Kindle 4にシリアル接続Kindle Hacks

間もなく本格的な日本上陸もうわさされるAmazonの電子書籍リーダー「Kindle」。本連載「Kindle Hacks」では、Kindleに関連するさまざまなTipsを硬軟織り交ぜて紹介していきます。記念すべき第1回は、Kindleの最新モデルを分解し、シリアル接続による起動ログの取得から、ハードウェア構成を調べます。

» 2011年11月12日 14時30分 公開
[ichinomoto,ITmedia]

はじめに

 間もなく本格的な日本上陸もうわさされるAmazonの電子書籍リーダー「Kindle」。本連載「Kindle Hacks」では、Kindleに関連するさまざまなTipsを硬軟織り交ぜて紹介していきます。記念すべき第1回は、Kindleの最新モデルを分解し、シリアル接続による起動ログの取得から、ハードウェア構成を調べるという超マニアックなTipsを紹介します。

 なお、本連載で取り上げる内容を実践すると、Amazon.comの保証対象外になる場合があります。試される場合は自己責任でお願いします。

Kindle 4にシリアル接続

 Kindle 4は先日購入してから普通にしか使っていませんでしたが、やっと時間ができたので開けてみました。

 今回も、シリコンハウスで購入したケース開け道具が役に立ちました。

 Kindle 4の分解記事は「blog kindle」ですでに掲載されており、そちらではシールドも剥がしてあるので、中を全部見たい場合はそちらをご覧ください(Part IIの方は壊す気で開けてる感じですね。コネクタが破損していますし……)。

Kindle 4 Disassembly ― Part I

Kindle 4 Disassembly ― Part II

 シールド板は半田でつけてあるので、ここでは外してません。

 Kindle 4では、裏のふた自体をゆがませてはめてある上に、ふたと本体がのりで貼り付いているので外すのに苦労します。

 ふたはかなり柔らかいので、けっこう力を入れてたわんでも大丈夫そうです。第2世代KindleやKindle DXのころはアルミ素材でしたのでそれに比べると安っぽいですが、コストの問題もあるでしょうし、個人的にはこれはこれでいいと思います。

 赤い丸で囲んだ部分の爪が折れてしまいました……。左の方にある爪を見ると折れてないのが分かると思います。

 さてシリアル接続ですが、以下の写真のポイントから引き出し可能です。

 @hondamarlboroさんのブログを参考に調べたところ、P2とシルク印刷されている四角い枠の中に3つある点のうち、左からTxD、RxD、GNDとなっていました。

 写真では黒い線がTxD、茶色い線がRxD、GNDは上の方にあるネジにつないでいます。

 全景はこんな感じです。

 以下は取得した起動ログです(編注:一部改行を入れています)。いろいろなことが分かりますね。


U-Boot 2009.08-lab126 (Sep 02 2011 - 22:45:17)

CPU: Freescale i.MX50 family 1.1V at 800 MHz mx50 pll1: 800MHz mx50 pll2: 400MHz mx50 pll3: 216MHz ipg clock : 50000000Hz ipg per clock : 50000000Hz uart clock : 24000000Hz ahb clock : 100000000Hz axi_a clock : 400000000Hz axi_b clock : 200000000Hz weim_clock : 100000000Hz ddr clock : 800000000Hz esdhc1 clock : 80000000Hz esdhc2 clock : 80000000Hz esdhc3 clock : 80000000Hz esdhc4 clock : 80000000Hz MMC: FSL_ESDHC: 0, FSL_ESDHC: 1 Board: Tequila Boot Reason: [POR] Boot Device: MMC Board Id: 00315011137300IG S/N: Initing MDDR memory ZQ calibration complete: 0x128=0x05090010 0x12C=0x00000408 DRAM: 256 MB Using default environment
In: serial Out: logbuff Err: logbuff Quick Memory Test 0x70000000, 0x10000000 POST done in 13 ms Hit any key to stop autoboot: 3 2 1 0 ## Booting kernel from Legacy Image at 70800000 ... Image Name: Linux-2.6.31-rt11-lab126 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 4760896 Bytes = 4.5 MB Load Address: 70008000 Entry Point: 70008000 Verifying Checksum ... OK Loading Kernel Image ... OK OK Starting kernel ... Linux version 2.6.31-rt11-lab126 (build2@lucid-build02) (gcc version 4.5.3 20110406 (prerelease) (Linaro GCC 4.5-2011.04-0) ) #5 Fri Sep 2 22:46:52 PDT 2011 CPU: ARMv7 Processor [412fc085] revision 5 (ARMv7), cr=10c53c7f CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache Machine: Amazon.com MX50 YOSHI Board Board ID and Serial Number driver for Lab126 boards version 1.0 MX50 Board id - 00315011137300IG Memory policy: ECC disabled, Data cache writeback On node 0 totalpages: 65536 free_area_init_node: node 0, pgdat c0491b24, node_mem_map c04bd000 DMA zone: 192 pages used for memmap DMA zone: 0 pages reserved DMA zone: 24384 pages, LIFO batch:3 Normal zone: 320 pages used for memmap Normal zone: 40640 pages, LIFO batch:7 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024 Kernel command line: consoleblank=0 rootwait ro ip=off root=/dev/mmcblk0p1 debug eink=fslepdc video=mxcepdcfb:E60,bpp=8 console=ttymxc0,115200 PID hash table entries: 1024 (order: 10, 4096 bytes) Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Memory: 256MB = 256MB total Memory: 254860KB available (3376K code, 362K data, 1072K init, 0K highmem) NR_IRQS:368 MXC IRQ initialized cko2_set_rate, new divider=5 MXC_Early serial console at MMIO 0x53fbc000 (options '115200') console [ttymxc0] enabled Console: colour dummy device 80x30 Calibrating delay loop... 799.53 BogoMIPS (lpj=3997696) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok regulator: core version 0.5 NET: Registered protocol family 16 i.MX IRAM pool: 128 KB@0xd0840000 CPU is i.MX50 Revision 1.1 MXC GPIO hardware Using SDMA I.API MXC DMA API initialized bio: create slab at 0 mxc_spi mxc_spi.0: chipselect 0 already in use mxc_spi mxc_spi.0: chipselect 0 already in use CSPI: mxc_spi-0 probed CSPI: mxc_spi-1 probed mxc_spi mxc_spi.2: chipselect 0 already in use CSPI: mxc_spi-2 probed MXC I2C driver MXC I2C driver PMIC Light driver loading... mc13892 Rev 2.1 FinVer 2 detected Initializing regulators for mx50 yoshi. regulator: SW1: 600 <--> 1375 mV regulator: SW2: 900 <--> 1850 mV regulator: SW3: 900 <--> 1850 mV regulator: SW4: 1100 <--> 1850 mV regulator: SWBST: 0 mV regulator: VIOHI: 0 mV regulator: VPLL: 1050 <--> 1800 mV regulator: VDIG: 1200 mV regulator: VSD: 1800 <--> 3150 mV regulator: VUSB2: 2400 <--> 2775 mV regulator: VVIDEO: 2775 mV regulator: VAUDIO: 2300 <--> 3000 mV regulator: VCAM: 2500 <--> 3000 mV fast normal regulator: VGEN1: 3000 mV regulator: VGEN2: 1200 <--> 3150 mV regulator: VGEN3: 1800 mV regulator: VUSB: 0 mV regulator: GPO1: 0 mV regulator: GPO2: 0 mV regulator: GPO3: 0 mV regulator: GPO4: 0 mV PMIC ADC start probe PMIC Light successfully loaded Device spi3.0 probed NET: Registered protocol family 2 IP route cache hash table entries: 2048 (order: 1, 8192 bytes) TCP established hash table entries: 8192 (order: 4, 65536 bytes) TCP bind hash table entries: 8192 (order: 3, 32768 bytes) TCP: Hash tables configured (established 8192 bind 8192) TCP reno registered NET: Registered protocol family 1 LPMode driver module loaded Static Power Management for Freescale i.MX5 PM driver module loaded sdram autogating driver module loaded Bus freq driver module loaded Initializing MX50 Yoshi Accessory Port mxc_dvfs_core_probe DVFS driver module loaded i.MXC CPU frequency driver msgmni has been set to 498 alg: No test for stdrng (krng) io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered (default) regulator: DISPLAY: 0 mV regulator: GVDD: 20000 mV regulator: GVEE: -22000 mV regulator: VCOM: 0 <--> 2749 mV regulator: VNEG: -15000 mV regulator: VPOS: 15000 mV regulator: TMST: 0 mV papyrus 1-0048: PMIC PAPYRUS for eInk display Amazon MX35 Yoshi Power Button Driver Serial: MXC Internal UART driver mxcintuart.0: ttymxc0 at MMIO 0x53fbc000 (irq = 31) is a Freescale MXC console handover: boot [ttymxc0] -> real [ttymxc0] loop: module loaded mxc_rtc mxc_rtc.0: rtc core: registered mxc_rtc as rtc0 Probing mxc_rtc done mc13892 rtc probe start pmic_rtc pmic_rtc.1: rtc core: registered pmic_rtc as rtc1 mc13892 rtc probe succeed i2c /dev entries driver kernel: I papyrus:TempExceeded:temp=30: MXC WatchDog Driver 2.0 MXC Watchdog # 0 Timer: initial timeout 127 sec MXC Watchdog: Started 10000 millisecond watchdog refresh PMIC Character device: successfully loaded pmic_battery: probe of pmic_battery.1 failed with error -1 sdhci: Secure Digital Host Controller Interface driver sdhci: Copyright(c) Pierre Ossman mxsdhci: MXC Secure Digital Host Controller Interface driver mxsdhci: MXC SDHCI Controller Driver. mmc0: SDHCI detect irq 273 irq 2 INTERNAL DMA mxsdhci mxsdhci.1: dmabounce: registered device mxsdhci: MXC SDHCI Controller Driver. mmc1: SDHCI detect irq 0 irq 3 INTERNAL DMA Registered led device: pmic_ledsr Registered led device: pmic_ledsg Registered led device: pmic_ledsb nf_conntrack version 0.5.0 (4096 buckets, 16384 max) ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 17 RPC: Registered udp transport module. RPC: Registered tcp transport module. kernel: I perf:kernel:kernel_loaded=0.72 seconds: VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 2 regulator_init_complete: disabling TMST regulator_init_complete: disabling VCOM regulator_init_complete: disabling GPO4 regulator_init_complete: disabling GPO3 regulator_init_complete: disabling GPO2 regulator_init_complete: disabling GPO1 regulator_init_complete: disabling VGEN3 regulator_init_complete: disabling VGEN1 regulator_init_complete: disabling VCAM regulator_init_complete: disabling VAUDIO regulator_init_complete: disabling VVIDEO regulator_init_complete: disabling VSD regulator_init_complete: disabling SWBST mxc_rtc mxc_rtc.0: setting system clock to 2011-10-22 18:55:13 UTC (1319309713) Freeing init memory: 1072K mmc0: queuing CIS tuple 0x01 length 3 mmc0: queuing CIS tuple 0x1a length 5 2.6.31-rt11-lab126 #5 Fri Sep 2 22:46:52 PDT 201mmc0: queuing CIS tuple 0x1b length 8 1 armv7l mmc0: queuing CIS tuple 0x14 length 0 mmc0: queuing CIS tuple 0x80 length 1 mmc0: queuing CIS tuple 0x81 length 1 mmc0: queuing CIS tuple 0x82 length 1 mmc0: new high speed SDIO card at address 0001 emmc: I def:mmcpartinfo:vendor=toshiba, ddr=1, host=mmc1: mmc1: new high speed MMC card at address 0001 mmcblk0: mmc1:0001 002G00 1.82 GiB mmcblk0: p1 p2 p3 p4 INFO:Loaded module /lib/modules/eink_fb_waveform.ko (35500 bytes) INFO:Loaded module /lib/modules/eink_fb_hal.ko (71576 bytes) INFO:Loaded module /lib/modules/mxc_epdc_fb.ko dont_register_fb=1 (43068 bytes) mxc_epdc_fb_init_hw: 06_05_0039_3c_151621_03_37_000007ae_85.wbf eink_fb: I EINKFB_PROBE:def:fb0 using 1416K of RAM for framebuffer INFO:Loaded module /lib/modules/eink_fb_hal_fslepdc.ko (21580 bytes) INFO:Loaded module /lib/modules/eink_fb_shim.ko (119240 bytes) INFO:eink initialized...input: tequila-keypad as /devices/platform/tequila-keypad/input/input0 (480000 bytes) INFO:Using default keypad setting. (not passing "kb_rev" to module) INFO:Loaded module /lib/modules/tequila_keypad.ko (11264 bytes) Press [ENTER] for recovery menu... 0 /INFO:*** Partition table verified for /dev/mmcblk0 *** INFO:Checking for updates... (auto-pilot mode) /dev/mmcblk0p4: CHS=4/16/44608 size=1461714944 bytes flag type first last lba first lba size Partition p1: 0x00 0x0b 16 16 2854896 CHS: 0/1/1 - Partition p2: Partition p3: Partition p4: INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 8192 INFO:No update*.bin found; no update needed. INFO:no updates found. BOOTING DEFAULT. argc == 10 argv[0]:kjournald starting. Commit interval 5 seconds "kinit" argv[1]: "consoleblaEXT3-fs: mounted filesystem with writeback data mode. nk=0" argv[2]: "rootwait" argv[3]: "ro" argv[4]: "ip=off" argv[5]: "root=/dev/mmcblk0p1" argv[6]: "debug" argv[7]: "eink=fslepdc" argv[8]: "video=mxcepdcfb:E60,bpp=8" argv[9]: "console=ttymxc0,115200" Running ipconfig argc == 4 argv[0]: "IP-Config" argv[1]: "-i" argv[2]: "Linux kinit" argv[3]: "ip=off" IP-Config: no devices to configure kinit: do_mounts kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1) kinit: root_dev = dev(179,1) kinit: /dev/root appears to be a ext3 filesystem kinit: trying to mount /dev/root on /root with type ext3 kinit: Mounted root (ext3 filesystem) readonly. Checking for init: /sbin/init Checking for init: /bin/init Checking for init: /etc/init Checking for init: /sbin/init.sysvinit INIT: version 2.86 booting system: I rcS:def:starting /etc/rcS.d/S02kdb system: I S02kdb:def:Setting boot device to mmcblk0 kdb set: 'system/driver/filesystem/DEV_ROOT' system: I rcS:def:starting /etc/rcS.d/S03udev system: I S03udev:def:setting up virtual fs for hotplug event handling system: I S03udev:def:starting the hotplug events dispatcher system: I S03udev:def:synthesizing initial hotplug events lipc-send-event[559]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory) lipc-send-event[559]: C def:dbusi::Failed to init dbus lipc-send-event[559]: E def:open::Failed to open LIPC lipc-send-event[559]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed system: I rcS:def:starting /etc/rcS.d/S10filesystems system: I rcS:def:starting /etc/rcS.d/S10hostname system: I rcS:def:starting /etc/rcS.d/S10network system: I S10filesystems:def:mounting filesystems rwfs on /mnt/rwfs type tmpfs (rw,size=32M) /mnt/rwfs/var on /var type none (rw,bind) shm on /dev/shm type tmpfs (rw) system: I S10hostname:def:setting device hostname kjournald starting. Commit interval 5 seconds EXT3 FS on mmcblk0p3, internal journal EXT3-fs: recovery complete. EXT3-fs: mounted filesystem with writeback data mode. /dev/mmcblk0p3 on /var/local type ext3 (rw,sync) system: I S10network:def:initializing network configuration system: I S10network:def:Installed Firewall system: I rcS:def:starting /etc/rcS.d/S20syslog-ng system: I S20syslog-ng:def:starting syslog-ng system: I rcS:def:starting /etc/rcS.d/S21init_time system: I S21init_time:initboot:time=5660:boot time after init in milliseconds system: I rcS:def:starting /etc/rcS.d/S45modules system: I S45modules:def:loading module mwan FATAL: Module mwan not found. system: C S45modules:def:failed to load module mwan system: I S45modules:def:loading module g_file_storage kernel: I perf:usb:usb_gadget_loaded=6.03 seconds: g_file_storage gadget: File-backed Storage Gadget, version: 7 August 2007 g_file_storage gadget: Number of LUNs=1 system: I S45modules:def:loading module fuse fuse init (API version 7.12) system: I S45modules:def:loading module uinput system: I S45modules:def:loading module tequila_keypad input: tequila-keypad as /devices/platform/tequila-keypad/input/input1 system: I S45modules:def:loading module mxc_keyb mxc_keyb: I def:drv::Keypad driver loaded system: I S45modules:def:loading module fiveway input: fiveway as /devices/virtual/input/input2 system: I S45modules:def:loading module volume volume: I def:probe0::Starting... volume: I def:probe_done::GPIOs and IRQs have been set up input: volume as /devices/virtual/input/input3 volume: I def:drv::Volume key driver loaded system: I rcS:def:starting /etc/rcS.d/S46video system: I S46video:def:initializing eInk HAL for system use system: I wfm_mount:def:mounting waveform filesystem system: I wfm_umount:def:umounting waveform filesystem system: I rcS:def:starting /etc/rcS.d/S50system system: I S50system:def:initializing shared library cache /etc/rcS.d/S50system: line 1: /sbin/ldconfig: not found mount: mount point /proc/bus/usb does not exist system: I rcS:def:starting /etc/rcS.d/S70ethernet system: I rcS:def:starting /etc/rcS.d/S70userstore system: I S70ethernet:def:not enet system: I S70ethernet:def:not usbnet system: I S70userstore:def:Found SHUTDOWN flag file system: I rcS:def:starting /etc/rcS.d/S90video system: I S90video:def:initializing eInk HAL for rootfs use INIT: Entering runlevel: 2 system: I lifeguard:def:starting eInk HAL lifeguard INIT: Switching to runlevel: 5 INIT: Sending processes the TERM signal Loading Atheros ar6003 driver SDIO: Enabling device mmc0:0001:1... SDIO: Enabled device mmc0:0001:1 kernel: I perf:wifi:wifi_driver_loaded=10.44 seconds: ar6003 Driver returning from ar6000_init_module ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/active_calibration MAC from kernel xx:xx:xx:xx:86:2B ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/otp.bin ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/athwlan.bin ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/data.patch.hw3_0.bin wmi_control_rx() : Unknown id 0x101e ar6003 driver: Completed loading the module ar6000_avail_ev system: I wpa_supplicant:def:wpa supplicant started system: I S30network:def:initializing network configuration system: I S30network:def:Installed Firewall system: W S50wan:def:This board does not support WAN; exiting script. system: I S60dbus:def:starting system message bus Starting Process Monitoring Daemon: Retrieved 112 keys for system/daemon/pmond/ Starting Power Management Daemon: system: I S70wifid:def:starting wifid system: I S70cmd:def:starting CMD daemon system: W S70wand:def:This board does not support WAN; exiting script. system: I S75phd:def:Starting Phone-Home Daemon system: I S76mcsd:def:skipping on non-Mario-based WW hardware system: I S80volumd:def:starting Volume daemon Battery Level: 77% Starting lipc-daemon: system: I S90cron:def:starting crond system: I S90tmd:def:Starting Transfer Manager Daemon system: I S94browserd:def:Starting Browser Daemon system: I S95framework:def:starting booklet framework system: I S95framework:def:logging reset type: hard start.sh: starting framework system: I S96boot_finished:def:Boot finished script running system: I S96boot_finished:symboot:time=16580:boot time before framework starts, in milliseconds system: I mntroot:def:Making root filesystem read-only
Welcome to Kindle!
kindle login: mxc_rtc: saved=0x911c boot=0x9155

 ログをみると、「Machine: Amazon.com MX50 YOSHI Board」とあります。Kindle 2やKindle DXの“Mario”、Kindle 3の“Luigi”ときて、Kindle 4は“Yoshi”であることが分かります。次は何になるんでしょう?

 現状はここまででrootを取りに行くところは試してません。その辺りはまた後ほど。

 rootの取得には、こちらで紹介されている方法を試してみました。が、Kindle 4のubootコマンドは数が減ってしまっているようで、run prg_kernel_serialやloadyなどが動作しないようです。以下はhelpコマンドとprintenvコマンドの結果です。


uboot > ?
? – alias for ‘help’
bist – start Built In Self Test
boot – boot default, i.e., run ‘bootcmd’
bootd – boot default, i.e., run ‘bootcmd’
bootm – boot application image from memory
go – start application at address ‘addr’
help – print online help
idme – idme – Set nv ram variables
log – manipulate logbuffer
printenv- print environment variables
reset – Perform RESET of the CPU
run – run commands in an environment variable
setenv – set environment variables
version – print monitor version
uboot > printenv
bootdelay=3
baudrate=115200
loadaddr=0×70800000
bootcmd=bootm 0×41000
failbootcmd=panic
loglevel=5
bootargs_diags=setenv bootargs consoleblank=0 rootwait ro ip=off root=/dev/mmcblk0p2 quiet eink=fslepdc
bootcmd_diags=run bootargs_diags ; bootm 0xE41000
bootcmd_factory=bist halt
bootcmd_fastboot=bist fastboot
stdin=serial
stdout=logbuff
stderr=logbuff
post_hotkeys=0
bootargs=
Environment size: 378/1020 bytes
Environment size: 378/1020 bytes
uboot >

著者紹介:ichinomoto

趣味で半田付けとかしてたら気がついたら組み込み系プログラマーになってた人。なのでハードも好きだけど主にソフト担当。



Copyright © ITmedia, Inc. All Rights Reserved.