Project Blacksphere Intro Hardware 331x/3330 Interrupts I/O Map 00-3F 40-7F 80-BF C0-FF Memory Ranges Timers GenSIO ARM DSP Phone models Peripherals Nokia OS Software Glossary of Terms Todo Credits Forum Guestbook

Primary I/O range (00020000-000200FF)

Almost all communication to external circuitry, and even some internal logic is controlled through here.
Addr r/w Size [class] Description
00 r 1 [CTSI] DCT3 ASIC version Primary hardware version - this identifies the phone hardware type to the MCU.
bits r/w Description
00001111 r Revision
11110000 r Version
01 rw 1 [CTSI] MCU reset control register
bits r/w Description
00000001 r Enabled after powerup
00000010 r Last reset was by watchdog
00000100 rw SW reset
02 rw 1 [CTSI] DSP reset control register
bits r/w Description
00000001 rw Enable DSP (0=hold DSP in reset)
00000010 rw Enabled after setup in task 0 - reason yet unknown Seems to have no effect at all on either the DSP or the MCU.
03 w 1 [CTSI] ASIC watchdog write register Load the ASIC watchdog timer with a certain number of seconds. When this reaches zero, the MCU is reset. Please note that the CCont has it's own watchdog which you need to set as well.
0xFF disables the dog
04 r 2 [CTSI] Sleep clock counter Reads the current value of the 16 bit timer 1. As this port can be a bit unstable you want to read this until two consecutive reads return the same value.
06 r 2 [CTSI] ? (sleep) clock destination
08 rw 1 [CTSI] FIQ lines active 0=inactive 1=pending
Write 1 to a bit to release pending interrupt.
bits r/w Description
00000001 rw FIQ 0
00000010 rw FIQ 1
00000100 rw FIQ 2
00001000 rw FIQ 3
00010000 rw FIQ 4
00100000 rw FIQ 5
01000000 rw FIQ 6
10000000 rw FIQ 7
09 rw 1 [CTSI] IRQ lines active 0=inactive 1=pending
Write 1 to a bit to release pending interrupt.
bits r/w Description
00000001 rw IRQ 0
00000010 rw IRQ 1
00000100 rw IRQ 2
00001000 rw IRQ 3
00010000 rw IRQ 4
00100000 rw IRQ 5
01000000 rw IRQ 6
10000000 rw IRQ 7
0A rw 1 [CTSI] FIQ lines mask 0=passed 1=masked
0B rw 1 [CTSI] IRQ lines mask 0=passed 1=masked
0C rw 1 [CTSI] Interrupt control register
bits r/w Description
00000001 rw Global FIQ enable
00000010 rw Global FIQ disable
00000100 rw Global IRQ enable
00001000 rw Global IRQ disable
00100000 rw IRQ 8 line active
01000000 rw IRQ 8 mask
0D rw 1 [CTSI] Clock control register Controls the various clock lines in the system
bits r/w Description
00000001 rw ARM clock
00000010 rw sleep(?) clock
00000100 rw GENSIO clock (must be enabled for CCont and LCD)
00001000 rw Enabled in firmware init - reason unknown
00100000 rw SIM clock
01000000 rw SIM ??
0E r 1 [CTSI] Interrupt trigger register The lines that trigger IRQ 5 and IRQ 6 can be monitored here (whether they are still low, for example, as
they are triggered on low)
bits r/w Description
00000001 r IRQ 5
00000010 r IRQ 6
00010000 rw
0F rw 1 [CTSI] Programmable timer clock divider Read: Current value of clock divide counter
Write: Set maximum value of clock divide counter (clock is divided by this value plus one)
10 r 2 [CTSI] Programmable timer counter Reads the current value of the 16 bit programmable timer. As this port can be a bit unstable you want to read this until two consecutive reads return the same value.
12 rw 2 [CTSI] Programmable timer destination When the 16 bit programmable timer (above) reaches this value, the programmable timer interrupt is generated.
15 rw 1 [PUP] PUP control
bits r/w Description
00000111 rw MBUS baudrate 000=9600, 001=19200, 010=?, 011=57600, 100=115200, 101=?, 110=?, 111=9600
00001000 rw Unknown (MBUS) MBUS reset? enabled&disabled in mbus_init
00010000 rw Vibrator enable
00100000 rw Buzzer enable
01000000 rw Unknown (MBUS) Cleared in mbus_init MBUS mode? 0 = clocked, 1 = synchronous
10000000 rw MBUS clock speed (FIQ3)With this bit zero 423.1 times per second, when this bit is set the speed is multiplied with 2 to 846.2 per second.
