PB631 stuck on boot

[sensi81]

Hello,
My reader stuck on boot and I my idea how to bring it to live also. I replaced memory card, restore four partitions structure and fill it data which I restored from damaged card. Then I make update firmware with success. Then reader stuck on boot in place as picture. I connected serial port monitor to it and in attachment is what he said. I tried to patch monitor.app with new CID of card as tutorial on this forum but he still is the same place. What is the reason that boot log include some errors?

▒▒

U-Boot 2009.08 (Jul 15 2016 - 16:04:21)

CPU: Freescale i.MX6 family TO0.0 at 792 MHz
Temperature:   33 C, calibration data 0x5764f75f
mx6q pll1: 792MHz
mx6q pll2: 528MHz
mx6q pll3: 480MHz
mx6q pll8: 50MHz
ipg clock     : 66000000Hz
ipg per clock : 24000000Hz
uart clock    : 80000000Hz
cspi clock    : 60000000Hz
ahb clock     : 132000000Hz
axi clock   : 198000000Hz
emi_slow clock: 22000000Hz
ddr clock     : 396000000Hz
usdhc1 clock  : 198000000Hz
usdhc2 clock  : 198000000Hz
usdhc3 clock  : 198000000Hz
usdhc4 clock  : 198000000Hz
epdc_axi sel=5 podf=2
epdc_pix sel=5 pred=1 podf=0
Board: MX6SoloLite-NTX:[ POR ]
Boot Device: SD
I2C:   ready
DRAM:  512 MB
MMC:   loading ntx config
ram p=80000000,size=536870912
csd is 0x400e0032, 0x5b590000, 0x747b7f80, 0xa400000
scr addr is 0x875feef0, switch_status addr is 0x875fee80
mmc0 is current device

MMC read: dev # 0, block # 1023, count 1 ... 1 blocks read: OK

MMC read: dev # 0, block # 1024, count 1 ... 1 blocks read: OK
FSL_USDHC: 0,FSL_USDHC: 1,FSL_USDHC: 2
i2c: I2C1 SDA is low, start i2c recovery...
I2C1 Recovery success
i2c: I2C2 SDA is low, start i2c recovery...
I2C2 Recovery success
hw_anadig_reg_core=7c3e1f
setup_epdc() 1448x1072
EPDPMIC_VIN=1
*** Warning - bad CRC or MMC, using default environment

In:    serial
Out:   serial
Err:   serial
ntx_hw_late_init()

MMC read: dev # 0, block # 1, count 1 ... 1 blocks read: OK
NTXSN:"NX170000000000000000"
REGISET2 val E0
RC5T619 read battery temperature 1235mV (0x7E7).
ntx_detect_usb_plugin():Charge detecting ............................set 900mA for DCP (26)
Battery OK, voltage 4008mv, charger ON
resolution 1448x1072, bpp 8, pixclk 80000000
waveform is at 88600000, size 241432, 472 blocks
vcom=-2220
Draw normal logo: offset 55296
Splash loaded at 88a00000
** bitmap 1072x1448
waveform buffer addr = 88600000
EPDC init ok
EPDPMIC_VIN=1
tps65185_rail_power_onoff() TPS65185 wakeup
tps65185_rail_power_onoff() TPS65185 Enable RAIL POWER
epdc_power_on : waiting for epd power on ...ok. cnt=9720
EPDPMIC_VCOM=1
Draw_splash_screen
Device: FSL_USDHC
Manufacturer ID: fe
OEM: 3432
Name: SD16G
Tran Speed: 50000000
Rd Block Len: 512
SD version 3.0
Clock: 50000000
High Capacity: Yes
Capacity: 15634268160 Bytes
Bus Width: 4-bit
Boot Partition for boot: No boot partition available
csd is 0x400e0032, 0x5b590000, 0x747b7f80, 0xa400000
scr addr is 0x875fef58, switch_status addr is 0x875feee8
ntx_config_fastboot_layout():8 binaries partition added
ntx_config_fastboot_layout():2 mbr partition added                                                                                                                                         0

 hwcfgp=9ffffe00,pcb=61,customer=0

ESDin=0,UPGKey=0,PWRKey=0,USBin=0x1,BootESD=0,MenuKey=0
Kernel RAM visiable size=511M->511M

