PirelliDPL10 » History » Version 22
steve-m, 02/19/2016 10:49 PM
1 | 1 | steve-m | |
---|---|---|---|
2 | 22 | steve-m | h1. Pirelli DP-L10 |
3 | 1 | steve-m | |
4 | 22 | steve-m | |
5 | The Pirelli DP-L10 is a tripleband GSM/Wifi [[VoIP]] dualmode phone, which was developed by Pirelli Broadband Solutions and manufactured by Foxconn. |
||
6 | |||
7 | 1 | steve-m | It was branded and sold by quite a few operators: |
8 | |||
9 | 22 | steve-m | * Pirelli DP-L10 |
10 | * Arcor Twintel DP-L10 |
||
11 | * Telekom TC-300 |
||
12 | * sipgate Pirelli Discus DualPhone DP-L10 |
||
13 | * free.fr Black |
||
14 | * Cubic Mobile DP-L10 |
||
15 | * Tovo t450g |
||
16 | * Eurotef-M |
||
17 | 1 | steve-m | |
18 | The phones are still available as new at various places like eBay, Pollin or rebelsimcard.com. |
||
19 | 22 | steve-m | For more information on the original firmware see the "ip-phone-forum wiki":http://wiki.ip-phone-forum.de/telefone:t-one_tc300:start (german). |
20 | 1 | steve-m | |
21 | |||
22 | 22 | steve-m | h2. Hardware |
23 | 1 | steve-m | |
24 | |||
25 | 22 | steve-m | * CPU/DBB: TI Calypso (D751992AZHH) |
26 | * ABB: TI Iota (TWL3014) |
||
27 | * GSM Transceiver: TI Rita (TRF6151) |
||
28 | * PA: SKY77328-13 |
||
29 | * Flash/SRAM: Spansion S71PL129NC0 128MBit/64MBit |
||
30 | * Wifi: Marvell 88W8385 802.11 MAC |
||
31 | *** Marvell 88W8015 802.11b/g transceiver |
||
32 | * Winbond W56940 ringtone chip |
||
33 | * Sunplus SPCA552E multimedia controller |
||
34 | * LSI-65194A1 ASIC (seems to be a DSP for [[VoIP]] en-/decoding) |
||
35 | * Silabs CP2102 USB UART (connected to UART_IRDA of the Calypso) |
||
36 | 1 | steve-m | |
37 | |||
38 | 22 | steve-m | h3. PCB |
39 | 1 | steve-m | |
40 | |||
41 | 22 | steve-m | The pcb is labelled with "T60N925", and the Foxconn internal project name seems to be "T60N925.00". |
42 | |||
43 | There are no schematics of this phone, however, steve-m has grinded down one of those boards, see the pictures of all layers "here":http://www.steve-m.de/pictures/pirelli_dpl10/ or locally at [[PirelliDPL10PCB]]. |
||
44 | |||
45 | [[Image(dpl10_front_small.jpg)]] |
||
46 | |||
47 | "large version":http://www.steve-m.de/pictures/dpl10_front.jpg |
||
48 | |||
49 | [[Image(dpl10_back_small.jpg)]] |
||
50 | |||
51 | "large version":http://www.steve-m.de/pictures/dpl10_back.jpg |
||
52 | |||
53 | "large version of RF part":http://www.steve-m.de/pictures/rf_frontend.jpg |
||
54 | |||
55 | |||
56 | h3. RF path |
||
57 | |||
58 | |||
59 | 6 | steve-m | Since this phone is a tripleband design, it uses 3 rx filters, connected to the respective Rita inputs: |
60 | |||
61 | 22 | steve-m | * Epcos B7820 for GSM900 |
62 | * Epcos B7821 for DCS1800 |
||
63 | * Epcos B7851 for DCS1900 |
||
64 | 13 | steve-m | |
65 | 22 | steve-m | Those are connected to an unknown "T 636 / 5475" antenna switch. The pinout of this switch however is identical with the Panasonic "EZFL897TB11C":http://www.panasonic.com/industrial/components/pdf/AEA0000CE1.pdf. |
66 | 9 | steve-m | The control voltage inputs of the switch are connected to the TSPACT outputs of the Calypso DBB through a Fairchild NC7NZ34 triple-buffer. |
67 | |||
68 | [[Image(dpl10_buffer.jpg)]] |
||
69 | |||
70 | |||
71 | 22 | steve-m | h3. Phone as clock generator |
72 | 3 | steve-m | |
73 | 22 | steve-m | |
74 | The idea to use an [[OsmocomBB]]-driven phone as an accurate clock source, e.g. for the USRP, by synchronizing the clock to a cell of a commercial operator was "discussed":http://lists.osmocom.org/pipermail/baseband-devel/2010-April/000322.html on the mailing list a while back. Since the USRP needs an input clock of 52MHz, but the Compal-phones only expose 13 and 26MHz, an external PLL would be required. The DP-L10 however exposes the MCLK/TSPACT11 pin of the Calypso, which is connected through the triple-buffer to the GSM900 TX/Vc3 input of the antenna switch, and thus easily accessible. When the corresponding bit in the MCU_SW_TRACE register is set, this pin outputs the 52MHz clock being fed to the ARM-core, which is phase-locked to the VCTCXO. See the blue circuit path in the picture above. |
||
75 | |||
76 | This is the output captured with a 100MHz scope (and thus limited): |
||
77 | |||
78 | |||
79 | 1 | steve-m | [[Image(mclk_buffered.png)]] |
80 | |||
