Author Topic: WM8650 de-brick guide  (Read 37283 times)

0 Members and 1 Guest are viewing this topic.

Offline rafaelbf

  • Site Donor
  • Newbie
  • *
  • Posts: 7
  • Karma: +11/-0
  • BitBanger
WM8650 de-brick guide
« on: December 05, 2011, 09:07:15 PM »
!! De-bricking guide for WM8650 !!

This guide requires soldering/electronics skills.

Try the reset hole, battery disconnect and others tricks before following this guide.

If your WM8650 turns on but the display stills black, then you got the "black screen of death" (or Hard Brick). So let's try to de-brick!

************ U-BOOT ************

U-Boot is the boot loader. When the WM8650 is powered on, it starts reading the SPI Flash.

Here is the boot sequence:
1 - U-boot is loaded from SPI Flash by CPU.
2a - Normal boot: Linux kernel is loaded from NAND Flash by u-boot.
2b - SDCard boot: Linux Kernel is loaded from SD Card by u-boot. This Linux run a script ( to reprogram the NAND Flash and SPI Flash, reading files from SD Card.

If SPI flash is corrupt or invalid, the WM8650 cannot boot and the Tabled is bricked.

You need access to the WM8650 serial port (console) to check if U-boot stills alive.
The tablet needs to be opened to connect PC serial port to WM8650 daughterboard.
Some Tablets come with a 30pin adapter with one Ethernet port and two USB.
This adapter can be disassembled to access serial port pins, and avoid opening the Tablet.

******** REQUIRED TOOLS ********

Get the original firmware to your Tablet model, or a firmware that you know is compatible.

This schematic connects the serial port from WM8650 (3 volts) to the PC serial port (12 volts):
MAX3232 - schematic
If your PC doesn't have a serial port, use a usb/serial converter cable.

You need either the original firmware or a firmware that you know works with your tablet.

Use Windows XP "HyperTerminal" or another terminal program in Vista/7 with Kermit protocol support.

These steps are only if U-boot is not working:

5 - SPI FLASH REPROGRAM (optional)
Use this schematic: SPIPGM - schematic
And this software:
Any other SPI Flash programmer can be used, if your chip is supported by the programmer.

6 - WINHEX (optional)
Hexadecimal Editor. WinHex site
You can use another Hex editor.

********* CONNECTIONS **********

1 - Connect MAX3232 to WM8650 serial port pins:

Connect TX from WM8650 to T2IN, like schematic.

2 - Connect MAX3232 to PC serial port.

********** TURN IT ON ***********

1 - Copy the firmware to the SDCard. (as the usual procedure to flash upgrade).

2 - Copy the files "wmt_scriptcmd", "FirmwareInstall/ramdisk.gz", "FirmwareInstall/uzImage.bin" and "FirmwareInstall/u-boot.bin" from SdCard to your computer.

3 - Open the "wmt_scriptcmd" with notepad. (or with Wordpad if the text is garbaged)

4 - Open Hyperterminal, find the serial port connected to MAX3232, (COM1, COM2,...), and configure the parameters: Baud 115200, No pariy, 8 data bits, 1 stop bit, no flow control (8N1).

5 - Turn on the tablet with SDCard and power supply plugged in.

If your bootloader (and the serial port converter) are working, you will see like this in hyperterminal:
Code: [Select]
U-Boot 1.1.4 (May 10 2011 - 22:25:33)
WonderMedia Technologies, Inc.

If nothing happens, the U-boot inside SPI Flash isn't working and need to be reprogrammed:

********* SPI REFLASHING *********

Reflash with SPIPGM. But you can use another programmer and skip this step.

Type "SPIPGMW.EXE /i" to check if the programmer works:

Code: [Select]
SPI FlashROM Programmer 1.9c (C) 2008-2011 by Martin Rehak;
Compiled by GCC 4.4.0 at 23:20:41, Mar 22 2011
(Win9x/NT/2K/XP compatability)

SPI connected to LPT port at I/O base address: 378h, SCK pulse width: t+0us
FlashROM JEDEC ID, type: C22013h
Macronix MX25L4005 (512kB)
Status = 00h (SRP, RES, TB , BP2, BP1, BP0, WEL, BSY)
               0    0    0    0    0    0    0    0

SPI flash layout:
0x00000000 u-boot.bin
0x00050000 config
0x00060000 config
0x00070000 w-boot

Dump your SPI flash with this command in Windows Prompt:
Code: [Select]
SPIPGMW.EXE /d wm8650.bin /d=500

Use WinHex to open the wm8650.bin (SPI Flash dump) and replace the u-boot at address 0 with your "FirmwareInstall/u-boot.bin".

Save the file and reprogram with this command:
Code: [Select]
SPIPGMW.EXE /p wm8650a.bin /d=500

Note we are replacing only the u-boot.

If your SPI flash is totally invalid/blank, you must reconstruct the flash file with WinHex. Use this file SPIflash-7in-green.rar / Mirror as example.

W-load is one of the "w-load....bin" files inside the "FirmwareInstall" folder. Each file is for a different RAM size and speed.

Place the SPI flash inside the daughtercard and turn it on to check if u-boot is working.

******** PLAYING WITH U-BOOT ********

When the WM8650 is turned on, the hyperterminal will show like this:
Code: [Select]
U-Boot 1.1.4 (May 10 2011 - 22:25:33)
WonderMedia Technologies, Inc.

Hit ENTER when you see this: (you need fast eyes!)
Code: [Select]
Hit any key to stop autoboot:  0

You will get the prompt:
Code: [Select]

If u-boot is working and you got the "WMT #" prompt, you can send commands typing inside the hyperterminal.
If you type "?" and hit ENTER, u-boot list all the supported commands.

Now, "copy & paste" line by line from your wmt_scriptcmd to the hyperterminal.
Copy & Paste only the "setenv" lines (before "fastload", "saveenv" lines) in the "WMT #" prompt, and hit ENTER after each line.
Code: [Select]
WMT # setenv kernel-NAND_ofs
WMT # setenv kernel-NAND_len
WMT # setenv initrd-NAND_mtd

Now Type in the "WMT #" prompt:
Code: [Select]
WMT # saveenv   
WMT # display init force
WMT # textout 0 0 \"hello world\" FFFFFF

If you see in your tablet display: "hello world", then the lcd display is working.

Copy the line like this one:
"setenv bootargs 'mem=214M root=dev/ram0 rw initrd=0x01000000,32768K console=ttyS0,115200n8 loadtime=-4'"
from your "wmt_scriptcmd" file to the "WMT #" prompt.

Code: [Select]
WMT # setenv bootargs 'mem=214M root=dev/ram0 rw initrd=0x01000000,32768K console=ttyS0,115200n8 loadtime=-4'

Now look these lines: (in your "wmt_scriptcmd")
fatload mmc 0 1000000 FirmwareInstall/ramdisk.gz
fatload mmc 0 0 FirmwareInstall/uzImage.bin

This loads ramdisk and uzImage (Linux) from SDcard.
The ramdisk in this case is loaded at 0x01000000 address in RAM, and linux kernel at address 0x00.

Let's transfer these files thru serial port, inside the Hyperterminal.

Instead of "fatload", we will use the "loadb" command to load the "ramdisk.gz":
Code: [Select]
WMT # loadb 1000000

After the "loadb" command, this line will appear in hyperterminal:
Code: [Select]
## Read for binary (kermit)" download to 0x01000000 as 115200 bps...
Now in hyperterminal menu choose "Trasfer", "Send file", choose "Kermit" and open the "ramdisk.gz"

The file will be transferred to RAM. This operation is slow, about 18 minutes. (remember the internet Dial-up days...)

Now lets load the "uzImage.bin":
Code: [Select]
WMT # loadb 0
Send the file "uzImage.bin", in the same way as "ramdisk.gz" above. Wait about 23 minutes...

After the transfer finishes type in "WMT #" prompt:
Code: [Select]
WMT # bootm 0 

Now Linux starts, the SD Card will be recognized, and the firmware upgrade screen will appear!!!

Code: [Select]
## Booting image at 00000000 ...
   Image Name:   Linux-
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    3109584 Bytes =  3 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
No initrd
## Transferring control to Linux (at address 00008000) ...

Starting kernel ...

Uncompressing Linux.................................... done, booting the kernel.
Linux version (jodyfu@szmce13) (gcc version 4.5.1 (Sourcery G++
 Lite 2010.09-50) ) #90 Fri Aug 19 18:23:02 HKT 2011
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177

« Last Edit: December 05, 2011, 09:43:41 PM by HardcoreHacker »

Offline Stephan

  • aka HcH, TechKnow Owner, EHVSN Admin
  • Administrator
  • Uber Member
  • *****
  • Posts: 9657
  • Karma: +2279/-106
Re: WM8650 de-brick guide
« Reply #1 on: December 05, 2011, 09:44:05 PM »
Epic post! Moved to FAQ! Thanks 10x!

Added all the needed files and schematics to the downloads section here:;sa=view;down=4
« Last Edit: December 05, 2011, 11:26:05 PM by HardcoreHacker »