Hacking the wm8505

So I bought this little Chinese ARM "smartbook."

It was the first of its kind so i thought it was interesting or something... Anyway, I ordered the thing, paid for it, waited about a week, and finally got it... and boy, was it useless...

A little overview:

These "smartbooks" are all generic. Assembled in China, they come with a ARM926EJ-S processor, a Wondermedia wm8505 chipset, 3 USB 2.0 ports, 1 ethernet port, 1 SDHC port, and different amounts of ram. Mine has 128 Mb of ram. They come loaded with Windows CE Embedded 6.0.

It's got a pair of tiny speakers on the sides of the monitor, but no sound ever came out of those. The audio jacks do work, and I guess it wouldn't be so bad to plug a pair of external speakers to it.

As far as applications are concerned, it includes internet explorer, the core media player, a messenger app, winrar, a mail program, a wifi control panel, a few desktop widgets, and a little office suite that can do word documents and excel spreadsheets.

Not bad, really, but then it's only 128 Mb of ram. Internet explorer? Good luck! Disabling images, styles, and pretty much everything that makes the web interesting will get you better results. IE can be a real memory hog. This device did not include any other browser, although I did manage to get Opera mini installed, working fine, and using much less resources than IE.

I got skype installed. Does it work? Well... I never found out. I'm not sure whether it froze every time I logged in, or whether i was just taking a long time to load.

Youtube? Yes but no I mean huh? It does come with a youtube app that is supposed to open youtube videos in the core media player. The only problem is the fact that youtube changes its protocols two or three times a day (ok maybe not that much), and while the youtube app does work for finding youtube videos, the core media player fails miserably when it comes to playing them.

I never tried the mail app... I just don't believe in those.

I suppose winrar does the job, at least.

The office suite is actually kind of ok. I wouldn't dare open more than one document at a time, lest I would lose everything in a heartbeat. It works, but I wouldn't do anything critical on it. It makes you remember to save your work every minute or so.

It does have a built in command line. A very much stripped down version of CMD. DOS? Not exactly. I've yet to figure out exactly what can be done with it, other than cd, dir, and cls.

To sum it all up, you can't really trust the thing to do anything without freezing, forcing you to do a hard shutdown... so yeah, it sucks...

wm8505 smartbook



It's a sad, miserable world

So, I tried to put this little paper weight to some good use. I read in different forums I don't care to cite, that it was possible to install android on it. I actually got a Android 1.5 image to flash it with. But then, as I did more research, I found out it wouldn't work 4 out of 5 times. Not only that, but there was also the possiblity of bricking the thing.

Now, why would installing android on it effectively kill it? Well, it depends.

If the device comes with a NAND flash hard drive, then it is possible to flash android on it. The android image will erase the Windows CE installation, and replace it with android 1.5.

If, on the other hand, it does not have a NAND flash hard drive, but something else, then the android image will succeed in erasing the Windows CE installation, but it will fail to replace it with android, thus rendering the machine useless.

But wait a minute! All of these smartbooks claim to have a NAND flash hard drive, so it should be safe, shouldn't it?

Not really. They're all generic, and they're all advertised to have the same features, but there's little differences, and those little differences can make a huge difference.

The one thing you should be worried about when trying to flash one of these smartbooks is whether or not it has a NAND flash hard drive, and the only way to find out, is to dissassemble it.

So, armed with a hammer, chainsaw, bulldozer, and other random tools, i took it upon myself to kill this little sucker...

This is what I found:

Motherboard back



Let's see what we have here, ok that's one, two, three USB ports; one ethernet, and what the hell is that thing hanging from the umbilical cord? Is that... the wifi adapter?

Yes. It is a ralink rt3070 usb wifi adapter. Not a very elegant solution, but it works.

Motherboard front



Here's a front look at the motherboard. There's the SD card reader on the far right, the daughterboard with the CPU, and, oh goodness... NO NAND FLASH DRIVE... we're screwed.

On the far left, right next to the USB ports, there's a strange looking piece of black plastic... what might that be?

