Modding ChipPC thin clients

From DietPC
Jump to: navigation, search

by Paul Whittaker, July 2009

Introduction

I have been curious about ChipPC thin clients for some time, because of their highly unusual choice of a MIPS core and their innovative designs (Jack PC etc). When ChipPC finally got around to supporting Linux as well as WinCE I decided to buy one, mostly so that I could justify porting DIET-PC 3 to MIPS[EL]. I ended up importing an LXN-2310 from the U.S. at relatively little cost (US$250 including postage). The Plug PC seemed more appealing than the LXN-2310, but I was worried that it might be less "hackable" in the event that I had to crack the case and use JTAG to bypass security measures, or something like that.

Hardware

The hardware used for Jack PC, Plug PC and Xtreme PC NG (a.k.a. LXN-2310) are all virtually identical. The only differences, apart from the case, are the quantity of RAM and presence of absence of the RS232 serial port, SVGA port and one of the USB ports.

So, from a Linux driver perspective, what's in an LXN-2310?

CPU RMI Alchemy Au1250 528 MHz (which is soooooooo NOT equivalent to a 1.8 GHz x86!)
RAM 256 MiB DDR2
Storage M-Systems (now Sandisk) Disk-on-Chip (mDOC)H3 256 MiB, TSOP-II (i.e. soldered on, not DIP)
GPU On-chip (au1200fb framebuffer) 1.5(?) MiB VRAM
Multimedia acceleration engine Unknown capability supported by mysterious "mae_driver" driver
Network ASIX AX88796B (ax88796b) 10/100 Mbit/s
Serial port standard 8250/16550
USB On-chip OHCI/EHCI (ohci_hcd / ehci_hcd (au1xxx)), hi-speed (480 Mbit/s) USB 2.0 capable
RTC On-chip (rtc-au1xxx)
I2C On-chip (i2c-au1550)
Audio On-chip AC97 (au1550_ac97)

The mDOC is TrueFFS-formatted, but the kernel includes a "TFFS" driver (presumably non-GPL, v1100.86) that maps the partitions on the mDOC to ten separate virtual disks, /dev/tffsa through /dev/tffsj:

Device Size (bytes) Contents
tffsa 524288 OEM boot loader (CLIO?)
tffsb 1048756 640x480x8 Windows BMP splash screen
tffsc 524288 Unknown
tffcd 524288 Unknown
tffsd 524288 Unknown
tffse 524288 Unknown
tffsf 2097152 Unknown
tffsg 33554432 Uncompressed 2.6.23.17 Linux kernel, but not a single contiguous file (TrueFFS?), unknown actual size
tffsh 67108864 Active copy of Squashfs 3.3 userspace (actual size 65152512 bytes)
tffsi 67108864 Duplicate (master? alternate?) copy of Squashfs 3.3 userspace (actual size 65152512 bytes)
tffsj 72351744 Ext3 filesystem used as AUFS front filesystem (actual size 72351744)

Presumably, the reason why there are two copies of the SquashFS is to allow the running O/S to write new firmware to the alternate location without fatally damaging itself in the process. The upgrade process would then flip a bit somewhere such that the alternate becomes the primary and vice versa, and /dev/tffsi is actively used instead of /dev/tffsh thereafter; that way, you'd still have a good copy of the old firmware to roll back to if something went wrong. At least, that's how I'd do it. Simple, but it wastes a lot of disk space.

The kernel command line (/proc/cmdline) is:

root=initramfs console=ttyS0,115200 console=tty0 loglevel=0 init=/linuxrc slub_debug=Z,kmalloc-3

So there is a 115200 bps ttyS0 serial console, but the kernel log level has been turned right down such that you don't see anything on it. This could theoretically be undone by a binary edit. Just as well I bought the model with the serial port, isn't it?

