wiki:Treo650Hardware

Version 4 (modified by SleepWalker, 10 years ago) (diff)

--

Palm Treo 650 Hardware

[:Treo650: Home] | [:Treo650Status: Status] | Hardware | [:Treo650Downloads: Downloads] | [:Treo650HowTo: How-To] | [:Cocoboot: Bootloader]

Photos

Specifications

GSM module

The GSM module is connected to the FFUART, audio codec and several GPIOs. On reset it speaks regular AT commands at baud 460800. It responds ERROR to almost everything until it is put into a high power state with AT+CFUN=1. Once in that state the module will put itself to sleep after being idle for 30 seconds, to make it up you must toggle the GSM WAKE (57) GPIO.

Undocumented commands

These commands aren't documented in the GC7x/GC8x command reference. The full (?) list of commands can be found with AT* or AT+CLAC.

AT*MBSEL band selection

AT*MBSEL=? *MBSEL: (0-6)

See: GreenphoneBandSelection::setBand

AT*MCAM call monitoring info

AT*MCAM=? *MCAM: (0,1)

See: GreenphoneCallProvider::mcamNotification

AT*MCSQ unsolicited call quality

AT*MCSQ=0 AT*MCSQ=1

See: GreenphoneModemService::reset

AT*MECNS echo cancellation and noise suppression

AT*MECNS=? *MECNS: (1-10),(0-32767),(0-32767),(0-32767),(0-32767),(0-32767),(0-32767),(0-32767)

See: GreenphoneModemService::setNoiseSuppression

AT*MKEYTONE play DTMS to local speaker

AT*MKEYTONE=? *MKEYTONE: (0-9, "*","#"), (0-500)

See: AT+VTS command which transmits the tone, but doesn't play locally

AT*MTZ timezone notification

AT*MTZ=? *MTZ: (1-3),(0-1) AT*MTZ? *MTZ: 3

See: GreenphoneModemService::mtz2Notification

AT*MVCHN select voice channel

AT*MVCHN? *MVCHN: 1

AT*MVCHN=? *MVCHN: (0,1)

See: GreenphoneModemService::setOutput

AT*MVERS extra modem firmware version info

See: GreenphoneConfiguration::request

AT*MVMSC voice mail service numbers

AT*MVMSC=? *MVMSC: (1-5),(0-1),(?),(128,129,145)

See: GreenphoneServiceNumbers::setServiceNumber

Keypad matrix

All the buttons except silent switch and reset button are connected to the PXA270's matrix keypad controller.

The Treo uses MKOUT0-MKOUT3

Pin MKOUT0MKOUT1MKOUT2MKOUT3
MKIN0
MKIN1
MKIN2
MKIN3 SPACE

Palm OS MMU configuration

Unlike other Palms the Treo has the TTB at 0xa1ffc000, this is mapped 1-1 but as a read-only page.

Virtual Physical
08000000-08000000 08000000-08000000
20000000-20d00000 a0000000-a0d00000
64000000-64400000 a1a00000-a1e00000
73100000-73b00000 a0f00000-a1900000
90000000-91800000 40000000-41800000
94000000-94000000 44000000-44000000
98000000-98000000 48000000-48000000
9c000000-9c000000 4c000000-4c000000
a0000000-a0000000 50000000-50000000
a8000000-a8000000 58000000-58000000
f0000000-f0000000 5c000000-5c000000
fef00000-fef00000 00000000-00000000

(Table is incomplete.)

LCD configuration

As set by PalmOS. The LCD registers are mapped to put value here by Linux.

RegisterValueMeaning
LCCR00x06000081
LCCR10x13070d3f
LCCR20x0768013d LPP=317 VSW=0 EFW=208 BFW=14
LCCR30x04700005
FDADR00xa1f8f300

Backlight is controlled by PXA's PWM0.

UARTs

FFUARTGSM module 460800 baud (confirmed)
STUARTirda?
BTUARTmulticonnector?
ASIC UARTBT module (confirmed)

ASIC 6 (HTC-30H80049-00)

