Project Blacksphere Intro Hardware 331x/3330 ARM DSP Code Blocks Shared Mem GSM MDI Memory Map Phone models Peripherals Nokia OS Software Glossary of Terms Todo Credits Forum Guestbook

DSP ROM6 shared memory (HPI) layout

This range is shared between the onchip DSP and MCU (also called HPI -- Host Programming Interface). It starts at 0x0800 seen by DSP, and at 0x10000 seen by MCU. Access by DSP needs to be enabled with a bit in the MCUIF range. The addresses seem to be valid for all ROM6 DCT3 phones (possibly others)
Addr
(MCU)		 Addr
(DSP)		 Size Description
000 0800 164 MDISND queue data
0A4 0852 2 MDISND queue tail (next available entry) store new tail here after write to queue
0A6 0853 2 MDISND queue head (oldest entry) free space in queue is [100A6]-[100A4]-1 if [100A4]<[100A6] else [100A6]-[100A4]+81. tail=head means empty
0A8 0854 36 Init data Initialisation data 1
18 words: 0x900F (0) 0x0000 (1) ... 0x0000 (10) 0xFF80 (11) 0x0000 (12) 0xFFFF (13) 0x0000 (14) 0x0000 (15) 0x0000 (16) 0x0000 (17)
0CC 0866 2 MDI flags 0x01 Process MDISND
0DA 086D 2 DSP->MCU short MDI command Short type (one byte) MDI packet. Handled in IRQ4. MCU writes 0 when handled. Low byte = MDI type High byte = Parameter
0DC 086E 2 MCU->DSP short MDI command Short type MDI packet. Handled on DSP interrupt, DSP writes 0 when handled. Low byte = MDI type High byte = Parameter
0DE 086F 2 ND command from DSP to MCU Something with ND task. Handled in IRQ4. MCU writes 0 when handled.
0E0 0870 2 Cobba command (dsp_write_command) handled on DSP interrupt, DSP writes 0 when handled
0E2 0871 2 Code block request from DSP to MCU Request to the MCU to upload a certain code block. Handled in IRQ4.
=0x14 The first one requested after primary DSP initialisation (memory is cleared, setup basic registers and interrupt vectors are set up). Contains secondary initialisation.
=0x01 Second one that is requested
MCU writes to Code block reply when handled: 0x0004 if code upload completed, 0x0002 if still more bytes to go.
0E4 0872 2 Code block reply MCU sets this to !=0 to acknowlegde having uploaded some code. DSP clears this to 0 when ready for more uploaded code.
0F6 087B 10 Upload codeblock header The first 5 words of the codeblock header are copied here after the codeblock has been written to DSP shared memory. Possibly bootstrap code.
100 0880 200 MDIRCV queue data 100 words, of which 1 will always be unused to prevent head=tail when full (because that means empty)
1C8 08E4 2 MDIRCV queue tail (next available entry)
1CA 08E5 2 MDIRCV queue head (oldest entry - read here) number of words in queue is [100C8]-[100CA] if [100CA]<=[100C8], else [100C8]-[100CA]+100. tail=head means empty
1D2 08E9 16 r_dsp2ftd (temporary DSP counters) 8 words; exact meaning yet unknown (they show up in Netmonitor though)
1E2 08F1 2 ASIC ID I/O [0x20000] is put here by the ARM firmware.
1E4 08F2 4 Some timer
E00 0F00 0 Address invoked on DSP reset After the DSP is reset, it boots to 0xFF80 in ROM, which does a jump to this address in the shared memory range. Note that the DSP process dies instantly when shared access is not enabled. (so make sure it is enabled before reset)

Last updated: 2005-02-21 14:19

This site is the result of a great deal of assembly code reading, research, countless (mostly futile) searches for data sheets, cross-referencing and analysing. If you use this information in any way please mention wumpus <blacksphere@goliath.darktech.org> (and others in the credits section) in the credits of your program/document. And tell me :) If you have more information please contribute. If you just copy this, stick your name on it and call it yours I hope you get your genitals bitten off by a three headed monkey. Have a nice day.

No mobile phones were harmed in the production of this site.