Custom kernel for Kindle 3

[DickeFix]

Yifanlu, thank you for another great Kindle hack! It feels great to have a backup of the Kindle 3 and possibility to recover if necessary.

However, I would like to better understand the Kindle file system. Could you please let me know if the following is correct?

Partition 1 (650 MB): Is this the entire operative system? I guess this corresponds to rootfs.img that one obtains running your prepare_kindle.bin on system 2.5.8 on DXG. As you have pointed out before it is larger (650 MB) on Kindle 3 compared to Kindle 2/DX/DXG (400 MB)

Partition 2 (24 MB): Is this the current values of the local variables? Is it necessary to backup this or are these variables initialized automatically if they are missing?

Partition 3 (8 MB): Is this the kernel that is used for booting and recovery?

Partition 4 (>3GB): Is this identical with the USB-partition you see when you plug it in?

I have also two questions how one can edit the content of these partitions on a Windows computer.

1. I have not yet tried USB networking. Does it give full control with possibility to read and write on all four partitions?

2. Another method is to take a partition, modify it on the computer and send it back to the device. Why can´t this be done directly as an .img file? Why is it necessary to first compress it, sign it and transfer it as an upgrade .bin file?

I am a real newbie in Linux but found a nifty freeware Windows program Explore2fs that allows you to explore the file system and read the content on partition 1 and 2 (by right-clicking on the file and View it in e.g. Wordpad). Do you know a Windows program that can mount the image files for both read and write?

[yifanlu]

Originally Posted by DickeFix

Yifanlu, thank you for another great Kindle hack! It feels great to have a backup of the Kindle 3 and possibility to recover if necessary.

However, I would like to better understand the Kindle file system. Could you please let me know if the following is correct?

Partition 1 (650 MB): Is this the entire operative system? I guess this corresponds to rootfs.img that one obtains running your prepare_kindle.bin on system 2.5.8 on DXG. As you have pointed out before it is larger (650 MB) on Kindle 3 compared to Kindle 2/DX/DXG (400 MB)

Partition 2 (24 MB): Is this the current values of the local variables? Is it necessary to backup this or are these variables initialized automatically if they are missing?

Partition 3 (8 MB): Is this the kernel that is used for booting and recovery?

Partition 4 (>3GB): Is this identical with the USB-partition you see when you plug it in?

I have also two questions how one can edit the content of these partitions on a Windows computer.

1. I have not yet tried USB networking. Does it give full control with possibility to read and write on all four partitions?

2. Another method is to take a partition, modify it on the computer and send it back to the device. Why can´t this be done directly as an .img file? Why is it necessary to first compress it, sign it and transfer it as an upgrade .bin file?

I am a real newbie in Linux but found a nifty freeware Windows program Explore2fs that allows you to explore the file system and read the content on partition 1 and 2 (by right-clicking on the file and View it in e.g. Wordpad). Do you know a Windows program that can mount the image files for both read and write?

Partition 1 is the linux filesystem (mounted at /). Aka, OS files & tools, the framework that you see, and all the hacks you install are here.
Partition 2 is mounted at /var/local and is all the settings for your kindle. In addition, your Kindle certificate (what identifies your kindle and is the thing that gets sent to amazon when you buy a book, not a password), ads, etc. It's the thing that makes your Kindle unique (other then your books). Doing a "reset" literally just formats this partition.
Partition 3 does not exist on all kindles (some only have 1,2,4). It's the linux swap space (I'm 99% sure of that).
Partition 4 is vfat, and where all your books are.

The kernel and bootloader are stored on the nand, but are not mounted as partitions. /dev/mmcblk0 starts late in the nand. The first few bytes of the raw nand is your serial number and boardid and stuff. Then some space for the bootloader (and second bootloader on the K2/DX). Then the kernel and second kernel (on k2/dx) and so on. So, if you nuke /dev/mmcblk0, you won't destroy the kernel nor the bootloader. So basically, the only way to truly brick the kindle is to erase the first thousand or so bytes of the nand, and I don't know if you can do that from linux.

