anarsoul's blog

I think I found a part of nand flash that wince bootloader loads to ram. This part is nk.exe, and it starts at 0x45400, whole wince partition starts at 0x44000. Bootloader loads some chunk (~1mb) at 0x80000000 (virtual address) and then jumps to 0x80000000. But that's only theory, need some practice now :) Anyway, more interesting links: http://lrk-python.googlecode.com

Tried to get htc bootloader load my custom "diag" image, but it fails with "Download failed" message :( My image consists of: 1024-byte header, starting with "HTC$IBG--444", others are zeros 28-byte code that fills framebuffer with some pattern (0x00ff) It seems that I need to add some more info to header (checksums, size?) - If anyone knows _anything_ about diagnostic image for WM5-based devices with s3c24xx CPU and HTC bootloader - please let me know. Also I hope that bootloader outputs some info to UART, but unfortunately I have no usb-com adapter to check :( And some more info: first stage bootloader seems to be nboot from smdk2440, but it does nothing except loading second stage bootloader :)

Still gathering info on HTC bootloader, acer n30 linux port and htc-flasher could be usefull. It seems that there're two ways to go: flash linux kernel into internal NAND flash (dangerous, I want to ensure that I can restore WM) boot linux via SD card with diagnostic image Second way seems to be complicated, as I'll need to write mmc and FAT drivers if bootloader puts diagnostic image in some unappropriated memory area. Anyway still need to figure out where bootloader puts diagnostic image, how this diagnostic image should look, etc...

Just found some interesting info how to boot device with htc bootloader from sd without booting wince. Tool is named eol (embedded OS loader) and is designed to be put on a miniSD card and loaded by the SPL (the initial loader in the flash ROM) by faking a diagnostic card signature. It's originally intended to use with HTC Tycoon. I'm going to modify it to use with rx1950 :) Can't wait getting hand on this tool ;)

Here's some interesting notes about suspend/resume with stock htc-compatible bootloader (rx1950, h1940, rx3000 PDAs) After waking up from suspend bootloader: checks if we really wake up from suspend (not power-on after power-off, etc) performs quick memory check (it calculates simple checksum), if check was successfull jumps to physical address 0x30081000 But haret loads kernel to address 0x30008000. So resume address overlaps kernel space. To avoid kernel code corruption we should load kernel higher :) So, you'll need to patch your kernel to create offset for .text section, and also you'll need to patch haret. Here's patch for haret: diff -Naur haret/src/linboot.cpp haret.offset/src/linboot.cpp --- haret/src/linboot.cpp 2007-04-15 20:13:41.000000000 +0200 +++ haret.offset/src/linboot.cpp 2007-04-26 19:52:13.000000000 +0200 @@ -87,7 +87,7 @@ // Recommended tags placement = RAM start + 256 #define PHYSOFFSET_TAGS 0x100 // Recommended kernel placement = RAM start + 3...