Serial Console on Google Nexus 5

5.12.2013 22:00 | Přečteno: 10850× | Návody | | poslední úprava: 28.1.2014 22:34

Nexus devices feature a working, accesible UART port in rather interesting place - it is built into the headphones jack.

Accessing the port is nothing new - there are several guides on the internets about this matter, I've used the one on blog.accuvant.com as a reference. Microphone pin in Nexus' headphone jack is connected to comparator, and if voltage on that pin exceeds certain voltage (blog post says 2.8V, but I had problems with that on Nexus 5), board/kernel switches R and L headphone ouputs to RX and TX UART lines. It operates at 1.8V and although the SoC would probably survive standard 3.3V UART<->USB converter many of you have laying around, it is better to make a voltage divider.

So, I've built voltage divider for the MIC trigger pin and for TX line as described in that blog post, but of course...

...it didn't work. After several hours I spent trying to fix the "board" I made (I'm a programmer and when I deal with electronics, it looks terrible and mostly doesn't work, so I kept thinking I soldered something wrong), I finally tried to attach the MIC pin directly to +3.3V from my UART<->USB converter, and suddenly, it works. So, voltage of ~3.0V on MIC pin is not enough to trigger the UART mode on Nexus 5. 3.3V works fine and enables the console (on MIC pin - RX/TX still should be at 1.8V).

On Nexus 5, the console is enabled out of the box, no need to anable anything in kernel or to add something to command line - just plug in the headphone jack with voltage to trigger the comparator and it starts vomiting data. Here are the first few lines from the console (with slightly modified kernel, hence those messages around kernel decompression):

welcome to hammerhead bootloader
[10] Power on reason 20091
[80] Loaded IMGDATA at 0x11000000
[90] Display Init: Start
[170] MDP GDSC already enabled
[170] bpp 24
[210] Config MIPI_CMD_PANEL.
[210] display panel: ORISE
[260] Found Appeneded Flattened Device tree
[260] DTB: platform id 126, board id 150, soc rev 20002, board rev 11
[300] Set panel ON cmds [35]
[420] Turn on MIPI_CMD_PANEL.
[470] Display Init: Done
[470] cable type from shared memory: 8
[470] reboot_mode restart reason = reboot
[480] Loading boot image (8824832): start
[790] Loading boot image (8824832): done
[790] Found Appeneded Flattened Device tree
[800] DTB: platform id 126, board id 150, soc rev 20002, board rev 11
[800] get_display_kcal = 0, 0, 0, x
[810] 
Booting Linux
[850] vibe
[950] splash: boot
[990] splash: unlocked
[1030] cmdline: console=ttyHSL0,115200,n8 androidboot.hardware=hammerhead user_debug=31 maxcpus=2 msm_watchdog_v2.enable=1 loglevel=15 uart_console=enable lcd_maker_id=primary lge.hreset=off lge.reset=unknown gpt=enable lge.kcal=0|0|0|x lge.rev=rev_11 androidboo[1050] Updating device tree: start
[1060] Updating device tree: done
[1060] booting linux @ 0x8000, ramdisk @ 0x2900000 (500053), tags/device tree @ 0x2700000
[1070] Turn off MIPI_CMD_PANEL.
[1070] Continuous splash enabled, keeping panel alive.

00000000-02700000
00000000:4A5DB007
dec
Uncompressing Linux... done, booting the kernel.
done 00008000-00000000-02700000
[    0.000000] Booting Linux on physical CPU 0
[    0.000000] Initializing cgroup subsys cpu
[    0.000000] Linux version 3.4.0-g9eb14ba-dirty (tassadar@nymeria) (gcc version 4.7 (GCC) ) #146 SMP PREEMPT Thu Dec 5 20:27:05 CET 2013
[    0.000000] CPU: ARMv7 Processor [512f06f0] revision 0 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] Machine: Qualcomm MSM 8974 HAMMERHEAD (Flattened Device Tree), model: LGE MSM 8974 HAMMERHEAD
[    0.000000] atags_pointer 0x2700000 c2700000
[    0.000000] qcom,ion-heap@28 reserved EBI1 size 614000
[    0.000000] qcom,mdss_fb_primary reserved EBI1 size 1000000
[    0.000000] qcom,msm-contig-mem reserved EBI1 size 280000
[    0.000000] Node qcom,msm-mem-hole removed memory 7b00000-ff00000
[    0.000000] memory pool 3 (start 0x7e700000 size 1900000) initialized
[    0.000000] Hardboot page reserved at 0x10100000
[    0.000000] PERSIST RAM CONSOLE START ADDR : 0x10000000
[    0.000000] Initialized persistent memory from 10000000-100fffff
[    0.000000] cma: CMA: reserved 16 MiB at 36c00000
[    0.000000] cma: Found secure_region, memory base 0, size 252 MiB
[    0.000000] cma: CMA: reserved 252 MiB at 6e800000
[    0.000000] cma: Found adsp_region, memory base 0, size 32 MiB
[    0.000000] cma: CMA: reserved 32 MiB at 6c800000
[    0.000000] cma: Found qsecom_region, memory base 0, size 17 MiB
[    0.000000] cma: CMA: reserved 20 MiB at 6b400000
[    0.000000] Memory policy: ECC disabled, Data cache writealloc
[    0.000000] IMEM DT static mapping successful
[    0.000000] On node 0 totalpages: 483840
[    0.000000] free_area_init_node: node 0, pgdat c0dff240, node_mem_map c10e4000
[    0.000000]   Normal zone: 1784 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 192520 pages, LIFO batch:31
[    0.000000]   HighMem zone: 2312 pages used for memmap
[    0.000000]   HighMem zone: 287224 pages, LIFO batch:31
[    0.000000] PERCPU: Embedded 7 pages/cpu @c212e000 s15616 r0 d13056 u32768
[    0.000000] pcpu-alloc: s15616 r0 d13056 u32768 alloc=8*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 479744
[    0.000000] Kernel command line: console=ttyHSL0,115200,n8 androidboot.hardware=hammerhead user_debug=31 maxcpus=2 msm_watchdog_v2.enable=1 loglevel=15 uart_console=enable lcd_maker_id=primary lge.hreset=off lge.reset=unknown gpt=enable lge.kcal=0|0|0|x lge.rev=rev_11 androidboot.laf androidboot.emmc=true androidboot.serialno=02b6ec61215fc56a androidboot.bootloader=HHZ11d androidboot.baseband=msm bootreason=reboot androidboot.hardware.sku=D821
[    0.000000] UART CONSOLE : enable
[    0.000000] BOARD : LGE rev_11 
[    0.000000] PID hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
[    0.000000] Memory: 123MB 2MB 1765MB = 1890MB total
[    0.000000] Memory: 1572028k/1572028k available, 389956k reserved, 846848K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     vmalloc : 0xf0000000 - 0xff000000   ( 240 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xef800000   ( 760 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]       .text : 0xc0008000 - 0xc0cf52d4   (13237 kB)
[    0.000000]       .init : 0xc0cf6000 - 0xc0d66d00   ( 452 kB)
[    0.000000]       .data : 0xc0d68000 - 0xc0e31c8c   ( 808 kB)
[    0.000000]        .bss : 0xc0e31cb0 - 0xc10e3334   (2758 kB)

Nexus 7

I happen to have also the Nexus 7s (both 2012 and 2013 version), so I've tried this thing on both.

On 2013's model (boardname flo), it works fine, except you need to add console=ttyHSL0,115200,n8 to cmdline in boot.img. It is already there, but bootloader removes first 26 characters of cmdline before passing it to kernel (lol), which is exactly the lenght of "console=ttyHSL0,115200,n8 ". Probably an attempt to disable the UART console as it _might_ be a security risk (and it works, you need to unlock the bootloader if you want to modify cmdline, but it is just funny).

On 2012's model (boardname grouper), it doesn't work with my setup. It puts too big current on the MIC line, which triggers a fuse on my UART<->USB converter (the fuse is 50mA), which then turns off the 3.3V source. I have no idea why, I'm pretty sure the HW part is there, I saw it mentioned in the kernel several times. It does the same thing while in bootloader.

Why did I need it?

I'm currently trying to make kexec-hardboot patch work on Nexus 5 for my multi-booting tool MultiROM and serial console helps me debug very early stages of kernel's boot process.

Why is this in English

To get it to Google search results. It took me long time to figure this out, so I want to let others know it works.

       

Obrázky

Komentáře

[Nehovorim po anglicky]

It looks great, but a little bit dangerous to use :)

[petr_p]

Phreaking is back again :)

[Atrament]

... I have know idea ... (v odstavci Why did I need it) To se mi už taky párkrát povedlo napsat, jsem rád, že v tom nejsem sám:))

[Tassadar]

Opraveno, díky, z nějakého důvodu se mi tohle stává čím dál tím častěji a vypadá to příšerně)

[pc2005]

To by mě zajímalo, jak přepínaj mezi analogem a digitálem.

[Tassadar]

Když na budeš hledat "Service Manual Nexus 5 LG D821" na Google, tak to vyplivne asi 115MB velké PDF které mimo jiné obsahuje i blokové diagramy a schéma desky. Na straně 223 je blokový diagram audio části. Přijde mi, že tam používají "něco jako relé", které se přepne z Audio čipu na UART na hlavním SoC tím napětím na MIC pinu, ale abych se přiznal, tak elektronice moc nerozumím)

Na straně 233 je pak schéma zapojení okolo sluchátkového jacku.

[Goheeca]

Je tam použit digitálně řízený analogový přepínač/multiplexer FSA2269UMX, pro ty co by si s tím chtěli hrát existuje něco podobného v CMOS řadě 4000 a to 4016, 4066. Rozhodně to nemá stejné vlastnosti, jen jsem chtěl poukázat na něco dostupnějšího.

[pc2005]

Díky za info, ono se ani nic jinýho čekat nedalo.

[Oskar]

Na schématu je vidět, že se porovnává napětí na mikrofonním vstupu dělené na polovinu (děličem 10k/10k) s napájecím napětím 1V8 děleném v poměru (56k/66k), tedy 1V52. Takže při nominálních hodnotách součástek musí být napětí na vstupu aspoň 3,04 V, když přidáme nějaký rozptyl, je jasné, že je potřeba tam připojit 3,3 V.