Alternate "Simple" debricking methods for K5-Touch, K4-Mini, & K3-Keyboard - Page 49

knc1 · 10-19-2012, 01:56 PM

Or that is stored in a locked section of the flash, and the code did not unlock it first.

eureka · 10-19-2012, 02:41 PM

Quote:

Originally Posted by adi23

Maybe have you missed something?

It could be so. But there are no more appropriate defines in bist U-Boot config to copy (as for me).

BTW, with U-Boot size about 80kb you're overwriting MMU table (which is located right after OCRAM). But it looks like in this case it's not dangerous at all.

eureka · 10-19-2012, 03:59 PM

Quote:

Originally Posted by adi23

Also, i could modify the custom u-boot again in order to load some data in memory, but i don't know exactly how should i do this, or what data should i load.

As you can access U-Boot through serial, you can try loadb command:

build bist U-boot (i.e. without TYPE=prod), but I think you should make clean beforehand if you've built ordinary U-Boot in the same directory previously
comment all mmc-related calls in function do_bist at file common/cmd_boot.c
add #define CONFIG_CMD_LOADB to include/configs/imx50_yoshi.h
build ordinary U-Boot (i.e. with TYPE=prod), but again don't forget make clean beforehand
load ordinary U-Boot and in serial console load bist U-Boot into memory with command loadb 0x79800000 (0x79800000 is the value of CONFIG_BISTADDR define)
issue command bist to run bist U-Boot loaded into memory (or bist fastboot to load straight into fastboot mode)

Again, I didn't try it, I've just read sources and googled a bit.

eureka · 10-19-2012, 04:13 PM

Quote:

Originally Posted by eureka

BTW, with U-Boot size about 80kb you're overwriting MMU table (which is located right after OCRAM). But it looks like in this case it's not dangerous at all.

Ha, imx_usb_loader spits out errors if u-boot.bin size goes beyond free OCRAM area. Also, 4kb of u-boot.bin takes not the U-Boot itself, but flash header or something.

Log of errors is here:

Spoiler:

It's just an observation, nothing more.

ixtab · 10-19-2012, 04:16 PM

FWIW, here's a compiled u-boot bist. It was compiled straight from the Amazon-published sources for the Kindle Touch (i.e., no bells and whistles, no custom modifications).

ixtab · 10-19-2012, 04:22 PM

Quote:

Originally Posted by eureka

Ha, imx_usb_loader spits out errors if u-boot.bin size goes beyond free OCRAM area. Also, 4kb of u-boot.bin takes not the U-Boot itself, but flash header or something.

I guess you meant to say: everything before offset 0x400 (that's 1 kB, not 4

). This is documented somewhere deep inside the manual... found it: it's section 6.6 (page 458).

eureka · 10-19-2012, 04:47 PM

Quote:

Originally Posted by ixtab

I guess you meant to say: everything before offset 0x400 (that's 1 kB, not 4

). This is documented somewhere deep inside the manual... found it: it's section 6.6 (page 458).

I was saying about log's content. Just look at it: there is successful loading of "file" with size 0x800 at address 0xf8006000 and then failed load of "file" with size 0x1290c at address 0xf8007000.

(There were no first or second file, it was the same file, just with two IVT)

Hmmm, OK, I was wrong, flash header takes 2 kb (0x800=2048). But anyway, second "file" (i.e. U-Boot itself) is loaded with offset of 0x1000 (4096) from start of free OCRAM area.

OK, 2kb is perfectly matching with that table 6-22 from Reference Manual: "eMMC" - "Initial image size: 2Kbyte"

All of it certainly isn't a big discovery, as flash_header.S is freely available for researching in board directory in U-Boot sources.

I've just lost control because of failed downloading of "big" U-Boot into OCRAM (does MfgTools really allow it?) and posted junk

eureka · 10-20-2012, 04:55 AM

With the help of hammer, chisel and pile of damns I've managed to make ordinary U-Boot that includes fastboot "server", automatically goes straight into fastboot mode on booting and could be loaded with imx_usb_loader. I've used Yifan Lu's fastboot client to get idme var and it worked. But I have no desire to overwrite my partitions now (to test flash command)

Note, that check command will not return real result (as crc32 checking function was removed to decrease file size).

Of course, I can't say for sure, whether it really does not require bist U-Boot, as I has no serial console access and can't check the log. So sorry for disappointment if it will not work as described.

