Miscellaneous Kindle 3 internals and hackings...

Wi-Fi antenna in corner of case (bottom right when held in normal usage, keyboard-downwards).

Reset button. Curious as there is no way to actuate it from outside the case - no pinhole. So why do they populate it on the PCB?

As the battery is screwed down it does make it easier to do a hard reset, but still seems odd for it to be populated on production PCBs.

Pressing it appears equivalent to a power-up reset.

Main board

Closeup of E-Ink controller. LHS chip probably power management - Eink uses a +/-15V supply.

Flex from E-ink display contains a large serial flash chip. This suggests that a significant amount of per-display or per-batch adjustment is needed. An Epson E-Ink controller spec I found mentioned "Serial flash memory waveform read support". This memory is read at power-up.

Of course I just had to read it to see if it contained anything interesting...  unfortunately couldn't see anything, although there is a lot of data there, about 97kbytes.  Here's the flash memory image if you want a look : kindle_eink_flash.bin

Flex unfolded - looks like 3 driver chips, 1 column and 2 row drivers. Possibly these or similar.

Central support frame between PCB and display - metallised plastic, holding keyboard and side switch flex PCBs.

The mysterious side connectors....

There are a couple of little holes in the side, providing access to 5 contacts. My guess is these are used as part of the customization/registration  they do as part of the shipping process, via a jig that the unit drops into for speed.

Top contact - does not appear to be ground - runs via  a thick-ish track on the PCB so may be for external power.

Detail of connector pads.Signals are at 1.8v  logic levels, baudrate is 115K2. The fourth pin is connected to something - my guess would be would be something like a resistor to ID different modes when in a test cradle.

Contact block - this unscrews easily. Looks like you could make  a plug   with something like a 1mm  thick piece of PCB with 4 tracks on.

Here's what comes out of the  serial port at reset - mostly gobbledygook to me - I'm sure it will mean something to the Penguin people out there...

U-Boot 1.3.0-rc3-lab126 (Aug 29 2010 - 19:01:12)

CPU: Freescale i.MX35 at 532 MHz
Board: MX35 Luigi [ POR]
WDOG_WCR = 0xff31
WDOG_WMCR = 0x0
Board Id: SP1B000000000000
S/N: B008A0A00322482F
DRAM: 256 MB
Using default environment

In: serial
Out: serial
Err: serial
No ethernet found.
i.MX35 CPU board version 2.0
Net: No ethernet found.
Hit any key to stop autoboot: 0
## Booting image at 87f40400 ...
Image Name: Linux-2.6.26-rt-lab126
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2147012 Bytes = 2 MB
Load Address: 80008000
Entry Point: 80008000
Verifying Checksum ... OK
Loading Kernel Image ... OK

Starting kernel ...

Uncompressing Linux.............................................................
............................................................ done, booting the k
ernel.
boot: I def:rst:Hard reset or Watchdog Reset Encountered:
2.6.26-rt-lab126 #5 Sun Aug 29 19:01:34 PDT 2010 armv6l
INFO:Using default keypad setting. (not passing "kb_rev" to module)
INFO:Loaded module /lib/modules/mxc_keyb.ko (22508 bytes)
Press [ENTER] for recovery menu... 0 /INFO:Partition table verified for /d
ev/mmcblk0
INFO:Checking for updates... (auto-pilot mode)
/dev/mmcblk0p4:
CHS=4/16/100167 size=3282272256 bytes
flag type first last lba first lba size
Partition p1:
0x00 0x0b 16 <large> 16 6410672
CHS: 0/1/1 - <large>
Partition p2:
Partition p3:
Partition p4:
INFO:Setup loop device /dev/loop0 for /dev/mmcblk0p4 + 8192
INFO:No update*.bin found; no update needed.
INFO:no updates found.
BOOTING DEFAULT.
argc == 9
argv[0]: "kinit"
argv[1]: "console=ttymxc0,115200"
argv[2]: "mem=256M"
argv[3]: "panic=10"
argv[4]: "root=/dev/mmcblk0p1"
argv[5]: "ro"
argv[6]: "ip=none"
argv[7]: "quiet"
argv[8]: "lpj=2555904"
Running ipconfig
argc == 4
argv[0]: "IP-Config"
argv[1]: "-i"
argv[2]: "Linux kinit"
argv[3]: "ip=none"
IP-Config: no devices to configure
kinit: do_mounts
kinit: name_to_dev_t(/dev/mmcblk0p1) = dev(179,1)
kinit: root_dev = dev(179,1)
kinit: /dev/root appears to be a ext3 filesystem
kinit: trying to mount /dev/root on /root with type ext3
kinit: Mounted root (ext3 filesystem) readonly.
Checking for init: /sbin/init
Checking for init: /bin/init
Checking for init: /etc/init
Checking for init: /sbin/init.sysvinit
INIT: version 2.86 booting
system: I rcS:def:starting /etc/rcS.d/S02kdb
system: I S02kdb:def:Setting boot device to mmcblk0
kdb set: 'system/driver/filesystem/DEV_ROOT'
system: I rcS:def:starting /etc/rcS.d/S03udev
system: I S03udev:def:setting up virtual fs for hotplug event handling
system: I S03udev:def:starting the hotplug events dispatcher
system: I S03udev:def:synthesizing initial hotplug events
lipc-send-event[379]: E lipc:con::Connection error(Failed to connect to socket /
var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[379]: C def:dbusi::Failed to init dbus
lipc-send-event[379]: E def:open::Failed to open LIPC
lipc-send-event[379]: E def:fail:source=com.lab126.hal, event=usbPlugIn:Sending
event failed
lipc-send-event[477]: E lipc:con::Connection error(Failed to connect to socket /
var/run/dbus/system_bus_socket: No such file or directory)
lipc-send-event[477]: C def:dbusi::Failed to init dbus
lipc-send-event[477]: E def:open::Failed to open LIPC
lipc-send-event[477]: E def:fail:source=com.lab126.hal, event=audioHS:Sending ev
ent failed
system: I rcS:def:starting /etc/rcS.d/S04rootfsresize
system: I S04rootfsresize:def:No rootfs on /dev/mmcblk0p1 resizing needed
system: I rcS:def:starting /etc/rcS.d/S10filesystems
system: I rcS:def:starting /etc/rcS.d/S10hostname
system: I rcS:def:starting /etc/rcS.d/S10network
system: I S10filesystems:def:mounting filesystems
system: I S10hostname:def:setting device hostname
system: I S10network:def:initializing network configuration
system: I S10network:def:Installed Firewall
system: I rcS:def:starting /etc/rcS.d/S11chpriority
system: I rcS:def:starting /etc/rcS.d/S11video
Unknown HZ value! (91) Assume 100.
system: W S11chpriority:def:Cannot set priority for IRQ-7
system: I S11video:def:initializing eInk HAL for system use
system: I S11video:def:eink_debug=0
system: I S11video:def:Controller set to broads
system: I rcS:def:starting /etc/rcS.d/S20syslog-ng
system: I S20syslog-ng:def:starting syslog-ng
system: I rcS:def:starting /etc/rcS.d/S21init_time
system: I S21init_time:initboot:time=16820:boot time after init in milliseconds
system: I rcS:def:starting /etc/rcS.d/S45modules
system: I S45modules:def:loading module mwan
system: I S45modules:def:loading module g_file_storage
system: I S45modules:def:loading module fuse
system: I S45modules:def:loading module uinput
system: I S45modules:def:loading module mxc_keyb
system: I S45modules:def:loading module fiveway
system: I S45modules:def:loading module volume
system: I rcS:def:starting /etc/rcS.d/S50system
mount: mount point /proc/bus/usb does not exist
system: I rcS:def:starting /etc/rcS.d/S55scroll
system: I S55scroll:def:skipping; no luigi-based work to do here
system: I rcS:def:starting /etc/rcS.d/S70ethernet
system: I rcS:def:starting /etc/rcS.d/S70userstore
system: I S70ethernet:def:not enet
system: I S70ethernet:def:not usbnet
system: I S70userstore:def:Found BOOTUP flag file
dosfsck 2.11-lab126 (1 Jun 2007)
dosfsck 2.11-lab126, 1 Jun 2007, FAT32, LFN
Checking we can access the last sector of the filesystem
There are differences between boot sector and its backup.
Differences: (offset:original/backup)
65:01/00
Not automatically fixing this.
Boot sector contents:
System ID "mkdosfs"
Media byte 0xf8 (hard disk)
512 bytes per logical sector
8192 bytes per cluster
32 reserved sectors
First FAT starts at byte 16384 (sector 32)
2 FATs, 32 bit entries
1601536 bytes per FAT (= 3128 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 3219456 (sector 6288)
400274 data clusters (3279044608 bytes)
32 sectors/track, 64 heads
0 hidden sectors
6410672 sectors total
Checking for unused clusters.
Checking free cluster summary.
/dev/loop/0: 42 files, 2225/400274 clusters
system: I rcS:def:starting /etc/rcS.d/S90video
system: I S90video:def:initializing eInk HAL for rootfs use
INIT: Entering runlevel: 2
system: I lifeguard:def:starting eInk HAL lifeguard
system: I S40diags:def:not starting Diagnostic Services
system: I S40diags:def:/mnt/base-us/ENABLE_DIAGS does not exist, forcing diagnos
tic disable
system: I S50battcheck:def:running
Sun Jan 10 01:43:11 2010 INFO:battery voltage: 3899 mV
Sun Jan 10 01:43:11 2010 INFO:battery charge: 61%
system: I S50battcheck:def:current voltage = 3896mV
Sun Jan 10 01:43:11 2010 INFO:battery charge: 61%
Sun Jan 10 01:43:11 2010 INFO:battery voltage: 3899 mV
Sun Jan 10 01:43:11 2010 INFO:battery current: -261 mA
system: I S50battcheck:def:gasgauge capacity=61% volts=3899 mV current=-261 mA
system: I S50battcheck:def:Waiting for 3460mV or 4%
system: I S50battcheck:def:battery sufficient, booting to normal runlevel
INIT: Switching to runlevel: 5
INIT: Sending processes the TERM signal
system: I wifi:def:WiFi Device mac = 28:EF:01:EA:3E:74
Platform set to SHASTA_NATIVEMMC-SDIO
Platform Setup Script is: /opt/ar6k/host/support/platformscripts/plat_SHASTA_NAT
IVEMMC-SDIO.sh
Image path: /sbin
No debug record limit set
Load Board Data from /opt/ar6k/target/AR6002/hw2.0/bin/lab126_15dBm_nodiv_WWR_CT
L.bin
Updating MAC address
BMI Set App Start (address: 0x913950)
BMI Bit-Wise (OR) modify Register (address: 0x500410, orig:0x8, new: 0x9, mask:
0x1)
BMI Write compressed Memory (address: 0x502070, filename: /opt/ar6k/target/AR600
2/hw2.0/bin/athwlan.bin.z77)
BMI Write Memory (address: 0x52d6d0, filename: /opt/ar6k/target/AR6002/hw2.0/bin
/data.patch.hw2_0.bin)
BMI Write Memory (address: 0x500418, value: 0x52d6d0)
BMI Done
system: I wifi:def:loadAR6000 finished, args=()
system: I wpa_supplicant:def:wpa supplicant started
system: I S30network:def:initializing network configuration
system: I S30network:def:Installed Firewall
system: I S60dbus:def:starting system message bus
Starting Process Monitoring Daemon: Retrieved 127 keys for system/daemon/pmond/
Starting Power Management Daemon: system: I S70cmd:def:starting CMD daemon
system: I S70wifid:def:starting wifid
system: I S75phd:def:Starting Phone-Home Daemon
system: I S76mcsd:def:starting MCS server
system: I S80volumd:def:starting Volume daemon
system: I S85audio:def:initializing audio driver defaults
No state is present for card mx35luigi
system: I S85audio:def:starting audio server
system: I S87ttsd:def:starting TTS daemon
Battery Level: 61%
Sun Jan 10 01:43:22 2010 INFO:battery charge: 61%
system: I S90tmd:def:Starting Transfer Manager Daemon
system: I S90cron:def:starting crond
Starting lipc-daemon: system: I S94browserd:def:Starting Browser Daemon
system: I S95framework:def:starting booklet framework
system: I S95framework:def:logging reset type: hard
system: I S96boot_finished:def:Boot finished script running
system: I S96boot_finished:symboot:time=37270:boot time before framework starts,
in milliseconds
start.sh: starting framework
system: I mntroot:def:Making root filesystem read-only



