kobo® glo [sic] HD hacking [part 1]

Whilst I’m very fond of trees and don’t want to turn the world’s forests into housing estates. I do have a number of e-book readers. They mostly don’t work as a replacement for paper as they’re either too small, too slow, lack the ability to scribble notes or lack resolution. however there are now 300dpi e-paper screens which at least fixes one of those problems.

I have a goodly number of the kobo mini e-readers around the place as wireless displays and wondered if the now 300 dpi kobo glo HD could be similarly used.

If you’re not interested in the insides, you might want to skip to part 2 now.

The kobo glo HD has a 300 dpi 1440×1070 screen, and inside theres:

• a 1GHz i.MX6Solo MCIMX6L7DVN10AB processor
• 512Mb of LPDDR2 Nanya RAM NT6TL128M32A0
• a 4GB SD card which holds the bootloader kernel and filesystems
• a Texas  msp430g2302 mcu which drives the front light.
• a Ricoh rc5t619 PMU and RTC which manages the battery.
• a Texas tps65185 PMIC to generate the peculiar voltages that e-paper needs.
• a Neonode zForce NN1001 IR touchscreen controller
• A 40 pin chip labeled NN2003 (presumably more zForce magic)
• A CyberTAN WC121 wifi module (contaning a Broadcom 43362)

This looks promising so I pulled the SD card and imaged it:

Offset	Sector	Contents
0x0	0	MBR Partition table
0x200	1	Serial #
0x400-0x7fdff	2-1022	U-Boot
0x7fe00-0x7ffff	1023	? (read by u-boot)
0x80000-0xbffff	1024-1535	hwconfig (read by ntx_hwconfig)
0xc0000-0xdffff	1536-1791	U-Boot config
0xe0000-0xeffff	1792-1919	?
0xf0000-0xffdff	1920-2046	?
0xffe00-0xfffff	2047	?
0x100000-0x5fffff	2048-12287	Kernel
0x600000-0x6ffdff	12288-14334	Zeroes
0x6ffe00-0x6fffff	14335	?
0x700000-0xefffff	12288-30719	?Waveform data
0xf00000-	30720-	First partition

The rest of the data on the card is described by the partition table

Partition	Type	Offset	Size	Contents
1	0xb (FAT32)	30720	524289	Ext4 software
2	0x83 (Linux)	555010	524289	Ext4 recovery
3	0x83 (Linux)	1079300	6632445	FAT32 content

There are also 4(‽) serial ports. The main console, used by u-boot and linux, ttymxc0, can be found at the top right. It’s the usual 3.3V 115200 baud affair.

The boot process looks like this:

kobo publish u-boot and kernel trees on github, the kernel tree builds relatively simply, but it lacks a competent e-ink auto update algorithm like marek’s kobo mini kernels. It’s easy to port that across, the only subtlety is that the width of the screen isn’t divisible by 16 so we modify it to use 8×8 CRCs.

I’ve modified the .config to match the modules that are found in the kobo filesystem.

The kobo repository doesn’t seem to have any wireless drivers – it appears they use some version of the broadcom dhd driver, I didn’t have the stomach for fighting with that so decided to use the mainline kernel driver.

Since the kobo kernel is 3.0.35, I, foolishly, started with backports-3.10.19-1 and then had to patch it to support the Broadcom 43362 chip used in the kobo.  A more foolish person would start with backports-4.2.6-1 or backports-3.18.1-1, both of which are incompatible with 3.0.35 and don’t appear able to drive the chip. You’ll also need firmware and parameters for the wireless – which you can pull from the original kobo SD card in /lib/firmware/wc121

/bin/ntx_hwconfig -s -p /dev/mmcblk0

will tell you what hardware you have (mine’s an E60Q90)

For compiling, you can either build on the device itself, or use one of the android pre-built tool-chains.

For the filesystem I debootstrapped an armv7l rootfs from a Debian machine.

All that’s left is to assemble the SD card from the parts above:

Make a root partition from sector 32768, copy the data from from original card from sectors 1 thru 30719.  Copy the uImage kernel (from make uImage) into the card at sector 2048.

Debootstrap Debian into the root partition, install the kernel modules from the kernel build, and the modules from the backports build, Edit /etc/fstab and /etc/shadow (if you have a Debian system mkpasswd -m sha-512 will generate the hash for you), and you’re done.

Finally hook up a serial cable put in your SD card and hit the power button and you should get something like this.

Continue to part 2.

All the code mentioned (with the exception of Debain 7.9 and the firmware can be donwloaded from my kobo-glo git repository)