Linux on the Wizard

[mind]

Hi.

Has anyone tried to make linux/familiar boot on the Wizard yet?
Any luck?

[kenshinjeff]

Hi.

Has anyone tried to make linux/familiar boot on the Wizard yet?
Any luck?

Oh this looks interesting. What could you do with a linux boot?

[cr2]

Has anyone tried to make linux/familiar boot on the Wizard yet?

Have you tried to run haret ?
If it works, can you post the
framebuffer address and 'dump mmu' here ?

[mitchello]

It might take a bit longer for anything like this to appear, but it would be interesting when it does.

[mind]

I haven't tried it. The reason for my question was that I'm going to do some development work for Opie (opie.handhelds.org), and need a machine that boots and runs familiar to test stuff. And I would like to get me a wizard ;)

Familiar has a list of machines tested on familiar ( booting or not ). But only Wallaby (XDA), Himalaya (XDA II), Blueangel (XDA III) and Universal (MDA Pro) are listed.

So if anyone in this forum wich has a wizard and would like to try out linux/opie on it; please let me know if it boots!!!

There are a lot of advantages having linux on you're XDA instead of windows mobile. The most obvious being that if you're stuck in some corner ( lets say mp3 audio over bt isn't working ), you could always do some work on the ( BlueZ ) code you're self to try to fix the problem. Also there's alot of cool software available that you don't have on WM.
And oh, you're free ;)

Best regards,

[cr2]

Familiar has a list of machines tested on familiar ( booting or not ). But only Wallaby (XDA), Himalaya (XDA II), Blueangel (XDA III) and Universal (MDA Pro) are listed.

The only machine where Linux WORKS right now
is Blueangel (with GPE, never seen reports about opie). Himalaya, Universal and Magician need some work. Alpine should work with some
effort too.
Wallaby is not really working (no SD) because
nobody is interested in writing this driver.
Power management (i.e. suspend) is missing now.


So if anyone in this forum wich has a wizard and would like to try out linux/opie on it; please let me know if it boots!!!

To run opie, you need a running kernel, which does not exist. To write the kernel it is necessary to run 'haret'. So, the first step
is to try 'haret' ! :)

[richardt007]

To run opie, you need a running kernel, which does not exist. To write the kernel it is necessary to run 'haret'. So, the first step
is to try 'haret' ! :)

Just tried it. Haret starts, but prints out the message "Exception reading coprocessor 15 register .." I can connect to Haret on port 9999 and can issue some commands like "dump mmu" but there's not much info there...:


descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write

Error: EXCEPTION reading coprocessor 15 register 2
MMU 1st level descriptor table is at FFFFC000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
00000000 | | | UNMAPPED
ffffffff | | | End of virtual address sp

[cr2]

Haret starts, but prints out the message "Exception reading coprocessor 15 register .." I can connect to Haret on port 9999 and can issue some commands like "dump mmu" but there's not much info there...:


Then you need to sign haret with the "priviledged certificate". Read more here:
http://forum.xda-developers.com/viewtopic.php?t=30399&start=0

[richardt007]

Can you tell me how to do that in a little more detail than what's described in the thread? I managed to compile the latest haret.exe using wine and the msvc package. Do I need to alter the asm-files (and which one?) with the code-snippet in that thread or is it a little more complicated than that? Would like to contribute though...

[cr2]

Can you tell me how to do that in a little more detail than what's described in the thread?

No, it seems that you don't need to change anything, only to sign the executable.
Don't ask me how, i don't know exactly :)
I've tried makecert.exe with wine-0.9.1 and
it works. You should look into the archives
on this site or read the microsoft documentation.

[cr2]

Don't ask me how, i don't know exactly :)

There is an explanation now at the end of this
thread.

[richardt007]

I managed to get some output from haret, although don't know the validity of the output.

1. I had to modify the asmstuff.asm to include the cp_0, cp_2 and cp_13 calls in order to get rid of the exception ( GetLastError returned 120=ERROR_CALL_NOT_IMPLEMENTED)

2. Called the cp_2 from _cpu_get_cp.

3. Signed the executable using signcode.exe from the Smartphone 2003 SDK (have no clue if this was needed at all)

Here is some output from the output, can somebody help out to interpret it?


