PirelliDPL10 » History » Version 25
fixeria, 01/09/2024 06:14 PM
add stock firmware notes
1 | 1 | steve-m | |
---|---|---|---|
2 | 22 | steve-m | h1. Pirelli DP-L10 |
3 | 1 | steve-m | |
4 | 22 | steve-m | |
5 | The Pirelli DP-L10 is a tripleband GSM/Wifi [[VoIP]] dualmode phone, which was developed by Pirelli Broadband Solutions and manufactured by Foxconn. |
||
6 | |||
7 | 24 | laforge | {{thumbnail(dp-l10.jpg)}} |
8 | |||
9 | 1 | steve-m | It was branded and sold by quite a few operators: |
10 | |||
11 | 22 | steve-m | * Pirelli DP-L10 |
12 | * Arcor Twintel DP-L10 |
||
13 | * Telekom TC-300 |
||
14 | * sipgate Pirelli Discus DualPhone DP-L10 |
||
15 | * free.fr Black |
||
16 | * Cubic Mobile DP-L10 |
||
17 | * Tovo t450g |
||
18 | * Eurotef-M |
||
19 | 1 | steve-m | |
20 | The phones are still available as new at various places like eBay, Pollin or rebelsimcard.com. |
||
21 | 22 | steve-m | For more information on the original firmware see the "ip-phone-forum wiki":http://wiki.ip-phone-forum.de/telefone:t-one_tc300:start (german). |
22 | 1 | steve-m | |
23 | |||
24 | 22 | steve-m | h2. Hardware |
25 | 1 | steve-m | |
26 | |||
27 | 22 | steve-m | * CPU/DBB: TI Calypso (D751992AZHH) |
28 | * ABB: TI Iota (TWL3014) |
||
29 | * GSM Transceiver: TI Rita (TRF6151) |
||
30 | * PA: SKY77328-13 |
||
31 | * Flash/SRAM: Spansion S71PL129NC0 128MBit/64MBit |
||
32 | * Wifi: Marvell 88W8385 802.11 MAC |
||
33 | *** Marvell 88W8015 802.11b/g transceiver |
||
34 | * Winbond W56940 ringtone chip |
||
35 | * Sunplus SPCA552E multimedia controller |
||
36 | * LSI-65194A1 ASIC (seems to be a DSP for [[VoIP]] en-/decoding) |
||
37 | * Silabs CP2102 USB UART (connected to UART_IRDA of the Calypso) |
||
38 | 1 | steve-m | |
39 | |||
40 | 22 | steve-m | h3. PCB |
41 | 1 | steve-m | |
42 | |||
43 | 22 | steve-m | The pcb is labelled with "T60N925", and the Foxconn internal project name seems to be "T60N925.00". |
44 | |||
45 | There are no schematics of this phone, however, steve-m has grinded down one of those boards, see the pictures of all layers "here":http://www.steve-m.de/pictures/pirelli_dpl10/ or locally at [[PirelliDPL10PCB]]. |
||
46 | |||
47 | 23 | laforge | !dpl10_front_small.jpg! |
48 | 22 | steve-m | |
49 | "large version":http://www.steve-m.de/pictures/dpl10_front.jpg |
||
50 | |||
51 | 23 | laforge | !dpl10_back_small.jpg! |
52 | 22 | steve-m | |
53 | "large version":http://www.steve-m.de/pictures/dpl10_back.jpg |
||
54 | |||
55 | "large version of RF part":http://www.steve-m.de/pictures/rf_frontend.jpg |
||
56 | |||
57 | |||
58 | h3. RF path |
||
59 | |||
60 | |||
61 | 6 | steve-m | Since this phone is a tripleband design, it uses 3 rx filters, connected to the respective Rita inputs: |
62 | |||
63 | 22 | steve-m | * Epcos B7820 for GSM900 |
64 | * Epcos B7821 for DCS1800 |
||
65 | * Epcos B7851 for DCS1900 |
||
66 | 13 | steve-m | |
67 | 22 | steve-m | Those are connected to an unknown "T 636 / 5475" antenna switch. The pinout of this switch however is identical with the Panasonic "EZFL897TB11C":http://www.panasonic.com/industrial/components/pdf/AEA0000CE1.pdf. |
68 | 9 | steve-m | The control voltage inputs of the switch are connected to the TSPACT outputs of the Calypso DBB through a Fairchild NC7NZ34 triple-buffer. |
69 | |||
70 | 23 | laforge | !dpl10_buffer.jpg! |
71 | 9 | steve-m | |
72 | |||
73 | 22 | steve-m | h3. Phone as clock generator |
74 | 3 | steve-m | |
75 | 22 | steve-m | |
76 | The idea to use an [[OsmocomBB]]-driven phone as an accurate clock source, e.g. for the USRP, by synchronizing the clock to a cell of a commercial operator was "discussed":http://lists.osmocom.org/pipermail/baseband-devel/2010-April/000322.html on the mailing list a while back. Since the USRP needs an input clock of 52MHz, but the Compal-phones only expose 13 and 26MHz, an external PLL would be required. The DP-L10 however exposes the MCLK/TSPACT11 pin of the Calypso, which is connected through the triple-buffer to the GSM900 TX/Vc3 input of the antenna switch, and thus easily accessible. When the corresponding bit in the MCU_SW_TRACE register is set, this pin outputs the 52MHz clock being fed to the ARM-core, which is phase-locked to the VCTCXO. See the blue circuit path in the picture above. |
||
77 | |||
78 | This is the output captured with a 100MHz scope (and thus limited): |
||
79 | |||
80 | |||
81 | 23 | laforge | !mclk_buffered.png! |
82 | 1 | steve-m | |
83 | 11 | steve-m | After synchronizing to a cell with the phone, the frequency error measured by the DSP is in the 0-10Hz range. |
84 | |||
85 | |||
86 | 22 | steve-m | h3. USB/Serial converter |
87 | |||
88 | |||
89 | 1 | steve-m | A nice feature of this phone is that it already has an integrated Silabs CP210x USB-UART, which is supported by Linux. Even faster, odd baudrates of the Calypso DBB are supported by this chip, including the maximum 812.500 baud. |
90 | 22 | steve-m | Most of the phones seem to use USB vid:pid 0489:e003, which is mainline since Linux 2.6.36 (-thus, older kernels need to be patched, the cp210x driver doesn't seem to take the vid/pid via modprobe parameters-). |
91 | 1 | steve-m | |
92 | As someone pointed out on the mailing list, you can do the following for Kernels < 2.6.36: |
||
93 | |||
94 | 22 | steve-m | <pre> |
95 | 11 | steve-m | # modprobe -v cp210x |
96 | 1 | steve-m | # echo "0489 e003" > /sys/bus/usb-serial/drivers/cp210x/new_id |
97 | 22 | steve-m | </pre> |
98 | 1 | steve-m | |
99 | 22 | steve-m | The DP-L10 has the [[CalypsoRomloader]] enabled. |
100 | 1 | steve-m | |
101 | |||
102 | 22 | steve-m | h3. JTAG |
103 | 1 | steve-m | |
104 | 22 | steve-m | |
105 | 1 | steve-m | All JTAG lines, as well as the second uart (UART_MODEM), go to the unpopulated connector next to the display connector. |
106 | 3 | steve-m | |
107 | 23 | laforge | !dpl10_debug_conn.jpg! |
108 | 1 | steve-m | |
109 | 23 | laforge | |_.pin|_.signal| |
110 | |1|Vcc| |
||
111 | |2|RX_MODEM| |
||
112 | |3|TESTRSTz (Iota)| |
||
113 | |4|TDI| |
||
114 | |5|TMS| |
||
115 | |6|TCK| |
||
116 | |7|TX_MODEM| |
||
117 | |8|TDO| |
||
118 | |9|-nc-| |
||
119 | |10|GND| |
||
120 | |11|-nc-| |
||
121 | |12|-nc-| |
||
122 | 10 | steve-m | |
123 | 23 | laforge | |
124 | 22 | steve-m | h2. State of support |
125 | |||
126 | 4 | steve-m | |
127 | The code which adds support for the Pirelli DP-L10 can be found in master. |
||
128 | 1 | steve-m | |
129 | 22 | steve-m | What works: |
130 | 1 | steve-m | * RX/TX in GSM900 and DCS1800, PCS1900 |
131 | * audio path |
||
132 | * SIM-reader |
||
133 | * keypad, keypad backlight |
||
134 | 4 | steve-m | * Display with backlight |
135 | 21 | steve-m | * pretty much everything else, except Wifi, ringtone generator, camera and the [[VoIP]] accelerator ASIC |
136 | 22 | steve-m | |
137 | Note: As the power button is not connected to the keyboard scan matrix and can only be read through a Iota status register, which is quite impractical, we use the camera button on the top left side of the phone as a substitute. |
||
138 | |||
139 | |||
140 | 14 | steve-m | h2. Loading procedure |
141 | 22 | steve-m | |
142 | 14 | steve-m | |
143 | 22 | steve-m | Due to the fact that the phone has a USB charging mode, loading osmocomBB is a bit more complicated: |
144 | 14 | steve-m | |
145 | 23 | laforge | # remove the battery |
146 | # plug in USB cable |
||
147 | # start osmocon, for example: |
||
148 | 14 | steve-m | <pre> |
149 | 22 | steve-m | ./osmocon -p /dev/ttyUSB0 -m romload ../../target/firmware/board/pirelli_dpl10/layer1.highram.bin |
150 | </pre> |
||
151 | 23 | laforge | # put in battery and the code is being loaded. If it should abort, remove the battery, kill osmocon and resume from step 3. |
152 | 22 | steve-m | |
153 | Without removing the battery the following procedure is possible (without SIM, but it takes longer): |
||
154 | |||
155 | 23 | laforge | # plug in USB cable, the USB charging mode will start |
156 | # press and hold the power button, the phone will boot and show "Insert SIM" |
||
157 | # start osmocon |
||
158 | # press and hold the power button, the phone will power off |
||
159 | # the code is being loaded (because after the poweroff Iota triggers a poweron due to the "Charger inserted"-condition, which executes the bootloader) |
||
160 | 21 | steve-m | |
161 | 22 | steve-m | When osmocom is alreday running on the phone and you want to reboot/load an updated version/different application, do the following: |
162 | |||
163 | 23 | laforge | # kill osmocon and start it again |
164 | # press the camera button on the side to power off the phone |
||
165 | # the code is being loaded (due to the fact mentioned above) |
||
166 | 25 | fixeria | |
167 | h2. Stock firmware notes |
||
168 | |||
169 | Below are some notes related to the stock Pirelli's firmware. |
||
170 | |||
171 | h3. MMI codes |
||
172 | |||
173 | |||
174 | Luckily for us, @###000#@ shows the list of available codes and a brief description for each of them: |
||
175 | |||
176 | # @*36446337464#@ - Not use now |
||
177 | # @*#2003#@ - Vibration On/Off |
||
178 | # @*#3692666#@ - Testing mode |
||
179 | # @*#3547#@ - Not use now |
||
180 | # @###000#@ - Show this help screen |
||
181 | # @###09000#@ - Log script On/Off |
||
182 | # @###09010#@ - Timer Log script On/Off |
||
183 | # @###4444#@ - Super reset |
||
184 | # @###520#@ - Display version number |
||
185 | # @###600#@ - Enable Call Deflection |
||
186 | # @###601#@ - Disable Call Deflection |
||
187 | # @###777#@ - Enable test SIM (00101) incoming call auto accept |
||
188 | # @###778#@ - Disable test SIM (00101) incoming call auto accept |
||
189 | # @###800#@ - Enable engineering mode |
||
190 | # @###801#@ - Disable engineering mode |
||
191 | # @###810#@ - Remove user data |
||
192 | # @###888#@ - Not use now |
||
193 | # @###999#@ - Enable power on CF status check |
||
194 | # @###989#@ - MBK libray Demo |
||
195 | |||
196 | (These codes can also be found in a firmware dump at offset 0x005f9b70) |