OsmocomBB

[[PageOutline]]

= CalypsoRomloader =

The Romloader is a serial bootloader inside the maskrom of the Calypso/lite/plus DBB.

It can be mapped to the reset-vector (0x000000) on the Calypso by pulling the nIBOOT pin to low, and if activated, it checks both UARTs (MODEM and IRDA) for incoming activation commands for a certain amount of time, if nothing is received, it jumps to the application code in the flash memory.[[BR]]

If the flash-memory is unprogrammed (checks a few flash locations for that), it stays activated and waits for incoming commands.

So even on devices which use their own bootloader stored inside the flash, it could be activated by pulling nIBOOT low (but which is inaccessible on most phones).

There are currently 3 known variants:

== "non-secure"-Romloader on Calypso/lite ==

The "non-secure" variant, which is used on the Calypso/Calypso lite and which we support with osmocon.

It doesn't require a "key".

It is known to be used by the Motorola W220, BenQ Siemens A38, the OpenMoko devices (Neo 1973 & Freerunner), as well as on many other Calypso phones (LG, Bird).

== "secure"-Romloader on Calypso/lite ==

This one seems to be used on some newer Calypso batches, and is known to be used on the Alcatel VLE5 series.

In order to activate it, you have to send a "key" (which seems to be the first block stored inside the flash).

Basic reverse engineering is done, but nothing working yet, at least we know the "key" for the Alcatel VLE5 phones.

== "secure"-Romloader on Calypso plus ==

This variant is very similar to the one on the Calypso, it requires a key, too, and has some different structure of the branch address.

It also seems to cooperate in some way with a second loader stored inside the flash.

We know the key for the Motorola C261 (which is manufactured by Compal).

== Romloader support in osmocon ==

For downloading code to a romloader target, connect your serial cable as with the Compal devices, start osmocon with the "-m romload" switch, and push the power button shortly.

Osmocon will activate the loader, download the code in blocks, submit a checksum and send a branch command to 0x820000.

For anyone who wants to try this out on an OpenMoko device, use

{{{

$ echo 0 >/sys/bus/platform/devices/neo1973-pm-gsm.0/power_on

$ echo 1 >/sys/bus/platform/devices/neo1973-pm-gsm.0/power_on

}}}

to control the GSM Module.

Since the Romloader itself uses 512 Byte of the RAM above 0x800000, we need a different memory layout, but for testing you can use loader.osmoload.bin, which can be loaded to 0x820000.

{{{

$ ./osmocon -p /dev/ttyUSB0 -m romload ../../target/firmware/board/compal_e88/loader.osmoload.bin

}}}

 * Push the power-on button of your phone (short push, not like a regular phone boot!)

 * Observe output resembling the following

{{{

Sending beacon...

Sending beacon...

Sending beacon...

Sending beacon...

got 1 bytes from modem, data looks like: 3e 

got 1 bytes from modem, data looks like: 69 

Received ident ack from phone, sending parameter sequence

read_file(../../target/firmware/board/compal_e88/loader.osmoload.bin): file_size=14580, hdr_len=0, dnload_len=14583

Received parameter ack from phone, starting download

Used blocksize for download is 1024 bytes 

Preparing block 1, block checksum is 0x93 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 0 finished

Received block ack from phone

Preparing block 2, block checksum is 0x3b 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 1 finished

Received block ack from phone

Preparing block 3, block checksum is 0x79 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 2 finished

Received block ack from phone

Preparing block 4, block checksum is 0x83 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 3 finished

Received block ack from phone

Preparing block 5, block checksum is 0xe5 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 4 finished

Received block ack from phone

Preparing block 6, block checksum is 0x6a 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 5 finished

Received block ack from phone

Preparing block 7, block checksum is 0x98 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 6 finished

Received block ack from phone

Preparing block 8, block checksum is 0x86 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 7 finished

Received block ack from phone

Preparing block 9, block checksum is 0x0f 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 8 finished

Received block ack from phone

Preparing block 10, block checksum is 0xa1 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 9 finished

Received block ack from phone

Preparing block 11, block checksum is 0x07 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 10 finished

Received block ack from phone

Preparing block 12, block checksum is 0x5c 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 11 finished

Received block ack from phone

Preparing block 13, block checksum is 0x68 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 12 finished

Received block ack from phone

Preparing block 14, block checksum is 0x1c 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 13 finished

Received block ack from phone

Preparing the last block, filling 630 bytes, block checksum is 0x54 

handle_write_block(): 1024 bytes (1024/1024)

handle_write_block(): Block 14 finished

Finished, sent 14 blocks in total

Received block ack from phone

Sending checksum: 0xdd 

Checksum on phone side matches, let's branch to your code

Branching to 0x00820000

Received branch ack, your code is running now!

OSMOCOM Calypso loader (revision 7025e5c-modified)

======================================================================

Running on compal_e88 in environment osmoload

}}}