16 rw 1 [PUP] FIQ 8 (timer?) interrupt control
bits r/w Description
00000001 rw Enable 0=disabled 1=enabled
00000010 rw FIQ8 active 0=inactive 1=pending Write 1 to this bit to release pending interrupt.
00000100 rw FIQ8 mask 0=passed 1=masked
18 rw 1 [PUP] MBUS control
bits r/w Description
00000011 rw Synchronous serial enable set to 1 in boot ROM when Flashing, 0 for normal operation
00001100 rw Unknown enabled in mbus_init
00100000 rw MBUS transmit mode to 0 in FIQ3, set 1 after send first byte, set 0 after send last byte
01000000 rw MBUS receive mode to 1 in FIQ3, to 1 in mbus_init
10000000 rw Status/initialisation enabled in mbus_init, wait until 0 after mbus_init
19 rw 1 [PUP] MBUS status
bits r/w Description
00000111 rw Number of bits transmitted/received Bit counter of shift register
00010000 r MBUS send ready
00100000 r MBUS receive byte available
01000000 r txd bit ready (flasher) = SCL = FBUS_RX
10000000 rw txd bit (flasher) = Serial data out = FBUS_TX
1A rw 1 [PUP] MBUS RX/TX Bytes are sent to and received from the line in this register.
1B w 1 [PUP] Vibrator
bits r/w Description
00011111 w Vibrator frequency
01100000 w Vibrator mode
1C w 1 [PUP] Buzzer clock divider Buzzing frequency is 13000000/div
1E w 1 [PUP] Buzzer volume
20 rw 1 [PUP] McuGenIO signal lines 0=low 1=high
bits r/w Description
00000001 rw CCUT (EM)
00000110 r Some version number
00001000 rw LCD leds on/off
00010000 rw CHARLIM (EM)
22 ? 1 [PUP] ?
bits r/w Description
00100000 ? Something with DSP Enabled and disabled in fbus command 0x40/sub 0x80
24 rw 1 [PUP] McuGenIO I/O direction 0=in 1=out
28 rw 1 [UIF/KBGPIO] Keyboard ROW signal lines 0=low 1=high
29 rw 1 [UIF/KBGPIO] Keyboard ROW ??
2A rw 1 [UIF/KBGPIO] Keyboard COL signal lines 0=low 1=high
2B rw 1 [UIF/KBGPIO] Keyboard COL ??
2C w 1 [UIF/GENSIO] CCont write
2D w 1 [UIF/GENSIO] GENSIO start transaction =0x25 (00100101) to start a GENSIO transaction, before writing to the CCont or LCD.
Note that the CCont will shut you down if you set this too slow, it will think some failure occured.
bits r/w Description
00011111 w Serial clock speed divisor 0x00 is fastest, 0x1F is slowest Bits per second seems to be around 60000000/y, but the absolute maximum seems to be around 950000 (118kB/s).
00100000 w Select/enable If you disable this bit the CCont will still respond to commands, but the LCD won't. Keep it enabled.
2E w 1 [UIF/GENSIO] LCD data write
32 rw 1 [UIF] CTRL I/O 2
bits r/w Description
00100000 rw Reset LCD (FraCtrl) 0=reset 1=enable
10000000 rw Another really cool and fluffy output bit
33 rw 1 [UIF] CTRL I/O 3
bits r/w Description
00000001 rw Vpp (flash write enable) (RxPwr pin)
00000010 rw Keyboard leds (TxPwr pin)
00001000 rw Maps memory 00400000 into 00200000 3330, seems to do nothing in 3310 (not strange as the flash is mirrored with 2MB chip..)
00100000 rw BUTTON_CTRL (EepromSelX pin)
01000000 rw CHAR_CTRL (xSynthEna2x pin)
36 w 1 [SIMI] SIM UART TxD
37 r 1 [SIMI] SIM UART RxD
38 r 1 [SIMI] SIM UART Interrupt Identification
39 rw 1 [SIMI] SIM Control
3A rw 1 [SIMI] SIM Clock Control
3B ? 1 [SIMI] SIM UART TxD Low Water Mark
3C r 1 [SIMI] SIM UART RxD queue fill
3D ? 1 [SIMI] SIM RxD flags
3E ? 1 [SIMI] SIM TxD flags
3F r 1 [SIMI] SIM UART TxD queue fill

Last updated: 2005-02-21 14:19

This site is the result of a great deal of assembly code reading, research, countless (mostly futile) searches for data sheets, cross-referencing and analysing. If you use this information in any way please mention wumpus <blacksphere@goliath.darktech.org> (and others in the credits section) in the credits of your program/document. And tell me :) If you have more information please contribute. If you just copy this, stick your name on it and call it yours I hope you get your genitals bitten off by a three headed monkey. Have a nice day.

No mobile phones were harmed in the production of this site.