Inner workings of "factory reset": bootloader or application?

[bramepc]

Hi,

I have opened up a bricked kobo auro N514 from a friend of mine thinking it would be a problem with a dead battery or something but it turns out that there is a SW problem too. Since the battery is dead I am currently running directly from a bench supply. I have connected to the serial output to see what is going on and I can see uboot booting, then loading and uncompressing the kernel but then it fails. Log:

U-Boot 2009.08-dirty-svn ( 5? 14 2013 - 08:44:55)

CPU: Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock : 66666666Hz
ipg per clock : 66666666Hz
uart clock : 24000000Hz
ahb clock : 133333333Hz
axi_a clock : 400000000Hz
axi_b clock : 200000000Hz
weim_clock : 100000000Hz
ddr clock : 200000000Hz
esdhc1 clock : 80000000Hz
esdhc2 clock : 80000000Hz
esdhc3 clock : 80000000Hz
esdhc4 clock : 80000000Hz
Board: MX50 RDP board
Boot Reason: [POR]
Boot Device: MMC
I2C: ready
DRAM: 256 MB
MMC: FSL_ESDHC: 0, FSL_ESDHC: 1, FSL_ESDHC: 2
In: serial
Out: serial
Err: serial
[_get_sd_number] g_sd_number:2

MMC read: dev # 2, block # 1023, count 1 partition # 0 ...
1 blocks read: OK

MMC read: dev # 2, block # 1024, count 1 partition # 0 ...
1 blocks read: OK
ram p=70000000,size=268435456

MMC read: dev # 2, block # 18431, count 1 partition # 0 ...
1 blocks read: OK
no "logo" bin header

MMC read: dev # 2, block # 14335, count 1 partition # 0 ...
1 blocks read: OK

MMC read: dev # 2, block # 14336, count 11463 partition # 0 ...
11463 blocks read: OK
Kernel RAM visiable size=250M->250M
init TPS65185 power ...
Relock PLL1 to 1GHz ...
mx50 pll1: 1000MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock : 66666666Hz
ipg per clock : 66666666Hz
uart clock : 24000000Hz
ahb clock : 133333333Hz
axi_a clock : 400000000Hz
axi_b clock : 200000000Hz
weim_clock : 100000000Hz
ddr clock : 200000000Hz
esdhc1 clock : 80000000Hz
esdhc2 clock : 80000000Hz
esdhc3 clock : 80000000Hz
esdhc4 clock : 80000000Hz
Hit any key to stop autoboot: 0

MMC read: dev # 2, block # 2047, count 1 partition # 0 ...
1 blocks read: OK
no kernel image signature !

MMC read: dev # 2, block # 2048, count 8192 partition # 0 ...
8192 blocks read: OK
## Booting kernel from Legacy Image at 70800000 ...
Image Name: r6836_#2039 Jul 30 10:07:41
Created: 2013-07-30 2:07:45 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1949916 Bytes = 1.9 MB
Load Address: 70008000
Entry Point: 70008000
Loading Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
NtxHwCfg_GetCfgFldStrVal:[WARNING]Config version too new !! Please update hardware config tool !!
1+0 records in
1+0 records out
512 bytes (512B) copied, 0.005079 seconds, 98.4KB/s
/etc/init.d/rcS: line 43: mkfifo: not found
cannot open /dev/null
dosfsck 3.0.6, 04 Oct 2009, FAT32, LFN
/dev/mmcblk0p3: 2 files, 2/817857 clusters
/etc/init.d/rcS: line 137: /usr/local/Kobo/nickel: not found
[PROGRESS_BAR-2917] No progess ...

(none) login: NtxHwCfg_GetCfgFldStrVal:[WARNING]Config version too new !! Please update hardware config tool !!

If I login I see that nickel is indeed not present:

root
login[520]: root login on 'ttymxc0'
-sh: id: not found
[root@(none) ~]# cd /usr/local/Kobo/
[root@(none) Kobo]# ls
conf libiwnn.so
configure_wep.sh libiwnn.so.1.0
configure_wpa_enterprise.sh libiwnn.so.1.0.0
configure_wps_network.sh liblzma.so.5
crypto libnickel.so.1
demoloop.sh libnickel.so.1.0
demoloopfnac.sh libnickel.so.1.0.0
demoloopja.sh libscribble.so
dic libsolitaire.so
fb2.xsl.gz libwikipedia.so
fickel pickel
hindenburg puz
libQtSolutions_IOCompressor-2.3.so revinfo
libQtSolutions_IOCompressor-2.3.so.1.0 save_config.sh
libboggle.so stockfish
libcb.so unrar
libcrossword.so zim

Maybe it died mid upgrade or something (?)

Anyway I tried performing a manual factory reset as described in https://wiki.mobileread.com/wiki/Kob...Aura_Edition_2 but so this does not seem to do the trick.

Is checking the button combination for factory reset something that is handled by the nickel application, or is it handled by uboot (or maybe something even more low level?) .
In the former case I guess it is pretty logical it does not work, in the latter I need to retry a bit more.

In the former is there is a chance i get it working again with the procedure described in https://www.mobileread.com/forums/sh...d.php?t=289206 ?
(there is no image for the aura but I read in another thread that ppl have success with the N250 Aura H2O image on the aura).

Or if there are suggestions for an alternative method, since I have root access I am guessing there should be a way to get it up and running again ?

Note : I also checked the contents of the init.d/rcS file for completeness (not sure what it is suppose to be, there is some stuff about upgrading in there so maybe this indicates a problem happining during mid update) :
[root@(none) Kobo]#cd /etc/init.d
[root@(none) init.d]# cat rcS
#!/bin/sh

PRODUCT=`/bin/kobo_config.sh`;
[ $PRODUCT != trilogy ] && PREFIX=$PRODUCT-

mount -o remount,noatime,nodiratime /dev/mmcblk0p1 /

PLATFORM=freescale
if [ `dd if=/dev/mmcblk0 bs=512 skip=1024 count=1 | grep -c "HW CONFIG"` == 1 ]; then
PLATFORM=ntx508
fi

if [ $PLATFORM == freescale ]; then
if [ ! -s /lib/firmware/imx/epdc_E60_V220.fw ]; then
mkdir -p /lib/firmware/imx
dd if=/dev/mmcblk0 bs=512K skip=10 count=1 | zcat > /lib/firmware/imx/epdc_E60_V220.fw
sync
fi
fi

PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/lib:
runlevel=S
prevlevel=N
umask 022
export PATH runlevel prevlevel

for i in /proc /dev /root /tmp /sys /mnt/sd /mnt/onboard /mnt/user /var/lib /var/log /var/run /lib/modules/`uname -r`; do
[ ! -d $i ] && mkdir -p $i
done;

/bin/mount -t proc none /proc
/bin/mount -t tmpfs none -o size=16m /tmp
/bin/mount -t tmpfs none /dev
/bin/mount -t tmpfs none -o size=16k /var/lib
/bin/mount -t tmpfs none -o size=16k /var/log
/bin/mount -t tmpfs none -o size=128k /var/run
/bin/mount -t sysfs none -o size=500k /sys

for i in /var/run/dbus /var/lib/dbus; do
mkdir -p $i
done

mkfifo /tmp/nickel-hardware-status
rm -rf /etc/udev/rules.d/70-persistent-net.rules
rm -rf /mnt/onboard/.kobo
rm -rf /mnt/onboard/*

echo -e '\000\000\000\000' > /proc/sys/kernel/hotplug
/sbin/udevd -d

if [ $PLATFORM == freescale ] || [ ! -e /etc/udev.tgz ]; then
/sbin/udevadm control --env=STARTUP=1
/sbin/udevadm trigger
/sbin/udevadm settle --timeout=2
/sbin/udevadm control --env=STARTUP=
[ $PLATFORM != freescale ] && tar cpzf /etc/udev.tgz /dev &
else
zcat /etc/udev.tgz > /dev/null || ( rm -rf /etc/udev.tgz; reboot )
tar zxf /etc/udev.tgz -C /
fi

dosfsck -a -w /dev/mmcblk0p3
mount -t vfat -o noatime,nodiratime,shortname=mixed,utf8 /dev/mmcblk0p3 /mnt/onboard
rm -rf /mnt/onboard/fsck*
rm -rf /mnt/onboard/FSCK*
rm -rf /usr/local/Kobo/db.tgz

echo -n 8192 > /proc/sys/vm/min_free_kbytes
echo -n 67108864 > /proc/sys/kernel/shmmax

