KT2 Exposed

[knc1]

I made a few mistakes along the way but I did get it open and it still works.

It seems that Amazon ran out of double sided tape after they stopped K4 production.
But their glue pot is still full.

The highlighted sections are in the same order as the pictures attached.

peel-1
Starting at an upper corner -
Using a thin, plastic tool (or credit card) -
Work down one side, work across the top, work down the other side.
Leave a trail of <something> (shown, glossy faced cardboard) behind so that the bezel glue doesn't grab the body again.

peel-2
Leaving the bottom for the last peel&pry effort, (gently) rip that little sucker off the face of the body.

unscrew
The Kindle hardware assembly is held in the bottom (or back) case pan by 10, T-5 (torx) socket head screws.
The red dots are just below the ones you want to remove.

In the following, I did the "right thing" for the wrong reason.
Work on these devices long enough and a person has to get lucky sometime.

pry-it
Using your thin, stiff, plastic tool (or strips of credit card) - -
Work up the two upper corners enough so that you can "bridge" the corner radii with the cards.

This leaves the e-ink display frame sitting on top of the plastic wedges, which are resting on the top edge of the case pan.

Thou shall be gentle from this point on - since bending the e-ink frame is detrimental to the display's operation.
It probably will not do the touch screen any good either.

clips
I thought I was separating double sided tape, but not so, Amazon is using interlocking, hook style, clips.

clip-pts
The matching hook style clips on the underside of the e-ink frame.

Note that you can't just slide something in there to use as a "release tool".
The least of the problems is that the battery is in the way.
The worst of the problems is that the display cable is in the way. Rip that up and you have KT2 spare parts.

Set aside all thoughts of brute force and reach for the hair dryer.

Place Kindle face down on soft cloth, heat outside of the case bottom until it is uncomfortably hot to the touch.

Work down either side with more plastic shims -
The hot case back will allow the plastic hooks to flex enough to release their hold on the e-ink frame.

BIG NOTE: You may have to alternate heating the backside of the case and the working of the shims down the side several times.

Expect a few loud, sharp, cracks and pops.
Those should be the clips releasing, not your e-ink display / touch screen being destroyed.

bottom-right
Here you will find two, unpopulated, pad sites.
The serial port connector pad (Kindle functions in red added) and a place for the hardware reset button.

bottom-left
Here you will find two more, unpopulated, pad sites.
One for the power on/off toggle button and one for the switch to enable booting from the USB device.

And in the left-most corner of the board, the Wifi antenna.
Note that is the right-most corner of the Kindle when looking at the display.

usb-adpt
This is the 1v8-serial to micro-USB connector, adapter board.
Viewed from the underside.

Note the "Control Bit" outputs (CB0 ... CB3) -
those can be controlled via the USB serial cable and look like just the thing to replace the (non-existent) buttons with.
(Well, the USB boot switch connections might be a bit tricky, but the rest should be straight forward.)

My next goal is to find a place (hopefully inside) to install this board.

- - - - -

For another take(down) on the 7th gen. rip-it-apart story, see:
https://www.ifixit.com/Teardown/Kind...Teardown/29802

[knc1]

The following borrowed (inspired? stolen?) from the ifixit list of major components.
See link at bottom of prior post.

SoC
Freescale, i.MX6 series.
(Attach-1: Product sheet)

Part: MC IMX6 L 7 D VN 10 A B
MC - Mass production
IMX6
L - i.MX6SoloLite
7 - EPD, no GPU
D - Commercial temp. range (-40c ... +105c)
VN - MAPBGA, 13x13 grid, 0.5mm pitch
10 - 1Ghz
A - supports E-INK EPDC if EPD enabled
B - silicon revision 1.2
(Attach-2: Product Technical Data sheet)

SoC i/o supply rail(s) can be either 1v8 or 3v3

RAM
Micron technology, B2432BCPE-8D-F
xxB: DDR-2, Mobile RAM
xxxxxC: VDD=1v8, VDDQ=1v8, LVCMOS
(Attach-3: Part Number Decode)

Which sort of determines which supply rail choice is made for RAM.

