Hi there. I just managed to copy the waveform from a broken panel into a new one!
This thread has provided me with very valuable info so I thought I'd share the process here.
Full picture album here.
A friend gave me a Kindle 3 (US 3G model), fully functional except for a broken screen. I ordered a new screen panel online. After replacing it, I had the same problem as the OP, grayscale images not displayed properly:
Broken panel model and waveform chip:
Code:
ED060SC7(LF)H2 2.02
Macronix International MX25L2005ZNI-12G
New panel model and waveform chip:
Code:
ED060SC7(LF)C1 1.54
Winbond W25X20
So, in my case both panels had a 256KB CMOS serial flash chip on the ribbon to store the waveform.
Firmware version was 3.1, I updated to 3.3 and then to 3.4 as per Amazon's instructions, just to see if this problem was fixed in later versions. (Nope).
Booting the Kindle with the broken panel and hot-swapping it for the new one works, but lasts only until the next restart. So far, nothing new.
The Kindle 3 reads the waveform from the flash chip on every boot, and if it can't (when there is no chip, or when the chip does not contain the proper waveform data), it uses a default waveform, which was not quite right for my new display, so grayscales didn't show as they should. There was evidence of this in the logs right after booting with the new panel:
Code:
140206:191308 eink_fb: I ipu_controller_type:def:Detected broadsheet controller
140206:191308 eink_fb: E bs_panel_data_valid:def:Unrecognized values in panel data
140206:191308 eink_fb: E broadsheet_waveform_valid:def:Unrecognized values in waveform header
140206:191308 eink_fb: W bs_get_isis_waveform:def:using built-in waveform as panel-specific waveform couldn't be found
140206:191308 eink_fb: E bs_panel_data_valid:def:Unrecognized values in panel data
Fortunately, the waveform from my old panel seemed to be good enough for the new one - grayscales were fine and text edges were smooth. So I looked for a way to copy the old waveform into the new panel. First, where to find the old waveform?
I poked around the filesystem, dumped it after booting with both panels and compared both dumps, as suggested here. Nothing changed below the first partition (sectors 0-7688). Nothing changed on the first partition (root) either. The second (/var/local) did change, but that was to be expected since it stores log files.
Found the .wbf files dsmid mentioned in /var/local/eink, but those are links to files on the first partition, which did not change:
Code:
[root@kindle root]# cd /var/local/
[root@kindle local]# ls -lah
drwxr-xr-x 9 root root 1.0k Feb 6 02:57 .
drwxr-xr-x 9 root root 180 Feb 6 12:02 ..
drwxr-xr-x 2 root root 1.0k Feb 6 02:57 audio
drwx------ 2 root root 1.0k Feb 6 02:57 browser
drwxr-xr-x 2 root root 1.0k Feb 6 12:03 eink
drwxr-xr-x 4 root root 1.0k Feb 6 02:58 java
drwxr-xr-x 2 root root 1.0k Feb 6 12:30 log
drwxr-xr-x 2 root root 1.0k Feb 6 12:04 system
drwxr-xr-x 2 root root 1.0k Feb 6 02:58 wan
[root@kindle local]# cd eink
[root@kindle eink]# ls -lah
drwxr-xr-x 2 root root 1.0k Feb 6 12:03 .
drwxr-xr-x 9 root root 1.0k Feb 6 02:57 ..
lrwxrwxrwx 1 root root 44 Feb 6 12:03 V110_044_60_M06 -> /opt/eink/images/V110_B044_60_TE2703_BTC.wbf
lrwxrwxrwx 1 root root 53 Feb 6 12:03 V110_059_60_M06 -> /opt/eink/images/V110_B059_60_WJ0105_ED060SC5_BTC.wbf
lrwxrwxrwx 1 root root 53 Feb 6 12:03 V220_004_60_M12 -> /opt/eink/images/V220_C004_60_WJ4405_ED060SC7_BTC.wbf
lrwxrwxrwx 1 root root 53 Feb 6 12:03 V220_008_60_M12 -> /opt/eink/images/V220_C008_60_WJ0607_ED060SC7_BTC.wbf
lrwxrwxrwx 1 root root 55 Feb 6 12:03 V220_008_60_M14 -> /opt/eink/images/V220_C008_60_WJ0705_ED060SC7H2_BTC.wbf
lrwxrwxrwx 1 root root 55 Feb 6 12:03 V220_008_60_M24 -> /opt/eink/images/V220_C008_60_WJ0804_ED060SC7C1_BTC.wbf
-rw-r--r-- 1 root root 236.0k Feb 6 02:57 usid
[root@kindle eink]# ls -lah /opt/eink/images/
drwxr-xr-x 2 root root 1.0k Jul 31 2010 .
drwxr-xr-x 4 root root 1.0k Mar 10 2011 ..
