Need some advice for resurrecting PW2 from a failed software update

[stack]

After searching through many threads on this forum and google I have come to a point where I need some expert advice on a proper course of action. My stock/unrooted kindle ran into trouble during an update, where it stuck at around 15% on the 'software update' screen. It will reset when I hold the power button for 30 seconds but it immediately boots into software update and the status bar climbs back to 15%, then stops.

So far I have tried charging it for days, contacting Amazon CS, and attempting to access the kindle in both Windows and Linux, but nothing has helped. The kindle isn't recognized in either OS and the Software Update loop continues.

I haven't found a similar occurrence of this issue through my searches so I'm not quite sure on the course of action. I am thinking that my issue is more of a soft-brick and am hoping that there is simply a file that needs deleting or modifying.

In preparation I have ordered a MicroFTX compact MicroUSB breakout available from http://jim.sh/ftx, which will arrive tomorrow. If it's actually bricked I plan on following THIS tutorial on gist.github.com

Thanks for taking the time to read this, I really appreciate any/all ideas or directions.

[Cinisajoy]

Is the wifi on or off?
Oh and the first 6 of the serial number.

[knc1]

"Kindle isn't recognized in either OS" <-- which OSs are you writing about?
Hopefully, at least one of them is *nix based (#1 choice of those, Linux).

Please define: "recognized".

*) Connect Kindle to PC with USB cable.
*) Reboot the Kindle.
*) During the couple of seconds the system exports the user file system poke the flag file named:
DO_FACTORY_RESTORE
All caps, no extension, no contents into the top of visible USB storage. (if your using Windows, the Kindle may be too quick for it.)
*) Reboot the Kindle.

Report back.

[stack]

Originally Posted by Cinisajoy

Is the wifi on or off?
Oh and the first 6 of the serial number.

Well played
Serial: 9017 22

knc1: "Recognized" meaning that the kindle doesn't show with either $lsblk, $usb-devices, or #lsusb from within linux (installed/non-vm kubuntu 14.4).

I am unfamiliar with "system poke the flag file". I did read that placing a DO_FACTORY_RESTORE file would do just that, but would appreciate a little more info on sending it to the kindle (if it's indeed possible).

Thanks again, I really appreciate the help.

[knc1]

Assuming a Linux of some flavor on the pc.

open terminal
clear kernel ring buffer:
$ sudo dmesg -c

Kindle is "hung" -
Connect usb cord

watch the kernel ring buffer for messages:
watch -n1 dmesg
(It should be blank at this point if the Kindle is really hung where it can't detect your plugging in the usb cable. If not, then copy messages and paste into next post.)

Ring buffer still empty:
Reboot Kindle.
*nix recognizes USB bus changes:

[883333.028027] usb 9-1: new high speed USB device number 20 using xhci_hcd
[883333.054420] scsi11 : usb-storage 9-1:1.0
[883334.053069] scsi 11:0:0:0: Direct-Access     Kindle   Internal Storage 0100
PQ: 0 ANSI: 2

That is only the "raw storage device" recognition step.
That happens early in the boot sequence, but the Kindle has only initialized the drivers to announce the USB storage device, without any media in it.

Next, if the boot process gets that far, it will export the "media" (a fuse file system thingy):

[883336.447790]  sdc: sdc1 <<-- ***

See the sequence?
The storage media is attached - sg3
Then it is identified as a removable disk - sdc
Then media is found - sdc1 (a single partition on media sdc)
The file system is identified (FAT-32)

At which point your desktop automation will probably auto-mount it and open a file manager window.

Then when ejected by file manager action - which is actually an un-mount and then an eject - you will see:

[883343.923536] sdc: detected capacity change from 3269459968 to 0

I.E: The Kindle system diddles the fuse file system and the kernel drivers to do the equivalent of physically removing the disk from the removable disk driver.

From the point marked: "<<-- ***" above, you can write to the USB storage media.

(ctrl-c now to stop watching the dmesg buffer).

That will happen ONCE, during early boot-up (while still in initramfs boot stage) -
IF the boot sequence gets that far, you can probably do:

touch /media/Kindle/DO_FACTORY_RESTORE

I.E: Poke (as in the Basic Language Peek and Poke instruction pair) a flag filename to top of visible USB storage.
It may not be availabe long enough for you to type it, so you will probably want to pre-type that command (in another terminal instance)
OR
write a simple do forever loop to keep trying the device write
OR
write a simple expect/send script
OR
get extra fancy a write a custom u-dev rule to "poke" (I.E: using :"touch" utility) the filename write when the storage media first becomes available.

- - -

Got the flag name written?
Good! Now remove USB cable and re-boot the Kindle.
It **should** restore itself.

[stack]

"watch the kernel ring buffer for messages:
watch -n1 dmesg"

It wasn't blank.

[ 7322.256026] usb 2-10: new low-speed USB device number 9 using ohci-pci
[ 7322.466037] usb 2-10: New USB device found, idVendor=1949, idProduct=dead
[ 7322.466042] usb 2-10: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[ 7322.466045] usb 2-10: Product: USB Charger
[ 7322.478090] input: USB Charger  as /devices/pci0000:00/0000:00:02.0/usb2/2-10/2-10:1
.0/input/input18
[ 7322.478259] hid-generic 0003:1949:DEAD.0007: input,hidraw4: USB HID v1.11 Device [US
B Charger ] on usb-0000:00:02.0-10/input0
[ 7322.669043] usb 2-10: USB disconnect, device number 9

I tried rebooting with the usb still attached but no new entries were recorded. In fact the only changes to dmesg came about when usb was connected from a completely powered off state (battery disconnected).

I would think this might be a good thing if the word "dead" wasn't displayed twice.

EDIT: After rereading your instructions it appears that you initially wanted me to plug in the usb when the kindle was on and at it's "hung" state. At this point the ring buffer remains empty.

"Ring buffer still empty:
Reboot Kindle.
*nix recognizes USB bus changes:"

On reboot there is no change, there is no output for the "raw storage device" recognition step.

[knc1]

Serial port time now, it never gets far enough into the process for us to change the contents of USB mass storage.

For over a year, the serial port was the only way we had to jailbreak or recover a "series 5.6" Kindle device, so there is a lot written about it here.

Maybe the best one giving a lot of the basics is the "serial port <something> for dummies" thread.
And if a little uncertain about soldering skills, there is mention and/or links to various ways to make the connections without soldering in that thread.

[stack]

Knc1, huge thank you for helping diagnose.

Do you think that it's worth trying to dd a DO_FACTORY_RESTORE file once I'm in with the serial cable? Or would you guess that at this point I'm better off trying to flash a stock image?

Also, since my kindle was unrooted and I don't know exactly which software is currently installed/installing, do you have any input on which version I should be installing since I'm now planning on rooting the device to ensure no further update issues?

Thanks again

[knc1]

Originally Posted by stack

Knc1, huge thank you for helping diagnose.

Do you think that it's worth trying to dd a DO_FACTORY_RESTORE file once I'm in with the serial cable? Or would you guess that at this point I'm better off trying to flash a stock image?

Also, since my kindle was unrooted and I don't know exactly which software is currently installed/installing, do you have any input on which version I should be installing since I'm now planning on rooting the device to ensure no further update issues?

Thanks again

Mostly no.

I would rather see what messages are generated by a device boot before deciding what should follow.

While waiting for the jm.ftx board - -

A PW-2 is still relatively new, I do not expect hardware failure.
But the 9017 is the first (non-Japanese) 4Gbyte device.
The Amazon customer updates **SHOULD BE** model locked, but this sounds like a 4Gbyte PW-2 trying to install the firmware for a 2Gbyte PW-2.

Now if you where using one of our PW-2 factory images, those are not model locked, but the only one we have posted is a version that **SHOULD** run either storage size PW-2.

But those are only speculation - let us see what messages are produced during a "from power off" boot sequence.

[stack]

Serial cable in place (thanks to raz572's post HERE) so I fired up putty in Windows 10 and connected during boot.

Output below:

rootfs.img.gz 212141222  [######################################]



imx60_wario/uImage 2883584    [######################################]
rootfs.img.gz 312463     [#:::::::::::::::::::::::::::::::::::::][   74.177740] mmcblk0: error -110 transferring data, sector 66216, nr 264, cmd response 0x900, card status 0xd00
[   74.187849] end_request: I/O error, dev mmcblk0, sector 66216
[   74.193623] Buffer I/O error on device mmcblk0p1, logical block 85
[   74.200773] end_request: I/O error, dev mmcblk0, sector 66224
[   74.206544] Buffer I/O error on device mmcblk0p1, logical block 86
[   74.213602] end_request: I/O error, dev mmcblk0, sector 66232
[   74.219369] Buffer I/O error on device mmcblk0p1, logical block 87
[   74.226408] end_request: I/O error, dev mmcblk0, sector 66240
[   74.232175] Buffer I/O error on device mmcblk0p1, logical block 88
[   74.239212] end_request: I/O error, dev mmcblk0, sector 66248
[   74.244980] Buffer I/O error on device mmcblk0p1, logical block 89
[   74.252022] end_request: I/O error, dev mmcblk0, sector 66256
[   74.257789] Buffer I/O error on device mmcblk0p1, logical block 90
[   74.264819] end_request: I/O error, dev mmcblk0, sector 66264
[   74.270586] Buffer I/O error on device mmcblk0p1, logical block 91
[   74.277618] end_request: I/O error, dev mmcblk0, sector 66272
[   74.283385] Buffer I/O error on device mmcblk0p1, logical block 92
[   74.290419] end_request: I/O error, dev mmcblk0, sector 66280
[   74.296186] Buffer I/O error on device mmcblk0p1, logical block 93
[   74.303220] end_request: I/O error, dev mmcblk0, sector 66288
[   74.308986] Buffer I/O error on device mmcblk0p1, logical block 94
[   74.316009] end_request: I/O error, dev mmcblk0, sector 66296
[   74.321784] end_request: I/O error, dev mmcblk0, sector 66304
[   74.327555] end_request: I/O error, dev mmcblk0, sector 66312
[   74.333326] end_request: I/O error, dev mmcblk0, sector 66320
[   74.339099] end_request: I/O error, dev mmcblk0, sector 66328
[   74.344870] end_request: I/O error, dev mmcblk0, sector 66336
[   74.350641] end_request: I/O error, dev mmcblk0, sector 66344
[   74.356412] end_request: I/O error, dev mmcblk0, sector 66352
[   74.362184] end_request: I/O error, dev mmcblk0, sector 66360
[   74.367954] end_request: I/O error, dev mmcblk0, sector 66368
[   74.373724] end_request: I/O error, dev mmcblk0, sector 66376
[   74.379494] end_request: I/O error, dev mmcblk0, sector 66384
[   74.385263] end_request: I/O error, dev mmcblk0, sector 66392
[   74.391033] end_request: I/O error, dev mmcblk0, sector 66400
[   74.396803] end_request: I/O error, dev mmcblk0, sector 66408
[   74.402574] end_request: I/O error, dev mmcblk0, sector 66416
[   74.408344] end_request: I/O error, dev mmcblk0, sector 66424
[   74.414113] end_request: I/O error, dev mmcblk0, sector 66432
[   74.419882] end_request: I/O error, dev mmcblk0, sector 66440
[   74.425651] end_request: I/O error, dev mmcblk0, sector 66448
[   74.431420] end_request: I/O error, dev mmcblk0, sector 66456
[   74.437189] end_request: I/O error, dev mmcblk0, sector 66464
[   74.442957] end_request: I/O error, dev mmcblk0, sector 66472

[   79.881944] mmcblk0: error -110 transferring data, sector 1263328, nr 256, cmd response 0x900, card status 0xb00
[   85.319061] mmcblk0: error -110 transferring data, sector 1263328, nr 256, cmd response 0x900, card status 0x0
[   85.329146] end_request: I/O error, dev mmcblk0, sector 1263328
[   85.338317] mmcblk0: timed out sending r/w cmd command, card status 0x400b00
[   90.771481] mmcblk0: error -110 transferring data, sector 1263329, nr 255, cmd response 0x900, card status 0x0
[   90.781557] end_request: I/O error, dev mmcblk0, sector 1263329
[   90.790733] mmcblk0: timed out sending r/w cmd command, card status 0x400b00
^A[   96.223920] mmcblk0: error -110 transferring data, sector 1263330, nr 254, cmd response 0x900, card status 0x0
[   96.233992] end_request: I/O error, dev mmcblk0, sector 1263330
[   96.243156] mmcblk0: timed out sending r/w cmd command, card status 0x400b0[  101.676344] mmcblk0: error -110 transferring data, sector 1263331, nr 253, cmd response 0x900, card status 0x0
[  101.686487] end_request: I/O error, dev mmcblk0, sector 1263331
[  101.695613] mmcblk0: timed out sending r/w cmd command, card status 0x400b00
rootfs.img.gz 212141222  [######################################]



imx60_wario/uImage 2883584    [######################################]
rootfs.img.gz 312463     [#:::::::::::::::::::::::::::::::::::::][   74.177740] mmcblk0: error -110 transferring data, sector 66216, nr 264, cmd response 0x900, card status 0xd00

As you can see it attempts to repeat the install even though there is no sign of action on the screen.

[knc1]

#1 - Use your Linux install, Windows will not connect to the serial port in time to get what we need.

#2 - a dummy run, after the Kindle has completed its boot and started the <whatever> it is doing -
I.E: So that diddling with minicom's setup isn't sending to the Kindle something that might otherwise do something (good or bad)

Got all the options on minicom set so that it is working?
Save that as the default configuration.
Now in the future you can start minicom with that configuration and skip it sending anything by:

minicom -o

1. Enable the capture to file feature.
2. minicom is running you will be seeing the serial output
3. Re-boot the Kindle (Linux will not drop the serial connection like Windows would)
4. Let the Kindle run through its full power-on boot sequence until you reach the above point.
   That will give the full set of u-boot messages, initramfs system messages, and kindle start up messages into the capture file.
5. turn off the capture to file
6. save the capture file.
7. Done with Kindle for now
8. gzip the capture file and attach to your next post (must use the "advanced" editor here, manage attachments box is below the text box for the post).

I'll go through the capture file, an quote back the lines of interest and a translation of what they mean.

THEN we can decide what needs to be done.

[stack]

Took me a minute to get acquainted with minicom. Thanks again for all the help

[knc1]

(The majority of our readers are not members - so in cases like this, I try to write for entire audience.)

The SoC has some on-chip, static, RAM and some code in ROM to get things started -
Then it loads and runs u-boot:

U-Boot 2009.08-lab126 (Aug 05 2014 - 04:37:39)

Which continues with the hardware initialization, including starting the external RAM and eMMC.
Went complete, it pauses before loading and executing the (combined) initramfs kernel and ram file system (what you see in your PC's grub menu as the kernel= and initrd= entries).
The Kindel's u-boot gives you an opportunity (of about 1 to 2 seconds) to stop the load and run of the initramfs and remain in interactive u-boot here:

Hit any key to stop autoboot:  1  0

If we have to use u-boot in interactive mode, the above is where we stop the sequence.

PS: All of the identification information that u-boot prints out, line 23 - line 30 is specific to the board and not stored in any of the file systems - so keep a copy of this information in case it is ever required to setup the eMMC (or its blank replacement).
The u-boot menu (there are two of them) has an "Erase All" choice - don't try it - it does exactly what the selection says - and then your device is toast unless you have the above information.
(Sometimes, Lab126 has fixed that coding error in some firmware versions.)

So we continue with loading the kernel:

## Booting kernel from Legacy Image at 80800000 ...

Then executing the kernel

Starting kernel ...

The kernel has an appended filesystem and some basic applications.
The auto-boot sequence can be interrupted at this point:

Press [ENTER] for recovery menu...        0

(Since you didn't that and the next message are run together.)
Before doing a switch-root to the on eMMC system, the initramfs checks (and corrects as required) the partitioning and formatting of the eMMC:

//dev/mmcblk0p4:
CHS=4/16/104512 size=3424649216 bytes
flag type      first       last  lba first   lba size
Partition p1:
0x00 0x0b         16 <large>            16    6688752
    CHS: 0/1/1 - <large>
Partition p2:
Partition p3:
Partition p4:

Checks the battery charge, and if considered sufficent to flash a new system image, looks for one on the root of partition four (a.k.a: visible USB storage - when it is exported).

Charge: 91% [######################################################::::]
update-payload.dat:1 8a21c7f18eb739bb2e348aa34a038f1b imx60_wario/uImage 22 main_kernel
128 e89fe09e72e7bfc948c451f141f51f4a rootfs.img.gz 1618 update_image_rootfs

Finding one, it loads the (new) kernel image:

imx60_wario/uImage 137330

At this point, the eMMC has the new kernel written to eMMC, but this kernel's modules (on the root filesystem) have not yet been updated.
Next we update the main system image (in partition 1):

rootfs.img.gz 50399

Then checks the new kernel/initramfs:

imx60_wario/uImage 137330

Which passes.
Then checks the new system image:

rootfs.img.gz 0

Which fails with a hard, eraseblock error on the eMMC:

[#:::::::::::::::::::::::::::::::::::::][   74.190221] mmcblk0: error -110 transferring data, sector 66216, nr 264, cmd response 0x900, card status 0xd00

And your Kindle is toast for several reasons.
But may be recoverable even from this hard, hardware error and mis-matched kernel / kernel modules.

- - - - -

This is already a very long post (for educational purposes of our lurking audience).
And it is late at night here.

So I will follow up tomorrow when mind is still fresh on the things we will try to recover from this.

PS: Remove your current attachment, and using a text editor, XXX out at least your serial number and board id before re-p0sting it.
The reason is that somebody might try to hijack that unique information.
Leading to both your and the hijacker's Kindles being blacklisted.
(Note that I did not quote that information in the above.)

[stack]

Very informative, thank you. I felt a little weird sending the cap with that info so I actually hashed out the last 10 characters/digits from both the serial and board ID before you responded. I have also stored the pertinent device info in a safe place in case I do something very stupid in the future

In the meantime I have retrieved my password but I am hesitant to do any more without instruction. I would love to know which firmware is installed, and attempting to install, and if in fact Amazon pushed the wrong update to my device. I'm still a little peeved that this sort of failure isn't covered by Amazon's warranty. Still, I am extremely grateful for your time and expertise, and would love to get it working again without buying a new device.

[knc1]

The eMMC does not have as "smart" a micro-controller built-in as an SSD does, but it does have one and we will try various ways to get it to map-out the bad erase blocks.

The sequence is:
U-Boot menu -
Recovery menu -

We will start at the higher level ( the recovery menu ):

#1 - Stop the boot sequence at the "recovery menu" place
The recovery menu will have an "export usb storage" (or words to that effect) selection.
Hook up USB cable to PC, select that choice.
Note: You may have to type something every 5 .. 10 seconds to keep the menu from timing out - space usually works.
When that selection is made, your PC's automation should auto-mount it and open a file manager (just as if it where normal).
Delete the update file(s) - you probably have both a *.bin and a *.stgz (or something like that).
Add the: "DO_FACTORY_RESTORE" flag filename to visible root.
With file manager: "eject"
Remove USB cord
With the Recovery Menu - "Exit" or "Reboot" or whatever it is named.
It it doesn't restart, restart it with the power button, wait.
You can watch what is happening on the serial port - it **might** loop, trying to write an erase block, error, map-out, try again - - - etc.
And eventually run (even with the mis-matched kernel / kernel-modules.

The worse that can happen is it will get hung again in another hardware failure loop.

#2 Presuming the above failed to do any good -
From the JB thread: https://www.mobileread.com/forums/sho...d.php?t=275877
Step #3, get the factory initial firmware for a PW-2 (and its MD5SUM).
As above, enter Recovery Menu, Cable, Export USB storage, put that factory initial firmware at the root of visible storage.
CHECK ITS MD5SUM - remember we are working with flaky storage.
Repeat moving the factory initial update file to the Kindle until you get a good copy in-place (the micro-controller is a bit dumb, it will only map out one block per try).
Got that in place?
eject, remove cable, reboot (menu or power button).

Your trying something un-tried so far - see if the factory initial firmware can recover the device - - I **think** this is the package that the "refurbish" people use.

If your lucky, that will fix it.

If not - we will have to get serious and tackle it at a lower level.