PW Source for PaperWhite uboot?

hjalfi · 03-13-2021, 04:45 PM

Does anyone know where I can get a copy of the source code (or even a precompiled uboot.imx) for the PaperWhite?

Context: I have a defunct PaperWhite which is showing signs of a dead eMMC. On bootup, I get the dreaded "Invalid board ID!" message. It'll enter recovery mode, although it's rather unwilling to do so and will typically require multiple reboots, and I have the tooling to download and run an image (imx_usb_loader). However, I have no uboot image to run, and the various links I've found here to get one have all bitrotted. I'm hoping to get an actual uboot prompt with which I can poke things a bit and try and figure out whether the eMMC is actually dead or whether something just erased the magic startup data.

NiLuJe · 03-13-2021, 05:51 PM

It should be part of the Kindle source drops (e.g., the "Source code notice" at the bottom of the Kindle Software Update page, IIRC).

katadelos · 03-13-2021, 06:21 PM

You might be able to extract a stock u-boot binary from the relevant factory image (possibly normal updates too, according to this post?) for your device.

If the binary is included, you should be able to use it with imx_usb_loader directly (I've had to do this myself after bricking one of my KT2s with a buggy self-built u-boot).

hjalfi · 03-14-2021, 10:27 AM

Thanks!

I managed to make u-boot build for the imx_yoshi (after finding a source package which would actually build, which for reference is Kindle_src_5.4.4.2_2323310003.tar.gz, and after fixing the archaic gccisms which were preventing it from building). Unfortunately imx_usb won't load it.

Quote:

config file </usr/share/imx-usb-loader/imx-loader.d//mx50_usb_work.conf>
parse /usr/share/imx-usb-loader/imx-loader.d//mx50_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0052
Interface 0 claimed
HAB security state: development mode (0x56787856)
== work item
filename u-boot.bin
load_size 0 bytes
load_addr 0x00000000
dcd 1
clear_dcd 0
plug 1
jump_mode 3
jump_addr 0x00000000
== end work item
header not found 8400:70e2, 4000
do_download failed, err=-22
HAB security state: development mode (0x56787856)

This suggests that the binary file is missing the IMX header, but I've found a number of references to using imx_usb with a u-boot.bin directly and none of them mention needing one. Do I need an SPL? If so, where would I get one?

I also looked at the precompiled factory image for the PaperWhite gen 5 update package... and it doesn't have u-boot file in it!

NiLuJe · 03-14-2021, 01:17 PM

As @katadelos said, I'd check a production update, too

.

katadelos · 03-14-2021, 03:38 PM

Quote:

Originally Posted by hjalfi

This suggests that the binary file is missing the IMX header, but I've found a number of references to using imx_usb with a u-boot.bin directly and none of them mention needing one.

Could be related to this issue, it might be worth checking the contents of your mx50_usb_work.conf - mine looks like this:

Code:

KindleTouch
hid,1024,0x70000000,256M,0xF8000000,128K

hjalfi · 03-14-2021, 08:08 PM

That does seem to be what's wrong. The default mx50_usb_work.conf file I have wants to upload an SPL, then u-boot, then it does something I don't understand via the SPL.

Your configuration fails for me because it still doesn't know where to load the binary.
The most working configuration I've found is to adapt the existing script to not try and load the SPL.
u-boot's linked at 0x79800000, so I've tried:

Code:

mx50
hid,64,0xf8006400,0xf8006400,128M,0x70000000,256M
u-boot.bin:load 0x79800000

But this just produces errors which suggest that there's no memory there...

Code:

parse .//mx50_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0052
Interface 0 claimed
HAB security state: development mode (0x56787856)
== work item
filename u-boot.bin
load_size 0 bytes
load_addr 0x79800000
dcd 0
clear_dcd 0
plug 0
jump_mode 2
jump_addr 0x79800000
== end work item

loading binary file(u-boot.bin) to 79800000, skip=0, fsize=10cec type=aa
report 2 out err=-1, last_trans=0 len=0x40 max=0x40 retry=10
report 2 out err=-1, last_trans=0 len=0x40 max=0x20 retry=9
report 2 out err=-1, last_trans=0 len=0x40 max=0x10 retry=8
report 2 out err=-1, last_trans=0 len=0x40 max=0x8 retry=7
report 2 out err=-1, last_trans=0 len=0x40 max=0x10 retry=6
report 2 out err=-1, last_trans=0 len=0x40 max=0x8 retry=5
report 2 out err=-1, last_trans=0 len=0x40 max=0x10 retry=4
report 2 out err=-4, last_trans=0 len=0x40 max=0x8 retry=3
report 2 out err=-4, last_trans=0 len=0x40 max=0x10 retry=2
report 2 out err=-4, last_trans=0 len=0x40 max=0x8 retry=1
Giving up

On startup I get this out of the serial port:

Code:

MC:  FSL_ESDHC: 0, FSL_ESDHC: 1
Board: Unknown
Boot Reason: [POR]
Boot Device: MMC
Board Id: 
S/N: 
Invalid board id!  Can't determine system type for RAM init.. bailing!
DRAM:   0 kB
Using default environment

AFAIK this is a classic symptom of eMMC failure, as it can't read the configuration information and cannot configure the DRAM. Therefore, I can't load u-boot into DRAM.

I know that some Kindles have two versions of u-boot: one which is small enough to run from the on-chip RAM, and one which has things like fastboot and bist linked in which are run once the DRAM is set up.
So I'm going to guess that I need to reproduce the cut-down uboot which can run from the on-chip RAM and run that. Is this the one called imx50_yoshi_mfgtool_config? That is also linked at 0x79800000, though...

katadelos · 03-15-2021, 11:29 AM

Quote:

Originally Posted by hjalfi

Your configuration fails for me because it still doesn't know where to load the binary.

Are you calling imx_usb directly? You need to pass the name of the u-boot binary that you want to load for things to work with the configuration above: ./imx_usb u-boot.bin.

According to this post, you can also specify the binary name within the config file like this:

Code:

KindleTouch
hid,1024,0x70000000,256M,0xF8000000,128K
img/main.bin:dcd,plug
img/main.bin:jumpheader

Quote:

Originally Posted by hjalfi

AFAIK this is a classic symptom of eMMC failure, as it can't read the configuration information and cannot configure the DRAM. Therefore, I can't load u-boot into DRAM.

Possibly, possibly not - all you know for sure is that the eMMC doesn't contain the config info. The output you attached is identical to what you'd get if you'd just soldered on a blank eMMC

Quote:

Originally Posted by hjalfi

I know that some Kindles have two versions of u-boot: one which is small enough to run from the on-chip RAM, and one which has things like fastboot and bist linked in which are run once the DRAM is set up.

There are 2 versions of u-boot on most Kindles but you're misunderstanding the boot process. AFAIK, the stripped down version is used in almost all cases unless you interrupt the boot process and drop to bist explicitly; the stripped down u-boot doesn't chainload bist.

Quote:

Originally Posted by hjalfi

So I'm going to guess that I need to reproduce the cut-down uboot which can run from the on-chip RAM and run that. Is this the one called imx50_yoshi_mfgtool_config?

In your case (PW1), you want the imx50_yoshime3_* defconfigs. You should focus on getting to the point where you can load u-boot in the first place though, it might help if you post the exact commands and env variables that you're using to build u-boot.

hjalfi · 03-15-2021, 03:49 PM

Yeah, I'm hoping that this eMMC had a vague moment and corrupted itself. But if I can get u-boot working at all, I can get some work out of this thing.

Thanks for the link --- there's some useful stuff there. The impression I get is that the DRAM gets configured by writing the DCD to the chip as part of the download process, but the only reference to this in the u-boot source is in board/imx50_yoshi/flash_header.S, and there's a magic number which appears in it, which I can't find in the binary.

To build u-boot, I'm doing this:

Code:

make CROSS_COMPILE=arm-linux-gnueabihf- -j imx50_yoshime3_mfgtool_config
make CROSS_COMPILE=arm-linux-gnueabihf- -j

This matches the instructions in the eMMC replacement thread. This outputs u-boot, an ELF file; u-boot.bin, the binary file I'm trying to upload; and an S-record file. Looking inside the S-record file just shows addresses in the 0x798xxxxx range. I've tried all the imx50_yoshi* configs and they all produce binaries linked at that address.

So, given that (a) there appears to be no DCD information in the binary and (b) imx_usb can't find the file header containing the load and execute addresses (I have to specify them manually), I'm guessing I'm trying to upload the wrong file.

Any ideas?

katadelos · 03-15-2021, 04:55 PM

I've just had a go at compiling and testing the various u-boot configurations on a KT2 and I get a similar error when trying to use imx60_wario_mfgtool config. It might be that MfgTool does things in a slightly different way to imx_usb_loader? I've never used it so can't say for sure.

However, I'm able to create working builds using the imx60_wario and imx60_wario_bist configs that are loadable using imx_usb_loader using the commands below:

Code:

# for production u-boot
CROSS_COMPILE=arm-kindlepw2-linux-gnueabi- ARCH=arm TYPE=prod make distclean
CROSS_COMPILE=arm-kindlepw2-linux-gnueabi- ARCH=arm TYPE=prod make imx60_wario_config
CROSS_COMPILE=arm-kindlepw2-linux-gnueabi- ARCH=arm TYPE=prod make
mv u-boot.bin u-boot_prod.bin

# for bist
CROSS_COMPILE=arm-kindlepw2-linux-gnueabi- ARCH=arm TYPE=bist make distclean
CROSS_COMPILE=arm-kindlepw2-linux-gnueabi- ARCH=arm TYPE=bist make imx60_wario_bist_config
CROSS_COMPILE=arm-kindlepw2-linux-gnueabi- ARCH=arm TYPE=bist make
mv u-boot.bin u-boot_bist.bin

Make sure that you're setting the TYPE env variable correctly as it changes which LD script is used:

Code:

# boards/imx50_yoshi/config.mk
ifeq ($(TYPE),prod)
LDSCRIPT := $(SRCTREE)/board/$(VENDOR)/$(BOARD)/u-boot.lds

TEXT_BASE = 0xF8007000
else
LDSCRIPT := $(SRCTREE)/board/$(VENDOR)/$(BOARD)/bist.lds

TEXT_BASE = 0x79800000
endif

hjalfi · 03-15-2021, 06:32 PM

Yes --- the TYPE=prod was the problem! The new images link at 0xf8007000, and they download and imx_usb is reporting that it's apparently run them. Thanks very much!

However I say 'apparently' because while I can see the USB connection disconnect and then reconnect, I see no serial output from it. Apparently nothing worthwhile is easy?

So either it's working but the console output is getting lost, or it's not working and execution is returning to the ROM, which is going back to download mode without producing another banner.

Incidentally, when (if) I ever get this going, I plan to write this up and produce a cleaned up works-out-of-the-box uboot version...

hjalfi · 03-17-2021, 07:36 PM

I have progress!

It appears that the mx50_yoshime3 configuration will not start at all unless I prevent it from calling arch_cpu_init. Otherwise, it runs a handful of instructions after returning and then hangs. My suspicion is that this is conflicting with the ROM's uboot somehow.

Once that's disabled, and with the board init hacked to always initialise as a gen 1.5 PW with ID 00002, it runs enough to get to a uboot prompt. From here I have discovered two things:

- after a random amount of time the Kindle disconnects from USB and hangs. This may be a hardware fault, or it may be an uninitialised watchdog timer of some description? The amount of time appears to be variable.

- trying to access the eMMC card, including trying to read the startup variables, always fails. The eMMC card response is that the card is locked (password protected but no password has been provided).

I'm guessing that this is spurious. If there's a hardware fault causing random resets (which I suspect) then maybe the card got powered down and corrupted its internal state? There is a way to reset the card's password by wiping it, but this seems... irreversable, so I thought I'd check in first. Any of this sound familiar to anyone?

03-13-2021, 04:45 PM	#1
hjalfi Member Posts: 24 Karma: 10 Join Date: Apr 2011 Device: Kindle 3g	Source for PaperWhite uboot? Does anyone know where I can get a copy of the source code (or even a precompiled uboot.imx) for the PaperWhite? Context: I have a defunct PaperWhite which is showing signs of a dead eMMC. On bootup, I get the dreaded "Invalid board ID!" message. It'll enter recovery mode, although it's rather unwilling to do so and will typically require multiple reboots, and I have the tooling to download and run an image (imx_usb_loader). However, I have no uboot image to run, and the various links I've found here to get one have all bitrotted. I'm hoping to get an actual uboot prompt with which I can poke things a bit and try and figure out whether the eMMC is actually dead or whether something just erased the magic startup data.

