OsmocomBB

{{>toc}}

h1. The Calypso DSP

The DSP inside the Calypso is a TMS320c5x LEAD2 DSP core.

The software inside the DSP is mainly mask-ROM implementing the signal processing related part of GSM (mostly Rx side).

h2. DSP Hardware

h3. Bus

The DSP has its own address adress and data bus, independent of the ARM bus.

There is a bridge (called RHEA bridge) interfacing the DSP with its peripherals.

h3. Clock

The Clock is fed from the DPLL of the Calypso chip.

h3. Reset

The Reset line of the DSP is controlled by the ARM.

h3. API RAM

There's a shared memory window (8kWords, i.e. 16kByte) between the DSP and the ARM used for inter-CPU-communication

h2. DSP Software

h3. Patches

The normal phone firmware downloads patches into the DSP RAM, using the API memory.

The DSP ROM code seems to contain some patch download program that is executed after reset.

Patches are likely used to fix bugs and to extend features in the DSP

h3. API

The API is the programming interface implemented via the API RAM.

It consists of

* A double buffered (DB) Read Page (DSP->ARM direction, mostly response values)

* A double buffered (DB) Write Page (ARM->DSP direction, mostly commands)

* A non double-buffered (NDB) Page

* A parameter area

Some parameters details:

* @ndb.d_tch_mode@

*** bit 11: ABB model selection. @1@ selects IOTA, @0@ selects ???. This changes the address at which @BULDATA@ register is expected.

*** bit ![10:7] : Number of guard bits inserted before actual data when TXing burst. (actual value - 4). Max value seems to be 8 guard bit. After that the DSP code will do strange things. So setting a value of 4 will TX 4+4=8 guard bits and so will be @11111111000xxxxx...@. The @1@ are guard bits, then 3 x @0@ of tail, then the data.

h3. Timing

The timing we know so far is for single-slot operation (i.e. only one of the 8 timeslots is used)

The flow of events is as follows:

* The ARM utilizeds the DB Write page to define the set of actions (tasks) to be performed by the DSP

** It indicates which tasks (GSM and/or MISC) are to be executed by a field in the NDB page

** It indicates which of the two double buffered write pages was used in the NDB page

* The ARM tells the TPU to issue a FRAME interrupt at the next GSM frame

* When the first FRAME interrupt executes, the DSP starts to process the tasks as indicated by the ARM

** The DSP seems to need a setup time of 66 Quarter-bits before it receives RF samples via TSP (DSP_SETUP_TIME)

** The DSP receives and processes the sample data

** Results are stored as they are ready, using the DB Read page

* When the next FRAME interrupt executes, the ARM can read the results from the DB Read page.

Those flows normally happen overlapping, i.e. after the first FRAME interrupt above, the ARM can already write

the next set of commands to the _other_ DB Write page.

Of course, some more complex DSP tasks take more than one frame to complete.  The ARM code needs to know how

many frame interrupts to wait before reading the results from the DB Read page.

h3. Tasks

The DSP has a number of tasks that it can execute on behalf of the ARM.  A full list is available at [[TSM30Layer1#DSPTasks]]

Please don't confuse DSP tasks with Layer1 tasks.  They are both called _tasks_ and even use one namespace,

but are distinctively different.  Each layer1 task (on the ARM) is using a sequence of one or multiple DSP tasks.

h4. CHECKSUM

This task computes a checksum over the program code inside the DSP.  It is used to ensure that patches in combination with

the ROM code have the desired overall result.

The checksum task finishes after 1 frame.

h4. PM (Power Measurement) / AGC Task

This task measures the received power level to control the gain of the analog Rx path.

The ARM can specify how many measurements are to be taken (1,2 or 3).

The number of measurements determines the execution time.

h4. FB (Frequency Burst)

This task performs Frequency Burst detection/decoding in idle mode.

This task finishes after a maximum of 13 frames.

The first frame is "idle", and all further 12 frames are checked for frequency burst detection results in the NDB page.

h4. SB (Synchronisation Burst)

This task performs Synchronisation Burst detection/decoding in idle mode.

<pre>

It processes 190 IQ samples and has a 50 bits training sequence search window starting at sample!r39 and correlating the full 64 bits.

(See PROM0:7C2C in DSP code for more details about demodulation)

h4. RX NB (Normal Burst - Reception)

This task performs reception of Normal Bursts in both idle mode & dedicated mode. It should be called four times (for the 4 bursts) and the final data can be retrieved on the fourth call response.

It processes 150 IQ samples and has a 10 bits training sequence search window starting at sample!r68 and correlating only 16 bits (TSC![10..25]).

(See PROM0:7C27 in DSP code for more details about demodulation)

h4. TCH_FB (Frequency Burst)

This task performs Frequency Burst reading in dedicated mode.

h4. TCH_SB (Synchronisation Burst)

This task performs Synchronisation Burst reading in dedicated mode.

h3. Data Formats

h4. Angle

This angle indicates how far the received carrier clock deviates from our synthesised LO-based clock.

It's measured in radians and coded in fx1.15 notation (fixed-point 16bit data type with 1 bit integral and 15bit fractional)

h4. SNR (Signal/Noise Ratio)

The SNR as measured by the DSP is measured in dB and coded in fx6.10 notation.

h4. Power

The Power of a signal present at the ADC baseband input, coded  in 1/64dBm

h4. TOA (Time Of Arrival)

When reading NB, this is expressed as full bits and seems to be only positive.