It turns out it's a USB port with a 4 pin header. What where they thinking? What can you possibly connect to a usb port with a 4 pin header? Well, here's what came out of it:

4 pin USB



It's a USB stick, really. It's just that instead of the regular USB port, it has a 4 pin header. AND THAT IS THE HARD DRIVE. God damn... no android, huh?

Speculation has it that this was done in order to save costs. It doesn't make sense really. The usb stick has a NAND flash drive of the same pinout as the daughterboard. I guess they ran out of 'em and just started using whatever they had at hand.

Here's a closer look at the daughterboard. There's an empty space, next to the CPU, where the NAND flash drive would go, had there been one.

Daughterboard



A new hope... or something...

I'd given up on the thing, and was seriously thinking about turning it into a digital picture frame, but then I came across the mother of all operating systems.

Enter Bento Linux. I don't really understand why they had to re brand it. It's just Debian, really, but what the heck. Bento Linux, we'll call it. (Debian is the mother of all operating systems, by the way)

It turns out Bento Linux has a working ARM port of Debian for the wm8505. I'll be damned! Yes, Bento Linux has the same restriction. It can only install to a NAND flash drive. But, it can boot a persistent live image from a SD card.

That's when I started to pay attention to it. Even if it fails to install to physical media, it can still boot, operate, and save changes to the live SD environment.

Bento Linux comes in two parts, each to be extracted into a different partition of the SD card. The 'fatpart' files must be decompressed into a fat partition, and the 'extpart' files go to a ext2 partition.

The 'fatpart' files are basically just the bootloader, while the 'extpart' files are the Debian system.

So, I partitioned a 4 Gb sd card and extracted the files to it, plugged it in, and turned it on... ta da!

Here's a look at the first boot from live SD, command line interface only. Debian is using only 27 out of the 128 Mb ram.

Live



Notice the hostname is "william" for some strange reason. Default user is root with no password. That's something I changed later.

What's really exciting about this is that even though the automatic installation script will fail to copy the files onto the funky usb thing my machine uses as a hard drive, the live system is still able to see it, mount it, AND read and write to it...

This is especially useful. Why? Well It does give me the possibility to install linux on this machine. Not through the automated scripts, but manually. And, it will give me a chance to back up the Windows CE installation, just in case.

It's just a matter of mounting the Windows CE drive, and creating a backup, with tar.

Windows CE drive mounted in Debian



Once the backup is created, and safely copied onto a different storage device, like a usb stick, all the WINCE files can go to hell.

# rm -rf *

and BAM! Windows is gone.

After windows is erased, the drive can be formatted to ext2, and all the files from the Bento Linux 'extpart' compressed archive, can be extracted there, directly from the live SD environment.

Reboot, take card out, and voila! A working Debian GNU/Linux on the wm8505.

Here's a screenshot, taken from inside the system. Notice the hostname has changed to "punchy," and I've also added myself as user "jon." Notice also it's no longer Debian 5. I edited /etc/apt/sources.list and changed it to Debian 6. The upgrade took about 45 minutes.

Screenshot



This screenshot shows ICEWM, RXVT terminal emulator (with BASH, of course), and rox-session managing desktop icons.

I'm using dillo and kazehakaze web browsers. Dillo is much faster, but can't do anything beyond html. I use kazehakaze for fancier sites. Pidgin is my messaging program of choice, as it allows me to add facebook chat, windows live messenger, google talk, yahoo messenger, and skype contacts. Abiword does my word processing, and gnumeric does my spreadsheets. Also added a few games. Unbin (my binary to text converter) works perfectly. I've installed python, as well, and medit, for quick syntax-highlited, code editing.

In order to get a display working, I had to install xserver-xorg-video-fbdev, and edit /etc/X11/xorg.conf accordigly. I was finally able to get sound out of the speakers.

There's no oficially recognized audio device. No driver either. But the open sound system (OSS) does manage to play music through the speakers, whether I use mplayer, sox, or mpg321.

Issues:

Yeah, it can't all be steak and potatoes, can it? There are some issues. One in particular that is highly annoying. Every time, at shutdown, you'll get a kernel panic.

