TI Calypso chipset history and development boards Presented by Mychaela N. Falconia, custodian of the chipset+firmware solution that was previously TI's. Topics to be covered: * How Texas Instruments became involved in GSM MS chipset business; * How TI got out of this business; * How I became the rights-owner to this GSM MS solution; * History of Calypso chipset; * Historical Calypso development boards from TI and iWOW; * Currently available development boards, as well as hackable Calypso phones and modem modules. How TI got into GSM chipset business It all started as a symbiotic relationship between Nokia and TI: Nokia were GSM experts, had protocol stack and handset designs, but TI had the best DSP in those days. TI made their first GSM DSP chip for Nokia, used in 6110 and other DCT3 phones, called MAD or MAD2 (not sure). It had an ARM7TDMI core as MCU plus TI's then-flagship C54x (LEAD2) DSP, same architecture as the much later Calypso! It appears that Nokia also pulled the strings for TI to become a licensee to the ARM7TDMI core from ARM Ltd. :) Later, with Condat providing a GSM L23 protocol stack, TI started selling a complete chipset+firmware solution to "lesser" phone manufacturers. Condat GmbH was originally a separate company, developing protocol stacks, with TI as their flagship customer - but then TI bought out Condat in 2002, becoming owner of the whole solution. How TI got out of this business The exact date is unclear: it appears that TI started on exit strategy path in 2009, with all WTCBU (Wireless Terminal Chipset Business Unit) shutdown complete by 2012. It appears that they tried to sell this business unit, but failed to find an interested buyer - so it went to the trash dumpster instead. TI had a huge facility (development center at least, possibly more, maybe even a fab) in Villeneuve-Loubet, Region de Nice, France - fully closed, everyone laid off - very bad for all of the good people who worked there! TI erased all traces of ever having been in this business - they don't want to admit they were ever in it, all indications are that they want the world to forget. Are they perhaps exercising their right to be forgotten, per GDPR etc? Me taking adverse possession of TI's abandonware Adverse possession is originally a feature of land title customs and laws: if the title owner to a piece of land abandons it and someone else physically moves in and puts the land to active use, after some years the adverse possessor can receive title to that land. ESR in _Homesteading the Noosphere_ applied the doctrine of adverse possession to abandoned FOSS projects, and I am applying the same doctrine to proprietary abandonware. According to law articles in the case of physical land claims, for an adverse possession claim to be valid, 5 elements must be met - the possession must be: * Continuous in time - check; * Hostile, meaning no rental agreement or the like - check, I never signed any license agreements or NDAs or whatever with TI; * Open and notorious - check, I've been doing my FreeCalypso work very publicly and in the open, not hiding in any way; * Actual - meaning acting *as if* I was the copyright holder, maintaining and releasing the software; * Exclusive - check, no one else has taken adverse possession of TI's abandonware. What TI did during their active days Following TI's first ARM7+DSP chip for Nokia, they produced many different DBB (digital baseband) chips with the same architecture, initially for GSM only and later for 3G/UMTS. They also made ABB (analog baseband) and RF chips to form a complete GSM MS chipset. Calypso was just one somewhat arbitrary point on that evolutionary line. It was NOT TI's last chip before shutdown of this business - far from it. LoCosto, E-Costo (EDGE) and whatever they had for 3G all came after Calypso. Besides making chips, TI also made development boards, released reference designs intended to be copied by phone and modem makers, and maintained the basic (non-differentiated) GSM MS firmware. Like other cellular phone chipset makers of that day, TI expected their customers to use TI's reference hardware designs as a starting point, and to use TI's baseline firmware as a starting point for building differentiated end user products. Why Calypso? Why did Calypso specifically become the TI chipset of choice for GSM MS tinkering projects? Why not LoCosto (successor to Calypso), and why not one of Calypso's predecessors such as Hercules or Ulysse? There may not be a true answer, but here are some partial answers: * In my case, I insisted on parity and equality, and would not accept anything less than what Openmoko had. * In the case of OsmocomBB, I don't know why Harald or Dieter or whoever were the earliest pioneers sought out a Motorola phone model that just happens to have exactly the same core chipset version as Openmoko - maybe for reasons covered in my REcon MTL 2017 presentation... Different versions of Calypso TI used designations like C05, C035, C027 etc to refer to process technology generations - but I don't know the mapping from those designations to nm. Calypso C05 rev A: DSP ROM version 3311, no AMR, a lot of silicon bugs - TI development board: C-Sample (plus RAM-based Samson prototype chip) - used in the legendary TSM30: that source targets this early Calypso version, NOT the one used by FC and OBB! Calypso C05 rev B: same DSP ROM 3311, still no AMR, but most bugs fixed - featured on both C-Sample and D-Sample boards Calypso C035, early DSP ROM versions: apparently there were *very* early C035 chips that had the same sans-AMR ROM 3311, but otherwise "early" Calypso C035 means DSP ROM 3416 - AMR included, but not the final DSP ROM version. Calypso C035, final DSP ROM version 3606: Openmoko, Compal/Motorola, all FC dev boards, everything that FC and OBB regularly work with. Different versions of Calypso (continued) All FreeCalypso dev boards and all targets supported by OBB are Calypso C035 with final DSP ROM version 3606, no earlier/other versions! Full Calypso vs Calypso Lite: the only difference is IRAM (internal RAM) capacity, 512 KiB vs 256 KiB - no other differences! The notion that Calypso Lite does not support GPRS is false. Low-end Motorola C1xx phones (lower than C155) not supporting GPRS with their official fw is not a chip issue, but a matter of product feature scoping decisions for those phone models, leading to firmware builds with GPRS excluded and external flash chip sizes chosen accordingly. Huawei GTM900 and iWOW TR-800 modem modules both have Calypso Lite chips, yet both modules were sold as GPRS-capable, with GPRS-enabled fw builds. AMR support in Calypso Downloaded DSP patches are not the whole story: if the AMR support were completely lacking in the DSP ROM and only added by patches, then TI would have had soft patches adding AMR support to their earlier Calypso silicon versions, which wasn't the case - with DSP ROM versions prior to 34, TI's chipset+fw solution had no AMR support at all, full stop. Instead it appears that AMR support is already present in the DSP ROM in versions 3416 and 3606, but perhaps buggy and thus needing patches. All TI fw versions always apply _some_ DSP patches, against all ROM versions that existed - there was never a version of official firmware that ran against unpatched DSP. Mystery: what was wrong with DSP ROM version 3416? Why did TI spin out a new silicon version with DSP ROM version 3606, the final version seen in mass- produced phones and modems? I got a Calypso chip with DSP ROM 3416 populated on an FCDEV3B and tested it lightly - everything seemed to work fine, including AMR, with TI's DSP patch version matching this ROM. But one little gotcha: with AMR on Calypso (as opposed to later LoCosto) there is no working DTXu! Thus a Calypso phone will waste battery during speech pauses in AMR mode, but not when EFR is used - yet another reason I run ThemWi with EFR instead of AMR. Additional required chips: ABB and RF ABB companion chip for Calypso is either Nausica or Iota: * Nausica used on C-Sample and TSM30, can put out 5V toward the SIM; * Iota used from D-Sample onward, and in all target devices supported by both FreeCalypso and OsmocomBB. RF transceiver: can be Clara, can be Rita, can be non-TI. Silabs Aero family was a popular non-TI choice for RF. The analog baseband I&Q interface between the baseband chipset and the RF transceiver was a common industry standard in those days, allowing the possibiliy of mix-n-matching baseband from one vendor with RF from a different vendor. No such interchangeability exists on the interface between DBB and ABB: these two chips are very tightly coupled. Note the older paradigm compared to DigRF: the vendor-interoperable BB-to-RF interface here is analog I&Q, not digital! DigRF was a later invention by other vendors, but TI never partook: instead they went to fully integrated LoCosto chip, baseband and RF in a single package. Full solution: chipset + firmware + dev boards Anyone who makes and sells a GSM baseband chipset also has to provide reference firmware and dev boards for it! Just a chip, without these additional support materials, would be useless: how would you even know for sure that it works correctly? TI in their day provided a complete solution: chips plus reference firmware plus development boards. TI's firmware suite from late-Calypso time period was called TCS2.1.1, or TCS211 for short. Destructive nature of Man: Library of Alexandria burned, clay tablets broken, Egyptian treasures destroyed... Likewise with TCS211 fw: only one version appears to have survived into the present, the one from the ruins of OM. What I do in FreeCalypso is fundamentally no different from what TI themselves did back in their day: dev boards and reference firmware. C-Sample development board The earliest TI dev board I have at least vague knowledge of - Calypso C05 rev A or rev B (or Samson), Nausica ABB, Clara RF, 84x48 pixel B&W LCD. The choice of small LCD appears to be from Nokia - back to symbiotic relation! INSERT: c-sample.preamb c-sample.asc85 Source for pictures All TI board pictures in this presentation have been extracted from TI's own historical presentation slide decks: https://www.freecalypso.org/members/falcon/TI-presentations/ Other pictures of misc hw (not from TI docs): https://www.freecalypso.org/members/falcon/pictures/ D-Sample development board INSERT: d-sample.preamb d-sample.asc85 D-Sample development board (continued) Main and primary dev board for Calypso chipset, used heavily inside TI in those days. My D-Sample board dates from 2002, but the same platform was still used inside TI for the remainder of Calypso program, perhaps as late as 2007. Key hardware components: * Calypso chip versions from C05 rev B to the final C035 * Iota ABB, Clara RF, 900/1800/1900 MHz triband * 8 MiB flash * 8 MiB extra RAM for development, switchable to flash chip select, JTAG * 176x220 pixel color LCD in the handset part, 16-bit Calypso MEMIF * Magnetic buzzer for ringing alerts D-Sample development board (continued) The version of TCS211 fw I got, which may be the world's last surviving version, lacks tpudrv10.c (Clara RF) source file - thus I am unable to build new fw for D-Sample with working RF. Just this one C file stands between current state and being able to run new FC firmware on this mighty piece of history! :( The only GSM-capable firmware I can run on this board is the one it came flashed with, dated 2002-09-17 - very old! This fw version is so old that FreeCalypso rvinterf tools barely work with it, and only in a very limited capacity. :( But I can connect this GSM MS running original 20020917 fw to Osmocom-based Themyscira Wireless network! EFR only, no AMR in this old Calypso silicon version from 2002. :) It once worked on T-Mobile USA too, back in 2016, including a successful CSD call to NIST ACTS. Lack of board schematics or any other hw docs also bites: it's a complex and mighty board, but without schematics or docs many workings are a mystery. Also missing is TI's original hw test code for this board, separate from GSM functional fw: the bird (?) in the photo in TI's presentation, D-Sample TETRIS game, etc - probably also lost to the great bit bucket in the sky. :( Leonardo development board Large color LCD, keypad and other UI peripherals removed, functionality reduced to AT command modem. RF changed from Clara to Rita - the only RF chip for which we have driver support! TI's internal version was quadband, but almost no derivative version preserved this quadband RF design. Extremely obscure iWOW TR-800 module, discovered only in late 2019, appears to be the only mass-produced Calypso gadget that retained the original quadband design from Leonardo+. Judging by surviving schematics and other docs, Leonardo appears to have existed in bazillion hw variants in its day, some quadband, others 900/1800 MHz only. This variety of different schematic versions was a confidence downer. The only reason I can think of why someone would produce so many versions of a board is if they are iterating through defective revisions, aiming for defect-free state - but if so, how can we know which of many floating schematic versions is the final fully-working one? Thus I had a low confidence in Leonardo design until the late discovery of a proven-working version from iWOW. Leonardo development board (continued) I never got my hands on a Leonardo board, never saw one with my own eyes, and the only Leonardo board photo I found is this one from TI's presentation: INSERT: leonardo.preamb leonardo.asc85 Leonardo development board (continued) Remaining mystery: what kind of work did TI's own developers actually do on their Leonardo boards? Leonardo schematics include provisions for hooking up a small serial LCD (probably 84x48 pix like classic Nokia phones and C-Sample) plus an 18-button keypad like on C-Sample - were these provisions actually exercised? The Leonardo variant whose photo appears in TI's presentation appears to be a real handset prototype - was this branch of Leonardo ever brought to completion with all components populated and plastics made? Was it ever brought into a working state in terms of hw and fw? The version depicted in Leonardo_plus_RD122.pdf is more like a traditional dev board: same power input connector as C-Sample and D-Sample (and FC boards), TI classic JTAG header, PWON and RESET buttons, RJ-style jacks for LVCMOS UARTs, RF I/O (antenna) interface on SMA - I _assume_ this version is what TI engineers actually used when preparing fw deliverables for Calypso+Iota+Rita customers... All UI code (LCD, keypad, battery charging) in TCS211 fw source tree is only for C-Sample and D-Sample, none for Leonardo! Openmoko GTA01/02 modem OM's modem is _almost_ identical to TI Leonardo, with only one significant diff: FIC removed TI's quadband RF FEM and replaced it with their own triband RFFE design. Firmware is incompatible between Leonardo and GTA01/02 because of permuted RFFE control signals! TI made a special build of their TCS211 fw for OM, modified for FIC's hobbled triband RFFE, and this one version of TCS211 appears to be the world's sole surviving copy. Handset UI code and config targeting D-Sample came from this recovered version too. :) FIC's Calypso-based design history prior to OM is a mystery of great interest to me; comments in FIC-modified devices.txt for FLUID have dates in 2004! A page in OM's wiki also shows firmware build version timestamps that _predate_ the first OM-official fw delivery of 2007-04-19... Motorola C1xx and SE J100 phones (Compal) Design very heavily modified relative to TI's baseline, both hw and fw. Hardware: same core chipset (Calypso+Iota+Rita), but totally different RF controls, brickable flash, non-sensical power button wiring... Firmware: Compal's engineers must have had strong opinions, very different from TI's, and somehow convinced their managers to allocate LOTS of hours for revamping TI's firmware to their own taste. Compal's fw modifications relative to TI's baseline: not as heavy as TSM30 src - they kept Nucleus, TIFFS and RVT - but still very heavy, much of RiViera gutted out, most interesting bits moved out of TIFFS, totally different approach to L1/RF config and calibration... Which way is "right", TI's or Compal's? It's a matter of opinion, taste and subjective preference: OsmocomBB chose Motorola as "canon", whereas FreeCalypso chose TI's version instead. FreeCalypso enters the scene For both practical (technical functionality) and ethical reasons, I needed a solution different from OsmocomBB. Prior to my own FreeCalypso hardware, my Calypso hw platform was Openmoko GTA02, *not* Motorola. Pirelli DP-L10 and Mot C139 (in this order) were my secondary hw platforms, but neither could ever replace Openmoko as primary. Problems with Openmoko GTA02 Hugely inconvenient: the modem of interest is tucked away behind an extra layer of Linux AP. I had to have cables plugged in from both sides (USB from one side to control the AP, and Calypso headset jack serial cable from the other side), and then hold the unit in the middle up to my ear for voice calls, with those cables still attached! No-longer-available hardware which no one else had meant no ability to share my work, even when someone wanted to join the project! Calypso JTAG is not accessible on Openmoko hw, same with MCSI. My solution: design and build FCDEV3B to serve as a replacement. FCDEV3B The board was intended to be a recreation of TI Leonardo, but based on PCB layout from OM GTA02. I searched high and low for TI Leonardo PCB layout files, but never found any - hence OM GTA02 version was the only safe, known-working option. Huge thanks to Mr. Sean Moss-Pultz for releasing those files in response to me asking! * Retains triband RFFE design from FIC - that's what '3B' at the end means; * Unbrickable, huge RAM and flash, Calypso JTAG and MCSI brought out; * Modem functionality only, no provision for connecting any handset UI peripherals; * Both Calypso UARTs brought out together as a set - matching TI's own dev boards, and an absolute necessity for working with TI's original fw architecture. 2019: Huawei GTM900 discovered In May of 2019 Comrade Songbosi posted on both Osmocom and FreeCalypso mailing lists, announcing the existence of Huawei GTM900-B and other variants. Packaged modem module, 56.5x36.0 mm, Calypso+Iota+Rita chipset inside: * Unbrickable flash, design much closer to Leonardo/Openmoko/FCDEV3B than to Motorola/Compal; * Calypso JTAG accessible on test points, although not on the FPC connector interface; * Common GTM900-B has 900/1800 MHz bands, rarer and more expensive GTM900-P has 850/1900 MHz. Downsides: integrated microphone circuit can get in the way of design freedom for analog audio, integrated XDS_RESET circuit is likewise a hindrance, and no MCSI for digital audio. Next big discovery: iWOW TR-800 Extremely obscure, discovered by me in 2019-12, made public in late 2020. It is another packaged modem module with Calypso+Iota+Rita