Kindle Touch bricked without USB

[geekmaster]

Did you try option 3 again. Maybe it only loads MMC0 from USB storage if mmcblk0p1 is erased.

The entire mmc0 image should contain a partition table. I would think that a partition table was created when you rebuilt /mnt/us.

Loading mmc0 from /mnt/us seems not accurately named. How can you reload an image of a block device from a paritition on that device?

So, not sure if that the image that uboot writes using '3' needs a partition table at the front or not. Obviously only a partial image (containing main and diags) if it needs a partition table. Is it a raw image like you would get with dd?

What was in the image that you tried to restore with uboot?

Perhaps you need an image that was exported from uboot, in order to import an image. It might have some header metadata that it is looking for (i.e. not a raw dd image). Perhaps somebody can give you a copy of an export from uboot on a kindle3. I have a kindle3.

The real question is, will the '3' key work IF there is a properly formatted (and named) image file on the USB Drive?

[rastik]

I used option I to initialize partition table. But that didn't help, still cannot choose 3. When I use fstor I can see:

scsi 13:0:0:0: Direct-Access Kindle Internal Storage 0100 PQ: 0 ANSI: 2
sd 13:0:0:0: [sdb] Attached SCSI removable disk

But apart from that no partitions.

[rastik]

Originally Posted by geekmaster

Loading mmc0 from /mnt/us seems not accurately named. How can you reload an image of a block device from a paritition on that device?

With K3 when you used option 3, you got all partitions mounted via usb - e.g. sdb1,sdb2,sdb3,sdb4. But it does not work here I will have to look into kernel code.

Originally Posted by geekmaster

So, not sure if that the image that uboot writes using '3' needs a partition table at the front or not. Obviously only a partial image (containing main and diags) if it needs a partition table. Is it a raw image like you would get with dd?

What was in the image that you tried to restore with uboot?

It is partitioned now, at least I think so. I tried to flash system, diags and data partitions with no luck. I'm trying to flash raw image. That's all I have.
And I'm doing that via fastboot - in uboot select bist and then fastboot. It will activate USB communication and then via USB with yifanlu's fastboot tool.
Sample from uboot view:

bist > fastboot
Entering fastboot mode...
USB speed: HIGH
Connected to USB host!
Charger disconnect
USB speed: HIGH
Connected to USB host!
USB configured.
downloading
..done
flashing diags to MMC0, partition 0
..done.

It always says partition 0, no matter which partition I write.

Originally Posted by geekmaster

Perhaps you need an image that was exported from uboot, in order to import an image. It might have some header metadata that it is looking for (i.e. not a raw dd image). Perhaps somebody can give you a copy of an export from uboot on a kindle3. I have a kindle3.

I don't know how to export data via uboot. Not even fastboot allows that.
I have K3, but would that help for KT?

[geekmaster]

Menu option 'I' inits partition table and formats USB storage.

I was curious if uboot wants to load mmc0 as it says, or mmcblk0p1. Should the image it wants to load from USB contain the partition table? Also, does it want to see some kind of header info in that image file?

I would think it wants to load whatever format is saved from the menu. Perhaps you can try loading an image created from uboot on a different kindle touch. Not knowing what uboot does, it would be interesting to see if it can restore the backup IF it sees a correct image, or if it really does not even SEE that you pressed '3'.

Why bother putting option '3' there if it does not work? That is in the uboot program stored in a a small i2c or spi memory device AFAIK.

Do we have the source code for the uboot version in the kindle touch? There are too many questions and possibilities without analyzing uboot to narrow it down. Perhaps the device containing uboot can be read and written, allowing patches to uboot so you can restore your backup image to the mmc device.

EDIT: Or just use JTAG. JTAG hacking with linux (read the comments there too):
http://hackaday.com/2010/06/01/jtag-...ver-a-network/
or this:
http://goodfet.sourceforge.net/

[rastik]

Why are you asking questions about K3? Mine is Touch 3G. We have uboot sources, I'm looking into them while trying. If that worked (as on K3), I would get separate drives that are identical to individual partitions as seen by dd. That is one of the methods to recover K3 - copy dd backup over.
Menu 3 is not in uboot, it is in recovery menu. I think it's part of kernel but cannot find it there.

[geekmaster]

Originally Posted by rastik

Why are you asking questions about K3?

Oops. I mean "touch". I was just answering K3 questions for somebody else earlier and I typed the wrong thing here. I type the wrong thing all too often these days. At least I can edit my posts here. I will go back and edit those "s/k3/touch/g"... Done.

