Montage is a linux/arm32 box (TI AM3352 w/ 256MB RAM if I remember right) with some nice custom DSP ASICs hanging off it. Separate from the 4GB wave flash, it also has 4GB of eMMC flash where the boot loader, (ancient) kernel, standard embedded linux user land, performances, arpeggios, etc. live.

At boot, the kernel unpacks an initramfs, whose init script (amongst other things) checks for the button combo for firmware upgrade. Without that, it mounts the normal root filesystem from flash, does the pivot_root() dance and execs the main init system. With the right combo held, it instead mounts the first USB drive, loopback mounts an ext2/3/4 image file named 8N70OS_.PGM onto /mnt/loop, and then runs /mnt/loop/update.sh. The loopback mount also contains a new image for the mmc flash: update.sh checks the SHA1 sum is correct before beginning to write the flash: corruption detected at this point is the red "NG" error some people get at the "Preparing..." stage with dodgy USB sticks.

That description tells you everything you need to know to launch your own code (such as a shell) on the Montage before it continues to boot, to pick apart firmware images, or to create your own modified firmware. However, hopefully it also explains why I'm not posting an explicit how-to. As you can see, the Montage needs to be able to launch the kernel and load the initramfs for you to be able to reflash it with a factory firmware image; corrupt those and you'll brick it hard enough that you'll need to JTAG to recover.

My answer would of been: "since I depend on this working in the future, I'm not going to post it here - find me on ideascale which has PM capabilities". And if I had unintentionally posted too much here (including that there was a possibility), I would have cleaned it up and posted something similar to the above after deleting.

However, hopefully it also explains why I'm not posting an explicit how-to.

Indeed. I'm having too much fun with my Montage to want to turn it into a brick. I can do my hacking on other machines.

Thanks for the interesting information, though.

Montage is a linux/arm32 box (TI AM3352 w/ 256MB RAM if I remember right) with some nice custom DSP ASICs hanging off it. Separate from the 4GB wave flash, it also has 4GB of eMMC flash where the boot loader, (ancient) kernel, standard embedded linux user land, performances, arpeggios, etc. live.

At boot, the kernel unpacks an initramfs, whose init script (amongst other things) checks for the button combo for firmware upgrade. Without that, it mounts the normal root filesystem from flash, does the pivot_root() dance and execs the main init system. With the right combo held, it instead mounts the first USB drive, loopback mounts an ext2/3/4 image file named 8N70OS_.PGM onto /mnt/loop, and then runs /mnt/loop/update.sh. The loopback mount also contains a new image for the mmc flash: update.sh checks the SHA1 sum is correct before beginning to write the flash: corruption detected at this point is the red "NG" error some people get at the "Preparing..." stage with dodgy USB sticks.

That description tells you everything you need to know to launch your own code (such as a shell) on the Montage before it continues to boot, to pick apart firmware images, or to create your own modified firmware. However, hopefully it also explains why I'm not posting an explicit how-to. As you can see, the Montage needs to be able to launch the kernel and load the initramfs for you to be able to reflash it with a factory firmware image; corrupt those and you'll brick it hard enough that you'll need to JTAG to recover.

Bravo! 😮