Jay-Tech PID 7901

CPU: VIA WM8505 + (ARM926EJ 400MHz)
RAM: DDRII 128MB
Flash: MLC Nand Flash 2Gb

Ein baugleiches Tablet scheint das Orphan M70003 zu sein.

Auf dem Mainboard sind vier PINs zugänglich. Hinter diesen verbirgt sich ein serieller Bus mit einem Signalpegel von 3,3 Volt (Low-Voltage-TTL). An diese kann man einen seriellen Adapter anschließen. Die Terminaleinstellungen sind 115200 Baud und der Einstellung 8N1. Wenn man das Tablet dann einschaltet, sieht man W-Load, U-Boot und danach das Android-System starten.

Anfangs konnte ich nur im Batteriebetrieb eine serielle Verbindung herstellen. Von Elektronik habe ich nicht viel Ahnung, aber es scheint, dass das mitgelieferte Netzteil daran Schuld ist. Ich hatte auch Probleme mit angschlossenen USB-Hubs. Nachdem ich das Netzteil durch ein hochwertiges Schaltnetzteil ersetzt hatte, funktioniert jetzt alles wie es soll.

Als seriellen Adapter nutze ich Breakout Board mit FT232RL USB (deutsche Bezugsquelle) und picocom als Terminalclient-Software:

picocom -b 115200 /dev/ttyUSB0

Startprotokoll:

WonderMedia Technologies, Inc.
W-Load Version : 0.19.00.04
ethaddr............found


U-Boot 1.1.4 (Nov  6 2010 - 12:28:29)
WonderMedia Technologies, Inc.
WMT U-Boot Version : 0.12.01.00.34
U-Boot code: 03F80000 -> 03FCD458  BSS: -> 0401EA74
RAM Configuration:
Bank #0: 00000000 128 MB
boot from spi flash.
flash:
     Bank1: FF800000 -- FFFFFFFF
     Bank2: FF000000 -- FF7FFFFF
Flash: 16 MB
In:    serial
Out:   serial
Err:   serial
logocmd="nand readblob 3c00000 600000;logo show;run text1"
maddr = 0x3c00000, naddr = 0x600000

<1> Read header
find NAND Flash SAMSUNG_K9LAG08U0M
nfc 0x1324 , divisor b
block8191 tag=74624230  version =1
block8190 tag=62743142  version =1
Un-know id = 0x0
Read finsih
Header is 0x00009a84 0x80101000

<2> Read Data
Read finsih
show logo .....
LCD param (setting): 1,40000,8,800,480,10,46,20,10,23,10
PWM param (setting): 0,4,599,599
LCD FrameBuffer = 0x07900000, BMP Address = 0x03C00000
Loading BMP ..... 
colorBits = 24
logo_width = 105, logo_height= 125
lcd_width= 800, lcd_height = 480
ok
no string .... 
PWM0 input freq = 47916666 Hz, output freq = 19998 Hz
PWM0 register setting: scalar = 3, period = 598, duty = 598
"WMT2.1.2_105" 
REG32_VAL(0xd8000440) = 0x08080800
memory size: 128MB
### main_loop entered: bootdelay=1

Execute register operation:
  reg op: 0xD8110064 | 0x8
  reg op: 0xD811008C | 0x8
  reg op: 0xD81100B4 | 0x8
  reg op: 0xD8110064 | 0x4
  reg op: 0xD811008C | 0x4
  reg op: 0xD81100B4 & 0xFFFFFFFB
  reg op: 0xD8130054 | 0x1
### main_loop: bootcmd="nand readblob 7c00000 b00000;nand read 0 0 300000;bootm 0"
Hit Enter key to stop autoboot:  0

U-Boot Enviroment

WMT # printenv
baudrate=115200
ipaddr=192.168.1.2
serverip=192.168.1.1
netmask=255.255.255.0
bootfile="uzImage.bin"
loadaddr=0x02000000
BMP_ADR=3c00000
lcdparam=1,40000,8,800,480,10,46,20,10,23,10
pwmparam=0,4,599,599
LCDC_FB=7900000
text1=textout2 651 455 "WMT2.1.2_105" c5c5c5
filesize=4D458
touchic=true
bootdelay=1
audioic=wm8900
touchirq=gpio5
battvoltlist=6830,7086,7310,7503,7575,7636,7720,7861,7953,8018,8190
gpiostate=3
kpadid=wms8088b_26
panelres.x=800
panelres.y=480
logocmd=nand readblob 3c00000 600000;logo show;run text1
bootcmd=nand readblob 7c00000 b00000;nand read 0 0 300000;bootm 0
bootargs=mem=109M noinitrd root=/dev/mtdblock9 rootfstype=yaffs2 rw console=ttyS0,115200n8 init=/init lcdid=11 androidboot.console=ttyS0 loadtime=-3
amp_powerup=0xd8110064|0x8,0xd811008c|0x8,0xd81100b4&~0x8
amp_powerdown=0xd8110064|0x8,0xd811008c|0x8,0xd81100b4|0x8
wifi_powerdown=0xd8110064|0x4,0xd811008c|0x4,0xd81100b4&~0x4
wifi_powerup=0xd8110064|0x4,0xd811008c|0x4,0xd81100b4|0x4
regop=0xd8110064|0x8,0xd811008c|0x8,0xd81100b4|0x8,0xd8110064|0x4,0xd811008c|0x4,0xd81100b4&~0x4,D8130054|0x1
basevolt=3300
basevoltcal=false
hibernation_ui=yes
eth_ui=yes
gsensor_axis=0,1,1,-1,2,1
gsensor_int=gpio6
gsensor_ui=yes
motor_ui=yes
88=1
need_restore_data=yes
orientation_ui=yes
camera_ui=no
musicplayer_black_cd=yes
enable_hw_scal=yes
enable_gome_theme=no
modem3g_ui=yes
pppoe_ui=yes
release_ver=WMT2.1.2_105
release_date=20101118
release_language=german
bluetooth_ui=yes
wmt.model=8105b
touchcodec=cs7146
hpvolum=90
vibratorset=D8110064,D811008C,D81100B4,4
showmemory_ui=yes
iLike=default
ethaddr=00:[removed by me]
sys.flt=946685132
serialnum=[snipp]
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.1.4 (Nov  6 2010 - 12:28:29)

Environment size: 1743/65531 bytes

Man kann für dieses Gerät einen eigenen Linux-Kernel bauen:

git clone git://gitorious.org/linux-on-via-vt8500/vt8500-kernel.git
cd vt8500-kernel
export CROSS_COMPILE=arm-linux-gnueabi-
export ARCH=arm
make wmt_defconfig
make menuconfig

Die Konfiguration ist standardmäßig sehr minimal. Im Menuconfig sollte man zusätzliche Dinge einbinden, die man im Kernel braucht (z. B. Dateisysteme, USB-Netzwerkkarten, etc.), danach übersetzt man ihn.

make -j2 uImage modules

To boot our kernel via u-boot, we must have a fat partition on the sd card. It's a good idea to create two partitions on the sd card. The first just for the kernel and the bootscript and the second one for the rootfs. The fat partition must contain and folder called „script“ in which the resulting uImage will be stored.

U-Boot is looking for a file called „scriptcmd“ in the script directory. We store the following commands in a file called script.txt and convert it with mkimage into a scriptcmd file.

U-Boot script

cleanlcd
textout 30 30 "Debian on the tablet" 00ff00
setenv bootargs mem=109M root=/dev/sda1 rootfstype=ext2 rootwait rw noinitrd console=ttyWMT0,115200n8 console=tty0 panel=800x480 lcdid=1 init=/bin/sh
textout 30 55 "loading kernel to RAM..." 00ff00
fatload mmc 0 0 /script/uImage
textout 30 80 "starting..." 00ff00
bootm 0

compile script

mkimage -A arm -O linux -T script -C none -a 0 -e 0 -n "bootscript" -d script.txt scriptcmd

Meine Anleitung von hier lässt sich ziemlich gut übernehmen. Es gibt nur ein paar feine Details die anders sind. Auf einer SD-Karte wird eine Partition rootfs (ext2) erzeugt und dort wird das Dateisystem für Debian angelegt:

sudo mount -o remount,exec,dev /media/rootfs
sudo debootstrap --verbose --arch armel --include openssh-server,ntpdate,usbutils,wpasupplicant,wireless-tools --foreign squeeze ./ http://ftp.de.debian.org/debian

Karte ausbauen, in das Tablet einstecken. Für den ersten Start muss in den bootargs ein „init=/bin/sh“ stehen, damit der zweite Schritt des Debootstrap von dort gestartet werden kann. Entweder baut man sich ein passendes scriptcmd oder man bricht über die serielle Konsole den Startvorgang des U-Boot ab und setzt bootargs temporär so dass es passt:

Hit Enter key to stop autoboot:  0 
WMT # mmcinit
WMT # fatload mmc 0 0 /script/uImage
WMT # setenv bootargs mem=109M root=/dev/mmcblk0p2 panel=800x480 rootfstype=ext2 rootwait rw noinitrd lcdid=1 console=tty0 console=ttyWMT0,115200n8 init=/bin/sh
WMT # bootm 0

Jetzt bootet das System. Entweder man schließt eine USB-Tastatur an das Tablet oder man macht die folgenden Schritte über die serielle Konsole. Übrigens bestimmt das letzte „console“-Argument in der Variable bootargs, auf welcher Konsole die Shell startet. Lautet die Reihenfolge „console=ttyWMT0,115200n8 console=tty0“ kann man sich mittels USB-Tastatur einloggen. Sollte man die Konsole auf dem seriellen Port wünschen, muss man die Argumente umdrehen „console=tty0 console=ttyWMT0,115200n8“.