Report me and I will delete attachment.

(Patch to original U-Boot source will be provided soon, if it really will work; just let me day or two to tidy up that mess of impulsive edits UPD: done.)

geekmaster · 10-20-2012, 09:07 AM

Quote:

Originally Posted by eureka

With the help of hammer, chisel and pile of damns I've managed to make oridinary U-Boot that includes fastboot "server", automatically goes straight into fastboot mode on booting and could be loaded with imx_usb_loader. I've used Yifan Lu's fastboot client to get idme var and it worked. And I have no desire to overwrite my partitions now

Note, that check command will not return real result (as crc32 checking function was removed to decrease file size).

Of course, I can't say for sure, whether it really does not require bist U-Boot, as I has no serial console access and can't check the log. So sorry for disappointment if it will not work as described.

Report me and I will delete attachment.

(Patch to original U-Boot source will be provided soon, if it really will work; just let me day or two to tidy up that mess of impulsive edits.)

That is effing awesome! I was dreaming about doing that "someday". It must have taken significant effort to add in the fastboot part of bist and then "condense" it down to just the essential parts to boot fastboot.

Thanks. This will certainly help those who erased their u-boot bist from mmc. I can't wait to test this out (but not now).

Be sure to put it in the Tools and K5 indexes...

Again, Thanks! Max karma to you for this post (when it will let me give you some again).

EDIT: I announced your tool in the simple debricking first post. I hope you do not mind hot pink.

EDIT2: I plan to replace the fastboot.bin in the MfgTool package in the Select Boot thread with this fastboot.bin, after I test it and make sure that it works correctly on both K4 and K5. Meanwhile, those who need it can do that themselves. But I prefer using the imx_usb_loader tool these days instead of MfgTool, so I can use only linux on my host PC.

ixtab · 10-20-2012, 09:27 AM

Quote:

Originally Posted by eureka

With the help of hammer, chisel and pile of damns I've managed to make oridinary U-Boot that includes fastboot "server", automatically goes straight into fastboot mode on booting and could be loaded with imx_usb_loader. I've used Yifan Lu's fastboot client to get idme var and it worked. And I have no desire to overwrite my partitions now

Note, that check command will not return real result (as crc32 checking function was removed to decrease file size).

Of course, I can't say for sure, whether it really does not require bist U-Boot, as I has no serial console access and can't check the log. So sorry for disappointment if it will not work as described.

Report me and I will delete attachment.

(Patch to original U-Boot source will be provided soon, if it really will work; just let me day or two to tidy up that mess of impulsive edits.)

GREAT!

I was trying to do that as well, but miserably failed

- good to see that you succeeded and got it to work... really interested in that diff.

geekmaster · 10-20-2012, 09:36 AM

I replaced fastboot.bin in my local copy of the Select Boot package with eureka's new fastboot.bin. MfgTool was able to start fastboot mode. The linux fastboot tool was able to do "sudo ./fastboot getvar serial" and it showed my kindle serial number.

I was not able (yet) to determine whether it was running fastboot protocol from eureka's u-boot, or if it loaded fastboot from the mmc (the old way). I suppose that I actually need to sacrifice a K5 (and a K4) by erasing mmc to properly test whether this new u-boot is up to the challenge of recovering a kindle in such a sorry state of affairs.

Also, we need to test other functions in the new fastboot.bin, to make sure that it flashes the correct locations and lengths in the mmc.

EDIT: Even with a few spare K4 and K5 demo kindles, I am (more than) hesitant to erase the mmc in them.

geekmaster · 10-20-2012, 09:46 AM

This PM really needs to be public, so it can help others, and so that others can help:

Quote:

Originally Posted by adi23

Quote:

Originally Posted by geekmaster

Quote:

Originally Posted by adi23

Quote:

Originally Posted by geekmaster

Here is an image of the first 32MB of my K5 (firmware 5.0.4):
http://www.mediafire.com/?pv5s2v33ssu2ucv

At various offsets and lengths, it contains uboot and uboot-bist, and the main and diags kernels.

I suppose you could just flash the whole thing starting at offset zero (with dd), but it could potentially zero your idme vars, so be sure to rewrite them with idme before rebooting...

