Damn Reboot using the shell

[hawhill]

I think that's the ATK, yes. I didn't check if it's the i.MX35 version, but you will notice when it's installed. It works using the USB connection, you've got to bring your Kindle into bootloader mode to connect. Nobody had success with any step further, however - hacking adventures before you. Since you are asking proficient questions it might not be fully out of scope for you, though. But you would need a good understanding on how a modern CPU/SoC works, what the exact role of a boot loader is and how to compile (for example) the Linux kernel for different targets.

Indeed, Yifanlu provided a great description on how to load a rescue kernel via serial console. It would work just the same on the K3, I think. Thanks for the link, I didn't stumble over that text yet. It's probably the easiest way out, since you know how to get to Uboot already. Also, this is an approach common to many embedded devices using uboot.

AFAIK, if the exporting would work, it should present you _all_ partitions of the Kindles flash storage. The basic layout (I don't have my K3 here right now) is as follows:
- partition 1: root file system, which is mounted read-only on normal Kindle use. Thus it should only break if you forget to bring it back into read-only mode...
- another partition for the user store, which is mounted to /mnt/base-us in normal use which is again mounted as /mnt/us (using a passthrough filesystem that's able to "cut" the bounds to the underlying file system when it needs to be accessed via USB)
- another partition for the kernel, I think
- another partition for bootloader "environment", i.e. configuration variables.

The latter don't carry filesystems. The root file system is ext2, I think, might also been ext3. The user store is VFAT.

[knc1]

Originally Posted by hawhill

- another partition for the user store, which is mounted to /mnt/base-us in normal use which is again mounted as /mnt/us (using a passthrough filesystem that's able to "cut" the bounds to the underlying file system when it needs to be accessed via USB)
- another partition for the kernel, I think
- another partition for bootloader "environment", i.e. configuration variables.

The latter don't carry filesystems. The root file system is ext2, I think, might also been ext3. The user store is VFAT.

As described in the kernel messages:

Originally Posted by Post 31

INFO:Partition table verified for /dev/mmcblk0
INFO:Checking for updates... (auto-pilot mode)
dev/mmcblk0p4:

- - - Finds media holding FAT file system image - - -
- - - The "offset" is to skip the reserved MBR / Partition area - - -

INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 8192

- - - A.K.A: USB Storage to user, /mnt/us to system once booted - - -

INFO:No update*.bin found; no update needed.

- - - That is one way to get out of this problem - - -
- - - See later messages cut from a different boot attempt - - -

and later:

Originally Posted by Post 33

kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: failed to identify filesystem /dev/root, trying all

- - - This will become "/" once system is booted - - -

kinit: Unable to mount root fs on device dev(179,1)

- - - Kernel should have panic'd here, can't run without a root filesystem - - -

Checking for init: /sbin/init
Checking for init: /bin/init
Checking for init: /etc/init
Checking for init: /sbin/init.sysvinit
Checking for init: /bin/sh
kinit: init not found!

- - - Actually a bit misleading previous error is the problem - - -
- - - No valid file system on /dev/mmcblk0p1 - - -
- - - Error when trying to re-load mmcblk0p1 likely cause - - -

Kernel panic - not syncing: Attempted to kill init!
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = cfab0000

The kernel initialization messages try their best to tell what is happening, but it still takes some experience to understand what they have to say.

If unable to put an update*.bin file on the user store to fix the main system image, then the next thing to try is to load over the serial port a kernel+initramfs that can run memory resident and re-load mmcblk0p1 with the root file system for you.

I am not sure if anyone has made such a serial port loadable image for the K3 - it will take YOU some research to learn if it exists.

[knc1]

As shown, that is a kernel+initramfs running memory resident.

We may have to tweak (or completely re-write) the initramfs scripting - -
We may have to add a MR_Dev public key for the "auto-pilot" mode update*.bin files - -

But there is the memory resident (rescue) kernel+initramfs that is known to run on the K3 talking to us.

