Calypso differences between C139 and C156?

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/baseband-devel@lists.osmocom.org/.

Michael Spacefalcon msokolov at ivan.Harhan.ORG
Sat Jun 21 00:27:52 UTC 2014


Hello fellow hackers,

In process of getting FreeCalypso loadtools (primarily the flash
manipulation utility fc-loadtool) working on the C1xx family in
addition to the previously supported Openmoko and Pirelli targets, I
discovered one bit of strangeness for which I have no explanation, and
I wonder if anyone else has seen it or might have an explanation for
it.

According to Calypso chip documentation (gathered on the GSM mini-
Wikileaks site ftp.ifctf.org:/pub/GSM), the complete nCS0 flash bank
should always be accessible at address 0x03000000, regardless of
whether the physical nIBOOT input is low or high, and regardless of
what may have been written into the FFFF:FB10 register to enable or
disable the mapping of the boot ROM at address 0.  And indeed I have
always used this nCS0 mapping at 0x03000000 on Openmoko and Pirelli
targets, and have got used to it always working.

But when I started playing with Compal phones a few months ago, I
discovered that at least on the North American (1900+850 MHz) C139s
reading from 0x03000000 returns all 0xFF's instead of the flash
content, no matter what the FFFF:FB10 register is set to.  So I
figured it must be some difference between the full Calypso in the
Openmoko & Pirelli phones and the Calypso Lite in C1xx, or perhaps
that mapping at 0x03000000 only works when the physical nIBOOT input
is low.

Then last night I dusted off my North American C156 (this C156 and a
bunch of NA C139s are the only Compal phones I have, as the more
"mainstream" 900+1800 MHz models aren't of much use to me, given my
geographic location) and tried my tools on it, as I'm polishing them
up for a stable release.  And guess what: reading from 0x03000000
yields the flash content on this phone, not the 0xFF's I get on all of
the C139s I've tested!

But don't all C1xx phones use the same Calypso Lite chip?  And this
C156 surely has nIBOOT tied high just like the other C1xx: the small
sector at 0x2000 is all 0xFF's (blank), so if the boot ROM were
enabled, the phone would never boot.  (The boot ROM requires the
32-bit word at 0x2000 to be either 0 or 1, selecting different modes
of booting the main fw.)

Just wondering if anyone else has seen this strangeness, and what the
behaviour might be on other C1xx phones besides those I have...

Oh, and all of the work I've done for Compal target support in
FreeCalypso loadtools is in the public Hg repository:

https://bitbucket.org/falconian/freecalypso-sw

VLR,
SF

P.S. Is Christophe Devine still on this list?  Christophe, if you are
reading this: I sent unicast email to your gmail address last night,
but it bounced.  Are you still around?




More information about the baseband-devel mailing list