OsmocomBB

{{>toc}}

h1. Sony Ericsson K200i/K220i

This is another ODM phone model based on TI Calypso. Both K200i and K220i are identical, except that the K220i has an FM receiver. Interestingly enough, this one has more similarities with [[PirelliDPL10|Pirelli DP-L10]] than with [[SonyEricssonJ100i]], so it's hard to tell who actually designed it for Sony Ericsson. It could have been Foxconn, the same people who designed Pirelli's foray into phones, which would explain the similarity.

{{thumbnail(k200-front.jpg)}}

{{thumbnail(k200-back.jpg)}}

Kudos to @steve-m for adding support of this phone to the firmware:

https://cgit.osmocom.org/osmocom-bb/commit/?id=d78f88c25adbe087e57324b9837d181d7a5f7368

https://cgit.osmocom.org/osmocom-bb/commit/?id=aeb19ea3efaaaab76a74f85684d7a9f7392a15d0

h2. Specifications

* GSM 900/1800

* 46 x 103 x 17 mm, 82g

* STN 65k, 128 x 128

* IrDA (infrared) port

* Camera 0.3MP, 640x480

* 900mAh Li-Ion battery (BST-37)

* Ti Calypso/Iota/Rita chipset

h2. Hardware

{{thumbnail(SE-K200i-PCB1.jpg)}}

{{thumbnail(SE-K200i-PCB2.jpg)}}

{{thumbnail(SE-K200i-fastport.jpg)}}

Large versions: attachment:SE-K200i-PCB1.jpg, attachment:SE-K200i-PCB2.jpg, attachment:SE-K200i-fastport.jpg.

h3. Schematics

We don't have any schematics yet.

h3. GSM Chipset

* DBB: Ti Calypso Baseband, 751992A model (C035, final DSP ROM version 3606), includes 512kBytes of internal SRAM

* ABB: Ti TWL3025BZ (Iota)

* RF: Ti TRF 6151CJ (Rita)

* RF PA: SKY77318-12

h3. NOR Flash + SRAM

* SPANSION S71PL129NB0HFW4B (4 MiB XRAM).

** 128Mbit NOR (16 MByte)

** 32Mbit SRAM (4 MByte)

h3. Audio ringtone

* Winbond W56932DYX chip (same W569x family as used in [[PirelliDPL10|Pirelli DP-L10]])

h3. Serial cable

K200i has standard Sony Ericsson Fastport connector. Refer to [[SonyEricssonJ100i]] for more details.

h2. Bootloader

Similarly to [[PirelliDPL10|Pirelli DP-L10]], K200i has the boot ROM (see [[CalypsoRomloader]]) enabled. According to @falconia, there is also SE's own loader, sitting at the beginning of the boot flash bank. This additional bootloader stage appears to provide its own UART interrupt-boot mechanism, possibly a replica of either familiar Calypso boot ROM protocol or perhaps the later Calypso+ secure boot one, and if no serial entry happens, this bootloader stage transfers control to the main firmware image at 0x20000. For more information, see https://www.freecalypso.org/hg/freecalypso-reveng/file/6c31d8c54ae4/se_k200i/boot-disasm.

h3. Running the firmware

The boot ROM in K200i requires a _shorter_ beacon interval than [[PirelliDPL10|Pirelli DP-L10]] (50), 10 seems to work:

<pre>

$ host/osmocon/osmocon -p /dev/ttyUSB0 -m romload -i 10 target/firmware/board/se_k2x0/layer1.highram.bin

</pre>

h2. Stock firmware notes

Below are some notes related to the stock SE's firmware.

h3. MMI codes

The following MMI codes were found in the firmware dump near the address 0x00223b40:

* @*#06#@ - no comments, we all know about this one,

* @#*87223564#@ - this is 'TRACELOG' in T9 (see below),

* @#*3722263#@ - not sure about '372', but '2263' is likely 'BAND',

* @#*6366794636#@ - this is 'MEMORYINFO' in T9,

* @#*2438378#@ - not sure about '243', but '8378' is likely 'TEST',

* @#*3378378#@ - likely 'FERTEST'.

h3. Enabling the RVTMUX logging

The "RVTMUX":https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/RVTMUX interface is disabled by default and can be re-enabled using the MMI code @#*87223564#@, which opens a hidden menu. Select the @Trace Log@ and reboot the phone. You should see the RVTMUX logging now. See also https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Host-tools-overview and https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Rvinterf-tools.