MB/64Mbit size, a Macronix MX25L6445E SOIC16 (16 total exposed pins) on the European version, but I heard of a Spansion chip on the US versions as well;
   
   
   
   
   The failsafe name is really misleading, because the software loaded in this chip is actually the bios or if you prefer the bootloader of the CMU operating system, and this piece of software is crucial for the correct functionality of the headunit itself. Without it or with a corruption of its data, there is no way your CMU will boot anymore, and the screen will be black and dead.
   
   This chip is located on the back of the CMU motherboard.
   
   
   
   
   
   
2. The operating system (a sort of linux displaying html pages as GUI) is stored on a NAND flash located on the front of the CMU motherboard:
   
   

When we update the firmware of our CMUs the main problems occur when we upgrade the failsafe image: this process involves, as you may understand, the reflash of the crucial SPI NOR flash memory... thus risking in case of failed installation, car shut down, corruption, or partial load to brick the CMU itself.... not so fail safe after all.

In fact the fail safe upgrade has been completely removed starting from firmware version v70.00.300+, I bet because they understood it was an uber risky process and finally decided to keep the "bios"/bootloader stable and untouched .... (they should have designed the system like this from the beginning, in a real fail safe way ...)

Credits for the mazda system teardown images: Mazda Connect infotainment teardown




HOW TO FIX (without soldering for absolute beginners):

Now in the unfortunate case you bricked your CMU, what can you do?? Can you really resurrect your CMU even though you're not an expert or an electronic engineer?
Yes absolutely, but of course you should be careful and buy the right material. With an expense of maximum 50€ you will save yourself a 1000€ expense at the dealership.

Material:

1. Trim removal kit: 10-20€ amazon link
   This is needed to remove the car internal trims without breaking them, to get access and be able to remove the CMU from the car;
   
   
   
2. 10 mm socket wrench
   
   
   
3. a set of torx and cross screwdrivers
   
   
   
4. 1x CH341A Programmer : 10-20€ / eu amazon link: ZHITING SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter Programmer BIOS + CH341A 24 25 Series EEPROM Flash BIOS USB Programmer Module (Doppia Clip + USB) : Amazon.it: Elettronica
   A simple and super cheap SPI NOR flash/EEPROM programmer. This is the most important part: you absolutely need this to reprogram your CMU's MX25L6445E chip (SPI NOR flash).
   
   
   
   
   
   NOTE: on Amazon there is a thousand of generic programmers available mainly coming from China.
   You should keep one main concept in mind: the MX25L6445E is a 3.3v chip (datasheet, check page 8) and for this reason you ABSOLUTELY need a programmer that powers the chip's VCC with exactly 3.3v (most of the programmers would do that) otherwise you will fry your SPI chip.
   Secondly (this is extremely important as well!!) the programmer that you buy should also program the chip with 3.3v tension; in other terms the logical channels (MISO, MOSI, etc.) should also be feeded with exactly 3.3v and NOT 5v otherwise the overvolted data channels will totally alter the data flow and you won't be able to read/write/verify valid data on the chip.
   Moreover you risk to fry your chip also in this case (even though the risk is much lower since you're not directly over tensioning the chip power source).
   
   
   
   
   Now this is very important to know.. most of the ch341a programmers that you will find online have an issue: they can feed the target chip in the socket with a selectable tension (using a jumper) of either 3.3v either 5v, but they will always provide a 5v tension to the logical channels... and this may be a big problem causing you big headaches as I explained you just above.
   A successful programming may be impossible, or extremely hard, and moreover you risk your chip health.
   
   At this point it's key testing with a voltage tester if your programmer feeds the chip and the data channels with a 5v or 3.3v tension.
   Refer to these videos (ignore the soldering solution, just check which contacts voltage you should measure):
   video 1 video2
   
   In case the channels are feeded with 5v, the solution resides in performing a simple volt mod on the programmer, to force the ch341a IC in a 100% 3.3v mode:
   
   - Just cut with a cutter the PCB trace as visible in this picture (this will cut out the 5v incoming tension from the USB port, making the tension 0v on the socket itself):
   
   
   
   
   - Place a jumper between the 3.3v and the 5v pins located on the usb programmer as in the following pic (this will bring the 3.3v tension back from the regulator and propagate it on the socket, reaching both the target chip's VCC and the logical channels, making only a 3.3v tension flow in the entire circuit):
   
   
   
   
   Now we are ready to succesfully program our SPI NOR flash.
   
   
   
5. 1x SOP16 IC Test clip with adapters ( amazon link ) or 8x single pin test clips ( amazon link ). 10-20€
   Now this is the second crucial component: you need it to connect the programmer to your chip without desoldering.
   If you decide to go for the 16pins test clip you want to make sure you will get in the package a SOP16 to SOP8 adapter as well. This will save you a big amount of time, because the wiring below will be already done.
   
   
   
   
   
   If you decide to go for the 8x single pin test clips, or if you have no SOP16-SOP8 adapter provided with your SOP16 test clip, it's important to connect the 16pins of the MX25L6445E chip to the 8pins of the 25xx ZIF (zero insertion force) socket of the CH341A programmer correctly:
   
   
   
   
   
   In this case the solution will be to manually connect each one of the 25 series socket's 8 pins to the corresponding pin of the MX25L6445E according to the schema above: to do this you can use jumper wires for your convenience or you can cut and rejoin clip cables. (example of manual connection performed cutting and joining cables)
   
   
   
6. Jumper wires (always useful to make connections): 5-10€ amazon link

Software:

1. CH341A programmer: this software is open source, you can search the internet for CH341A 1.18 programming software (check this how-to video description for a link to it), this is the best software to work with this SPI chip; otherwise you may try one between: AsProgrammer, NeoProgrammer or Colibri (also easy to find on Google);
2. [optional] a non corrupted copy of your failsafe rom version (e.g: if before bricking it you had the 56.00.513 installed, you need a working version of the failsafe v56.00.513);
   for v56.00.513 EU you may find it in the comments of this page: How I unbricked CMU in my Mazda

