Iriver firmware flashing

Supported players

It is possible to update the bootloader and even store the Rockbox RAM and/or ROM image in the Flash memory chip inside the iriver players. Currently, only the following models are tested to work:

• Iriver iHP110/H110
• Iriver iHP115/H115
• Iriver iHP120/H120
• Iriver iHP140/H140

Do not attempt to flash other players unless you are prepared to risk rendering the player useless.

How it works

When Rockbox has been initially flashed to a player, the flash memory has been organized into the following different sections:

• Reset vector (0x000000 - 0x000007)
• Original firmware (0x000008 - 0x1EFFFF)
• Bootloader (0x1F0000 - 0x1FFFFF)

The reset vector contains important information to the CPU where to start executing code after the system has been powered up. The reset vector is implemented as two 4-byte memory address location pointers, who contain the memory addresses for the stack pointer and the program code entry point. With pure original firmware (without Rockbox), the entry point is always 0x0000008 (which is the start and execution address for the original firmware). After flashing the modified Rockbox firmware, that entry point is changed to point somewhere in the bootloader address space (0x1F0000 - 0x1FFFFF) to the correct bootloader entry point. That way, the Rockbox bootloader can load and the user can have a multi-boot choice whether to load Rockbox or the original firmware.

Because the original firmware does not use all available flash ROM space, it's possible to place the bootloader at the very end of the flash memory (the last 16 sectors). That way there is no need to modify the original firmware.

The Rockbox flashing plugin makes it possible to update both bootloader and firmware sections. Bootloader version 7 contains the ability to detect if there is original firmware present or if the user has replaced it with the Rockbox firmware. With flashed Rockbox, the memory organization is slightly different (but still compatible with the original firmware):

• Reset vector (0x000000 - 0x000007)
• Rockbox RAM image (0x001000 - 0x0EFFFF)
• Rockbox ROM image (0x100000 - 0x1EFFFF)
• Bootloader (0x1F0000 - 0x1FFFFF)

Rockbox firmware is stored in a different sector than the critical reset vector. That makes it possible for the user to safely upgrade Rockbox in flash without the fear of bricking the unit even if the firmware upgrade fails. The bootloader auto detection works by looking for a magic code at address 0x001000. If it detects Rockbox in flash, the bootloader enables additional features including EEPROM support and multiboot option between loading Rockbox from flash or to load from disk as Rockbox is usually loaded.

Overview of flashing procedure;

Flashing has three steps and done in the following sequence,

• 1). Bootloader flash/upgrade, (no need to re-do on subsequent firmware reflashing, re-do only if the bootloader is updated to a newer version)
• 2). Flash procedure (RAM).
• 3). Flash procedure (ROM).

Once flashing is completed go to Bootloader Configuration to set the Boot sequence.

Upgrading the bootloader

With the iriver_flash plugin it's possible to upgrade the bootloader inside Rockbox without using the original firmware at all. Bootloader version 7-pre3 or newer is required to load Rockbox directly from flash. The table at the end of this page contains a pre-release bootloader for H110/H115/H120/H140 players. The checksum is also verified internally by the iriver_flash plugin before flashing is possible so it shouldn't be possible to mess up the bootloader.

Before flashing (especially when flashing the bootloader), make sure the battery is fully charged and no audio is playing. It's strongly recommended to use official Rockbox builds to modify the flash ROM contents, since if something goes wrong during the bootloader upgrade procedure, your player can be rendered useless! Before starting the procedure, make sure no other plugins has been used or audio has been played. If necessary, shutdown and reboot the player.

Bootloader Flashing Procedure:
After starting up the player;

• Set "Show Files" to "All".
• Through the Files entry in the Rockbox menu, navigate to the .rockbox directory, enter it and scroll down to bootloader.iriver,
• Place cursor over bootloader.iriver and long press joystick, (navi), then select "Open with...".
• From the list of plugins, select iriver_flash and execute it.
• If the check requirements are met, a confirmation message is displayed,
• Press PLAY to confirm, the bootloading flashing starts, this usually takes a few seconds, don't touch your player during this process, as any interruption could brick the player
• If everything went fine, you should see, "Success" displayed briefly.
• Now you can either reboot your player and use it like before, or continue to the next section and flash Rockbox over the original firmware.

However, if in the very rare situation there were errors and flashing of the critical sections failed, you will see fatal warning messages on the display. In that case, it's important to plug the player to AC power, and make sure idle power off is disabled. The next thing is to contact the Rockbox developers as soon as possible and make sure you in no circumstances shut down or reboot the player or use it for anything before developers has given exact instructions what to try.

