XMOS Chip Stuck on old Firmware (SMSL M500 USB DAC)

[Bob54]

Dear Community,
I came to you from an other “audio-device-forum” and hope you can give me a little hint about the following problem, because a lot of customers seems to be affected and the manufacturer SMSL is not very talkative.
Following situation:

• Device USB DAC “M500” from SMSL.

• They probably use the Thesycon “Update Tools” for usb firmware updates for the xmos chip.

• Devices manufactured at the end of last year have a SMSL XMOS USB firmware 1.05 or 1.08 on board.

• Some weeks ago SMSL published an Update 2.1 on their page and withdrawn it some days later.

The Problem:
Customers had try to update there devices. The Update tool shows it has succeeded but the “driver info panel” shows the older 1.05 firmware. The devices still works but it is impossible to update the firmware again an it stuck at 1.05. (So it sounds it has fallback to the initial firmware) Also other update combination (from 1.05 to 1.08) seems to fail at some devices.. all fall back to 1.05

My question:
SMSL say the device can only be update once. Is this plausible or why should a “on time update” should be implemented?

They also say the devices must be sand back to manufactory… probably the biggest issue because the devices must be shipped over the halve globe.
Is there any chance to “force” a update by the typical “xmos update tools” so customer can try the updates again?

Thanks in advanced an kind regards.

[mon2]

Hi Bob54. No idea on how this design works but guessing it will be a close derivative of one of the XMOS reference designs.

Can you take some quality pics of the PCB and post them for access on this forum? For future readers we should post on a permanent hosting website. Once you are ready, we can probably host on our company server.

The pictures should offer clarity on the component part numbers so we can continue this investigation.

Thanks.

[Bob54]

Hello mon2,
thanks for your response.
The manufacture himself has posted some pics of this m500 boards on the following forum post. (because there where already discussions about chip heating problems)

https://www.audiosciencereview.com/foru ... 67/page-13

[Bob54]

On the following link of an onlinehsop is also a public copy of the 1.08 USB Firmware update (DFU_Tool, .bin File etc.)
that was published by smsl. (In the past this was also downloadable from the official smsl-audio.com page but meanwhiles its withdrawn)

Maybe it is helpful for investigation:
https://download.shenzhenaudio.com/Smsl ... 0firmware/

[mon2]

Hi. The referenced pictures of the PCB are not very clear but believe that there is an external flash storage device near the XMOS marked CPU.

It is very possible and most likely that the firmware is encrypted. This conclusion is from a quick review of the .bin file. So what happens here is that the XMOS CPU has an internal OTP (one time programmable hidden key that only the factory knows) and this OTP holds firmware to load and run encrypted firmware that is held in the outside storage device (flash chip).

Could not see any visible standard text with a hex file editor (like HxD). Need to confirm the firmware header details before saying this is 100% accurate.

Can you run the command shown in chapter 3 of the following document:

https://www.xmos.com/download/DFU-loade ... ces(4).pdf

Code: Select all

dfucons info

What do you see after the above command? If you do not have this dfucons tool - believe you can download from the TheSyscon website - the full (evaluation) toolkit should be available there.

Which exact commands did you run to upgrade the firmware?

Do not run any other commands onto your box at this time.

Suspecting that if you must return the unit to the factory then perhaps the DFU tool is no longer operational due to being bricked and perhaps the flash must be removed and replaced. Just a logical guess.

On this note, are you in the US or perhaps Europe? One idea is to remove the flash device onboard -> make a verbatim copy of the flash and then try some experiments with the cloned flash to see if the firmware can be selectively erased.

Share the results from the above to see anything can be done via s/w.

Unfortunately TheSyscon will not support at even the simplest level unless they see proof of being a licensee of their tool. So no point to ask them for any help.

On the ESS DAC IC issue read on the above forum - I recall the use of thermal pads as heat spreaders which is a common solution inside of laptops to keep them slim. Just trying to recall the brand name associated with that technology - it may be Panasonic but no hits yet on this technology. One thought is to use a good thermal pad to place onto the ESS IC and fasten to a heavy copper PCB plate to act like a slim heat sink. Copper should be able to relieve the heat off this IC.

[Bob54]

Thanks for your response and your time. I really appreciate this.

I am not “directly” affected by this firmware fallback. My device had firmware 1.05 and in the past I updated to 1.08. (worked well)
As SMSL published the firmware 2.01 I "luckily" didn’t had access to my device .. I already downloaded it but did never run this firmware update,
because suddenly a lot of people complained in the “audio-science-forum” about falling back to 1.05 even when they successfully updated before to 1.08.
So this fifty-fifty chance was to hot for me as I would give it a try.