Procedure:

1. Use the trim kit to remove all the trims and gain access to the CMU: you can refer to these videos to understand how to get access the CMU unit;
2. Use the 10mm socket wrench to remove the main bolt holding the CMU, pull it and disconnect the connectors (be very careful, these connectors and matching pins are really weak, I managed easily to bend something and it was a nightmare make it fit again);
3. Use the torx and cross screwdrivers to remove only the bottom metal bracket and case from the CMU so that you gain access to the CMU motherboard;
4. Extract the CMU motherboard, put it upside down and get access to the SPI NOR flash chip, try to locate it using the above pictures as a reference;
5. Clamp precisely the test clip on the MX25L6445E SPI chip so that the magenta cable (indicating PIN n°1) matches exactly the dot on the chip (indicating PIN n°1) (don't make mistakes: you won't damage the chip but without a good connection no programming will be possible);
6. Connect the connector of the test clip to the SOP16-to-SOP8 adapter (making sure that the magenta colored wire corresponds to the silkscreened 1 on the adapter PCB) (otherwise perform the correct jumper connections as explained above);
7. Place the adapter or the jumpers in the ZIF (zero insertion force) socket of the CH341A programmer (making sure you match the PIN n°1 of the adapter with the PIN n°1 of the 25xx side of the ZIF socket, that should be silkscreened on the programmer itself. In any case normally it's in the center right (4th pin of the right column from top) of the ZIF socket looking at it with the lever facing down. Check this how-to video to understand it better);
8. NOTE: step 5, 6 and 7 are crucial: if you don't connect correctly the chip to the programmer no programming will be feasible;
9. Install the CH341A parallel drivers on your PC
10. Start the CH341A programmer on your PC, you should see a Device disconnected status
11. Connect the USB programmer, you should see a Device connected status
12. Click detect IC chip, the Macronix MX25L6445E should be detected (often is wrongly detected as MX25L6405D, this isn't a problem since the 2 chip have the exact same page size and total size);
13. Click read chip;
14. Click verify chip;
15. If the verification is a success you can save the current status of the rom in a backup.bin file, to preserve your current status of the chip (even if it's broken you never know);
16. Erase the chip and verify the blank space of the chip;
17. Now you have two options: either you open the working ROM file of the same version of your CMU OS that I mentioned above (Software -> point 2), and program it to get your CMU working again (so for example you could then remove any existing tweaks and clean up your CMU before updating it), or in case you haven't found a valid rom for your CMU OS, you can just keep the corrupted version of the rom, go to hex offset 0x10000 (boot select partition) and change all the FF bytes of the row to 00 so that you change the boot mode from OS to update mode: this tells the CMU to start and try to complete the interrupted update. In this last scenario you will need to prepare an usb pen with the update you want to complete before mounting back the CMU in your car;
18. Program the chosen ROM file on the chip and verify the correctness of the write;
19. NOTE: Only if all of the above steps are passed with success you can proceed to reassemble the CMU with confidence that it will work;
20. Re-assemble the CMU;
21. Mount again the CMU in the car and in case you forced the update mode, complete the update procedure (make sure not to turn off the car this time);

Done! If you followed everything carefully you should, by now, have again a working & resurrected CMU yay!


For a more clear overview of the steps I described, check out this extremely helpful how-to video.



2) Updating firmware (without destroying) Mzd Connect CMU:

Find the correct firmware update for your CMU:

• if you have < 31.00.100 you should first update to v31.00.100
• if you have < 70.00.100 you should first update to v70.00.100
• if you have >= 70.00.100 you can update directly to v70.00.367 (latest)

I don't have links but you may find something on the internet.
Once you find your update copy failsafe.up and reinstall.up on a fat32 formatted empty <64gb USB pen.

EXTREMELY IMPORTANT NOTE: if you intend to update and you have Mazda AIO Tweaks installed on your CMU I strongly suggest you to remove all of them (perform system restore) before proceeding with the update, otherwise you risk to brick it for failure during failsafe installation (as it happened to me).
Also ensure that the usb pen contains only the update files and that is a fully working usb pen (any read error at failsafe installation time may end up into bricking your CMU).

If you took all the above precautions you can proceed with the update. Follow carefully the PDF guide provided with the updates: before the update press 2 and 3 in the diagnostic menu and press the brake pedal every 10-20 minutes to avoid the CMU to shutdown in the middle of the update process.

Good luck!

3) [bonus] Retrofit CarPlay/Android Auto

This kit is really simple to install, just follow the video provided in the useful resources. You can find working compatible kits on Amazon for less than 150€. It just consists into a new more powerful USB HUB and cables (able to bring in more current, thus more data), and it makes the updated CMUs (at least on FW v70.00.021) enable the Android Auto and CarPlay features.
The kit you are searching for should contain cables C922-V6-605A and USB HUB TK78-66-9U0C and they should work for both EU and US versions of the CMU (according to forum sources, I can confirm for EU version: link to working kit).

Useful resources:

• 2 repair techniques described (one with raspberry pi and the other with this same usb programmer)
• 2x4logic Mazda connect teardown
• 2x4 logic Mazda failsafe invocation
• 2x4logic Mazda failsafe not so safe
• How I unbricked my cmu
• Mazda3 Retrofit (carplay+android auto) how-to-install video

I really hope that these information will come in a handy and be useful to anyone still facing these issues.
I thought it could be convenient to concentrate all these infos in one single page, since I spent couple of days collecting them all.

Finally I wish you again a happy new year and good luck with modifying your CMU!

 

Hi everyone and happy new year!

A couple of days ago (the new year's eve ) I had the frustrating experience of bricking my MZD Connect CMU , getting a permanent black screen, while trying to update the firmware from v56.00.513 to v70.00.100, due to a failure during the failsafe step, because I left the Mazda AIO Tweaks installed before proceeding with the update.

I eventually managed to resurrect my CMU, to upgrade to the latest firmware and even (as a bonus) to install the retrofit kit for Apple CarPlay/Android Auto with complete success , but it didn't come without some difficulties, especially to collect every piece of information needed to arrive to the final solution.

As many say on the web and throughout the forum unbricking a dead Mazda CMU it's a completely simple and doable DIY process, that can save you a bunch (1000~€), but at the same time it cannot be completely easy and straightforward when you know nothing of electronics, especially when it comes to buy some crappy cheap programming devices from the web where no accurate specification is given, and seldomly you manage to perfectly replicate the setup of a forum or a blog post.

For those of you that want to know every single detailed step-by-step information on how to resurrect a dead CMU, upgrade the firmware and how to install a retrofit kit, I will explain everything about my adventures here below.


1) Resurrecting a dead Mzd Connect CMU in case of failed failsafe installation:

CONTEXT:
The Mazda connect operating system is distributed on 2 chips:

1. The failsafe is stored on a SPI NOR Flash memory of 8MB/64Mbit size, a Macronix MX25L6445E SOIC16 (16 total exposed pins) on the European version, but I heard of a Spansion chip on the US versions as well;
   
   View attachment 285149
   
   The failsafe name is really misleading, because the software loaded in this chip is actually the bios or if you prefer the bootloader of the CMU operating system, and this piece of software is crucial for the correct functionality of the headunit itself. Without it or with a corruption of its data, there is no way your CMU will boot anymore, and the screen will be black and dead.
   
   This chip is located on the back of the CMU motherboard.
   
   View attachment 285150
   
   
   
2. The operating system (a sort of linux displaying html pages as GUI) is stored on a NAND flash located on the front of the CMU motherboard:
   
   View attachment 285151

When we update the firmware of our CMUs the main problems occur when we upgrade the failsafe image: this process involves, as you may understand, the reflash of the crucial SPI NOR flash memory... thus risking in case of failed installation, car shut down, corruption, or partial load to brick the CMU itself.... not so fail safe after all.

In fact the fail safe upgrade has been completely removed starting from firmware version v70.00.300+, I bet because they understood it was an uber risky process and finally decided to keep the "bios"/bootloader stable and untouched .... (they should have designed the system like this from the beginning, in a real fail safe way ...)

Credits for the mazda system teardown images: Mazda Connect infotainment teardown




HOW TO FIX (without soldering for absolute beginners):

Now in the unfortunate case you bricked your CMU, what can you do?? Can you really resurrect your CMU even though you're not an expert or an electronic engineer?
Yes absolutely, but of course you should be careful and buy the right material. With an expense of maximum 50€ you will save yourself a 1000€ expense at the dealership.

Material:

1. Trim removal kit: 10-20€ amazon link
   This is needed to remove the car internal trims without breaking them, to get access and be able to remove the CMU from the car;
   
   
   
2. 10 mm socket wrench
   
   
   
3. a set of torx and cross screwdrivers
   
   
   
4. 1x CH341A Programmer : 10-20€ / eu amazon link: ZHITING SOIC8 SOP8 Flash Chip IC Test Clips Socket Adapter Programmer BIOS + CH341A 24 25 Series EEPROM Flash BIOS USB Programmer Module (Doppia Clip + USB) : Amazon.it: Elettronica
   A simple and super cheap SPI NOR flash/EEPROM programmer. This is the most important part: you absolutely need this to reprogram your CMU's MX25L6445E chip (SPI NOR flash).
   
   View attachment 285152
   
   
   NOTE: on Amazon there is a thousand of generic programmers available mainly coming from China.
   You should keep one main concept in mind: the MX25L6445E is a 3.3v chip (datasheet, check page 8) and for this reason you ABSOLUTELY need a programmer that powers the chip's VCC with exactly 3.3v (most of the programmers would do that) otherwise you will fry your SPI chip.
   Secondly (this is extremely important as well!!) the programmer that you buy should also program the chip with 3.3v tension; in other terms the logical channels (MISO, MOSI, etc.) should also be feeded with exactly 3.3v and NOT 5v otherwise the overvolted data channels will totally alter the data flow and you won't be able to read/write/verify valid data on the chip.
   Moreover you risk to fry your chip also in this case (even though the risk is much lower since you're not directly over tensioning the chip power source).
   
   View attachment 285153
   
   Now this is very important to know.. most of the ch341a programmers that you will find online have an issue: they can feed the target chip in the socket with a selectable tension (using a jumper) of either 3.3v either 5v, but they will always provide a 5v tension to the logical channels... and this may be a big problem causing you big headaches as I explained you just above.
   A successful programming may be impossible, or extremely hard, and moreover you risk your chip health.
   
   At this point it's key testing with a voltage tester if your programmer feeds the chip and the data channels with a 5v or 3.3v tension.
   Refer to these videos (ignore the soldering solution, just check which contacts voltage you should measure):
   video 1 video2
   
   In case the channels are feeded with 5v, the solution resides in performing a simple volt mod on the programmer, to force the ch341a IC in a 100% 3.3v mode:
   
   - Just cut with a cutter the PCB trace as visible in this picture (this will cut out the 5v incoming tension from the USB port, making the tension 0v on the socket itself):
   
   View attachment 285154
   
   - Place a jumper between the 3.3v and the 5v pins located on the usb programmer as in the following pic (this will bring the 3.3v tension back from the regulator and propagate it on the socket, reaching both the target chip's VCC and the logical channels, making only a 3.3v tension flow in the entire circuit):
   
   View attachment 285156
   
   Now we are ready to succesfully program our SPI NOR flash.
   
   
   
5. 1x SOP16 IC Test clip with adapters ( amazon link ) or 8x single pin test clips ( amazon link ). 10-20€
   Now this is the second crucial component: you need it to connect the programmer to your chip without desoldering.
   If you decide to go for the 16pins test clip you want to make sure you will get in the package a SOP16 to SOP8 adapter as well. This will save you a big amount of time, because the wiring below will be already done.
   
   View attachment 285158
   
   
   If you decide to go for the 8x single pin test clips, or if you have no SOP16-SOP8 adapter provided with your SOP16 test clip, it's important to connect the 16pins of the MX25L6445E chip to the 8pins of the 25xx ZIF (zero insertion force) socket of the CH341A programmer correctly:
   
   View attachment 285157
   
   
   In this case the solution will be to manually connect each one of the 25 series socket's 8 pins to the corresponding pin of the MX25L6445E according to the schema above: to do this you can use jumper wires for your convenience or you can cut and rejoin clip cables. (example of manual connection performed cutting and joining cables)
   
   
   
6. Jumper wires (always useful to make connections): 5-10€ amazon link

Software:

1. CH341A programmer: this software is open source, you can search the internet for CH341A 1.18 programming software (check this how-to video description for a link to it), this is the best software to work with this SPI chip; otherwise you may try one between: AsProgrammer, NeoProgrammer or Colibri (also easy to find on Google);
2. [optional] a non corrupted copy of your failsafe rom version (e.g: if before bricking it you had the 56.00.513 installed, you need a working version of the failsafe v56.00.513);
   for v56.00.513 EU you may find it in the comments of this page: How I unbricked CMU in my Mazda

Procedure:

1. Use the trim kit to remove all the trims and gain access to the CMU: you can refer to these videos to understand how to get access the CMU unit;
2. Use the 10mm socket wrench to remove the main bolt holding the CMU, pull it and disconnect the connectors (be very careful, these connectors and matching pins are really weak, I managed easily to bend something and it was a nightmare make it fit again);
3. Use the torx and cross screwdrivers to remove only the bottom metal bracket and case from the CMU so that you gain access to the CMU motherboard;
4. Extract the CMU motherboard, put it upside down and get access to the SPI NOR flash chip, try to locate it using the above pictures as a reference;
5. Clamp precisely the test clip on the MX25L6445E SPI chip so that the magenta cable (indicating PIN n°1) matches exactly the dot on the chip (indicating PIN n°1) (don't make mistakes: you won't damage the chip but without a good connection no programming will be possible);
6. Connect the connector of the test clip to the SOP16-to-SOP8 adapter (making sure that the magenta colored wire corresponds to the silkscreened 1 on the adapter PCB) (otherwise perform the correct jumper connections as explained above);
7. Place the adapter or the jumpers in the ZIF (zero insertion force) socket of the CH341A programmer (making sure you match the PIN n°1 of the adapter with the PIN n°1 of the 25xx side of the ZIF socket, that should be silkscreened on the programmer itself. In any case normally it's in the center right (4th pin of the right column from top) of the ZIF socket looking at it with the lever facing down. Check this how-to video to understand it better);
8. NOTE: step 5, 6 and 7 are crucial: if you don't connect correctly the chip to the programmer no programming will be feasible;
9. Install the CH341A parallel drivers on your PC
10. Start the CH341A programmer on your PC, you should see a Device disconnected status
11. Connect the USB programmer, you should see a Device connected status
12. Click detect IC chip, the Macronix MX25L6445E should be detected (often is wrongly detected as MX25L6405D, this isn't a problem since the 2 chip have the exact same page size and total size);
13. Click read chip;
14. Click verify chip;
15. If the verification is a success you can save the current status of the rom in a backup.bin file, to preserve your current status of the chip (even if it's broken you never know);
16. Erase the chip and verify the blank space of the chip;
17. Now you have two options: either you open the working ROM file of the same version of your CMU OS that I mentioned above (Software -> point 2), and program it to get your CMU working again (so for example you could then remove any existing tweaks and clean up your CMU before updating it), or in case you haven't found a valid rom for your CMU OS, you can just keep the corrupted version of the rom, go to hex offset 0x10000 (boot select partition) and change all the FF bytes of the row to 00 so that you change the boot mode from OS to update mode: this tells the CMU to start and try to complete the interrupted update. In this last scenario you will need to prepare an usb pen with the update you want to complete before mounting back the CMU in your car;
18. Program the chosen ROM file on the chip and verify the correctness of the write;
19. NOTE: Only if all of the above steps are passed with success you can proceed to reassemble the CMU with confidence that it will work;
20. Re-assemble the CMU;
21. Mount again the CMU in the car and in case you forced the update mode, complete the update procedure (make sure not to turn off the car this time);

Done! If you followed everything carefully you should, by now, have again a working & resurrected CMU yay!


For a more clear overview of the steps I described, check out this extremely helpful how-to video.



2) Updating firmware (without destroying) Mzd Connect CMU:

Find the correct firmware update for your CMU:

• if you have < 31.00.100 you should first update to v31.00.100
• if you have < 70.00.100 you should first update to v70.00.100
• if you have >= 70.00.100 you can update directly to v70.00.367 (latest)

I don't have links but you may find something on the internet.
Once you find your update copy failsafe.up and reinstall.up on a fat32 formatted empty <64gb USB pen.

EXTREMELY IMPORTANT NOTE: if you intend to update and you have Mazda AIO Tweaks installed on your CMU I strongly suggest you to remove all of them (perform system restore) before proceeding with the update, otherwise you risk to brick it for failure during failsafe installation (as it happened to me).
Also ensure that the usb pen contains only the update files and that is a fully working usb pen (any read error at failsafe installation time may end up into bricking your CMU).

If you took all the above precautions you can proceed with the update. Follow carefully the PDF guide provided with the updates: before the update press 2 and 3 in the diagnostic menu and press the brake pedal every 10-20 minutes to avoid the CMU to shutdown in the middle of the update process.