Or better, figure out the length and offset to the uboot-bist portion and just flash that. Be sure to read ixtab's README for flashing diags+ssh (including diags kernel) using dd instead of fastboot. Adapt for uboot offset and length instead of the kernel shown in his example...

This is my last mail received from you. I had my message box full.

I don't think i can flash through ssh becouse it's not installed. I have posted more details on Simple debricking method for K5-Touch, K4-Mini, & K3-Keyboard thread.

There is now a u-boot (non-bist) that can be loaded with MfgTool or the new command-line usb downloader tool, which has fastboot built-in. Awesome! You can thank eureka for that.

Yes i have already tryed and it works to fastboot

(i will post later to thanks eureka

) i have flashed both kernels and partition main and diags. Now i am able to enter diags and linux promt, but the main still have some errors. When i boott to main i receive :

kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: Mounted root (ext3 filesystem) readonly.
EXT3-fs error (device mmcblk0p1): ext3_lookup: deleted inode referenced: 7132
/sbin/init.exe: error while loading shared libraries: libdbus-1.so.3: cannot open shared object file: Input/output error
Kernel panic - not syncing: Attempted to kill init!

Did you flash main from diags ssh with dd? If you used fastboot, it did not write the complete main partition... fastboot has a size limit and quits early while falsely reporting "success"... Use dd instead.

eureka · 10-20-2012, 09:54 AM

Quote:

Originally Posted by geekmaster

I was not able (yet) to determine whether it was running fastboot protocol from eureka's u-boot, or from if it loaded fastboot from the mmc (the old way). I suppose that I actually need to sacrifice a K5 (and a K4) by erasing mmc to properly test whether this new u-boot is up to the challenge of recovering a kindle in such a sorry state of affairs.

If you have KT with access to serial console then comparison of logs of loading process of "my" fastboot.bin and "your" fastboot.bin can also throw some light on this question.

geekmaster · 10-20-2012, 10:02 AM

Another PM relevant to this thread:

Quote:

Originally Posted by adi23

Quote:

Originally Posted by geekmaster

Did you flash main from diags ssh with dd? If you used fastboot, it did not write the complete main partition... fastboot has a size limit and quits early while falsely reporting "success"... Use dd instead.

Yes, i used the fastboot to flash it (forgot that it has a limit) now i just need to search how i do the flash with ssh (never used ssh)

Please continue this in the simple debricking thread. I am copying these posts there. This discussion can help others, and others can help here too.

NOTE: It appears that eureka's standalone fastboot actually did work, and adi23 is close to debricking his "erased mmc" K5 (after he flashes main with dd instead of fastboot).

eureka · 10-20-2012, 10:49 AM

Quote:

Originally Posted by eureka

(Patch to original U-Boot source will be provided soon, if it really will work; just let me day or two to tidy up that mess of impulsive edits.)

Quote:

Originally Posted by geekmaster

It appears that eureka's standalone fastboot actually did work, and adi23 is close to debricking his "erased mmc" K5 (after he flashes main with dd instead of fastboot).

OK, as it works and diff of changes isn't so big as I've imagined it, I post diff [to unpacked uboot_2009.08.tar.gz from Kindle_src_5.1.2_1679530004.tar.gz] as promised (I didn't clean it, though):

Spoiler:

PHP Code:


			
diff -ur uboot/board/imx50_yoshi/config.mk uboot_fastboot/board/imx50_yoshi/config.mk

--- uboot/board/imx50_yoshi/config.mk    2010-11-30 23:30:43.000000000 +0000

+++ uboot_fastboot/board/imx50_yoshi/config.mk    2012-10-20 08:23:07.000000000 +0000

@@ -1,7 +1,7 @@

 ifeq ($(TYPE),prod)

 LDSCRIPT := $(SRCTREE)/board/$(VENDOR)/$(BOARD)/u-boot.lds

 

-TEXT_BASE = 0xF8007000

+TEXT_BASE = 0xF8006000

 else

 LDSCRIPT := $(SRCTREE)/board/$(VENDOR)/$(BOARD)/bist.lds

 

diff -ur uboot/board/imx50_yoshi/imx50_yoshi.c uboot_fastboot/board/imx50_yoshi/imx50_yoshi.c

--- uboot/board/imx50_yoshi/imx50_yoshi.c    2012-03-13 23:53:41.000000000 +0000

+++ uboot_fastboot/board/imx50_yoshi/imx50_yoshi.c    2012-10-19 18:42:52.000000000 +0000

