[MOD]UART Debugging Connection - Barnes & Noble Nook Tablet

Introduction
Why is UART useful? It's a debugging tool. During the boot sequence on most computers, you see a splash screen. On most computers, you can hit 'ESC' to see the diagnostics in the background and then press a key like 'F2' to jump into the BIOS and make changes. On our devices we don't have that option.
On the Nook we have U-Boot which functions as a BIOS. We press 'Space Bar' to get into the U-Boot options. UART allows you to get into the U-Boot and make changes, as well as view the logs as they are generated. See the following code block for an example output
Code:
Texas Instruments X-Loader 1.41 (Oct 21 2011 - 14:00:05)
Start not on PWRON, skipping power button check.
Starting OS Bootloader from EMMC ...
U-Boot 1.1.4-acclaim1.4_1.4.0.1029^{} (Nov 11 2011 - 12:34:20)
Load address: 0x80e80000
DRAM: 1024 MB
Using default environment
In: serial
Out: serial
Err: serial
hw_status 0x23 vbus_status 0x80
mmc read: Invalid size
mmc read: Invalid size
2 bytes read
MAX17042+UBOOT: battery type=LG
MAX17042+UBOOT: gas gauge detected (0x0000)
MAX17042_STATUS (00h) is 0x0000
MAX17042+UBOOT: BATTERY Detected!
MAX17042+UBOOT:WARM BOOT
mmc read: Invalid size
mmc read: Invalid size
40 bytes read
Valid max17042 init data is loaded into memory
0x1234
0x215b
0x00d6
0x2037
0x0000
0x0100
0x007e
0x3670
0x078f
0x0000
0x0000
0x6435
0x2f2c
0x0140
0x7d5a
0x87a4
0x1400
0x205c
0x205c
0x6046
verify if mem loaded: FullcapNom was saved as 2037
uboot verify: 1d CONFIG is 2210 ; should be 2210 & 0xFDFB
uboot verify: 2a RELAXCFG is 083b ; should be 083b
uboot verify: 29 FILTERCFG is 87a4 ; should be 87a4
uboot verify: 28 LEARNCFG is 2466 ; should be 2406 & 0xFF0F
uboot verify: 18 DesignCap is 205c ; should be 205c
uboot verify: 12 Vempty is 7d5a ; should be 7d5a
uboot verify: 25 TEMPLIM is 2305 ; should be 2305
uboot verify: 2b MiscCFG is 0810 ; should be 0810 & cc1f
uboot verify: 2c TGAIN is e3e1 ; should be e3e1
uboot verify: 2d TOFF is 290e ; should be 290e
uboot verify: 2e CGAIN is 4000 ; should be 4000
uboot verify: 2f COFF is 0000 ; should be 0000
uboot verify: 37 FCTC is 05e0 ; should be 05e0
MAX17042+UBOOT: warm config is okay
SOC 90%, booting.
Board revision PVT
mmc read: Invalid size
mmc read: Invalid size
16 bytes read
ptn 0 name='xloader' start=256 len=131072
ptn 1 name='bootloader' start=512 len=262144
ptn 2 name='recovery' start=1024 len=15728640
ptn 3 name='boot' start=32768 len=16777216
ptn 4 name='rom' start=65536 len=50331648
ptn 5 name='bootdata' start=163840 len=50331648
ptn 6 name='factory' start=262144 len=387973120
ptn 7 name='system' start=1019904 len=641728512
ptn 8 name='cache' start=2273280 len=446693376
ptn 9 name='media' start=3145728 len=1073741824
ptn 10 name='userdata' start=5242880 len=64991232
mmc read: Invalid size
1088 bytes read
BCB found, checking...
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
** Unable to use mmc 0:1 for fatload **
Booting into Android
mmc read: Invalid size
mmc read: Invalid size
4 bytes read
BootCnt 2
1 bytes written
Autobooting in 0 seconds, press <SPACE> to stop...
kernel @ 80088120 (2682952)
ramdisk @ 81080000 (157153)
Initrd start : 81080000 , Initrd end : 810a64c1Acclaim Board.
Starting kernel ...
Linux version 2.6.35.7 ([email protected]) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 SMP PREEMPT Fri Nov 11 12:35:42 PST 2011
CPU: ARMv7 Processor [411fc093] revision 3 (ARMv7), cr=10c53c7f
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: OMAP4430 ACCLAIM
Memory policy: ECC disabled, Data cache writealloc
On node 0 totalpages: 245760
free_area_init_node: node 0, pgdat c0587e00, node_mem_map c062a000
Normal zone: 1536 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 178688 pages, LIFO batch:31
HighMem zone: 512 pages used for memmap
HighMem zone: 65024 pages, LIFO batch:15
***********************
OMAP4430 ES2.3 type(HS)
id-code (6b95c02f)
Die-id (5C360006-00000001-09111715-1601D00D)
Prod-id (000DB95C-000600CC)
***********************
SRAM: Mapped pa 0x40300000 to va 0xfe400000 size: 0x100000
FIXME: omap44xx_sram_init not implemented
Reserving 33554432 bytes SDRAM for VRAM
SMC: Allocated workspace of 3M at (0x9c900000)
PERCPU: Embedded 7 pages/cpu @c0e37000 s5632 r8192 d14848 u65536
pcpu-alloc: s5632 r8192 d14848 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 243712
Kernel command line: androidboot.console=ttyO0 console=ttyO0,115200n8 [email protected] [email protected] init=/init rootwait vram=32M,82000000 omapfb.vram=0:[email protected]
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 448MB 256MB 256MB = 960MB total
Memory: 935252k/935252k available, 47788k reserved, 262144K highmem
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
DMA : 0xffc00000 - 0xffe00000 ( 2 MB)
vmalloc : 0xf0800000 - 0xf8000000 ( 120 MB)
lowmem : 0xc0000000 - 0xf0000000 ( 768 MB)
pkmap : 0xbfe00000 - 0xc0000000 ( 2 MB)
modules : 0xbf000000 - 0xbfe00000 ( 14 MB)
.init : 0xc0008000 - 0xc003d000 ( 212 kB)
.text : 0xc003d000 - 0xc053f000 (5128 kB)
.data : 0xc0540000 - 0xc05888c0 ( 291 kB)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
RCU-based detection of stalled CPUs is disabled.
Verbose stalled-CPUs detection is disabled.
You will need
In order to get started you will need some things. Here's what you will need.
Torx T5 screw driver (the star kind)
Soldering iron ( any soldering iron)
Case opener tool ( or guitar pick or something small and plastic)
30-40 AWG wire (small wires)
1.8V UART to USB converter (Like The Bus Priate)
Tweezers (Makes it easier to handle small things)
Most of the tools and parts used can be obtained at Lowes or Radio Shack
For a UART device, I recommend The Bus Pirate. The Bus Pirate is known as "The Hacker's Multi-tool" and it is useful for alot more than just UART. It is an Open-Source, Open-Hardware, community supported tool. You can get it from SeeedStudios.com for $27.15.
Instructions
There are several ways to set up UART. Here is how I set up mine.
Image 1:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Disassembly
If you have an SDCard inserted, remove it.
Remove two(2) T5 Torx screws securing the back cover to the unit
Using the Case Opener tool, pry the rear cover off the unit. It is held on by small plastic hooks. They are fairly durable and I have not broken any in several removal and installations.
Remove ten(10) T5 torx screws from the metal case which secure the front cover
Image 2:
disconnect the battery and the volume control swich connections which are accessible through holes in the metal case.
Remove the front cover using a case opener tool or your bare hands, whichever is more comfortable for you
Remove the board and LCD from the metal case
Modification
Image 3:
Locate the UART RX and TX lines on the board shown in Image2.
You can hook your UART device to this directly, RX to TX and TX to RX, or keep reading and I'll show you how I set mine up. so..
Stop here and use UART or continue on for a cleaner method
run 40 awg wire to a piece of perf-board, about 8 holes wide.
Using 20 awg wire, make a loop on the perf-board which joins two holes in two spots on the small piece of perf-board
attach the UART RX
Image 4:
Route the wires along the board and tape them down
Use epoxy to mount the perfboard. It should be mounted at a very slight downward angle. Set something under the board while it dries. This gives room for the case to close.
Reassemble the unit, Assembly is reverse of Disassembly.
Image 5:
Hook up RX, TX to your perf-board hooks and connect ground to the metal case.
Image 6:
You will now be able to talk to your UART device using
Baud: 115200
Bits: 8
Parity: None
Stop Bits: 1
Voltage: 1.8 (open drain)
For the Bus Pirate, get it working in a termianal and use the following settings:
Code:
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)
(1)>3
Set serial port speed: (bps)
1. 300
2. 1200
3. 2400
4. 4800
5. 9600
6. 19200
7. 38400
8. 57600
9. 115200
10. BRG raw value
(1)>9
Data bits and parity:
1. 8, NONE *default
2. 8, EVEN
3. 8, ODD
4. 9, NONE
(1)>1
Stop bits:
1. 1 *default
2. 2
(1)>1
Receive polarity:
1. Idle 1 *default
2. Idle 0
(1)>1
Select output type:
1. Open drain (H=Hi-Z, L=GND)
2. Normal (H=3.3V, L=GND)
(1)>1
Ready
UART>(3)
Conclusion
For those of you helping with security bypass methods, this will surely be useful as it will tell you when a secure failure is encountered. For those of you who want to experiment with U-Boot or a cool electronics project, I'd encourage you to try this. There's not alot that can go wrong because the board is well built and fairly heat resistant and the tools/parts used in this mod are available from several sources.
I hope this was informative and/or interesting for you to read.
Thanks to pokey9000 for pointing me to the right area.

---

A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?
Also, what would happen if it didn't autoboot in 0 seconds and you could hit the spacebar?
Sent from my BNTV250 using Tapatalk

---

HMG10 said:
A few lines before the kernal starts loading, it has bootcnt 2. What does this mean and what happens if it is modified? Or is any modification break the secure CHAIN?
Sent from my BNTV250 using Tapatalk
Click to expand...
Click to collapse
That's the number of boots since the counter was reset. After 8 failed boots, the device will go into recovery and restore all firmware.

---

this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.
Glad I dont have to pull out the logic analyser and find those pins..

---

servergod said:
this is great! I have been looking at my arduino and my pandaII (.netMF) dev boards and my tablet for a few days now.
Glad I dont have to pull out the logic analyser and find those pins..
Click to expand...
Click to collapse
that's exactly what I did...

---

Adafruit's FTDI Friend should also do the trick, $10 less.

---

I changed up my UART connection. I feel this is much cleaner and runs less wire through the nook. This makes it into a really good development device.
This new setup is made with a piece of perf-board from Radio Shack and it's held onto the nook using double-sided tape. Here are some pictures:
The wires are routed through the crack in the back cover and run to the same points mentioned in the Original Post. The 3rd connection (middle) here is Ground. Ground is the point on the board closest to the edge and furthest from UART TX in the staggered group of pins..

---

I thought I'd update this... I though I'd update this after a few weeks of working with it. The external connection works very well. It is easy to remove and replace if required with just 3 solder joints if required. The external perf-board is very unobtrusive, and does not interfere with operation.
I also found a case that works well with this modification. it's called "Mini Suit" for Nook Tablet.
If you go with this method and need a case, Mini Suit will suit you.

---

Adam,
In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?
Thanks Again for all you do on these forums.!

---

acruxksa said:
Adam,
In picture 3 you have a diagram that shows the pinout for uart tx and rx on the nook tablet (appears to be the left two pins of the 4 in the diagram), but if you look closely at picture 4, the top wire appears to be soldered to the top right pin rather than the top left pin as show on the diagram in picture 3. Is this just an optical illusion?
Thanks Again for all you do on these forums.!
Click to expand...
Click to collapse
disregard picture 4. I took alot of pictures while setting things up and I chose the ones that gave the best idea of what was going on. Thanks.

---

Replacement for Bus Pirate
Hi Adam
Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?
if can kindly help to give a detail guide connection setup from PC USB to Phone.
appreciate you help.
thanks

---

chongns said:
Hi Adam
Good day to you.
I would like to setup my own Uart devices for Samsung Phone, however, not able to locate the Bus Pirate devices as mention in your thread.
but i found a USB to RS232 converter as per attach PDF file.
would you please help to check on it? is it possible to setup the UART setup use on Samsung phone?
if can kindly help to give a detail guide connection setup from PC USB to Phone.
appreciate you help.
thanks
Click to expand...
Click to collapse
This should really go into the Samsung forum for the phone you're trying to get to, however here is where you can buy a bus pirate.