Hmm.. There was only one reference to k3 in my posts that I could edit. All the rest are in your posts (or your copies of my post). Anyway, I changed the one instance of "k3" to "touch" that was in my posts.

But, the idea is the same. Is the TOUCH apparently ignoring the '3' key in the uboot menu BECAUSE it cannot find a file formatted the way it wants?

The recovery menu on TOUCH is in mmcblk0p2, which was whacked by by zeroing the entire mmc, it looks like.

Is the uboot source code that you have for the TOUCH?

[yifanlu]

Stop worrying about option 3. It was removed from kindle builds after 3.3. You have only two viable options. Unfortunately both are untested. 1) USB download mode. You should find the imx50 USB programmer from freescale's website. I don't know if it will work. I never tried it. 2) use fastboot. I see you didn't get it working. It's most likely my fault. I coded it blindly, so you may want to take a look at the c source and see if it's interpreting the input correctly. Join the kindle dev irc chat and when I'm on, I can help you.

[geekmaster]

I do not know if this will help anybody, but it was discussed, so here is a fastboot cheat sheet:
http://andblogs.net/fastboot/

My question is still unanswered:
How do you enable fastboot on the kindle touch?

[yifanlu]

The kindle fastboot is very different from android fastboot even though some parts are alike (and I wrote the tool to be more like it). Your cheat sheet doesn't really apply. You get into fastboot either from uboot, diags, or using idme to set bootvars

[rastik]

Originally Posted by geekmaster

Oops. I mean "touch". I was just answering K3 questions for somebody else earlier and I typed the wrong thing here.

Originally Posted by geekmaster

The recovery menu on TOUCH is in mmcblk0p2, which was whacked by by zeroing the entire mmc, it looks like.

This recovery menu must be part of kernel, it gets executed before init (look for Press [ENTER] for recovery menu... in the text below). And I can access it no matter if I try booting from system (p1) or diags (p2). And even partitioning seems fine.

Starting kernel ...
mxc_spi mxc_spi.0: chipselect 0 already in use
mxc_spi mxc_spi.0: chipselect 0 already in use
mxc_spi mxc_spi.2: chipselect 0 already in use
2.6.31-rt11-lab126 #1 Thu Nov 10 00:32:00 PST 2011 armv7l
INFO:Loaded module /lib/modules/eink_fb_waveform.ko  (35728 bytes)
mxc_epdc_fb mxc_epdc_fb: not use_builtin_cmap !!
INFO:Loaded module /lib/modules/mxc_epdc_fb.ko default_panel_hw_init=1 default_update_mode=1 (45148 bytes)
INFO:eink initialized... (486400 bytes)
INFO:Using default keypad setting. (not passing "kb_rev" to module)
INFO:Loaded module /lib/modules/whitney_button.ko  (9268 bytes)
Press [ENTER] for recovery menu...       0 /INFO:*** Partition table verified for /dev/mmcblk0 ***
INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/105536 size=3458203648 bytes
flag type      first       last  lba first   lba size
Partition p1:
0x00 0x0b <large>    <large>         65536    6688768
    CHS: <large>
 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 33554432
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
  argc == 10
  argv[0]: "kinit"
  argv[1]: "consoleblank=0"
  argv[2]: "rootwait"
  argv[3]: "ro"
  argv[4]: "ip=off"
  argv[5]: "root=/dev/mmcblk0p1"
EXT3-fs: error loading journal.
EXT3-fs: error loading journal.
  argv[6]: "quiet"
  argv[7]: "eink=fslepdc"
  argv[8]: "video=mxcepdcfb:E60,bpp=8"
  argv[9]: "console=ttymxc0,115200"
  argc == 4
  argv[0]: "IP-Config"
  argv[1]: "-i"
  argv[2]: "Linux kinit"
  argv[3]: "ip=off"
EXT4-fs (mmcblk0p1): error loading journal
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: failed to identify filesystem /dev/root, trying all
kinit: trying to mount /dev/root on /root with type ext3
kinit: trying to mount /dev/root on /root with type ext2
kinit: trying to mount /dev/root on /root with type ext4
kinit: trying to mount /dev/root on /root with type cramfs
kinit: trying to mount /dev/root on /root with type vfat
kinit: trying to mount /dev/root on /root with type msdos
kinit: Unable to mount root fs on device dev(179,1)
kinit: init not found!
Kernel panic - not syncing: Attempted to kill init!

Originally Posted by geekmaster

Is the uboot source code that you have for the TOUCH?

Yes, it is included in the sources from Amazon. Even though it is for version 4.0 and my KT is 4.0.1.