[hawhill]

Ah, thank you for highlighting the relevant parts. That explains a lot. Yifanlu also created a "rescue kernel" before, I think he might have customized the initramfs in that case. The "update*.bin" path sounds great, but as you mentioned, it is blocked by being not affected by the jailbreak, so custom update*.bin files won't work. As you said, the MR_Dev public key would have to be added.

Good thing however is that this reminded me:
- Yifanlu already went through the creation of a custom rescue kernel.
- Such a kernel probably can be loaded via serial interface to uboot.

It's published here:
http://yifan.lu/2011/06/25/one-more-...-for-kindle-3/

Also, Seaniko7 has also created such a kernel (that also has kexec support, which is irrelevant for the problem at hand):
https://www.mobileread.com/forums/sho...75602&langid=2

[knc1]

I am taking the week off from wiki-editing, but will bookmark your post above and add those links to the index system next time around.
Unless someone else beats me to it.

[knc1]

For the purposes of this thread (with a working u-boot and a working kernel+initramfs) ....

In u-boot, add: rdinit=/bin/sh (or /bin/ash if that doesn't work) and then tell u-boot to continue the boot process.

That will give you a busybox ash shell rather than run the initramfs shell scripting.

Then you can "rescue and bring up" the system from the memory resident system that is known to run "by hand".

Ref:
http://www.linuxtopia.org/online_boo...tion/re63.html

[dasmoover]

I have a K3G on firmware 3.3. I can provide a simple dd img backup if you would like.

[knc1]

Originally Posted by wlaf

supermagically, I came to uboot! Maybe I've been pressing Enter at the right time.

You can let your computer "press enter" at the right time.

Here is a write-up (for RealTek media players) that you can adapt for the Kindle messages.
http://minimodding.com/tiki-index.php?page=SystemRescue

That one is windows, there is also a *nix version on the site using expect. Dig around a bit in the "HowTo" sections.

[knc1]

If this doesn't help (as u-boot entries in the kernel command line variables):
http://www.linuxtopia.org/online_boo...tion/ch10.html
Maybe this will help:

[wlaf]

Originally Posted by dasmoover

I have a K3G on firmware 3.3. I can provide a simple dd img backup if you would like.

I would be thankful if you send me link of a zipped version of the dd backup via PM. Any suggestions for a good dd backup, guys?

Btw, I found this page, that has great information about Kindle 3. The title of the post is:
"Kindle 3 Discovery Tour: Kernel Config, Processes, Programs, Modules, /proc, cpuinfo, dmesg, meminfo, mounts, fstab and other Inside Information (Firmware 3.1)"

http://linux-tipps.blogspot.com/2011...el-config.html

Originally Posted by knc1

For the purposes of this thread (with a working u-boot and a working kernel+initramfs) ....
In u-boot, add: rdinit=/bin/sh (or /bin/ash if that doesn't work) and then tell u-boot to continue the boot process.
That will give you a busybox ash shell rather than run the initramfs shell scripting.
Then you can "rescue and bring up" the system from the memory resident system that is known to run "by hand".

This is the first thing I should try. Working with bash is much easier than recompiling the kernel and changing boot scripts and transfering it to the device.

[knc1]

Originally Posted by wlaf

This is the first thing I should try. Working with bash is much easier than recompiling the kernel and changing boot scripts and transferring it to the device.

If you have never brought up a Linux system "by hand" - you will have questions, do not hesitate to ask.

If the rdinit=/bin/sh on the kernel command line (gotten there by adding it to one of the u-boot, command line variables) gets you a sh command shell...

The first thing you will need to do is:
mount -t proc proc /proc
mount -t sysfs sysfs /sys
Those two will need to be mounted because many commands/utilities need to be able to reference them.

You will also need /dev but that may be handled by your kernel internally, we can look around and see what is needed after doing the above.

Note: It is getting late in the day, early in the evening, in my time zone - this may have to wait until tomorrow (say 12 hours from now).

[geekmaster]

Originally Posted by dasmoover

I have a K3G on firmware 3.3. I can provide a simple dd img backup if you would like.