03-15-2021, 03:49 PM	#9
hjalfi Member Posts: 24 Karma: 10 Join Date: Apr 2011 Device: Kindle 3g	Yeah, I'm hoping that this eMMC had a vague moment and corrupted itself. But if I can get u-boot working at all, I can get some work out of this thing. Thanks for the link --- there's some useful stuff there. The impression I get is that the DRAM gets configured by writing the DCD to the chip as part of the download process, but the only reference to this in the u-boot source is in board/imx50_yoshi/flash_header.S, and there's a magic number which appears in it, which I can't find in the binary. To build u-boot, I'm doing this: Code: make CROSS_COMPILE=arm-linux-gnueabihf- -j imx50_yoshime3_mfgtool_config make CROSS_COMPILE=arm-linux-gnueabihf- -j This matches the instructions in the eMMC replacement thread. This outputs u-boot, an ELF file; u-boot.bin, the binary file I'm trying to upload; and an S-record file. Looking inside the S-record file just shows addresses in the 0x798xxxxx range. I've tried all the imx50_yoshi* configs and they all produce binaries linked at that address. So, given that (a) there appears to be no DCD information in the binary and (b) imx_usb can't find the file header containing the load and execute addresses (I have to specify them manually), I'm guessing I'm trying to upload the wrong file. Any ideas?

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
KT3 wiped mmc, only uboot	csakakirc	Kindle Developer's Corner	15	08-21-2023 02:06 PM
Uboot needed for pw2	Merlin09	Kindle Developer's Corner	67	03-13-2020 08:31 PM
YouTube (German) Paperwhite 2 and Paperwhite 3 - including light	Richard529	Amazon Kindle	6	06-22-2015 07:13 AM
Source for Paperwhite screensavers?	modified	Kindle Developer's Corner	8	01-02-2013 11:24 AM

03-13-2021, 05:51 PM	#2
NiLuJe BLAM! Posts: 13,495 Karma: 26047188 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	It should be part of the Kindle source drops (e.g., the "Source code notice" at the bottom of the Kindle Software Update page, IIRC).

03-13-2021, 06:21 PM	#3
katadelos rm -rf / Posts: 219 Karma: 3333683 Join Date: Nov 2019 Location: United Kingdom Device: K5, KT, KT2, KT3, KT4, KV, PW2, PW3, PW4, PW5	You might be able to extract a stock u-boot binary from the relevant factory image (possibly normal updates too, according to this post?) for your device. If the binary is included, you should be able to use it with imx_usb_loader directly (I've had to do this myself after bricking one of my KT2s with a buggy self-built u-boot).

03-14-2021, 01:17 PM	#5
NiLuJe BLAM! Posts: 13,495 Karma: 26047188 Join Date: Jun 2010 Location: Paris, France Device: Kindle 2i, 3g, 4, 5w, PW, PW2, PW5; Kobo H2O, Forma, Elipsa, Sage, C2E	As @katadelos said, I'd check a production update, too .

03-15-2021, 06:32 PM	#11
hjalfi Member Posts: 24 Karma: 10 Join Date: Apr 2011 Device: Kindle 3g	Yes --- the TYPE=prod was the problem! The new images link at 0xf8007000, and they download and imx_usb is reporting that it's apparently run them. Thanks very much! However I say 'apparently' because while I can see the USB connection disconnect and then reconnect, I see no serial output from it. Apparently nothing worthwhile is easy? So either it's working but the console output is getting lost, or it's not working and execution is returning to the ROM, which is going back to download mode without producing another banner. Incidentally, when (if) I ever get this going, I plan to write this up and produce a cleaned up works-out-of-the-box uboot version...

03-17-2021, 07:36 PM	#12
hjalfi Member Posts: 24 Karma: 10 Join Date: Apr 2011 Device: Kindle 3g	I have progress! It appears that the mx50_yoshime3 configuration will not start at all unless I prevent it from calling arch_cpu_init. Otherwise, it runs a handful of instructions after returning and then hangs. My suspicion is that this is conflicting with the ROM's uboot somehow. Once that's disabled, and with the board init hacked to always initialise as a gen 1.5 PW with ID 00002, it runs enough to get to a uboot prompt. From here I have discovered two things: - after a random amount of time the Kindle disconnects from USB and hangs. This may be a hardware fault, or it may be an uninitialised watchdog timer of some description? The amount of time appears to be variable. - trying to access the eMMC card, including trying to read the startup variables, always fails. The eMMC card response is that the card is locked (password protected but no password has been provided). I'm guessing that this is spurious. If there's a hardware fault causing random resets (which I suspect) then maybe the card got powered down and corrupted its internal state? There is a way to reset the card's password by wiping it, but this seems... irreversable, so I thought I'd check in first. Any of this sound familiar to anyone?

Advert

Advert