View Source: CompaqEvoT20Notes - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
The Compaq Evo T20 is a thin-client device targetted at Windows TS or Citrix TS services.

! Specifications:
* 300 MHz Geode CPU
* 16 - 256 MB flash
* 32 - 256 MB ram
* 4 USB ports
* No PS/2 ports (legacy free)

!Available Configurations: (Flash/RAM size)

* 16/32
* 32/64
* 48/64
* 64/64
* 64/96
* 96/128
* 128/128
* 192/256
* 256/256

! Operating Systems

The 192/256 and 256/256 models have WinXPe on them, the other models have WinNTe.

! Video depth

It appears that the driver [XOrg] uses for this unit can't support a bit depth of 24bits, but it does support 16bits.

! [PXE] Boot

The 64/64 model has an image for WinNTe + PXE, which can be downloaded from Compaq's website. The WinXPe models appear to both support [PXE] boot. If you don't have one of these models, the other models can be made to PXE boot by modifying the firmware.

! Flashing the device

You need a program called netxfer, available from Compaq's download site. This needs MS Java, however, which is not available from MS anymore. Try http://java-virtual-machine.net/download.htm



!!General notes

Interestingly, if you allow the bootp to wait, it times out after an hour and tries to tftp /tftpboot/kernel on port 10069.

If you don't have a PXE boot model, or you wish to run linux locally, you could look at what is meant to be a master reference for [Linux on the Evo T20|http://open-evot20.sourceforge.net/] - this has a mailling list and links to [hacking the firmware|http://www.kazak.ws/evo/] and [DEvoSL - DSL on Evo T20 HowTo|http://www.mowson.org/karl/evo_t20/]

!! Notes on flashing the firmware.


tried the stuff above - i'm not really a hacker - but ... yes it works !


my way:

since i saw a cheap t20 on ebay i've looked for information to run linux/bsd on this machine, then i found the solution from Dag Sverre and got a t20 with 96/128 memory configuration fom ebay (30$).

first i've downloaded the firmware-image (U96CPQ163.bin) from hp-support-site and compared it with the 48/64-imgefile from Dags machine: the offset differs, while it seems to be exactly the same stuff is contained and loaded up before starting up the NTe-Image (don't ask me).

<verbatim>
	# for the entire file:
	losetup -o 834236 /dev/loop0 U96CPQ163.bin
	# for the contained ntfs-filesystem
	losetup -o 834748 /dev/loop1 U96CPQ163.bin

	mount -t ntfs /dev/loop1 /mountpoint
	cd /mountpoint
	ls -l
</verbatim>



! first i tried to manipulate the bootloader with grub for nt

http://marc.herbert.free.fr/linux/win2linstall.html#grub-for-nt

but neither i can't edit the boot.ini file nor i can't write a "menu.lst"-file to the filesystem (file truncated, no rights ...)

... probing on a standard-machine: the default-entry in boot.ini seems to be useless, while the NT-startup-routine allways tries to boot up the NT-environment, also when i put the c:\grldr="Start GRUB" to this position
(it would be fine, if somebody could explain me the sense of the default-entry in boot.ini)
(... another problem there's no keyboard available on a t20 at this moment to change to the grub entry - with legacy keyboard support this no problem ... but for my evo-t20 - no way!)



! so i tried "Making GRUB work"

commented out the A20-calls in "builtins.c" and "common.c" patched the other files as described (maybe i have forget/ignored to comment out the routine itself in "asm.S" - don't know if this is nessesary) and wrote the preset-menu (may be i failed here - i wrote all in the same row - shit!)

after compiling, patching

<verbatim>
	dd if=my-compiled-grub-src/stage1/stage1 of=/dev/loop0 bs=512 seek=1
	dd if=my-compiled-grub-src/stage2/stage2 of=/dev/loop0 bs=512 seek=2
</verbatim>

and flashing (with netxfer)... and rebooting ...

... the machine waited for me at the grub command-prompt (no preset-menu) ... without having a keyboard - kacke!



! i've tried some etherboot images

http://rom-o-matic.net

(but which kind of it?)
after testing with version 5.4.1 as a floppy bootable ROM-Image (.zdsk) and Binary ROM-Image (.zrom) i tried a HD-Image (experimental)(.zhd) but forget to enable "direct-PCI-Support" (machine boots up (hooray) ... and - no wonder - can't find a NIC) ... after enabling Direct-PCI i got a compiler-error

! i've tried version 5.4.2pre2 with these settings:

1. natsemi:dp83815 -- 0x100b,0x0020

2. HD (experimental) Hard Disk Partition Image (.zhd)

3. default-values + CONFIG_PCI_DIRECT

and got a "eb-5.4.2pre2-natsemi.zhd"



! now i have patched the firmware with this image

<verbatim>
	dd if=eb-5.4.2pre2-natsemi.zhd of=/dev/loop0 bs=512 seek=1
</verbatim>

then i have flashed the patched U96CPQ163.bin to my t20 ... rebooted ... and:

! BINGO! ### a DHCP/PXE-Request on my sniffer-screen and the machine replies on ICMP-Requests

i hope the hardest part is done.
next days i will try to boot some LinTS-images and my own bsd-stuff for building a diskless FreeRADIUS-Server and a RDP/X-Client ... will tell you about my experiences

floaty



! changing bootscreen und booting up pxes-prebuild client over the network

bootscreen:

the bitmap from bootup is ugly :

http://mitglied.lycos.de/szeissig/bilch.bmp

my screen is not really beautifull but inspired (from this web-site) :

http://mitglied.lycos.de/szeissig/bilch-patch.bmp


patching the bitmap is easy:
#note the filesize of your startup.bmp while flashing firmware
#the bitmap is before your (unused) mbr (remember the offset - for me starts at 834236) the filesize is 14120 bytes
#you find the bmp-header: BM(7......
#make your own screen.bmp (640 x 480 x 8 BPP)
#patch the new screen with dd or a hex-editor
#flashing - finished


! booting the prebuild-client:

http://downloads.2x.com/pxes/1.1.1/PREBUILT/

#download *.nbi file for etherboot
#set up dhcp / tftp (for me tftpd32 ... yes!, quick & dirty!)
#boot the machine (have a look on your brand new start-up screen) - fertich



<verbatim>
	P192168100251# dmesg
	Linux version 2.4.32-2pxes (diego@thindev) (gcc version 3.3.5 (Debian 1:3.3.5-8)) #3 Tue Feb 21 18:02:22 EST 2006
	BIOS-provided physical RAM map:
	BIOS-e801: 0000000000000000 - 000000000009f000 (usable)
	BIOS-e801: 0000000000100000 - 0000000007d10000 (usable)
	125MB LOWMEM available.
	On node 0 totalpages: 32016
	zone(0): 4096 pages.
	zone(1): 27920 pages.
	zone(2): 0 pages.
	DMI not present.
	ACPI: Unable to locate RSDP
	Kernel command line: rw root=/dev/nfs ramdisk_size=17080 initrd=pxes-1.1-1PB.squash ro root=/dev/ram
	Initializing CPU#0
	Working around Cyrix MediaGX virtual DMA bugs.
	Detected 300.683 MHz processor.
	Console: colour VGA+ 80x25
	Calibrating delay loop... 599.65 BogoMIPS
	Memory: 106808k/128064k available (1351k kernel code, 20868k reserved, 528k data, 108k init, 0k highmem)
	Checking if this processor honours the WP bit even in supervisor mode... Ok.
	Dentry cache hash table entries: 16384 (order: 5, 131072 bytes)
	Inode cache hash table entries: 8192 (order: 4, 65536 bytes)
	Mount cache hash table entries: 512 (order: 0, 4096 bytes)
	Buffer cache hash table entries: 4096 (order: 2, 16384 bytes)
	Page-cache hash table entries: 32768 (order: 5, 131072 bytes)
	Working around Cyrix MediaGX virtual DMA bugs.
	CPU:     After generic, caps: 00808131 00818131 00000000 00000001
	CPU:             Common caps: 00808131 00818131 00000000 00000001
	CPU: NSC Geode(TM) Integrated Processor by National Semi stepping 02
	Checking 'hlt' instruction... OK.
	POSIX conformance testing by UNIFIX
	ACPI: Subsystem revision 20040326
	ACPI: Interpreter disabled.
	PCI: Using configuration type 1
	PCI: Probing PCI hardware
	PCI: Probing PCI hardware (bus 00)
	PCI: Fixup for MediaGX/Geode Slave Disconnect Boundary (0x41=0x9c)
	Linux NET4.0 for Linux 2.4
	Based upon Swansea University Computer Society NET3.039
	Initializing RT netlink socket
	Starting kswapd
	devfs: v1.12d (20021015) Richard Gooch (rgooch@atnf.csiro.au)
	devfs: boot_options: 0x1
	Squashfs 2.2-r2 (released 2005/09/08) (C) 2002-2005 Phillip Lougher
	intelfb: Framebuffer driver for Intel(R) 830M/845G/852GM/855GM/865G chipsets
	intelfb: Version 0.7.7, written by David Dawes <dawes@tungstengraphics.com>
	tridentfb: Trident framebuffer 0.7.5 initializing
	keyboard: Timeout - AT keyboard not present?(ed)
	keyboard: Timeout - AT keyboard not present?(f4)
	pty: 256 Unix98 ptys configured
	Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
	RAMDISK driver initialized: 16 RAM disks of 17080K size 1024 blocksize
	NET4: Linux TCP/IP 1.0 for NET4.0
	IP Protocols: ICMP, UDP, TCP, IGMP
	IP: routing cache hash table of 512 buckets, 4Kbytes
	TCP: Hash tables configured (established 8192 bind 16384)
	NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
	RAMDISK: squashfs filesystem found at block 0
	RAMDISK: Loading 17078 blocks [1 disk] into ram disk... done.
	Freeing initrd memory: 17128k freed
	VFS: Mounted root (squashfs filesystem) readonly.
	Mounted devfs on /dev
	Freeing unused kernel memory: 108k freed
	usb.c: registered new driver usbdevfs
	usb.c: registered new driver hub
	usb-uhci.c: $Revision: 1.275 $ time 18:01:58 Feb 21 2006
	usb-uhci.c: High bandwidth mode enabled
	usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
	PCI: Setting latency timer of device 00:13.0 to 64
	usb-ohci.c: USB OHCI at membase 0xc00cc000, IRQ 6
	usb-ohci.c: usb-00:13.0, Compaq Computer Corporation ZFMicro Chipset USB
	usb.c: new USB bus registered, assigned bus number 1
	hub.c: USB hub found
	hub.c: 2 ports detected
	usb.c: registered new driver hid
	hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>
	hid-core.c: USB HID support drivers
	mice: PS/2 mouse device common for all mice
	hub.c: new USB device 00:13.0-1, assigned address 2
	hub.c: USB hub found
	hub.c: 4 ports detected
	hub.c: new USB device 00:13.0-1.2, assigned address 3
	input: USB HID v1.10 Keyboard [  USB Keyboard] on usb1:3.0
	input: USB HID v1.10 Device [  USB Keyboard] on usb1:3.1
	hub.c: new USB device 00:13.0-1.3, assigned address 4
	input: USB HID v1.10 Mouse [05e3:1205] on usb1:4.0
	natsemi dp8381x driver, version 1.07+LK1.0.17, Sep 27, 2002
	originally by Donald Becker <becker@scyld.com>
	http://www.scyld.com/network/natsemi.html
	2.4.x kernel port by Jeff Garzik, Tjeerd Mulder
	eth0: NatSemi DP8381[56] at 0xc883d000, 00:80:64:1e:48:f3, IRQ 10.
	eth0: link up.
	usb-uhci.c: $Revision: 1.275 $ time 18:01:58 Feb 21 2006
	usb-uhci.c: High bandwidth mode enabled
	usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
	inserting floppy driver for 2.4.32-2pxes
	Floppy drive(s): fd0 is unknown type 7 (usb?), fd1 is 360K PC
	floppy0: Unable to grab IRQ6 for the floppy driver
	SCSI subsystem driver Revision: 1.00
	Initializing USB Mass Storage driver...
	usb.c: registered new driver usb-storage
	USB Mass Storage support registered.
	Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
	ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
	isapnp: Scanning for PnP cards...
	isapnp: No Plug & Play device found
	Soundblaster audio driver Copyright (C) by Hannu Savolainen 1993-1996
	sb: No ISAPnP cards found, trying standard ones...
	SB 4.12 detected OK (220)
	Too much work in interrupt on uart401 (0x330). UART jabbering ??
	parport0: PC-style at 0x3bc [PCSPP(,...)]
	parport1: PC-style at 0x378 [PCSPP(,...)]
	parport2: PC-style at 0x278 [PCSPP(,...)]
	lp0: using parport0 (polling).
	lp1: using parport1 (polling).
	lp2: using parport2 (polling).
	P192168100251#
</verbatim>
----
! Patching the Firmware with DD

I tried patching the firmware

#natsemi:dp83815 -- 0x100b,0x0020
#HD (experimental) Hard Disk Partition Image (.zhd)
#default-values + CONFIG_PCI_DIRECT

and received a ~~22.54k eb-5.4.2-natsemi.zhd .

I used dd to patch my stock binfile:

<verbatim>
	dd if=/tmp/eb-5.4.2-natsemi.zhd of=/tftpboot/evo/U48CPQ163.bin
</verbatim>

However, the unit hates this new, very small file:

<verbatim>
	May 24 01:43:38 fishy in.tftpd[5271]: RRQ from 192.168.0.125 filename /tftpboot/evo/U48CPQ163.bin
</verbatim>

repeated about 50 times per second

the old binfile is 48544412b;  this new one is 23594b.  Is that as much a concern as I think it is?

Anyway, my 48/64 is still unhappy.  I even got desperate and random:

<verbatim>
	Uploading /tftpboot/evo/pxes-1.2-2PB-2.6.nbi  [4002](02)
	Upload Successful [4002](01)
</verbatim>

And nothing more....

... it seems, that you have tried to patch direct into the org.-firmware-file and without offset ...

set up a loopdevice as decribed above:

<verbatim>
	losetup -o 834198 /dev/loop0 firmware.bin
	# 834198 is the offset for the 48/64-T20
	# other mem-configs use firmware with different offsets
	# you can identify the ntfs-partition-header with a hex-editor
	# have a look in the 48/64-Firmware and compare the pattern with your
	# machine-specific firmware-file
</verbatim>

and then

<verbatim>
	dd if=etherboot-image.zhd of=/dev/loop0 bs=512 seek=1
</verbatim>

now the patch is written to the right position in the mounted
firmware-file and you can send this file to your machine

!!! patching to the part of the firmware the soft-bios and flash-tools are located can break the machine - be carefull

floaty

ps.: the mofu's from lycos have killed my account, so my splash-screens are no longer online


----

CategoryHardware
2 pages link to CompaqEvoT20Notes:
Last edited on Wednesday, May 16, 2007 7:46:20 am by KarlMowattWilson
Edit PageHistory Diff Info LikePages