Handhelds.org - Open source for handheld devices

UserPreferences

HpIpaqH2200LAB

Linux in flash, and LAB (Linux As Bootloader)

  1. Back up PocketPC and the 2nd-stage bootloader
  2. Replace PocketPC 2nd-stage bootloader with LAB
  3. Using internal flash for your rootfs (optional)
    1. Method 1: Flash a rootfs to internal flash using LAB (serial cable required)
    2. Method 2: Flash a rootfs to internal flash from linux
  4. Future LAB features

LAB stands for Linux As Bootloader. Its job is to load and execute kernels. The benefit of LAB is that we can leverage the power of Linux to make a more powerful bootloader than the stock bootloader. On h2200 we use it to boot from MMC/SD, CF, NFS, or even NFS-over-PPP-over-Bluetooth (if you really want to), plus erase and write to internal flash, copy files to filesystems over serial (like fixing a broken kernel), or download and boot a new kernel over serial.

The h2200 actually has three bootloaders:

  1. The 1st-stage bootloader: On power-up/reset, the first 16K of internal NAND flash (referred to here as the 1st-stage bootloader) is loaded and executed. It minimally initializes the iPAQ, and then loads either of the other two bootloaders depending on what buttons are pressed, or whether the 2nd-stage bootloader passes validity checks.

  2. The 2nd-stage bootloader: The 1st-stage bootloader loads 1.25M from flash and executes it. On a stock h2200, this code loads and starts PocketPC.

  3. The rescue bootloader: If Contacts-Power-Reset is pressed when the 1st-stage bootloader starts, it loads and executes the rescue bootloader (112K). The rescue bootloader can save and restore the contents of internal flash to and from CF.

To run Linux from flash instead of PocketPC, we merely replace the 2nd-stage bootloader with our own. It is possible to replace it with a zImage (as long as the zImage sets r1 to the proper machine type for h2200). Note that as long as we don't touch the 1st-stage or rescue bootloaders, there is virtually no risk of bricking the iPAQ, as we can always restore Linux or PocketPC from a CF card.

This page explains how to replace the stock 2nd-stage bootloader with LAB.

1. Back up PocketPC and the 2nd-stage bootloader

First let's make a backup.

  1. Back up all your PocketPC data using iPAQ Backup.

  2. Insert a CF card (> 32M) that you don't mind erasing. The rescue bootloader overwrites whatever is on the card, including any partition table and filesystems.

  3. Hook up a serial or USB cable. You'll use this to talk to the rescue bootloader using a terminal program like tip, minicom, or HyperTerminal. If you are using a USB cable under Windows then you might want to use [WWW]Multi-Port/USB TTY. In order for it to be able to communicate with the WCEUSBSH port you have to kill the wcescomm porcess.

  4. Press Contacts-Power-Reset to get into the rescue bootloader. The iPAQ's screen should display some text, and your terminal program should display something like: 

    Manufacture Code=EC
Device Code=75
SAMSUNG K9F5608U0A 32M NAND flash Memory found
dwROMTotalSize = 2000000
wTotalChip = 1


HTC Integrated Re-Flash Utility for bootloader Version:1.18d  GreatWall PVT ver 1.08
MainBoardID = 4
Built at: Mar 16 2003 11:05:12
Copyright (c) 1998-2002 High Tech Computer Corporation

Turbo Mode Frequency = 398 MHz
Run Mode Frequency = 398 MHz
Memory Frequency = 100 MHz
SDRAM Frequency = 100 MHz
Main=0x90036118
awID[0]= 90
awID[1]= 90
SanDisk SDCFB-32 HAD 2.13
Model number : SanDisk SDCFB-32
Firware revision : HAD 2.13
Max Cylinder : 490, Max Head : 4, Max Sector : 32, Total space : 31360 KB
Skip address transfer error: g_dwSkipLen=0

SER>

  5. Back up PocketPC by typing the following at the SER> or USB> prompt (If you need a password, like I did, it is: CPQHAMMER): 

    d2s
    This takes a few minutes. Then store this CF card away, or dd the first 33M somewhere safe; I've copied mine onto my hard disk. If you have a card reader on a linux system and the CF card is /dev/hda, insert the CF card into your card reader and do this: 
    dd if=/dev/hda of=pocketpc.rescue bs=1M count=33

  6. Back up the 2nd-stage bootloader by typing 

    d2s 28000 140000
    Note that this overwrites whatever was on the CF card before, including what was written in step 5! So either insert another CF card, or copy the contents of the card as described in the previous step before doing this step. Then back up the first 1.25M of the CF card; if your CF card on your linux host is /dev/hda, insert the CF card into your card reader and do this: 
    dd if=/dev/hda of=2ndstage.rescue bs=1K count=1280

2. Replace PocketPC 2nd-stage bootloader with LAB

Now we'll replace the 2nd-stage bootloader with LAB. We can do this using the rescue bootloader or from linux. We'll use the rescue bootloader.

Assuming that you have a card reader on /dev/hda in your host linux system (not the iPAQ):

  1. Get a LAB bootloader from [WWW]here. Note that this file is not a plain zImage; it must have the HTC header, or the rescue bootloader will not recognize it.

