ZoomGo Media Stick (ZX10)
ZoomGo Media Stick (ZX10) is a in-car charger with WiFi file/media sharing ability.
Hardware highlights
| CPU | RAM | Flash | WLAN | USB-OTG | UART | JTAG |
|---|---|---|---|---|---|---|
| Damai DM6291A (Ingenic X1000) @ 1000 MHz | 256 MiB | 16 MiB | bgn | 1x 2.0 | Yes | No |
OpenWrt support
Not supported, until conclusion is reached which path to support.
Supporting activities
Previous support attempts: https://forum.openwrt.org/t/support-for-zoomgo-media-stick/19156
The support for this device is added in this fork of OpenWrt tree: https://github.com/tmn505/openwrt.git branch: zx10-k5.15
All of the functions are supported.
Experimental firmware
There are two paths for using this device with the source mentioned in Supporting activities:
Simple
Checkout at hash with commit title “xburst: add SPI Flash Controller driver ”. This will produce factory.bin and sysupgrade.bin images. The factory.bin image is directly writable to NOR flash through web interface. The sysupgrade.bin image is provided for later upgrades of OpenWrt on the NOR flash. Simple path has one major caveat, kernel size is hard-limited to 2 MiB. It could be probably worked-around by using OKLI (OpenWrt kernel loader), but I'm not a fan of such approach.
Hard
but better at the moment and for the future. Checkout at HEAD. The factory.bin image is still directly writable to NOR flash through web interface, while the sysupgrade.bin image is provided for later upgrades of OpenWrt on NOR flash. Additionally there's an sdcard.img image. This image is intended to be written to an µSD card and is also used later for upgrading the OpenWrt on the same medium. The caveats with Hard path is that the boot loader needs an update. The source of modified U-Boot necessary for Hard path is at: https://github.com/tmn505/u-boot branch: zx10 and automatically compiled binaries are available at: https://tmn505.github.io/u-boot.
Installation
Before choosing, consult caveats of each path written in Experimental firmware section. There's also information at which commit to checkout from the zx10-k5.15 branch to have desired images compiled and where to get modified U-Boot.
Simple
1. Connect to WiFi network provided by the device.
2. Navigate to http://192.168.222.254/a_fu.shtml.
3. Browse for OpenWrt image name ending with factory.bin.
4. Select “Upgrade Firmware” and after it checks validity, confirm the upgrade.
5. After writing new firmware to flash, system will reboot. Wait until the green LED at some point will start constantly blinking (ignore the first three blinks emitted by U-Boot). This indicates that OpenWrt userspace is preparing the device. After the LED stays solid, the device is ready for configuration.
Hard
1. Connect to WiFi network provided by the device.
2. Copy modified U-Boot binary to FAT32 formatted µSD card and insert the card to the slot.
3. Original system provides configuration web interface, which is not password protected, however the telnet and serial console are. To reset the password go to http://192.168.222.254/a_advanced2.shtml and paste this: $(passwd -d root) to the empty “Password” field. Now click “Done” and password for root user should be empty. The other possibility is using serial connection, entering failsafe mode, and there, resetting the password.
4. Enter the command line interface through telnet or serial console.
5. Execute this command (adjust accordingly if Your environment differs):
mtd -r write /tmp/mnt/SD-Card-1/u-boot-v2013.07-zx10-rel2.bin bootloader
6. After rebooting, to write OpenWrt to NOR flash follow instructions from “Simple Installation”
- or -
6. Power off the device, write sdcard.img image to µSD card, insert to the slot and power on the device.
7. For both, wait until the green LED at some point will start constantly blinking (ignore the first three blinks emitted by U-Boot). This indicates that OpenWrt userspace is preparing the device. After the LED stays solid, the device is ready for configuration.
Configuration
By default in OpenWrt, wireless interface is disabled for security reasons. To perform initial configuration, there's a serial gadget enabled on USB-OTG port, so hook up USB cable and do use Your favorite terminal application. Be sure to enable wireless before changing USB-OTG port role.
Debricking
Without device disassembly
The original U-Boot boots kernel from backup partition if airdisk[n] flag on airdiskflag partition reaches airdisk3 or calculated checksum of kernel doesn't match the stored one. It will boot to initramfs system with open WiFi network and only firmware flashing web interface available. From there factory.bin image can be written.
The modified U-Boot first seeks for boot.scr boot script on ext4 or FAT32 formatted µSD card. The script should contain U-Boot commands which can boot normal system, initramfs kernel or even flash new U-Boot binary or OpenWrt to NOR flash. So until the boot loader is intact the device is unbrickable. For example of commands in boot.scr check target/linux/xburst/image/bootscript.txt of source tree and consult U-Boot command line documentation, to compile the script use mkimage from U-Boot tools suite.
