PirelliDPL10 » History » Version 26
fixeria, 01/09/2024 08:32 PM
document firmware update procedure
1 | 22 | steve-m | h1. Pirelli DP-L10 |
---|---|---|---|
2 | 1 | steve-m | |
3 | 22 | steve-m | |
4 | The Pirelli DP-L10 is a tripleband GSM/Wifi [[VoIP]] dualmode phone, which was developed by Pirelli Broadband Solutions and manufactured by Foxconn. |
||
5 | |||
6 | 24 | laforge | {{thumbnail(dp-l10.jpg)}} |
7 | |||
8 | 1 | steve-m | It was branded and sold by quite a few operators: |
9 | |||
10 | 22 | steve-m | * Pirelli DP-L10 |
11 | * Arcor Twintel DP-L10 |
||
12 | * Telekom TC-300 |
||
13 | * sipgate Pirelli Discus DualPhone DP-L10 |
||
14 | * free.fr Black |
||
15 | * Cubic Mobile DP-L10 |
||
16 | * Tovo t450g |
||
17 | * Eurotef-M |
||
18 | 1 | steve-m | |
19 | The phones are still available as new at various places like eBay, Pollin or rebelsimcard.com. |
||
20 | 22 | steve-m | For more information on the original firmware see the "ip-phone-forum wiki":http://wiki.ip-phone-forum.de/telefone:t-one_tc300:start (german). |
21 | 1 | steve-m | |
22 | |||
23 | 22 | steve-m | h2. Hardware |
24 | 1 | steve-m | |
25 | |||
26 | 22 | steve-m | * CPU/DBB: TI Calypso (D751992AZHH) |
27 | * ABB: TI Iota (TWL3014) |
||
28 | * GSM Transceiver: TI Rita (TRF6151) |
||
29 | * PA: SKY77328-13 |
||
30 | * Flash/SRAM: Spansion S71PL129NC0 128MBit/64MBit |
||
31 | * Wifi: Marvell 88W8385 802.11 MAC |
||
32 | *** Marvell 88W8015 802.11b/g transceiver |
||
33 | * Winbond W56940 ringtone chip |
||
34 | * Sunplus SPCA552E multimedia controller |
||
35 | * LSI-65194A1 ASIC (seems to be a DSP for [[VoIP]] en-/decoding) |
||
36 | * Silabs CP2102 USB UART (connected to UART_IRDA of the Calypso) |
||
37 | 1 | steve-m | |
38 | |||
39 | 22 | steve-m | h3. PCB |
40 | 1 | steve-m | |
41 | |||
42 | 22 | steve-m | The pcb is labelled with "T60N925", and the Foxconn internal project name seems to be "T60N925.00". |
43 | |||
44 | There are no schematics of this phone, however, steve-m has grinded down one of those boards, see the pictures of all layers "here":http://www.steve-m.de/pictures/pirelli_dpl10/ or locally at [[PirelliDPL10PCB]]. |
||
45 | |||
46 | 23 | laforge | !dpl10_front_small.jpg! |
47 | 22 | steve-m | |
48 | "large version":http://www.steve-m.de/pictures/dpl10_front.jpg |
||
49 | |||
50 | 23 | laforge | !dpl10_back_small.jpg! |
51 | 22 | steve-m | |
52 | "large version":http://www.steve-m.de/pictures/dpl10_back.jpg |
||
53 | |||
54 | "large version of RF part":http://www.steve-m.de/pictures/rf_frontend.jpg |
||
55 | |||
56 | |||
57 | h3. RF path |
||
58 | |||
59 | |||
60 | 6 | steve-m | Since this phone is a tripleband design, it uses 3 rx filters, connected to the respective Rita inputs: |
61 | |||
62 | 22 | steve-m | * Epcos B7820 for GSM900 |
63 | * Epcos B7821 for DCS1800 |
||
64 | * Epcos B7851 for DCS1900 |
||
65 | 13 | steve-m | |
66 | 22 | steve-m | Those are connected to an unknown "T 636 / 5475" antenna switch. The pinout of this switch however is identical with the Panasonic "EZFL897TB11C":http://www.panasonic.com/industrial/components/pdf/AEA0000CE1.pdf. |
67 | 9 | steve-m | The control voltage inputs of the switch are connected to the TSPACT outputs of the Calypso DBB through a Fairchild NC7NZ34 triple-buffer. |
68 | |||
69 | 23 | laforge | !dpl10_buffer.jpg! |
70 | 9 | steve-m | |
71 | |||
72 | 22 | steve-m | h3. Phone as clock generator |
73 | 3 | steve-m | |
74 | 22 | steve-m | |
75 | The idea to use an [[OsmocomBB]]-driven phone as an accurate clock source, e.g. for the USRP, by synchronizing the clock to a cell of a commercial operator was "discussed":http://lists.osmocom.org/pipermail/baseband-devel/2010-April/000322.html on the mailing list a while back. Since the USRP needs an input clock of 52MHz, but the Compal-phones only expose 13 and 26MHz, an external PLL would be required. The DP-L10 however exposes the MCLK/TSPACT11 pin of the Calypso, which is connected through the triple-buffer to the GSM900 TX/Vc3 input of the antenna switch, and thus easily accessible. When the corresponding bit in the MCU_SW_TRACE register is set, this pin outputs the 52MHz clock being fed to the ARM-core, which is phase-locked to the VCTCXO. See the blue circuit path in the picture above. |
||
76 | |||
77 | This is the output captured with a 100MHz scope (and thus limited): |
||
78 | |||
79 | |||
80 | 23 | laforge | !mclk_buffered.png! |
81 | 1 | steve-m | |
82 | 11 | steve-m | After synchronizing to a cell with the phone, the frequency error measured by the DSP is in the 0-10Hz range. |
83 | |||
84 | |||
85 | 22 | steve-m | h3. USB/Serial converter |
86 | |||
87 | |||
88 | 1 | steve-m | A nice feature of this phone is that it already has an integrated Silabs CP210x USB-UART, which is supported by Linux. Even faster, odd baudrates of the Calypso DBB are supported by this chip, including the maximum 812.500 baud. |
89 | 22 | steve-m | Most of the phones seem to use USB vid:pid 0489:e003, which is mainline since Linux 2.6.36 (-thus, older kernels need to be patched, the cp210x driver doesn't seem to take the vid/pid via modprobe parameters-). |
90 | 1 | steve-m | |
91 | As someone pointed out on the mailing list, you can do the following for Kernels < 2.6.36: |
||
92 | |||
93 | 22 | steve-m | <pre> |
94 | 11 | steve-m | # modprobe -v cp210x |
95 | 1 | steve-m | # echo "0489 e003" > /sys/bus/usb-serial/drivers/cp210x/new_id |
96 | 22 | steve-m | </pre> |
97 | 1 | steve-m | |
98 | 22 | steve-m | The DP-L10 has the [[CalypsoRomloader]] enabled. |
99 | 1 | steve-m | |
100 | |||
101 | 22 | steve-m | h3. JTAG |
102 | 1 | steve-m | |
103 | 22 | steve-m | |
104 | 1 | steve-m | All JTAG lines, as well as the second uart (UART_MODEM), go to the unpopulated connector next to the display connector. |
105 | 3 | steve-m | |
106 | 23 | laforge | !dpl10_debug_conn.jpg! |
107 | 1 | steve-m | |
108 | 23 | laforge | |_.pin|_.signal| |
109 | |1|Vcc| |
||
110 | |2|RX_MODEM| |
||
111 | |3|TESTRSTz (Iota)| |
||
112 | |4|TDI| |
||
113 | |5|TMS| |
||
114 | |6|TCK| |
||
115 | |7|TX_MODEM| |
||
116 | |8|TDO| |
||
117 | |9|-nc-| |
||
118 | |10|GND| |
||
119 | |11|-nc-| |
||
120 | |12|-nc-| |
||
121 | 10 | steve-m | |
122 | 23 | laforge | |
123 | 22 | steve-m | h2. State of support |
124 | |||
125 | 4 | steve-m | |
126 | The code which adds support for the Pirelli DP-L10 can be found in master. |
||
127 | 1 | steve-m | |
128 | 22 | steve-m | What works: |
129 | 1 | steve-m | * RX/TX in GSM900 and DCS1800, PCS1900 |
130 | * audio path |
||
131 | * SIM-reader |
||
132 | * keypad, keypad backlight |
||
133 | 4 | steve-m | * Display with backlight |
