Editing N900 Hardware Hacking

Warning: You are not logged in. Your IP address will be recorded in this page's edit history.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.

Learn more about Contributing to the wiki.

This page outlines what is known about the hardware of the [[Nokia N900|N900]], and possible modifications or additions to it.

Much of the information on this page may be incorrect, and may cause damage to your N900 if you attempt any of it.

==Hacks==

* Case
* Camera
* Wifi
* Bluetooth
* Battery
* Audio
* Video

==Additional Hardware==

===Compass===

The [http://search.digikey.com/scripts/DkSearch/dksus.dll?Cat=1967220&k=HMC5843 HMC5843] compass from honeywell seems as if it would be a simple addition, if it could be wired onto a I2C bus.

There is also miniSD [http://www.aichi-mi.com/ AMI603SD] 6 degree sensor available, if it is possible to wire that to microSD slot. The same manufacturer is also providing small magnetic sensors AMI304 to i2c bus with DIP8 so it would be easier to solder with capacitors but there is not much room inside N900.

I2C bus can have chained up to 112 slave devices. Only problem is to get those pins available maybe de-soldering some component first... also one free GPIO/interrupt line would be good thing to have. There seems to be some pads available for I2C when looking from [[N900_Hardware_Schematic]], J6183 and J6184 in H7 Top layout near FM transmitter. Most probably too small to solder by hand.
There seems to be also one interrupt line used by transmitter in J6181.

If not needing the FM TX it could be possible remove whole component and replace it with compass.

==Gyroscope==

The forthcoming invensense [http://invensense.com/mems/gyro/itg3200.html itg3200] is a gyroscope chip that could similarly be connected to a I2C bus.

==UART to I2C bridge==

There is also available some bridge chips [http://ics.nxp.com/products/bridges/uart.i2c.master.gpio/ UARTtoI2C] that can be used over UART. Most likely UART pins can be found in debug ports.

==MMC card==

The MMC controller pins are convertable to GPIO pins. See page 3 top-left of [[N900 Hardware Schematic]], and page 691 of spruf98.pdf.
This means that there are 6 available easily contactable GPIO pins, static protected. (see same page of schematic) along with a 3.3V possibly variable power supply.

==Debug ports==

Under the battery are several groups of test pad connectors. With the camera on the left, and the battery removed, these are numbered left-to-right then top-down for the purposes of this page, with pad 1 of a connector at its top left.

Probable connections are anything that will enable full tests and bootstrap of of the phone without a case.

Obvious candidates are [[:wikipedia:JTAG|JTAG]] for flashing any bootloader, and USB for flashing the device. Serial ports, I2C, SPI are also possible.

The third serial port / UART is reportedly connected to these ports, so it is accessible.

There are 4 groups:

* Group1 - 2 pad connector to the middle left above the battery connector (J5300/1).
**This is labeled J5300 and J5301 on the schematic.  J5300 is USB D+, J5301 is USB D-.
* Group2 14 pad connector in two parts (J2000 (J2060+J2061)).
** (a) - 6 pad connector.
** (b) - 8 pad connector 
* Group3 - 7 pads (J5602).
* Group4 - 7 pads.

Here are the pad names from the [[N900 Hardware Schematic|schematic]] linked in the resources section, using same logic for "+" vs "o"

<pre>
+ J5301
+ J5300

J2000            J2060
  J2062 +   o   o       o   o   o   o  
              o   o   o       o   o   o   + J2061

J5602       J3109 J3111 J3113 J3115
        o   o   o   o      +   +   +   +
           o   o   o          +   +   +
                        J3110 J3112 J3114
</pre>

The plus-sign (supposedly) signifies invidual pad and group of lowercase "o" pads is a port (or similar).

According to [[User:rambo|my]] measurements with DMM ([http://www.tek.com/products/digital-multimeter/ Digital Multimeter]) the following pads are [[:wikipedia:Ground_(electricity)#Electronics|ground]] (counting from top-left and always going left-to-right in case of group of pads): first of J2000, last of J2060, first of J5602 and J3115.

[[N900 Hardware Schematic|Schematic]] did not reveal where these pads might actually be connected to.

According to [[User:jacekowski|jacekowski]]s [http://img36.imageshack.us/i/teki.png/ measurements] J2000 is serial console, 
{{ambox
|type=delete
|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)
}}
 J2000
 pin 1 :: GND (MIDDLE upper point, right to J2062 !)
 pin 2 :: RX, according to r00t
 pin 3 :: USB VBUS 5V
 pin 4 :: <unknown>
 pin 5 :: TX (confirmed by jacekowski ([[N900 Hardware Hacking/serial dump|115200 8-N-1]] ~2.6 V, connected to 1st UART in omap via some mysterious levelshifter - <code>/dev/ttyS0</code> in Linux), and r00t (see below))

<pre>
+ J5301
+ J5300

J2000                   J2060
  J2062 +  GND RX         1   o   o   4  
              5V  o    TX          5   o   7   + J2061

J5602       J3109 J3111 J3113 J3115
        1   o   o   4      +   +   +   +
          5   o   7            +   +   +
                        J3110 J3112 J3114
</pre>
(confirmed by >><r00t|home> anyway... here's the actual TxD now: http://www.constancy.org/~r00t/IMG_9246.JPG <<
[[Image:testpoints_tx.jpg]]

>><r00t|home> <r00t|home> this is serial loopback: http://www.constancy.org/~r00t/IMG_9251.JPG<<)

According to [http://cpkb.org/wiki/Nokia_N900_pinout CPKB] J2060 is [http://www.embedtronics.com/nokia/fbus.html F/MBus port].

