Wink Hub root

[rajil.s]

My followed the Pin 29 ground method and got the uboot prompt on Wink Hub Gen 1. I set up init /bin/sh, and booted the hub. Unfortunately, i receive the following error on bootup.

IFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   75550720 bytes (73780 KiB, 72 MiB, 595 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: zlib
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:11.
Freeing init memory: 124K
UBIFS error (pid 952): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 952): ubifs_read_node: bad node at LEB 213:64680
UBIFS error (pid 952): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 952): ubifs_read_node: bad node at LEB 213:76288
can't run '/bin/mount': Invalid argument
UBIFS error (pid 1): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 1): ubifs_read_node: bad node at LEB 213:67680
UBIFS error (pid 1): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 1): ubifs_read_node: bad node at LEB 213:67680
UBIFS error (pid 1): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 1): ubifs_read_node: bad node at LEB 213:67680
UBIFS error (pid 1): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 1): ubifs_read_node: bad node at LEB 213:67680
UBIFS error (pid 1): ubifs_read_node: bad node type (

Boot ROM Geometry
-----------------
Boot Area Count            : 1
Boot Area Size in Bytes    : 3145728 (0x300000)
Stride Size in Pages       : 64
Search Area Stride Exponent: 2
Scanning device for bad blocks
Bad eraseblock 280 at 0x000002300000
Bad eraseblock 281 at 0x000002320000
Bad eraseblock 282 at 0x000002340000
Bad eraseblock 283 at 0x000002360000
Bad eraseblock 288 at 0x000002400000
Bad eraseblock 289 at 0x000002420000
Bad eraseblock 290 at 0x000002440000
Bad eraseblock 291 at 0x000002460000
Bad eraseblock 296 at 0x000002500000
Bad eraseblock 297 at 0x000002520000
Bad eraseblock 298 at 0x000002540000
Bad eraseblock 299 at 0x000002560000
Bad eraseblock 304 at 0x000002600000
Bad eraseblock 305 at 0x000002620000
Bad eraseblock 306 at 0x000002640000
Bad eraseblock 331 at 0x000002960000
Bad eraseblock 339 at 0x000002a60000
Boot area protection is enabled.
Creating 6 MTD partitions on "gpmi-nfc-main":
0x000000000000-0x000000300000 : "gpmi-nfc-0-boot"
0x000000300000-0x000000700000 : "updater-kernel"
0x000000700000-0x000002300000 : "updater-rootfs"
0x000002300000-0x000002b00000 : "database"
0x000002b00000-0x000003300000 : "app-kernel"
0x000003300000-0x000008000000 : "gpmi-nfc-general-use"
cmdlinepart partition parsing not available
UBI: attaching mtd5 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd5 to ubi0
UBI: MTD device name:            "gpmi-nfc-general-use"
UBI: MTD device size:            77 MiB
UBI: number of good PEBs:        616
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     1
UBI: available PEBs:             0
UBI: total number of reserved PEBs: 616
UBI: number of PEBs reserved for bad PEB handling: 6
UBI: max/mean erase counter: 68/48
UBI: image sequence number: 1024843640
UBI: background thread "ubi_bgt0d" started, PID 922
 ubiblka: unknown partition table
mice: PS/2 mouse device common for all mice
MXS RTC driver v1.0 hardware v2.3.0
mxs-rtc mxs-rtc.0: rtc core: registered mxs-rtc as rtc0
mxs watchdog: initialized, heartbeat 19 sec
mxs-mmc: MXS SSP Controller MMC Interface driver
__mxs_reset_block(f0010000): timeout when resetting
__mxs_reset_block(f0010000): timeout when resetting
mxs-mmc mxs-mmc.0: mmc0: MXS SSP MMC DMAIRQ 82 ERRIRQ 96 
TCP cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
mxs-rtc mxs-rtc.0: setting system clock to 1970-01-01 00:00:17 UTC (17)
mmc0: queuing unknown CIS tuple 0x80 (7 bytes)
mmc0: queuing unknown CIS tuple 0x80 (6 bytes)
UBIFS: recovery needed
mmc0: new high speed SDIO card at address 0001
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size:   75550720 bytes (73780 KiB, 72 MiB, 595 LEBs)
UBIFS: journal size:       9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: zlib
UBIFS: reserved for root:  0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) on device 0:11.
Freeing init memory: 124K
UBIFS error (pid 1): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 1): ubifs_read_node: bad node at LEB 213:83752
Failed to execute /bin/sh.  Attempting defaults...
UBIFS error (pid 952): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 952): ubifs_read_node: bad node at LEB 213:64680
UBIFS error (pid 952): ubifs_read_node: bad node type (255 but expected 2)
UBIFS error (pid 952): ubifs_read_node: bad node at LEB 213:76288

Only way to recover this is by pressing the 'reset' button on the back. I have tried this several times, but the device refuses to run /bin/sh.

Any idea what could be the issue?

 

[jmayes]

Hi, I am trying to get a root console on my wink hub 1 and have followed all the pin29 procedures however in /etc/inittab I have "::respawn:/root/platform/spawnTerminal.sh # GENERIC_SERIAL" instead of "#ttyAM0::respawn:/sbin/getty -L ttyAM0 115200 vt100 # GENERIC_SERIAL" as expected. I have tried adding the line and tried several normal linix commands but still do not get a console on normal boot, just the status info. Any help would be appreciated!
J

 

[jmayes]

No ideas on why this won't work for me?

 

[Slingky1178]

Hi guys, I have an old Wink Hub v1. (probably running latest firmware as of december 2019, was using winkapp until now...)

I'm trying to root it using the nand glitch and I get the console.

1st command passed :
setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh';

2nd command failed :
nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

This is the error message :
NAND read: device 0 offset 0x2b00000, size 0x400000
Attempt to read outside the flash area
0 bytes read: ERROR

Any ideas?

** I found a thread on rootwink[.]com and it was suggested to copy-paste instead of typing but it's what I did...

Thanks

 

[Seattleweather]

I got following message. Please help

<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>404 - Not Found</title>
</head>
<body>
<h1>404 - Not Found</h1>
</body>
</html>

 

[Peratelli]

=> printenv
app_boot=run appboot_args && nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}
app_boot_bad=run updater_args; setenv bootargs ${bootargs} badapp; nand read ${loadaddr} updater-kernel 0x00300000; bootm ${loadaddr}
appboot_args=setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi';
baudrate=115200
bd_addr=0021CC09EAB0
boot_app=run app_boot || run app_boot_bad
boot_getflag=mtdparts default && ubi part database && ubifsmount ubi0:database && mw 42000000 0 8 && ubifsload 42000000 DO_UPDATE 1 && run boot_logic
boot_logic=mw 42000004 30; if cmp 42000000 42000004 1; then run boot_app; else run boot_updater; fi;
boot_updater=run updater_boot || run updater_boot_bad
bootargs=noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi badupdater
bootcmd=mtdparts default; run boot_getflag || echo Falling back to updater...; run boot_updater
bootdelay=1
bootfile=uImage
ethact=FEC0
ethaddr=00:04:00:00:00:00
ethprime=FEC0
loadaddr=0x42000000
mtddevname=u-boot
mtddevnum=0
mtdids=nand0=gpmi-nand
mtdparts=mtdparts=gpmi-nand:3m(u-boot),4m(updater-kernel),28m(updater-rootfs),8m(database),8m(app-kernel),-(app-rootfs)
partition=nand0,0
serialno=162100447WZD1
stderr=serial
stdin=serial
stdout=serial
updater_args=setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=2 root=ubi0:rootfs rw gpmi';
updater_boot=run updater_args && nand read ${loadaddr} updater-kernel 0x00300000 && bootm ${loadaddr}
updater_boot_bad=run appboot_args; setenv bootargs ${bootargs} badupdater; nand read ${loadaddr} app-kernel 0x00400000; bootm ${loadaddr}
ver=U-Boot 2014.01-14400-gda781c6-dirty (Apr 30 2014 - 22:35:38)

Environment size: 1762/16379 bytes
=> setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh'
=> nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

 

[Peratelli]

I followed the Pin 29 ground method and got the uboot prompt on Wink Hub Gen 1.

I putted de line commands:
=> setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh'
=> nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

The Wink Hub restart , but stop in this point:

Spoiler

NAND read: device 0 offset 0x2b00000, size 0x400000
Skipping bad block 0x02c60000
4194304 bytes read: OK
## Booting kernel from Legacy Image at 42000000 ...
Image Name: Linux-2.6.35.3-flex-dvt
Created: 2014-04-30 3:15:35 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1928460 Bytes = 1.8 MiB
Load Address: 40008000
Entry Point: 40008000
Verifying Checksum ... OK
Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
Linux version 2.6.35.3-flex-dvt (saurabh@localhost.localdomain) (gcc version 4.4.4 (4.4.4_09.06.2010) ) #32 PREEMPT Tue Apr 29 23:15:31 EDT 2014
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: Freescale MX28EVK board
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 64MB = 64MB total
Memory: 60784k/60784k available, 4752k reserved, 0K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xfde00000 - 0xffe00000 ( 32 MB)
vmalloc : 0x84800000 - 0xf0000000 (1720 MB)
lowmem : 0x80000000 - 0x84000000 ( 64 MB)
modules : 0x7f000000 - 0x80000000 ( 16 MB)
.init : 0x80008000 - 0x80027000 ( 124 kB)
.text : 0x80027000 - 0x803b6000 (3644 kB)
.data : 0x803b6000 - 0x803deec0 ( 164 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
NR_IRQS:288
Console: colour dummy device 80x30
console [ttyAM0] enabled
Calibrating delay loop... 226.09 BogoMIPS (lpj=1130496)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
regulator: core version 0.5
NET: Registered protocol family 16
regulator: vddd: 800 <--> 1575 mV at 1500 mV fast normal
regulator: vdddbo: 800 <--> 1575 mV fast normal
regulator: vdda: 1500 <--> 2275 mV at 1800 mV fast normal
vddio = 3380000, val=10
regulator: vddio: 2880 <--> 3680 mV at 3380 mV fast normal
regulator: overall_current: fast normal
regulator: vbus5v:
regulator: mxs-duart-1: fast normal
regulator: mxs-bl-1: fast normal
regulator: mxs-i2c-1: fast normal
regulator: mmc_ssp-1: fast normal
regulator: mmc_ssp-2: fast normal
regulator: charger-1: fast normal
regulator: power-test-1: fast normal
regulator: cpufreq-1: fast normal
i.MX IRAM pool: 124 KB@0x84820000
Initializing GPMI pins
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource mxs clock source
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
Bus freq driver module loaded
mxs_cpu_init: cpufreq init finished
Slow work thread pool: Starting up
Slow work thread pool: Ready
fuse init (API version 7.14)
msgmni has been set to 118
alg: No test for stdrng (krng)
cryptodev: driver loaded.
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
mxs-duart.0: ttyAM0 at MMIO 0x80074000 (irq = 47) is a DebugUART
mxs-auart.0: ttySP0 at MMIO 0x8006a000 (irq = 112) is a mxs-auart.0
Found APPUART 3.1.0
mxs-auart.1: ttySP1 at MMIO 0x8006c000 (irq = 113) is a mxs-auart.1
Found APPUART 3.1.0
mxs-auart.2: ttySP2 at MMIO 0x8006e000 (irq = 114) is a mxs-auart.2
Found APPUART 3.1.0
mxs-auart.3: ttySP3 at MMIO 0x80070000 (irq = 115) is a mxs-auart.3
Found APPUART 3.1.0
mxs-auart.4: ttySP4 at MMIO 0x80072000 (irq = 116) is a mxs-auart.4
Found APPUART 3.1.0
loop: module loaded
i.MX GPMI NFC
NFC: Version 1, 8-chip GPMI and BCH
Boot ROM: Version 1, Single-chip boot area, block mark swapping supported
Scanning for NAND Flash chips...
NAND device: Manufacturer ID: 0x01, Chip ID: 0xf1 (AMD NAND 128MiB 3,3V 8-bit)
-----------------------------
NAND Flash Device Information
-----------------------------
Manufacturer : AMD (0x01)
Device Code : 0xf1
Cell Technology : SLC
Chip Size : 128 MiB
Pages per Block : 64
Page Geometry : 2048+64
ECC Strength : 4 bits
ECC Size : 512 B
Data Setup Time : 10 ns
Data Hold Time : 5 ns
Address Setup Time: 10 ns
GPMI Sample Delay : 6 ns
tREA : Unknown
tRLOH : Unknown
tRHOH : Unknown
Description : S34ML01G1
-----------------
Physical Geometry
-----------------
Chip Count : 1
Page Data Size in Bytes: 2048 (0x800)
Page OOB Size in Bytes : 64
Block Size in Bytes : 131072 (0x20000)
Block Size in Pages : 64 (0x40)
Chip Size in Bytes : 134217728 (0x8000000)
Chip Size in Pages : 65536 (0x10000)
