- Table of contents
- Sony Ericsson K200i/K220i
Sony Ericsson K200i/K220i¶
This is another ODM phone model based on TI Calypso. Both K200i and K220i are identical, except that the K220i has an FM receiver. Interestingly enough, this one has more similarities with Pirelli DP-L10 than with SonyEricssonJ100i, so it's hard to tell who actually designed it for Sony Ericsson. It could have been Foxconn, the same people who designed Pirelli's foray into phones, which would explain the similarity.
Kudos to steve-m for adding support of this phone to the firmware:
- GSM 900/1800
- 46 x 103 x 17 mm, 82g
- STN 65k, 128 x 128
- IrDA (infrared) port
- Camera 0.3MP, 640x480
- 900mAh Li-Ion battery (BST-37)
- Ti Calypso/Iota/Rita chipset
We don't have any schematics yet.
- DBB: Ti Calypso Baseband, 751992A model (C035, final DSP ROM version 3606), includes 512kBytes of internal SRAM
- ABB: Ti TWL3025BZ (Iota)
- RF: Ti TRF 6151CJ (Rita)
- RF PA: SKY77318-12
NOR Flash + SRAM¶
- SPANSION S71PL129NB0HFW4B (4 MiB XRAM).
- 128Mbit NOR (16 MByte)
- 32Mbit SRAM (4 MByte)
- Winbond W56932DYX chip (same W569x family as used in Pirelli DP-L10)
K200i has standard Sony Ericsson Fastport connector. Refer to SonyEricssonJ100i for more details.
Similarly to Pirelli DP-L10, K200i has the boot ROM (see CalypsoRomloader) enabled. According to falconia, there is also SE's own loader, sitting at the beginning of the boot flash bank. This additional bootloader stage appears to provide its own UART interrupt-boot mechanism, possibly a replica of either familiar Calypso boot ROM protocol or perhaps the later Calypso+ secure boot one, and if no serial entry happens, this bootloader stage transfers control to the main firmware image at 0x20000. For more information, see https://www.freecalypso.org/hg/freecalypso-reveng/file/6c31d8c54ae4/se_k200i/boot-disasm.
Running the firmware¶
The boot ROM in K200i requires a shorter beacon interval than Pirelli DP-L10 (50), 10 seems to work:
$ host/osmocon/osmocon -p /dev/ttyUSB0 -m romload -i 10 target/firmware/board/se_k2x0/layer1.highram.bin
Stock firmware notes¶
Below are some notes related to the stock SE's firmware.
The following MMI codes were found in the firmware dump near the address 0x00223b40:
*#06#- no comments, we all know about this one,
#*87223564#- this is 'TRACELOG' in T9 (see below),
#*3722263#- not sure about '372', but '2263' is likely 'BAND',
#*6366794636#- this is 'MEMORYINFO' in T9,
#*2438378#- not sure about '243', but '8378' is likely 'TEST',
#*3378378#- likely 'FERTEST'.
Enabling the RVTMUX logging¶
The RVTMUX interface is disabled by default and can be re-enabled using the MMI code
#*87223564#, which opens a hidden menu. Select the
Trace Log and reboot the phone. You should see the RVTMUX logging now. See also https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Host-tools-overview and https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Rvinterf-tools.