HaRET(3)# dump gpio
GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER | GPIO# D S A INTER
------------------+-------------------+-------------------+------------------
0 O 1 0 | 21 I 0 0 | 42 O 0 0 | 63 O 0 2
1 O 0 0 | 22 I 0 0 | 43 I 0 0 | 64 I 0 0
2 I 1 0 | 23 I 0 0 | 44 I 0 0 | 65 I 0 2 FE
3 I 0 0 | 24 I 0 0 | 45 I 0 0 | 66 I 0 3
4 I 0 0 | 25 I 0 0 | 46 I 0 0 | 67 I 0 3
5 I 0 0 | 26 I 0 0 | 47 O 0 0 | 68 I 0 3
6 I 0 0 | 27 I 0 0 | 48 I 0 0 | 69 I 0 1
7 I 0 0 | 28 I 0 0 | 49 I 0 2 | 70 I 0 0
8 I 0 0 | 29 I 0 0 | 50 I 0 3 | 71 I 0 2
9 I 0 0 | 30 I 0 0 | 51 O 0 3 | 72 I 0 0
10 I 0 0 | 31 I 0 0 | 52 O 0 3 | 73 I 0 2
11 I 0 0 | 32 I 0 0 FE | 53 O 0 1 | 74 I 0 3
12 I 0 0 | 33 I 1 0 | 54 O 0 0 | 75 I 0 3
13 I 0 0 | 34 I 0 0 FE | 55 O 0 2 | 76 I 0 3
14 I 0 0 | 35 O 0 0 | 56 O 0 0 | 77 I 0 1
15 I 0 0 | 36 O 0 0 | 57 O 0 2 | 78 I 0 0
16 I 0 3 | 37 O 0 0 | 58 O 0 3 | 79 I 0 2
17 I 0 3 | 38 O 0 0 | 59 I 0 3 | 80 I 0 0
18 I 0 3 | 39 O 0 0 | 60 I 0 3 | 81 I 0 2
19 I 0 1 | 40 O 0 0 | 61 I 0 1 | 82 I 0 3
20 I 0 0 | 41 O 0 0 | 62 I 0 0 | 83 I 0 3


HaRET(2)# print "%x" VRAM
20001020


Dump mmu gives a lot of lines, have no idea what the most relevant part of it is, so here a snippet:

HaRET(7)# dump mmu
----- Virtual address map -----
Descriptor flags legend:
C: Cacheable
B: Bufferable
0..3: Access Permissions (for up to 4 slices):
0: Supervisor mode Read
1: Supervisor mode Read/Write
2: User mode Read
3: User mode Read/Write
MMU 1st level descriptor table is at 10360000
Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------
00000000 | | | UNMAPPED
02000000 | | | UNMAPPED
02101000 | 10463000 | CB0000 | Small page (4K)
...
...
29fff000 | 12b4b000 | CB3 | Small page (4K)
2a000000 | | | UNMAPPED


Then it stops, with the progress bar somewhere at 40%. had to give it a soft reset. So what's the next step...?

[cr2]

I managed to get some output from haret, although don't know the validity of the output.

Here is some output from the output, can somebody help out to interpret it?


I have looked in the docs, wizard has TI OMAP processor, and haret 'gpio' knows only about
PXA. So , this table is probably useless.


HaRET(2)# print "%x" VRAM
20001020


From omap730.h:
#define OMAP730_SRAM_START 0x20000000

So your VRAM is in the OMAP built-in SRAM.


HaRET(7)# dump mmu

MMU 1st level descriptor table is at 10360000

Your RAM starts at 0x10000000.
At least 4MB for the kernel & stuff.


Virtual | Physical | Descr | Description
address | address | flags |
----------+----------+---------+-----------------------------

02101000 | 10463000 | CB0000 | Small page (4K)


The page in RAM mapped for some system purposes.


Then it stops, with the progress bar somewhere at 40%. had to give it a soft reset.

It's normal, "dump mmu" in haret is buggy :)


So what's the next step...?

It is interesting to find out where is your ROM mapped.
You can also sign the itsutils and try to dump the memory with these tools.
Read the linux-omap documentation and code
and dump the OMAP registers. You can also
try to find out from the wince dlls what other
chips are used in this phone.

