[G1 Android Development] lbcoder:
Another theory. And its a good one!

I think I have an idea about how to go from 0.95.x000->1.33.2005 directly, without chance of bricking, using recovery.

I WILL NOT make any guarantees about this, it is a THEORY that needs to be confirmed (experiment to confirm outlined at bottom).

The engineering SPLs are designed to jump into fastboot mode in the event that recovery fails. The brick is created when the recovery *doesn't fail*, but doesn't succeed. It is kind of a limbo mode.

The solution is to MAKE SURE that the recovery fails!

And this can be accomplished by writing 0's to the recovery partition as the last step before rebooting into update-hboot/radio mode.

The process of writing the hboot/radio image via fastboot goes like this:

1) First you go into recovery mode and select to write the update.zip.

* In this step, the cache partition is set up with the image found in the update.zip and the misc partition is set to update-hboot/radio.

2) Second, it reboots, reads the misc partition, and goes into update-hboot/radio mode

* In this step, the cache partition contents are copied over to the hboot/radio partitions, and the misc partition is updated to boot-recovery.

3) Third, it reboots, reads the misc partition, and goes into boot-recovery. If the SPL believes that the recovery has booted, but it HASN'T, then you have yourself a brick. If the SPL knows that the recovery has NOT booted, then it *should* go into fastboot. Step 3 is the big ugly problem!

So the theory here is that if after step 1 is completed, you DESTROY the contents of the recovery partition, then in step 3, recovery will NOT boot, and you end up landing in FASTBOOT.

When in FASTBOOT, you can do your thing!

EDIT:

A point of possible failure in the above is the possibility that the act of nuking the recovery partition could fail after actually setting up the update. One could still potentially brick from that possibility (however unlikely it actually is).

One very nice and important thing to be aware of... if you are starting with any kind of an engineering spl, including the pseudo-engineering SPL 0.95.3000, then you don't need to actually have anything IN the recovery partition in order to boot recovery. Fastboot has a really slick mode where it allows you to "fastboot boot somebootable.img", and that includes a recovery image.

I would like to suggest that the FIRST step at safely changing the radio/hboot image on a phone is to NUKE THE RECOVERY. If you have an engineering SPL, you can get back by using "fastboot boot" (or by flashing a recovery image, but this is actually pointless), and if you have a standard SPL, you can, of course, run the DREAIMG.NBH to recovery from a nuked recovery.

EDIT 2:

I'm not certain that a recovery partition can actually be wiped from within recovery. There is a possibility that one could add a "format RECOVERY:" into an hboot/radio update-script (ABOVE the "write_radio_image" line) and that this would completely take care of bricks. Maybe not though -- it might not allow that. If it doesn't, then boot into fastboot and run a "fastboot erase recovery", then a "fastboot boot recovery.img", then run the hboot/radio update.zip, do the thing, and end up back in fastboot.

Note: Without any kind of risk, anybody can TRY running an update.zip containing this update-script:

assert compatible_with("0.2") == "true"
assert getprop("ro.product.device") == "dream" || getprop("ro.build.product") == "dream"
show_progress 0.5 0
format RECOVERY:
show_progress 0.5 10

If rebooting after this with the HOME key pressed lands you in FASTBOOT, then the following changes should be made to ALL radio/hboot update.zip update-script files:

From this:

assert compatible_with("0.2") == "true"
assert getprop("ro.product.device") == "dream" || getprop("ro.build.product") == "dream"
show_progress 0.5 0
write_radio_image PACKAGE:radio.img
show_progress 0.5 10

To THIS:

assert compatible_with("0.2") == "true"
assert getprop("ro.product.device") == "dream" || getprop("ro.build.product") == "dream"
show_progress 0.5 0
[b]format RECOVERY:[/b]
write_radio_image PACKAGE:radio.img
show_progress 0.5 10

THE EXPERIMENT:

To confirm that this works as expected, someone with a jtag'ed mainboard (that means you ezterry) will need to install a 1.x radio, 0.95.x000 SPL, and some recovery image. Boot into the recovery, write in 1.33.2005, wipe the recovery partition, reboot. If it goes into fastboot, then we have a safe procedure. If it doesn't, then back to the drawing board.

Note: though I can't confirm it, I *believe* that booting into fastboot mode will clear the misc partition without further intervention, which means that even if an invalid recovery partition is written in fastboot, it should not end up a brick.