Flash
Sandisk, SDIN7DP-4G
eMMC, iNand, Ultra 4G NAND Flash
(Link: http://www.sandisk.com/products/embe...d/inand-ultra/ , product overview)

Specs. quoted use a 4KB write/read - so device must have a 4096byte erase block size.

Power Management
Maxim MAX77696A Power Management Circuit
(Attach-4: MAX7769A Product Brief)

Main Board
IFixIt photo with shields removed.
(Attach-5: Sorry, I had to gzip it to get it past the attachment size limits.)

IMX6 Ref.
Freescale, IMX6 SoloLite Reference Manual
Added because it is referenced by earlier attachments.
(Attach-6: IMX6SLRM.pdf zip -9 compressed to imx6slrm.zip)

[knc1]

Micro-FTX
As shipped, unless otherwise requested, is configured for 5v0 i/o levels.
(Attach-1: ftx-bottom)

FTX Jumpers
Since the Kindle uses 1v8 for its serial port, and other controls, the jumpers have to be changed to configuration #3.
(Attach-2: ftx-jmpr)

FTX I/O References
A usable (very quiet) ground and a 1v8 reference for the FTX can be found at the top right of the KT2 board.
(Attach-3: adptr-io-ref)

Serial Port
The "Serial Debug" pad site is wired to the FTX (only Rx and Tx) in the usual manner.
(Attach-4: serial-port)

Hardware Reset (reboot)
This control lead is pulled up to 1v8 and protected from noise by the adjacent resistor, capacitor, and diode combination.

Either pad on the cntrl lead could be used, but to spare some possible grief the pad furthest from existing parts will be used.
(Attach-5: reset-cntrl)

Power on/off
This control lead is pulled up to 1v8 and protected from noise by the adjacent resistor, capacitor, and diode combination.

Either pad on the cntrl lead could be used, but to spare some possible grief the pad furthest from existing parts will be used.
(Attach-6: power-cntrl)

USB Boot
This control pair require a more sophisticated handling than a simple connect to ground (like the two controls above do).

Also, these control leads from the SoC are driven by one of the 3v3 supply rails.
The result of those two facts will require a few parts to interface the boot-mode leads to the FTX bit controls.

FTX CB Leads
These leads will have to be re-configured from the factory default by re-programming the chip's on-board eeprom.

But the Micro-FTX board supplies 4 such control bits and we need only 3 of them.
The re-programming of the Micro-FTX will be the next step in taking control of the KT2. Ah, which is the reason I did not indicate which of CB0 ... CB3 will be used on the pics. ('cause I don't know yet )

PS:
Yes, the power on/off and the reboot (hardware reset) have been confirmed to be working as expected.

[eschwartz]

Awesome! So, the first step to eventually finding a new jailbreak.

Got an ETA yet?

[knc1]

Originally Posted by eschwartz

Awesome! So, the first step to eventually finding a new jailbreak.

Got an ETA yet?

No ETA.

I understand that the PW2, KV, and maybe the PW1 has these same pad sets exposed.

But yes, of course, that is why I am going to all this trouble.

Worse comes to worse, the end user will have to open the device and force the Kindle to boot from an image we provide on a USB stick.
But no ETA - I am not even sure if I can get it booting from USB.
(But we do have access to known good boot images . Recent versions of Buildroot can generate i.MX6 serial boot images.)

[knc1]

I took leedjc's PW2 picture from: https://www.mobileread.com/forums/sho...96&postcount=9
(Attach-1)

And GIMP'd it almost to death to supplement this thread for the PW2 owners.
(Attach-2)

Not shown is a good place to pick-up the 1v8 interface reference lead.
Someone with an open'd PW2 please assist in finding a good reference point to use.

Edit:
One 1v8 location shown in this post:
https://www.mobileread.com/forums/sho...25&postcount=3

[knc1]

After reviewing FTDI's free drivers and libraries - -
I decided to go with the OpenSource equivalent:
http://www.intra2net.com/en/developer/libftdi/index.php
and
http://developer.intra2net.com/git/?p=libftdi;a=tree
open and read the README.build in the above tree.

- - - - -

Until I can think of a better way - -
I will probably just define some new control key combinations in MiniCom sources.

I.E: A terminal emulator that can hardware reset, power on/off, and (maybe) USB boot any of the i.MX6 Kindles.
At least one can dream.

[knc1]

Originally Posted by knc1

I took leedjc's PW2 picture from: https://www.mobileread.com/forums/sho...96&postcount=9
(Attach-1)

And GIMP'd it almost to death to supplement this thread for the PW2 owners.
(Attach-2)

Not shown is a good place to pick-up the 1v8 interface reference lead.
Someone with an open'd PW2 please assist in finding a good reference point to use.

After GIMP'ing that PW2 pic some more (see attachment), I am not sure if the control leads have been de-populated or not.

Someone with an open PW2 please check S501 and S502 pad sites for me.

Hint: helps if you have a mirror so you can watch both the display and what you are doing on the back-side.

Tests:
Use a short, stiff, length of light gage, insulated wire - stripped bare at both ends. Something like 20 .. 24 gage solid wire will do fine.

Hold by remaining insulation (I.E: protect Kindle wiring from human body static).

Momentarily connect one of the called out, proposed, connection points to gnd.

S501: Expect an immediate, hardware triggered, full re-boot.

S502: Expect the Kindle to "turn off" (with cleared screen) or to "turn on" (I.E: resume).

If the missing CR500 and CR501 are required, nothing will happen (nor will any harm be done).
If they **are not** required - then the controls should work as expected (and no harm will be done).

- - - - -

Note: the above tests have been performed on the KT2 and they work exactly as labeled.

- - - - -

Note: You might want to forego the coffee for a few hours prior to the above testing - -
The test points are a tad bit smaller in real-life than shown in the picture attached.
Steady hands are required.

[knc1]

Due to the overwhelming non-response from PW2 owners, I will drop that from consideration for now at least.

For use in the KT2 - the MicroFTX board really needs to be built in a low profile version.
I.E: Currently has a surface mount micro-usb connector, needs to have a micro-usb connector that mounts with its centerline on the board centerline (like at least some kindles have).

For now, I will just fake it by physically hacking up a high profile version into a low profile version.

Lucky for us, Jim Paris has OpenSourced all of his design files:
http://jim.sh/ftx/#design-files

The PCB board layout requires (at least) Eagle V.6:
http://www.cadsoftusa.com/download-eagle/?language=en

But I think that the "Freeware" version should also work:
http://www.cadsoftusa.com/download-e...e/?language=en

EDIT:
Confirmed, the "Freeware" version (for Linux) easily handles the Jim Paris files (in the *.zip archive).

(The *.pdf files are **OUTPUTS** of the board layout program.)

- - - - - -

Next development step (skipping over the days of work between now and then):

The board breaks out 4 of the 'cb' pins -
This far I have only committed to using 2 of them (reset and on/off) -
They can be programmed as inputs (also) -
I will set the other two as inputs, and use them to monitor the levels on the two "USB boot" leads beginning with a hardware reset.

Expected:
That they will be the "boot mode" leads during reset -
The "boot mode" leads will be scanned by the hardware during reset -
After reset, they may (or may not) be re-programmed as other signals (the PW2 silk screen seems to indicate that one of them becomes one of the JTAG leads).
The boot mode leads are not multiplexed, but then these may not be the actual boot mode leads from the SoC.

But I suspect the hardware around them is setup so that the same type of single pole, momentary contact, switch was used to just hold the two leads connected during the reset scan, and to do no harm if held (or pushed) after the reset scan completes.

(They used (or are using) the same board for development as for production. We will learn if lab126 has shot themselves in the foot (again) with that decision. )

Edit-2:
Added drawing of typical mid-mount, micro-usb connector for the low profile adapter board as attachment-5.

Edit-3:
Added tech. sheet on switch chip.
The MicroFTX "cb" outputs are open-drain with a 75k ohm pull-up.
So far, the chip's I/O cells are referenced to 1v8 (since that matches the serial port I/O levels).
But the boot-mode lines need to be connected together (I am assuming here) to emulate a mechanical switch.
Plus, they are running on the 3v3 supply rail(s).

Hence, the added-in, switch chip.
And since they come in four per package ...
There are enough for all four "CB" outputs, if required by another project.

Edit-4:
Added tech. sheet on level translation chip.
Decided on setting up the layout to hold 2, 2 bit wide, level translators.
Which seems to be the most generally useful layout, even though we only need one (or maybe two) bits worth (I.E: a single chip) worth of translation.

This chip will handle any (common) logic level found in today's logic (except 1v2 and 1v5 cell phones) and translate it to any of the choosen adapter chip's i/o levels (1v8, 3v3 or 5v0).

[knc1]

Added the mid-line mount connector drawing to the above collection.
Will replace this post with something useful - someday, RSN.
- - - -
Crud! Phooey!

Could not find a mid-mount micro-usb connector to salvage in a house-full of electronic junk, had to order new ones.

- - - -

Well, the idea of having "dev Kindles" with built in serial/USB port that includes at least 4 hardware control lines is just too tempting to me - -
I order everything in sets of 10.

Yeah, as if anyone in the world other than myself would want a "dev Kindle".

[Glorfindel]

Originally Posted by knc1

After GIMP'ing that PW2 pic some more (see attachment), I am not sure if the control leads have been de-populated or not.
Someone with an open PW2 please check S501 and S502 pad sites for me.
Hint: helps if you have a mirror so you can watch both the display and what you are doing on the back-side.
Tests:
Use a short, stiff, length of light gage, insulated wire - stripped bare at both ends. Something like 20 .. 24 gage solid wire will do fine.
Hold by remaining insulation (I.E: protect Kindle wiring from human body static).
Momentarily connect one of the called out, proposed, connection points to gnd.
S501: Expect an immediate, hardware triggered, full re-boot.
S502: Expect the Kindle to "turn off" (with cleared screen) or to "turn on" (I.E: resume).
If the missing CR500 and CR501 are required, nothing will happen (nor will any harm be done).
If they **are not** required - then the controls should work as expected (and no harm will be done).
- - - - -
Note: the above tests have been performed on the KT2 and they work exactly as labeled.
- - - - -
Note: You might want to forego the coffee for a few hours prior to the above testing - -
The test points are a tad bit smaller in real-life than shown in the picture attached.
Steady hands are required.

If I had a PW I would help :\

[knc1]

Originally Posted by Glorfindel

If I had a PW I would help :\

I have the PW, the above was about the PW2, which I don't have.

And if someone wants to post some better board pictures than those we already have here of the KV (which I don't have) ....
That would probably help.

- - - - -

PS: There is no "secret site" to be invited to, this thread is just me.

[knc1]

Originally Posted by knc1

- - - - -
Added tech. sheet on switch chip.
The MicroFTX "cb" outputs are open-drain with a 75k ohm pull-up.
So far, the chip's I/O cells are referenced to 1v8 (since that matches the serial port I/O levels).
But the boot-mode lines need to be connected together (I am assuming here) to emulate a mechanical switch.
Plus, they are running on the 3v3 supply rail(s).

Hence, the added-in, switch chip.
And since they come in four per package ...
There are enough for all four "CB" outputs, if required by another project.

Hmm...
Use the four "CB" outputs as a 4-bit bus (possible with this adapter) -
Add 1-of-16 decoder -
Add as many as 16 buffer/driver/switches -

More than enough for every button on a K4 to be remote controlled over the USB-to-serial adapter.

[knc1]

An overview of current level translation challenges in modern digital devices.

This overview is two pages from a TI technical note, so just ignore the "buy TI" bias, its the overall situation that I am presenting here.

[pghaworth]

Nice - all of it! Nothing better than a nice cup of tear-down in the morning. Thanks!