| Rev | Author | # | Line |
|---|---|---|---|
| 10 | FloaTy | 1 | The Compaq Evo T20 is a thin-client device targetted at Windows TS or Citrix TS services. |
| 2 | |||
| 17 | DanielLawson | 3 | ! Specifications: |
| 10 | FloaTy | 4 | * 300 MHz Geode CPU |
| 17 | DanielLawson | 5 | * 16 - 256 MB flash |
| 6 | * 32 - 256 MB ram | ||
| 7 | * 4 USB ports | ||
| 8 | * No PS/2 ports (legacy free) | ||
| 10 | FloaTy | 9 | |
| 17 | DanielLawson | 10 | !Available Configurations: (Flash/RAM size) |
| 10 | FloaTy | 11 | |
| 17 | DanielLawson | 12 | * 16/32 |
| 13 | * 32/64 | ||
| 14 | * 48/64 | ||
| 15 | * 64/64 | ||
| 16 | * 64/96 | ||
| 17 | * 96/128 | ||
| 18 | * 128/128 | ||
| 19 | * 192/256 | ||
| 20 | * 256/256 | ||
| 10 | FloaTy | 21 | |
| 17 | DanielLawson | 22 | ! Operating Systems |
| 15 | MilanHauth | 23 | |
| 17 | DanielLawson | 24 | The 192/256 and 256/256 models have WinXPe on them, the other models have WinNTe. |
| 10 | FloaTy | 25 | |
| 26 | ! Video depth | ||
| 27 | |||
| 28 | It appears that the driver [XOrg] uses for this unit can't support a bit depth of 24bits, but it does support 16bits. | ||
| 29 | |||
| 17 | DanielLawson | 30 | ! [PXE] Boot |
| 31 | |||
| 32 | The 64/64 model has an image for WinNTe + PXE, which can be downloaded from Compaq's website. The WinXPe models appear to both support [PXE] boot. If you don't have one of these models, the other models can be made to PXE boot by modifying the firmware. | ||
| 16 | DanielLawson | 33 | |
| 34 | ! Flashing the device | ||
| 35 | |||
| 17 | DanielLawson | 36 | You need a program called netxfer, available from Compaq's download site. This needs MS Java, however, which is not available from MS anymore. Try http://java-virtual-machine.net/download.htm |
| 16 | DanielLawson | 37 | |
| 10 | FloaTy | 38 | |
| 39 | |||
| 17 | DanielLawson | 40 | !!General notes |
| 41 | |||
| 42 | Interestingly, if you allow the bootp to wait, it times out after an hour and tries to tftp /tftpboot/kernel on port 10069. | ||
| 43 | |||
| 18 | KarlMowattWilson | 44 | If you don't have a PXE boot model, or you wish to run linux locally, you could look at what is meant to be a master reference for [Linux on the Evo T20|http://open-evot20.sourceforge.net/] - this has a mailling list and links to [hacking the firmware|http://www.kazak.ws/evo/] and [DEvoSL - DSL on Evo T20 HowTo|http://www.mowson.org/karl/evo_t20/] |
| 17 | DanielLawson | 45 | |
| 46 | !! Notes on flashing the firmware. | ||
| 10 | FloaTy | 47 | |
| 48 | |||
| 17 | DanielLawson | 49 | tried the stuff above - i'm not really a hacker - but ... yes it works ! |
| 10 | FloaTy | 50 | |
| 51 | |||
| 52 | my way: | ||
| 53 | |||
| 54 | since i saw a cheap t20 on ebay i've looked for information to run linux/bsd on this machine, then i found the solution from Dag Sverre and got a t20 with 96/128 memory configuration fom ebay (30$). | ||
| 55 | |||
| 56 | first i've downloaded the firmware-image (U96CPQ163.bin) from hp-support-site and compared it with the 48/64-imgefile from Dags machine: the offset differs, while it seems to be exactly the same stuff is contained and loaded up before starting up the NTe-Image (don't ask me). | ||
