Oh yes it is convoluted. This is for parallel nor flash though, not serial. I suppose a pi could work I am just confused how you would dump it over serial. You need to connect:

D0-D15

A0-A15

CE (STATIC)

OE (STATIC)

WE (STATIC)

WP (STATIC)

RST (STATIC)

GND (STATIC)

3.3 (STATIC)

The pi would have to request an address over the address bus to the flash chip using A0-A15 and then the data would come over on D0-D15 and you would have to collect it. A pi would work if external static pins were held or tied to their respective state in order to read. TSOP56/48/40 would not work for this as a pico only has 26 GPIO pins available.

Here are images of the busses for both serial and parallel nor flashes. The bus sizes are different. Serial: https://www.embedded.com/wp-content/uploads/contenteetimes-i...

Parallel: https://www.embedded.com/wp-content/uploads/contenteetimes-i...

connect parallel pins to gpios, data out over usb-serial. i've done this a few times using the very same socket depicted in TFA

Or hook up a counter (reset + clock signal, that's 2 gpio's), and feed counter output to address lines.

If you're really short on gpio's, you could do the same with the data outputs (use some parallel in, serial out shift register, or a multiplexer that selects which data bit(s) to read).

Updated. Curious about how you wound up tying all 30+ pins on the pico (26 gpio)

You can put that nor flash into byte mode, saving you 8 data lines in exchange for an extra address line.

You can also throw a shift register in to increase the number of GPIOs.

Yes, I suppose this would be a functional way to do this. It would take much longer (double or quadruple depending on data bus size). But none the less, it could work.

I think you'll find that even that is much quicker than twiddling lines via boundary scan. At best, JTAG boundary scan is basically one giant shift register generally hundreds to thousands of bits long. Every cycle you'd need to shift out the whole thing even if you change the state of one signal.

Yeah, about the only way this would make sense is if they used the boundary scan of the original board's SoC so they didn't have to desolder anything.

This also does work. Some devices do not have the ability to connect to a part though (no bsdl, no jtag header)

Given that the top bit of every 16bit word looks to be set, I'm not sure that it does work.

This would work. And I have done this. You need a jtag port and the flash needs to be directly connected to the SOC/MCU/FPGA. This is similar to how EJTAG works but without ejtag, you need to specify the pins themselves. As long as all 16 data and addr pins are connected, this is possible.

I know it can be done. NOR boot flashes like this were typically written and verified via boundary scan at manufacturing time. That's probably how this flash was initially written.

I question whether you successfully performed that operation.