Support for ZoomGo Media Stick

I'm looking at what possibility there is for porting OpenWRT to a ZoomGo Media Stick I got at Walmart for fairly cheap. It's running a custom version of OpenWRT Barrier Breaker right now, and uses the Ingenic Xburst X1000 chip.

Cursory Amazon Link

I bought one and was able to successfully dump the firmware using a Raspberry Pi and a Pomona clip. John the Ripper told me the root password was "damai" (no quotes). Though it appears to have telnet enabled out of the box I can't seem to log in with that password as root for some reason. Any reason why the root password wouldn't work with telnet? None of the other users on the device have a shell set (so I assume no login is possible) but they don't have a password either.

Bootlog (courtesy of /r/jay0eee from Reddit). Link
Reddit Thread with Pictures (again courtesy of /r/jay0eee) Link
Factory Firmware Bin. Link

Any advice for an attempt at porting? It's my first try. I see the Ben Nano Note uses a chip similar to this one, but otherwise it's completely unsupported in OpenWRT. My end-game is to turn this into something running stock OpenWRT and put PirateBox on it.

Mind that support for the xburst target has been dropped with https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=fa0275bd90ce913de57330c9abbe594703d589c6

Well shit. Thanks, that pretty much answers my question.

Time to move on to a new device.

Wow, this is exactly the use case I have for my zsun wifi reader, except that I use it with a battery pack. how does the hardware in this one compare to the 16M/64M AR9331 that is in the zsun?

why was it dropped? was it buggy, an old platform? It seems like fairly reasonable hardware for the price.

Because there was nobody to maintain it, and since it was not on 4.9 or 4.14 kernel it was dropped from being built and included in any of the new stable releases.
But you can still find it in the master branch on kernel 3.18

More RAM (256MB) and a supposedly faster processor at 1GHz.

I’ll attempt a build of the Ben Nano Note on the Master branch; if that works I might try a fork of 18.06 just for this device. I really wish the XBurst core was mainline.

Master seems to build, but still on the 3.18 kernel.

Well there is nobody to maintain it,that is why its not bumped.
Altough it really has only a couple of patches.
Should not be hard to bump it to 4.14

I bumped the kernel on the Ben Nano Note to 4.14 and it compiled on master without issue, so that’s a good sign.

Did you at least refresh the patches?
If you are lucky they apply cleanly.

Nope, i didn’t. I’ll try that and see what happens. For my needs I don’t know if they will be necessary though; looks like 2 are for NAND flash, one is for audio, 2 are for video (the device I have has none of these), one appears to be for the RTC, and one for UBI.

Well, it looks like part of those was upstreamed and can be dropped.
I can do it but I dont have anything to test it on

Tested the following patches against 4.14.63 in the master branch. I don't have the Ben Nano Note (the only current xburst board), so I have no idea if it will actually boot.

001-ubi-Read-only-the-vid-header-instead-of-the-whole-pa.patch:
Fails, but a cursory examination of the patch suggests that this code has already been upstreamed and the patch is no longer necessary.

002-NAND-Optimize-NAND_ECC_HW_OOB_FIRST-read.patch:
Fails, a cursory examination of the patch suggests that at least part of this patch is now upstreamed. Not sure if still necessary.

003-NAND-Add-support-for-subpage-reads-for-NAND_ECC_HW_O.patch:
Fails, and the code does not appear to have been upstreamed.

004-ASoC-JZ4740-delay-activation-of-the-DAC-to-work-arou.patch:
Fails, and the code does not appear to have been upstreamed.

005-RTC-JZ4740-Init-the-regulator-register-on-startup.patch:
Fails. I think the code has been upstreamed but it differs a fair amount from what's in the patch so I can't tell (I don't speak C).

006-Add-ili8960-lcd-driver.patch:
Succeeds. Still needed.

007-qi_lb60-Don-t-use-3-wire-spi-mode-for-the-display-fo.patch:
Succeeds. Still needed.

I have been checking them out too.
First one is fully merged upstream from what I have seen.
Second one is not really merged,only the description for structure was merged in another commit.
Third one is not upstream.
Fourth one is not upstream.
Fifth one is partially upstream,needs rework.
Sixth is not upstream.
Seventh is not upstream.

Most of them needs a refresh or a rework.
But it doesnt matter as we really dont have anything to test it on.

There seems to be some people here zoomgo reddit that have the possibility to test some things out. I attempted to redirect them here if it is possible that they could help.

