Some Kindle source code digging

[TadW]

So I poked around the sources a little bit, and here is what I've discovered so far (pardon the disorder, my mind sometimes works in mysterious ways):

• Lab126 is the developer (software, hardware?) of the Kindle (notice, it's now assimilated by the Amazon Borg) - hint: they are hiring
• Of particular interest: u-boot-1.1.2.tar.bz2 (contains boot loader code) and linux-2.6.10-lab126.tar.bz2 (obvious)
• The Kindle is referred to as the Fiona computer platform
• The u-boot code contains customized code for the Kindle; for example, it allows you to go into maintenance mode during booting (more about this later)
• Some packages not only contain source and header files, but also precompiled libraries: /u-boot-1.1.2/bml/xsr.a, /u-boot-1.1.2/common/cmd_util.a
• The Kindle is based on the older E Ink Apollo controller architecture (rather than the newer Metronome)
• /u-boot-1.1.2/board/fiona/recovery.S contains the code to step into recovery/diagnostics mode
• /u-boot-1.1.2/board/fiona/images contains images of various booting options (including recovery) in binary hex (gzipped content)
• /u-boot-1.1.2/common/main.c describes the booting sequence. Notice the important keys for initiating maintenance/diagnostic mode.
• Various board revisions of the Kindle exist. At one point, the power switch was a slide-switch as opposed to a toggle (see /linux-2.6.10/arch/arm/mach-pxa/fiona.c)
• AnyData DTEV dual modem module used for Sprint's wireless EVDO network
• Misc snippets:
  

  #ifdef CONFIG_ARCH_FIONA
  #define BOARD_SERIALNUM_SIZE  32

  //#define USER_DIAGNOSTIC_RAM_BASE    (0xA2000000-USER_DIAGNOSTIC_SIGNATURE_SIZE)
  #define USER_DIAGNOSTIC_RAM_BASE    0xA2000000
  #define USER_DIAGNOSTIC_CODE_ENTRY_PT   (USER_DIAGNOSTIC_RAM_BASE+USER_DIAGNOSTIC_SIGNATURE_OFFSET+USER_DIAGNOSTIC_SIGNATURE_SIZE)
  #define USER_DIAGNOSTIC_VECTOR_TABLE_ADDR (USER_DIAGNOSTIC_RAM_BASE+USER_DIAGNOSTIC_VECTOR_TABLE_OFFSET)
  
  #define CONFIG_RECOVER_CONSOLE_KEY    'R' // Force recovery bootloader into console.
  
  #define CONFIG_DIAGS_KEY      'D' // Go into diagnostics mode (if CONFIG_BOOT_DIAGS defined).
  #define CONFIG_DIAGS_IOC_KEY      0x23  // Key code for 'd'.
  
  #define CONFIG_FW_RESET_KEY     '?' // Force recovery bootloader to do a firmware reset.
  #define CONFIG_FW_RESET_IOC_KEY     0x27  // Key code for '/'
  
  #define CONFIG_SW_UPDATE_KEY      'U' // Force recovery bootloader to do a firmware update.
  #define CONFIG_SW_UPDATE_IOC_KEY    0x22  // Key code for 'u'.
  
  #define CONFIG_FACTORY_UPDATE_KEY   '%' // Force recovery bootloader to do a factory update.
  #define CONFIG_FACTORY_UPDATE_IOC_KEY   0x20  // Key code for '5'.
  
  #define CONFIG_MENU_SCROLL_IOC_KEY    0x07  // Force recovery bootloader into service menu.
  #define CONFIG_MENU_HOME_IOC_KEY    0x2F  // Force recovery bootloader into service menu.
  #define CONFIG_MENU_KEY       0x1B  // Force recovery bootloader into service menu (ESC, ^[).
  
  #define CONFIG_MENU_DIAG_BOOT_KEY   '0' // Service menu's diag selection key.
  #define CONFIG_MENU_DIAG_BOOT_IOC_KEY   0x19  // Key code for '0'.
  
  #define CONFIG_MENU_UPDATE_BOOT_KEY   '1' // Service menu's firware update selection key.
  #define CONFIG_MENU_UPDATE_BOOT_IOC_KEY   0x00  // Key code for '1'
  
  #define CONFIG_MENU_RESET_BOOT_KEY    '2' // Service menu's firmware reset selection key.
  #define CONFIG_MENU_RESET_BOOT_IOC_KEY    0x08  // Key code for '2'
  
  #define CONFIG_MENU_STANDARD_BOOT_KEY   '3' // Service menu's normal boot (exit) selection key.
  #define CONFIG_MENU_STANDARD_BOOT_IOC_KEY 0x10  // Key code for '3'

  static bool fiona_preserve_boot_key(void)
  {
      // Check to see whether the user has hit a key on either the
      // device or the console, and then decide what to do, depending
      // on the keys they've hit.
      //
      bool boot_key_preserved = true, console = false;
      int boot_key = get_boot_ioc_key();
  
      // The boot key is either an IOC key or it's coming from the
      // console.
      //
      if ( 0 == boot_key )
      {
          boot_key = get_boot_key();
          console = true;
      }
      else
      {
          // For device keys, we need to ensure that the key is still down
          // to prevent stray key presses on boot from snagging.
          //
          if ( !ioc_key_still_down(boot_key) )
              boot_key = 0;
      }

[agnimidhun]

Its good to see the software specs.. Has anybody tried to find out whats the hardware? That should be interesting stuff..

[igorsk]

As far as I can guess from the sources:
The base system is based on a Gumstix board.
The CPU is XScale PXA250.
The I/O chip to talk to the PN-LCD, keyboard, scrollwheel and battery is from Foxconn.
Flash chip is OneNAND from Samsung.
The CDMA modem is AnyData DTG.
USB controller is Philips ISP1761 (it has On-The-Go!).
Eink controller is Apollo (the older one used in PRS-500 etc, I think).
Audio is WM8971.

[jimad]

Here's a blurb on the [presumed] USB controller

http://www.nxp.com/acrobat_download/...7/75011327.pdf

[KeithSloan]

Originally Posted by igorsk

As far as I can guess from the sources:
The CPU is XScale PXA250.

Do you think it would be possible to emulate the kindle on a PC?
There are PC emulators for RiscOS which natively runs an ARM processor,
see http://www.riscos.info/index.php/RPCEmu

[jesse]

Keith,

qemu + the kindle's linux userland and a kernel built with a few additional drivers _should_ mostly "just work"

[xobs]

You could probably run it in Scratchbox without too much trouble.

[jesse]

Originally Posted by xobs

You could probably run it in Scratchbox without too much trouble.

So far, I've found scratchbox's quasivirtualization (which uses qemu) to be not quite enough.

[jyavenard]

Hi there.

Has anyone managed to compile and build a Kindle 2 firmware?

I downloaded the source code, but there's a fair amount of stuff missing before you can start compiling...

I made the mistake of upgrading to 2.0.3 and then realised I couldn't do USB tethering anymore ...
I'd like to downgrade, or better compile my own firmware. I'm quite familiar with the ARM architecture

Any hints would be appreciated.
Cheers
Jean-Yves

[Blog Kindle]

You can't compile it since Amazon publishes only part of the source code (the portion of linux sources that they've used or modded). Source code of actual client application is not included.