If you're not familiar with Linux, then you've no idea what a kernel panic is. Well, it's the blue screen of death, pretty much... only it's black, not blue... so I guess it's still BSOD...

This happens every time you shut down. Every. God. Damn. Time.

This is because it's trying to set the hardware clock from the system clock, and it's failing to do so.

Solution? Yeah... that...

Go to /etc/init.d/ and remove hwclock.sh and hwclockfirst.sh. A wiser person might tell you to rename them to hwclock.sh.bak and hwclockfirst.sh.bak. But, then again, I ain't wise... so screw it.

Once hwclock.sh and hwclockfirst.sh are gone, create them again, and paste this into each one:


#!/bin/sh
#
hwclocksh()
{
    case "$1" in
start)
    /sbin/wmt-rtc --hw2sys
    ;;
show)
    date
    ;;
    stop)
        /sbin/wmt-rtc --sys2hw
            ;;
    *)
    log_success_msg "Usage: hwclock.sh {start|stop|reload|force-reload|show}"
    log_success_msg "      start sets kernel (system) clock from hardware (RTC) clock"
    log_success_msg "      stop and reload set hardware (RTC) clock from kernel (system) clock"
    return 1
    ;;
    esac
}

hwclocksh "$@"


Both files have to have this in 'em. After that, you have to make sure these files are executable, but issuing:


# chmod a+rwx hwclock.sh hwclockfirst.sh

That's it. Next shutdown will be smooth. Another, quicker, and dirtier, solution is to simply remove /dev/rtc0 every time before shutdown. An alias for shutdown can be created:

alias shutdown='rm /dev/rtc0 && shutdown -h now'

Not as elegant, but it still works.

Wifi works. As mentioned earlier, the adapter is a ralink rt3070. The driver is available, and works. In order to get it to work, it's only a matter of running the following commands, as root:

# modprobe rt3070sta
# ifconfig ra0 up
# iwconfig ra0 essid NAME-OF-NETWORK key restricted KEY
# dhclient ra0

Youtube? No. That's still a no. Both gnash and flashplugin-nonfree have been ported to the armel architecture and are in the debian repositories, but trying to play a video is a pain in the butt. No matter how small, no matter how short, it's a no no.

Playing video in general is a no way jose situation.

So, it has ups and downs. With Windows CE we had video, but no sound. With Linux, we have sound, but no video.

Other than that, Debian performs much better, and can do much more, given the limited resources. It's possible to code in just about any programming language, as the required libraries are all in the debian repositories. With windows CE, there's not a chance in hell.

The big downside to windows ce is that there aren't many programs made for it, and it's not easy trying to add something to it. Debian, on the other hand, has thousands of programs readily available via online repositories.

It's still not the fastest machine in the world, but at least it's something that can be used for more than just weighing down papers.

Miscellaneous

Using a USB-TTL ftdi 232 USB to serial cable, and plugging it into the serial uart0 port on the device, it is possible to communicate with it, via minicom.

Serial port



It is possible to enter an interactive menu, by pressing enter during the boot logo. Here are the options presented:

minicom commands

Hit Enter key to stop autoboot:  0
WMT #
WMT # help
shutdown the board
?       - alias for 'help'
SaveAnimation - Load animation from SD Card and save animation to NAND Flash
SaveAnimation nandAddr filename
for example: SaveAnimation  b00000 animation.data
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cleanlcd - clean LCD screen
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
dmacp     - dma memory copy
echo    - echo args to console
erase   - erase FLASH memory
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatstore - store binary file to a dos filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
ide     - IDE sub-system
iminfo  - print header information for application image
imls    - list all images found in flash
itest   - return true/false on integer compare
lcdinit - initialize LCD
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
show    -
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
msleep   - delay execution for some time
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
randmac - generate a random MAC address and save to "ethaddr" environment variable
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdwaitins - wait sd card inserted or removed
sdwaitins 0 -- waiting removed
sdwaitins 1 -- waiting inserted
setenv  - set environment variables
shutdown the board
sleep   - delay execution for some time
textout - show text to the screen, it clean the background
textout x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout 0 0 "hello world" FFFFFF
textout2 - show text to the screen, it don't clean the background
textout2 x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout2 0 0 "hello world" FFFFFF
tftpboot- boot image via network using TFTP protocol
tmpt     - execute Mass Production Tool
uploadfile- Transfer the spi flash image to the server.
version - print monitor version
WMT # --- pwmparam = 0,4,599,599


