WebOS Internals - User contributions [en]

Talk:Last Resort Emergency BootLoader Recovery

2010-04-14T01:03:43Z

Onlinespending:

Question: I'm curious if any progress has been made doing a similar procedure with the Pixi. I have a Pixi that will not boot and does not go into recovery mode using the standard hold volume up + insert USB cable.

Peef: The Pixi has a Qualcomm MSM7627 core rather than the Texas Instruments OMAP3430 that's in the Pre. My experience is that it's much easier to get information and tools from TI than it is from Qualcomm. I'm sure there is similar functionality, but until someone discovers the tool for loading boot code over USB, this is not possible. The only other way would be to crack it open and use JTAG, which is a whole other can of worms. Historically Qualcomm is very secretive and will not even give out datasheets on things unless you are a bigshot carrier who has signed many NDA's and have their secret police following you around 24/7. I recommend you sell it on ebay as a "parts only" phone. Someone will want the LCD or other parts.

-----------------------
Question: As far the NVRAM Tokens. How does one write these token values?

Answer: The tokens can be written by editing the castle.xml (pixie.xml for the Pixi) under resources/webOS under the "nvram" section. Entries look like this as an example.

<Val name="DMCARRIER" action="overwrite" value="Sprint"/>
-----------------------
Question: What is the PN (product number) for the Sprint Pixi?

Answer: 180-10714-03

Last Resort Emergency BootLoader Recovery

2010-04-14T01:03:21Z

Onlinespending: /* NVRAM Tokens */

==Recovery Mode==

Typically, any damage to the operating system on the Palm Pre/Pre Plus can be recovered by booting into recovery mode. ([[How_To_Recover]])

One situation which cannot be recovered so easily is the extremely unlikely event of corruption of the installed bootloader ([[bootie]]) stored on the [[Pre's flash disk]].

If bootie on the flash disk has been damaged or corrupted in such a way that booting into recovery mode is not possible, the Pre is still not "bricked" as the OMAP3430 processor in the Pre provides for a mechanism to boot code from its USB interface. At this time this operation has not been performed on a Pixi, and will not be the same as it has a different core.

==NVRAM Tokens==

If the NVRAM partition gets trashed too, the token area will be empty and the doctor will refuse to install. If you're in this situation you need to rebuild it. Here are a few of the minimal token sets to allow the doctor to start:

Sprint Pre: DMCARRIER=Sprint, DMMODEL=P100EWW, HWoRev=A, KEYoBRD=z, PN=180-10642-05, PRODoID=P100EWW, installer=trenchcoat

GSM Pre: DMCARRIER=ROW, DMMODEL=castle, HWoRev=A, PN=180-10722-03, PRODoID=P100UEU

Verizon Pre Plus: DMCARRIER=Verizon, DMMODEL=P101EWW, HWoRev=A, KEYoBRD=z, PN=180-10724-01, PRODoID=P101EWW, installer=trenchcoat

Verizon Pixi Plus: DMCARRIER=Verizon, DMMODEL=P121EWW, HWoRev=A, KEYoBRD=z, PN=180-10714-01, PRODoID=P121EWW, installer=trenchcoat

Sprint Pixi: DMCARRIER=Sprint, DMMODEL=P200EWW, HWoRev=A, KEYoBRD=z, PN=180-10714-03, PRODoID=P200EWW, installer=trenchcoat

If you want BlueTooth and Wifi to work, You may also want to set BToADDR=00:1D:FE:''xx:yy:zz'', WIFIoADDR=00:1D:FE:''uu:vv:ww'' and PalmSN=''serial''. If you are unsure of your original MAC addresses, They can safely be any random number, the serial number is on the box and on a sticker inside the battery compartment.