[richardt007]

You can also sign the itsutils and try to dump the memory with these tools.


Signing itsutils was not enough unfortunately, as I had to change the security policy (policy ID=4097) from 1 to 2 to allow RAPI calls.
(see http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnppcgen/html/wmdeploy.asp)

After that, itsutils ran like a charm:

c:\src\itsutils\build>pmemmap
v82000000-83000000 -> p00000000-01000000
v8a000000-8a400000 -> p13c00000-14000000
v8c000000-8fc00000 -> p10000000-13c00000
v90000000-90100000 -> p20000000-20100000
v98000000-98100000 -> pfff00000-00000000 (huh?)
v98100000-98200000 -> p04000000-04100000
v98400000-98500000 -> p06000000-06100000
v98500000-98600000 -> p40000000-40100000


A simple process list, 'pps -t' showed _alot_ of .dll's being used (mainly by device.exe, naturally)

c:\src\itsutils\build>pps
handle n base kern user heap exe
0ddf5fba 5 20000000 0.0 8.2 0 rapiclnt -drndis_peer
0dfb5706 2 0e000000 0.0 0.0 0 elatepushservice.exe
0dfdf8ce 11 1a000000 0.0 0.5 0 repllog.exe /sched /remote /h
0e0f03ba 2 10000000 0.0 0.0 0 sddaemon.exe
0fbb4002 2 c2000000 0.0 0.0 0 NK.EXE
2e0a2402 8 14000000 0.0 0.0 0 srvtrust.exe 80
4de65d06 10 18000000 0.0 0.0 0 cprog.exe -n
4e3767c2 10 08000000 0.0 2.1 0 shell32.exe 50
6fba4bfa 12 04000000 0.0 37.8 0 filesys.exe
8dfb56e2 2 1c000000 0.0 0.0 0 PowerTray.exe
8e91ce1a 107 06000000 0.0 1.8 0 device.exe 20
adf78e9e 1 1e000000 0.0 0.0 0 WiFiTray.exe
ae0b6dc2 11 12000000 0.0 0.0 0 connmgr.exe 70
ae54049a 15 0a000000 0.0 0.0 0 gwes.exe 30
ce376c4a 20 0c000000 0.0 0.0 0 services.exe 60
edc4dd32 9 22000000 0.0 0.0 0 tmail.exe -RunInBKG
ee040e02 1 16000000 0.0 0.0 0 poutlook.exe
0 ........ 0.0 50.4 0 total


The list of partitions is completely unclear to me:

c:\src\itsutils\build>pdocread -l
57.00M TrueFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
48.23M TrueFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
10.00M TRUEFFS
| 3.06M Part00
| 2.88M Part01
| 51.06M Part02
483.88M DSK1:
| 483.70M Part00
STRG handles: afb7d5fe
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
(483.70M) ce9ec2da
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 10.00M) 0eae8ede
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 48.23M) 0fb2bf42
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 51.06M) efb2bd82
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 2.88M) cfb2bd5e
3 partitions, 2 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 fe 04 01 02 1c 32 08 ee 0d 07 05 4d
( 3.06M)


This machine has 128Mb of ROM, is there anyway I can read this using itsutils? pmemdump can successfully read only after 0x82000000 and prints out "Attempt to access invalid address"...

I dumped the first 16Megs after 0x82000000 and there's all kind of garbage, same like on the maui device. (marxx printed the first 8192 bytes in the above thread). Unfortunately, arm-wince-pe-objdump says "File format not recognized" on both dumps... What am I missing here?

[cr2]

arm-wince-pe-objdump says "File format not recognized" on both dumps... What am I missing here?


arm-wince-pe-objdump expects a PE binary, so
it is necessary to tell it that we have a raw binary dump.

arm-wince-pe-objdump -D -b binary -m arm dump.file

[cr2]

I have found this information about Linux
on HTC Typhoon:
http://vivien.chappelier.free.fr/typhoon/index.html

[htcblaze]

I was going to recomend a kernel built with omap 730 support, since the 850 seems to just be a 730 with edge. TI's site isn't to informational about the other circuits built into the omap850, or 730.

