PRS-700 internals and disassembly

I already knew a bit about PRS-700 internals from the sources published by Sony, but looking inside allowed me to confirm guesses and find out some new things. So what's new in PRS-700?

The main change is the CPU - Sony switched from iMXL to iMX31L. It is much faster (up to 532MHz instead of 200MHz) and has an ARM11 core (with ARMv6 instruction set) versus ARM9 in iMXL. It also includes USB2.0 OTG controller and SDHC/MS controllers, which allowed Sony to get rid of separate USB and flash card controller chips, though they did have to add an NXP ISP1504 USB tranciever.
Another chip they dumped is the 2MB NOR flash which housed the bootloader and some other rarely updated info. Now everything is stored on the NAND flash, which doubled in size (512MB instead of 256MB). RAM size was also doubled to 128MB.
The E-Ink controller is now Epson/E-Ink's "Broadsheet" S1D13521 (was E-Ink's Metronome), which has its own separate 8MB of RAM for extra display speed. Asahi Kasei DAC got replaced by Wolfson's WM8350 codec, which also includes power management, battery control and real-time clock. The sub-CPU which handles keys and touch screen is now a 16-bit Renesas R8C/2A, replacing the 8-bit H8/38004.
On software side, Linux kernel was upgraded to 2.6.23 (compiled with gcc 4.2) from 2.4.17 (gcc 2.95.3), and glibc got replaced by uClibc.

See my Flickr gallery for step-by-step PRS-700 disassembly guide. It was a bit trickier than PRS-505, so take care. When assembling, make sure there is nothing between E-Ink and touch screen, any foreign particles stand out really good when you turn on the built-in light.