Getting some Console on APC

If you’ve been following our First and Second Articles on the VIA APC, you’ll know that the bootloader EEPROM contained some interesting strings that sure look like there’s a fully functioning console down in there somewhere.  Getting console access will be an important step, for both debugging, as well as UNBRICKING units that suffer a bad flash.  As long as the device still has a functioning boot EEPROM, it will be possible to resurrect from a corrupted NAND.

A Little Port Digging

The first step towards getting access is probing out the 6-pin UART_PH port that is located at the front right side of the board.  By using a multimeter in connectivity (beep) mode, you can find that pin 1 (Left-most) is GND, and pin 6 is +3.3V.  When the board is first powered up, you can also see that pin 5 has some wiggling.  Using a scope, we can see the nice 3.3V square waves of a UART.  Time to grab your Sparkfun FT232 or hacked USB-RS232 converter and get to pluggin.   Remember, this is a 3.3V port!  Only use a 3.3v converter or you will probably kill the port on your WM8750 forever.  From the scope shot and debug strings in the boot ROM, we estimate that the baud rate is 115,200 and it sure is!  Plugging the FT232′s RxD line into pin 5 of the APC’s UART_PH port gives us a tremendous wealth of churning serial data.  Once you get the PC to receive data, a little trial and error plugging of the other wire tells us that pin 4 is the WM8750′s receive port (PC’s TxD).  Here’s the final answer for those who don’t want to dig it out themselves..

Fig 1 – APC’s RS232 Port

VIA APC UART Connection

For those who like to see things in completion, here’s a pic of our simple setup showing the 3 minimum connections needed for console access.  Brown (pin 1) is GND and must be connected, lest you get unreliable comms at best, and a complete fail at worst.  Then Yellow (pin 4) to transmit data from the PC to the APC, and Green (pin 5) to transmit data from the APC to the PC.  Open your favorite terminal emulator program at 115,200 8N1 and power up the APC.

Fig 2 – Example RS232 Connection to VIA APC

It Speaks!

Since the text moves quickly and will scroll off your screen before you really get to digest anything, it’s useful to take a text capture of the boot sequence.  Here, we’ve captured up to the point where we’re allowed to hit a key to drop into the U-Boot console.  You may also let the timeout expire and watch the entire boot sequence into Android.

---------------------------------------------------
WonderMedia Technologies, Inc.

W-Load Version : 0.20.00.00

uboot set plla cmd ..found
wmt.plla.param=1:800:1,2:5,2:3
device clock is disabledethaddr............found
wloader finish

U-Boot 1.1.4 (Feb  3 2012 - 17:41:10)
WonderMedia Technologies, Inc.
U-Boot Version : 0.24.00.00
U-Boot code: 03F80000 -> 03FC9FF8  BSS: -> 03FEDA88
boot from spi flash.
SF0: ManufID = C2, DeviceID = 2013 (Missing or Unknown FLASH)
     Use Default - Total size = 8MB, Sector size = 64KB
SF1: ManufID = FF, DeviceID = FFFF (Missing or Unknown FLASH)
     Use Default - Total size = 8MB, Sector size = 64KB
flash:
     Bank1: FF800000 -- FFFFFFFF
     Bank2: FF000000 -- FF7FFFFF
Flash: 16 MB
sfboot: NAND init:env nand config fail, use default flash id list info
pllb=0x2270001, spec_clk=0x140a0cff
T1=2, clk1=18, div1=9, Thold=1, tREA=20+delay(9)
T2=1, clk2=36, div2=18, Thold2=1, comp=1
Tim1=442368 , Tim2=589824
T2 is greater and not use
T=2, clk=18, divisor=9, Thold=0x601
divisor is set 0x9, NFC_timing=0x2424
USE_HW_ECC ECC12bit
2048 MB
In:    serial
Out:   serial
Err:   serial
Load Image Form NAND Flash
col=0x217a, row = 0x3ff80
block2047 tag=42627430  version =1
col=0x217a, row = 0x3ff00
block2046 tag=31746242  version =1
bbt table is found
USE_HW_ECC ECC12bit

Read NAND Flash OK
Usage:
nandrw  - NAND sub-system

[VPP] vpp path ori fb vpp_init,Y 0x1cc00000,C 0x1ce32800
[VT1632] DVI ext device (hw mode)
## Warning: wmt.display.regop not defined
## Warning: wmt.display.param not defined
## Warning: wmt.display.param2 not defined
[VOUT] vo_init_wmt 1024x768@60
vpp_config(1024x768@60)
find the equal valuewmt_graphic_init ok
Loading BMP ..... ok
Hit any key to stop autoboot:  3  2  0
WMT #
---------------------------------------------------

Bingo!   The WMT # is the console’s command prompt, so the device is just sitting there, waiting for our input.  Typically, the “help” command will list everything that a particular UBOOT implementation has to offer, so we naturally try that next.

---------------------------------------------------
WMT # help
?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp    - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
show    -
dmacp     - dma memory copy
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatstore - store binary file to a dos filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imls    - list all images found in flash
imm     - i2c memory modify (auto-incrementing)
ims  - set i2c device context from memory
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest    - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
memory bit operation :
Format : mbit <parameter>
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
  mmcinit 0 -- init mmc device 0
  mmcinit 1 -- init mmc device 1
  mmcinit 2 -- init mmc device 2
mmcread - read data from SD/MMC card
  <dev_id> <addr> <block_num> <bytes>
   -read data from SD/MMC card block address 'block_num' on 'dev_id'
    to memory address 'addr' size is 'bytes'
mmcwrite - write data to SD/MMC card
  <dev_id> <addr> <block_num> <bytes>
   -write data to SD/MMC card block address 'block_num' on 'dev_id'
    from memory address 'addr' size is 'bytes'
mtest   - simple RAM test
mw      - memory write (fill)
nandrw  - NAND sub-system
nboot   - boot from NAND device
nfs    - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdwaitins - wait sd card inserted or removed
sdwaitins 0 -- waiting removed
sdwaitins 1 -- waiting inserted
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
textout - show text to the screen
textout x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout 0 0 "hello world" FFFFFF
tftpboot- boot image via network using TFTP protocol
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor version
WMT #

---------------------------------------------------

Wow, great stuff!  This console is much more capable than the little junkers we’re used to working with.  In addition to the USB, MMC, SPI, and Flash commands, we have the all important binary load and “go”.  That means we can immediately begin compiling and executing our own software (Think “Hello World” for now) on the platform using only this console and gcc for ARM.  If you’ve ever wanted to learn to code low-level ARM, you’re ready to go.