# /debootstrap/debootstrap --second-stage
# echo "T0:2345:respawn:/sbin/getty 115200 ttyWMT0" >> /etc/inittab
# echo ttyWMT0 >> /etc/securetty
# passwd root

Grab this file: http://www.multiupload.com/9C1E61O33R and extract the archive to your SD card. The kernel in this file is not able to mount the NAND in the Jay-Tech tablet. But we have a serial connection, so we can use the original kernel form the pad. We preload the rootfs into the RAM and modify the kernel boot options to use the RAM disk for starting:

WMT # fatload mmc 0 1000000 script/mvl5_v5t_ramdisk_WM8505.090922.loop.gz
WMT # setenv bootargs mem=109M root=/dev/ram rw initrd=0x01000000,32M console=ttyS0,115200n8 
WMT # boot

That's all. If you install a console application lile Android Terminal Emulator 1.0.14 (term.apk) and connect a USB-Keyboard, you can just „su“ and got root. :)

If you upgraded your PID 7901 with the WMT_2.0.rar from Jay-Tech and it didn't work. When I tried to upgrade my PID 7901, the upgrade finished with the following error message:

Erase File-System partition Fail! Exit!
Maybe the kernel don't support this NAND Flash

So far, so bad. After a reset, my tablet didn't boot any more. U-Boot shows me an older version and it can't find the NAND flash.

WonderMedia Technologies, Inc.
W-Load Version : 0.19.00.01
ethaddr............found


U-Boot 1.1.4 (Sep 10 2010 - 15:59:06)
WonderMedia Technologies, Inc.
WMT U-Boot Version : 0.12.01.00.30
U-Boot code: 03F80000 -> 03FBBED8  BSS: -> 04009AFC
RAM Configuration:
Bank #0: 00000000 128 MB
boot from spi flash.
flash:
     Bank1: FF800000 -- FFFFFFFF
     Bank2: FF000000 -- FF7FFFFF
Flash: 16 MB
vibra start !
  reg op: 0xD811005C | 0x8
  reg op: 0xD8110084 | 0x8
  reg op: 0xD81100AC | 0x8
vibra time: 200 mesc
vibra stop !
  reg op: 0xD81100AC & 0xFFFFFFF7
In:    serial
Out:   serial
Err:   serial
bootcmd="nand readblob 3c00000 600000;logo show;run text1"
maddr = 0x3c00000, naddr = 0x600000

<1> Read header
Un-know id = 0xecd55525
Un-know id = 0x0
Err : Can not find any nand flash
Init Flash Failed rc=-1
Header is 0x153495b4 0x95b495b4
error: magicNum = 0x95b495b4, it should be 0x80101000

show logo .....
LCD param (setting): 1,30000,8,800,480,48,40,40,3,29,13
PWM param (setting): 0,45,1040,1040
LCD FrameBuffer = 0x07900000, BMP Address = 0x03C00000
Error : Not BMP Format
do_textout2 error: LCD isn't initialized, please run "lcdinit" first
REG32_VAL(0xd8000440) = 0x08080800
memory size: 128MB
### main_loop entered: bootdelay=1

Execute register operation:
  reg op: 0xD8110064 | 0x8
  reg op: 0xD811008C | 0x8
  reg op: 0xD81100B4 | 0x8
  reg op: 0xD8110064 | 0x4
  reg op: 0xD811008C | 0x4
  reg op: 0xD81100B4 & 0xFFFFFFFB
  reg op: 0xD8130054 | 0x1
### main_loop: bootcmd="nand readblob 7f80000 b00000;nand read 0 0 300000;bootm 0"
Hit Enter key to stop autoboot:  0 
ATSMB Host 390KHz 
SD Card is not inserted
maddr = 0x7f80000, naddr = 0xb00000

<1> Read header
Un-know id = 0xecd55525
Un-know id = 0x0
Err : Can not find any nand flash
Init Flash Failed rc=-1
Header is 0x95b49530 0x95b4d5b0
error: magicNum = 0x95b4d5b0, it should be 0x80101000

Un-know id = 0xecd55525
Un-know id = 0x0
Err : Can not find any nand flash
Init Flash Failed rc=-1
## Booting image at 00000000 ...
   Image Name:   MontaVista Linux 2.6.10
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2611712 Bytes =  2.5 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... Bad Data CRC
WMT #

So, here is how to fix it. First we need a working u-boot version, which knows the NAND flash, after some search, I found a working u-boot in an archive called „script_V2.1.rar“…

With all these experiments I've bricked my PID7901. U-boot didn't load. If that happens on the serial console you can't see anything. To fix this you need to open the case and connect JTAG (see details here) or solder out the spi flash eprom and flash it on a external programmer. Since I can't find the JTAG pins on my wm8505 board, I soldered out the spi flash (details here). I've you have bricked the spi flash, which is normally very unlikely, you can aquire a spare part. This http://darisusgmbh.de/shop/product_info.php/info/p20776_M25P40-VMN6-----Flash-serial-2-7V-4Mbit-50MHz-SO8.html M25P40-VMN6 works great.

• Mainboard product details (China)
• Debian on WM8505
• great board, with lots of infos
• great blog
• Wondermedia WM8505 Linux + u-boot source code
• Vanilla Kernel with patches
• Instructions for the vanilla sources