@@ -889,6 +889,10 @@

     char boot_mode[20];

     char boot_cmd[20];

 

+    setenv("bootcmd", "fastboot");

+

+    return 0;

+

 #ifdef CONFIG_BIST

     setenv("bootdelay", "-1");

 #endif

diff -ur uboot/common/cmd_bootm.c uboot_fastboot/common/cmd_bootm.c

--- uboot/common/cmd_bootm.c    2012-03-14 17:14:22.000000000 +0000

+++ uboot_fastboot/common/cmd_bootm.c    2012-10-19 20:24:16.000000000 +0000

@@ -102,7 +102,7 @@

 typedef int boot_os_fn (int flag, int argc, char *argv[],

             bootm_headers_t *images); /* pointers to os/initrd/fdt */

 

-#define CONFIG_BOOTM_LINUX 1

+//#define CONFIG_BOOTM_LINUX 1

 //#define CONFIG_BOOTM_NETBSD 1

 //#define CONFIG_BOOTM_RTEMS 1

 

diff -ur uboot/drivers/usb/gadget/fastboot.c uboot_fastboot/drivers/usb/gadget/fastboot.c

--- uboot/drivers/usb/gadget/fastboot.c    2012-03-14 17:14:22.000000000 +0000

+++ uboot_fastboot/drivers/usb/gadget/fastboot.c    2012-10-19 17:41:45.000000000 +0000

@@ -630,7 +630,7 @@

 extern void board_reset(void);

 extern void board_power_off(void);

 extern unsigned int get_dram_size(void);

-extern int mmc_crc32_test (uint part, uint start, int size, uint crc);

+/*extern int mmc_crc32_test (uint part, uint start, int size, uint crc);*/

 extern int do_pass (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]);

 extern int do_fail (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]);

 

@@ -1030,10 +1030,10 @@

         src = (unsigned char *) strtok(NULL, " \0"); // get crc

         crc = (uint)simple_strtoul((char *)src, NULL, 16);

 

-        if (mmc_crc32_test(part_index, start, size, crc)) {

+        /*if (mmc_crc32_test(part_index, start, size, crc)) {

             fastboot_send_reply("FAILcrc failure");

             goto out;

-        }

+        }*/

 

         fastboot_send_reply("OKAY");

     }

diff -ur uboot/include/configs/imx50_yoshi.h uboot_fastboot/include/configs/imx50_yoshi.h

--- uboot/include/configs/imx50_yoshi.h    2012-03-14 17:14:23.000000000 +0000

+++ uboot_fastboot/include/configs/imx50_yoshi.h    2012-10-20 14:39:38.000000000 +0000

@@ -41,8 +41,8 @@

 #define CONFIG_SYS_AXIA_PODF    0

 #define CONFIG_SYS_AXIB_PODF    1

 

-#define CONFIG_DISPLAY_CPUINFO

-#define CONFIG_DISPLAY_BOARDINFO

+//#define CONFIG_DISPLAY_CPUINFO

+//#define CONFIG_DISPLAY_BOARDINFO

 

 #define CONFIG_SYS_64BIT_VSPRINTF

 

@@ -107,6 +107,23 @@

 #define CONFIG_BOOT_PARTITION_ACCESS

 #define CONFIG_BOOT_FROM_PARTITION    1

 

+#define CONFIG_MMC_MAX_TRANSFER_SIZE    (0xFFFF * 512)

+/*

+ * USB Configs

+ */

+#define CONFIG_USB_DEVICE        1

+#define CONFIG_DRIVER_FSLUSB        1

+#define CONFIG_GADGET_FASTBOOT        1

+

+#define CONFIG_USBD_MANUFACTURER "Amazon"

+#define CONFIG_USBD_PRODUCT_NAME "Kindle"

+

+#define CONFIG_USBD_VENDORID            0x1949

+#define CONFIG_USBD_PRODUCTID_FASTBOOT        0xd0d0

+#define CONFIG_FASTBOOT_MAX_DOWNLOAD_LEN    ((get_dram_size()) - (2*1024*1024) - (CONFIG_FASTBOOT_TEMP_BUFFER - CONFIG_SYS_SDRAM_BASE))

