HardwareCalypso » History » Version 14
Anonymous, 02/19/2016 10:48 PM
1 | 5 | laforge | [[PageOutline]] |
---|---|---|---|
2 | 1 | laforge | = Calypso Digital Baseband = |
3 | |||
4 | The Calypso Digital Base Band chip is a popular DBB implementation for inexpensive feature phones. |
||
5 | |||
6 | 5 | laforge | The register-level manuals seem to have leaked at some point and are available from cryptome.org |
7 | 6 | laforge | at http://cryptome.org/ti-calypso2.pdf and http://cryptome.org/ti-calypso1.pdf |
8 | 5 | laforge | |
9 | 8 | laforge | As cryptome.org is currently suffering legal battles due to Microsoft stupidity, |
10 | you can use http://cryptome.quintessenz.org/mirror/ti-calypso1.pdf / http://cryptome.quintessenz.org/mirror/ti-calypso2.pdf |
||
11 | 7 | laforge | |
12 | 1 | laforge | == Variants == |
13 | * Calypso G2 C035 |
||
14 | * Calypso G2 C035 Lite (D751749GHH) |
||
15 | * Like C035, only 256kBytes of internal memory |
||
16 | 2 | laforge | |
17 | 12 | nion | == DSP == |
18 | |||
19 | More information on the DSP used in the Calypso DBB is available on [wiki:Hardware/CalypsoDSP]. |
||
20 | |||
21 | 9 | vogelchr | == CPU == |
22 | |||
23 | The CPU embedded in the calypso chipset is a ARM7TDMI. Details documents about this CPU is available from the ARM infocenter at [http://infocenter.arm.com/help/index.jsp]. |
||
24 | |||
25 | 3 | laforge | == Memory Map == |
26 | |||
27 | 4 | roh | * nCS0 0x0000'0000 ... 0x007f'ffff (C123: external NOR flash) |
28 | 3 | laforge | * nCS6 0x0080'0000 ... 0x00bf'ffff (internal SRAM, in case of calypso lite only 256kBytes) |
29 | * nCS1 0x0100'0000 ... 0x017f'ffff (C123: external SRAM) |
||
30 | 2 | laforge | |
31 | == Integrated Peripherals == |
||
32 | 7 | laforge | === TPU (Time Processing Unit) === |
33 | * A programmable micro-engine clocked at GSM quarter-bit clock |
||
34 | === MODEM UART === |
||
35 | * The UART that is typically connected to a PC or the application processor in a smartphone |
||
36 | === IRDA UART === |
||
37 | * The UART that is either connected to IRDA or for diagnostics/programming |
||
38 | === RIF (Radio Interface) === |
||
39 | * Connects to the synchronous bi-directional BSP (Baseband Serial Port) |
||
40 | === DPLL + clock block === |
||
41 | * Generate clocks for DSP, ARM and all peripherals |
||
42 | === GEA (GPRS Encryption Algorithm) === |
||
43 | * Encrypts/Decrypts data according to the proprietary GEA algorithm |
||
44 | === Watchdog timer === |
||
45 | === Interrupt Controller === |
||
46 | === Memory interface (SRAM/ROM) === |
||
47 | === DMA controller === |
||
48 | * Only usable for UART and RIF, can only DMA to small API RAM memory region |
||
49 | === SIM card controller === |
||
50 | * Connects to the SIM card socket in the phone |
||
51 | === TSP controller (Time Serial Port) === |
||
52 | * Controls the TSP, which controls the sequencing of all external peripherals like ABB, RF chip, RF PA, Antenna Switch |
||
53 | === RTC clock === |
||
54 | * A pretty standard realtime clock |
||
55 | === ULPD (Ultra Low Power Device) === |
||
56 | * Responsible for enabling the phone to go to lowest-possible power mode while IDLE, but still waking up at the right point to receive important data (like paging channel) from the BTS |
||
57 | === I2C Master controller === |
||
58 | * Typically connects to external peripherals like LCD (if any) |
||
59 | 2 | laforge | |
60 | The controller has two oddities: |
||
61 | 1 | laforge | * It assumes that the peripheral has an address byte. If your peripheral doesn't, you have to |
62 | write the first byte into the address register and not the FIFO |
||
63 | * You cannot under-fill the FIFO, i.e. if you write 8 bytes into the 16byte deep fifo, the controller |
||
64 | 2 | laforge | will transmit 16 bytes rather than 8. Therefore, always limit the FIFO depth to your write size! |
65 | 13 | nion | More details about this can be seen at [wiki:Hardware/CalypsoI2CFIFO] |
66 | 7 | laforge | === SPI Master controller === |
67 | * Connects to USP of ABB and possibly other external peripherals |
||
68 | === TIMER1 / TIMER2 general purpose timers === |
||
69 | 2 | laforge | The timer input clock is not mentioned in the data sheet. It seems to be 13MHz / 32, i.e. 406.25kHz |
70 | 7 | laforge | === PWL (PWM for Light) === |
71 | * connected to the screen/keypad backlight |
||
72 | === PWT (PWM for Tones) === |
||
73 | * connected to a buzzer for ringtone generation |
||
74 | 10 | steve-m | |
75 | 11 | steve-m | === JTAG Interface === |
76 | |||
77 | The Calypso has an ARM7TDMI JTAG interface, which is exposed on phones like the Motorola [wiki:MotorolaC115 C115], [wiki:MotorolaC155 C155], [wiki:SonyEricssonJ100i Sony Ericsson J100i] and the [wiki:PirelliDPL10 Pirelli DP-L10]. |
||
78 | With standard ARM JTAG debuggers like OpenOCD, halting the core does not work out-of-the-box, because ARM instruction 0xb needs to be executed first (which is an proprietary extension to the ARM7TDMI TAP-Controller). It is unclear what this instruction does exactly. |
||
79 | The OpenOCD configuration file along with the corresponding svf-file is attached to this page. |
||
80 | 10 | steve-m | |
81 | === Debug traces === |
||
82 | |||
83 | The chip has very tiny debug traces on a small flex-pcb around the 4 sides of the chip. |
||
84 | Which trace goes to which ball can be seen on this scan: http://www.steve-m.de/pictures/calypso_bottom.jpg |