1. Making a Phone Call with Phase Change Memory Justin Treon Embedded Linux Conference Session W-130-C April 15, 2008

2. Copyright © 2008 Numonyx B.V. Page 2 Objective Explain Techniques I Use to Modify This Phone Phase Change Memory –Changes required for PCM Bit-Alterable Writing

3. Copyright © 2008 Numonyx B.V. Page 3 Project Goals PCM Demonstration Platform –Realistic Device Make a phone call –Utilize Bit Alterable Features The Problem –Original Phone: 48 MB of RAM and 1.8V V18 NOR Flash x32P ball-out –Modified Phone: 32 MB of RAM and 3.3V PCM SDRAM: x16D ball-out PCM: EZBGA ball-out

4. Copyright © 2008 Numonyx B.V. Page 4 Modifying the Phone Page 4 Copyright © 2007 Numonyx B.V. Modifying the Phone Communicating with the Phone Changing the System Memory

5. Copyright © 2008 Numonyx B.V. Page 5 JTag and UART Depopulated Phone –Memory Stack –Applications Processor

6. Copyright © 2008 Numonyx B.V. Page 6 JTag and UART Depopulated Phone –Memory Stack –Applications Processor Manufactured a Debug Board –Cut phones apart to make connectors Special thanks to Daniel Willmann

7. Copyright © 2008 Numonyx B.V. Page 7 JTag and UART Depopulated Phone –Memory Stack –Applications Processor Manufactured a Debug Board –Cut phones apart to make connectors Debugging Tools –Intel® XDB Debugger –Albatross BDI 2000 Ethernet Capable

8. Copyright © 2008 Numonyx B.V. Page 8 Boot Log Dmesg through BusyBox –Not very useful if it is not booting Boot Log Over UART Disabled –Boot Log disabled to decrease boot time Boot Log to Display – Kept the display in TEXT mode Commenting out: vt_cons[conp->vc_num]->vc_mode = KD_GRAPHICS;

9. Copyright © 2008 Numonyx B.V. Page 9 Enable Serial Port Hardware pins available, but not enabled Enabled the STUART in the Bootloader Modified the CRAMFS Root Image to Provide a Login Prompt –Adding the following to /etc/inittab: T0:23:respawn:/sbin/getty -L ttyS2 115200 vt100 Special thanks to Daniel Willmann

10. Copyright © 2008 Numonyx B.V. Page 10 EZBGA to x32P Converting from x16D to x32P From EZBGA x16D –Converting from 1.8V to 3.3V

11. Copyright © 2008 Numonyx B.V. Page 11 Going from 48MB to 32MB Original Phone had 48MB of SDRAM Modified Phone has 32 MB of SDRAM Changes to the Boot Loader Memory Map apboot/src/blob/HW_init.c @@ -165,7 +165,7 @@ {0xA0000000, 0x00F00000, 0x0a},// SDRAM Bank 0, 15M, B=0, C=1 {0xA0F00000, 0x00100000, 0x02},// SDRAM Bank 0, 1M, B=0, C=0 {0xA1000000, 0x01000000, 0x0a},// SDRAM Bank 0, 16M, B=0, C=1 - {0xAC000000, 0x01000000, 0x0a},// SDRAM Bank 3, 16M, B=0, C=0 + // Change to the map to only use 32MB of SDRAM {0,0,0x0}// end };

12. Copyright © 2008 Numonyx B.V. Page 12 Modifying the Kernel Memory Usage Changes to the Kernel’s Use of Memory Banks Kernel/arch/arm/mm/init.c @@ -443,6 +443,8 @@ unsigned int bootmap_pages, bootmap_pfn, map_pg; int node, initrd_node; +mi->nr_banks = 2; /* Hack to use 32MB of SDRAM */ + bootmap_pages = find_memend_and_nodes(mi, np); bootmap_pfn = find_bootmap_pfn(0, mi, bootmap_pages); initrd_node = check_initrd(mi);

13. Copyright © 2008 Numonyx B.V. Page 13 Enabling PCM Page 13 Copyright © 2007 Numonyx B.V. Enabling PCM PCM Technology How to Integrate Drivers Driver Feed Back

14. Copyright © 2008 Numonyx B.V. Page 14 Phase Change Memory Made From The Same Material as Re-Writable CDs NOR NAND RAM Execution XIP Fast Writes No Erase, Bit Alterability NVM RAM PCM

15. Copyright © 2008 Numonyx B.V. Page 15 PCM System Benefits Software for Flash Memories can be Simplified –Erase/write in background, block management, garbage collection, etc.. Overwrite Capability Allows Simplification of Software Stack –Flash Translation Layer is no longer needed –Improves system level performance File and Chunk Size MB/s FAT on PCM (FAT + FTL) on Flash Defrag ON > x5

16. Copyright © 2008 Numonyx B.V. Page 16 New Commands Backwards Compatible –Traditional erase and write commands are backwards compatible No Need to Erase Blocks with PCM –New Commands Bit-Alterable Write One Word Bit-Alterable Buffer Write

17. Copyright © 2008 Numonyx B.V. Page 17 Updating the CFI tables Original phone used Common Flash Interface 1.3 Our PCM used CFI version 1.5 @@ -326,6 +347,10 @@ goto need_more; nb_parts = extp->extra[extra_size - 1]; +/* skip the sizeof(partregion) field in CFI 1.4 */ +if (extp->MinorVersion >= '4') +extra_size += 2; + for (i = 0; i < nb_parts; i++) { struct cfi_intelext_regioninfo *rinfo; rinfo = (struct cfi_intelext_regioninfo *)&extp->e

18. Copyright © 2008 Numonyx B.V. Page 18 Adding Bit-Alterable Support For a MontaVista 3.0, Based on Linux Kernel 2.4.20 –Changes to: drivers/mtd/chips/cfi_cmdset_0001.c drivers/mtd/mtdblock.c drivers/mtd/mtdpart.h include/linux/mtd/mtd.h The Majority of Changes to cfi_cmdset_0001.c –Adding: static int cfi_intelext_overwrite_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *); static int cfi_intelext_overwrite_buffers(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);

19. Copyright © 2008 Numonyx B.V. Page 19 Enabling a Desktop Filing System Minor Changes to drives/mtd/mtdblock.c static int mtdblock_writesect(struct mtd_blktrans_dev *dev, unsigned long block, char *buf) { struct mtdblk_dev *mtdblk = mtdblks[dev->devnum]; struct mtd_info *mtd = mtdblk->mtd; size_t retlen; int ret; ret = (*(mtd->overwrite))(mtd, block<<9, 512, &retlen, buf); if (ret) return ret; if (retlen != 512) { printk("mtdblock: EIO error\n"); return -EIO; } return 0; }

20. Copyright © 2008 Numonyx B.V. Page 20 Acknowledgements Abatron BDI 2000 – www.abatron.ch – High speed debugger developers, gdb compatiblewww.abatron.ch BusyBox – www.busybox.net – Compact suite of toolswww.busybox.net InetD daemon – www.e2mod.com – author unknownwww.e2mod.com OpenEZX – www.openezx.org – Organization devoted make EZX phones truly Open phoneswww.openezx.org

21. Copyright © 2008 Numonyx B.V. Page 21

22. Copyright © 2008 Numonyx B.V. Page 22 Dead Phones 8 Phones used for project –2 Work Malfunctioning Phones –1 Used for Signal Tracing –1 Damage to Baseband –2 Lost Pads During Rework –1 Damaged Power Circuitry –1 Reasons Unknown

23. Copyright © 2008 Numonyx B.V. Page 23 Key Learnings Start With At Least 4 Phones Fasten Down All Boards and Cables Add or Make Connectors –Saves pads –Makes it portable

24. Copyright © 2008 Numonyx B.V. Page 24 System Assembly