Chip Size in Blocks : 1024 (0x400)
Medium Size in Bytes : 134217728 (0x8000000)
------------
NFC Geometry
------------
ECC Algorithm : BCH
ECC Strength : 8
Page Size in Bytes : 2112
Metadata Size in Bytes : 10
ECC Chunk Size in Bytes: 512
ECC Chunk Count : 4
Payload Size in Bytes : 2048
Auxiliary Size in Bytes: 16
Auxiliary Status Offset: 12
Block Mark Byte Offset : 1999
Block Mark Bit Offset : 0
-----------------
Boot ROM Geometry
-----------------
Boot Area Count : 1
Boot Area Size in Bytes : 3145728 (0x300000)
Stride Size in Pages : 64
Search Area Stride Exponent: 2
Scanning device for bad blocks
Bad eraseblock 64 at 0x000000800000
Bad eraseblock 128 at 0x000001000000
Bad eraseblock 129 at 0x000001020000
Bad eraseblock 145 at 0x000001220000
Bad eraseblock 280 at 0x000002300000
Bad eraseblock 281 at 0x000002320000
Bad eraseblock 282 at 0x000002340000
Bad eraseblock 283 at 0x000002360000
Bad eraseblock 288 at 0x000002400000
Bad eraseblock 329 at 0x000002920000
Bad eraseblock 355 at 0x000002c60000
Bad eraseblock 784 at 0x000006200000
Bad eraseblock 948 at 0x000007680000
Boot area protection is enabled.
Creating 6 MTD partitions on "gpmi-nfc-main":
0x000000000000-0x000000300000 : "gpmi-nfc-0-boot"
0x000000300000-0x000000700000 : "updater-kernel"
0x000000700000-0x000002300000 : "updater-rootfs"
0x000002300000-0x000002b00000 : "database"
0x000002b00000-0x000003300000 : "app-kernel"
0x000003300000-0x000008000000 : "gpmi-nfc-general-use"
cmdlinepart partition parsing not available
UBI: attaching mtd5 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd5 to ubi0
UBI: MTD device name: "gpmi-nfc-general-use"
UBI: MTD device size: 77 MiB
UBI: number of good PEBs: 614
UBI: number of bad PEBs: 2
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 614
UBI: number of PEBs reserved for bad PEB handling: 6
UBI: max/mean erase counter: 2512/1371
UBI: image sequence number: 207253702
UBI: background thread "ubi_bgt0d" started, PID 922
ubiblka: unknown partition table
mice: PS/2 mouse device common for all mice
MXS RTC driver v1.0 hardware v2.3.0
mxs-rtc mxs-rtc.0: rtc core: registered mxs-rtc as rtc0
mxs watchdog: initialized, heartbeat 19 sec
mxs-mmc: MXS SSP Controller MMC Interface driver
__mxs_reset_block(f0010000): timeout when resetting
__mxs_reset_block(f0010000): timeout when resetting
__mxs_reset_block(f0010000): timeout when resetting
__mxs_reset_block(f0010000): timeout when resetting
__mxs_reset_block(f0010000): timeout when resetting
__mxs_reset_block(f0010000): timeout when resetting
mxs-mmc mxs-mmc.0: mmc0: MXS SSP MMC DMAIRQ 82 ERRIRQ 96
TCP cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 15
lib80211: common routines for IEEE802.11 drivers
mxs-rtc mxs-rtc.0: setting system clock to 1970-01-01 00:32:32 UTC (1952)
mmc0: queuing unknown CIS tuple 0x80 (7 bytes)
mmc0: queuing unknown CIS tuple 0x80 (6 bytes)
UBIFS: recovery needed
mmc0: new high speed SDIO card at address 0001
UBI error: ubi_io_read: error -74 while reading 83968 bytes from PEB 305:47104, read 83968 bytes
UBIFS error (pid 1): ubifs_scanned_corruption: corruption at LEB 362:45096
UBIFS error (pid 1): ubifs_recover_leb: LEB 362 scanning failed
VFS: Cannot open root device "ubi0:rootfs" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
1f00 3072 mtdblock0 (driver?)
1f01 4096 mtdblock1 (driver?)
1f02 28672 mtdblock2 (driver?)
1f03 8192 mtdblock3 (driver?)
1f04 8192 mtdblock4 (driver?)
1f05 78848 mtdblock5 (driver?)
fe00 74896 ubiblka (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
Backtrace:
[<8002b9d0>] (dump_backtrace+0x0/0x110) from [<802d90e0>] (dump_stack+0x18/0x1c)
r7:80023a14 r6:00008000 r5:83c13000 r4:803dfd58
[<802d90c8>] (dump_stack+0x0/0x1c) from [<802d915c>] (panic+0x78/0xfc)
[<802d90e4>] (panic+0x0/0xfc) from [<80008ee8>] (mount_block_root+0x25c/0x2ac)
r3:00000000 r2:00000001 r1:83c23f78 r0:8035bd98
[<80008c8c>] (mount_block_root+0x0/0x2ac) from [<80009038>] (prepare_namespace+0x94/0x18c)
[<80008fa4>] (prepare_namespace+0x0/0x18c) from [<800084f8>] (kernel_init+0x128/0x170)
r5:80022248 r4:803def40
[<800083d0>] (kernel_init+0x0/0x170) from [<80046f38>] (do_exit+0x0/0x6a4)
r5:800083d0 r4:00000000

