Debrick a K3 (mmc0 cleared without backup)

[tthsn]

Hello everyone, the following is my k3 experience.

K3 stucked when boot

One day, my kindle 3 (US 3G) stuck at boot (man under the tree).
Then I buy a usb to serial cable and connect it to my k3 to access serial console.

After kernel loading, I found the following output is repeated.

Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
mmc1: Got data interrupt 0x00000020 even though no data operation was in progress.
mxsdhci: ============== REGISTER DUMP ==============
mxsdhci: Sys addr: 0x00000008 | Version: 0x00001201
mxsdhci: Blk size: 0x00000004 | Blk cnt: 0x00000000
mxsdhci: Argument: 0x14080a04 | Trn mode: 0x353a0012
mxsdhci: Present: 0xff880a0a | Host ctl: 0x00000123
mxsdhci: Clock: 0x000e003a
mxsdhci: Int stat: 0x00000020
mxsdhci: Int enab: 0x117f003b | Sig enab: 0x117f003b
mxsdhci: Caps: 0x07f30000
mxsdhci: Present: 0xff880a0a
mxsdhcicardint_sdio_irq=0, cardint_stat=0
mxsdhcisd1_turn_of_dma=0, sd2_turn_of_dma=0
mxsdhciSDIO LPM Counter=1

mmc0 cleared without backup

Then I decide to "unbrick" it, so I press 'Enter' after kernel loaded, and the kindle restore menu appears.

Menu
====
3. Load MMC0 over USB storage
4. Erase MMC0
I. Initialize Partition Table (fdisk) and format FAT
O. Format and overwrite FAT partition
E. Export FAT partition
U. Update using update*.bin file on FAT partition
M. Update using update*.bin file on FAT partition of second MMC port
D. dmesg / kernel printk ring buffer.
Q. quit
Choose: 1 -

I press 4 to Erase MMC0, then my k3 won't boot any more. Nothing was backed up.

k3flash uboot, kernel and rootfs

After searching the related threads in this forum, I found this one is useful

https://www.mobileread.com/forums/sho...d.php?t=184310

So I download and build k3flasher-v07.tar.gz(http://www.mobileread.mobi/forums/at...2&d=1342195426).

The images were got from:

- http://pastebin.com/Wdw4L7yT
- uboot: partitiontable-header-uboot.img
- kernel: http://www.mediafire.com/?k45j3h4zg0cap7q
- rootfs: https://docs.google.com/open?id=0BwJ...jVuM0FXUzd4d00

# uboot.img
sudo ./k3flasher mx35to2_mmc.bin program 0x0 partitiontable-header-uboot.img

# devid.img (I don't have)

# kernel
sudo ./k3flasher mx35to2_mmc.bin program 0x00041000 k3w-kernel-factory.img

# isis.img (I don't have)

# rootfs (started 13:17, completed 15:56, elapsed: 2hours and 40minutes)
sudo ./k3flasher mx35to2_mmc.bin program 0x003c1000 mmcblk0p1-3.0.2-factory.img

# varfs.img(I don't have)
# partition3.img(I don't have)

Only uboot, kernel, rootfs are burned into k3. devid, isis, varfs, partition3 are all absent.

Load MMC0 over USB storage failed

Reset my k3, uboot apears, kernel loading, againl stucked at

Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
mxsdhci: ===========================================
mmc1: Got data interrupt 0x00000020 even though no data operation was in progress.
mxsdhci: ============== REGISTER DUMP ==============
mxsdhci: Sys addr: 0x00000000 | Version: 0x00001201
mxsdhci: Blk size: 0x00000004 | Blk cnt: 0x00000000
mxsdhci: Argument: 0x1408a004 | Trn mode: 0x353a0012
mxsdhci: Present: 0xff880a0a | Host ctl: 0x00000123
mxsdhci: Clock: 0x000e003a
mxsdhci: Int stat: 0x00000020
mxsdhci: Int enab: 0x117f003b | Sig enab: 0x117f003b
mxsdhci: Caps: 0x07f30000
mxsdhci: Present: 0xfe880a0a
mxsdhcicardint_sdio_irq=0, cardint_stat=0
mxsdhcisd1_turn_of_dma=0, sd2_turn_of_dma=0
mxsdhciSDIO LPM Counter=1

I decided to dig rootfs, after reentered kindle recovery menu, press 3 to "Load MMC0 over USB storage". I enter the fiona password, but always fails to login. (echo fiona`echo THE_SERIAL|md5sum|cut -c8-11`) I realized that my serial number has been cleared. The result is that I never get logined.

But how to write the serial to k3?

So, where can I download 'devid.img template', in which I can fill my own serial and mac number in?

Thanks.

[dsmid]

There are four ids stored in my devid.img:

1. B00A*********2TL

2. 28EF0130****

3. A010******SHR

- md5sum: f22edb2b1d28a53473061bf94db02580

4. SYLGN2*********D5333

- md5sum: 87688f57871aec416f28b1742a63d38e

It's clear that the first one is the serial, the second one is the MAC address. What are the other two ids ?
If someone confirms his/her md5sums are the same, then I can provide you the template with serial and MAC missing.

[knc1]

mxsdhci: ===========================================
mmc1: Got data interrupt 0x00000020 even though no data operation was in progress.

Hardware failure - no amount of restoring firmware is going to fix that.

[tthsn]

hi, dsmid, thanks!

hi knc1,
I guess mmc0 stands for the only internal nand flash.
Do you mean mmc1 has hardware failure. What mmc1 stands for?

[knc1]

Originally Posted by tthsn

hi, dsmid, thanks!

hi knc1,
I guess mmc0 stands for the only internal nand flash.
Do you mean mmc1 has hardware failure. What mmc1 stands for?

The second nand flash.
Not present on production boards.

When you start getting interrupts from a device that does not exist, you have serious hardware problems.

[tthsn]

Ignoring all interrupts from mmc1 in kernel will fix the boot problem, right?

[knc1]

Originally Posted by tthsn

Ignoring all interrupts from mmc1 in kernel will fix the boot problem, right?

according to the message, they are being ignored.

impossible to tell with the information given.
tell us what is generating the interrupt and we could guess.

[tthsn]

update my K3's situation.

- Now OK to 'Load MMC0 over USB storage'

Although don't know the exact format of devid.img. I create a file named devid.img which is exactly 1024bytes, then fill its every byte to 0x31, then my K3's serial is '1111111111111111', so I'm able to mount internal mmc via /dev/sdb.

- "mmc1: Got data interrupt 0x00000020 even though no data operation was in progress." bypassed

Unplug the battery for one or two days, then plug the battary to K3, K3 boot OK.
Then plug the battery again, "mmc1: Got data interrupt 0x00000020 even though no data operation was in progress" happens again. OMG.
Don't know how long exactly to discharge the K3 main board to kill the 'interrupt'.

[tthsn]

By digging the boot log and narrow down the scripts in /etc/init.d.

# calling tree
/etc/init.d/pre-wifid
  /etc/init.d/wifi
    /opt/ar6k/host/support/loadAR6000.sh
      /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
        # load wifi chips driver
        modprobe ar6000 bmienable=1 ifname=wlan0 fwmode=1 busspeedlow=0

'modprobe ar6000' is located to bring the message: "mmc1: Got data interrupt 0x00000020 even though no data operation was in progress."

# /etc/init.d/pre-wifid
...
WIFIOFF_FILE=/mnt/us/WIFIOFF

[ -f ${_FUNCTIONS} ] && . ${_FUNCTIONS}

if [ -e $WIFIOFF_FILE ]; then
  msg "WiFi driver disabled" I
  exit 1
fi
...

Just 'sudo touch /mnt/us/WIFIOFF' and reboot K3 to kindle home page (boot shelf).
Still don't know why the wifi related hardware is "currupted".

[tthsn]

Originally Posted by dsmid

There are four ids stored in my devid.img:

1. B00A*********2TL

2. 28EF0130****

3. A010******SHR

- md5sum: f22edb2b1d28a53473061bf94db02580

4. SYLGN2*********D5333

- md5sum: 87688f57871aec416f28b1742a63d38e

It's clear that the first one is the serial, the second one is the MAC address. What are the other two ids ?
If someone confirms his/her md5sums are the same, then I can provide you the template with serial and MAC missing.

hi, dsmid, could you please kindly provide offsets of mac and serial in devid.img. (the 1024bytes long file)

About other ids you mentioned besides of mac and serial. I think they belongs to the following listing.

[root@kindle root]# idme ?
serial number = 1111111111111111
board id = SP1B000000000000
pcb serial number = t
accelerometer offset string = 1111111111111111
MAC address  = 111111111111
pcb config id = 111111111111
Manufacturer Code = 11111111111111111111

[tthsn]

Another problem arose, although my K3 boot to book shelf, but I can not find any .pdf or .txt files I copied.

[dsmid]

Originally Posted by tthsn

hi, dsmid, could you please kindly provide offsets of mac and serial in devid.img. (the 1024bytes long file)

The 3rd id is pcb serial and the 4th one is manufacturer code.
Take a look at the template.

[knc1]

Uncompress the image template and open in a hex editor.

The location of each field has been marked with a text entry, in-place of the actual data.

A "self documented" file layout format.

[tthsn]

Update my kindle 3 status:

OK to boot to home page, but I can not find any books (.txt .pdf) that I copied to kindle.

The homepage is:
- The New Oxford American Dictionary
- Oxford Dictionary of English
- Archived Items (0)

Have you ever deal with this issue?

I haven't write isis.img, varfs.img, partition3.img to my kindle via k3flasher tool. Is it related to the issue.

Thanks!