The DSP is, like the MCU(ARM), integrated into the MAD2 chip. It's instruction set is that of the TMS320C54x range (binutils tic54x).
It communicates with the COBBA and HAGAR chips, does digital sound processing and delivers and returns GSM frames.
Texas Instruments TMS320C54x series data sheets:
It contains about 48kB of ROM with program and data, which is not flashable.
Some of the information in this sectin is borrowed from Nokia Flash Reverse Engineering Forum (AlexD)
Furthermore it has it's own I/O port ranges (pa0..paXXX), flags, timers/clocks, interrupts, UARTs and scheduling system.. madness!
The DSP starts at 0xFF80 after reset and goto 0x0F00, which is in shared RAM. (location 0x10E00)
Make sure APIMODE=0 in the DSPIF register before pulling the DSP from reset, because otherwise the address jumped to wil not even exist.
FF80 loc_FF80: ; CODE XREF: ROM:FF20 FF80 771D FFA8 stm #0FFA8h, PMST FF82 F073 FF85 b loc_FF85 FF84 ; ----------------------------------------------------------- FF84 F49B retf FF85 ; ----------------------------------------------------------- FF85 FF85 loc_FF85: ; CODE XREF: ROM:FF82 FF85 F073 0F00 b unk_F00
# BSCR (Bank Switching Control Register) orm #0x0008,*(0x29) andm #0xFFF7,*(0x29)
Last updated: 2005-02-21 14:19
This site is the result of a great deal of assembly code reading, research, countless (mostly futile) searches for data sheets, cross-referencing and analysing. If you use this information in any way please mention wumpus <blacksphere@goliath.darktech.org> (and others in the credits section) in the credits of your program/document. And tell me :) If you have more information please contribute. If you just copy this, stick your name on it and call it yours I hope you get your genitals bitten off by a three headed monkey. Have a nice day.
No mobile phones were harmed in the production of this site.