CPU - DSP1C

TODO

try dump with JTAG (could be found by brute-force)

Basic description

Custom chip (ASIC) made for Vaisala by VLSI solution.

signature:

DSP1C
VAISALA
1101C
37130

Chip manufacturing process is 3 layer metal.

Pinouts

Pins are numbered counterclock-wise, pin 1 is near the small pit (ignore possible 2 large circles placed orthogonaly).

Pin state has been measured with osciloscope. Timing informations are inoccurate (+-50%).

PIN No.	state (type)	description
1	GND
2	VCC
3	I_SIGN (in)	noise - signal from GPS RF module
4	I_MAGN (in)	noise - signal from GPS RF module
5	Q_SIGN (in)	noise - signal from GPS RF module
6	Q_MAGN (in)	noise - signal from GPS RF module
7	CLK (in)	16.3676 MHz - clock from GPS RF module
8		0
9		0
10		0
11		0
12		0
13	GND
14	VCC
15	POW_RESET_IN (in)	Power on reset
16	POW_RESET_OUT (out)	go from 0 to 1 approx. 2 ms after powering CPU
-	-	-
17		SPI CLK
18		SPI MISO
19		SPI MOSI
20		SPI /CS EEPROM
21		1, ? /CS ? CON5 pin 10
22		SPI /CS GPS, IC3 - pin 18
23		1
24	GND
25	VCC
26		1
27		1
28		CLK (250 μs), CON5 pin 2
29		DATA (400 μs), CON5 pin 3
30		0
31		1
32		0
-	-	-
33	GND
34	VCC
35		CLK (50 μs)
36		connected to GND
37		connected to GND
38		connected to GND
39		1
40		connected to GND
41		CLK (1 μs)
42		connected to GND
43		DATA (150 ns)
44	GPIO_1_15	0
45	GPIO_1_14 ?	0
46	GPIO_1_13 ?	1
47	GND
48	VCC
-	-	-
49	GPIO_1_12	1, CON5 - pin 4
50	GPIO_1_11	0, CON5 - pin 11
51	GPIO_1_10	0, CON5 - pin 12
52	GPIO_1_9	1, CON2 - pin6
53	GPIO_1_8	1
54	GPIO_1_7	1, CON6 - pin 7, ? heating, 0 = on, 1 = off
55	GPIO_1_6	0, CON6 - pin 8, ? select heated element, 0 = upper, 1 = lower
56	GPIO_1_5	0, CON6 - pin 2, ?
57	GND
58	VCC
59	GPIO_1_4?	1
60	GPIO_1_3?	1
61	GND
62	GPIO_1_2?	1, CON2 - pin 1
63	GPIO_1_1	0
64	GPIO_1_0	0

CPU building blocks

block name	type	description
B1	ROM (2KB)	1K x 16 bit, mapped to Y, offset 0x1000
B2	SRAM (4KB)	256 x 16 x 8 bits, mapped to Y, offset 0x0
B3	SRAM (32KB)	512 x 32 x 16 bits, used for code, mapped to X, offset 0x2000
B4	???	something relly complicated
B5	???	block made from few smaller blocks
B6	ROM (4KB)	32 bit bus, code (bootloader and some basic routines), mapping to address space not found (anny way to read it by software?)
B7	???	looks like long and a bit entangled wires
B8	memory/registers?	???
B9, B10	GPS	12x GPS processing block
B11	SRAM (3KB)	192 x 16 x 8 bits, mapped to X, offset 0x0
B12	???	something with more stages
B13	???	something complicated

Those units might be implemented in HW:

CRC16
Reed-Solomon (result is 24B long)
some GPS related stuff
instruction decoder

CPU peripherals (SPI/GPIO/...)

