PRS-T1 PRS-T1 run from SD card / UART recovery from broken internal flash

[jpa]

After close to 10 years, my PRS-T1 finally had its internal eMMC flash fail. Not sure if it weared out, or if I messed up something as I was just doing some hacking when it happened. Anyway, the end result is that it just kept blinking yellow light, wouldn't go into recovery and wouldn't boot.

I opened it up and probed until I found serial port (UART) testpoints on the backside of the PCB. They are the three corner points in a group of 3x4 testpoints, shown in image below:



Connecting them to USB-serial converter (3.3V voltage), I got access to boot messages. This is where I found about the flash issue:

mmcblk2: retrying using single block read(cmderr=0,dataerr=-110,stoperr=0)
mmcblk2: error -110 transferring data, sector 52832, nr 84, card status 0x80900
end_request: I/O error, dev mmcblk2, sector 52832

It was on the recovery filesystem area, so I did get it working by just forcing uboot to do a normal boot. But I fear that the internal flash may soon stop working completely if it already has a bad sector.

So I copied everything to a SD card and modified initramfs to mount mmcblk0 instead of mmcblk2. At the same time I added adb support.
This is how to rebuild the initrd (on PC Linux):

find | cpio -H newc -R 0:0 -o > ../initrd_new.cpio
gzip -c < initrd_new.cpio > initrd_new.gz
mkimage -A ARM -O Linux -T ramdisk -a 0x70308000 -C none -n 'Normal Rootfs' -d initrd_new.gz initrd_new
sudo dd if=initrd_new of=/dev/mmcblk0 bs=1 seek=5242880

Then it is just a matter of pointing uboot to boot kernel from mmc0 instead of mmc2. There are three ways to do it:

1. Write eMMC from Linux recovery environment
2. Write eMMC from uboot command prompt
3. Write NAND chip from uboot command prompt

Writing to eMMC is easiest, but if your eMMC was totally broken (not just bad sectors), you'd have to modify the uboot image in NAND so that it would load its configuration from mmc0 instead of mmc2.

To get recovery environment to boot, put rupor-rescue on the SD card partition 4 and then use this Python script to temporarily point uboot to load the rescue partition from SD card:

import serial, time, sys
s = serial.Serial("/dev/ttyUSB0", 115200, timeout = 0.1)

def slowsend(x):
    for b in x:
        s.write(b)
        time.sleep(0.001)

while True:
    d = s.read(32)
    sys.stdout.write(d)
    s.write(' ' * 32)  # "Any key" for uboot
    if 'Hit' in d:
        slowsend("\r\nprintenv\r\n")
        time.sleep(1.5)

# To boot recovery from SD card
        slowsend("setenv bootargs 'root=/dev/mmcblk0p1 rootfstype=ext4 rw "
                + "rootwait init=/linuxrc console=ttymxc4,115200 bootdev=2 rawtable=0xF40000'\r\n")

# To boot normal system from SD card
#        slowsend("setenv bootargs 'console=ttymxc4,115200 init=/init bootdev=0 rawtable=0xF40000'\r\n")

        time.sleep(1.0)
        slowsend("boot\r\n")
        break

while True:
    d = s.read(64)
    sys.stdout.write(d)

You can also just copy-paste the commands to serial terminal, but that is a bit annoying as the watchdog will reboot the device if it is stuck in uboot for more than 10 seconds or so.

In the recovery shell you can run this to copy the uboot configuration from SD card to eMMC:

dd if=/dev/mmcblk0 skip=786432 of=/dev/mmcblk2 seek=786432 bs=1 count=131072

That's it, it should now boot from SD card after loading only the uboot configuration from eMMC.