[htcblaze]

I have not been able to get the bootloader thing to do a single useful thing. I only get the tricolored screen. When pluged into the usb I get it saying usb in the corner. I set my mini sd up for the omap 730 image off the above site, but no dice.
My phone is the wiza 100 I beleive (cingular 8125).

[tsiros]

YAY! PROGRESS! :D i will join you guys, when i find out more about how memory is organised. TI supports linux on the omap, maybe if we asked... :/

[htcblaze]

I never have any luck with the installing the damn toolchains, they never come with any instructions, or limited instructions. But I think I may have it. I nticed a lot of you are better coders and embedded developers than I I hope to learn a lot from you. Also, if there are any tutorials you can provide links to to help me learn, that would be perfect.

[htcblaze]

OK,

ToolChains (Check)

Compiled proper perl tools (Check)

Compiled and prepared the sd card boot loader
and image like on website above (also check)

Set up my wizard (Cingular 8125, I think wiza 110) with a new firmware
void of branding or lock -ed- ness. (Check)

Problem?, yes, the spl is the only thing that didn't change to a diffrent version. From what I learned, that is the boot loader for the phones, right? It is at 1.08 and I should change that for it only goes strait to the colored screen. My friends tornado, tmobile sda (also omap 850 based), was able to do the correct thing, just it was the original firmware so it would not allow a boot from sd card. I need to know if I should try to get the spl updated with another rom, or if the wizard will never boot linux. I hope it does, it just doesn't want to get along.

[mosfet]

Just for information, I am regularly watching Linux omap mailing list and a few weeks ago, someone has added support for TI OMAP850 board (HTC Wizard is based upon this plateform).
Check my post in Development/HAcking forum




OK,

ToolChains (Check)

Compiled proper perl tools (Check)

Compiled and prepared the sd card boot loader
and image like on website above (also check)

Set up my wizard (Cingular 8125, I think wiza 110) with a new firmware
void of branding or lock -ed- ness. (Check)

Problem?, yes, the spl is the only thing that didn't change to a diffrent version. From what I learned, that is the boot loader for the phones, right? It is at 1.08 and I should change that for it only goes strait to the colored screen. My friends tornado, tmobile sda (also omap 850 based), was able to do the correct thing, just it was the original firmware so it would not allow a boot from sd card. I need to know if I should try to get the spl updated with another rom, or if the wizard will never boot linux. I hope it does, it just doesn't want to get along.

[boboki]

This will be interesting if this gets working.
I would imagine that the amount of freeware for this phone will SKYROCKET if we have a working linux kernel.
Also, imagine the functionality we can add!
I will be watching this topic, though I use my phone for work, so I cannot yet participate.

[htcblaze]

Thats cool that you all want to watch and see where this project goes, but I am currently stuck on the boot loader. I'm not about to pop the thing open to get to the Jtag. If any one wants to try to enter the boot loader and tell me what they see, that may help me.

If your boot loader shows more information than the spl and ipl, such as it actually tells you what kind of phone you have, it should say wizard. Then let me know. If it actually flashes a white screen before that multi colored screen, then we have a functional boot loader. If that is the case, tell me what version of the any rom you used to upgrade to this point. Also if it works, listing the spl and ipl could help. Untill then I'm not sure if I can even get this device to boot an sd card linux. If so, I'm going to get a tmobile sda, I know it will atleast boot the sd card if the cid unlock is properly done. So a little help would be welcome to get this moving foward even more.

To get into said boot loader, you must fully power down your phone and the hold the camera button, then press the power button for about 1 second. It will sit black for a few seconds and then turn on. from there you SHOULD see a white screen flash for about five seconds and then the multi-colored screen with the other stuff above. If it goes strait to the multicolored screen, then it is no good, but thanks for trying. If anyone who has upgraded their phone can try this, this may help in figureing out how to get the linux going, and it won't damage your phone or settings when you do so. thanks

[boboki]

My ipl and spl are 2.21.
I entered bootloader mode and got no white screen. There IS a 5 second black screen before the bootloader though, which perhaps is the same thing?

[exbros]

ipl 2.21 / spl 2.21
No success, as above (or on the previous page :? )...

[htcblaze]

Hmm. this is proving to be a problem. Is there a way to downgrade to an older version of these components, or does any one else have an idea as to how this may work.