It has options to replace the boot logo, mount a sd card, copy or rewrite system disk, etc.

wm8505 ARM smartbook, running debian squeeze



It is also possible to extract the boot messages.

bootlog

WonderMedia Technologies, Inc.
W-Load Version : 0.15.00.00.01
ethaddr............found


U-Boot 1.1.4 (Mar 2 2010 - 20:04:21)
WonderMedia Technologies, Inc.
WMT U-Boot Version : 0.12.01.00.13
U-Boot code: 03F80000 -> 03FB9188 BSS: -> 040075A0
RAM Configuration:
Bank #0: 00000000 128 MB
boot from spi flash.
flash:
Bank1: FF800000 -- FFFFFFFF
Bank2: FF000000 -- FF7FFFFF
Flash: 16 MB
In: serial
Out: serial
Err: serial
### main_loop entered: bootdelay=1

bootcmd="nand read 3c00000 12f00000 200000;logo show"
CE0: NAND FLASH ID: 0xECD514B6
CE0: NAND FLASH Name: SAMSUNG_K9XXG08UXM (2048 MB)
block4095 tag=74624230 version =1
block4094 tag=62743142 version =1
g_nfinfo[0].id = 0xE, g_nfinfo[1].id = 0xFFFF
Read finsih
show logo .....
LCD param (setting): 1,30000,8,800,480,48,40,40,3,29,13
PWM param (setting): 0,233,1028,514,1000,100,90,0,27
LCD FrameBuffer = 0x07600000, BMP Address = 0x03C00000
Loading BMP ..... ok
no string ....
PWM0 input freq = 47916666 Hz, output freq = 200 Hz
PWM0 register setting: scalar = 232, period = 1027, duty = 513
Execute register operation:
reg op: 0xD8110064 | 0xC
reg op: 0xD811008C | 0xC
reg op: 0xD81100B4 & 0xFFFFFFF7
reg op: 0xD8130054 | 0x1
### main_loop: bootcmd="nand read 0 0 300000;bootm 0"
Hit any key to stop autoboot: 0
ATSMB Host 390KHz
Found SD Card

scriptcmd start:
ATSMB Host 390KHz

Init : SD Card !

Init : card selected !

SD:Four Bits Mode!

Initial SD Card OK!
ATSMB Host 25MHz
SD clock is 25Mhz
register mmc device
part_offset : 33, cur_part : 1
part_offset : 33, cur_part : 1
reading script/scriptcmd

** Unable to read "script/scriptcmd" from mmc 0:1 **
Read finsih
## Booting image at 00000000 ...
Image Name: MontaVista Linux 2.6.10
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2516748 Bytes = 2.4 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
No initrd
## Transferring control to Linux (at address 00008000) ...

Starting kernel ...

