Finding a recovery path with Freescale's Advanced Toolkit - Page 6

WoenK · 07-08-2012, 12:50 PM

Just found something in iMX35 manual:
To determine the active serial port (either UART or USB), MCU ROM polls the UART and USB status register for 32 seconds. If there is no activity on either of the ports, within the predefined polling loop time,then the ROM powers down the device, using the watchdog (WDOG). In the USB/UART bootloader validcase, the WDOG is serviced periodically. If the communication between the host and Baseboard IC (BB IC) hangs for more than 32 seconds or the processor goes into an endless loop, then the WDOG expires,and powers down the device.

Could someone with a functioning K3 please post how long it takes until the dwonload mode kicks in ?

PoP · 07-08-2012, 01:50 PM

Quote:

Originally Posted by WoenK

Question would be...did you set your your Kindle into download mode by holding the powerswitch on "ON" until the light wents out, then simultaneously pressing the VOL - and then releasing both buttons?
Yes
As far as I understood that is the only way to make the tool work .
Should at least work in a Virtual XP,
It didn't for me, repeatedly tried.
I do not think the ATK drivers are meant for Win7
Agreed, and jungo drivers are not for 64 bit OS either.

Must be some other timing issue, the phases of the moon...
or perhaps that I have previously flashed Seaniko7's custom kernel

WoenK · 07-08-2012, 02:45 PM

Quote:

Originally Posted by PoP

Must be some other timing issue, the phases of the moon...
or perhaps that I have previously flashed Seaniko7's custom kernel

Can't be the Kernel, because it is not even there when you activate the downloadmode.
Rather suspect that Win7 resets the USB connection somewhere inbetween.

Convinced my girl to lend me her functioning one...at least I wll be able to try to find out how and with which setup it should work.

geekmaster · 07-08-2012, 05:19 PM

The Vol- button must be held in while the power button is released. Releasing them at the same time is not reliable. There is no need to press Vol- until just before releasing the power button.

arooni · 07-08-2012, 06:29 PM

Has anyone with a bricked Kindle 3 been able to do a recovery using this method? I'd love to know if this is something I should pursue or if I should just wait to get a broken screen Kindle and just swap mobo/parts.

kraqh3d · 07-08-2012, 08:12 PM

Nope. I just gave it my last try. I've charged on an AC adapter for close to 40 hours over two days but I still can't access the bricked Kindle. Oh well. I gave it a shot but it's time to box her up and send her back.

arooni · 07-09-2012, 12:18 AM

Quote:

Originally Posted by kraqh3d

Nope. I just gave it my last try. I've charged on an AC adapter for close to 40 hours over two days but I still can't access the bricked Kindle. Oh well. I gave it a shot but it's time to box her up and send her back.

Good thing I just found a broken Kindle with apparently working internals. Hopefully it's just a matter of swapping the mobo from the broken screen kindle into my borked kindle. Looks like this repair will set me back $5.15 including shipping. Let's hope.

WoenK · 07-09-2012, 07:12 AM

Tried a dump with a perfectly working K3 and with that I get the error "flash failed because of an unknown reason".
Must be in download mode, else it would tell me that it is not in bootstrap mode.
In the iMX35 Manula I read that there are some efuses with could prevent some functionality...could it be that USB download has been blocked on some devices ?

hawhill · 07-09-2012, 07:39 AM

In theory, yes. But then that error wouldn't pop up, I think. I'm currently in the course of hacking a libusbx-based (or libusb-1.0) approach to flashing/dumping. As it is not working correctly yet, I'm hesitating to publish since people might brick their devices with it. But expect it in the course of the following 2-3 days.

Funny thing is, I remember having exactly the same errors over and over again with ATK and my Kindle. However, suddenly it worked. I attributed that to me failing to entering the correct settings for ATK (which were iMX35_TO2, mDDR and selecting SD/MMC in flash util). Maybe it is so very timing critical, that the specific setup here makes it work (VirtualBox, BTW, I need to explicitly re-attach the USB device to the VM after starting the flashing/dumping, since it "ejects" on its own after the RAM kernel is uploaded by ATK).