if [ ! -e /mnt/onboard/.kobo ]; then
mkdir -p /mnt/onboard/.kobo
fi

if [ -e /mnt/onboard/.kobo/Kobo.tgz ]; then
zcat /mnt/onboard/.kobo/Kobo.tgz > /dev/null && tar zxf /mnt/onboard/.kobo/Kobo.tgz -C /usr/local/Kobo/
rm /mnt/onboard/.kobo/Kobo.tgz
echo "Done upgrading..."
fi

if [ -e /mnt/onboard/.kobo/KoboRoot.tgz ]; then
zcat /etc/images/$PREFIX\ghostbuster.raw.gz | /usr/local/Kobo/pickel showpic
/etc/init.d/update-animator.sh &
zcat /mnt/onboard/.kobo/KoboRoot.tgz > /dev/null && tar zxf /mnt/onboard/.kobo/KoboRoot.tgz -C /
if [ -e /mnt/onboard/.kobo/upgrade ]; then
/etc/init.d/upgrade-wifi.sh
rm -rf /mnt/onboard/.kobo/upgrade
fi
rm /mnt/onboard/.kobo/KoboRoot.tgz
killall update-animator.sh
echo "Done upgrading..."
zcat /etc/images/$PREFIX\ghostbuster.raw.gz | /usr/local/Kobo/pickel showpic
zcat /etc/images/$PREFIX\reboot.raw.gz | /usr/local/Kobo/pickel showpic
sync
reboot
fi

( usleep 400000; /etc/init.d/on-animator.sh ) &

(
/usr/local/Kobo/pickel disable.rtc.alarm

if [ ! -e /etc/wpa_supplicant/wpa_supplicant.conf ]; then
cp /etc/wpa_supplicant/wpa_supplicant.conf.template /etc/wpa_supplicant/wpa_supplicant.conf
fi

echo 1 > /sys/devices/platform/mxc_dvfs_core.0/enable

/sbin/hwclock -s -u
) &

INTERFACE=wlan0
WIFI_MODULE=ar6000
if [ $PLATFORM == ntx508 ]; then
INTERFACE=eth0
WIFI_MODULE=dhd
fi

export INTERFACE
export WIFI_MODULE

export QWS_MOUSE_PROTO="tslib_nocal:/dev/input/event1"
export QWS_KEYBOARD=imx508kbd:/dev/input/event0
export QWS_DISPLAY=Transformed:imx508:Rot90
export NICKEL_HOME=/mnt/onboard/.kobo
export LD_LIBRARY_PATH=/usr/local/Kobo
export WIFI_MODULE_PATH=/drivers/$PLATFORM/wifi/$WIFI_MODULE.ko
export LANG=en_US.UTF-8
export UBOOT_MMC=/etc/u-boot/$PLATFORM/u-boot.mmc
export UBOOT_RECOVERY=/etc/u-boot/$PLATFORM/u-boot.recovery

/bin/dbus-uuidgen > /var/lib/dbus/machine-id
/bin/dbus-daemon --system &
export DBUS_SESSION_BUS_ADDRESS=`/bin/dbus-daemon --session --print-address --fork`

/usr/local/Kobo/hindenburg &
/usr/local/Kobo/nickel -qws -skipFontLoad &
[ $PLATFORM != freescale ] && rm -rf /dev/mmcblk1* && udevadm trigger &
[root@(none) init.d]#

[PeterT]

You might be interested in this excerpt from the thread on Kobo µSD Card Image Requests https://www.mobileread.com/forums/sh...d.php?t=355778

Originally Posted by DNSB

*Kobo N514 Aura*
The Aura N514 does not have removable internal storage so no image is available. People have used a N250 Aura H2O image copied to a µSD card and booted from that card in the external µSD card slot. See message #124 in this thread for one user's experience.

[bramepc]

Yeah I have seen it, that is the procedure I refer to in "In the former is there is a chance i get it working again with the procedure described in ...". That process is afaik handled in the bootloader since in that case the bootloader decides to load a different image (so it cannot be something in linux land).

So this led me to hoping that the factory reset stuff is also handled in the bootloader but then i do not understand why it does not seem to trigger a different boot scenario when i do it.

[geek1011]

Originally Posted by bramepc

Maybe it died mid upgrade or something (?)

Dying mid-upgrade shouldn't result in missing files; updates are purely additive. I don't remember the exact details, but this situation might be possible if shutting down during a hard factory reset.