| 57 | |||
| 14 | MilanHauth | 58 | <verbatim> |
| 59 | # for the entire file: | ||
| 60 | losetup -o 834236 /dev/loop0 U96CPQ163.bin | ||
| 61 | # for the contained ntfs-filesystem | ||
| 62 | losetup -o 834748 /dev/loop1 U96CPQ163.bin | ||
| 10 | FloaTy | 63 | |
| 14 | MilanHauth | 64 | mount -t ntfs /dev/loop1 /mountpoint |
| 65 | cd /mountpoint | ||
| 66 | ls -l | ||
| 67 | </verbatim> | ||
| 10 | FloaTy | 68 | |
| 69 | |||
| 70 | |||
| 71 | ! first i tried to manipulate the bootloader with grub for nt | ||
| 72 | |||
| 73 | http://marc.herbert.free.fr/linux/win2linstall.html#grub-for-nt | ||
| 74 | |||
| 75 | but neither i can't edit the boot.ini file nor i can't write a "menu.lst"-file to the filesystem (file truncated, no rights ...) | ||
| 76 | |||
| 77 | ... probing on a standard-machine: the default-entry in boot.ini seems to be useless, while the NT-startup-routine allways tries to boot up the NT-environment, also when i put the c:\grldr="Start GRUB" to this position | ||
| 78 | (it would be fine, if somebody could explain me the sense of the default-entry in boot.ini) | ||
| 79 | (... another problem there's no keyboard available on a t20 at this moment to change to the grub entry - with legacy keyboard support this no problem ... but for my evo-t20 - no way!) | ||
| 80 | |||
| 81 | |||
| 82 | |||
| 83 | ! so i tried "Making GRUB work" | ||
| 84 | |||
| 85 | commented out the A20-calls in "builtins.c" and "common.c" patched the other files as described (maybe i have forget/ignored to comment out the routine itself in "asm.S" - don't know if this is nessesary) and wrote the preset-menu (may be i failed here - i wrote all in the same row - shit!) | ||
| 86 | |||
| 87 | after compiling, patching | ||
| 88 | |||
| 14 | MilanHauth | 89 | <verbatim> |
| 90 | dd if=my-compiled-grub-src/stage1/stage1 of=/dev/loop0 bs=512 seek=1 | ||
| 91 | dd if=my-compiled-grub-src/stage2/stage2 of=/dev/loop0 bs=512 seek=2 | ||
| 92 | </verbatim> | ||
| 10 | FloaTy | 93 | |
| 94 | and flashing (with netxfer)... and rebooting ... | ||
| 95 | |||
| 96 | ... the machine waited for me at the grub command-prompt (no preset-menu) ... without having a keyboard - kacke! | ||
| 97 | |||
| 98 | |||
| 99 | |||
| 100 | ! i've tried some etherboot images | ||
| 101 | |||
| 102 | http://rom-o-matic.net | ||
| 103 | |||
| 104 | (but which kind of it?) | ||
| 105 | after testing with version 5.4.1 as a floppy bootable ROM-Image (.zdsk) and Binary ROM-Image (.zrom) i tried a HD-Image (experimental)(.zhd) but forget to enable "direct-PCI-Support" (machine boots up (hooray) ... and - no wonder - can't find a NIC) ... after enabling Direct-PCI i got a compiler-error | ||
| 106 | |||
| 107 | ! i've tried version 5.4.2pre2 with these settings: | ||
| 108 | |||
| 109 | 1. natsemi:dp83815 -- 0x100b,0x0020 | ||
| 110 | |||
| 111 | 2. HD (experimental) Hard Disk Partition Image (.zhd) | ||
| 112 | |||
| 113 | 3. default-values + CONFIG_PCI_DIRECT | ||
| 114 | |||
| 115 | and got a "eb-5.4.2pre2-natsemi.zhd" | ||
| 116 | |||
| 117 | |||
| 118 | |||
| 119 | ! now i have patched the firmware with this image | ||
| 120 | |||
| 14 | MilanHauth | 121 | <verbatim> |
| 122 | dd if=eb-5.4.2pre2-natsemi.zhd of=/dev/loop0 bs=512 seek=1 | ||
| 123 | </verbatim> | ||
| 10 | FloaTy | 124 | |
| 125 | then i have flashed the patched U96CPQ163.bin to my t20 ... rebooted ... and: | ||
| 126 | |||
| 127 | ! BINGO! ### a DHCP/PXE-Request on my sniffer-screen and the machine replies on ICMP-Requests | ||
| 128 | |||
| 129 | i hope the hardest part is done. | ||
| 130 | next days i will try to boot some LinTS-images and my own bsd-stuff for building a diskless FreeRADIUS-Server and a RDP/X-Client ... will tell you about my experiences | ||
| 131 | |||
| 132 | floaty | ||
| 133 | |||
| 134 | |||
| 135 | |||
| 136 | ! changing bootscreen und booting up pxes-prebuild client over the network | ||
| 137 | |||
| 138 | bootscreen: | ||
| 139 | |||
| 140 | the bitmap from bootup is ugly : | ||
| 141 | |||
| 142 | http://mitglied.lycos.de/szeissig/bilch.bmp | ||
| 143 | |||
| 144 | my screen is not really beautifull but inspired (from this web-site) : | ||
| 145 | |||
| 146 | http://mitglied.lycos.de/szeissig/bilch-patch.bmp | ||
| 147 | |||
| 148 | |||
| 149 | patching the bitmap is easy: | ||
| 150 | #note the filesize of your startup.bmp while flashing firmware | ||
| 151 | #the bitmap is before your (unused) mbr (remember the offset - for me starts at 834236) the filesize is 14120 bytes | ||
| 152 | #you find the bmp-header: BM(7...... | ||
| 153 | #make your own screen.bmp (640 x 480 x 8 BPP) | ||
| 154 | #patch the new screen with dd or a hex-editor | ||
| 155 | #flashing - finished | ||
| 156 | |||
| 157 | |||
| 158 | ! booting the prebuild-client: | ||
| 159 | |||
| 160 | http://downloads.2x.com/pxes/1.1.1/PREBUILT/ | ||
| 161 | |||
| 162 | #download *.nbi file for etherboot | ||
| 163 | #set up dhcp / tftp (for me tftpd32 ... yes!, quick & dirty!) | ||
| 164 | #boot the machine (have a look on your brand new start-up screen) - fertich | ||
| 165 | |||
| 166 | |||
| 167 | |||
| 168 | <verbatim> | ||
| 14 | MilanHauth | 169 | P192168100251# dmesg |
| 170 | Linux version 2.4.32-2pxes (diego@thindev) (gcc version 3.3.5 (Debian 1:3.3.5-8)) #3 Tue Feb 21 18:02:22 EST 2006 | ||
| 171 | BIOS-provided physical RAM map: | ||
| 172 | BIOS-e801: 0000000000000000 - 000000000009f000 (usable) | ||
| 173 | BIOS-e801: 0000000000100000 - 0000000007d10000 (usable) | ||
| 174 | 125MB LOWMEM available. | ||
| 175 | On node 0 totalpages: 32016 | ||
| 176 | zone(0): 4096 pages. | ||
| 177 | zone(1): 27920 pages. | ||
| 178 | zone(2): 0 pages. | ||
| 179 | DMI not present. | ||
| 180 | ACPI: Unable to locate RSDP | ||
| 181 | Kernel command line: rw root=/dev/nfs ramdisk_size=17080 initrd=pxes-1.1-1PB.squash ro root=/dev/ram | ||
| 182 | Initializing CPU#0 | ||
| 183 | Working around Cyrix MediaGX virtual DMA bugs. | ||
| 184 | Detected 300.683 MHz processor. | ||
| 185 | Console: colour VGA+ 80x25 | ||
| 186 | Calibrating delay loop... 599.65 BogoMIPS | ||
| 187 | Memory: 106808k/128064k available (1351k kernel code, 20868k reserved, 528k data, 108k init, 0k highmem) | ||
| 188 | Checking if this processor honours the WP bit even in supervisor mode... Ok. | ||
| 189 | Dentry cache hash table entries: 16384 (order: 5, 131072 bytes) | ||
| 190 | Inode cache hash table entries: 8192 (order: 4, 65536 bytes) | ||
| 191 | Mount cache hash table entries: 512 (order: 0, 4096 bytes) | ||
| 192 | Buffer cache hash table entries: 4096 (order: 2, 16384 bytes) | ||
| 193 | Page-cache hash table entries: 32768 (order: 5, 131072 bytes) | ||
| 194 | Working around Cyrix MediaGX virtual DMA bugs. | ||
| 195 | CPU: After generic, caps: 00808131 00818131 00000000 00000001 | ||
| 196 | CPU: Common caps: 00808131 00818131 00000000 00000001 | ||
| 197 | CPU: NSC Geode(TM) Integrated Processor by National Semi stepping 02 | ||
| 198 | Checking 'hlt' instruction... OK. | ||
| 199 | POSIX conformance testing by UNIFIX | ||
| 200 | ACPI: Subsystem revision 20040326 | ||
| 201 | ACPI: Interpreter disabled. | ||
| 202 | PCI: Using configuration type 1 | ||
| 203 | PCI: Probing PCI hardware | ||
| 204 | PCI: Probing PCI hardware (bus 00) | ||
| 205 | PCI: Fixup for MediaGX/Geode Slave Disconnect Boundary (0x41=0x9c) | ||
| 206 | Linux NET4.0 for Linux 2.4 | ||
| 207 | Based upon Swansea University Computer Society NET3.039 | ||
| 208 | Initializing RT netlink socket | ||
| 209 | Starting kswapd | ||
| 210 | devfs: v1.12d (20021015) Richard Gooch (rgooch@atnf.csiro.au) | ||
| 211 | devfs: boot_options: 0x1 | ||
| 212 | Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher | ||
| 213 | intelfb: Framebuffer driver for Intel(R) 830M/845G/852GM/855GM/865G chipsets | ||
| 214 | intelfb: Version 0.7.7, written by David Dawes <dawes@tungstengraphics.com> | ||
| 215 | tridentfb: Trident framebuffer 0.7.5 initializing | ||
| 216 | keyboard: Timeout - AT keyboard not present?(ed) | ||
| 217 | keyboard: Timeout - AT keyboard not present?(f4) | ||
| 218 | pty: 256 Unix98 ptys configured | ||
| 219 | Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled | ||
| 220 | RAMDISK driver initialized: 16 RAM disks of 17080K size 1024 blocksize | ||
| 221 | NET4: Linux TCP/IP 1.0 for NET4.0 | ||
| 222 | IP Protocols: ICMP, UDP, TCP, IGMP | ||
| 223 | IP: routing cache hash table of 512 buckets, 4Kbytes | ||
| 224 | TCP: Hash tables configured (established 8192 bind 16384) | ||
| 225 | NET4: Unix domain sockets 1.0/SMP for Linux NET4.0. | ||
| 226 | RAMDISK: squashfs filesystem found at block 0 | ||
| 227 | RAMDISK: Loading 17078 blocks [1 disk] into ram disk... done. | ||
| 228 | Freeing initrd memory: 17128k freed | ||
| 229 | VFS: Mounted root (squashfs filesystem) readonly. | ||
| 230 | Mounted devfs on /dev | ||
| 231 | Freeing unused kernel memory: 108k freed | ||
| 232 | usb.c: registered new driver usbdevfs | ||
| 233 | usb.c: registered new driver hub | ||
| 234 | usb-uhci.c: $Revision: 1.275 $ time 18:01:58 Feb 21 2006 | ||
| 235 | usb-uhci.c: High bandwidth mode enabled | ||
| 236 | usb-uhci.c: v1.275:USB Universal Host Controller Interface driver | ||
| 237 | PCI: Setting latency timer of device 00:13.0 to 64 | ||
| 238 | usb-ohci.c: USB OHCI at membase 0xc00cc000, IRQ 6 | ||
| 239 | usb-ohci.c: usb-00:13.0, Compaq Computer Corporation ZFMicro Chipset USB | ||
| 240 | usb.c: new USB bus registered, assigned bus number 1 | ||
| 241 | hub.c: USB hub found | ||
| 242 | hub.c: 2 ports detected | ||
| 243 | usb.c: registered new driver hid | ||
| 244 | hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz> | ||
| 245 | hid-core.c: USB HID support drivers | ||
| 246 | mice: PS/2 mouse device common for all mice | ||
| 247 | hub.c: new USB device 00:13.0-1, assigned address 2 | ||
| 248 | hub.c: USB hub found | ||
| 249 | hub.c: 4 ports detected | ||
| 250 | hub.c: new USB device 00:13.0-1.2, assigned address 3 | ||
| 251 | input: USB HID v1.10 Keyboard [ USB Keyboard] on usb1:3.0 | ||
| 252 | input: USB HID v1.10 Device [ USB Keyboard] on usb1:3.1 | ||
| 253 | hub.c: new USB device 00:13.0-1.3, assigned address 4 | ||
| 254 | input: USB HID v1.10 Mouse [05e3:1205] on usb1:4.0 | ||
| 255 | natsemi dp8381x driver, version 1.07+LK1.0.17, Sep 27, 2002 | ||
| 256 | originally by Donald Becker <becker@scyld.com> | ||
| 257 | http://www.scyld.com/network/natsemi.html | ||
| 258 | 2.4.x kernel port by Jeff Garzik, Tjeerd Mulder | ||
| 259 | eth0: NatSemi DP8381[56] at 0xc883d000, 00:80:64:1e:48:f3, IRQ 10. | ||
| 260 | eth0: link up. | ||
| 261 | usb-uhci.c: $Revision: 1.275 $ time 18:01:58 Feb 21 2006 | ||
| 262 | usb-uhci.c: High bandwidth mode enabled | ||
| 263 | usb-uhci.c: v1.275:USB Universal Host Controller Interface driver | ||
| 264 | inserting floppy driver for 2.4.32-2pxes | ||
| 265 | Floppy drive(s): fd0 is unknown type 7 (usb?), fd1 is 360K PC | ||
| 266 | floppy0: Unable to grab IRQ6 for the floppy driver | ||
| 267 | SCSI subsystem driver Revision: 1.00 | ||
| 268 | Initializing USB Mass Storage driver... | ||
| 269 | usb.c: registered new driver usb-storage | ||
| 270 | USB Mass Storage support registered. | ||
| 271 | Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4 | ||
| 272 | ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx | ||
| 273 | isapnp: Scanning for PnP cards... | ||
| 274 | isapnp: No Plug & Play device found | ||
| 275 | Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996 | ||
| 276 | sb: No ISAPnP cards found, trying standard ones... | ||
| 277 | SB 4.12 detected OK (220) | ||
| 278 | Too much work in interrupt on uart401 (0x330). UART jabbering ?? | ||
| 279 | parport0: PC-style at 0x3bc [PCSPP(,...)] | ||
| 280 | parport1: PC-style at 0x378 [PCSPP(,...)] | ||
| 281 | parport2: PC-style at 0x278 [PCSPP(,...)] | ||
| 282 | lp0: using parport0 (polling). | ||
| 283 | lp1: using parport1 (polling). | ||
| 284 | lp2: using parport2 (polling). | ||
| 285 | P192168100251# | ||
| 10 | FloaTy | 286 | </verbatim> |
| 11 | BishopClark | 287 | ---- |
| 288 | ! Patching the Firmware with DD | ||
| 289 | |||
| 290 | I tried patching the firmware | ||
| 291 | |||
| 292 | #natsemi:dp83815 -- 0x100b,0x0020 | ||
| 293 | #HD (experimental) Hard Disk Partition Image (.zhd) | ||
| 294 | #default-values + CONFIG_PCI_DIRECT | ||
| 295 | |||
| 296 | and received a ~~22.54k eb-5.4.2-natsemi.zhd . | ||
| 297 | |||
| 298 | I used dd to patch my stock binfile: | ||
| 299 | |||
| 14 | MilanHauth | 300 | <verbatim> |
| 301 | dd if=/tmp/eb-5.4.2-natsemi.zhd of=/tftpboot/evo/U48CPQ163.bin | ||
| 302 | </verbatim> | ||
| 11 | BishopClark | 303 | |
| 304 | However, the unit hates this new, very small file: | ||
| 14 | MilanHauth | 305 | |
| 11 | BishopClark | 306 | <verbatim> |
| 14 | MilanHauth | 307 | May 24 01:43:38 fishy in.tftpd[5271]: RRQ from 192.168.0.125 filename /tftpboot/evo/U48CPQ163.bin |
| 11 | BishopClark | 308 | </verbatim> |
| 14 | MilanHauth | 309 | |
| 310 | repeated about 50 times per second | ||
| 11 | BishopClark | 311 | |
| 312 | the old binfile is 48544412b; this new one is 23594b. Is that as much a concern as I think it is? | ||
| 313 | |||
| 314 | Anyway, my 48/64 is still unhappy. I even got desperate and random: | ||
| 14 | MilanHauth | 315 | |
| 11 | BishopClark | 316 | <verbatim> |
| 14 | MilanHauth | 317 | Uploading /tftpboot/evo/pxes-1.2-2PB-2.6.nbi [4002](02) |
| 318 | Upload Successful [4002](01) | ||
| 11 | BishopClark | 319 | </verbatim> |
| 14 | MilanHauth | 320 | |
| 11 | BishopClark | 321 | And nothing more.... |
| 12 | FloTy | 322 | |
| 323 | ... it seems, that you have tried to patch direct into the org.-firmware-file and without offset ... | ||
| 324 | |||
| 325 | set up a loopdevice as decribed above: | ||
| 326 | |||
| 14 | MilanHauth | 327 | <verbatim> |
| 328 | losetup -o 834198 /dev/loop0 firmware.bin | ||
| 329 | # 834198 is the offset for the 48/64-T20 | ||
| 330 | # other mem-configs use firmware with different offsets | ||
| 331 | # you can identify the ntfs-partition-header with a hex-editor | ||
| 332 | # have a look in the 48/64-Firmware and compare the pattern with your | ||
| 333 | # machine-specific firmware-file | ||
| 334 | </verbatim> | ||
| 12 | FloTy | 335 | |
| 336 | and then | ||
| 337 | |||
| 14 | MilanHauth | 338 | <verbatim> |
| 339 | dd if=etherboot-image.zhd of=/dev/loop0 bs=512 seek=1 | ||
| 340 | </verbatim> | ||
| 12 | FloTy | 341 | |
| 342 | now the patch is written to the right position in the mounted | ||
| 343 | firmware-file and you can send this file to your machine | ||
| 344 | |||
| 16 | DanielLawson | 345 | !!! patching to the part of the firmware the soft-bios and flash-tools are located can break the machine - be carefull |
| 12 | FloTy | 346 | |
| 347 | floaty | ||
| 13 | FloTy | 348 | |
| 349 | ps.: the mofu's from lycos have killed my account, so my splash-screens are no longer online | ||
| 17 | DanielLawson | 350 | |
| 351 | |||
| 352 | ---- | ||
| 353 | |||
| 354 | CategoryHardware |
lib/blame.php:177: Warning: Invalid argument supplied for foreach() (...repeated 9 times)