HardwareCalypso » History » Version 15
Anonymous, 02/19/2016 10:49 PM
1 | 15 | laforge | {{>toc}} |
---|---|---|---|
2 | 1 | laforge | |
3 | 15 | laforge | h1. Calypso Digital Baseband |
4 | |||
5 | |||
6 | 1 | laforge | The Calypso Digital Base Band chip is a popular DBB implementation for inexpensive feature phones. |
7 | |||
8 | 5 | laforge | The register-level manuals seem to have leaked at some point and are available from cryptome.org |
9 | 6 | laforge | at http://cryptome.org/ti-calypso2.pdf and http://cryptome.org/ti-calypso1.pdf |
10 | 7 | laforge | |
11 | 1 | laforge | As cryptome.org is currently suffering legal battles due to Microsoft stupidity, |
12 | you can use http://cryptome.quintessenz.org/mirror/ti-calypso1.pdf / http://cryptome.quintessenz.org/mirror/ti-calypso2.pdf |
||
13 | |||
14 | |||
15 | 15 | laforge | h2. Variants |
16 | 1 | laforge | |
17 | 15 | laforge | * Calypso G2 C035 |
18 | * Calypso G2 C035 Lite (D751749GHH) |
||
19 | ** Like C035, only 256kBytes of internal memory |
||
20 | 1 | laforge | |
21 | |||
22 | 15 | laforge | h2. DSP |
23 | 1 | laforge | |
24 | |||
25 | 15 | laforge | More information on the DSP used in the Calypso DBB is available on [[HardwareCalypsoDSP]]. |
26 | 1 | laforge | |
27 | |||
28 | 15 | laforge | h2. CPU |
29 | |||
30 | |||
31 | The CPU embedded in the calypso chipset is a ARM7TDMI. Details documents about this CPU is available from the ARM infocenter at "h2. Memory Map |
||
32 | |||
33 | |||
34 | * nCS0 0x0000'0000 ... 0x007f'ffff (C123: external NOR flash) |
||
35 | * nCS6 0x0080'0000 ... 0x00bf'ffff (internal SRAM, in case of calypso lite only 256kBytes) |
||
36 | * nCS1 0x0100'0000 ... 0x017f'ffff (C123: external SRAM) |
||
37 | |||
38 | |||
39 | h2. Integrated Peripherals == |
||
40 | TPU (Time Processing Unit) === |
||
41 | * A programmable micro-engine clocked at GSM quarter-bit clock |
||
42 | |||
43 | h3. MODEM UART |
||
44 | |||
45 | * The UART that is typically connected to a PC or the application processor in a smartphone |
||
46 | |||
47 | h3. IRDA UART |
||
48 | |||
49 | * The UART that is either connected to IRDA or for diagnostics/programming |
||
50 | |||
51 | h3. RIF (Radio Interface) |
||
52 | |||
53 | * Connects to the synchronous bi-directional BSP (Baseband Serial Port) |
||
54 | |||
55 | h3. DPLL + clock block |
||
56 | |||
57 | * Generate clocks for DSP, ARM and all peripherals |
||
58 | |||
59 | h3. GEA (GPRS Encryption Algorithm) |
||
60 | |||
61 | * Encrypts/Decrypts data according to the proprietary GEA algorithm |
||
62 | |||
63 | h3. Watchdog timer === |
||
64 | Interrupt Controller === |
||
65 | |||
66 | h3. Memory interface (SRAM/ROM) === |
||
67 | DMA controller === |
||
68 | * Only usable for UART and RIF, can only DMA to small API RAM memory region |
||
69 | |||
70 | h3. SIM card controller |
||
71 | |||
72 | * Connects to the SIM card socket in the phone |
||
73 | |||
74 | h3. TSP controller (Time Serial Port) |
||
75 | |||
76 | * Controls the TSP, which controls the sequencing of all external peripherals like ABB, RF chip, RF PA, Antenna Switch |
||
77 | |||
78 | h3. RTC clock |
||
79 | |||
80 | * A pretty standard realtime clock |
||
81 | |||
82 | h3. ULPD (Ultra Low Power Device) |
||
83 | |||
84 | * Responsible for enabling the phone to go to lowest-possible power mode while IDLE, but still waking up at the right point to receive important data (like paging channel) from the BTS |
||
85 | |||
86 | h3. I2C Master controller |
||
87 | |||
88 | * Typically connects to external peripherals like LCD (if any) |
||
89 | |||
90 | 7 | laforge | The controller has two oddities: |
91 | 15 | laforge | * It assumes that the peripheral has an address byte. If your peripheral doesn't, you have to |
92 | 7 | laforge | write the first byte into the address register and not the FIFO |
93 | 15 | laforge | * You cannot under-fill the FIFO, i.e. if you write 8 bytes into the 16byte deep fifo, the controller |
94 | 2 | laforge | will transmit 16 bytes rather than 8. Therefore, always limit the FIFO depth to your write size! |
95 | 15 | laforge | More details about this can be seen at [[HardwareCalypsoI2CFIFO"httpinfocenterarmcomhelpindexjsp]]. |
96 | |||
97 | h3. SPI Master controller |
||
98 | |||
99 | * Connects to USP of ABB and possibly other external peripherals |
||
100 | |||
101 | h3. TIMER1 / TIMER2 general purpose timers |
||
102 | |||
103 | 2 | laforge | The timer input clock is not mentioned in the data sheet. It seems to be 13MHz / 32, i.e. 406.25kHz |
104 | 7 | laforge | |
105 | 15 | laforge | h3. PWL (PWM for Light) |
106 | 7 | laforge | |
107 | 15 | laforge | * connected to the screen/keypad backlight |
108 | 10 | steve-m | |
109 | 15 | laforge | h3. PWT (PWM for Tones) |
110 | |||
111 | * connected to a buzzer for ringtone generation |
||
112 | |||
113 | |||
114 | h3. JTAG Interface |
||
115 | |||
116 | |||
117 | The Calypso has an ARM7TDMI JTAG interface, which is exposed on phones like the Motorola [[MotorolaC115|C115] [wikiMotorolaC155 C155] [wikiSonyEricssonJ100i Sony Ericsson J100i] and the [wikiPirelliDPL10 Pirelli DP-L10]]. |
||
118 | With standard ARM JTAG debuggers like [[OpenOCD]], halting the core does not work out-of-the-box, because ARM instruction 0xb needs to be executed first (which is an proprietary extension to the ARM7TDMI TAP-Controller). It is unclear what this instruction does exactly. |
||
119 | The [[OpenOCD]] configuration file along with the corresponding svf-file is attached to this page. |
||
120 | |||
121 | |||
122 | h3. Debug traces |
||
123 | |||
124 | 1 | laforge | |
125 | The chip has very tiny debug traces on a small flex-pcb around the 4 sides of the chip. |
||
126 | Which trace goes to which ball can be seen on this scan: http://www.steve-m.de/pictures/calypso_bottom.jpg |