nRF9151 UART3 and enable line (task 2.2, partial)

Evidence class: board-read. This was run on the second T-Display K230 board, clipped into the LILYGO keyboard base, on 2026-10-13 at about 19:30 UTC. The commands went over the serial console on /dev/ttyACM0 channel 0 while the host held flock /tmp/k230-board.lock.

Setup

• Image: .#sdImage-landscape from master at dc2c4dae.
• Device tree: rebuilt with this branch’s uart3_nrf_pins and nrf9151_en_pins (and the keyboard base’s I2C4 node from impl/keyboard-base), with the image’s /chosen/bootargs copied in. It was installed with tools/push-file.py --src <dtb> --dest /boot/k230-tdisplay.dtb --reboot.

Observations

• Console: channel 0 logged in as root after the reboot.
• UART: dmesg reported 91403000.serial: ttyS3 MMIO32:0x0000000091403000 (irq = 14, base_baud = 3125000) is a 16550A.
• Pin muxing, from /sys/kernel/debug/pinctrl/*/pinmux-pins:

  pin 2 (IO2): device 91403000.serial function nrf9151-en-pins group nrf9151-en-cfg
  pin 28 (IO28): device 91403000.serial function uart3-nrf-pins group uart3-txd-cfg
  pin 29 (IO29): device 91403000.serial function uart3-nrf-pins group uart3-rxd-cfg
  pin 50 (IO50): device 91403000.serial function uart3-nrf-pins group uart3-io50-io51-release-cfg
  pin 51 (IO51): device 91403000.serial function uart3-nrf-pins group uart3-io50-io51-release-cfg
  

• Exchange: IO2 was held high with setsid nohup timeout 90 gpioset -c gpiochip0 2=1 &. Then:

  stty -F /dev/ttyS3 115200 raw -echo
  timeout 12 cat /dev/ttyS3 > /tmp/at.log &   # started 5 s after IO2 high
  printf "AT\r\n" > /dev/ttyS3; sleep 1
  printf "AT+CGMR\r\n" > /dev/ttyS3; sleep 1
  printf "AT+CFUN?\r\n" > /dev/ttyS3
  

  cat -v /tmp/at.log gave:

  OK^M
  ^M
  mfw_nrf91x1_2.0.3^M
  ^M
  OK^M
  ^M
  +CFUN: 1^M
  ^M
  OK^M
  

The modem firmware is mfw_nrf91x1_2.0.3. +CFUN: 1 means the base’s application firmware had already set the modem fully functional on its own within about 7 s of power-on, with no command from us.

Limits

• The task’s terminal tool was not used. cat and printf replaced microcom.
• Channel 1 silence was not checked, so task 2.2 stays open.
• IO2 power-up was not isolated. IO2 had not been driven before the gpioset, and it was not shown that the modem is unpowered while IO2 is low. The modem could also have been powered by the base’s own battery.
• No identifier was queried. IMEI, ICCID and IMSI were not requested.