==Modifications==

===USB===

Further details can be found in the [[N900_Hardware_USB|USB on the N900]] page.

===External antennas===

On the N900 there are three ''Reverse Polarity'' [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways. As an alternative to the RP Hirose U.FL connectors, the antennas are each attached to two solder points on the bottom of the motherboard, visible as small orange rectangles in the images below.

The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.

However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's RP Hirose U.FL connector is the most easily accessible as it is on the underside of the N900's PCB (where one can see those solder pads when the battery is taken out of N900). Access to Bluetooth and Wireless LAN's as well as GPS receiver's RP Hirose U.FL are on the obverse side of that N900 PCB.

The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly (~50-200 cycles) so that would leave the most appropriate solution is to get an adapter/converter.

While Hirose U.FL -> [http://en.wikipedia.org/wiki/RP-SMA#Reverse_polarity_SMA RP-SMA] adapters are commonly available, it is much more difficult to find a ''Reverse Polarity'' Hirose U.FL ->RP-SMA adapter. If one can be obtained, the SMA connector itself would have a longer wear than Hirose U.FL along with the fact that there are many antennas available in the form of RP-SMA connector form. With the cable attached and if one prefers the connector to be attached to the back of the device, this highlights the issue noted beforehand with the connectors on the obverse side of the device.

Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance.

The last set of limitation would be finding the right antennas that would be compatible with the said radio frequency bands. Both Bluetooth and Wireless LAN on N900 operate on the unlicensed ISM 2.4GHz band and antennas for them are abundant. GPS receiver operates on [http://en.wikipedia.org/wiki/Global_Positioning_System#Satellite_frequencies 1.2GHz-1.5GHz band] and antennas for them maybe more rare than antennas for Bluetooth/Wireless LAN. On similar level for availability the GSM antennas are equally less abundant than antennas for Bluetooth and Wireless LAN.

It is also noteworthy that the FM transmitter module relies on its own antenna, though it may also be possible with some soldering one maybe able to attach external antenna to the device.

For the locations of these Hirose U.FL connectors one will need the [http://mohammadag.xceleo.org/public/.private/Nokia_N900_RX-51_Schematics.pdf Hardware Schematics]:
[[Image:Nokia_N900_front_internal-Hirose_u.fl_bluetooth_wireless_LAN_and_GPS_test_connectors.png|frame|center|alt=Photo of N900 with open keyboard|Front view]]
* Bluetooth and Wireless LAN: Page 16, ID: X6301, Sector: N11
* GPS: Page 16, ID: X6200, Sector: H8
[[Image:Nokia_N900_rear-internal-Hirose_u.fl_GSM_and_non_Hirose_u.fl_FM_transmitter_antenna_and_test_pads.png|frame|center|alt=Photo of N900 with open keyboard|Rear view]]
* GSM: Page 17, ID: X7500, Sector: X10
* FMTX (not a Hirose U.FL connector): Page 17: ID: X6189, Sector H1 (Test pads??: J6192, J6193)

==Resources==

* N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld]
* N900 Service Manual - Level 3&4: [http://www.mediafire.com/?59g00171rwv3mjc MediaFire], [http://torrentpump.com/download/n900-rx-51-sm-l3-4-pdf-5228583 Torrent], [http://rghost.net/679258 rghost] or [http://rs768.rapidshare.com/files/314490131/N900_RX-51_SM_L3_4.pdf RapidShare]  
* [[N900 Hardware Schematic]]
* A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly.
* Disassembly [http://www.engadget.com/2009/12/04/nokia-n900-teardown-reveals-smartphone-semantics/ video] from tehkseven.
* N900 disassembled, super-highres scans by [http://talk.maemo.org/member.php?u=35572 Joerg_rw]: [http://maemo.cloud-7.de/Gallery-N900-exploded/]
* [https://fjallfoss.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=726569&fcc_id=%27LJPRX-51X%27 Internal photos] of N900 from FCC OET website (U.S. Govt. - May not be accessible for some people. Site does not allow hot linking, click on internal photos from the table)
* [[N900 Software Kernel Modules]]

==Vendors==

* [http://www.tessco.com/products/bmd/listItemsForSelectedCategory.do?bmdTypeId=007_26&mfgName=007_26_NOKIA&modelId=785585&groupSubgroupId=SHOW_ALL Tessco] had a variety of n900 parts. Note that they sold Tessco Nokia parts [http://www.tessco.com/yts/faq/faq/faq_28.html only to Authorized Service Centers]. (they currently do not and have stopped listing parts for Nokia phones.)
* As always - [http://shop.ebay.co.uk/pid-handy-fit/m.html?_nkw=n900 ebay] - this vendor has at the moment a stock of screens and various other original parts.

[[Category:N900]]
[[Category:N900 Hardware]]

Please note that all contributions to maemo.org wiki may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see maemo.org wiki:Copyrights for details). Do not submit copyrighted work without permission!

Summary:

Cancel | Editing help (opens in new window)

Templates used on this page:

Template:Ambox (view source) (semi-protected)

Retrieved from "https://wiki.maemo.org/N900_Hardware_Hacking"

Personal tools

Navigation

Views

Editing N900 Hardware Hacking

@@ Line 84: / Line 84: @@
 {{ambox
 |type=delete
-|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)<br>
+|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)
-Pin number: AH8, name: etk_d15/sdti_txd3 (serial data out, system trace messages); power domain: vdds 1.8V [http://neo900.org/stuff/joerg/random-media/UART-console-pin/DSCF2376.JPG]<br>voltage level actually seen is a miracle
 }}
   J2000