HpIpaqH4100Howto

HP iPAQ H415x / H435x Howto's

About

This page collects random bits of information related to h4000 (not only, really) development and hacking. Note that they may be pretty outdates, or superceeded, or not recommended. But you may find a gem you may need here.

Notes related to h4000 by different people - if you want to add something, please add there, unless you are sure it does belong to main pages.
Backing up your handheld's data
Dumping / Saving the WinCE ROM
Booting using a precompiled kernel
Setting up the desktop for root over NFS
Setting up usbnet on the desktop
Creating serial cable from dual usb/serial

How to dump/backup the iPAQ h4150's ROM

This page contains all you need to know about h4100 native bootloader and backing up the ROM: "How to make backup of Windows CE and bootloader (IPL and SPL) for iPAQ h4150", http://www.geocities.com/ipaq41xx/ .

Booting using a precompiled kernel:

If you want to connect to your handheld from desktop (can omit this for the first bare kernel boot, but will need sooner or later), you need to setup either UsbNet (recommended) or Serial minicom (serial cable is prerequisite; this type of connection is not really required for anything any longer).
Download a kernel zImage and rootfs from HpIpaqH4100Downloads.

Download a copy of HaRET.

Create a startup.txt file with the following contents:

pfw 0x40e0005c 1 0x600a9558 
pfw 0x0c000008 1 0x0040

set kernel "\Storage Card\zImage-<version number>"
set mtype 459
set cmdline "root=/dev/nfs nfsroot=192.168.0.200:/home/ipaq_rootfs ip=192.168.0.202:192.168.0.200:192.168.0.200:255.255.255.0:ipaq:usb0 console=tty0 console=ttyS0,115200n8"
bootlinux

Decide how you will put these files on your ipaq. You can put them on a memory card via cardreader, or you can transfer them over the USB sync cable (use ActiveSync on Windows or SynCE on Linux). If you lack SD card and will copy them over the sync cable to main memory, change startup.txt to say "My Documents" where it says "Storage Card".
Put the four files on your handheld.
Make sure your computer is not in the sync process with the handheld (i.e. if you used the sync cable to copy the files, make sure you're disconnected).
Make sure the USB / Serial cable is connected to your computer.
Start minicom when having serial
Do Start->Programs->File Explorer and go to the folder containing HaRET.
Check the contents to have Haret, startup.txt and the correct zImage.
Now tap haret.exe.
You should see an image of a penguin and a thermometer. The thermometer should go to full, Tux will start looking stoned, and then the screen will show tux bootlogo. It is time to connect sync cable to the handheld again. If using minicom, after a short time boot messagesshould appear in its window.
In case you don't have kernel booting, try to hard reset the handheld and repeat the steps above.
Now you'll see the GPE bootsplash showing up.
When in minicom you'll see when it's starting up dropbear the first time.
After the Xserver starting and calibrating the screen you'll be prompted to fill in a password. Don't leave this blank, ssh access requires a password.
Now you can start an SSH session to 192.168.0.202 (your iPAQ's IP address)
Log in as "root". Use password you specifed above. If you boot using bootstrap initrd (as opposite to GPE/Opie image), one common password which images used to have is "rootme".
When you're done, you'll have to do a hard reset (press the power button while using the stylus to press the reset button), which will make your device lose everything not in the flash memory.

NFS setup on your computer

Download the latest rootfs from the mirror provided in the Booting using a precompiled kernel howto.
Extract its contents to /home/ipaq_rootfs or mount the ungzipped ext2 file as a loop to /home/ipaq_rootfs.

Note: It's important not to change /home/ipaq_rootfs. When you look at the startup.txt you'll see a reference to that!!

Add the below line to your /etc/exports file:

/home/ipaq_rootfs 192.168.0.202/32(rw,insecure,sync,no_wdelay,no_root_squash)

Run "man exports" for more details about this file
Start (or restart) the NFS services on your computer:
```
exportfs -ra
```
or
```
/etc/init.d/nfs restart
```

(example from Fedora Core 1, and this also works under gentoo)

Creating a serial cable from dual serial/usb cable

You can convert dual serial/usb cable from the cradle use in other Ipaqs for h4000 series in order to use serial console for porting. ~ Noli (17-2-2004)

[JelleKalf] 02-Jan-2004: My best advise is just to buy the HP cable. HP partnumber: FA122A#AC3. Amazon has the cables and tends to deliver them pretty quick. note: This is not an autocharge cable! However the pda connector on the cable has a charger hole. So you can use your regular charger that came with the pda.

note 2: This cable is not to be used with H19xx devices.

THE INFORMATION HERE MAY BE OUTDATED OR DOES NOT BELONG HERE

Disassembled Stuff - Boot.256k

Disassembling boot.256k would probably give us some things how this bootloader initialising h4000 devices. Some of the main linux porters have managed to download the boot 256k and disassembled it. Some hints on this:

disassembly and analysis of the bootloader of Toshiba e740/750
Joshua, h1910 disassembled sfuff, he used JTAG to download the boot
"Disassembling Bootloader on Sharp SL-C700"???,
pxaregs and friends
Interesting disassembled stuff in XDA Himalaya using IDAPro (Prof. Disassembler) - asic3, boot and wince. -Noli 30-3-2004

Using the following commands in EnterBootloader.exe "How to dump the iPAQ h4150's ROM":

r2sd [command]

r2sd : Backup WINCE OS+Boot Loader image from RAM to SD card.

r2sd boot : Backup boot loader image from RAM to SD card.

r2sd strap : Backup IPL/boot loader image from RAM to SD card.

We could probably ask the XDA-Himalaya developer to dissamble 3 files using IDAPro to get the exact stuff for h4000. -Noli 29-3-2004

While browsing XDA-Himalaya, I found out that Himalaya uses the same HTC Chip and DiskOnChip for the WinCE part of the device, hence the disassembled (IDC files for ASIC3) may applies to h4000 devices in figure out values for asm in kernel26/include/asm-arm/arch-pxa/, in addition to Shawn and Eddi had figured it out already. Hopefully, these files would be useful in the development of SD/MMC driver, it seems a lot of SD words in these file. - Noli 30-3-2004

XDA-Developers Complete Tools

Hopefully with the backup WinCE ROM of h4000, we could find some tools from XDA-developers that would help hack things for porting in this device. The complete tools can be found here. RomTools and XdaUtils might be useful even without backup ROM. I am just speculating here. - Noli 23-3-2004

Historical Archive

Initial Inquiries on Hp Ipaq 4150 - wrong link! - I think http://handhelds.org/hypermail/ipaq/187/18781.html may be the right one... - Eddi 18-3-2004

Earlier what is in h4000 devices discussion and the thread on this.

From Jamey's email:

I think the first step to porting linux is adapting the h1910 2.6
kernel, using linexec or haret to boot the zImage from PocketPC. The
new bootldr, LAB, is part of the 2.6 kernel, so it will take very
little extra to get LAB booting once the kernel is booting. It will
probably be useful to use haret or to do a full teardown in order to
determine how the CPU reprogrammable general purpose IO pins are
connected on the H41xx and H43xx. I have no schematics or specs for
this device and I do not think I will be able to get them even inside
HP.
- Jamey

Note about Jamey's first e-mail: Although, we don't have any schematics or specs for this device, we almost figure out what is in the guts in this device as you have been read in the previous section. ~ns 1-4-2004

Interesting links

The Sharp SL-A300 (Discovery) is simillar to h4000 hardware, here is some stuff that may be interesting to look at. picure of insides, dmesg, kernel patches

Shawn's Repo some h4000 linux stuff...

Eddi's Repo some h4000 linux stuff.. and interesting screenshots.

View/browse HandHelds.org 2.6 kernel CVS

HpIpaqH4100Old

Unstructured information

By entering bootloader you may got some difficult to exit... - I had to try addresses near the suggested to get wince starting again ~ 27-3-2004, Eddi

h4150 bootloader seems to be very similar to wallaby bootloader. By reading this you can get very interesting other information that at the moment lacks in VSergey page. Eg. from bootloader we can get memory map for h4100 (map command), we can disassemble pieces of memory (u command), perhaps get the right wince location (r command whith no params - not tested). However do not use memory location from xda page since are different from ours ~ Eddi 27-3-2004

Handhelds.org - Open source for handheld devices