SonyEricssonK200i » History » Version 16
fixeria, 11/30/2023 05:21 PM
add another possible flash chip
1 | 1 | fixeria | {{>toc}} |
---|---|---|---|
2 | |||
3 | 12 | fixeria | h1. Sony Ericsson K200i/K220i |
4 | 1 | fixeria | |
5 | 12 | fixeria | This is another ODM phone model based on TI Calypso. Both K200i and K220i are identical, except that the K220i has an FM receiver. Interestingly enough, this one has more similarities with [[PirelliDPL10|Pirelli DP-L10]] than with [[SonyEricssonJ100i]], so it's hard to tell who actually designed it for Sony Ericsson. It could have been Foxconn, the same people who designed Pirelli's foray into phones, which would explain the similarity. |
6 | 1 | fixeria | |
7 | {{thumbnail(k200-front.jpg)}} |
||
8 | {{thumbnail(k200-back.jpg)}} |
||
9 | 2 | fixeria | |
10 | 14 | fixeria | Kudos to @steve-m for adding support of this phone to the firmware: |
11 | 1 | fixeria | |
12 | 14 | fixeria | https://cgit.osmocom.org/osmocom-bb/commit/?id=d78f88c25adbe087e57324b9837d181d7a5f7368 |
13 | https://cgit.osmocom.org/osmocom-bb/commit/?id=aeb19ea3efaaaab76a74f85684d7a9f7392a15d0 |
||
14 | 11 | fixeria | |
15 | 3 | fixeria | h2. Specifications |
16 | |||
17 | * GSM 900/1800 |
||
18 | * 46 x 103 x 17 mm, 82g |
||
19 | * STN 65k, 128 x 128 |
||
20 | * IrDA (infrared) port |
||
21 | * Camera 0.3MP, 640x480 |
||
22 | * 900mAh Li-Ion battery (BST-37) |
||
23 | * Ti Calypso/Iota/Rita chipset |
||
24 | 4 | fixeria | |
25 | h2. Hardware |
||
26 | |||
27 | {{thumbnail(SE-K200i-PCB1.jpg)}} |
||
28 | {{thumbnail(SE-K200i-PCB2.jpg)}} |
||
29 | {{thumbnail(SE-K200i-fastport.jpg)}} |
||
30 | |||
31 | 5 | fixeria | Large versions: attachment:SE-K200i-PCB1.jpg, attachment:SE-K200i-PCB2.jpg, attachment:SE-K200i-fastport.jpg. |
32 | 6 | fixeria | |
33 | h3. Schematics |
||
34 | |||
35 | We don't have any schematics yet. |
||
36 | |||
37 | h3. GSM Chipset |
||
38 | |||
39 | * DBB: Ti Calypso Baseband, 751992A model (C035, final DSP ROM version 3606), includes 512kBytes of internal SRAM |
||
40 | * ABB: Ti TWL3025BZ (Iota) |
||
41 | * RF: Ti TRF 6151CJ (Rita) |
||
42 | * RF PA: SKY77318-12 |
||
43 | 7 | fixeria | |
44 | h3. NOR Flash + SRAM |
||
45 | |||
46 | 16 | fixeria | * SPANSION S71PL129NB0HFW4B (4 MiB XRAM) |
47 | 7 | fixeria | ** 128Mbit NOR (16 MByte) |
48 | 1 | fixeria | ** 32Mbit SRAM (4 MByte) |
49 | 16 | fixeria | * Samsung K5L29xx_A or compatible |
50 | 8 | fixeria | |
51 | h3. Audio ringtone |
||
52 | |||
53 | * Winbond W56932DYX chip (same W569x family as used in [[PirelliDPL10|Pirelli DP-L10]]) |
||
54 | 9 | fixeria | |
55 | h3. Serial cable |
||
56 | |||
57 | 10 | fixeria | K200i has standard Sony Ericsson Fastport connector. Refer to [[SonyEricssonJ100i]] for more details. |
58 | 13 | fixeria | |
59 | 15 | fixeria | h2. Bootloader |
60 | |||
61 | Similarly to [[PirelliDPL10|Pirelli DP-L10]], K200i has the boot ROM (see [[CalypsoRomloader]]) enabled. According to @falconia, there is also SE's own loader, sitting at the beginning of the boot flash bank. This additional bootloader stage appears to provide its own UART interrupt-boot mechanism, possibly a replica of either familiar Calypso boot ROM protocol or perhaps the later Calypso+ secure boot one, and if no serial entry happens, this bootloader stage transfers control to the main firmware image at 0x20000. For more information, see https://www.freecalypso.org/hg/freecalypso-reveng/file/6c31d8c54ae4/se_k200i/boot-disasm. |
||
62 | |||
63 | h3. Running the firmware |
||
64 | |||
65 | The boot ROM in K200i requires a _shorter_ beacon interval than [[PirelliDPL10|Pirelli DP-L10]] (50), 10 seems to work: |
||
66 | |||
67 | <pre> |
||
68 | $ host/osmocon/osmocon -p /dev/ttyUSB0 -m romload -i 10 target/firmware/board/se_k2x0/layer1.highram.bin |
||
69 | </pre> |
||
70 | |||
71 | 13 | fixeria | h2. Stock firmware notes |
72 | |||
73 | Below are some notes related to the stock SE's firmware. |
||
74 | |||
75 | h3. MMI codes |
||
76 | |||
77 | The following MMI codes were found in the firmware dump near the address 0x00223b40: |
||
78 | |||
79 | * @*#06#@ - no comments, we all know about this one, |
||
80 | * @#*87223564#@ - this is 'TRACELOG' in T9 (see below), |
||
81 | * @#*3722263#@ - not sure about '372', but '2263' is likely 'BAND', |
||
82 | * @#*6366794636#@ - this is 'MEMORYINFO' in T9, |
||
83 | * @#*2438378#@ - not sure about '243', but '8378' is likely 'TEST', |
||
84 | * @#*3378378#@ - likely 'FERTEST'. |
||
85 | |||
86 | h3. Enabling the RVTMUX logging |
||
87 | |||
88 | The "RVTMUX":https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/RVTMUX interface is disabled by default and can be re-enabled using the MMI code @#*87223564#@, which opens a hidden menu. Select the @Trace Log@ and reboot the phone. You should see the RVTMUX logging now. See also https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Host-tools-overview and https://www.freecalypso.org/hg/freecalypso-tools/file/tip/doc/Rvinterf-tools. |