# HG changeset patch
# User Mychaela Falconia <falcon@freecalypso.org>
# Date 1673740763 0
# Node ID 4b6b595ae0a0a607677fbdbc994625fb25ffedcd
# Parent  5377f91aea97a105fa875e9ead14bb5071fd5bfa
compal/boot/code-deriv: new analysis

diff -r 5377f91aea97 -r 4b6b595ae0a0 compal/boot/code-deriv
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/compal/boot/code-deriv	Sat Jan 14 23:59:23 2023 +0000
@@ -0,0 +1,112 @@
+It is apparent that Compal's bootloader was genealogically derived from TI's
+original FRBL (flash-resident bootloader) built into TCS211 reference fw.  The
+most "basic" or "pristine" version of Compal's bootloader is the one analyzed
+in c123-boot.disasm, aided by symbolic information from R87.2.1.03.map; here we
+shall analyze the diffs between this code and the original TCS211 version in
+the ../../leo-obj/bootloader directory.
+
+0x830: serial.obj .const section
+
+Exact match to TCS211-20070608!
+
+0x86c: bootloader.obj .text section
+
+The only diffs from TCS211 are:
+
+1) The addition of these instructions (right at _INT_Bootloader_Start) to set
+   VCLKOUT_DIV2 bit in the FFFF:FD02 register:
+
+     89c:	e51f1020	ldr	r1, =0xfffffd00	; via 0x884
+     8a0:	e1d120b2	ldrh	r2, [r1, #2]
+     8a4:	e51f002c	ldr	r0, =0x40	; via 0x880
+     8a8:	e1800002	orr	r0, r0, r2
+     8ac:	e1c100b2	strh	r0, [r1, #2]
+
+2) The addition of 32-bit word 0x40 to the literal at the beginning of this
+   .text section, before _INT_Bootloader_Start entry point.
+
+0x968: start.obj .text section
+
+Static function 0 (0x0 in reference object, 0x968 in Compal's bl) matches
+exactly.
+
+Static function 1 (0x2c in reference object, 0x994 in Compal's bl) matches
+exactly.
+
+Static function 2 (0xe0 in reference object, 0xa48 in Compal's bl) matches
+exactly.
+
+Final function sta_select_application():
+
+* The beginning of the function is the same between TI and Compal versions:
+
+  - call to static function 0 (hw init)
+  - call to ser_initialize_serial_link()
+  - call to con_initialize_conversion()
+
+* The remainder of the function differs fundamentally:
+
+  - TI's version calls cmd_check_application_in_flash(), followed by static
+    functions 1 and 2 that implement FRBL1 interrupt-boot window provision.
+
+  - Compal's version calls their heavily modified version of fluid_bootloader(),
+    which is where Compal's serial boot entry protocol is implemented, followed
+    by FTM_Tool_check() where the "ftmtool - (yes) - (modem)error" business
+    happens.
+
+0xb10: boot.obj .text section
+
+The dead code preamble before fluid_bootloader() function (5 32-bit ARM
+instructions) is the same between TI and Compal versions.
+
+The body of fluid_bootloader() is completely different, leaving only the now-
+misleading function name: all FRBL2 code has been ripped out, replaced with
+Compal's serial boot entry protocol.
+
+The following functions from TI's original boot.c survive in Compal's version:
+
+jump()
+putchar()
+getchar()
+hardware_init()		-- already a mostly-do-nothing in TCS211
+uart_init()
+
+The following functions in this module are entirely new in Compal's version:
+
+SeekMsg()
+FTM_Tool_check()
+getchar_timeout()
+UartTimeout()		-- unused!
+CheckFTMtoolMode()
+putchar__()		-- unused!
+getchar__()		-- unused!
+
+0xfb4: branch_in_RAM.obj .text section
+
+Exact match to TCS211-20070608, but then it's a trivial assembly module.
+
+0xfb8: command.obj .text section
+
+Exact match to TCS211-20070608!
+
+0x13d0: convert.obj .text section
+
+Exact match to TCS211-20070608, including the call to fluid_bootloader() in
+con_get_command_from_string() which is now a complete bogon.
+
+0x1594: optboot.obj .text section
+
+Exact match to TCS211-20070608, except for one byte change in the ID returned
+by opt_get_monitor_id().
+
+0x165c: serial.obj .text section
+
+Exact match to TCS211-20070608!
+
+0x1cec: cmdboot.obj .text section
+
+Exact match to TCS211-20070608!
+
+0x1dd8: start.obj .text:v$3 section
+
+Exact match to TCS211-20070608!