Editing N900 Hardware Hacking

Warning: You are not logged in. Your IP address will be recorded in this page's edit history.
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision Your text
Line 41: Line 41:
==Debug ports==
==Debug ports==
-
Under the battery are several groups of test pad connectors. With the camera on the left, and the battery removed, these are numbered left-to-right then top-down for the purposes of this page, with pad 1 of a connector at its top left.
+
Under the battery are several groups of test pad connectors. With the camera on the left, and the battery removed. These are numbered for the purposes of this page clockwise, with pad 1 of a connector at its top left.
Probable connections are anything that will enable full tests and bootstrap of of the phone without a case.
Probable connections are anything that will enable full tests and bootstrap of of the phone without a case.
Line 47: Line 47:
Obvious candidates are [[:wikipedia:JTAG|JTAG]] for flashing any bootloader, and USB for flashing the device. Serial ports, I2C, SPI are also possible.
Obvious candidates are [[:wikipedia:JTAG|JTAG]] for flashing any bootloader, and USB for flashing the device. Serial ports, I2C, SPI are also possible.
-
The third serial port / UART is reportedly connected to these ports, so it is accessible.
+
The third serial port is reportedly connected to these ports, so it is accessible.
-
There are 4 groups:
+
* J1 - 2 pad connector to the middle left above the battery connector.
-
 
+
-
* Group1 - 2 pad connector to the middle left above the battery connector (J5300/1).
+
**This is labeled J5300 and J5301 on the schematic.  J5300 is USB D+, J5301 is USB D-.
**This is labeled J5300 and J5301 on the schematic.  J5300 is USB D+, J5301 is USB D-.
-
* Group2 14 pad connector in two parts (J2000 (J2060+J2061)).
+
* J2 14 pad connector in two parts.
** (a) - 6 pad connector.
** (a) - 6 pad connector.
** (b) - 8 pad connector  
** (b) - 8 pad connector  
-
* Group3 - 7 pads (J5602).
+
* J3 - 7 pads.
-
* Group4 - 7 pads.
+
* J4 - 7 pads.
Here are the pad names from the [[N900 Hardware Schematic|schematic]] linked in the resources section, using same logic for "+" vs "o"
Here are the pad names from the [[N900 Hardware Schematic|schematic]] linked in the resources section, using same logic for "+" vs "o"
Line 67: Line 65:
             J2000            J2060
             J2000            J2060
   J2062 +  o  o      o  o  o  o   
   J2062 +  o  o      o  o  o  o   
-
              o  o  o      o  o  o  + J2061
+
          o  o  o      o  o  o  + J2061
             J5602      J3109 J3111 J3113 J3115
             J5602      J3109 J3111 J3113 J3115
-
         o  o  o  o     +  +  +  +
+
         o  o  o  o   +  +  +  +
-
          o  o  o         +  +  +
+
          o  o  o       +  +  +
                         J3110 J3112 J3114
                         J3110 J3112 J3114
</pre>
</pre>
Line 81: Line 79:
[[N900 Hardware Schematic|Schematic]] did not reveal where these pads might actually be connected to.
[[N900 Hardware Schematic|Schematic]] did not reveal where these pads might actually be connected to.
-
According to [[User:jacekowski|jacekowski]]s [http://img36.imageshack.us/i/teki.png/ measurements] J2000 is serial console,  
+
According to [[User:jacekowski|jacekowski]]s [http://img36.imageshack.us/i/teki.png/ measurements] J2000 is serial console, pin 5 is confirmed to be TX ([[N900 Hardware Hacking/serial dump|115200 8-N-1]] ~2.6 V, connected to 1st UART in omap - <code>/dev/ttyS0</code> in Linux). Since J2000 is group of 5 pads one could suppose the serial console uses HW flow control.
-
{{ambox
+
-
|type=delete
+
-
|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)<br>
+
-
 
+
-
Pin number: AH8, name: etk_d15/sdti_txd3 (serial data out, system trace messages); power domain: vdds 1.8V [http://neo900.org/stuff/joerg/random-media/UART-console-pin/DSCF2376.JPG]<br>voltage level actually seen is a miracle
+
-
}}
+
-
J2000
+
-
pin 1 :: GND (MIDDLE upper point, right to J2062 !)
+
-
pin 2 :: RX, according to r00t
+
-
pin 3 :: USB VBUS 5V
+
-
pin 4 :: <unknown>
+
-
pin 5 :: TX (confirmed by jacekowski ([[N900 Hardware Hacking/serial dump|115200 8-N-1]] ~2.6 V, connected to 1st UART in omap via some mysterious levelshifter - <code>/dev/ttyS0</code> in Linux), and r00t (see below))
+
-
 