  2. Insert a CF card in the card reader and copy the LAB 2nd-stage bootloader to the card: 

    dd if=zImage-LAB-20060222.htc of=/dev/hda

  3. Insert the CF card in the h2200 and enter the rescue bootloader by pressing Contacts-Power-Reset. It should scan the CF card and prompt you on the iPAQ's screen to "Press Power to flash". Note that on some large CF cards the scan can take a while.

  4. Press the iPAQ's power button. The rescue bootloader will copy the LAB from CF to flash and verify the checksum. It may take a while, on 512Mb card it takes around an hour. A failed checksum is not necessarily bad; it may just mean that the correct checksum was not put in the header. This step should take 15-20 seconds.

  5. Reset the iPAQ. LAB should boot, showing its splash screen. If you're connected to the serial console, you should see LAB kernel messages as it boots, and then a command prompt. You may press a key to interrupt autobooting the target kernel.

Before booting root filesystem edit the 1st line of /etc/fstab so it should look like:

When LAB autoboots, it looks for the file /boot/labrun on the following devices in this order:

The rootfs must have a /boot/labrun file that loads the appropriate zImage and boots it with the right cmdline arguments. Here are some examples:

Add console=ttyS0,115200n8 to make the kernel use a serial console.

Note that if /boot/zImage is symlinked, it must be a relative symlink; e.g. it must be symlinked to something like zImage-2.6.13-hh1-20060104, not /boot/zImage-2.6.13-hh1-20060104. For example: 
# cd /mnt/boot
# ls -l
-rw-r--r-- 1 mreimer mreimer 856552 Jan  5 17:21 zImage-2.6.13-hh1+cvs20051221

# ln -s zImage-2.6.13-hh1+cvs20051221 zImage
# ls -l /mnt/boot
lrwxr-xr-x 1 mreimer mreimer     35 Jan 19 19:08 zImage -> zImage-2.6.13-hh1+cvs20051221
-rw-r--r-- 1 mreimer mreimer 856552 Jan  5 17:21 zImage-2.6.13-hh1+cvs20051221

Note that previous versions of LAB just looked for /boot/zImage, so if you're upgrading from an older version of LAB, you'll need to create an appropriate /boot/labrun.

3. Using internal flash for your rootfs (optional)

You can use the h2200's internal flash for your rootfs. Note that as long as you do not mistype /dev/mtd3 or erasemtd 3 below, there is virtually no risk of bricking your h2200. First back up PocketPC as described above, download a jffs2 image, and then use one of the following methods:

3.1. Method 1: Flash a rootfs to internal flash using LAB (serial cable required)

  1. Copy the jffs2 rootfs image to an ext2 filesystem on a CF or MMC/SD card - GPE can be found [WWW]here. This link doesn't work anymore!

  2. Boot into LAB.

  3. Mount the CF or MMC/SD card: 

        mount /dev/hda1 /mnt ext2 (for CF)
    mount /dev/mmcblk0p1 /mnt ext2 (for MMC/SD)

  4. Erase the internal flash: 

        erasemtd 3

  5. Write the rootfs to flash: 

        copy fs:/mnt/gpe-image.jffs2 nand:jffs2:3

  6. Unmount the card: 

        umount /mnt

  7. Reset your iPAQ and if your rootfs contains a proper /boot/labrun, it should load the kernel from the rootfs and boot it.

  8. If you use the GPE jffs2 package mentioned above, you can boot linux by typing the following into the lab boot promt: 

     mount /dev/mtdblock3 /mnt 
 copy fs:/mnt/boot/zImage-2.6.15-hh0 fs:/zImage
 umount /mnt
 armboot fs:/zImage "rootfstype=jffs2 root=/dev/mtdblock3 console=ttyS0,115200n8"

3.2. Method 2: Flash a rootfs to internal flash from linux

Boot linux on your iPAQ. Familiar 0.8.4 Release lacks mtdchar module. So at first download somewhere on your root filesystem [WWW]kernel-module-mtdchar-2.6_2.6.15-hh2-r2_h2200.ipk and install it with command: 

ipkg install /path/to/kernel-module-mtdchar-2.6_2.6.15-hh2-r2_h2200.ipk

Then do the following: 

modprobe mtdchar 
flash_eraseall -j /dev/mtd3
nandwrite /dev/mtd3 gpe-image.jffs2

To make sure flashing was successful: 
mount -t jffs2 /dev/mtdblock3 /mnt
ls /mnt

When LAB boots, it will automatically look for /boot/labrun and boot it. See above for examples of labrun files or take the one below if you use 0.8.4 GPE/OPIE image: 

copy fs:/mnt/boot/zImage-2.6.15-hh2 fs:/zImage 
umount /mnt
armboot fs:/zImage "rootfstype=jffs2 root=/dev/mtdblock3 console=ttyS0,115200n8"

Now copy labrun to /boot/labrun or create it there.

Unmount internal flash and then restart: 
umount /mnt/

Notes:

4. Future LAB features