---

For reference, here are the addresses of various important blocks that are stored on SD/eMMC before the first partition:

[root (ttyGS0)]# cat /sys/module/rawdatatable/parameters/rawdata_param
MBR                             :0x00000000:0x00000400
uBoot                           :0x00000400:0x000bfc00
Boot Env                        :0x000c0000:0x00020000
Reserved1                       :0x000e0000:0x00020000
Normal Kernel                   :0x00100000:0x00400000
Normal Rootfs                   :0x00500000:0x00100000
Recovery Kernel                 :0x00600000:0x00400000
Reserved2                       :0x00a00000:0x00500000
Normal Boot Env                 :0x00f00000:0x00020000
Recovery Boot Env               :0x00f20000:0x00020000
Raw Data Table                  :0x00f40000:0x00020000
Info                            :0x00f60000:0x00020000  
Id                              :0x00f80000:0x00020000
Reserved3                       :0x00fa0000:0x00060000
Boot Image                      :0x01000000:0x00100000
Waveform                        :0x01100000:0x00200000
LOG                             :0x01300000:0x00500000

I'll post a link to premade SD card image below soon.

[jpa]

Here is the SD card image. It has adb enabled, but otherwise stock firmware 1.0.07. Install to SD card (minimum 4 GB card, at least up to 16 GB works) using dd on a Linux PC:

unxz sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress

You can resize the partitions quite freely with gparted. Just don't touch the unallocated space before the first partition, as that contains the kernel.

[indiana71]

Hello JPA,

My Reader stopped to work after 10years. It is blocked on Opening book...

I tryed a lot of solution, but I can reach only recovery console with serial using rupor-rescue on my SD Card.

If I try to make a backup of my PRS-T1 with DD, I receive Input/output error on dev/mmcblk2.

dd if=/dev/mmcblk2 of=/dev/null skip=119000 count=2000
dd: /dev/mmcblk2: Input/output error


So, after reading your posts, I prepared my 8gB SD card with your PRS-T1 1.0.07 image. I don't touch anything else on SD card.

sudo dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/rdisk2 bs=1m

Then I tried to boot my PRS-T1 on recovery mode (HOME + MENU), it reach 100%, but restart.

So I don't undestand exactly how to use your premade image and exactly wich are the instructions to change the uboot configuration.
I'm using MacOS.

[jpa]

Originally Posted by indiana71

So, after reading your posts, I prepared my 8gB SD card with your PRS-T1 1.0.07 image. I don't touch anything else on SD card.

Then I tried to boot my PRS-T1 on recovery mode (HOME + MENU), it reach 100%, but restart.

So I don't undestand exactly how to use your premade image and exactly wich are the instructions to change the uboot configuration.
I'm using MacOS.

Yeah, I guess my post wasn't very clear on that. I had the extra complication that my device wouldn't boot even rupor rescue from SD card, so I had to use solder wires to hardware serial port to effect recovery.

Based on your error messages & symptoms, it seems your flash is broken in the user partition area while my was broken in the kernel area. But doesn't matter, as my image moves it all to SD card.

I haven't actually tried this myself, but I think you could get it done this way using the rupor USB shell:

1. Copy the uboot env from my image to a separate file:

dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin skip=786432 of=uboot_new.bin bs=1 count=131072

and copy uboot_new.bin to rupor rescue SD card, along with the other files that are already there.
2. Boot rupor rescue so that you get serial port shell over USB.
3. Find where the file is visible on PRS-T1 shell, [code]mount[code] command probably tells if the sd card is mounted.
4. You can backup the old uboot env to a file:

dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072

5. And then write a new one:

dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072

After that it should boot (in normal mode) from SD card that has my image on it. Rescue mode should still work as before, as this only changes the "active uboot env" instead of "rescue uboot env".

As usual, no warranty and be careful with the numbers

[indiana71]

In your description it is not clear were you are working... for example...

To get recovery environment to boot, put rupor-rescue on the SD card partition 4 and then use this Python script to temporarily point uboot to load the rescue partition from SD card:

How this? rupor-rescue is already on your custom SD image?

If I try this to mount the SD card partition 4 on my MacOS, I receive

mount: /dev/disk2s4: unknown special file or file system.

So, I can use rupor-rescue only into a separate SDCard.


Also..

In the recovery shell you can run this to copy the uboot configuration from SD card to eMMC:

but this command may be usefull if I have serial access to PRS-T1 with premade SDCard inserted... and I don't know how to.

Please, let me know some suggests.

[JSWolf]

Is it worth all this hassle to try to get a T1 up and running? If it was me, I'd be buying a new Reader.

