Kindle DX internal SD card reader

[darron]

There are pads for an internal SD card slot on the Kindle DX, in the large space under the mini-PCIe slot.

Since there are 32Gb SD cards out there, this could be pretty useful if anyone got it to work.

However, AFTER soldering a surface mount SD card slot to it, and soldering 22 ohm resistors on all the missing resistor pads leading to the SD slot traces (just a guess, they're probably for zero-ohm, but 22 is a little safer just in case)... I finally noticed that most of the IO lines going to the slot are shorted together.

Now, this could simply be that they did not want to leave unused IO lines floating, so there could easily be other zero-ohm resistors somewhere else pulling them to something. The problem is that if this is a common power rail, then it'll be very hard to tell where the pull resistors are.

The pictures I see online of the other side of the board do not show much around that area. I have not tried removing the display from the front of the PCB to check myself, though. (And I don't plan to)

The slot might also be meant to be controlled from one of the unpopulated IC pads.

Anyway, I thought this was interesting and so I wanted to share it. It's not quite worth pursuing further for me, though.

I've since completed my hack (so far) and I've closed it up again. My wife caught me with the brand-new Kindle in many pieces, so now I -really- have to be careful not to fry the thing. I can't play dumb now.

...

Also, I'd be very interested in if anyone has found pads for an extra USB slot somewhere. ???

[kindx]

Hi darron,

maybe the pins look like short in case of the processor is not setup proper,
as of the MCIMX31L manual, no additional line-drivers needed.

http://www.freescale.com/files/32bit...1_5.pdf?fpsp=1

http://www.freescale.com/files/32bit...1RM.pdf?fpsp=1


I looks like the propper SD modul in the kernal has to be selected.

http://clara.tuwien.ac.at/wiki/view/MCIMX31/SdCards

Unfortunally I'm not into kernal / linux programming, but maybe somebody out there can check the software issue?

[onnie]

It is strange to short lines together when you have already taken the effort of routing them on the PCB.

My guess is that the tracks are actually routed to the MX31L, probably with a pull up to a voltage rail. My guess also is that the pull-up voltage is connected to a disabled regulator

Internally, the MX31L can route the SDIO interface to different GPIO pins, and in addition to this you need to configure how the pin is internally driven (internal pull-up, internal pull-down, ground or open-drain)

The external pull-ups are neccesary nevertheless, mainly to avoid glitches in the power-up procedure before GPIO configuration.

So summarising this is my take:
- The SD card lines are connected to the MX31L. In the worst case, they have DNP 0 ohm registors on the lines... check if they are 5 unpopulated registors near the MX31 IC.
- There are 5 pull up registors to a power rail. My belief is that there is a footprint for a regulator, but they have not placed it. I do not believe it is SW disabled because that may induce some standby current leakage. Look for an unpopulated IC.
- We need to identify the pins connected to the lines, this can be tedious, but with patience can be done with some kernel programming and colorful leds.
- Once that is done, then we need to create a kernel module to change the GPIO. I believe the MX31 SDIO mxc driver will do nicely.


Warning, there may be a very good reason the SD card is not enabled.
The MX31L has up to three SDIO interfaces, but the number of external pins is limited, so on production the integrator can choose to make one available. This is called pin sharing or pin functionality multiplexing...

Unfortunately the 3G modem may be connected using SPI/SDIO interface (other option will be USB, or UART but that will be strange...). On the worst case the unpopulated SDcard and the 3G module may be sharing resources, so in the future we may have a SD card, but enabling it will disable 3G network.

Also because of this... if you play with the SD module... Remove the 3G module!!!

[onnie]

I extracted the MXC kernel configuration.

Several interesting points:
1. MXC-MMC is enabled. Actually the internal memory is connected through a SDIO interface <sdio 0 on option 3>
2. The 3G module is using an SPI interface, which uses <option 2>
3. The audio device is using I2C to comunicate with the audio codec via GPIO option 1

So, bottomline, all the SPI like external interfaces are used.
It will be possible to enable the SDIO interface to connect an external SD card, but that will mean that we either loose one of the previous devices...
The ideal will be to replace the internal memory with a much bigger external memory by replicating the rootfs into the external interface.

Actually what it may make sense is that the unpopulated SD interface was used during development as a way to bypass the internal SD/MMC card... When they got to the final product the just unpopulated the connector and removed zero ohms registors...

Anyone wants to do some hacking?

[kindx]

Hi Onnie,

ad 1.MXC-MMC
the internal flash memory has a mmc interface onchip, it looks like:
Samsung MoviNAND
There are chips with 32 GB! (but with BGA it gets difficult to change).

Have you thought about useing a mini-pci-e SD card adaptor?
I tried this one: MR09R but without the proper drivers (it's connected via pci-e lanes, but it is not recognised.
Any idea how to solve? Beside the additional memory it can be used to catch the USB lines on the connector :-)

ad 2. 3G module
Are you sure about the SPI interface, I checked the module and it uses the USB lines and USB0 comes up if the modem is online. Maybe the SPI is used in combination?

ad 3. I2C Audio
There might be more functions over this interface it's connected to MC13783 Audio, USB OTG, Power Management
Can you figure out how to turn the USB OTG into master mode? Connecting with a microUSB-A adapter doesn't do anything.

thx
kindx

[onnie]

Hi kindx

1) MMC is compatible with SD interface up to 4 bit mode... I still believe that it is possible two bypass the internal MMC with the internal interface with some resistor swapping, just to find them...

donc want to predate the pci-e, dont want to loose the 3G connectivity.

2) Im pretty sure with your comment on the 3G module that the mini-pci lines are not used and just the USB is available...

I am way to used to old 3G/GSM designs in which the BB was connected through usb and then the connection to the RF was done with SPI. In Amazon's design the MXC does not seem to be in a SOC with a sc3xxx DSP, so it directly uses the USB to connect to the SPRINT/HSDPA module on the pci-express lines... no need to use SPI from the MXC

On my defense, i am too afraid of opening my own DXi so all my guesses are based in SW and experience..., I'd rather buy a broken one from ebay when available...

3) Actually the device you told about is the PM, and it not only controls regulators, but the audio codec, the usb port, the charger, ...
To enable OTG, and even the RS232 passthough, you need to issue some commands over the SPI channel to modify its configuration.
I need to dig a bit to get the specs... but it may be doable.

Still no idea what driver to use, but could be fun