PW1 hangs when booting diags mode

[wstrzalka]

Hi

I got into a trouble trying to debrick my PW1 and need some help.

I do have serial connection working and I'm able to do any uboot & fastboot commands. Till now I did flashed system, kernel & diags partitions successfully and made unsuccessful attempt to flash data. I flashed images from http://ixtab.tk/kindle-touch-images/PaperWhite. I had also set the 'fastboot setvar bootmode diags' and now trying to boot in diags mode.

And here is the problem. After getting into uboot prompt I do issue 'bootm 0xE41000' and the device start to boot - but it hangs in the middle of the process.

U-Boot 2009.08-lab126 (Jan 08 2013 - 21:47:48)

CPU:   Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock     : 66666666Hz
ipg per clock : 66666666Hz
uart clock    : 24000000Hz
ahb clock     : 133333333Hz
axi_a clock   : 400000000Hz
axi_b clock   : 200000000Hz
weim_clock    : 100000000Hz
ddr clock     : 800000000Hz
esdhc1 clock  : 80000000Hz
esdhc2 clock  : 80000000Hz
esdhc3 clock  : 80000000Hz
esdhc4 clock  : 80000000Hz
MMC:  FSL_ESDHC: 0, FSL_ESDHC: 1
Board: Celeste WFO (256 MB)
Boot Reason: [POR]
Boot Device: MMC
Board Id: <my board id>
S/N: <my S/N>
DRAM:  256 MB
Using default environment

In:    serial
Out:   logbuff
Err:   logbuff
Quick Memory Test 0x70000000, 0xfffc000
POST done in 17 ms
BOOTMODE OVERRIDE: DIAGS
Hit any key to stop autoboot:  0
uboot >
uboot > bootm 0xE41000
## Booting kernel from Legacy Image at 70800000 ...
   Image Name:   Linux-2.6.31-rt11-lab126
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    4608576 Bytes =  4.4 MB
   Load Address: 70008000
   Entry Point:  70008000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
Starting kernel ...
2.6.31-rt11-lab126 #1 Tue Sep 25 22:13:12 PDT 2012 armv7l
INFO:Loaded module /lib/modules/eink_fb_waveform.ko  (36956 bytes)
INFO:Loaded module /lib/modules/mxc_epdc_fb.ko default_panel_hw_init=1 default_update_mode=1 (51152 bytes)
INFO:eink initialized... (786432 bytes)
INFO:DIAGS MODE
Press [ENTER] for recovery menu...       0 /INFO:!!! Checking MBR /dev/mmcblk0 !!!!
INFO:partition 2, start sector is 782336
INFO:partition 3, start sector is 913408
INFO:partition 4, start sector is 1044480
INFO:maximizing partition 2797568 sectors
INFO:*** Partition table verified for /dev/mmcblk0 ***
INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/43712 size=1432354816 bytes
flag type      first       last  lba first   lba size
Partition p1:
0x00 0x0b         16 <large>            16    2797552
    CHS: 0/1/1 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 8192
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
  argc == 11
  argv[0]: "kinit"
  argv[1]: "consoleblank=0"
  argv[2]: "rootwait"
  argv[3]: "ro"
  argv[4]: "ip=off"
  argv[5]: "root=/dev/mmcblk0p2"
  argv[6]: "quiet"
  argv[7]: "eink=fslepdc"
  argv[8]: "video=mxcepdcfb:E60,bpp=8,x_mem=4M"
  argv[9]: "mem=256M"
  argv[10]: "console=ttymxc0,115200"
  argc == 4
  argv[0]: "IP-Config"
  argv[1]: "-i"
  argv[2]: "Linux kinit"
  argv[3]: "ip=off"
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p2) = dev(179,2)
kinit: root_dev = dev(179,2)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: Mounted root (ext3 filesystem) readonly.
init started: BusyBox v1.17.1 (2012-09-07 15:07:58 PDT)
starting pid 423, tty '': '/etc/init.d/rcS'
/etc/init.d/rcS: line 85: boot_milestone: not found
system: I rcS:def:starting /etc/rcS.d/S50diags
USER=root
prevlevel=N
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/
VERBOSE=no
READ_AHEAD=4
USER=root
prevlevel=N
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/
VERBOSE=no
IO_SCHED=anticipatory
USER=root
prevlevel=N
HOME=/
runlevel=S
eink=fslepdc
TERM=vt102
PATH=/sbin:/bin:/usr/sbin:/usr/bin
SHELL=/bin/sh
PWD=/
VERBOSE=no
TMP_SIZE=32M
info firsttime:mount_rw:time=5050:Mounting root RW for first boot
info firsttime:cursor:Linking Xorg cursor:
ln: /usr/share/fonts/X11/misc/cursor.pcf: No such file or directory
info firsttime:mount_ro:time=5230:Mounting root RO
elevator: type  not found
info system:start:time=5300:
/etc/rcS.d/S50diags: line 466: f_proto: not found
info hardware:no_wan::WiFi only device. No WAN found
info system:config:platform=yoshime3,board=celeste,rev=22,proto=N,wifi=Y,wan=N:
info system:done:time=5670:
info cyttsp:update:vendor=CANDO:
/etc/rcS.d/S50diags: line 466: iptables-restore: not found
/opt/ar6k/include/dbglog.h.save: No such file or directory
info userstore:run:time=6990,action=start:
info userstore:mntus.param_not_found::mntus.param not found, initializing volume
info userstore:check_us::checking userstore filesystem
dosfsck 2.11 (12 Mar 2005)
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "mkdosfs"
Media byte 0xf8 (hard disk)
       512 bytes per logical sector
      8192 bytes per cluster
      9558 reserved sectors
First FAT starts at byte 4893696 (sector 9558)
         2 FATs, 32 bit entries
    698880 bytes per FAT (= 1365 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 6291456 (sector 12288)
    174079 data clusters (1426055168 bytes)
32 sectors/track, 64 heads
         0 hidden sectors
   2797552 sectors total
Checking for unused clusters.
Checking free cluster summary.
Free cluster summary wrong (174675 vs. really 174078)
  Auto-correcting.
Performing changes.
/dev/loop/0: 1 files, 1/174079 clusters
system: I mntus:def:File system errors recovered
info userstore:create_default::creating userstore system and documents directories I
/mnt/base-us/system     hsd
/etc/rcS.d/S50diags: line 13: /usr/local/sbin/dropbear: not found
boot: C def:bcut:batterycut=1,version=174700:
kernel: E wdog:Abnormal reset detected but saved buffer invalid:
INFO: task kjournald:555 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
INFO: task loop0:607 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
INFO: task display:642 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
INFO: task kjournald:555 blocked for more than 120 seconds.

and I can't get any further. In particular to the diags menu ....
In this thread: http://www.mobileread.mobi/forums/sh...=164018&page=3

the user gets more and the next lines shall be smth like this:

/etc/rcS.d/S50diags: line 13: /usr/local/sbin/dropbear: not found
mounting waveform filesystem
umounting waveform filesystem
info display:started:time=12430:
/etc/upstart/battery-diags: line 91: f_proto: not found
info battery:charged:cap=100,mV=4177,mAH=1408:
USER=root
prevlevel=N
OLDPWD=/
HOME=/
runlevel=S
.....

So it seems like it hangs on this waveform thing??
Any advice to progress with this ?

[wstrzalka]

Just an update - I had tried it the way shown here: https://gist.github.com/TobiasWooldr...ca75190b9a473f

the output is ... weird again.
When I do try to copy entire file (or significant part of the file) it hangs on:

info filesystems:installdata:KINDLEFIX looking for /mnt/us/mmcblk0p1.img ...:
info filesystems:installdata:KINDLEFIX found mmcblk0p1.img, trying to install:I
boot: C def:rst:reset=hard:version=174700
kernel: E wdog:Abnormal reset detected but saved buffer invalid:

INFO: task kjournald:561 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
INFO: task loop0:613 blocked for more than 120 seconds.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

but when I do try to only copy ie. 4MB of the file - by adding 'count=1000' to the dd command it does perform the copy succesfully (when I do set count to 8000 it breaks as for full file).

