EZX Platform Overview
From OpenEZX
Taken from Harald Welte's OpenEZX slide presentation (Dec 2005) available here as a pdf.
Original Disclaimer: All Information is based on observation (of A780), and may be wrong
Contents |
[edit]
Hardware
[edit]
Family Names
Bulverde refers to the Intel PXA CPU platform, of which all EZX phone models are currently a subset.
EZX family subset names and their handsets (some help here)
- A780: A780,E680
- Barbados:
- Martinique: A910
- Hainan: A1200
- Sumatra: Rokr E2
- Macau: Rokr E6
- Penglai:
- Ohau:
[edit]
Processors
- A Motorola Neptune LTE based mobile phone (BP) plus
- A PXA270 Xscale (AP) based PDA in one case
[edit]
Application Processor (PXA270)
- Runs heavily modified linux-2.4.20 kernel
- 48MB RAM
- 32MB "wireless" StrataFlash
- contains bootloader, kernel, rootfs, /ezxlocal, /usr/setup and a logo bitmap.
- software-configurable clock speed up to 400MHz
- JTAG port on test pads, BSDL file and JFlash available
- SPI/SSP interface to PCAP and BP
- directly attached to LCD display
- directly attached to touch screen, buttons
- directly attached to camera module
[edit]
Baseband Processor (Neptune LTE Platform)
- contains ARM7TDMI for GSM stack
- contains 566xx DSP for digital baseband
- JTAG port on test pads, but no BSDL file
- Connected to Application processor via USB
- SPI/SSP interface to PCAP and AP
- UART connected to AGPS processor
- Connects to GSM SIM module
- 8MB external flash
- 2MB external RAM
[edit]
AGPS Processor (Motorola Telematics MG4100)
- Attached to UART of BP
- Has it's own Flash and RAM (2MB?)
[edit]
PCAP2
- Power management, Clock and Audio Peripheral (PCAP)
- produces 16 different voltages
- handles all mono/stereo audio
- connected to 2 speakers, microphone, vibrator
- clock generation
- SPI/SSP interface to AP and BP
- Backlight control
[edit]
RF Subsystems (A780)
[edit]
RF6003
- fractional-n RF synthesizer
[edit]
RF2722
- GPRS/EDGE capable receiver (RX)
[edit]
RF3144
- quad-band power amplifier (TX)
[edit]
Flash chips (DiskOnChip based MCP)
- 16MB SDRAM
- 64MB DiskOnChip G3
- contains /diska and /usr/language
[edit]
Software
[edit]
linux-2.4.20
- MontaVista "mobilinux" additions
- dynamic power management
- EZX arm subarchitecture
- low-level drivers for:
- SPI/SSP
- PCAP Audio (mono/stereo/headset/...)
- Vibrator (/dev/vibrator)
- USB host port attached to BP
- USB device port (belcarra usbd, not gadget)
- Transflash/SD/MMC
- THREE proprietary flash file systems
- Intel VFM (hatcreek.o)
- m-systems DiskOnChip (tffs.o)
- third unknown
- A1200 and ROKR E2 have custom Selinux static kernel module called motoac
The modified Linux kernel used on the Motorola Linux phones has been released by Motorola on SourceForge:
Multiple versions are available:
- linux_kernel_a760_2.tar.bz2 seems to be based on Linux 2.4.18, and was uploaded to SourceForge on 2004-08-09.
- Judging from drivers/misc/ezx-log.c it seems to contain code for the A760 only.
- original_kernel.tar.gz seems to be based on Linux 2.4.20, and was uploaded to SourceForge on 2005-07-01.
- original_kernel_2.tar.gz seems to be based on Linux 2.4.20, and was uploaded to SourceForge on 2006-01-06.
The Linux Kernel running on (most) EZX smartphones is a 2.4.20 based kernel, with the following modifications:
- Lots of hardware (cpu/architecture) related patches to mips/ppc/arm from MontaVista
- Drivers for
- PXA270 Dynamic Power Management
- PXA270 SD/MMC Controller (depending on firmware version statically linked !!)
