Do it before modding your tablet !

This is not a suggestion to have nice time with your girl-friend (or droid-friend, freely choose) but a smart way to operate when going to change your tablet from the “usual” Android to the “excellent” Uberoid. I have seen so much posts, in the HCH TechKnow forum, with messages like “help me, I just upgraded my tablet and now it autonomously speaks in ancient languages even if turned off”. Stop it, let we operate in a smart way. Prior to change, we must know what are we changing. Don’t post messages like “my tablet doesn’t work; it has -probably- a 7 inches screen, help me”, but change your approach. Your tablet is a complex machine, it looks like a toy, but has very sophisticated solutions inside it.

Your tablet COMMUNICATES with you, in its manner, but you can’t see the messages until the display goes on and the user-interface fully starts. BUT… there is some initial activity that is very, very interesting to indagate. I’m speaking about the U-boot.
The U-boot, as all of you can remember, is an underwater… no, sorry, I’m confusing with my other job. Redo: the U-boot is the first program that’s executed by the processor which animates your tablet (in our specific case, the WonderMedia WM8650).

The U-boot has big potential, you can -really- make any sort of operations on your tablet’s core, but the full list of such possibilities is too big to be exposed in this small page. So I just want to point your attention to some commands.

Let’s start. First of all: where U-boot comes out ? And, how can I interact with the program ? Good questions (I like to say to myself I pose good questions).
The answer is that you can’t see the U-boot activity without a little hardware and some software ; both of them are easily available. Note that the time you can lose with this preliminaries, will be widely balanced by that you can spare avoiding to brick your tablet with wrong rom upgrade.

HARDWARE

We need to look at the U-boot messages that are sent to the system serial port. Even if you can’t see any connector, the serial port is ALWAYS present on such tablets (for this generation). Now, the first operation requires some hardware. You must find 3 basic signals: TXD, RXD and GND. These are, respectively, the serial output, serial input and common (ground) signals of ttyS0 peripheral (assigned by the system to the console device). Any tablet has its own arrangement. In my experience, all the tablets that have an external connector for USB and LAN has also pads for such signals in the same external box, while tablets having USB and LAN built-in, must be OPENED (mechanically) to gain access to the lines.

Look at the pictures posted below to some examples of serial port wires in tablets I have used for my embedded applications (click images to enlarge).

This is the expander for a 7″ tablet with 24 pin connector. Wiring is easy ‘cause there are 4 holes 0.100″ spaced. Soldering wires is easy and low probability to destroy pads for overheating.

This is the expander for a 9.7″ tablet with 30 pin connector. Wiring is a little bit more difficult ‘cause the pads haven’t holes; you must take care of overheating to not destroy pads.

 

Another model of expander for a 9.7″ tablet with 30 pin connector. Wiring is difficult due to small pads without holes. Be carefully, high probability of destroy pads for overheating or pulling of soldered wires. Use small, flexyble wires and apply some strong adhesive tape to mantain them in position and to protect pads from strapping.

Connections for a 10.1″ tablet that hasn’t external expander. The USB and LAN ports are inside, so you must mechanically open the tablet to gain access to the pads. You must follow the same rules as for previous model.

This image is very interesting ‘cause you connect the wires directly to the WM8650 CoreBoard, so this solution will be valid for about ALL the tablets based on it. Note that I used 4 wires, getting gnd, txd, rxd and +3.3V, so the power can be used to supply an external interface.

 

Now, the signals have to be connected to your PC to interact with the U-Boot. The processor serial port signal are swinging from 0 to 3.3 Volts in negative logic, while a standard serial port (RS-232) has typically -5 to +5 Volts signals in positive logic, so you can’t connect directly the tablet signals to the PC ones: you need for an interface to logic inversion and level translation.

At least, you have two chances: the first is my own circuit you can find in another my article here ; you have to build it by yourself, it isn’t for sale…

I noticed that my interface was added as part of zip file “kit for tablet unbricking” by the Uberoid guru HcH ! Thanks for considering this small hardware as a useful tool 🙂

 

 

With this interface you can connect a standard PC serial port ( or USB to RS232 adapter) to the tablet; in case you try an USB adapter, remember to disable the FIFO buffers or reduce anyway the latence of signals at the minimum using the device properties menu.

The second option is to buy this USB-Serial-TTL interface. I found it on ebay after the suggestion of a friend; it’s very cheap and (obviously) doesn’t requires any solder works. Just one problem: the shipping time from the Far Orient was 3 weeks, here in Italy. Even with this usb interface (that your PC discovers like a serial port) you will turn OFF the FIFO buffers or decrease the latency to the minimum.

Using my interface, you have to connect 4 wires: +3.3V, Txd, Rxd, Gnd (‘cause the circuit is powered by the tablet’s 3.3V), and must cross Txd and Rxd signals between tablet and interface (look at the project’s page for detailed pictures) ; with the commercial interface, you just have to connect Gnd, Txd and Rxd of the circuit to the correspondant signals of the tablet (NO crossing).

SOFTWARE

The software needed is simply a serial terminal. We have many different choises; under Windows the most famous is the HyperTerm, but in Win7 it has been removed (but why ?), so you must use somewhat different. Usually, I use RealTerm under Windows and CuteCom under Linux. There is, also, my own terminal, called miterm-en you can download from this link . The zipped file contains the executable, compiled for Windows (working in Win7) and the source file in FreeBasic, so, if you want, you can easily modify, expand, arrange and compile, for example, under Linux. FreeBasic is a GREAT free compiler available for Windows and Linux. It can be used for small programs like this, but even for huge and sophisticated programs. It’s fast, simple, compatible with old “Basic” dialects like GW-basic, Qbasic etc. and it’s FREE. I use it with the Geany editor (under Win7) and is one of the powerful instruments on my software workbench. In the picture below you can see the program screen at start. The default serial port is COM4, but if such port isn’t available on your system, the program asks you for a new available one. In the example, I typed in the com19, ‘cause is the port number assigned to the usb-serial-ttl interface.
The program simply writes on the screen what comes in from the serial input and puts on serial output what you type on the keyboard. There are only 2 “command” keys: the [Esc] for program terminate and the [Ctrl-R] for toggling on-off the logging of the received data on a disk file.

In the next screen you can see what happens if you type [Ctrl-R]: the recording starts on file named log_xxx.txt, where xxx is a number that increases every second (system timer).

Now, I have my serial port connected to the tablet (that’s actually turned OFF, not suspended, really OFF). Now, I press the power button and the tablet sends a lot of data to my PC, then asks to press any character to stop the autoboot (typically for 3 seconds, then the autoboot takes place). Ok, quickly pressed [cr], and the transmission stopped here…

As you can see, we have the WMT# prompt that indicates we can send commands to the U-Boot program, finally… But we still are recording to a log file, so stop now typing again [Ctrl-R]. If you look inside the last log_xxx.txt file, you can see all the messages sent from the tablet. Please, note that the txt file logs data as sent from the tablet, and this data is in Linux mode, so you can experience missing line breaks when using a Windows program like the Notepad as the viewer, but if you use Geanie or any text editor able to handle the Unix/Linux format, there are no problems. Now, type the question mark then [cr]. This is the alias for HELP, so you will receive a list of ALL possible commands you can execute with U-Boot. Here is what I received on my tablet :

?       - alias for 'help'
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
decompanima - decompress logo image to the dest position.
dhcp    - invoke DHCP client to obtain IP/boot params
diskboot- boot from IDE device
show    -
echo    - echo args to console
erase   - erase FLASH memory
exit    - exit script
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatstore - store binary file to a dos filesystem
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
ide     - IDE sub-system
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imls    - list all images found in flash
imm     - i2c memory modify (auto-incrementing)
ims  - set i2c device context from memory
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loop    - infinite loop on address range
memory bit operation :
Format : mbit
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
mmcinit - init mmc card
  mmcinit 0 -- init mmc device 0
  mmcinit 1 -- init mmc device 1
mmcread - read data from SD/MMC card

   -read data from SD/MMC card block address 'block_num' on 'dev_id'
    to memory address 'addr' size is 'bytes'
mmcwrite - write data to SD/MMC card

   -write data to SD/MMC card block address 'block_num' on 'dev_id'
    from memory address 'addr' size is 'bytes'
mtest   - simple RAM test
mw      - memory write (fill)
nandrw  - NAND sub-system
nboot   - boot from NAND device
nfs - boot image via network using NFS protocol
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
poweroff - wmt device power off.
printenv- print environment variables
protect - enable or disable FLASH write protection
randmac - generate a random MAC address and save to "ethaddr" environment variable
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
sdwaitins - wait sd card inserted or removed
sdwaitins 0 -- waiting removed
sdwaitins 1 -- waiting inserted
setenv  - set environment variables
sleep   - delay execution for some time
test    - minimal test like /bin/sh
textout - show text to the screen
textout x y "str" color
color is 24bit Hex, R[23:16], G[15:8], B[7:0]
for example: textout 0 0 \"hello world\" FFFFFF
tftpboot- boot image via network using TFTP protocol
version - print monitor version
WMT #

The command that can save us from a wrong rom upgrade is “printenv”. This command simply puts out the env list that actually is stored in your tablet. This is an example taken from my 9.7″ tablet. This tablet has been modded with Uberoid, but it works, so all the settings are right.

memtotal=212M
mmcid=0
lpj=AUTO
ipaddr=192.168.0.2
serverip=192.168.0.1
gatewayip=192.168.0.1
netmask=255.255.255.0
kernelargs=setenv bootargs mem=${memtotal} root=${filesystem-NAND_mtd} noinitrd rootfstype=yaffs2 rw console=ttyS0,115200n8 lpj=${lpj} ${android_bootargs} ${platform_bootargs} quiet
bootcmd=nandrw r ${kernel-NAND_ofs} 0x1000000 ${kernel-NAND_len}; if iminfo 0x1000000; then run kernelargs; bootm 0x1000000; fi; echo No kernel found
logocmd=nandrw r ${wmt.nfc.mtd.u-boot-logo} ${wmt.display.logoaddr} 10000; nandrw r ${wmt.nfc.mtd.u-boot-logo2} ${wmt.display.logoaddr2} 40000; nandrw r ${wmt.nfc.mtd.kernel-logo} ${wmt.kernel.animation.addr} 80000; display init force; decompanima -f ${wmt.display.logoaddr2} 0x3000000; decompanima -f ${wmt.display.logoaddr} 0x3000000
wmt.display.logoaddr=500000
#=chg emilio next line - wmt.display.logoaddr2 550000
wmt.display.logoaddr2=500000
wmt.kernel.animation.addr=f600000
#wmt.audio.spi=1:0:0
wmt.audio.i2s=vt1603:f1:f2:ff:ff:100
wmt.io.pwbn=100:0:2000
wmt.eth.param=1
wmt.gpi.bat=[0:0:00020000:d8110040:d8110080:d8110000:d8110480:d81104C0][1:0:00000020:d8110040:d8110080:d8110000:d8110480:d81104C0][2:1:00010000:d8110040:d8110080:d8110000: d8110480:d81104C0]
wmt.gpo.camera1=1:0:7:D8110040:D8110080:D81100C0
wmt.gpo.wifi=6:1:6:d8110040:d8110080:d81100C0
wmt.gpt.gsensor=3:8:d8110040:d8110080:d8110000:d8110480:d81104c0:83000000:d8110300:8:d8110320:6
wmt.io.bat=3:2:1000:d7a:b22:d7a:d3d:d02:cc5:c8b:c4e:c12:bd6:b9c:b5e:b22
wmt.io.gsensor=1:3:4:0:1:1:-1:2:-1
wmt.sys.keypad=wms8151a:1:rc_1:4:c0_72:c1_73:r0_9e:r2_76:1:9e_8b
wmt.pwbn.param=100:0:500
wmt.ui.storage=7
wmt.io.touch=1:uor615x:0:1024:768
wmt.bus.i2c=i2c0:1:1:i2c1:1:1
bootdelay=3
wmt_ui_hibernation=1
wmt_sys_powerhold=0
wmt.gpo.vibrator=1:1:2:D8110040:D8110080:D81100C0:1
wmt.camera.param=1:1
android_bootargs=init=/init
platform_bootargs=wmtvo=2:0:16:1024:768:60
wmt.display.param=2:0:16:0:0:0
wmt.display.tmr=65000:0:320:480:1024:260:10:6:768:16
wmt.display.pwm=0:50:1000:999
wmt.io.mxcgsensor=1:3:4:0:-1:1:-1:2:-1
##=chg emilio next line - wmt.vt160x.bat 0:1:10:0
#wmt.vt160x.bat=1:0:10:0
wmt.vt160x.bat=0:1:10:0
wmt.gpo.camera=1:1:7:D8110040:D8110080:D81100C0
wmt.model.no=yongpeng_9.7inch_usbcamera
#=chg emilio next line - wmt.io.ts.2dcal 40 -30251 117186489 24194 22 -8405089 106502
wmt.io.ts.2dcal=40 -30251 117186489 24194 22 -8405089 106502
kernel-NAND_mtd=/dev/mtdblock9
kernel-NAND_ofs=0x2600000
kernel-NAND_len=0x800000
initrd-NAND_mtd=/dev/mtdblock10
initrd-NAND_ofs=0x2e00000
initrd-NAND_len=0x600000
filesystem-NAND_mtd=/dev/mtdblock11
filesystem-NAND_ofs=0x3400000
filesystem-NAND_len=0x20000000
wmt.nfc.mtd.u-boot-logo2=0x23500000
ethaddr=00:40:63:26:75:03
serialnum=c93521e3eb114a4ab51e6912e1ed7c4f
sys.flt=1324841537
wmt_sys_restore=0
wmt.nfc.mtd.u-boot-logo=23400000
wmt.nfc.mtd.kernel-logo=23c00000
wmt.io.wifi.drv=start
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.1.4 (Aug 24 2011 - 10:14:10)

Environment size: 2945/65531 bytes
WMT #

Note that in the row wmt.model.no you have your tablet model, that’s more precise than say: “the green led with the black button and the gray case” etc. Also note the row wmt.io.ts.2dcal that contains the touchpad calibration values. Don’t consider the rows in which you can read “emilio” ‘cause are experiments I did changing the default env_uboot file.
Look with attention to the values your tablet has built-in BEFORE trying to update the rom. A quick comparison with the contents of file env_uboot in the FirmwareInstall/env/ folder of the rom you have selected for modding can advice you if there is some incompatibility. Also, look inside the wmt_scriptcmd for some wrong parameter. The screen size for example, if wrong, can lock your tablet in the very first steps of upgrading process. The third and last step to do before a tablet upgrade, can be done without any hardware tool. You just need for a terminal program to run on the tablet, like the Android_Terminal_Emulator or others. Once installed the apk, run the terminal emulator on the tablet and execute the dmesg command, re-directing the output on a file, then save that file on the sdcard. You will have a list of the drivers and all was running in your tablet with the original rom. If you want to take a look to a dmesg.txt file coming from one of my tablets, click on this link (use the right mouse button and “save destination as” if you want to download a copy on your PC).

That’s all, for now. I hope this document can help someone to save time and to choose the right rom for making his tablet the best (with Uberoid 🙂