Obtaining a shell on Yamaha Montage

8N70OS_.PGM

README

Obtaining a shell on Yamaha Montage
===================================

Yamaha Montage firmware updates consist of an ext2 filesystem image which is
loopback mounted from a file 8N70OS_.PGM on an attached USB drive when the
machine powers up with the Utility and Cursor Up buttons held.

The initramfs /init script detects the magic button combination, mounts the
USB drive and filesystem image, then runs update.sh from within that image.
(The name 'update.sh' is misleading: it is actually exec()ed rather than run
with a shell, so needs execute permissions and #! magic.)

Real firmware updates overwrite the partitions on /dev/mmcblk0 with new
images, but you can instead use this mechanism to non-destructively launch a
shell on the Montage.

Attached to this gist is such an update.sh script, along with a ready-made
ext2 filesystem containing it. Copy the 8N70OS_.PGM image file to the root
of a USB drive, then switch on the instrument with the drive attached,
holding Utility and Cursor Up. A prompt will appear on the touchscreen and
you can plug in a USB keyboard to interact with it.

Before launching the shell, the instrument's main / and /home filesystems
are mounted read-only on /mnt/root and /mnt/home respectively. In normal
operation, Montage uses /home/ngs to store user data and configuration, and
preset data can be found in /usr/share/yamaha. The front-end itself is
started by the /usr/bin/daisy-start script.

The FAT32 boot filesystem is left unmounted as damaging this will brick the
instrument in a way that will require JTAG and cannot be fixed with the
standard update process.

8N70OS_.PGM is built from update.sh on a GNU/Linux host with

  fallocate -l 64k 8N70OS_.PGM
  mke2fs -t ext2 8N70OS_.PGM
  mkdir -p mnt && mount -o loop 8N70OS_.PGM mnt
  cp update.sh mnt/update.sh
  umount mnt

Please remember that if your synthesiser bursts into flames and kills the
cat as a result of experiments or modifications gone wrong, you are unlikely
to elicit much sympathy from Yamaha. I make no warranty and disclaim all
liability for any damage caused by your use of this unofficial hack, which I
hereby dedicate to the public domain.

update.sh

#!/bin/sh

RELEASE_VERSION=999.999.999

exec <>/dev/tty0 2>&1
reset

while [ ! -b /dev/mmcblk0 ]; do
  sleep 1
done

if [ ! -d /mnt/root ]; then
  mkdir -p /mnt/root
  mount -t ext4 -o discard,noatime,ro /dev/mmcblk0p2 /mnt/root
fi

if [ ! -d /mnt/home ]; then
  mkdir -p /mnt/home
  mount -t ext4 -o discard,noatime,ro /dev/mmcblk0p3 /mnt/home
fi

umount -l /mnt/loop
exec getty -l sh -n 115200 tty0

A more recent version of this code is maintained as part of my Montage resources at https://arachsys.github.io/montage/ and can be found at https://github.com/arachsys/montage/tree/main/shell