Here's as much dmesg output as I have been able to capture:

[    0.000000] [kmem_cache_flags]####### queue='kmalloc-364'
[    0.000000] SLUB: Genslabs=25, HWalign=32, Order=0-2, MinObjects=8, CPUs=1, Nodes=1
[    0.000000] Calibrating delay loop... 527.27 BogoMIPS (lpj=4120576)
[    0.328125] Security Framework v1.0.0 initialized
[    0.328125] Mount-cache hash table entries: 2048
[    0.328125] NET: Registered protocol family 16
[    0.343750] [blk_dev_init]request = 180 bytes
[    0.343750] Generic PHY: Registered new driver
[    0.343750] SCSI subsystem initialized
[    0.343750] usbcore: registered new interface driver usbfs
[    0.359375] usbcore: registered new interface driver hub
[    0.359375] usbcore: registered new device driver usb
[    0.375000] NET: Registered protocol family 2
[    0.390625] Time: MIPS clocksource has been installed.
[    0.515625] IP route cache hash table entries: 4096 (order: 0, 16384 bytes)
[    0.515625] TCP established hash table entries: 8192 (order: 2, 65536 bytes)
[    0.515625] TCP bind hash table entries: 8192 (order: 1, 32768 bytes)
[    0.515625] TCP: Hash tables configured (established 8192 bind 8192)
[    0.515625] TCP reno registered
[    1.359375] audit: initializing netlink socket (disabled)
[    1.359375] audit(946684801.359:1): initialized
[    1.375000] VFS: Disk quotas dquot_6.5.1
[    1.375000] Dquot-cache hash table entries: 4096 (order 0, 16384 bytes)
[    1.390625] DLM (built Feb  2 2009 11:15:28) installed
[    1.390625] squashfs: version 3.3 (2007/10/31) Phillip Lougher
[    1.390625] NTFS driver 2.1.28 [Flags: R/W].
[    1.390625] fuse init (API version 7.8)
[    1.406250] aufs 20080714
[    1.406250] io scheduler noop registered
[    1.406250] io scheduler anticipatory registered
[    1.406250] io scheduler deadline registered
[    1.406250] io scheduler cfq registered (default)
[    1.406250] au1200fb: LCD controller driver for AU1200 processors
[    1.406250] [AU1200FB] options: '<NULL>', panelres = 1
[    1.406250] au1200fb: Panel 1 VGA_640x480
[    1.406250] au1200fb: Win 3 0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx
[    1.406250] [au1200_setpanel] begin (newpanel 0x8079325C)
[    1.406250] [au1200_setpanel] Panel(VGA_640x480), 640x480
[    1.406250] [au1200_setpanel] External clock source is used to drive LCD (mode 1 [640x480])
[    1.406250] [au1200_setpanel] screen reg 0x13F9DF80, win enable 0x1
[    1.406250] [au1200_setpanel] Setting DAC (mode 1 [640x480])
[    1.406250] [SetDac] Total: W=0320, H=220D; Sync: H=96, V=3
[    1.406250] [WriteI2C]can't get i2c device
[    1.406250] [SetDac] i2c_ret = -19
[    1.406250] [WriteI2C]can't get i2c device
[    1.406250] [SetDac] i2c_ret = -19
[    1.406250] [WriteI2C]can't get i2c device
[    1.406250] [WriteI2C]can't get i2c device
[    1.406250] [au1200fb_drv_probe] begin
[    1.406250] drivers/video/au1200fb.c: Framebuffer memory map at 84000000
[    1.406250] drivers/video/au1200fb.c: phys=0x04000000, size=600K
[    1.406250] drivers/video/au1200fb.c: line length: 1280
[    1.406250]
[    1.406250] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.406250]
[    1.406250] [au1200fb_fb_set_par]***** xres=640, yres=480, bits_per_pixel=16
[    1.406250] drivers/video/au1200fb.c: line length: 1280
