PW Kindle PW1 is stuck in diagnostics mode (Paperwhite 1)

[remember]

CELESTE.WFO - System Diags

I am stuck in this mode again. I would link to my last post but it would trigger automod.

This time it seems like I entered one of the few menu items that disables the touch screen.

Touch sensor plate test
close down the plate
connect the usb serial cable
to run the test from gui

q) to continue

x) exit

gonna charge it up to full power on a wall charger per forum policy. i think i tried this before though.

the only state change I can trigger is holding down the power button for ~30 seconds while plugged into my PC turns the LED from orange (charging) to off.

some manufacturer I can't remember showed up when I plugged in the cable to windows for the first time in this mode.

I have linux and windows and a raspberry pi and arduino clone. I don't know how to solder and i'd prefer not to disassemble my kindle. if it comes to that, could i just hold wires to the serial points inside the kindle or do i need to solder?

imx_usb_loader$ sudo ./imx_usb 
config file <.//imx_usb.conf>
vid=0x066f pid=0x3780 file_name=mx23_usb_work.conf
vid=0x15a2 pid=0x004f file_name=mx28_usb_work.conf
vid=0x15a2 pid=0x0052 file_name=mx50_usb_work.conf
vid=0x15a2 pid=0x0054 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0061 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0063 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0071 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x007d file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0080 file_name=mx6ull_usb_work.conf
vid=0x1fc9 pid=0x0128 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0076 file_name=mx7_usb_work.conf
vid=0x1fc9 pid=0x0126 file_name=mx7ulp_usb_work.conf
vid=0x15a2 pid=0x0041 file_name=mx51_usb_work.conf
vid=0x15a2 pid=0x004e file_name=mx53_usb_work.conf
vid=0x15a2 pid=0x006a file_name=vybrid_usb_work.conf
vid=0x066f pid=0x37ff file_name=linux_gadget.conf
vid=0x1b67 pid=0x4fff file_name=mx6_usb_sdp_spl.conf
vid=0x0525 pid=0xb4a4 file_name=mx6_usb_sdp_spl.conf
vid=0x1fc9 pid=0x012b file_name=mx8mq_usb_work.conf
vid=0x1fc9 pid=0x0134 file_name=mx8mm_usb_work.conf
vid=0x1fc9 pid=0x013e file_name=mx8mn_usb_work.conf
vid=0x3016 pid=0x1001 file_name=mx8m_usb_sdp_spl.conf
config file <.//mx50_usb_work.conf>
parse .//mx50_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0052
Interface 0 claimed
HAB security state: development mode (0x56787856)
== work item
filename SPL
load_size 0 bytes
load_addr 0x00000000
dcd 1
clear_dcd 0
plug 0
jump_mode 0
jump_addr 0x00000000
== end work item

error, can not open input file: SPL
do_download failed, err=-5
HAB security state: development mode (0x56787856)

lsusb
Bus 003 Device 008: ID 15a2:0052 Freescale Semiconductor, Inc. i.MX50 SystemOnChip in RecoveryMode

# does nothing - do i need an ancient version of fastboot?
fastboot devices
fastboot devices -l

I'm very vanilla with kindle jailbreaks. i just do it for the heck of it. I'm not even 100% sure this kindle IS jailbroken. the first time I saw this menu I may not have even jailbroken it.

possible trigger is weirdness with unregistered kindle. afaik I never registered it (prior owner may have).

I'm also hoping theres some undocumented way to interact with this menu without disassembling the port.

[remember]

I don't know how to make the SPL file mentioned below. It's a short file.

This is what it looks like for another device:

mx6_spl_sdp
#hid/bulk,[old_header,]max packet size, {ram start, ram size}(repeat valid ram areas)
#In SPL, we typically load u-boot.img which has a U-boot header...
hid,uboot_header,1024,0x10000000,1G,0x00907000,0x31000

Claude AI output (I didn't see any rule against AI posting)

Relevant parts of AN4581 for the PW1

This is a general HABv4 secure-boot note rather than anything Kindle-specific, so most of it (SRK tables, fuse blowing, i.MX53/i.MX6 sections) doesn't apply.

1. Why the chip is in recovery mode (Fig. 1, p. 6)
The ROM copies the first 2-4 KB from the boot device and looks for a valid Image Vector Table. If there's no valid IVT, DCD processing fails, the image copy fails, or HAB verification fails, it drops into SDP, the serial download mode. That matches what you're seeing. The ROM either can't find a valid bootloader, as with a wiped or corrupted boot area, or it finds one it rejects.

2. Open vs. Closed matters most for your attempts
In Open configuration, all HAB failures are non-fatal and boot continues. In Closed configuration, only a properly signed image will execute, including through USB recovery mode. If your PW1 is fused Closed, an unsigned U-Boot pushed with imx_usb_loader would be rejected silently. That would fit the forum user who saw no banner. The note doesn't say how to tell which state your chip is in, and I don't know how Amazon fused the PW1. The report_status function needs running code to query it, which you don't have yet. If a self-built U-Boot ever prints anything over UART, the device is Open.

3. DCD controls whether RAM works (§3.1.2, p. 10)
The DCD is a register table the ROM runs to set up memory before copying the image into SDRAM. A wrong DCD for the PW1's DDR would mean the loaded U-Boot never executes. That's a second explanation for "loaded fine, no output." When you load over SDP, the tool loads the DCD table to 0x00910000 in OCRAM with the DCD_WRITE command. So your U-Boot image needs an IVT with a DCD matching the Kindle's actual memory configuration.

4. IVT format (pp. 9-10)
The header is 0xD1, length 0x0020, and version 0x40, which is the bytes D1 00 20 40. For the SD/MMC layout the IVT sits at start + 0x400, and the IVT, boot data, and DCD must fit inside the first 2-4 KB. That's handy for checking whether a U-Boot binary you built has a sane header.

5. i.MX50 HAB nuance (§7.2)
On i.MX50, HAB enforces SRK authentication even in Open configuration. In Open that failure is only logged, so it doesn't block boot.

What this note doesn't cover: the i.MX50 System Boot chapter of the Reference Manual, which has the per-device IVT offsets and the USB recovery details, and the SDP command set itself.

Warning: Don't touch the fuse-programming sections (§5). Burning fuses is irreversible and could permanently stop the device from booting.

Next, I'd check whether the U-Boot you tried had the right DCD for the PW1's RAM, and whether you get any UART output at all. Do you know which U-Boot build or config you used?

[hr]

Reading your imx_usb_loader output

This output answers the Open vs. Closed question from the last message.

1. The chip is in Open configuration.
The tool reports "development mode (0x56787856)". From memory, imx_usb_loader prints that for an Open chip and "production mode" for a Closed one, but I haven't confirmed the constants against its source. Per the app note (§3.2.2), an Open chip treats all HAB failures as non-fatal, so it will run unsigned code. You don't need to sign anything.

2. USB communication works.
It found 15a2:0052 and claimed the interface, so the cable, port, and ROM SDP link are fine.

3. The failure is just a missing file.
The error is can not open input file: SPL, and the work item shows load_size 0. The loader read mx50_usb_work.conf, which names a file called SPL, and then couldn't open it. Nothing was sent to the device.

The tool expects a boot image named SPL in the current working directory. That's a U-Boot/SPL binary with a valid IVT and a DCD matching the Kindle's DDR. The "dcd 1" in the work item suggests it will send that DCD to OCRAM via SDP first. Two things to check:

• Run

  cat mx50_usb_work.conf

  and

  ls

  in the directory you launched from. If the conf lists several files, you need all of them present.
• You can usually pass the image as a command-line argument instead of relying on the conf. Check

  imx_usb --help

  for your build, since I'm not sure of your version's syntax.

What image goes there.
It needs to be built for the PW1's RAM setup. The MobileRead wiki and forum threads I found earlier point to U-Boot source for this, and the forum user who built from it saw no banner. That suggests the DCD or board config may have been off, since the chip is Open and unsigned code should run. I don't have a confirmed-working PW1 image to name, so I won't guess a filename.

Once a correctly built image loads, the ROM jumps to it, and you'll want the 1.8V UART attached to see its output.

Can you paste the contents of mx50_usb_work.conf and the

ls

of your working directory? That will show which files it expects and whether any exist.