Managed to get to a Linux shell prompt by UART booting a zimage based on the Leapster Explorer kernel source and an initramfs containing a custom rootfs and modules that support SD/MMC cards.
The kernel module setup needs more refinement...
LF1000 # go 1800000 ## Starting application at 0x01800000 ... Uncompressing Linux............................................................................................................................................... done, booting the kernel. Linux version 2.6.31-leapfrog (mgold@mgold-garage) (gcc version 4.4.3 (GCC) ) #40 Sat Nov 13 01:16:54 EST 2010 CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177 CPU: VIVT data cache, VIVT instruction cache Machine: ARM-LF1000 Warning: bad configuration page, trying to continue Memory policy: ECC disabled, Data cache writeback lf1000_oscvco_set.50 changing pll 0, old=0x00250001, new=0x00496300 PLL0=532.500000 MHz lf1000_oscvco_set.50 changing pll 1, old=0x00348E01, new=0x0024C402 PLL1=147.000 MHz Built 1 zonelists in Zone order, mobility grouping on. Total pages: 27940 Kernel command line: init=/bin/busybox console=ttyS0,115200 mem=110M PID hash table entries: 512 (order: 9, 2048 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 110MB = 110MB total Memory: 106780KB available (2684K code, 314K data, 1608K init, 0K highmem) NR_IRQS:42 TIM0= 4.593 MHz TIM1= 4.593 MHz TIM2= 4.593 MHz TIM3= 4.593 MHz TIM4= 4.593 MHz console [ttyS0] enabled Calibrating delay loop (skipped) preset value.. 1065.00 BogoMIPS (lpj=5325000) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 bio: create slab at 0 usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered NET: Registered protocol family 1 arch/arm/mach-lf1000/gpio_main.c.check_for_touchscreen:1346 X2 == high, no touchscreen Reading Board ID = 0 msgmni has been set to 208 alg: No test for stdrng (krng) io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x0 (irq = 10) is a 8250 serial8250: ttyS1 at MMIO 0x0 (irq = 34) is a 8250 serial8250: ttyS2 at MMIO 0x0 (irq = 35) is a 8250 serial8250: ttyS3 at MMIO 0x0 (irq = 36) is a 8250 brd: module loaded loop: module loaded ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver usb_hcd_lf1000_probe hcd->regs: xc706e000 before ohci_hcd_init() after ohci_hcd_init() lf1000-ohci lf1000-ohci: LF1000 OHCI lf1000-ohci lf1000-ohci: new USB bus registered, assigned bus number 1 lf1000-ohci lf1000-ohci: irq 28, io mem 0xc000d000 ohci->regs: xc706e000 &ohci->regs->control: xc706e004 ioread32(&ohci->regs->control): 0x0 after hcd->driver->start usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 2 ports detected usb_add_hcd() returns 0 after usb_add_hcd() usb_hcd_lf1000_probe returns IRQ 31/lf1000-rtc: IRQF_DISABLED is not guaranteed on shared IRQs lf1000-rtc lf1000-rtc: rtc core: registered lf1000-rtc as rtc0 LF1000 Real Time Clock driver. i2c /dev entries driver Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 0) setAudioRate: expected rate 32000Hz, actual: 32001Hz *** MLC mlc_fb_addr=00000000 size=00000000 fb[0]=00000000 *** lf1000-dpc driver dpc: DPC not enabled, do config+enable dpc: PWM clock rate is 9800000 input: LF1000 USB as /class/input/input0 lf1000_power_probe.647 input: Power Button as /class/input/input1 usb 1-1: new full speed USB device using lf1000-ohci and address 2 lf1000_power_probe.717 initial battery reading is :9575 input: LF1000 Keyboard as /class/input/input2 resource BUTTON_VOLUMEUP (16) port is undefined (-1) resource BUTTON_VOLUMEUP (16) pin is undefined (-1) resource BUTTON_VOLUMEDOWN (17) port is undefined (-1) resource BUTTON_VOLUMEDOWN (17) pin is undefined (-1) dm9000 Ethernet Driver, V1.31 Advanced Linux Sound Architecture Driver Version 1.0.20. ALSA device list: No soundcards found. TCP cubic registered NET: Registered protocol family 17 lf1000-rtc lf1000-rtc: setting system clock to 1974-11-13 01:19:20 UTC (153537560) Freeing init memory: 1608K usb 1-1: device descriptor read/64, error -62 # # Executing /init # sh: can't access tty; job control turned off / # usb 1-1: device descriptor read/64, error -62 usb 1-1: new full speed USB device using lf1000-ohci and address 3 usb 1-1: device descriptor read/64, error -62 usb 1-1: device descriptor read/64, error -62 usb 1-1: new full speed USB device using lf1000-ohci and address 4 usb 1-1: device not accepting address 4, error -62 usb 1-1: new full speed USB device using lf1000-ohci and address 5 usb 1-1: device not accepting address 5, error -62 hub 1-0:1.0: unable to enumerate USB device on port 1 / # cat /proc/meminfo MemTotal: 108540 kB MemFree: 100960 kB Buffers: 0 kB Cached: 5016 kB SwapCached: 0 kB Active: 744 kB Inactive: 4520 kB Active(anon): 248 kB Inactive(anon): 0 kB Active(file): 496 kB Inactive(file): 4520 kB Unevictable: 0 kB Mlocked: 0 kB SwapTotal: 0 kB SwapFree: 0 kB Dirty: 0 kB Writeback: 0 kB AnonPages: 272 kB Mapped: 444 kB Slab: 1788 kB SReclaimable: 456 kB SUnreclaim: 1332 kB PageTables: 48 kB NFS_Unstable: 0 kB Bounce: 0 kB WritebackTmp: 0 kB CommitLimit: 54268 kB Committed_AS: 640 kB VmallocTotal: 278528 kB VmallocUsed: 18592 kB VmallocChunk: 246780 kB / # ls bin init linuxrc proc usr dev lib lost+found sbin etc libold mnt sys / # modprobe lf1000_mmc lf1000_mmc: Unknown symbol mmc_request_done lf1000_mmc: Unknown symbol mmc_remove_host lf1000_mmc: Unknown symbol mmc_alloc_host lf1000_mmc: Unknown symbol mmc_add_host lf1000_mmc: Unknown symbol mmc_free_host # XXX: checking for SDIO... lf1000-sdio lf1000-sdio: response timeout lf1000-sdio lf1000-sdio: response timeout lf1000-sdio lf1000-sdio: response timeout lf1000-sdio lf1000-sdio: response timeout XXX: checking for SD... XXX: SD... mmc0: host does not support reading read-only switch. assuming write-enable. mmc0: new SD card at address 0001 / # modprobe mmc_block mmcblk0: mmc0:0001 00000 1.89 GiB mmcblk0: p1 / # mount /dev/mmcblk0p1 /mnt / # ls /mnt initrd~1.gz zImage-46M-WORKING zimage~1 initrd~1.gz zImage.NAND-LX zimage~1 initrd~1.gz zimage~1 zimage~1 trash-~1 zimage~1 zimage~2 zImage zimage~1 / #