EZX Platform Overview

From OpenEZX

Taken from Harald Welte's OpenEZX slide presentation (Dec 2005) available here as a pdf.

Original Disclaimer: All Information is based on observation (of A780), and may be wrong

Contents 1 Hardware 1.1 Family Names 1.2 Processors 1.2.1 Application Processor (PXA270) 1.2.2 Baseband Processor (Neptune LTE Platform) 1.2.3 AGPS Processor (Motorola Telematics MG4100) 1.3 PCAP2 1.4 RF Subsystems (A780) 1.4.1 RF6003 1.4.2 RF2722 1.4.3 RF3144 1.5 Flash chips (DiskOnChip based MCP) 2 Software 2.1 linux-2.4.20 2.2 Modules 2.2.1 mux_cli.o 2.2.2 gprsv.o 2.2.3 ipsec.o 2.3 Libraries 2.3.1 Bluetooth 2.3.2 GPS 2.3.3 UI 2.4 Partitions 2.5 Bootloader 2.6 "Enhanced Mini USB" (EMU) 2.6.1 Port Modes 2.6.2 USB Configurations

Hardware

Family Names

Bulverde refers to the Intel PXA CPU platform, of which all EZX phone models are currently a subset.

EZX family subset names and their handsets (some help here)

• A780: A780,E680
• Barbados:
• Martinique: A910
• Hainan: A1200
• Sumatra: Rokr E2
• Macau: Rokr E6
• Penglai:
• Ohau:

Processors

• A Motorola Neptune LTE based mobile phone (BP) plus
• A PXA270 Xscale (AP) based PDA in one case

Application Processor (PXA270)

• Runs heavily modified linux-2.4.20 kernel
• 48MB RAM
• 32MB "wireless" StrataFlash
  • contains bootloader, kernel, rootfs, /ezxlocal, /usr/setup and a logo bitmap.
• software-configurable clock speed up to 400MHz
• JTAG port on test pads, BSDL file and JFlash available
• SPI/SSP interface to PCAP and BP
• directly attached to LCD display
• directly attached to touch screen, buttons
• directly attached to camera module

Baseband Processor (Neptune LTE Platform)

• contains ARM7TDMI for GSM stack
• contains 566xx DSP for digital baseband
• JTAG port on test pads, but no BSDL file
• Connected to Application processor via USB
• SPI/SSP interface to PCAP and AP
• UART connected to AGPS processor
• Connects to GSM SIM module
• 8MB external flash
• 2MB external RAM

AGPS Processor (Motorola Telematics MG4100)

• Attached to UART of BP
• Has it's own Flash and RAM (2MB?)

PCAP2

• Power management, Clock and Audio Peripheral (PCAP)
• produces 16 different voltages
• handles all mono/stereo audio
• connected to 2 speakers, microphone, vibrator
• clock generation
• SPI/SSP interface to AP and BP
• Backlight control

RF Subsystems (A780)

RF6003

• fractional-n RF synthesizer

RF2722

• GPRS/EDGE capable receiver (RX)

RF3144

• quad-band power amplifier (TX)

Flash chips (DiskOnChip based MCP)

• 16MB SDRAM
• 64MB DiskOnChip G3
  • contains /diska and /usr/language

Software

linux-2.4.20

• MontaVista "mobilinux" additions
• dynamic power management
• EZX arm subarchitecture
• low-level drivers for:
  • SPI/SSP
  • PCAP Audio (mono/stereo/headset/...)
  • Vibrator (/dev/vibrator)
  • USB host port attached to BP
  • USB device port (belcarra usbd, not gadget)
  • Transflash/SD/MMC
• THREE proprietary flash file systems
  • Intel VFM (hatcreek.o)
  • m-systems DiskOnChip (tffs.o)
  • third unknown
• A1200 and ROKR E2 have custom Selinux static kernel module called motoac

The modified Linux kernel used on the Motorola Linux phones has been released by Motorola on SourceForge:

• http://sourceforge.net/projects/a760/
• http://sourceforge.net/projects/e680/

Multiple versions are available:

• linux_kernel_a760_2.tar.bz2 seems to be based on Linux 2.4.18, and was uploaded to SourceForge on 2004-08-09.
  • Judging from drivers/misc/ezx-log.c it seems to contain code for the A760 only.
• original_kernel.tar.gz seems to be based on Linux 2.4.20, and was uploaded to SourceForge on 2005-07-01.
  • Judging from drivers/misc/ezx-log.c it seems to contain code for the A760, E680, and A780
• original_kernel_2.tar.gz seems to be based on Linux 2.4.20, and was uploaded to SourceForge on 2006-01-06.
  • Judging from drivers/misc/ezx-log.c it seems to contain code for the A760, E680, and A780.

