Unbrick a PW3 (Fastboot)

[geekmaster]

Originally Posted by nigredo

... I think possible lab26 used the sense pin of the usb port, reading the datasheet it is clear that only a external device could tie the boot pin in the proper state at reset. ...

Ooh! Another place to test for a bootmode pin (i.e. "magic key" for usb downloader mode)! We just need a hacked USB cable plugged in while it boots, to see if it presents a freescale USB VID (15a2, as I recall) instead of a lab126 (1949, as I recall). If just a short, a standard OTG cable ought to do the trick. I will try that in the morning when no risk of waking spouse (3:40am here). I tried everything else. It is *possible* they are looking for a particular value of resistor across the USB OTG sense pin though (other than a 0-ohm short common in OTG cables), depending on the circuitry tied to that USB pin.

[geekmaster]

Originally Posted by knc1

I have not finished (yet) - "life" sucked up all of my time.

Yeah, I have that problem too. Life adjustments suck additional time, when time flies by faster than it used to (perceived time = measured time / life span).



I have a LOT of catching up to do around here, especially if I want to do dev work at the kernel level (or perhaps a custom boot loader, which fascinates me more, close to the bare hardware). The SDRAM init based on serial number was totally fascinating to me when I did custom uboot 'idme bootmode' patches for MfgTool (later used in kubrick). Now that I have a PW3, I was testing the "USB BOOT" pads (no luck), hoping to see if the uboots I did would work on the PW3 as well as K3/K4/K5. If now, new patched uboots would be in order. There are TWO bootmode pins in the SoC, so perhaps that (unpolulated) switch inside AND a special OTG USB plug? Worth a try!

I do not recall reading this particular thread before, but it is full of stuff very interesting to me now. So much to study, so little time.

[damon12]

Hi! I guess I soft-bricked my PW3. I am not sure if it's good to start a new thread or continue this one.

I jail-broke my PW3 5.6.5 and install KUAL+, usbnet etc, I also installed latest busybox downloaded from busybox.net

Then I found that all books/KUAL shows "error not found" (can't remember the full message).

I entered diags mode, and found that the partition 4 may be corrupted, so I formatted it into vFAT. I also mounted partition 1 and removed the root lock (!) and left the password blank in /etc/shadow. Then I left my PW3 on the table and take a nap

Next day, when I woke up and continued. I found that the console shown these error repeatedly

[78668.128343] mmc0: Controller never released inhibit bit(s).
[78668.140806] mmcblk0: error -5 sending status command, retrying
[78668.151792] mmcblk0: error -110 sending status command, retrying
[78668.160333] mmcblk0: error -110 sending status command, aborting
[78668.166352] end_request: I/O error, dev mmcblk0, sector 524088

Not sure if I forgot to umount partition 1 or the eMMC is corrupted. I planned to restart my PW3 into diags mode again and fsck the partition 1 but there was no output in console. When I connect the PW3 to Windows via USB, it is recognized as USB Input Device (VID:15a2 PID:0063).

Not sure if I still have chance to boot it into Fastboot. Moreover, it seems Windows has no driver for Kindle in fastboot mode, does Linux have drivers out-of-the-box?

Which generation of PW can use these images? (1 or 2 or 3 only, or for both 2 or 3)?
https://ixtab.tk/kindle-touch-images/PaperWhite/

[damon12]

I guess the command for flashing in fastboot mode should be these?

./fastboot flash system fwo_rootfs.img
./fastboot flash kernel uImage.img

[geekmaster]

Originally Posted by knc1

Note:
The Geekmaster "getkernels-1.4" script is copying too much data, but the excess is the same value as erased data (which is probably why he didn't notice it).
The kernels extracted by "getkernels-1.4" will not verify with mkimage due to the excess.

The previous version sometimes copied too little data, which was worse. I will fix that, if I can figure out where to chop it, and I will add the cpio extraction seaniko7 posted to my thread too, I think. I need to track down this "mkimage" of which you speak, to test my changes...

