WebOS Internals - User contributions [en]

Debug-Testpads

2010-12-07T21:10:49Z

Morphis:

On the backside of the pre device are some testpads. Currently it is unknown which testpad is used for what. This page will describe the research process and the finals results for finding the for serial and jtag relevant pads.

Debug-Testpads

2010-12-07T21:10:27Z

Morphis: Created page with '= Debug Testpads = On the backside of the pre device are some testpads. Currently it is unknown which testpad is used for what. This page will describe the research process and …'

= Debug Testpads =

On the backside of the pre device are some testpads. Currently it is unknown which testpad is used for what. This page will describe the research process and the finals results for finding the for serial and jtag relevant pads.

Portal:Hardware

2010-12-07T21:09:06Z

Morphis:

__notoc__
{{portal-header|
Just list everything related to the hardware. <br>
Title pages: '''Hardware [description]'''
}}
'''[[:Category:Hardware|All pages in Category:Hardware]]'''

* [[External Battery Pack]]
* [[A2dp]]
* [[Accelerometer]]
* [[Ambient Light Sensor]]
* [[Bluetooth Research]]
* [[GPS]]
* [[Hardware]]
* [[Hardware issues]]
* [[IR Proximity Sensor]]
* [[Controlling LEDs from the Shell|LEDS: Control from the shell]]
* [[More on Leds|LEDS: More information]]
* [[OMAP vibration device|OMAP vibration device]]
* [[Torch/Flash|Torch/Flash]]
* [[USB]]
* [[WLAN|WLAN / WIFI]]
* [[Touchscreen]]
* [[Temperature Sensor]]
* [[Camera]]
* [[Battery]]
* [[PalmPre2HardwareAndDriversInformations| Hardware and drivers used in the palm-pre 2, and how different it is from the palm-pre]]
* [[Debug-Testpads]]

PalmPre2HardwareAndDriversInformations

2010-11-14T09:46:22Z

Morphis: Add informations about the modem

== Introduction ==
The palm-pre 2 is now out.
This page goal is to find out what exact chip,interfaces,drivers are used on the palm-pre 2.

== Components ==

=== Modem ===

Modem is exactly the same as in the Pre and Pre Plus devices. The modem protocol is the same too. What Palm changes between Pre/Pre Plus and Pre 2 is the software which drives the modem. But in the end the new log files style helps me (morphis) to get more informations about the protocol to finish the implementation of msmcomm (http://git.freesmartphone.org/?p=msmcomm.git;a=summary).

== Dumps ==

=== ls /dev ===
<pre>
root@roadrunner:/dev# ls -l
crw-rw---- 1 root root 247, 0 Nov 13 18:17 DspBridge
lrwxrwxrwx 1 root root 13 Nov 13 18:17 MAKEDEV -> /sbin/MAKEDEV
lrwxrwxrwx 1 root root 4 Nov 13 18:17 XOR -> null
crw-rw---- 1 root root 10, 62 Nov 13 18:17 btuart
drwxr-xr-x 3 root root 60 Nov 13 18:17 bus
drwxr-xr-x 6 root root 120 Nov 13 18:18 cgroup
drwxr-xr-x 44 root root 0 Nov 13 18:17 cgroups
crw------- 1 root root 5, 1 Nov 13 18:17 console
lrwxrwxrwx 1 root root 11 Nov 13 18:17 core -> /proc/kcore
c--------- 1 root root 249, 0 Nov 13 18:18 discsock
drwxr-xr-x 5 root root 100 Nov 13 18:17 disk
lrwxrwxrwx 1 root root 3 Nov 13 18:17 fb -> fb0
crw-rw---- 1 root video 29, 0 Nov 13 18:17 fb0
crw-rw---- 1 root video 29, 1 Nov 13 18:17 fb1
lrwxrwxrwx 1 root root 13 Nov 13 18:17 fd -> /proc/self/fd
prw-r--r-- 1 root root 0 Nov 13 18:17 fifo.1
prw-r--r-- 1 root root 0 Nov 13 18:17 fifo.2
crw-rw-rw- 1 root root 1, 7 Nov 13 18:17 full
crw-rw-rw- 1 root root 10, 229 Nov 13 18:17 fuse
drwxr-xr-x 2 root root 40 Nov 13 18:17 gadget
lrwxrwxrwx 1 root root 7 Nov 13 18:17 gps -> ttyACM2
prw-r--r-- 1 root root 0 Nov 13 18:17 grfifo.1
prw-r--r-- 1 root root 0 Nov 13 18:17 grfifo.2
crw-r--r-- 1 root root 1, 5 Nov 13 18:17 heap
crw-rw---- 1 root root 89, 1 Nov 13 18:17 i2c-1
crw-rw---- 1 root root 89, 2 Nov 13 18:17 i2c-2
crw-rw---- 1 root root 89, 3 Nov 13 18:17 i2c-3
prw------- 1 root root 0 Nov 13 18:17 initctl
drwxr-xr-x 2 root root 300 Nov 13 18:17 input
crw-r----- 1 root kmem 1, 2 Nov 13 18:17 kmem
crw-rw---- 1 root root 1, 11 Nov 13 18:17 kmsg
srw-rw-rw- 1 root root 0 Nov 13 18:17 log
drwxr-xr-x 2 root root 40 Nov 13 18:17 logdir
drwxr-xr-x 2 root root 60 Nov 13 18:17 loop
brw-r----- 1 root disk 7, 0 Nov 13 18:17 loop0
brw-r----- 1 root disk 7, 1 Nov 13 18:17 loop1
brw-r----- 1 root disk 7, 2 Nov 13 18:17 loop2
brw-r----- 1 root disk 7, 3 Nov 13 18:17 loop3
brw-r----- 1 root disk 7, 4 Nov 13 18:17 loop4
brw-r----- 1 root disk 7, 5 Nov 13 18:17 loop5
brw-r----- 1 root disk 7, 6 Nov 13 18:17 loop6
brw-r----- 1 root disk 7, 7 Nov 13 18:17 loop7
crw-rw---- 1 root lp 10, 57 Nov 13 18:17 lp8501
drwxr-xr-x 2 root root 220 Nov 13 18:17 mapper
crw-r----- 1 root kmem 1, 1 Nov 13 18:17 mem
crw-rw---- 1 root root 253, 0 Nov 13 18:17 memnotify
brw-r----- 1 root disk 179, 0 Nov 13 18:17 mmcblk0
brw-r----- 1 root disk 179, 1 Nov 13 18:17 mmcblk0p1
brw-r----- 1 root disk 179, 2 Nov 13 18:17 mmcblk0p2
brw-r----- 1 root disk 179, 3 Nov 13 18:17 mmcblk0p3
lrwxrwxrwx 1 root root 7 Nov 13 18:17 modem0 -> ttyACM0
lrwxrwxrwx 1 root root 7 Nov 13 18:17 modemdiag -> ttyACM1
crw-rw---- 1 root root 10, 61 Nov 13 18:17 modemuart
crw-rw---- 1 root root 10, 60 Nov 13 18:17 nduid
drwxr-xr-x 2 root root 60 Nov 13 18:17 net
crw-rw---- 1 root root 10, 56 Nov 13 18:17 novacom_ep0
crw-rw---- 1 root root 10, 55 Nov 13 18:17 novacom_ep_in
crw-rw---- 1 root root 10, 54 Nov 13 18:17 novacom_ep_out
crw-rw-rw- 1 root root 1, 3 Nov 13 18:17 null
crw-rw---- 1 root root 250, 0 Nov 13 18:17 ondemandtcl0
lrwxrwxrwx 1 root root 6 Nov 13 18:17 par8501 -> lp8501
prw-r--r-- 1 root root 0 Nov 13 18:17 pm_server_in
prw-r--r-- 1 root root 0 Nov 13 18:17 pm_server_out
crw------- 1 root root 108, 0 Nov 13 18:17 ppp
crw-rw-rw- 1 root tty 5, 2 Nov 13 19:07 ptmx
drwxr-xr-x 2 root root 0 Jan 1 1970 pts
crw-rw-rw- 1 root root 248, 0 Nov 13 18:17 pvrsrvkm
lrwxrwxrwx 1 root root 4 Nov 13 18:17 ram -> ram1
brw-r----- 1 root disk 1, 0 Nov 13 18:17 ram0
brw-r----- 1 root disk 1, 1 Nov 13 18:17 ram1
brw-r----- 1 root disk 1, 2 Nov 13 18:17 ram2
brw-r----- 1 root disk 1, 3 Nov 13 18:17 ram3
lrwxrwxrwx 1 root root 4 Nov 13 18:17 ramdisk -> ram0
crw-rw-rw- 1 root root 1, 8 Nov 13 18:17 random
lrwxrwxrwx 1 root root 4 Nov 13 18:17 rtc -> rtc0
crw-rw---- 1 root root 254, 0 Nov 13 18:17 rtc0
drwxrwxrwt 2 root root 280 Nov 13 18:18 shm
drwxr-xr-x 2 root root 180 Nov 13 18:17 snd
lrwxrwxrwx 1 root root 24 Nov 13 18:17 sndstat -> /proc/asound/oss/sndstat
lrwxrwxrwx 1 root root 15 Nov 13 18:17 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 root root 15 Nov 13 18:17 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 root root 15 Nov 13 18:17 stdout -> /proc/self/fd/1
drwx------ 2 root root 200 Nov 13 18:17 store
lrwxrwxrwx 1 root root 11 Nov 13 18:17 tokens -> /tmp/tokens
crw-rw---- 1 root root 10, 59 Nov 13 18:17 touchscreen
drwxr-xr-x 2 root root 80 Nov 13 18:17 tts
crw-rw-rw- 1 root tty 5, 0 Nov 13 18:17 tty
crw--w---- 1 root tty 4, 0 Nov 13 18:17 tty0
crw--w---- 1 root tty 4, 1 Nov 13 18:17 tty1
crw--w---- 1 root tty 4, 2 Nov 13 18:17 tty2
crw--w---- 1 root tty 4, 3 Nov 13 18:17 tty3
crw--w---- 1 root tty 4, 4 Nov 13 18:17 tty4
crw--w---- 1 root tty 4, 5 Nov 13 18:17 tty5
crw--w---- 1 root tty 4, 6 Nov 13 18:17 tty6
crw--w---- 1 root tty 4, 7 Nov 13 18:17 tty7
crw-rw---- 1 root dialout 166, 0 Nov 13 18:20 ttyACM0
crw-rw---- 1 root dialout 166, 1 Nov 13 18:17 ttyACM1
crw-rw---- 1 root dialout 166, 2 Nov 13 18:17 ttyACM2
crw-rw---- 1 root dialout 4, 66 Nov 13 18:17 ttyS2
crw-rw---- 1 root dialout 4, 67 Nov 13 18:17 ttyS3
crw-rw-rw- 1 root root 1, 9 Nov 13 18:17 urandom
crw-rw---- 1 root root 251, 0 Nov 13 18:17 usbdev1.1_ep00
crw-rw---- 1 root root 251, 1 Nov 13 18:17 usbdev1.1_ep81
crw-rw---- 1 root root 251, 2 Nov 13 18:17 usbdev1.2_ep00
crw-rw---- 1 root root 251, 5 Nov 13 18:17 usbdev1.2_ep02
crw-rw---- 1 root root 251, 7 Nov 13 18:17 usbdev1.2_ep04
crw-rw---- 1 root root 251, 9 Nov 13 18:17 usbdev1.2_ep06
crw-rw---- 1 root root 251, 3 Nov 13 18:17 usbdev1.2_ep81
crw-rw---- 1 root root 251, 4 Nov 13 18:17 usbdev1.2_ep82
crw-rw---- 1 root root 251, 6 Nov 13 18:17 usbdev1.2_ep84
crw-rw---- 1 root root 251, 8 Nov 13 18:17 usbdev1.2_ep86
crw-rw---- 1 root root 252, 0 Nov 13 18:17 usbmon0
crw-rw---- 1 root root 252, 1 Nov 13 18:17 usbmon1
crw-rw---- 1 root tty 7, 0 Nov 13 18:17 vcs
crw-rw---- 1 root tty 7, 1 Nov 13 18:17 vcs1
crw-rw---- 1 root tty 7, 128 Nov 13 18:17 vcsa
crw-rw---- 1 root tty 7, 129 Nov 13 18:17 vcsa1
lrwxrwxrwx 1 root root 6 Nov 13 18:17 video -> video0
crw-rw---- 1 root video 81, 0 Nov 13 18:17 video0
crw-rw---- 1 root video 81, 1 Nov 13 18:17 video1
crw-rw---- 1 root video 81, 2 Nov 13 18:17 video2
crw-rw---- 1 root root 10, 63 Nov 13 18:17 vtmdrv
crw-rw---- 1 root root 10, 130 Nov 13 18:17 watchdog
crw-rw-rw- 1 root root 1, 5 Nov 13 18:17 zero
</pre>

=== ls /dev/input ===
<pre>
root@roadrunner:/dev/input# ls -l
lrwxrwxrwx 1 root root 6 Nov 13 18:17 accelerometer0 -> event5
crw-r----- 1 root root 13, 64 Nov 13 18:17 event0
crw-r----- 1 root root 13, 65 Nov 13 18:17 event1
crw-r----- 1 root root 13, 66 Nov 13 18:17 event2
crw-r----- 1 root root 13, 67 Nov 13 18:17 event3
crw-r----- 1 root root 13, 68 Nov 13 18:17 event4
crw-r----- 1 root root 13, 69 Nov 13 18:17 event5
lrwxrwxrwx 1 root root 6 Nov 13 18:17 keypad0 -> event2
lrwxrwxrwx 1 root root 6 Nov 13 18:17 keypad1 -> event1
lrwxrwxrwx 1 root root 6 Nov 13 18:17 keypad2 -> event0
lrwxrwxrwx 1 root root 6 Nov 13 18:17 light0 -> event4
lrwxrwxrwx 1 root root 6 Nov 13 18:17 proximity0 -> event3
crw------- 1 root root 10, 223 Nov 13 18:17 uinput
</pre>

=== Dmesg ===

<pre>
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 2.6.24-palm-joplin-3430 (na@na) (gcc version 4.3.3 (Sourcery G++ 4.3-234) ) #1 48
[ 0.000000] CPU: ARMv7 Processor [413fc082] revision 2 (ARMv7), cr=00c5387f
[ 0.000000] Machine: Sirloin OMAP3630 board
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] On node 0 totalpages: 128512
[ 0.000000] DMA zone: 1004 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 127508 pages, LIFO batch:31
[ 0.000000] Normal zone: 0 pages used for memmap
[ 0.000000] Movable zone: 0 pages used for memmap
[ 0.000000] BUG: map for 0x50000000 at 0xe0000000 can not be mapped using pages, ignoring.
[ 0.000000] omap_revision is 0x3630133c, patching legacy revision to 0x34304332
[ 0.000000] OMAP3630ES1.1
[ 0.000000] SRAM: Mapped pa 0x40200000 to va 0xd7000000 size: 0x100000
[ 0.000000] CPU0: D VIPT write-back cache
[ 0.000000] CPU0: cache: 768 bytes, associativity 1, 8 byte lines, 64 sets
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 127508
[ 0.000000] Kernel command line: root=/dev/mmcblk0p2 rootwait ro fb=0x9f600000 fbcon=disable console=tty1 nduid=[elided] klog=0x9ff00000 klog_len=0x100000 boardtype=castle-roadrunner-pvt dsp_base=0x9f900000 dsp_len=0x600000 HousingA=glass lastboot=reboot
[ 0.000000] OMAP: Initializing Shared Resource Framework
[ 0.000000] GPMC revision 5.0
[ 0.000000] IRQ: Found an INTC at 0xd8200000 (revision 4.0) with 96 interrupts
[ 0.000000] Total of 96 interrupts on 1 active controller
[ 0.000000] OMAP34xx GPIO hardware version 2.5
[ 0.000000] PID hash table entries: 2048 (order: 11, 8192 bytes)
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [tty1] enabled
[ 0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
[ 0.000000] Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
[ 0.060000] Memory: 502MB = 502MB total
[ 0.060000] Memory: 504320KB available (4384K code, 565K data, 172K init)
[ 0.060000] SLUB: Genslabs=11, HWalign=32, Order=0-1, MinObjects=4, CPUs=1, Nodes=1
[ 0.060000] Calibrating delay loop... 249.03 BogoMIPS (lpj=1245184)
[ 0.300000] Mount-cache hash table entries: 512
[ 0.300000] Initializing cgroup subsys ns
[ 0.300000] Initializing cgroup subsys cpuacct
[ 0.300000] CPU: Testing write buffer coherency: ok
[ 0.300000] net_namespace: 64 bytes
[ 0.310000] NET: Registered protocol family 16
[ 0.320000] OMAP Clock subsystem initializing.
[ 0.320000] System clock speed: 26000000, mpu speed: 250000000, l3_speed: 100000000
[ 0.320000] OMAP DMA hardware revision 5.0
[ 0.380000] OMAP: Display hardware version 2.0
[ 0.390000] klog_init: entry
[ 0.390000] klog_init: phys buffer is at 0x9ff00000
[ 0.390000] klog_init: virt address is bf800000
[ 0.390000] klog_init: magic 0x6b6c6f67 version 0x1
[ 0.390000] found klog, len 1048576, using buffer number 3
[ 0.400000] i2c_omap i2c_omap.1: bus 1 rev4.0 at 400 kHz
[ 0.400000] i2c_omap i2c_omap.2: bus 2 rev4.0 at 100 kHz
[ 0.400000] i2c_omap i2c_omap.3: bus 3 rev4.0 at 400 kHz
[ 0.400000] TWL4030: TRY attach Slave TWL4030-ID0 on Adapter OMAP I2C adapter [1]
[ 0.400000] TWL4030: TRY attach Slave TWL4030-ID1 on Adapter OMAP I2C adapter [1]
[ 0.400000] TWL4030: TRY attach Slave TWL4030-ID2 on Adapter OMAP I2C adapter [1]
[ 0.400000] TWL4030: TRY attach Slave TWL4030-ID3 on Adapter OMAP I2C adapter [1]
[ 0.410000] OMAP: Programming TWL sleep/wake scripts...
[ 0.410000] TWL4030 Power Companion Active
[ 0.410000] TWL4030: Driver registration complete.
[ 0.420000] twl4030_usb: Device ATTACHED: Cold plugging
[ 0.420000] twl4030_phy_suspend: irq_disable=0
[ 0.420000] check_musb_idle: can't get otg_state
[ 0.420000] phy_suspend: enter
[ 0.420000] twl4030_phy_resume: mode=1
[ 0.430000] charger_detector: schudule detection (not ready)
[ 0.430000] Initialized TWL4030 USB module
[ 0.430000] SCSI subsystem initialized
[ 0.440000] usbcore: registered new interface driver usbfs
[ 0.440000] usbcore: registered new interface driver hub
[ 0.440000] usbcore: registered new device driver usb
[ 0.440000] musb_hdrc: version 6.0/dbg, musb-dma, peripheral, debug=1
[ 0.440000] HS USB OTG: revision 0x40, sysconfig 0x2014, sysstatus 0x1, intrfsel 0x1, simenable 0x0
[ 0.440000] musb_hdrc: ConfigData=0xde (UTMI-8, dyn FIFOs, bulk combine (X), bulk split (X), HB-ISO Rx (X), HB-ISO Tx (X), SoftConn)
[ 0.440000] musb_hdrc: MHDRC RTL version 1.800
[ 0.440000] musb_hdrc: setup fifo_mode 4
[ 0.440000] musb_hdrc: 29/31 max ep, 15424/16384 memory
[ 0.440000] musb_hdrc: hw_ep 0shared, max 64
[ 0.440000] musb_hdrc: hw_ep 1tx, max 512
[ 0.440000] musb_hdrc: hw_ep 1rx, max 512
[ 0.440000] musb_hdrc: hw_ep 2tx, max 512
[ 0.440000] musb_hdrc: hw_ep 2rx, max 512
[ 0.440000] musb_hdrc: hw_ep 3tx, max 512
[ 0.440000] musb_hdrc: hw_ep 3rx, max 512
[ 0.440000] musb_hdrc: hw_ep 4tx, max 512
[ 0.440000] musb_hdrc: hw_ep 4rx, max 512
[ 0.440000] musb_hdrc: hw_ep 5tx, max 512
[ 0.440000] musb_hdrc: hw_ep 5rx, max 512
[ 0.440000] musb_hdrc: hw_ep 6tx, max 512
[ 0.440000] musb_hdrc: hw_ep 6rx, max 512
[ 0.440000] musb_hdrc: hw_ep 7tx, max 512
[ 0.440000] musb_hdrc: hw_ep 7rx, max 512
[ 0.440000] musb_hdrc: hw_ep 8tx, max 512
[ 0.440000] musb_hdrc: hw_ep 8rx, max 512
[ 0.440000] musb_hdrc: hw_ep 9tx, max 512
[ 0.440000] musb_hdrc: hw_ep 9rx, max 512
[ 0.440000] musb_hdrc: hw_ep 10tx, max 512
[ 0.440000] musb_hdrc: hw_ep 10rx, max 512
[ 0.440000] musb_hdrc: hw_ep 11tx, max 512
[ 0.440000] musb_hdrc: hw_ep 11rx, max 512
[ 0.440000] musb_hdrc: hw_ep 12tx, max 512
[ 0.440000] musb_hdrc: hw_ep 12rx, max 512
[ 0.440000] musb_hdrc: hw_ep 13tx, max 512
[ 0.440000] musb_hdrc: hw_ep 13rx, max 512
[ 0.440000] musb_hdrc: hw_ep 14shared, max 1024
[ 0.440000] musb_hdrc: hw_ep 15shared, max 1024
[ 0.440000] musb_hdrc: USB Peripheral mode controller at bf904000 using DMA, IRQ 92
[ 0.440000] musb_init_controller 2088: PERIPHERAL mode, status 0, dev98
[ 0.440000] Registered /proc/driver/musb_hdrc
[ 0.480000] NET: Registered protocol family 2
[ 0.490000] Time: 32k_counter clocksource has been installed.
[ 0.490000] Switched to high resolution mode on CPU 0
[ 0.570000] IP route cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.570000] TCP established hash table entries: 16384 (order: 5, 131072 bytes)
[ 0.570000] TCP bind hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.570000] TCP: Hash tables configured (established 16384 bind 16384)
[ 0.570000] TCP reno registered
[ 0.600000] SmartReflex Driver: Initializing
[ 0.600000] SmartReflex Driver: Using EFUSED nvalues
[ 0.600000] SmartReflex Driver: Initialized
[ 0.600000] OMAP 3430 Power Management subsystem initializing.
[ 0.600000] OMAP: Setting up clocks.
[ 0.600000] OMAP: Change MPU speed: 250 => 1000 MHz
[ 0.600000] SR1: OPP5: initiate calibration (initial vsel 62)
[ 0.600000] SR1: OPP5: calibrated to 49. add margin.
[ 0.600000] SR1: OPP5: update vsel 0 => 52
[ 0.600000] OMAP: ARM/DSP clock at 1000/430 MHz.
[ 0.600000] BogoMIPS: 996.14 @1000000 KHz
[ 0.600000] OMAP: Change CORE speed: 100 => 200 MHz
[ 0.620000] SR2: OPP3: initiate calibration (initial vsel 43)
[ 0.620000] SR2: OPP3: update vsel 0 => 29
[ 0.650000] OMAP CPU idle driver initializing.
[ 0.650000] create_proc_entry succeeded
[ 0.650000] Initialize power support module
[ 0.650000] OMAP3: PM: Sirloin target registered successfully.
[ 0.650000] TWL4030: Setting up LDOs.
[ 0.660000] input: headset as /class/input/input0
[ 0.660000] Invalid Console Name
[ 0.660000] UART: Invalid console parameter.
[ 0.660000] VFS: Disk quotas dquot_6.5.1
[ 0.660000] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 0.660000] fuse init (API version 7.9)
[ 0.660000] io scheduler noop registered
[ 0.660000] io scheduler anticipatory registered
[ 0.660000] io scheduler deadline registered
[ 0.660000] io scheduler cfq registered (default)
[ 0.660000] OMAP LCD controller initialized
[ 0.660000] omap24xxfb: Options "<NULL>"
[ 0.660000] omap24xxfb: fb0 frame buffer device
[ 0.660000] omap24xxfb: display mode 320x480x32 hsync 30kHz vsync 61Hz
[ 0.710000] lcd panel ID: 10 81 3
[ 0.710000] LCD panel initialized
[ 0.740000] Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
[ 0.740000] serial8250.0: ttyS0 at MMIO 0x4806a000 mem 0xd806a000 (irq = 72) is a ST16654
[ 0.740000] serial8250.0: ttyS1 at MMIO 0x4806c000 mem 0xd806c000 (irq = 73) is a ST16654
[ 0.740000] serial8250.0: ttyS2 at MMIO 0x49020000 mem 0xd9020000 (irq = 74) is a ST16654
[ 0.740000] RAMDISK driver initialized: 4 RAM disks of 32768K size 1024 blocksize
[ 0.740000] loop: module loaded
[ 0.740000] Vibrator driver initialized...
[ 0.740000] USERPINS: Configuring irq for gpio=176
[ 0.740000] hsuart1: grap dma chain 5
[ 0.740000] omap_hsuart: creating 'btuart' device on UART 1
[ 0.740000] Trying to free nonexistent resource <000000004806c000-000000004806c01f>
[ 0.740000] hsuart0: grap dma chain 8
[ 0.740000] omap_hsuart: creating 'modemuart' device on UART 0
[ 0.740000] Trying to free nonexistent resource <000000004806a000-000000004806a01f>
[ 0.740000] mdm_act: initializing driver.
[ 0.740000] mdm_act: AWM=157, MWA=152, MWU=155 Timeout 250ms, Uart Port 0. Acm dev (0x0)
[ 0.740000] digest size 20
[ 0.740000] nduid: [elided]
[ 0.750000] PPP generic driver version 2.4.2
[ 0.750000] tun: Universal TUN/TAP device driver, 1.6
[ 0.750000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 0.750000] Linux video capture interface: v2.00
[ 0.750000] omap24xxvout: registered device video2 [v4l2]
[ 0.950000] omap34xx-isp: found revision=f0
[ 0.950000] omap34xx-isp: registered v4l2 interface: name=smia 1.0
[ 0.950000] omap34xx-isp: registered v4l2 device: type=1 minor=0
[ 0.950000] omap34xx-isp: registered v4l2 device: type=128 minor=1
[ 0.970000] vx6953: found silicon id 8 nvm v1 (cut-3.0)
[ 0.990000] i2c /dev entries driver
[ 0.990000] charger_detector: schudule detection
[ 0.990000] Driver 'sd' needs updating - please use bus_type methods
[ 0.990000] ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
[ 0.990000] ohci-omap ohci-omap.0: OMAP OHCI
[ 0.990000] ohci-omap ohci-omap.0: new USB bus registered, assigned bus number 1
[ 0.990000] ohci-omap ohci-omap.0: irq 76, io mem 0x48064400
[ 1.070000] usb_detect_quirks: disable autosuspend for hub! udev=bbff8000
[ 1.070000] usb usb1: configuration #1 chosen from 1 choice
[ 1.070000] hub 1-0:1.0: USB hub found
[ 1.070000] hub 1-0:1.0: 3 ports detected
[ 1.180000] usbcore: registered new interface driver cdc_acm
[ 1.180000] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems and ISDN adapters
[ 1.180000] g_rockhopper gadget: serial_number=[elided]
[ 1.180000] mass_storage_function_add
[ 1.180000] gadget_event: enable storage events
[ 1.180000] g_rockhopper gadget: Number of LUNs=1
[ 1.180000] g_rockhopper gadget: mass storage function is added
[ 1.180000] g_rockhopper gadget: Rockhopper Gadget, version: Cinco de Mayo 2009
[ 1.180000] g_rockhopper gadget: g_rockhopper ready
[ 1.210000] input: gpio-keys as /class/input/input1
[ 1.230000] musb_stage2_irq 813: SUSPEND (b_idle) devctl 99 power e0
[ 1.240000] gpio-keys: volume up button released
[ 1.240000] gpio-keys: volume down button released
[ 1.240000] gpio-keys: push to talk button released
[ 1.240000] gpio-keys: power button released
[ 1.240000] gpio-keys: core navi button released
[ 1.240000] MAXIM7359 keyboard driver
[ 1.240000] input: maxim_keypad as /class/input/input2
[ 1.300000] input: hsdl9100_proximity as /class/input/input3
[ 1.330000] hsdl9100_proximity: Proximity Sensor driver initialized....
[ 1.330000] input: temt6200_light as /class/input/input4
[ 1.360000] i2c_omap i2c_omap.3: No Acknowledgement
[ 1.360000] i2c_omap i2c_omap.3: No Acknowledgement
[ 1.360000] i2c_omap i2c_omap.3: No Acknowledgement
[ 1.360000] input: kxsd9_accelerometer as /class/input/input5
[ 1.390000] musb_stage0_irq 661: BUS RESET as b_idle
[ 1.390000] gadget_event: source=bus mA=100
[ 1.390000] twl4030_rtc twl4030_rtc: rtc core: registered twl4030_rtc as rtc0
[ 1.390000] Driver for 1-wire Dallas network protocol.
[ 1.390000] OMAP_HDQ: OMAP HDQ Hardware Revision 0.5. Clock shutdown timeout: 100ms
[ 1.390000] OMAP Watchdog Timer Rev 0x31: initial timeout 60 sec
[ 1.390000] device-mapper: uevent: version 1.0.3
[ 1.390000] device-mapper: ioctl: 4.12.0-ioctl (2007-10-02) initialised: dm-devel@redhat.com
[ 1.390000] hsmmc-omap hsmmc-omap.1: initialized
[ 1.390000] hsmmc-omap hsmmc-omap.2: initialized
[ 1.390000] Registered led device: kbd_bl_led_right
[ 1.390000] Registered led device: kbd_bl_led_center
[ 1.390000] Registered led device: kbd_bl_led_left
[ 1.390000] TI TPS6105x LED driver
[ 1.390000] Registered led device: core_navi_center
[ 1.390000] Registered led device: core_navi_left
[ 1.390000] Registered led device: core_navi_right
[ 1.390000] usbcore: registered new interface driver usbhid
[ 1.390000] drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
[ 1.400000] Advanced Linux Sound Architecture Driver Version 1.0.15 (Tue Nov 20 19:16:42 2007 UTC).
[ 1.400000] audio support initialized (twl4030-i2s (mcbsp2))
[ 1.400000] audio support initialized (btsco (mcbsp3))
[ 1.400000] ALSA device list:
[ 1.400000] #0: twl4030-i2s (mcbsp2)
[ 1.400000] #1: btsco (mcbsp3)
[ 1.400000] GACT probability NOT on
[ 1.400000] Mirror/redirect action on
[ 1.400000] u32 classifier
[ 1.400000] Performance counters on
[ 1.400000] input device check on
[ 1.400000] Actions configured
[ 1.400000] Netfilter messages via NETLINK v0.30.
[ 1.400000] nf_conntrack version 0.5.0 (8192 buckets, 32768 max)
[ 1.400000] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 1.400000] arp_tables: (C) 2002 David S. Miller
[ 1.400000] TCP bic registered
[ 1.400000] TCP cubic registered
[ 1.400000] TCP westwood registered
[ 1.400000] TCP htcp registered
[ 1.400000] TCP veno registered
[ 1.400000] TCP illinois registered
[ 1.400000] NET: Registered protocol family 1
[ 1.400000] NET: Registered protocol family 17
[ 1.400000] NET: Registered protocol family 15
[ 1.400000] Bridge firewalling registered
[ 1.400000] RPC: Registered udp transport module.
[ 1.400000] RPC: Registered tcp transport module.
[ 1.400000] VFP support v0.3: implementor 41 architecture 3 part 30 variant c rev 3
[ 1.400000] OMAP cpufreq driver initializing.
[ 1.400000] SR1: OPP1: initiate calibration (initial vsel 33)
[ 1.430000] SR1: OPP1: update vsel 0 => 22
[ 1.440000] registered taskstats version 1
[ 1.440000] twl4030_rtc twl4030_rtc: setting system clock to 2010-11-13 17:17:43 UTC (1289668663)
[ 1.440000] timechange: time was changed.
[ 1.440000] cpuidle: using governor menu
[ 1.440000] Waiting for root device /dev/mmcblk0p2...
[ 1.510000] musb_stage0_irq 661: BUS RESET as b_peripheral
[ 1.510000] gadget_event: source=bus mA=100 (no change)
[ 1.600000] mmc1: new high speed MMC card at address 0001:
[ 1.600000] mmcblk0: mmc1:0001 SEM16G 15552512KiB
[ 1.600000] mmcblk0: p1 p2 p3
[ 1.660000] g_rockhopper gadget: high speed config #1: ROCKHOPPER
[ 1.660000] gadget_event: schedule host_connected
[ 1.660000] musb_hdrc periph: enabled ep1in for bulk IN, dma, maxpacket 512
[ 1.660000] musb_hdrc periph: enabled ep1out for bulk OUT, dma, maxpacket 512
[ 1.660000] g_rockhopper gadget: mass_storage ready
[ 1.660000] gadget_event: host_connected=1
[ 1.660000] charger_detector: cancel detection
[ 1.680000] kjournald starting. Commit interval 5 seconds
[ 1.680000] EXT3-fs: mounted filesystem with ordered data mode.
[ 1.680000] VFS: Mounted root (ext3 filesystem) readonly.
[ 1.680000] Freeing init memory: 172K
[ 1.970000] mdm_act: 4294937493: modem wakeup timeout
[ 2.000000] charger_detector: pullup not detected (> 510ms)
[ 2.000000] gadget_event: source=bus mA=500
[ 2.110000] kjournald starting. Commit interval 5 seconds
[ 2.110000] EXT3-fs: mounted filesystem with ordered data mode.
[ 2.510000] ------------------Rsense = 20
[ 2.540000] ------------------Full40 = 3786
[ 2.970000] mdm_act: 4294937593: modem wakeup timeout
[ 3.970000] mdm_act: 4294937693: modem wakeup timeout
[ 3.980000] /etc/init.d/mountall.sh: vgscan/vgchange done
[ 4.410000] /etc/init.d/mountall.sh: fsck of /var done
[ 4.420000] kjournald starting. Commit interval 5 seconds
[ 4.420000] EXT3 FS on dm-1, internal journal
[ 4.420000] EXT3-fs: mounted filesystem with writeback data mode.
[ 4.420000] /etc/init.d/mountall.sh: /var mounted
[ 4.450000] timechange: time was changed.
[ 4.460000] /usr/sbin/clock_from_var.sh: set clock from time_saver: Sat Nov 13 18:17:46 CET 2010
[ 4.770000] /etc/init.d/mountall.sh: wiping done
[ 4.790000] kjournald starting. Commit interval 5 seconds
[ 4.790000] EXT3 FS on dm-4, internal journal
[ 4.790000] EXT3-fs: mounted filesystem with ordered data mode.
[ 4.790000] kjournald starting. Commit interval 5 seconds
[ 4.800000] EXT3 FS on dm-5, internal journal
[ 4.800000] EXT3-fs: mounted filesystem with ordered data mode.
[ 4.800000] kjournald starting. Commit interval 5 seconds
[ 4.800000] EXT3 FS on dm-3, internal journal
[ 4.800000] EXT3-fs: mounted filesystem with ordered data mode.
[ 4.820000] /etc/init.d/mountall.sh: rest mounted
[ 4.850000] /etc/init.d/mountall.sh: filesystem checking done
[ 4.970000] mdm_act: 4294937793: modem wakeup timeout
[ 4.980000] /etc/init.d/mountall.sh: setup_cryptofs done
[ 5.060000] /etc/init.d/mountall.sh: done reporting fsck results
[ 5.070000] EXT3 FS on dm-0, internal journal
[ 5.080000] EXT3 FS on mmcblk0p2, internal journal
</pre>

Tokens

2010-05-21T14:34:45Z

Morphis:

The Tokens area contains a number of entries. Each entry has the following format:

Magic: 0x4e4b4f54 'TOKN'
Version: 0x00000001
Length: 0x???????? Length of the data area
Generation: 0x00000001
CRC: 0x???????? CRC of the full entry treating the 4 CRC bytes as zeroes
Name: up to 16 bytes, zero padded name of the token
Data: 'lenght' bytes, plus zero padding up to the next 4 bytes boundary

The CRC polynomial is 0xedb88320.

In the freesmartphone.org git repository [http://git.freesmartphone.org/?p=utilities.git;a=tree;f=palmpre/read_tokens;h=e84d2cbbc1baf0656287c67abfdf971946291a35;hb=HEAD] you will find a little utility which reads all tokens and outputs a key/value file.

Pre Touchscreen

2010-04-30T17:27:56Z

Morphis: Change style and add minor informations to ts_frame struct

==Intro==

This is a research page on the pre touchscreen -- how to examine what it does, how it works, etc.

==Screen format==
The screen is devided in 70 (7x10) fields + 7 fields for the gesture area

==Dataformat==

The dataset has 167 byte and is structured like the following struct:

<source lang="c">
struct ts_frame {
uint16_t frame_start; // constant:
uint16_t field[77]; // contains the intensity of the 7*11 fields
uint16_t frame_end; // frame end indicator; always 0xffff
uint8_t seq_nr1; // incremented if seq_nr0 = scanrate
uint16_t seq_nr2; // incremeted if seq_nr1 = 255
uint8_t unknown[4]; // timestap?
uint8_t seq_nr0; // incremented: from 0 to scanrate
uint8_t null_value; // \0
};
</source>

Touchscreen

2010-01-15T17:40:41Z

Morphis: first information; andoird driver, chipset etc.

= Touchscreen =

== Cypress CY8MRLN chipset ==

They are using the CY8MRLN chipset from Cypress in the Palm Pre which is connected over SPI to the core. The CY8MRLN provides some quite interesting features already included in the driver provided by the kernel source:

* Wake-on-touch (configurable from userspace through ioctl's; see include/linux/spi/cy8mrln.h)
* firmware loading (the CY8MRLN provide's a [[http://en.wikipedia.org/wiki/PSoC|PSoC]])
* touchscreen data is forwarded from kernel to usermode interface on /dev/touchscreen

== dump data from touchscreen ==
There are some userland tools from palm in /usr/bin which helps you to dump the data ariving on /dev/touchscreen.

== ts-lib implementation ==
For using the touchscreen with a different os like SHR or FSO we have to implement a plugin for ts-lib which decodes the data from the touchscreen ariving through /dev/touchscreen. Palm uses therefore there own implementaton /usr/bin/hidd which also provides plugin for other input system like the keyboard or the system buttons.

Current problem with the ts-lib plugin is that the structure of the data arriving on /dev/touchsreen is not known. There is another driver for a different touchscreen chipset for android available on the cypress homepage (http://www.cypress.com/?rID=40085) which includes decoding of data from the touchscreen chipset. I assume that the data from the chipset used in the Palm Pre is nearly the same.

Portal:Hardware

2010-01-15T17:23:52Z

Morphis:

Boot Chain

2009-12-14T07:42:33Z

Morphis: offset informations

== boot/boot.bin==
'''Load Address''': 0x40200000

This does some minimal hardware initialization, then loads the "real" bootloader and executes it. The "real" bootloader is tacked onto the end of boot.bin as a gzip. The offset of the "real" bootloader is different for every version. Table below will give you the right offset
(If your version is not listed, then search with "hexdump -C boot-castle.bin | less" for the byte sequence "1f 8b" (the gzip format identifier)).

<table cellpadding="2" cellspacing="0" style="text-align:left;border:1px solid #d4d4d4;">
<tr style="background-color:#F1F1F1;">
<td style="border-bottom:1px solid #d4d4d4;border-right:1px solid #d4d4d4;">Version</td>
<td style="border-bottom:1px solid #d4d4d4;">Offset</td>
</tr>
<tr>
<td style="border-right:1px solid #d4d4d4;border-bottom:1px solid #d4d4d4;">unknown</td>
<td style="border-bottom:1px solid #d4d4d4;">0x19D0 (thanks roxfan)</td>
</tr>
<tr>
<td style="border-right:1px solid #d4d4d4;border-bottom:1px solid #d4d4d4;">1.3.1 (O2)</td>
<td style="border-bottom:1px solid #d4d4d4;">0x19f0</td>
</tr>
</table>

== "real" bootloader ([[bootie]])==
'''Load Address''': 0x82000000

This looks a _lot_ like iBoot from the iPhoneOS devices, but others say that this is based off u-boot, so I will assume that is true and that iBoot is also based off of it. It even seems to have some of the u-boot commands, such as "printenv", "run", "setenv", "getenv", etc. I am currently looking into how to communicate with it as you can with iBoot.

Research Pre Boot Process

2009-12-11T18:47:51Z

Morphis:

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<source lang=bash>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</source>

When using the nova-installer-image-castle.uImage image bootie hands over the following cmdline to the kernel:

<source lang=bash>
root=/dev/ram0 ramdisk=32768 ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000 lastboot=recover
</source>

The nova-installer-image-castle.uImage image uses a initrd an not an initramfs. Somehow bootie detects if the kernel which is loaded has an initrd build in. If yes, then bootie changes the cmdline for the kernel to the env var bootargs-ramdisk.

You can even boot a kernel from your local host with novacom:

<source lang=bash>
cat uImage-kexecboot-2.6.24-r50-palmpre.bin | novaterm boot mem://
</source>

novacom loads the kernel into ram and then boots it. The kernel is loaded with the same cmdline as mentioned above.

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<source lang=bash>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</source>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<source lang=bash>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</source>

Research Pre Boot Process

2009-12-11T18:40:58Z

Morphis:

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<source lang=bash>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</source>

When using the nova-installer-image-castle.uImage image bootie hands over the following cmdline to the kernel:

<source lang=bash>
root=/dev/ram0 ramdisk=32768 ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000 lastboot=recover
</source>

The nova-installer-image-castle.uImage image uses a initrd an not an initramfs.

You can even boot a kernel from your local host with novacom:

<source lang=bash>
cat uImage-kexecboot-2.6.24-r50-palmpre.bin | novaterm boot mem://
</source>

novacom loads the kernel into ram and then boots it. The kernel is loaded with the same cmdline as mentioned above.

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<source lang=bash>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</source>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<source lang=bash>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</source>

Research Pre Boot Process

2009-12-11T18:37:58Z

Morphis: different cmdline with nova-installer image

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<source lang=bash>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</source>

When using the nova-installer-image-castle.uImage image bootie hands over the following cmdline to the kernel:

<source lang=bash>
root=/dev/ram0 ramdisk=32768 ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000 lastboot=recover
</source>

You can even boot a kernel from your local host with novacom:

<source lang=bash>
cat uImage-kexecboot-2.6.24-r50-palmpre.bin | novaterm boot mem://
</source>

novacom loads the kernel into ram and then boots it. The kernel is loaded with the same cmdline as mentioned above.

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<source lang=bash>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</source>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<source lang=bash>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</source>

Research Pre Boot Process

2009-12-09T20:20:15Z

Morphis: note about cmdline when booting a kernel with novacom

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<source lang=bash>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</source>

You can even boot a kernel from your local host with novacom:

<source lang=bash>
cat uImage-kexecboot-2.6.24-r50-palmpre.bin | novaterm boot mem://
</source>

novacom loads the kernel into ram and then boots it. The kernel is loaded with the same cmdline as mentioned above.

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<source lang=bash>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</source>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<source lang=bash>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</source>

Research Pre Boot Process

2009-12-09T20:07:32Z

Morphis: style correctness

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<source lang=bash>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</source>

You can even boot a kernel from your local host with novacom:

<source lang=bash>
cat uImage-kexecboot-2.6.24-r50-palmpre.bin | novaterm boot mem://
</source>

novacom loads the kernel into ram and then boots it.

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<source lang=bash>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</source>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<source lang=bash>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</source>

Research Pre Boot Process

2009-12-09T20:06:37Z

Morphis: booting your a kernel with novacom

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<pre>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</pre>

You can even boot a kernel from your local host with novacom:

<source lang=bash>
# cat uImage-kexecboot-2.6.24-r50-palmpre.bin | novaterm boot mem://
</source>

novacom loads the kernel into ram and then boots it.

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<pre>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</pre>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<pre>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</pre>

Research Pre Boot Process

2009-12-08T20:36:13Z

Morphis: add informations about initial boot process (bootloader & kernel startup)

== Bootloader & kernel startup ==

When the pre is starting it loads the boot.bin image into ram. This is the booloader bootie which loads the linux kernel. The Linux kernel is loaded with the following cmdline (which is build out of the env vars from bootie):
<pre>
root=/dev/mmcblk0p2 rootwait ro fb=0x8f600000 fbcon=disable console=tty1 nduid=ea413b0b980b26d75c6658199d532472049644ae klog=0x8ff00000 klog_len=0x100000 boardtype=castle-dvt3 dsp_base=0x8f900000 dsp_len=0x600000
</pre>

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<pre>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</pre>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<pre>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</pre>

Research Pre Boot Process

2009-11-28T14:03:00Z

Morphis: g_composite driver is build in the kernel

== General ==
On startup /dev/root is mounted as rootfs. Then /sbin/init is called which mounts /dev/mapper/store-root as the new rootfs. Finally the init script on /dev/root calls the init script in /sbin /dev/mapper/store-root.

The init script on /dev/mapper/store-root starts upstart or the miniboot.sh script in /etc.

== Networking ==
When upstart is starting it executes a script called usbctrl whichs load the right usb driver and configuration for novacom or usbnetworking. Depending which machine is used the g_composite driver is loaded with a different product id.

<pre>
if [[ "$machineType" == "armv7l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x101 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8002 || true
else
/sbin/modprobe -q g_composite product=0x8004 || true
fi
elif [[ "$machineType" == "armv6l" ]];then
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/usbnet_enabled ]; then
/sbin/modprobe -q g_composite product=0x103 || true
elif [ -e /var/gadget/novacom_enabled ]; then
/sbin/modprobe -q g_composite product=0x8012 || true
else
/sbin/modprobe -q g_composite product=0x8012 || true
fi
else
/sbin/modprobe -q g_composite || true
fi
</pre>

Is the g_composite driver is build in the kernel the script changes the configuration of the gadget driver through a sysfs entry.
<pre>
if [[ -e /var/gadget/usbnet_enabled && -e /var/gadget/novacom_enabled ]]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/usbnet_enabled ]; then
echo 5 > /sys/class/usb_gadget/config_num
elif [ -e /var/gadget/novacom_enabled ]; then
echo 2 > /sys/class/usb_gadget/config_num
else
echo 1 > /sys/class/usb_gadget/config_num
fi
</pre>

Research Pre Boot Process

2009-11-28T14:00:12Z

Morphis: Add some initial informations about the boot process

Portal:Research

2009-11-28T13:54:24Z

Morphis: Add entry for boot-process research page

__notoc__
{{portal-header|
The Research Portal is for bleeding edge things being done with the device.

Title all pages: '''Research [description]''' or '''Reference [description]'''
}}
{{portal-two-columns
|column1=
===Research:===

* [[Applications Bundled on the Pre]]
* [[Application_Framework|Application Framework]]
* [[Blocking Updates]]
* [[New Bluetooth|BlueZ (Replacing Palm Bluetooth)]]
* [[Boot_Chain|Boot Chain]]
* [[Bootie]]
* [[ClassicFilesystem]]
* [[Decrypt SSL (trusted man-in-the-middle technique)|Decrypt SSL (trusted man-in-the-middle technique)]]
* [[FirstUse Application Functionality]]
* [[Fonts available on board the Pre]]
* [[Gstreamer]]
* [[Hidd]]
* [[Introspecting_Dbus|Introspecting Dbus]]
* [[Key Codes|Key Codes]]
* [[Pre Specific Hash Codes|Pre Specific Hash Codes]]
* [[Pictures from Self-Test|Pictures from Self-Test]]
* [[Restore Debug Log|Restore Debug Log]]
* [[Reverse_Engineering_WebOS_Doctor|Reverse Engineering WebOS Doctor]]
* [[Rooted Pre Issues|Rooted Pre Issues]]
* [[Research_Securing_Pre|Securing your Pre]]
* [[Running Processes|Running Processes]]
* [[Symlink Applications|Symlink Applications]]
* [[System Sounds|System Sounds]]
* [[TestApps|TestApps]]
* [[Update Service Trace|Update Service Trace]]
* [[Tidbits|Tidbits]]
* [[VideoRecording]]
* [[WebOS Exploration - Various Information|WebOS Exploration - Various Information]]
* [[Research_Pre_GSM_Modem | Pre GSM modem device informations]]
* [[Research_Pre_GSM_Modem_Protocol | Pre GSM modem protocol informations]]
* [[Research_Pre_Audio | Audio routing and setup on the Pre]]
* [[Research_mpt | MSM modem passthru mode ]]
* [[Research_Pre_Boot_Process | Boot process]]

|column2=
===Reference===
* [[Packaging Standards|Packaging Standards]]
* [[webkit_transform|Webkit Transform]]- a powerful set of commands for manipulating elements.
}}

WLAN

2009-11-16T19:22:32Z

Morphis:

= WLAN / WIFI=

== Marvell 88W8686 chipset (connected over SDIO) ==

* http://i.cmpnet.com/eetimes/eedesign/2009/image5_060709.jpg

=== Information about a Linux Kernel module ===
modinfo sd8xxx

filename: /lib/modules/2.6.24-palm-joplin-3430/kernel/net/wifi/sd8xxx.ko
license: GPL
author: Marvell International Ltd.
description: M-WLAN Driver
srcversion: 533BB7E5866E52F63B9ACCB
depends:
vermagic: 2.6.24-palm-joplin-3430 mod_unload ARMv7
parm: param_sd_slot_selector:int
parm: param_sdio_bus_width:int
parm: param_use_sdio_irq:int
parm: helper_name:charp
parm: fw_name:charp
parm: mfgmode:int

The sd8xxx driver is open source (although it requires proprietary firmware) and available under the GPL.
But why is it not on palm's open source packages site? Where is the source?
Didn't find it under http://opensource.palm.com/1.1.3/index.html

The original Marvell GPL sources are published in this download: http://www.marvell.com/drivers/driverDisplay.do?driverId=203 however the palm modifications to these sources do not appear to be published (morphis: wrote an email to Palm to get their modifications if they have some)

=== Exploring the /proc/net/wlan===
cat /proc/net/wlan/info

driver_name = "wlan"
driver_version = sd8686-9.15.14-26409.p62-(FP4)
InterfaceName="eth0"
...