Forensic image pastebin from "simple debricking" thread now contains your K3 images. Thanks!

[wlaf]

The last time I was working with the kindle, I got kernel panic and I didn't have enough time to work on it until today. I didn't know if it consumes battery when getting "kernel panic" or not, so I attached the USB cable hoping that it will chare! After a while, at last, today I found a time to work on my kindle. Now I see that the device actually "consumes" battery when in the state of kernel panic. This is what I see:

[Critical Battery Lock-out Menu]
1. Skip
R. reboot
Choose: \
INFO:luigi_gadget_is_charging: read '1'
Charge: 2% [##::::::::::::::::::::::::::::::::::::::::::::::::::::::::]

And after connecting the USB and waiting for a while, it seems that the battery is charging:

[Critical Battery Lock-out Menu]
1. Skip
R. reboot
Choose: \
INFO:luigi_gadget_is_charging: read '1'
Charge: 3% [##::::::::::::::::::::::::::::::::::::::::::::::::::::::::]

After reaching 4%, it automaically booted:

[Critical Battery Lock-out Menu]
1. Skip
R. reboot
Choose: \
INFO:luigi_gadget_is_charging: read '1'

=== BATTERY HAS SUFFICIENT CHARGE (4%) ===
INFO:Partition table verified for /dev/mmcblk0
INFO:Checking for updates... (auto-pilot mode)

I'm waiting for a good charge status to start working. :-)

[wlaf]

For the purposes of this thread (with a working u-boot and a working kernel+initramfs) ....

In u-boot, add: rdinit=/bin/sh (or /bin/ash if that doesn't work) and then tell u-boot to continue the boot process.

That will give you a busybox ash shell rather than run the initramfs shell scripting.

Then you can "rescue and bring up" the system from the memory resident system that is known to run "by hand".

Using "setenv rdinit /bin/sh" I got:

uboot> setenv rdinit /bin/sh
uboot> boot

Checking for init: /sbin/init
Checking for init: /bin/init
Checking for init: /etc/init
Checking for init: /sbin/init.sysvinit
Checking for init: /bin/sh
kinit: init not found!
Kernel panic - not syncing: Attempted to kill init!

Using /bin/ash gives the same result. This is more complete output:

INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/100167 size=3282272256 bytes
flag type      first       last  lba first   lba size
Partition p1:
0x00 0x0b      24072 <large>          7688    6403000
    CHS: 376/0/9 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 3936256
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
  argc == 9
  argv[0]: "kinit"
  argv[1]: "console=ttymxc0,115200"
  argv[2]: "mem=256M"
  argv[3]: "panic=10"
  argv[4]: "root=/dev/mmcblk0p1"
  argv[5]: "ro"
  argv[6]: "ip=none"
  argv[7]: "quiet"
  argv[8]: "lpj=2555904"
Running ipconfig
  argc == 4
  argv[0]: "IP-Config"
  argv[1]: "-i"
  argv[2]: "Linux kinit"
  argv[3]: "ip=none"
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: failed to identify filesystem /dev/root, trying all
kinit: trying to mount /dev/root on /root with type ext3
kinit: trying to mount /dev/root on /root with type ext2
kinit: trying to mount /dev/root on /root with type cramfs
kinit: trying to mount /dev/root on /root with type msdos
kinit: trying to mount /dev/root on /root with type vfat
kinit: Unable to mount root fs on device dev(179,1)
Checking for init: /sbin/init
Checking for init: /bin/init
Checking for init: /etc/init
Checking for init: /sbin/init.sysvinit
Checking for init: /bin/sh
kinit: init not found!
Kernel panic - not syncing: Attempted to kill init!

My guess before testing was that this way won't work, because the problem is the partitions itself.

[wlaf]

I also could be able to connect via ATK:

Image Convert:


Flash tool:


But it don't work when the kindle is in kernel panic state. It says:

Connection error. Please reset the board and make sure the board in bootstrap mode

Download failed!