Aura Help unbricking Aura

[mikeash]

Help me, Obi Wan, you're my only hope!

I bought a Kobo Aura with the intention of installing XCSoar on it. I gather this is not a very good choice of device since it doesn't have an internal SD card, but, too late for that now.

XCSoar installed fine. I added wires for the onboard serial port and connected a GPS unit. All good. Then I heard about Top Hat Soaring and decided to give it a try. Bad idea. After attempting to install Top Hat, the device won't boot.

I've tried the factory reset procedure about six hundred times. Turn off, turn on while holding the light button. No dice.

I'm able to boot it from an SD card, which is interesting. I couldn't find a suitable image for the card. I did dig one up for the H2O and wrote that to a card. Apparently this is close enough to sort of work. It boots into what looks like it may be the language chooser from the initial setup screen, except it's white text on a black background and very difficult to read. It's also unresponsive to touch. No surprise considering it's the wrong software.

Using the wires I soldered to the onboard serial port intended for the GPS module, I'm able to connect using a USB serial adapter on my computer and inspect what's going on. Interestingly, with the H2O image on there, I can actually log in as root and mess around with the device that way. If I leave the SD card out and boot from internal storage, it doesn't get very far, and just prints:

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[PROGRESS_BAR-2857] No progess ...

Then it hangs forever.

It looks like, to my uneducated and ignorant eye, like it would work if I could get a proper image to write to the SD card. I don't think this would fix the internal storage so I'd have to boot off the SD card forever, but that would be totally fine. Or maybe there's another way forward.

Does anyone happen to have a firmware image for this device that I could borrow? I've looked everywhere and found various things for other devices, but not the Aura. Lots of stuff for the Aura H2O and Aura HD! Alternatively, does anyone have any other ideas for stuff I might be able to try to recover this device? I'd even be happy to install Android on the thing and go from there, except I couldn't dig up any Android images for the Aura either!

Many thanks in advance.

[davidfor]

Sorry, but I don't know of an image suitable for the Aura. The images you see for the other devices were created by someone opening the device, taking the internal SD card out and making an image from that. As this can't be done for the Aura, no image has been made.

As you do have access to the console when booted from the external card, do you have access to the internal memory? If so, you might be able to write the uboot and uimage files to it. These are in the firmware packages. Or, if it is accessible, there are copies in the recoveryfs partition. These might be better to use as they are the original versions used when the device was first created.

The image commands to use are in "etc/init.d/upgrade-generic.sh". During a firmware upgrade, this is called by "etc/init.d/upgrade-wifi.sh" which is what determines the names of the image files to use. There are equivalents to these in the recoveryfs. They are probably the same name, but I don't have the files with me to check.

[mikeash]

I was afraid that might be the case.

I don't think I have access to the internal memory, but I'm not completely sure where to look. I've trawled the contents of /dev and not seen anything that looks likely. "fdisk -l" just shows me the SD card. There is /mnt/onboard but it looks like that's just a partition of the SD card. Is there any other place I might look, or some magic incantation that might cause the OS to start talking to the internal storage?

[frostschutz]

It would be /dev/mmcblk0. Also check /proc/partitions.

I don't know XCSoar so I have no clue what kind of modifications it makes. But anyone with a working Aura and telnet access could provide you with an image.

You might be able to repair it using only the files you find in a firmware update download. But it would be an experiment; I'm not sure how you manage to boot from the external card, and whether you could lose that ability by overwriting the internal memory and hope it would boot...

[mikeash]

/dev/mmcblk0 is the SD card. /proc/partitions just lists mmcblk0 and partitions on it. It's weird! I can boot from the SD card simply by having the SD card inserted when booting the device. It's like how old PCs would automatically boot from the floppy drive if you had a bootable floppy inserted. Unlike those old PCs, it appears to block access to the internal storage, unless there's some obscure place I'm missing. I gather I'm in new territory with all this.

[frostschutz]

Mh, could be the soldered-in memory needs a slightly different storage driver, which may not be included in the whatever you're booting there. Thus the internal storage would be invisible. Basically it's not mounted neither, so 'mount' just lists sd card stuff, yes? OTOH it does not make sense since according to the direct firmware download, H2O and Aura are family, use same firmware and same kernel.

So - no idea what's going on there. Unless it is, after all, the internal storage you're seeing. Does the system crash when you take out the SD card and then do something like, uh, `find /` or `cat /dev/mmcblk0 > /dev/null`? or whatever?

With/out access to the internal storage there is not much you can do.

Can you post the output of this script?