+
-
 
+
-
<pre>
+
-
+ J5301
+
-
+ J5300
+
-
 
+
-
            J2000                   J2060
+
-
  J2062 +  GND RX        1  o  o  4 
+
-
              5V  o    TX          5   o  7  + J2061
+
-
 
+
-
            J5602      J3109 J3111 J3113 J3115
+
-
        1  o  o  4      +  +  +  +
+
-
          5  o  7            +  +  +
+
-
                        J3110 J3112 J3114
+
-
</pre>
+
-
(confirmed by >><r00t|home> anyway... here's the actual TxD now: http://www.constancy.org/~r00t/IMG_9246.JPG <<
+
-
[[Image:testpoints_tx.jpg]]
+
-
 
+
-
 
+
-
 
+
-
>><r00t|home> <r00t|home> this is serial loopback: http://www.constancy.org/~r00t/IMG_9251.JPG<<)
+
According to [http://cpkb.org/wiki/Nokia_N900_pinout CPKB] J2060 is [http://www.embedtronics.com/nokia/fbus.html F/MBus port].
According to [http://cpkb.org/wiki/Nokia_N900_pinout CPKB] J2060 is [http://www.embedtronics.com/nokia/fbus.html F/MBus port].
Line 126: Line 91:
===External antennas===
===External antennas===
-
On the N900 there are three ''Reverse Polarity'' [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways. As an alternative to the RP Hirose U.FL connectors, the antennas are each attached to two solder points on the bottom of the motherboard, visible as small orange rectangles in the images below.
+
On the N900 there are three [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways.
-
The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.
+
The three chips that has Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.
-
However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's RP Hirose U.FL connector is the most easily accessible as it is on the underside of the N900's PCB (where one can see those solder pads when the battery is taken out of N900). Access to Bluetooth and Wireless LAN's as well as GPS receiver's RP Hirose U.FL are on the obverse side of that N900 PCB.  
+
However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's Hirose U.FL connector is the most easily accessible as it is on the underside of the N900's PCB (where one can see those solder pads when the battery is taken out of N900). Access to Bluetooth and Wireless LAN's as well as GPS receiver's Hirose U.FL are on the obverse side of that N900 PCB.  
The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly (~50-200 cycles) so that would leave the most appropriate solution is to get an adapter/converter.  
The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly (~50-200 cycles) so that would leave the most appropriate solution is to get an adapter/converter.  
-
While Hirose U.FL -> [http://en.wikipedia.org/wiki/RP-SMA#Reverse_polarity_SMA RP-SMA] adapters are commonly available, it is much more difficult to find a ''Reverse Polarity'' Hirose U.FL ->RP-SMA adapter. If one can be obtained, the SMA connector itself would have a longer wear than Hirose U.FL along with the fact that there are many antennas available in the form of RP-SMA connector form. With the cable attached and if one prefers the connector to be attached to the back of the device, this highlights the issue noted beforehand with the connectors on the obverse side of the device.
+
Most common adapter/converter would be a Hirose U.FL connector -> [http://en.wikipedia.org/wiki/RP-SMA#Reverse_polarity_SMA RP-SMA] as these can be commonly found in various setup, furthermore SMA connector itself would have a longer wear than Hirose U.FL itself along with the fact that there are many antennas available in the form of RP-SMA connector form. With the cable attached and if one prefers the connector to be attached to the back of the device, this highlights the issue noted beforehand with the connectors on the obverse side of the device.
Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance.
Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance.
Line 153: Line 118:
* N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld]
* N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld]
-
* N900 Service Manual - Level 3&4: [http://www.mediafire.com/?59g00171rwv3mjc MediaFire], [http://torrentpump.com/download/n900-rx-51-sm-l3-4-pdf-5228583 Torrent], [http://rghost.net/679258 rghost] or [http://rs768.rapidshare.com/files/314490131/N900_RX-51_SM_L3_4.pdf RapidShare]   
+
* N900 Service Manual - Level 3&4: [http://torrentpump.com/download/n900-rx-51-sm-l3-4-pdf-5228583 Torrent], [http://rghost.net/679258 rghost] or [http://rs768.rapidshare.com/files/314490131/N900_RX-51_SM_L3_4.pdf RapidShare]   
* [[N900 Hardware Schematic]]
* [[N900 Hardware Schematic]]
* A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly.
* A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly.

Learn more about Contributing to the wiki.


Please note that all contributions to maemo.org wiki may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see maemo.org wiki:Copyrights for details). Do not submit copyrighted work without permission!


Cancel | Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://wiki.maemo.org/N900_Hardware_Hacking"