81 | 11 | steve-m | After synchronizing to a cell with the phone, the frequency error measured by the DSP is in the 0-10Hz range. |
82 | |||
83 | |||
84 | 22 | steve-m | h3. USB/Serial converter |
85 | |||
86 | |||
87 | 1 | steve-m | A nice feature of this phone is that it already has an integrated Silabs CP210x USB-UART, which is supported by Linux. Even faster, odd baudrates of the Calypso DBB are supported by this chip, including the maximum 812.500 baud. |
88 | 22 | steve-m | Most of the phones seem to use USB vid:pid 0489:e003, which is mainline since Linux 2.6.36 (-thus, older kernels need to be patched, the cp210x driver doesn't seem to take the vid/pid via modprobe parameters-). |
89 | 1 | steve-m | |
90 | As someone pointed out on the mailing list, you can do the following for Kernels < 2.6.36: |
||
91 | |||
92 | 22 | steve-m | <pre> |
93 | 11 | steve-m | # modprobe -v cp210x |
94 | 1 | steve-m | # echo "0489 e003" > /sys/bus/usb-serial/drivers/cp210x/new_id |
95 | 22 | steve-m | </pre> |
96 | 1 | steve-m | |
97 | 22 | steve-m | The DP-L10 has the [[CalypsoRomloader]] enabled. |
98 | 1 | steve-m | |
99 | |||
100 | 22 | steve-m | h3. JTAG |
101 | |||
102 | |||
103 | 3 | steve-m | All JTAG lines, as well as the second uart (UART_MODEM), go to the unpopulated connector next to the display connector. |
104 | 1 | steve-m | |
105 | [[Image(dpl10_debug_conn.jpg)]] |
||
106 | ||pin||signal|| |
||
107 | ||1||Vcc|| |
||
108 | 4 | steve-m | ||2||RX_MODEM|| |
109 | 8 | steve-m | ||3||TESTRSTz (Iota)|| |
110 | ||4||TDI|| |
||
111 | ||5||TMS|| |
||
112 | ||6||TCK|| |
||
113 | 10 | steve-m | ||7||TX_MODEM|| |
114 | ||8||TDO|| |
||
115 | ||9||-nc-|| |
||
116 | ||10||GND|| |
||
117 | ||11||-nc-|| |
||
118 | ||12||-nc-|| |
||
119 | |||
120 | |||
121 | 22 | steve-m | h2. State of support |
122 | |||
123 | |||
124 | 10 | steve-m | The code which adds support for the Pirelli DP-L10 can be found in master. |
125 | 4 | steve-m | |
126 | What works: |
||
127 | 22 | steve-m | * RX/TX in GSM900 and DCS1800, PCS1900 |
128 | * audio path |
||
129 | * SIM-reader |
||
130 | * keypad, keypad backlight |
||
131 | * Display with backlight |
||
132 | * pretty much everything else, except Wifi, ringtone generator, camera and the [[VoIP]] accelerator ASIC |
||
133 | 4 | steve-m | |
134 | Note: As the power button is not connected to the keyboard scan matrix and can only be read through a Iota status register, which is quite impractical, we use the camera button on the top left side of the phone as a substitute. |
||
135 | |||
136 | 20 | steve-m | |
137 | 22 | steve-m | h2. Loading procedure |
138 | |||
139 | |||
140 | 21 | steve-m | Due to the fact that the phone has a USB charging mode, loading osmocomBB is a bit more complicated: |
141 | |||
142 | 22 | steve-m | 1. remove the battery |
143 | |||
144 | 2. plug in USB cable |
||
145 | |||
146 | 14 | steve-m | 3. start osmocon, for example: |
147 | 22 | steve-m | <pre> |
148 | 14 | steve-m | ./osmocon -p /dev/ttyUSB0 -m romload ../../target/firmware/board/pirelli_dpl10/layer1.highram.bin |
149 | 22 | steve-m | </pre> |
150 | 14 | steve-m | |
151 | 4. put in battery and the code is being loaded. If it should abort, remove the battery, kill osmocon and resume from step 3. |
||
152 | |||
153 | Without removing the battery the following procedure is possible (without SIM, but it takes longer): |
||
154 | |||
155 | 22 | steve-m | 1. plug in USB cable, the USB charging mode will start |
156 | |||
157 | 2. press and hold the power button, the phone will boot and show "Insert SIM" |
||
158 | |||
159 | 3. start osmocon |
||
160 | |||
161 | 4. press and hold the power button, the phone will power off |
||
162 | |||
163 | 15 | steve-m | 5. the code is being loaded (because after the poweroff Iota triggers a poweron due to the "Charger inserted"-condition, which executes the bootloader) |
164 | 16 | steve-m | |
165 | 1 | steve-m | When osmocom is alreday running on the phone and you want to reboot/load an updated version/different application, do the following: |
166 | 21 | steve-m | |
167 | 22 | steve-m | 1. kill osmocon and start it again |
168 | |||
169 | 3. press the camera button on the side to power off the phone |
||
170 | |||
171 | 1 | steve-m | 4. the code is being loaded (due to the fact mentioned above) |