Editing N900 Hardware Hacking
Warning: You are not logged in.
Your IP address will be recorded in this page's edit history.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 41: | Line 41: | ||
==Debug ports== | ==Debug ports== | ||
- | Under the battery are several groups of test pad connectors. With the camera on the left, and the battery removed | + | Under the battery are several groups of test pad connectors. With the camera on the left, and the battery removed. These are numbered for the purposes of this page clockwise, with pad 1 of a connector at its top left. |
Probable connections are anything that will enable full tests and bootstrap of of the phone without a case. | Probable connections are anything that will enable full tests and bootstrap of of the phone without a case. | ||
Line 47: | Line 47: | ||
Obvious candidates are [[:wikipedia:JTAG|JTAG]] for flashing any bootloader, and USB for flashing the device. Serial ports, I2C, SPI are also possible. | Obvious candidates are [[:wikipedia:JTAG|JTAG]] for flashing any bootloader, and USB for flashing the device. Serial ports, I2C, SPI are also possible. | ||
- | The third serial port | + | The third serial port is reportedly connected to these ports, so it is accessible. |
- | + | * J1 - 2 pad connector to the middle left above the battery connector. | |
- | + | ||
- | * | + | |
**This is labeled J5300 and J5301 on the schematic. J5300 is USB D+, J5301 is USB D-. | **This is labeled J5300 and J5301 on the schematic. J5300 is USB D+, J5301 is USB D-. | ||
- | * | + | * J2 14 pad connector in two parts. |
** (a) - 6 pad connector. | ** (a) - 6 pad connector. | ||
** (b) - 8 pad connector | ** (b) - 8 pad connector | ||
- | * | + | * J3 - 7 pads. |
- | * | + | * J4 - 7 pads. |
Here are the pad names from the [[N900 Hardware Schematic|schematic]] linked in the resources section, using same logic for "+" vs "o" | Here are the pad names from the [[N900 Hardware Schematic|schematic]] linked in the resources section, using same logic for "+" vs "o" | ||
Line 67: | Line 65: | ||
J2000 J2060 | J2000 J2060 | ||
J2062 + o o o o o o | J2062 + o o o o o o | ||
- | + | o o o o o o + J2061 | |
J5602 J3109 J3111 J3113 J3115 | J5602 J3109 J3111 J3113 J3115 | ||
- | o o o o | + | o o o o + + + + |
- | + | o o o + + + | |
J3110 J3112 J3114 | J3110 J3112 J3114 | ||
</pre> | </pre> | ||
Line 81: | Line 79: | ||
[[N900 Hardware Schematic|Schematic]] did not reveal where these pads might actually be connected to. | [[N900 Hardware Schematic|Schematic]] did not reveal where these pads might actually be connected to. | ||
- | According to [[User:jacekowski|jacekowski]]s [http://img36.imageshack.us/i/teki.png/ measurements] J2000 is serial console, | + | According to [[User:jacekowski|jacekowski]]s [http://img36.imageshack.us/i/teki.png/ measurements] J2000 is serial console, pin 5 is confirmed to be TX ([[N900 Hardware Hacking/serial dump|115200 8-N-1]] ~2.6 V, connected to 1st UART in omap - <code>/dev/ttyS0</code> in Linux). Since J2000 is group of 5 pads one could suppose the serial console uses HW flow control. |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
According to [http://cpkb.org/wiki/Nokia_N900_pinout CPKB] J2060 is [http://www.embedtronics.com/nokia/fbus.html F/MBus port]. | According to [http://cpkb.org/wiki/Nokia_N900_pinout CPKB] J2060 is [http://www.embedtronics.com/nokia/fbus.html F/MBus port]. | ||
Line 126: | Line 91: | ||
===External antennas=== | ===External antennas=== | ||
- | On the N900 there are three | + | On the N900 there are three [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways. |
- | The three chips that | + | The three chips that has Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector. |
- | However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's | + | However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's Hirose U.FL connector is the most easily accessible as it is on the underside of the N900's PCB (where one can see those solder pads when the battery is taken out of N900). Access to Bluetooth and Wireless LAN's as well as GPS receiver's Hirose U.FL are on the obverse side of that N900 PCB. |
- | The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly | + | The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly so that would leave the most appropriate solution is to get an adapter/converter. |
- | + | Most common adapter/converter would be a Hirose U.FL connector -> [http://en.wikipedia.org/wiki/RP-SMA#Reverse_polarity_SMA RP-SMA] as these can be commonly found in various setup, furthermore SMA connector itself would have a longer wear than Hirose U.FL itself along with the fact that there are many antennas available in the form of RP-SMA connector form. With the cable attached and if one prefers the connector to be attached to the back of the device, this highlights the issue noted beforehand with the connectors on the obverse side of the device. | |
Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance. | Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance. | ||
Line 143: | Line 108: | ||
For the locations of these Hirose U.FL connectors one will need the [http://mohammadag.xceleo.org/public/.private/Nokia_N900_RX-51_Schematics.pdf Hardware Schematics]: | For the locations of these Hirose U.FL connectors one will need the [http://mohammadag.xceleo.org/public/.private/Nokia_N900_RX-51_Schematics.pdf Hardware Schematics]: | ||
- | + | * GSM: Page 17, ID: X7500, Sector: X10 | |
* Bluetooth and Wireless LAN: Page 16, ID: X6301, Sector: N11 | * Bluetooth and Wireless LAN: Page 16, ID: X6301, Sector: N11 | ||
* GPS: Page 16, ID: X6200, Sector: H8 | * GPS: Page 16, ID: X6200, Sector: H8 | ||
- | + | * FMTX: Page 17: ID: X6189, Sector H1 (Test pads??: J6192, J6193) | |
- | + | ||
- | * FMTX | + | |
==Resources== | ==Resources== | ||
* N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld] | * N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld] | ||
- | * N900 Service Manual - Level 3&4: | + | * N900 Service Manual - Level 3&4: [http://torrentpump.com/download/n900-rx-51-sm-l3-4-pdf-5228583 Torrent], [http://rghost.net/679258 rghost] or [http://rs768.rapidshare.com/files/314490131/N900_RX-51_SM_L3_4.pdf RapidShare] |
* [[N900 Hardware Schematic]] | * [[N900 Hardware Schematic]] | ||
* A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly. | * A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly. | ||
* Disassembly [http://www.engadget.com/2009/12/04/nokia-n900-teardown-reveals-smartphone-semantics/ video] from tehkseven. | * Disassembly [http://www.engadget.com/2009/12/04/nokia-n900-teardown-reveals-smartphone-semantics/ video] from tehkseven. | ||
- | |||
- | |||
* [[N900 Software Kernel Modules]] | * [[N900 Software Kernel Modules]] | ||
Learn more about Contributing to the wiki.