FrankenDoctor 1.4.5/2.0.0

[rwhitby]

This procedure does not yet result in a bootable device, and it will destroy all data on your device and may permanently destroy the modem too.

Do not run this on your device unless you would be perfectly happy to hit your device with a sledge hammer and not try and return it to Palm or your carrier under warranty or insurance.

How to create a FrankenDoctor 1.4.5/2.0.0

First, you need a Ubuntu 10.x Linux box. Don't ask about any other OS or version - use VirtualBox to get a Ubuntu 10.x Linux box.

First you need the meta-doctor.

Put that in /srv/tools/meta-doctor/

Then you need the Pre WR 1.4.5 and Pre 2 SFR 2.0.0 webOS Doctors.

Put them in /srv/tools/meta-doctor/downloads/

Then you need to unpack the webOS Doctor 1.4.5 - use the unpack doctor script in the meta-doctor repository.

Put that in /srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/

Then you need to unpack the webOS Doctor 2.0.0 - use the unpack doctor script in the meta-doctor repository.

Put that in /srv/doctors/unpacked/webosdoctorp103ueu-wr-2.0.0/

Working directory is /srv/tools/meta-doctor/

First option is to replace the bootloader, kernel and kernel modules in the webOS 2.0.0 doctor with those from the webOS 1.4.5 doctor:

make DEVICE=pre2 CUSTOM_DEVICETYPE=castle CUSTOM_BOOTLOADER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs/boot/boot.bin CUSTOM_INSTALLER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/webOS/nova-installer-image-castle.uImage CUSTOM_KERNEL_DIR=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs REMOVE_MODEL_CHECK=1 REMOVE_CARRIER_CHECK=1 DISABLE_MODEM_UPDATE=1 DISABLE_UPLOAD_DAEMON=1 clobber-wr all-wr

java -jar ./build/pre2-p103ueu-wr-2.0.0/webosdoctorp103ueu-wr-2.0.0.jar

Second option is to replace the rootfs in the webOS 1.4.5 doctor with the one from the webOS 2.0.0 doctor:

make DEVICE=pre CUSTOM_BOOTLOADER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs/boot/boot.bin CUSTOM_KERNEL_DIR=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs CUSTOM_ROOTFS=/srv/doctors/unpacked/webosdoctorp103ueu-wr-2.0.0/webOS/nova-cust-image-roadrunner.rootfs.tar.gz CUSTOM_XML=/srv/doctors/unpacked/webosdoctorp103ueu-wr-2.0.0/webOS/roadrunner.xml DISABLE_UPLOAD_DAEMON=1 DISABLE_MODEM_UPDATE=1 REMOVE_CARRIER_CHECK=1 REMOVE_MODEL_CHECK=1 clobber-wr all-wr

java -jar ./build/pre-p100ueu-wr-1.4.5/webosdoctorp100ueu-wr-1.4.5.jar

In either case, you then need to recovery boot, memload and mount the filesystem, and then copy libc.so, libm.so and ld.so from /tmp/root/lib to /tmp/boot/lib so that the library dependencies for busybox are satisfied.

make DEVICE=pre memload-wr mount
novaterm
mount -o remount,rw /tmp/boot
cp /tmp/root/lib/libc-*.so /tmp/boot/lib/
cp /tmp/root/lib/libm-*.so /tmp/boot/lib/
cp /tmp/root/lib/ld-*.so /tmp/boot/lib/

Current status is that it boots to userspace but LunaSysMgr segfaults.

Respond in the thread when you get to here.

Interested parties should join #webos-internals IRC if you have the skills to help debug.

-- Rod

[Xanadu73]

Rod,

I'm sure you already know, but in my 10+ year Linux experience, 99 times out of 100 that error is caused by not having the proper file system built INTO the kernel (not a module) or, the fstab says a different FS than what the drive(s) actually is.


M.

[rwhitby]

Kernel log says mmcblk0p2 is mounted as ext3 successfully.

It's the 1.4.5 kernel.

-- Rod

[ice8lue]

Really, you guys are amazing. If I can help, count me in!

[tooearly]

All I have to say is, ridiculous. (In an awesome way)

[OmegaSupreme]

Originally Posted by tooearly

All I have to say is, ridiculous. (In an awesome way)

i agree. it's absolutely ridiculous. there's no telling how many customers that internals and homebrew have kept around with this stuff ("thissssss.... stufffffff???" -miranda priestly).

i'll be a frequent vistor to this thread. thanks, rod.

[GuyFromNam]

cp: cannot stat `/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs/boot/boot.bin': No such file or directory
boot under rootfs doesn't unpack?

EDIT: OK, so the boot dir wouldn't extract to rootfs. I extracted the bootie binary manually, copied it to the right location.
I get an Unable to reset your phone.

[destinal]

I also get the cannot reset error -- this is the error in the java stderr

INFO: exiting handleFailCase()
java.io.FileNotFoundException: nova-installer-image-castle.uImage (No such file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.<init>(FileInputStream.java:106)
at java.io.FileInputStream.<init>(FileInputStream.java:66)
at com.palm.nova.installer.core.InstallerModel.getInputStream(InstallerModel.java:112)
at com.palm.nova.installer.core.InstallerModel.getRamDiskFileStream(InstallerModel.java:241)
at com.palm.nova.installer.core.stages.RamdiskLoadingStage.run(RamdiskLoadingStage.java:46)
at com.palm.nova.installer.core.FlasherThread.run(FlasherThread.java:245)

[GuyFromNam]

Figures, it's been renamed:
cp /srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/webOS/nova-installer-image-castle.uImage build/pre2-p103ueu-wr-2.0.0/webOS/./nova-installer-image-roadrunner.uImage

Does this mean:
make -f Makefile.new DEVICE=pre2 CUSTOM_DEVICETYPE=castle CUSTOM_BOOTLOADER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs/boot/boot.bin CUSTOM_INSTALLER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/webOS/nova-installer-image-castle.uImage CUSTOM_KERNEL_DIR=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs clobber-wr all-wr

should be changed to:
make -f Makefile.new DEVICE=pre2 CUSTOM_DEVICETYPE=castle CUSTOM_BOOTLOADER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs/boot/boot.bin CUSTOM_INSTALLER=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/webOS/nova-installer-image-roadrunner.uImage CUSTOM_KERNEL_DIR=/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs clobber-wr all-wr

Hmm no. It does not mean that.

[ashi]

Originally Posted by destinal

I also get the cannot reset error -- this is the error in the java stderr

INFO: exiting handleFailCase()
java.io.FileNotFoundException: nova-installer-image-castle.uImage (No such file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.<init>(FileInputStream.java:106)
at java.io.FileInputStream.<init>(FileInputStream.java:66)
at com.palm.nova.installer.core.InstallerModel.getInputStream(InstallerModel.java:112)
at com.palm.nova.installer.core.InstallerModel.getRamDiskFileStream(InstallerModel.java:241)
at com.palm.nova.installer.core.stages.RamdiskLoadingStage.run(RamdiskLoadingStage.java:46)
at com.palm.nova.installer.core.FlasherThread.run(FlasherThread.java:245)

Yup, I am getting the same. I had some errors running unpack-doctor until I ran as root. I tried becoming root and clobbering and re-doing the make and the doctor, but I still got the same error.

Something is off... but I must get some lunch. Hopefully Rod will enlighten us soon.

[NuttyBunny]

I have the Doctor, just a question:
Right now it won't boot, it won't install and it won't work at all, leaving my Pre in a state in which I'll would have to use another Doctor to restore it, am I right?

[MudShark22]

I think Rod's warning is implying that a doctor may not restore your phone if everything heads south. So YMMV.

[rwhitby]

Originally Posted by NuttyBunny

I have the Doctor, just a question:
Right now it won't boot, it won't install and it won't work at all, leaving my Pre in a state in which I'll would have to use another Doctor to restore it, am I right?

For me, it leaves the device in a kernel reboot loop which can easily be recovered from with a recovery mode doctor. But I'm using a Sprint Pre for testing, so I have no way of verifying whether the radio has been destroyed or not.

-- Rod

[GuyFromNam]

Pre Plus users have flashed their devices with Pre meta-doctored firmware without disabling the modem install.

[rwhitby]

Originally Posted by GuyFromNam

cp: cannot stat `/srv/doctors/unpacked/webosdoctorp100ueu-wr-1.4.5/rootfs/boot/boot.bin': No such file or directory
boot under rootfs doesn't unpack?

EDIT: OK, so the boot dir wouldn't extract to rootfs. I extracted the bootie binary manually, copied it to the right location.
I get an Unable to reset your phone.

Are you using the latest unpack-doctor script?

-- Rod

[rwhitby]

Originally Posted by ashi

Yup, I am getting the same. I had some errors running unpack-doctor until I ran as root. I tried becoming root and clobbering and re-doing the make and the doctor, but I still got the same error.

Something is off... but I must get some lunch. Hopefully Rod will enlighten us soon.

Try now with the updated Makefile. Makefile.new is removed.

-- Rod

[GuyFromNam]

Originally Posted by rwhitby

Are you using the latest unpack-doctor script?

-- Rod

Hmmm not sure. I think I did a git pull.
Midnight here. Will try again tomorrow when this thread is at page 200.

Question: if and when this FDoctor results in a bootable phone, it will run at stock speed and be slower than a stock Pre on 145 right?

[rwhitby]

Originally Posted by GuyFromNam

Hmmm not sure. I think I did a git pull.
Midnight here. Will try again tomorrow when this thread is at page 200.

Question: if and when this FDoctor results in a bootable phone, it will run at stock speed and be slower than a stock Pre on 145 right?

The procedure is obtuse, so I doubt we'll get more than 2 pages in that time.

You'll be able to install UberKernel on it if/when it works.

-- Rod

[NuttyBunny]

Originally Posted by rwhitby

The procedure is obtuse, so I doubt we'll get more than 2 pages in that time.

You'll be able to install UberKernel on it if/when it works.

-- Rod

We don't even know if it will(would) run faster or slower than a stock 500Mhz Pre.

[ashi]

Thanks Rod, got it flashed. Here is my klog:

root@oreeegon:/srv/tools/meta-doctor# novacom get file://klog
******************************************
* Welcome to bootie!
* Version: 191.4
******************************************
cid: 0xcfaf5cdb 0x4d354b06 0x4d473030 0x15000043
mfg id: 0x15
oem id: 0x0
name: 'CMG00'
rev: 0x4d
sn: 0x354b06cf
date: 5.2009
token section is 4096 bytes long
bootargs = 6
p=100 ca=1160000
autobooting with 'fsboot' command
loading file '/boot/uImage' to address 0x81000000
parse_uimage:229: uimage 0x81000000
welcome to klog, buffer at af840018, length 262116
<6>i2c_omap i2c_omap.1: bus 1 rev3.12 at 400 kHz
<6>i2c_omap i2c_omap.2: bus 2 rev3.12 at 100 kHz
<6>i2c_omap i2c_omap.3: bus 3 rev3.12 at 400 kHz
<6>TWL4030: TRY attach Slave TWL4030-ID0 on Adapter OMAP I2C adapter [1]
<6>TWL4030: TRY attach Slave TWL4030-ID1 on Adapter OMAP I2C adapter [1]
<6>TWL4030: TRY attach Slave TWL4030-ID2 on Adapter OMAP I2C adapter [1]
<6>TWL4030: TRY attach Slave TWL4030-ID3 on Adapter OMAP I2C adapter [1]
<3>i2c_omap i2c_omap.1: controller timed out
<3>twl4030: Unable to register interrupt subsystem[-110][888]
<6>TWL4030: Driver registration complete.
<3>i2c_omap i2c_omap.1: controller timed out
<3>twl4030_usb: i2c read failed, line 706
<7>can't get IRQ 373, err -22
<3>can't get IRQ 371, err -22
<5>SCSI subsystem initialized
<6>usbcore: registered new interface driver usbfs
<6>usbcore: registered new interface driver hub
<6>usbcore: registered new device driver usb
<6>musb_hdrc: version 6.0/dbg, musb-dma, peripheral, debug=1
<1>Unable to handle kernel NULL pointer dereference at virtual address 00000000
<1>pgd = a0004000
<1>[00000000] *pgd=00000000
Internal error: Oops: 5 [#1]
Modules linked in:
CPU: 0 Not tainted (2.6.24-palm-joplin-3430 #1)
PC is at musb_platform_init+0x4c/0x110
LR is at prcm_clock_control+0x218/0x240
pc : [<a00237fc>] lr : [<a003f9d4>] psr: 60000013
sp : ae013d98 ip : 00000010 fp : ae013dbc
r10: 00000000 r9 : a04883d8 r8 : ae012000
r7 : a04a0ff8 r6 : ae0e4000 r5 : d80ab000 r4 : 00000000
r3 : d8004a00 r2 : 00000000 r1 : 43fffe01 r0 : 00000000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
Control: 00c5387f Table: 80004018 DAC: 00000017
Process swapper (pid: 1, stack limit = 0xae0122d8)
Stack: (0xae013d98 to 0xae014000)
3d80: a04883d8 00000000
3da0: ae013dbc 00000000 a0489fd8 ae0e4000 ae013e8c ae013dc0 a002309c a00237bc
3dc0: a01a76a8 a01a7434 a04883e0 0000005c af904000 ae0e4074 a0376da4 a008225c
3de0: ae013e50 00000000 ae0a37b0 ae03a630 ae013e0c ae013e00 a0376e0c a0376cfc
3e00: ae013e4c ae013e10 a00f7a3c a0376e08 a00f7504 a01ab5a4 ae013e50 ae0a37b0
3e20: ae013e4c ae013e30 a00f775c ae013e50 00000000 ae0a37b0 ae03a630 ae012000
3e40: ae013e7c ae013e50 a00f8534 a00f7a2c ae03a630 00000000 00000000 00000001
3e60: a04883e0 a04883e0 a04883e0 a04aa344 a04a0ff8 ae012000 00000000 00000000
3e80: ae013e9c ae013e90 a01e9bf8 a0022ef0 ae013ebc ae013ea0 a01e85c8 a01e9be4
3ea0: a04883e0 a0488484 a04aa344 a04a0ff8 ae013ed4 ae013ec0 a01e86f4 a01e84f8
3ec0: 00000000 a01e8678 ae013f04 ae013ed8 a01e7e18 a01e8684 00000000 a04a1090
3ee0: a04a1090 a0488428 a01a8d68 00000000 a04aa344 a04aa34c ae013f14 ae013f08
3f00: a01e840c a01e7ddc ae013f34 ae013f18 a01e7684 a01e83f8 a04aa344 a04aa328
3f20: 00000000 00000000 ae013f4c ae013f38 a01e88dc a01e7620 a04aa328 a04aa328
3f40: ae013f5c ae013f50 a01e9f10 a01e8868 ae013f74 ae013f60 a01e9f44 a01e9eb0
3f60: a04aa328 a002d6fc ae013f8c ae013f78 a0022d98 a01e9f38 00000000 a002d6fc
3f80: ae013ff4 ae013f90 a00084b4 a0022d78 ae013fac ae013fa0 a0062210 a00620b0
3fa0: 00000001 ae013fb0 a0033fc4 a0062204 00000000 00000000 a00083d0 a0067fc4
3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
3fe0: 00000000 00000000 00000000 ae013ff8 a0067fc4 a00083dc 00000000 00000000
Backtrace:
[<a00237b0>] (musb_platform_init+0x0/0x110) from [<a002309c>] (musb_probe+0x1b8/0x8cc)
r6:ae0e4000 r5:a0489fd8 r4:00000000
[<a0022ee4>] (musb_probe+0x0/0x8cc) from [<a01e9bf8>] (platform_drv_probe+0x20/0x24)
[<a01e9bd8>] (platform_drv_probe+0x0/0x24) from [<a01e85c8>] (driver_probe_device+0xdc/0x18c)
[<a01e84ec>] (driver_probe_device+0x0/0x18c) from [<a01e86f4>] (__driver_attach+0x7c/0xd4)
r7:a04a0ff8 r6:a04aa344 r5:a0488484 r4:a04883e0
[<a01e8678>] (__driver_attach+0x0/0xd4) from [<a01e7e18>] (bus_for_each_dev+0x48/0x7c)
r5:a01e8678 r4:00000000
[<a01e7dd0>] (bus_for_each_dev+0x0/0x7c) from [<a01e840c>] (driver_attach+0x20/0x28)
r6:a04aa34c r5:a04aa344 r4:00000000
[<a01e83ec>] (driver_attach+0x0/0x28) from [<a01e7684>] (bus_add_driver+0x70/0x1bc)
[<a01e7614>] (bus_add_driver+0x0/0x1bc) from [<a01e88dc>] (driver_register+0x80/0x88)
r7:00000000 r6:00000000 r5:a04aa328 r4:a04aa344
[<a01e885c>] (driver_register+0x0/0x88) from [<a01e9f10>] (platform_driver_register+0x6c/0x88)
r5:a04aa328 r4:a04aa328
[<a01e9ea4>] (platform_driver_register+0x0/0x88) from [<a01e9f44>] (platform_driver_probe+0x18/0x64)
[<a01e9f2c>] (platform_driver_probe+0x0/0x64) from [<a0022d98>] (musb_init+0x2c/0x40)
r5:a002d6fc r4:a04aa328
[<a0022d6c>] (musb_init+0x0/0x40) from [<a00084b4>] (kernel_init+0xe4/0x2b8)
r5:a002d6fc r4:00000000
[<a00083d0>] (kernel_init+0x0/0x2b8) from [<a0067fc4>] (do_exit+0x0/0x720)
Code: e59f50c0 e7c1309f e5c63b50 eb00b396 (e8b4000f)
<0>Kernel panic - not syncing: Fatal exception
<0>Rebooting in 15 seconds..