-rw-r--r-- 1 root root 46.3k Jul 31 2010 V110_B044_60_TE2703_BTC.wbf
-rw-r--r-- 1 root root 56.8k Jul 31 2010 V110_B059_60_WJ0105_ED060SC5_BTC.wbf
-rw-r--r-- 1 root root 79.4k Jul 31 2010 V220_C004_60_WJ4405_ED060SC7_BTC.wbf
-rw-r--r-- 1 root root 87.9k Jul 31 2010 V220_C008_60_WJ0607_ED060SC7_BTC.wbf
-rw-r--r-- 1 root root 94.4k Jul 31 2010 V220_C008_60_WJ0705_ED060SC7H2_BTC.wbf
-rw-r--r-- 1 root root 86.9k Jul 31 2010 V220_C008_60_WJ0804_ED060SC7C1_BTC.wbf
-rw-r--r-- 1 root root 2.1k Jul 31 2010 cmd0047_c0_fi260_fo5_d0100_s00_cd0b00.bin
-rw-r--r-- 1 root root 24.0k Jul 31 2010 factory_reset_n.png
-rw-r--r-- 1 root root 22.3k Jul 31 2010 factory_reset_s.png
-rw-r--r-- 1 root root 16.9k Jul 31 2010 factory_reset_t.png
-rw-r--r-- 1 root root 138 Jul 31 2010 rectangle.gif
[root@kindle eink]#
I booted the Kindle into diagnostic mode (placing an empty file named ENABLE_DIAGS on the user memory of the Kindle and rebooting) with the new panel attached.
Pressed N for Misc Diagnostics, then V for Video. The new panel couldn't be identified.
I rebooted with the old panel, hot-swapped it with the new one and ran Video diagnostics again. This time it showed the ID of the old panel and passed all tests... until next reboot.
I figured I'd try those .wbf files from /opt/eink/images. After booting with the new panel, pressed S for Settings:
Then pressed T to update the waveform. However, none of the .wbf files I tried matched the panel ID (which was blank), so none worked. It turns out the flash chip on the panel also contains the panel ID, and the Kindle won't accept any waveform unless it somehow matches the panel ID. So back to square one.
My last resort was to read the flash chip directly. I knew it could be done (kudos to
Mike Harrison). I had an Arduino Uno microcontroller board on hand, and some
Logic Level Converters from Sparkfun. I built a
flash reader, fashioned a crude jig to connect it to the chip, and used
flashrom on my linux laptop to read the chip from the old panel.
Code:
nephiel@laptop$ flashrom -p serprog:dev=/dev/ttyACM0:2000000 -Vr oldpanel.rom
flashrom v0.9.7-r1711 on Linux 3.2.0-58-generic (i686)
flashrom is free software, get the source code at http://www.flashrom.org
flashrom was built with libpci 3.1.8, GCC 4.6.3, little endian
Command line (4 args): flashrom -p serprog:dev=/dev/ttyACM0:2000000 -Vr oldpanel.rom
Calibrating delay loop... OS timer resolution is 3 usecs, 550M loops per second, 10 myus = 12 us, 100 myus = 120 us, 1000 myus = 1058 us, 10000 myus = 9982 us, 12 myus = 18 us, OK.
Initializing serprog programmer
Baud rate is 2000000.
serprog: connected - attempting to synchronize
...
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
Warning: Automatic command availability check failed for cmd 0x08 - won't execute cmd
Warning: Automatic command availability check failed for cmd 0x11 - won't execute cmd
serprog: Programmer name is "serprog-duino"
serprog: Serial buffer size is 65535
serprog: Warning: Programmer does not support toggling its output drivers
The following protocols are supported: SPI.
[...]
