The D-Sample is here

[Spacefalcon the Outlaw]

Hello again everyone,

Earlier today I got the Weidmuller 1716330000 connector parts I
ordered from Digi-Key, needed for making a power cable that would mate
with the Weidmuller 1510460000 power input connectors used on TI's
development boards, and wired up a rig for powering the D-Sample from
a lab bench power supply.  (The Weidmuller connector on one end, a
pair of banana plugs on the other end, a pair of wires in between.)

Good news: I was able to power the board up, figured out how to enable
the RS-232 transceivers (this board brings both Calypso UARTs out on
DE9Fs at real RS-232 levels), and figured out how to enable the
Calypso boot ROM.  (The board has DIP switches to enable/disable the
RS-232 xcvrs and to control the nIBOOT strapping.)  The internal boot
ROM is a bogus version in this F741979B Calypso chip, but I managed to
connect to the MODEM UART with fc-loadtool (the IrDA port didn't work),
and then use this lovely tool of ours to dump images of both the old
F741979B boot ROM and the flash content this board came with.  You can
find the booty here:

ftp://ftp.freecalypso.org/pub/GSM/TI_history/D-Sample/

F741979B boot ROM: I have not spent any time reversing it yet, but
this TI document (which we've had since 2011) candidly explains some
of its bugs:

ftp://ftp.freecalypso.org/pub/GSM/Calypso/cal228.pdf

The flash image: as you can see in the flash dump I posted, the fw
code image fits in the first 2.5 MiB of the total 8 MiB of flash, and
the last megabyte contains the FFS.  As you can see from timestamp
strings in the fw image, it dates from 2002-09-17 - quite old compared
to what we are used to working with.  (Heck, it's even older than the
TSM30 code!)

Functionality exhibited by this firmware image:

* The big disappointment: no matter what I tried, the LCD stays dark. :(
  The strings in the fw image suggest that it doesn't have BMI, but
  has some early inklings of UI development, perhaps something similar
  to the LCD picture in this historic photo (extracted from a TI
  marketing presentation PDF from that era):

  https://www.freecalypso.org/boards/d-sample.jpeg

  The strings also suggest there being a Tetris game in there - but I
  just wasn't able to get this fw to light the LCD up.  I don't know
  if it needs the DIP switches or jumpers on the board to be set in
  some different way (we have no schematics), if it needs some magic
  AT or RVTMUX command, or if the fw image needs to be compiled
  differently (i.e., the strings might be in dead code) - but without
  the corresponding source, we are simply out of luck.

* The MODEM UART presents a working AT command interface - or at least
  working to the extent to which I could exercise it without getting
  connected to a network - see below.

* The output emitted on the IrDA UART follows our familiar RVT format,
  and we can see that this fw does include RiViera and many familiar
  components.  A log of captured power-up RVT output is on the FTP
  site next to the flash and boot ROM images.

However, adoring the output from the fw was as far as I could get with
this RVT interface.  ETM commands that work with TCS211 don't work
with this fw, and I don't see any mention of ETM in the power-up
output - so I'm guessing that this fw probably has the older
non-Enhanced Test Mode code implemented inside L1TM.  I haven't looked
at our available L1TM sources at all yet, so I'm not ready to make any
meaningful observations here.  GPF traces are emitted in a different
format as well - this fw must have an earlier version of the GPF "test
interface", one for which we have no corresponding source.  Thus we
have no workable way to send any commands to this 2002-09-17 fw via
RVTMUX.

I tried putting a real SIM in the socket, and I was able to interrogate
it through the AT command interface: +CNUM and +CIMI worked.  But I
haven't tried connecting to a GSM network, for two reasons:

1. The GSM antenna I have is the right angle version:

   https://www.sparkfun.com/products/675

   It looks like TI used the straight version instead.  As I discovered
   experimentally, twisting the RA antenna onto the SMA connector on
   the D-Sample is a royal pita in mechanical terms: even with the
   power cable disconnected, the plastic box still gets in the way.

2. The almost-blank FFS this board came with (see the flash dump I
   posted) has no IMEI in it.  In the absence of a /pcm/IMEI file the
   fw runs with the compiled-in value in pcmdata.c, and I have very
   strong doubts that Operator 310260's network will accept this
   placeholder IMEI as valid.  Setting some acceptable IMEI would
   normally be trivial, but none of our familiar tools work with this
   ancient fw version.

Oh, and the almost-blank FFS has no calibration files in it either,
except for the ones for the VCXO frequency.  Hence the Tx power levels
will almost certainly be out of spec.

Oh well, a toy it is - a piece of TI history and nothing more.  Well,
OK, if we ever obtain a copy of the TCS211 fw in full source form, as
opposed to the semi-src we have now, building an image configured for
this very old hw (Calypso F741979B and Clara RF) should be quite
doable, and it may then run beautifully on this board - but obviously
I'm just dreaming here.

Meanwhile, we have to work with what we have - and that means building
our own FCDEV3B board specifically so it can run the version of TCS211
we have.  My current status on that front is that I got the netlist
ECO for PADS import finished, and I'm about to start looking for a
PADS-using PCB layout engineer to help me with the actual layout.

Happy hacking,
SF