SMSL say “You can run a firmware update only once on this device”…
but they make this statement after all this people trap into this problem and all updates now reverted from the official homepage... a bit strange ¯\_(ツ)_/¯
So I was intrested if there is a way to help these people "by software" (becaus most of them probably must ship there device back to china on there own costs)
and so I dig a bit in these thesycon/xmos documentation (becaus I'm alos a software developer.. but not specialized in USB/ Driver or hardware stuff)

"Can you run the command..":
Unfortunate I didn’t get "dfucons info" to run correctly, just get the error:
TUSBAUDIO_OpenDeviceByIndex failed (st=0xEE000060)
TUSBAUDIO_GetDriverInfo failed, st=0xEE000060


Which exact commands did you run to upgrade the firmware?
On the flowing page you can have a look at a step by step picture tutorial how a firmwareupdate is done by the endusers. (Looks like it’s just the customized Thesycon-GUI Tool / GUI-Version of dfucon)
https://sites.google.com/view/audiofoli ... flash-m500
(Funfact: The person who has done this tutorial seems to downgraded his device.. see last screenhots of the tool: It was on 2.01 and after successfull flashing he is on 1.08)

On this note, are you in the US or perhaps Europe..
I’m located in Germany

[mon2]

Hi. It may be possible to use the more flexible xflash tool for some experiments with the flash as the API is the same inside xflash and the DFU tools.

Not fully awake so will study once at the office in a few hours.

Idea is to see if the latest image can be erased so the DFU believes there is no upgrade.

Perhaps the vendor is marking a flag location inside the flash to denote "no more upgrades for you"? But why?

Guessing that it is a misunderstanding on how to use the DFU by the manufacturer that has led to this corruption of the flash and the bootloader is defaulting to the factory good (but older) firmware image.

All speculation at this time.

Are there any friendly testers out in the field with corrupted boxes?

[mon2]

Hi. On the DFU tool, review the following steps:

This is a console based flash programming utility and is available from this download:

https://www.xmos.com/file/usb-audio-cla ... er-windows

Download and extract this package. The dfucons.exe program is posted inside the following folder (after you run the download):

C:\Thesycon\TUSBAudio_v3.34.0\EvaluationKit\utilities

Copy the dfucons.exe program and paste into the following folder:

C:\Thesycon\TUSBAudio_v3.34.0\EvaluationKit\DriverPackages\XMOS_EVAL_KITS_DEMO\DriverSetup\release

This is because when you run the dfucons.exe program, the application will search for the supporting dll files to launch.

Once you have done this, enter the dos prompt (aka Command Prompt - admin) and enter the following commands:

cd\ <ENTER> ; to take you to the root folder on your hard drive

cd C:\Thesycon\TUSBAudio_v3.34.0\EvaluationKit\DriverPackages\XMOS_EVAL_KITS_DEMO\DriverSetup\release

to enter the folder with the dfucons.exe program.

Then type:

dfucons info <ENTER>

[Bob54]

Unfortunately still no success with the dfucons:

If I try it with the eval-drivers, like in your description the tool shows “No Device Found”.
Also the “thesycon-info-panel” in the windows-tray shows no device.

Then I have tried driver package that is provided by smsl
http://www.smsl-audio.com/productshow.asp?id=157
(It has other configurations in the “custom.ini”)
In this case the dfucons shows “TUSBAUDIO_OpenDeviceByIndex failed”
but the “thesycon-info-panel” in the windows-tray shows now the device.

[mon2]

Hi. After some research I think I understand the is procedure that led to this issue.

Can you share other flash firmware images for this box?

How many boxes are impacted by this issue?

Are others sending the audio box back for the fix?

How difficult is it to open this box to get access to the PCB?

Are you a hardware developer?

At this time, believe that you will be required to locate the surface mount flash device to read/write/erase some regions to correct the DFU upgrade lock.

This is the reason the factory wants you to return to their location. So that they can remove the surface mount flash for a correction.

If the box contained a JTAG like tool, called xtag3 for Xmos developers, then the fix would have been rather simple. Just run xflash using xtag3 --> correct the flash and retry the upgrade. However, do not see this on the design.

Noting the above, wonder if there is a market for an affordable tool to fix the issue?

Will need to study the case further but above process sounds correct. Unless the DFU has the ability to access the flash at absolute locations using the API, external hardware will be required. Let me study the DFU API to understand the operation and see if it can be fixed over software. You can research the same documents in the meantime. Not wanting to purchase this rather expensive box for development but will do so if there is a business model with a return on investment. Personally not an audio developer and neither is our company but after seeing the margins in this field perhaps we should consider it.