B0000000: 00 00 00 00 01 00 00 00 - 00 00 60 00 B0 00 00 00 | ..........`.....
B0000010: 40 00 E0 00 00 00 0F 00 - 0F 00 0F 00 00 00 00 00 | @...............
B0000020: 07 00 01 00 00 00 0E 00 - 00 00 00 00 0F 00 00 00 | ................
B0000030: 08 00 01 00 02 00 02 00 - 00 00 00 00 00 00 00 00 | ................
B0000040: FF 00 1F 00 FA 00 1F 00 - 80 00 1F 00 00 00 00 00 | ................
B0000050: 00 00 00 00 00 00 00 00 - FF 00 1F 00 00 00 00 00 | ................
B0000060: 00 00 00 00 00 00 00 00 - 00 00 80 00 1F 00 00 00 | ................
B0000070: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B0000080: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B0000090: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000B0: 08 00 00 00 0E 00 02 00 - 00 00 00 00 00 00 00 00 | ................
B00000C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000D0: 18 00 01 00 0F 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000E0: 48 00 54 00 43 00 2D 00 - 33 00 30 00 48 00 38 00 | H.T.C.-.3.0.H.8.
B00000F0: 30 00 30 00 34 00 39 00 - 2D 00 30 00 30 00 00 00 | 0.0.4.9.-.0.0...
NameOffsetComment
UART_THR_RBR_DLL0x0
UART_IER_DM0x2
UART_IIR_FCR0x4
UART_LCR0x6
UART_MCR0x8
UART_LSR0xa
UART_MSR0xc
??0x10should be 0x80 to enable green LED flashing (GPIO AF? DIR?), 0x40 no flashing
??0x12should be 0xe1 to enable red LED flashing (GPIO AF? DIR?), e2 for keypad, 0xe0 no flashing
??0x16should be 0x6 to enable LEDs, flashing speeds up when value is lowered. Some clock control?
??0x36 bit 3 = USB_DETECT_N
??0x44(GPIO related ?)
gpio output level?0x48 2,3 = also BT related? bit 4,5 = BT reset/power (which is which?), bit 6 = GSM power
??0x64(GPIO related ?)
??0x66bits: 0=LED0 1=LED1 2=LED2 3=PXA's PWM0??
??0x6a(read-only) GPIO input levels? (same GPIO bits as 0x48)
LED0_TimeBase0x80bits: 0-3=LED_TBS 4=LED_EN 5=LED_AUTOSTOP 6=LED_ALWAYS
??0x82value=0
LED0_PeriodTime0x84
??0x86value=3
LED0_DutyTime0x88
LED0_AutoStopCount0x8aIf autostop_en is set, LED will flash this many times then deactivate
LED1_TimeBase0x90bits: 0-3=LED_TBS 4=LED_EN 5=LED_AUTOSTOP 6=LED_ALWAYS
LED1_PeriodTime0x94
LED1_DutyTime0x98
LED1_AutoStopCount0x9aIf autostop_en is set, LED will flash this many times then deactivate
LED2_TimeBase0xa0bits: 0-3=LED_TBS 4=LED_EN 5=LED_AUTOSTOP 6=LED_ALWAYS
LED2_PeriodTime0xa4
LED2_DutyTime0xa8
LED2_AutoStopCount0xaaIf autostop_en is set, LED will flash this many times then deactivate

GPIO configuration

GPIO#DirectionStateAFRInterruptFunction
GPIO#DirectionStateAFRInterruptFunction
0In10 External power (AC adapter) connected
1In10 Reset button
2Out10 SYS_EN (reserved)
3Out10 PWR_SCL
4Out10 PWR_SDA
5Out10 PWR_CAP 0 (reserved)
6Out10 PWR_CAP 1 (reserved)
7Out10 PWR_CAP 2 (reserved)
8Out10 PWR_CAP 3 (reserved)
9In00
10Out10
11In00RE GSM host wake (?)
12In00
13In10
14In02RE Bluetooth (?) (ASIC6?)
15In13RE FE
16Out12 PWM0
17In12 CIF_DD<6>
18In01 RDY
19Out10
20Out10 LCD power
21In00RE FE Bluetooth int (?)
22In00
23Out00 SD power
24Out10 ASIC clock? (keypad backlight starts blinking slowly when low)
25Out00
26Out10 Vibrate
27Out00
28In01 BITCLK_AC97
29In01 SDATA_In_AC97
30Out02 SDATA_Out_AC97
31Out02 SYNC_AC97
32Out02 MMCCLK
33In00 Silent switch
34In11 FFRXD
35In11 FFCTS
36In10 GSM related (on=1)
37Out10 |EXT_POWER (power pin on multiconnector)
38In00
39Out12 FFTXD
40Out10
41Out12 FFRTS
42In10 GSM related (on=1)
43Out10 GSM related (on=1)
44Out10 When 1 the GSM won't turn on. Have to set to 0 and then toggle GPIO 87 or ASIC GPIO 6
45Out00
46In10
47In00
48In11 CIF_DD<5>
49Out02 nPWE
50In11 DD_CIF<3>
51In11 DD_CIF<2>
52In11 DD_CIF<4>
53Out12 nPCE_2
54Out10
55In11 DD_CIF<1>
56Out10
57Out00 GSM wake (when 0 allows BP to sleep)
58Out12 LDD_0
59Out02 LDD_1
60Out02 LDD_2
61Out12 LDD_3
62Out12 LDD_4
63Out02 LDD_5
64Out12 LDD_6
65Out12 LDD_7
66Out02 LDD_8
67Out02 LDD_9
68Out12 LDD_10
69Out02 LDD_11
70Out02 LDD_12
71Out12 LDD_13
72Out12 LDD_14
73Out02 LDD_15
74Out12 LCD_FCLK
75Out12 LCD_LCLK
76Out02 LCD_PCLK
77Out10 switching this GPIO causes LCD fade out
78Out02 nCS_2
79Out00
80In10
81In12 DD_CIF<0>
82Out00
83Out10
84In13 CIF_FV
85In13 CIF_LV
86Out10 LCD and backlight power
87Out10 Another GSM power (see also ASIC6 gpio 6)
88Out00
89Out11 AC97_SYSCLK
90In00
91In01 KP_MKIN<6>
92Out01 MMCDAT0
93In01 KP_MKIN<0>
94In10 battery_detect_n
95Out01 AC97_RESET_n
96Out13 KP_MKOUT<6>
97In03 KP_MKIN<3>
98In13 KP_MKIN<4>
99In13 KP_MKIN<5>
100In01 KP_MKIN<0>
101In01 KP_MKIN<1>
102In01 KP_MKIN<2>
103Out12 KP_MKOUT<0>
104Out12 KP_MKOUT<1>
105Out12 KP_MKOUT<2>
106Out02 KP_MKOUT<3>
107Out02 KP_MKOUT<4>
108Out12 KP_MKOUT<5>
109Out01 MMCDAT1
110Out01 MMCCS1
111Out01 MMCDAT3
112Out01 MMCCMD
113In10 RE FESD_DETECT
114Out10 USB Power?
115Out00
116Out00 Back speaker power
117Out11 I2CSCL
118Out11 I2CSDA
119In00

Legend:

  • Direction: In - input, Out - output, In/Out? - bidirectional
  • State: pin level, GPLR
  • AFR (Alternate Function Number): 0-3, GAFR
  • Interrupt (status): Rising Edge (RE), Falling Edge (FE)
  • Function - description

HTC Bootloader

You can access the bootloader via USB from a Linux host computer with this patch. To enter bootloader mode, hold down the hotsync button on the USB cable and reset the treo.

From shadowmite.com:

pmsys =0xA171A808
HTC Sausalito Bootloader Version : BOOTLOAD V0.24 Built on Apr 14 2005 at 15: Copyright (c) 2003 High Tech Computer Corporation
++Check BT Router
>>? Available monitor commands are: ? [command]
h [command]
mb [StartAddr [Count [Filler]]] --- Display/Set memory
mh [StartAddr [Count [Filler]]] --- Display/Set memory
mw [StartAddr [Count [Filler]]] --- Display/Set memory
l [pathname] --- Start a BIN file download via MTTY
lr [pathname] --- Same as above, but run it when complete
tftp --- Start a BIN file download via tFtp
flashtest --- This appears to try writing to every byte of memory, it will kill a phone!
jump [addr] --- Jump to a memory address
touch --- Touch Screen Test
touchssp --- Touch SSPx panel test??
idle --- Put the CPU into idle state
sense --- Put the CPU into sense state
standby --- Put the CPU into standby state
sleep --- Put the CPU into sleep state
deepsleep --- Put the CPU into deepsleep state
fcs [CLKCFG] --- Alter the CPU freq.
keytest --- Keypad test
pi2ctest --- Power I2C bus tests
debug
flashtype 0 (or 1)
rdoc 0(IPL)/1(SPL)/2(XIPKERNEL)/3(BINFS)
os
upload [addr] [size] --- Upload memory to terminal - writes binary to your connection!
pwr [0:normal; 1:idle; 2:standby; 3:sleep; 5:sense;
wpdoc [0/1] KEY
usb --- USB debug mode enable
led [1:LED1; 2:LED2; 3:LED3 ]
r2sd [command]
sd2r
rtask [Type[Value]]
rroute
rtest
rimgdata
jmptoos
pwm
audio
btrouter
vibratortest
audiogsm
audiocdma
dsdoc 1 or 0
gsm460
hwt
gsmdl 

Hidden commands:

ruu
gettoken
settoken