== Token Backup ==

If you are a heavy experimenter, you should probably backup your tokens before you start experimenting, this way you can easily recover a future problem without as much hassle. Also, there are tokens that control thinks like touchscreen calibration, so these cannot be easily obtained if they are lost! Once booted, you can backup all your tokens by copying everything in /tmp/tokens. Here are a list of the Tokens on an Average Pre:

ACCELCAL BToADDR DMCLoAUTHPW DMSETS HWoRev PN ProdSN
BATToCH DMCARRIER DMCLoNONCE DMSVRoAUTHPW KEYoBRD PRODoID WIFIoADDR
BATToRSP DMCLoAUTHNAME DMMODEL DMSVRoNONCE ModemSN PalmSN installer

== OMAP boot Procedure ==

First, ensure that the Linux SDK and novacom packages are installed, as you will need to run webOS Doctor as the final step in this process.
Second, ensure that you have a copy of the webOS doctor jar ready for your phone.

Download: [http://markmail.org/download.xqy?id=l4qabusyxcqsslwn&number=1 omap3_usb.tar.bz2]

Compile on Linux system with "make". Optionally install with "sudo cp omap3_usbload /usr/local/bin"

Now extract the bootie binary from a WebOS Doctor image: (note: webosdoctor file name will vary)

mkdir doctor; cd doctor; unzip ../webosdoctor.jar; cd resources
mkdir webOS; cd webOS; tar xvf ../webOS.tar; mkdir nova-cust-image-castle.rootfs; cd nova-cust-image-castle.rootfs
tar xvzf ../nova-cust-image-castle.rootfs.tar.gz ./boot/boot.bin; cd boot

Booting bootie over USB:

Ensure USB is unplugged from the Pre, and remove the Pre's battery.

On your Linux system, run:

sudo omap3_usbload boot.bin

This should return:

TI OMAP3 USB boot ROM tool, version 0.1
......

and a series of dots while it looks for an OMAP3 to send boot code to.

Now, plug the pre into USB.

If all works as it should, the usbload program should return:

found device!
download ok

And your Pre will now show a USB logo. (this is bootie's "Recovery mode")

Put the battery back in without unplugging the USB.

Since you are now in USB recovery mode, you should be able to run the webOS doctor on the host Linux box. Remember that the SDK novacom package must be installed for the webOS Doctor to work in Linux.

One way to do this is to launch the doctor from the command line like:

sudo java -jar webosdoctor.jar

And follow the usual steps to recover your pre's operating system from here.

== Alternative Recovery ==

Another available option now that bootie is running is to send bootie a Linux image over USB and perform some kind of recovery work directly on the pre itself. This is not recommended unless you are very familiar with linux systems administration.

First you send bootie the boot image of the doctor's installer. This can be extracted from the WebOS Doctor jar.

novacom boot mem:// < nova-installer-image-castle.uImage

Wait 15 seconds for the system to boot then connect in to a shell on the running linux system with novaterm. (you will see no on-screen indication that the device is booting linux, only a solid Palm logo)

novaterm

You should get a shell prompt

root@palm-webos-device:/#

Now find and activate the LVM disk voumes with the following two commands:

lvm.static vgscan --ignorelockingfailure
lvm.static vgchange -ay --ignorelockingfailure

Next, mount all disks

for N in root var media log update; do mkdir /mnt/$N; mount /dev/mapper/store-$N /mnt/$N; done

When done with whatever you need to do on the system, shutting it down safely is a good idea

umount -a; tellbootie reboot

== Recovery using OS/X ==

For a Mac, the process of running USB booting the OMAP may be much simpler.

The MacOS X version of the SDK provides a pre-built executable /opt/nova/bin/cpuboot and a recovery image. You can simply run

/opt/nova/bin/cpuboot -o -v -d usb -f /opt/nova/bin/recovery-castle.bin

Last Resort Emergency BootLoader Recovery

2010-04-13T05:07:32Z

Onlinespending: /* NVRAM Tokens */

==Recovery Mode==

Typically, any damage to the operating system on the Palm Pre/Pre Plus can be recovered by booting into recovery mode. ([[How_To_Recover]])

One situation which cannot be recovered so easily is the extremely unlikely event of corruption of the installed bootloader ([[bootie]]) stored on the [[Pre's flash disk]].

If bootie on the flash disk has been damaged or corrupted in such a way that booting into recovery mode is not possible, the Pre is still not "bricked" as the OMAP3430 processor in the Pre provides for a mechanism to boot code from its USB interface. At this time this operation has not been performed on a Pixi, and will not be the same as it has a different core.

==NVRAM Tokens==

If the NVRAM partition gets trashed too, the token area will be empty and the doctor will refuse to install. If you're in this situation you need to rebuild it. Here are a few of the minimal token sets to allow the doctor to start:

Sprint Pre: DMCARRIER=Sprint, DMMODEL=P100EWW, HWoRev=A, KEYoBRD=z, PN=180-10642-05, PRODoID=P100EWW, installer=trenchcoat

GSM Pre: DMCARRIER=ROW, DMMODEL=castle, HWoRev=A, PN=180-10722-03, PRODoID=P100UEU

Verizon Pre Plus: DMCARRIER=Verizon, DMMODEL=P101EWW, HWoRev=A, KEYoBRD=z, PN=180-10724-01, PRODoID=P101EWW, installer=trenchcoat

Verizon Pixi Plus: DMCARRIER=Verizon, DMMODEL=P121EWW, HWoRev=A, KEYoBRD=z, PN=180-10714-01, PRODoID=P121EWW, installer=trenchcoat

Sprint Pixi: ???

If you want BlueTooth and Wifi to work, You may also want to set BToADDR=00:1D:FE:''xx:yy:zz'', WIFIoADDR=00:1D:FE:''uu:vv:ww'' and PalmSN=''serial''. If you are unsure of your original MAC addresses, They can safely be any random number, the serial number is on the box and on a sticker inside the battery compartment.

== Token Backup ==

If you are a heavy experimenter, you should probably backup your tokens before you start experimenting, this way you can easily recover a future problem without as much hassle. Also, there are tokens that control thinks like touchscreen calibration, so these cannot be easily obtained if they are lost! Once booted, you can backup all your tokens by copying everything in /tmp/tokens. Here are a list of the Tokens on an Average Pre:

ACCELCAL BToADDR DMCLoAUTHPW DMSETS HWoRev PN ProdSN
BATToCH DMCARRIER DMCLoNONCE DMSVRoAUTHPW KEYoBRD PRODoID WIFIoADDR
BATToRSP DMCLoAUTHNAME DMMODEL DMSVRoNONCE ModemSN PalmSN installer

== OMAP boot Procedure ==

First, ensure that the Linux SDK and novacom packages are installed, as you will need to run webOS Doctor as the final step in this process.
Second, ensure that you have a copy of the webOS doctor jar ready for your phone.

Download: [http://markmail.org/download.xqy?id=l4qabusyxcqsslwn&number=1 omap3_usb.tar.bz2]

Compile on Linux system with "make". Optionally install with "sudo cp omap3_usbload /usr/local/bin"

Now extract the bootie binary from a WebOS Doctor image: (note: webosdoctor file name will vary)

mkdir doctor; cd doctor; unzip ../webosdoctor.jar; cd resources
mkdir webOS; cd webOS; tar xvf ../webOS.tar; mkdir nova-cust-image-castle.rootfs; cd nova-cust-image-castle.rootfs
tar xvzf ../nova-cust-image-castle.rootfs.tar.gz ./boot/boot.bin; cd boot

Booting bootie over USB:

Ensure USB is unplugged from the Pre, and remove the Pre's battery.

On your Linux system, run:

sudo omap3_usbload boot.bin

This should return:

TI OMAP3 USB boot ROM tool, version 0.1
......

and a series of dots while it looks for an OMAP3 to send boot code to.

Now, plug the pre into USB.

If all works as it should, the usbload program should return:

found device!
download ok

And your Pre will now show a USB logo. (this is bootie's "Recovery mode")

Put the battery back in without unplugging the USB.

Since you are now in USB recovery mode, you should be able to run the webOS doctor on the host Linux box. Remember that the SDK novacom package must be installed for the webOS Doctor to work in Linux.

One way to do this is to launch the doctor from the command line like:

sudo java -jar webosdoctor.jar

And follow the usual steps to recover your pre's operating system from here.