[    1.406250]
[    1.406250] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.406250]
[    1.406250] [au1200fb_fb_set_par]***** xres=640, yres=480, bits_per_pixel=16
[    1.406250] drivers/video/au1200fb.c: line length: 1280
[    1.406250]
[    1.406250] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.406250]
[    1.406250] Console: switching to colour frame buffer device 80x30
[    1.421875] drivers/video/au1200fb.c: Framebuffer memory map at 8490c000
[    1.421875] drivers/video/au1200fb.c: phys=0x0490c000, size=2K
[    1.421875] drivers/video/au1200fb.c: line length: 1280
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.421875]
[    1.421875] [au1200fb_fb_set_par]***** xres=640, yres=480, bits_per_pixel=16
[    1.421875] drivers/video/au1200fb.c: line length: 1280
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: Framebuffer memory map at 849dc000
[    1.421875] drivers/video/au1200fb.c: phys=0x049dc000, size=2K
[    1.421875] drivers/video/au1200fb.c: line length: 1280
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.421875]
[    1.421875] [au1200fb_fb_set_par]***** xres=640, yres=480, bits_per_pixel=16
[    1.421875] drivers/video/au1200fb.c: line length: 1280
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: Framebuffer memory map at 84a30000
[    1.421875] drivers/video/au1200fb.c: phys=0x04a30000, size=2K
[    1.421875] drivers/video/au1200fb.c: line length: 1280
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.421875]
[    1.421875] [au1200fb_fb_set_par]***** xres=640, yres=480, bits_per_pixel=16
[    1.421875] drivers/video/au1200fb.c: line length: 1280
[    1.421875]
[    1.421875] drivers/video/au1200fb.c: bits_per_pixel: 16
[    1.421875]
[    1.421875] [au1200fb_drv_probe] end ok
[    1.468750] rtc: I/O resource 70 is not free.
[    1.468750] Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
[    1.468750] serial8250.9: ttyS0 at MMIO 0x11100000 (irq = 0) is a 16550A
[    1.468750] console [ttyS0] enabled
[    1.484375] loop: module loaded
[    1.484375] nbd: registered device at major 43
[    1.484375] tffs: mDOC driver (XAT & MAC support by Chip PC) 1100.86
[    1.484375] tffs: will not use IRQ
[    1.484375] tffs: Searching for H3 device...
[    1.484375] tffs:
[    1.484375] Searching devices on socket #0...
[    1.484375] tffs: Try 8KB window...
[    1.484375] tffs: Memory window is 8KB
[    1.484375] tffs: doch_reset() - enter
[    1.484375] tffs: doch_reset() - exit (OK)
[    1.484375] tffs:
[    1.484375] Found #1 device(s)...
[    1.484375] tffs: mDOC found
[    1.484375] tffs: H3 Device found !!!
[    1.484375] tffs: Socket 0 in addr 0x1fc00000
[    1.500000] tffs: C/H/S (0) 32 1 32
[    1.500000] tffs: Device 0x0: 1024 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 32 1 32
[    1.500000] tffs: C/H/S (0) 64 1 32
[    1.500000] tffs: Device 0x1: 2048 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 64 1 32
[    1.500000] tffs: C/H/S (0) 32 1 32
[    1.500000] tffs: Device 0x2: 1024 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 32 1 32
[    1.500000] tffs: C/H/S (0) 32 1 32
[    1.500000] tffs: Device 0x3: 1024 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 32 1 32
[    1.500000] tffs: C/H/S (0) 32 1 32
[    1.500000] tffs: Device 0x4: 1024 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 32 1 32
[    1.500000] tffs: C/H/S (0) 128 1 32
[    1.500000] tffs: Device 0x5: 4096 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 128 1 32
[    1.500000] tffs: C/H/S (0) 512 4 32
[    1.500000] tffs: Device 0x6: 65536 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 512 4 32
[    1.500000] tffs: C/H/S (0) 512 8 32
[    1.500000] tffs: Device 0x7: 131072 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 512 8 32
[    1.500000] tffs: C/H/S (0) 512 8 32
[    1.500000] tffs: Device 0x8: 131072 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 512 8 32
[    1.500000] tffs: C/H/S (0) 736 4 48
[    1.500000] tffs: Device 0x9: 141312 512-byte sectors, h/w sector 512 bytes
[    1.500000] tffs: C/H/S 736 4 48
[    1.500000] tffs: use major device number 100
[    1.500000]  tffsa: unknown partition table
[    1.515625]  tffsb: unknown partition table
[    1.515625]  tffsc: unknown partition table
[    1.515625]  tffsd: unknown partition table
[    1.531250]  tffse: unknown partition table
[    1.531250]  tffsf: unknown partition table
[    1.531250]  tffsg: unknown partition table
[    1.546875]  tffsh: unknown partition table
[    1.546875]  tffsi: unknown partition table
[    1.546875]  tffsj: unknown partition table
[    1.546875] tffs:  [MDOCH3] PhysicalInfo@0xBFC00000:15, 524288, 1024, 0, 0
[    1.562500] tffs:  [MDOCH3] flVolumeInfo 2 (0) Size 524288 b, Unit 524288 b
[    1.562500] tffs: bdCallTFFSToDOCH(): actualPartitionNum failed with status:
[    1.562500] tffs: 0x69
[    1.562500] tffs:  [MDOCH3] bdkCopyBootAreaInit (0, MACA) -> (2, 0) returns 0
[    1.562500] tffs: dwMAC=4,data size=26, data(hex) 12007F00E8004A003300D40027002B003600D6002700D2002105
[    1.562500]
[    1.562500] /proc/regi created
[    1.562500] /proc/flush_regi created
[    1.562500] PPP generic driver version 2.4.2
[    1.562500] PPP Deflate Compression module registered
[    1.562500] PPP BSD Compression module registered
[    1.562500] SLIP: version 0.8.4-NET3.019-NEWTTY (dynamic channels, max=256) (6 bit encapsulation enabled).
[    1.562500] CSLIP: code copyright 1989 Regents of the University of California.
[    1.562500] SLIP linefill/keepalive option.
[    1.562500] HDLC support module revision 1.21
[    1.562500] Cronyx Ltd, Synchronous PPP and CISCO HDLC (c) 1994
[    1.562500] Linux port (c) 1998 Building Number Three Ltd & Jan "Yenya" Kasprzak.
[    1.562500] STRIP: Version 1.3A-STUART.CHESHIRE (unlimited channels)
[    1.562500] au1xxx-ehci au1xxx-ehci.0: Au1xxx EHCI
[    1.562500] au1xxx-ehci au1xxx-ehci.0: new USB bus registered, assigned bus number 1
[    1.562500] au1xxx-ehci au1xxx-ehci.0: irq 29, io mem 0x14020200
[    1.593750] au1xxx-ehci au1xxx-ehci.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
[    1.593750] usb usb1: configuration #1 chosen from 1 choice
[    1.593750] hub 1-0:1.0: USB hub found
[    1.593750] hub 1-0:1.0: 2 ports detected
[    1.718750] ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
[    1.718750] drivers/usb/host/ohci-au1xxx.c: starting Au1xxx OHCI USB Controller
[    1.718750] drivers/usb/host/ohci-au1xxx.c: Clock to USB host has been enabled
[    1.718750] au1xxx-ohci au1xxx-ohci.0: Au1xxx OHCI