With device diassembly
If serial console is available, both U-Boot support serial echo, so it's possible to push new firmware to memory with the help of ubootwrite.py. Remember this is little-endian system so check if copied binary in memory has proper endianness. Additionally with the modified U-Boot You'll be able to load binaries from µSD card to memory.
Each Ingenic SoC BootROM has implemented USB protocol for initial flashing or recovery. To do that we'll use Ingenic developed cloner tool for mass flashing of the devices with Ingenic SoC, available at ftp://ftp.ingenic.com.cn/DevSupport/Tools/USBBurner (use the latest one). Only two recovery scenarios for ZoomGo Media Stick will be covered here. For each use this ZoomGo ZX10 bootloader recovery image: https://tmn505.github.io/u-boot/zoomgo_zx10.ingenic, it writes only the U-Boot mod mentioned in Experimental firmware to first 300 KiB.
1. After connecting USB cable to PC, only device with a108:1000 (Vid:Pid) is enumerated. This is straight-forward scenario, where NOR flash chip is erased or U-Boot is faulty.
a) disconnect USB cable (power-off ZX10),
b) execute cloner tool (You'll be asked for root permissions),
c) load linked cloner image with Load image button and press Start,
d) now connect USB cable with ZX10 on other side and wait,
e) wait until all steps will be complete (reach 100%) and press Stop,
f) power-off the ZX10,
g) on next boot U-Boot will search for µSD card with operating system.
2. After powering-on the ZX10 boots but You can't access it. This will involve removing board from enclosure, since we need to trigger recovery mode. Consult Opening the case and FCC Photos how to do that.
a) from first scenario follow a, b, c points,
b) short two pins showed on the photo below,
c) now connect USB cable with ZX10 on other side and wait, until ZX10 gets enumerated as a108:1000 and quickly release the shorted two pins,
d) now, from first scenario, follow e, f, g points.
The linked cloner image is an zip archive and can be extended to write the full or parts of NOR flash, just edit config/x1000/zoomgo_zx10.cfg file and place desired images in images directory. We won't be explaining in detail, how to do that, since it's outside the scope of this paragraph.
Failsafe mode
Reachable only with serial console, since there's no ethernet interface.
Hardware
Info
| Architecture | MIPS Little Endian (mipsel) |
|---|---|
| Vendor | Ingenic |
| Bootloader | U-Boot |
| System-On-Chip | Damai DM6291A |
| CPU / Speed | Ingenic XBurst X1000 (mips32r2) / 1000 MHz |
| Flash Chip / Size | GigaDevice GD25Q127CSIG / 16 MiB |
| RAM Type / Size | LPDDR / 256 MiB |
| Wireless Chip / Type | AMPAK AP6212 / 2.4GHz 802.11bgn |
| USB-OTG Chip / Ports | Synopsys DesignWare 2.0 Controller / 1x |
| Mass storage | 1x µSD card slot |
| UART | Yes |
Flash Layout
Original & Simple
0x000000000000-0x000000030000 : "bootloader" 0x000000030000-0x000000040000 : "config" 0x000000040000-0x000000240000 : "kernel" 0x000000240000-0x000000a40000 : "rootfs" 0x000000a40000-0x000000ff0000 : "backup" 0x000000ff0000-0x000001000000 : "airdiskflag"
Hard
0x000000000000-0x000000030000 : "u-boot" 0x000000030000-0x000000040000 : "config" 0x000000040000-0x000000ff0000 : "firmware" 0x000000ff0000-0x000001000000 : "u-boot-env"
Photos
For photos and additional information please look at FCC filling: https://fccid.io/A4XZX10
Opening the case
Prepare two or three sturdy and thin prying tools. Start with inserting them near both USB charging ports and gradually slide them along the crack. There's bit of glue holding both sides together. Be careful to not brake the pegs of the case.
Serial
→ port.serial general information about the serial port, serial port cable, etc.
The UART port is accessible on NW5030 module on the test points near power input. The marks (RX, TX, GND) on the PCB clearly indicate the purpose of the test points.
