LaForge's home page (Posts about a780)https://laforge.gnumonks.org/blog/tags/a780.atom2022-06-21T07:49:57ZHarald WelteNikolaMy reason for being away from OpenEZXhttps://laforge.gnumonks.org/blog/20061204-openezx_openmoko/2006-12-04T03:00:00+01:002006-12-04T03:00:00+01:00Harald Welte<p>
This post should have been posted months ago, but only since very recently I'm
allowed to talk about the real reason. You might have read about it, if you
read my full blog, but I'm posting this again in the 'a780' category to make it
appear on <a href="http://planet.openezx.osmoocm.org/">planet.openezx.org</a>
</p>
<p>
I've been hired to be key element in the design and implementation of the <a href="http://www.openmoko.com/">OpenMoko</a> platform and the first device it
supports: The Neo1973 phone. While there is no provision in the contract
preventing me from working on the OpenEZX project at all, this assignment has
just sucked up all available time like a vacuum cleaner.
</p>
<p>
To OpenEZX developers, users and supporters: Please be assured that most of the
work done on OpenMoko will eventually benefit OpenEZX quite a lot. So please
stay tuned, and concentrate on the low-leve device-specific issues that need to
be resolved with the Motorola EZX hardware :)
</p>A1200 LSM / SELinux updatehttps://laforge.gnumonks.org/blog/20060915-a1200-lsm/2006-09-15T03:00:00+02:002006-09-15T03:00:00+02:00Harald Welte<p>
James Morris got quite interested when I told him that the A1200 uses SELinux
to lock out the users (owners!) from their own phone ;) So we both did some
further analysis, and it turned out that Motorola had actually released the
source code to their own policy engine (MotoAC) with the A1200 kernel sources
on <a href="http://opensource.motorola.com/">opensource.motorola.com</a>, whcih
is good.
</p>
<p>
Still we didn't understand why you would use an unmaintained, at least three
years old version of SELinux to base a forked policy engine on it - but
obviously this is the world of Free Software and everybody is allowed to make
his own decisions.
</p>
<p>
I've also catched up with the A1200 in general and found out that people have
already managed to flash their own kernel into it, whcih is great. I wish I had
more time to put into <a href="http://openezx.osmocom.org/">OpenEZX</a> at this point,
turning it into something that is actually useful. <i>HINT: Skilled volunteers
needed</i>.
</p>
<p>
<a href="http://pavelmachek.livejournal.com/28110.html">Pavel Machek apparently
got one</a> and is annoyed by the restrictive SELinux policies. By now I'm quite sure that it's not all too difficult to get rid of them ;)
</p>ROKR E2 Linux Phone reviewhttps://laforge.gnumonks.org/blog/20060901-rokr_e2-review/2006-09-01T03:00:00+02:002006-09-01T03:00:00+02:00Harald Welte<p>
There has been an extensive <a href="http://www.osnews.com/story.php?news_id=15678&page=1">review of the Linux based Motorola ROKR E2 phone</a> at osnews.com.
</p>Wanted: Author and/or sources for EZX "qonsole" applicationhttps://laforge.gnumonks.org/blog/20060829-qonsole-author-sources/2006-08-29T03:00:00+02:002006-08-29T03:00:00+02:00Harald Welte<p>
The original author of the KDE "Konsole" program, Lars Doelle, <a href="http://www.motorolafans.com/index.php?name=News&file=article&sid=79">is
actively looking for the Author and/or the source code of the "qonsole"
program</a>, a terminal program for the Motorola EZX platform that is
apparently derived from GPL licensed Konsole.
</p>
<p>
Since the legal status of qonsole never was clear, I always refused to host it
on any of the <a href="http://openezx.osmocom.org/">OpenEZX</a> project resources.
I didn't really know of any GPL violation going on, but had a somewhat strange
feeling.
</p>
<p>
If any of you has information on where the qonsole program originates, please
make sure to inform either Lars or me about it. We know by now that it
appears to originate from some Chinese or Singapore mobile phone forums.
</p>
<p>
It's good to see more software authors of GPL licensed programs actually caring
about enforcement of their license :) I sincerely hope this can be resolved and
qonsole either distributed in gpl-compliant way, or a re-implementation be found/made.
</p>Motorola ROKR E2https://laforge.gnumonks.org/blog/20060710-rokr_e2/2006-07-10T03:00:00+02:002006-07-10T03:00:00+02:00Harald Welte<p>
I've found the ROKR E2, which is yet another Motorola Linux GSM/GPRS phone
exclusively sold in china so far. Apparently since June 22nd, so it's a quite
new thing. It's very different from the A7xx/E680x series in that it doesn't have a
touch screen, but many more buttons. Also, it features a full-size SD card
slot, which makes it theoretically SDIO compatible (I'm pretty sure they use some SDIO compatible SD host controller in there).
</p>
<p>
Let's see whether I can work with the Chinese language firmware. I already
found out how to get it into boot-loader flash mode (by pressing the camera
button on the upper right side while powering the device up). It looks
completely different than the blob on the A780/E680, but that doesn't really
mean anything.
</p>
<p>
As of now, I don't have any technical proof that the device runs Linux. I'll
probably not find time to play with this toy before I get back to Germany.
But if anyone has hints or further information on how to dig deeper into the
ROKR E2, don't hesitate to send me an email about your findings.
</p>Motorola A728 and A732https://laforge.gnumonks.org/blog/20060708-a728-a732/2006-07-08T03:00:00+02:002006-07-08T03:00:00+02:00Harald Welte<p>
Just next to my hotel, there is a book store that also sells mobile phones.
Among the Motorola models are the A728 and A732, both Linux based. They're
about 160EUR each. I don't yet know whether that is a good price, but now
after checking with some online shops I think it is.
</p>
<p>
So I guess I'll get one of each in order to investigate whether we can hack
them from an OpenEZX point of view. Also, this finally allows me to obtain
proof whether they're still shipping GPL incompliant or not.
</p>
<p>
I'll continue to look for an A768 and E895. Let's see whether I'll find some
time to do some more serious 'shop browsing'.
</p>Some small A780 progresshttps://laforge.gnumonks.org/blog/20060623-ezx6-mux_cli/2006-06-23T03:00:00+02:002006-06-23T03:00:00+02:00Harald Welte<p>
I've continued my work on porting the ts07.10 from Motorola's mux_cli to 2.6.x.
It now compiles, although I have no idea whether it actually works as expected.
</p>
<p>
Since Linux 2.5/2.6 has undergone quite some sophisticated changes in both
scheduling/context area (no more struct task_queue) as well as the tty layer
(dynamically allocated and managed flip buffers, etc), the task has been a bit
more challenging than the usual copy+paste+minor_fixup task.
</p>
<p>
I'll also be releasing the -ezx6 kernel soon (2.6.17 based) in the next couple
of days, where I plan to merge mickey's various driver bits (LED, backlight,
keypad fixes) and the above-mentioned mux_cli.
</p>Interview on OpenEZX at LWN.nethttps://laforge.gnumonks.org/blog/20060612-lwn-interview/2006-06-12T03:00:00+02:002006-06-12T03:00:00+02:00Harald Welte<p>
For those interested, <a href="http://lwn.net">lwn.net</a> is featuring the
first part of an <a href="http://lwn.net/Articles/186972/">interview withe me
on the status of the OpenEZX project</a>. The way longer pert of the interview
on <a href="http://gpl-violations.org/">gpl-violations.org</a> will be posted
within the next two weeks.
</p>
<p>
Now let's hope that I'll be able to fix that nasty netfilter bug that I'm
hunting for weeks now and get back to OpenEZX kernel hacking...
</p>Not working on OpenEZX at the momenthttps://laforge.gnumonks.org/blog/20060607-busy/2006-06-07T03:00:00+02:002006-06-07T03:00:00+02:00Harald Welte<p>
Due to lots of other "real life" and "real work" constraints, I'm not able to
work on OpenEZX for at least another week :(
</p>Porting Motorola's TS07.10 MUX driver to 2.6.xhttps://laforge.gnumonks.org/blog/20060527-mux_cli/2006-05-27T03:00:00+02:002006-05-27T03:00:00+02:00Harald Welte<p>
Since Motorola has finally released the source code for the mux_cli.o and
gprsv.o modules of their 2.4.17 kernel on <a href="http://opensource.motorola.com">opensource.motorola.com</a>, I've started
to clean them up and port them to 2.6.x.
</p>
<p>
Due to the questionable coding style of that original source code, and the many
interface changes in the TTY layer between 2.4.x and 2.6.x, this turns out to
be a bigger task than expected. With some luck, I'll find some time tomorrow
at <a href="http://ph-neutral.org/">ph-neutral</a> to finish the initial port.
</p>
<p>
Once that code works on 2.6.x, I already have a quite long list of TODO's.
First of all, the lower-layer interface needs to be cleaned up. Ideally, the
whole TS 07.10 implementation is a TTY line discipline that can be stacked on
top of any UART, together with a virtual/fake UART that makes use of the
Motorola specific TS07.10 USB transport.
</p>Touch-screen driver for A780/E680, lots of other progresshttps://laforge.gnumonks.org/blog/20060519-touchscreen/2006-05-19T03:00:00+02:002006-05-19T03:00:00+02:00Harald Welte<p>
As of today, the OpenEZX project has a working touch screen driver. I've been
testing this with the Kdrive X11 server of OpenEmbedded, and it seems to work
nicely on my A780 after calibrating with ts_calibrate.
</p>
<p>
This is such a major step forward, since the touch-screen driver requires a
functional PCAP2 driver, which in turn comprises working SPI support, as well as some
tricky SPI-during-hardirq for interrupt chaining.
</p>
<p>
If you're interested in giving it a try, there's the <a href="http://people.openezx.osmocom.org/laforge/kernel/patches-2.6.16-2.6.16.13-exz6.tar.bz2">the
-ezx6 quilt patchset</a> including all this work.
</p>
<p>
Also, thanks to the work by Michael 'mickey' Lauer, I've managed to set up an
<a href="http://www.openembedded.org/">OpenEmbedded</a> environment to build a
distribution for OpenEZX. You can find the first <a href="http://people.openezx.osmocom.org/laforge/a780oe/">bunch of packages</a> as well
as <a href="http://people.openezx.osmocom.org/laforge/a780-openzaurus-root-20060518.tar.bz2">a
root filesystem that you can put on TransFlash</a> on my OpenEZX developer
pages.
</p>
<p>
The availability of a OE based root filesystem, a kernel with keypad,
touch-screen, usbnet and framebuffer support actually means that all the [G]UI
people can now start to work on making their favourite UI system work on OpenEZX.
Given the amount of interest I've seen in this area, I'm confident that I still don't
(yet) need to dive into UI development myself but can stay with the more
technical low-level stuff.
</p>
<p>
Speaking of which, I've also hacked a nice tool called <a href="http://svnweb.openezx.osmocom.org/cgi-bin/viewcvs.cgi/trunk/src/gpiotool/">gpiotool</a>,
using which you can read/write GPIO configuration as well as individual GPIO
pins from userspace. If I had written this earlier on, it would have saved a
lot of time and hassle. But then, it's always hard pushing yourself to develop
code that _just_ aids development and doesn't really add any functionality
itself.
</p>
<p>
Using this tool I'm now investigating the AP/BP interaction (handshake). Let's
hope that we can actually use the phone as a phone really soon.
</p>Motorola launching opensource.motorola.comhttps://laforge.gnumonks.org/blog/20060515-motorola-opensource/2006-05-15T03:00:00+02:002006-05-15T03:00:00+02:00Harald Welte<p>
Motorola seems to be making some progress internally. Today they've announced
the availability of <a href="http://opensource.motorola.com/">opensource.motorola.com</a>, a web site
dedicated to free and open source software used and developed in/by Motorola.
This is apparently also the portal where they are starting to publicize the
source code for their Linux based Smartphones.
</p>
<p>
While the source code there is not complete in any way [yet], it actually
includes the kernel sources for the A1200 phone, too. After a quick read
through it, it seems to be very similar to the A780 code (because of a very
similar hardware architecture).
</p>
<p>
Some of the differences are:
</p><ul>
<li>FOTA (Flash on-the-air)</li>Basically a function by which network operators
can modify the flash memory of your phone, thereby forcing software updates
onto you. Not something completely new in the GSM world, but something that always gives me the creeps as a security professional.
<li>Power Management</li>Apparently the power management capabilities were extended to provide better battery life time.
<li>Minor differences in boot loader / kernel handover</li>
<li>SE Linux</li> Yes, they're actually using SE Linux features on a phone. I haven't yet tried to figure out for what, but usually you would assume that the mobile phone vendors/operators use it to lock their users out of the phone, rather than protecting the users from the evil outside world.
</ul>A full day of EZX driver developmenthttps://laforge.gnumonks.org/blog/20060514-slow-progress/2006-05-14T03:00:00+02:002006-05-14T03:00:00+02:00Harald Welte<p>
Today wasn't exactly the most efficient day of development I ever had.
Basically, the amount of progress made after 13 hours of hacking in the area of
EZX device drivers is extremely slow. It didn't even help to not eat, not
cook, and not get out of the bed for the whole day. Basically I started with
"let's fix this quickly before breakfast", but it wasn't fixed even when I stopped
working at 11pm.
</p>
<p>
My new SPI driver seems to be working fine, but I have massive problems with
all the PCAP drivers. This is mainly touch-screen, but also ADC for reading
battery voltage, etc. Somehow I cannot get it to produce any IRQ's.
</p>Debian sarge root filesystem image for EZX phoneshttps://laforge.gnumonks.org/blog/20060512-sarge-root/2006-05-12T03:00:00+02:002006-05-12T03:00:00+02:00Harald Welte<p>
In order to get other developers going quickly, I have now provided a Debian
sarge (arm) root filesystem and a corresponding kernel plus instructions.
</p>
<p>
Anyone who wants to see a stock Debian installation boot on his EZX phone,
have a look at the files published <a href="http://people.openezx.osmocom.org/laforge/">here</a>.
</p>OpenEZX virtual host runninghttps://laforge.gnumonks.org/blog/20060511-vhost/2006-05-11T03:00:00+02:002006-05-11T03:00:00+02:00Harald Welte<p>
I've finally found the time to configure the OpenEZX virtual host. This means
that I now have absolutely no problems to hand out developer accounts on
openezx.org. I've also moved the EZX related subversion repository from
gnumonks.org to this machine.
</p>
<p>
If you're working on free software for Motorola EZX smartphones, and are interested
in getting some account where you can host your project(s) in svn / git, dump
some code on http/ftp or just want a openezx.org email address, please let me know.
</p>Working on Bluetooth and GPRS/GSM supporthttps://laforge.gnumonks.org/blog/20060511-bt-gprs/2006-05-11T03:00:00+02:002006-05-11T03:00:00+02:00Harald Welte<p>
I've been working a bit on getting Bluetooth and GPRS/GSM support into my 2.6.x
based kernel for the A780. Both are quite a bit challenging, even more than I initially thought so.
</p>
<p>
As for Bluetooth: In theory there is a bcm2035 chip, compatible to the
Bluetooth HCI specification, attached to ttyS1 (BTUART) of the PXA270.
However, there are some power management related additional signals hooked up
to GPIO signals. I think I'm configuring them right, though. Also, there is
some indication that the bcm2035 actually requires a bit of firmware loaded
into it. Without a vendor data sheet and with only some stripped proprietary
Motorola dload program this will require quite a bit more of investigation.
</p>
<p>
My initial 'demand' for Bluetooth would have been the possibility to use my
Apple BT keyboard with the framebuffer console, providing a local console in
case telnet dies for some reason.
</p>
<p>
On the GSM/GPRS front (yes, we actually want to use the phone as a phone
sometimes), I've been wading through disassembled gprsv.o and mux_cli.o code.
Both re-implementations are progressing slowly, but steadily.
</p>
<p>
The easier part seems to be mux_cli.o. I've now started to write some libusb
based userspace code to test a ts07.10 implementation in userspace via the USB
endpoints to the BP. Once the userspace code seems to be working, I can work
on a kernel level implementation. The good thing about this is that there are
actually quite a few GSM phones that support this multiplex on their serial
port. So the resulting mux/demux driver will actually be useful for more
people, not just Motorola Linux smartphone owners.
</p>A780/E680: SPI driver using hardware SPI controllers workinghttps://laforge.gnumonks.org/blog/20060429-ezx_spi/2006-04-29T03:00:00+02:002006-04-29T03:00:00+02:00Harald Welte<p>
So apparently there is no obvious reason for Motorola's driver using bit-banging
rather than the controllers inside the PXA270. I now have a modified Motorola
driver on 2.6.16.5 running that uses the SPI controller for the bus to PCAP2.
Getting my own driver running should therefore be quite fast now.
</p>
<p>
I've also hacked a bit on the keyboard side, although it's not working yet.
</p>Working on new SPI/SSP drivers for OpenEZX kernelhttps://laforge.gnumonks.org/blog/20060427-ezx_spi/2006-04-27T03:00:00+02:002006-04-27T03:00:00+02:00Harald Welte<p>
One of the fundamental interfaces on the Motorola EZX phones is SPI, which
interconnects (among others) the PCAP2 peripheral with the PXA270. Motorola
ships their 2.4.20 kernel with some ugly piece of spaghetti code driver for it.
Apparently they've had difficulties driving the PXA27x SPI controller, and in
the end decided to just 'bit-bang' the signals over GPIO. Obviously that's
inefficient and CPU-intensive. I hope there is no real hardware problem
preventing the use of the embedded SPI controllers.
</p>
<p>
First I started writing a driver against arch/arm/mach-pxa/ssp.c, only to
discover later that this code actually predates (and therefore doesn't use) the
generic drivers/spi/ interface. Since I'm a fan of generic interfaces, I chose
to write a PXA generic driver for the drivers/spi interface, plus some EZX
specific glue code for it.
</p>
<p>
One of the interesting bits is that the PCAP2 can interrupt the PXA, and it
then acts as an external interrupt controller, whose registers you can access
over SPI. So a PCAP2 interrupt can mean that some touch-screen event happened,
that the headphone, USB or microphone jack state has changed, etc. All those
various real interrupt sources need to be fed to individual distinct drivers
(audio, touch-screen, USB). The Motorola kernel uses an ugly kludge of callback functions that those drivers can register with the SSP/SPI driver.
</p>
<p>
So in my new driver, I choose to actually model that bit of PCAP2 functionality
as an external interrupt controller. This way the actual sound/touch-screen
driver can just do request_interrupt() like they usually do.
However, this means that I need to access SPI from within hardirq
context, which again doesn't mix well with the architecture of the drivers/spi
code (which is asynchronous and queues requests). So I need to implement a
couple of synchronous SPI functions in addition to that.
</p>
<p>
This is now a lot of code, and I'm about to test and debug it, which is
expected to be time-consuming and boring. I'll post a status update as soon as
there's more information.
</p>OpenEZX: USB Ethernet support workinghttps://laforge.gnumonks.org/blog/20060422-kernel26-udc/2006-04-22T03:00:00+02:002006-04-22T03:00:00+02:00Harald Welte<p>
After lots of hacking at FISL 7.0 in Porto Alegre, I've managed to get the
PXA27x USB device controller to work in USB Ethernet emulation to work. I can now
actually ping and telnet to the 2.6.16.5-running E680, using a debootstrapped
Debian/ARM on SD-Card.
</p>
<p>
I'll publish the patches in one or two days, when everything has stabilized a
bit, and the debugging code has been removed.
</p>
<p>
Also, at the event here, I've managed to convince quite a number of Free
Software people that those Linux smartphones are actually quite interesting
toys. Most notably, Keith Packard of Xorg fame has indicated he would probably
be getting one and working on a lightweight UI. This motivates me even more to have
a stable and fully working kernel environment finished soon.
</p>2.6.16.5 boots on EZX phoneshttps://laforge.gnumonks.org/blog/20060417-ezx-2616/2006-04-17T03:00:00+02:002006-04-17T03:00:00+02:00Harald Welte<p>
I've finally managed to get a 2.6.x kernel running on the Motorola A780 and
E680. Apparently the problems I encountered are part of 2.6.14 (which was
current mainline when I started the port). After merging my patches into
2.6.16.5, everything suddenly worked fine ;)
</p>
<p>
So what I've got now:
</p><ul>
<li>kernel 2.6.16.5 booting on both A780 and E680</li>
<li>USB host controller towards Neptune BP working</li>
<li>USB device controller partially working</li>
<li>MTD support for all flash partitions</li>
<li>SD/MMC support on E680 (TransFlash on A780 not working yet)</li>
<li>Framebuffer working on both models, with nice 4x6 tiny font</li>
</ul>
<p>
The main obstacle now is that TransFlash on the A780 is not working yet. The
A780 is actually more important than the E680. For some strange reason, all
the response bytes from the TF card appear to be zero (at least that's what the
response FIFO of the PXA27x embedded SD/MMC controller reports). I've already tried a lot, but am a bit clueless after many hours of trial and error :(
</p>State of OpenEZX 2.6.x kernel developmenthttps://laforge.gnumonks.org/blog/20060417-kernel26-status/2006-04-17T03:00:00+02:002006-04-17T03:00:00+02:00Harald Welte<p>
During my two days of <a href="http://openezx.org/">EZX phone hacking</a>, I've
made significant progress. Probably the most important discovery was how to
get a serial console on the USB plug, enabling other people to do further kernel
development without physically modifying the phone - but it's still a long way
to go.
