A tale of two 9's

[bean]

On the left we have the EHX Synth 9, PCB rev.E and on the right the B9, PCB rev.B.

Looks like the two boards are nearly identical with the rev.E having possibly additional decoupling caps. Also, the Rev.E has a dry mute option. Both have Macronix MX25L6445E flash memory chips (on the left it's the one with the purple dot). https://datasheetspdf.com/pdf-file/927690/MACRONIX/25l6445E/1

You see where I'm going with this? I don't know too much about digital but I guess it's safe to assume there's going to be some kind of code protection on the memory to prevent copying. But, I'm wondering about removing both and setting up a selector switch in a single unit for hot swapping (or, at worst, swap with power cycling).

[imJonWain]

Maybe?  I'm sure someone more knowledgeable then I will chime in but it's gonna depend.  I doubt hot swapping would be possible. 

What's U7?  and U1?

[bluebunny]

This is way beyond my pay grade, Brian (I did some VLSI stuff for my degree, but that was soooo last century...), but that chip select pin looks like a good way to choose between two chips?  Dunno whether those I/O pins sit on something that constitutes a "bus", but assuming the un-select makes them go high-impedance, then I would make a wild guess and say piggy-back two chips.

[bean]

I did a little more reading and it looks like the chip select pin can be used in slave configurations. So, you set the CS pin to a high impedance output and it basically turns it off, if I read that correctly. So, I'm thinking rather than a selector switch maybe a PIC type control which mutes the effect output, does the chip swap and then cycles the power all in one go via a pushbutton momentary. I'll need to spend a bit more time to see if that's "in my pay-grade" as you put it

[bluebunny]

Does the power need to be cycled?  Are you talking about the flash chip?

[Digital Larry]

Does the power need to be cycled?  Are you talking about the flash chip?

Just a guess, it's only being read when you change patches.  I'd start by just having something that drives CS alternately high or low for each chip and see what happens.

[bean]

Does the power need to be cycled?  Are you talking about the flash chip?

Just a guess, it's only being read when you change patches.  I'd start by just having something that drives CS alternately high or low for each chip and see what happens.

Thanks. I think that is probably the easiest thing to do. Do you think I should include a pull-up resistor for each CS pin or just connect straight to (assuming) 3.3v?
I'll report back if I make any progress.

[Digital Larry]

Use pullup resistors and switch to ground.

[pruttelherrie]

How would the code protection work? The bits need to get sent over the line, so I would think the flash is readable?
Unless there's some kind of encryption in place, with decryption on the DSP.

[pruttelherrie]

To reply to myself:

Unless there's some kind of encryption in place, with decryption on the DSP.

In that case, just copying encrypted code would work. So to be able to fully protect the data, the DSP needs to send a key, with which the memchip encrypts it data.
But as far as I can tell from the dtasheet linked, the data protection concerns accidental overwrites, and ways to make it read-only.
So it looks like it might be copy-able?

[hgamal]

In that case, just copying encrypted code would work. So to be able to fully protect the data, the DSP needs to send a key, with which the memchip encrypts it data.
But as far as I can tell from the dtasheet linked, the data protection concerns accidental overwrites, and ways to make it read-only.
So it looks like it might be copy-able?

The Analog Device DSP can be booted in some ways. Using internal ROM code or just by download an external flash ram.

If DSP uses the internal ROM, which must be ordered from Analog Devices with that, the ROM code can decode the data inside the external flash ram and load it as DSP code.

If this ROM is not used, it is very probable that the DSP just downloads the flash and runs it as a DSP code program.

If the code is encrypted and those two products use the same key, they can be switched.

[hgamal]

Maybe the DSP code is not encrypted after all:

https://www.musicradar.com/news/electro-harmonix-wins-copyright-infringement-case-against-mooer

Maybe this pedal can be cloned with some effort. Looking at its construction seen to be just a DSP, boot flash, and CODEC. But I have not seen the other side of the board and if it has other boards.

[pruttelherrie]

It has no other boards; check my pictures of the guts at https://imgur.com/gallery/W1GQnxx
or the thread about this pedal here https://www.diystompboxes.com/smfforum/index.php?topic=124047.0

I'm not actually interested in cloning, but merging all pedals into one, with MIDI control, would save a LOT of board space!

[pruttelherrie]

Just a guess, it's only being read when you change patches.  I'd start by just having something that drives CS alternately high or low for each chip and see what happens.

Thanks. I think that is probably the easiest thing to do. Do you think I should include a pull-up resistor for each CS pin or just connect straight to (assuming) 3.3v?
I'll report back if I make any progress.

