Handhelds.org - Open source for handheld devices

PalmTreo650Hardware

Palm Treo 650 Hardware

Home | Status | Hardware | Downloads | How-To | Bootloader

Photos

• Check out the screenshots here

Specifications

• General Device Specification

• http://www.palm.com/us/products/smartphones/treo650/details.epl

• CPU

• Intel XScale PXA270

• http://www.intel.com/design/embeddedpca/applicationsprocessors/302302.htm

• XScale manuals are downloadable from Gumstix

• ROM

• 32mb M-Systems DiskOnChip P3

• Product brief (PDF)

• read-only driver source

• RAM

• 32mb Samsung K4S56163LF SDRAM

• Datasheet (PDF)

• Display

• 320x320

• Sony ACX533AKM

• HTC part no. 60H00027-00

• AC97 Touchscreen / Audio codec

• WM9712

• Datasheet (PDF)

• Bluetooth

• Broadcom BCM2035

• Datasheet (PDF)

• ASIC6

• HTC-30H80049-00

• Controls LEDs, backlight, fourth serial port, other stuff?

• Registers mapped at 8000000

• GSM phone module

• Present only in the GSM version of the Treo 650.

• Communicated with via ttyS0 FFUART baud 460800.

• Broadcom BCM2132 EDGE/GPRS/GSM Baseband Processor

• Product brief (PDF)

• AT commands partially documented by a Sony Ericcson PC card manual (PDF)

• See also: EDGE_EE54_AT_Commands_Rev_C.pdf (PDF)

• Infineon PMB6258 EDGE RF Transceiver

• Product brief (PDF)

• Spansion 71PL032JA 32Mbit Flash + 8Mbit SRAM

• Datasheet (PDF)

• Power Management

• MAXIM MAX1587A I2C power management

• Datasheet (PDF)

• MAXIM MAX1874E USB/AC Li+ battery charger

• Datasheet (PDF)

• DS2761 battery monitor (believed to be located in battery)

• Datasheet (PDF)

• Camera

• Uses I2C and PXA's Quick Capture Interface

• SD/SDIO/MMC

• Uses CPU's controller

• USB

• Uses CPU's controller

GSM module

The GSM module is connected to the FFUART, audio codec and several GPIOs. On reset it speaks regular AT commands at baud 460800. It responds ERROR to almost everything until it is put into a high power state with AT+CFUN=1. Once in that state the module will put itself to sleep after being idle for 30 seconds, to make it up you must toggle the GSM WAKE (57) GPIO.

Undocumented commands

These commands aren't documented in the GC7x/GC8x command reference. The full (?) list of commands can be found with AT* or AT+CLAC.

AT*MBSEL band selection

AT*MBSEL=? *MBSEL: (0-6)

See: GreenphoneBandSelection::setBand

AT*MCAM call monitoring info

AT*MCAM=? *MCAM: (0,1)

See: GreenphoneCallProvider::mcamNotification

AT*MCSQ unsolicited call quality

AT*MCSQ=0 AT*MCSQ=1

See: GreenphoneModemService::reset

AT*MECNS echo cancellation and noise suppression

AT*MECNS=? *MECNS: (1-10),(0-32767),(0-32767),(0-32767),(0-32767),(0-32767),(0-32767),(0-32767)

See: GreenphoneModemService::setNoiseSuppression

AT*MKEYTONE play DTMS to local speaker

AT*MKEYTONE=? *MKEYTONE: (0-9, "*","#"), (0-500)

See: AT+VTS command which transmits the tone, but doesn't play locally

AT*MTZ timezone notification

AT*MTZ=? *MTZ: (1-3),(0-1) AT*MTZ? *MTZ: 3

See: GreenphoneModemService::mtz2Notification

AT*MVCHN select voice channel

AT*MVCHN? *MVCHN: 1

AT*MVCHN=? *MVCHN: (0,1)

See: GreenphoneModemService::setOutput

AT*MVERS extra modem firmware version info

See: GreenphoneConfiguration::request

AT*MVMSC voice mail service numbers

AT*MVMSC=? *MVMSC: (1-5),(0-1),(?),(128,129,145)

See: GreenphoneServiceNumbers::setServiceNumber

Keypad matrix

All the buttons except silent switch and reset button are connected to the PXA270's matrix keypad controller.

The Treo uses MKOUT0-MKOUT3

Palm OS MMU configuration

Unlike other Palms the Treo has the TTB at 0xa1ffc000, this is mapped 1-1 but as a read-only page.

(Table is incomplete.)

LCD configuration

As set by PalmOS. The LCD registers are mapped to put value here by Linux.

Backlight is controlled by PXA's PWM0.

UARTs

ASIC 6 (HTC-30H80049-00)

B0000000: 00 00 00 00 01 00 00 00 - 00 00 60 00 B0 00 00 00 | ..........`.....
B0000010: 40 00 E0 00 00 00 0F 00 - 0F 00 0F 00 00 00 00 00 | @...............
B0000020: 07 00 01 00 00 00 0E 00 - 00 00 00 00 0F 00 00 00 | ................
B0000030: 08 00 01 00 02 00 02 00 - 00 00 00 00 00 00 00 00 | ................
B0000040: FF 00 1F 00 FA 00 1F 00 - 80 00 1F 00 00 00 00 00 | ................
B0000050: 00 00 00 00 00 00 00 00 - FF 00 1F 00 00 00 00 00 | ................
B0000060: 00 00 00 00 00 00 00 00 - 00 00 80 00 1F 00 00 00 | ................
B0000070: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B0000080: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B0000090: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000B0: 08 00 00 00 0E 00 02 00 - 00 00 00 00 00 00 00 00 | ................
B00000C0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000D0: 18 00 01 00 0F 00 00 00 - 00 00 00 00 00 00 00 00 | ................
B00000E0: 48 00 54 00 43 00 2D 00 - 33 00 30 00 48 00 38 00 | H.T.C.-.3.0.H.8.
B00000F0: 30 00 30 00 34 00 39 00 - 2D 00 30 00 30 00 00 00 | 0.0.4.9.-.0.0...

GPIO configuration

Legend:

• Direction: In - input, Out - output, In/Out - bidirectional

• State: pin level, GPLR

• AFR (Alternate Function Number): 0-3, GAFR

• Interrupt (status): Rising Edge (RE), Falling Edge (FE)

• Function - description

HTC Bootloader

You can access the bootloader via USB from a Linux host computer with this patch. To enter bootloader mode, hold down the hotsync button on the USB cable and reset the treo.

From shadowmite.com:

pmsys =0xA171A808
HTC Sausalito Bootloader Version : BOOTLOAD V0.24 Built on Apr 14 2005 at 15: Copyright (c) 2003 High Tech Computer Corporation
++Check BT Router
>>? Available monitor commands are: ? [command]
h [command]
mb [StartAddr [Count [Filler]]] --- Display/Set memory
mh [StartAddr [Count [Filler]]] --- Display/Set memory
mw [StartAddr [Count [Filler]]] --- Display/Set memory
l [pathname] --- Start a BIN file download via MTTY
lr [pathname] --- Same as above, but run it when complete
tftp --- Start a BIN file download via tFtp
flashtest --- This appears to try writing to every byte of memory, it will kill a phone!
jump [addr] --- Jump to a memory address
touch --- Touch Screen Test
touchssp --- Touch SSPx panel test??
idle --- Put the CPU into idle state
sense --- Put the CPU into sense state
standby --- Put the CPU into standby state
sleep --- Put the CPU into sleep state
deepsleep --- Put the CPU into deepsleep state
fcs [CLKCFG] --- Alter the CPU freq.
keytest --- Keypad test
pi2ctest --- Power I2C bus tests
debug
flashtype 0 (or 1)
rdoc 0(IPL)/1(SPL)/2(XIPKERNEL)/3(BINFS)
os
upload [addr] [size] --- Upload memory to terminal - writes binary to your connection!
pwr [0:normal; 1:idle; 2:standby; 3:sleep; 5:sense;
wpdoc [0/1] KEY
usb --- USB debug mode enable
led [1:LED1; 2:LED2; 3:LED3 ]
r2sd [command]
sd2r
rtask [Type[Value]]
rroute
rtest
rimgdata
jmptoos
pwm
audio
btrouter
vibratortest
audiogsm
audiocdma
dsdoc 1 or 0
gsm460
hwt
gsmdl 

Hidden commands:

ruu
gettoken
settoken 

MoinMoin Powered

Immutable page (last edited 2008-10-13 13:43:51 by AlexOsborne)

Or try one of these actions: AttachFile, DeletePage, LikePages, LocalSiteMap, RenamePage, SpellCheck