HardwareCalypso » History » Version 16
fixeria, 07/11/2018 11:20 AM
1 | 1 | laforge | h1. Calypso Digital Baseband |
---|---|---|---|
2 | 15 | laforge | |
3 | 16 | fixeria | {{>toc}} |
4 | 15 | laforge | |
5 | 1 | laforge | The Calypso Digital Base Band chip is a popular DBB implementation for inexpensive feature phones. |
6 | |||
7 | 5 | laforge | The register-level manuals seem to have leaked at some point and are available from cryptome.org |
8 | 6 | laforge | at http://cryptome.org/ti-calypso2.pdf and http://cryptome.org/ti-calypso1.pdf |
9 | 7 | laforge | |
10 | 1 | laforge | As cryptome.org is currently suffering legal battles due to Microsoft stupidity, |
11 | you can use http://cryptome.quintessenz.org/mirror/ti-calypso1.pdf / http://cryptome.quintessenz.org/mirror/ti-calypso2.pdf |
||
12 | |||
13 | |||
14 | 15 | laforge | h2. Variants |
15 | 1 | laforge | |
16 | 15 | laforge | * Calypso G2 C035 |
17 | * Calypso G2 C035 Lite (D751749GHH) |
||
18 | ** Like C035, only 256kBytes of internal memory |
||
19 | 1 | laforge | |
20 | |||
21 | 15 | laforge | h2. DSP |
22 | 1 | laforge | |
23 | |||
24 | 15 | laforge | More information on the DSP used in the Calypso DBB is available on [[HardwareCalypsoDSP]]. |
25 | 1 | laforge | |
26 | |||
27 | 15 | laforge | h2. CPU |
28 | |||
29 | |||
30 | The CPU embedded in the calypso chipset is a ARM7TDMI. Details documents about this CPU is available from the ARM infocenter at "h2. Memory Map |
||
31 | |||
32 | |||
33 | * nCS0 0x0000'0000 ... 0x007f'ffff (C123: external NOR flash) |
||
34 | * nCS6 0x0080'0000 ... 0x00bf'ffff (internal SRAM, in case of calypso lite only 256kBytes) |
||
35 | * nCS1 0x0100'0000 ... 0x017f'ffff (C123: external SRAM) |
||
36 | |||
37 | |||
38 | h2. Integrated Peripherals == |
||
39 | TPU (Time Processing Unit) === |
||
40 | * A programmable micro-engine clocked at GSM quarter-bit clock |
||
41 | |||
42 | h3. MODEM UART |
||
43 | |||
44 | * The UART that is typically connected to a PC or the application processor in a smartphone |
||
45 | |||
46 | h3. IRDA UART |
||
47 | |||
48 | * The UART that is either connected to IRDA or for diagnostics/programming |
||
49 | |||
50 | h3. RIF (Radio Interface) |
||
51 | |||
52 | * Connects to the synchronous bi-directional BSP (Baseband Serial Port) |
||
53 | |||
54 | h3. DPLL + clock block |
||
55 | |||
56 | * Generate clocks for DSP, ARM and all peripherals |
||
57 | |||
58 | h3. GEA (GPRS Encryption Algorithm) |
||
59 | |||
60 | * Encrypts/Decrypts data according to the proprietary GEA algorithm |
||
61 | |||
62 | h3. Watchdog timer === |
||
63 | Interrupt Controller === |
||
64 | |||
65 | h3. Memory interface (SRAM/ROM) === |
||
66 | DMA controller === |
||
67 | * Only usable for UART and RIF, can only DMA to small API RAM memory region |
||
68 | |||
69 | h3. SIM card controller |
||
70 | |||
71 | * Connects to the SIM card socket in the phone |
||
72 | |||
73 | h3. TSP controller (Time Serial Port) |
||
74 | |||
75 | * Controls the TSP, which controls the sequencing of all external peripherals like ABB, RF chip, RF PA, Antenna Switch |
||
76 | |||
77 | h3. RTC clock |
||
78 | |||
79 | * A pretty standard realtime clock |
||
80 | |||
81 | h3. ULPD (Ultra Low Power Device) |
||
82 | |||
83 | * Responsible for enabling the phone to go to lowest-possible power mode while IDLE, but still waking up at the right point to receive important data (like paging channel) from the BTS |
||
84 | |||
85 | h3. I2C Master controller |
||
86 | |||
87 | * Typically connects to external peripherals like LCD (if any) |
||
88 | |||
89 | 7 | laforge | The controller has two oddities: |
90 | 15 | laforge | * It assumes that the peripheral has an address byte. If your peripheral doesn't, you have to |
91 | 7 | laforge | write the first byte into the address register and not the FIFO |
92 | 15 | laforge | * You cannot under-fill the FIFO, i.e. if you write 8 bytes into the 16byte deep fifo, the controller |
93 | 2 | laforge | will transmit 16 bytes rather than 8. Therefore, always limit the FIFO depth to your write size! |
94 | 15 | laforge | More details about this can be seen at [[HardwareCalypsoI2CFIFO"httpinfocenterarmcomhelpindexjsp]]. |
95 | |||
96 | h3. SPI Master controller |
||
97 | |||
98 | * Connects to USP of ABB and possibly other external peripherals |
||
99 | |||
100 | h3. TIMER1 / TIMER2 general purpose timers |
||
101 | |||
102 | 2 | laforge | The timer input clock is not mentioned in the data sheet. It seems to be 13MHz / 32, i.e. 406.25kHz |
103 | 7 | laforge | |
104 | 15 | laforge | h3. PWL (PWM for Light) |
105 | 7 | laforge | |
106 | 15 | laforge | * connected to the screen/keypad backlight |
107 | 10 | steve-m | |
108 | 15 | laforge | h3. PWT (PWM for Tones) |
109 | |||
110 | * connected to a buzzer for ringtone generation |
||
111 | |||
112 | |||
113 | h3. JTAG Interface |
||
114 | |||
115 | |||
116 | The Calypso has an ARM7TDMI JTAG interface, which is exposed on phones like the Motorola [[MotorolaC115|C115] [wikiMotorolaC155 C155] [wikiSonyEricssonJ100i Sony Ericsson J100i] and the [wikiPirelliDPL10 Pirelli DP-L10]]. |
||
117 | With standard ARM JTAG debuggers like [[OpenOCD]], halting the core does not work out-of-the-box, because ARM instruction 0xb needs to be executed first (which is an proprietary extension to the ARM7TDMI TAP-Controller). It is unclear what this instruction does exactly. |
||
118 | The [[OpenOCD]] configuration file along with the corresponding svf-file is attached to this page. |
||
119 | |||
120 | |||
121 | h3. Debug traces |
||
122 | |||
123 | 1 | laforge | |
124 | The chip has very tiny debug traces on a small flex-pcb around the 4 sides of the chip. |
||
125 | Which trace goes to which ball can be seen on this scan: http://www.steve-m.de/pictures/calypso_bottom.jpg |