After close to 10 years, my PRS-T1 finally had its internal eMMC flash fail. Not sure if it weared out, or if I messed up something as I was just doing some hacking when it happened. Anyway, the end result is that it just kept blinking yellow light, wouldn't go into recovery and wouldn't boot.
I opened it up and probed until I found serial port (UART) testpoints on the backside of the PCB. They are the three corner points in a group of 3x4 testpoints, shown in image below:
![]()
Connecting them to USB-serial converter (3.3V voltage), I got access to boot messages. This is where I found about the flash issue:
It was on the recovery filesystem area, so I did get it working by just forcing uboot to do a normal boot. But I fear that the internal flash may soon stop working completely if it already has a bad sector.
So I copied everything to a SD card and modified initramfs to mount mmcblk0 instead of mmcblk2. At the same time I added adb support.
This is how to rebuild the initrd (on PC Linux):
Then it is just a matter of pointing uboot to boot kernel from mmc0 instead of mmc2. There are three ways to do it:
Writing to eMMC is easiest, but if your eMMC was totally broken (not just bad sectors), you'd have to modify the uboot image in NAND so that it would load its configuration from mmc0 instead of mmc2.
To get recovery environment to boot, put rupor-rescue on the SD card partition 4 and then use this Python script to temporarily point uboot to load the rescue partition from SD card:
You can also just copy-paste the commands to serial terminal, but that is a bit annoying as the watchdog will reboot the device if it is stuck in uboot for more than 10 seconds or so.
In the recovery shell you can run this to copy the uboot configuration from SD card to eMMC:
That's it, it should now boot from SD card after loading only the uboot configuration from eMMC.
---
For reference, here are the addresses of various important blocks that are stored on SD/eMMC before the first partition:
I'll post a link to premade SD card image below soon.
I opened it up and probed until I found serial port (UART) testpoints on the backside of the PCB. They are the three corner points in a group of 3x4 testpoints, shown in image below:
Connecting them to USB-serial converter (3.3V voltage), I got access to boot messages. This is where I found about the flash issue:
Code:
mmcblk2: retrying using single block read(cmderr=0,dataerr=-110,stoperr=0)
mmcblk2: error -110 transferring data, sector 52832, nr 84, card status 0x80900
end_request: I/O error, dev mmcblk2, sector 52832So I copied everything to a SD card and modified initramfs to mount mmcblk0 instead of mmcblk2. At the same time I added adb support.
This is how to rebuild the initrd (on PC Linux):
Code:
find | cpio -H newc -R 0:0 -o > ../initrd_new.cpio
gzip -c < initrd_new.cpio > initrd_new.gz
mkimage -A ARM -O Linux -T ramdisk -a 0x70308000 -C none -n 'Normal Rootfs' -d initrd_new.gz initrd_new
sudo dd if=initrd_new of=/dev/mmcblk0 bs=1 seek=5242880- Write eMMC from Linux recovery environment
- Write eMMC from uboot command prompt
- Write NAND chip from uboot command prompt
Writing to eMMC is easiest, but if your eMMC was totally broken (not just bad sectors), you'd have to modify the uboot image in NAND so that it would load its configuration from mmc0 instead of mmc2.
To get recovery environment to boot, put rupor-rescue on the SD card partition 4 and then use this Python script to temporarily point uboot to load the rescue partition from SD card:
Code:
import serial, time, sys
s = serial.Serial("/dev/ttyUSB0", 115200, timeout = 0.1)
def slowsend(x):
for b in x:
s.write(b)
time.sleep(0.001)
while True:
d = s.read(32)
sys.stdout.write(d)
s.write(' ' * 32) # "Any key" for uboot
if 'Hit' in d:
slowsend("\r\nprintenv\r\n")
time.sleep(1.5)
# To boot recovery from SD card
slowsend("setenv bootargs 'root=/dev/mmcblk0p1 rootfstype=ext4 rw "
+ "rootwait init=/linuxrc console=ttymxc4,115200 bootdev=2 rawtable=0xF40000'\r\n")
# To boot normal system from SD card
# slowsend("setenv bootargs 'console=ttymxc4,115200 init=/init bootdev=0 rawtable=0xF40000'\r\n")
time.sleep(1.0)
slowsend("boot\r\n")
break
while True:
d = s.read(64)
sys.stdout.write(d)In the recovery shell you can run this to copy the uboot configuration from SD card to eMMC:
Code:
dd if=/dev/mmcblk0 skip=786432 of=/dev/mmcblk2 seek=786432 bs=1 count=131072---
For reference, here are the addresses of various important blocks that are stored on SD/eMMC before the first partition:
Code:
[root (ttyGS0)]# cat /sys/module/rawdatatable/parameters/rawdata_param
MBR :0x00000000:0x00000400
uBoot :0x00000400:0x000bfc00
Boot Env :0x000c0000:0x00020000
Reserved1 :0x000e0000:0x00020000
Normal Kernel :0x00100000:0x00400000
Normal Rootfs :0x00500000:0x00100000
Recovery Kernel :0x00600000:0x00400000
Reserved2 :0x00a00000:0x00500000
Normal Boot Env :0x00f00000:0x00020000
Recovery Boot Env :0x00f20000:0x00020000
Raw Data Table :0x00f40000:0x00020000
Info :0x00f60000:0x00020000
Id :0x00f80000:0x00020000
Reserved3 :0x00fa0000:0x00060000
Boot Image :0x01000000:0x00100000
Waveform :0x01100000:0x00200000
LOG :0x01300000:0x00500000