[XCSSA] Someone proof my PIC hacking article?
X-otic Computer Systems of San Antonio
xcssa at xcssa.org
Sun Jun 14 23:27:02 CDT 2009
Wow.. I spent all weekend playing around with getting Xubuntu installed on the
little AMD PIC device that I'm showing at XCSSA Monday night.
I ended up writing a whole article on my experience with hacking on the AMD
PIC. Would appreciate any constructive feedback. I'm thinking about taking
out my PIC#1/PIC#2 references and cleaning up and condensing it a bit to
submit to a Linux magazine. Please email feedback directly to me:
tweeks-junk2 at theweeks dot org
Thanx..
p.s. And no.. I don't normally have this kind of weekend time.. My wife and
kids are out of town for the week with their grandparents. :)
De-WinCE-ing the AMD "PIC Brick" PC: By Thomas Weeks
================================================
2009-06-14(c) Tweeks
Background:
------------
The AMD PIC (Personal Internet Communicator) was one of AMD's early attempts
at a complete, low cost, low power and reliable PC designed to get more
people access to the Internet as a part of the "50x15 Initiative"[1]. One of
the main goals of 50x15 was to get 50% of the world population Internet access
by 2015 -- especially focusing on underprivileged users in third world
countries. The PIC was an early part of AMD's efforts in this arena, as were
other mini PC platforms such as the OLTPC (One Laptop Per Child), the Linutop
(http://en.wikipedia.org/wiki/Linutop) and other small, low power, cheap PCs.
These mini-PC efforts, while somewhat successful, have in turn lead to first
world market innovations such as the Mac mini and the hot, new "Netbook"
category of small, low power laptops.
Under The PIC's Hood:
---------------------
The AMD PIC runs a low power AMD Geode processor that only consumes around
1Watt, and with the running hard drive overall only consumes between 8-12watts
total. The hardware consists of:
* AMD Geode GX 500 at 1.0W processor, 366 MHz clock rate
* 128 MBytes DDR RAM (Up to 512 MBytes)
* VGA display interface up to 1600x1200
* four USB 1.1 ports
* 56 kbit/s ITU v.92 Fax/Modem
* AC'97 audio interface
* Fanless design.
* Input Voltage: 12 VDC (Factory provided AC/DC converter)
* Power Dissipation: 8 Watts (plus power supply's own dissipation)
* Total power Dissipation: 12.7 Watts @ 100% CPU Load
* Weight ~3 pounds
* Dimensions 5.5x 8.5 x 2.5 inches
The PIC, and similar low power devices, represent a new class of PCs that can
literally be powered and run off a car battery and a solar cell.[1][3]
The Problem:
------------
With the AMD-PIC specifically, AMD worked with Microsoft closely and agreed to
run the PIC on a locked down, "Trusted Platform" restricted type of hardware
configuration that would only allow a special, incompatible version of
WindowsCE to be used on the platform. A restriction that ended up killing
the PICs adoption.[2]
The Linux Hacker's Solution:
-----------------------------
The stated goals of this article are mainly two fold. To record and
communicate how to effectively:
1) Reflash the PIC BIOS:
-Get to a DOS prompt
-Access the flashce utility
-Reflash the stock-BIOS with the new unlocked-BIOS ROM
(thus allowing the running of "un-trusted binaries" and/or
boot from an alternate OS)
2) Wipe WindowsCE and Load Linux on the AMD PIC:
This can be done from either a USB based CD-ROM or thumb drive after
#1 is complete... but not before.
The first goal, for me anyway, was a bit more problematic on the two AMD PICs
that I had in my possession.
First, while both systems booted WinCE (which is where you have to
reflash from), neither PIC was fully operational. PIC#1 was password locked
at the initial WinCE GUI, diallowing you to click on anything (much less hack
on it or drop to DOS), and since the "Trusted Platform" BIOS disallows
alternate OS booting... nada. PIC#2 had seen some heavy use as a Hurricane
Katrina desktop for the huddled, computer illiterate masses. And as a result
it had multiple chkdisk files with lots of system partition filesystem
corruption. It looks like the \windows\explorer binary had become heavily
corrupted, as anything that I tried to pull up in a file window interface or
in IE would simply lock up and leave window fragments on the screen. Great.
I guess this is why I got them for free. :)
Broken PICs Giving Me Headaches:
--------------------------------
WARNING: If these PICs have any sort of warranty, following this further will
DEFINITELY void them! [4] ;)
My first PIC (PIC#1) was locked up at a WinCE password prompt just after boot,
and nothing that I did could get around that -- no OS access, no file access,
no BIOS access, zip. The second system (PIC#2) had quite a bit of filesystem
damage, no explorer or file interface other than the desktop, and tons of
chkdisk (scandisk) error files... Great... Even with the hack-docs and flash
ROM image files in hand: [5]
http://xcssa.org/files/AMD-pic-BIOS-flash.txt
http://xcssa.org/files/AMD-pic-BIOS-flash.rar
I can't achieve my goal#1.
So... Both of my PICs are broken and don't even fully boot up and run WinCE
correctly. Time to dig in.
Evaluating What I Have and What I Need:
---------------------------------------
NOTE: Skip this secion if you're not intersted in my specific problems.
However, it is still a good read if you want to completely understand the
nature and inner workings of this hack.
Neither of my PICs can pull up a DOS prompt, run regedit, or access any file
that doesn't have a pre-existing link from the desktop or icon under the
start menu. And since the requirement for completing goal #1 is to copy and
modify a system link file to in turn get a DOS prompt (so that I can access
the flashce.exe binary (under \windows) with the unlocked BIOS ROM file
(PICMOD.ROM)) -- it's apparent that I can't even use the hack-doc directions
(above) to complete goal#1.
NOTE: For more details on how reflashing in the PIC's WinCE all works, see
[6]:
http://mozy.org/amd-pic/
Creating my own DOS link files manually on the Desktop was also not working.
I needed an existing "system link" copied to PIC#2's half-working desktop
(that was at least coming up for me). But with no working file-explorer
access or method of copying files, I was going to have to preform an
off-line, "prep-hack hack". My only option here was to pull the drives,
mount them on Linux and see what I could salvage from them to get WinCE
marginally working to achieve goal#1.
The PIC's Funky Little OS/Filesystem Layout:
--------------------------------------------
NOTE: These are more of my own diagnostic musings. Feel free to skip it if
you're not that curious and just want to get your PIC done.
The partitioning system on these things is rather strange -- and pretty messy
from all the developer file remnants and cruft seen on the drive! The
partition layout looks something like this:
Disk /dev/sda: 10.2 GB, 10242892800 bytes
255 heads, 63 sectors/track, 1245 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x145eb828
Device Boot Start End Blocks Id System
/dev/sda1 * 1 66 530113+ b W95 FAT32
/dev/sda2 67 1178 8932140 c W95 FAT32 (LBA)
/dev/sda3 1179 1244 530145 c2 Unknown
The first partition is a 512MiB boot partition with the bulk of the
diminutive WinCE OS on it (including \Windows\) plus a few OEM apps and other
related files. As previously mentioned, PIC#2 had a number of damaged OS
files, however the strange thing was that even mounted on Linux, the actual
windows binaries (explorer.exe, ie6.exe, cmd.exe, etc) were all "missing"
when looking for them on the partitions in their non-live mounted state from
Linux as we are here. It looks like the "Trusted Platform", signed OS files
were not actually normal files on the filesystem, but are seemingly some type
of read-only system files that get mapped over the filesystem once the OS is
up and running. So, though I wanted to fix PIC#2's filesystem damaged
binaries, it became apparent that in this off-line state I was NOT going to
be able "fix" the broken in missing files by copying good system exe files as
there was nothing to copy from!
So, for my situation, I was not going to be able to mend the filesystem wounds
of PIC#2's little WinCE OS. I really wanted to dig more into the methodology
and technology behind this interesting little MS-hacked up Trusted Platform
filesystem and binary overlay technology... however I really was growing
weary of fighting with Windows (as is often the case with UN*X geeks). And
besides, fixing WinCE would just be healing the little OS in preparation to
shoot it in the head, so why bother?! eh?
Coming to grips with this, and realizing that I had already wasted a late
night getting this far -- I decided to skip fixing the broken WinCE
filesystem/OS and just get back to hack goal #1, and then after succeeding
there, then use this one usable WinCE load to accomplish goal#1 on both PIC
systems.
Moving along....
On To My Pre-Hack to Complete The Hack:
---------------------------------------
As per my hack goal#1, I still need to:
-modify the a system file link:
(such as the control panel link) to point to \Windows\cmd.exe file
-Open a DOS prompt
-Copy the unlocked PICMOD.ROM BIOS file to the WinCE filesystem
-From DOS, run
/Windows/flashce 256 PICMOD.ROM 0x01dfd81a noreboot
and reboot, allowing me to boot Linux from USB, and from there...
Goal#2
-Wipe WinCE off the system and
-Install my distro of choice
(from a USB stick in my case)
However, since from the native WinCE environment I could not pull up the
equivalent of the "My Computer" icon (to modify the control panel link file
(as detailed in the docs), I had to brute force it. I simply pulled and
mounted PIC#2's 10GiB hard drive on my Linux laptop. Here's what it looked
like, manually mounted and ready to go:
/dev/sdb1 517M 157M 360M 31% /mnt/s1 <----- Boot partition
/dev/sdb2 8.6G 101M 8.5G 2% /mnt/s2 <----- Data partition
/dev/sdb3 517M 137M 380M 27% /mnt/s3 <----- Hidden backup boot
NOTE: Though the drive appears here as /dev/sdb on my laptop, once back in the
PIC, it will appear (to Linux) as /dev/sda.
After mounting the PIC's hard drive on my system, I next jumped right in to s1
and knowing exactly what I needed, quickly copied "s1/Control Palel.lnk" to
the OS' desktop directory so that I could get to it from the WinCE OS desktop
once installed back in the PIC:
# cp -a "/mnt/s1/Control Panel.lnk" /mnt/s1/Windows/Desktop/
Next, I needed to make the link file point to the proper DOS prompt
executable. So I next went ahead, and edited the contents of the new link
file "/mnt/s1/Windows/Desktop/Control Panel.lnk" to point to where I needed
it to for when the system was back up -- changing it from:
20#\windows\control.exe
to this:
20#\windows\cmd.exe
That's it.
Now gracefully umounting the partitions (umount /dev/sdb*) and putting the
drive back into the PIC, WinCE comes up and I now have a "Control Panel" link
on the desktop that has the familiar, icky, multi-color 1980's "MSDOS" icon.
Good to go!
Now simply clicking on the link drops me to a full screen, white DOS window
with a basic, letter-less prompt:
. >
A simple dir shows me that I'm in "\" (the WinCE equiv of C:\). Good to go.
The Re-Flashing (aka. de-hobbling):
-----------------------------------
My little PIC#2 unit was able to get onto my LAN and get an IP just fine with
use of a little USB-to-CAT5 adapter. However, since IE was not working at
all, I couldn't download the unlocked BIOS flash-ROM image (PICMOD.ROM)
from the Net, so I simply fell back to the sneaker-net method. I copied the
ROM file over to a small thumb drive, plugged it in, and copied it from "\USB
Device\PICMOD.ROM" to the root of the PIC filesystem:
. > copy "USB Device\PICMOD.ROM" \
Done. Now, from the DOS prompt simply run the built in flashce utility like
this:
. > cd \
. > flashce 256 UNLOCK.ROM 0x01DFD81A noreboot
CE Bios Flash Utility v1.01.03
Command line checksum: 01DFD81A
Calculated file checksum: 01DFD81A
The actual FLASH size on the board is 256K
FLASH Attempt 1...
FLASH WRITE Successful & Verified!
File checksum: 01DFD81A FLASH checksum: 01DFD81A
Done!
. >
NOTE: Contrary to some of the other hack directions out there, having the
flashce.exe utility read the ROM file directly from the "USB Device" directory
didn't work for me. Doing so resulted in some kind of strange I/O problem
from the flashce program. However, I found that that copying the ROM file
over to the PIC's "\" worked fine, and then the flashce program was able to
load it up and do the needful (as seen above).
At this point, your PIC is de-hobbled, de-bricked and should behave more like
a traditional PC. You should now be able to reboot the PIC and the new BIOS
shows more traditional boot time info, as well as WinCE booting prep screens.
>From here, you shouldn't even have to enter the BIOS. It should now boot
from USB if you have bootable media hooked up.
You can now either employ a live-CD (via USB CD-ROM), or use the method that I
chose -- usb-creator: a tool for creating casper based ISO bootable USB
drives with the remaining space functioning as a persistant filesystem.
Hardware Resources and Choosing a Lean Distro:
-----------------------------------------------
Since we're running with limited hardware resources, a lean distro needs to be
used, unless your running a headless firewall or something.
NOTE: The pic comes with only 1 128MiB stock (only one socket, no RAM on the
board). I would recommend swapping it out and maxing out the RAM to 512MiB
if you have a spare 512MiB PC2700 SODIMM laying around. I picked up a couple
of 256MiB SODIMMs for $5 at the local good will Computer (one for each PIC),
as new 512MiB SODIMMs are going for a whopping $60 in some places!
As for which Linux distro to use, some people go with DSL (Damn Small Linux)..
but since I've grown comfortable with Ubuntu and aptitude, I opted for
Xubuntu (Ubuntu with the lead XFCE GUI) to get the best of both worlds.
I created my bootable USB thumb drive using usb-creator. In the old days,
making a bootable thumb drive with persistant user data space was rather
complex. However, nowdays is much easier. With Ubuntu you can now simply
(on another system) do the following:
-DL the Ubuntu/Xubuntu Live Desktop CD & burn it
-Boot the live CD on your desktop system
-Pull up a command prompt and install usb-creator
(https://launchpad.net/usb-creator) like this:
$ sudo aptitude install usb-creator
...
$ sudo usb-creator
-Point the GUI at the live CD ISO image
-Tell it to use the rest of the USB drive as persistence storage
-Done
WARNING: Don't go out and just blindly pick some pretty, eye candy Linux
distro that you dream of running from the PIC. Carefully examine the
distro's minimum RAM requirements.. and then double it! If you don't have
the RAM needed on your PIC, the don't install it. The PIC is no powerhouse
and can easily fall over if pushed too hard. Before starting the install, I
replaced the stock 128MiB RAM with a 256MiB SODIMM, and it was still
paintfully slow. I recommend maxing out the RAM to the max 512kiB (single
SODIMM socket) if you can. You have been warned.
After completing the steps above on an alternate PC, you should now have a
bootable live-CD thumb drive that doubles as a bootable, mobile,
persistence "home drive" with all of your data and favorite apps preloaded --
a very nice thing to have in and of itself. However, for this project here
and now, it is simply another way for doing the Linux-PIC OS install.
It's not required.
NOTE: Before wiping the PIC's drive, you might want to poke around and check
out some of the stock graphic images and desktop backgrounds. They're
actually rather nice. I suggest harvest a few of them -- if not for their
eventual use, then for no other reason then as a type of hacker-warrior
trophy. "Bill Fingers" if you will (google "finger necklace of war").
hehe ;)
Booting & Installing Linux from USB Thumb Drive:
-------------------------------------------------
Some people who are serious about using the PIC as a thin desktop long term
often replace the the stock, power hungry, cheap, 10GiB PATA/IDE drive with a
nice 4/8/16GiB CF solid state drive like this:
http://pair.offshore.ai/pic/
Some folks just skip the internal drive interface all together and hang a
cheap thumb drive off one of the four USB ports. Embedded system with no
moving parts are pretty cool (literally!).. but I've been there, and done
that.. I'm not going to stuff this cute little brick with any of my nicer
hardware until I find out if my wife actually wants to USE it as a kitchen PC
or not (printing recipes, playing mahjong, etc).
But I digress...
All that is needed now is to go ahead and boot from your distro media of
choice and install. Doing this with Xubuntu was a bit tricky on the given
hardware. The Xubuntu stock GUI install locked up during my initial boot
until I utilized the "safe graphics" mode. But even with this fallback in
place, the install GUI was PAINFULLY slow. With by USB boot media, it took
some 30 minutes just to boot.. then another 30 minutes to navigate through
the simple, seven steps of the pre-install Q&A process. The install itself
was still running some three hours into it. In hindsight, I probably should
have opted for the Xubuntu "alternate" install image with usb-creator, or
even down shifted to a thinner distro like DSL.
All Done!
----------
Well, the install completed and the PIC now boots directly into Xubuntu
(albeit rather slowly), and everything "just works". Some folks report
struggling with things like tweaking the Xorg and sound configs, while
others report occasional install issues with keyboard or mice (depending on
the distro chosen). But overall, the PIC makes a nice little, low power PC
that can easily be mounted under a kitchen cabinet or wired into a car glove
compartment.
It's a real shame AMD didn't opt for using Linux out of the gate. After
selling the PIC to Data Evolution (http://www.dataevolution.com/ ), they
re-released the PIC with Linux and won the tech industry IDEA innovation
award for 2006.[7]
If you end up getting a hold of one of these units (on ebay for as little as
$40) and get it running Linux, drop us a line here at XCSSA and share your
experience with the community!
Happy Hacking!
Tweeks
President of XCSSA.ORG
REFERENCES:
[1] The 50x15 Initiative:
http://blogs.guardian.co.uk/technology/category/windows/
[2] AMD PIC + WinCE = Flop
http://blogs.guardian.co.uk/technology/category/windows/
http://www.linuxdevices.com/news/NS8339641893.html
http://arstechnica.com/gadgets/news/2006/11/8201.ars
[3] Info on AMD PIC:
http://www.amdboard.com/pic.html
http://en.wikipedia.org/wiki/Personal_Internet_Communicator
[4] "I void warranties"
http://www.thinkgeek.com/interests/techies/8f52/
[5] Needed Files for de-WinCEing the AMD PIC:
http://xcssa.org/files/AMD-pic-BIOS-flash.txt
http://xcssa.org/files/AMD-pic-BIOS-flash.rar
[6] Info on Hacking the AMD PIC:
http://mozy.org/amd-pic/
[7] AMD DecTop (new PIC+Linux) wins the IDEA award, 2006
http://50x15.amd.com/en-us/sol_tech_dectop.aspx
More information about the XCSSA
mailing list