Probing for Macronix MX25L2005(C), 256 kB: probe_spi_rdid_generic: id1 0xc2, id2 0x2012
Found Macronix flash chip "MX25L2005(C)" (256 kB, SPI) on serprog.
Chip status register is 0x00.
Chip status register: Status Register Write Disable (SRWD, SRP, ...) is not set
Chip status register: Bit 6 is not set
Chip status register: Bit 5 is not set
Chip status register: Bit 4 is not set
Chip status register: Block Protect 1 (BP1) is not set
Chip status register: Block Protect 0 (BP0) is not set
Chip status register: Write Enable Latch (WEL) is not set
Chip status register: Write In Progress (WIP/BUSY) is not set
[...]
Found Macronix flash chip "MX25L2005(C)" (256 kB, SPI).
===
This flash part has status UNTESTED for operations: PROBE READ ERASE WRITE
The test status of this chip may have been updated in the latest development
version of flashrom. If you are running the latest development version,
please email a report to flashrom@flashrom.org if any of the above operations
work correctly for you with this flash part. Please include the flashrom
output with the additional -V option for all operations you tested (-V, -Vr,
-VE, -Vw), and mention which mainboard or programmer you tested.
Please mention your board in the subject line. Thanks for your help!
Reading flash... done.
This produced a 256KB rom file. Comparing it to the one from Mike Harrison, it was not identical, but the data structure was very similar. The chip from the new panel, however, produced a 256KB file with all bits set to 1, meaning the chip was
empty. Blank. No wonder the Kindle couldn't read the waveform nor the panel ID.
All that was left was to cross my fingers and write the rom file from the old panel into the new...
Code:
nephiel@laptop$ flashrom -p serprog:dev=/dev/ttyACM0:2000000 -Vw oldpanel.rom
flashrom v0.9.7-r1711 on Linux 3.2.0-58-generic (i686)
flashrom is free software, get the source code at http://www.flashrom.org
flashrom was built with libpci 3.1.8, GCC 4.6.3, little endian
Command line (4 args): flashrom -p serprog:dev=/dev/ttyACM0:2000000 -Vw oldpanel.rom
Calibrating delay loop... OS timer resolution is 2 usecs, 514M loops per second, 10 myus = 16 us, 100 myus = 132 us, 1000 myus = 1316 us, 10000 myus = 13060 us, 8 myus = 12 us, OK.
Initializing serprog programmer
Baud rate is 2000000.
serprog: connected - attempting to synchronize
...
serprog: Synchronized
serprog: Interface version ok.
serprog: Bus support: parallel=off, LPC=off, FWH=off, SPI=on
Warning: Automatic command availability check failed for cmd 0x08 - won't execute cmd
Warning: Automatic command availability check failed for cmd 0x11 - won't execute cmd
serprog: Programmer name is "serprog-duino"
serprog: Serial buffer size is 65535
serprog: Warning: Programmer does not support toggling its output drivers
The following protocols are supported: SPI.
[...]
Probing for Winbond W25X20, 256 kB: probe_spi_rdid_generic: id1 0xef, id2 0x3012
Found Winbond flash chip "W25X20" (256 kB, SPI) on serprog.
Chip status register is 0x00.
[...]
Found Winbond flash chip "W25X20" (256 kB, SPI).
