PirelliDPL10 » History » Version 23
laforge, 02/21/2016 10:23 AM
1 | 1 | steve-m | |
---|---|---|---|
2 | 22 | steve-m | h1. Pirelli DP-L10 |
3 | 1 | steve-m | |
4 | 22 | steve-m | |
5 | The Pirelli DP-L10 is a tripleband GSM/Wifi [[VoIP]] dualmode phone, which was developed by Pirelli Broadband Solutions and manufactured by Foxconn. |
||
6 | |||
7 | 1 | steve-m | It was branded and sold by quite a few operators: |
8 | |||
9 | 22 | steve-m | * Pirelli DP-L10 |
10 | * Arcor Twintel DP-L10 |
||
11 | * Telekom TC-300 |
||
12 | * sipgate Pirelli Discus DualPhone DP-L10 |
||
13 | * free.fr Black |
||
14 | * Cubic Mobile DP-L10 |
||
15 | * Tovo t450g |
||
16 | * Eurotef-M |
||
17 | 1 | steve-m | |
18 | The phones are still available as new at various places like eBay, Pollin or rebelsimcard.com. |
||
19 | 22 | steve-m | For more information on the original firmware see the "ip-phone-forum wiki":http://wiki.ip-phone-forum.de/telefone:t-one_tc300:start (german). |
20 | 1 | steve-m | |
21 | |||
22 | 22 | steve-m | h2. Hardware |
23 | 1 | steve-m | |
24 | |||
25 | 22 | steve-m | * CPU/DBB: TI Calypso (D751992AZHH) |
26 | * ABB: TI Iota (TWL3014) |
||
27 | * GSM Transceiver: TI Rita (TRF6151) |
||
28 | * PA: SKY77328-13 |
||
29 | * Flash/SRAM: Spansion S71PL129NC0 128MBit/64MBit |
||
30 | * Wifi: Marvell 88W8385 802.11 MAC |
||
31 | *** Marvell 88W8015 802.11b/g transceiver |
||
32 | * Winbond W56940 ringtone chip |
||
33 | * Sunplus SPCA552E multimedia controller |
||
34 | * LSI-65194A1 ASIC (seems to be a DSP for [[VoIP]] en-/decoding) |
||
35 | * Silabs CP2102 USB UART (connected to UART_IRDA of the Calypso) |
||
36 | 1 | steve-m | |
37 | |||
38 | 22 | steve-m | h3. PCB |
39 | 1 | steve-m | |
40 | |||
41 | 22 | steve-m | The pcb is labelled with "T60N925", and the Foxconn internal project name seems to be "T60N925.00". |
42 | |||
43 | There are no schematics of this phone, however, steve-m has grinded down one of those boards, see the pictures of all layers "here":http://www.steve-m.de/pictures/pirelli_dpl10/ or locally at [[PirelliDPL10PCB]]. |
||
44 | |||
45 | 23 | laforge | !dpl10_front_small.jpg! |
46 | 22 | steve-m | |
47 | "large version":http://www.steve-m.de/pictures/dpl10_front.jpg |
||
48 | |||
49 | 23 | laforge | !dpl10_back_small.jpg! |
50 | 22 | steve-m | |
51 | "large version":http://www.steve-m.de/pictures/dpl10_back.jpg |
||
52 | |||
53 | "large version of RF part":http://www.steve-m.de/pictures/rf_frontend.jpg |
||
54 | |||
55 | |||
56 | h3. RF path |
||
57 | |||
58 | |||
59 | 6 | steve-m | Since this phone is a tripleband design, it uses 3 rx filters, connected to the respective Rita inputs: |
60 | |||
61 | 22 | steve-m | * Epcos B7820 for GSM900 |
62 | * Epcos B7821 for DCS1800 |
||
63 | * Epcos B7851 for DCS1900 |
||
64 | 13 | steve-m | |
65 | 22 | steve-m | Those are connected to an unknown "T 636 / 5475" antenna switch. The pinout of this switch however is identical with the Panasonic "EZFL897TB11C":http://www.panasonic.com/industrial/components/pdf/AEA0000CE1.pdf. |
66 | 9 | steve-m | The control voltage inputs of the switch are connected to the TSPACT outputs of the Calypso DBB through a Fairchild NC7NZ34 triple-buffer. |
67 | |||
68 | 23 | laforge | !dpl10_buffer.jpg! |
69 | 9 | steve-m | |
70 | |||
71 | 22 | steve-m | h3. Phone as clock generator |
72 | 3 | steve-m | |
73 | 22 | steve-m | |
74 | The idea to use an [[OsmocomBB]]-driven phone as an accurate clock source, e.g. for the USRP, by synchronizing the clock to a cell of a commercial operator was "discussed":http://lists.osmocom.org/pipermail/baseband-devel/2010-April/000322.html on the mailing list a while back. Since the USRP needs an input clock of 52MHz, but the Compal-phones only expose 13 and 26MHz, an external PLL would be required. The DP-L10 however exposes the MCLK/TSPACT11 pin of the Calypso, which is connected through the triple-buffer to the GSM900 TX/Vc3 input of the antenna switch, and thus easily accessible. When the corresponding bit in the MCU_SW_TRACE register is set, this pin outputs the 52MHz clock being fed to the ARM-core, which is phase-locked to the VCTCXO. See the blue circuit path in the picture above. |
||
75 | |||
76 | This is the output captured with a 100MHz scope (and thus limited): |
||
77 | |||
78 | |||
79 | 23 | laforge | !mclk_buffered.png! |
80 | 1 | steve-m | |
81 | 11 | steve-m | After synchronizing to a cell with the phone, the frequency error measured by the DSP is in the 0-10Hz range. |
82 | |||
83 | |||
84 | 22 | steve-m | h3. USB/Serial converter |
85 | |||
86 | |||
87 | 1 | steve-m | A nice feature of this phone is that it already has an integrated Silabs CP210x USB-UART, which is supported by Linux. Even faster, odd baudrates of the Calypso DBB are supported by this chip, including the maximum 812.500 baud. |
88 | 22 | steve-m | Most of the phones seem to use USB vid:pid 0489:e003, which is mainline since Linux 2.6.36 (-thus, older kernels need to be patched, the cp210x driver doesn't seem to take the vid/pid via modprobe parameters-). |
89 | 1 | steve-m | |
90 | As someone pointed out on the mailing list, you can do the following for Kernels < 2.6.36: |
||
91 | |||
92 | 22 | steve-m | <pre> |
93 | 11 | steve-m | # modprobe -v cp210x |
94 | 1 | steve-m | # echo "0489 e003" > /sys/bus/usb-serial/drivers/cp210x/new_id |
95 | 22 | steve-m | </pre> |
96 | 1 | steve-m | |
97 | 22 | steve-m | The DP-L10 has the [[CalypsoRomloader]] enabled. |
98 | 1 | steve-m | |
99 | |||
100 | 22 | steve-m | h3. JTAG |
101 | 1 | steve-m | |
102 | 22 | steve-m | |
103 | 1 | steve-m | All JTAG lines, as well as the second uart (UART_MODEM), go to the unpopulated connector next to the display connector. |
104 | 3 | steve-m | |
105 | 23 | laforge | !dpl10_debug_conn.jpg! |
106 | 1 | steve-m | |
107 | 23 | laforge | |_.pin|_.signal| |
108 | |1|Vcc| |
||
109 | |2|RX_MODEM| |
||
110 | |3|TESTRSTz (Iota)| |
||
111 | |4|TDI| |
||
112 | |5|TMS| |
||
113 | |6|TCK| |
||
114 | |7|TX_MODEM| |
||
115 | |8|TDO| |
||
116 | |9|-nc-| |
||
117 | |10|GND| |
||
118 | |11|-nc-| |
||
119 | |12|-nc-| |
||
120 | 10 | steve-m | |
121 | 23 | laforge | |
122 | 22 | steve-m | h2. State of support |
123 | |||
124 | 4 | steve-m | |
125 | The code which adds support for the Pirelli DP-L10 can be found in master. |
||
126 | 1 | steve-m | |
127 | 22 | steve-m | What works: |
128 | 1 | steve-m | * RX/TX in GSM900 and DCS1800, PCS1900 |
129 | * audio path |
||
130 | * SIM-reader |
||
131 | * keypad, keypad backlight |
||
132 | 4 | steve-m | * Display with backlight |
133 | 21 | steve-m | * pretty much everything else, except Wifi, ringtone generator, camera and the [[VoIP]] accelerator ASIC |
134 | 22 | steve-m | |
135 | Note: As the power button is not connected to the keyboard scan matrix and can only be read through a Iota status register, which is quite impractical, we use the camera button on the top left side of the phone as a substitute. |
||
136 | |||
137 | |||
138 | 14 | steve-m | h2. Loading procedure |
139 | 22 | steve-m | |
140 | 14 | steve-m | |
141 | 22 | steve-m | Due to the fact that the phone has a USB charging mode, loading osmocomBB is a bit more complicated: |
142 | 14 | steve-m | |
143 | 23 | laforge | # remove the battery |
144 | # plug in USB cable |
||
145 | # start osmocon, for example: |
||
146 | 14 | steve-m | <pre> |
147 | 22 | steve-m | ./osmocon -p /dev/ttyUSB0 -m romload ../../target/firmware/board/pirelli_dpl10/layer1.highram.bin |
148 | </pre> |
||
149 | 23 | laforge | # put in battery and the code is being loaded. If it should abort, remove the battery, kill osmocon and resume from step 3. |
150 | 22 | steve-m | |
151 | Without removing the battery the following procedure is possible (without SIM, but it takes longer): |
||
152 | |||
153 | 23 | laforge | # plug in USB cable, the USB charging mode will start |
154 | # press and hold the power button, the phone will boot and show "Insert SIM" |
||
155 | # start osmocon |
||
156 | # press and hold the power button, the phone will power off |
||
157 | # the code is being loaded (because after the poweroff Iota triggers a poweron due to the "Charger inserted"-condition, which executes the bootloader) |
||
158 | 21 | steve-m | |
159 | 22 | steve-m | When osmocom is alreday running on the phone and you want to reboot/load an updated version/different application, do the following: |
160 | |||
161 | 23 | laforge | # kill osmocon and start it again |
162 | # press the camera button on the side to power off the phone |
||
163 | # the code is being loaded (due to the fact mentioned above) |