There are many ways of booting SHR on the nokia n900. The nokia n900 has many storage devices:

  • 256M of NAND
  • 32G eMMC
  • a microsd slot


Here's the NAND:

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bootloader"
mtd1: 00060000 00020000 "config"
mtd2: 00040000 00020000 "log"
mtd3: 00200000 00020000 "kernel"
mtd4: 00200000 00020000 "initfs"
mtd5: 0fb40000 00020000 "rootfs"

mtd0 contains 2 bootloaders:

  • xloader
  • nolo


  • xloader is proprietary and signed(can't be changed currently)
  • xloader loads nolo
  • xloader can be coldflashed with flasher(that features has not been replaced yet in 0xFFFF and I had no success with pusb)


  • nolo is proprietary and unsigned(could be replaced if someone write a replacement)
  • nolo has battery charging capabilities
  • nolo is capable of flashing things(for instance the kernel,the rootfs and so on)
  • nolo loads the kernel


The config partition is used for storing device specific configurations

The log partition is used for mtdoops


Here's the eMMC:

# cat /proc/partitions 
major minor  #blocks  name

 179        0   31264768 mmcblk0
 179        1   28315648 mmcblk0p1
 179        2    2097152 mmcblk0p2
 179        3     786432 mmcblk0p3

Here are the mounts of the eMMC in maemo :

# df -h | grep mmc
/dev/mmcblk0p1           27.0G    335.2M     26.7G   1% /home/user/MyDocs
/dev/mmcblk0p2            2.0G    396.3M      1.5G  21% /home
# cat /proc/swaps 
Filename                                Type            Size    Used    Priority
/dev/mmcblk0p3                          partition       786424  60948   -1


The microsd slot can be accessed removing the back cover. Note that Removing the cover while the phone is running is a bad idea since the kernel will stop reading and writing to the microsd.


There are currently 3 ways of booting SHR:

  • flashing a zImage on the kernel NAND partition
  • flashing a chainloaded combined(contains also a maemo kernel) u-boot image on the kernel NAND partition
  • flashing a kexecboot image on the kernel NAND partition

zImage on NAND

  • very fast boot time (less than 30 sec to Xorg loaded)
  • loading maemo needs reflasing or kexec-ing


  • fast boot time
  • cannot charge the battery(do not stay too long in uboot when the battery is low)
  • has some problems with some microsd(works fine with 4GB, I had issues with a 16GB microsd)
  • no poweroff(must boot and then power off)
  • can boot maemo
  • difficult to change the configuration(the user must create a boot.scr that has to be loaded manually)


  • very long boot time(about 1 minute and 30 seconds)
  • no visual feedback during the one minute
  • supports reboot and poweroff
  • good microsd compatibility(kernel)
  • could support battery charging if someone makes an init script(a charging script is already available) and add it to the kexecboot image
  • some problems in maemo such as buttons press not beeing taken into account with the cameras buttons.


There are mainly 2 flashers that can talk to nolo:

  • 0xFFFF
  • flasher

0xFFFF is Free(as in freedom) and open source but has the following drawbacks:

  • it cannot coldboot the bootloaders
  • it has to flash an image(it cannot just send it and boot it without flashing)
  • it has some difficulties flashing maemo PR 1.3 images(but a workarround exist, decompose the image and flash the individual pieces). altough it's capable of flashing a .fastboot kernel.

Note that if you have some difficulties with the USB, you can press u during the nolo boot. it'll hold nolo in the usb flashing mode longer.


The nokia n900 has some watchdogs, in fact you can see them with 0xFFFF:

# ./0xFFFF -i
Waiting for device... -009 found!
found n770/n810/n900 (0421:0105)
No software version detected
HW revision string: 'prod_code:RX-51,hw_rev:2204'
SubVersionString autodetected: '2204'
Root device is: flash
Device's USB mode is 'client'
Current rd flag setting:
disable OMAP watchdog  : set
disable RETU watchdog  : set
disable lifeguard reset: not set
enable serial console  : not set
disable USB timeout    : not set

The watchdog, if not fed, will reboot your phone. if you don't want that to happen you can disable them:

# ./0xFFFF -f help
* Flags are composed of:
  0x02 - disable OMAP watchdog (possibly)
  0x04 - disable RETU watchdog (possibly)
  0x08 - disable lifeguard reset
  0x10 - enable serial console
  0x20 - disable USB timeout
./0xFFFF -f 0x06

will disable both modem and Main CPU watchdog


0xFFFF installation

hg clone
cd 0xFFFF/
cd src/
./0xFFFF -h

To use it do:

sudo ./0xFFFF -i

that will keep you in the bootloader and permit you to wait longer for sending commands to it

kexecboot dual-boot installation

Install the kernel-power maemo kernel in maemo:

apt-get install kernel-power-settings kernel-power-bootimg

That will give you a kernel capable of beeing kexec-ed, and will replace the default maemo kernel. Accept the GUI warning. that will make the install continue

Then we must prepare that kernel for kexecboot: put that configuration in /home/user/MyDocs/boot: first create the boot directory:

mkdir /home/user/MyDocs/boot

and put a file named boot.cfg inside boot/ that contains the following text:

# zImage-2.6.28-maemo42
APPEND=init=/sbin/preinit ubi.mtd=rootfs root=ubi0:rootfs rootfstype=ubifs rootflags=bulk_read,no_chk_data_crc rw console=ttyMTD,log console=tty0 snd-soc-rx51.hp_lim=42 snd-soc-tlv320aic3x.hp_dac_lim=6

Also put the kernel there:

cp /boot/zImage-2.6.28-maemo42 /home/user/MyDocs/boot/zImage

kexecboot dual-boot Uninstallation

get the zImage-2.6.28-maemo42 and flash it back with 0xFFFF

u-boot dual-boot installation for the standard maemo kernel

  • go in maemo and install the image of your kernel, if you have the standard kernel do:
    apt-get install kernel-maemo
  • download the correct uboot(SHR version) for your device:
    wget -O u-boot.bin
  • extract the zImage from /boot/zImage-2.6.28-maemo19.fiasco with 0xFFFF
    ./0xFFFF -u zImage-2.6.28-maemo**.fiasco 
  • convert the zImage to an uImage:
    mkimage  -A arm -O linux -T kernel -C none -a 80008000 -e 80008000 -n maemo -d kernel-2.6.28-maemo** uImage
  • combine the uImage and the u-boot image
  • flash the combined u-boot image:

u-boot dual-boot installation for the kernel power maemo kernel

  • Be sure the kernel power image is installed:
    apt-get install kernel-power-settings kernel-power-bootimg
  • Also install openssh server(to get the zImage out of the device)
  • get the zImage on your laptop and convert the zImage to an uImage:
    scp root@n900_ip_address:/boot/zImage-2.6.28-maemo42 ./
    mkimage  -A arm -O linux -T kernel -C none -a 80008000 -e 80008000 -n maemo -d zImage-2.6.28-maemo42 uImage

Replace n900_ip_address by the n900 ip address

  • dowload the correct u-boot:
  • combine the uImage and the u-boot image
    wget -O
  • flash the combined u-boot image:

[TODO] Known-Problems

  • Keyboard right and left sides starts to blink faster for CPU actions and

splash image in boot is 'strange'

./0xFFFF -r 0


  • create a uboot image for the kernel power, else we have:
    $ python builder.py0x2b74c 0x1c38d4
    kernel is too big
  • do an init script for charging and add it to kexecboot-image
Last modified 8 years ago Last modified on Aug 30, 2011, 8:05:43 PM