Uncompressing Linux............................................................................................................................................................... done, booting the kernel.
Linux version 2.6.29-00236-g4f8dbbb-dirty (simenxie@Szmce01) (gcc version 4.2.0 20070126 (prerelease) (MontaVista 4.2.0-3.0.0.0702771 2007-03-10)) #2 Wed Mar 24 14:36:30 CST 2010
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: WMT
Memory policy: ECC disabled, Data cache writethrough
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 26924
Kernel command line: mem=106M noinitrd root=/dev/mtdblock7 rootfstype=yaffs2 rw console=ttyS0,115200n8 init=/init lcdid=1
[LCD] lcd_arg_panel_id: <6>set lcd panel id = 1
PID hash table entries: 512 (order: 9, 2048 bytes)
start_kernel(): bug: interrupts were enabled early
Console: colour dummy device 80x30
console [ttyS0] enabled
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 106MB = 106MB total
Memory: 101844KB available (4640K code, 760K data, 140K init)
Calibrating delay loop... 174.48 BogoMIPS (lpj=872448)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
loadtime = 0
--> start progress bar
gefb: framebuffer at 0x7a00000, mapped to 0xc7800000, using 6144KB, total 6144KB
start_boot_splash: screen xres = 800, yres = 480
net_namespace: 520 bytes
NET: Registered protocol family 16
wmt_pci_init
PCI: WonderMidia Technology PCI Bridge
PCI: bus0: Fast back to back transfers disabled
bio: create slab at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
VT8500 SPI Flash Driver, (c) 2007 VIA Electronics ltd.
Find SPI Flash, ID = 0x00EF3013
un-know id = 0xef3013
Find SPI Flash, ID = 0x00000000
un-know id = 0x0
vt8500 sf controller initial ok
cmdlinepart partition parsing not available
Creating 6 MTD partitions on "mtdsf device":
0x000000000000-0x000000d00000 : "filesystem-SF"
0x000000d00000-0x000000f80000 : "kernel-SF"
0x000000f80000-0x000000fd0000 : "u-boot-SF"
0x000000fd0000-0x000000fe0000 : "u-boot env. cfg. 1-SF"
0x000000fe0000-0x000000ff0000 : "u-boot env. cfg. 2-SF"
0x000000ff0000-0x000001000000 : "w-load-SF"
[WMT-MB] Preparing VIDEO BUFFER (SIZE 16384 kB) ...
[WMT-MB] MAX MB Area size: Max 4096 Kbs Min 256 Kbs
[WMT-MB] prob /dev/Memory Block major 216, minor 0
ashmem: initialized
yaffs Mar 24 2010 14:31:27 Installing.
msgmni has been set to 199
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
[WMT-MB *W*] mb_allocate unavailable size 5a4
[WMT-MB *W*] mb_allocate unavailable size 5a4
vpp_init(boot logo 1)
[VOUT] DVO to LCD
fb0: WMT GE frame buffer device
[WMT-MB *W*] mb_free invalid paramaters 0/VPP-MB
[WMT-MB *W*] mb_free invalid paramaters 0/VPP-MB
fb1: WMT VPU frame buffer device
WMT vibrater driver load successfully!
uart.0: ttyS0 at MMIO 0xd8200000 (irq = 32) is a wmt serial
uart.1: ttyS1 at MMIO 0xd82b0000 (irq = 33) is a wmt serial
uart.2: ttyS2 at MMIO 0xd8210000 (irq = 47) is a wmt serial
uart.3: ttyS3 at MMIO 0xd82c0000 (irq = 50) is a wmt serial