That leads me to on of the two options:
- the storage is somehow broken for larger offsets ??
- the two lines that shows afterwards somehow do play evil role and break the process

boot: C def:rst:reset=hard:version=174700
kernel: E wdog:Abnormal reset detected but saved buffer invalid:

Any ideas?

[Yourcat]

You could try to seek and skip 8MB with dd. Anyhow I'm not sure whether it helps to know that the other memory if fine or broken.

[wstrzalka]

Thanks for the tip. I did couple of tries with skip and it seems to be the size (time) issue not the place in memory where I do write.

Every try with larger amount of data fails with those two lines (or very similiar):

boot: C def:rst:reset=hard:version=174700
kernel: E wdog:Abnormal reset detected but saved buffer invalid:

while similiar attempts with smaller amount of data success (the script brakes later on the above way anyway).

Wojtek

[wstrzalka]

Just for a record - I had tried to update it using Amazon update and it always stucks in EXACTLY the same place (even byte):

rootfs.img.gz 17194491 [####::::::::::::::::::::::::::::::::::]

I'm giving up

[Yourcat]

' it seems to be the size (time) issue not the place in memory' So it should be possible to use a loop to write 1k chunks with a delay of 1s. Unless the memory chip detects write failures and sucessfully re-organizes it will still fail at the end of the day.
Hopefully geekmaster or knc1 leave a comment.

[knc1]

Read and understand the attachment before using it.

[wstrzalka]

After running the script (with minor updates):

...

+ /bin/dd if=/tmp/t1.bin of=/dev/mmcblk0p1 bs=4096 seek=57 count=1
+ set 1+0 records in 1+0 records out 4096 bytes (4.0KB) copied, 0.003026 seconds, 1.3MB/s
+ OK=1+0
+ BYTES=4096
+ [ 1+0 = 1+0 ]
+ /bin/dd if=/dev/mmcblk0p1 of=/tmp/t2.bin bs=4096 skip=57 count=1
+ set 1+0 records in 1+0 records out 4096 bytes (4.0KB) copied, 0.002108 seconds, 1.9MB/s
+ OK=1+0
+ BYTES=4096
+ [ 1+0 = 1+0 ]
+ cmp -s /tmp/t1.bin /tmp/t2.bin
+ [ 0 -eq 0 ]
+ BLK=58
+ TOT=237568
+ continue
+ [ 1+0 = 1+0 ]
+ /bin/dd if=/mnt/us/mmcblk0p1.img of=/tmp/t1.bin bs=4096 skip=58 count=1
+ set 1+0 records in 1+0 records out 4096 bytes (4.0KB) copied, 0.001844 seconds, 2.1MB/s
+ Ret1=1+0
+ Sze1=4096
+ /bin/dd if=/dev/mmcblk0p1 of=/tmp/t2.bin bs=4096 skip=58 count=1
+ set 1+0 records in 1+0 records out 4096 bytes (4.0KB) copied, 0.001273 seconds, 3.1MB/s
+ Ret2=1+0
+ Sze2=4096
+ [ 1+0 = 1+0 ]
+ [ 1+0 = 1+0 ]
+ cmp -s /tmp/t1.bin /tmp/t2.bin
+ [ 1 -eq 0 ]
+ /bin/dd if=/tmp/t1.bin of=/dev/mmcblk0p1 bs=4096 seek=58 count=1
+ set 1+0 records in 1+0 records out 4096 bytes (4.0KB) copied, 0.002816 seconds, 1.4MB/s
+ OK=1+0
+ BYTES=4096
+ [ 1+0 = 1+0 ]
+ /bin/dd if=/dev/mmcblk0p1 of=/tmp/t2.bin bs=4096 skip=58 count=1
boot: C def:rst:reset=hard:version=174700
kernel: E wdog:Abnormal reset detected but saved buffer invalid:

.. and hangs.

