So I poked around the sources (http://www.mobileread.com/forums/showthread.php?t=16247) a little bit, and here is what I've discovered so far (pardon the disorder, my mind sometimes works in mysterious ways):


Lab126 (http://www.lab126.com/) is the developer (software, hardware?) of the Kindle (notice, it's now assimilated by the Amazon Borg) - hint: they are hiring
Of particular interest: u-boot-1.1.2.tar.bz2 (contains boot loader code) and linux-2.6.10-lab126.tar.bz2 (obvious)
The Kindle is referred to as the Fiona computer platform
The u-boot code contains customized code for the Kindle; for example, it allows you to go into maintenance mode during booting (more about this later)
Some packages not only contain source and header files, but also precompiled libraries: /u-boot-1.1.2/bml/xsr.a, /u-boot-1.1.2/common/cmd_util.a
The Kindle is based on the older E Ink Apollo controller architecture (rather than the newer Metronome (http://eink.com/products/matrix/metronome.html))
/u-boot-1.1.2/board/fiona/recovery.S contains the code to step into recovery/diagnostics mode
/u-boot-1.1.2/board/fiona/images contains images of various booting options (including recovery) in binary hex (gzipped content)
/u-boot-1.1.2/common/main.c describes the booting sequence. Notice the important keys for initiating maintenance/diagnostic mode.
Various board revisions of the Kindle exist. At one point, the power switch was a slide-switch as opposed to a toggle (see /linux-2.6.10/arch/arm/mach-pxa/fiona.c)
AnyData DTEV dual modem module used for Sprint's wireless EVDO network
Misc snippets:
#ifdef CONFIG_ARCH_FIONA
#define BOARD_SERIALNUM_SIZE 32
//#define USER_DIAGNOSTIC_RAM_BASE (0xA2000000-USER_DIAGNOSTIC_SIGNATURE_SIZE)
#define USER_DIAGNOSTIC_RAM_BASE 0xA2000000
#define USER_DIAGNOSTIC_CODE_ENTRY_PT (USER_DIAGNOSTIC_RAM_BASE+USER_DIAGNOSTIC_SIGNATUR E_OFFSET+USER_DIAGNOSTIC_SIGNATURE_SIZE)
#define USER_DIAGNOSTIC_VECTOR_TABLE_ADDR (USER_DIAGNOSTIC_RAM_BASE+USER_DIAGNOSTIC_VECTOR_T ABLE_OFFSET)

#define CONFIG_RECOVER_CONSOLE_KEY 'R' // Force recovery bootloader into console.

#define CONFIG_DIAGS_KEY 'D' // Go into diagnostics mode (if CONFIG_BOOT_DIAGS defined).
#define CONFIG_DIAGS_IOC_KEY 0x23 // Key code for 'd'.

#define CONFIG_FW_RESET_KEY '?' // Force recovery bootloader to do a firmware reset.
#define CONFIG_FW_RESET_IOC_KEY 0x27 // Key code for '/'

#define CONFIG_SW_UPDATE_KEY 'U' // Force recovery bootloader to do a firmware update.
#define CONFIG_SW_UPDATE_IOC_KEY 0x22 // Key code for 'u'.

#define CONFIG_FACTORY_UPDATE_KEY '%' // Force recovery bootloader to do a factory update.
#define CONFIG_FACTORY_UPDATE_IOC_KEY 0x20 // Key code for '5'.

#define CONFIG_MENU_SCROLL_IOC_KEY 0x07 // Force recovery bootloader into service menu.
#define CONFIG_MENU_HOME_IOC_KEY 0x2F // Force recovery bootloader into service menu.
#define CONFIG_MENU_KEY 0x1B // Force recovery bootloader into service menu (ESC, ^[).

#define CONFIG_MENU_DIAG_BOOT_KEY '0' // Service menu's diag selection key.
#define CONFIG_MENU_DIAG_BOOT_IOC_KEY 0x19 // Key code for '0'.

#define CONFIG_MENU_UPDATE_BOOT_KEY '1' // Service menu's firware update selection key.
#define CONFIG_MENU_UPDATE_BOOT_IOC_KEY 0x00 // Key code for '1'

#define CONFIG_MENU_RESET_BOOT_KEY '2' // Service menu's firmware reset selection key.
#define CONFIG_MENU_RESET_BOOT_IOC_KEY 0x08 // Key code for '2'

#define CONFIG_MENU_STANDARD_BOOT_KEY '3' // Service menu's normal boot (exit) selection key.
#define CONFIG_MENU_STANDARD_BOOT_IOC_KEY 0x10 // Key code for '3'
static bool fiona_preserve_boot_key(void)
{
// Check to see whether the user has hit a key on either the
// device or the console, and then decide what to do, depending
// on the keys they've hit.
//
bool boot_key_preserved = true, console = false;
int boot_key = get_boot_ioc_key();

// The boot key is either an IOC key or it's coming from the
// console.
//
if ( 0 == boot_key )
{
boot_key = get_boot_key();
console = true;
}
else
{
// For device keys, we need to ensure that the key is still down
// to prevent stray key presses on boot from snagging.
//
if ( !ioc_key_still_down(boot_key) )
boot_key = 0;
}

Its good to see the software specs.. Has anybody tried to find out whats the hardware? That should be interesting stuff.. :grin2:

As far as I can guess from the sources:
The base system is based on a Gumstix board.
The CPU is XScale PXA250.
The I/O chip to talk to the PN-LCD, keyboard, scrollwheel and battery is from Foxconn.
Flash chip is OneNAND from Samsung.
The CDMA modem is AnyData DTG.
USB controller is Philips ISP1761 (it has On-The-Go!).
Eink controller is Apollo (the older one used in PRS-500 etc, I think).
Audio is WM8971.

Here's a blurb on the [presumed] USB controller

http://www.nxp.com/acrobat_download/literature/9397/75011327.pdf