The Linux Kernel running on (most) EZX smartphones is a 2.4.20 based kernel, with the following modifications:

• Lots of hardware (cpu/architecture) related patches to mips/ppc/arm from MontaVista
• Drivers for
  • PXA270 Dynamic Power Management
  • PXA270 SD/MMC Controller (depending on firmware version statically linked !!)
  • Camera (v4l2 driver)
  • Keypad
  • Buttons
  • PXA270 Framebuffer
  • PXA270 Touchscreen
  • IPC (AP<->BP) USB Host
  • USB Device (Belcarra usbd, _not_ the Linux gadget driver)
• Proprietary kernel modules for
  • USB IPC demultiplex (mux_cli)
  • GPRS (gprsv)
  • Intel VFM (hatcreek) flash file system
    • Generic code is released by Intel upon request, but not GPL-compatible
  • MSystems TrueFFS (tffs) flash file system
    • Acts as a translation layer between VFAT and the underlying flash device
    • vfat is only required to achieve USB mass storage compatibility for Windows boxes
  • Logging/testing of AP, BP and DSP (logger)

For in depth analysis of the code see CodeAnalysis

Modules

mux_cli.o

• hooks into special functions of USB host driver
• provides GSM TS07.10 (de)multiplex
• userspace has tty devices

gprsv.o

• implements GPRS line discipline for mux_cli ttys
• hooks into netfilter to intercept DNS packets ?!?
• provides gprs0 / grps1 network devices

ipsec.o

• proprietary ipsec stack (don't we already have two GPL licensed?)
• Copyright Certicom Corp

Libraries

• glibc

Bluetooth

• proprietary userspace program directly opens HCI

GPS

• no NMEA, no serial device emulation :(
• proprietary library via mux_cli kernel module

UI

• embeddedQt
• Motorola EZX toolkit
• Low-level devices (framebufffer, etc) accessable.

Partitions

CodeGroup	size	description
CG0	200B	BP
CG1	2.4M	BP
CG2	448k
CG3	27k
CG18	2k	BP
CG32	856k	mtd1 linux kernel
CG33	24M	cramfs root
CG34	5.5M	mtd2 vfm fs /ezxlocal
CG35	11M	tffsa cramfs /usr/language
CG36	32k	cramfs master .cfg files
CG37	128k	mtd3 "logo" partition. gzipped 16 bit 240x320 windows bmp
CG38	19M	ttfsb (ttfsb1) vfat /diska
CG39	196B
RDL0	128k	ram downloader?
RDL3	241k	ram downloader?

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00008000 "Bootloader"
mtd1: 000e0000 00020000 "Kernel"
mtd2: 00580000 00020000 "VFM_Filesystem"
mtd3: 00020000 00020000 "Logo"

Bootloader

• EZX bootloader
• based on GPL licensed blob
• low-level initialization code (GPIO config, clock, ...)
• vendor specific USB device allows for:
  • transfer of executable code from USB host
  • execution of transferred executable
• serial console code is present in binary (but not used)
• PST/RSD firmware updates work by uploading a "ramloader"

"Enhanced Mini USB" (EMU)

Port Modes

• Depending on pullup/pulldown/... resistors
• USB device port
• Serial port (RS232 at 3.3V levels)
• Stereo audio signal
• 500mA charger
• Carkit (easy install, professionally installed)
• Factory test

USB Configurations

• Official configs
  • cdc_acm (serial modem emulation for host pc)
  • USB mass storage (transflash and VFAT-on-TFFS devices)
• Undocumented configs
  • usbnet "network-BLAN"
    • Network device over USB
    • Allows telnet into phone
  • PST
    • Mode used by PST Windows App
  • DSPlog
    • Apparently a way to dump data from DSP
  • NetMonitor
    • supposedly for GSM network monitor
  • cfg11 (ROKR E2)
    • ??