Bootie

Current Version: 191.4 introduced with WebOS 1.4.1
Old version : 145.2.6 introduced with WebOS 1.0.3

Bootie is the stage3 bootloader of webOS devices. It is unpacked from the end of boot.bin, and loaded to **0x82000000** in memory. Bootie looks very similar to iBoot from the iPhoneOS devices.

Getting into bootie mode is as easy as holding the volume-up key while plugging the phone into USB while the phone is in the "off" state. The novaterm/novaproxy programs can then be used to talk to bootie.

Running Bootie commands

The following is an example of using novaterm to run the bootie command "help":

] help 
command list:
	nduid           : get the device id
	usb             : usb transfer commands
	lboot           : boot linux image
	klog            : klog commands
	printenv        : print all of the environment variables
	getenv          : read an environment variable
	setenv          : set an environment variable
	reset           : reset the device
	script          : run a script at specified address
	run             : run a script at from an environment variable
	return          : return from current script
	help            : this list
	version         : get bootie version
        battery         : battery status (found in webOS 1.4.1 and not in 1.0.3)
	charging        : commands to set charging states 
	fsboot          : boot current image based on environment
	chainboot       : boot another bootloader image based on environment
	go              : Jump to a given address with the given arguments
	cpurev          : read the cpu revision (found in webOS 1.0.3 but not in 1.4.1)
	diag            : perform diag operations: write, boot, verify
	poweroff        : power off completely

For a Pre 3, the command set is greatly extended:

] help 
command list:
        hotspot         : hotspot commands
        heap            : heap debug commands
        gfx             : gfx commands
        fs              : fs debug commands
        nduid           : get the device id
        display         : display debug commands
        backlight       : backlight debug commands
        token           : token read/write commands
        usb             : usb transfer commands
        nvram           : nvram read/write/init commands
        logo            : logo display commands
        lboot           : boot linux image
        klog            : klog commands
        printenv        : print all of the environment variables
        getenv          : read an environment variable
        setenv          : set an environment variable
        saveenv         : save the current environment to nvram
        log             : dump debug log
        dw              : display memory in words
        dh              : display memory in halfwords
        db              : display memory in bytes
        mw              : modify word of memory
        mh              : modify halfword of memory
        mb              : modify byte of memory
        fw              : fill range of memory by word
        fh              : fill range of memory by halfword
        fb              : fill range of memory by byte
        mc              : copy a range of memory
        mtest           : simple memory test
        reset           : reset the device
        reboot          : reset the device
        poweroff        : power off completely
        wall            : see what's written on the wall
        script          : run a script at specified address
        run             : run a script at from an environment variable
        return          : return from current script
        help            : this list
        test            : test the command processor
        history         : command history
        clk             : system clocks control
        crc             : crc32 a range of memory
        adler           : adler32 a range of memory
        sha1            : sha1 a range of memory
        chainboot       : boot another bootloader image based on environment
        go              : Jump to a given address with the given arguments
        bio             : block io debug commands
        version         : get bootie version
        threads         : list kernel threads
        threadstats     : thread level statistics
        threadload      : toggle thread load display
        summit          : commands to interact with the smb338
        mmcid           : identify the mmc
        lm3528          : led drivers
        lcd             : lcd info/update/pattern/fill/write/read
        i2c             : i2c read/write commands
        ctp             : capacitive touch panel commands
        battery         : battery status
        a6_sbw          : test a6 sbw interface
        a6              : test a6 interface
        charging        : commands to set charging states
        fsboot          : boot current image based on environment
        phytune         : commands to tune the phy on msm7k
        smem            : smem control
        pcomm           : pcomm command
        gpio            : gpio read/write commands
        acpuclk         : clk set/get/test commands
        spi             : MSM7X30 SPI driver 
        ssbi            : ssbi read/write commands
        audio           : Audio related commands for Broadway
        vibrator        : enable/disable the vibrator
        chg             : charger command

The Bootie Environment

The default environment of Pre phones during boot follows:

] getenv
T   ? = 0
T   chargebypass = 0
T   framebuffer = 0x8f600000
T   boardtype = castle-dvt3
    installer = trenchcoat
T   klog_len = 0x100000
T   klog_addr = 0x8ff00000
T   logofile = boot/logo.tga
T   bootaddress = 0x81000000
T   bootfile = uImage
T   bootfs = ext2
T   bootdevice = mmc0p1
T   bootargs-ramdisk = root=/dev/ram0 ramdisk=32768 ro
T   bootargs = root=b302 rootdelay=2 ro
T   bootconsole = tty1
    autoboot = fsboot

The boot environment on a TouchPad (3.0.2) follows:

T   ? = -1000
T   framebuffer = 0x7f600000
    installer = trenchcoat
    checkbatt = 1
T   chargebypass = 1
T   klog_len = 0x100000
T   klog_addr = 0x7ff00000
T   tablet_wod_support = 0x0
T   extended_timeout = 0x0
T   chainbootdevice = mmc0
T   bootaddress = 0x41000000
T   bootdevice = mmc0p12
T   bootfile = uImage
T   bootfs = ext2
T   bootargs-ramdisk = root=/dev/ram0 rw
T   bootargs = root=/dev/mmcblk0p13 rootwait ro
T   bootconsole = ttyS0,115200n8
T   autoboot = fsboot
T   boardtype = topaz-Wifi-pvt

Additional commands

In addition to the commands listed by the help command displayed above, bootie supports the command get which will return the contents of a file, for example:

 novacom get file://klog

Image formats accepted

It looks like Bootie accepts images generated with mkimage from u-boot tools.

There are apparently two kinds of images:

• simple images are just the uImage as produced by kernel build process.
• multi images that have both the kernel and a ramdisk. Both the kernel and the ramdisk must be processed with mkimage first (kernel is processed by the build). It is important to pass -C none to mkimage when generating the ramdisk file, otherwise Bootie refuses to recognize it. Then generate the multi image like this:

mkimage -A arm -T multi -C none -n 'test-multi-image' -d arch/arm/boot/uImage:/tmp/uRamdisk /tmp/uMulti

When Bootie detects such a multi image, it uses bootargs-ramdisk variable as kernel argument instead of just bootargs, so no need to do any extra actions when trying to feed such a multi-image into the Bootie.