Good luck!

3) [bonus] Retrofit CarPlay/Android Auto

This kit is really simple to install, just follow the video provided in the useful resources. You can find working compatible kits on Amazon for less than 150€. It just consists into a new more powerful USB HUB and cables (able to bring in more current, thus more data), and it makes the updated CMUs (at least on FW v70.00.021) enable the Android Auto and CarPlay features.
The kit you are searching for should contain cables C922-V6-605A and USB HUB TK78-66-9U0C and they should work for both EU and US versions of the CMU (according to forum sources, I can confirm for EU version: link to working kit).

Useful resources:

• 2 repair techniques described (one with raspberry pi and the other with this same usb programmer)
• 2x4logic Mazda connect teardown
• 2x4 logic Mazda failsafe invocation
• 2x4logic Mazda failsafe not so safe
• How I unbricked my cmu
• Mazda3 Retrofit (carplay+android auto) how-to-install video

I really hope that these information will come in a handy and be useful to anyone still facing these issues.
I thought it could be convenient to concentrate all these infos in one single page, since I spent couple of days collecting them all.

Finally I wish you again a happy new year and good luck with modifying your CMU!

All steps and instructions for SPI NOR flash method will not work on bricked CMU which have firmware version >= 70.00.335 from Mazda factory....
So everyone must be carefully on working with that CMU (eg: update firmware, install scripts...)
I tried it two years ago on CMU with firmware 70.00.335 and can't recover that CMU... (tried on 3 CMU)...
Did somebody successful recover bricked CMU with firmware >=70.00.335 (original firmware install by Mazda factory, not upgraded firmware)?
Thank!

 

^ Incredible documentation. Thank you very much for sharing.

I've sure bookmarked it!

 

First off, kudos to everyone here who provided instructions etc. I unfortunately have ended up in this predicament as well. I was attempting to update my v55 to v70 to get my CarPlay kit installed and when I installed the failsafe I got an error that it failed. I know you're not supposed to turn the car off but my install had "failed" so I thought I'd turn the car off to try a new USB stick. Big mistake...

I have ordered the parts to try and fix this mess but a question as I wait. I believe I was on 55.00.753A. I cannot find any working download for that firmware. It looks like my best option is to change the hex offset to force a firmware re-install? My fear is I'm not sure if the car will be looking for 55.00.753A or 70.00.100A once I do that? I'm not actually sure which failsafe I have now. In the case of 55.00.753 I may not be able to find it on the web. There's some comments on page 6 about a European rom that allowed people to boot back in to 55.00.760A but is that failsafe also compatible with 55.00.753?

 

Try any available backup. For many FW 56 backup worked. As long as the CMU boots afterwards you can update to any other FW version - following the instructions (this time).

 

Thanks. I'm thinking it was due to having AIO tweaks still installed. I also have another Mazda that coincidentally has the same FW so I'm thinking I could read the good chip and write it to my broken one but I'd rather not have both my vehicles disassembled at once if I can help it. I will try the 56 fail safe first and see what happens.

 

HUGE thanks to everyone here that provided instructions. My Mazda is how back to life and upgraded to Carplay. I used the instructions provided by Raoulh on the first page of this thread except instead of setting the bits to force a reinstall I used the v56 failsafe from a European backup but it booted back into my v55 firmware and I was then able to upgrade to 70.00.100 and then a v74.

Here's the parts I used from Amazon Canada:

10Pcs IC Hook Test Clip, Test Clips Mini Test Clips Hook Grabbers SMD IC Hook Probe Jumper Logic Analyze Accessories, Hook Clip Grabbers Test Probe : Amazon.ca: Industrial & Scientific

10Pcs IC Hook Test Clip, Test Clips Mini Test Clips Hook Grabbers SMD IC Hook Probe Jumper Logic Analyze Accessories, Hook Clip Grabbers Test Probe : Amazon.ca: Industrial & Scientific

www.amazon.ca

3 Pack Solderless Plug in Breadboard with 3 Pack Jumper Wires, 830 Tie-Point 4 Power Rails Breadboard for Circuit Test (40 Pin Male to Female,40 Pin Male to Male,40 Pin Female to Female) : Amazon.ca: Electronics

3 Pack Solderless Plug in Breadboard with 3 Pack Jumper Wires, 830 Tie-Point 4 Power Rails Breadboard for Circuit Test (40 Pin Male to Female,40 Pin Male to Male,40 Pin Female to Female) : Amazon.ca: Electronics

www.amazon.ca

I actually did not use the breadboard and just used the female to female cables in the kit to directly connect the test clips to my Raspberry Pi.

The recovery was actually very easy and I would say many parts of the Carplay DIY were actually harder (getting the old USB hub out and routing cables).

 

I joined this forum explicitly to thank raoulh for saving my bacon. Your instructions were great - thank you for sharing your experience, and your crazy awesome technical knowledge. I’ll add one fact that may help others - after following his instructions, I used a different USB stick to try and install the update, and it wouldn’t work. A few curse words later, I realized that it may be because I used a different USB stick (which was newer / faster speed / larger memory). Tried using the older one I’d used for the failsafe, and everything worked fine.

 

@craz I botched my update from 59.00.504 eu n to 70.00.100a by trying to install reinstall package first now i'm asked for update file on usb and nothing is installing. After reading the entire forum my heads spinning, do I need to flash the 513 rom you supplied in this thread earlier to my cmu ? The only update files I have are 70.00.100a failsafe and reinstall..I'm struggling to get my headround this any help appreciated...

 

@Flakeyman : How is the status? As there is no update file for 59.00.504 available, I would give the flashing of the 513 rom a try (if the 00010000 value is set to 00 - forced update).

