Yet another reverse engineering blog

Sunday, December 21, 2008

PRS-700 internals and disassembly

I already knew a bit about PRS-700 internals from the sources published by Sony, but looking inside allowed me to confirm guesses and find out some new things. So what's new in PRS-700?

The main change is the CPU - Sony switched from iMXL to iMX31L. It is much faster (up to 532MHz instead of 200MHz) and has an ARM11 core (with ARMv6 instruction set) versus ARM9 in iMXL. It also includes USB2.0 OTG controller and SDHC/MS controllers, which allowed Sony to get rid of separate USB and flash card controller chips, though they did have to add an NXP ISP1504 USB tranciever.
Another chip they dumped is the 2MB NOR flash which housed the bootloader and some other rarely updated info. Now everything is stored on the NAND flash, which doubled in size (512MB instead of 256MB). RAM size was also doubled to 128MB.
The E-Ink controller is now Epson/E-Ink's "Broadsheet" S1D13521 (was E-Ink's Metronome), which has its own separate 8MB of RAM for extra display speed. Asahi Kasei DAC got replaced by Wolfson's WM8350 codec, which also includes power management, battery control and real-time clock. The sub-CPU which handles keys and touch screen is now a 16-bit Renesas R8C/2A, replacing the 8-bit H8/38004.
On software side, Linux kernel was upgraded to 2.6.23 (compiled with gcc 4.2) from 2.4.17 (gcc 2.95.3), and glibc got replaced by uClibc.

See my Flickr gallery for step-by-step PRS-700 disassembly guide. It was a bit trickier than PRS-505, so take care. When assembling, make sure there is nothing between E-Ink and touch screen, any foreign particles stand out really good when you turn on the built-in light.


Anonymous said...

I just had a quick look into the kernel source published by Sony. I could not find driver for the Epson Broadsheet.. also, no input devices are configured (but the Linux input event API is enabled). Could it be closed sourceby Sony? Also: does the reader have touchscreen?

Igor Skochinsky said...

@Anonymous: broadsheet driver is in linux-2.6.23_081002/drivers/broadsheet. Keys and touchscreen are handled by the subcpu, which talks to the main cpu over /dev/ttymxc1. Unfortunately, that protocol is not published.

maxlawbr said...

I posted a note in mobileread forum, I'm having problem attaching the power on switch, the plastic part don't "connect" the internal switch, it stay at the right side of the switch.
I've tried to pull the up cover, and force the plastic part to the left side and then assembly the up cover, but nothing happen.
Do you have any light? I'm from Brasil and sony don't fix the reader here, and I'd like to try to fix it.
Thanks a lot,

Anonymous said...

Great on Flicker! However, I would really like to print the main board front with the labels. It seems the labels go away when I print. Thanks for this.

Katherine said...

Igor, I have a PRS-700 that is marked as Version: D.E.M.O. 100002T. Do you know how i can change the firmware so that it can be a fully functional unit?