[PW1] stuck on U-boot / USB Download Mode / unbrick attempt

[chefchens]

I got a bricked PW 1 (only amber light - never reaches green - NS blank CODEX on USB)

after reading a in the forum I started to try my luck in unbricking it - but to be honest I did not get the idea why the K5-Touch and K5-Paperwhite1 stories are mixed together in the forum and I did not find a good explanation .. from my understanding the hardware and board layout is different – so maybe the bootloader too?!?
I figured out that my PW1 is in USB download mode (it displays “NS blank CODEX” in the device Manager in Windows).
I opened the PW1 and attached a 1v8 TTL USB converter to the serial port to see if there was some output over the console -> long story short: no, nothing.

Next step was to try MFGTool to upload U-Boot into RAM directly - this seems to work up to a point :
1st MFG detects the kindle -> that’s OK
2nd MFG is able to upload U-Boot according to profile into RAM -> that’s OK
3rd I do get a serial output on the Console: -> that’s OK

U-Boot 2009.08-lab126 (Feb 19 2012 - 05:01:38)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock     : 50000000Hz
ipg per clock : 50000000Hz
uart clock    : 24000000Hz
ahb clock     : 100000000Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock    : 100000000Hz
ddr clock     : 800000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1
Timeout waiting for DAT0 to go high!
mmc switch failed: -19
### ERROR ### Please RESET the board ###

4th after ‘MMC: FSL_ESDHC: 0, FSL_ESDHC: 1’ there is a long wait period -> that’s might be OK, I do not have a comparison.
5th the ‘timeout message appears’ and after this the PW1 reboots. -> that’s is most likely NOT OK

To confirm my approach I have the following questions:
- Is the logged behavior expected? – I think the answer is ‘no’
- Is the logged timeout triggered because of a wrong u-boot version (that was compiled for the K5-Touch and not for the K5-PW1) and do I only need a correct U-Boot for the PW1?
- Do I have a hardware fault on the PW1 board – maybe an EMMC hardware fault?


To find out about an error situation, a valid approach might be to upload a U-Boot with debugging enabled so that the output on the serial console is a little more verbose – does anybody know of a pre-compiled U-Boot version for the PW1 out there in the Internet that I could upload into my PW1?



In Addition to the scenario described above where I used U-Boot included in this forums pre-tailored MFGTool distribution I uploaded u-Boot with the fastboot server included by eureka into my PW1 – but the outcome was not different I had the same error message as in the other version on the serial console.
u-boot serial log with embedded fastboot by eureka on my PW1:

U-Boot 2009.08-lab126 (Dec 14 2013 - 16:51:54)

MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1
Timeout waiting for DAT0 to go high!
mmc switch failed: -19
### ERROR ### Please RESET the board ###

So guys, can you provide a hint if I can stop trying to unbrick my PW1 or if I should try to connect to the EMMC directly to try to read / or restore the content.


Thanks for your help....


BTW. Which shielding on the PW1-Board contains the emmc chip? The one with the engraved 1, 2, 3 or 4?

[chefchens]

Hi Guys

can you please give me a hint if i posed a dumb or a hard question.

...and yes I know that a PW1 is a hard one to work on...

[knc1]

Originally Posted by chefchens

- - - -
So guys, can you provide a hint if I can stop trying to unbrick my PW1 or if I should try to connect to the EMMC directly to try to read / or restore the content.


Thanks for your help....


BTW. Which shielding on the PW1-Board contains the emmc chip? The one with the engraved 1, 2, 3 or 4?

The last two in reverse order:

Check with the teardown links listed in the master wiki index.
There should be ones with good board photos.

Directly connect to the eMMC chip ????
That will be a real good trick if you pull it off (no pun intended), it is a BGA package.
And even if you could (or can), it will not do any good, you need to replace it.

[chefchens]

Thanks for your answer

I was thinking of a similar approach as it was used over here https://www.exploitee.rs/index.php/Amazon_FireTV where they had a comparable problem to interface a emmc chip.
since the board will most likely die during this operation I would prefer to upload a correct first stage bootloader (the initial u-boot) via MFGtool into ram.

can you give me a hint where I could find one of those - or should the ones includes in the MFGTool from this forum be working?

I found a K4 and a Touch Teardown with shields removed.... i keep looking

Thanks

[knc1]

https://wiki.mobileread.com/wiki/K5_Index

[hawhill]

I think not many people fiddled with the device in this mode. Most likely, the eMMC does indeed have a hardware failure.

[chefchens]

Ok I got the point

After a little further reading I saw that a flat battery might force the PW1 into a secure low power mode without auxiliary like eMMC.
To prevent low power mode I added (in parallel to the battery) a fixed voltage source - which did not change the behaviour of the PW1-board.
Next step from my side will be to build an u-boot from source and try to enable debugging (if I remember this correctly there were some disabled switches in the code) to see if I get more information from U-Boot on the serial console before it is halting the board and to find out more about MMC switch: -19

cheers

[knc1]

Either repair the hardware or stop wasting your time.

[chefchens]

@knc1: it is just for phun.
I have two working K4 and a PW2 for reading – so I am fine on that side.
I have, as a sure thing, a PW2 with a cracked screen - with replacement parts for the screen arriving from china every day – so this one is going to work again.

My current project is the PW1 Board I am playing around with, with the screen working…..
…and a K4 Board without a screen with a “Frankenstein Battery” - where I connected a LiIo Cell savaged from an old blackberry battery to the electronics of a broken K4 Battery – which works fine.
... as I said. It’s for the sake of it.... and it would be a nice thing if I found out more about the PW1…

[eureka]

Originally Posted by chefchens

To confirm my approach I have the following questions:
- Is the logged behavior expected? – I think the answer is ‘no’
- Is the logged timeout triggered because of a wrong u-boot version (that was compiled for the K5-Touch and not for the K5-PW1) and do I only need a correct U-Boot for the PW1?
- Do I have a hardware fault on the PW1 board – maybe an EMMC hardware fault?

Take my words with a grain of salt, I'm not an expert, just did some grepping/reading of sources and googling.

Your error happened in phase of internal storage initialization. CPU sent command to storage and polled DAT0 line of storage's interface to wait when "busy" (busy with command execution) signal ends. And after 25 seconds timeout, waiting was stopped with timeout error (number -19 is defined in source as TIMEOUT).

Here PW1 owner got at least after storage initialization stage by using precompiled U-Boot from this forum, so the problem is not in wrong U-Boot, I think.

[chefchens]

Originally Posted by eureka

Take my words with a grain of salt, I'm not an expert, just did some grepping/reading of sources and googling.

Your error happened in phase of internal storage initialization. CPU sent command to storage and polled DAT0 line of storage's interface to wait when "busy" (busy with command execution) signal ends. And after 25 seconds timeout, waiting was stopped with timeout error (number -19 is defined in source as TIMEOUT).

Here PW1 owner got at least after storage initialization stage by using precompiled U-Boot from this forum, so the problem is not in wrong U-Boot, I think.

Thanks for that.. I have seen the timeout error in the sources too.
And I even read the message you linked to...but in the quoted log that the kindle the message was generated on was identified as a "KindleTouch" so I was not sure if it really was a PW1 and not a Kindle Touch.

I think I will let the PW1 board RIP



Maybe I will give it a try desoldering of the shields and try to find out how to interface the emmc....

Thanks for your help...

[chefchens]

more or less just out of curiosity I build a yoshime u-boot with a debug switch turned on in mmc.c

it does seem that the my mmc chip answers to u-boot quite a bit
i will try to make sense out of the log in the next days.
maybe somebody else wants to jump in

this is the log:

U-Boot 2009.08-lab126 (Jun 07 2015 - 23:58:45)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock     : 50000000Hz
ipg per clock : 50000000Hz
uart clock    : 24000000Hz
ahb clock     : 100000000Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock    : 100000000Hz
ddr clock     : 800000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1
mmc_init begin
esdhc_init begin: base_addr=0x50020000
 wait for restart
set_sysctl: begin
set_sysctl: setting clock
set_sysctl: exit
  wait for init
esdhc_init complete
esdhc_set_ios: set clock to 0
set_sysctl: begin
set_sysctl: setting clock
set_sysctl: exit
esdhc_set_ios: set bus_width to 1
esdhc_set_ios: set clock to 400000
set_sysctl: begin
set_sysctl: setting clock
set_sysctl: exit
esdhc_set_ios: set bus_width to 1
Sending CMD0
 cmd status=0x1
  success
Detecting SD card..
Sending CMD8
 cmd status=0x10001
Sending CMD55
 cmd status=0x10001
SD init cmds timeout.  Trying MMC
Sending CMD1
 cmd status=0x1
  success
mmc_send_op_cond: ocr=0x80ff8080 hc=0
Sending CMD2
 cmd status=0x1
  success
Sending CMD3
 cmd status=0x1
  success
Sending CMD9
 cmd status=0x1
  success
rd blklen = 1024 wr blklen = 512
Sending CMD7
 cmd status=0x1
  success
card=0x0 host=0xf11
Sending CMD6
 cmd status=0x1
Timeout waiting for DAT0 to go high!
mmc switch failed: -19
### ERROR ### Please RESET the board ###

[knc1]

Originally Posted by chefchens

more or less just out of curiosity I build a yoshime u-boot with a debug switch turned on in mmc.c

it does seem that the my mmc chip answers to u-boot quite a bit
i will try to make sense out of the log in the next days.
maybe somebody else wants to jump in

this is the log:

- - - - - -
card=0x0 host=0xf11
Sending CMD6
Sending CMD6
 cmd status=0x1
Timeout waiting for DAT0 to go high!
mmc switch failed: -19
### ERROR ### Please RESET the board ###

The micro-controller in your eMMC is beyond recovery.
Please see:
https://www.mobileread.com/forums/sho...49&postcount=3

[eureka]

Originally Posted by chefchens

more or less just out of curiosity I build a yoshime u-boot with a debug switch turned on in mmc.c

it does seem that the my mmc chip answers to u-boot quite a bit
i will try to make sense out of the log in the next days.
maybe somebody else wants to jump in

From my reading of sources, it looks like card works fine from the start, but it can't switch to wider data bus width (I read mmc_startup function in drivers/mmc/mmc.c of U-Boot). Maybe if mmc->card_caps |= (MMC_MODE_4BIT | MMC_MODE_8BIT); line will be commented, device will boot.

[knc1]

It seems to me that we have had other posters who lost the 8bit wide mode and found out (the hard way) that 4bit mode will not work with the Kindle SoC.

I might be wrong, the posts where a year or two ago.