I/O mapping

BUS X

address(es)	boot value	description
0x0000 - 0x05FF	-	X-RAM
0x2000 - 0x6000	-	???, instruction memory I/O port
0xFF83, 0xFF85	???	??? FW - (0xff83) = 0x3c3c, (0xff85) = 0x2d2d
0xFF95	???	FW, → A0
0xFF96	0xffbf	???
0xFF97 - 0xFF98	0xffff, 0xffff	???
0xFF99	0xfdff	???, constant
0xFFA0	0x4000	???, settable bits: 0xffc3, …
0xFFA1, 0xFFA2	???	???, FW: read to A as pair (0xFFA1, 0xFFA2) → (A0, A1)
0xFFA4	0x0001	SPI_CONFIG, settable bits: 0x01f7, …
0xFFA5	0x0001	SPI_DATA, read recieved data, (write to send data?)
0xFFA6	0x0000	SPI, EEPROM address?
0xFFA7	0x0000	SPI_LEN, bytes/words to transfer
0xFFAA	0x0003	???, constant: 0x0001 / not writable?
0xFFAB	0x0000	???, settable bits: 0x0003
0xFFAC	0x0000	???, settable bits: 0x7fff
0xFFAD	0x07fe	???, settable bits: 0xffff
0xFFAE	0x0000	???, settable bits: 0x00ff, …
0xFFAF	0x0000	???, settable bits: 0x007f, …
0xFFB0	0x0000	???, settable bits: 0x003f
0xFFB4	???	FW, 0xffb4 → A0 …
0xFFB5	???	FW: X[0xffb5] = 0x3;
0xFFB6	0x0000	USART? data, FW: write some data
0xFFB7	0x0000	USART? config
0xFFB8	0x0000	???, …
0xFFB9	????	???, settable bits: 0xffff, …
0xFFBA - 0xFFBB	???, settable bits: 0xffff
0xFFBC	0x0412	???, reads 0x0412 when set to 0x0, reads 0x0 when set to 0xffff, …
0xFFBE	0x0000	???, const: 0x0000 (once 0x0004 ???), cleared by reading? Have something to do with interrupts?
0xFFBF	0x0000	???, when read returns number of writes to this port (limited by something, now counts to 7 ), Have something to do with interrupts?
0xFFC0	0x2b0c	GPIO_A_DATA data, see DSP1C pinouts for assignment
0xFFC1	0xcfff	GPIO_A_DIR direction, 0 for input, 1 for output
0xFFC3	0x0000	???, settable bits: 0xffff
0xFFC4	0x0000	???, settable bits: 0xffff
0xFFC6	0x0000	settable bits: 0x7fff, counter, counts down, resets to 0x7FFF (or near this value), (watchdog?)
0xFFC7	0x0000	settable bits: 0xffff, counter, counts up, value is increased by one when 0xFFC6 underflows, (handled by interrupt?)
0XFFC8	0x0100	???, constant; FW: while ( !(X[0xffc8] & 0x800) ) ;;
0xFFC9	0x0000	???, 0x000 ⇒ 0x1800, 0xffff ⇒ 0x1bff, …
0xFFCA	???	???, FW: X[0xffca] = 0x35; X[0xffca] = 0x47;
0xFFFE	0x01ff	????, settable bits: 0x07ff, when writen to 0xffff, power consumption increases +2mA; FW: X[0xfffe] &= 0xfdff; X[0xfffe] \|= 0x400; X[0xfffe] \|= 0x200;
0xFFFF	0x0026	???, 0x0000 ⇒ 0x0020, 0xffff ⇒ 0x003f, lowest bit enables something when set to 0; FW if (X[0xffff] & 0x20); X[0xffff] &= 0xfffe; X[0xffff] \|= 0x2; X[0xffff] \|= 0x4;

(0xffa0)

FW: X[0xffa0] = 0x4001; X[0xffa0] = 0x4000; # send pulse to something?
while(X & 0x2) ;; # wait for something after pulse was send?
next read result from (0xffa1, 0xffa2)?

SPI_CONFIG (0xffa4)

0x0000 - send data at full speed (CLK = 2 MHz)
0x0001 - select function: 0 - read EEPROM, 1 - read status register
0x0002 - set to 1 to start transmission, keep 1 until while transation is completed
0x0004 - single short pulse on CS (HI lo HI), then keeps high ???
0x0008 - goes to 1 when is ready to transfer another byte/word, FW: while(!(X[0xffa4] & 0x8)) ;;
0x0010 - 1 while operating, FW: while(X[0xffa4] & 0x10) ;;
0x0060 - clock speed setup (0x00 ⇒ 2MHz, 0x20 ⇒ 1MHz, 0x40 ⇒ 0.6 MHz, 0x60 ⇒ 0.3 MHz)
0x0080 - CS high all the time - singals polarity/phase ???
0x0100 - CS high all the time - singals polarity/phase
for higner bits no changes observed

(0xffae, 0xffaf)

FW: X[0xffaf] = 0x37; # start something1
while(X[0xffaf] & 0x8) ;; # ready loop?;
result = X[0xffae] # get result?
X[0xffaf] = 0x34; # start something2
while(X[0xffaf] & 0x8) ;; # ready loop?;
result = X[0xffae] # get result?

serial configuration / enable (0xffb7)

0x0000 - off
0x0001 - send out start/stop bit(s) and all 0 values
0x0002 - send out start/stop bit(s) and value from 0xffb6
0x0004 - output is driven to 1
0x0008 - ???

(0xffb8)

FW: X[0xffb8] |= 1; X[0xffb8] &= 0xfffe; # enable/disable somethig?
FW: X[0xffb8] |= 0x10;

(0xffb9)

FW: X[0xffb9] |= 0x4;
FW: X[0xffb9] |= 0x10; # en/dis something?
FW: X[0xffb9] &= 0xfffb;
FW: X[0xffb9] |= 0xfc00;

(0xffbc)

X[0xffbc] = 0x1000;

(0xffc9)

FW: X[0xffc9] = 0xff;
while(X[0xffc9] & 0x1800) ;;
X[0xffc9] = 0x3;
while(X[0xffc9] & 0x1000) ;;

BUS Y

bus	address(es)	description
0x0000 - 0x07FF	Y - RAM
0x0800 - 0x0FFF	Y - RAM - identical content to previous block
0x1000 - 0x13FF	data ROM

Interrupt vector

TODO: find interrupt enable registers

addr (I-RAM)	description
0x20
0x21
0x22
0x23
0x24
0x25
0x26
0x27
0x28
0x29
0x2a
0x2b
0x2c
0x2d
0x2e
0x2f
0x30
0x31
0x32
0x33
0x34
0x35
0x36
0x37
0x38
0x39
0x3a
0x3b
0x3c
0x3d
0x3e
0x3f

Instruction ROM

ROM deconding

2 ROMs are present B1 and B6. Those ROMs use “drain contact programming”, for every data bit there is a N-fet transistor with Source connected to Vss, Gate connected to the wordline, but the drain may (logic 0) or may not (logic 1) be connected to the bitline.

When the 3 metal layers are removed (for example by etching), the connecting pads can be clearly seed and read. When the gold is present line is tied to ground and read as 0, when is missing (green spot), then line is read as 1. There are also 1:8 decoders, so to get valid data you need skip each 8 joints.

Identified fucntions in I-ROM

addr	arguments	result	description
0x20f9	I2 = addr, D0 = 1	B1	read EEPROM (1B from 'addr' to B1)
0x21d6	I7 - addr?, D1 - uint16_t data	D1 ???	store instruction memmory?
0x21d9	I7++	D1	load instruction memmory, (addr 0x2000 - 0x5FFF)
0x22ac	I7, A0 ???	???	used by stage 2 bootloader in latter stage of boot
0x22af	I7, A0 ???	???	used by stage 2 bootloader in latter stage of boot

Delayered ROM from chip

TODO: read bits and decode instruction from the ROM

pictures

deccaped DSP1C chip - low resolution. Credit: Klepko

RTG image of Vaisala DSP1C chip with pin wiring visible

RTG image of vaisala1608B1 with wiringvisible

brmlab

Table of Contents