=== Exploring Kernel configuration ===
cat /boot/config-2.6.24-palm-joplin-3430

[...]
#
# Wireless LAN
#
# CONFIG_WLAN_PRE80211 is not set
CONFIG_WLAN_80211=y
# CONFIG_LIBERTAS is not set
# CONFIG_USB_ZD1201 is not set
# CONFIG_HOSTAP is not set
[...]

CONFIG_LIBERTAS is not set ???

==libertas==
* http://wireless.kernel.org/en/users/Drivers/libertas
* http://lists.infradead.org/pipermail/libertas-dev/
Why don't they use libertas ???

==Firmware==

md5sum /lib/firmware/*.bin

2a4d8f4df198ce949c350df5674f4ac6 /lib/firmware/helper_sd.bin
83006642f0ae4d6e9af89f6c852327c2 /lib/firmware/mfg_sd8686.bin
261d6ed255f2cc9f5bad014b2234b8cd /lib/firmware/sd8686.bin

Firmware from: http://www.marvell.com/drivers/driverDisplay.do?driverId=203

md5sum FwImage/*.bin

2a4d8f4df198ce949c350df5674f4ac6 FwImage/helper_sd.bin
3025de2a1ed575fd691958d7da341d8b FwImage/sd8686.bin

Research Pre GSM Modem Protocol

2009-11-11T21:03:26Z

Morphis: Add more information about the frame header and first implementation of the protocol

Here we are collecting informations about the modem protocol. At the moment all the research is done on the european UMTS version of the Palm Pre. The CDMA version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Implementation ===

There is a first implementation of the protocol. You can find it at:
* http://git.freesmartphone.org/?p=msmcomm.git;a=summary

Be careful: Nothing is in a usable state! It's a first implementation to play around with the protocol.

=== Packet Start ===

A new packet starts with: '''0xFA''' (This may be an address instead as rfc1662 uses only one flag for frame separation).

As we found out that the CRC is calculated even over the flag '''0xFA''' and with assuming that the basic for the protocol is HDLC we can say that 0xFA is not the starting flag of the frame. It should be an adress if we have a real implemenation of HDLC that follows the rfc.

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefore '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

Header consists of 3 bytes. The first byte seems to be an adress or something like that, cause it's everytime the same byte '''0xFA'''.

The second byte contains the type of the frame. It's stored in the lower for bytes ('''header[1] >> 4''') There are six types.
* 1: Sync Message
* 2: Sync Response Message
* 3: Configuration Message
* 4: Configuration Response message
* 5: Acknowledge Message
* 6: Data Message

The third byte contains the sequence and acknowledge number (look at the HCI Transport specification to find out how this two numbers are used in the protocol)
* sequence number: '''header[2] >> 4'''
* acknowledge number: '''header[2] & 0xf'''

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two bytes before the packet ending marker are a CRC16-FCS checksum. (See rfc1662 for polynom and table)

=== Similarity to RFC1662 ===

The usage of CRC-16-FCS but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Even a grep -i HDLC over the binary firmware image reports the usage of PPP and HDLC as communication protocol format. So we can be almost sureley that HDLC+PPP is used.

http://tools.ietf.org/html/rfc1662

=== Similarity to Bluetooth HCI ===

The protocol on the lower level has many similarities with the HCI Link Layer protocol used in Bluetooth for Serial transports.

http://www.bluetooth.com/NR/rdonlyres/24C24181-5B5D-4566-BB4F-D4C302910B9D/1766/Volume4_SPEC.pdf

=== Identified byte sequences ===
* Sync Message: 0xfa 0x10 0x0
* Sync Response Message: 0xfa 0x30 0x0
* Configuration Message: 0xfa 0x30 0x00 0x1
* Empty Configuration Message: 0xfa 0x40 0x0
* Configuration Response Message: 0xfa 0x40 0x0
* Acknowledge Message: 0xfa 0x50 0x0
* SIM PIN on startup is sent with: 0xfa 0x60 0xe3 0x0f 0x0e 0x00 0x13 0x00 0x00 0x00 0x00 <4 ASCII digits> 0x00 0x00 0x00 0x00 0x00
* SIM PIN acknowledgement from modem: 0xfa 0x50 0x0f

=== GPS ===
The [[GPS]] receiver is part of the modem in Palm Pre and all data received and sent related to location goes over the same port using the same frame coding as GSM. GPS functionality can not be enabled (at least not using the Palm-provided drivers) until modem radio is enabled and seemingly until the modem successfully registers to the network.

Tracing the data sent over /dev/modemuart the following hostnames can be seen being sent from the OS to the modem chip:
xtra1.gpsonextra.net, xtra2.gpsonextra.net, xtra3.gpsonextra.net

They point to the RX Network's company website (rxnetwork.ca) that claims to provide better geolocation by combining GPS, wifi signals, GSM CellID and live reports downloaded over GPRS. The modem downloads the following files:
http://xtra1.gpsonextra.net/xtra.bin, http://xtra2.gpsonextra.net/xtra.bin, http://xtra3.gpsonextra.net/xtra.bin

Research Pre GSM Modem Protocol

2009-10-24T09:30:50Z

Morphis: Add HDLC+PPP usage

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA''' (This may be an address instead as rfc1662 uses only one flag for frame separation).

As we found out that the CRC is calculated even over the flag '''0xFA''' and with assuming that the basic for the protocol is HDLC we can say that 0xFA is not the starting flag of the frame. It should be an adress if we have a real implemenation of HDLC that follows the rfc.

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefor '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two bytes before the packet ending marker are a CRC16-FCS checksum. (See rfc1662 for polynom and table)

=== Similarity to RFC1662 ===

The usage of CRC-16-FCS but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Even a grep -i HDLC over the binary firmware image reports the usage of PPP and HDLC as communication protocol format. So we can be almost sureley that HDLC+PPP is used.

http://tools.ietf.org/html/rfc1662

=== Identified byte sequences ===
* Sync Message: 0xfa 0x10 0x0
* Sync Response Message: 0xfa 0x30 0x0
* Configuration Message: 0xfa 0x30 0x00 0x1
* Empty Configuration Message: 0xfa 0x40 0x0
* Configuration Response Message: 0xfa 0x40 0x0
* Acknowledge Message: 0xfa 0x50 0x0

Research Pre GSM Modem Protocol

2009-10-21T18:25:55Z

Morphis:

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA''' (This may be an address instead as rfc1662 uses only one flag for frame separation).

As we found out that the CRC is calculated even over the flag '''0xFA''' and with assuming that the basic for the protocol is HDLC we can say that 0xFA is not the starting flag of the frame. It should be an adress if we have a real implemenation of HDLC that follows the rfc.

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefor '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two bytes before the packet ending marker are a CRC16-FCS checksum. (See rfc1662 for polynom and table)

=== Similarity to RFC1662 ===

The usage of CRC-16-FCS but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol.

http://tools.ietf.org/html/rfc1662

=== Identified byte sequences ===
* Sync Message: 0xfa 0x10 0x0
* Sync Response Message: 0xfa 0x30 0x0
* Configuration Message: 0xfa 0x30 0x00 0x1
* Empty Configuration Message: 0xfa 0x40 0x0
* Configuration Response Message: 0xfa 0x40 0x0
* Acknowledge Message: 0xfa 0x50 0x0

Research Pre GSM Modem Protocol

2009-10-21T18:12:39Z

Morphis: Add assume about 0xfa as non-starting-flag