Corrupt flash

[smartfone2001-prog]

Hey everyone,
​I'm currently trying to unbrick an Electribe 2 Sampler and have hit a wall where I likely need a clean, working 16MB SPI flash dump to proceed.

​Current Situation & Hardware Status:
​Initial state: Device was totally bricked.
​JTAG Setup: Successfully connected via OpenOCD & Raspberry Pi. I can load SBL.bin to 0x80000000 and SYSTEM.bin (as well as hacktribe.bin) to 0xc0000000 perfectly (2,097,152 bytes written).

​The Issue: The device successfully boots from RAM, the Korg logo appears, and the progress bar hits 100%. However, it completely freezes right before entering the main menu.

​Debug Logs & CPU State:
Halting the CPU via Telnet at the frozen loading bar reveals that it is not crashing (no Data Abort), but getting stuck in an infinite polling loop:
pc: 0xc0014658 -> pc: 0xc0014684 -> pc: 0xc0012210 -> pc: 0xc0014658

​It seems the OS is trying to mount/read the internal SPI flash (looking for global settings, magic bytes, or user data), gets garbage in return, and loops forever. SD card auto-recovery is not triggering.

​Further Troubleshooting:
​I used a custom hex-patched firmware (thanks to Claude) that completely bypassed the flash-check during boot. With this patched bin, the Electribe successfully booted into the main menu (all pads lit up!), but immediately triggered a controlled "Power Off" shutdown screen. In my opinion this confirms the CPU/RAM/Mainboard are 100% physically fine, but crucial data (like power-latch parameters or calibration) is missing from the flash.

​The original bootloader on the flash also seems completely dead by now (black screen on normal power-up without JTAG).

​Current Step (SPI Flashing):
I hooked up a SOIC-8 clip directly to the Macronix MX25L12835F chip and have stable read access via flashrom. I will try to manually hex-edit the app section at 0x020000 into my corrupted dump.

​My Request:
Does anyone have a verified, working full 16MB SPI dump for the Electribe 2 Sampler that I could flash directly?
​Thanks in advance!

[vanana-old-acc]

any luck?

[smartfone2001-prog]

nope..someone sent me a copy, i flashed it but it still wont boot

[ghost]

getting stuck in an infinite polling loop
It seems the OS is trying to mount/read the internal SPI flash

It's not waiting for SPI flash, it's waiting for a response from the Blackfin DSP.

For some reason the DSP is not responding, this could be a hardware issue. Either the DSP is not booting, or the communication between the DSP and CPU is broken.

I had one with a dry solder joint on one of the resistors between the DSP and its RAM. The RAM wouldn't initialise so the DSP didn't complete boot.

If you hold [Pattern Set] + [Bar 1] while powering up it should enter a test mode. Record button will flash, press it to start the test. If the DSP and CPU can't communicate it will fail, I think the test is at the start before any of the loopback tests.

[vanana-old-acc]

I didn't know about that test mode :O i just managed to boot factory firmware from freetribe, so I'm writing the custom bootloader. Would have been useful to know this the last two weeks!

[smartfone2001-prog]

I tried the different testing modes (depending on bar 1-3), it says flashrom works and i even completed the loopback tests

[vanana-old-acc]

Hi, by chance, I messed up my electribe 2 somehow. Regularily booting works, from splash screen onwards, the RGB lights on the bottom of the korgs lighting up and when I press play they turn red. I have no sound :(
Is this a known issue for you aswell?

[vanana-old-acc]

Hey everyone, ​I'm currently trying to unbrick an Electribe 2 Sampler and have hit a wall where I likely need a clean, working 16MB SPI flash dump to proceed.

​Current Situation & Hardware Status: ​Initial state: Device was totally bricked. ​JTAG Setup: Successfully connected via OpenOCD & Raspberry Pi. I can load SBL.bin to 0x80000000 and SYSTEM.bin (as well as hacktribe.bin) to 0xc0000000 perfectly (2,097,152 bytes written).

​The Issue: The device successfully boots from RAM, the Korg logo appears, and the progress bar hits 100%. However, it completely freezes right before entering the main menu.

​Debug Logs & CPU State: Halting the CPU via Telnet at the frozen loading bar reveals that it is not crashing (no Data Abort), but getting stuck in an infinite polling loop: pc: 0xc0014658 -> pc: 0xc0014684 -> pc: 0xc0012210 -> pc: 0xc0014658

​It seems the OS is trying to mount/read the internal SPI flash (looking for global settings, magic bytes, or user data), gets garbage in return, and loops forever. SD card auto-recovery is not triggering.

​Further Troubleshooting: ​I used a custom hex-patched firmware (thanks to Claude) that completely bypassed the flash-check during boot. With this patched bin, the Electribe successfully booted into the main menu (all pads lit up!), but immediately triggered a controlled "Power Off" shutdown screen. In my opinion this confirms the CPU/RAM/Mainboard are 100% physically fine, but crucial data (like power-latch parameters or calibration) is missing from the flash.

​The original bootloader on the flash also seems completely dead by now (black screen on normal power-up without JTAG).

​Current Step (SPI Flashing): I hooked up a SOIC-8 clip directly to the Macronix MX25L12835F chip and have stable read access via flashrom. I will try to manually hex-edit the app section at 0x020000 into my corrupted dump.

​My Request: Does anyone have a verified, working full 16MB SPI dump for the Electribe 2 Sampler that I could flash directly? ​Thanks in advance!

First things first, I dumped a virgin blue korg this week:
blue_factory_flash.zip

Note: blue factory flash also works on red hardware and vice versa

[vanana-old-acc]

@smartfone2001-prog

Second, like hacksyn said, it's DSP related:

pc: 0xc0014658 -> pc: 0xc0014684 -> pc: 0xc0012210 -> pc: 0xc0014658

ushort dsp_is_data_ready??(undefined4 emifaFIFOAddr)
{
  ushort *dataReadyFlagPtr;
  
  dataReadyFlagPtr = (ushort *)dsp_mailbox_ready_flag_ptr(emifaFIFOAddr);
  do {
  } while ((*dataReadyFlagPtr & 0x80) == 0);
  return *dataReadyFlagPtr & 0x50;
}

Funnily enough I had to reverse that function while working on the bootloader last week -,-
for me the issue ended up I didn't send some GPIO properly:

SBL bootloader decompilation:

  Set_GPIO_GP6P8_MCU(gpio0regs,1);
  r0 = (astruct_1 *)GetClassObjAt_0x8001B000();
  FUN_80005070_initsSomeStruct(r0);
  Set_GPIO_GP6P6(gpio0regs,1);
  Set_GPIO_GP7P13((uint32_t *)gpio0regs,1);
  pBoard = Board::GetInstance();
  Board::delay_block_us(pBoard,60);
  Set_GPIO_GP6P2__ADC_Reset_xorState(gpio0regs,1);
  Set_GPIO_GP7P10__ADC_MEMCLK(gpio0regs,1);

It may not be the DSP chip itself necessarily though.
You got past the ROM and SBL, that means CPU is generally fine, LCD (SPI0) works, Flash (SPI1) works etc..
My rough guess is there's something up with any of those GPIO lines that are related to the Blackfin DSP.

Considering you say now JTAG setup also is screwed, and if that's verifiably the hardware case, then the issue may not even be with the GPIO lines but some faulting semiconductor.

Hope that helps