[tsiros]

i connect my wiz to the usb, while in bootloader screen, run mtty, but mtty says unable to connect, in usb and every com :(

just checking: you mean the mtty that is 49152 bytes, right guys?

[phil13]

Hello,

this page might help: http://vivien.chappelier.free.fr/typhoon/index.html

Phil

[htcblaze]

this site has already been mentioned, infact I need a working boot loader so I can try the image on that exact site. Please, every one, read the whole thread if you are new and what to add something. see that has already been done. Now I've been busy latley and haven't been able to try any other spl versions, but I would like to know about the other versions incase it isn't downgrade-able because I'm at 1.8 and don't want to chance it.

[silven]

In the bootloader with all the colors, if i'm connected to it via usb I can fire up minicom to /dev/ttySUB0 and get some kinda shell. The help doesn't work and I can't do anything with it, but it's interesting.

[htcblaze]

hmm, whats your version? Did throwing out commands do anything?

[devilboy1488]

i did it too with IPL/SPL 2.25 and as soon as i connect i receive this command line without typing anything


Cmd>AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0
Invalid command : AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0
For a help screen, use command ? or h



my settings are 9600 8N1 @ /dev/ttyUSB0

and i too am a linux enthusiast, so i'll try and help if i can :)

edit: lol forget that AT S7 blah blah line, it's just a minicom script

well it seems that in bootloader there are at least 2 commands, r2sd that dumps your rom to your sd card, and there is format that is not allowed to run (i wonder why :P )

anyone knows more that can be useful?

[Bratag]

http://ertos.nicta.com.au/news/home.pml#v-gt-r

Interesting seems as though it is designed for ARM/Xscale processors.

[silven]

Here are the versions that I have:

When I boot into the rainbow bootloader and connect via minicom to ttyUSB0 I get a shell.

IPL 1.08
SPL 1.08
GSM 01.09.11
OS 1.8.11.1

The shell has a help function that didn't work when I tried it.. I tried tossing a LOT of commands at the shell and I couldn't get it to do ANYTHING other than give me a lot of prompts.

[htcblaze]

perhaps the shell doesn't echo, so be carefull with those commands.

[htcblaze]

I can not get my machines to want to connect with the phone, after maining painful hours of net surfing. I did "dmesg | tail -n 10" and found my machine sees it connect but has no clue what drive to asociate it with, so my wizard just sits there and charges...

hub.c: new USB device 00:1d.1-1, assigned address 13
usb.c: USB device 13 (vend/prod 0xbb4/0xa07) is not claimed by any active driver.


Maybe it is becuse my spl is 1.8 and ipl is 1.1. Another issue is becuse the site I got the image from says to boot from sd you must have SID unlocked. I am still new to this device because I bought it for this project, anyone have a clue what or how to do the SID unlock. Also After that I will upgrade my ipl and spl to the 2.* so maybe I can get that fun filled console. I've come to think it is with the ipl/spl version the trouble lies.

Post your output of "dmesg | tail -n 10" if you find your self able to get to the console. Iwould like to see how your machines respond to this little critter.

[cr2]

hub.c: new USB device 00:1d.1-1, assigned address 13
usb.c: USB device 13 (vend/prod 0xbb4/0xa07) is not claimed by any active driver.


If this is in the bootloader, then just load the 'ipaq'
driver with these parameters (product=, vendor=)


anyone have a clue what or how to do the SID unlock.

Do you know how to use the search button on this forum ? :oops:

[htcblaze]

hub.c: new USB device 00:1d.1-1, assigned address 13
usb.c: USB device 13 (vend/prod 0xbb4/0xa07) is not claimed by any active driver.


If this is in the bootloader, then just load the 'ipaq'
driver with these parameters (product=, vendor=)


anyone have a clue what or how to do the SID unlock.

Do you know how to use the search button on this forum ? :oops:

Ok I wasn't sure if there was a special way for the wizard or if it works for all. I tried to look for how to for the wizard, now I'll give it a try with the next one I find.

[cr2]

Ok I wasn't sure if there was a special way for the wizard or if it works for all.

http://forum.xda-developers.com/viewtopic.php?t=33796

[ithamar]

Please check also this topic:

http://forum.xda-developers.com/viewtopic.php?t=49560

for another way of running Linux on your Wizard!

Ithamar.