Shanling M2s

---

Overview

This is the page for the Shanling M2s (not the same as M2 without s at the end!). See http://www.shanling.com/Product/Detail?id=2de2216f17334b2dbaa4377d95d65550

Main Features

These information are mostly from Shanlings' product page:

• No internal memory
• Expandable microSDXC card slot
• 3" TFT display, resolution 480x800 pixels (310ppi)
• USB-C connector
• Output: 3,5mm jack connector for headphones
• Bluetooth 4.0 with APT-X D/A converter (AK4490EQ)
• Output power: 130mW@32ohm
• DSD playback:DSD256DAC: supported up to 192kHz--32bit
• Frequency response: 20Hz--20kHz（-0.2dB）
• THD+N: 0.003%（A-weighting，outputing 500mV）
• SNR: ＞108dB（A-weighting）
• Dynamic range: ＞108dB
• Output impedance: 4.8Ω
• Channel separation: ＞75dB（32Ω，1kHz）
• 1800 mAh battery
• Size: 53x14.5x85.6mm
• Weight: about 100g
• Buttons: 3+1 at left side ("reset" hole, "prev" button, "play/pause" button, "next" button), one at top ("power" button), two at right side: click wheel ("up" and "down" buttons) and "cancel/return" button

Components

• SoC: Ingenic X1000E (MIPS, 1000 MHz, 64 MB embedded DDR, 128 MB ext. NANS SPI flash)
• DAC: AK4490EQ,
• Headphone Amplifier: TI TPA6120
• OP-AMP: MUSES8920
• HBC2500A - proprietary buffer/oscillator manager by Hiby Music (similar to SA2000 in previous models of players).

TBD

System

The original firmware is booting by an u-boot and then starting a linux system. A firmware update will be done with an update.upt file. The whole system seems to be very similar to the one used by AgptekRocker - even the started music player is named the same (hiby_player).

Shanling provides a so called "theme tool (for Windows based OS) with which it's possible to unpack and repack the firmware - actually for theme changing purposes - but it's also possible to change files of the linux system start and inject some own things...

Original firmware file update.upt

The original update.upt firmware file is ISO9660 image file (created with mkisofs). If you unpack the update.upt (for example with 7z), the following is included:

_gitigno
system.ubi
uboot.bin
uimage.bin
update.txt
version.txt

_gitgno seems to be a .gitignore text file which contains just *.*

system.ubi is the system partition in UBIFS format - this can be unpacked with ubireader_extract_files

uboot.bin is the u-boot bootloader partition.

uimage.bin linux kernel image

update.txt is a text file which contains management information for rebuild_update (a uncommented tool from Shanling):

kernel={
        name=kernel
        file_path=autoupdate/uimage.bin
        md5=3dfe26016773fcc52a1f63974c6e546b
}

rootfs={
        name=rootfs
        full_upgrade=yes
        file_path=autoupdate/system.ubi
        md5=c075df9e745c0ccc3b90bbd80491575d
}

version.txt is a text file which contains the version information about the firmware - also used by rebuild_update:

version={
        name=m2s
        ver=2018-05-04T17:36:49+08:00
}

Starting the original firmware

When unpacking the system partition and tweaking some of the init scripts, repacking it as update.upt firmware and flashing it back to the device, [MatthiasM] was able to get an output of dmesg:

[    0.000000] Initializing cgroup subsys cpuset
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Initializing cgroup subsys cpuacct
[    0.000000] Linux version 3.10.14 (sgr@HiBy-Linux) (gcc version 4.7.2 (Ingenic 2015.02) ) #1 PREEMPT Fri May 4 17:36:17 CST 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 RESET ERROR PC:801EC070
[    0.000000] [<801ec070>] memcpy_fromiovec+0x60/0xa8
[    0.000000] CPU0 revision is: 2ed1024f (Ingenic Xburst)
[    0.000000] FPU revision is: 00330000
[    0.000000] CCLK:1008MHz L2CLK:504Mhz H0CLK:200MHz H2CLK:200Mhz PCLK:100Mhz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 004eb000 @ 00010000 (usable)
[    0.000000]  memory: 001b5000 @ 004fb000 (usable after init)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] On node 0 totalpages: 16384
[    0.000000] free_area_init_node: node 0, pgdat 804f90c0, node_mem_map 81000000
[    0.000000]   Normal zone: 128 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16384 pages, LIFO batch:3
[    0.000000] Primary instruction cache 16kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 16kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping off.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS2,115200n8 mem=64M@0x0 no_console_suspend lpj=5009408 ip=off init=/linuxrc ubi.mtd=4 root=ubi0:rootfs ubi.mtd=5 rootfstype=ubifs sn_no=00000000000000000000000000000000 bt_mac=425430000836 wifi_mac=xxxxxxxxxxxx hw_version=4 rw
[    0.000000] hw version:4
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Memory: 57772k/65536k available (3836k kernel code, 7764k reserved, 1197k data, 1748k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000] NR_IRQS:410
[    0.000000] clockevents_config_and_register success.
[    0.000000] Console: colour dummy device 80x25
[    0.004581] Calibrating delay loop (skipped) preset value.. 1001.88 BogoMIPS (lpj=5009408)
[    0.012942] pid_max: default: 32768 minimum: 301
[    0.017920] Mount-cache hash table entries: 512
[    0.023268] Initializing cgroup subsys devices
[    0.027775] Initializing cgroup subsys freezer
[    0.032210] Initializing cgroup subsys blkio
[    0.040153] regulator-dummy: no parameters
[    0.044532] NET: Registered protocol family 16
[    0.065557] bio: create slab <bio-0> at 0
[    0.071106] jz-dma jz-dma: JZ SoC DMA initialized
[    0.076030] gpio_regulator_gpio_init 0
[    0.079875] GPIO_BT_PWR: no parameters
[    0.084200] SCSI subsystem initialized
[    0.088173] usbcore: registered new interface driver usbfs
[    0.093698] usbcore: registered new interface driver hub
[    0.099332] usbcore: registered new device driver usb
[    0.104590]  (null): set:999  hold:1000 dev=100000000 h=2000 l=2000
[    0.111318]  (null): set:249  hold:250 dev=100000000 h=500 l=500
[    0.117606] AXP add mfd driver = 0
[    0.827211] sa ok
[    0.829213] Advanced Linux Sound Architecture Driver Initialized.
[    0.835943] Bluetooth: Core ver 2.16
[    0.839562] NET: Registered protocol family 31
[    0.843997] Bluetooth: HCI device and connection manager initialized
[    0.850521] Bluetooth: HCI socket layer initialized
[    0.855414] Bluetooth: L2CAP socket layer initialized
[    0.860537] Bluetooth: SCO socket layer initialized
[    0.865733] [AXP-MFD] axp_mfd_probe
[    0.869191] [AXP-MFD] axp_init_chip
[    0.873145] axp_mfd 2-0034: AXP (CHIP ID: 0x03) detected
[    0.881807] [AXP-MFD] register regultors
[    0.886411] [AXP-MFD] register power supply
[    0.890861] Switching to clocksource jz_clocksource
[    0.896094] FS-Cache: Loaded
[    0.905317] jz-dwc2 jz-dwc2: regulator vbus get error
[    0.910485] DWC IN OTG MODE
[    1.064710] dwc2 dwc2: Dynamic Power Control
[    1.069004] dwc2 dwc2: Using Buffer DMA mode
[    1.073294] dwc2 dwc2: Core Release: 3.00a
[    1.077507] dwc2 dwc2: DesignWare USB2.0 High-Speed Host Controller
[    1.083821] dwc2 dwc2: new USB bus registered, assigned bus number 1
[    1.091089] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
[    1.098001] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[    1.105257] usb usb1: Product: DesignWare USB2.0 High-Speed Host Controller
[    1.112342] usb usb1: Manufacturer: Linux 3.10.14 dwc2-hcd
[    1.117904] usb usb1: SerialNumber: dwc2
[    1.122330] hub 1-0:1.0: USB hub found
[    1.126141] hub 1-0:1.0: 1 port detected
[    1.130350] dwc2 dwc2: DWC2 Host Initialized
[    1.135058] Suspend otg by shutdown dwc cotroller and phy
[    1.140548] DIS PHY
[    1.143377] axp_ldo1: 1250 mV 
[    1.148145] axp_ldo2: 1800 <--> 3300 mV at 3300 mV 
[    1.154673] axp_ldo3: 700 <--> 3500 mV at 3675 mV 
[    1.161133] axp_ldo4: 1800 <--> 3300 mV at 2500 mV 
[    1.167740] axp_buck1: 700 <--> 3500 mV at 3300 mV 
[    1.174188] axp_buck2: 700 <--> 2275 mV at 1250 mV 
[    1.180741] axp_buck3: 700 <--> 3500 mV at 1800 mV 
[    1.186840] axp_buck4: 700 <--> 3500 mV at 1200 mV 
[    1.192765] axp_ldoio0: 1800 <--> 3300 mV at 2800 mV 
[    1.200398] charging current = 800 mA
[    1.215123] NET: Registered protocol family 1
[    1.220141] 359,init_ddr_proc
[    1.230386] NTFS driver 2.1.30 [Flags: R/O].
[    1.234965] fuse init (API version 7.22)
[    1.239530] exFAT: Version 1.2.9
[    1.242923] msgmni has been set to 112
[    1.249578] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
[    1.257182] io scheduler noop registered
[    1.261081] io scheduler deadline registered
[    1.265607] io scheduler cfq registered (default)
[    1.270670] pwm-backlight pwm-backlight.0: unable to request PWM, trying legacy API
[    1.285298] jz-fb jz-fb: Frame buffer size: 1536000 bytes
[    1.288599] jz-uart.0: ttyS0 at MMIO 0x10030000 (irq = 59) is a uart0
[    1.295305] jz-uart.2: ttyS2 at MMIO 0x10032000 (irq = 57) is a uart2
[    1.303387] console [ttyS2] enabled, bootconsole disabled
[    1.314921] register vprivilege driver OK! Major = 252
[    1.320455] register vprivilege driver OK! Major = 251
[    1.327448] nand_magic=0xfffffffferror in read magic
[    1.332665] sfcnand num=8
[    1.335379] Scanning device for bad blocks
[    1.397505] Creating 6 MTD partitions on "sfc_nand":
[    1.402636] 0x000000000000-0x000000080000 : "uboot"
[    1.408169] ftl_cs: FTL header not found.
[    1.412957] 0x000000080000-0x000000300000 : "logo"
[    1.418688] ftl_cs: FTL header not found.
[    1.423443] 0x000000300000-0x000000900000 : "kernel"
[    1.429386] ftl_cs: FTL header not found.
[    1.434095] 0x000000900000-0x000001000000 : "recovery"
[    1.440243] ftl_cs: FTL header not found.
[    1.444951] 0x000001000000-0x000005000000 : "rootfs"
[    1.450933] ftl_cs: FTL header not found.
[    1.455695] 0x000005000000-0x000008000000 : "data"
[    1.461512] ftl_cs: FTL header not found.
[    1.466464] usbcore: registered new interface driver usb-storage
[    1.472852] usbcore: registered new interface driver usbserial
[    1.479008] usbcore: registered new interface driver usbserial_generic
[    1.485774] usbserial: USB Serial support registered for generic
[    1.492793] input: sa-ring-keys as /devices/platform/sa-ring-keys/input/input0
[    1.501121] jz-rtc jz-rtc.0: rtc core: registered jz-rtc as rtc0
[    1.508202] Bluetooth: HCI UART driver ver 2.2
[    1.512788] Bluetooth: HCI H4 protocol initialized
[    1.517763] Bluetooth: HCI BCSP protocol initialized
[    1.522880] Bluetooth: HCILL protocol initialized
[    1.527904] jzmmc_v1.2 jzmmc_v1.2.0: vmmc regulator missing
[    1.545848] jzmmc_v1.2 jzmmc_v1.2.0: card inserted, state=0
[    1.775862] jzmmc_v1.2 jzmmc_v1.2.0: register success!
[    1.781424] usbcore: registered new interface driver usbhid
[    1.787233] usbhid: USB HID core driver
[    1.791396] sa_information_init success
[    1.795684] usbcore: registered new interface driver snd-usb-audio
[    1.803290] jz-asoc-aic jz-asoc-aic: Aic core probe success
[    1.809378] jz-asoc-aic-i2s jz-asoc-aic-i2s: i2s platform probe success
[    1.816397] jz-asoc-pcm jz-asoc-pcm: pcm platform probe success
[    1.822657] hbc2500_driver_init
[    1.826026] hbc2500_probe.
[    1.828818] hbc2500_probe finish.
[    1.832832] HBC2500 power on.
[    1.888954] HBC2500 power off.
[    1.892104] hbc2500_init finish
[    1.896271] dma dma0chan4: Channel 4 have been requested.(phy id 3,type 0x06 desc a2192000)
[    1.909483] ingenic-m2s ingenic-m2s.0:  ak4490-hifi <-> jz-asoc-aic-i2s mapping ok
[    1.917754] dma dma0chan2: Channel 2 have been requested.(phy id 5,type 0x20 desc a2193000)
[    1.930878] ingenic-m2s ingenic-m2s.0:  ak4490-hifi <-> jz-asoc-pcm mapping ok
[    1.939802] SWITCH: init OK
[    1.942836] NET: Registered protocol family 17
[    1.947782] Bluetooth: RFCOMM TTY layer initialized
[    1.952860] Bluetooth: RFCOMM socket layer initialized
[    1.958288] Bluetooth: RFCOMM ver 1.11
[    1.962155] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[    1.967658] Bluetooth: BNEP filters: protocol multicast
[    1.973061] Bluetooth: BNEP socket layer initialized
[    1.978202] Bluetooth: HIDP (Human Interface Emulation) ver 1.2
[    1.984313] Bluetooth: HIDP socket layer initialized
[    1.992439] UBI: attaching mtd4 to ubi0
[    2.106110] UBI: scanning is finished
[    2.115783] UBI: attached mtd4 (name "rootfs", size 64 MiB) to ubi0
[    2.122337] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.129357] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.136332] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.143420] UBI: good PEBs: 512, bad PEBs: 0, corrupted PEBs: 0
[    2.149547] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    2.156925] UBI: max/mean erase counter: 60/31, WL threshold: 4096, image sequence number: 195063132
[    2.166364] UBI: available PEBs: 0, total reserved PEBs: 512, PEBs reserved for bad PEB handling: 20
[    2.175806] UBI: background thread "ubi_bgt0d" started, PID 40
[    2.181858] UBI: attaching mtd5 to ubi1
[    2.267837] UBI: scanning is finished
[    2.277262] UBI: attached mtd5 (name "data", size 48 MiB) to ubi1
[    2.283554] UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.290633] UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.297563] UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.304651] UBI: good PEBs: 384, bad PEBs: 0, corrupted PEBs: 0
[    2.310773] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[    2.318153] UBI: max/mean erase counter: 12/8, WL threshold: 4096, image sequence number: 4288452627
[    2.327593] UBI: available PEBs: 0, total reserved PEBs: 384, PEBs reserved for bad PEB handling: 20
[    2.337082] UBI: background thread "ubi_bgt1d" started, PID 41
[    2.343424] file system registered
[    2.348245] using random self ethernet address
[    2.352851] using random host ethernet address
[    2.357901] android_usb gadget: Mass Storage Function, version: 2009/09/11
[    2.364999] android_usb gadget: Number of LUNs=1
[    2.369829]  lun0: LUN: removable file: (no medium)
[    2.375245] android_usb gadget: android_usb ready
[    2.380765] input: gpio-keys as /devices/platform/gpio-keys/input/input1
[    2.388166] jz-rtc jz-rtc.0: setting system clock to 2014-09-03 06:26:29 UTC (1409725589)
[    2.396662] ALSA device list:
[    2.399720]   #0: m2s
[    2.411096] UBIFS: background thread "ubifs_bgt0_0" started, PID 44
[    2.466810] UBIFS: mounted UBI device 0, volume 0, name "rootfs"
[    2.473017] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    2.484703] UBIFS: FS size: 60567552 bytes (57 MiB, 477 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
[    2.495477] UBIFS: reserved for root: 0 bytes (0 KiB)
[    2.500775] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 98765432-1098-7654-3210-987654321098, small LPT model
[    2.512328] VFS: Mounted root (ubifs filesystem) on device 0:11.
[    2.526361] Freeing unused kernel memory: 1748K (804fb000 - 806b0000)
[    3.462129] mmc0: SD Status: Invalid Allocation Unit size.
[    3.596061] UBIFS: background thread "ubifs_bgt1_0" started, PID 70
[    3.630985] UBIFS: recovery needed
[    3.938776] UBIFS: recovery completed
[    3.942693] UBIFS: mounted UBI device 1, volume 0, name "data_vol"
[    3.965805] UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    3.975230] UBIFS: FS size: 44441600 bytes (42 MiB, 350 LEBs), journal size 2285568 bytes (2 MiB, 18 LEBs)
[    3.990918] mmc0: new high speed SDXC card at address 0001
[    3.996959] UBIFS: reserved for root: 2099086 bytes (2049 KiB)
[    4.002989] UBIFS: media format: w4/r0 (latest is w4/r0), UUID 01234567-8901-2345-6789-012345678901, small LPT model
[    4.025977] mmcblk0: mmc0:0001 EE8QT 238 GiB 
[    4.037613]  mmcblk0: p1
[    4.123162] FAT-fs (mmcblk0p1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[    4.136047] FAT-fs (mmcblk0p1): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
[    4.149542] [EXFAT] trying to mount...
[    4.247091] [EXFAT] mounted successfully
[    5.566903] android_usb: already disabled
[    5.571670] adb_bind_config
[    5.712406] adb_open
[    7.841286] graphics fb0: open count : 1
[    7.841355] jz-fb jz-fb: the slcd  slcd_cfg_new is 00000200
[    7.868545] adb_release
[    7.873002] adb_open
[    8.814305] clear SIGNATURE

Keys

Output of cat /proc/bus/input/devices:

I: Bus=0019 Vendor=0001 Product=0001 Version=0100
N: Name="sa-ring-keys"
P: Phys=ring-keys/input0
S: Sysfs=/devices/platform/sa-ring-keys/input/input0
U: Uniq=
H: Handlers=kbd event0 
B: PROP=0
B: EV=3
B: KEY=600 0 0 0

I: Bus=0019 Vendor=0001 Product=0001 Version=0100
N: Name="gpio-keys"
P: Phys=gpio-keys/input0
S: Sysfs=/devices/platform/gpio-keys/input/input1
U: Uniq=
H: Handlers=kbd event1 
B: PROP=0
B: EV=3
B: KEY=38 40000800 100000 0 0 0

Output of evtest for /dev/input/event0 (sa-ring-keys) - used for the scroll wheel:

Input driver version is 1.0.1
Input device ID: bus 0x19 vendor 0x1 product 0x1 version 0x100
Input device name: "sa-ring-keys"
Supported events:
  Event type 0 (EV_SYN)
  Event type 1 (EV_KEY)
    Event code 105 (KEY_LEFT)
    Event code 106 (KEY_RIGHT)
Properties:
Testing ... (interrupt to exit)
Event: time 1410670680.434824, type 1 (EV_KEY), code 106 (KEY_RIGHT), value 1
Event: time 1410670680.434824, -------------- SYN_REPORT ------------
Event: time 1410670680.434851, type 1 (EV_KEY), code 106 (KEY_RIGHT), value 0
Event: time 1410670680.434851, -------------- SYN_REPORT ------------
Event: time 1410670683.694707, type 1 (EV_KEY), code 105 (KEY_LEFT), value 1
Event: time 1410670683.694707, -------------- SYN_REPORT ------------
Event: time 1410670683.694732, type 1 (EV_KEY), code 105 (KEY_LEFT), value 0
Event: time 1410670683.694732, -------------- SYN_REPORT ------------

Output of evtest for /dev/input/event1 (gpio-keys) (used for all other buttons):

Input driver version is 1.0.1
Input device ID: bus 0x19 vendor 0x1 product 0x1 version 0x100
Input device name: "gpio-keys"
Supported events:
  Event type 0 (EV_SYN)
  Event type 1 (EV_KEY)
    Event code 116 (KEY_POWER)
    Event code 139 (KEY_MENU)
    Event code 158 (KEY_BACK)
    Event code 163 (KEY_NEXTSONG)
    Event code 164 (KEY_PLAYPAUSE)
    Event code 165 (KEY_PREVIOUSSONG)
Properties:
Testing ... (interrupt to exit)
Event: time 1410670603.065350, type 1 (EV_KEY), code 116 (KEY_POWER), value 1
Event: time 1410670603.065350, -------------- SYN_REPORT ------------
Event: time 1410670603.247802, type 1 (EV_KEY), code 116 (KEY_POWER), value 0
Event: time 1410670603.247802, -------------- SYN_REPORT ------------
Event: time 1410670606.034879, type 1 (EV_KEY), code 165 (KEY_PREVIOUSSONG), value 1
Event: time 1410670606.034879, -------------- SYN_REPORT ------------
Event: time 1410670606.248565, type 1 (EV_KEY), code 165 (KEY_PREVIOUSSONG), value 0
Event: time 1410670606.248565, -------------- SYN_REPORT ------------
Event: time 1410670607.813559, type 1 (EV_KEY), code 139 (KEY_MENU), value 1
Event: time 1410670607.813559, -------------- SYN_REPORT ------------
Event: time 1410670608.023915, type 1 (EV_KEY), code 139 (KEY_MENU), value 0
Event: time 1410670608.023915, -------------- SYN_REPORT ------------
Event: time 1410670609.329085, type 1 (EV_KEY), code 163 (KEY_NEXTSONG), value 1
Event: time 1410670609.329085, -------------- SYN_REPORT ------------
Event: time 1410670609.551015, type 1 (EV_KEY), code 163 (KEY_NEXTSONG), value 0
Event: time 1410670609.551015, -------------- SYN_REPORT ------------
Event: time 1410670610.623797, type 1 (EV_KEY), code 158 (KEY_BACK), value 1
Event: time 1410670610.623797, -------------- SYN_REPORT ------------
Event: time 1410670610.852883, type 1 (EV_KEY), code 158 (KEY_BACK), value 0
Event: time 1410670610.852883, -------------- SYN_REPORT ------------
Event: time 1410670612.105535, type 1 (EV_KEY), code 164 (KEY_PLAYPAUSE), value 1
Event: time 1410670612.105535, -------------- SYN_REPORT ------------
Event: time 1410670612.297579, type 1 (EV_KEY), code 164 (KEY_PLAYPAUSE), value 0
Event: time 1410670612.297579, -------------- SYN_REPORT ------------

Name	Button position	Device type	Code	Action normal	Action longpress
KEY_POWER	Upper side	gpio-keys	116	Switch backlight on or off (wake up)	Switch on/off device
KEY_PREVIOUSSONG	Left side, top	gpio-keys	165	switch to previous song	-
KEY_MENU	Left side, middle	gpio-keys	139	Play / Pause	-
KEY_NEXTSONG	Left side, bottom	gpio-keys	163	switch to next song	-
KEY_BACK	Right side, bottom	gpio-keys	158	Go back in menus / cancel	-
KEY_PLAYPAUSE	Right side, scroll wheel button	gpio-keys	164	Select / Enter	-
KEY_LEFT	Right side, scroll wheel up	sa-ring-keys	105	Volume up / go up in menu	-
KEY_RIGHT	Right side, scroll wheel down	sa-ring-keys	106	Volume down / go down in menu	-

Battery

Backlight

RTC

Standard linux 'new' rtc interface with read only access in /sys/class/rtc/rtc0, device in /dev/rtc0 and proc interface in /proc/driver/rtc

Screen

Displaying content on lcd is done through more or less standard Framebuffer interface. The device is /dev/fb0.

System server

There is a system daemon /usr/bin/sys_server that receives messages over the unix socket /var/run/sys_server and processes them. The answer is returned over another unix socket /var/run/sys_client on which client (hiby_player) listens.

The messages are always zero-terminated strings that are parsed by the daemon.

The daemon answers with one (or more ?) message strings.

Command Format	Return Format	Action
Mount Service
MOUNT:MOUNT:%s %s		mount %1 at %2
MOUNT:UMOUNT:%s		umount %1
MOUNT:SETLUN:%s %s		if %2 = "empty" then write %2 to file %1, otherwise write "" to file %1

| MOUNT:FORMAT:%s %s %[^ ] | | umounts and format |

Log Service
LOG:%s		set log level to %1 (only recognized level is "debug")
Bluetooth Service
BT:ON	BT:ON:WAITINIT or BT:ON:FAIL	turn bluetooth services on (does a lot of stuff)
BT:OFF	BT:OFF:OK or BT:OFF:FAIL	turn bluetooth services off
BT:DISCOVER	BT:DISCOVER:OK or BT:DISCOVER:FAIL	set addapter as discoverable (bt-adapter --set "Discoverable" "On")
BT:NONDISCOVER	BT:NONDISCOVER:OK or BT:NONDISCOVER:FAIL	set adapter as non discoverable (bt-adapter --set "Discoverable" "Off")
BT:LIST	BT:LIST:OK or BT:LIST:FAIL	bt-device -l -p /data/bt_list.txt
BT:PAIR:%s	BT:PAIR:OK or BT:PAIR:FAIL	bt-device -c %s
BT:UNPAIR:%s	BT:UNPAIR:OK or BT:UNPAIR:FAIL	bt-device -d %s; bt-device -r %s
BT:CONNECT:%s	BT:CONNECT:OK or BT:CONNECT:FAIL	bt-connect -c %s
BT:DISCONNECT:%s	BT:DISCONNECT:OK or BT:DISCONNECT:FAIL	bt-connect -d %s
BT:SCAN	BT:SCAN:OK or BT:SCAN:FAIL	bt-adapter -d -p /data/bt_scan.txt
BT:CANCEL_SCAN	?
BT:STATUS:%s	BT:STATUS:OK or BT:STATUS:FAIL	bt-device -i %s > /data/bt_status.txt
BT:CONTROL:%s %s	BT:CONTROL:OK or BT:CONTROL:FAIL	bt-control -d %s -o %s
BT:SETNAME:%s	BT:SETNAME:OK or BT:SETNAME:FAIL	set player name (bt-adapter --set "Name" "%s"
Findable Service
FINDABLE:START:BC:%s %s
FINDABLE:START:CS:%s %s
FINDABLE:STOP
Shairport Service
SHAIRPORT:TURN_ON
SHAIRPORT:TURN_OFF
DLNA Service
DLNA:TURN_ON
DLNA:TURN_OFF
Wifi Service
WIFI:LIST_NETWORK:%s	WIFI:LIST_NETWORK:OK or BT:ON:WAITINIT or WIFI:LIST_NETWORK:FAIL and result in /data/wifi_network.txt	get list of available WiFi network for the given interface
WIFI:STATUS:%s
WIFI:REMOVE:%s %s
WIFI:CONNECT:%s %s
WIFI:DISCONNECT:%s %s
WIFI:SSID_CONNECT:%[^:]:%[^:]:%[^:]
WIFI:GETMACADDR:%s
WIFI:OFF:%s
WIFI:ON:%s
WIFI:AIRKISS:%s
WIFI:SCAN:%s

adb daemon

The original firmware is able to start an Android adbd - if that is started and enabled, you're able to connect to the device and get shell access with "adb shell". After the init script has been activated by renaming from K90adb to S90adb, the adbd will be started at startup and sets the following values in /sys:

/sys/class/android_usb/android0/idVendor 18d1
/sys/class/android_usb/android0/idProduct d002
/sys/class/android_usb/android0/functions adb,mass_storage
/sys/class/android_usb/android0/enable 1

BUT: after the player GUI has been started (hiby_player), the above values gets cyclic be overwritten by hiby_player and therefore the adbd does not work anymore...

Note: when connecting is possible, you need an adb 1.0.36 or older - 1.0.37 does not work!

Codec

Scratchpad

Mounts (including SD card):

rootfs / rootfs rw 0 0
ubi0:rootfs / ubifs rw,relatime 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /dev tmpfs rw,relatime 0 0
tmpfs /tmp tmpfs rw,relatime 0 0
devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=000 0 0
tmpfs /dev/shm tmpfs rw,relatime 0 0
ubi1_0 /data ubifs rw,relatime 0 0
/dev/mmcblk0p1 /mnt/sd_0 exfat rw,relatime,fmask=0022,dmask=0022,iocharset=utf8,namecase=1,errors=remount-ro 0 0

Output of /bin/ps (including some self writtten scripts and a started adbd, which normally will not be started):

PID   USER     TIME   COMMAND
    1 root       0:02 {linuxrc} init
    2 root       0:00 [kthreadd]
    3 root       0:00 [ksoftirqd/0]
    4 root       0:00 [kworker/0:0]
    5 root       0:00 [kworker/0:0H]
    6 root       0:00 [kworker/u2:0]
    7 root       0:00 [rcu_preempt]
    8 root       0:00 [rcu_bh]
    9 root       0:00 [rcu_sched]
   10 root       0:00 [khelper]
   11 root       0:00 [writeback]
   12 root       0:00 [bioset]
   13 root       0:00 [kblockd]
   14 root       0:00 [khubd]
   15 root       0:00 [irq/89-usb-dete]
   16 root       0:00 [irq/170-usb-hos]
   17 root       0:00 [kworker/0:1]
   18 root       0:00 [kswapd0]
   19 root       0:00 [crypto]
   35 root       0:00 [ring keys]
   36 root       0:00 [irq/9-jz-asoc-a]
   37 root       0:00 [kworker/u2:1]
   38 root       0:00 [krfcommd]
   39 root       0:00 [deferwq]
   40 root       0:00 [ubi_bgt0d]
   41 root       0:00 [ubi_bgt1d]
   42 root       0:00 [f_mtp]
   43 root       0:00 [file-storage]
   44 root       0:00 [ubifs_bgt0_0]
   45 root       0:00 {rcS} /bin/sh /etc/init.d/rcS
   68 root       0:00 [kworker/u2:2]
   70 root       0:00 [ubifs_bgt1_0]
   72 root       0:00 [mmcqd/0]
   81 root       0:00 [kworker/0:1H]
   91 root       0:00 /usr/bin/sys_server
  112 dbus       0:00 dbus-daemon --config-file=/etc/dbus-1/system.conf
  126 root       0:00 [kworker/0:2]
  127 root       0:00 [kworker/u3:0]
  128 root       0:00 [hci0]
  129 root       0:00 [hci0]
  132 root       0:00 [kworker/u3:1]
  133 root       0:00 hciattach -s 115200 ttyS0 any 3000000
  135 root       0:00 [kworker/u3:2]
  142 root       0:00 {adbserver.sh} /bin/sh /sbin/adbserver.sh
  144 root       0:00 bluetoothd
  149 root       0:00 /sbin/adbd
  154 root       0:00 bt-agent
  155 root       0:00 bt-monitor
  156 root       0:00 bt-media
  164 root       0:00 {S93_03_start_mu} /bin/sh /etc/init.d/S93_03_start_music_player start
  174 root       0:00 /bin/ps

Here are my random notes what to check on device:

TODOs in random order

* find a way to keep the adb daemon running even when hiby_player runs * find out hardware buttons and their codes

A lot more

-- MatthiasM - 30 May 2018