Unbrick a PW3 (Fastboot)

[nigredo]

Thanks knc1,
I found your photos.

By now I'm practicing with my old k4nc, using imx_usb_loader to set the kindle in fastboot mode. But it seems that there are problems flashing the main fs (too big).

So I'm considering alternatives, for example try to load the official uboot for imx6 in ram (don't know if it is possible) because this version,
reading the freescale forum, is apparently able to run commands on the device like a shell (sort of) using other utility named utp_com.

[knc1]

Originally Posted by nigredo

Thanks knc1,
I found your photos.

By now I'm practicing with my old k4nc, using imx_usb_loader to set the kindle in fastboot mode. But it seems that there are problems flashing the main fs (too big).

So I'm considering alternatives, for example try to load the official uboot for imx6 in ram (don't know if it is possible) because this version,
reading the freescale forum, is apparently able to run commands on the device like a shell (sort of) using other utility named utp_com.

The K4 is not an I.MX6 (only newer than PW-1 are I.MX6).
It is one of the i.MX5 series (mx50? mx53? - not sure).

Check the Wiki master index for K4, and then that section for a teardown - at least one of them will mention part numbers.

[nigredo]

I know, but the purpose of this exercise is to get the voyage jailbreak.
Since I've lost the chance of using the serial my only hope is flash a modified root fs. Or discover some way of rooting it.

I worked with microcontrollers years ago, but compared with these SoC were toys...

[knc1]

Originally Posted by nigredo

I know, but the purpose of this exercise is to get the voyage jailbreak.
Since I've lost the chance of using the serial my only hope is flash a modified root fs. Or discover some way of rooting it.

I worked with microcontrollers years ago, but compared with these SoC were toys...

Which is why I suggested you investigate that "USB Boot" feature labeled on the board.

There is a 'special' format for booting the i.MX6SL from SD Card (buildroot(.org) can create it) - I suspect that the labeled "USB Boot" feature expects the same bootable format over usb.

[nigredo]

Already downoloaded, now studying the docs...

Thanks very much knc1

[knc1]

That thread of mine you found with all the attachements - -
One of those is the i.MX6 reference manual.

[nigredo]

So far I got that the USB boot mode is rather misterious...

Yes, there's a tool named elftosb in buildroot, but it is not in the menu tree, I'm investigating how to include.

Anyway what it is not clear at all is: WHAT will execute a file uploaded with imx_usb and, more important, in which state the system is ?

I suspect that closing the USB boot while the kindle is running normal the system shoud be available, but I'm waiting for more informations before re-open the kindle, it is a tedious work...

[nigredo]

Finally some light... inclusive about why I got so confused.

The famous USB boot mode happens at reset, so we are with a cpu uninitialized, no dreams.
In this case: upload a uboot, upload a kernel+initramfs, run uboot that run the kernel.

At this point some people change the protocol from Serial Download Protocol to Updater Transport Protocol (the one used by utp_com, but mfgtool use too), but having a kernel there are more options.

UTP is based on SCSI messages, freescale has a kernel module that create a /dev/something.
Then a userspace daemon/program can commmunicate and handle the (few) commands, erase, flash etc. and can pass the commands to the shell too, or whatever.

UTP can be used on a normal running system (having the module), but I don't know if lab126 implemented it. I'll try to modify utp_com and see if there are answers when kindle is in normal state.

Update: I checked the kernel config, the module is disabled...

[knc1]

Originally Posted by nigredo

Finally some light... inclusive about why I got so confused.

The famous USB boot mode happens at reset, so we are with a cpu uninitialized, no dreams.
In this case: upload a uboot, upload a kernel+initramfs, run uboot that run the kernel.

At this point some people change the protocol from Serial Download Protocol to Updater Transport Protocol (the one used by utp_com, but mfgtool use too), but having a kernel there are more options.

UTP is based on SCSI messages, freescale has a kernel module that create a /dev/something.
Then a userspace daemon/program can communicate and handle the (few) commands, erase, flash etc. and can pass the commands to the shell too, or whatever.

UTP can be used on a normal running system (having the module), but I don't know if lab126 implemented it. I'll try to modify utp_com and see if there are answers when kindle is in normal state.

Update: I checked the kernel config, the module is disabled...

Anything that you learn is more than we know here, so whatever time you spend is not wasted.

I have read (a small) bit of the Lab126 u-boot code -
And learned things like:
The voltage regulators are shut down (but u-boot finishes the SoC initialization).

I suspect that the on-chip boot code will jump to the USB download state with only OCRAM availabe (no dynamic ram start-up yet) -
ready to read the DCD (SoC hardware set-up) file.

Note: Just a few threads down in the index here is someone who has done better than "erase all" - their Kindle can not even init the dynamic ram.
So we have a use for anything learned here from that point on.

There is (or was) a separate manual posted @ Freescale about the on-chip to off-chip boot sequence.
One note: "Secure Boot" is disabled in the Kindle's SoC, one less thing to be worried about (that is from one of the log files posted in this thread).

There is no telling what NXP Semiconductors is going to do about the i.MX?? documentation and git repositories.

Note:
NXP Semiconductor purchased the firm previously known as Freescale Semiconductor last December 7th.
Freescale Semiconductor was the name of the firm previously known as Motorola.

I doubt that NXP will drop the i.MX6 product line (the newest line, with a very big customer (Amazon) ) - -
But that doesn't say anything about what will happen to the support available to non-customers.

In fact, I would not be surprised if we hear that Jeff Bezos has purchased a large chunk of NXP stock, just to be sure that the i.MX6 product line doesn't 'get lost' in the ownership transition. (It would probable be a smart move for Amazon to make.)

= = = = =

Note to the casual reader:
These recent posts are not 'off topic' - this stuff is all related.

[nigredo]

Hi knc1,

I'm considering to build a minimal kernel for imx5/6 and initramfs which should do :
load the g_ether module to enable usbnet, run sshd/dropbear.

The problem is uboot. Buildroot brags "use make uboot-menuconfig", but unfortunately this target doesn't exist... The OCRAM is only 128k, if at all, eureka suspects it is even less, but the one BR built is more than 250k.

The uboot-fastboot developed by eureka it is more suited as start point, I'll try to remove the flash part and enable the part to load the kernel+initramfs.

[knc1]

Originally Posted by nigredo

Hi knc1,

I'm considering to build a minimal kernel for imx5/6 and initramfs which should do :
load the g_ether module to enable usbnet, run sshd/dropbear.

The problem is uboot. Buildroot brags "use make uboot-menuconfig", but unfortunately this target doesn't exist... The OCRAM is only 128k, if at all, eureka suspects it is even less, but the one BR built is more than 250k.

The uboot-fastboot developed by eureka it is more suited as start point, I'll try to remove the flash part and enable the part to load the kernel+initramfs.

There are a couple other things to consider -
To use Amazon's source (recommended), you will have to use "source dir override" so you can un-pack their u-boot source (2009-08 IIRC) into a local dir rather than let BR download the current.

I don't think eureka ever put his changes in a public repo -
Although he/she did post the diff files here.

I would:
Download the 5.6.1.1 source code tarball from Amazon it runs on both the PW1 (i.MX5) and the PW3 (i.MX6), perhaps not the same build, but the same source code release.

Init the directory tree made by the u-boot tarball as a local git repo.

Then checkout a branch -

Then apply eureka's diff -

Use git features to do the merge -

Then work with that (which, when your satisfied with it,) can be used as the target of a source dir override.

The advantages of working under source control + the advantages of using an automated build system for anything non-customized.

There is also some trick to declaring that BR should use the u-boot .config in the external directory.

The on-line user's manual is the key document.

[knc1]

Might be a doc error:

Makefile:	@echo '  menuconfig             - interactive curses-based configurator'
Makefile:	@echo '  busybox-menuconfig     - Run BusyBox menuconfig'
Makefile:	@echo '  linux-menuconfig       - Run Linux kernel menuconfig'
Makefile:	@echo '  uclibc-menuconfig      - Run uClibc menuconfig'
Makefile:	@echo '  barebox-menuconfig     - Run barebox menuconfig'

I'll try to make time tomorrow to look into it.

[nigredo]

Some updates...

The u-boot in the kindle sources is incomplete, is missing (at least) boardid.h...

The eureka's patch is not for this source tree.

But...

imx_usb can set up the ddr (before loading u-boot) through dcd writes.
These dcd are in the header of uboot.imx files (imx being the current format for uboot images). The problem is to find one suitable for the kindles.

I may be naive, but lab126 seems not a vulcan of innovations... would't be surprised if they simply copied evaluation boards from freescale or others. If so a uboot.imx picked out there could work.

[knc1]

that sounds familar but its been years since anyone worked on things at this level.

Check the kernel tree in the Amazon sources for boardid.h

[nigredo]

Well, I tried... In the 5.4.4.2 source tree I found a boardid.h, clearly lacking the last models Ids, but this could be managed. Soon after faking the missing ids more errors appeared due to missing files.

Now I'm thinking in buy a PW3, now in offer, to continue with experiments, and leave the voyage for reading.

knc1, did you complete the mod with internal USB rs232 adapter ? Is there room for the fdti micro board ? If so I'll try too, maybe with the help of a friend of mine that do have proper tools and better sight.