Introduction
Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.
On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
You will need
In order to get started you will need some things. Here's what you will need.
For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.
Instructions
There are several ways to set up UART. Here is how I set up mine.
Image 1:
Disassembly
You will now be able to talk to your UART device using
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Voltage: 1.8 (open drain)
For the Bus Pirate, get it working in a termianal and use the following settings:
Conclusion
For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.
I hope this was informative and/or interesting for you to read.
Thanks to pokey9000 for pointing me to the right area.
Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.
On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
Code:
Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Start not on PWRON, skipping power button check.
Starting OS Bootloader from EMMC ...
U-Boot 1.1.4-acclaim1.4_1.4.0.1029^{} (Nov 11 2011 - 12:34:20)
Load address: 0x80e80000
DRAM: 1024 MB
Using default environment
In: serial
Out: serial
Err: serial
hw_status 0x23 vbus_status 0x80
mmc read: Invalid size
mmc read: Invalid size
2 bytes read
MAX17042+UBOOT: battery type=LG
MAX17042+UBOOT: gas gauge detected (0x0000)
MAX17042_STATUS (00h) is 0x0000
MAX17042+UBOOT: BATTERY Detected!
MAX17042+UBOOT:WARM BOOT
mmc read: Invalid size
mmc read: Invalid size
40 bytes read
Valid max17042 init data is loaded into memory
0x1234
0x215b
0x00d6
0x2037
0x0000
0x0100
0x007e
0x3670
0x078f
0x0000
0x0000
0x6435
0x2f2c
0x0140
0x7d5a
0x87a4
0x1400
0x205c
0x205c
0x6046
verify if mem loaded: FullcapNom was saved as 2037
uboot verify: 1d CONFIG is 2210 ; should be 2210 & 0xFDFB
uboot verify: 2a RELAXCFG is 083b ; should be 083b
uboot verify: 29 FILTERCFG is 87a4 ; should be 87a4
uboot verify: 28 LEARNCFG is 2466 ; should be 2406 & 0xFF0F
uboot verify: 18 DesignCap is 205c ; should be 205c
uboot verify: 12 Vempty is 7d5a ; should be 7d5a
uboot verify: 25 TEMPLIM is 2305 ; should be 2305
uboot verify: 2b MiscCFG is 0810 ; should be 0810 & cc1f
uboot verify: 2c TGAIN is e3e1 ; should be e3e1
uboot verify: 2d TOFF is 290e ; should be 290e
uboot verify: 2e CGAIN is 4000 ; should be 4000
uboot verify: 2f COFF is 0000 ; should be 0000
uboot verify: 37 FCTC is 05e0 ; should be 05e0
MAX17042+UBOOT: warm config is okay
SOC 90%, booting.
Board revision PVT
mmc read: Invalid size
mmc read: Invalid size
16 bytes read
ptn 0 name='xloader' start=256 len=131072
ptn 1 name='bootloader' start=512 len=262144
ptn 2 name='recovery' start=1024 len=15728640
ptn 3 name='boot' start=32768 len=16777216
ptn 4 name='rom' start=65536 len=50331648
ptn 5 name='bootdata' start=163840 len=50331648
ptn 6 name='factory' start=262144 len=387973120
ptn 7 name='system' start=1019904 len=641728512
ptn 8 name='cache' start=2273280 len=446693376
ptn 9 name='media' start=3145728 len=1073741824
ptn 10 name='userdata' start=5242880 len=64991232
mmc read: Invalid size
1088 bytes read
BCB found, checking...
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
Booting into Android
mmc read: Invalid size
mmc read: Invalid size
4 bytes read
BootCnt 2
1 bytes written
Autobooting in 0 seconds, press <SPACE> to stop...
kernel @ 80088120 (2682952)
ramdisk @ 81080000 (157153)
Initrd start : 81080000 , Initrd end : 810a64c1Acclaim Board.
Starting kernel ...
Linux version 2.6.35.7 (build@dhabuildimage17) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011
CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: OMAP4430 ACCLAIM
Memory policy: ECC disabled, Data cache writealloc
On node 0 totalpages: 245760
free_area_init_node: node 0, pgdat c0587e00, node_mem_map c062a000
Normal zone: 1536 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 178688 pages, LIFO batch:31
HighMem zone: 512 pages used for memmap
HighMem zone: 65024 pages, LIFO batch:15
***********************
OMAP4430 ES2.3 type(HS)
id-code (6b95c02f)
Die-id (5C360006-00000001-09111715-1601D00D)
Prod-id (000DB95C-000600CC)
***********************
SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
FIXME: omap44xx_sram_init not implemented
Reserving 33554432 bytes SDRAM for VRAM
SMC: Allocated workspace of 3M at (0x9c900000)
PERCPU: Embedded 7 pages/cpu @c0e37000 s5632 r8192 d14848 u65536
pcpu-alloc: s5632 r8192 d14848 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 243712
Kernel command line: androidboot.console=ttyO0 console=ttyO0,115200n8 mem=448M@0x80000000 mem=512M@0xA0000000 init=/init rootwait vram=32M,82000000 omapfb.vram=0:5M@82000000
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 448MB 256MB 256MB = 960MB total
Memory: 935252k/935252k available, 47788k reserved, 262144K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xf0800000 - 0xf8000000 ( 120 MB)
lowmem : 0xc0000000 - 0xf0000000 ( 768 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.init : 0xc0008000 - 0xc003d000 ( 212 kB)
.text : 0xc003d000 - 0xc053f000 (5128 kB)
.data : 0xc0540000 - 0xc05888c0 ( 291 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.You will need
In order to get started you will need some things. Here's what you will need.
- Torx T5 screw driver (the star kind)
- Soldering iron ( any soldering iron)
- Case opener tool ( or guitar pick or something small and plastic)
- 30-40 AWG wire (small wires)
- 1.8V UART to USB converter (Like The Bus Priate)
- Tweezers (Makes it easier to handle small things)
For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.
Instructions
There are several ways to set up UART. Here is how I set up mine.
Image 1:
Disassembly
- If you have an SDCard inserted, remove it.
- Remove two(2) T5 Torx screws securing the back cover to the unit
- Using the Case Opener tool, pry the rear cover off the unit. It is held on by small plastic hooks. They are fairly durable and I have not broken any in several removal and installations.
- Remove ten(10) T5 torx screws from the metal case which secure the front cover
Image 2:
- disconnect the battery and the volume control swich connections which are accessible through holes in the metal case.
- Remove the front cover using a case opener tool or your bare hands, whichever is more comfortable for you
- Remove the board and LCD from the metal case
Modification
Image 3:
- Locate the UART RX and TX lines on the board shown in Image2.
You can hook your UART device to this directly, RX to TX and TX to RX, or keep reading and I'll show you how I set mine up. so..
Stop here and use UART or continue on for a cleaner method
- run 40 awg wire to a piece of perf-board, about 8 holes wide.
- Using 20 awg wire, make a loop on the perf-board which joins two holes in two spots on the small piece of perf-board
- attach the UART RX
Image 4:
- Route the wires along the board and tape them down
- Use epoxy to mount the perfboard. It should be mounted at a very slight downward angle. Set something under the board while it dries. This gives room for the case to close.
- Reassemble the unit, Assembly is reverse of Disassembly.
Image 5:
- Hook up RX, TX to your perf-board hooks and connect ground to the metal case.
Image 6:
You will now be able to talk to your UART device using
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Voltage: 1.8 (open drain)
For the Bus Pirate, get it working in a termianal and use the following settings:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)
(1)>3
Set serial port speed: (bps)
1. 300
2. 1200
3. 2400
4. 4800
5. 9600
6. 19200
7. 38400
8. 57600
9. 115200
10. BRG raw value
(1)>9
Data bits and parity:
1. 8, NONE *default
2. 8, EVEN
3. 8, ODD
4. 9, NONE
(1)>1
Stop bits:
1. 1 *default
2. 2
(1)>1
Receive polarity:
1. Idle 1 *default
2. Idle 0
(1)>1
Select output type:
1. Open drain (H=Hi-Z, L=GND)
2. Normal (H=3.3V, L=GND)
(1)>1
Ready
UART>(3)Conclusion
For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.
I hope this was informative and/or interesting for you to read.
Thanks to pokey9000 for pointing me to the right area.
Last edited:
