yashsingh1/xdaforums huggingface dataset:
[Motorola Photon 4G] phatninja55:
I almost lost all hope too. Was thinking about getting a galaxy s2.
[Motorola Photon 4G] yumm91:
Yeah.. Me too.. Currently i am using desire hd borrowed from my brother and i started to like it due to active community even though it is far older than photon 4g..
[Motorola Photon 4G] tdhite:
Well, you know what? I *might* have actually achieved a kernel load. Why do I say *might*? Well, all I'm loading is the existing kernel stripped from mmcblk0p11 and the initrd image from the same. I use the ATAGS we produced in this thread (and in fact, I think we can read them from mmcblk0p11 after a bit of playing with the loading code in the kexec/arch/arm code.

Anyway -- I get the reboot sequence quite quickly (near immediate) -- not after a wait period (as if watchdog). Dunno if it's all good quite yet, but this is very different than all prior boots for me.

So, if someone else wants to gin up a new initrd for me (I'll do it later this week if no one signs up), I can try to load that and we'll see where we land. On the other hand, you can too if you want, I can upload my binaries. With all that said, I'm on a locked/OTA set and can test at will now -- not seeing any sort of issues.

Let's see where the week lands.
[Motorola Photon 4G] phatninja55:
I got tired of motorola, so i bought a new phone.

I plan on keeping this phone as a backup. I hope ill get the chance to try a kexec build of cm9 or cm10.1.

Now I wait for my new phone to come to me.
[Motorola Photon 4G] ch.ch1:
What are the chances the Photon bootloader should get unlocked?

Would like to get something out of my paperwight, like Ubuntu or Firefox to play around
[Motorola Photon 4G] Productzer01:
0.01%
[Motorola Photon 4G] phatninja55:
0%

If your thinking kexec will unlock the bootloader you are wrong.

Kexec is a bypass to load a differnt kernel.
[Motorola Photon 4G] Productzer01:
I figured he was asking if Motorola releases a leak for unlocking the bootloader
[Motorola Photon 4G] yumm91:
Motorola probably trashed all the files related to photon 4g already.. Pretty sure they all have forgotten this device.. My brother got this phone, isw11m at japan for 8000yen.. Approximately 80 dolar.. Very cheap
[Motorola Photon 4G] krrishvaid:
If someone could explain where has the development reached and where it has to reach....

http://i.imgur.com/dM6jtB7.png

Sent from my Beast
[Motorola Photon 4G] Koopa777:
Any progress? I am just waiting for the LG G2 at this point....
[Motorola Photon 4G] tdhite:
I have to say, I'm a pretty good hacker, but this is frustrating.

Where I am is at a discrepancy between what some code from the kexec tools believes is the proper base for the kernel sys_call_table and what the kernel build (System.map) says. In neither case is the deal really truly the source of truth. The kernel build is from the sources provided by Motorola, and thereafter as they document. Whether what they sent is indeed what went into the phone is not something of which I can guarantee.

With the said, here's the printk's I do that shows the discrepancy -- the first is a look through kernel memory for the sys_close function and backing off that function to the sys_call_table beginning. Effectivelly, where some pointer P in kernel space has that P[__NR_close] == sys_close (from the module, as it should be in the same space).

Here's what happens (first line, the location via the above comment, the second is the value stuffed from the System.map file (kernel build output).

<4>[ 7168.060507] Found system call table at c05015c0

<4>[ 7168.060533] Still, using c003d364

Both reboot hard, I'm stumped for a bit. I'm going to e-mail the kexec folks because this can't be -- one or the other is lying, or both are (meaning the kexec code is wrong, or the kernel build info from Motorola is wrong).

Sigh, we all knew this wasn't easy, but I want to crack this nut -- the phone is too interesting to me. Getting all that I have done with Webtop, multiple chroot'ed Debian squeeze 'instances' running, DNS caching app I wrote, and a tinyproxy server to boot -- I have too much to lose by going to another phone.
[Motorola Photon 4G] tdhite:
bump -- don't want the thread to die -- I've just been busy with work. Settled down now for a bit.
[Motorola Photon 4G] roushan84:
Same goes with us too.. We definately dont want this thread to die... love my MoPho
[Motorola Photon 4G] The Solutor:
I apreciate the work done here, but I remember that the same path was tried back in 2009/2010 for the Milestone (one) that, unlike its American cousin Droid 1,was locked.

If I'm not wrong a second kernel was successfully loaded, and the PDA part of the milestone was working perfectly wit it.

But any effort to reset the phone part to get it working too, was futile.
[Motorola Photon 4G] Chad The Pathfinder:
Dude, is there a donation buttoned somewhere? I know this project has pretty much stopped but I'd still like to buy you a coffee for all your hard work. Thanks!
[Motorola Photon 4G] carlosirai:
if this can work, will this a way to can port safestrap to photon?
[Motorola Photon 4G] phatninja55:
Back to the electrify. I may have hated most things about the s2, but the one thing i do miss is the custom roms.
[Motorola Photon 4G] Productzer01:
I got a cheap photon q and the radio is useless but I like having jelly bean so....wish I could somehow merge the photon q and original photon to get best of each phone
[Motorola Photon 4G] The Solutor:
I have both of them, and frankly I would like to have Gingerbread on Photon Q. :o

---------- Post added at 03:52 PM ---------- Previous post was at 03:36 PM ----------

OK, I was wrong.

Looks like the problem was solved, and on milestone one you can have ICS and JB even if the bootloader is still locked

http://xdaforums.com/showthread.php?t=1445209
[Motorola Photon 4G] tdhite:
Atags loaded, initrd loaded (finally) ...

All,

Just a quick message. After some work, I got the atags provided from earlier posts loaded. As well, I modified an initrd image and loaded that:

data/local/tmp/kexec # ./kexec -l mmcblk0p11.img-kernel --initrd=newinitrd.gz
Opening atags file: atags
Copying tag 8 bytes for tag 1413545985.
Skipping ATAG_INITRD2 1413611525.
Copying tag 16 bytes for tag 1413545990.
Skipping ATAG_CMDLINE 1413545993.
Copying tag 24 bytes for tag 1090521089.
Adding initrd...
/data/local/tmp/kexec # ./kexec -e

Alas, on the kexec -e, it either hangs, or reboots hard (meaning clean reboot). I know the latter because the modified initrd will drop breadcrumbs for me to see it executed.

What I think now is that the reboot vector in kexec_load.ko is simply incorrect so when kexec execs the new kernel, it flies off into obvlivion. I'll review that but it's calculated from the exact build specs from Motorola (from the download sites and instructions). How that's incorrect seems strange, but I see no other reason it's not working now. Just has to be reboot vector mismatch, or maybe someone can throw something out there that give me a hint (almost anything will work, just have to trigger something in my brain that I'm not considering).
[Motorola Photon 4G] tdhite:
Wait a minute ..... on a whim -- when I rebooted this time the screen stayed lit, but I *thought* the whole thing was dead. So I disconnected and reconnected the USB cable:

[20944.753718] scsi7 : usb-storage 5-6:1.0

[20945.865184] usb 5-6: reset high-speed USB device number 8 using ehci-pci

[20946.098155] usb 5-6: reset high-speed USB device number 8 using ehci-pci

[20946.333082] usb 5-6: reset high-speed USB device number 8 using ehci-pci

[20946.566215] usb 5-6: reset high-speed USB device number 8 using ehci-pci

[21013.041273] usb 5-6: USB disconnect, device number 8

[21033.188085] usb 5-6: new high-speed USB device number 9 using ehci-pci

[21033.321737] usb-storage 5-6:1.0: USB Mass Storage device detected

[21033.321967] scsi8 : usb-storage 5-6:1.0

[21034.433082] usb 5-6: reset high-speed USB device number 9 using ehci-pci

[21034.666169] usb 5-6: reset high-speed USB device number 9 using ehci-pci

[21034.899069] usb 5-6: reset high-speed USB device number 9 using ehci-pci

[21035.134110] usb 5-6: reset high-speed USB device number 9 using ehci-pci

Given the usb-storage was *recognized*, does that not tell us the new kernel is actually running, just not starting up zygote??? It should have, but hey -- maybe that's progress. I'm not a USB genius, so someone might have some input here?
[Motorola Photon 4G] Jc_master:
Is this still going?

Is this still going? I got really exited when i first saw the post but it has been over a month since the last update, i know its difficult to do this but you guys are awesome, i read all the posts in this thread and even though i just understanded the 2% i got really exited to see how you found some of the things and how you tested them and found more things, anyways i hope this is not dead because i would love to see some ics or jb on my photon, thanks for the effort and keep up the good work
[Motorola Photon 4G] tdhite:
Just have to hang in. I plan to get back to it over the holidays. Frustrating as it is, still like this phone and can't find a compelling reason to switch. No promises still, other than I still will work as time permits.
[Motorola Photon 4G] Jc_master:
Thanks

Well thank for the reply, i'm not pushing you or something i;m really exited to hear that, well i'm going to be like extra extra patience i hope that you figure this out and even if you can't or something that would be totally ok, it not like you have an obligation, well thanks anyway
[Motorola Photon 4G] tdhite:
no worries -- I might brick the phone along the way, who knows. I'll try a few more tricks with the kexec module, but I'm honestly thinking the kernel sources Motorola put on the download site is simply not the kernel we have. Can't be sure, but the vector simply is not lining up for the kexec jump.
[Motorola Photon 4G] ciriux:
Thank you for your persistence

thanks for all ... I think you're the last hope for this great phone that has nothing to envy the SII and LG shot to oblivion ... thanks again ... :good:
[Motorola Photon 4G] tdhite:
Giving it some shots over the week. If any of you reading this have an Arm expert, could use the help reviewing the bootstrap code.
[Motorola Photon 4G] tdhite:
Ok folks. I now definitely need an arm expert. I tried over 400 variations on the kexec reboot vector. Identical results, which means I probably did get the right vector, but the basic arm assembly is wrong setting up the reboot. I do not know arm code so well, but will start reading in it. Interesting I've not yet trashed the phone, tells me we can really mess with the in memory kernel so long as it doesn't go writing over partitions

Sigh, failure is not one of my string suits, though I'm feeling it here. I have an HTC One now, so don't worry too much if I trash my photon. My wife's has been relegated to this as well.
[Motorola Photon 4G] kingtiger01:
I really wish you wouldnt give up on this, The Photon is a amazing phone.
[Motorola Photon 4G] phatninja55:
Yeah i feel that all yhe problems i have with this phone could be fixed with a custom rom.
[Motorola Photon 4G] tdhite:
Not giving up. Just stumped about the setup code. It's pure arm assembly, something with which in not knowledgeable right now. This is a good phone, but the makers want it gone, that's for sure.
[Motorola Photon 4G] pradeeppk:
Can you please compare the 2nd int .apk of Motorola defy which is used to load custom ROM with custom kernel.

They are now reach 4.4.2. And it run smoothly in my defy, its hardware is far below from photon
[Motorola Photon 4G] tdhite:
Closing ...

All,

I am so sorry -- my attempts to get a working kexec without hard reboots are futile for some reason. I'm sure it's within the ARM code, deep somewhere that I am not sufficiently familiar and requests for help there go effectively unanswered. As this phone, frankly, has been abandoned by Motorola, then Google, and likely now Lenovo (new Motorola owner), I just don't have the time to invest any more.

I'm happy to help anyone that wants to go forward by sharing up the bitbucket repo with my build scripts, etc. But before you begin -- recognize you are, by definition, totally risking your phone with each and every reboot try.

Mods -- please close this thread until further notice, which likely will never come, we'll see.

Sorry, all. :(
[Motorola Photon 4G] ganeshshas:
:(

It's very hard days for our Photon
[Motorola Photon 4G] Koopa777:
For what it's worth, NVIDIA screwed us over the most. They never released source or drivers for the Tegra 2 board, Motorola unfortunately had no choice but to drop it. Other phones with T2 got ICS but at a heavy cost of stability. Even HTC recently dropped support for the One X and One X+, citing lack of drivers from NVIDIA.

Anyway, thank you for your work. You were the only one crazy enough to try. [emoji14]
[Motorola Photon 4G] fuzzy7k:
That is odd. nvidia is great about providing closed source drivers for the desktop. Plus, they are the first mobile company that I know of to officially start producing an open source driver. I wonder if they just shifted their resources from closed source to open source. I'm not counting them out yet, an open source driver totally trumps a few years of no updates.
[Motorola Photon 4G] phatninja55:
I think, the electrify mounts the sdcard as /sd-ext and internal as /sdcard.
[Motorola Photon 4G] tdhite:
Ok, folks, I generated a kexec_load.ko module for the Electrify. For the record, the module indeed has a different sys_call_table vector than does the Photon (not unlikely). I built only the 4.5.1A_SUN_USC_19.0 version of the sources, and interestingly, the version magic *does not* match what the folks previously suggested they had after running modinfo. Why we have disparate values is somewhat disturbing, but let's see how this goes with the build pursuant to Motorola's instructions.

First, the requirements we'll always follow:

IF YOU INSTALL THE MODULE, YOU ASSUME ALL THE RISK OF HARM IT MAY CAUSE, IN WHATEVER FORM THAT HARM TAKES. THE MODULE IS A KERNEL LEVEL MODULE AND THEREFORE ANY ERROR IT CAUSES COULD DESTROY YOUR PHONE, BRICK IT, AND THE DAMAGE COULD BE WORSE AND I HAVE NO WAY TO KNOW WHAT IT MIGHT DO. THEREFORE, YOU ASSUME ALL RISK IN USING THE MODULE FOR ANY PURPOSE AND IT IS SUPPLIED "AS IS" AND WITH NO WARRANTIES, EXPRESS OR IMPLIED, NOR ANY WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, NOR THAT IT WORKS AT ALL.

In short, you agree, completely and utterly, that you cannot hold me responsible for what happens to your phone even if the module actually and proximately causes the harm.

The module specifically for the Electrify is here: https://www.dropbox.com/sh/nra0gpvmdiz2rur/h5hVJkmvRi

As I said, the version magic bugs me -- it says:

filename: kexec_load.ko

license: GPL

depends:

vermagic: 2.6.32.9 SMP preempt mod_unload modversions ARMv7

If you choose to try the load, let me know how it goes and I'll work to fixup probs. We'll work it out ...
[Motorola Photon 4G] phatninja55:
Good news:

# lsmod

lsmod

Module Size Used by

kexec_load 21792 0 [permanent]

vpnclient 66860 1

Will reboot, and power off. Then tell you whats wrong/right.

Worked, as far as I know. ;)

Didn't show up on reboot or power off. Didn't hang on either.
[Motorola Photon 4G] krrishvaid:
Thats great.......thumbs up for the development and success
[Motorola Photon 4G] LightingZ:
Tested the Electrify one it worked!

So we've got module whats next?
[Motorola Photon 4G] tdhite:
What's next is fixing the segfault in kexec-tools -- it'll take a few days, but thanks for testing.
[Motorola Photon 4G] cmbinf:
Just wanted to chime-in and confirm on the Electrify(MB853), kexec result...

# lsmod

Module Size Used by

kexec_load 21792 0 [permanent]

vpnclient 66860 1

#

Edit - Question for you tdhite, thought I read somewhere you're using ubuntu 12.04. I haven't used it in awhile and having a little trouble remembering how to pull an system dump on the electrify. Can you give me the terminal comand? I can't remember. Thanks.

Edit 2 - Found what I was looking for Here: http://xdaforums.com/showthread.php?t=1759997
[Motorola Photon 4G] twaffle:
It might also be possible to have the existing kexec module, without kexec_tools, to restart *the existing kernel*, however, modifying the kernel command line, allowing initrd to be mounted from someplace else.

I was actually thinking out loud on a couple of ideas. Since kexec modifies the syscall table......

init.c in its main loop calls:

nr = poll(ufds, 3, timeout);

Can you derive the PID of a calling process from a kernel module? It'd be an easier way to hijack, if it is possible, than 2nd-init. Basically, if poll was called by PID 1, block it from ever returning, and exec a new init.

Like I said, this is all more thinking out loud. It did make me ask myself, "Why CAN'T you screw with PID 1?". I mean, it's just a kernel task that launches it. It can't return, but isn't there any way a kernel module can stop it from actually doing anything, and hold it up in kernel land somehow?
[Motorola Photon 4G] tdhite:
A kernel module can find the calling process id the process calls the kernel. The kernel is just executing on behalf of the process in that case.

I think it's reasonable to consider a hijack like that. If you want to try it, I can make you a starter module, lemme know.
[Motorola Photon 4G] tdhite:
Oh, and if you read back a ways in the other thread, I was killing init, not just halting it. I see no problem with that since the there never is a chroot that init tries.
[Motorola Photon 4G] phatninja55:
I thought that killing init causes kernel panics?
[Motorola Photon 4G] tdhite:
Pretty much all I got was a lot of phone hanging, as I noted. But, as the kernel starts the process, it seems plausible to replace it when running in the context of the kernel since cleanup can occur prior to exiting the module call. Not sure, just things to try.
[Motorola Photon 4G] tdhite:
"prWas working on kexec-tools and took a break to kill init to watch. To kill it, you first must poke the process table to set init's flags to allow killing it. The hang comes from the reaper trying to re-parent all the other processes, but no such process exists -- init was stopped.

To fix that, we have to kill all processes and clear any watchdogs that would try to restart them before we can kill and restart init. Not easy, but still a valid rat hole to go down.
[Motorola Photon 4G] twaffle:
I looked thru the code, and I think this is entirely possible. If the watchdog is the one I think it is, it doesn't actually restart init, it soft resets the kernel itself. However, if this *IS* what is doing on, it's entirely possible to stop the watchdog monitoring.

If you're already in the land of iterating thru init_task, you *should* be able to lock the kernel, and flag each one of the entries and make them all die in one fell swoop (I think).

Even in that case, if you started a new init, it should be able to feed the watchdog itself, so it might not be a big issue to leave the watchdogs enabled. I'm pretty sure it is just looking for something to feed /dev/watchdog. I'm not sure what is actually performing that function....

** Leaving what I typed, but I went looking around **

Ok, this looks to be MUCH easier then I expected!! The panic kicks in here:

http://lxr.linux.no/linux+v2.6.32/kernel/exit.c#L717

Looking around, I wonder if init_pid_ns can be manipulated to 'trick' the kernel into losing track of the init process, creating a new one, and saying 'Yea, that's pid 0, honest!'.

Your doing an awesome job playing around in the trenches, I wish I had more time this week, but the lunch time web searches are all Ive had time to do. That, and I while I have the code downloaded, I don't have enough HD space on my laptop to BUILD it. X-D Need to free some up and increase the virtual box partition size.
[Motorola Photon 4G] sonurajput56:
Ok.. devs.....

Now plz let me know the steps .. for update custom roms in moto photon.. very eager ..
[Motorola Photon 4G] tdhite:
Hang a bit. Just getting kexec tools running. Not working yet, hopefully tomorrow -- copies that try a reboot into the existing kernel.
[Motorola Photon 4G] tdhite:
Developers: would like to see if you'd check out the kexec executable. That should have both the module and kexec executable.

That's Photon only, for now. I'll build an Electrify version a little later (I doubt it's different, but because kexec includes header code from the kernel, I find it reasonable to hang just to assure it's no different).

You know the drill, you brick your phone using this, you assume total risk of any harms, including consequential or incidental.

Load the kernel module, and give kexec a whack. It's certainly not done, but at least it runs. To be sure, it will still segfault on exit, but that appears to be an error in the NDK when the 'die' function is called. That just prints things and calls exit(1). The NDK doesn't work like that, but to change how 'die' operates it right now is a ton of work -- not going there yet.
[Motorola Photon 4G] phatninja55:
Every command I try it segfualts. On the electrify, wasn't expecting segfaults but wasn't expecting it to work either. =P

I once tried kexec for another moto phone and it attempted to load the kernel, but didn't. So idk whats wrong here.
[Motorola Photon 4G] Slender Troll:
Just wanted to say KEEP UP THE GOOD WORK YOU GUYS!!!!
[Motorola Photon 4G] LightingZ:
You are a god.

but i have a question i have an au kiddi photon but i flashed Electrify SBF can i use what you posted or may i just wait for electrify?
[Motorola Photon 4G] tdhite:
More to the point is what kernel you're using. The module is quite specific to a kernel right now, hopefully one day we'll add some intelligence so as to allow run-time detection of the relevant info (namely the sys_call_table).

So, what kernel do you have?
[Motorola Photon 4G] LightingZ:
electrify one
[Motorola Photon 4G] phatninja55:
He means your build version. If its USC-19. 0 then the kexec module he built for the electrify will work.
[Motorola Photon 4G] LightingZ:
Yes it is USC-19.0
[Motorola Photon 4G] tdhite:
Hang on a bit. The kexec tool build is broken. It's failing to properly handle the command line arguments. Working on it, but darned NDK is a B regarding startup code.
[Motorola Photon 4G] tdhite:
Update: I dug through the debugging last night, and the issue with kexec-tools running properly (at least to setup a kernel, minimally) is the NDK is not adding the correct argc/argv handling for the main function. At least not in the NDK used for building the Photon kernel and build. The tricks are deep in the build process of all the C apps and, generally, the Android.mk files pull in certain assembly files based on the executable type (shared lib, static link, etc.).

In our case, kexec-tools is *not* an Android project, so obviously it doesn't dream up which startup object to link (crtbegin.o, et al). I'm just letting folks out there know I'll figure this out over the weekend, but if anyone has actually built a running command line app that actually deals with command line arguments (as does kexec-tools) with the NDK but *not* with an Android.mk (rather a normal makefile), I'd love to get some pointers before spending a couple days unwinding the NDK build process.