How the OUYA Safe recovery works

Hey there! Since I read some posts over at the xda developers forum for the OUYA regarding the OUYA Safe recovery, it was clear to me, that not everybody is understanding how this approach works. So here is a short post about how the OUYA Safe recovery, respectively the OUYA boot process works.

First of all: There is a custom recovery for the OUYA. I installed it to my device and it is working great. The OUYA Safe recovery is a project developed by a user named “ProfessorAnomaly” and  you can find more information on further development here.

The aim of this project is to get the ability to flash custom roms and kernels to the OUYA without bricking the device. The goal was reached by “switching” the boot- (aka kernel) partition and the recovery partition. To understand why this approach was successful and necessary in the first place, we have to look on the boot process of the OUYA.

When you push the power-button on the OUYA the device starts 😉 the first stage of the boot-process is to load the bootloader. You can imagine the bootloader as an extended BIOS. It loads the chip functions and loads the kernel.
While most of the common handheld devices are offering the ability to stop the boot-process for recovery activities at this point by pressing a additional key while booting, OUYA is lacking of this ability. You can access the bootloader-mode, but you can only do so, if you successfully booted the kernel in the first place. We have already written on the topic of the locked bootloader here.
So let’s go further threw this: the bootloader is booting the kernel, which is placed on the 3rd (or LNX) partition on the flash chip. It is hard-coded into the bootloader to look for the kernel on the LNX partition. So if you write a non-functioning kernel to the  LNX-partition, the device won’t ever be able to boot into a state, where you can communicate with it to change or reverse settings – it’s a softbrick.
So what ProfessorAnomaly made was to move his recovery (which usually is located at the 4th or SOS-partition) to the LNX partition. That was an trivial, but brilliant idea, since it ensures, that you won’t brake the partition, where the bootloader assumes the kernel to be located. You simply always boot into a known functioning recovery and load the kernel followed by the rom from there.

There is one problem though. Most of the kernel and rom-developers don’t know or care for this type of solution. There is a good reason for that: the norm is, that the kernel is on the LNX partition and the recovery on the SOS partition. As a developer of such multi-device software as for instance ClockworkMod recovery, you can’t know all devices your software is working on. So if you flash a rom to your device, what actually happens is that there is a so called updater-script located at “\META-INF\com\google\android\” of the .zip file that is processed. Since the author of the scripts assumes that the kernel is located at LNX, and recovery at SOS, it can easily happen, that this update will overwrite it`s kernel over the existing recovery. When the flash process is faulty your device gets soft-bricked….

OUYA_Safe_recovery

But what would happens if you have the OUYA Safe recovery installed and additionally flash the ClockworkMod recovery (CWM)? You would have one recovery in the kernel partition and another recovery in the recovery-partition, hence there would be no place to boot your kernel/rom…

So until there is an adjusted version especially for the OUYA you have to open the updater-script in a text editing program and delete or edit all lines that include “LNX” or mmcblk3 (which is another designation for the 3 partition on the mmc-flash device)

I hope I could bring some clarification on this issue. If you have any questions or notes place them in the comments section and stay tuned!

Leave a Reply

Your email address will not be published. Required fields are marked *

Si prega di attivare i Javascript! / Please turn on Javascript!

Javaskripta ko calu karem! / Bitte schalten Sie Javascript!

S'il vous plaît activer Javascript! / Por favor, active Javascript!

Qing dakai JavaScript! / Qing dakai JavaScript!

Пожалуйста включите JavaScript! / Silakan aktifkan Javascript!