uart.4: ttyS4 at MMIO 0xd8370000 (irq = 31) is a wmt serial
uart.5: ttyS5 at MMIO 0xd8380000 (irq = 30) is a wmt serial
WMT Serial driver initialized: ok
brd: module loaded
loop: module loaded
nbd: registered device at major 43
pmem: 0 init
VIA Networking Velocity Family Gigabit Ethernet Adapter Driver Ver. 1.13
Copyright (c) 2002, 2003 VIA Networking Technologies, Inc.
Copyright (c) 2004 Red Hat Inc.
eth0: VIA Networking Velocity Family Gigabit Ethernet Adapter
eth0: Ethernet Address: 00:40:63:BE:67:F6
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0
STRIP: Version 1.3A-STUART.CHESHIRE (unlimited channels)
Linux video capture interface: v2.00
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v0.1.0)
[wmt-vd] prob /dev/wmt-vd major 236, minor 0, prdt ffc01000/6560000, size 100 KB
[wmt-vd] WonderMedia HW decoder driver inited
st: Version 20081215, fixed bufsize 32768, s/g segs 256
Driver 'st' needs updating - please use bus_type methods
Driver 'sd' needs updating - please use bus_type methods
NAND Driver, (c) 2008 WMT Electronics ltd.
NAND device: Manufacturer ID: 0xec, Chip ID: 0xd514b6 (Samsung SAMSUNG_K9XXG08UXM)
NAND device: Manufacturer ID: 0xec, Chip ID: 0xd514b6 (Samsung SAMSUNG_K9XXG08UXM)
Creating 4 MTD partitions on "SAMSUNG_K9XXG08UXM":
0x000000000000-0x000000300000 : "kernel-NAND"
0x000000300000-0x000012f00000 : "filesystem-NAND"
0x000012f00000-0x000013500000 : "logo-NAND"
0x000013500000-0x000080000000 : "user-data-NAND"
nand initialised ok
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: enabling device 0000:00:04.0 (0040 -> 0042)
ehci_hcd 0000:00:04.0: EHCI Host Controller
ehci_hcd 0000:00:04.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:04.0: irq 1, io mem 0xd8007100
ehci_hcd 0000:00:04.0: USB 0.0 started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
uhci_hcd: USB Universal Host Controller Interface driver
PCI: enabling device 0000:00:05.0 (0000 -> 0001)
uhci_hcd 0000:00:05.0: UHCI Host Controller
uhci_hcd 0000:00:05.0: new USB bus registered, assigned bus number 2
uhci_hcd 0000:00:05.0: irq 0, io base 0xd8007300
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
usbserial: USB Serial Driver core
udc: VIA UDC driver, version: 3 December 2007 (dma)
udc: pullup_disable()
IRQ 5/wmotgdev: IRQF_DISABLED is not guaranteed on shared IRQs
IRQ 2/wmotgdev: IRQF_DISABLED is not guaranteed on shared IRQs
udc: wmt_udc_probe - request_irq(0x05) pass!
i8042_controller_init
I8042_CMD_CTL_TEST ok 0x55
write 0xbe cmd 0x1060
serio: i8042 AUX port at 0xd8008800,0xd8008804 irq 4
serio: i8042 KBD port at 0xd8008800,0xd8008804 irq 23
mice: PS/2 mouse device common for all mice
wmt_rtc on
wmt-rtc wmt-rtc.0: rtc core: registered wmt-rtc as rtc0
WMT Real Time Clock driver v0.54 initialized: ok
i2c /dev entries driver
i2c: adding wmt_i2c_adapter.
i2c: successfully added bus
[wmt_i2c_api_i2c_init]
[wmt_i2c_api_init] wmt_i2c_api_init.
i2c: wmt algorithm module loaded.
WMT AHB to SD/MMC bus controller registered!
Registered led device: lcd-backlight
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
logger: created 64K log 'log_main'
logger: created 256K log 'log_events'
logger: created 64K log 'log_radio'
Advanced Linux Sound Architecture Driver Version 1.0.18a.
Sound: WMT AC97: dsp id 3 mixer id 0
VT1613 generic driver installed
ALSA device list:
No soundcards found.
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
input: kpadPower as /devices/virtual/input/input0
PMC: WonderMedia Power Management driver
PMC: Power button is configured as soft power
VFP support v0.3: not present
wmt-rtc wmt-rtc.0: setting system clock to 2000-01-01 12:50:17 UTC (946731017)
Trying to free already-free IRQ 4
mmc0: new SD card at address 05b2
mmcblk0: mmc0:05b2 SD01G 982 MiB
mmcblk0: p1
usb 1-2: new high speed USB device using ehci_hcd and address 2
usb 1-2: configuration #1 chosen from 1 choice
hub 1-2:1.0: USB hub found
hub 1-2:1.0: 4 ports detected
input: PS/2 Generic Mouse as /devices/platform/i8042/serio0/input/input1
input: AT Raw Set 2 keyboard as /devices/platform/i8042/serio1/input/input2
yaffs: dev is 32505863 name is "mtdblock7"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.7, "mtdblock7"
yaffs: restored from checkpoint
yaffs_read_super: isCheckpointed 1
VFS: Mounted root (yaffs2 filesystem) on device 31:7.
Freeing init memory: 140K
Warning: unable to open an initial console.
init: /init.rc: 345: invalid option '-n'
BCH Read data ecc eror command: 0 column:0, page_addr:4a79
data area 1 bit corrected err on bank 0
in nfc_wait_idle(): data area 0th ecc error position is byte254 bit3
reserve_mm: module license 'DualBSD/GPL' taints kernel.
Reserve mm enter!
i will kmalloc 10M memory for wifi
wmt_battery ver 1.0 charg state 1 charg gpio 0 bat:180,138
battery:char state 1 0 -> 1
battery: 30 -> -1090500840
init: cannot find '/system/bin/playmp3', disabling 'bootsound'
init: cannot find '/system/etc/install-recovery.sh', disabling 'flash_recovery'
warning: `adbd' uses 32-bit capabilities (legacy support in use)
[GOVRH] VGA DAC DISCONNECT
/system/bin/sh: can't access tty; job control turned off
/ # battery:char state 1 1 -> 1
battery: -1090500840 -> 100
BCH Read data ecc eror command: 0 column:0, page_addr:4fdd
data area 1 bit corrected err on bank 3
in nfc_wait_idle(): data area 0th ecc error position is byte2031 bit4
BCH Read data ecc eror command: 0 column:0, page_addr:507d
data area 1 bit corrected err on bank 3
in nfc_wait_idle(): data area 0th ecc error position is byte1551 bit2
SNDCTL_DSP_SETFMT, val = 0x10
SNDCTL_DSP_CHANNELS, value= 2
SNDCTL_DSP_SPEED, val=44100
SOUND_MIXER_VOLUME. volume val = 100
left = 0x0000, right = 0x0000
BCH Read data ecc eror command: 0 column:0, page_addr:43c1
data area 1 bit corrected err on bank 2
in nfc_wait_idle(): data area 0th ecc error position is byte1065 bit0
pmem: pid 0, allocate 1000000
the curr is 0, and allocate order is c, and curr order is c
ioctl VPPIO_VPPSET_DIRECTPATH!!!!!!!!!!
ioctl VPPIO_VPPSET_DIRECTPATH end!!!!!!!!!!
procfile_write get 0