| Serial connection parameters | 115200, 8N1 |
|---|
Bootlogs
OEM bootlog
U-Boot SPL 2013.07 (Sep 20 2016 - 19:10:03) ddrfreq 200000000 cclk 1008000000 U-Boot 2013.07 (Sep 20 2016 - 19:10:03) Board: Canna (Ingenic XBurst X1000 SoC) DDR Freq: 200000000 DRAM: 256 MiB Top of RAM usable for U-Boot at: 90000000 Reserving 346k for U-Boot at: 8ffa8000 Reserving 8224k for malloc() at: 8f7a0000 Reserving 32 Bytes for Board Info at: 8f79ffe0 Reserving 124 Bytes for Global Data at: 8f79ff64 Reserving 128k for boot params() at: 8f77ff64 Stack Pointer at: 8f77ff48 Now running in RAM - U-Boot at: 8ffa8000 MMC: Using default environment In: serial Out: serial Err: serial start check_system_start_normalthe id code = 1840c8, the flash name is GD25Q128C set quad mode is enable.the buf = 1840c802 airdisk flag :airdisk1 sfc erase ok kernel_md5_buf = b683ac02d5ad722c00297fe57ca99ec0 kernel_md5_cal_buf = b683ac02d5ad722c00297fe57ca99ec0 Coming into normal system gpio_request lable = off-led gpio = 89 gpio_request lable = led-sys gpio = 90 bootdelay = 1 Please choose the operation: 1: Entr boot command line interface. others: Boot system code via Flash (default). Hit any key to stop autoboot: 1 You choosed 0 the id code = 1840c8, the flash name is GD25Q128C sfcnor read Image from 0x40000 to 0x80800000 size is 0x200000 ... sfcnor read ok! ## Booting kernel from Legacy Image at 80800000 ... Image Name: NW5030 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1940634 Bytes = 1.9 MiB Load Address: 80010000 Entry Point: 80456cd0 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... [ 0.000000] Linux version 3.0.8 (hcy@hcy-All-Series) (gcc version 4.6.4 (OpenWrt/Linaro GCC 4.6-2013.05 r3731) ) #4 PREEMPT Tue Aug 1 17:02:27 CST 2017 [ 0.000000] CPU0 RESET ERROR PC:E77FF12B [ 0.000000] bootconsole [early0] enabled [ 0.000000] CPU revision is: 2ed1024f (Ingenic Xburst) [ 0.000000] FPU revision is: 00330000 [ 0.000000] CCLK:1008MHz L2CLK:504Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz [ 0.000000] Determined physical RAM map: [ 0.000000] User-defined physical RAM map: [ 0.000000] memory: 10000000 @ 00000000 (usable) [ 0.000000] Zone PFN ranges: [ 0.000000] Normal 0x00000000 -> 0x00010000 [ 0.000000] Movable zone start PFN for each node [ 0.000000] early_node_map[1] active PFN ranges [ 0.000000] 0: 0x00000000 -> 0x00010000 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 65024 [ 0.000000] Kernel command line: console=ttyS2,115200n8 consoleblank=0 mem=256M@0x0 ip=off rootfstype=squashfs,jffs2 root=/dev/mtdblock4 rw init=/sbin/init [ 0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes) [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) [ 0.000000] Primary instruction cache 16kB, 4-way, VIPT, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 0kB, (null), linesize 0 bytes. [ 0.000000] Memory: 253988k/262144k available (4424k kernel code, 8156k reserved, 1083k data, 184k init, 0k highmem) [ 0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] Preemptible hierarchical RCU implementation. [ 0.000000] Verbose stalled-CPUs detection is disabled. [ 0.000000] NR_IRQS:387 [ 0.000000] clockevents_config_and_register success. [ 0.000000] Console: colour dummy device 80x25 [ 0.004530] Calibrating delay loop... 1001.88 BogoMIPS (lpj=5009408) [ 0.047788] pid_max: default: 32768 minimum: 301 [ 0.052726] Mount-cache hash table entries: 512 [ 0.059439] print_constraints: dummy: [ 0.063346] NET: Registered protocol family 16 [ 0.071878] bio: create slab <bio-0> at 0 [ 0.076988] jz-dma jz-dma: JZ SoC DMA initialized [ 0.082088] SCSI subsystem initialized [ 0.086096] usbcore: registered new interface driver usbfs [ 0.091653] usbcore: registered new interface driver hub [ 0.097192] usbcore: registered new device driver usb [ 0.103219] cfg80211: Calling CRDA to update world regulatory domain [ 0.109958] Switching to clocksource jz_clocksource [ 0.121565] DWC IN DEVICE ONLY MODE [ 0.127187] dwc2 dwc2: Dynamic Power Control [ 0.330448] dwc2 dwc2: Core Release: 3.00a [ 0.334518] EN PHY [ 0.336628] DIS PHY [ 0.338844] EN PHY [ 0.340866] DIS PHY [ 0.342920] EN PHY [ 0.345061] DIS PHY [ 0.347206] Suspend otg by shutdown dwc cotroller and phy [ 0.352710] Resume otg by reinit dwc controller and phy [ 0.357945] DWC IN DEVICE ONLY MODE [ 0.363450] EN PHY [ 0.365788] NET: Registered protocol family 2 [ 0.370253] IP route cache hash table entries: 2048 (order: 1, 8192 bytes) [ 0.377528] TCP established hash table entries: 8192 (order: 4, 65536 bytes) [ 0.384990] TCP bind hash table entries: 8192 (order: 3, 32768 bytes) [ 0.391628] TCP: Hash tables configured (established 8192 bind 8192) [ 0.398025] TCP reno registered [ 0.401184] UDP hash table entries: 256 (order: 0, 4096 bytes) [ 0.407127] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes) [ 0.413898] NET: Registered protocol family 1 [ 0.418534] >>>>>>>>>>register my wifi led<<<<<<<<<<<<<<<<< [ 0.431392] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.437572] NTFS driver 2.1.30 [Flags: R/W]. [ 0.442166] ufsd: driver (8.6, Jul 31 2017 14:27:39, LBD=ON, delalloc, ioctl, bdi) loaded at (null) [ 0.442176] NTFS (with native replay) support included [ 0.442182] optimized: speed [ 0.442185] Built_for__Asus_n65u_2012-03-29 [ 0.442190] [ 0.465569] JFFS2 version 2.2 (NAND) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.475953] msgmni has been set to 496 [ 0.479991] io scheduler noop registered [ 0.483894] io scheduler deadline registered [ 0.488458] io scheduler cfq registered (default) [ 0.493664] jz-uart.0: ttyS0 at MMIO 0x10030000 (irq = 59) is a uart0 [ 0.514918] jz-uart.1: ttyS1 at MMIO 0x10031000 (irq = 58) is a uart1 [ 0.534920] jz-uart.2: ttyS2 at MMIO 0x10032000 (irq = 57) is a uart2 [ 0.542948] console [ttyS2] enabled, bootconsole disabled [ 0.542948] console [ttyS2] enabled, bootconsole disabled [ 0.565240] jkzhao++++++++AP6212 BT probe ok [ 0.570505] the chip id c84018 [ 0.573662] JZ SFC Controller for SFC channel 0 driver register [ 0.579820] Creating 8 MTD partitions on "sfc_mtd": [ 0.584871] 0x000000000000-0x000001000000 : "ALL" [ 0.590622] 0x000000000000-0x000000030000 : "bootloader" [ 0.596999] 0x000000030000-0x000000040000 : "config" [ 0.602952] 0x000000040000-0x000000240000 : "kernel" [ 0.608977] 0x000000240000-0x000000a40000 : "rootfs" [ 0.615032] mtd: partition "rootfs" set to be root filesystem [ 0.622553] mtd: partition "rootfs_data" created automatically, ofs=9C0000, len=80000 [ 0.630760] 0x0000009c0000-0x000000a40000 : "rootfs_data" [ 0.637210] 0x000000040000-0x000000a40000 : "firmware" [ 0.643457] 0x000000a40000-0x000000ff0000 : "backup" [ 0.649554] 0x000000ff0000-0x000001000000 : "airdiskflag" [ 0.656145] SPI NOR MTD LOAD OK [ 0.659447] Initializing USB Mass Storage driver... [ 0.664544] usbcore: registered new interface driver usb-storage [ 0.670820] USB Mass Storage support registered. [ 0.675762] wait stable.[223][cgu_msc0] [ 0.679730] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing [ 0.686939] jzmmc_v1.2 jzmmc_v1.2.0: register success! [ 0.692317] wait stable.[223][cgu_msc1] [ 0.696397] jzmmc_v1.2 jzmmc_v1.2.1: vmmc regulator missing [ 0.703427] jzmmc_v1.2 jzmmc_v1.2.1: register success! [ 0.709524] Netfilter messages via NETLINK v0.30. [ 0.714465] nf_conntrack version 0.5.0 (3968 buckets, 15872 max) [ 0.721183] NF_TPROXY: Transparent proxy support initialized, version 4.1.0 [ 0.728429] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. [ 0.734505] ip_set: protocol 6 [ 0.737857] ip_tables: (C) 2000-2006 Netfilter Core Team [ 0.743533] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully [ 0.750178] TCP cubic registered [ 0.754277] NET: Registered protocol family 10 [ 0.760136] Mobile IPv6 [ 0.762714] ip6_tables: (C) 2000-2006 Netfilter Core Team [ 0.768511] IPv6 over IPv4 tunneling driver [ 0.773445] NET: Registered protocol family 17 [ 0.778134] lib80211: common routines for IEEE802.11 drivers [ 0.783981] Registering the dns_resolver key type [ 0.789583] BCM:dhd_module_init in [ 0.793111] BCM:found wifi platform device bcmdhd_wlan [ 0.798532] BCM:Power-up adapter 'DHD generic adapter' [ 0.803871] BCM:wifi_platform_set_power = 1 [ 0.808207] BCM:=========== WLAN placed in NOMAL ON======== [ 0.971579] mmc1: queuing unknown CIS tuple 0x80 (2 bytes) [ 0.978883] mmc1: queuing unknown CIS tuple 0x80 (3 bytes) [ 0.986165] mmc1: queuing unknown CIS tuple 0x80 (3 bytes) [ 0.994745] mmc1: queuing unknown CIS tuple 0x80 (7 bytes) [ 1.003993] mmc1: queuing unknown CIS tuple 0x81 (9 bytes) [ 1.100055] mmc1: new high speed SDIO card at address 0001 [ 1.141407] dhd_customer_oob_irq_map,host_oob_irq = 152 [ 1.148019] BCM:F1 signature OK, socitype:0x1 chip:0xa9a6 rev:0x1 pkg:0x4 [ 1.155505] BCM:DHD: dongle ram size is set to 524288(orig 524288) at 0x0 [ 1.162672] BCM:wifi_platform_get_mac_addr [ 1.166969] Can not access wifi mac file : /etc/mac.txt [ 1.172355] BCM:>>>>>>>>>use_default_mac [ 1.177334] wl_create_event_handler(): thread:wl_event_handler:1b started [ 1.184568] BCM:<6>CFG80211-ERROR) wl_event_handler : BCM:tsk Enter, tsk = 0x8c26130c [ 1.193421] BCM:p2p0: P2P Interface Registered [ 1.198207] dhd_attach(): thread:dhd_watchdog_thread:1c started [ 1.204391] dhd_attach(): thread:dhd_dpc:1d started [ 1.209561] dhd_attach(): thread:dhd_rxf:1e started [ 1.214607] BCM:dhd_deferred_work_init: work queue initialized [ 1.221012] BCM:Dongle Host Driver, version 1.141.66 [ 1.221021] Compiled in drivers/net/wireless/bcmdhd on Jul 31 2017 at 14:27:31 [ 1.234268] BCM:Register interface [wlan0] MAC: 84:5d:d7:aa:bb:cc [ 1.234277] [ 1.242246] BCM:dhd_prot_ioctl : bus is down. we have nothing to do [ 1.248853] BCM:wifi_platform_set_power = 0 [ 1.253165] BCM:=========== WLAN placed in NOMAL OFF ======== [ 1.263743] VFS: Mounted root (squashfs filesystem) readonly on device 31:4. [ 1.271957] Freeing unused kernel memory: 184k freed procd: Console is alive procd: - preinit - Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level s[ 5.097242] JFFS2 notice: (56) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. block: extroot: no root or overlay mount defined jffs2 is ready jffs2 is ready [ 5.139849] JFFS2 notice: (53) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 4 of xref (0 dead, 0 orphan) found. switching to overlay procd: - early - procd: - ubus - procd: - init - Please press Enter to activate this console. [ 6.612743] dwc2 dwc2: registering gadget driver 'g_file_storage' [ 6.619227] dwc2 dwc2: bind to driver g_file_storage usb_gadget_probe_driver, 2641 [ 6.627088] g_file_storage gadget: No serial-number string provided! [ 6.633859] g_file_storage gadget: File-backed Storage Gadget, version: 1 September 2010 [ 6.642287] g_file_storage gadget: Number of LUNs=1 [ 6.652916] exFAT: Version 1.2.9 [ 6.664933] xt_time: kernel timezone is -0000 [ 11.247928] BCM: [ 11.247941] Dongle Host Driver, version 1.141.66 [ 11.247946] Compiled in drivers/net/wireless/bcmdhd on Jul 31 2017 at 14:27:31 [ 11.263218] BCM:wl_android_wifi_on in [ 11.267921] BCM:wifi_platform_set_power = 1 [ 11.272910] BCM:=========== WLAN placed in RESET ON ======== [ 11.594871] sdio_reset_comm(): [ 11.606282] wait stable.[223][cgu_msc1] [ 11.611709] BCM:F1 signature OK, socitype:0x1 chip:0xa9a6 rev:0x1 pkg:0x4 [ 11.619373] BCM:DHD: dongle ram size is set to 524288(orig 524288) at 0x0 [ 11.626797] BCM:concate_revision: BCM43438_CHIP_ID [ 11.632342] BCM:CHIP VER = [0x1] [ 11.635897] BCM:----- CHIP BCM43438_A1 ----- [ 11.640301] fw_path = /lib/firmware/BCM43438_A1 [ 11.645115] nv_path = /lib/firmware/BCM43438_A1.cal [ 11.840958] BCM:dhdsdio_write_vars: Download, Upload and compare of NVRAM succeeded. [ 11.910181] BCM:dhd_bus_init: enable 0x06, ready 0x06 (waited 0us) [ 11.917825] BCM:wifi_platform_get_mac_addr [ 11.922238] source_addr 84:5D:D7:[redacted]:[�hU�hU� [ 11.927695] wifi mac 84 wifi mac 5d wifi mac d7 wifi mac 07 wifi mac b8 wifi mac 9e [ 11.939029] BCM:Firmware up: op_mode=0x0005, MAC=84:5d:d7:[redacted] [ 11.950202] BCM:dhd_preinit_ioctls pspretend_threshold for HostAPD failed -23 [ 11.962560] BCM:Firmware version = wl0: Oct 8 2016 15:31:47 version 7.46.57.4.ap.r4 (A1 Station/P2P) FWID 01-3621395e es6.c5.n4.a3 [ 11.975753] BCM:dhd_wlfc_hostreorder_init(): successful bdcv2 tlv signaling, 64 [ 11.984596] BCM:<6>CFG80211-ERROR) wl_cfg80211_attach_post : BCM:p2p0: p2p_dev_addr=86:5d:d7:[redacted] [ 