<DOWNLOADS>

Bootloader

The purpose of this page is to provide introduction to the way to get into completely"dead" PRS-500 and PRS-505 Readers and collect links to original efforts (to get an idea where to read and whom to ask) and useful tech files. My contribution is minimal, I tried this method myself on PRS-500 reader (on the operational reader, just to test the method). On this page you will find the links and detailed description of my experience. If you are not familiar with the discussed problems, please ask your questions in the-ebook.org or mobileread.com forums.

At the bottom of this page you will find also dumps of NOR and NAND flashes of operational (russified) PRS-500 and PRS-505 in case somebody will need some part for it.

This is the "last resort" way to unbrick the device, before try please be sure that other methods (e.g. method of "10 resets" or console mode) do not work and ask experts in the forums for help.

The story (as per 01/08/09).

From the very moment it was known that main processor has 2 "hardware" ways to access internal registers and therefore to get a possibility to modify content of the memory. They are JTAG and bootstrap. Location of JTAG or boot pins were unknown untill service manuals for 500 and 505 became available.

As far as I know there were several successful attempts to unbrick the readers with both bootstrap (wenjie, his post) and JTAG/bootloader (root, his post and discussion form here) (to my current knowledge, sorry if I missed something or somebody). All the following is a result of kind help of root (see discussion). He has used code of wenjie and has compiled the uboot.bin bootloader (latest version v3). I made b-records of his uboot.bin, used b-records for initialization from wenjie's project and added some more b-records built from wenjie's C code. Links to the mentioned projects can be found in the discussion. The bootloader is named and shows itself as "505" but it perfectly works for 500 as well.

So now it is possible just upload the b-record files to the Reader and get running bootloader program which provides set of commands and drivers to operate with the Reader. Note, with the bootloader neither part of original PRS-50X code is used, it means the Reader can be restored virtually from any possible damage of the firmware. Uploading the bootloader is safe, because its located in RAM, but executing the commands requires special attention, because any part of the firmware can be modified without warning.

Principle of operation, from MC9328MXLRM.pdf processor manual:

The main processor have 4 pins (boot pins) which determines from where to load the program. In the original PRS configuration they are set to 0101 which means boot from CS0 space. There is special combination 0000 (bootstrap); when this combination is set, UART of the main processor is ready to accept so called b-records. With the b-records one can access internal registers and internal memory of the processor. In this mode baud rate is set automatically based on the serial communication attempt. To run uboot bootloader program we need access to the RAM where uboot will be uploaded and some more "hardware" settings. This is done with b-records accessing internal registers of the processor. This b-records are in the "init.txt" file. After we have access to RAM, we just upload uboot itself to 0x09000000 address of RAM (in b-record format) and execute it from this address ("uboot.txt" file). After successful run of the uboot there will be serial communication with the device and set of uboot commands can be executed, uboot has a code to access all types of the memories (RAM and NOR, NAND flashes). In the following instruction all init files are cobined with the u-boot (u-boot_v2.txt).

The steps are (see tools at the bottom of this page):

1. Wire UART to PC (as described here PRS-500, PRS-505)
2. Ground boot pins via 1-10k resistors. Here are corresponding pictures (part of original) from PRS-500 and PRS-505 service manuals:

3. Using hyperterminal program (Windows) or similar set communication parameters to 57600 8-n-1, control flow :none.
4. Push reset button on the Reader board
5. Power the reader with power switch. Yellow LED will blink.
6. Click "Call"-"Call" ( for hyperterminal program of Windows)
7. You will see nothing until you press "a" or "A". If bootstrap successful you will see colon ":" in response.
8. Click "Transfer"-"Send Text File" and browse to the "u-boot_v3.txt" file. You will see echoing of the content of this file. Transfer takes 10-15 min.


 

Update:

01/12/09. root modified bootloader to v3 which supports upload of kernel (also provided by root), please see discussion (in Russian) for successful application of this method to PRS505:

Tools:

Dumps:

PRS-500:
a) NOR flash (mtd0) (~1 MB)
b) NAND flash (mtd2) (~20MB!)

PRS-505
a) NOR flash (mtd0) (~1 MB)
b) NAND flash (mtd2) (80 MB!)

Bootstrap/bootloader: u-boot_v3.txt

kernel for 505 kernel for 505 which can be uploaded and executed with bootloader v3

Autorun Script to get content of the flash (from operational Reader), use 1Gb card, because mtd2 is huge.

 

 

 

 

: