Project

General

Profile

HardwareCalypso » History » Version 11

steve-m, 02/19/2016 10:48 PM
add JTAG section

1 5 laforge
[[PageOutline]]
2 1 laforge
= Calypso Digital Baseband =
3
4
The Calypso Digital Base Band chip is a popular DBB implementation for inexpensive feature phones.
5
6 5 laforge
The register-level manuals seem to have leaked at some point and are available from cryptome.org
7 6 laforge
at http://cryptome.org/ti-calypso2.pdf and http://cryptome.org/ti-calypso1.pdf
8 5 laforge
9 8 laforge
As cryptome.org is currently suffering legal battles due to Microsoft stupidity,
10
you can use http://cryptome.quintessenz.org/mirror/ti-calypso1.pdf / http://cryptome.quintessenz.org/mirror/ti-calypso2.pdf
11 7 laforge
12 1 laforge
== Variants ==
13
 * Calypso G2 C035 
14
 * Calypso G2 C035 Lite (D751749GHH)
15
  * Like C035, only 256kBytes of internal memory
16 2 laforge
17 9 vogelchr
== CPU ==
18
19
The CPU embedded in the calypso chipset is a ARM7TDMI. Details documents about this CPU is available from the ARM infocenter at [http://infocenter.arm.com/help/index.jsp].
20
21 3 laforge
== Memory Map ==
22
23 4 roh
 * nCS0 0x0000'0000 ... 0x007f'ffff (C123: external NOR flash)
24 3 laforge
 * nCS6 0x0080'0000 ... 0x00bf'ffff (internal SRAM, in case of calypso lite only 256kBytes)
25
 * nCS1 0x0100'0000 ... 0x017f'ffff (C123: external SRAM)
26 2 laforge
27
== Integrated Peripherals ==
28 7 laforge
== Integrated Peripherals ==
29
=== TPU (Time Processing Unit) ===
30
 * A programmable micro-engine clocked at GSM quarter-bit clock
31
=== MODEM UART ===
32
 * The UART that is typically connected to a PC or the application processor in a smartphone
33
=== IRDA UART ===
34
 * The UART that is either connected to IRDA or for diagnostics/programming
35
=== RIF (Radio Interface) ===
36
 * Connects to the synchronous bi-directional BSP (Baseband Serial Port)
37
=== DPLL + clock block ===
38
 * Generate clocks for DSP, ARM and all peripherals
39
=== GEA (GPRS Encryption Algorithm) ===
40
 * Encrypts/Decrypts data according to the proprietary GEA algorithm
41
=== Watchdog timer ===
42
=== Interrupt Controller ===
43
=== Memory interface (SRAM/ROM) ===
44
=== DMA controller ===
45
 * Only usable for UART and RIF, can only DMA to small API RAM memory region
46
=== SIM card controller ===
47
 * Connects to the SIM card socket in the phone
48
=== TSP controller (Time Serial Port) ===
49
 * Controls the TSP, which controls the sequencing of all external peripherals like ABB, RF chip, RF PA, Antenna Switch
50
=== RTC clock ===
51
 * A pretty standard realtime clock
52
=== ULPD (Ultra Low Power Device) ===
53
 * Responsible for enabling the phone to go to lowest-possible power mode while IDLE, but still waking up at the right point to receive important data (like paging channel) from the BTS
54
=== I2C Master controller ===
55
 * Typically connects to external peripherals like LCD (if any)
56 2 laforge
57
The controller has two oddities:
58 1 laforge
 * It assumes that the peripheral has an address byte.  If your peripheral doesn't, you have to
59
   write the first byte into the address register and not the FIFO
60
 * You cannot under-fill the FIFO, i.e. if you write 8 bytes into the 16byte deep fifo, the controller
61 2 laforge
   will transmit 16 bytes rather than 8.  Therefore, always limit the FIFO depth to your write size!
62 1 laforge
   More details about this can be seen at [wiki:CalypsoI2CFIFO]
63 7 laforge
=== SPI Master controller ===
64
 * Connects to USP of ABB and possibly other external peripherals
65
=== TIMER1 / TIMER2 general purpose timers ===
66 2 laforge
The timer input clock is not mentioned in the data sheet.  It seems to be 13MHz / 32, i.e. 406.25kHz
67 7 laforge
=== PWL (PWM for Light) ===
68
 * connected to the screen/keypad backlight
69
=== PWT (PWM for Tones) ===
70
 * connected to a buzzer for ringtone generation
71 10 steve-m
72 11 steve-m
=== JTAG Interface ===
73
74
The Calypso has an ARM7TDMI JTAG interface, which is exposed on phones like the Motorola [wiki:MotorolaC115 C115], [wiki:MotorolaC155 C155], [wiki:SonyEricssonJ100i Sony Ericsson J100i] and the [wiki:PirelliDPL10 Pirelli DP-L10].
75
With standard ARM JTAG debuggers like OpenOCD, halting the core does not work out-of-the-box, because ARM instruction 0xb needs to be executed first (which is an proprietary extension to the ARM7TDMI TAP-Controller). It is unclear what this instruction does exactly.
76
The OpenOCD configuration file along with the corresponding svf-file is attached to this page.
77 10 steve-m
78
=== Debug traces ===
79
80
The chip has very tiny debug traces on a small flex-pcb around the 4 sides of the chip.
81
Which trace goes to which ball can be seen on this scan: http://www.steve-m.de/pictures/calypso_bottom.jpg 
Add picture from clipboard (Maximum size: 48.8 MB)