• Table of contents
• Sony Ericsson K200i/K220i
  • Specifications
  • Hardware
    • Schematics
    • GSM Chipset
    • NOR Flash + SRAM
    • Audio ringtone
    • Serial cable
  • Bootloader
    • Running the firmware
  • Stock firmware notes
    • MMI codes
    • Enabling the AT command interpreter
    • Enabling the RVTMUX logging

Sony Ericsson K200i/K220i¶

This is another ODM phone model based on TI Calypso. Both K200i and K220i are identical, except that the K220i has an FM receiver. Interestingly enough, this one has more similarities with Pirelli DP-L10 than with SonyEricssonJ100i, so it's hard to tell who actually designed it for Sony Ericsson. It could have been Foxconn, the same people who designed Pirelli's foray into phones, which would explain the similarity.

Kudos to steve-m for adding support of this phone to the firmware:

https://cgit.osmocom.org/osmocom-bb/commit/?id=d78f88c25adbe087e57324b9837d181d7a5f7368
https://cgit.osmocom.org/osmocom-bb/commit/?id=aeb19ea3efaaaab76a74f85684d7a9f7392a15d0

Specifications¶

• GSM 900/1800
• 46 x 103 x 17 mm, 82g
• STN 65k, 128 x 128
• IrDA (infrared) port
• Camera 0.3MP, 640x480
• 900mAh Li-Ion battery (BST-37)
• Ti Calypso/Iota/Rita chipset

Hardware¶

Large versions: SE-K200i-PCB1.jpg, SE-K200i-PCB2.jpg, SE-K200i-fastport.jpg.

Schematics¶

We don't have any schematics yet.

GSM Chipset¶

• DBB: Ti Calypso Baseband, 751992A model (C035, final DSP ROM version 3606), includes 512kBytes of internal SRAM
• ABB: Ti TWL3025BZ (Iota)
• RF: Ti TRF 6151CJ (Rita)
• RF PA: SKY77318-12

NOR Flash + SRAM¶

• SPANSION S71PL129NB0HFW4B (4 MiB XRAM)
  • 128Mbit NOR (16 MByte)
  • 32Mbit SRAM (4 MByte)
• Samsung K5L2931CAM

Audio ringtone¶

• Winbond W56932DYX chip (same W569x family as used in Pirelli DP-L10)

Serial cable¶

K200i has standard Sony Ericsson Fastport connector. Refer to SonyEricssonJ100i for more details.

Bootloader¶

Similarly to Pirelli DP-L10, K200i has the boot ROM (see CalypsoRomloader) enabled. According to falconia, there is also SE's own loader, sitting at the beginning of the boot flash bank. This additional bootloader stage appears to provide its own UART interrupt-boot mechanism, possibly a replica of either familiar Calypso boot ROM protocol or perhaps the later Calypso+ secure boot one, and if no serial entry happens, this bootloader stage transfers control to the main firmware image at 0x20000. For more information, see https://www.freecalypso.org/hg/freecalypso-reveng/file/6c31d8c54ae4/se_k200i/boot-disasm.

Running the firmware¶

The boot ROM in K200i requires a shorter beacon interval than Pirelli DP-L10 (50), 10 seems to work:

$ host/osmocon/osmocon -p /dev/ttyUSB0 -m romload -i 10 target/firmware/board/se_k2x0/layer1.highram.bin

Stock firmware notes¶

Below are some notes related to the stock SE's firmware.

MMI codes¶

The following MMI codes were found in the firmware dump near the address 0x00223b40:

• *#06# - no comments, we all know about this one,
• #*87223564# - this is 'TRACELOG' in T9 (see below),
• #*3722263# - not sure about '372', but '2263' is likely 'BAND',
• #*6366794636# - this is 'MEMORYINFO' in T9,
• #*2438378# - not sure about '243', but '8378' is likely 'TEST',
• #*3378378# - likely 'FERTEST'.

Enabling the AT command interpreter¶

The AT command interpreter is disabled by default and can be re-enabled using the MMI code #*87223564#, which opens a hidden menu. Select the AT CMD and reboot the phone. You should see AT-Command Interpreter ready after rebooting.

Enabling the RVTMUX logging¶

The RVTMUX interface is disabled by default and can be re-enabled using the MMI code #*87223564#, which opens a hidden menu. Select the Trace Log and reboot the phone. You should see the RVTMUX logging now. See also https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Host-tools-overview and https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Rvinterf-tools.