Yet another reverse engineering blog

Thursday, December 6, 2007

Kindle boot log

So the Kindle has a console running. Lots of interesting info here...

U-Boot 1.1.2 (Oct 29 2007 - 16:35:25)

*** Welcome to Kindle ***

U-Boot code: A3F00000 -> A3F3FA6C BSS: -> A3F77850

REV2 Bootloader: Kindle 400 MHz REV2 Board, Revision #9
Boot block version: 20070525
Checksum: 0x9F132881
Buildrev: 292-Kindle-012138
IOC Firmware Version #63

RAM Configuration:
Bank #0: 0xA0000000 64 MB
Flash Configuration:
Bank #0: 0x00000000 128 MB
Bank #1: 0x04000000 128 MB
NAND Configuration:
256 MB
BML_Init success
BML_Open success
**************** device info *******************
nPgsPerBlk = 64
nSctsPerPg = 4
nNumOfUsBlks = 2002
*************************************************
bml open success
pi->nNumOfPartEntry: 10Success loading partition
load env done
op_amp#=65535
gain#=0
rve#=1015
panel#=010_01_23
panel#=010_01_23
serial#=B001BAB074999999
usb_force_sleep: hw_flags.disable_pdc_suspend = 0
waiting for CLKREADY
Mode reg = 0x00000000
soft resetting device controller
power switch is on
Update battery level: >3720mV
Boot battery level: >3680mV
Alert battery level: >3600mV
Current battery level: 3911mV (bootable)

Loading partition "Standard Kernel" into 0xA2000000... Success
Loading partition "Standard Initrd" into 0xA2E20000... Success

iminfo a2000000 a2e20000

## Checking Image at a2000000 ...
Image Name: Linux-2.6.10-lab126
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1236608 Bytes = 1.2 MB
Load Address: a0008000
Entry Point: a0008000
Verifying Checksum ... OK

## Checking Image at a2e20000 ...
Image Name: initrd_fs.gz
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 689536 Bytes = 673.4 KB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK

bootm a2000000 a2e20000
## Booting image at a2000000 ...
Image Name: Linux-2.6.10-lab126
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1236608 Bytes = 1.2 MB
Load Address: a0008000
Entry Point: a0008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at a2e20000 ...
Image Name: initrd_fs.gz
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 689536 Bytes = 673.4 KB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux................................................................................ done, booting the kernel.
Linux version 2.6.10-lab126 (build@lab126-build) (gcc version 3.4.2) #1 Mon Oct 29 16:38:09 PST 2007
CPU: XScale-PXA255 [69052d06] revision 6 (ARMv5TE)
CPU: D VIVT undefined 5 cache
CPU: I cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
CPU: D cache: 32768 bytes, associativity 32, 32 byte lines, 32 sets
Machine: Fiona Platform
Fiona Board Resistance : 150 mOhms
Memory policy: ECC disabled, Data cache writeback
Memory clock: 99.53MHz (*27)
Run Mode clock: 398.13MHz (*4)
Turbo Mode clock: 398.13MHz (*1.0, inactive)
Built 1 zonelists
Kernel command line: console=ttyS2,115200n8 root=/dev/rd/0 initrd=/linuxrc rw reboot=hard
reserved 4096 bytes at a3fff000 for boot globals
reserved 122880 bytes at a3fe1000 for framebuffer
PID hash table entries: 512 (order: 9, 8192 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 64MB = 64MB total
Memory: 61456KB available (2070K code, 357K data, 100K init)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 673K
NET: Registered protocol family 16
Recalculated watermarks:
wan: 3603 (was 3603)
low: 3586 (was 3586)
critical: 3536 (was 3536)
REV2 board detected
Power transition failed err=-5 for pnlcd video display class
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
PXA CPU frequency change support initialized
NetWinder Floating Point Emulator V0.97 (extended precision)
FPOW: Fiona Power Management Driver v0.54
squashfs: version 3.0 (2006/03/15) Phillip Lougher
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
Initializing Cryptographic API
WATER: Disabling IOC voltage reporting, initing our own timer...
Battery Voltage: 3881 mVolts (raw: 3854 mVolts)
V[1] : ~3881~
A[1] : ~181~
T[1] : ~26~
OP Amp Offset : Uninitialized
Op Amp Gain Correction : Uninitialized
Voltage Reference Correction Factor : 1015 / 1000
IOC: Fiona IOC Driver v1.0, IOC FW version #63
Battery: 3.911 Volts, 26 Degrees C, 164 mA Draw, DISCHARGING, 72%
PNLCD: Fiona PNLCD Driver v0.94
KEYBOARD: Fiona Keyboard Driver v1.0
ppoke driver: Major: 207 Rev. 4 Kernel v.2.6.10-lab126
/proc/peek initialized.
/proc/poke initialized.
ttyS0 at MMIO 0x40100000 (irq = 15) is a FFUART
ttyS1 at MMIO 0x41600000 (irq = 0) is a HWUART
ttyS2 at MMIO 0x40700000 (irq = 13) is a STUART
io scheduler noop registered
RAMDISK driver initialized: 8 RAM disks of 4096K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
wan: AnyDATA DTEV WAN module driver 0.8.4
i2c /dev entries driver
i2c_adapter i2c-0: found device 0x1a
Advanced Linux Sound Architecture Driver Version 1.0.6 (Sun Aug 15 07:17:53 2004 UTC).
soc: version 0.7 liam.girdwood@wolfsonmicro.com
wm8971: WM8971 audio codec 0.2.3
soc: WM8971 <-> pxa2xx-i2s mapping ok
ALSA device list:
#0: WM8971 Portable Codec (SoC)
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 8192)
NET: Registered protocol family 1
NET: Registered protocol family 17
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
Mounted devfs on /dev
starting initrd...
eink_fb: /dev/fb/0 frame buffer device, using 471K for video memory
eink_fb: Apollo Display Driver 1.00
xsr: module license 'Samsung Proprietary' taints kernel.
Samsung XSR Core 1.2.1-lab126-2
elevator: using noop as default io scheduler
Samsung STL 1.2.1-lab126-2
Samsung RFS 1.2.1-lab126-2
kjournald starting. Commit interval 5 seconds
EXT3 FS on stl8, internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
starting init...
dosfsck 2.11-lab126 (7 Dec 2006)
dosfsck 2.11-lab126, 7 Dec 2006, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "mkdosfs"
Media byte 0xf8 (hard disk)
512 bytes per logical sector
2048 bytes per cluster
32 reserved sectors
First FAT starts at byte 16384 (sector 32)
2 FATs, 32 bit entries
386048 bytes per FAT (= 754 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 788480 (sector 1540)
96416 data clusters (197459968 bytes)
8 sectors/track, 1 heads
0 hidden sectors
387204 sectors total
Checking for unused clusters.
Checking free cluster summary.
/dev/stl0/9: 293 files, 7117/96416 clusters
mount: Mounting /dev/mmc/blk0/part1 on /mnt/mmc failed: No such file or directory
system: processing module dependencies
system: loading module pdc
pdc: version 1.0
pdc: IRQ 26
system: loading module usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for Generic
usbcore: registered new driver usbserial_generic
usbcore: registered new driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial Driver core v2.0
system: initializing eInk driver for rootfs use
eink_fb: /dev/fb/0 frame buffer device, using 588K for video memory
eink_fb: Apollo Display Driver 1.00
eink_fb: write_eink_which, size=50327
eink_fb: curr_count=0 write_size=50327
eink_fb: done, status=1
1+0 records in
1+0 records out
system: initializing random number generator
system: initializing USB gadget driver
g_file_storage gadget: controller 'pdc' not recognized
g_file_storage gadget: File-backed Storage Gadget, version: 28 July 2004
g_file_storage gadget: Number of LUNs=2
system: initializing audio configuration for REV2 or higher
system: initializing audio driver defaults
system: initializing network configuration
system: setting "conservative" processor power mode
system: starting processor watchdog
SA1100/PXA2xx Watchdog Timer: timer margin 60 sec
watchdogd 0.1 Copyright (C) 2007 Lab126, Inc. All rights reserved.
system: starting network connection watchdog
netwatchd 0.5 Copyright (C) 2007 Lab126, Inc. All rights reserved.
system: starting CVM memory watchdog
nomkd 0.7 Copyright (C) 2006-2007 Lab126, Inc. All rights reserved.
system: starting TPH monitor
system: starting tphserver
tphserver 0.2 Copyright (C) 2007 Lab126, Inc. All rights reserved.
system: starting booklet framework



Welcome to Kindle!

kindle login:

4 comments:

jayakumar said...

Very interesting. I would like to hear more about how you're doing this. Thanks.

Anonymous said...

So what's the login?!

Anonymous said...

Do either of your algorithms allow a Kindle book to be read by a Kindle with a different serial number?

Lawk Salih said...

Very interesting hack.