</p>
<p>
A current list of TODO's:
</p><ul>
<li>find out why kernel doesn't boot with CONFIG_IWMMXT</li>
<li>find out why E680 SD/MMC works, but not A780 TransFlash</li>
<li>debug and fix pxa27x_udc in order to provide usbnet (nfsroot!)</li>
<li>debug and fix mtd support in order to be able to access system flash</li>
<li>port and cleanup video and sound drivers</li>
<li>port Motorola-specific SSP/SPI drivers into 2.6.x generic SPI stack</li>
<li>port all the driver specific dpm bits from Motorola's 2.4.20 to 2.6.x</li>
<li>clean up the already working keypad drivers</li>
<li>finish re-implementation of mux_cli and grpsv modules</li>
<li>look into re-implementing the proprietary flash fs drivers, though I don't think
that is particularly important, we could run our code 100% on SD/TransFlash</li>
<li>create a modified bootloader that allows for multi-boot configurations. It could
actually include SD/TF support for booting kernels from there.</li>
<li>check how the other (later) Motorola Linux smartphones differ and merge their
device-specific code into our 2.6.x kernel tree</li>
<li>last, but not least, we need to do something about userspace. I'm not a GUI guy
at all, and I haven't yet thoroughly investigated all the existing projects like
OPIE, etc. I'm sure once the hardware support is there, some more GUI-savvy people
will do something in that area, though.
</li></ul>
<p>
So why am I stating this here? Because it's up to _you_ to help and take care
of one of these tasks if we want to see the dream of having a fully-free
software E680/A780 before they get phased out ;)
</p>Running a serial console on the A780https://laforge.gnumonks.org/blog/20060416-ezx-sercons-hacking/2006-04-16T03:00:00+02:002006-04-16T03:00:00+02:00Harald Welte<p>
After about half a day of trial and error (which was related to a totally
different problem, as it turned out), I now have a 2.4.20-based kernel with
working serial console for my A780. Unfortunately the console requires
soldering four wires onto test pads of the PCB - something that I achieved with
0.1mm diameter magnet wire (Kupferlackdraht for you Germans). The magnet wires
are thin enough to get them through the TransFlash slot to the outside, without
having to modify the case.
</p>
<p>
If you're interested in a bootup log captured from the STUART, check <a href="http://svn.gnumonks.org/trunk/a780/src/stuart-test/stuart.S">this one</a>.
</p>
<p>
The rest of the day was spent debugging why my (still 2.6.14 based) kernel
doesn't want to boot on the machine. As it turns out, booting stops somewhere
in the early initialization after head.S has called <i>decompress_kernel()</i>.
Debugging this problem has also caused me to actually write some ARM assembly
code. For years I'm reading and debugging ARM code, but I've never actually
written ARM asm from scratch. So my assembly code now prints one character for every stage of the booting process (ABCDEFGHI) and then stops. At the time the
C code should print its first character, the device is already gone. So maybe something with the setup of the registers according to C calling convention, or setup of stack/heap is erroneous.
</p>
<p>
Interestingly, that startup code has not really changed all that much from
2.4.20 (which runs) and my 2.6.14 based kernel.
</p>
<p>
It's not unlikely that I'm [again] hunting a totally different problem. I'll probably merge my patches into 2.6.17-rc1 and see whether that works...
</p>Obtaining Asian Motorola EZX phones in Europehttps://laforge.gnumonks.org/blog/20060411-motorola_asian_phones/2006-04-11T03:00:00+02:002006-04-11T03:00:00+02:00Harald Welte<p>
A couple of days ago, <a href="http://gnumonks.org/~laforge/weblog/2006/04/08#20060408-looking_for_linux_phones">I
was looking for a way to obtain Motorola Linux Smartphones in Europe</a>, i.e.
those plenty of models that are not officially sold anywhere but China and
other areas of Asia.
</p>
<p>
I've now found a suitable importer specialized in importing Asian phones into
the European market. In case you're interested, feel free to contact me for
more details. The phones range between EUR 180 and EUR 300, but there's a
minimum order of five phones. I'll probably be ordering around early may.
</p>Looking for Motorola Linux phoneshttps://laforge.gnumonks.org/blog/20060408-looking_for_linux_phones/2006-04-08T03:00:00+02:002006-04-08T03:00:00+02:00Harald Welte<p>
Since right now I only have E680i and A780, I would be interested in a way to
obtain E896, A1200, A910, A768, A760, A732, A728 as well as ROKR E2. Most of them seem
to be mainly sold in China / Taiwan.
</p>
<p>
If anybody knows a good source (importer in Europe) or some other way how to
get these phones in the western half of the world, let me know.
</p>
<p>
Direct import would also be possible, but I'd need to know a serious exporter in .cn/.tw
in order to do so. Any suggestions welcome.
</p>planet.openezx.org launchedhttps://laforge.gnumonks.org/blog/20060408-planet/2006-04-08T03:00:00+02:002006-04-08T03:00:00+02:00Harald Welte<p>
In the tradition of my main project netfilter (which has a <a href="http://planet.netfilter.org/">planet.netfilter.org</a>, I've now also
opened a planet site for the <a href="http://openezx.osmocom.org">OpenEZX</a> project at
<a href="http://planet.openezx.osmocom.org/">planet.openezx.org</a>.
</p>
<p>
This should give users the ability to stay up to date with current developments
in the Motorola Linux smartphone hacking community.
</p>
<p>
If you know of any feeds that I should add to this planet, please let me know
</p>Booting kernels on A780 / E680https://laforge.gnumonks.org/blog/20060407-kernel-booting-problemx/2006-04-07T03:00:00+02:002006-04-07T03:00:00+02:00Harald Welte<p>
It's a bit strange that I still have so much difficulty running my own kernel
on the phone. As it appears, there are some subtle hardware (or bootloader?)
version differences that made me struggle for so long.
</p>
<p>
Two out of my three A780, and my one E680 don't boot any self-compiled kernels
but rather just crash. The third A780 however boots them just fine.
</p>
<p>
Obviously, as Murphy's law indicates, the phone it works on is my 'production'
phone, i.e. the one I use for my day-by-day phone needs.
</p>
<p>
We really have to get to the bottom of what's going on here. Also, if there really
are differences, then Motorola has to publish the kernel source for both versions under
the obligations of the GPL. So far they have only released a single version.
</p>Downloading and executing your own code in RAM of EZX phoneshttps://laforge.gnumonks.org/blog/20060327-usb_boot/2006-03-27T03:00:00+02:002006-03-27T03:00:00+02:00Harald Welte<p>
In the last two days I've written a <a href="http://svn.gnumonks.org/trunk/a780/src/boot_usb/">small program</a> that
allows you to utilize part of the built-in firmware update mechanism of the
Motorola EZX phones. In fact, what it does is to download an arbitrary (max
1MB) piece of code from the PC to the phone via USB, and then execute that code
on the phone.
</p>
<p>
On the one hand, this might look like a security hole (but well, nobody really
cares about security on mobile phones anyway). On the other hand, this should
definitely speed up kernel and driver development within the <a href="http://openezx.osmocom.org/">OpenEZX</a> project, since it basically removes
the need to flash the phone for testing of some new code.
</p>
<p>
Also, once a working driver for the TransFlash slot has been cooked up, it
would actually be possible to usb-boot the phone into an OS that mounts its files
from TransFlash. This doesn't touch a single bit of flash memory and is therefore
ideal for development and probably even something similar to what 'live CD'
distributions are to PC systems.
</p>There's hope for running our own kernel on the A780https://laforge.gnumonks.org/blog/20051118-kernel-hope/2005-11-18T03:00:00+01:002005-11-18T03:00:00+01:00Harald Welte<p>
Ok, now I am in contact with one guy that managed to run a working kernel that
he compiled himself from the source code that Motorola Hong Kong has published.
</p>
<p>
This finally confirms that the kernel (even though it was requested for E68)
works on a A780 without further modifications. On the other hand, I'm a bit
puzzled why it won't work here. To figure out where the problem is, I've asked
him to pass me the exact source tar-ball that he was using, plus detailed
information on his cross toolchain.
</p>
<p>
I've also started over again from a 'vanilla' Motorola kernel tree and will
give it another try. If this works, I'll re-try with the serial console, and if
that works, move on to the 2.6.x tree (which I'm planning to make public this
weekend, btw).
</p>
<p>
Meanwhile, I have confirmed that the bootloader is actually based on blob, and
thus also needs to be released under the GPL. This, in turn, should facilitate
the development of a GPL licensed host-side replacement of PST for flashing the
phones.
</p>
<p>
I'm a bit worried since I'm busy with many other things over the next couple of
weeks. But even while travelling, I'll have the full toolchain, sources, and
everything with me.
</p>linuxdevices reports on OpenEZX, quote from Motorola executivehttps://laforge.gnumonks.org/blog/20051029-linuxdevices/2005-10-29T03:00:00+02:002005-10-29T03:00:00+02:00Harald Welte<p>
<a href="http://linuxdevices.com/">linuxdevices.com</a> <a href="http://www.linuxdevices.com/news/NS9440744013.html">reports</a> about
OpenEZX. In that report, it quotes Motorola's chief architect of mobile devices: <i>Motorola had no immediate plans to support native Linux applications on its phones, in part due to carrier concerns about network health, security, and interoperability.</i>.
</p>
<p>
This is just not true. In fact, the A780 as it ships in Germany comes with a
native GPS navigation and routing application called "CoPilot". Also, since
the whole GSM stack runs on a different CPU than the Linux OS, there are no
security/interoperability/network health concerns that I could think of.
</p>
<p>
Also, I have received reports that Motorola actually distributes a Linux SDK to
selected third party vendors. Parts of those SDK's (the header files for the
EZX libraries) have actually leaked, which support the position that there is a SDK.
</p>
<p>
In many ways, the EZX phones are a combination of a traditional Neptune-based
Motorola GSM phone, plus a Linux-based PDA. Therefore, if any native Linux
apps on the PDA half could influence the 'network health' in a negative way,
then any other Neptune based phone could, too.
</p>OpenEZX wiki was launchedhttps://laforge.gnumonks.org/blog/20051023-openezx-wiki/2005-10-23T03:00:00+02:002005-10-23T03:00:00+02:00Harald Welte<p>
Thanks to my friends at <a href="http://www.maintech.de/">maintech</a>, The <a href="http://openezx.osmocom.org/">OpenEZX</a> project now has a <a href="http://wiki.openezx.osmocom.org/">Wiki</a>.
</p>
<p>
I've only added some very basic information, but I hope that developers and
users especially from <a href="http://www.motorolafans.com/">motorolafans</a>
will contribute soon.
</p>
<p>
One of the important things we need soon is a project logo, for both the
website and the wiki. Volunteers welcome :)
</p>Massive Response to OpenEZX announcementhttps://laforge.gnumonks.org/blog/20051021-massive_response/2005-10-21T03:00:00+02:002005-10-21T03:00:00+02:00Harald Welte<p>
When I launched the OpenEZX page two days ago, I didn't expect such a massive
(press) response to it.
</p>
<p>
All I did was to write a small announcement to my weblog, and it was picked up
by a lot of press, such as <a href="http://lwn.net/Articles/156260/">lwn.net</a> and <a href="http://www.golem.de/0510/41140.html">golem.de</a>.
</p>
<p>
Looks like this blog is read by a lot of people, and there's nothing I can't
post here that doesn't get immediately distributed to a lot of places. Amazing ;)
</p>
<p>
Also, I've even received multiple requests for EZX-based consulting. Apparently
there are companies who're interested in a 'fully programmable GSM phone'.
</p>
<p>
On a side-note, even Bruce Perens has now bought an A780 since he thinks it's
"fun to hack". David Miller is pondering to buy one after his holidays in
Korea... Let's only hope that they will actually find some time to get work on
the EZX phone done. It's vital to have some basic running code ASAP in order
to get more people to hack on stuff like the user interface.
</p>
<p>
After two days of full-time EZX kernel hacking, I now have a compiling
2.6.14-rc4 based kernel that has already half of the EZX-specific drivers
merged.
</p>
<p>
I didn't really test to flash that kernel to a phone yet, mostly because I
currently don't have an original E680 firmware that I could flash into the
device if anything goes wrong. Also, before trying ti flash the kernel, I'd
preferably like to have JTAG running. I'll publish my kernel tree as soon as
I have confirmed it actually boots on the device.
</p>
<p>
Unfortunately I also have real work to do, and today is a full-time
gpl-violations.org day, the weekend will probably be spent with some more
librfid hacking. Stay tuned for some more OpenEZX news next week.
</p>There are other (more advanced) Linux Phone projectshttps://laforge.gnumonks.org/blog/20051021-other-open-phones/2005-10-21T03:00:00+02:002005-10-21T03:00:00+02:00Harald Welte<p>
Since I'm getting that much coverage, I want to redirect some of that in the
direction of the already-existing (and way more advanced, as of now) Linux
phone projects.
</p>
<p>
There are multiple mobile phone projects at <a href="http://handhelds.org/">handhelds.org</a>, esp. for the <a href="http://handhelds.org/moin/moin.cgi/HpIpaqH6315">iPAQ H6315</a> and the <a href="http://handhelds.org/moin/moin.cgi/BlueAngel">HTC BlueAngel</a>.
</p>
<p>
I didn't know about any of these projects so far, but I'll certainly look at
their codebase and see whether any of the high-level (user interface) code
could be re-used. But let me finish the low-level driver/operating system
part first :)
</p>OpenEZX.org project launchedhttps://laforge.gnumonks.org/blog/20051019-openezx_org/2005-10-19T03:00:00+02:002005-10-19T03:00:00+02:00Harald Welte<p>
Today I've started a small preliminary homepage about my A780/E680 hacking
efforts at <a href="http://openezx.osmocom.org/">openezx.osmocom.org</a>. This also means
that the old a780-hackers@lists.gnumonks.org list was renamed to
openezx-devel@lists.gnumonks.org.
</p>
<p>
Expect no big news for some time, since I'm mostly working on porting/merging
all EZX specific stuff into a 2.6.14-rc4 kernel.. a quite big job that will
certainly take some time.
</p>
<p>
Stay tuned.
</p>E680 has arrivedhttps://laforge.gnumonks.org/blog/20051018-e680/2005-10-18T03:00:00+02:002005-10-18T03:00:00+02:00Harald Welte<p>
I've managed to obtain a 2nd hand E680 phone, which is based on the same
Motorola EZX platform as the A780. The E680 are only sold in Asia, so the
device I now have is actually a Chinese model.
</p>
<p>
Next on the plan for A780/E680 hacking is playing with the JTAG port, and
trying to flash a non-OEM non-branded non-chinese firmware into the E680.
</p>
<p>
Once JTAG is running, I will be trying to port the drivers to a 2.6.14-ish
kernel and compile and install that more recent kernel.
</p>A780 batteries/charger dead?https://laforge.gnumonks.org/blog/20051016-a780-bat-jtag/2005-10-16T03:00:00+02:002005-10-16T03:00:00+02:00Harald Welte<p>
I'm unable to recharge any of my two A780 batteries, at least not via USB.
Since I'm travelling, I cannot try with the real power-supply charger. Let's
hope I can somehow resolve this, and it isn't really some damage to the phone's
built-in charging controller :(
</p>
<p>
On the A780 hacking front, I've now successfully confirmed that there are
indeed JTAG pads on the PCB, both for the PXA270 and for the ARM7TDMI, which is
great news.
</p>
<p>
I also think there is still hope that the USB device port could actually be
used as a host port. At least the PXA270 supports various options for OTG.
Now the big question is only whether this is compatible with Motorola's
overloading of the USB (called Enhanced Mini USB).
</p>More A780 hackinghttps://laforge.gnumonks.org/blog/20051001-a780-hacks/2005-10-01T03:00:00+02:002005-10-01T03:00:00+02:00Harald Welte<p>
Today was a very exciting day of more A780 hacking. You know, from time to
time it's quite good to do something else than stupid netfilter development or
the like ;)
</p>
<p>
So what I've been able to do? Well, I analyzed most of the device drivers from
userspace side. I now know the key-codes of every keypad or other
button/wheel/dial on the device, I know the touch screen and framebuffer. I can
control the three different backlights.
</p>
<p>
Then I've learned a bit more about the architecture of the phone. The Xscale
processor (PXA270 Bulverde) actually uses USB to talk to the Neptune chip.
Neptune is a DSP with a synthesized ARM7TDMI on-chip. The PXA270 runs in host
mode, the Neptune in device mode.
</p>
<p>
Interestingly, the Motorola developers have debugging callbacks in the stock
kernel. So by registering a simple kernel module with the USB rx/tx
functions, I now have hexdumps of the USB traffic between those two chips (also
called AP and BP).
</p>
<p>
Then I called the a780, and I immediately received some nice hexdumps in the
kernel ring buffer. The first thing I could spot was "IP:
"+4930xxxxxxxx",1\r\n". There it was, the incoming phone number :)
</p>
<p>
Some other nice guy at motorolafans.com has managed to replace the proprietary
userspace Bluetooth code with the stock Linux BlueZ codebase. He's working on Bluetooth keyboard support... that would really be nice. Using a Bluetooth keyboard with the Qonsole terminal emulator (or even a framebuffer console) of your phone :)
</p>
<p>
I'm really confident that the AP<->BP protocol can be worked out fairly
quickly. Once this is done, we can start developing our own "phone" programs,
and get rid of all the bloated embeddedQT and Java crap that is running on the
phone. It has 48MB of physical ram, and the database daemon has a resident size
of 2.7MB, the address book 4.5MB, the "phone" program has 6.6MB. This is
really ridiculous...
</p>
<p>
At the end of the road, I'm dreaming of something small and efficient, running
uClibc, busybox, DirectFB, ...
</p>
<p>
The USB device port of the device is called "Extended Mini USB (EMU)", because
it apparently can be switched in more than half a dozen of different modes (by
assigning various pull-up/pull-down resistors). Apart from a USB device, it can
for example run a UART on that port. However, since the USB host port is
already used for Bulverde<->Neptune communication, I don't think it is possible
to run the phone in USB host mode. This basically rules out attaching a stock 802.11 wifi USB adapter, which is very sad.
</p>More fun with the Motorola A780https://laforge.gnumonks.org/blog/20050930-a780-ext3-nfs/2005-09-30T03:00:00+02:002005-09-30T03:00:00+02:00Harald Welte<p>
I've now successfully built a compatible toolchain for the Motorola A780,
thanks to <a href="http://marcus.bluetroll.se/e680/">this good site with
instructions</a>.
</p>
<p>
Obviously, one of the first things to do was to build <a href="http://busybox.net/">busybox</a> with a config that enables all the
missing tools. For some strange reason, the A780 does not ship with the usual
uClibc/busybox combination, but with the straight GNU tools (glibc, fileutils,
...). Unfortunately important bits such as less, top, strace, etc. were missing.
</p>
<p>
I've also managed to build matching ext2,jbd,ext3,sunrpc,nfsd and af_packet
kernel modules. The VFAT partition on the TransFlash card was shrunk, and an
ext3 partition added. Some hooks into the startup scripts, and now the ext3 is
mounted when the phone is switched on. Some PATH and LD_LIBRARY_PATH mangling
in .profile, and I have a very workable environment on the phone.
</p>
<p>
Obviously the most important goal would be to port the EZX arm architecture
support into a recent 2.6.x kernel, and then run a full-fledged 2.6.x kernel on
the device. With embedded IPsec, packet filtering, etc. That goal is very
far, due to stupid proprietary device drivers.
</p>
<p>
So for now, I'll be looking into the kernel/userspace API's and the
userspace/userspace API's in order to develop native userspace applications
that can actually use the phone (i.e. make voice/data calls, use the
headset/speaker/microphone, ...
</p>Running netfilter/iptables on your cellphonehttps://laforge.gnumonks.org/blog/20050930-a780-iptables/2005-09-30T03:00:00+02:002005-09-30T03:00:00+02:00Harald Welte<p>
Yes, you're reading this right. I've managed to build iptables.o, ipt_*.o,
iptable_filter.o, iptable_nat.o, ip_conntrack.o and the like for my Motorola
A780 cellphone.
</p>
<p>
As of now, there's not really all that much need for it... but when I start running dozens of applications on the device, I better make sure to have a decent packet filter to the GPRS/HSCSD world.
</p>
<p>
But even then, in theory it should now be possible to NAT between the GPRS
device one one side, and the usb-lan on the other side. Maybe I should try to
bring my whole home network online via the A780 :)
</p>
<p>
OTOTH this doesn't fix the various security issues on the horizon. The A780
apparently ships zlib-1.1.3. I don't even know how many security
vulnerabilities were fixed since then...
</p>Obtaining a root-shell on the Motorola A780https://laforge.gnumonks.org/blog/20050913-motorola-a780-rootshell/2005-09-13T03:00:00+02:002005-09-13T03:00:00+02:00Harald Welte<p>
I've recently acquired a Motorola A780 quad-band GSM cellphone. It's basically
an Intel PXA270 based system with 48MB flash, a 256MB TransFlash reader,
Bluetooth, a GPS receiver and MotaVista CEE Linux 3.0 (2.4.20 based).
</p>
<p>
As usual, the vendor tries to "lock down" the OS from the user. Luckily, some
nice people of <a href="http://www.motorolafans.com/">motorolafans.com</a> have
already found their way into the phone. Using their "linloader", you can put
shell scripts on the TransFlash card and execute them by clicking on them in
the explorer. Using that you can put the phone into a mode where it runs as
usbnet 'device' with telnetd and samba.
</p>
<p>
By now I've already learned quite a bit about the phone. Interestingly, they
are running glibc (not uClibc). The same goes for the rest of the device. No
busybox, but rather the standard gnu programs. So it's much less of the
typical embedded Linux environment, and more like a "regular" GNU/Linux system.
</p>
<p>
glibc-2.3.2, embedded QT, and some "ezx" class library on top. Add some J2ME
runtime environment, a handful of different filesystems (vfat, cramfs, romfs,
TrueFFS, mfs), a SD/MMC reader driver, a GPRS module, some strange "USB Logger"
(looks like syslog-over-usb) and a number of userspace programs and there you
go.
</p>
<p>
Oh, and yes, obviously the phone was delivered with no GPL license text, no source code and no written offer thereof. But that's a different chapter.
</p>