Custom kernel for Kindle 3

[yifanlu]

When I made the 3.1 updater for K2/DX, I included a custom kernel that allows people to recover from potential bad flashes. Some people asked me for a similar thing for the Kindle 3, so I made one. The patches are the same as described here, but the offsets and stuff are different.

Basically, this kernel adds the following recovery features:
-Export entire filesystem (including linux rootfs) to the USB from the recovery menu with Alt+E
-Install custom recovery packages signed with the jailbreak keys (to make a custom recovery package, copy the Kindle rootfs using "dd if=/dev/mmcblk0p1 of=/mnt/us/rootfs.img", then you can mount the image and modify it on your computer (if you want). After your done, gzip rootfs.img, sign it using the jailbreak key and package rootfs.img.gz and rootfs.img.gz.sig into an update. Change the first 4 bytes of the header from "FC02" to "FB02" and you're done.

If you don't know what this is or how it's useful, it's not for you. This is for people who want to mess with the kindle filesystem, but are afraid of bricking. A safety net for those people. With this kernel, you can pretty much recover from most "bricks" (bad fonts, deleted system files, etc) in the future without the need to access the serial port. The only exceptions are if you broke the bootloader or the kernel. Also if you somehow wiped the rootfs clean, you can upload this kernel via recovery serial and make a recovery package with a backup rootfs.img.

I may also add additional linux features if I have time and if there are any that people want. The kindle comes with a pretty bare linux kernel.

Oh, and so far, it's only for Kindle 3.1. I don't have a KSO, so I can't test 3.2/3.2.1.

Download
http://yifan.lu/p/kindle-custom-kernel

EDIT:
seaniko7 has modified this to work with the 3.3 kernel: https://www.mobileread.com/forums/sho...1&postcount=45

[giorgio130]

Great idea. Where can I find the source code? You should create a project on github so if people want to help it becomes really easier...

[PoP]

Originally Posted by yifanlu

...
Some people asked me for a similar thing for the Kindle 3, so I made one.
...

I was one of them!

Thank you so much yifanlu. And also, nicely documented on your blog.

[yifanlu]

Originally Posted by giorgio130

Great idea. Where can I find the source code? You should create a project on github so if people want to help it becomes really easier...

It's amazon's version of the kernel, untouched. The recovery script was parched with a hex editor.

[PoP]

Originally Posted by yifanlu

... (to make a custom recovery package, copy the Kindle rootfs using "dd if=/dev/mmcblk0p1 of=/mnt/us/rootfs.img", then you can mount the image and modify it on your computer (if you want). After your done, gzip rootfs.img, sign it using the jailbreak key and package rootfs.img.gz and rootfs.img.gz.sig into an update. Change the first 4 bytes of the header from "FC02" to "FB02" and you're done...

Ok I did this:

Spoiler:

dd if=/dev/mmcblk0p1 > rootfs.img

gzip -9 rootfs.img

openssl dgst -sha256 -sign sign.key -out rootfs.img.gz.sig rootfs.img.gz

python kindle_update_tool.py m --k3w --fb k3w-restore-rootfs-v3.1 rootfs.img.gz rootfs.img.gz.sig

and now have a update_k3w-restore-rootfs-v3.1.bin for the future.

But it is the first time that I prepare an update package and I have (too many) questions.

The bin file has the expected FB02 header -- thanks to the fb parameter of the python update tool -- with 00 padding up to hex 20000, so it appears to be using the expected block size of decimal 131072

Does that look correct to you for an manual update? The package only consists of an image with its jailkey signed file. I am afraid to test it and not quite ready to risk bricking my Kindle.

When I go to the Recovery menu pressing ENTER at Boot time (per version 3.1 of my Kindle 3 WiFi) I get the recovery screen:

but even after installing the recovery kernel, pressing E did not seem to do anything. And when plugging the USB to the computer, Windows did not see a file system (and foolishly asked me if I wanted to format the device) so I am wondering if pressing U will give me the chance in the future to copy the restore-rootfs.bin file before rebooting by pressing R to exit from recovery.

I also read ALT+E was rather required, I tried it with the same results. How long should one wait for the export to complete? And where will the file be created if I can't connect the USB to the computer.

Finaly, I am not reassured by the description of option U which suggests that both the file system *and* the kernel will be updated... since my package only contains the file system.

[giorgio130]

rootfs is an ext2 filesystem, maybe you can't see it because windows doesn't recognize it? just a guess though... try under an ubuntu livecd...

[yifanlu]

Originally Posted by PoP

Ok I did this:

Spoiler:

dd if=/dev/mmcblk0p1 > rootfs.img

gzip -9 rootfs.img

openssl dgst -sha256 -sign sign.key -out rootfs.img.gz.sig rootfs.img.gz

python kindle_update_tool.py m --k3w --fb k3w-restore-rootfs-v3.1 rootfs.img.gz rootfs.img.gz.sig

and now have a update_k3w-restore-rootfs-v3.1.bin for the future.

But it is the first time that I prepare an update package and I have (too many) questions.

The bin file has the expected FB02 header -- thanks to the fb parameter of the python update tool -- with 00 padding up to hex 20000, so it appears to be using the expected block size of decimal 131072

Does that look correct to you for an manual update? The package only consists of an image with its jailkey signed file. I am afraid to test it and not quite ready to risk bricking my Kindle.

When I go to the Recovery menu pressing ENTER at Boot time (per version 3.1 of my Kindle 3 WiFi) I get the recovery screen:

Attachment 73505

but even after installing the recovery kernel, pressing E did not seem to do anything. And when plugging the USB to the computer, Windows did not see a file system (and foolishly asked me if I wanted to format the device) so I am wondering if pressing U will give me the chance in the future to copy the restore-rootfs.bin file before rebooting by pressing R to exit from recovery.

Attachment 73506

I also read ALT+E was rather required, I tried it with the same results. How long should one wait for the export to complete? And where will the file be created if I can't connect the USB to the computer.

Finaly, I am not reassured by the description of option U which suggests that both the file system *and* the kernel will be updated... since my package only contains the file system.

You are correct in using the --fb option to create a large block size. You may have been using my modified kindle_update_tool.py, but for others, the default kindle_update_tool.py creates a "FB01" package with the --fb option. If so, just change either the header of the bin or the python file source to FB02. But other than that, your image looks fine.

You need an ext2 compatible OS to see the filesystem exported by Alt+E. Pressing "U" will only update the kernel if it finds it in the .bin package.

[PoP]

Originally Posted by giorgio130

rootfs is an ext2 filesystem, maybe you can't see it because windows doesn't recognize it? just a guess though... try under an ubuntu livecd...

Indeed I could see and access it under Ubuntu:

Originally Posted by yifanlu

... You need an ext2 compatible OS to see the filesystem exported by Alt+E.

Silly me, I thought that ALT+E Export meant dumping the file system somewhere (such as when using dd) when it instead just makes it visible to the ext3 compatible OS.

Originally Posted by yifanlu

... Pressing "U" will only update the kernel if it finds it in the .bin package.

Ahh, good to know. I just hope that using "U" in the future will give me write access to the vfat file system (partition 4) so I can copy my .bin file on it.

Thanks to you both.

[yifanlu]

Originally Posted by PoP

Indeed I could see and access it under Ubuntu:

Attachment 73511

Silly me, I thought that ALT+E Export meant dumping the file system somewhere (such as when using dd) when it instead just makes it visible to the ext3 compatible OS.


Ahh, good to know. I just hope that using "U" in the future will give me write access to the vfat file system (partition 4) so I can copy my .bin file on it.

Thanks to you both.

When you want to restore, first press E to export just the fat filesystem. Copy the bin and then press U.

[zrenyi]

hello yifanlu:
my k3g is brick,rootfs is bad .How can I apply to your program?i have a img "mmcblk0p1"，You can make a tutorial?Thank you very much.my English is a google translation.

************************************************** *
Menu
====
3. Load MMC0 over USB storage
4. Erase MMC0
I. Initialize Partition Table (fdisk) and format FAT
O. Format and overwrite FAT partition
E. Export FAT partition
U. Update using update*.bin file on FAT partition
M. Update using update*.bin file on FAT partition of second MMC port
D. dmesg / kernel printk ring buffer.
Q. quit
Choose: 8 \

# my choose "U"

/dev/mmcblk0p4:
CHS=4/16/101575 size=3328409600 bytes
flag type first last lba first lba size
Partition p1:
0x00 0x0b 24072 <large> 7688 6493112
CHS: 376/0/9 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 3936256
INFO:Found update_kindle_3.1_custom_kernel_k3g.bin
INFO:Skipping battery charge check
INFO:Found bundle /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin
INFO:*** NORMAL MODE
*** CHECKING /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin ***
INFO:do_unbundle: filename=/mnt-us/update_kindle_3.1_custom_kernel_k3g.bin, new_file=0x0000db70
ERROR:OTA bundles are not supported.ERROR:do_unbundle: parse_sysbundle_header failed with error code 22
ERROR:Could not unbundle /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin
INFO:removing /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin
************************************************** *

[zrenyi]

Originally Posted by PoP

Indeed I could see and access it under Ubuntu:

Attachment 73511

Silly me, I thought that ALT+E Export meant dumping the file system somewhere (such as when using dd) when it instead just makes it visible to the ext3 compatible OS.


Ahh, good to know. I just hope that using "U" in the future will give me write access to the vfat file system (partition 4) so I can copy my .bin file on it.

Thanks to you both.

hello,PoP
I do not see how this map? How to access to / dev/sdc1?

[yifanlu]

Originally Posted by zrenyi

hello yifanlu:
my k3g is brick,rootfs is bad .How can I apply to your program?i have a img "mmcblk0p1"，You can make a tutorial?Thank you very much.my English is a google translation.

************************************************** *
Menu
====
3. Load MMC0 over USB storage
4. Erase MMC0
I. Initialize Partition Table (fdisk) and format FAT
O. Format and overwrite FAT partition
E. Export FAT partition
U. Update using update*.bin file on FAT partition
M. Update using update*.bin file on FAT partition of second MMC port
D. dmesg / kernel printk ring buffer.
Q. quit
Choose: 8 \

# my choose "U"

/dev/mmcblk0p4:
CHS=4/16/101575 size=3328409600 bytes
flag type first last lba first lba size
Partition p1:
0x00 0x0b 24072 <large> 7688 6493112
CHS: 376/0/9 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 3936256
INFO:Found update_kindle_3.1_custom_kernel_k3g.bin
INFO:Skipping battery charge check
INFO:Found bundle /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin
INFO:*** NORMAL MODE
*** CHECKING /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin ***
INFO:do_unbundle: filename=/mnt-us/update_kindle_3.1_custom_kernel_k3g.bin, new_file=0x0000db70
ERROR:OTA bundles are not supported.ERROR:do_unbundle: parse_sysbundle_header failed with error code 22
ERROR:Could not unbundle /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin
INFO:removing /mnt-us/update_kindle_3.1_custom_kernel_k3g.bin
************************************************** *

In your case, you cannot install the kernel installer because you are already bricked. You need to extract the uImage from my update package, then flash it manually through the serial port (that I see you have access to) and uBoot (there is a command to update kernel via zmodem or Kermit)

[the-equinoxe]

@yifanlu
As one of the people requested the K3 Kernel:
Thanks!!
This is awesome!

[AZImmortal]

Originally Posted by yifanlu

Oh, and so far, it's only for Kindle 3.1. I don't have a KSO, so I can't test 3.2/3.2.1.

Does this mean that it definitely doesn't work for 3.2/3.2.1? Or just that it's not tested?

[yifanlu]

Originally Posted by AZImmortal

Does this mean that it definitely doesn't work for 3.2/3.2.1? Or just that it's not tested?

It has been untested so I don't know, but for safety precaution, the package wont run on 3.2.1.