The Nokia E6, the 2011 Symbian business phone with a QWERTY keypad and a 640x480 touchscreen, is getting a second life as a Linux machine. Developer fluffleswaffles has brought up Linux 6.12 on it. The project's milestone log starts with a first boot to a BusyBox shell on 13 October, and the kernel now drives the phone's own display, runs the Wayland compositor weston with the foot terminal, reads the hardware keypad and the multitouch screen, and renders GLES 2 on the phone's Broadcom VideoCore GPU. And as of 22 October, the phone no longer resets itself after four minutes.
Booting Linux on a phone with a locked bootloader
The E6 has no unlocked bootloader, so the project takes over the phone from a running Symbian install. A small Symbian app (e6bfix.sis or e6calb.sis) grabs the largest free block of physical RAM, loads an uncompressed kernel image and a device tree from the memory card, turns off the MMU and caches, and jumps into Linux. It is a one-way trip: there is no way back to Symbian without a power cycle.
Getting a picture on the screen was the hard part. The display hangs off a Broadcom BCM2727B1 (VideoCore III) over Nokia's ViSSI host bus, so the developer ran Nokia's own display drivers from a ROM dump inside the Unicorn CPU emulator, recorded every message they send to the VideoCore, and wrote a Linux driver that replays those sequences. The VideoCore firmware is pulled from your own phone's ROM at build time and is not shipped in the repository.
The four-minute reset, fixed
Until this week, the phone always reset after about 240 seconds in Linux, and the investigation first pointed at the modem side of the phone. The cause turned out to be a secure watchdog (PA_SWD) that Symbian normally services. Linux now services it too: the README's log shows kernel build #196 still running, with the watchdog serviced, at 648 seconds. The fix is opt-in for now with the e6.swd=1 boot argument.
What the hardware looks like
| Part | Details from the project |
|---|---|
| CPU | ARM1176JZF-S (ARMv6K) in Nokia's RapuYama SoC |
| RAM | 256 MiB |
| Display | 640x480 panel on a Broadcom VideoCore III |
| Input | Toshiba TC3589x keypad and Atmel maXTouch touchscreen, both over I2C |
| Storage | microSD and internal eMMC (read-only for now) |
Why it matters
This is a textbook example of embedded reverse engineering: no datasheets, no bootloader, just register probes from inside Symbian, ROM analysis and an emulator to learn how a closed driver talks to its hardware. It also shows the limits honestly. The ViSSI bus only moves about 7 MB/s, so weston manages around 9 to 16 fps in RGB565, and the developer has moved fast rendering onto the VideoCore with GLES 2, where a spinning test triangle hits 170 to 250 fps. The modem, radio, audio and power key are not supported, so this is not an everyday phone OS yet.
The kernel config, device tree, loaders, drivers and a porting guide for other RapuYama and VideoCore phones are on GitHub.
Image credit: fluffleswaffles, from the rapuyama-linux GitHub repository, placed on a blurred background.
About the author: Aswinth Raj is an electronics engineer and the editor of CircuitDigest, where he has published more than 150 hands-on projects and tutorials across Arduino, PIC, ESP32, Raspberry Pi and EV battery systems. He selects the stories on this page for what engineers and makers can actually learn or build from. Connect on LinkedIn
Add a comment
No account needed. Your comment appears once a moderator has reviewed it.