If you use usbnetworking, you can use putty to SSH into the Kindle. Then you have a linux shell that you can do stuff like "dd if=/dev/mmcblk0p2 of=/mnt/us/vars.img bs=1024" to backup your /var/local partition. You can also access the partition directly by cd-ing to /var/local, as that's where partition 2 is mounted.

Sending an .img ONLY works with Partition 1 (rootfs). It works because Amazon's recovery script is designed to do so. When the Kindle is fresh out of the press, I'm pretty sure only the bootloader and kernel is pre-flashed on the device. Before shipping, or sometime before that, Amazon loads the OS as a recovery bin. That way, you get the most up-to-date firmware. However, this bin has to be signed. I just replaced the signature with the jailbreak signature, so we can sign our own recovery packages. It's a package because it can also flash/update the bootloader and kernel, but we don't want to touch those.

If you're having trouble access the partition on Windows, it's pretty easy to burn a linux live cd or live USB stick. Damn small linux is like 50MB if you don't want to download an entire cd.

[DickeFix]

Thanks for the comprehensive and clarifying answer! Your reply would be nice to have in a Kindle developers FAQ or Wiki.

Just an additional question. You wrote "Sending an .img only works with Partition 1 (rootfs)." Does that mean that, in order to recover a bricked Kindle it is only necessary to transfer back partitiopn 1, i.e., the backuped rootfs.img file. Is it not necessary to first make a signed recovery .bin package of the rootfs.img file? If so, can the rootfs.img file be transfered back by only using the recovery terminal?

[yifanlu]

Originally Posted by DickeFix

Thanks for the comprehensive and clarifying answer! Your reply would be nice to have in a Kindle developers FAQ or Wiki.

Just an additional question. You wrote "Sending an .img only works with Partition 1 (rootfs)." Does that mean that, in order to recover a bricked Kindle it is only necessary to transfer back partitiopn 1, i.e., the backuped rootfs.img file. Is it not necessary to first make a signed recovery .bin package of the rootfs.img file? If so, can the rootfs.img file be transfered back by only using the recovery terminal?

Sorry, my bad. I mean transfer the img in a bin package. So, yes, you need a signed package.

[DickeFix]

Thanks again for clarifying. Then I have an additional request. I know that you have done more than enough so only if and when you get some time.

Would it be difficult to modify the prepare_kindle.bin for 2.5.8 so it works on Kindle 3.1, i.e., a package that not only modifies the kernel but also creates a signed back-up file of the rootfs.img? That would be handy for all us Linux-illiterate persons.

[zrenyi]

hello yifanlu:
My kindle 3g has been rewritten rootfs, but the modules loaded at startup error, please help me to see how it is, how to fix? Thank you
log:

U-Boot 1.3.0-rc3-lab126 (Sep 15 2010 - 19:24:53)

CPU: Freescale i.MX35 at 532 MHz
Board: MX35 Luigi [ POR]
WDOG_WCR = 0xff31
WDOG_WMCR = 0x0
Board Id: SP1B000000000000
S/N: B006A0A004042ADB
DRAM: 256 MB
Using default environment