*IMPORTANT* If you already had Rockbox in flash and you are upgrading from a previous bootloader to the bootloader version 7-pre4, please proceed to the next section immediately without rebooting the device and flash either the RAM image, ROM image or both of them. That way you can avoid possible issues when there are no recognized versions of Rockbox or original firmware in flash.

Replacing the original firmware

If you are sure you don't need the original iriver firmware, you can replace it with Rockbox. Flashing Rockbox over the original firmware has several advantages:

• Faster boot time (with dircache usually about 3s improvement)
• Reduced RAM usage (if ROM image is used)
• Ability to use EEPROM memory for firmware settings
• Dircache & database hibernation (saves battery at startup)

To flash Rockbox you need to have the latest bootloader supporting Rockbox flash images. Updating the bootloader is explained in the previous section.

If this is the first time you are flashing Rockbox to the RAM image in your player, make a backup of the flash ROM contents first, this backup can be used to restore the original firmware later if desired. To do the backup, go to Info -> Debug -> Dump ROM contents. That creates a file, internal_rom_000000-1FFFFF.bin, containing a full image of the flash rom. After making a backup, you may continue.

You can decide if you want to load Rockbox to the RAM image (.rockbox / rockbox.iriver ); or to the ROM image ( .rockbox / rombox.iriver ) or have both of them in flash. The ROM image is run directly from flash ROM. The RAM image is loaded from ROM and executed in RAM. It's recommended to have the ROM image present, because it can be started using the reset button and the bootloader's reset cookie failsafe system.

• Set "Show Files" to "All".
• Get the latest "Current Build" and install it by executing "RoLo" (you must RoLo the new build or it will fail to flash).
• Through the Files entry in the Rockbox menu, navigate to the .rockbox directory, enter it and scroll down to rockbox.iriver
• Place cursor over rockbox.iriver and long press joystick, (navi), then select "Open with...".
• From the list of plugins, select iriver_flash and execute it.
• If the requirements are met, a confirmation message is displayed,
• Press PLAY to confirm, the firmware flashing starts, (rockbox now overwrites iriver firmware).
• If everything went fine, you should see, "Success" and the player will return to the file browser.
• Now you can commence using your Rockbox flashed player !.

Flashing with Rombox (ROM):

To upgrade the flash image in the future, you can follow the same procedure as described in this section.

Bootloader configuration.

Bootloader version 7-pre3(4) has an integrated failsafe menu system that can be used to configure the default boot sequence.

Once you have flashed your player, change the boot sequence to your preference as follows,

• Switch off your player, set the HOLD switch to 'ON',
• Switch on player, you will be presented with a boot menu,
• Set the HOLD switch to 'OFF', navigate to your choice, press record to enable it as default.
• Save your settings and exit

Firmware recovery

Should there ever be a problem preventing startup using the flashed firmware image, you can always invert the boot priority by pressing and holding down REC button before turning on player. That will cause Rockbox to load from disk if default behaviour was to load from flash and vice versa. Also with REC button it's possible to access the bootloader USB mode.

Restoring the original firmware

If you want to restore the original firmware, you can do so by using a file from either one of these methods:

• Convert an original firmware provided by iRiver from ihp_120.hex to ihp_120.bin
• Use an existing flash rom backup image file

To restore the flash contents of the firmware section (bootloader will be always kept untouched, however we need to re-flash the critical reset vector sector), open the file from either one of the previously mentioned methods by iriver_flash and the contents of the original firmware section will be restored from the file.

Issues with the bootloader

• When Rockbox is loaded from flash with the newest bootloader, a loud signal is emitted through the headphone/line-out connector if the player has been turned off for some hours. This lasts for a fraction of a second. When Rockbox is loaded from disk however, booting is silent. This probably affects certain players only. Early bootloaders for the h120 also showed this behaviour, but a fix for this was introduced in this commit.

IMPORTANT: Do NOT use mkboot or any instructions in IriverBoot to flash the bootloader using original firmware. The format used in bootloader.iriver is not compatible with bootloader.bin -format and doing that WILL brick your player. Use Rockbox plugin iriver_flash instead. It contains many safety measurements to prevent possible failures.

Note: the MD5 sum for the bootloader.iriver file is 01e1f9e812bb9811bfbba8fa3681ea15

• bootloader.iriver: H120/H140 bootloader, version 7-pre3

• bootloader_h120_7pre4.zip: H120/H140 bootloader, version 7-pre4 (Install the latest current build before flashing the new bootloader).

• bootloader_h100_7pre4.zip: H110/H115 bootloader, version 7-pre4