UART Boot Mod

About

The UART boot mod is a method to access and rescue your Archos (Player/ Studio, Recorder, FM Recorder, Recorder V2, Ondio 128/ 128 FM/ 128 SP) even if the flash content is completely garbled. It requires to open up your box and do some soldering to it. It also requires some additional hardware.

*Warning*: You should only attempt this if you are familiar with electronics. The authors take no responsibility for any damage you may cause to your box.

Theory

Archos boot sequence

There are two different ways an Archos boots, depending on whether it has a separate boot ROM (inside the CPU) or not. The majority of Archoses has a separate boot ROM, and btw. all Archoses with boot ROM found "in the wild" use an identical one.

Archos with boot ROM

1. Boot ROM (inside the CPU)
2. Code from the serial interface, if in a special mode, else:
3. Flash ROM bootloader (copied into IRAM for execution)
4. Flash ROM software image (copied into DRAM for execution)
5. .ajz image on harddisk

Archos without boot ROM (ROMless)

1. Flash ROM bootloader (copied into IRAM for execution)
2. Flash ROM software image (copied into DRAM for execution)
3. .ajz image on harddisk

Note: This means that you are out of luck with a ROMless Archos if the flash content is completely garbled, as there is no way to gain access to it. However, if you tried first-time flashing rockbox and it crashed, with a bit of luck, the first few thousand bytes were already written. If so, minimon (see below) should be available from flash.

Booting Archos over the serial

So, before the Flash ROM is used for the first time, the box may already receive code from a serial interface. This allows to intercept and "work" with the box even if the Flash is garbled.

The "uart_boot" program is a rescue tool, allowing to download a monitor program (minimon) into the box and communicating with it. The monitor can in principle do anything. The uart_boot PC client is specialized mainly to read and write the flash content, but it can also download another program (e.g. Rockbox) and start it.

Not all boxes have a boot ROM, some start directly from flash. The rockbox flash bootloader contains minimon, since otherwise there would be no way to load it. You can check under Rockbox with Info -> Debug -> View HW Info. If it shows a ROM CRC value, you have a boot ROM. If it says "none", you don't have this safety feature. But "uart_boot" is still the application to use the flash loader built-in version of minimon.

Hardware hookup

You'll need two things: serial communication, and a way to cause the boot ROM to enter the special mode if you don't/ can't use minimon from a rockbox flash image.

The first thing requires to do the serial mod or an equivalent of it. You will also need a level converter, converting the +/- 12 V of a standard RS232 interface to the 0/ +3.3 V needed by the Archos (note the inverter function). This is something that low-level hackers have in their drawer, but else a bit difficult to get resp. recognize. Many mobile phone adapters should have what you need, you just don't know where to cut and tap it.

The archos boot ROM switches the LCD lines to input on boot, and then checks the input level. They're normally pulled high by pullup resistors, you need to pull 3 of them low (PB1..PB3) to cause the boot ROM to enter the special mode and start waiting for code from the serial interface.

There are two methods to achieve this:

1. If the LCD line pullups are present as one resistor array, it is relatively simple. Cut away the common end of the array from Vcc, and connect it to a switch that allows to connect the common end to either Vcc or ground.
2. If the LCD line pullups are single resistors (player/Studio), the only feasible method is to pull down "against" the fixed pullup resistors. This method should also include a way to switch off the pulldown, at least if you want to be able to use the LCD after UART booting. Because the pulldown resistors have to be relatively small, the CPU outputs are not strong enough to force the port pins high against the pulldown resistors.

Doing the mod

Player/ Studio

First, you need to open up the Archos and take apart the elecronics. On the main board, there is a convenient header carrying all the signals needed for UART boot:

I chose not to do the serial mod separately, but connect all needed pads to one 5-pin ribbon cable:

The first two pins of the ribbon (TxD and RxD) cable were connected to the level converter. I needed a method to select pullup or pulldown for thhe other three pins (PB1..PB3). In order to pull down against the builtin 10 kOhm pullup resistors, I chose 1 kOhm resistors. I connected the 3 pins to a cheap DIL IC socket, and a set of three resistors to the ground wire. This way I could select between pulldown and pullup by plugging/ unplugging the resistors to the IC socket.

You can see the resistors and the DIL socket at the bottom. The SUB-D9 plug at the top left contains the level converter.

JensArnold

Recorder V1

The heart of the mod for a Recorder V1	A detail

FM Recorder / Recorder V2

For FM PCB revision 2.1 (and maybe others as well), you find the serial at a kind of empty 2*3 header position close to the headphone jack. RX is the square pad, TX is across. The 4*10k pullup array which you temporarily have to change into a pulldown is right below the flash chip.

Ondio

The serial port is used to communicate to with the MMC. So I've made an adapter, a MMC dummy from a piece of striped prototyping PCB. Nice non-intrusive interfacing.

We still have to bring the unit into boot mode, which does require to open it. This time I didn't bother to patch the pullup resistor array (it is located between the two boards, close to the top), but made a "universal" (good for all recorders, too) LCD replacement from a broken display.

Serial adapter	LCD replacement to force boot mode (good for all recorders, too)

Operation

There is a somewhat user-friendly tool to perform an UART boot - uart_boot. It's in cvs and it is currently implemented for Windows only, but it shouldn't be hard to port it to Linux or another OS.

Here's the basic order of steps:

1. Connect everything ready to power up. It might be a good idea to power the Archos from a lab power supply, but that isn't required.
2. Put the pullup/ pulldown circuitry in the pulldown position
3. Power up the archos and the converter. It seems like it's best to power up both at the same time. If you power up the converter before the Archos, the Archos may get 'wild' voltage through the converter, and if powering up the converter later, this may cause a glitch at the Archos serial port. Both effects may lead to non-working communication later. You may need to experiment a bit.
4. Wait some seconds to make sure the bootrom has checked the LCD lines
5. Put the pullup/ pulldown circuitry back to normal pullup
6. Load minimon and perform your tasks with uart_boot

When using minimon from flash, you only need to perform the last step, and you need to tell uart_boot not to load minimon again as it's already there.

Some hints for using uart_boot:

uart_boot prints its usage information to the shell when called without parameters. One important point is the -r (-recorder) switch. This switch determines the usable serial bitrate, and it depends on the Archos CPU clock. The important point is that an Ondio counts as a 'player' here. Simple rules:

• For Player/ Studio and Ondio, do not use -r. Bitrate is 14400 bps.
• For Recorder / FM Recorder / Recorder V2, use -r. Bitrate is 115200 bps.

Be prepared that especially the player operation is really slow. It is technically possible to use 38400 bps with the player, but that's somewhat more advanced stuff...