[rastik]

Originally Posted by yifanlu

You have only two viable options. Unfortunately both are untested. 1) USB download mode. You should find the imx50 USB programmer from freescale's website. I don't know if it will work. I never tried it. 2) use fastboot. I see you didn't get it working. It's most likely my fault. I coded it blindly, so you may want to take a look at the c source and see if it's interpreting the input correctly. Join the kindle dev irc chat and when I'm on, I can help you.

USB download mode doesn't seem viable know, I'll keep it for later.
With fastboot flash I see it correctly sends download and flash commands. I know that writing system partition has to be changed, because uboot has a buffer of size 0x5e00000 only. And it is not enough for 15e00000 size of system partition.
When looking into mx50_yoshi_board.h from uboot sources, everything is written to partition 0:

static const struct partition_info_t partition_info[] = {
    {
	.name = "bootloader",
	.address = 0,
	.size = (376*1024), /* 376 KiB */
	.partition = 1,
    },
    {
	.name = "prod",
	.address = 0x0, /* overlap with bootloader */
	.size = (120*1024), /* 120 KiB */
	.partition = 1,
    },
    {
	.name = "bist",
	.address = CONFIG_MMC_BIST_ADDR, /* overlap with bootloader */
	.size = CONFIG_MMC_BIST_SIZE, /* 256 KiB */
	.partition = 1,
    },
    {
	.name = "userdata",
	.address = CONFIG_MMC_USERDATA_ADDR,
	.size = CONFIG_MMC_USERDATA_SIZE,  /* 5 KiB */
	.partition = 1,
    },
    {
    .name = "userpartition",
    .address = 0,
    .size = PARTITION_FILL_SPACE,  /* based on MMC size */
    .partition = 0,
    },
    {
	.name = "mbr",
	.address = 0,
	.size = 1024,  /* 1 KiB */
	.partition = 0,
    },
    {
	.name = "kernel",
	.address = CONFIG_MMC_BOOTFLASH_ADDR,
	.size = CONFIG_MMC_BOOTFLASH_SIZE,  /* 14 MiB */
	.partition = 0,
    },
    {
	.name = "diags_kernel",
	.address = CONFIG_MMC_BOOTDIAGS_ADDR,
	.size = CONFIG_MMC_BOOTFLASH_SIZE,  /* 14 MiB */
	.partition = 0,
    },
    {
	.name = "system",
	.address = 0x2000000,
	.size = (350*1024*1024),  /* 350 MiB */
	.partition = 0,
    },
    {
	.name = "diags",
	.address = 0x17E00000,
	.size = (64*1024*1024),  /* 64 MiB */
	.partition = 0,
    },
    {
	.name = "data",
	.address = 0x1BE00000,
	.size = PARTITION_FILL_SPACE,  /* based on MMC size */
	.partition = 0,
    }
};

No luck with irc now, will try later.

[rastik]

Originally Posted by geekmaster

How do you enable fastboot on the kindle touch?

I use serial console. Immediately after restart I press ENTER to stop autoboot. Then enter bist and then fastboot. uboot propagates USB command interface.

U-Boot 2009.08-lab126 (Nov 10 2011 - 00:14:40)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock     : 50000000Hz
ipg per clock : 50000000Hz
uart clock    : 24000000Hz
ahb clock     : 100000000Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock    : 100000000Hz
ddr clock     : 800000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1
Board: Whitney
Boot Reason: [POR]
Boot Device: MMC
Board Id: 0052601114771GW0
S/N: B00F260714822WVF
DRAM:  256 MB
Using default environment

In:    serial
Out:   logbuff
Err:   logbuff
Quick Memory Test 0x70000000, 0xfffe000
POST done in 13 ms
Hit any key to stop autoboot:  0
uboot > bist


U-Boot 2009.08-lab126 (Nov 10 2011 - 00:14:55)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock     : 50000000Hz
ipg per clock : 50000000Hz
uart clock    : 24000000Hz
cspi clock    : 54000000Hz
ahb clock     : 100000000Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock    : 100000000Hz
ddr clock     : 200000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1
Board: Whitney
Boot Reason: [POR]
Boot Device: MMC
Board Id: 0052601114771GW0
S/N: B00F260714822WVF
I2C:   ready
DRAM:  256 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
POST done in 1 ms
Battery voltage: 4143 mV

bist > fastboot
Entering fastboot mode...
Battery voltage: 4138 mV
USB speed: HIGH
Connected to USB host!
Charger disconnect
USB speed: HIGH
Connected to USB host!
USB configured.

Looking intpo uboot sources one (only) of the reasons to allow fstor command in bist is to export USB mass storage to charge the device. Once you enter fstor command it sticks there until restart or until battery reaches 5000mV. That's how I charge it now, apart from totally depleting battery first.

[rastik]

Somehow I managed to flash diags partition and boot from it:

uboot > run bootargs_diags ; bootm 0xE41000
## Booting kernel from Legacy Image at 70800000 ...
   Image Name:   Linux-2.6.31-rt11-lab126
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    5122560 Bytes =  4.9 MB
   Load Address: 70008000
   Entry Point:  70008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
Starting kernel ...
mxc_spi mxc_spi.0: can't setup spi1.0, status -22
mxc_spi mxc_spi.2: chipselect 0 already in use
2.6.31-rt11-lab126 #1 Wed Nov 9 15:20:18 PST 2011 armv7l
INFO:Loaded module /lib/modules/eink_fb_waveform.ko  (35504 bytes)
INFO:Loaded module /lib/modules/mxc_epdc_fb.ko default_panel_hw_init=1 default_update_mode=1 (43336 bytes)
INFO:eink initialized... (486400 bytes)
Press [ENTER] for recovery menu...       0 /INFO:*** Partition table verified for /dev/mmcblk0 ***
INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/105536 size=3458203648 bytes
flag type      first       last  lba first   lba size
Partition p1:
0x00 0x0b <large>    <large>         65536    6688768
    CHS: <large>
 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 33554432
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
  argc == 11
  argv[0]: "kinit"
  argv[1]: "consoleblank=0"
  argv[2]: "rootwait"
  argv[3]: "ro"
  argv[4]: "ip=off"
  argv[5]: "root=/dev/mmcblk0p2"
  argv[6]: "quiet"
  argv[7]: "user_debug=31"
  argv[8]: "eink=fslepdc"
  argv[9]: "video=mxcepdcfb:E60,bpp=8"
  argv[10]: "console=ttymxc0,115200"
  argc == 4
  argv[0]: "IP-Config"
  argv[1]: "-i"
  argv[2]: "Linux kinit"
  argv[3]: "ip=off"
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p2) = dev(179,2)
kinit: root_dev = dev(179,2)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: Mounted root (ext3 filesystem) readonly.
init started: BusyBox v1.17.1 (2011-11-09 15:05:40 PST)
starting pid 477, tty '': '/etc/init.d/rcS'
/etc/init.d/rcS: line 85: boot_milestone: not found
system: I rcS:def:starting /etc/rcS.d/S50diags
USER=root
prevlevel=N
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/
VERBOSE=no
READ_AHEAD=4
USER=root
prevlevel=N
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/
VERBOSE=no
IO_SCHED=anticipatory
USER=root
prevlevel=N
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/
VERBOSE=no
TMP_SIZE=32M
info firsttime:mount_rw:time=3610:Mounting root RW for first boot
ln: /usr/share/fonts/X11/misc/cursor.pcf: No such file or directory
info firsttime:mount_ro:time=3640:Mounting root RO
elevator: type  not found
info system:start:time=3710:
/etc/rcS.d/S50diags: line 462: f_proto: not found
info system:config:platform=yoshi,board=whitney,rev=38,proto=N,wifi=Y,wan=Y:
info system:done:time=3980:
info zforce:start:version=2.0b0r12:
/etc/rcS.d/S50diags: line 462: iptables-restore: not found
/opt/ar6k/include/dbglog.h.save: No such file or directory
info userstore:run:time=4910,action=start:
info userstore:found_bootup_flag::Found BOOTUP flag file
dosfsck 2.11 (12 Mar 2005)
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Logical sector size is zero.
FAT: bogus number of reserved sectors
mount: wrong fs type, bad option, bad superblock on /dev/loop/0,
       missing codepage or other error
       In some cases useful info is found in syslog - try
       dmesg | tail  or so

system: E mntus:def:partition mount failed (32)
info userstore:create_us::creating userstore filesystem
1+0 records in
1+0 records out
64 bytes (64B) copied, 0.002921 seconds, 21.4KB/s
BLKRRPART: Invalid argument

Disk /dev/mmcblk0p4: 105536 cylinders, 4 heads, 16 sectors/track
Old situation:
Units = sectors of 512 bytes, counting from 0

   Device Boot    Start       End   #sectors  Id  System
/dev/mmcblk0p4p1         65536   6754303    6688768   b  W95 FAT32
/dev/mmcblk0p4p2             0         -          0   0  Empty
/dev/mmcblk0p4p3             0         -          0   0  Empty
/dev/mmcblk0p4p4             0         -          0   0  Empty
New situation:
Units = sectors of 512 bytes, counting from 0

   Device Boot    Start       End   #sectors  Id  System
/dev/mmcblk0p4p1            16   6754303    6754288   b  W95 FAT32
/dev/mmcblk0p4p2             0         -          0   0  Empty
/dev/mmcblk0p4p3             0         -          0   0  Empty
/dev/mmcblk0p4p4             0         -          0   0  Empty
Successfully wrote the new partition table

Re-reading the partition table ...
BLKRRPART: Invalid argument

mkfs.vfat 2.11 (12 Mar 2005)
Loop device does not match a floppy size, using default hd params
/dev/loop/0 has 64 heads and 32 sectors per track,
logical sector size is 512,
using 0xf8 media descriptor, with 6754288 sectors;
file system has 2 32-bit FATs and 16 sectors per cluster.
FAT size is 3295 sectors, and provides 421729 clusters.
Volume ID is 0000c9fe, volume label Kindle     .
info userstore:create_default::creating userstore system and documents directories I
/mnt/base-us/system     hsd
/etc/rcS.d/S50diags: line 13: /usr/local/sbin/dropbear: not found
mounting waveform filesystem
umounting waveform filesystem
info display:started:time=12430:
/etc/upstart/battery-diags: line 91: f_proto: not found
info battery:charged:cap=100,mV=4177,mAH=1408:
USER=root
prevlevel=N
OLDPWD=/
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/dev
VERBOSE=no
LD_LIBRARY_PATH=/usr/lib/tts/speech/components/common/:/usr/lib/tts
No state is present for card imxyoshi
Unknown hardware: "WM8962" "" "" "" ""
Hardware is initialized using a guess method
/etc/rcS.d/S50diags: line 13: audioServer: not found
/etc/rcS.d/S50diags: line 13: kb: not found
diags : /opt/factory/rootfs_md5_list not found.
Sending: mkdir -p /mnt/base-us/diagnostic_logs/
PostMode len = 6 of 16
Ignoring PostMode
GlobalHalImpl: found DeviceType: 18
found: zforce
Sending cmd: modprobe mx50_yoshi_mma8453
input: mma8453 as /devices/virtual/i2c-adapter/i2c-0/0-001c/input/input5
check mma8453 chip ID
mma8453 0-001c: build time Nov  9 2011 15:18:29
add mma8453 i2c driver
Sending cmd: modprobe mx50_proximity
FATAL: Module mx50_proximity not found.
found: whitney_button
Input driver version is 1.0.0
Input device ID: bus 0x18 vendor 0x0 product 0x0 version 0x0
Input device name: "WM8962 Beep Generator"
Supported events:
Input driver version is 1.0.0
Input device ID: bus 0x0 vendor 0x0 product 0x0 version 0x0
Input device name: "imx-yoshi Headset"
Supported events:
Input driver version is 1.0.0
Input device ID: bus 0x19 vendor 0x1 product 0x1 version 0x100
Input device name: "whitney-button"
Supported events:
Input driver version is 1.0.0
Input device ID: bus 0x0 vendor 0x0 product 0x0 version 0x0
Input device name: "zforce"
Supported events:
Input driver version is 1.0.0
Input device ID: bus 0x19 vendor 0x0 product 0x0 version 0x0
Input device name: "mxckpd"
Supported events:
Input driver version is 1.0.0
Input device ID: bus 0x18 vendor 0x0 product 0x0 version 0x0
Input device name: "mma8453"
Supported events:
 failed to open /dev/input/event6
 failed to open /dev/input/event7
Ignoring PostMode
1000
1000
system_diags[MainTest] 1 INFO : Start test
   WHITNEY - System Diags
   ~~~~~~  1.0.6.217  ~~~ -1098617976 ~~~~~~~~~~~~
~ S ~ Device Setting
O) Operator test suite
R) Run in Test
G) Gas Gauge
E) 511
T) Power Test
B) Audio Test
H) Adjust battery
M) MoviNand
N) Misc individual diagnostics
Y) ART 11g factory test
U) USB device mode
D) Exit, Reboot or Disable Diags
K) Lock to HOME button
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
X) Exit

Entering U I was able to upload bin backup. Then via D and L got login prompt. root password I got from

http://members.ping.de/~sven/kindle.html

You need the whole string, with all 4 characters after fiona. And finally I rewrote mmcblk0p1 with dd using my backup.

IT WORKS!!! Thank you geekmaster and yifanlu. I'll write what I've found on wiki.

[yifanlu]

Cool, how did you finally flash diags?

[geekmaster]

Way beyond cool, IMHO. Totally awesome dude!

And yes, how did you do that flash? I realize that you said "somehow", but we need to document a repeatable method.

Congratulations!