--> stop progress bar
BCH Read data ecc eror command: 0 column:0, page_addr:1ba4
data area 1 bit corrected err on bank 2
in nfc_wait_idle(): data area 0th ecc error position is byte1307 bit2
BCH Read data ecc eror command: 0 column:0, page_addr:240c
data area 1 bit corrected err on bank 2
in nfc_wait_idle(): data area 0th ecc error position is byte1100 bit0
BCH Read data ecc eror command: 0 column:0, page_addr:2239
data area 1 bit corrected err on bank 2
in nfc_wait_idle(): data area 0th ecc error position is byte1273 bit5
request_suspend_state: wakeup (3->0) at 28778224002 (2000-01-01 12:50:45.072494000 UTC)
Reserve mm exit!
rtusb init --->
wifi_power_ctrlaa 1
usbcore: registered new interface driver rt2870
usb 1-1: new high speed USB device using ehci_hcd and address 3
usb 1-1: configuration #1 chosen from 1 choice


=== pAd = c7302000, size = 462912 ===

<-- data-blogger-escaped---="" data-blogger-escaped-left="0x0000," data-blogger-escaped-net_device_ops="" data-blogger-escaped-not="" data-blogger-escaped-ra0="" data-blogger-escaped-right="0x0000" data-blogger-escaped-rtmpallocadapterblock="" data-blogger-escaped-rtmpalloctxrxringmemory="" data-blogger-escaped-sound_mixer_volume.="" data-blogger-escaped-status="0" data-blogger-escaped-usb="" data-blogger-escaped-using="" data-blogger-escaped-val="100" data-blogger-escaped-volume="" data-blogger-escaped-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo0pen="" data-blogger-escaped-yet="">RTUSBVenderReset
<--rtusbvenderreset data-blogger-escaped-00="" data-blogger-escaped-01="" data-blogger-escaped-0x1300="00064300" data-blogger-escaped-1.="" data-blogger-escaped-1211="" data-blogger-escaped-1226="" data-blogger-escaped-198:204="" data-blogger-escaped-198="" data-blogger-escaped-2.="" data-blogger-escaped-3.="" data-blogger-escaped-active="" data-blogger-escaped-and="" data-blogger-escaped-binder:="" data-blogger-escaped-channel="1" data-blogger-escaped-efuse="" data-blogger-escaped-first="" data-blogger-escaped-freed="==" data-blogger-escaped-invalid="" data-blogger-escaped-is="" data-blogger-escaped-its="" data-blogger-escaped-key1str="" data-blogger-escaped-key2str="" data-blogger-escaped-key3str="" data-blogger-escaped-key4str="" data-blogger-escaped-key="" data-blogger-escaped-length="" data-blogger-escaped-mcs="" data-blogger-escaped-mode="9" data-blogger-escaped-not="" data-blogger-escaped-nvm="" data-blogger-escaped-of="" data-blogger-escaped-or="" data-blogger-escaped-out="" data-blogger-escaped-phy="" data-blogger-escaped-proc="" data-blogger-escaped-range="" data-blogger-escaped-release="" data-blogger-escaped-rt28xx_init="" data-blogger-escaped-rtmpsetphymode:="" data-blogger-escaped-set="ff" data-blogger-escaped-size="2d[2d0-2fc]" data-blogger-escaped-status="0" data-blogger-escaped-still="" data-blogger-escaped-transaction="" data-blogger-escaped-type="" data-blogger-escaped-use="">rt_ioctl_giwscan. 2(2) BSS returned, data->length = 208
==>rt_ioctl_siwfreq::SIOCSIWFREQ[cmd=0x8b04] (Channel=1)
[WMT-MB] mb driver is opened by thumbserver
===>rt_ioctl_giwscan. 2(2) BSS returned, data->length = 208
[WMT-MB] mb driver is closed by thumbserver.
save exit: isCheckpointed 1
BCH Read data ecc eror command: 0 column:0, page_addr:1ba4
data area 1 bit corrected err on bank 2
in nfc_wait_idle(): data area 0th ecc error position is byte1307 bit2
binder: 116:123 transaction failed 29189, size8-0
binder: send failed reply for transaction 1211, target dead
request_suspend_state: wakeup (0->0) at 704142311002 (2000-01-01 13:02:00.436581000 UTC)
request_suspend_state: wakeup (0->0) at 766553363002 (2000-01-01 13:03:02.847631000 UTC)
request_suspend_state: wakeup (0->0) at 1181616605002 (2000-01-01 13:09:57.910874000 UTC)

We can See that the board has 6 serial Ports and the default UART0 is used for console messages

uart.0: ttyS0 at MMIO 0xd8200000 (irq = 32) is a wmt serial
uart.1: ttyS1 at MMIO 0xd82b0000 (irq = 33) is a wmt serial
uart.2: ttyS2 at MMIO 0xd8210000 (irq = 47) is a wmt serial
uart.3: ttyS3 at MMIO 0xd82c0000 (irq = 50) is a wmt serial
uart.4: ttyS4 at MMIO 0xd8370000 (irq = 31) is a wmt serial
uart.5: ttyS5 at MMIO 0xd8380000 (irq = 30) is a wmt serial
WMT Serial driver initialized: ok



Further hacking

Another nice thing. Installing network-manager and network-manager-gnome, it is possible to use this little sucker for sharing internet connection.

The following command must be appended to .xinitrc

nm-applet --sm-disable


Then, following my tutorial on Internet Connection Sharing, it is possible to... well... share the internet connection. This is especially useful when you're out of internet for whatever reason. You can follow my tutorial on Cracking WEP With Backtrack 5, steal your neighbor's internet, and use this smartbook as a switch, or access point.

In the following picture, I'm connected to the neighbor's wifi signal. The smartbook is then connected to a router through a standard ethernet cable. The router then redirects that signal, thus allowing me to connect other devices.

Internet connection sharing