 

Hi @Tristan-cx5 , well after flashing several roms to the unit including the 513 with and without the value set 00 I have had no joy whatsoever. I saved the original rom .504 and even re flashed that with the value set back to FF and still nothing. the nearest I got was the mazda logo when flashing 70.00.100 to the unit. I re flashed the .504 with value FF and the unit now displays nothing at all so the vehicle is booked into the main dealer, I'm hoping the warranty on the car will cover it or some of it at least. when I flashed the 513 rom it asked for and update but would not take the 70.00.100 file.

 

Just as info: With an installed 74.00.310 NA you can not downgrade anymore (before including 74.00.230 NA this was possible for me). At the update/downgrade process it does not show lower versions anymore. But via the SPI NOR method described here, lower versions can be installed again. I tried it myself. I had 74.00.310 NA installed. Then I flashed the SPI NOR to failsafe 70.00.100 EU (file see post #88), changed the FF to 00, so that a forced update process began. At the usb stick were the two 70.00.100 EU firmware files, which were installed successfully. Now I have 70.00.100 EU again and can upgrade/downgrade like I want. Afterwards you can also install the firmware of other regions like NA or ADR.

Tip/hint: No files of lower firmware versions should be at the stick. Otherwise it tries to install them, which was not successful in my 1st try.

Thanks again to raoulh and Vien Tinh!

 

Version 74.00.310 of your CMU is factory installed firmware or you upgrade it to ver 74.00.310...
If CMU is upgraded from lower version (etc: ver 59 or 70.00.100) to 74.00.310, may be there is chance to recover it if you get CMU bricked...
But CMU bricked with factory installed firmware 70.00.335 or greater, you will have no chance to unbrick it, Don't you?
Thank!

 

Hello, I have a problem with a CMU from my colleague's MAZDA. He was trying to update the original firmware 27.00.000 to version 56.00.513B on a 2014 Mazda 3 (yes, he made a mistake here unfortunately, because I found out later that he should have updated to version 31.00.000A first). The CMU just goes to a black screen (radio playing). Then another MAZDA colleague tried to fix the CMU. He loaded a backup SPI FLASH with version 56.00.513B (bootstrap, fail-safe, i2c, ...) and set 0x10000 to 0x00. No success. When the CMU boots, there is still only a black screen (radio playing). Now I have CMU. I have a backup bin file of the old SPI FLASH (from previous colleague) where everything is before flashing the backup bin 56.00.513B. In the failsafe section of the bin file I found for example the text "CMU-140_27.00.000B". So it looks like the first install of xx_failsafe.up version 56 was also unsuccessful and created a "black screen"(maybe). Is there any hope of reviving the CMU? And what are the steps to do so? Thanks

 

The steps are described here in this thread in several posts... just read all the posts before.

If I were you, I would try to load the old SPI backup from previous colleague (v27) and set 0x10000 to 0x00. Usually afterwards the text in the display should ask you to insert a usb stick with the firmware and should continue the firmware update, if there is the firmware at the usb stick. Strange, that it did not ask at the v56 try... perhaps it was not done properly.

 

I upgraded with an old CMU (factory version 56.00.100) to FW 74.00.310 NA. A downgrade was only possible via flashing the SPI NOR chip.
I never had a CMU with from factory .335 or higher, therefore I do not know, how it would behave. But I guess you are right, that .335 and higher from factory can not be recovered via SPI NOR flash, due to the missing failsafe file.

 

I'm trying to help someone to recover a bricked unit. The unit was 56.00.100A and failed the update to 70.00.335C.
The fail-safe in the SPI is already updated to 70.00.335C.

I've tried with various versions ( 56.00513B, 70.00.100A, 70.00.335C) by replacing the relevant blocks in the SPI dump, set 0x10000 to 00 while keeping config and the rest and no success.

Only the 70.00.100A fail-safe image finds the update and starts validating the package, then the unit resets (probably the watchdog).
As a last resort I've extracted the gziped cpio inside the failsafe block, negated the last IF from the init script so that the unit will enter in the debug mode ( no watchdog and reset) repacked everything back and I'll try again with that tomorrow.

If some has a 56.00.100 spi dump to share I'd really appreciate it. Thanks!

 

NVM

 

At the SPI NOR is the failsafe located. So if you install 70.00.100 failsafe via SPI NOR dump, then the forced update only will and has to install the reinstall file. So the failsafe then is already installed. You do not have to select anything if I remember correctly. Reinstall file will be installed automatically. After this you have both files installed as you should. So with this process you do not have to think about the order (which file has to be installed first at a downgrade).

 

Awesome. Thanks again for the details. Looks like I'll be giving the EEPROM route a go than to get back to v70.x from v74.x.

 

For anyone reading this, I was successful; I added some details on the link below that might help others if they find themselves wishing to roll back to v70.
AIO Tweaks and Firmware Ver .502- READ THIS | Page 83 | 2004 to 2020 Mazda 3 Forum and Mazdaspeed 3 Forums (mazda3revolution.com)

 

Hi,
So I recently attempted and succeeded at upgrading my 2016 Mazda 3 GS with Apple CarPlay/Android Auto. However my experience was not as smooth due to my ignorance, but with the help of many sources I got it figured out. I wanted to write this post to share my personal experience and to kind of put together the different posts that I used to figure this out.

Part 1: Firmware Update
My firmware version was 56.000.xxx on my original unit so I would only have to do the single update (2 files) to get to 70.000.100. I started off by following this guide on YouTube:

until I stupidly decided to turn the car off between the firmware update file and reinstall package. As many of you probably know this BRICKS your CMU and you will be left with a black screen and audio from the last radio station you had open.

Part 1b: Unbricking your CMU
So now I’ve bricked my CMU. There are people here who explain the situation way more in detail and properly compared to what my understanding is so look around if you want a run down of the problem. But now I had to take out the CMU. Which is nicely explained here:

Once I had the unit out, I undid ALL the screws which are a combination of phillips and torx 20 screws. (They are also cleverly color coded from Mazda) After taking out the torx screws I popped off the metal cover and revealed the SPI NOR flash chip:

this is the chip that you need to read and flash. As far as I found there are two ways to do this.
1. With a cheap USB programmer
2. With a raspberry pi
Your mileage may vary, but the USB programmer did not work AT ALL and I only succeeded when using the raspberry pi. This forum post (up above explains how to use the raspberry: Black Screen MZD

Here’s what happened to me. Because I did not have access to a raspberry pi I decided to try the USB Programmer method explained here:

This process requires you to erase the original contents of your chip after you do a backup. (DO A BACKUP) Now I’m not sure if it was because of the USB programmer, or if it was the test clips I was using but I had problems reading and writing and essentially ended up with corrupted files and an empty chip. So now is when I went for help. Find someone who not only has but KNOWS how to use a raspberry pi. In the video that uses the USB Programmer there is a link to a google drive in the description with a copy of the users own modified file of the flash chip. Essentially I used the raspberry to flash that file from the google drive onto my chip. It’s not crazy complicated, but you can use the code from the forum post above:

Black Screen MZD

Hello, today i wanted to install the v70. I pressed the Start-Stopp Button one time and successfully installed the failsafe package. After that i wanted to install the reinstall package but an error came up "Failed to validate package certificate". So i pressed the Start-Stopp Button another...

www.mazda3revolution.com

to achieve this. Go to the line where the user writes “Now it’s time to write the modified file to the flash” and in the line of code below replace “cmu-mod.bin” with the file name of the modified version posted in the Google Drive. You can verify if it worked by switching the file names in the other lines of code, but once I installed the CMU back into the car I was prompted to insert the USB containing my reinstall package to which the installation went off without a hitch. (Pressing the clutch (manual) every 15 minutes). , I was left with a successful update to firmware 70.000.100

Side note: I also tried various ways the attach the flash chip to the raspberry pi. Ideally, you get an SOC16 Test Clip, but there are pretty hard to find in Canada so I opted to use an SOC8 Test clip for half the connections and used individual test clips for the other half of the connections:

Part 2: Installing the USB Hub
So there are plenty of tutorials online for how to Install the USB Hub when it is located in the center armrest, but my hub was located in the front of the Center console under the climate controls making the removal of the old hub more difficult. There is the hack to drill through the 4 clips, but I decided to opt out of that wanting to save my OEM part. To my surprise, taking it out properly wasn’t that difficult despite the lack of tutorials online.

Essentially, I had to slide the entire center console back which is well shown in this video here:

Now I’m this video the guy gets to a point where he takes out completely the center console including the arm rest, I DID NOT have to do this. Once I had the center console slid back about 5 inches, I was able to reach in and undo the 2 top clips of the USB hub and get the top edge poking out of the hole while keeping tension. Next with my other hand and a flathead screwdriver, I was able to reach in and pop one of the bottom clips and once that clip was free I was able to wiggle the USB hub out without undoing the last clip. What comes next is relatively easy, you run the new cables through the glove box up to where the touchscreen is wrapping everything in sponge tape. Next I tested everything to make sure everything was working then zip tied the cables to parts of the interior so that they wouldn’t wiggle or rattle around. Note: you should take the ends of the old USB Hub cable and zip tie/sponge tape it to the new cable so that the loose connector doesn’t rattle around either. Closing everything back up in the opposite way it was installed I finally had CarPlay in my car.

Obviously, don’t be an idiot like me and brick your CMU and you could have this whole process done in 2-3 hours, but for the few who do I hope my experiences help. For the USB hub installation, it is more difficult when it’s in the front, but still only took and hour, plus I got to save my OEM Hub.

Again hope somebody can benefit from this!

 

Hi,
So I recently attempted and succeeded at upgrading my 2016 Mazda 3 GS with Apple CarPlay/Android Auto. However my experience was not as smooth due to my ignorance, but with the help of many sources I got it figured out. I wanted to write this post to share my personal experience and to kind of put together the different posts that I used to figure this out.

Part 1: Firmware Update
My firmware version was 56.000.xxx on my original unit so I would only have to do the single update (2 files) to get to 70.000.100. I started off by following this guide on YouTube:

until I stupidly decided to turn the car off between the firmware update file and reinstall package. As many of you probably know this BRICKS your CMU and you will be left with a black screen and audio from the last radio station you had open.

Part 1b: Unbricking your CMU
So now I’ve bricked my CMU. There are people here who explain the situation way more in detail and properly compared to what my understanding is so look around if you want a run down of the problem. But now I had to take out the CMU. Which is nicely explained here:

Once I had the unit out, I undid ALL the screws which are a combination of phillips and torx 20 screws. (They are also cleverly color coded from Mazda) After taking out the torx screws I popped off the metal cover and revealed the SPI NOR flash chip:
View attachment 287640

this is the chip that you need to read and flash. As far as I found there are two ways to do this.
1. With a cheap USB programmer
2. With a raspberry pi
Your mileage may vary, but the USB programmer did not work AT ALL and I only succeeded when using the raspberry pi. This forum post (up above explains how to use the raspberry: Black Screen MZD

Here’s what happened to me. Because I did not have access to a raspberry pi I decided to try the USB Programmer method explained here:

This process requires you to erase the original contents of your chip after you do a backup. (DO A BACKUP) Now I’m not sure if it was because of the USB programmer, or if it was the test clips I was using but I had problems reading and writing and essentially ended up with corrupted files and an empty chip. So now is when I went for help. Find someone who not only has but KNOWS how to use a raspberry pi. In the video that uses the USB Programmer there is a link to a google drive in the description with a copy of the users own modified file of the flash chip. Essentially I used the raspberry to flash that file from the google drive onto my chip. It’s not crazy complicated, but you can use the code from the forum post above:

Black Screen MZD

Hello, today i wanted to install the v70. I pressed the Start-Stopp Button one time and successfully installed the failsafe package. After that i wanted to install the reinstall package but an error came up "Failed to validate package certificate". So i pressed the Start-Stopp Button another...

www.mazda3revolution.com

to achieve this. Go to the line where the user writes “Now it’s time to write the modified file to the flash” and in the line of code below replace “cmu-mod.bin” with the file name of the modified version posted in the Google Drive. You can verify if it worked by switching the file names in the other lines of code, but once I installed the CMU back into the car I was prompted to insert the USB containing my reinstall package to which the installation went off without a hitch. (Pressing the clutch (manual) every 15 minutes). , I was left with a successful update to firmware 70.000.100

Side note: I also tried various ways the attach the flash chip to the raspberry pi. Ideally, you get an SOC16 Test Clip, but there are pretty hard to find in Canada so I opted to use an SOC8 Test clip for half the connections and used individual test clips for the other half of the connections:
View attachment 287641



Part 2: Installing the USB Hub
So there are plenty of tutorials online for how to Install the USB Hub when it is located in the center armrest, but my hub was located in the front of the Center console under the climate controls making the removal of the old hub more difficult. There is the hack to drill through the 4 clips, but I decided to opt out of that wanting to save my OEM part. To my surprise, taking it out properly wasn’t that difficult despite the lack of tutorials online.

Essentially, I had to slide the entire center console back which is well shown in this video here:

Now I’m this video the guy gets to a point where he takes out completely the center console including the arm rest, I DID NOT have to do this. Once I had the center console slid back about 5 inches, I was able to reach in and undo the 2 top clips of the USB hub and get the top edge poking out of the hole while keeping tension. Next with my other hand and a flathead screwdriver, I was able to reach in and pop one of the bottom clips and once that clip was free I was able to wiggle the USB hub out without undoing the last clip. What comes next is relatively easy, you run the new cables through the glove box up to where the touchscreen is wrapping everything in sponge tape. Next I tested everything to make sure everything was working then zip tied the cables to parts of the interior so that they wouldn’t wiggle or rattle around. Note: you should take the ends of the old USB Hub cable and zip tie/sponge tape it to the new cable so that the loose connector doesn’t rattle around either. Closing everything back up in the opposite way it was installed I finally had CarPlay in my car.

Obviously, don’t be an idiot like me and brick your CMU and you could have this whole process done in 2-3 hours, but for the few who do I hope my experiences help. For the USB hub installation, it is more difficult when it’s in the front, but still only took and hour, plus I got to save my OEM Hub.

Again hope somebody can benefit from this!

How did you go about downloading the modified file to the raspberry pi? When I try to simply download it and change the command line to the name of the file, it says it cannot find the file. I have tried the ch341a programmer many times with both the clip and separate jumpers to verify my connection was good. I am in a constant boot loop on the firmware failure menu after my Mazda dealer bricked the system. A different mazda dealer said they were able to read the contents and said the dealer who did it accidentally downgraded me to v33 from v59 instead of upgrading like I requested. I have tried flashing v59, v70, v56, v31 .bin files to my chip with ch341a with no luck so I moved onto the raspberry pi. I modified the file as outlined in post on page 1 but still in a boot loop. Your method is the only one I have yet to try. Any help would be appreciated.

 

Hello everyone. I upgraded my Mazda 3 to 74.00.311 and I want to downgrade to 70 or 59. Is the rewrite SPI NOR chip the only solution or does the serial connection give me root access to downgrade it? Thank you for your help.

 

Hi dxdiag, pls keep me posted if you able to downgrade via SPI NOR chip method. TIA

 

Yes he can. Many in this thread already have, myself included. Note: don’t attempt if your car was delivered with 74.

has anyone tried with their car came stock with 74.00.310+?

 

has anyone tried with their car came stock with 74.00.310+?

That will brick the MCU apparently due to hardware differences.

 

SPI NOR is only known option. Serial access does not affect the update/downgrade option.

 

Thank you for your reply. May I ask if there is any danger in this solution?

 

Of course... have you read the instructions/this thread? If not, please do so.

Edit: That you ask such a question, might mean that you better should not try this solution.

 

Indeed!
For reference, I read this thread and several others from start to finish and watched many YouTube videos before committing to the SPI NOR recovery, or even the serial flash, and even then I missed that v74 could not be tweaked.

I'm comfortable with this kind of work, but still read all I could.
Don't cut corners, don't ignore all the experiences of those who have done, or attempted, the work before you. Read it all, benefit from their experiences.

YES anything serial or SPI NOR comes with a risk. Do your research before you attempt anything.

 

After waiting for the various parts needed, i tried to unbrick my 2 bricked cmu's today. One is 70.00.335 the other 352.

I got a CH341A programmer, cut the pcb track and fitted additional jumper as shown (i.e. to keep it at 3.3V). Also got a SOP16 clip connector with a 16 to 8 pin adapter etc.

Downloaded and installed drivers and software version 1.18. I am running Win10 X64.

Anyway, I was able to connect everything and erase the chip, then verify it as empty, no problems it says both are the same etc.

Then i open Ride & Live's "mazda back up modified" bin file (i.e. with all 00's at 10000).

But then when i click on "program" button at top of screen, i keep getting error "write timeout operations failed".

What do i do now?

I have tried disconnecting & reconnecting the CH341A programmer also closing & reopening the software program. Still the same error, and it happens on both my bricked cmu's.

Should i buy another CH341A programmer (from a different seller) in case it is faulty? Or should i try and download a different windows driver and/or software version?

I am stuck.

 

You should press READ first and save buffer to file. just in case.
Load file you'd want to be programmed and press in this order ERASE wait WRITE wait VERIFY.
Chip needs to be blank in order to be written.

 

Ok thanks Craz, i'll have another go tonight.

 

Craz, i did it in the exact order you said. I still get this stupid dialog box "Write operations timout failed!".