Mobileread
PRS-T1 PRS-T1 run from SD card / UART recovery from broken internal flash
#1  jpa 04-26-2020, 02:36 PM
After close to 10 years, my PRS-T1 finally had its internal eMMC flash fail. Not sure if it weared out, or if I messed up something as I was just doing some hacking when it happened. Anyway, the end result is that it just kept blinking yellow light, wouldn't go into recovery and wouldn't boot.

I opened it up and probed until I found serial port (UART) testpoints on the backside of the PCB. They are the three corner points in a group of 3x4 testpoints, shown in image below:

image »

Connecting them to USB-serial converter (3.3V voltage), I got access to boot messages. This is where I found about the flash issue:

Code
mmcblk2: retrying using single block read(cmderr=0,dataerr=-110,stoperr=0)
mmcblk2: error -110 transferring data, sector 52832, nr 84, card status 0x80900
end_request: I/O error, dev mmcblk2, sector 52832
It was on the recovery filesystem area, so I did get it working by just forcing uboot to do a normal boot. But I fear that the internal flash may soon stop working completely if it already has a bad sector.

So I copied everything to a SD card and modified initramfs to mount mmcblk0 instead of mmcblk2. At the same time I added adb support.
This is how to rebuild the initrd (on PC Linux):

Code
find | cpio -H newc -R 0:0 -o > ../initrd_new.cpio
gzip -c < initrd_new.cpio > initrd_new.gz
mkimage -A ARM -O Linux -T ramdisk -a 0x70308000 -C none -n 'Normal Rootfs' -d initrd_new.gz initrd_new
sudo dd if=initrd_new of=/dev/mmcblk0 bs=1 seek=5242880
Then it is just a matter of pointing uboot to boot kernel from mmc0 instead of mmc2. There are three ways to do it:
  1. Write eMMC from Linux recovery environment
  2. Write eMMC from uboot command prompt
  3. Write NAND chip from uboot command prompt

Writing to eMMC is easiest, but if your eMMC was totally broken (not just bad sectors), you'd have to modify the uboot image in NAND so that it would load its configuration from mmc0 instead of mmc2.

To get recovery environment to boot, put rupor-rescue on the SD card partition 4 and then use this Python script to temporarily point uboot to load the rescue partition from SD card:

Code
import serial, time, sys
s = serial.Serial("/dev/ttyUSB0", 115200, timeout = 0.1)
def slowsend(x): for b in x: s.write(b) time.sleep(0.001)
while True: d = s.read(32) sys.stdout.write(d) s.write(' ' * 32) # "Any key" for uboot if 'Hit' in d: slowsend("\r\nprintenv\r\n") time.sleep(1.5)
# To boot recovery from SD card slowsend("setenv bootargs 'root=/dev/mmcblk0p1 rootfstype=ext4 rw " + "rootwait init=/linuxrc console=ttymxc4,115200 bootdev=2 rawtable=0xF40000'\r\n")
# To boot normal system from SD card
# slowsend("setenv bootargs 'console=ttymxc4,115200 init=/init bootdev=0 rawtable=0xF40000'\r\n") time.sleep(1.0) slowsend("boot\r\n") break
while True: d = s.read(64) sys.stdout.write(d)
You can also just copy-paste the commands to serial terminal, but that is a bit annoying as the watchdog will reboot the device if it is stuck in uboot for more than 10 seconds or so.

In the recovery shell you can run this to copy the uboot configuration from SD card to eMMC:

Code
dd if=/dev/mmcblk0 skip=786432 of=/dev/mmcblk2 seek=786432 bs=1 count=131072
That's it, it should now boot from SD card after loading only the uboot configuration from eMMC.

---

For reference, here are the addresses of various important blocks that are stored on SD/eMMC before the first partition:

Code
[root (ttyGS0)]# cat /sys/module/rawdatatable/parameters/rawdata_param
MBR :0x00000000:0x00000400
uBoot :0x00000400:0x000bfc00
Boot Env :0x000c0000:0x00020000
Reserved1 :0x000e0000:0x00020000
Normal Kernel :0x00100000:0x00400000
Normal Rootfs :0x00500000:0x00100000
Recovery Kernel :0x00600000:0x00400000
Reserved2 :0x00a00000:0x00500000
Normal Boot Env :0x00f00000:0x00020000
Recovery Boot Env :0x00f20000:0x00020000
Raw Data Table :0x00f40000:0x00020000
Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000
I'll post a link to premade SD card image below soon.
Reply 

#2  jpa 04-26-2020, 03:21 PM
Here is the SD card image. It has adb enabled, but otherwise stock firmware 1.0.07. Install to SD card (minimum 4 GB card, at least up to 16 GB works) using dd on a Linux PC:

Code
unxz sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress
You can resize the partitions quite freely with gparted. Just don't touch the unallocated space before the first partition, as that contains the kernel.
Reply 

Today's Posts | Search this Thread | Login | Register