inside, but even smaller than GTM900, only 41.2x36.0 mm. It's a mass-produced version of TI Leonardo core, including the original quadband RFFE! I really liked this module, thus I officially adopted it into FreeCalypso family under new name FC Tango, and I paid to have its PCB professionally reversed. The PCB RE company delivered Gerber files that look so good, you would think it is the original design if you didn't know they came from RE! These Gerber files are now published, along with a component placement drawing assigning new FC Tango reference designators to components, and a netlist matching the physical PCB. * Better than GTM900 in every way except one: no JTAG. * Lots of Calypso and Iota signals brought out, enough to recreate most (but not all) handset UI peripherals from D-Sample. iWOW TR-800 module guts INSERT: TR800-guts.preamb TR800-guts.asc85 iWOW development board: DSK aka Caramel iWOW had their own development board for TR-800, which they called DSK for Development Starter Kit. This board was codenamed Caramel in FreeCalypso. This DSK/Caramel board was very obviously inspired by D-Sample! INSERT: DSK-v4.0-board.preamb DSK-v4.0-board.asc85 Calypso development boards available today FC only made two Calypso dev boards so far: FCDEV3B and Caramel2. The latter was intended to replicate iWOW's DSK aka Caramel, hence the name. C2 boards came out poor (by my perfectionist standards), but in any case a dev board made from iWOW TR-800 (or GTM900) will always be much cheaper than a board made from "raw" chips like FCDEV3B. I am told that Sysmocom will be offering their version of Calypso dev board built around GTM900 - but I like iWOW TR-800 better. But irrespective of whether you choose GTM900 or TR-800, a vital question is _how_ you design your board around that base module. It is unfortunately very easy to design a board in a way that makes it very crippled for FreeCalypso, producing an OBB-only board in effect. Every dev board or other hw platform that is made for running FreeCalypso can trivially run OBB too, but not the other way around! Ultra-cheap Motorola C1xx phones are great for running OBB - but they are so poor for FC that I had to expend years of work and insane amounts of money to produce better hardware to meet the more demanding requirements of FreeCalypso. Most ambitious goal: recreate an equivalent of D-Sample Remember D-Sample from earlier in this presentation? TI's original development platform for Calypso, the mother of all development boards - my ultimate dream goal is to recreate an equivalent of that holy board, but with known hardware (no sans-schematics mysteries) and with Rita RF, so it can run current FreeCalypso firmware. D-Sample LCD is 176x220 pix, 16-bit color, parallel interface connected to Calypso MEMIF, full 16-bit width. Fortunately it is one of industry standard sizes and interfaces, hence I found newly made LCD modules with equivalent specs. First attempt: FC Luna in 2020, an LCD of the right kind connected to Calypso MEMIF on Caramel boards, both original iWOW and C2, plus a keypad board (5x5) connected to the same expansion interface. It worked, progress was made on FC handset UI firmware, but the physical arrangement of many boards connected with ribbon cables was an utter mess, and the buzzer function of classic fw cannot be exercised as Calypso BU/PWT signal is not brought out on TR-800. New ethereal dream goal: FC Venus, a board to be designed the "hard" way like FCDEV3B (from "raw" chips). It will be insanely expensive, but no one can put a price on happiness and dream satisfaction! Engaging both FC and Osmocom communities Given wide availability of OBB-only Calypso hw (meaning Calypso devices that are just fine for the purpose of running OBB, but aren't good at all for FC), it is my mission to make higher-quality FC-capable hardware just as easily and just as readily available as the more popular OBB-only kind. FC Venus board (proposal from previous slide) is an item which I desire for myself, but it will probably be very expensive. Hence I am exploring ideas for an intermediate board: more capable and more FC-friendly than OBB-only hardware being developed by Sysmocom, but not as expensive as FCDEV3B or planned FC Venus. FC Minnie is one tentative plan: an initial draft of design spec has been written, but no actual board design work has been started yet. Fundamental objectives are: * Basic feature match to OS#4030, but FC-friendly instead of OBB-only; * Cost reduced as much as possible, to have a chance at matching OS#4030. Community input: I am very open to designing almost any hw which the community would find desirable, subject to the constraint that it must be compatible with established FreeCalypso workflows. Input is wanted!