== Alternative Recovery ==

Another available option now that bootie is running is to send bootie a Linux image over USB and perform some kind of recovery work directly on the pre itself. This is not recommended unless you are very familiar with linux systems administration.

First you send bootie the boot image of the doctor's installer. This can be extracted from the WebOS Doctor jar.

novacom boot mem:// < nova-installer-image-castle.uImage

Wait 15 seconds for the system to boot then connect in to a shell on the running linux system with novaterm. (you will see no on-screen indication that the device is booting linux, only a solid Palm logo)

novaterm

You should get a shell prompt

root@palm-webos-device:/#

Now find and activate the LVM disk voumes with the following two commands:

lvm.static vgscan --ignorelockingfailure
lvm.static vgchange -ay --ignorelockingfailure

Next, mount all disks

for N in root var media log update; do mkdir /mnt/$N; mount /dev/mapper/store-$N /mnt/$N; done

When done with whatever you need to do on the system, shutting it down safely is a good idea

umount -a; tellbootie reboot

== Recovery using OS/X ==

For a Mac, the process of running USB booting the OMAP may be much simpler.

The MacOS X version of the SDK provides a pre-built executable /opt/nova/bin/cpuboot and a recovery image. You can simply run

/opt/nova/bin/cpuboot -o -v -d usb -f /opt/nova/bin/recovery-castle.bin

Talk:Last Resort Emergency BootLoader Recovery

2010-04-13T05:02:24Z

Onlinespending:

User talk:PEEf

2010-04-11T22:28:35Z

Onlinespending:

I saw your comment about the OMAP3 boot recovery not working with the Pixi. With its Qualcomm MSM7627 I didn't expect it to work unfortunately, but am wondering if a similar tool exists that will work with the Pixi. I have a Pixi which won't boot. It doesn't even allow me to go into USB recovery mode using the standard hold volume up + insert USB cable technique. Thanks.

Peef: The Pixi has a Qualcomm MSM7627 core rather than the Texas Instruments OMAP3430 that's in the Pre. My experience is that it's much easier to get information and tools from TI than it is from Qualcomm. I'm sure there is similar functionality, but until someone discovers the tool for loading boot code over USB, this is not possible. The only other way would be to crack it open and use JTAG, which is a whole other can of worms. Historically Qualcomm is very secretive and will not even give out datasheets on things unless you are a bigshot carrier who has signed many NDA's and have their secret police following you around 24/7. I recommend you sell it on ebay as a "parts only" phone. Someone will want the LCD or other parts.

onlinesending: How does one go about editing the NVRAM tokens? Apparently it's not as easy as editing them in /tmp/tokens. Also do you know the PN of the Sprint Pixi and Verizon Pixi Plus?

Talk:Last Resort Emergency BootLoader Recovery

2010-04-11T22:23:54Z

Onlinespending:

I'm curious if any progress has been made doing a similar procedure with the Pixi. I have a Pixi that will not boot and does not go into recovery mode using the standard hold volume up + insert USB cable.

is there a method which could be done on windows???

help please.

Peef: The Pixi has a Qualcomm MSM7627 core rather than the Texas Instruments OMAP3430 that's in the Pre. My experience is that it's much easier to get information and tools from TI than it is from Qualcomm. I'm sure there is similar functionality, but until someone discovers the tool for loading boot code over USB, this is not possible. The only other way would be to crack it open and use JTAG, which is a whole other can of worms. Historically Qualcomm is very secretive and will not even give out datasheets on things unless you are a bigshot carrier who has signed many NDA's and have their secret police following you around 24/7. I recommend you sell it on ebay as a "parts only" phone. Someone will want the LCD or other parts.

As far the NVRAM Tokens. How does one write these token values?

User talk:PEEf

2010-04-10T17:07:16Z

Onlinespending: New page: I saw your comment about the OMAP3 boot recovery not working with the Pixi. With its Qualcomm MSM7627 I didn't expect it to work unfortunately, but am wondering if a similar tool exists t...

Talk:Last Resort Emergency BootLoader Recovery

2010-04-10T17:01:05Z

Onlinespending: