WebOS Internals - User contributions [en]

Research Pre Audio

2009-11-11T08:20:10Z

StefanSchmidt: add location of audio scripts

This side should cover the audio architecture used on the Palm Pre.

== Hardware ==

The used TWL4030 PMIC covers the audio part.

== Soundcards ==
<pre>
root@castle:/var/home/root# aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: mcbsp2 [twl4030-i2s (mcbsp2)], device 0: omap-mcbsp-pcm [omap-mcbsp-pcm]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 1: mcbsp3 [btsco (mcbsp3)], device 0: omap-mcbsp-pcm [omap-mcbsp-pcm]
Subdevices: 1/1
Subdevice #0: subdevice #0
</pre>

== Scripts ==

Palm uses scripts to configure the lower levels of the sound system that are executed inside the kernel. Audiod triggers them over a sysfs interface.
<pre>
echo "#list" > /sys/devices/platform/twl4030_audio/scdebug
</pre>
for example lists you all available scripts over the kernel message output which you can view with dmesg. You can also try

<pre>
#all
#volume
#init
</pre>

These scripts can be triggered by writing is name as a string into

<pre>
/sys/devices/platform/twl4030_audio/scrun
</pre>

A good start to dive into this is sound/arm/omap-twl4030/script.c in the kernel patch from palm.

New scripts are inserted into the kernel list via:

<pre>
/sys/devices/platform/twl4030_audio/scinit
</pre>

This is also handled by audiod. The scripts can be found in /etc/audio

Research Pre Audio

2009-10-21T17:48:04Z

StefanSchmidt:

Research Pre Audio

2009-10-21T17:24:16Z

StefanSchmidt: update about audio scripts

Research Pre GSM Modem Protocol

2009-10-20T22:57:57Z

StefanSchmidt: /* Checksum */

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA''' (This may be an address instead as rfc1662 uses only one flag for frame separation)

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefor '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two bytes before the packet ending marker are a CRC16-FCS checksum. (See rfc1662 for polynom and table)

=== Similarity to RFC1662 ===

The usage of CRC-16-FCS but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol.

http://tools.ietf.org/html/rfc1662

Research Pre GSM Modem Protocol

2009-10-20T22:57:11Z

StefanSchmidt: /* Similarity to HDLC */

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA''' (This may be an address instead as rfc1662 uses only one flag for frame separation)

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefor '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two(?) bytes before the packet ending marker seem to be a CRC16 checksum. For now we think it is the CRC-16-CCITT variant.

=== Similarity to RFC1662 ===

The usage of CRC-16-FCS but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol.

http://tools.ietf.org/html/rfc1662

Research Pre GSM Modem Protocol

2009-10-20T22:55:39Z

StefanSchmidt: /* Packet Start */

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA''' (This may be an address instead as rfc1662 uses only one flag for frame separation)

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefor '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two(?) bytes before the packet ending marker seem to be a CRC16 checksum. For now we think it is the CRC-16-CCITT variant.

=== Similarity to HDLC ===

The usage of CRC-16-CCITT but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Using HDLC would of course make sense and we need to do further investigation on this.

http://en.wikipedia.org/wiki/Cyclic_redundancy_check

http://en.wikipedia.org/wiki/HDLC

Research Pre GSM Modem Protocol

2009-10-20T10:14:50Z

StefanSchmidt: /* Escaping */

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA'''

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead. Therefor '''0x7D''' is escaped as '''0x7D 0x5D''' as well.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two(?) bytes before the packet ending marker seem to be a CRC16 checksum. For now we think it is the CRC-16-CCITT variant.

=== Similarity to HDLC ===

The usage of CRC-16-CCITT but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Using HDLC would of course make sense and we need to do further investigation on this.

http://en.wikipedia.org/wiki/Cyclic_redundancy_check

http://en.wikipedia.org/wiki/HDLC

Research Pre GSM Modem Protocol

2009-10-20T10:07:52Z

StefanSchmidt: Its actually FA

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0xFA'''

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two(?) bytes before the packet ending marker seem to be a CRC16 checksum. For now we think it is the CRC-16-CCITT variant.

=== Similarity to HDLC ===

The usage of CRC-16-CCITT but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Using HDLC would of course make sense and we need to do further investigation on this.

http://en.wikipedia.org/wiki/Cyclic_redundancy_check

http://en.wikipedia.org/wiki/HDLC

Research Pre GSM Modem Protocol

2009-10-20T10:01:24Z

StefanSchmidt: links

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0x7A'''

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two(?) bytes before the packet ending marker seem to be a CRC16 checksum. For now we think it is the CRC-16-CCITT variant.

=== Similarity to HDLC ===

The usage of CRC-16-CCITT but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Using HDLC would of course make sense and we need to do further investigation on this.

http://en.wikipedia.org/wiki/Cyclic_redundancy_check

http://en.wikipedia.org/wiki/HDLC

Research Pre GSM Modem Protocol

2009-10-20T09:59:05Z

StefanSchmidt: more infos about the protocol

Here we are collecting informations about the modem protocol. At the moment all the research is don on the european UMTS version of the Palm Pre. The CDM version is likely to be pretty similar to the UMTS variant with regards to the protocol.

What we are doing to get used to the protocol is to strace the different applications that talk to the modem and log everything that goes over /dev/modemuart to the actual modem. From this wire protocol traces we are working backwards to the actual protocol and packet format.

=== Packet Start ===

A new packet starts with: '''0x7A'''

=== Packet End ===

A packet ends with: '''0x7E'''

=== Escaping ===

For the packet end marker there is an escaping sequence inside the packet. It is used '''0x7D 0x5E''' instead.

=== Header ===

No informations about the header format have been gathered yet.

=== Payload ===

No informations about the payload format have been gathered yet.

=== Checksum ===

The last two(?) bytes before the packet ending marker seem to be a CRC16 checksum. For now we think it is the CRC-16-CCITT variant.

=== Similarity to HDLC ===

The usage of CRC-16-CCITT but even more the frame boundary packet as well as the escaping for it looks similar to what we found about this protocol. Using HDLC would of course make sense and we need to do further investigation on this.

Portal:Research

2009-10-20T09:50:48Z

StefanSchmidt: add modem protocol link

__notoc__
{{portal-header|
The Research Portal is for bleeding edge things being done with the device.

Title all pages: '''Research [description]''' or '''Reference [description]'''
}}
{{portal-two-columns
|column1=
===Research:===

* [[Applications Bundled on the Pre]]
* [[Application_Framework|Application Framework]]
* [[Blocking Updates]]
* [[New Bluetooth|BlueZ (Replacing Palm Bluetooth)]]
* [[Boot_Chain|Boot Chain]]
* [[Bootie]]
* [[ClassicFilesystem]]
* [[Decrypt SSL (trusted man-in-the-middle technique)|Decrypt SSL (trusted man-in-the-middle technique)]]
* [[Fonts available on board the Pre]]
* [[Gstreamer]]
* [[Hidd]]
* [[Introspecting_Dbus|Introspecting Dbus]]
* [[Key Codes|Key Codes]]
* [[Pre Specific Hash Codes|Pre Specific Hash Codes]]
* [[Pictures from Self-Test|Pictures from Self-Test]]
* [[Restore Debug Log|Restore Debug Log]]
* [[Reverse_Engineering_WebOS_Doctor|Reverse Engineering WebOS Doctor]]
* [[Rooted Pre Issues|Rooted Pre Issues]]
* [[Research_Securing_Pre|Securing your Pre]]
* [[Running Processes|Running Processes]]
* [[Symlink Applications|Symlink Applications]]
* [[System Sounds|System Sounds]]
* [[TestApps|TestApps]]
* [[Update Service Trace|Update Service Trace]]
* [[Tidbits|Tidbits]]
* [[VideoRecording]]
* [[WebOS Exploration - Various Information|WebOS Exploration - Various Information]]
* [[Research_Pre_GSM_Modem | Pre GSM modem device informations]]
* [[Research_Pre_GSM_Modem_Protocol | Pre GSM modem protocol informations]]
* [[Research_Pre_Audio | Audio routing and setup on the Pre]]
* [[Research_mpt | MSM modem passthru mode ]]

|column2=
===Reference===
* [[Packaging Standards|Packaging Standards]]
* [[webkit_transform|Webkit Transform]]- a powerful set of commands for manipulating elements.
}}

Research Pre GSM Modem Protocol

2009-10-20T09:49:19Z

StefanSchmidt: start modem protocol page

Research mpt

2009-10-16T14:24:41Z

StefanSchmidt: infos about mpt passthru

The system contains a tool called mpt which allows to route some of the MSM modem traffic to the microUSB connection and such enables a passthru mode where the host PC could use the modem directly. That way the modem can be configured with some special software from Quallcom.

<pre>
root@castle:/var/home/root# mpt
Usage:
To enable passthru: mpt [port_spec]
To disable passthru: mpt disable (or mpt x)

[port_spec]
dun (or '0') : DUN (port0) only
diag (or 'd') : Diag port only
dun,diag (or '0d') : DUN (port0) and Diag port
diag,gps : Diag port and GPS port
userial : Serial passthru with USB cable
serial : Serial passthru with Serial cable
</pre>

Sadly a special USB driver is needed for this. It shows up like this on my linux box:

<pre>
[16675.933683] usb 2-4.4: new full speed USB device using ohci_hcd and address 10
[16676.032663] usb 2-4.4: not running at top speed; connect to a high speed hub
[16676.048665] usb 2-4.4: New USB device found, idVendor=0830, idProduct=8003
[16676.048675] usb 2-4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[16676.048682] usb 2-4.4: Product: Pre
[16676.048686] usb 2-4.4: Manufacturer: Palm Inc.
[16676.048876] usb 2-4.4: configuration #1 chosen from 1 choice
</pre>

Portal:Research

2009-10-16T14:21:09Z

StefanSchmidt: add link to new page about mpt

__notoc__
{{portal-header|
The Research Portal is for bleeding edge things being done with the device.

Title all pages: '''Research [description]''' or '''Reference [description]'''
}}
{{portal-two-columns
|column1=
===Research:===

* [[Applications Bundled on the Pre]]
* [[Application_Framework|Application Framework]]
* [[Blocking Updates]]
* [[New Bluetooth|BlueZ (Replacing Palm Bluetooth)]]
* [[Boot_Chain|Boot Chain]]
* [[Bootie]]
* [[ClassicFilesystem]]
* [[Decrypt SSL (trusted man-in-the-middle technique)|Decrypt SSL (trusted man-in-the-middle technique)]]
* [[Fonts available on board the Pre]]
* [[Gstreamer]]
* [[Hidd]]
* [[Introspecting_Dbus|Introspecting Dbus]]
* [[Key Codes|Key Codes]]
* [[Pre Specific Hash Codes|Pre Specific Hash Codes]]
* [[Pictures from Self-Test|Pictures from Self-Test]]
* [[Restore Debug Log|Restore Debug Log]]
* [[Reverse_Engineering_WebOS_Doctor|Reverse Engineering WebOS Doctor]]
* [[Rooted Pre Issues|Rooted Pre Issues]]
* [[Research_Securing_Pre|Securing your Pre]]
* [[Running Processes|Running Processes]]
* [[Symlink Applications|Symlink Applications]]
* [[System Sounds|System Sounds]]
* [[TestApps|TestApps]]
* [[Update Service Trace|Update Service Trace]]
* [[Tidbits|Tidbits]]
* [[VideoRecording]]
* [[WebOS Exploration - Various Information|WebOS Exploration - Various Information]]
* [[Research_Pre_GSM_Modem | Pre GSM modem devices, protocols, etc]]
* [[Research_Pre_Audio | Audio routing and setup on the Pre]]
* [[Research_mpt | MSM modem passthru mode ]]

|column2=
===Reference===
* [[Packaging Standards|Packaging Standards]]
* [[webkit_transform|Webkit Transform]]- a powerful set of commands for manipulating elements.
}}

Research Pre GSM Modem

2009-10-16T00:35:16Z

StefanSchmidt: Script to trace modemuart communication

== Modem Ports ==
There are several ports for communicating with the modem on the Palm Pre:
* /dev/modemuart: Modem UART (UART Port)
* /dev/tts/modem0 (Symlink for ttyACM0): USB Serial to Modem for AT commands (Data Port)
* /dev/tts/modemdiag (Symlink for ttyACM1): USB Serial to Modem for Diagnositics (DIAG Port)

== sysfs Entries ==
* Power Control: /sys/user_hw/pins/modem/power_on/level

== Palm Programs for communicating with the modem ==
In /usr/bin are some interessting programs:
* PmLinuxModemCmd: You can do some operations on the modem from command line
* PmModemInfo: Shows you the IMEI and the version of the modem firmware
* PmModemPower: A simple shell script to turn on/reset the modem
* PmModemUpdater: Flash the modem with a new firmware

The binary sequences are:
<pre>
00014a1c <enableloopbackdataport>:
14a1c: 31455441 .word 0x31455441
...
159c0: 0a0d .short 0x0a0d

000159c2 <loopback>:
159c2: 0f88 .short 0x0f88
159c4: 00010000 .word 0x00010000
159c8: 7eb3d400 .word 0x7eb3d400

000159cc <identify>:
159cc: 7e3b1c1d .word 0x7e3b1c1d

000159d0 <getVer>:
159d0: 1b0000fa .word 0x1b0000fa
159d4: 00000009 .word 0x00000009
159d8: 00000000 .word 0x00000000
159dc: 7e .byte 0x7e

000159dd <testAlive>:
159dd: fa .byte 0xfa
159de: 0000 .short 0x0000
159e0: 0000011b .word 0x0000011b
159e4: 00000000 .word 0x00000000
159e8: b74c .short 0xb74c
159ea: 7e .byte 0x7e

000159eb <testAliveResp>:
159eb: 1b .byte 0x1b
159ec: 00000001 .word 0x00000001
159f0: 0000 .short 0x0000
...

000159f3 <testAliveResp1>:
159f3: 1c .byte 0x1c
159f4: 00000002 .word 0x00000002
159f8: 0000 .short 0x0000
...

000159fb <testAliveCDMA>:
159fb: fa .byte 0xfa
159fc: 14080000 .word 0x14080000
15a00: f904d200 .word 0xf904d200
15a04: 7e27 .short 0x7e27

00015a06 <testAliveRespCDMA>:
15a06: 0122 .short 0x0122
15a08: 0000 .short 0x0000
...

00015a0b <enterFTMmode>:
15a0b: 29 .byte 0x29
15a0c: 73810003 .word 0x73810003
15a10: 7e .byte 0x7e

00015a11 <CDMAdiagPortOnUART>:
15a11: fa .byte 0xfa
15a12: 0000 .short 0x0000
15a14: 00002308 .word 0x00002308
15a18: fbf1 .short 0xfbf1
15a1a: 7e .byte 0x7e

00015a1b <CDMAdiagPortOnUSB>:
15a1b: fa .byte 0xfa
15a1c: 23080000 .word 0x23080000
15a20: 29e20001 .word 0x29e20001
15a24: 7e .byte 0x7e

00015a25 <resetCDMA>:
15a25: 29 .byte 0x29
15a26: 0002 .short 0x0002
15a28: 6a59 .short 0x6a59
15a2a: 7e .byte 0x7e

00015a2b <onlineMode>:
15a2b: fa .byte 0xfa
15a2c: 00030000 .word 0x00030000
15a30: 00000000 .word 0x00000000
15a34: 09f00500 .word 0x09f00500
15a38: 7e .byte 0x7e

00015a39 <offlineMode>:
15a39: fa .byte 0xfa
15a3a: 0000 .short 0x0000
15a3c: 00000003 .word 0x00000003
15a40: 06000000 .word 0x06000000
15a44: 3b6b .short 0x3b6b
15a46: 7e .byte 0x7e

00015a47 <ATCGDCONT>:
15a47: 41 .byte 0x41
15a48: 47432b54 .word 0x47432b54
15a4c: 4e4f4344 .word 0x4e4f4344
15a50: 0a0d3f54 .word 0x0a0d3f54

00015a54 <ATE0E1Cmd>:
15a54: 30455441 .word 0x30455441
15a58: 30453145 .word 0x30453145
15a5c: 30453145 .word 0x30453145
15a60: 30453145 .word 0x30453145
15a64: 0a0d3145 .word 0x0a0d3145

00015a68 <ATCmd>:
15a68: 0a0d5441 .word 0x0a0d5441

00015a6c <Charging90mA>:
15a6c: 1b0000fa .word 0x1b0000fa
15a70: 00000006 .word 0x00000006
15a74: 00180000 .word 0x00180000
15a78: f0f30000 .word 0xf0f30000
15a7c: 7e .byte 0x7e

00015a7d <Charging500mA>:
15a7d: fa .byte 0xfa
15a7e: 0000 .short 0x0000
15a80: 0000061b .word 0x0000061b
15a84: 18000000 .word 0x18000000
15a88: 2b000100 .word 0x2b000100
15a8c: 7ee9 .short 0x7ee9

00015a8e <Charging1A>:
15a8e: 00fa .short 0x00fa
15a90: 00061b00 .word 0x00061b00
15a94: 00000000 .word 0x00000000
15a98: 00070018 .word 0x00070018
15a9c: bdfb .short 0xbdfb
15a9e: 7e .byte 0x7e

00015a9f <getQPSTConfig>:
15a9f: 0c .byte 0x0c
15aa0: 417e3a14 .word 0x417e3a14
15aa4: 43512454 .word 0x43512454
15aa8: 0d474d44 .word 0x0d474d44
15aac: 51245441 .word 0x51245441
15ab0: 474d4443 .word 0x474d4443
15ab4: 2454410d .word 0x2454410d
15ab8: 4d444351 .word 0x4d444351
15abc: 067e0d47 .word 0x067e0d47
15ac0: 7e7e954e .word 0x7e7e954e

00015ac4 <getESN>:
15ac4: 00000026 .word 0x00000026
...
15b48: 7ed2ad00 .word 0x7ed2ad00

00015b4c <CDMAPcmLoopbackOn>:
15b4c: 000e0b4b .word 0x000e0b4b
15b50: 00010003 .word 0x00010003
15b54: 0001000c .word 0x0001000c
15b58: 7e00 .short 0x7e00

00015b5a <CDMAPcmLoopbackOff>:
15b5a: 0b4b .short 0x0b4b
15b5c: 0003000e .word 0x0003000e
15b60: 000c0001 .word 0x000c0001
15b64: 7e000000 .word 0x7e000000

00015b68 <GSMPcmLoopbackOn>:
15b68: 000e0b4b .word 0x000e0b4b
15b6c: 000b0003 .word 0x000b0003
15b70: 0001000c .word 0x0001000c
15b74: 7e00 .short 0x7e00

00015b76 <GSMPcmLoopbackOff>:
15b76: 0b4b .short 0x0b4b
15b78: 0003000e .word 0x0003000e
15b7c: 000c000b .word 0x000c000b
15b80: 7e000000 .word 0x7e000000

00015b84 <Dial>:
15b84: 000000fa .word 0x000000fa
15b88: 00000000 .word 0x00000000
15b8c: 04000000 .word 0x04000000
...
15bf0: 34000000 .word 0x34000000
15bf4: 31363830 .word 0x31363830
15bf8: 32333837 .word 0x32333837
15bfc: 00000037 .word 0x00000037
...
15c30: 0a000000 .word 0x0a000000
...
15c58: 0000 .short 0x0000
15c5a: 7e .byte 0x7e

00015c5b <disableloopbackdataport>:
15c5b: 41 .byte 0x41
15c5c: 0d304554 .word 0x0d304554
15c60: 0a .byte 0x0a

00015c61 <ATDT>:
15c61: 41 .byte 0x41
15c62: 4454 .short 0x4454
15c64: 37313654 .word 0x37313654
15c68: 37323338 .word 0x37323338
15c6c: 0a0d .short 0x0a0d

00015c6e <testAlive_1>:
15c6e: 00fa .short 0x00fa
15c70: 00011b00 .word 0x00011b00
15c74: 00000001 .word 0x00000001
15c78: 7ead8101 .word 0x7ead8101

00015c7c <onlineMode_1>:
15c7c: 030000fa .word 0x030000fa
15c80: 00000000 .word 0x00000000
15c84: 4f020000 .word 0x4f020000
15c88: 5d7d .short 0x5d7d
15c8a: 7e .byte 0x7e
</pre>

=== PmModemUpdater ===
Usage:
PmModemUpdater -h Print usage
PmModemUpdater -v Detect current modem firmware version
PmModemUpdater -p /path/to/firmware.tar Check the firmware package info
PmModemUpdater -b Backup NV items from device to /var/firmware/palm_nv_backup.txt
PmModemUpdater -r /path/to/nvfile Load NV items from nvfile
PmModemUpdater<firmware.tar Update the firmware using a tar file as input
PmModemUpdater<firmware.tar -f Force an update even the modem has the same version than tar file
PmModemUpdater<firmware.tar -s xx xx Force the modem to be flashed (RESCUE MODE)
PmModemUpdater -i Start a data/voice test on your umts modem directly
PmModemUpdater -e Ignore stop/start TIL/WAND
PmModemUpdater -o silent mode which means no verbose output at all
PmModemUpdater<firmware.tar -m Force the modem to be flashed (INFINITE USB RESCUE MODE) on USB

=== pmmodempower ===
<pre>
#!/bin/sh
for i in "$*"
if [ "$i" = "on" ]
then
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "off" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "cycle" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/wakeup_modem/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
sleep 2
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
#echo Waiting for MODEM_WAKE_APP Low
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#echo Waiting for MODEM_WAKE_APP Pulse High
#appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#while [ "$appwake" != "1" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
echo Asserting APP_WAKE_MODEM
echo 1 > /sys/user_hw/pins/modem/wakeup_modem/level
fi
done
</pre>

=== PmLinuxModemCmd ===
<pre>
usage: PmLinuxModemCmd <Port> <[a][b][c][d <number>][e][f][ftm][h][g][i][k <#pkts>][l][m][n][o][pcmloopback <radio> <state>][q][r][s][t][u <#pkts>][zr][zt][zl][1] [5][9]]> [v]
where: <Port>:
/dev/ttyS0 - Modem UART. - UART PORT
/dev/tts/modem0 - USB Serial to Modem for AT commands - DATA PORT.
/dev/tts/modemdiag - USB Serial to Modem for Diagnostics - DIAG PORT.
where:
e - empty read buffer from specified port.
u - Loopback mode performance test. Next argument <#pkts>
UART PORT COMMANDS: (/dev/ttyS0)
b - Send loopback mode command for 256 bytes. UART goes into loopback mode until power cycle.
d - Send commands to dial a phone number. Phone number in the format 4086178327.
f - Send offline mode and read pkt.
ftm - Enter modem FTM mode (both CDMA and GSM modems).
i - Send identify command.
l - Send testalive then loop forever doing ( onlinemode, offlinemode, sleep to UART.
m - Disable loopback mode.
o - Send online mode and read pkt.
pcmloopback - control PCM loopback. <radio> = GSM/CDMA <state> = on/off.
q - Send test alive, online mode and then read pkts.
r - Get firmware version.
t - Send test alive and read pkt.
1 - Send command to enable 1A charging.
5 - Send command to enable 500mA charging.
9 - Send command to enable 90mA charge.
zs - CDMA reset modem.
zt - CDMA send test alive and read pkts.
zdiagonusb - CDMA put diag port on USB diag.
zdiagonuart- CDMA put diag port on UART.
DATA PORT COMMANDS: (/dev/tts/modem0)
a - Send AT\n.
c - Send ATCGDCONT\n.
h - Send Echo command.
k - Test loopback perf using command (ATE1\n).
DIAG PORT COMMANDS: (/dev/tts/modemdiag)
g - Get QPST serial port config from DIAG port.
s - Get ESN from DIAG port.
zl - CDMA put modemdiag into loopback.
zr - CDMA Read performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zr <NumPkts> <PktSize> [v]
zw - CDMA Write performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zw <NumPkts> <PktSize> [v]
zu - CDMA Performance tests of the diag port after putting it into loopback. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zu <NumPkts> <PktSize> [v]
where v - verbose output.
</pre>

== TelephonyInterfaceLayerGsm ==

/usr/bin/TelephonyInterfaceLayerGsm connects to /dev/modemuart with a baudrate of 115200. Trying the same with screen shows me just rubbish. Seem to be the binary protocol. Make sure you rename the file before killing the process as it gets restarted automatically.

To strace TelephonyInterfaceLayerGsm and write out the relevant communication to /dev/modemuart we offer a small shell script below. Make sure your / is remounted rw for it.

<pre>
#!/bin/sh
#Make sure TelephonyInterfaceLayerGsm gets not restarted when we kill it
mv /usr/bin/TelephonyInterfaceLayerGsm /usr/bin/TelephonyInterfaceLayerGsm-backup
kill $(pidof TelephonyInterfaceLayerGsm)

sleep 2

#I always had fd=10 for /dev/modemuart, be verbose on reads on writes on this fd
strace -x -s 10000 -f -F -o gsm.log -e read=10 -e write=10 TelephonyInterfaceLayerGsm-backup &
sleep 25
kill $(pidof TelephonyInterfaceLayerGsm-backup)

sleep 2

#Bring the system into a useable state again
mv /usr/bin/TelephonyInterfaceLayerGsm-backup /usr/bin/TelephonyInterfaceLayerGsm
sh /etc/event.d/TelephonyInterfaceLayer
</pre>

Custom Kernels

2009-10-15T18:32:03Z

StefanSchmidt: Clarify the g_compisite part of the custom kernel

'''Some caveats and warnings:'''

At this point, the kernels I've compiled seem to work fine.
These steps assume that root access is enabled on your Pre, and a secure ssh access mechanism is available.

This procedure has only been verified to work on WebOS 1.0.3 through 1.0.4 and 1.1.3. Any prior or future releases may not work.

If anything goes wrong during the installation, your device may end up in a state where the kernel can't boot, in which case you can use [[bootie]] to change the boot kernel to the previous one.

'''NOTE:''' currently, unless you plan to do that just out of scientific interest, there's no real reason to build a custom kernel as everything is available in the "standard" one. In fact these instructions should build exactly (well, not //exactly// because Palm may be using a different version of the compiler) the same kernel you already have on the device.

=Custom Kernel=
== Download and install the cross-compiler==

1. Download the appropriate [http://www.codesourcery.com/sgpp/lite/arm/portal/release858 ARM toolchain] for your the platform you'll be building on. So far, all testing has been done using the [http://www.codesourcery.com/sgpp/lite/arm/portal/package4571/public/arm-none-linux-gnueabi/arm-2009q1-203-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2 IA32 Linux toolchain, 2009q1 release]. '''NOTE:''' The compiler used by palm is actually [http://www.codesourcery.com/sgpp/lite/arm/portal/release313 this one]. The [http://www.codesourcery.com/sgpp/lite/arm/portal/package1788/public/arm-none-linux-gnueabi/arm-2007q3-51-arm-none-linux-gnueabi-i686-mingw32.tar.bz2 IA32 Linux toolchain, 2007q3-51 release]

2. Un-tar the toolchain distribution to a convenient location on your system. I extracted it to a temporary directory and moved the arm-2009q1 subdirectory to /usr/local/arm, with subdirectories arm-none-linux-gnueabi, bin lib, libexec, share, and usr below.
<pre><nowiki>
tar xjvf arm-2009q1-203-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2
sudo mv arm-2009q1 /usr/local/arm
</nowiki></pre>

3. To use the toolchain properly for kernel builds (and anything else you want to cross-compile for the Pre) you'll want to have some environment variables set. The following, based on the setup-env script from the opennoko toolchain, is what I use to setup my Pre cross-compile environment.

<pre><nowiki>
export PRETOOL_DIR="/usr/local/arm"
(echo "$PATH" | grep -q "${PRETOOL_DIR}") || export PATH="${PRETOOL_DIR}/bin:${PATH}"
export STRIP="arm-none-linux-gnueabi-strip"
export LD="arm-none-linux-gnueabi-ld"
export CC="arm-none-linux-gnueabi-gcc -march=armv4t -mtune=arm920t"
export CPPFLAGS="-isystem${PRETOOL_DIR}/arm/arm-none-linux-gnueabi/include"
export RANLIB="arm-none-linux-gnueabi-ranlib"
export CXX="arm-none-linux-gnueabi-g++ -march=armv4t -mtune=arm920t"
export OBJCOPY="arm-none-linux-gnueabi-objcopy"
export PKG_CONFIG_PATH="${PRETOOL_DIR}/usr/local/lib/pkgconfig"
export PKG_CONFIG_SYSROOT_DIR="${PRETOOL_DIR}/arm/arm-none-linux-gnueabi"
#export LDFLAGS="-L${PRETOOL_DIR}/usr/local/lib -Wl,-rpath-link,${PRETOOL_DIR}/arm/arm-none-linux-gnueabi/lib -Wl,-O1"
export CCLD="arm-none-linux-gnueabi-gcc -march=armv4t -mtune=arm920t"
export MAKE="make"
export CFLAGS="-isystem${PRETOOL_DIR}/usr/local/include -fexpensive-optimizations -fomit-frame-pointer -frename-registers -Os"
export CXXFLAGS="-isystem${PRETOOL_DIR}/arm/arm-none-linux-gnueabi/include -fexpensive-optimizations -fomit-frame-pointer -frename-registers -Os -fpermissive -fvisibility-inlines-hidden"
export F77="arm-none-linux-gnueabi-g77 -march=armv4t -mtune=arm920t"
export AS="arm-none-linux-gnueabi-as"
export AR="arm-none-linux-gnueabi-ar"
export CPP="arm-none-linux-gnueabi-gcc -E"
export OBJDUMP="arm-none-linux-gnueabi-objdump"
export CONFIG_SITE="${PRETOOL_DIR}/arm/site-config"
</nowiki></pre>

To use it, just change PRETOOL_DIR to the root directory of your toolchain, then source it into your shell:

<pre><nowiki>
. /usr/local/pre/setup-env
</nowiki></pre>

== Build U-Boot and install the mkimage utility==

To build the kernel as a uImage file, you will need the mkimage utility, which is part of [http://www.denx.de/wiki/U-Boot U-Boot]. If mkimage is already on your system, great. It wasn't on mine, so here's what I did to install it.

1. Download the [ftp://ftp.denx.de/pub/u-boot/u-boot-2009.06.tar.bz2 latest U-boot release].

2. Extract the tarball

<pre><nowiki>
tar xjvf ../u-boot-2009.06.tar.bz2
</nowiki></pre>

3. Configure U-Boot for the Pre. I don't know that the mkimage utility is architecture-specific, but I used the config that looked like it most closely matched the Pre's architecture just to be safe:

<pre><nowiki>
cd u-boot-2009.06
make omap3_beagle_config
</nowiki></pre>

4. u-boot seems to want the commands in a slightly different format so make some links in /usr/local/arm/bin

<pre><nowiki>
cd /usr/local/arm/bin
ln -s arm-none-linux-gnueabi-gcc arm-linux-gcc
ln -s arm-none-linux-gnueabi-ar arm-linux-ar
ln -s arm-none-linux-gnueabi-ld arm-linux-ld
ln -s arm-none-linux-gnueabi-objcopy arm-linux-objcopy
ln -s arm-none-linux-gnueabi-objdump arm-linux-objdump
ln -s arm-none-linux-gnueabi-nm arm-linux-nm
</nowiki></pre>

5. The mkimage utility should now be built in the tools subdirectory. To make it available for the kernel build, I just manually copied it into /usr/local/bin. Just make sure it's available somewhere in your PATH, or the kernel build will fail.

== Download, patch, configure, and build the kernel.==

6. From Palm's [http://opensource.palm.com/packages.html Open Source Packages] page, download the [http://palm.cdnetworks.net/opensource/1.0.1/linuxkernel-2.6.24.tgz Linux 2.6.24 kernel tarball] and [http://palm.cdnetworks.net/opensource/1.0.1/linux-2.6.24-patch.gz Palm's kernel modifications].

7. Extract the kernel tarball somewhere on your system, and gunzip the compressed patch file in the linux-2.6.24 directory.

<pre><nowiki>
cd linux-2.6.24
gunzip linux-2.6.24-patch.gz
</nowiki></pre>

8. Apply Palm's kernel patches to the kernel source tree.

<pre><nowiki>
patch -p1 < linux-2.6.24-patch
</nowiki></pre>

9. Configure the kernel

Your Pre should have a config file in the /boot directory that is ostensibly what was used to build the original kernel. This file is virtually identical to the file arch/arm/configs/omap_sirloin_3430_defconfig in the patched kernel tree. Copy either file (I used the defconfig) to a file named ".config" in the top level of your source tree.

'''NOTE:''' if you change the vermagic, you won't be able to load binary-only modules. Until you can rebuild all the modules, it's probably a good idea to leave CONFIG_LOCALVERSION="-joplin-3430"

'''Modules'''
These are the modules that look to be binary only.
<pre><nowiki>
./dspbridge/bridgedriver.ko
./drivers/misc/exmap.ko
./kernel/net/wifi/sd8xxx.ko
</nowiki></pre>

Now, you're ready to build.

10. Build the kernel

<pre><nowiki>
make && make uImage
</nowiki></pre>

This will take some time. Assuming you followed the above steps, and assuming I didn't miss anything in documenting them, you should have a uImage file in arch/arm/boot once the "make uImage" command completes. The uImage target requires the mkimage mentioned earlier. Again, make sure it's in your path.

Now that the kernel's built, it's time to install it on the Pre.

== Install the kernel on your Pre (here be dragons)==

The following steps are crucial. I've done my best to capture the steps I went through, but I make no promises. If you botch the kernel install, you're probably looking at wiping your phone clean with WebOS doctor and restoring all your files/settings. You've been warned.

These instructions assume you've installed and configured the sudo package. If you prefer, you can just do everything as root.

1. Copy it over

There are a bunch of ways to copy files onto the Pre. I use scp to copy the arch/arm/boot/uImage and System.map files into the /tmp directory first.

<pre><nowiki>
scp -P 222 arch/arm/boot/uImage userid@1.2.3.4:/tmp/uImage-2.6.24-palm-joplin-3430-custom
scp -P 222 drivers/usb/gadget/composite/g_composite.ko userid@1.2.3.4:/tmp/
</nowiki></pre>

2. Fix file ownership and permissions

Next, I ssh in to my Pre and change the owner/group of the files to root, and make sure the permissions are set properly.

<pre><nowiki>
sudo chown root:root /tmp/uImage-2.6.24-palm-joplin-3430-custom /tmp/System.map-2.6.24-palm-joplin-3430-custom
</nowiki></pre>

3. Prepare modules for new kernel

The above mentioned modules will only load when we have the same LOCALVERSION set. Thje defconfig does that for you. Still the g_composite module did not load for me with a custom kernel due to symbol problems. Luckily the source is included in the kernel patch and already built as module. We need to make a backup of our modules directory and then replace the old g_composite.ko with our selfbuild one.

<pre><nowiki>
cd /lib/modules
sudo cp -rp 2.6.24-palm-joplin-3430 2.6.24-palm-joplin-3430-backup
sudo mv /tmp/g_composite.ko 2.6.24-palm-joplin-3430/kernel/drivers/usb/gadget/composite/
</nowiki></pre>

4. Switcheroo time!

Now, you're going to to mount the /boot partition read-write, remove the uImage symbolic link, replace it with a link to your new kernel, and remount the /boot partition read-only.

<pre><nowiki>
cd /boot
sudo mount -o remount,rw /boot
sudo rm uImage
sudo ln -s uImage-2.6.24-palm-joplin-3430 uImage
sudo mount -o remount,ro /boot
</nowiki></pre>

5. Double check the files and permissions

Just because I'm paranoid, I always take a look at the /boot directory to make sure everything is in order. The uImage symbolic link should properly point to your new kernel file, and the permissions should match those of the original kernel. Here's what mine looks like after replacing the kernel:

<pre><nowiki>
-rw-r--r-- 1 root root 1098470 May 22 16:24 System.map-2.6.24-palm-joplin-3430
drwxr-xr-x 2 root root 4096 Dec 31 1999 bin
-rw-r--r-- 1 root root 53756 Jun 16 21:47 boot.bin
-rw-r--r-- 1 root root 8 Jun 16 21:47 bootheader
-rw-r--r-- 1 root root 43372 May 22 16:24 config-2.6.24-palm-joplin-3430
drwxr-xr-x 2 root root 4096 Dec 31 1999 dev
drwxr-xr-x 3 root root 4096 Dec 31 1999 etc
drwxr-xr-x 2 root root 4096 Dec 31 1999 lib
drwx------ 2 root root 16384 Dec 31 1999 lost+found
drwxr-xr-x 2 root root 4096 Dec 31 1999 proc
drwxr-xr-x 2 root root 4096 Dec 31 1999 realroot
drwxr-xr-x 2 root root 4096 Dec 31 1999 sbin
drwxr-xr-x 2 root root 4096 Dec 31 1999 sys
lrwxrwxrwx 1 root root 30 Jun 24 12:16 uImage -> uImage-2.6.24-palm-joplin-3430
-rw-r--r-- 1 root root 2217848 May 22 16:24 uImage-2.6.24-palm-joplin-3430
-rw-r--r-- 1 root root 2226296 Jun 24 00:17 uImage-2.6.24-palm-joplin-3430-backup
drwxr-xr-x 5 root root 4096 Dec 31 1999 usr
</nowiki></pre>

== The moment of truth==

1. Reset your Pre

Hold '''Orange-Sym-R''' to reboot. If all goes well, you'll see the flashing Palm logo and eventually WebOS will come up. ssh into your Pre and run uname -a to confirm that the new kernel is indeed running. If it is, congrats, you're running your own kernel. Happy hunting!

Custom Kernels

2009-10-15T18:22:45Z

StefanSchmidt: remove notes to change the LOCALVERSION as they bring more problems then advantage

'''Some caveats and warnings:'''

At this point, the kernels I've compiled seem to work fine.
These steps assume that root access is enabled on your Pre, and a secure ssh access mechanism is available.

This procedure has only been verified to work on WebOS 1.0.3 through 1.0.4 and 1.1.3. Any prior or future releases may not work.

If anything goes wrong during the installation, your device may end up in a state where the kernel can't boot, in which case you can use [[bootie]] to change the boot kernel to the previous one.

'''NOTE:''' currently, unless you plan to do that just out of scientific interest, there's no real reason to build a custom kernel as everything is available in the "standard" one. In fact these instructions should build exactly (well, not //exactly// because Palm may be using a different version of the compiler) the same kernel you already have on the device.

=Custom Kernel=
== Download and install the cross-compiler==

1. Download the appropriate [http://www.codesourcery.com/sgpp/lite/arm/portal/release858 ARM toolchain] for your the platform you'll be building on. So far, all testing has been done using the [http://www.codesourcery.com/sgpp/lite/arm/portal/package4571/public/arm-none-linux-gnueabi/arm-2009q1-203-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2 IA32 Linux toolchain, 2009q1 release]. '''NOTE:''' The compiler used by palm is actually [http://www.codesourcery.com/sgpp/lite/arm/portal/release313 this one]. The [http://www.codesourcery.com/sgpp/lite/arm/portal/package1788/public/arm-none-linux-gnueabi/arm-2007q3-51-arm-none-linux-gnueabi-i686-mingw32.tar.bz2 IA32 Linux toolchain, 2007q3-51 release]

2. Un-tar the toolchain distribution to a convenient location on your system. I extracted it to a temporary directory and moved the arm-2009q1 subdirectory to /usr/local/arm, with subdirectories arm-none-linux-gnueabi, bin lib, libexec, share, and usr below.
<pre><nowiki>
tar xjvf arm-2009q1-203-arm-none-linux-gnueabi-i686-pc-linux-gnu.tar.bz2
sudo mv arm-2009q1 /usr/local/arm
</nowiki></pre>

3. To use the toolchain properly for kernel builds (and anything else you want to cross-compile for the Pre) you'll want to have some environment variables set. The following, based on the setup-env script from the opennoko toolchain, is what I use to setup my Pre cross-compile environment.

<pre><nowiki>
export PRETOOL_DIR="/usr/local/arm"
(echo "$PATH" | grep -q "${PRETOOL_DIR}") || export PATH="${PRETOOL_DIR}/bin:${PATH}"
export STRIP="arm-none-linux-gnueabi-strip"
export LD="arm-none-linux-gnueabi-ld"
export CC="arm-none-linux-gnueabi-gcc -march=armv4t -mtune=arm920t"
export CPPFLAGS="-isystem${PRETOOL_DIR}/arm/arm-none-linux-gnueabi/include"
export RANLIB="arm-none-linux-gnueabi-ranlib"
export CXX="arm-none-linux-gnueabi-g++ -march=armv4t -mtune=arm920t"
export OBJCOPY="arm-none-linux-gnueabi-objcopy"
export PKG_CONFIG_PATH="${PRETOOL_DIR}/usr/local/lib/pkgconfig"
export PKG_CONFIG_SYSROOT_DIR="${PRETOOL_DIR}/arm/arm-none-linux-gnueabi"
#export LDFLAGS="-L${PRETOOL_DIR}/usr/local/lib -Wl,-rpath-link,${PRETOOL_DIR}/arm/arm-none-linux-gnueabi/lib -Wl,-O1"
export CCLD="arm-none-linux-gnueabi-gcc -march=armv4t -mtune=arm920t"
export MAKE="make"
export CFLAGS="-isystem${PRETOOL_DIR}/usr/local/include -fexpensive-optimizations -fomit-frame-pointer -frename-registers -Os"
export CXXFLAGS="-isystem${PRETOOL_DIR}/arm/arm-none-linux-gnueabi/include -fexpensive-optimizations -fomit-frame-pointer -frename-registers -Os -fpermissive -fvisibility-inlines-hidden"
export F77="arm-none-linux-gnueabi-g77 -march=armv4t -mtune=arm920t"
export AS="arm-none-linux-gnueabi-as"
export AR="arm-none-linux-gnueabi-ar"
export CPP="arm-none-linux-gnueabi-gcc -E"
export OBJDUMP="arm-none-linux-gnueabi-objdump"
export CONFIG_SITE="${PRETOOL_DIR}/arm/site-config"
</nowiki></pre>

To use it, just change PRETOOL_DIR to the root directory of your toolchain, then source it into your shell:

<pre><nowiki>
. /usr/local/pre/setup-env
</nowiki></pre>

== Build U-Boot and install the mkimage utility==

To build the kernel as a uImage file, you will need the mkimage utility, which is part of [http://www.denx.de/wiki/U-Boot U-Boot]. If mkimage is already on your system, great. It wasn't on mine, so here's what I did to install it.

1. Download the [ftp://ftp.denx.de/pub/u-boot/u-boot-2009.06.tar.bz2 latest U-boot release].

2. Extract the tarball

<pre><nowiki>
tar xjvf ../u-boot-2009.06.tar.bz2
</nowiki></pre>

3. Configure U-Boot for the Pre. I don't know that the mkimage utility is architecture-specific, but I used the config that looked like it most closely matched the Pre's architecture just to be safe:

<pre><nowiki>
cd u-boot-2009.06
make omap3_beagle_config
</nowiki></pre>

4. u-boot seems to want the commands in a slightly different format so make some links in /usr/local/arm/bin

<pre><nowiki>
cd /usr/local/arm/bin
ln -s arm-none-linux-gnueabi-gcc arm-linux-gcc
ln -s arm-none-linux-gnueabi-ar arm-linux-ar
ln -s arm-none-linux-gnueabi-ld arm-linux-ld
ln -s arm-none-linux-gnueabi-objcopy arm-linux-objcopy
ln -s arm-none-linux-gnueabi-objdump arm-linux-objdump
ln -s arm-none-linux-gnueabi-nm arm-linux-nm
</nowiki></pre>

5. The mkimage utility should now be built in the tools subdirectory. To make it available for the kernel build, I just manually copied it into /usr/local/bin. Just make sure it's available somewhere in your PATH, or the kernel build will fail.

== Download, patch, configure, and build the kernel.==

6. From Palm's [http://opensource.palm.com/packages.html Open Source Packages] page, download the [http://palm.cdnetworks.net/opensource/1.0.1/linuxkernel-2.6.24.tgz Linux 2.6.24 kernel tarball] and [http://palm.cdnetworks.net/opensource/1.0.1/linux-2.6.24-patch.gz Palm's kernel modifications].

7. Extract the kernel tarball somewhere on your system, and gunzip the compressed patch file in the linux-2.6.24 directory.

<pre><nowiki>
cd linux-2.6.24
gunzip linux-2.6.24-patch.gz
</nowiki></pre>

8. Apply Palm's kernel patches to the kernel source tree.

<pre><nowiki>
patch -p1 < linux-2.6.24-patch
</nowiki></pre>

9. Configure the kernel

Your Pre should have a config file in the /boot directory that is ostensibly what was used to build the original kernel. This file is virtually identical to the file arch/arm/configs/omap_sirloin_3430_defconfig in the patched kernel tree. Copy either file (I used the defconfig) to a file named ".config" in the top level of your source tree.

'''NOTE:''' if you change the vermagic, you won't be able to load binary-only modules. Until you can rebuild all the modules, it's probably a good idea to leave CONFIG_LOCALVERSION="-joplin-3430"

'''Modules'''
These are the modules that look to be binary only.
<pre><nowiki>
./dspbridge/bridgedriver.ko
./drivers/misc/exmap.ko
./kernel/net/wifi/sd8xxx.ko
</nowiki></pre>

Now, you're ready to build.

10. Build the kernel

<pre><nowiki>
make && make uImage
</nowiki></pre>

This will take some time. Assuming you followed the above steps, and assuming I didn't miss anything in documenting them, you should have a uImage file in arch/arm/boot once the "make uImage" command completes. The uImage target requires the mkimage mentioned earlier. Again, make sure it's in your path.

Now that the kernel's built, it's time to install it on the Pre.

== Install the kernel on your Pre (here be dragons)==

The following steps are crucial. I've done my best to capture the steps I went through, but I make no promises. If you botch the kernel install, you're probably looking at wiping your phone clean with WebOS doctor and restoring all your files/settings. You've been warned.

These instructions assume you've installed and configured the sudo package. If you prefer, you can just do everything as root.

1. Copy it over

There are a bunch of ways to copy files onto the Pre. I use scp to copy the arch/arm/boot/uImage and System.map files into the /tmp directory first.

<pre><nowiki>
scp -P 222 arch/arm/boot/uImage userid@1.2.3.4:/tmp/uImage-2.6.24-palm-joplin-3430-custom
scp -P 222 System.map userid@1.2.3.4:/tmp/System.map-2.6.24-palm-joplin-3430-custom
</nowiki></pre>

2. Fix file ownership and permissions

Next, I ssh in to my Pre and change the owner/group of the files to root, and make sure the permissions are set properly.

<pre><nowiki>
sudo chown root:root /tmp/uImage-2.6.24-palm-joplin-3430-custom /tmp/System.map-2.6.24-palm-joplin-3430-custom
sudo chmod 644 /tmp/uImage-2.6.24-palm-joplin-3430-custom /tmp/System.map-2.6.24-palm-joplin-3430-custom
</nowiki></pre>

3. Duplicate the modules directory from the original kernel

Technically, we should be copying over our custom-compiled kernel modules here, but the Pre seems to have some closed source modules that we can't build ourselves, particularly the Marvell sd8xxx wi-fi driver. So, I just copied the modules directory for the replacement kernel:

<pre><nowiki>
cd /lib/modules
sudo cp -rp 2.6.24-palm-joplin-3430 2.6.24-palm-joplin-3430-custom
</nowiki></pre>

4. Switcheroo time!

Now, you're going to to mount the /boot partition read-write, remove the uImage symbolic link, replace it with a link to your new kernel, and remount the /boot partition read-only.

<pre><nowiki>
cd /boot
sudo mount -o remount,rw /boot
sudo rm uImage
sudo ln -s uImage-2.6.24-palm-joplin-3430 uImage
sudo mount -o remount,ro /boot
</nowiki></pre>

5. Double check the files and permissions

Just because I'm paranoid, I always take a look at the /boot directory to make sure everything is in order. The uImage symbolic link should properly point to your new kernel file, and the permissions should match those of the original kernel. Here's what mine looks like after replacing the kernel:

<pre><nowiki>
-rw-r--r-- 1 root root 1098470 May 22 16:24 System.map-2.6.24-palm-joplin-3430
-rw-r--r-- 1 root root 1098329 Jun 24 00:17 System.map-2.6.24-palm-joplin-3430-custom
drwxr-xr-x 2 root root 4096 Dec 31 1999 bin
-rw-r--r-- 1 root root 53756 Jun 16 21:47 boot.bin
-rw-r--r-- 1 root root 8 Jun 16 21:47 bootheader
-rw-r--r-- 1 root root 43372 May 22 16:24 config-2.6.24-palm-joplin-3430
drwxr-xr-x 2 root root 4096 Dec 31 1999 dev
drwxr-xr-x 3 root root 4096 Dec 31 1999 etc
drwxr-xr-x 2 root root 4096 Dec 31 1999 lib
drwx------ 2 root root 16384 Dec 31 1999 lost+found
drwxr-xr-x 2 root root 4096 Dec 31 1999 proc
drwxr-xr-x 2 root root 4096 Dec 31 1999 realroot
drwxr-xr-x 2 root root 4096 Dec 31 1999 sbin
drwxr-xr-x 2 root root 4096 Dec 31 1999 sys
lrwxrwxrwx 1 root root 30 Jun 24 12:16 uImage -> uImage-2.6.24-palm-joplin-3430-custom
-rw-r--r-- 1 root root 2217848 May 22 16:24 uImage-2.6.24-palm-joplin-3430
-rw-r--r-- 1 root root 2226296 Jun 24 00:17 uImage-2.6.24-palm-joplin-3430-custom
drwxr-xr-x 5 root root 4096 Dec 31 1999 usr
</nowiki></pre>

== The moment of truth==

1. Reset your Pre

Hold '''Orange-Sym-R''' to reboot. If all goes well, you'll see the flashing Palm logo and eventually WebOS will come up. ssh into your Pre and run uname -a to confirm that the new kernel is indeed running. If it is, congrats, you're running your own kernel. Happy hunting!

Research Pre GSM Modem

2009-10-14T12:14:27Z

StefanSchmidt:

Research Pre GSM Modem

2009-10-13T18:19:06Z

StefanSchmidt: some infos about TelephonyInterfaceLayerGsm

== Modem Ports ==
There are several ports for communicating with the modem on the Palm Pre:
* /dev/modemuart: Modem UART (UART Port)
* /dev/tts/modem0 (Symlink for ttyACM0): USB Serial to Modem for AT commands (Data Port)
* /dev/tts/modemdiag (Symlink for ttyACM1): USB Serial to Modem for Diagnositics (DIAG Port)

== sysfs Entries ==
* Power Control: /sys/user_hw/pins/modem/power_on/level

== Palm Programs for communicating with the modem ==
In /usr/bin are some interessting programs:
* PmLinuxModemCmd: You can do some operations on the modem from command line
* PmModemInfo: Shows you the IMEI and the version of the modem firmware
* PmModemPower: A simple shell script to turn on/reset the modem
* PmModemUpdater: Flash the modem with a new firmware

Through disassembling the PmLinuxModemCmd binary I found some binary sequences which indicates that the Pre communicates with the modem over a binary protocol.

The binary sequences are:
<pre>
00014a1c <enableloopbackdataport>:
14a1c: 31455441 .word 0x31455441
...
159c0: 0a0d .short 0x0a0d

000159c2 <loopback>:
159c2: 0f88 .short 0x0f88
159c4: 00010000 .word 0x00010000
159c8: 7eb3d400 .word 0x7eb3d400

000159cc <identify>:
159cc: 7e3b1c1d .word 0x7e3b1c1d

000159d0 <getVer>:
159d0: 1b0000fa .word 0x1b0000fa
159d4: 00000009 .word 0x00000009
159d8: 00000000 .word 0x00000000
159dc: 7e .byte 0x7e

000159dd <testAlive>:
159dd: fa .byte 0xfa
159de: 0000 .short 0x0000
159e0: 0000011b .word 0x0000011b
159e4: 00000000 .word 0x00000000
159e8: b74c .short 0xb74c
159ea: 7e .byte 0x7e

000159eb <testAliveResp>:
159eb: 1b .byte 0x1b
159ec: 00000001 .word 0x00000001
159f0: 0000 .short 0x0000
...

000159f3 <testAliveResp1>:
159f3: 1c .byte 0x1c
159f4: 00000002 .word 0x00000002
159f8: 0000 .short 0x0000
...

000159fb <testAliveCDMA>:
159fb: fa .byte 0xfa
159fc: 14080000 .word 0x14080000
15a00: f904d200 .word 0xf904d200
15a04: 7e27 .short 0x7e27

00015a06 <testAliveRespCDMA>:
15a06: 0122 .short 0x0122
15a08: 0000 .short 0x0000
...

00015a0b <enterFTMmode>:
15a0b: 29 .byte 0x29
15a0c: 73810003 .word 0x73810003
15a10: 7e .byte 0x7e

00015a11 <CDMAdiagPortOnUART>:
15a11: fa .byte 0xfa
15a12: 0000 .short 0x0000
15a14: 00002308 .word 0x00002308
15a18: fbf1 .short 0xfbf1
15a1a: 7e .byte 0x7e

00015a1b <CDMAdiagPortOnUSB>:
15a1b: fa .byte 0xfa
15a1c: 23080000 .word 0x23080000
15a20: 29e20001 .word 0x29e20001
15a24: 7e .byte 0x7e

00015a25 <resetCDMA>:
15a25: 29 .byte 0x29
15a26: 0002 .short 0x0002
15a28: 6a59 .short 0x6a59
15a2a: 7e .byte 0x7e

00015a2b <onlineMode>:
15a2b: fa .byte 0xfa
15a2c: 00030000 .word 0x00030000
15a30: 00000000 .word 0x00000000
15a34: 09f00500 .word 0x09f00500
15a38: 7e .byte 0x7e

00015a39 <offlineMode>:
15a39: fa .byte 0xfa
15a3a: 0000 .short 0x0000
15a3c: 00000003 .word 0x00000003
15a40: 06000000 .word 0x06000000
15a44: 3b6b .short 0x3b6b
15a46: 7e .byte 0x7e

00015a47 <ATCGDCONT>:
15a47: 41 .byte 0x41
15a48: 47432b54 .word 0x47432b54
15a4c: 4e4f4344 .word 0x4e4f4344
15a50: 0a0d3f54 .word 0x0a0d3f54

00015a54 <ATE0E1Cmd>:
15a54: 30455441 .word 0x30455441
15a58: 30453145 .word 0x30453145
15a5c: 30453145 .word 0x30453145
15a60: 30453145 .word 0x30453145
15a64: 0a0d3145 .word 0x0a0d3145

00015a68 <ATCmd>:
15a68: 0a0d5441 .word 0x0a0d5441

00015a6c <Charging90mA>:
15a6c: 1b0000fa .word 0x1b0000fa
15a70: 00000006 .word 0x00000006
15a74: 00180000 .word 0x00180000
15a78: f0f30000 .word 0xf0f30000
15a7c: 7e .byte 0x7e

00015a7d <Charging500mA>:
15a7d: fa .byte 0xfa
15a7e: 0000 .short 0x0000
15a80: 0000061b .word 0x0000061b
15a84: 18000000 .word 0x18000000
15a88: 2b000100 .word 0x2b000100
15a8c: 7ee9 .short 0x7ee9

00015a8e <Charging1A>:
15a8e: 00fa .short 0x00fa
15a90: 00061b00 .word 0x00061b00
15a94: 00000000 .word 0x00000000
15a98: 00070018 .word 0x00070018
15a9c: bdfb .short 0xbdfb
15a9e: 7e .byte 0x7e

00015a9f <getQPSTConfig>:
15a9f: 0c .byte 0x0c
15aa0: 417e3a14 .word 0x417e3a14
15aa4: 43512454 .word 0x43512454
15aa8: 0d474d44 .word 0x0d474d44
15aac: 51245441 .word 0x51245441
15ab0: 474d4443 .word 0x474d4443
15ab4: 2454410d .word 0x2454410d
15ab8: 4d444351 .word 0x4d444351
15abc: 067e0d47 .word 0x067e0d47
15ac0: 7e7e954e .word 0x7e7e954e

00015ac4 <getESN>:
15ac4: 00000026 .word 0x00000026
...
15b48: 7ed2ad00 .word 0x7ed2ad00

00015b4c <CDMAPcmLoopbackOn>:
15b4c: 000e0b4b .word 0x000e0b4b
15b50: 00010003 .word 0x00010003
15b54: 0001000c .word 0x0001000c
15b58: 7e00 .short 0x7e00

00015b5a <CDMAPcmLoopbackOff>:
15b5a: 0b4b .short 0x0b4b
15b5c: 0003000e .word 0x0003000e
15b60: 000c0001 .word 0x000c0001
15b64: 7e000000 .word 0x7e000000

00015b68 <GSMPcmLoopbackOn>:
15b68: 000e0b4b .word 0x000e0b4b
15b6c: 000b0003 .word 0x000b0003
15b70: 0001000c .word 0x0001000c
15b74: 7e00 .short 0x7e00

00015b76 <GSMPcmLoopbackOff>:
15b76: 0b4b .short 0x0b4b
15b78: 0003000e .word 0x0003000e
15b7c: 000c000b .word 0x000c000b
15b80: 7e000000 .word 0x7e000000

00015b84 <Dial>:
15b84: 000000fa .word 0x000000fa
15b88: 00000000 .word 0x00000000
15b8c: 04000000 .word 0x04000000
...
15bf0: 34000000 .word 0x34000000
15bf4: 31363830 .word 0x31363830
15bf8: 32333837 .word 0x32333837
15bfc: 00000037 .word 0x00000037
...
15c30: 0a000000 .word 0x0a000000
...
15c58: 0000 .short 0x0000
15c5a: 7e .byte 0x7e

00015c5b <disableloopbackdataport>:
15c5b: 41 .byte 0x41
15c5c: 0d304554 .word 0x0d304554
15c60: 0a .byte 0x0a

00015c61 <ATDT>:
15c61: 41 .byte 0x41
15c62: 4454 .short 0x4454
15c64: 37313654 .word 0x37313654
15c68: 37323338 .word 0x37323338
15c6c: 0a0d .short 0x0a0d

00015c6e <testAlive_1>:
15c6e: 00fa .short 0x00fa
15c70: 00011b00 .word 0x00011b00
15c74: 00000001 .word 0x00000001
15c78: 7ead8101 .word 0x7ead8101

00015c7c <onlineMode_1>:
15c7c: 030000fa .word 0x030000fa
15c80: 00000000 .word 0x00000000
15c84: 4f020000 .word 0x4f020000
15c88: 5d7d .short 0x5d7d
15c8a: 7e .byte 0x7e
</pre>

=== PmModemUpdater ===
Usage:
PmModemUpdater -h Print usage
PmModemUpdater -v Detect current modem firmware version
PmModemUpdater -p /path/to/firmware.tar Check the firmware package info
PmModemUpdater -b Backup NV items from device to /var/firmware/palm_nv_backup.txt
PmModemUpdater -r /path/to/nvfile Load NV items from nvfile
PmModemUpdater<firmware.tar Update the firmware using a tar file as input
PmModemUpdater<firmware.tar -f Force an update even the modem has the same version than tar file
PmModemUpdater<firmware.tar -s xx xx Force the modem to be flashed (RESCUE MODE)
PmModemUpdater -i Start a data/voice test on your umts modem directly
PmModemUpdater -e Ignore stop/start TIL/WAND
PmModemUpdater -o silent mode which means no verbose output at all
PmModemUpdater<firmware.tar -m Force the modem to be flashed (INFINITE USB RESCUE MODE) on USB

=== pmmodempower ===
<pre>
#!/bin/sh
for i in "$*"
if [ "$i" = "on" ]
then
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "off" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "cycle" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/wakeup_modem/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
sleep 2
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
#echo Waiting for MODEM_WAKE_APP Low
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#echo Waiting for MODEM_WAKE_APP Pulse High
#appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#while [ "$appwake" != "1" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
echo Asserting APP_WAKE_MODEM
echo 1 > /sys/user_hw/pins/modem/wakeup_modem/level
fi
done
</pre>

=== PmLinuxModemCmd ===
<pre>
usage: PmLinuxModemCmd <Port> <[a][b][c][d <number>][e][f][ftm][h][g][i][k <#pkts>][l][m][n][o][pcmloopback <radio> <state>][q][r][s][t][u <#pkts>][zr][zt][zl][1] [5][9]]> [v]
where: <Port>:
/dev/ttyS0 - Modem UART. - UART PORT
/dev/tts/modem0 - USB Serial to Modem for AT commands - DATA PORT.
/dev/tts/modemdiag - USB Serial to Modem for Diagnostics - DIAG PORT.
where:
e - empty read buffer from specified port.
u - Loopback mode performance test. Next argument <#pkts>
UART PORT COMMANDS: (/dev/ttyS0)
b - Send loopback mode command for 256 bytes. UART goes into loopback mode until power cycle.
d - Send commands to dial a phone number. Phone number in the format 4086178327.
f - Send offline mode and read pkt.
ftm - Enter modem FTM mode (both CDMA and GSM modems).
i - Send identify command.
l - Send testalive then loop forever doing ( onlinemode, offlinemode, sleep to UART.
m - Disable loopback mode.
o - Send online mode and read pkt.
pcmloopback - control PCM loopback. <radio> = GSM/CDMA <state> = on/off.
q - Send test alive, online mode and then read pkts.
r - Get firmware version.
t - Send test alive and read pkt.
1 - Send command to enable 1A charging.
5 - Send command to enable 500mA charging.
9 - Send command to enable 90mA charge.
zs - CDMA reset modem.
zt - CDMA send test alive and read pkts.
zdiagonusb - CDMA put diag port on USB diag.
zdiagonuart- CDMA put diag port on UART.
DATA PORT COMMANDS: (/dev/tts/modem0)
a - Send AT\n.
c - Send ATCGDCONT\n.
h - Send Echo command.
k - Test loopback perf using command (ATE1\n).
DIAG PORT COMMANDS: (/dev/tts/modemdiag)
g - Get QPST serial port config from DIAG port.
s - Get ESN from DIAG port.
zl - CDMA put modemdiag into loopback.
zr - CDMA Read performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zr <NumPkts> <PktSize> [v]
zw - CDMA Write performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zw <NumPkts> <PktSize> [v]
zu - CDMA Performance tests of the diag port after putting it into loopback. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zu <NumPkts> <PktSize> [v]
where v - verbose output.
</pre>

== TelephonyInterfaceLayerGsm ==

/usr/bin/TelephonyInterfaceLayerGsm connects to /dev/modemuart with a baudrate of 115200. Trying the same with screen shows me just rubbish. Seem to be the binary protocol. Make sure you rename the file before killing the process as it gets restarted automatically.

Research Pre GSM Modem

2009-10-13T18:13:50Z

StefanSchmidt: its /dev/modemuart not ttyS0

== Modem Ports ==
There are several ports for communicating with the modem on the Palm Pre:
* /dev/modemuart: Modem UART (UART Port)
* /dev/tts/modem0 (Symlink for ttyACM0): USB Serial to Modem for AT commands (Data Port)
* /dev/tts/modemdiag (Symlink for ttyACM1): USB Serial to Modem for Diagnositics (DIAG Port)

== sysfs Entries ==
* Power Control: /sys/user_hw/pins/modem/power_on/level

== Palm Programs for communicating with the modem ==
In /usr/bin are some interessting programs:
* PmLinuxModemCmd: You can do some operations on the modem from command line
* PmModemInfo: Shows you the IMEI and the version of the modem firmware
* PmModemPower: A simple shell script to turn on/reset the modem
* PmModemUpdater: Flash the modem with a new firmware

Through disassembling the PmLinuxModemCmd binary I found some binary sequences which indicates that the Pre communicates with the modem over a binary protocol.

The binary sequences are:
<pre>
00014a1c <enableloopbackdataport>:
14a1c: 31455441 .word 0x31455441
...
159c0: 0a0d .short 0x0a0d

000159c2 <loopback>:
159c2: 0f88 .short 0x0f88
159c4: 00010000 .word 0x00010000
159c8: 7eb3d400 .word 0x7eb3d400

000159cc <identify>:
159cc: 7e3b1c1d .word 0x7e3b1c1d

000159d0 <getVer>:
159d0: 1b0000fa .word 0x1b0000fa
159d4: 00000009 .word 0x00000009
159d8: 00000000 .word 0x00000000
159dc: 7e .byte 0x7e

000159dd <testAlive>:
159dd: fa .byte 0xfa
159de: 0000 .short 0x0000
159e0: 0000011b .word 0x0000011b
159e4: 00000000 .word 0x00000000
159e8: b74c .short 0xb74c
159ea: 7e .byte 0x7e

000159eb <testAliveResp>:
159eb: 1b .byte 0x1b
159ec: 00000001 .word 0x00000001
159f0: 0000 .short 0x0000
...

000159f3 <testAliveResp1>:
159f3: 1c .byte 0x1c
159f4: 00000002 .word 0x00000002
159f8: 0000 .short 0x0000
...

000159fb <testAliveCDMA>:
159fb: fa .byte 0xfa
159fc: 14080000 .word 0x14080000
15a00: f904d200 .word 0xf904d200
15a04: 7e27 .short 0x7e27

00015a06 <testAliveRespCDMA>:
15a06: 0122 .short 0x0122
15a08: 0000 .short 0x0000
...

00015a0b <enterFTMmode>:
15a0b: 29 .byte 0x29
15a0c: 73810003 .word 0x73810003
15a10: 7e .byte 0x7e

00015a11 <CDMAdiagPortOnUART>:
15a11: fa .byte 0xfa
15a12: 0000 .short 0x0000
15a14: 00002308 .word 0x00002308
15a18: fbf1 .short 0xfbf1
15a1a: 7e .byte 0x7e

00015a1b <CDMAdiagPortOnUSB>:
15a1b: fa .byte 0xfa
15a1c: 23080000 .word 0x23080000
15a20: 29e20001 .word 0x29e20001
15a24: 7e .byte 0x7e

00015a25 <resetCDMA>:
15a25: 29 .byte 0x29
15a26: 0002 .short 0x0002
15a28: 6a59 .short 0x6a59
15a2a: 7e .byte 0x7e

00015a2b <onlineMode>:
15a2b: fa .byte 0xfa
15a2c: 00030000 .word 0x00030000
15a30: 00000000 .word 0x00000000
15a34: 09f00500 .word 0x09f00500
15a38: 7e .byte 0x7e

00015a39 <offlineMode>:
15a39: fa .byte 0xfa
15a3a: 0000 .short 0x0000
15a3c: 00000003 .word 0x00000003
15a40: 06000000 .word 0x06000000
15a44: 3b6b .short 0x3b6b
15a46: 7e .byte 0x7e

00015a47 <ATCGDCONT>:
15a47: 41 .byte 0x41
15a48: 47432b54 .word 0x47432b54
15a4c: 4e4f4344 .word 0x4e4f4344
15a50: 0a0d3f54 .word 0x0a0d3f54

00015a54 <ATE0E1Cmd>:
15a54: 30455441 .word 0x30455441
15a58: 30453145 .word 0x30453145
15a5c: 30453145 .word 0x30453145
15a60: 30453145 .word 0x30453145
15a64: 0a0d3145 .word 0x0a0d3145

00015a68 <ATCmd>:
15a68: 0a0d5441 .word 0x0a0d5441

00015a6c <Charging90mA>:
15a6c: 1b0000fa .word 0x1b0000fa
15a70: 00000006 .word 0x00000006
15a74: 00180000 .word 0x00180000
15a78: f0f30000 .word 0xf0f30000
15a7c: 7e .byte 0x7e

00015a7d <Charging500mA>:
15a7d: fa .byte 0xfa
15a7e: 0000 .short 0x0000
15a80: 0000061b .word 0x0000061b
15a84: 18000000 .word 0x18000000
15a88: 2b000100 .word 0x2b000100
15a8c: 7ee9 .short 0x7ee9

00015a8e <Charging1A>:
15a8e: 00fa .short 0x00fa
15a90: 00061b00 .word 0x00061b00
15a94: 00000000 .word 0x00000000
15a98: 00070018 .word 0x00070018
15a9c: bdfb .short 0xbdfb
15a9e: 7e .byte 0x7e

00015a9f <getQPSTConfig>:
15a9f: 0c .byte 0x0c
15aa0: 417e3a14 .word 0x417e3a14
15aa4: 43512454 .word 0x43512454
15aa8: 0d474d44 .word 0x0d474d44
15aac: 51245441 .word 0x51245441
15ab0: 474d4443 .word 0x474d4443
15ab4: 2454410d .word 0x2454410d
15ab8: 4d444351 .word 0x4d444351
15abc: 067e0d47 .word 0x067e0d47
15ac0: 7e7e954e .word 0x7e7e954e

00015ac4 <getESN>:
15ac4: 00000026 .word 0x00000026
...
15b48: 7ed2ad00 .word 0x7ed2ad00

00015b4c <CDMAPcmLoopbackOn>:
15b4c: 000e0b4b .word 0x000e0b4b
15b50: 00010003 .word 0x00010003
15b54: 0001000c .word 0x0001000c
15b58: 7e00 .short 0x7e00

00015b5a <CDMAPcmLoopbackOff>:
15b5a: 0b4b .short 0x0b4b
15b5c: 0003000e .word 0x0003000e
15b60: 000c0001 .word 0x000c0001
15b64: 7e000000 .word 0x7e000000

00015b68 <GSMPcmLoopbackOn>:
15b68: 000e0b4b .word 0x000e0b4b
15b6c: 000b0003 .word 0x000b0003
15b70: 0001000c .word 0x0001000c
15b74: 7e00 .short 0x7e00

00015b76 <GSMPcmLoopbackOff>:
15b76: 0b4b .short 0x0b4b
15b78: 0003000e .word 0x0003000e
15b7c: 000c000b .word 0x000c000b
15b80: 7e000000 .word 0x7e000000

00015b84 <Dial>:
15b84: 000000fa .word 0x000000fa
15b88: 00000000 .word 0x00000000
15b8c: 04000000 .word 0x04000000
...
15bf0: 34000000 .word 0x34000000
15bf4: 31363830 .word 0x31363830
15bf8: 32333837 .word 0x32333837
15bfc: 00000037 .word 0x00000037
...
15c30: 0a000000 .word 0x0a000000
...
15c58: 0000 .short 0x0000
15c5a: 7e .byte 0x7e

00015c5b <disableloopbackdataport>:
15c5b: 41 .byte 0x41
15c5c: 0d304554 .word 0x0d304554
15c60: 0a .byte 0x0a

00015c61 <ATDT>:
15c61: 41 .byte 0x41
15c62: 4454 .short 0x4454
15c64: 37313654 .word 0x37313654
15c68: 37323338 .word 0x37323338
15c6c: 0a0d .short 0x0a0d

00015c6e <testAlive_1>:
15c6e: 00fa .short 0x00fa
15c70: 00011b00 .word 0x00011b00
15c74: 00000001 .word 0x00000001
15c78: 7ead8101 .word 0x7ead8101

00015c7c <onlineMode_1>:
15c7c: 030000fa .word 0x030000fa
15c80: 00000000 .word 0x00000000
15c84: 4f020000 .word 0x4f020000
15c88: 5d7d .short 0x5d7d
15c8a: 7e .byte 0x7e
</pre>

=== PmModemUpdater ===
Usage:
PmModemUpdater -h Print usage
PmModemUpdater -v Detect current modem firmware version
PmModemUpdater -p /path/to/firmware.tar Check the firmware package info
PmModemUpdater -b Backup NV items from device to /var/firmware/palm_nv_backup.txt
PmModemUpdater -r /path/to/nvfile Load NV items from nvfile
PmModemUpdater<firmware.tar Update the firmware using a tar file as input
PmModemUpdater<firmware.tar -f Force an update even the modem has the same version than tar file
PmModemUpdater<firmware.tar -s xx xx Force the modem to be flashed (RESCUE MODE)
PmModemUpdater -i Start a data/voice test on your umts modem directly
PmModemUpdater -e Ignore stop/start TIL/WAND
PmModemUpdater -o silent mode which means no verbose output at all
PmModemUpdater<firmware.tar -m Force the modem to be flashed (INFINITE USB RESCUE MODE) on USB

=== pmmodempower ===
<pre>
#!/bin/sh
for i in "$*"
if [ "$i" = "on" ]
then
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "off" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "cycle" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/wakeup_modem/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
sleep 2
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
#echo Waiting for MODEM_WAKE_APP Low
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#echo Waiting for MODEM_WAKE_APP Pulse High
#appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#while [ "$appwake" != "1" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
echo Asserting APP_WAKE_MODEM
echo 1 > /sys/user_hw/pins/modem/wakeup_modem/level
fi
done
</pre>

=== PmLinuxModemCmd ===
<pre>
usage: PmLinuxModemCmd <Port> <[a][b][c][d <number>][e][f][ftm][h][g][i][k <#pkts>][l][m][n][o][pcmloopback <radio> <state>][q][r][s][t][u <#pkts>][zr][zt][zl][1] [5][9]]> [v]
where: <Port>:
/dev/ttyS0 - Modem UART. - UART PORT
/dev/tts/modem0 - USB Serial to Modem for AT commands - DATA PORT.
/dev/tts/modemdiag - USB Serial to Modem for Diagnostics - DIAG PORT.
where:
e - empty read buffer from specified port.
u - Loopback mode performance test. Next argument <#pkts>
UART PORT COMMANDS: (/dev/ttyS0)
b - Send loopback mode command for 256 bytes. UART goes into loopback mode until power cycle.
d - Send commands to dial a phone number. Phone number in the format 4086178327.
f - Send offline mode and read pkt.
ftm - Enter modem FTM mode (both CDMA and GSM modems).
i - Send identify command.
l - Send testalive then loop forever doing ( onlinemode, offlinemode, sleep to UART.
m - Disable loopback mode.
o - Send online mode and read pkt.
pcmloopback - control PCM loopback. <radio> = GSM/CDMA <state> = on/off.
q - Send test alive, online mode and then read pkts.
r - Get firmware version.
t - Send test alive and read pkt.
1 - Send command to enable 1A charging.
5 - Send command to enable 500mA charging.
9 - Send command to enable 90mA charge.
zs - CDMA reset modem.
zt - CDMA send test alive and read pkts.
zdiagonusb - CDMA put diag port on USB diag.
zdiagonuart- CDMA put diag port on UART.
DATA PORT COMMANDS: (/dev/tts/modem0)
a - Send AT\n.
c - Send ATCGDCONT\n.
h - Send Echo command.
k - Test loopback perf using command (ATE1\n).
DIAG PORT COMMANDS: (/dev/tts/modemdiag)
g - Get QPST serial port config from DIAG port.
s - Get ESN from DIAG port.
zl - CDMA put modemdiag into loopback.
zr - CDMA Read performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zr <NumPkts> <PktSize> [v]
zw - CDMA Write performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zw <NumPkts> <PktSize> [v]
zu - CDMA Performance tests of the diag port after putting it into loopback. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zu <NumPkts> <PktSize> [v]
where v - verbose output.
</pre>

Research Pre Audio

2009-10-13T13:51:15Z

StefanSchmidt: mention PMIC chip used also for audio

Portal:Research

2009-10-13T13:44:10Z

StefanSchmidt: audio research link

__notoc__
{{portal-header|
The Research Portal is for bleeding edge things being done with the device.

Title all pages: '''Research [description]''' or '''Reference [description]'''
}}
{{portal-two-columns
|column1=
===Research:===

* [[Applications Bundled on the Pre]]
* [[Application_Framework|Application Framework]]
* [[Blocking Updates]]
* [[New Bluetooth|BlueZ (Replacing Palm Bluetooth)]]
* [[Boot_Chain|Boot Chain]]
* [[Bootie]]
* [[ClassicFilesystem]]
* [[Decrypt SSL (trusted man-in-the-middle technique)|Decrypt SSL (trusted man-in-the-middle technique)]]
* [[Fonts available on board the Pre]]
* [[Gstreamer]]
* [[Hidd]]
* [[Introspecting_Dbus|Introspecting Dbus]]
* [[Key Codes|Key Codes]]
* [[Pre Specific Hash Codes|Pre Specific Hash Codes]]
* [[Pictures from Self-Test|Pictures from Self-Test]]
* [[Restore Debug Log|Restore Debug Log]]
* [[Reverse_Engineering_WebOS_Doctor|Reverse Engineering WebOS Doctor]]
* [[Rooted Pre Issues|Rooted Pre Issues]]
* [[Research_Securing_Pre|Securing your Pre]]
* [[Running Processes|Running Processes]]
* [[Symlink Applications|Symlink Applications]]
* [[System Sounds|System Sounds]]
* [[TestApps|TestApps]]
* [[Update Service Trace|Update Service Trace]]
* [[Tidbits|Tidbits]]
* [[VideoRecording]]
* [[WebOS Exploration - Various Information|WebOS Exploration - Various Information]]
* [[Research_Pre_GSM_Modem | Pre GSM modem devices, protocols, etc]]
* [[Research_Pre_Audio | Audio routing and setup on the Pre]]

|column2=
===Reference===
* [[Packaging Standards|Packaging Standards]]
* [[webkit_transform|Webkit Transform]]- a powerful set of commands for manipulating elements.
}}

Research Pre Audio

2009-10-13T13:43:14Z

StefanSchmidt: start audio research page

This side should cover the audio architecture used on the Palm Pre.

== Soundcards ==

<pre>
root@castle:/var/home/root# aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: mcbsp2 [twl4030-i2s (mcbsp2)], device 0: omap-mcbsp-pcm [omap-mcbsp-pcm]
Subdevices: 1/1
Subdevice #0: subdevice #0
card 1: mcbsp3 [btsco (mcbsp3)], device 0: omap-mcbsp-pcm [omap-mcbsp-pcm]
Subdevices: 1/1
Subdevice #0: subdevice #0
</pre>

Portal:Research

2009-10-13T13:25:02Z

StefanSchmidt: link for the new GSm research page

__notoc__
{{portal-header|
The Research Portal is for bleeding edge things being done with the device.

Title all pages: '''Research [description]''' or '''Reference [description]'''
}}
{{portal-two-columns
|column1=
===Research:===

* [[Applications Bundled on the Pre]]
* [[Application_Framework|Application Framework]]
* [[Blocking Updates]]
* [[New Bluetooth|BlueZ (Replacing Palm Bluetooth)]]
* [[Boot_Chain|Boot Chain]]
* [[Bootie]]
* [[ClassicFilesystem]]
* [[Decrypt SSL (trusted man-in-the-middle technique)|Decrypt SSL (trusted man-in-the-middle technique)]]
* [[Fonts available on board the Pre]]
* [[Gstreamer]]
* [[Hidd]]
* [[Introspecting_Dbus|Introspecting Dbus]]
* [[Key Codes|Key Codes]]
* [[Pre Specific Hash Codes|Pre Specific Hash Codes]]
* [[Pictures from Self-Test|Pictures from Self-Test]]
* [[Restore Debug Log|Restore Debug Log]]
* [[Reverse_Engineering_WebOS_Doctor|Reverse Engineering WebOS Doctor]]
* [[Rooted Pre Issues|Rooted Pre Issues]]
* [[Research_Securing_Pre|Securing your Pre]]
* [[Running Processes|Running Processes]]
* [[Symlink Applications|Symlink Applications]]
* [[System Sounds|System Sounds]]
* [[TestApps|TestApps]]
* [[Update Service Trace|Update Service Trace]]
* [[Tidbits|Tidbits]]
* [[VideoRecording]]
* [[WebOS Exploration - Various Information|WebOS Exploration - Various Information]]
* [[Research_Pre_GSM_Modem | Pre GSM modem devices, protocols, etc]]

|column2=
===Reference===
* [[Packaging Standards|Packaging Standards]]
* [[webkit_transform|Webkit Transform]]- a powerful set of commands for manipulating elements.
}}

Research Pre GSM Modem

2009-10-13T13:23:33Z

StefanSchmidt: GSM modem information moved over from http://www.freesmartphone.org/index.php/PalmPreGSM

== Modem Ports ==
There are several ports for communicating with the modem on the Palm Pre:
* /dev/ttyS0: Modem UART (UART Port)
* /dev/tts/modem0 (Symlink for ttyACM0): USB Serial to Modem for AT commands (Data Port)
* /dev/tts/modemdiag (Symlink for ttyACM1): USB Serial to Modem for Diagnositics (DIAG Port)

== sysfs Entries ==
* Power Control: /sys/user_hw/pins/modem/power_on/level

== Palm Programs for communicating with the modem ==
In /usr/bin are some interessting programs:
* PmLinuxModemCmd: You can do some operations on the modem from command line
* PmModemInfo: Shows you the IMEI and the version of the modem firmware
* PmModemPower: A simple shell script to turn on/reset the modem
* PmModemUpdater: Flash the modem with a new firmware

Through disassembling the PmLinuxModemCmd binary I found some binary sequences which indicates that the Pre communicates with the modem over a binary protocol.

The binary sequences are:
<pre>
00014a1c <enableloopbackdataport>:
14a1c: 31455441 .word 0x31455441
...
159c0: 0a0d .short 0x0a0d

000159c2 <loopback>:
159c2: 0f88 .short 0x0f88
159c4: 00010000 .word 0x00010000
159c8: 7eb3d400 .word 0x7eb3d400

000159cc <identify>:
159cc: 7e3b1c1d .word 0x7e3b1c1d

000159d0 <getVer>:
159d0: 1b0000fa .word 0x1b0000fa
159d4: 00000009 .word 0x00000009
159d8: 00000000 .word 0x00000000
159dc: 7e .byte 0x7e

000159dd <testAlive>:
159dd: fa .byte 0xfa
159de: 0000 .short 0x0000
159e0: 0000011b .word 0x0000011b
159e4: 00000000 .word 0x00000000
159e8: b74c .short 0xb74c
159ea: 7e .byte 0x7e

000159eb <testAliveResp>:
159eb: 1b .byte 0x1b
159ec: 00000001 .word 0x00000001
159f0: 0000 .short 0x0000
...

000159f3 <testAliveResp1>:
159f3: 1c .byte 0x1c
159f4: 00000002 .word 0x00000002
159f8: 0000 .short 0x0000
...

000159fb <testAliveCDMA>:
159fb: fa .byte 0xfa
159fc: 14080000 .word 0x14080000
15a00: f904d200 .word 0xf904d200
15a04: 7e27 .short 0x7e27

00015a06 <testAliveRespCDMA>:
15a06: 0122 .short 0x0122
15a08: 0000 .short 0x0000
...

00015a0b <enterFTMmode>:
15a0b: 29 .byte 0x29
15a0c: 73810003 .word 0x73810003
15a10: 7e .byte 0x7e

00015a11 <CDMAdiagPortOnUART>:
15a11: fa .byte 0xfa
15a12: 0000 .short 0x0000
15a14: 00002308 .word 0x00002308
15a18: fbf1 .short 0xfbf1
15a1a: 7e .byte 0x7e

00015a1b <CDMAdiagPortOnUSB>:
15a1b: fa .byte 0xfa
15a1c: 23080000 .word 0x23080000
15a20: 29e20001 .word 0x29e20001
15a24: 7e .byte 0x7e

00015a25 <resetCDMA>:
15a25: 29 .byte 0x29
15a26: 0002 .short 0x0002
15a28: 6a59 .short 0x6a59
15a2a: 7e .byte 0x7e

00015a2b <onlineMode>:
15a2b: fa .byte 0xfa
15a2c: 00030000 .word 0x00030000
15a30: 00000000 .word 0x00000000
15a34: 09f00500 .word 0x09f00500
15a38: 7e .byte 0x7e

00015a39 <offlineMode>:
15a39: fa .byte 0xfa
15a3a: 0000 .short 0x0000
15a3c: 00000003 .word 0x00000003
15a40: 06000000 .word 0x06000000
15a44: 3b6b .short 0x3b6b
15a46: 7e .byte 0x7e

00015a47 <ATCGDCONT>:
15a47: 41 .byte 0x41
15a48: 47432b54 .word 0x47432b54
15a4c: 4e4f4344 .word 0x4e4f4344
15a50: 0a0d3f54 .word 0x0a0d3f54

00015a54 <ATE0E1Cmd>:
15a54: 30455441 .word 0x30455441
15a58: 30453145 .word 0x30453145
15a5c: 30453145 .word 0x30453145
15a60: 30453145 .word 0x30453145
15a64: 0a0d3145 .word 0x0a0d3145

00015a68 <ATCmd>:
15a68: 0a0d5441 .word 0x0a0d5441

00015a6c <Charging90mA>:
15a6c: 1b0000fa .word 0x1b0000fa
15a70: 00000006 .word 0x00000006
15a74: 00180000 .word 0x00180000
15a78: f0f30000 .word 0xf0f30000
15a7c: 7e .byte 0x7e

00015a7d <Charging500mA>:
15a7d: fa .byte 0xfa
15a7e: 0000 .short 0x0000
15a80: 0000061b .word 0x0000061b
15a84: 18000000 .word 0x18000000
15a88: 2b000100 .word 0x2b000100
15a8c: 7ee9 .short 0x7ee9

00015a8e <Charging1A>:
15a8e: 00fa .short 0x00fa
15a90: 00061b00 .word 0x00061b00
15a94: 00000000 .word 0x00000000
15a98: 00070018 .word 0x00070018
15a9c: bdfb .short 0xbdfb
15a9e: 7e .byte 0x7e

00015a9f <getQPSTConfig>:
15a9f: 0c .byte 0x0c
15aa0: 417e3a14 .word 0x417e3a14
15aa4: 43512454 .word 0x43512454
15aa8: 0d474d44 .word 0x0d474d44
15aac: 51245441 .word 0x51245441
15ab0: 474d4443 .word 0x474d4443
15ab4: 2454410d .word 0x2454410d
15ab8: 4d444351 .word 0x4d444351
15abc: 067e0d47 .word 0x067e0d47
15ac0: 7e7e954e .word 0x7e7e954e

00015ac4 <getESN>:
15ac4: 00000026 .word 0x00000026
...
15b48: 7ed2ad00 .word 0x7ed2ad00

00015b4c <CDMAPcmLoopbackOn>:
15b4c: 000e0b4b .word 0x000e0b4b
15b50: 00010003 .word 0x00010003
15b54: 0001000c .word 0x0001000c
15b58: 7e00 .short 0x7e00

00015b5a <CDMAPcmLoopbackOff>:
15b5a: 0b4b .short 0x0b4b
15b5c: 0003000e .word 0x0003000e
15b60: 000c0001 .word 0x000c0001
15b64: 7e000000 .word 0x7e000000

00015b68 <GSMPcmLoopbackOn>:
15b68: 000e0b4b .word 0x000e0b4b
15b6c: 000b0003 .word 0x000b0003
15b70: 0001000c .word 0x0001000c
15b74: 7e00 .short 0x7e00

00015b76 <GSMPcmLoopbackOff>:
15b76: 0b4b .short 0x0b4b
15b78: 0003000e .word 0x0003000e
15b7c: 000c000b .word 0x000c000b
15b80: 7e000000 .word 0x7e000000

00015b84 <Dial>:
15b84: 000000fa .word 0x000000fa
15b88: 00000000 .word 0x00000000
15b8c: 04000000 .word 0x04000000
...
15bf0: 34000000 .word 0x34000000
15bf4: 31363830 .word 0x31363830
15bf8: 32333837 .word 0x32333837
15bfc: 00000037 .word 0x00000037
...
15c30: 0a000000 .word 0x0a000000
...
15c58: 0000 .short 0x0000
15c5a: 7e .byte 0x7e

00015c5b <disableloopbackdataport>:
15c5b: 41 .byte 0x41
15c5c: 0d304554 .word 0x0d304554
15c60: 0a .byte 0x0a

00015c61 <ATDT>:
15c61: 41 .byte 0x41
15c62: 4454 .short 0x4454
15c64: 37313654 .word 0x37313654
15c68: 37323338 .word 0x37323338
15c6c: 0a0d .short 0x0a0d

00015c6e <testAlive_1>:
15c6e: 00fa .short 0x00fa
15c70: 00011b00 .word 0x00011b00
15c74: 00000001 .word 0x00000001
15c78: 7ead8101 .word 0x7ead8101

00015c7c <onlineMode_1>:
15c7c: 030000fa .word 0x030000fa
15c80: 00000000 .word 0x00000000
15c84: 4f020000 .word 0x4f020000
15c88: 5d7d .short 0x5d7d
15c8a: 7e .byte 0x7e
</pre>

=== PmModemUpdater ===
Usage:
PmModemUpdater -h Print usage
PmModemUpdater -v Detect current modem firmware version
PmModemUpdater -p /path/to/firmware.tar Check the firmware package info
PmModemUpdater -b Backup NV items from device to /var/firmware/palm_nv_backup.txt
PmModemUpdater -r /path/to/nvfile Load NV items from nvfile
PmModemUpdater<firmware.tar Update the firmware using a tar file as input
PmModemUpdater<firmware.tar -f Force an update even the modem has the same version than tar file
PmModemUpdater<firmware.tar -s xx xx Force the modem to be flashed (RESCUE MODE)
PmModemUpdater -i Start a data/voice test on your umts modem directly
PmModemUpdater -e Ignore stop/start TIL/WAND
PmModemUpdater -o silent mode which means no verbose output at all
PmModemUpdater<firmware.tar -m Force the modem to be flashed (INFINITE USB RESCUE MODE) on USB

=== pmmodempower ===
<pre>
#!/bin/sh
for i in "$*"
if [ "$i" = "on" ]
then
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "off" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
fi
if [ "$i" = "cycle" ]
then
echo Powering Off Modem
echo 0 > /sys/user_hw/pins/modem/boot_mode/level
echo 0 > /sys/user_hw/pins/modem/wakeup_modem/level
echo 0 > /sys/user_hw/pins/modem/power_on/level
sleep 2
echo Powering On Modem
echo 1 > /sys/user_hw/pins/modem/power_on/level
#echo Waiting for MODEM_WAKE_APP Low
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#echo Waiting for MODEM_WAKE_APP Pulse High
#appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#while [ "$appwake" != "1" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
#while [ "$appwake" != "0" ]
#do
# appwake=`cat /sys/user_hw/pins/modem/wakeup_app/level`
#done
echo Asserting APP_WAKE_MODEM
echo 1 > /sys/user_hw/pins/modem/wakeup_modem/level
fi
done
</pre>

=== PmLinuxModemCmd ===
<pre>
usage: PmLinuxModemCmd <Port> <[a][b][c][d <number>][e][f][ftm][h][g][i][k <#pkts>][l][m][n][o][pcmloopback <radio> <state>][q][r][s][t][u <#pkts>][zr][zt][zl][1] [5][9]]> [v]
where: <Port>:
/dev/ttyS0 - Modem UART. - UART PORT
/dev/tts/modem0 - USB Serial to Modem for AT commands - DATA PORT.
/dev/tts/modemdiag - USB Serial to Modem for Diagnostics - DIAG PORT.
where:
e - empty read buffer from specified port.
u - Loopback mode performance test. Next argument <#pkts>
UART PORT COMMANDS: (/dev/ttyS0)
b - Send loopback mode command for 256 bytes. UART goes into loopback mode until power cycle.
d - Send commands to dial a phone number. Phone number in the format 4086178327.
f - Send offline mode and read pkt.
ftm - Enter modem FTM mode (both CDMA and GSM modems).
i - Send identify command.
l - Send testalive then loop forever doing ( onlinemode, offlinemode, sleep to UART.
m - Disable loopback mode.
o - Send online mode and read pkt.
pcmloopback - control PCM loopback. <radio> = GSM/CDMA <state> = on/off.
q - Send test alive, online mode and then read pkts.
r - Get firmware version.
t - Send test alive and read pkt.
1 - Send command to enable 1A charging.
5 - Send command to enable 500mA charging.
9 - Send command to enable 90mA charge.
zs - CDMA reset modem.
zt - CDMA send test alive and read pkts.
zdiagonusb - CDMA put diag port on USB diag.
zdiagonuart- CDMA put diag port on UART.
DATA PORT COMMANDS: (/dev/tts/modem0)
a - Send AT\n.
c - Send ATCGDCONT\n.
h - Send Echo command.
k - Test loopback perf using command (ATE1\n).
DIAG PORT COMMANDS: (/dev/tts/modemdiag)
g - Get QPST serial port config from DIAG port.
s - Get ESN from DIAG port.
zl - CDMA put modemdiag into loopback.
zr - CDMA Read performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zr <NumPkts> <PktSize> [v]
zw - CDMA Write performance tests. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zw <NumPkts> <PktSize> [v]
zu - CDMA Performance tests of the diag port after putting it into loopback. Takes two arguments <numpkts> and <pktSize>.
Eg. %s /dev/tts/modemdiag zu <NumPkts> <PktSize> [v]
where v - verbose output.
</pre>