間もなく本格的な日本上陸もうわさされるAmazonの電子書籍リーダー「Kindle」。本連載「Kindle Hacks」では、Kindleに関連するさまざまなTipsを硬軟織り交ぜて紹介していきます。記念すべき第1回は、Kindleの最新モデルを分解し、シリアル接続による起動ログの取得から、ハードウェア構成を調べます。
間もなく本格的な日本上陸もうわさされるAmazonの電子書籍リーダー「Kindle」。本連載「Kindle Hacks」では、Kindleに関連するさまざまなTipsを硬軟織り交ぜて紹介していきます。記念すべき第1回は、Kindleの最新モデルを分解し、シリアル接続による起動ログの取得から、ハードウェア構成を調べるという超マニアックなTipsを紹介します。
なお、本連載で取り上げる内容を実践すると、Amazon.comの保証対象外になる場合があります。試される場合は自己責任でお願いします。
Kindle 4は先日購入してから普通にしか使っていませんでしたが、やっと時間ができたので開けてみました。
今回も、シリコンハウスで購入したケース開け道具が役に立ちました。
Kindle 4の分解記事は「blog kindle」ですでに掲載されており、そちらではシールドも剥がしてあるので、中を全部見たい場合はそちらをご覧ください(Part IIの方は壊す気で開けてる感じですね。コネクタが破損していますし……)。
Kindle 4 Disassembly ― Part II
シールド板は半田でつけてあるので、ここでは外してません。
Kindle 4では、裏のふた自体をゆがませてはめてある上に、ふたと本体がのりで貼り付いているので外すのに苦労します。
ふたはかなり柔らかいので、けっこう力を入れてたわんでも大丈夫そうです。第2世代KindleやKindle DXのころはアルミ素材でしたのでそれに比べると安っぽいですが、コストの問題もあるでしょうし、個人的にはこれはこれでいいと思います。
赤い丸で囲んだ部分の爪が折れてしまいました……。左の方にある爪を見ると折れてないのが分かると思います。
さてシリアル接続ですが、以下の写真のポイントから引き出し可能です。
@hondamarlboroさんのブログを参考に調べたところ、P2とシルク印刷されている四角い枠の中に3つある点のうち、左からTxD、RxD、GNDとなっていました。
写真では黒い線がTxD、茶色い線がRxD、GNDは上の方にあるネジにつないでいます。
全景はこんな感じです。
以下は取得した起動ログです(編注:一部改行を入れています)。いろいろなことが分かりますね。
U-Boot 2009.08-lab126 (Sep 02 2011 - 22:45:17)
CPU: Freescale i.MX50 family 1.1V at 800 MHz
mx50 pll1: 800MHz
mx50 pll2: 400MHz
mx50 pll3: 216MHz
ipg clock : 50000000Hz
ipg per clock : 50000000Hz
uart clock : 24000000Hz
ahb clock : 100000000Hz
axi_a clock : 400000000Hz
axi_b clock : 200000000Hz
weim_clock : 100000000Hz
ddr clock : 800000000Hz
esdhc1 clock : 80000000Hz
esdhc2 clock : 80000000Hz
esdhc3 clock : 80000000Hz
esdhc4 clock : 80000000Hz
MMC: FSL_ESDHC: 0, FSL_ESDHC: 1
Board: Tequila
Boot Reason: [POR]
Boot Device: MMC
Board Id: 00315011137300IG
S/N:
Initing MDDR memory
ZQ calibration complete: 0x128=0x05090010 0x12C=0x00000408
DRAM: 256 MB
Using default environment
In: serial
Out: logbuff
Err: logbuff
Quick Memory Test 0x70000000, 0x10000000
POST done in 13 ms
Hit any key to stop autoboot: 3 2 1 0
## Booting kernel from Legacy Image at 70800000 ...
Image Name: Linux-2.6.31-rt11-lab126
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 4760896 Bytes = 4.5 MB
Load Address: 70008000
Entry Point: 70008000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
Starting kernel ...
Linux version 2.6.31-rt11-lab126 (build2@lucid-build02) (gcc version 4.5.3 20110406 (prerelease)
(Linaro GCC 4.5-2011.04-0) ) #5 Fri Sep 2 22:46:52 PDT 2011
CPU: ARMv7 Processor [412fc085] revision 5 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Amazon.com MX50 YOSHI Board
Board ID and Serial Number driver for Lab126 boards version 1.0
MX50 Board id - 00315011137300IG
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 65536
free_area_init_node: node 0, pgdat c0491b24, node_mem_map c04bd000
DMA zone: 192 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 24384 pages, LIFO batch:3
Normal zone: 320 pages used for memmap
Normal zone: 40640 pages, LIFO batch:7
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 65024
Kernel command line: consoleblank=0 rootwait ro ip=off root=/dev/mmcblk0p1 debug eink=fslepdc
video=mxcepdcfb:E60,bpp=8 console=ttymxc0,115200
PID hash table entries: 1024 (order: 10, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 256MB = 256MB total
Memory: 254860KB available (3376K code, 362K data, 1072K init, 0K highmem)
NR_IRQS:368
MXC IRQ initialized
cko2_set_rate, new divider=5
MXC_Early serial console at MMIO 0x53fbc000 (options '115200')
console [ttymxc0] enabled
Console: colour dummy device 80x30
Calibrating delay loop... 799.53 BogoMIPS (lpj=3997696)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
regulator: core version 0.5
NET: Registered protocol family 16
i.MX IRAM pool: 128 KB@0xd0840000
CPU is i.MX50 Revision 1.1
MXC GPIO hardware
Using SDMA I.API
MXC DMA API initialized
bio: create slab at 0
mxc_spi mxc_spi.0: chipselect 0 already in use
mxc_spi mxc_spi.0: chipselect 0 already in use
CSPI: mxc_spi-0 probed
CSPI: mxc_spi-1 probed
mxc_spi mxc_spi.2: chipselect 0 already in use
CSPI: mxc_spi-2 probed
MXC I2C driver
MXC I2C driver
PMIC Light driver loading...
mc13892 Rev 2.1 FinVer 2 detected
Initializing regulators for mx50 yoshi.
regulator: SW1: 600 <--> 1375 mV
regulator: SW2: 900 <--> 1850 mV
regulator: SW3: 900 <--> 1850 mV
regulator: SW4: 1100 <--> 1850 mV
regulator: SWBST: 0 mV
regulator: VIOHI: 0 mV
regulator: VPLL: 1050 <--> 1800 mV
regulator: VDIG: 1200 mV
regulator: VSD: 1800 <--> 3150 mV
regulator: VUSB2: 2400 <--> 2775 mV
regulator: VVIDEO: 2775 mV
regulator: VAUDIO: 2300 <--> 3000 mV
regulator: VCAM: 2500 <--> 3000 mV fast normal
regulator: VGEN1: 3000 mV
regulator: VGEN2: 1200 <--> 3150 mV
regulator: VGEN3: 1800 mV
regulator: VUSB: 0 mV
regulator: GPO1: 0 mV
regulator: GPO2: 0 mV
regulator: GPO3: 0 mV
regulator: GPO4: 0 mV
PMIC ADC start probe
PMIC Light successfully loaded
Device spi3.0 probed
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
LPMode driver module loaded
Static Power Management for Freescale i.MX5
PM driver module loaded
sdram autogating driver module loaded
Bus freq driver module loaded
Initializing MX50 Yoshi Accessory Port
mxc_dvfs_core_probe
DVFS driver module loaded
i.MXC CPU frequency driver
msgmni has been set to 498
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
regulator: DISPLAY: 0 mV
regulator: GVDD: 20000 mV
regulator: GVEE: -22000 mV
regulator: VCOM: 0 <--> 2749 mV
regulator: VNEG: -15000 mV
regulator: VPOS: 15000 mV
regulator: TMST: 0 mV
papyrus 1-0048: PMIC PAPYRUS for eInk display
Amazon MX35 Yoshi Power Button Driver
Serial: MXC Internal UART driver
mxcintuart.0: ttymxc0 at MMIO 0x53fbc000 (irq = 31) is a Freescale MXC
console handover: boot [ttymxc0] -> real [ttymxc0]
loop: module loaded
mxc_rtc mxc_rtc.0: rtc core: registered mxc_rtc as rtc0
Probing mxc_rtc done
mc13892 rtc probe start
pmic_rtc pmic_rtc.1: rtc core: registered pmic_rtc as rtc1
mc13892 rtc probe succeed
i2c /dev entries driver
kernel: I papyrus:TempExceeded:temp=30:
MXC WatchDog Driver 2.0
MXC Watchdog # 0 Timer: initial timeout 127 sec
MXC Watchdog: Started 10000 millisecond watchdog refresh
PMIC Character device: successfully loaded
pmic_battery: probe of pmic_battery.1 failed with error -1
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
mxsdhci: MXC Secure Digital Host Controller Interface driver
mxsdhci: MXC SDHCI Controller Driver.
mmc0: SDHCI detect irq 273 irq 2 INTERNAL DMA
mxsdhci mxsdhci.1: dmabounce: registered device
mxsdhci: MXC SDHCI Controller Driver.
mmc1: SDHCI detect irq 0 irq 3 INTERNAL DMA
Registered led device: pmic_ledsr
Registered led device: pmic_ledsg
Registered led device: pmic_ledsb
nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
kernel: I perf:kernel:kernel_loaded=0.72 seconds:
VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 2
regulator_init_complete: disabling TMST
regulator_init_complete: disabling VCOM
regulator_init_complete: disabling GPO4
regulator_init_complete: disabling GPO3
regulator_init_complete: disabling GPO2
regulator_init_complete: disabling GPO1
regulator_init_complete: disabling VGEN3
regulator_init_complete: disabling VGEN1
regulator_init_complete: disabling VCAM
regulator_init_complete: disabling VAUDIO
regulator_init_complete: disabling VVIDEO
regulator_init_complete: disabling VSD
regulator_init_complete: disabling SWBST
mxc_rtc mxc_rtc.0: setting system clock to 2011-10-22 18:55:13 UTC (1319309713)
Freeing init memory: 1072K
mmc0: queuing CIS tuple 0x01 length 3
mmc0: queuing CIS tuple 0x1a length 5
2.6.31-rt11-lab126 #5 Fri Sep 2 22:46:52 PDT 201mmc0: queuing CIS tuple 0x1b length 8
1 armv7l
mmc0: queuing CIS tuple 0x14 length 0
mmc0: queuing CIS tuple 0x80 length 1
mmc0: queuing CIS tuple 0x81 length 1
mmc0: queuing CIS tuple 0x82 length 1
mmc0: new high speed SDIO card at address 0001
emmc: I def:mmcpartinfo:vendor=toshiba, ddr=1, host=mmc1:
mmc1: new high speed MMC card at address 0001
mmcblk0: mmc1:0001 002G00 1.82 GiB
mmcblk0: p1 p2 p3 p4
INFO:Loaded module /lib/modules/eink_fb_waveform.ko (35500 bytes)
INFO:Loaded module /lib/modules/eink_fb_hal.ko (71576 bytes)
INFO:Loaded module /lib/modules/mxc_epdc_fb.ko dont_register_fb=1 (43068 bytes)
mxc_epdc_fb_init_hw: 06_05_0039_3c_151621_03_37_000007ae_85.wbf
eink_fb: I EINKFB_PROBE:def:fb0 using 1416K of RAM for framebuffer
INFO:Loaded module /lib/modules/eink_fb_hal_fslepdc.ko (21580 bytes)
INFO:Loaded module /lib/modules/eink_fb_shim.ko (119240 bytes)
INFO:eink initialized...input: tequila-keypad as /devices/platform/tequila-keypad/input/input0
(480000 bytes)
INFO:Using default keypad setting. (not passing "kb_rev" to module)
INFO:Loaded module /lib/modules/tequila_keypad.ko (11264 bytes)
Press [ENTER] for recovery menu... 0 /INFO:*** Partition table verified for /dev/mmcblk0 ***
INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/44608 size=1461714944 bytes
flag type first last lba first lba size
Partition p1:
0x00 0x0b 16 16 2854896
CHS: 0/1/1 -
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 8192
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
argc == 10
argv[0]:kjournald starting. Commit interval 5 seconds
"kinit"
argv[1]: "consoleblaEXT3-fs: mounted filesystem with writeback data mode.
nk=0"
argv[2]: "rootwait"
argv[3]: "ro"
argv[4]: "ip=off"
argv[5]: "root=/dev/mmcblk0p1"
argv[6]: "debug"
argv[7]: "eink=fslepdc"
argv[8]: "video=mxcepdcfb:E60,bpp=8"
argv[9]: "console=ttymxc0,115200"
Running ipconfig
argc == 4
argv[0]: "IP-Config"
argv[1]: "-i"
argv[2]: "Linux kinit"
argv[3]: "ip=off"
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: Mounted root (ext3 filesystem) readonly.
Checking for init: /sbin/init
Checking for init: /bin/init
Checking for init: /etc/init
Checking for init: /sbin/init.sysvinit
INIT: version 2.86 booting
system: I rcS:def:starting /etc/rcS.d/S02kdb
system: I S02kdb:def:Setting boot device to mmcblk0
kdb set: 'system/driver/filesystem/DEV_ROOT'
system: I rcS:def:starting /etc/rcS.d/S03udev
system: I S03udev:def:setting up virtual fs for hotplug event handling
system: I S03udev:def:starting the hotplug events dispatcher
system: I S03udev:def:synthesizing initial hotplug events
lipc-send-event[559]: E lipc:con::Connection error(Failed to connect to socket
/var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[559]: C def:dbusi::Failed to init dbus
lipc-send-event[559]: E def:open::Failed to open LIPC
lipc-send-event[559]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed
system: I rcS:def:starting /etc/rcS.d/S10filesystems
system: I rcS:def:starting /etc/rcS.d/S10hostname
system: I rcS:def:starting /etc/rcS.d/S10network
system: I S10filesystems:def:mounting filesystems
rwfs on /mnt/rwfs type tmpfs (rw,size=32M)
/mnt/rwfs/var on /var type none (rw,bind)
shm on /dev/shm type tmpfs (rw)
system: I S10hostname:def:setting device hostname
kjournald starting. Commit interval 5 seconds
EXT3 FS on mmcblk0p3, internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with writeback data mode.
/dev/mmcblk0p3 on /var/local type ext3 (rw,sync)
system: I S10network:def:initializing network configuration
system: I S10network:def:Installed Firewall
system: I rcS:def:starting /etc/rcS.d/S20syslog-ng
system: I S20syslog-ng:def:starting syslog-ng
system: I rcS:def:starting /etc/rcS.d/S21init_time
system: I S21init_time:initboot:time=5660:boot time after init in milliseconds
system: I rcS:def:starting /etc/rcS.d/S45modules
system: I S45modules:def:loading module mwan
FATAL: Module mwan not found.
system: C S45modules:def:failed to load module mwan
system: I S45modules:def:loading module g_file_storage
kernel: I perf:usb:usb_gadget_loaded=6.03 seconds:
g_file_storage gadget: File-backed Storage Gadget, version: 7 August 2007
g_file_storage gadget: Number of LUNs=1
system: I S45modules:def:loading module fuse
fuse init (API version 7.12)
system: I S45modules:def:loading module uinput
system: I S45modules:def:loading module tequila_keypad
input: tequila-keypad as /devices/platform/tequila-keypad/input/input1
system: I S45modules:def:loading module mxc_keyb
mxc_keyb: I def:drv::Keypad driver loaded
system: I S45modules:def:loading module fiveway
input: fiveway as /devices/virtual/input/input2
system: I S45modules:def:loading module volume
volume: I def:probe0::Starting...
volume: I def:probe_done::GPIOs and IRQs have been set up
input: volume as /devices/virtual/input/input3
volume: I def:drv::Volume key driver loaded
system: I rcS:def:starting /etc/rcS.d/S46video
system: I S46video:def:initializing eInk HAL for system use
system: I wfm_mount:def:mounting waveform filesystem
system: I wfm_umount:def:umounting waveform filesystem
system: I rcS:def:starting /etc/rcS.d/S50system
system: I S50system:def:initializing shared library cache
/etc/rcS.d/S50system: line 1: /sbin/ldconfig: not found
mount: mount point /proc/bus/usb does not exist
system: I rcS:def:starting /etc/rcS.d/S70ethernet
system: I rcS:def:starting /etc/rcS.d/S70userstore
system: I S70ethernet:def:not enet
system: I S70ethernet:def:not usbnet
system: I S70userstore:def:Found SHUTDOWN flag file
system: I rcS:def:starting /etc/rcS.d/S90video
system: I S90video:def:initializing eInk HAL for rootfs use
INIT: Entering runlevel: 2
system: I lifeguard:def:starting eInk HAL lifeguard
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
Loading Atheros ar6003 driver
SDIO: Enabling device mmc0:0001:1...
SDIO: Enabled device mmc0:0001:1
kernel: I perf:wifi:wifi_driver_loaded=10.44 seconds:
ar6003 Driver returning from ar6000_init_module
ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/active_calibration
MAC from kernel xx:xx:xx:xx:86:2B
ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/otp.bin
ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/athwlan.bin
ar6k_wlan mmc0:0001:1: firmware: requesting /opt/ar6k/target/AR6003/hw2.1.1/bin/data.patch.hw3_0.bin
wmi_control_rx() : Unknown id 0x101e
ar6003 driver: Completed loading the module ar6000_avail_ev
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: W S50wan:def:This board does not support WAN; exiting script.
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 112 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70wifid:def:starting wifid
system: I S70cmd:def:starting CMD daemon
system: W S70wand:def:This board does not support WAN; exiting script.
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:skipping on non-Mario-based WW hardware
system: I S80volumd:def:starting Volume daemon
Battery Level: 77%
Starting lipc-daemon: system: I S90cron:def:starting crond
system: I S90tmd:def:Starting Transfer Manager Daemon
system: I S94browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: I S95framework:def:logging reset type: hard
start.sh: starting framework
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=16580:boot time before framework starts, in milliseconds
system: I mntroot:def:Making root filesystem read-only
Welcome to Kindle!
kindle login: mxc_rtc: saved=0x911c boot=0x9155
ログをみると、「Machine: Amazon.com MX50 YOSHI Board」とあります。Kindle 2やKindle DXの“Mario”、Kindle 3の“Luigi”ときて、Kindle 4は“Yoshi”であることが分かります。次は何になるんでしょう?
現状はここまででrootを取りに行くところは試してません。その辺りはまた後ほど。
rootの取得には、こちらで紹介されている方法を試してみました。が、Kindle 4のubootコマンドは数が減ってしまっているようで、run prg_kernel_serialやloadyなどが動作しないようです。以下はhelpコマンドとprintenvコマンドの結果です。
uboot > ?
? – alias for ‘help’
bist – start Built In Self Test
boot – boot default, i.e., run ‘bootcmd’
bootd – boot default, i.e., run ‘bootcmd’
bootm – boot application image from memory
go – start application at address ‘addr’
help – print online help
idme – idme – Set nv ram variables
log – manipulate logbuffer
printenv- print environment variables
reset – Perform RESET of the CPU
run – run commands in an environment variable
setenv – set environment variables
version – print monitor version
uboot > printenv
bootdelay=3
baudrate=115200
loadaddr=0×70800000
bootcmd=bootm 0×41000
failbootcmd=panic
loglevel=5
bootargs_diags=setenv bootargs consoleblank=0 rootwait ro ip=off root=/dev/mmcblk0p2 quiet eink=fslepdc
bootcmd_diags=run bootargs_diags ; bootm 0xE41000
bootcmd_factory=bist halt
bootcmd_fastboot=bist fastboot
stdin=serial
stdout=logbuff
stderr=logbuff
post_hotkeys=0
bootargs=
Environment size: 378/1020 bytes
Environment size: 378/1020 bytes
uboot >
趣味で半田付けとかしてたら気がついたら組み込み系プログラマーになってた人。なのでハードも好きだけど主にソフト担当。
Copyright © ITmedia, Inc. All Rights Reserved.