[indiana71]

@JSWolf you're right! But I would to try...

And now I don't know what to buy

[JSWolf]

Originally Posted by indiana71

@JSWolf you're right! But I would to try...

And now I don't know what to buy

I went from a T1 to a Kobo Aura H2O. If I was going from a T1 to another Reader, I would go with the Kobo Libra H2O (7" screen) or the Kobo Forma (8" screen).

Kobo will handle the same ePub your T1 handles. It has a lot more features abd you can patch/add other programs if you want. Plus, it's a lot faster then the T1 and it's high-res 300DPI.

[indiana71]

Originally Posted by JSWolf

I went from a T1 to a Kobo Aura H2O. If I was going from a T1 to another Reader, I would go with the Kobo Libra H2O (7" screen) or the Kobo Forma (8" screen).

Kobo will handle the same ePub your T1 handles. It has a lot more features abd you can patch/add other programs if you want. Plus, it's a lot faster then the T1 and it's high-res 300DPI.

Thanks! And what about KOBO Clara HD (less expensive)?

[4691mls]

Originally Posted by indiana71

Thanks! And what about KOBO Clara HD (less expensive)?

If you are happy with the 6" size the Clara is a good reader. The comfort light is nice and the screen is clear. Early on, there were complaints about a "light bleed" but this eventually got worked out so if you buy a new one now, it should be fine.

[JSWolf]

Originally Posted by indiana71

Thanks! And what about KOBO Clara HD (less expensive)?

For a 6" screen, the Clara HD is a good Reader. It runs the same firmware that the two big brothers run.

But if you do go with the 7" screen, you won't want to go back to a 6" screen (IMHO).

[indiana71]

Originally Posted by jpa

Here is the SD card image. It has adb enabled, but otherwise stock firmware 1.0.07. Install to SD card (minimum 4 GB card, at least up to 16 GB works) using dd on a Linux PC:

unxz sd_card_PRS-T1_1.0.07_adb_enabled.bin.xz
dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin of=/dev/mmcblk0 bs=1M status=progress

You can resize the partitions quite freely with gparted. Just don't touch the unallocated space before the first partition, as that contains the kernel.

Meanwhile, will be usefull some explain from JPA on his good job!

[indiana71]

Originally Posted by indiana71

Meanwhile, will be usefull some explain from JPA on his good job!

JPA, sorry... I didn't read your old answer.
I'll try now.

Thanks!

[indiana71]

Originally Posted by jpa

Yeah, I guess my post wasn't very clear on that. I had the extra complication that my device wouldn't boot even rupor rescue from SD card, so I had to use solder wires to hardware serial port to effect recovery.

Based on your error messages & symptoms, it seems your flash is broken in the user partition area while my was broken in the kernel area. But doesn't matter, as my image moves it all to SD card.

I haven't actually tried this myself, but I think you could get it done this way using the rupor USB shell:

1. Copy the uboot env from my image to a separate file:

dd if=sd_card_PRS-T1_1.0.07_adb_enabled.bin skip=786432 of=uboot_new.bin bs=1 count=131072

and copy uboot_new.bin to rupor rescue SD card, along with the other files that are already there.
2. Boot rupor rescue so that you get serial port shell over USB.
3. Find where the file is visible on PRS-T1 shell, [code]mount[code] command probably tells if the sd card is mounted.
4. You can backup the old uboot env to a file:

dd if=/dev/mmcblk2 skip=786432 of=uboot_old.bin bs=1 count=131072

5. And then write a new one:

dd if=uboot_new.bin of=/dev/mmcblk2 seek=786432 bs=1 count=131072

After that it should boot (in normal mode) from SD card that has my image on it. Rescue mode should still work as before, as this only changes the "active uboot env" instead of "rescue uboot env".

As usual, no warranty and be careful with the numbers

IT WORKS!! Thanks!


I've used GPARTED Live CD to resize READER partition and it is very easy to use!

[nesiax]

Thank you so much !

I have my faulty Sony PRS-T1 working again.

Does anybody know how to root this device in order to show the android settings and run other apps ? I suppose it should be easy since it run everything now from the sd card, but I have no experience with Android low level.