Raiders of the lost UART [Update x2]

By | September 8, 2013

Yes, it was a very (un)productive day.

Inspecting the board-support code of the stock Android kernel gave some clues to the UART-ports.

UPDATE: Might have found it. See below.

According to the Nexus 7 board support code in the current Android-kernel, two UART ports are defined and the I/O is handled by the MSM (so Qualcomm) GPIO-Chip.

Assignments are:

  • GPIO 18: GSBI1 UART TX
  • GPIO 19: GSBI1 UART RX
  • GPIO 82: GSBI7 UART TX
  • GPIO 83: GSBI7 UART RX

However, it seems that only GSBI1 is actually defined as a UART-Port, as the struct-name “gsbi1_uart_config” and the implementation in board-flo.c suggests. GSBI7 might still be implemented (the devices-8064.c hints towards it), but not implemented on the board itself – who knows? The kernel definitely initializes 2 serial ttys: ttyHSL0 and ttyHSL1.

Judging from the way things are done with other Nexus devices, I assume that ttyHSL1 is reserved for the (in my case nonexistent) LTE modem, which leaves ttyHSL0 for serial / debug, and might explain why one configuration seems to be just a stub in the board-support code, as the WWAN driver would take care of the rest. Since I don’t have access to an LTE-enabled Nexus 7 2013, I’d be glad if anyone could comment on this one.

Furthermore, all the UART-definitions only have a profile for GPIOMUX_SUSPENDED, which seems to me as if they also need to be enabled / assigned an active profile, too.

UPDATE

 


So – after BigMac II made it over here safe and sound (quad-core-awesomeness!!!), I could finally start poking around some more. While the search for technical documents / schematics for the Nexus 7 2013 didn’t really yield anything, I stumbled over some info for the Nexus 5 by LG which indicated that it also had the debug-mechanism in the headphone jack dm8tbr discovered, I decided to give the sound-drivers another look.
And – HEUREKA! I remember looking into a couple of files in that folder, but how / why I missed this bit is beyond me.

The sound/soc/msm/asustek_headset.c contains exactly what we need: the function insert_headset(void) distinguishes between headphones, headset and *drumroll* debug board!

Since I don’t have access to the equipment dm8tbr used to detect the debug-function, I just count on Google’s / ASUS’ need to keep costs low and assume they want to be able to use the same debug-interfaces throughout the entire product lineup.

The error-notice in line 246 gives enough reason to assume, that the mechanism that forces the Nexus 7 to enter debug mode is the same as it is documented in the commit-log for the Nexus 4 kernel, which means that this circuitry should do the trick. TO THE HARDWARE STORE!

So, the good news is: most likely found the Nexus 7 UART port (hiding in plain sight -_-)
Bad news: I wasted the past weeks waiting for the friggin spudgers 😉

I’ll keep you posted!

 

Update 2

Cracked it, Watson!

8 thoughts on “Raiders of the lost UART [Update x2]

  1. Thorbjorn Vynne

    Hi dTatham

    Found your post regarding getting a serial connection through the headset jack input for the Nexus 7 (2013), and followed the link you refer to as well.

    Fantastic findings, since we are modifying the kernel and desperately need to debug why it doesn’t boot.

    We got a TTL to USB converter and created the setup mentioned in the link, but we still cannot get into debug mode. The kernel always just detects our debug board as a standard headset.

    We tried applying 3V directly on the sleeve, but with no luck still. Seems the UART mode is never triggered.

    Did you have success with this setup in your end ?

    Regards
    Thorbjørn

    Reply
  2. dTatham Post author

    Hey Thorbjørn,
    thanks for the feedback, it’s good to know that I’m not the only one hellbent on voiding the warranty on a perfectly(?) working tablet 😉

    I had no luck so far either, but I’m not 100% certain why. Have some theories though and I have another post in draft that’ll need some more honing.

    All the best,
    Daniel

    Reply
    1. dTatham Post author

      Hey Dave,
      I remember stumbling over the *cough* “Service Manual Nexus 5 LG D821” *cough* while googling around (*hinthint* ;D) and it showed the circuitry for the headphone jack / serial port, which – to me – looked identical to the mechanism described in the blog.
      I’m fairly certain that it’s implemented on the hardware-side throughout the entire Nexus series, but for newer models, it might need a specially prepared kernel or a fastboot-setting to enable it. Work has been piling up these days, that’s why I didn’t get to poke around any furhter, but hopefully I’ll have some downtime coming my way.

      Keep me posted if you should find something!

      Daniel

      Reply
      1. Tassadar

        Hi, I got the serial console working on Nexus 5. I used info from http://blog.accuvant.com/jduckandryan/building-a-nexus-4-uart-debug-cable/ , but Nexus 5 wouldn’t enable uart with ~3.0V on the sleeve ring, so I tried to let ~3.28V direcly from my USBUART converter in, and it worked.

        Same setup works for my N7 (2013), but just in bootloader – booted kernel recognizes it as “debug board”, but nothing arrives to the console. It might be disabled in kernel, I didn’t look into that much.

        Reply
        1. dTatham Post author

          Wow! Great job!!! Please do keep me posted about your progress!
          Have you checked whether the console=ttyHSL0,blah is handed over to the kernel cmdline? I had to recompile the stock-android kernel and instruct it to append the CMDLINE with the information provided by the bootloader.

          Reply
          1. Tassadar

            On Nexus 5, it works out of the box. flo’s bootloader removes first 26 from cmdline supplied by boot.img which is “console=ttyHSL0,115200,n8”, so if you add that to the end of cmdline again, the serial console works.

            Unfortunatelly, this doesn’t work for earlyprintk option in kernel, so the serial console didn’t solve my problem (I’m working on kexec-hardboot for N5, and it currently freezes somewhere after kernel decompresses itself and before the first prink gets in the serial console).

          2. dTatham Post author

            Tassadar: Thanks for the tip! I finally got the friggin thing to work – no resistors, nada.
            At least on the N7, I get the entire bootlog starting with the bootloader – is it any different on the N5?

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload the CAPTCHA.

This site uses Akismet to reduce spam. Learn how your comment data is processed.