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:W, 0x001000-0x001fff:W, 0x002000-0x002fff:W, 0x003000-0x003fff:W, 0x004000-0x004fff:W, 0x005000-0x005fff:W, 0x006000-0x006fff:W, 0x007000-0x007fff:W, 0x008000-0x008fff:W, 0x009000-0x009fff:W, 0x00a000-0x00afff:W, 0x00b000-0x00bfff:W, 0x00c000-0x00cfff:W, 0x00d000-0x00dfff:W, 0x00e000-0x00efff:W, 0x00f000-0x00ffff:W, 0x010000-0x010fff:W, 0x011000-0x011fff:W, 0x012000-0x012fff:W, 0x013000-0x013fff:W, 0x014000-0x014fff:W, 0x015000-0x015fff:W, 0x016000-0x016fff:W, 0x017000-0x017fff:W, 0x018000-0x018fff:W, 0x019000-0x019fff:W, 0x01a000-0x01afff:W, 0x01b000-0x01bfff:W, 0x01c000-0x01cfff:W, 0x01d000-0x01dfff:W, 0x01e000-0x01efff:W, 0x01f000-0x01ffff:W, 0x020000-0x020fff:W, 0x021000-0x021fff:W, 0x022000-0x022fff:W, 0x023000-0x023fff:W, 0x024000-0x024fff:W, 0x025000-0x025fff:W, 0x026000-0x026fff:W, 0x027000-0x027fff:W, 0x028000-0x028fff:W, 0x029000-0x029fff:W, 0x02a000-0x02afff:W, 0x02b000-0x02bfff:W, 0x02c000-0x02cfff:W, 0x02d000-0x02dfff:W, 0x02e000-0x02efff:W, 0x02f000-0x02ffff:W, 0x030000-0x030fff:W, 0x031000-0x031fff:S, 0x032000-0x032fff:S, 0x033000-0x033fff:S, 0x034000-0x034fff:S, 0x035000-0x035fff:S, 0x036000-0x036fff:S, 0x037000-0x037fff:S, 0x038000-0x038fff:S, 0x039000-0x039fff:S, 0x03a000-0x03afff:S, 0x03b000-0x03bfff:S, 0x03c000-0x03cfff:S, 0x03d000-0x03dfff:S, 0x03e000-0x03efff:S, 0x03f000-0x03ffff:S
Erase/write done.
Verifying flash... FAILED at 0x000144e4! Expected=0xaa, Found=0x56, failed byte count from 0x00000000-0x0003ffff: 0x3
Your flash chip is in an unknown state.
Please report this on IRC at chat.freenode.net (channel #flashrom) or
mail flashrom@flashrom.org, thanks!
...the first write attempt failed verification, but a second try...
Code:
[...]
Found Winbond flash chip "W25X20" (256 kB, SPI).
Reading old flash chip contents... done.
Erasing and writing flash chip... Trying erase function 0... 0x000000-0x000fff:S, 0x001000-0x001fff:S, 0x002000-0x002fff:S, 0x003000-0x003fff:S, 0x004000-0x004fff:S, 0x005000-0x005fff:S, 0x006000-0x006fff:S, 0x007000-0x007fff:S, 0x008000-0x008fff:S, 0x009000-0x009fff:S, 0x00a000-0x00afff:S, 0x00b000-0x00bfff:S, 0x00c000-0x00cfff:S, 0x00d000-0x00dfff:S, 0x00e000-0x00efff:S, 0x00f000-0x00ffff:S, 0x010000-0x010fff:S, 0x011000-0x011fff:S, 0x012000-0x012fff:S, 0x013000-0x013fff:S, 0x014000-0x014fff:S, 0x015000-0x015fff:S, 0x016000-0x016fff:S, 0x017000-0x017fff:S, 0x018000-0x018fff:S, 0x019000-0x019fff:S, 0x01a000-0x01afff:S, 0x01b000-0x01bfff:S, 0x01c000-0x01cfff:S, 0x01d000-0x01dfff:S, 0x01e000-0x01efff:S, 0x01f000-0x01ffff:S, 0x020000-0x020fff:S, 0x021000-0x021fff:S, 0x022000-0x022fff:S, 0x023000-0x023fff:S, 0x024000-0x024fff:S, 0x025000-0x025fff:S, 0x026000-0x026fff:S, 0x027000-0x027fff:S, 0x028000-0x028fff:S, 0x029000-0x029fff:S, 0x02a000-0x02afff:S, 0x02b000-0x02bfff:S, 0x02c000-0x02cfff:S, 0x02d000-0x02dfff:S, 0x02e000-0x02efff:S, 0x02f000-0x02ffff:S, 0x030000-0x030fff:S, 0x031000-0x031fff:S, 0x032000-0x032fff:S, 0x033000-0x033fff:S, 0x034000-0x034fff:S, 0x035000-0x035fff:S, 0x036000-0x036fff:S, 0x037000-0x037fff:S, 0x038000-0x038fff:S, 0x039000-0x039fff:S, 0x03a000-0x03afff:S, 0x03b000-0x03bfff:S, 0x03c000-0x03cfff:S, 0x03d000-0x03dfff:S, 0x03e000-0x03efff:S, 0x03f000-0x03ffff:S
Warning: Chip content is identical to the requested image.
Erase/write done.
Success! Diagnostics show ID and model from the old panel, which isn't quite right, but it works, and grayscales now survive reboots
