So I got myself a new little toy in the mail today, a shiny new Western Digital WDTV Live.
In the following writeup I’ll analyze the internals a bit and dig a little into things for everyones amusement…for the record it took me 2:43 from unbox to broken warranty–aka–Open device.
Ok, so first there was a box.

Then there was an open box.

Then there was an open WDTV Live box. As you can see it contains pretty much identical contents to the original WDTV, except for the inclusion of the component cable.

Then I applied some gentle pressure to seperate the outer shell from the innards and undid four screws…to give me the good stuff ![]()

It made me very happy to see the CN4 socket was left on, which means my investigation can get somewhere almost immediately. So here we go, I’ve unplugged one of my wdtv’s and connected the WDTV Live right in. I’ve just swapped all the cables I had plugged into the original to the Live.
OMG…nows the time…Lets turn it on and excitedly watch the boot process
So theres some interesting information in there, I’ll c&p the interesting bits and explain them.
Configured for SMP865x, detected SMP8655 (revision unknown).
Detected CPU/System/DSP Frequencies: 499.50/333.00/333.00MHz
For those unaware the 8655 chipset has a 500MHz cpu, a 333MHz coprocessor, AND a 333MHz DSP…that all combines to make the WDTV Live aka Villa (Codename written inside) incredibly more snappy and responsive than the original.
k_name=Tangox SATA 0 driver=Tangox SATA 0
SATA version 0x3139302a ID 0x0 is detected
scsi0 : Tangox SATA 0
ata1: SATA max UDMA/133 cmd 0xa0023000 ctl 0xa0023020 bmdma 0xcdcdcdcd irq 49
ata1: SATA link down (SStatus 0 SControl 300)
k_name=Tangox SATA 1 driver=Tangox SATA 1
SATA version 0x3139302a ID 0x0 is detected
scsi1 : Tangox SATA 0
ata2: SATA max UDMA/133 cmd 0xa0023800 ctl 0xa0023820 bmdma 0xcdcdcdcd irq 62
ata2: SATA link down (SStatus 0 SControl 300)
…Strange??? Could there be two hidden SATA connections?
ieee80211: 802.11 data/management/control stack, git-1.1.13
ieee80211: Copyright (C) 2004-2005 Intel Corporation
ieee80211_crypt: registered algorithm 'NULL'
In case you missed it from the specs, the WDTV Live has some wireless capabilities. I’ll get back to that in a bit.
Checking md5sum for all files in application firmware..
scsi 4:0:0:0: Direct-Access Single Flash Reader 1.00 PQ: 0 ANSI: 0
scsi 2:0:0:0: CD-ROM PLEXTOR DVDR PX-716A 1.09 PQ: 0 ANSI: 0 CCS
scsi 3:0:0:0: Direct-Access Patriot Memory PMAP PQ: 0 ANSI: 0 CCS
sr0: scsi3-mmc drive: 125x/94x writer cd/rw xa/form2 cdda tray
Uniform CD-ROM driver Revision: 3.20
:-O They’ve compiled in optical drive functionality!!! Nice. It is non-functional, but give me a short bit and I’ll fix that nonsense.
**************************************************************
* *
* *
* Current Version: *
* *
* *
* 1.01.00 *
* *
* *
* *
* *
* *
**************************************************************
In case you’re wondering what firmware revision we’re starting with
fwup_load_okok_partition, 132, Partition status not in okok, status=����
fwup_dual_romfs_1st_active, 171, Only /dev/sigmblocki is okok
fwup_dual_romfs_1st_active, 194, Result announce: active=/dev/sigmblockh, inactive=/dev/sigmblocki
Heres an odd one, looks like theres a ‘backup’ firmware partition in case something hoses the first one…decent idea.
This usb port 1 has been taken. We don't mount this device
User decided not to mount this partition
Awww, lame. I guess WD doesn’t want us having more than one device per slot again…I’ll put a fix to that as well
NETSERVICE_save_dhcp_config[1265]:Get ip from DHCP server ok!
============= DHCP ===============
IP = 192.168.0.103
NETMASK = 255.255.255.0
GATEWAY = 192.168.0.1
DNS = x.x.x.x,y.y.y.y
nameserver = x.x.x.x
nameserver = y.y.y.y
===================================
It received an IP from my router without a hitch.
ftp_download_data, 433, MAX_RETRY_NUM = 3
ftp_download_data, 434, MAX_CONNECT_TIMEOUT = 30
pathname = http://support.wdc.com/download/wdtvlive.asp?id=wdfwdtv_live&type=autoupdate&ptype=villa&fw=1.01.00
userpwd =
mode = 0
* About to connect() to support.wdc.com port 80 (#0)
* Trying 129.253.170.35... * connected
* Connected to support.wdc.com (129.253.170.35) port 80 (#0)
* Server auth using Basic with user ''
* Connection #0 to host support.wdc.com left intact
* Closing connection #0
ftp_download_data, 451, download file from server successfully.
fwupwd_check_update, 863, pkg_url=currentversion
OK, now this one disturbs me a bit. Auto-update functionality is all well&good, but it best be a bit secure. I’ll have to sniff out the communications and see exactly whats going on in the transaction. One things for sure, quick change to /etc/hosts and something bad could happen if theres no security. Interesting that I might be able to hyjaack the functionality and have WDLiveXTV auto-udate itself
So thats most of the interesting parts of the boot cycle, now for a bit of system analysis.
/ # uname -r
2.6.22.19-19-4
/ # cat /proc/version
Linux version 2.6.22.19-19-4 (andy@SVN-server) (gcc version 4.3.2 (Sourcery G++ Lite 4.3-51) ) #4 PREEMPT Fri Sep 11 17:14:24 CST 2009
This is nice, much more modern a kernel this time around.
/ # ls /lib/modules/
em8xxx.ko llad.ko rt3070sta.ko sigmablock.ko
fctrl.ko proc_pipe.ko rt3572sta.ko ufsd.ko
irkernel.ko rt2870sta.ko scsi_wait_scan.ko wd_led_rst.ko
So heres the kernel modules that come stock. rt2870sta, rt3070sta, and rt3572sta are the wireless modules. This means you find a wireless dongle with one of those chipsets and it *should* work. Pretty nice option for those without wired houses.
/ # ls -la /dev/mtd*
brw-r--r-- 1 root root 254, 0 Jan 1 00:00 /dev/mtdblock0
brw-r--r-- 1 root root 254, 3 Jan 1 00:00 /dev/mtdblock2
brw-r--r-- 1 root root 254, 6 Jan 1 00:00 /dev/mtdblock3
lrwxrwxrwx 1 root root 15 Jan 1 00:00 /dev/mtdblock_bootloader -> /dev/sigmblocka
lrwxrwxrwx 1 root root 15 Jan 1 00:00 /dev/mtdblock_kernel -> /dev/sigmblockd
lrwxrwxrwx 1 root root 15 Jan 1 00:00 /dev/mtdblock_romfs -> /dev/sigmblockh
Different firmware layout than the original WDTV, with the addition of the sigmblocks where the goods are really located.
/ # ls /dev/sigmblock* -la
brw-rw---- 1 root root 254, 0 Jan 1 00:00 /dev/sigmblocka
brw-rw---- 1 root root 254, 1 Jan 1 00:00 /dev/sigmblockb
brw-rw---- 1 root root 254, 2 Jan 1 00:00 /dev/sigmblockc
brw-rw---- 1 root root 254, 3 Jan 1 00:00 /dev/sigmblockd
brw-rw---- 1 root root 254, 4 Jan 1 00:00 /dev/sigmblocke
brw-rw---- 1 root root 254, 5 Jan 1 00:00 /dev/sigmblockf
brw-rw---- 1 root root 254, 6 Jan 1 00:00 /dev/sigmblockg
brw-rw---- 1 root root 254, 7 Jan 1 00:00 /dev/sigmblockh
brw-rw---- 1 root root 254, 8 Jan 1 00:00 /dev/sigmblocki
brw-rw---- 1 root root 254, 9 Jan 1 00:00 /dev/sigmblockj
brw-rw---- 1 root root 254, 10 Jan 1 00:00 /dev/sigmblockk
brw-rw---- 1 root root 254, 11 Jan 1 00:00 /dev/sigmblockl
Woah, lots of internal NANDy goodness goin on here. I’m not too sure what all sigmblocka contains as its 256MB, but I theorize below. At the minimum sigmblocka contains bootloader code and various flashing instructions. sigmblockb is nothing really, just 512KB of FF’s & 00′s. sigmblockc is YAMON. The kernel is located/mirrored in sigmblockd and sigmblocke. The loading, splash screen, and splash pic are in sigmablockf, which is a bit strange since that block appears to be 16MiB. The ROMFS firmware image is located in sigmblockh and sigmblocki. It would seem that sigmblockj, sigmblockk, and sigmblockl are the persistent /conf data settings area, tripled this time instead of doubled. The inaccessible lower half of memory is (maybe–i theorize here) sigmblocka, coming in at a cool 267,911,168 bytes (256MB), with an additional ~56MB of main memory reserved by the kernel and some other stuff. The linux kernel only sees 200MB as instructed by the bootloader. The firmware able to consume 94,371,840 bytes. In case you’re unaware the original WDTV’s complete NAND size was 24MiB and the firmware itself was limited to 14MiB, this makes the WDTV Live a whole new class. The firmwares current size is a measly 26MiB (as cramfs) so there is PLENTY of room to play.
/ # cat /proc/cpuinfo
system type : Sigma Designs TangoX
processor : 0
cpu model : MIPS 24K V7.12 FPU V0.0
Initial BogoMIPS : 332.59
wait instruction : yes
microsecond timers : yes
tlb_entries : 32
extra interrupt vector : yes
hardware watchpoint : yes
ASEs implemented : mips16
shadow register sets : 1
VCED exceptions : not available
VCEI exceptions : not availableSystem bus frequency : 333000000 Hz
CPU frequency : 499500000 Hz
DSP frequency : 333000000 Hz
rundown of the CPU.
/ # cat /proc/meminfo
MemTotal: 198864 kB
MemFree: 61184 kB
Buffers: 26352 kB
Cached: 71824 kB
SwapCached: 0 kB
Active: 54384 kB
Inactive: 59856 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 16112 kB
Mapped: 13584 kB
Slab: 13456 kB
SReclaimable: 3216 kB
SUnreclaim: 10240 kB
PageTables: 1952 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
CommitLimit: 99424 kB
Committed_AS: 191008 kB
VmallocTotal: 1048272 kB
VmallocUsed: 3424 kB
VmallocChunk: 1043840 kB
200MB RAM!!!! 61MB free currently too, this will make complex homebrewage a more definite possibility. More memory will be able to be claimed as well if you disable the SAMBA stuff that comes pre-enabled. I’ve been streaming 1080p content off my NFS the last bit and noticed most of the free memory is consumed by cache.
So…now how about I try and mount a DVD from my trusty Plextor A816.
/ # mkdir /tmp/media/usb/Sphere
/ # mount /dev/sr0 /tmp/media/usb/Sphere/
/ # ls /tmp/media/usb/Sphere -la
dr-xr-xr-x 2 root root 2048 Aug 27 2009 .
drwxr-xr-x 4 root root 80 Jan 1 00:04 ..
-r--r--r-- 1 root root 61869 Aug 27 2009 Sphere.1998.720p.BluRay...jpg
-r--r--r-- 1 root root 399652678 Aug 23 2009 Sphere.1998.720p.BluRay...mkv
-r--r--r-- 1 root root 144 Aug 24 2009 Sphere.1998.720p.BluRay...nfo
-r--r--r-- 1 root root 78 Aug 27 2009 Sphere.1998.720p.BluRay...sfv
Hmmm, no bueno the mkv is most definitely NOT 400MB. A quick check out /etc/filesystems indicates they left out automagic UDF filesystem support, so theres another thing I’ll have to add in. No problems though, I’ll just be descript.
/ # umount /tmp/media/usb/Sphere/
/ # mount -t udf /dev/sr0 /tmp/media/usb/Sphere/
UDF-fs: Partition marked readonly; forcing readonly mount
/ # ls -la /tmp/media/usb/Sphere/
dr-xr-xr-x 2 root root 376 Aug 27 2009 .
drwxr-xr-x 4 root root 80 Jan 1 00:04 ..
-r--r--r-- 1 root root 61869 Aug 27 2009 Sphere.1998.720p.BluRay...jpg
-r--r--r-- 1 root root 4694619974 Aug 23 2009 Sphere.1998.720p.BluRay...mkv
-r--r--r-- 1 root root 144 Aug 24 2009 Sphere.1998.720p.BluRay...nfo
-r--r--r-- 1 root root 78 Aug 27 2009 Sphere.1998.720p.BluRay...sfv
There we go, full size mkv. I just watched a bit and it plays just fine.
/tmp/media/usb/USB1/5fa9bced-4efe-4bb1-bf3e-4c1f91c0f46b # mkdir villavf_monitor_parse_event, 986, event=MKDIR, name=villa
vf_monitor_add_changed_path, 916, changed path=/tmp/media/usb/USB1/5fa9bced-4efe-4bb1-bf3e-4c1f91c0f46b/villacas_timer_func, 90, need to rescan = 1
/tmp/media/usb/USB1/5fa9bced-4efe-4bb1-bf3e-4c1f91c0f46b # cd villa/
vf_rebuild_root, 555, /tmp/media/usb/USB1 rebuild done, it takes 0 seconds
Heres something quite interesting. It would appear as if they’ve compiled inotify support into the kernel and now monitor attached shares for rescanning on any change. I’ve dreamt of having inotify support compiled in, so this is most welcome to my homebrew adventures.
This pretty much concludes my initial analysis of the WDTV Live, now its time to settle in and actually use the little guy and see how it feels.
I would include some firmware dumps, but its not going as smooth as I’d hope…seems theres a bit of internal something or another that I’m missing. I have a feeling the mystery partitions have something to do with things. Give me a couple days and I’ll update this post.
I was pointed to a mystery package on WD’s servers by asgard on wdtvforum. After unwrapping it, I found the firmware files for an original update. So I present:
WDTVLIVE_FW_1.01.00 For informational purposes only!!!
I hope you enjoyed this writeup. Look forward to unofficial homebrew firmware for the WDTV Live very soon.
For full support visit forum.wdlxtv.com
*** edit ***
So although the WDTV Live claims only SAMBA network sharing capabilities I have managed to mount my NFS and have watched various 1080p material stutter free
*** edit 2 ***
Finally figured things out and have a preliminary beta-alpha-pre-release homebrew firmware. It is pretty stabled and enables a whole slew of things. This really unleashes a whole new ballgame for the WDTV Live, and its only been out a week
You can read about & find it in this thread. It is a test release only, but fully usable.