134 | 21 | steve-m | * pretty much everything else, except Wifi, ringtone generator, camera and the [[VoIP]] accelerator ASIC |
135 | 22 | steve-m | |
136 | Note: As the power button is not connected to the keyboard scan matrix and can only be read through a Iota status register, which is quite impractical, we use the camera button on the top left side of the phone as a substitute. |
||
137 | |||
138 | |||
139 | 14 | steve-m | h2. Loading procedure |
140 | 22 | steve-m | |
141 | 14 | steve-m | |
142 | 22 | steve-m | Due to the fact that the phone has a USB charging mode, loading osmocomBB is a bit more complicated: |
143 | 14 | steve-m | |
144 | 23 | laforge | # remove the battery |
145 | # plug in USB cable |
||
146 | # start osmocon, for example: |
||
147 | 14 | steve-m | <pre> |
148 | 22 | steve-m | ./osmocon -p /dev/ttyUSB0 -m romload ../../target/firmware/board/pirelli_dpl10/layer1.highram.bin |
149 | </pre> |
||
150 | 23 | laforge | # put in battery and the code is being loaded. If it should abort, remove the battery, kill osmocon and resume from step 3. |
151 | 22 | steve-m | |
152 | Without removing the battery the following procedure is possible (without SIM, but it takes longer): |
||
153 | |||
154 | 23 | laforge | # plug in USB cable, the USB charging mode will start |
155 | # press and hold the power button, the phone will boot and show "Insert SIM" |
||
156 | # start osmocon |
||
157 | # press and hold the power button, the phone will power off |
||
158 | # the code is being loaded (because after the poweroff Iota triggers a poweron due to the "Charger inserted"-condition, which executes the bootloader) |
||
159 | 21 | steve-m | |
160 | 22 | steve-m | When osmocom is alreday running on the phone and you want to reboot/load an updated version/different application, do the following: |
161 | |||
162 | 23 | laforge | # kill osmocon and start it again |
163 | # press the camera button on the side to power off the phone |
||
164 | # the code is being loaded (due to the fact mentioned above) |
||
165 | 25 | fixeria | |
166 | h2. Stock firmware notes |
||
167 | |||
168 | Below are some notes related to the stock Pirelli's firmware. |
||
169 | |||
170 | h3. MMI codes |
||
171 | |||
172 | Luckily for us, @###000#@ shows the list of available codes and a brief description for each of them: |
||
173 | |||
174 | # @*36446337464#@ - Not use now |
||
175 | # @*#2003#@ - Vibration On/Off |
||
176 | # @*#3692666#@ - Testing mode |
||
177 | # @*#3547#@ - Not use now |
||
178 | # @###000#@ - Show this help screen |
||
179 | # @###09000#@ - Log script On/Off |
||
180 | # @###09010#@ - Timer Log script On/Off |
||
181 | # @###4444#@ - Super reset |
||
182 | # @###520#@ - Display version number |
||
183 | # @###600#@ - Enable Call Deflection |
||
184 | # @###601#@ - Disable Call Deflection |
||
185 | # @###777#@ - Enable test SIM (00101) incoming call auto accept |
||
186 | # @###778#@ - Disable test SIM (00101) incoming call auto accept |
||
187 | # @###800#@ - Enable engineering mode |
||
188 | # @###801#@ - Disable engineering mode |
||
189 | # @###810#@ - Remove user data |
||
190 | # @###888#@ - Not use now |
||
191 | # @###999#@ - Enable power on CF status check |
||
192 | # @###989#@ - MBK libray Demo |
||
193 | 1 | steve-m | |
194 | (These codes can also be found in a firmware dump at offset 0x005f9b70) |
||
195 | 26 | fixeria | (Also, here is a list in Spanish: https://web.archive.org/web/20100331121723/http://www.voipnovatos.es/item/2007/09/cdigos-modo-ingeniera-tcom-tc-300) |
196 | |||
197 | h3. OTA Firmware Update |
||
198 | |||
199 | The OTA (Over-the-Air) firmware update is described here: |
||
200 | |||
201 | https://web.archive.org/web/20150918171544/http://blog.manty.net/2011/10/how-to-solve-90-of-problems-with-your.html |
||
202 | |||
203 | Here is a brief summary: |
||
204 | |||
205 | * Download the firmware image. The article mentions this one: |
||
206 | ** https://web.archive.org/web/20071012212107/https://www.sipgate.de/downloads/pirelli/Firmware.zip |
||
207 | |||
208 | <pre><code class="shell"> |
||
209 | $ wget https://web.archive.org/web/20071012212107/https://www.sipgate.de/downloads/pirelli/Firmware.zip |
||
210 | $ unzip Firmware.zip |
||
211 | $ sha256sum Firmware.zip Firmware/PU_D910.0.3.98f_PG1.img |
||
212 | 8fda319797c45313d98e3cf95f3755002c8a157184aa7ba7251855bd36ff17f8 Firmware.zip |
||
213 | b160602d46d483b3703c55af5d57b439013b23546c08e6635b95f8a395df7dc4 Firmware/PU_D910.0.3.98f_PG1.img |
||
214 | </code></pre> |
||
215 | |||
216 | * Create a file named @T60N925.00_FOX-general.cfg@ with the following content: |
||
217 | ** Replace @192.168.1.231@ with IP address (not sure about DNS) of your HTTP server; |
||
218 | *** The server must be running at port @80@, the firmware does not seem to accept other port numbers; |
||
219 | ** Replace @PU_D910.0.3.98f_PG1.img@ with filename of the firmware image you want to flash; |
||
220 | *** Make sure both the firmware image and this file is in the same directory; |
||
221 | |||
222 | <pre> |
||
223 | [Provision] |
||
224 | SERVER=192.168.1.231 |
||
225 | BACKUP_SERVER=twintel-fw.arcor.de |
||
226 | FIRMWARE_FILENAME=PU_D910.0.3.98f_PG1.img |
||
227 | </pre> |
||
228 | |||
229 | * Start an HTTP server at the configured host. You can use Python's HTTP module: |
||
230 | |||
231 | <pre><code class="shell"> |
||
232 | $ sudo python -m http.server 80 |
||
233 | Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... |
||
234 | </code></pre> |
||
235 | |||
236 | * Enable the engineering mode on the phone by entering @###800#@ (you should see "Engineering mode Activated"). |
||
237 | * Go to "Menu" / "Settings" / "Provision config": |
||
238 | ** Select "Server address" and enter the address of HTTP server hosting @T60N925.00_FOX-general.cfg@ (like "192.168.1.231"); |
||
239 | ** Select "Settings" and choose "Once". |
||
240 | * Go back to the main screen and wait a while, the phone will initiate firmware update check on its own: |
||
241 | |||
242 | <pre> |
||
243 | Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... |
||
244 | 192.168.1.185 - - [10/Jan/2024 02:01:04] "GET /T60N925.00_FOX-general.cfg HTTP/1.1" 200 - |
||
245 | </pre> |
||
246 | |||
247 | * The phone will offer to download the firmware image, you know what to do here. |
||
248 | ** Downloading takes a lot of time (~45 min for above-mentioned @PU_D910.0.3.98f_PG1.img@), be patient. |
||
249 | ** You can observe the progress by monitoring RVTMUX traces (using rvtdump from freecalypso-tools). |
||
250 | * Once downloading is complete, the phone will offer to flash it immediately or postpone. |
||
251 | ** Flashing is relatively quick (~2 min), the phone will reboot automatically. |