As for understanding what is going on with ATK and USB downloader mode:
- having Vol- pressed upon reboot/boot-up will trigger the built-in ROM kernel mode (you can recognized it because the Kindle identifies as "SE Ringo" USB device in that mode)
- when using ATK, the first page settings (mDDR, iMX35_TO2) will be used to write first initialization values to certain SoC registers in order to initialize the RAM and I think a few timing settings (didn't check yet). That uses features of the ROM kernel.
- in the flash util, when you start the very first operation there, ATK will upload the "RAM kernel" and make the ROM kernel branch into it. In that moment, the USB device is reset (which makes it eject from my VirtualBox container and I need to re-enable the device or it would time-out)
- the RAM kernel is specific to the selected Flash type (SD/MMC in our case). It is used for the dumping/programming of the flash.

In my own libusb-based try, I successfully uploaded a RAM kernel and started it, I could read status codes etc., but there is still a bug when flashing. I'll implement dumping before trying anything else.

Edit: all the mentioned "kernel"s don't have anything to do with the Linux kernel on the Kindle or Linux kernels in general. It's a small embedded kernel in both the RAM and the ROM kernel case.

qlob · 07-09-2012, 09:11 AM

Quote:

Originally Posted by arooni

Has anyone with a bricked Kindle 3 been able to do a recovery using this method? I'd love to know if this is something I should pursue or if I should just wait to get a broken screen Kindle and just swap mobo/parts.

EDIT:Just thought i'd update this since GeekMaster threw in a reference to me in the debricking sticky thread.

Successful Debrick using ATK

I had a bricked Kindle I had given up on (would only boot into diags), and using Freescale's ATK program (windowsXP 32 bit, physical Hardware) I unbricked it by flashing the rootfs with an image i got from this forum somewhere that i renamed <imagename>.img.bin( i cant exactly remember where i got it...). To test ATK, i flashed Seaniko7's custom kernel (even though i already had it... lol) and then proceeded to flash the image. I left it running overnight, so sadly i can't give you a time estimate... In the morning, i booted it up, and it booted normally! the only problem i had was then that the FAT32 table was corrupted, so I did a factory reset which temporaily fixed part of it but unzipping an update file gave me errors so i got a friend to run mkfs.vfat (as i'm still a linux noob

) for me on my Raspberry Pi. now i have a completely functioning Kindle!

(the image below is the corrupted fat32 partition (/mnt/us) on the kindle when i plugged the kindle in to install usbnetwork on LinuxMint)

knc1 · 07-09-2012, 10:49 AM

Quote:

Originally Posted by qlob

I just finished flashing my k3g that i had pretty much given up on. It works great now, except for the fact that when i plug the device into my linux box, i end up with 17 items, totalling 9.8 GB, according to nautilus. They are read only, which leads me to believe a small part of /bin or something got flashed in the wrong place or something...

The image shows a trashed FAT-32 file allocation table.

I think the K3 works the same as the other, if you ssh into the Kindle and destroy the file system on mmcblk0p4 with zeros, when the Kindle is next re-booted it will reformat the partition for you.

It would be best if you researched these threads a bit before trying that at home. I am not sure the K3 will auto-reformat the user storage partition.

qlob · 07-09-2012, 11:26 AM

Quote:

Originally Posted by knc1

The image shows a trashed FAT-32 file allocation table.

I think the K3 works the same as the other, if you ssh into the Kindle and destroy the file system on mmcblk0p4 with zeros, when the Kindle is next re-booted it will reformat the partition for you.

It would be best if you researched these threads a bit before trying that at home. I am not sure the K3 will auto-reformat the user storage partition.

Ok will try that.

Thanks!

hawhill · 07-09-2012, 01:26 PM

Quote:

Originally Posted by qlob

I just finished flashing my k3g that i had pretty much given up on.