MMC read: dev # 0, block # 2047, count 1 ... 1 blocks read: OK
kernel size = 2837928

MMC read: dev # 0, block # 2048, count 5549 ... 5549 blocks read: OK
hwcfg partition type : 0
Splash screen update - Waiting for LUT to complete......................... OK
## Booting kernel from Legacy Image at 80007fc0 ...
   Image Name:   ?_#1 Oct 31 13:23:18
   Created:      2019-10-31  11:23:25 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2558472 Bytes =  2.4 MB
   Load Address: 80008000
   Entry Point:  80008000
   Loading Kernel Image (80008000->80008000) ... OK
OK

Starting kernel ...

 --
rm /mnt/secure/debug_mode to disable debug
Check Network Manager Status
Atached mp shm: id 0 addr 2d144000 size 21736
epdc_default_init
epdc_default_rotate: w=1072 h=1448 scan=1088 mem=1695744
program_name = [./pocketbook], basename = [pocketbook], init_string = [/P7.Sink=Null /P7.Pool=128 /P7.Format="{%ts}[%fs:%fl] %lv %ms"]
program init string = [(null)]
default init string = [(null)]
[748 : ./pocketbook] (open_mqueue)cannot attach to message queue[hw_ipcrequest_to] msgsnd error: Invalid argument
hw_eink_init: could not get current task
[hw_ipcrequest_to] msgsnd error: Invalid argument
Process has been terminated by signal {SIGSEGV::SEGV_MAPERR}
Segmentation fault

Please press Enter to activate this console. Start Network Manager
[766:01/01/12 00:00:06] netagent called with parameters < net on >
[766:01/01/12 00:00:06] bringing up wifi
Failed to connect to non-global ctrl_ifname: eth0  error: No such file or directory
Successfully initialized wpa_supplicant
rfkill: Cannot open RFKILL control device
Network Manager checker work done

[WYXUS]

Hi,
This is quite fortunate that I find your post. In fact my own sd card broke down completely and I am trying to resurrect my reader.
Regarding your question, from what I understood from different forums and videos, the os takes the SD card CID numer and if it is wrong (like when you copy everything to a new SD card) it simply won't boot.
Apparently there is a way to make a patch of the software so it would read this number from a file not from the card. If your old card is still alive and functional I can explain you in details.

I also have a question, how did you manage to boot your reader? When I copied the partition table and the files it did boot so I assumed that I have to install some bootloader or something.

[sensi81]

Hi,
Your answer helped me. I bring it to live, but different way.
I messed something up in this description. Few months ago I made copy "dd" command, but not all card. I must cancel operation copy because after many hours it didn`t move forward, only display some errors. But fortunately it was enough - structure partition was restored but not all data was restored and some errors also was in this image. I write it image on new card then many probes bring it to live, patches etc. Nothing works until today. I reversed previous changes to original state and do only one modification - I modified .freezestatus file as in (https://www.mobileread.com/forums/sh...0&postcount=93). Previously the problem was the wrong serial number of the new card that I pass to this generator. I restored all files to original state and then connected the serial monitor and I could read the correct one ( reader print it: SD card number: 00000022 ). And it works now ! Left only one problem with battery. Unnecessarily I replace it with new one , and reader works on charger and sometimes on battery but not long.

[sensi81]

Resolved problem with battery - connector not correctly pressed down.

[nhedgehog]

This solution has one culprit, TTS is not working afterwards. Only way out of this, get pocketbook.ru to send you a new image.
Not sure if they are doing this now, in times of war and boycott.

[sensi81]

Hi,
my solution in my case works fine as in attachment. Best regards.

[rkomar]

Originally Posted by nhedgehog

This solution has one culprit, TTS is not working afterwards.