12.287920] BCM:Register interface [wl0.1] MAC: 84:5d:d7:[redacted] [ 12.287930] [ 12.511107] BCM:<6>CFG80211-ERROR) wl_cfg80211_event : BCM:ignore event 16, not interested procd: - init complete - ZoomGo login: root BusyBox v1.22.1 (2017-07-31 14:15:36 CST) built-in shell (ash) Enter 'help' for a list of built-in commands. _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- BARRIER BREAKER (Barrier Breaker, r3731) ----------------------------------------------------- * 1/2 oz Galliano Pour all ingredients into * 4 oz cold Coffee an irish coffee mug filled * 1 1/2 oz Dark Rum with crushed ice. Stir. * 2 tsp. Creme de Cacao ----------------------------------------------------- root@ZoomGo:~#
OpenWrt on µSD card with modified U-Boot bootlog
U-Boot SPL 2013.07-zx10-rel1 (May 03 2021 - 18:20:59) ddrfreq 200000000 cclk 1008000000 U-Boot 2013.07-zx10-rel1 (May 03 2021 - 18:20:59) Board: ZoomGo ZX10 (Damai DM6291A SoC) DDR Freq: 200000000 DRAM: 256 MiB Top of RAM usable for U-Boot at: 90000000 Reserving 355k for U-Boot at: 8ffa4000 Reserving 8256k for malloc() at: 8f794000 Reserving 32 Bytes for Board Info at: 8f793fe0 Reserving 124 Bytes for Global Data at: 8f793f64 Reserving 128k for boot params() at: 8f773f64 Stack Pointer at: 8f773f48 Now running in RAM - U-Boot at: 8ffa4000 MMC: msc: 0 the id code = 1840c8, the flash name is GD25Q128C set quad mode is enable.the buf = 1840c802 *** Warning - bad CRC, using default environment In: serial Out: serial Err: serial gpio_request lable = led-status gpio = 90 bootdelay = 1 Please choose the operation: 1: Entr boot command line interface. others: Boot system code via Flash (default). Hit any key to stop autoboot: 0 254 bytes read in 4 ms (61.5 KiB/s) ## Executing script at 88000000 1970038 bytes read in 103 ms (18.2 MiB/s) ## Booting kernel from Legacy Image at 88000000 ... Image Name: NW5030 Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 1969974 Bytes = 1.9 MiB Load Address: 80100000 Entry Point: 80100000 Verifying Checksum ... OK Uncompressing Kernel Image ... OK Starting kernel ... [ 0.000000] Linux version 5.10.39 (tomek@minix-neo) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 8.4.0 r16153+3-fc5b101c06) 8.4.0, GNU ld (GNU Binutils) 2.34) #0 Sun Jun 13 17:58:18 2021 [ 0.000000] CPU0 revision is: 2ed1024f (Ingenic XBurst) [ 0.000000] FPU revision is: 00330000 [ 0.000000] MIPS: machine is ZoomGo Media Stick [ 0.000000] earlycon: x1000_uart0 at MMIO 0x10032000 (options '115200n8') [ 0.000000] printk: bootconsole [x1000_uart0] enabled [ 0.000000] Initrd not found or empty - disabling initrd [ 0.000000] Primary instruction cache 16kB, VIVT, 4-way, linesize 32 bytes. [ 0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes [ 0.000000] MIPS secondary cache 128kB, 4-way, linesize 128 bytes. [ 0.000000] Zone ranges: [ 0.000000] Normal [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] HighMem empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff] [ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 65024 [ 0.000000] Kernel command line: earlycon clk_ignore_unused root=PARTUUID=1a4b6b4f-02 rw rootwait [ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear) [ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear) [ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off [ 0.000000] Memory: 252116K/262144K available (4915K kernel code, 584K rwdata, 732K rodata, 1248K init, 218K bss, 10028K reserved, 0K cma-reserved, 0K highmem) [ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1 [ 0.000000] NR_IRQS: 256 [ 0.000000] random: get_random_bytes called from 0x80718aa0 with crng_init=0 [ 0.000000] clocksource: ingenic-ost: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1274173631191 ns [ 0.000010] sched_clock: 32 bits at 1500kHz, resolution 666ns, wraps every 1431655764658ns [ 0.008433] Calibrating delay loop... 1007.61 BogoMIPS (lpj=5038080) [ 0.096534] pid_max: default: 32768 minimum: 301 [ 0.101401] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.108754] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) [ 0.118342] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build [ 0.129007] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns [ 0.138998] futex hash table entries: 256 (order: -1, 3072 bytes, linear) [ 0.145917] pinctrl core: initialized pinctrl subsystem [ 0.152336] NET: Registered protocol family 16 [ 0.221560] jz4780-dma 13420000.dma-controller: JZ4780 DMA controller initialised [ 0.229986] SCSI subsystem initialized [ 0.234065] usbcore: registered new interface driver usbfs [ 0.239639] usbcore: registered new interface driver hub [ 0.245103] usbcore: registered new device driver usb [ 0.266369] clocksource: Switched to clocksource ingenic-ost [ 0.273306] NET: Registered protocol family 2 [ 0.277958] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear) [ 0.285973] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear) [ 0.294503] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear) [ 0.302265] TCP bind hash table entries: 2048 (order: 1, 8192 bytes, linear) [ 0.309409] TCP: Hash tables configured (established 2048 bind 2048) [ 0.315975] UDP hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.322609] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear) [ 0.329889] NET: Registered protocol family 1 [ 0.340264] workingset: timestamp_bits=30 max_order=16 bucket_order=0 [ 0.351513] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 0.357443] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc. [ 0.370397] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled [ 0.378012] printk: console [ttyS0] disabled [ 0.382370] 10032000.serial: ttyS0 at MMIO 0x10032000 (irq = 49, base_baud = 1500000) is a 16550A [ 0.391433] printk: console [ttyS0] enabled [ 0.391433] printk: console [ttyS0] enabled [ 0.399781] printk: bootconsole [x1000_uart0] disabled [ 0.399781] printk: bootconsole [x1000_uart0] disabled [ 0.411123] ingenic-rng 100000d8.rng: Ingenic RNG driver registered [ 0.434004] loop: module loaded [ 0.445919] spi-nor spi0.0: gd25q128 (16384 Kbytes) [ 0.451728] 4 fixed-partitions partitions found on MTD device spi0.0 [ 0.458169] Creating 4 MTD partitions on "spi0.0": [ 0.462965] 0x000000000000-0x000000030000 : "u-boot" [ 0.469910] 0x000000030000-0x000000040000 : "config" [ 0.475909] 0x000000040000-0x000000ff0000 : "firmware" [ 0.485430] 2 uimage-fw partitions found on MTD device firmware [ 0.491445] Creating 2 MTD partitions on "firmware": [ 0.496433] 0x000000000000-0x000000200000 : "kernel" [ 0.503272] 0x000000200000-0x000000fb0000 : "rootfs" [ 0.509255] mtd: device 4 (rootfs) set to be root filesystem [ 0.516793] 1 squashfs-split partitions found on MTD device rootfs [ 0.522995] 0x000000980000-0x000000fb0000 : "rootfs_data" [ 0.529427] 0x000000ff0000-0x000001000000 : "u-boot-env" [ 0.541560] jz4770-phy 1000003c.usb-phy: supply vcc not found, using dummy regulator [ 0.550273] dwc2 13500000.usb: supply vusb_d not found, using dummy regulator [ 0.557803] dwc2 13500000.usb: supply vusb_a not found, using dummy regulator [ 0.896636] dwc2 13500000.usb: EPs: 9, dedicated fifos, 3576 entries in SPRAM [ 0.904190] dwc2 13500000.usb: DWC OTG Controller [ 0.909005] dwc2 13500000.usb: new USB bus registered, assigned bus number 1 [ 0.916074] dwc2 13500000.usb: irq 21, io mem 0x13500000 [ 0.922140] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 5.10 [ 0.930472] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 0.937715] usb usb1: Product: DWC OTG Controller [ 0.942413] usb usb1: Manufacturer: Linux 5.10.39 dwc2_hsotg [ 0.948084] usb usb1: SerialNumber: 13500000.usb [ 0.953899] hub 1-0:1.0: USB hub found [ 0.958315] hub 1-0:1.0: 1 port detected [ 0.963625] usbcore: registered new interface driver usb-storage [ 0.969931] usbcore: registered new interface driver usbserial_generic [ 0.976574] usbserial: USB Serial support registered for generic [ 0.982961] g_serial gadget: Gadget Serial v2.4 [ 0.987563] g_serial gadget: g_serial ready [ 0.991753] dwc2 13500000.usb: bound driver g_serial [ 1.001357] jz4740-rtc 10003000.rtc: registered as rtc0 [ 1.006700] jz4740-rtc 10003000.rtc: hctosys: unable to read the hardware clock [ 1.017287] NET: Registered protocol family 10 [ 1.024771] jz4740-mmc 13450000.mmc: Got CD GPIO [ 1.030415] jz4740-mmc 13460000.mmc: allocated mmc-pwrseq [ 1.048139] Segment Routing with IPv6 [ 1.051917] NET: Registered protocol family 17 [ 1.056521] 8021q: 802.1Q VLAN Support v1.8 [ 1.065709] clk: Not disabling unused clocks [ 1.076687] jz4740-mmc 13450000.mmc: Ingenic SD/MMC card driver registered [ 1.083571] jz4740-mmc 13450000.mmc: Using DMA, 8-bit mode [ 1.117858] random: fast init done [ 1.127015] mmc0: host does not support reading read-only switch, assuming write-enable [ 1.136965] mmc0: new high speed SDHC card at address 59b4 [ 1.144279] mmcblk0: mmc0:59b4 USD00 7.36 GiB [ 1.150950] mmcblk0: p1 p2 [ 1.288935] jz4740-mmc 13460000.mmc: Ingenic SD/MMC card driver registered [ 1.295821] jz4740-mmc 13460000.mmc: Using DMA, 4-bit mode [ 1.313985] VFS: Mounted root (squashfs filesystem) readonly on device 179:2. [ 1.327065] Freeing unused kernel memory: 1248K [ 1.331607] This architecture does not have kernel memory protection. [ 1.338135] Run /sbin/init as init process [ 2.251637] init: Console is alive [ 2.255401] init: - watchdog - [ 2.708102] kmodloader: loading kernel modules from /etc/modules-boot.d/* [ 2.979852] kmodloader: done loading kernel modules from /etc/modules-boot.d/* [ 2.997728] init: - preinit - [ 4.831844] random: jshn: uninitialized urandom read (4 bytes read) [ 5.125417] random: jshn: uninitialized urandom read (4 bytes read) [ 5.154924] random: jshn: uninitialized urandom read (4 bytes read) Press the [f] key and hit [enter] to enter failsafe mode Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level [ 9.823167] F2FS-fs (loop0): Mounted with checkpoint version = d70cad8 [ 9.831435] mount_root: switching to f2fs overlay [ 10.343949] EXT4-fs (mmcblk0p1): mounted filesystem without journal. Opts: (null) [ 10.366744] urandom-seed: Seeding with /etc/urandom.seed [ 10.402035] procd: - early - [ 10.405047] procd: - watchdog - [ 11.235470] procd: - watchdog - [ 11.246947] procd: - ubus - [ 11.509885] urandom_read: 1 callbacks suppressed [ 11.509893] random: ubusd: uninitialized urandom read (4 bytes read) [ 11.543264] random: ubusd: uninitialized urandom read (4 bytes read) [ 11.557447] random: ubusd: uninitialized urandom read (4 bytes read) [ 11.575315] procd: - init - Please press Enter to activate this console. [ 12.306697] EXT4-fs (mmcblk0p1): mounted filesystem without journal. Opts: (null) [ 13.584963] urngd: v1.0.2 started. [ 13.637541] kmodloader: loading kernel modules from /etc/modules.d/* [ 13.707071] Loading modules backported from Linux version v5.10.34-0-g0aa66717f684 [ 13.714649] Backport generated by backports.git v5.10.34-1-0-g7b5533e1 [ 13.782752] xt_time: kernel timezone is -0000 [ 13.997795] PPP generic driver version 2.4.2 [ 14.005313] random: crng init done [ 14.008813] random: 3 urandom warning(s) missed due to ratelimiting [ 14.016861] NET: Registered protocol family 24 [ 14.176800] usbcore: registered new interface driver brcmfmac [ 14.191103] kmodloader: done loading kernel modules from /etc/modules.d/* BusyBox v1.33.1 (2021-06-13 17:58:18 UTC) built-in shell (ash) _______ ________ __ | |.-----.-----.-----.| | | |.----.| |_ | - || _ | -__| || | | || _|| _| |_______|| __|_____|__|__||________||__| |____| |__| W I R E L E S S F R E E D O M ----------------------------------------------------- OpenWrt SNAPSHOT, r16799+6-7131f5a2fb ----------------------------------------------------- === WARNING! ===================================== There is no root password defined on this device! Use the "passwd" command to set up a new password in order to prevent unauthorized SSH logins. -------------------------------------------------- root@OpenWrt:/#
Notes
Official site: https://web.archive.org/web/20171219115313/http://www.zoomgo.tv
Source code of original OpenWrt based firmware: https://github.com/tonystark3188/6291.git and https://github.com/lxl1140989/6291-xl.git
Presumably the source code of Android App: https://github.com/zhangchaojiong/ZOOMGO.git
Announcement and discussion related to the device: https://groups.google.com/g/mips-creator-ci20/c/5KjoNhkvmKI