#!/bin/sh
set -x
mmc_detect() {
    local error=1
    for driver in /sys/bus/platform/drivers/*/unbind
    do
        driver=$(dirname "$driver")
        for device in "$driver"/*/
        do
            if [ -e "$device"/mmc_host/mmc${1:-0} ]
            then
                MMC_DRIVER="$driver"
                MMC_DEVICE=$(basename "$device")
                error=0
            fi
        done
    done

    return $error
}
mmc_detect
echo $MMC_DRIVER $MMC_DEVICE

(This is part of my Magic Memory Upgrade mod)

----

Also I tried to boot from the ext. SD slot on the H2O to no avail. If this can be done somehow, it's not an [entirely] automatic process. Simply putting the int. card in the ext. slot does not do the trick. Putting an empty/zeroed card in the int. slot does not change anything either. My guess is it would at least need U-Boot and somehow make U-Boot detect it needs to run the ext. SD card instead the internal one.

----

Also, the output of `hexdump -C -s 512 -n 64 /dev/mmcblk0`?

It should show a serial number. If it starts with N250 it should be a H2O image you're seeing. Maybe just changing that to something Aura (not sure which number it uses) would somehow make it operate in Aura mode.

[mikeash]

Interesting idea on the storage driver. That would probably be compiled into the kernel, right? Could it be that whatever differences exist between the H2O and the Aura are restricted to the kernel, and the updates somehow discriminate that way?

Yes, mount just shows the SD card, and stuff like proc and tmpfs. No sign of the internal storage anywhere in there or in /dev. I even tried making dev nodes for every block device listed in /proc/devices in case one of them might somehow be it, but no dice.

If I remove the SD card while the unit is on and then do `find /` it gives me a ton of errors like:

mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0

On the other hand, some stuff seems to work. Hmm! I think some of it might just be cached files. But with the card ejected, the first 16kB of the device is still readable. I don't know what to make of that.

[root@(none) ~]# dd if=/dev/mmcblk0 bs=1|wc
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 32
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 33
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 34
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 35
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 36
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 37
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 38
mmcblk0: error -110 sending status comand
mmcblk0: error -110 sending read/write command, response 0x0, card status 0x0
end_request: I/O error, dev mmcblk0, sector 39
Buffer I/O error on device mmcblk0, logical block 4
dd: /dev/mmcblk0: Input/output error
      113       413     16384

Maybe that's just some sort of caching too?

Running your script produces:

+ mmc_detect
+ local error=1
+ dirname /sys/bus/platform/drivers/arm-pmu/unbind
+ driver=/sys/bus/platform/drivers/arm-pmu
+ [ -e /sys/bus/platform/drivers/arm-pmu/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/busfreq/unbind
+ driver=/sys/bus/platform/drivers/busfreq
+ [ -e /sys/bus/platform/drivers/busfreq/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/fsl-ehci/unbind
+ driver=/sys/bus/platform/drivers/fsl-ehci
+ [ -e /sys/bus/platform/drivers/fsl-ehci/fsl-ehci.0//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/fsl-ehci/fsl-ehci.1//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/gpio-keys/unbind
+ driver=/sys/bus/platform/drivers/gpio-keys
+ [ -e /sys/bus/platform/drivers/gpio-keys/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/ltc3589-regulator/unbind
+ driver=/sys/bus/platform/drivers/ltc3589-regulator
+ [ -e /sys/bus/platform/drivers/ltc3589-regulator/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/max17135-reg/unbind
+ driver=/sys/bus/platform/drivers/max17135-reg
+ [ -e /sys/bus/platform/drivers/max17135-reg/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/max17135_sensor/unbind
+ driver=/sys/bus/platform/drivers/max17135_sensor
+ [ -e /sys/bus/platform/drivers/max17135_sensor/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mc13892-regulatr/unbind
+ driver=/sys/bus/platform/drivers/mc13892-regulatr
+ [ -e /sys/bus/platform/drivers/mc13892-regulatr/mc13892-regulatr.0//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mx51_lpmode/unbind
+ driver=/sys/bus/platform/drivers/mx51_lpmode
+ [ -e /sys/bus/platform/drivers/mx51_lpmode/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mx5_pm/unbind
+ driver=/sys/bus/platform/drivers/mx5_pm
+ [ -e /sys/bus/platform/drivers/mx5_pm/mx5_pm.0//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc-pxp/unbind
+ driver=/sys/bus/platform/drivers/mxc-pxp
+ [ -e /sys/bus/platform/drivers/mxc-pxp/mxc-pxp//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_dvfs_core/unbind
+ driver=/sys/bus/platform/drivers/mxc_dvfs_core
+ [ -e /sys/bus/platform/drivers/mxc_dvfs_core/mxc_dvfs_core.0//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_dvfsper/unbind
+ driver=/sys/bus/platform/drivers/mxc_dvfsper
+ [ -e /sys/bus/platform/drivers/mxc_dvfsper/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_epdc_fb/unbind
+ driver=/sys/bus/platform/drivers/mxc_epdc_fb
+ [ -e /sys/bus/platform/drivers/mxc_epdc_fb/mxc_epdc_fb//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_i2c_hs/unbind
+ driver=/sys/bus/platform/drivers/mxc_i2c_hs
+ [ -e /sys/bus/platform/drivers/mxc_i2c_hs/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_iim/unbind
+ driver=/sys/bus/platform/drivers/mxc_iim
+ [ -e /sys/bus/platform/drivers/mxc_iim/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_ipu/unbind
+ driver=/sys/bus/platform/drivers/mxc_ipu
+ [ -e /sys/bus/platform/drivers/mxc_ipu/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_keypad/unbind
+ driver=/sys/bus/platform/drivers/mxc_keypad
+ [ -e /sys/bus/platform/drivers/mxc_keypad/mxc_keypad.0//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_pwm/unbind
+ driver=/sys/bus/platform/drivers/mxc_pwm
+ [ -e /sys/bus/platform/drivers/mxc_pwm/mxc_pwm.1//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_sdma/unbind
+ driver=/sys/bus/platform/drivers/mxc_sdma
+ [ -e /sys/bus/platform/drivers/mxc_sdma/mxc_sdma//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_spi/unbind
+ driver=/sys/bus/platform/drivers/mxc_spi
+ [ -e /sys/bus/platform/drivers/mxc_spi/mxc_spi.2//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_wdt/unbind
+ driver=/sys/bus/platform/drivers/mxc_wdt
+ [ -e /sys/bus/platform/drivers/mxc_wdt/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxc_zq_calib/unbind
+ driver=/sys/bus/platform/drivers/mxc_zq_calib
+ [ -e /sys/bus/platform/drivers/mxc_zq_calib/mxc_zq_calib//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxcintuart/unbind
+ driver=/sys/bus/platform/drivers/mxcintuart
+ [ -e /sys/bus/platform/drivers/mxcintuart/mxcintuart.0//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/mxcintuart/mxcintuart.1//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/mxcintuart/mxcintuart.2//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxcpwrkey/unbind
+ driver=/sys/bus/platform/drivers/mxcpwrkey
+ [ -e /sys/bus/platform/drivers/mxcpwrkey/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxs-dma-apbh/unbind
+ driver=/sys/bus/platform/drivers/mxs-dma-apbh
+ [ -e /sys/bus/platform/drivers/mxs-dma-apbh/mxs-dma-apbh.0//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxs_viim/unbind
+ driver=/sys/bus/platform/drivers/mxs_viim
+ [ -e /sys/bus/platform/drivers/mxs_viim/mxs_viim//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/mxsdhci/unbind
+ driver=/sys/bus/platform/drivers/mxsdhci
+ [ -e /sys/bus/platform/drivers/mxsdhci/mxsdhci.0//mmc_host/mmc0 ]
+ MMC_DRIVER=/sys/bus/platform/drivers/mxsdhci
+ basename /sys/bus/platform/drivers/mxsdhci/mxsdhci.0/
+ MMC_DEVICE=mxsdhci.0
+ error=0
+ [ -e /sys/bus/platform/drivers/mxsdhci/mxsdhci.1//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/mxsdhci/mxsdhci.2//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/pmic_adc/unbind
+ driver=/sys/bus/platform/drivers/pmic_adc
+ [ -e /sys/bus/platform/drivers/pmic_adc/pmic_adc.1//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/pmic_battery/unbind
+ driver=/sys/bus/platform/drivers/pmic_battery
+ [ -e /sys/bus/platform/drivers/pmic_battery/pmic_battery.1//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/pmic_leds/unbind
+ driver=/sys/bus/platform/drivers/pmic_leds
+ [ -e /sys/bus/platform/drivers/pmic_leds/pmic_leds.103//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/pmic_leds/pmic_leds.114//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/pmic_leds/pmic_leds.98//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/pmic_light/unbind
+ driver=/sys/bus/platform/drivers/pmic_light
+ [ -e /sys/bus/platform/drivers/pmic_light/pmic_light.1//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/pmic_rtc/unbind
+ driver=/sys/bus/platform/drivers/pmic_rtc
+ [ -e /sys/bus/platform/drivers/pmic_rtc/pmic_rtc.1//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/pxp-device/unbind
+ driver=/sys/bus/platform/drivers/pxp-device
+ [ -e /sys/bus/platform/drivers/pxp-device/pxp-device//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/reg-fixed-voltage/unbind
+ driver=/sys/bus/platform/drivers/reg-fixed-voltage
+ [ -e /sys/bus/platform/drivers/reg-fixed-voltage/reg-fixed-voltage//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/sdram_autogating/unbind
+ driver=/sys/bus/platform/drivers/sdram_autogating
+ [ -e /sys/bus/platform/drivers/sdram_autogating/*//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/usb_plug/unbind
+ driver=/sys/bus/platform/drivers/usb_plug
+ [ -e /sys/bus/platform/drivers/usb_plug/usb_plug.0//mmc_host/mmc0 ]
+ dirname /sys/bus/platform/drivers/usb_wakeup/unbind
+ driver=/sys/bus/platform/drivers/usb_wakeup
+ [ -e /sys/bus/platform/drivers/usb_wakeup/usb_wakeup.0//mmc_host/mmc0 ]
+ [ -e /sys/bus/platform/drivers/usb_wakeup/usb_wakeup.1//mmc_host/mmc0 ]
+ return 0
+ echo /sys/bus/platform/drivers/mxsdhci mxsdhci.0
/sys/bus/platform/drivers/mxsdhci mxsdhci.0

As far as booting from the SD card, maybe something I did while either installing the software or trying to recover the device convinced it to start booting from the SD card. It might even be related to whatever made it no longer want to boot internally. Not sure on that one!

Your hexdump command produces:

00000200  53 4e 2d 4e 32 35 30 34  38 34 30 30 35 33 38 31  |SN-N250484005381|
00000210  00 39 5f 31 34 30 38 30  35 31 33 31 34 00 00 00  |.9_1408051314...|
00000220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000240

So indeed an H2O image. I got out a hex editor and replaced it with the serial number from my Aura's box (which starts with 514B), but alas there was no change other than causing it to print "There are differences between boot sector and its backup." and some related stuff at boot.

[frostschutz]

Hmmm, so far we're consistent. External SD card is mxsdhci.0 on the H2O as well. The internal is mxsdhci.2.

Is there anything in dmesg when you run this:

echo mxsdhci.2 > /sys/bus/platform/drivers/mxsdhci/unbind
echo mxsdhci.2 > /sys/bus/platform/drivers/mxsdhci/bind

That's (kind of) what Magic Memory Upgrade Mod uses to re-detect internal storage (after the internal card was replaced).

As for the serial number, there are several occurences of it, I've never had reason to change mine and for people who're asking for my H2O image I usually suggest to change it to their original number using sed (and sed should catch all occurences of it, as long as they're in plain ascii),

[mikeash]

I hunted down and replaced all instances of the serial number on the SD card, but there was no change.

I tried your commands. The unbind command shows nothing in dmesg. The bind command gives me:

mxsdhci: MXC SDHCI Controller Driver. 
mmc2: SDHCI detect irq 0 irq 3 INTERNAL DMA

Is that anything useful or meaningful?

[frostschutz]

If that's all there is and no /dev/mmcblk* created then - no, not really.

It looks like this on my H2O:

mxsdhci: MXC SDHCI Controller Driver. 
mmc2: SDHCI detect irq 273 irq 1 INTERNAL DMA
mmc2: new high speed SDHC card at address e624
mmcblk1: mmc2:e624 SU04G 3.69 GiB 
 mmcblk1: unknown partition table

We'd need someone with a working Aura and telnet access to compare. The internal storage may not be "mxsdhci" at all, but a different driver, I don't know.

[mikeash]

Interesting. Thanks for all the ideas and info in any case.

If anyone out there has a working Aura and feels like helping, please chime in! If not, I think it might be time to hit up eBay for a Kobo with accessible internal storage. And I'll make sure to take an image of what's on there before I start screwing around with it!

[freekobo]

I have one, but not sure what I can do to help.

Edit: I thought about it for a bit, and remembered reading this post a while back;
https://www.mobileread.com/forums/sho...0&postcount=23
Perhaps he still has the image and will share it with you?

[mikeash]

Thanks for that pointer. I sent that person a message and perhaps they'll have what I need!

As for your offer to help, I'm not 100% sure on the procedure, but it sounds like a prerequisite is to have telnet access. If you have that, then I think we can figure out the right commands to dump the internal storage to a file, probably over WiFi to a convenient computer. But we can see if the other fellow has it already done first.

[freekobo]

Yeah that thread (semi)automatic dump of Kobo firmware on a SD card has info on how to do this, I'm worried that I'll brick my Aura if I do it.

[frostschutz]

my magic memory upgrade mod (external variant) does the same; and the first thing it does is uninstall itself, so if it goes wrong, everything should be normal when you reset.

you could also use my webportal / filemanager mod and download /dev/mmcblk0 with it.

but no guarantees, every mod no matter how simple brings the risk of brickage with it... even official firmwares if you download them from here have that risk. and I don't have an aura so - I test my mods on my H2O but very difficult to say what other readers will do (like just now someone reported AutoShelf not working on Glo HD and I'm stumped as to why that would be).