You did not write about it, so I dare to make sure: Did you use ATK for that? I'm guessing so, since you wrote in this thread... If so, what setup did you use? WinXP? On physical hardware or virtual? And did you notice any hickups - and by chance remember how you did overcome them?

qlob · 07-09-2012, 03:02 PM

Quote:

Originally Posted by hawhill

You did not write about it, so I dare to make sure: Did you use ATK for that? I'm guessing so, since you wrote in this thread... If so, what setup did you use? WinXP? On physical hardware or virtual? And did you notice any hickups - and by chance remember how you did overcome them?

See my earlier post, i editied it to include details of my debrick

WoenK · 07-09-2012, 07:18 PM

One thing I experienced with both the functioning as well as the broken K3 was, that the USB gets reset after roughly 15 seconds, even though the reset should happen after 30 seconds. I tried quite a lot with the functioning one including pressing vol- after 15 seconds and realsing power while keeping it held for another 10 seconds and also keeping it fixed for the whole dump try. The functioning one simply does not dump even a dump

Some timings in seconds would really help noobs like me (how long to hold the powerswithc until the Vol- gets pressed, how long to hold the vol- with the power switch and how long to hold the vol- after releasing the power switch)

edith: just managed to dump 100 bytes with the working one....
held the power button for 16 seconds, green light switched to orange, held it with the vol- together 1 second, released it and held the vol- for another second.
now dumping from 0x00000000 to 0x08000000 and seems to go really fast (2/3 done in about 5 mins)

Also noticed that on the broken on it does not show the flash capacity (bottom right in ATK) Could be that the meory in the broken is damaged.

07-09-2012, 07:39 AM	#84
hawhill Wizard Posts: 1,379 Karma: 2155307 Join Date: Nov 2010 Location: Goettingen, Germany Device: Kindle Paperwhite, Kobo Mini	In theory, yes. But then that error wouldn't pop up, I think. I'm currently in the course of hacking a libusbx-based (or libusb-1.0) approach to flashing/dumping. As it is not working correctly yet, I'm hesitating to publish since people might brick their devices with it. But expect it in the course of the following 2-3 days. Funny thing is, I remember having exactly the same errors over and over again with ATK and my Kindle. However, suddenly it worked. I attributed that to me failing to entering the correct settings for ATK (which were iMX35_TO2, mDDR and selecting SD/MMC in flash util). Maybe it is so very timing critical, that the specific setup here makes it work (VirtualBox, BTW, I need to explicitly re-attach the USB device to the VM after starting the flashing/dumping, since it "ejects" on its own after the RAM kernel is uploaded by ATK). As for understanding what is going on with ATK and USB downloader mode: - having Vol- pressed upon reboot/boot-up will trigger the built-in ROM kernel mode (you can recognized it because the Kindle identifies as "SE Ringo" USB device in that mode) - when using ATK, the first page settings (mDDR, iMX35_TO2) will be used to write first initialization values to certain SoC registers in order to initialize the RAM and I think a few timing settings (didn't check yet). That uses features of the ROM kernel. - in the flash util, when you start the very first operation there, ATK will upload the "RAM kernel" and make the ROM kernel branch into it. In that moment, the USB device is reset (which makes it eject from my VirtualBox container and I need to re-enable the device or it would time-out) - the RAM kernel is specific to the selected Flash type (SD/MMC in our case). It is used for the dumping/programming of the flash. In my own libusb-based try, I successfully uploaded a RAM kernel and started it, I could read status codes etc., but there is still a bug when flashing. I'll implement dumping before trying anything else. Edit: all the mentioned "kernel"s don't have anything to do with the Linux kernel on the Kindle or Linux kernels in general. It's a small embedded kernel in both the RAM and the ROM kernel case. Last edited by hawhill; 07-09-2012 at 07:42 AM.

07-09-2012, 07:18 PM	#90
WoenK Member Posts: 22 Karma: 10 Join Date: Jul 2012 Device: Kindle3, Trekstor5	One thing I experienced with both the functioning as well as the broken K3 was, that the USB gets reset after roughly 15 seconds, even though the reset should happen after 30 seconds. I tried quite a lot with the functioning one including pressing vol- after 15 seconds and realsing power while keeping it held for another 10 seconds and also keeping it fixed for the whole dump try. The functioning one simply does not dump even a dump Some timings in seconds would really help noobs like me (how long to hold the powerswithc until the Vol- gets pressed, how long to hold the vol- with the power switch and how long to hold the vol- after releasing the power switch) edith: just managed to dump 100 bytes with the working one.... held the power button for 16 seconds, green light switched to orange, held it with the vol- together 1 second, released it and held the vol- for another second. now dumping from 0x00000000 to 0x08000000 and seems to go really fast (2/3 done in about 5 mins) Also noticed that on the broken on it does not show the flash capacity (bottom right in ATK) Could be that the meory in the broken is damaged. Last edited by WoenK; 07-09-2012 at 07:34 PM.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Kindle emulator on Java CDC toolkit	zenob	Kindle Developer's Corner	2	09-18-2011 01:52 PM
FINDING FILE PATH IN CALIBRE	Berni	Calibre	3	02-05-2011 10:10 AM
Freescale Smartbook - it's looking pretty nice	Houndx	Alternative Devices	2	03-09-2010 05:23 PM
Freescale CPU with E Ink controller	wallcraft	News	1	03-01-2010 01:20 PM
iLiad FOX gui toolkit for Iliad	hansel	iRex Developer's Corner	2	09-15-2008 02:26 PM

07-08-2012, 12:50 PM	#76
WoenK Member Posts: 22 Karma: 10 Join Date: Jul 2012 Device: Kindle3, Trekstor5	Just found something in iMX35 manual: To determine the active serial port (either UART or USB), MCU ROM polls the UART and USB status register for 32 seconds. If there is no activity on either of the ports, within the predefined polling loop time,then the ROM powers down the device, using the watchdog (WDOG). In the USB/UART bootloader validcase, the WDOG is serviced periodically. If the communication between the host and Baseboard IC (BB IC) hangs for more than 32 seconds or the processor goes into an endless loop, then the WDOG expires,and powers down the device. Could someone with a functioning K3 please post how long it takes until the dwonload mode kicks in ?

07-08-2012, 05:19 PM	#79
geekmaster Carpe diem, c'est la vie. Posts: 6,433 Karma: 10773668 Join Date: Nov 2011 Location: Multiverse 6627A Device: K1 to PW3	The Vol- button must be held in while the power button is released. Releasing them at the same time is not reliable. There is no need to press Vol- until just before releasing the power button.

07-08-2012, 06:29 PM	#80
arooni Addict Posts: 315 Karma: 26 Join Date: Jul 2012 Device: Kindle Paperwhite 4 (2018)	Has anyone with a bricked Kindle 3 been able to do a recovery using this method? I'd love to know if this is something I should pursue or if I should just wait to get a broken screen Kindle and just swap mobo/parts.

07-08-2012, 08:12 PM	#81
kraqh3d Member Posts: 20 Karma: 10 Join Date: Jan 2012 Device: Kindle	Nope. I just gave it my last try. I've charged on an AC adapter for close to 40 hours over two days but I still can't access the bricked Kindle. Oh well. I gave it a shot but it's time to box her up and send her back.

07-09-2012, 07:12 AM	#83
WoenK Member Posts: 22 Karma: 10 Join Date: Jul 2012 Device: Kindle3, Trekstor5	Tried a dump with a perfectly working K3 and with that I get the error "flash failed because of an unknown reason". Must be in download mode, else it would tell me that it is not in bootstrap mode. In the iMX35 Manula I read that there are some efuses with could prevent some functionality...could it be that USB download has been blocked on some devices ?