It either hangs after some time or when accessing some particular address in flash memory.

[knc1]

comment out the debug flag near the top, it will be easier to read the output.

Somewhere here, there is a post with an archive of the finished version of that script, directions, and the dependencies plus another storage forensic utility.
The post will be by myself, but I couldn't find it the other day.

It should be around the first of this year.

There is also a thread here about replacing the eMMC chip and then recovering the Kindle.

[Yourcat]

Does it always hang at position (seek/skip) 58 now?
Are all cmp's before 58 OK and 58 is the 1st and unfortunately also the last write attempt?

This seems to be a really nice script.

[wstrzalka]

@knc1 - when I do comment the debug flag the last one I do get is 'Executable dd found' so ...

@Yourcat - although that was my first impression after running series I 'm getting results as low as 68 and as high as hundreds blocks copied.

I had made small experiment - I did added echo to all the possible loop exits.
I write the following characters to console:
. - when the source and dest are identical
* - when they are initially differnt but after I do copy it over I do get correct readback
X - readback test failed
# - readback to ram failed
@ - copy incomplete

See the result of subsequent runs in attached file (with some lines removed as sometimes it hangs on readback just few blocks after start).

Scroll to the right and look for the pattern; where the previous run hangs dot ends and asterixes starts to pickup. But with every run the number of block written is shorter and shorter .....

[knc1]

See next.

[knc1]

If the utility was forcing the eMMC to correct itself, one erase block at a time, the failed block number would be increasing (it is).

The failed block number decreasing would mean that the eMMC controller has run out of good eraseblocks to map in.

In the case of your file -
The script and the eMMC are doing exactly as intended.
Each time it is run, the previous contents written are found to be correct and then it continues to extend the correct contents.

The number of blocks newly written is not significant, it may be as small as one block.
Just as long as it continues to extend the correct contents.

Keep on repeating the script as long as it continues to extend the 'found correct' contents.
KEEP IT ON EXTERNAL POWER use a wall charger, not a PC port that might go to sleep on you!
The erase / re-program eMMC process is very power hungry and we do not know the condition of your battery.

I am assuming your writing mmcblk0p1 (the 'main' system).
Also, that you used KindlTool to extract the main kernel and main system image from the current 5.6.1.1 Amazon update file.
Otherwise, all you have done is confirm the script works and the eMMC can be recovered.
If you are not, the device will try to do an OTA update, and fail.

The OTA updater does not use a copy&confirm flash algorithm (high dollar SSDs, the 'server grade' ones, do this internally).
The Kindle fastboot does not do a copy&confirm when it is writing either, so don't be surprised if you have to use it multiple times to get a correct copy of the 5.6.1.1 kernel written.

Once you get a complete copy of that, reboot to main, and then put a really big file on mmcblk0p4 (user storage).
Use a file of all 1's - that is 'erased' on flash storage. The micro-controller should be smart enough to know that all it has to do is 'erase' not 'erase and re-program'.
(That feature could probably be added to the script - just repeat using the same block of 4K 1's as the source file. )

(just touch the desired end of the file - a sparse file will do) and repeat.
(Its fat-32, which does not support sparse files).

That should get you most of the bad blocks mapped out by the internal eMMC controller.

I have found the mmc utility:
https://www.mobileread.com/forums/sho...&postcount=887
But it probably isn't of any help in this situation.

But have not found where I posted the finished version of this script and its package.

= = = =

The cost of this help is that you should answer some questions here placed by others.
I CAN NOT devote time to this forum. Health too poor.

[Yourcat]

I just used the attachement search and looked for "copy" by "knc1". It returned copycmd.tar.gz in Kindle paperwhite doesn't upgrade software. This seems to be the more recent script.

[knc1]

That is it.
I stopped my searching in January, and it is a February 2nd. post.
Drat!

"Close" only counts in horseshoes, grenades, and nuclear weapons.