- Camera (v4l2 driver)
- Keypad
- Buttons
- PXA270 Framebuffer
- PXA270 Touchscreen
- IPC (AP<->BP) USB Host
- USB Device (Belcarra usbd, _not_ the Linux gadget driver)
- Proprietary kernel modules for
- USB IPC demultiplex (mux_cli)
- GPRS (gprsv)
- Intel VFM (hatcreek) flash file system
- Generic code is released by Intel upon request, but not GPL-compatible
- MSystems TrueFFS (tffs) flash file system
- Acts as a translation layer between VFAT and the underlying flash device
- vfat is only required to achieve USB mass storage compatibility for Windows boxes
- Logging/testing of AP, BP and DSP (logger)
For in depth analysis of the code see CodeAnalysis
[edit]
Modules
[edit]
mux_cli.o
- hooks into special functions of USB host driver
- provides GSM TS07.10 (de)multiplex
- userspace has tty devices
[edit]
gprsv.o
- implements GPRS line discipline for mux_cli ttys
- hooks into netfilter to intercept DNS packets ?!?
- provides gprs0 / grps1 network devices
[edit]
ipsec.o
- proprietary ipsec stack (don't we already have two GPL licensed?)
- Copyright Certicom Corp
[edit]
Libraries
- glibc
[edit]
Bluetooth
- proprietary userspace program directly opens HCI
[edit]
GPS
- no NMEA, no serial device emulation :(
- proprietary library via mux_cli kernel module
[edit]
UI
- embeddedQt
- Motorola EZX toolkit
- Low-level devices (framebufffer, etc) accessable.
[edit]
Partitions
| CodeGroup | size | description |
| CG0 | 200B | BP |
| CG1 | 2.4M | BP |
| CG2 | 448k | |
| CG3 | 27k | |
| CG18 | 2k | BP |
| CG32 | 856k | mtd1 linux kernel |
| CG33 | 24M | cramfs root |
| CG34 | 5.5M | mtd2 vfm fs /ezxlocal |
| CG35 | 11M | tffsa cramfs /usr/language |
| CG36 | 32k | cramfs master .cfg files |
| CG37 | 128k | mtd3 "logo" partition. gzipped 16 bit 240x320 windows bmp |
| CG38 | 19M | ttfsb (ttfsb1) vfat /diska |
| CG39 | 196B | |
| RDL0 | 128k | ram downloader? |
| RDL3 | 241k | ram downloader? |
# cat /proc/mtd dev: size erasesize name mtd0: 00020000 00008000 "Bootloader" mtd1: 000e0000 00020000 "Kernel" mtd2: 00580000 00020000 "VFM_Filesystem" mtd3: 00020000 00020000 "Logo"
[edit]
Bootloader
- EZX bootloader
- based on GPL licensed blob
- low-level initialization code (GPIO config, clock, ...)
- vendor specific USB device allows for:
- transfer of executable code from USB host
- execution of transferred executable
- serial console code is present in binary (but not used)
- PST/RSD firmware updates work by uploading a "ramloader"
[edit]
"Enhanced Mini USB" (EMU)
[edit]
Port Modes
- Depending on pullup/pulldown/... resistors
- USB device port
- Serial port (RS232 at 3.3V levels)
- Stereo audio signal
- 500mA charger
- Carkit (easy install, professionally installed)
- Factory test
[edit]
USB Configurations
- Official configs
- cdc_acm (serial modem emulation for host pc)
- USB mass storage (transflash and VFAT-on-TFFS devices)
- Undocumented configs
- usbnet "network-BLAN"
- Network device over USB
- Allows telnet into phone
- PST
- Mode used by PST Windows App
- DSPlog
- Apparently a way to dump data from DSP
- NetMonitor
- supposedly for GSM network monitor
- cfg11 (ROKR E2)
- ??
- usbnet "network-BLAN"