Huh! I hardly ever use TTS, so I didn't notice this on my Inkpad 1 with the replaced internal SD card. You are right, some certificate used for verification no longer matches and the TTS fails. Oh well, it's still better than a completely broken device.

[WYXUS]

Great that you solved everything!
As my original card stopped working I have no access to it and cannot simply clone it.
Therefore the only solution I found is to build everything from sources (i found the kernel sources for PB631 and UBoot sources). I am not really good at this and for now have not succeeded. I'd appreciate if you have any useful tips.
I cannot even build the kernel as the compiler complains (i found an sdk with a cross-compiler) for some reason

[WYXUS]

And also I asked the tech support from the pocketbook but they refused to give me the iso. :-(

[rkomar]

@WYXUS: I think building your own OS from scratch is a bit crazy. I am pretty sure that all of the necessary software (including kernel modules) is not provided as source packages, so you cannot duplicate their system yourself. In the past, others have found someone who would make an image of their own card and send it to them. Perhaps you can get someone to do that for you, and then you can modify that to work with your own SD card.

[WYXUS]

@rkomar:
I pretty much agree with you that this is crazy :-D
I am super new to that kind of stuff and probably simply underestimate the complexity. I figured that I might learn a bit about that stuff and try my best.
The problem is that i could not find a way (or person) to make an iso image for me, otherwise I would have used this solution with pleasure!
And also it is not even about the money, but more about sustainable world: the device is fully functional and it would such a waste of resources just to through it away...

[sensi81]

This solution has one culprit, TTS is not working afterwards.

Yeah after check TTS in my reader it also doesn`t work . I again dissamble reader and connect serial monitor:

980 mixer_init() out
global_config::ttslanguage=<pl_agnieszka>
lingwarepath /mnt/ext1/system/tts/pl_agnieszka/
mainlingware vox_pl_agnieszka22i
voxdb /mnt/ext1/system/tts/pl_agnieszka/vox/vox_pl_agnieszka22i
voicelib /mnt/ext1/system/tts/pl_agnieszka/libvoice.so
 ######## IVONA preload
Try load /mnt/ext1/system/tts/pl_agnieszka/libtts_engine.so
reading /mnt/ext1/system/tts/pl_agnieszka/libtts_engine.so
File size 2055456
reading /mnt/ext1/system/tts/pl_agnieszka/libtts_engine.so.sig
File size 64
Checking key /ebrmain/share/ssl/pubkey3.rsa
!EVP_DigestVerifyFinal
807047168:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:rsa_pk1.c:103:
807047168:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:rsa_eay.c:705:
Checking key /ebrmain/share/ssl/pubkey2.rsa
Ok /mnt/ext1/system/tts/pl_agnieszka/libtts_engine.so loading..
Load library. Init procs.
Found magic with offset 390
Failed to create a TTS instance: Invalid certificate line

I think something is wrong with pubkey3.rsa key. That the private key used to sign does not correspond to the public key used to verify. Correct me if I am wrong.

[sensi81]

Originally Posted by WYXUS

@rkomar:
I pretty much agree with you that this is crazy :-D
I am super new to that kind of stuff and probably simply underestimate the complexity. I figured that I might learn a bit about that stuff and try my best.
The problem is that i could not find a way (or person) to make an iso image for me, otherwise I would have used this solution with pleasure!
And also it is not even about the money, but more about sustainable world: the device is fully functional and it would such a waste of resources just to through it away...

I think I could prepare this image but first I must delete my private data from it. Does anyone know which data should I clean?

[nhedgehog]

Originally Posted by sensi81

I think something is wrong with pubkey3.rsa key. That the private key used to sign does not correspond to the public key used to verify. Correct me if I am wrong.

You are wrong. TTS registration is hidden somewhere else in the secure partition.

[WYXUS]

Originally Posted by sensi81

I think I could prepare this image but first I must delete my private data from it. Does anyone know which data should I clean?

I would greatly appreciate if you could do that!

Unfortunatelly I ahve no idea what is the private data you might have..