In: serial
Out: serial
Err: serial
No ethernet found.
i.MX35 CPU board version 2.0
Net: No ethernet found.
Hit any key to stop autoboot: 0
## Booting image at 87f40400 ...
Image Name: Linux-2.6.26-rt-lab126
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2166568 Bytes = 2.1 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux............................................. .................................................. ........................... done, booting the kernel.
boot: C def:bcut:batterycut=1:
2.6.26-rt-lab126 #5 Sat Feb 5 19:05:05 PST 2011 armv6l
INFO:Using default keypad setting. (not passing "kb_rev" to module)
INFO:Loaded module /lib/modules/mxc_keyb.ko (22508 bytes)
Press [ENTER] for recovery menu... 0 /INFO:Partition table verified for /dev/mmcblk0
INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/101575 size=3328409600 bytes
flag type first last lba first lba size
Partition p1:
0x00 0x0b 16 <large> 16 6500784
CHS: 0/1/1 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 8192
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
argc == 9
argv[0]: "kinit"
argv[1]: "console=ttymxc0,115200"
argv[2]: "mem=256M"
argv[3]: "panic=10"
argv[4]: "root=/dev/mmcblk0p1"
argv[5]: "ro"
argv[6]: "ip=none"
argv[7]: "quiet"
argv[8]: "lpj=2555904"
Running ipconfig
argc == 4
argv[0]: "IP-Config"
argv[1]: "-i"
argv[2]: "Linux kinit"
argv[3]: "ip=none"
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: Mounted root (ext3 filesystem) readonly.
Checking for init: /sbin/init
Checking for init: /bin/init
Checking for init: /etc/init
Checking for init: /sbin/init.sysvinit
INIT: version 2.86 booting
system: I rcS:def:starting /etc/rcS.d/S02kdb
system: I S02kdb:def:Setting boot device to mmcblk0
kdb set: 'system/driver/filesystem/DEV_ROOT'
system: I rcS:def:starting /etc/rcS.d/S03udev
system: I S03udev:def:setting up virtual fs for hotplug event handling
system: I S03udev:def:starting the hotplug events dispatcher
system: I S03udev:def:synthesizing initial hotplug events
lipc-send-event[380]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[380]: C def:dbusi::Failed to init dbus
lipc-send-event[380]: E defpen::Failed to open LIPC
lipc-send-event[380]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending event failed
lipc-send-event[478]: E lipc:con::Connection error(Failed to connect to socket /var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[478]: C def:dbusi::Failed to init dbus
lipc-send-event[478]: E defpen::Failed to open LIPC
lipc-send-event[478]: E def:fail:source=com.lab126.hal, event=audioHS:Sending event failed
system: I rcS:def:starting /etc/rcS.d/S04rootfsresize
system: I S04rootfsresize:def:No rootfs on /dev/mmcblk0p1 resizing needed
system: I rcS:def:starting /etc/rcS.d/S10filesystems
system: I rcS:def:starting /etc/rcS.d/S10hostname
system: I rcS:def:starting /etc/rcS.d/S10network
system: I S10filesystems:def:mounting filesystems
system: I S10hostname:def:setting device hostname
system: I S10network:def:initializing network configuration
system: I S10network:def:Installed Firewall
system: I rcS:def:starting /etc/rcS.d/S11chpriority
system: I rcS:def:starting /etc/rcS.d/S11video
Unknown HZ value! (77) Assume 100.
system: W S11chpriority:def:Cannot set priority for IRQ-7
system: I S11video:def:initializing eInk HAL for system use
system: I S11video:def:eink_debug=0
system: I S11video:def:Controller set to broads
insmod: error inserting '/lib/modules/2.6.26-rt-lab126/kernel/drivers/video/eink/hal/eink_fb_hal.ko': -1 Invalid module format
insmod: error inserting '/lib/modules/2.6.26-rt-lab126/kernel/drivers/video/eink/hal/eink_fb_hal_broads.ko': -1 Invalid module format
insmod: error inserting '/lib/modules/2.6.26-rt-lab126/kernel/drivers/video/eink/legacy/eink_fb_shim.ko': -1 Invalid module format
system: C S11video:def:could not start video, halting
shutdown: /dev/initctl: No such file or directory
init: /dev/initctl: No such file or directory
system: I rcS:def:starting /etc/rcS.d/S20syslog-ng
system: I S20syslog-ng:def:starting syslog-ng
system: I rcS:def:starting /etc/rcS.d/S21init_time
system: I S21init_time:initboot:time=10020:boot time after init in milliseconds
system: I rcS:def:starting /etc/rcS.d/S45modules
system: I S45modules:def:loading module mwan
FATAL: Error inserting mwan (/lib/modules/2.6.26-rt-lab126/kernel/drivers/net/wan/mwan.ko): Invalid module format
system: C S45modules:def:failed to load module mwan
system: I S45modules:def:loading module g_file_storage
WARNING: Error inserting arcotg_udc (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/gadget/arcotg_udc.ko): Invalid module format
FATAL: Error inserting g_file_storage (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/gadget/g_file_storage.ko): Invalid module format
system: C S45modules:def:failed to load module g_file_storage
system: I S45modules:def:loading module fuse
FATAL: Error inserting fuse (/lib/modules/2.6.26-rt-lab126/kernel/fs/fuse/fuse.ko): Invalid module format
system: C S45modules:def:failed to load module fuse
system: I S45modules:def:loading module uinput
FATAL: Error inserting uinput (/lib/modules/2.6.26-rt-lab126/kernel/drivers/input/misc/uinput.ko): Invalid module format
system: C S45modules:def:failed to load module uinput
system: I S45modules:def:loading module mxc_keyb
FATAL: Error inserting mxc_keyb (/lib/modules/2.6.26-rt-lab126/kernel/drivers/input/keyboard/mxc_keyb.ko): Invalid module format
system: C S45modules:def:failed to load module mxc_keyb
system: I S45modules:def:loading module fiveway
FATAL: Error inserting fiveway (/lib/modules/2.6.26-rt-lab126/kernel/drivers/input/fiveway/fiveway.ko): Invalid module format
system: C S45modules:def:failed to load module fiveway
system: I S45modules:def:loading module volume
FATAL: Error inserting volume (/lib/modules/2.6.26-rt-lab126/kernel/drivers/input/volume/volume.ko): Invalid module format
system: C S45modules:def:failed to load module volume
system: I rcS:def:starting /etc/rcS.d/S50system
mount: mount point /proc/bus/usb does not exist
Sat Jul 31 00:00:00 UTC 2010
system: I rcS:def:starting /etc/rcS.d/S55scroll
system: I S55scroll:def:skipping; no luigi-based work to do here
system: I rcS:def:starting /etc/rcS.d/S70ethernet
system: I rcS:def:starting /etc/rcS.d/S70userstore
system: I S70ethernet:def:not enet
system: I S70ethernet:def:not usbnet
dosfsck 2.11-lab126 (1 Jun 2007)
dosfsck 2.11-lab126, 1 Jun 2007, FAT32, LFN
Checking we can access the last sector of the filesystem
Boot sector contents:
System ID "mkdosfs"
Media byte 0xf8 (hard disk)
512 bytes per logical sector
8192 bytes per cluster
32 reserved sectors
First FAT starts at byte 16384 (sector 32)
2 FATs, 32 bit entries
1624064 bytes per FAT (= 3172 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 3264512 (sector 6376)
405900 data clusters (3325132800 bytes)
32 sectors/track, 64 heads
0 hidden sectors
6500784 sectors total
Checking for unused clusters.
Checking free cluster summary.
/dev/loop/0: 21 files, 6159/405900 clusters
fuse: device not found, try 'modprobe fuse' first
system: I rcS:def:starting /etc/rcS.d/S73loc-init
system: I S73loc-init:def:[/mnt/us/localization not found] Localization update is disabled
system: I rcS:def:starting /etc/rcS.d/S76launchpad
system: I rcS:def:starting /etc/rcS.d/S90video
system: I S90video:def:initializing eInk HAL for system use
system: I S90video:def:eink_debug=0
system: I S90video:def:Controller set to broads
insmod: error inserting '/lib/modules/2.6.26-rt-lab126/kernel/drivers/video/eink/hal/eink_fb_hal.ko': -1 Invalid module format
insmod: error inserting '/lib/modules/2.6.26-rt-lab126/kernel/drivers/video/eink/hal/eink_fb_hal_broads.ko': -1 Invalid module format
insmod: error inserting '/lib/modules/2.6.26-rt-lab126/kernel/drivers/video/eink/legacy/eink_fb_shim.ko': -1 Invalid module format
system: C S90video:def:could not start video, halting
shutdown: /dev/initctl: No such file or directory
init: /dev/initctl: No such file or directory
INIT: Entering runlevel: 2
system: I S40diags:def:not starting Diagnostic Services
system: I S40diags:def:/mnt/base-us/ENABLE_DIAGS does not exist, forcing diagnostic disable
system: I S50battcheck:def:running
system: C S50battcheck:def:/sys/devices/platform/fsl-usb2-udc/voltage not found. Aborting battcheck
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I wifi:def:WiFi Device mac = 28:EF:01:0C:78:B7
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
FATAL: Error inserting ar6000 (/lib/modules/2.6.26-rt-lab126/kernel/drivers/net/wireless/ath6k22.133/ar6000.ko): Invalid module format
*** Failed to install AR6K Module
/opt/ar6k/host/support/platformscripts/plat_SHASTA_NATIVEMMC-SDIO.sh: exit: line 32: Illegal number: -1
Platform script failed : loadAR6K
/opt/ar6k/host/support/loadAR6000.sh: exit: line 244: Illegal number: -1
system: I wifi:def:loadAR6000 finished, args=()
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: I wancontrolcrocessing "wanon"
/usr/sbin/wancontrol: line 1: cannot create /proc/wan/power: nonexistent directory
/usr/sbin/wancontrol: line 1: cannot create /proc/wan/usb: nonexistent directory
FATAL: Error inserting usbcore (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/core/usbcore.ko): Invalid module format
mount: mount point /proc/bus/usb does not exist
WARNING: Error inserting mwan (/lib/modules/2.6.26-rt-lab126/kernel/drivers/net/wan/mwan.ko): Invalid module format
WARNING: Error inserting usbcore (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/core/usbcore.ko): Invalid module format
FATAL: Error inserting ehci_hcd (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/host/ehci-hcd.ko): Invalid module format
WARNING: Error inserting usbcore (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/core/usbcore.ko): Invalid module format
FATAL: Error inserting usbserial (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/serial/usbserial.ko): Invalid module format
WARNING: Error inserting mwan (/lib/modules/2.6.26-rt-lab126/kernel/drivers/net/wan/mwan.ko): Invalid module format
WARNING: Error inserting usbcore (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/core/usbcore.ko): Invalid module format
WARNING: Error inserting ehci_hcd (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/host/ehci-hcd.ko): Invalid module format
WARNING: Error inserting usbserial (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/serial/usbserial.ko): Invalid module format
FATAL: Error inserting option (/lib/modules/2.6.26-rt-lab126/kernel/drivers/usb/serial/option.ko): Invalid module format
system: E wancontrol:usdf:USB serial device failure
system: E wancontrol:wspf:WAN USB serial port failure -- aborting
/usr/sbin/wancontrol: line 1: cannot create /proc/wan/power: nonexistent directory
system: E S50wan:wpuf1:WAN power-up failure (1)
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 127 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70wifid:def:starting wifid
system: I S70cmd:def:starting CMD daemon
system: I S70wand:def:starting WAN daemon
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:starting MCS server
system: I S80volumd:def:starting Volume daemon
system: I S85audio:def:initializing audio driver defaults
No state is present for card mx35luigi
system: I S85audio:def:starting audio server
system: I S87ttsd:def:starting TTS daemon
Battery Level: 8%
Sat Jul 31 00:00:29 2010 INFO:battery charge: 8%
system: I S90cron:def:starting crond
Starting lipc-daemon: system: I S90tmd:def:Starting Transfer Manager Daemon
system: I S94browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: C S95framework:def:not starting framework on account of no screen
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=41450:boot time before framework starts, in milliseconds
system: I mntroot:def:Making root filesystem read-only



Welcome to Kindle!

kindle login: root
#################################################
# N O T I C E * N O T I C E * N O T I C E #
#################################################
Rootfs is mounted read-only. Invoke mntroot rw to
switch back to a writable rootfs.
#################################################
[root@kindle root]#


Thank you very much!

[PoP]

Originally Posted by zrenyi

hello,PoP
I do not see how this map? How to access to / dev/sdc1?

On a linux machine, create a /newdir new directory of the file system and mount /dev/sdc1 /newdir then cd /newdir to access files in it.

[zrenyi]

thanks Pop. my kindle 3g is unbrick,but not insmod modules,help me ,thank.

[dasmoover]

zrenyi

I've tried building kernel modules and I get the same error, further research indicates that you may have to build the modules with the same binutils, gcc, g++, etc, etc.

[zrenyi]

Originally Posted by dasmoover

zrenyi

I've tried building kernel modules and I get the same error, further research indicates that you may have to build the modules with the same binutils, gcc, g++, etc, etc.

hi dasmoover

My rootfs is from mmcblk0p1, version 3.03. Brick before is 3.1 version, may be updated kernel, perhaps for this reason. I do not know how to restore the kernel is 3.03 now.

[zrenyi]

I have successfully repaired my kindle 3g. Thank you yifanlu, PoP, Sir Alex, boloto etc.

dd if=./uImage of=/dev/mmcblk0 seek=260 bs=1024

I have successfully written to the kernel 3.03 version

[khmann]

Any update on a recovery kernel for 3.2.1?

I just bought my girlfriend a K3 B006 SO on sale. She's not a hacker and would prefer the stock kindle experience (amazon store, software updates, social networking features)... While she would happily pay $25 to avoid SO, my unit didn't have them; has not, and will not ever accept EULA or connect to the internet. And its actually running a K1 s# for DRM purposes. So I dd'd all 3.8mb of the stock mmcblk0 image from my 3.1 unit over top of hers for full idme compliance, even swapped my 3g card and SIM to complete the illusion.

Everything works as expected. Does this mean I am running 3.1 kernel on 3.2.1 software? I thought it might, but seemed like an acceptable risk.

How do I apply recovery kernel to this unit? I had to remove jailbreak to get online stuff working, I assume because of certificate change. Maybe now that unit has it's private key I can put it back and run the installer, but I would rather just do it command line.

Thanks for your hard work.

[yifanlu]

Originally Posted by khmann

Any update on a recovery kernel for 3.2.1?

I just bought my girlfriend a K3 B006 SO on sale. She's not a hacker and would prefer the stock kindle experience (amazon store, software updates, social networking features)... While she would happily pay $25 to avoid SO, my unit didn't have them; has not, and will not ever accept EULA or connect to the internet. And its actually running a K1 s# for DRM purposes. So I dd'd all 3.8mb of the stock mmcblk0 image from my 3.1 unit over top of hers for full idme compliance, even swapped my 3g card and SIM to complete the illusion.

Everything works as expected. Does this mean I am running 3.1 kernel on 3.2.1 software? I thought it might, but seemed like an acceptable risk.

How do I apply recovery kernel to this unit? I had to remove jailbreak to get online stuff working, I assume because of certificate change. Maybe now that unit has it's private key I can put it back and run the installer, but I would rather just do it command line.

Thanks for your hard work.

I don't get what you're asking. It seems like you got everything figured out. If you are using the 3.1 software, you can use my recovery kernel, if not I don't know if it works or not.

[khmann]

So... by my above command, it is confirmed that stock 3.2.1 seems to work OK with stock 3.1 kernel.

I guess for my purposes it is enough to flash_kernel() from command line, ala 'dd' command above.

[superium]

Good job! it's just what i need.

my kindle keyboard lost response which was caused by some soft.
I just need to update my kernel and rootfs.

but when i copy it to kindle, holding enter-key when startup, and press U to update kernel, the screen just flash.it did nothing.

Is there anyone could tell me how could I update the kernel now ?