Any news on this?

[pruttelherrie]

But I *DO* have news on this!

All of the flash chip's pins are available on the header in the top left. So my thinking was to remove the flash from the board, put it on a small piece of perfboard with a header that plugs into the programming header.

Yesterday I did a 'brain transplant' (or, better said: a 'memory transplant') by desoldering the flash of a C9, putting it on a SOP->DIP adapterboard (I'm a through-hole guy) and making a makeshift adapter that plugs in the header. See photos below.

Well, this works - Next step is to do the same to a different pedal and check if this adapter works in that pedal. So today I removed the Synth9 flash, put it on a SOP->DIP adapter and plugged it into the C9. Whaddayathink: the C9 now is a Synth9 pedal! The reverse also works: placing the DIP into the perf into the Synth9 board makes it a C9 pedal   

So now the next step is to put both DIPs on a perfboard with a /CS selector switch. I'll keep you guys posted.

Just some more random thoughts: there might be a connection from the header to the /RESET of the BlackFin. We could use that to reset the DSP and load the new programs after switching /CS. I'll have to probe those connections.

Also, I opened up a MEL9. This one has a different chip, the MX25L12833F. This is a 16Mbyte flash, much bigger than the 1Mbyte flash of the C9/Synth9. It's probably holding all the wavetables. We'll see if that one is compatible later on.

[pruttelherrie]

Short update.

I put both chips on the perfboard, everything connected bus-like, except for the /CS.
These I pulled up to 3.3V and also to a SPDT to ground. This did not work.

Then I connected the /CS from the header to the SPDT, and that to the flash chips. This worked: I can switch the pedal between C9 and Synth9 with the switch but I do need a reset of the DSP (disconnect power for now).

So it seems the flash really needs the /CS signal from the BlackFin. How do we do this with an MCU-controlled selector? MOSFETs in the lines which are switched by GPIO's? Putting relays in there seems a bit overkill, we should be able to do it with silicon i think? [edit] Doh, I need an AND gate. [edit2] But do I? I need a selector/de-multiplexer.

[edit] connecting one /CS to +3.3V and the other /CS to GND does not work, it really needs to be connected to the BlackFin.

[free electron]

Small SOT23-6 two channel demultiplexer like this one:
https://assets.nexperia.com/documents/data-sheet/74LVC1G18.pdf

Blackfin's /CS goes into A (3)
1Y(6) to /CS of the 1st Flash
2Y(4) to /CS of the 2nd one.
Pull up on S (1) + a switch shorting it to gnd to select the active flash.
The deselected output is floating/3-state, so both /CS lines should have a pull up resistor.

[pruttelherrie]

Followup.

The /RESET of the BlackFin is also on the header, so after switching the /CS to a different flash, pulling down that pin forces a reboot of 2~3 seconds after which the programs have switched. Yay.

For the people at home following along, this is the pinout of the header on the pedal-PCB:

Code Select Expand


EHX9 header -  MX25L6445E  - Function

    5       -  1           - CS
    6       -  2           - SO/MISO
   10       -  3           - NC/WriteProtect
    9       -  4           - GND
    7       -  5           - IS/MOSI
    8       -  6           - SCLK
   10       -  7           - NC
   10       -  8           - VCC

    3       - 53 on DSP => /RESET on DSP

EHX header pin counting:
    -----   -----
    | 2 4 6 8 10|
    |           |
    | 1 3 5 7 9 |
    -------------


Also, I decided that with a 74HC138 I can make a selector for the /CS signal.

[edit] (after reading free electron's post): Yep, that would work too! For two chips. The 9-family consists of 6 pedals at the moment, I was thinking of designing a PCB for that maximum of flash chips, addressable with a microcontroller.

[free electron]

The '138 will not work here. You still need the Blackfin to control the /CS line, the chip has to route it to the selected flash. '138 is a 3 to 8 line decoder. The 3 address inputs control where the '1' will show up. There is no data input (/CS coming from the Blackfin) as on the LVC1G18.
74HC4051 could work, although i'm not sure how or if the switching/propagation delays would impact the SPI timings.

[vigilante397]

I don't own any 9 series pedals but I think they're neat. So while I don't anticipate ever needing this information I'm still enjoying following along Thanks for sharing @pruttelherrie, and please continue to keep us posted!

Question that got me thinking: has anyone tried copying the flash to another chip with something like a bus pirate so you could build a big combo pedal without ruining the other units?