Got serial. For some reason no matter what I did I couldn't get root access until I did. Not posting the bootlog since someone already did. Here's some more detail:

root@ZoomGo:~# cat /proc/cmdline
console=ttyS2,115200n8 consoleblank=0 mem=256M@0x0 ip=off rootfstype=squashfs,jffs2 root=/dev/mtdblock4 rw init=/sbin/init

root@ZoomGo:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 01000000 00008000 "ALL"
mtd1: 00030000 00008000 "bootloader"
mtd2: 00010000 00008000 "config"
mtd3: 00200000 00008000 "kernel"
mtd4: 00800000 00008000 "rootfs"
mtd5: 00080000 00008000 "rootfs_data"
mtd6: 00a00000 00008000 "firmware"
mtd7: 005b0000 00008000 "backup"
mtd8: 00010000 00008000 "airdiskflag"

root@ZoomGo:~# cat /proc/cpuinfo
system type             : canna_v10
processor               : 0
cpu model               : Ingenic Xburst V4.15  FPU V0.0
BogoMIPS                : 1001.88
wait instruction        : yes
microsecond timers      : no
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 1, address/irw mask: [0x0fff]
microMIPS               : no
ASEs implemented        : mxu
shadow register sets    : 1
kscratch registers      : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
Hardware                : canna
Serial          : 00000000 00000000 00000000 00000000

root@ZoomGo:~# cat /proc/meminfo
MemTotal:         254172 kB
MemFree:          230104 kB
Buffers:            3748 kB
Cached:            10716 kB
SwapCached:            0 kB
Active:             6844 kB
Inactive:          10704 kB
Active(anon):       3104 kB
Inactive(anon):       44 kB
Active(file):       3740 kB
Inactive(file):    10660 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          3104 kB
Mapped:             3804 kB
Shmem:                64 kB
Slab:               4216 kB
SReclaimable:       1292 kB
SUnreclaim:         2924 kB
KernelStack:         592 kB
PageTables:          392 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      127084 kB
Committed_AS:      58068 kB
VmallocTotal:    1048372 kB
VmallocUsed:         908 kB
VmallocChunk:    1047028 kB

root@ZoomGo:~# cat /proc/devices
Character devices:
  1 mem
  4 /dev/vc/0
  4 tty
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
  7 vcs
 10 misc
 13 input
 90 mtd
128 ptm
136 pts
180 usb
189 usb_device

Block devices:
259 blkext
  8 sd
 31 mtdblock
 65 sd
 66 sd
 67 sd
 68 sd
 69 sd
 70 sd
 71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
179 mmc

root@ZoomGo:~# ls /sys/devices/platform
bcmdhd_wlan.1  jz-sfc.0       jzmmc_v1.2.0   reg-dummy
bt_power       jz-uart.0      jzmmc_v1.2.1   regulatory.0
jz-dma         jz-uart.1      leds-gpio      uevent
jz-dwc2        jz-uart.2      power          wdt_reset.0

root@ZoomGo:~# ifconfig -a
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1992 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1992 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:163344 (159.5 KiB)  TX bytes:163344 (159.5 KiB)

p2p0      Link encap:Ethernet  HWaddr 86:5D:D7:07:DB:1C
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

sit0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-B0-23-00-00-00-00-00-00-00-00
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wl0.1     Link encap:Ethernet  HWaddr 84:5D:D7:07:DB:1C
          inet addr:192.168.222.254  Bcast:192.168.222.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:29 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:6113 (5.9 KiB)

wlan0     Link encap:Ethernet  HWaddr 84:5D:D7:07:DB:1C
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:478 (478.0 B)

root@ZoomGo:~# ls /sys/class/net
lo     p2p0   sit0   wl0.1  wlan0

root@ZoomGo:~# lsmod
aes_generic            31033  0
arc4                     848  0
exfat                 108651  0
g_file_storage         23348  0
ts_bm                   1568  0
ts_fsm                  2896  0
ts_kmp                  1472  0
xt_layer7              12372  0
xt_owner                 736  0
xt_pkttype               704  0
xt_recent               7456  0
xt_string                816  0
xt_time                 1600  0

For $5 its hard to beat the bang for the buck for this device.
Where can I buy this, preferably with free international shipping for not so much more than $5?`

I think I saw $13 somewhere, that is still very cheap I think.

Does anyone know how I’d go about creating a flash map? Near as I can tell the only existing XBurst target uses ubi instead of a squashfs image and it doesn’t use device tree.

I’m about 1200 miles away from my device right now, but I could start getting test images compiled at least.

Also, based on experimentation with the bootloader it looks like it may support booting from USB (over the MicroUSB port). It claims to support booting from MMC but I could never get it to detect the card. No support for tftp, serial modem transfers, or other methods though; so if USB booting doesn’t work an SPI writer is the only method of debricking I can see.

Well,you can do it pretty easily like in the upstream board:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/mips/jz4740/board-qi_lb60.c?h=v4.14.66

I would suggest first bumping the target to 4.14
Then requesting GPL since there is no way of knowing all of the GPIOs without it