[    1.718750] au1xxx-ohci au1xxx-ohci.0: new USB bus registered, assigned bus number 2
[    1.718750] au1xxx-ohci au1xxx-ohci.0: irq 29, io mem 0x14020100
[    1.828125] usb usb2: configuration #1 chosen from 1 choice
[    1.828125] hub 2-0:1.0: USB hub found
[    1.828125] hub 2-0:1.0: 2 ports detected
[    2.062500] usb 1-1: new high speed USB device using au1xxx-ehci and address 2
[    2.265625] usb 1-1: configuration #1 chosen from 1 choice
[    2.265625] hub 1-1:1.0: USB hub found
[    2.265625] hub 1-1:1.0: 4 ports detected
[    2.687500] usb 1-1.3: new low speed USB device using au1xxx-ehci and address 3
[    2.859375] usb 1-1.3: configuration #1 chosen from 1 choice
[    3.156250] usb 1-1.1: new low speed USB device using au1xxx-ehci and address 4
[    3.312500] usb 1-1.1: configuration #1 chosen from 1 choice
[    3.312500] usbcore: registered new interface driver usblp
[    3.312500] Initializing USB Mass Storage driver...
[    3.312500] usbcore: registered new interface driver usb-storage
[    3.312500] USB Mass Storage support registered.
[    3.312500] mice: PS/2 mouse device common for all mice
[    3.312500] [rtc_au1xxx_init]
[    3.312500] rtc-au1xxx rtc-au1xxx.0: rtc core: registered rtc_au1xxx_rtc as rtc0
[    3.312500] [rtc_au1xxx_probe] rtc_device_register = 0x8491CC00
[    3.312500] i2c /dev entries driver
[    3.328125] [i2c_au1550_init] @@@@@@@@@@@ standby thread started
[    3.328125] Au1550 I2C: [base 0XB1B00000][i2c_au1550_add_bus] cp1
[    3.328125] [i2c_au1550_add_bus] cp2
[    3.328125] [i2c_au1550_add_bus] cp3
[    3.328125] [i2c_au1550_add_bus] cp4
[    3.328125] [i2c_au1550_add_bus] cp5
[    3.328125] [i2c_au1550_add_bus] cp6
[    3.328125] initialized.
[    3.328125] Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_margin=60 sec (nowayout= 0)
[    3.328125] input: Chicony  USB Keyboard as /devices/platform/au1xxx-ehci.0/usb1/1-1/1-1.3/1-1.3:1.0/input/input0
[    3.437500] input: USB HID v1.10 Keyboard [Chicony  USB Keyboard] on usb-Au1xxx-1.3
[    3.453125] input: Chicony  USB Keyboard as /devices/platform/au1xxx-ehci.0/usb1/1-1/1-1.3/1-1.3:1.1/input/input1
[    3.562500] input: USB HID v1.10 Device [Chicony  USB Keyboard] on usb-Au1xxx-1.3
[    3.562500] input: HID 1241:1111 as /devices/platform/au1xxx-ehci.0/usb1/1-1/1-1.1/1-1.1:1.0/input/input2
[    3.656250] input: USB HID v1.00 Mouse [HID 1241:1111] on usb-Au1xxx-1.1
[    3.656250] usbcore: registered new interface driver usbhid
[    3.656250] drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
[    3.656250] DAC: DMA14, ADC: DMA15
[    3.656250] [AC97 INIT] point 1, PSC0_BASE_ADDR = 0xB1A00000, AC97_PSC_BASE = 0xB1A00000, AC97_PSC_CTRL = 0xB1A00004
[    3.656250] [AC97 INIT] PCM dev ID 3, MIXER dev ID 0
[    3.656250] [AC97 INIT] point 2
[    3.656250] [AC97 INIT] point 3
[    3.656250] [AC97 INIT] point 4
[    4.156250] [AC97 INIT] point 5
[    4.156250] [AC97 INIT] point 5 5
[    4.156250] [AC97 INIT] point 6
[    4.156250] [AC97 INIT] point 7
[    4.156250] [AC97 INIT] point 8
[    4.156250] ac97_codec: AC97 Audio codec, id: ALG64 (Unknown)
[    4.156250] [AC97 INIT] point 9
[    4.156250] AC'97 Base/Extended ID = 5990/0607<6>NET: Registered protocol family 26
[    4.156250] GACT probability on
[    4.156250] Mirror/redirect action on