Anyway I tried performing a manual factory reset as described in https://wiki.mobileread.com/wiki/Kob...Aura_Edition_2 but so this does not seem to do the trick.

Is checking the button combination for factory reset something that is handled by the nickel application, or is it handled by uboot (or maybe something even more low level?) .
In the former case I guess it is pretty logical it does not work, in the latter I need to retry a bit more.

Last I checked, it is handled in the early init script.

In the former is there is a chance i get it working again with the procedure described in https://www.mobileread.com/forums/sh...d.php?t=289206 ?
(there is no image for the aura but I read in another thread that ppl have success with the N250 Aura H2O image on the aura).

Or if there are suggestions for an alternative method, since I have root access I am guessing there should be a way to get it up and running again ?

If you have root access and no sd card image, first take a sd card image (at least of the first few tens of megabytes, preferably also the recovery partition too, or even the whole thing) so you have one.

See if you have a working recovery partition. In there is a fs.tgz file which contains the initial contents of the system partition. If you're lucky, you should be able to just extract that over the system partition, then extract an upgrade over it after.

[bramepc]

If you have root access and no sd card image, first take a sd card image (at least of the first few tens of megabytes, preferably also the recovery partition too, or even the whole thing) so you have one.

That will be a bit hard since there is no sd card in the aura, it boots from emmc.
From what i gather from the uboot log it first reads emmc sectors containing the linux image in dram memory, then jumps to that memory.
If there is a raw emmc driver in the linux partition available I might be able to read the 8192 emmc blocks starting from 2048 and dump that the external sd card. But i would need to investigate a bit more how this should work in practice.

Cfr:

MMC read: dev # 2, block # 2047, count 1 partition # 0 ...
1 blocks read: OK
no kernel image signature !

MMC read: dev # 2, block # 2048, count 8192 partition # 0 ...
8192 blocks read: OK
## Booting kernel from Legacy Image at 70800000 ...
Image Name: r6836_#2039 Jul 30 10:07:41
Created: 2013-07-30 2:07:45 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1949916 Bytes = 1.9 MB
Load Address: 70008000
Entry Point: 70008000
Loading Kernel Image ... OK
OK

I also see that the kernel image data is really old, but maybe that part is never updated and it is only files inside the file system that are replaced.

I tried already a few times to stop uboot from automatically executing its boot script by continuously pressing keys but it seems they do not allow this option (timer is set to 0, not being able to stop is probably a consequence of that but i need to look at uboot documentation to be sure).

What i would hope is an option is that i somehow trigger factory reset from the linux command prompt. I will try to look around in the init scripts if i can find something like that back.

[sherman]

Originally Posted by bramepc

That will be a bit hard since there is no sd card in the aura, it boots from emmc.
From what i gather from the uboot log it first reads emmc sectors containing the linux image in dram memory, then jumps to that memory.
If there is a raw emmc driver in the linux partition available I might be able to read the 8192 emmc blocks starting from 2048 and dump that the external sd card. But i would need to investigate a bit more how this should work in practice.

Cfr:

MMC read: dev # 2, block # 2047, count 1 partition # 0 ...
1 blocks read: OK
no kernel image signature !

MMC read: dev # 2, block # 2048, count 8192 partition # 0 ...
8192 blocks read: OK
## Booting kernel from Legacy Image at 70800000 ...
Image Name: r6836_#2039 Jul 30 10:07:41
Created: 2013-07-30 2:07:45 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1949916 Bytes = 1.9 MB
Load Address: 70008000
Entry Point: 70008000
Loading Kernel Image ... OK
OK

I also see that the kernel image data is really old, but maybe that part is never updated and it is only files inside the file system that are replaced.

I tried already a few times to stop uboot from automatically executing its boot script by continuously pressing keys but it seems they do not allow this option (timer is set to 0, not being able to stop is probably a consequence of that but i need to look at uboot documentation to be sure).

What i would hope is an option is that i somehow trigger factory reset from the linux command prompt. I will try to look around in the init scripts if i can find something like that back.

geek1011 is talking about dumping the contents of the eMMC storage. There is a recovery partition on the eMMC which contains a file called fs.tgz which you can extract over the root filesystem in the rootfs partition.



Is it possible to (slowly) dump the eMMC over serial using something like dd?