Welcome to Kindle!

kindle login:

system: I S96boot_finished:def:Boot finished script received framework booted ev
ent
system: I S96boot_finished:fwboot:time=79130:boot time after framework starts, i
n milliseconds
system: I loginfo:devhw:boardID=SP1B:Shasta PVT device - rev 1
system: I loginfo:devhwphy::USB PHY built by unknown
system: I loginfo:devsworig::Original System Software Version: 101-shasta0.5-052
512
Sun Aug 29 19:03:19 PDT 2010
system: I loginfo:devswota::OTA Kindle 3.0.1 (~~otaVersion~~)
com.lab126.wan failed to access property localTimeOffset (0x3 lipcErrNoSuchSourc
e)
system: W loginfo:ltofailwandoff:cannot retrieve local time offset - wand not ru
nning
com.lab126.powerd failed to set value for property wakeUp (0x8 lipcErrNoSuchProp
erty)
system: I ckimage:def:skipping kernel check
system: I governor:def:switching to ondemand governor
system: E governor:def:/sys/devices/system/cpu/cpu0/cpufreq/ondemand/up_threshol
d is set to 11 instead of 30
system: I tinyrot:def::Rotating file /var/log/messages with max size 256
cat: can't open '/var/local/log/nexttosendfile': No such file or directory
/usr/sbin/tinyrot : Signaling syslog
/usr/sbin/tinyrot : Calculating total size /var/local/log/messages_*.gz
/usr/sbin/tinyrot : Total size of /var/local/log/messages_*.gz is 250kb

Login timed out after 60 seconds


Welcome to Kindle!

kindle login: