If you’ve been following our First and Second Articles on the VIA APC, you’ll know that the bootloader EEPROM contained some interesting strings that sure look like there’s a fully functioning console down in there somewhere. Getting console access will be an important step, for both debugging, as well as UNBRICKING units that suffer a bad flash. As long as the device still has a functioning boot EEPROM, it will be possible to resurrect from a corrupted NAND.
A Little Port Digging
The first step towards getting access is probing out the 6-pin UART_PH port that is located at the front right side of the board. By using a multimeter in connectivity (beep) mode, you can find that pin 1 (Left-most) is GND, and pin 6 is +3.3V. When the board is first powered up, you can also see that pin 5 has some wiggling. Using a scope, we can see the nice 3.3V square waves of a UART. Time to grab your Sparkfun FT232 or hacked USB-RS232 converter and get to pluggin. Remember, this is a 3.3V port! Only use a 3.3v converter or you will probably kill the port on your WM8750 forever. From the scope shot and debug strings in the boot ROM, we estimate that the baud rate is 115,200 and it sure is! Plugging the FT232′s RxD line into pin 5 of the APC’s UART_PH port gives us a tremendous wealth of churning serial data. Once you get the PC to receive data, a little trial and error plugging of the other wire tells us that pin 4 is the WM8750′s receive port (PC’s TxD). Here’s the final answer for those who don’t want to dig it out themselves..
Fig 1 – APC’s RS232 Port
VIA APC UART Connection
For those who like to see things in completion, here’s a pic of our simple setup showing the 3 minimum connections needed for console access. Brown (pin 1) is GND and must be connected, lest you get unreliable comms at best, and a complete fail at worst. Then Yellow (pin 4) to transmit data from the PC to the APC, and Green (pin 5) to transmit data from the APC to the PC. Open your favorite terminal emulator program at 115,200 8N1 and power up the APC.
Fig 2 – Example RS232 Connection to VIA APC
Since the text moves quickly and will scroll off your screen before you really get to digest anything, it’s useful to take a text capture of the boot sequence. Here, we’ve captured up to the point where we’re allowed to hit a key to drop into the U-Boot console. You may also let the timeout expire and watch the entire boot sequence into Android.
--------------------------------------------------- WonderMedia Technologies, Inc. W-Load Version : 0.20.00.00 uboot set plla cmd ..found wmt.plla.param=1:800:1,2:5,2:3 device clock is disabledethaddr............found wloader finish U-Boot 1.1.4 (Feb 3 2012 - 17:41:10) WonderMedia Technologies, Inc. U-Boot Version : 0.24.00.00 U-Boot code: 03F80000 -> 03FC9FF8 BSS: -> 03FEDA88 boot from spi flash. SF0: ManufID = C2, DeviceID = 2013 (Missing or Unknown FLASH) Use Default - Total size = 8MB, Sector size = 64KB SF1: ManufID = FF, DeviceID = FFFF (Missing or Unknown FLASH) Use Default - Total size = 8MB, Sector size = 64KB flash: Bank1: FF800000 -- FFFFFFFF Bank2: FF000000 -- FF7FFFFF Flash: 16 MB sfboot: NAND init:env nand config fail, use default flash id list info pllb=0x2270001, spec_clk=0x140a0cff T1=2, clk1=18, div1=9, Thold=1, tREA=20+delay(9) T2=1, clk2=36, div2=18, Thold2=1, comp=1 Tim1=442368 , Tim2=589824 T2 is greater and not use T=2, clk=18, divisor=9, Thold=0x601 divisor is set 0x9, NFC_timing=0x2424 USE_HW_ECC ECC12bit 2048 MB In: serial Out: serial Err: serial Load Image Form NAND Flash col=0x217a, row = 0x3ff80 block2047 tag=42627430 version =1 col=0x217a, row = 0x3ff00 block2046 tag=31746242 version =1 bbt table is found USE_HW_ECC ECC12bit Read NAND Flash OK Usage: nandrw - NAND sub-system [VPP] vpp path ori fb vpp_init,Y 0x1cc00000,C 0x1ce32800 [VT1632] DVI ext device (hw mode) ## Warning: wmt.display.regop not defined ## Warning: wmt.display.param not defined ## Warning: wmt.display.param2 not defined [VOUT] vo_init_wmt 1024x768@60 vpp_config(1024x768@60) find the equal valuewmt_graphic_init ok Loading BMP ..... ok Hit any key to stop autoboot: 3 2 0 WMT # ---------------------------------------------------
Bingo! The WMT # is the console’s command prompt, so the device is just sitting there, waiting for our input. Typically, the “help” command will list everything that a particular UBOOT implementation has to offer, so we naturally try that next.
--------------------------------------------------- WMT # help ? - alias for 'help' autoscr - run script from memory base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation dhcp - invoke DHCP client to obtain IP/boot params diskboot- boot from IDE device show - dmacp - dma memory copy echo - echo args to console erase - erase FLASH memory exit - exit script fatinfo - print information about filesystem fatload - load binary file from a dos filesystem fatls - list files in a directory (default /) fatstore - store binary file to a dos filesystem flinfo - print FLASH memory information go - start application at address 'addr' help - print online help icrc32 - checksum calculation ide - IDE sub-system iloop - infinite loop on address range imd - i2c memory display iminfo - print header information for application image imls - list all images found in flash imm - i2c memory modify (auto-incrementing) ims - set i2c device context from memory imw - memory write (fill) inm - memory modify (constant address) iprobe - probe to discover valid I2C chip addresses itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loop - infinite loop on address range memory bit operation : Format : mbit <parameter> md - memory display mii - MII utility commands mm - memory modify (auto-incrementing) mmcinit - init mmc card mmcinit 0 -- init mmc device 0 mmcinit 1 -- init mmc device 1 mmcinit 2 -- init mmc device 2 mmcread - read data from SD/MMC card <dev_id> <addr> <block_num> <bytes> -read data from SD/MMC card block address 'block_num' on 'dev_id' to memory address 'addr' size is 'bytes' mmcwrite - write data to SD/MMC card <dev_id> <addr> <block_num> <bytes> -write data to SD/MMC card block address 'block_num' on 'dev_id' from memory address 'addr' size is 'bytes' mtest - simple RAM test mw - memory write (fill) nandrw - NAND sub-system nboot - boot from NAND device nfs - boot image via network using NFS protocol nm - memory modify (constant address) ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage sdwaitins - wait sd card inserted or removed sdwaitins 0 -- waiting removed sdwaitins 1 -- waiting inserted setenv - set environment variables sleep - delay execution for some time test - minimal test like /bin/sh textout - show text to the screen textout x y "str" color color is 24bit Hex, R[23:16], G[15:8], B[7:0] for example: textout 0 0 "hello world" FFFFFF tftpboot- boot image via network using TFTP protocol usb - USB sub-system usbboot - boot from USB device version - print monitor version WMT # ---------------------------------------------------
Wow, great stuff! This console is much more capable than the little junkers we’re used to working with. In addition to the USB, MMC, SPI, and Flash commands, we have the all important binary load and “go”. That means we can immediately begin compiling and executing our own software (Think “Hello World” for now) on the platform using only this console and gcc for ARM. If you’ve ever wanted to learn to code low-level ARM, you’re ready to go.