[Kindle Touch] Boot over USB HID serial / "USB downloader" mode

[eureka]

While poking with my "bricked" Kindle Touch, I've found a way to enable "USB downloader" boot mode of Freescale i.MX508 MCU used in a device.

When mode is enabled, Kindle is recognized as USB HID device with VID 0x15A2 and PID 0x0052. It should be possible to connect to it via custom Serial Download Protocol designed by Freescale and described in MCU Reference Manual. Protocol allows to read/write memory, upload program image into RAM and start executing at given address.

(More info has been dumped to wiki page about Kindle Touch hacking).

To enable this mode one should perform "hard reset" with pressed Home button. Hold Home button, then perform "hard reset" by holding Power button for 20 seconds and releasing it. Then wait about a second or two and release Home button. That's all.

It's easier to follow with Kindle connected to computer. After 20 seconds of holding Power button, Kindle USB disk should be detached from computer. It's time to release Power button. Then Kindle should be recognized as USB HID device. Now Home button could be released.

With loading arbitary code to RAM and executing it, this mode could be used as base for the ultimate unbricking solution, so I'm pretty excited about it. But it could be just a useless discovery if any restrictions will be revealed in further exploration.

Anyway, it is of no value for ordinary user right now.

[dasmoover]

Thank you very much for this information, I wonder if I can get my bricked touch working.

[yifanlu]

Awesome! Does the diags option "USB download" do the same thing? I was afraid to choose it because I may not be able to get back into normal mode.

[geekmaster]

When I tried that a couple of days ago, Windows automatically installed two different HID device drivers for it. They must be built into Windows XP. I also downloaded some tools and source code to use it.

There was a discussion about which software tools may be used with this mode on the IRC channel. IRC archive here:
http://kindle-synchrone.dotcloud.com

[yifanlu]

If you read iMX's documentions about running android on iMX cpus, one of the step involves flashing the bootloader, ramdisk, kernel, and other partitions using the iMX tool. Just saying.

[laneovcc]

Is this means we can boot android or linux from tftp and NFS without break kindle's file system?

see 3.3.2 Boot from TFTP and NFS
http://reviews.androids.name/2011/03...ual-very-good/

I have download the demo from http://www.freescale.com/webapp/sps/...?code=IMX50_SW

[geekmaster]

Originally Posted by laneovcc

see 3.3.2 Boot from TFTP and NFS
http://reviews.androids.name/2011/03...ual-very-good/

That link contains this text:

Android supports running the system on NFS root file system. You can put the total Android root system into NFS, but you need to load the kernel image from the TFTP server. Therefore, you must have a PC that has NFS and TFTP servers, with their root directory set up correctly, that is, /opt/tftproot for TFTP root, and /opt/nfsroot for NFS root.

That looks pretty exciting to me! Besides being a potential recovery method, it may be usable for other things if needed later (mp3 replacement, for example).

[geekmaster]

For anybody following this thread, I started a new thread where you can see my progress with the things that interested me in the post above:
https://www.mobileread.com/forums/sho...d.php?t=169645

Most importantly, I am providing tools to recover bricked kindles, which have been used successfully by mutliple kindle owners. I am also working on extensions to this for root access, jailbreak, and application installations. I plan to provide support for Kindle 3 and earlier as well.

[knc1]

Originally Posted by geekmaster

For anybody following this thread, I started a new thread where you can see my progress with the things that interested me in the post above:
https://www.mobileread.com/forums/sho...d.php?t=169645

Most importantly, I am providing tools to recover bricked kindles, which have been used successfully by mutliple kindle owners. I am also working on extensions to this for root access, jailbreak, and application installations. I plan to provide support for Kindle 3 and earlier as well.

And for people who have not (yet) bricked their kindle - the USB-serial mode should be available during "normal" operation also.

My reasoning on that:

root:k321# ls -l etc/udev/rules.d
total 15
lrwxrwxrwx 1 root root   32 May  6  2011 10-hw.rules -> /etc/udev/rules.d/XX-mario.rules

Which is a bit brain-dead, it causes XX-mario.rules to be loaded twice.
That should be /etc/udev/XX-mario.rules - but that is lab126's problem.

root:k321# less etc/udev/rules.d/XX-mario.rules
- - - big snip - - -
# USB notifications

KERNEL=="arc_udc",      RUN+="/lib/udev/bin/notifyusb"
KERNEL=="g_file_storage",       RUN+="/lib/udev/bin/notifyusb"
KERNEL=="g_ether",      RUN+="/lib/udev/bin/notifyusb"
KERNEL=="g_serial",     RUN+="/lib/udev/bin/notifyusb"

Not provided as part of any of the source code releases:

root:cat$ grep 'XX-mario.rules' Amazon_2012.02.18_sha1.cat
root:cat$

Developers get to examine the actual file system images to see if it is
include with a specific model/system-version.

Anyway -
What that says is the USB port is put into 'serial mode' on the loading
of the kernel's g_serial module.

Note:
The Kindle-3.2.1 system build does not include usb_modeswitch, might be a nice thing to add to the system images.

[knc1]

Hmm...
Only two versions of udev in the Kindles (udev v-1.1.2 and udev v-1.4.6) no mention of the modified configuration rules (which may be a violation of section 3 of the gpl).

root:cat$ grep 'rules.d/' Amazon_2012.02.18_sha1.cat | sort >rules.d.txt

Output of query attached.

[knc1]

Originally Posted by knc1

Anyway -
What that says is the USB port is put into 'serial mode' on the loading
of the kernel's g_serial module.

Note:
The Kindle-3.2.1 system build does not include usb_modeswitch, might be a nice thing to add to the system images.

Minor correction -
What that says is that it sends an even notification using lipc to anything that is listening for the event.
Note: just gotta get rid of that propritary lipc thing using an opensource equivalent.
(Contractors often do that, re-invent standard software - it pays more.)

But the root cause is the same, loading of the kernel module.

Don't see anything in the gaget driver itself that sets the line speed:

root:k321$ modinfo ./lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/gadget/g_serial.ko
filename:       ./lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/gadget/g_serial.ko
license:        GPL
author:         Al Borchers
description:    Gadget Serial
depends:        arcotg_udc
vermagic:       2.6.26-rt-lab126 mod_unload modversions ARMv6 
parm:           read_q_size:Read request queue size, default=32 (uint)
parm:           write_q_size:Write request queue size, default=32 (uint)
parm:           write_buf_size:Write buffer size, default=8192 (uint)
parm:           use_acm:Use CDC ACM, 0=no, 1=yes, default=no (uint)

Must be set at the usb-serial level in the stack,
and I don't recall what those limits where in this old a kernel version.

EDIT:
Hmm...
Since that module depends on (and modprobe will thus pre-load it) arcotg_udc, and there is a udev notification for that event (the loading of the dependant module)....

Anything listen for either (or both) events should certainly "get the word" (msg).

[geekmaster]

The source code files for 4.0 and 4.0.1 have same length and md5sum so no need to catalog both of them.

The source code files for 5.0.0 and 5.0.3 have same length and md5sum so no need to catalog both of them.

[geekmaster]

Originally Posted by knc1

And for people who have not (yet) bricked their kindle - the USB-serial mode should be available during "normal" operation also.

I thought that USB Downloader mode (which uses MfgTool or sb_loader) and USB Serial mode (a gadget that uses a USB serial device driver and a serial terminal program) were different things.

Did I miss something here?

[knc1]

Originally Posted by geekmaster

I thought that USB Downloader mode (which uses MfgTool or sb_loader) and USB Serial mode (a gadget that uses a USB serial device driver and a serial terminal program) were different things.

Did I miss something here?

I may have been half-asleep when I wrote that.
Plus, some of the terms get handed around like a cheap wh....

Here, this may help:
http://cgit.openembedded.org/openemb...enembedded.dev

And click 'files' in the breadcrumb trail to get at the init and config files.

An example of a worked script to handle them all in the general case.

[geekmaster]

Originally Posted by knc1

And click 'files' in the breadcrumb trail to get at the init and config files.

Nice. Thanks. I see opie in the breadcrumb trail. I actually booted that up on my Palm Tx a few weeks ago. It was sitting on a shelf gathering dust for a few years, and I needed to drop in and say "hello" to it when some folding serial keyboards arrived from ebay...

But now that we know that kindles have OTG external USB ports, we can use USB keyboards when we figure out how to switch modes.