Please, how to solve this problem?

{Mod edit: Spoiler added for better reading and scrolling experiences - Regards Oswald Boelcke}

 

[Jmm1961]

Hi guys, I have an old Wink Hub v1. (probably running latest firmware as of december 2019, was using winkapp until now...)

I'm trying to root it using the nand glitch and I get the console.

1st command passed :
setenv bootargs 'noinitrd console=ttyAM0,115200 rootfstype=ubifs ubi.mtd=5 root=ubi0:rootfs rw gpmi init=/bin/sh';

2nd command failed :
nand read ${loadaddr} app-kernel 0x00400000 && bootm ${loadaddr}

This is the error message :
NAND read: device 0 offset 0x2b00000, size 0x400000
Attempt to read outside the flash area
0 bytes read: ERROR

Any ideas?

** I found a thread on rootwink[.]com and it was suggested to copy-paste instead of typing but it's what I did...

Thanks

I have had the same problem. I was able to
setenv bootdelay 1
saveenv
Then reset that will allow you to interrupt the boot with the keyboard and then load the kernel into memory and boot with the second command

For some reason the latest firmware 4.4.1 causes this odd error

I know this is a long time after the original post but I just found my stored wink

 

[akcracker]

was having same issue w/nand error w/later firmware (anything that doesn't produce "home page" when you connect to the wink open wifi & browse to its internal web server at 192.168.0.1)

I found it best to start the hub normally w/UART connected, then after about a minute of boot display, press the reset button to reboot & touch pin 29 after 1 sec. if nand still fails, I try again. but using this method has worked for me on the 6 hubs I rooted.

also found how to get wifi, tty & ssh working in later firmware (thru 4.4.1) - removed all but getty line in /root/platform/spawnTerminal.sh (don't touch /etc/inittab), removed "if" logic surrounding /database/bundle_id in /etc/init.d/S31platform, & DROPBEAR_ARGS settings in /etc/init.d/S50dropbear. then stop & start (not restart) dropbear, sync, & reboot -f (wifi /database/wpa_supplicant.conf changes are the same as w/the older firmware)

 

[RoganDawes]

In case anyone is interested, I did a writeup of my attempts to hack the Wink Hub v2, which seems to be less documented online.

SensePost | Investigating the wink hub 2

Leaders in Information Security

sensepost.com

So far, I haven't got any meaningful access, but there are a few avenues of attack still to be investigated. The most promising would be to remove the flash chip to take a copy of the firmware, but perhaps someone here has figured out the path to the v2 firmware files? This doc lists a number of Hub v1 firmware files: https://github.com/wink-hub-root/demystified/wiki/Official-Wink-Repo-File-Listings

Note that the hub is looking for the following host on boot: hub-updates.winkapp.com

Which appears to contain a backup of the files listed above.