+#define CONFIG_FASTBOOT_TEMP_BUFFER        0x7A000000

+#define CONFIG_CMD_GADGET 1

+

 #define CONFIG_BOOT_HALT_VOLTAGE    3400    /* 3.4V */

 #define CONFIG_BOOT_CONTINUE_VOLTAGE    3600    /* 3.6V */    

 #define CONFIG_BOOT_AUTOCHG_VOLTAGE    3800    /* 3.8V */    

@@ -121,15 +138,15 @@

  * Command definition

  ***********************************************************/

 

-#define CONFIG_CMD_BOOTD    /* bootd            */

-#define CONFIG_CMD_RUN        /* run command in env variable    */

-#define CONFIG_CMD_LOG

+//#define CONFIG_CMD_BOOTD    /* bootd            */

+//#define CONFIG_CMD_RUN        /* run command in env variable    */

+//#define CONFIG_CMD_LOG

 

 /* Lab 126 cmds */

-#define CONFIG_CMD_BIST        1

-#define CONFIG_CMD_PMIC        1

+//#define CONFIG_CMD_BIST        1

+//#define CONFIG_CMD_PMIC        1

 #define CONFIG_CMD_IDME        1

-#define CONFIG_CMD_HALT        1

+//#define CONFIG_CMD_HALT        1

 

 #define CONFIG_IDME_UPDATE        1

 #define CONFIG_IDME_UPDATE_ADDR        0x3f000

@@ -190,7 +207,7 @@

 #define CONFIG_WDOG_PRINTK_SIZE        (4096 * 2)

 #define CONFIG_SYS_MEMTEST_END      (PHYS_SDRAM_1 + get_dram_size() - 1 - CONFIG_WDOG_PRINTK_SIZE)

 

-#define CONFIG_LOGBUFFER

+//#define CONFIG_LOGBUFFER

 

 #define CONFIG_POST         (CONFIG_SYS_POST_MEMORY | \

                              CONFIG_SYS_POST_FAIL)

@@ -201,7 +218,7 @@

 

 #define CONFIG_SYS_HZ                1000

 

-#define CONFIG_CMDLINE_EDITING    1

+//#define CONFIG_CMDLINE_EDITING    1

 

 /*-----------------------------------------------------------------------

  * Physical Memory Map

10-19-2012, 01:56 PM	#721
knc1 Embedded Cheerleader Posts: 4,098 Karma: 3854695 Join Date: Feb 2012 Device: Intel 4004	Or that is stored in a locked section of the flash, and the code did not unlock it first. __________________ "Hack is just a four letter word." - - With apologies to B. Dylan

10-20-2012, 09:36 AM	#731
geekmaster Всё гениальное просто. Posts: 5,022 Karma: 6352591 Join Date: Nov 2011 Location: Щедрость не имеет пределов. Device: .	I replaced fastboot.bin in my local copy of the Select Boot package with eureka's new fastboot.bin. MfgTool was able to start fastboot mode. The linux fastboot tool was able to do "sudo ./fastboot getvar serial" and it showed my kindle serial number. I was not able (yet) to determine whether it was running fastboot protocol from eureka's u-boot, or if it loaded fastboot from the mmc (the old way). I suppose that I actually need to sacrifice a K5 (and a K4) by erasing mmc to properly test whether this new u-boot is up to the challenge of recovering a kindle in such a sorry state of affairs. Also, we need to test other functions in the new fastboot.bin, to make sure that it flashes the correct locations and lengths in the mmc. EDIT: Even with a few spare K4 and K5 demo kindles, I am (more than) hesitant to erase the mmc in them. __________________ This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. Last edited by geekmaster; 10-20-2012 at 09:58 AM.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
K5 [Kindle touch]help, debricking , can't enter diags mode	zklcy	Kindle Developer's Corner	26	10-24-2012 09:47 AM
Help to Unbrick KT with simple debrick Method.	Loko_bielsa	Kindle Developer's Corner	2	07-16-2012 07:26 AM
I have some questions about K4 touch debricking	drjonvargas	Kindle Developer's Corner	4	04-22-2012 03:46 PM
kindle touch simple debricking for help	non_fox	Amazon Kindle	4	04-18-2012 08:32 PM
Troubleshooting simple kindle touch (and k4nt) debricking method	geekmaster	Amazon Kindle	0	03-02-2012 10:31 PM


Advertisement Enthusiast