It is apparent that Compal's bootloader was genealogically derived from TI's
original FRBL (flash-resident bootloader) built into TCS211 reference fw.  The
most "basic" or "pristine" version of Compal's bootloader is the one analyzed
in c123-boot.disasm, aided by symbolic information from R87.2.1.03.map; here we
shall analyze the diffs between this code and the original TCS211 version in
the ../../leo-obj/bootloader directory.

0x830: serial.obj .const section

Exact match to TCS211-20070608!

0x86c: bootloader.obj .text section

The only diffs from TCS211 are:

1) The addition of these instructions (right at _INT_Bootloader_Start) to set
   VCLKOUT_DIV2 bit in the FFFF:FD02 register:

     89c:	e51f1020	ldr	r1, =0xfffffd00	; via 0x884
     8a0:	e1d120b2	ldrh	r2, [r1, #2]
     8a4:	e51f002c	ldr	r0, =0x40	; via 0x880
     8a8:	e1800002	orr	r0, r0, r2
     8ac:	e1c100b2	strh	r0, [r1, #2]

2) The addition of 32-bit word 0x40 to the literal at the beginning of this
   .text section, before _INT_Bootloader_Start entry point.

0x968: start.obj .text section

Static function 0 (0x0 in reference object, 0x968 in Compal's bl) matches
exactly.

Static function 1 (0x2c in reference object, 0x994 in Compal's bl) matches
exactly.

Static function 2 (0xe0 in reference object, 0xa48 in Compal's bl) matches
exactly.

Final function sta_select_application():

* The beginning of the function is the same between TI and Compal versions:

  - call to static function 0 (hw init)
  - call to ser_initialize_serial_link()
  - call to con_initialize_conversion()

* The remainder of the function differs fundamentally:

  - TI's version calls cmd_check_application_in_flash(), followed by static
    functions 1 and 2 that implement FRBL1 interrupt-boot window provision.

  - Compal's version calls their heavily modified version of fluid_bootloader(),
    which is where Compal's serial boot entry protocol is implemented, followed
    by FTM_Tool_check() where the "ftmtool - (yes) - (modem)error" business
    happens.

0xb10: boot.obj .text section

The dead code preamble before fluid_bootloader() function (5 32-bit ARM
instructions) is the same between TI and Compal versions.

The body of fluid_bootloader() is completely different, leaving only the now-
misleading function name: all FRBL2 code has been ripped out, replaced with
Compal's serial boot entry protocol.

The following functions from TI's original boot.c survive in Compal's version:

jump()
putchar()
getchar()
hardware_init()		-- already a mostly-do-nothing in TCS211
uart_init()

The following functions in this module are entirely new in Compal's version:

SeekMsg()
FTM_Tool_check()
getchar_timeout()
UartTimeout()		-- unused!
CheckFTMtoolMode()
putchar__()		-- unused!
getchar__()		-- unused!

0xfb4: branch_in_RAM.obj .text section

Exact match to TCS211-20070608, but then it's a trivial assembly module.

0xfb8: command.obj .text section

Exact match to TCS211-20070608!

0x13d0: convert.obj .text section

Exact match to TCS211-20070608, including the call to fluid_bootloader() in
con_get_command_from_string() which is now a complete bogon.

0x1594: optboot.obj .text section

Exact match to TCS211-20070608, except for one byte change in the ID returned
by opt_get_monitor_id().

0x165c: serial.obj .text section

Exact match to TCS211-20070608!

0x1cec: cmdboot.obj .text section

Exact match to TCS211-20070608!

0x1dd8: start.obj .text:v$3 section

Exact match to TCS211-20070608!