Project

General

Profile

HardwareCalypso » History » Version 16

fixeria, 07/11/2018 11:20 AM

1 1 laforge
h1. Calypso Digital Baseband
2 15 laforge
3 16 fixeria
{{>toc}}
4 15 laforge
5 1 laforge
The Calypso Digital Base Band chip is a popular DBB implementation for inexpensive feature phones.
6
7 5 laforge
The register-level manuals seem to have leaked at some point and are available from cryptome.org
8 6 laforge
at http://cryptome.org/ti-calypso2.pdf and http://cryptome.org/ti-calypso1.pdf
9 7 laforge
10 1 laforge
As cryptome.org is currently suffering legal battles due to Microsoft stupidity,
11
you can use http://cryptome.quintessenz.org/mirror/ti-calypso1.pdf / http://cryptome.quintessenz.org/mirror/ti-calypso2.pdf
12
13
14 15 laforge
h2. Variants
15 1 laforge
16 15 laforge
* Calypso G2 C035 
17
* Calypso G2 C035 Lite (D751749GHH)
18
** Like C035, only 256kBytes of internal memory
19 1 laforge
20
21 15 laforge
h2. DSP
22 1 laforge
23
24 15 laforge
More information on the DSP used in the Calypso DBB is available on [[HardwareCalypsoDSP]].
25 1 laforge
26
27 15 laforge
h2. CPU
28
29
30
The CPU embedded in the calypso chipset is a ARM7TDMI. Details documents about this CPU is available from the ARM infocenter at "h2. Memory Map
31
32
33
* nCS0 0x0000'0000 ... 0x007f'ffff (C123: external NOR flash)
34
* nCS6 0x0080'0000 ... 0x00bf'ffff (internal SRAM, in case of calypso lite only 256kBytes)
35
* nCS1 0x0100'0000 ... 0x017f'ffff (C123: external SRAM)
36
37
38
h2. Integrated Peripherals ==
39
 TPU (Time Processing Unit) ===
40
* A programmable micro-engine clocked at GSM quarter-bit clock
41
42
h3. MODEM UART
43
44
* The UART that is typically connected to a PC or the application processor in a smartphone
45
46
h3. IRDA UART
47
48
* The UART that is either connected to IRDA or for diagnostics/programming
49
50
h3. RIF (Radio Interface)
51
52
* Connects to the synchronous bi-directional BSP (Baseband Serial Port)
53
54
h3. DPLL + clock block
55
56
* Generate clocks for DSP, ARM and all peripherals
57
58
h3. GEA (GPRS Encryption Algorithm)
59
60
* Encrypts/Decrypts data according to the proprietary GEA algorithm
61
62
h3. Watchdog timer ===
63
 Interrupt Controller ===
64
65
h3. Memory interface (SRAM/ROM) ===
66
 DMA controller ===
67
* Only usable for UART and RIF, can only DMA to small API RAM memory region
68
69
h3. SIM card controller
70
71
* Connects to the SIM card socket in the phone
72
73
h3. TSP controller (Time Serial Port)
74
75
* Controls the TSP, which controls the sequencing of all external peripherals like ABB, RF chip, RF PA, Antenna Switch
76
77
h3. RTC clock
78
79
* A pretty standard realtime clock
80
81
h3. ULPD (Ultra Low Power Device)
82
83
* Responsible for enabling the phone to go to lowest-possible power mode while IDLE, but still waking up at the right point to receive important data (like paging channel) from the BTS
84
85
h3. I2C Master controller
86
87
* Typically connects to external peripherals like LCD (if any)
88
89 7 laforge
The controller has two oddities:
90 15 laforge
* It assumes that the peripheral has an address byte.  If your peripheral doesn't, you have to
91 7 laforge
   write the first byte into the address register and not the FIFO
92 15 laforge
* You cannot under-fill the FIFO, i.e. if you write 8 bytes into the 16byte deep fifo, the controller
93 2 laforge
   will transmit 16 bytes rather than 8.  Therefore, always limit the FIFO depth to your write size!
94 15 laforge
   More details about this can be seen at [[HardwareCalypsoI2CFIFO"httpinfocenterarmcomhelpindexjsp]].
95
96
h3. SPI Master controller
97
98
* Connects to USP of ABB and possibly other external peripherals
99
100
h3. TIMER1 / TIMER2 general purpose timers
101
102 2 laforge
The timer input clock is not mentioned in the data sheet.  It seems to be 13MHz / 32, i.e. 406.25kHz
103 7 laforge
104 15 laforge
h3. PWL (PWM for Light)
105 7 laforge
106 15 laforge
* connected to the screen/keypad backlight
107 10 steve-m
108 15 laforge
h3. PWT (PWM for Tones)
109
110
* connected to a buzzer for ringtone generation
111
112
113
h3. JTAG Interface
114
115
116
The Calypso has an ARM7TDMI JTAG interface, which is exposed on phones like the Motorola [[MotorolaC115|C115] [wikiMotorolaC155 C155] [wikiSonyEricssonJ100i Sony Ericsson J100i] and the [wikiPirelliDPL10 Pirelli DP-L10]].
117
With standard ARM JTAG debuggers like [[OpenOCD]], halting the core does not work out-of-the-box, because ARM instruction 0xb needs to be executed first (which is an proprietary extension to the ARM7TDMI TAP-Controller). It is unclear what this instruction does exactly.
118
The [[OpenOCD]] configuration file along with the corresponding svf-file is attached to this page.
119
120
121
h3. Debug traces
122
123 1 laforge
124
The chip has very tiny debug traces on a small flex-pcb around the 4 sides of the chip.
125
Which trace goes to which ball can be seen on this scan: http://www.steve-m.de/pictures/calypso_bottom.jpg 
Add picture from clipboard (Maximum size: 48.8 MB)