[damon12]

Originally Posted by damon12

Hi! I guess I soft-bricked my PW3. I am not sure if it's good to start a new thread or continue this one.

I jail-broke my PW3 5.6.5 and install KUAL+, usbnet etc, I also installed latest busybox downloaded from busybox.net

Then I found that all books/KUAL shows "error not found" (can't remember the full message).

I entered diags mode, and found that the partition 4 may be corrupted, so I formatted it into vFAT. I also mounted partition 1 and removed the root lock (!) and left the password blank in /etc/shadow. Then I left my PW3 on the table and take a nap

Next day, when I woke up and continued. I found that the console shown these error repeatedly

[78668.128343] mmc0: Controller never released inhibit bit(s).
[78668.140806] mmcblk0: error -5 sending status command, retrying
[78668.151792] mmcblk0: error -110 sending status command, retrying
[78668.160333] mmcblk0: error -110 sending status command, aborting
[78668.166352] end_request: I/O error, dev mmcblk0, sector 524088

Not sure if I forgot to umount partition 1 or the eMMC is corrupted. I planned to restart my PW3 into diags mode again and fsck the partition 1 but there was no output in console. When I connect the PW3 to Windows via USB, it is recognized as USB Input Device (VID:15a2 PID:0063).

Not sure if I still have chance to boot it into Fastboot. Moreover, it seems Windows has no driver for Kindle in fastboot mode, does Linux have drivers out-of-the-box?

Which generation of PW can use these images? (1 or 2 or 3 only, or for both 2 or 3)?
https://ixtab.tk/kindle-touch-images/PaperWhite/

Seems the bootloader is still working but not the eMMC flash

uboot > idme

Warning: fail to get ext csd for MMC!
idme_get_var ERROR: couldn't switch to boot partition
serial:

Warning: fail to get ext csd for MMC!
idme_get_var ERROR: couldn't switch to boot partition
mac:

Warning: fail to get ext csd for MMC!
idme_get_var ERROR: couldn't switch to boot partition
sec:

Warning: fail to get ext csd for MMC!
idme_get_var ERROR: couldn't switch to boot partition
pcbsn:

Warning: fail to get ext csd for MMC!
idme_get_var ERROR: couldn't switch to boot partition
bootmode:

Warning: fail to get ext csd for MMC!
idme_get_var ERROR: couldn't switch to boot partition
postmode:

uboot > bist

Warning: fail to get ext csd for MMC!
ERROR: couldn't switch to boot partition

[geekmaster]

Originally Posted by damon12

Seems the bootloader is still working but not the eMMC flash

Are you using a custom bootloader? If so, is the flash being initialized (including dependent hardware) and accessed correctly?

[NiLuJe]

@GM: Quick braindump: if you have time to spare, double-check that the cpio extract stuff still works properly with current FW versions, I think we discussed somewhere that, at least for extracting the initramfs, it wasn't doing the job anymore.

[damon12]

Originally Posted by geekmaster

Are you using a custom bootloader? If so, is the flash being initialized (including dependent hardware) and accessed correctly?

Original boot loader.
Sorry, how to check if the flash being initialized (including dependent hardware) and accessed correctly?

[geekmaster]

Originally Posted by damon12

Original boot loader.
Sorry, how to check if the flash being initialized (including dependent hardware) and accessed correctly?

If original bootloader, you have no control over that. Those questions were for if you were using a custom bootloader, to make sure it included all necessary hardware initialization. The original boot loader obviously does that, or it would not work in any kindle. You probably have some other problem.

If it was mine, I would connect to the serial port and see what debug messages are being output to the serial console. That last lines before it stops would be of primary importance in solving the problem. Especially things that look like error messages.

[damon12]

Originally Posted by geekmaster

If original bootloader, you have no control over that. Those questions were for if you were using a custom bootloader, to make sure it included all necessary hardware initialization. The original boot loader obviously does that, or it would not work in any kindle. You probably have some other problem.

If it was mine, I would connect to the serial port and see what debug messages are being output to the serial console. That last lines before it stops would be of primary importance in solving the problem. Especially things that look like error messages.

U-Boot 2009.08-lab126 (Apr 15 2015 - 07:37:55)

CPU: Freescale i.MX6 family TO0.0 at 996 MHz
Temperature:   35 C, calibration data 0x54d4dd5f
mx6sl pll1: 996MHz
mx6sl pll2: 528MHz
mx6sl pll3: 480MHz
mx6sl pll8: 50MHz
ipg clock     : 66000000Hz
ipg per clock : 66000000Hz
uart clock    : 80000000Hz
cspi clock    : 60000000Hz
ahb clock     : 132000000Hz
axi clock   : 198000000Hz
emi_slow clock: 22000000Hz
ddr clock     : 396000000Hz
usdhc1 clock  : 198000000Hz
usdhc2 clock  : 198000000Hz
usdhc3 clock  : 198000000Hz
usdhc4 clock  : 198000000Hz
MMC:  FSL_ESDHC: 0,FSL_ESDHC: 1,FSL_ESDHC: 2
Board: Muscat WFO
Boot Reason: [ POR ]
Boot Device: NAND
Board Id: 067020915307021L
S/N: G090GXXXXXXXXX
I2C:   ready
DRAM:  512 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Quick Memory Test 0x80000000, 0x1fff0000
POST done in 111 ms
Low battery voltage=3492mV, please plug in charger and wait..
battery voltage=3467mV
battery voltage=3610mV
Battery voltage: 3673 mV

Hit any key to stop autoboot:  0
mmc read failed
ERROR: couldn't read boot image from flash address 0x41000
Wrong Image Format for bootm command
ERROR: can't get kernel image!

Seems the eMMC is corrupted......not sure if it is physically damaged or just had corrupted data.

[geekmaster]

Originally Posted by damon12

Seems the eMMC is corrupted......not sure if it is physically damaged or just had corrupted data.

Can you reflash the eMMC from your bootloader?

[knc1]

Originally Posted by geekmaster

The previous version sometimes copied too little data, which was worse. I will fix that, if I can figure out where to chop it, and I will add the cpio extraction seaniko7 posted to my thread too, I think. I need to track down this "mkimage" of which you speak, to test my changes...

Start at the tail and read toward the head of the file.
Erased flash (I.E: un-programmed locations in the erase block) are "FF" (all ones - not all zeros).

When you hit the first non-FF byte - call that end of file and throw everything skipped away.
Expect that prior (last of the FF sequence) to be on a 4-byte boundary).

The trimmed file will pass the mkimage internal checksum tests when everything works out as intended.

[knc1]

Originally Posted by damon12

- - - -
I entered diags mode, and found that the partition 4 may be corrupted, so I formatted it into vFAT.
- - - -
Which generation of PW can use these images? (1 or 2 or 3 only, or for both 2 or 3)?
https://ixtab.tk/kindle-touch-images/PaperWhite/

And here we take careful aim at the foot and shoot off the big toe.
- - - -
Not pleased with that result, we take aim at the ankle . . . .

= = = =

1) If not happy with USB storage area -
Zero the first 16 sectors (wiping the mbr and partition table) and then re-boot.
The re-boot initialization will detect the 4th partition as un-formatted and "do the right thing" -
That storage partition is formatted with a special combination of options not available in the utilities you usually find on a PC.

2) Don't even think about those -
With the exception of any diags images.

Use the main system images posted by Amazon.
I.E: Any Update_*.bin file of your choosing + KindleTool to open it.

[geekmaster]

Originally Posted by knc1

Start at the tail and read toward the head of the file.
Erased flash (I.E: un-programmed locations in the erase block) are "FF" (all ones - not all zeros).

When you hit the first non-FF byte - call that end of file and throw everything skipped away.
Expect that prior (last of the FF sequence) to be on a 4-byte boundary).

The trimmed file will pass the mkimage internal checksum tests when everything works out as intended.

Is that how mkinage does it? If not, then a file that ended with FF could screw the checksum after it is flashed. In which case the "right thing to do" after stripping trailing FFs would be to test checksum and append FFs until it passes, I suppose.