Linux kernel upgrades for sony reader PRS 600

[fastrobot]

Anyone know how the bootloader for sony readers works?
Or know how to reverse engineer it for compatibility reasons?
(I Made a typo in the subject, I'm using a sony PRS900, but the PRS600's loader is exactly the same.)

I'm needing to test replacement linux kernels because the one Igorsks' hack uses (and the original sony kernel) has serious driver bugs for permanently compiled in drivers.

My problem is that, unfortunately, the kernel does not have Kexec() compiled into it, and there is no way to replace the kernel that I know of except to reflash it, which I will need to do from the sony itself -- although thankfully, I do have all normal linux tools installed on the rooted sony reader itself, and have prepared a new kernel compiled from sony's sourcecode.
Right now I am simply trying to compile the kernel exactly as /proc/config.gz says it should be.

But I don't know how/where to install my new kernel on the sony, or check that it indeed matches the original. I compiled the kernel using the binary tools distributed on sony's site, and the final images look like: ls -l on ...linux.../arch/arm/boot/

-rwxr-xr-x 1 andrew3 users 3.6M 2014-07-12 01:33:02 Image
-rw-r--r-- 1 andrew3 users 2.8K 2009-12-03 03:12:15 Makefile
drwxr-xr-x 2 andrew3 users 4.0K 2009-12-03 03:15:33 bootp
drwxr-xr-x 2 andrew3 users 4.0K 2014-07-12 01:33:35 compressed
-rw-r--r-- 1 andrew3 users 1.3K 2009-12-03 03:12:15 install.sh
-rwxr-xr-x 1 andrew3 users 1.8M 2014-07-12 01:33:38 zImage

So -- the kernel image is 3.6Megs in size.

The sony's flash chip (PRS900) is partitioned like this:

cat /proc/mtd
dev:    size   erasesize  name
mtd0: 77800000 00020000 "sdm device eMMC"
mtd1: 00080000 00020000 "nblconfig"
mtd2: 00020000 00020000 "Id"
mtd3: 00020000 00020000 "Info"
mtd4: 00100000 00020000 "LOG"
mtd5: 00400000 00020000 "Linux0"
mtd6: 00600000 00020000 "Rootfs2"
mtd7: 00100000 00020000 "BootImg"
mtd8: 00400000 00020000 "Linux"
mtd9: 04000000 00020000 "Rootfs"
mtd10: 03200000 00020000 "Dic"
mtd11: 6b7e0000 00020000 "Data"
mtd12: 00a00000 00020000 "Data2"
mtd13: 00800000 00020000 "Opt0"

...and I know from examining the partitions that the two partitions marked linux, have the boot command line from the kernel file /proc/config.gz showing in them in plain text when I "grep -C0 console=" ; and so those are likely kernels or boot loaders, and the partition which follows them is the root partition for each kernel. Linux 0 is a recovery kernel, and Linux is the main kernel.

I figured out that I can set which root partition boots by running /usr/local/sony/bin/nblconfig -ksel [ normal/recovery ]
... and I assume that command name stands for nand boot loader config.

So...
I got the nand bootloader source code from sony, http://www.sony.net/Products/Linux/A...oot_091125.tgz and followed the readme:

The nandboot instructions indicate that I should copy the linux.../arch/arm/boot/zImage into the nandboot directory as image/Image , and then run make. When I do that I get the following:

-rwxr-xr-x 1 andrew3 users 1.6K 2014-07-12 09:57:21 IMX31EBX_nb_ipl.bin
-rwxr-xr-x 1 andrew3 users  26K 2014-07-12 10:03:06 IMX31EBX_nb_iplspl.bin
-rwxr-xr-x 1 andrew3 users  24K 2014-07-12 09:57:21 IMX31EBX_nb_spl.bin
-rw-r--r-- 1 andrew3 users 130K 2014-07-12 10:03:11 bootloader.bin
-rwxr-xr-x 1 andrew3 users 4.0M 2014-07-12 10:03:08 bootloader_kernel.bin
-rwxr-xr-x 1 andrew3 users  365 2009-12-03 01:25:11 mkiplspl.sh

ipl means initial program loader, and spl means secondary program loader, and clearly there is only one image large enough to be what I would copy into /dev/mtdblock8

bootloader_kernel.bin.

but something is wrong, because when I grep for "console=" in the new file, it doesn't exist.
In part that makes sense because zImage is compressed -- so possibly I need to NOT follow the instructions.

I'm thinking that possibly the instructions are a little wrong, and maybe I need to copy ...arch/arm/boot/Image rather than zImage.

Any thoughts? What bootloader does sony actually use, where is the real kernel image stored, and how would I verify how it is set up?
Is there an easy way to check if uboot is being used by some kind of binary signature test, or whether the ipl/spl code is being used? or should I just try making plain Image rather than zImage, and erase /dev/mtd8 -- and then install the bootloader_kernel.bin and hope it works?

Edit: I figured out that the script in /nandboot/nandboot/bin wanted the image to the kernel, not the compressed file. Apparently the sony tech/engineer edited the original nandboot.
When I changed the path, it made kernel file with the expected console= in it.
However, the image was still different than the original, in that it had whitespace where the script put it. I tried eraseall /dev/mtd8, then I did cat bootloader_kernel.bin > /dev/mtdblock8, then I did an md5 on the block device to verify it wrote correctly (it did.); But upon reboot -- the system bricked. Now the led flashes about once a second, like it's going to start up -- but never stops doing that. The screen displays nothing. And the 10 reset unbrick sequence doesn't seem to help.