[    4.156250] Simple TC action Loaded
[    4.156250] netem: version 1.2
[    4.156250] u32 classifier
[    4.156250]     Performance counters on
[    4.156250]     input device check on
[    4.156250]     Actions configured
[    4.156250] TCP bic registered
[    4.156250] TCP cubic registered
[    4.156250] TCP westwood registered
[    4.156250] TCP htcp registered
[    4.156250] Initializing XFRM netlink socket
[    4.156250] NET: Registered protocol family 1
[    4.156250] NET: Registered protocol family 10
[    4.156250] lo: Disabled Privacy Extensions
[    4.156250] IPv6 over IPv4 tunneling driver
[    4.156250] sit0: Disabled Privacy Extensions
[    4.156250] NET: Registered protocol family 17
[    4.156250] NET: Registered protocol family 15
[    4.156250] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    4.156250] All bugs added by David S. Miller <davem@redhat.com>
[    4.156250] SCTP: Hash tables configured (established 32768 bind 65536)
[    4.250000] ieee80211: 802.11 data/management/control stack, git-1.1.13
[    4.250000] ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@li
[    4.156250] GACT probability on
[    4.156250] Mirror/redirect action on
[    4.156250] Simple TC action Loaded
[    4.156250] netem: version 1.2
[    4.156250] u32 classifier
[    4.156250]     Performance counters on
[    4.156250]     input device check on
[    4.156250]     Actions configured
[    4.156250] TCP bic registered
[    4.156250] TCP cubic registered
[    4.156250] TCP westwood registered
[    4.156250] TCP htcp registered
[    4.156250] Initializing XFRM netlink socket
[    4.156250] NET: Registered protocol family 1
[    4.156250] NET: Registered protocol family 10
[    4.156250] lo: Disabled Privacy Extensions
[    4.156250] IPv6 over IPv4 tunneling driver
[    4.156250] sit0: Disabled Privacy Extensions
[    4.156250] NET: Registered protocol family 17
[    4.156250] NET: Registered protocol family 15
[    4.156250] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    4.156250] All bugs added by David S. Miller <davem@redhat.com>
[    4.156250] SCTP: Hash tables configured (established 32768 bind 65536)
[    4.250000] ieee80211: 802.11 data/management/control stack, git-1.1.13
[    4.250000] ieee80211: Copyright (C) 2004-2005 Intel Corporation <jketreno@linux.intel.com>
[    4.250000] ieee80211_crypt: registered algorithm 'NULL'
[    4.250000] ieee80211_crypt: registered algorithm 'WEP'
[    4.250000] ieee80211_crypt: registered algorithm 'CCMP'
[    4.250000] ieee80211_crypt: registered algorithm 'TKIP'
[    4.250000] rtc-au1xxx rtc-au1xxx.0: setting the system clock to 2008-05-31 14:14:13 (1212243253)
[    4.250000] Freeing unused kernel memory: 2896k freed
[    5.125000] EXT3-fs warning: checktime reached, running e2fsck is recommended
[    5.125000] kjournald starting.  Commit interval 5 seconds
[    5.187500] EXT3 FS on tffsj, internal journal
[    5.187500] EXT3-fs: recovery complete.
[    5.187500] EXT3-fs: mounted filesystem with journal data mode.
[    5.203125] tffs: unknown ioctl=0x4c01 on tffsj
[    6.593750] kjournald starting.  Commit interval 5 seconds
[    6.609375] EXT3 FS on tffsj, internal journal
[    6.609375] EXT3-fs: mounted filesystem with journal data mode.

Software

ChipPC's "ThinX" operating system is essentially a minimal-footprint variant of early Debian Lenny (/etc/debian_version identifies it as "lenny/sid"), optimised using "-march=mips32" (i.e. unlike regular Debian mipsel, it doesn't support MIPS CPUs earlier than mips32). It doesn't use uClibc, Busybox or any of the standard embedded tools. The GUI environment is Xorg 7.1.1 with ICEWM (although the Xephyr X server, used to do Xnest-style XDMCP connections to remote hosts, is Xorg 7.2 as the ChipPC glossy claims).

Everything runs as root, and the root password is null (i.e. no password). Although there is no Xterm menu option it is trivially easy to add a desktop icon. Just use the text editor to create a ~/Desktop/xterm.desktop file with contents as follows, and a desktop icon will appear instantly:

[Desktop Entry]
Type=Application
Encoding=UTF-8
Name=XTerm
GenericName=X Terminal Emulator
Icon=terminal
TryExec=xterm
Exec=xterm
Terminal=false
Categories=GTK

The userspace is built on AUFS (an advanced UnionFS clone), which is initialised by early userspace (an initramfs that I haven't yet been able to extract from the kernel image in /dev/tffsg) and activated via a pivot_root(2) system call. The root filesystem union consists of the base read-only SquashFS filesystem on /dev/tffsh mounted on /static (SquashFS is intrinsically read-only, plus up to 64 additional read-only SquashFS "plugin" filesystems, located in files named [/dynamic]/usr/lib/chippc/plugins/XXXXX_container.NN.part (where XXXXX is the abbreviated plugin name and NN is a plugin number in the range 01-64), overlayed with the persistent, writable ext3 filesystem on /dev/tffsj mounted on /dynamic (a.k.a. /plugrr and /doc). After the pivot_root, /static, /dynamic and /plugrr are no longer accessible.

Here's where the bastardry comes in: the writable "front" filesystem (/dynamic a.k.a. /pluginrr a.k.a. /doc) is mounted with the "noexec" option. Or more accurately, /pluginrr is, and /dynamic is probably a "--bind" mount of /pluginrr. This means that you can only execute binaries in the read-only squashfs "back" filesystem(s), because any other file (including ones on NFS mount points and removable media) are subject to the "noexec" constraint of the front filesystem such that you will get "Operation not permitted" errors when trying to execute them. Same goes for shared libraries. This is evidently a deliberate security/anti-tamper mechanism.

The practical upshot of all this is that ThinX behaves like a normal operating system (unlike DIET-PC, the front filesystem is persistent, so any changes that you make are still there after a reboot) except that it won't allow you to run any "outside" binaries. So, even assuming that you could somehow install the apt and apt-utils debs so that you could run "apt-get update; apt-get install xxx", it wouldn't do you any good, because you wouldn't be able to execute anything that you downloaded.

Could this feature be turned off? Yes, but you'd have to isolate the part of /dev/tffsg that contains the initramfs (cpio.gz), remove "noexec" from the relevant mount instruction, write back the modified cpio.gz with trailing garbage such that it remains the same size, and then reboot and hope that there isn't an integrity checksum for the kernel file or the partition that it lives in. However, it appears that the kernel is non-contiguous in /dev/tffsg, so before you can do any of this you'd have to solve the mystery of /dev/tffsg's filesystem format and the metadata that it adds to each block/sector/whatever. So the whole thing is dangerous and complicated.

ThinX's plugin system is quite sophisticated. FYI, an LPLN (Linux Plugin) file consists of the four characters "LPLN" followed by 1264 bytes of policy file (written to [/doc]/usr/lib/chippc/doc/plugins/XXXXX/XXXXX_policy.plc, where XXXXX is the plugin name, possibly derived from the policy library filename it contains), 256 bytes of unqualified squashfs filename (padded with trailing zeroes), and the remainder of the file is the plugin squashfs (little endian version 3.1) itself. The squashfs filename has the form XXXXX_container.NN.part, where XXXXX is the (short) name of the plugin and NN is the plugin slot number that it uses (01 through 64), and installs to [/doc]/usr/lib/chippc/doc/plugins. Once the squashfs is merged into the root union (after a reboot), additional plugin metadata files will appear in /usr/lib/chippc/doc/plugins/XXXXX/, including a XXXXX_policy.so file (which presumably defines a remote management API for Xcalibur Global), a XXXXX_icon.ico Windows icon, a XXXXX_setup.exe configuration program (a Linux X11 (GTK2) binary, not a Windows binary, despite the .exe extension) and the XXXXX_setup.glade XML file that it uses. The GTK stuff hooks into the LBT configurator (Settings -> Device in the ICEWM menu), and is launched by that plugin's "Configure" button. Plugins are "signed" in some way, such that LBT will refuse to install a plugin whose squashfs has been modified. The plugin signature must be in the XXXXX_policy.plc file, most likely somewhere in the first 32 bytes.

Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox