Maemo Wiki Mirror - User contributions [en]

N900 Hardware Hacking

2010-07-14T13:33:11Z

80.189.50.167: /* Debug ports */

This page outlines what is known about the hardware of the [[Nokia N900|N900]], and possible modifications or additions to it.

Much of the information on this page may be incorrect, and may cause damage to your N900 if you attempt any of it.

==Hacks==

* Case
* Camera
* Wifi
* Bluetooth
* Battery
* Audio
* Video

==Additional Hardware==

===Compass===

The [http://search.digikey.com/scripts/DkSearch/dksus.dll?Cat=1967220&k=HMC5843 HMC5843] compass from honeywell seems as if it would be a simple addition, if it could be wired onto a I2C bus.

There is also miniSD [http://www.aichi-mi.com/ AMI603SD] 6 degree sensor available, if it is possible to wire that to microSD slot. The same manufacturer is also providing small magnetic sensors AMI304 to i2c bus with DIP8 so it would be easier to solder with capacitors but there is not much room inside N900.

I2C bus can have chained up to 112 slave devices. Only problem is to get those pins available maybe de-soldering some component first... also one free GPIO/interrupt line would be good thing to have. There seems to be some pads available for I2C when looking from [[N900_Hardware_Schematic]], J6183 and J6184 in H7 Top layout near FM transmitter. Most probably too small to solder by hand.
There seems to be also one interrupt line used by transmitter in J6181.

If not needing the FM TX it could be possible remove whole component and replace it with compass.

==Gyroscope==

The forthcoming invensense [http://invensense.com/mems/gyro/itg3200.html itg3200] is a gyroscope chip that could similarly be connected to a I2C bus.

==UART to I2C bridge==

There is also available some bridge chips [http://ics.nxp.com/products/bridges/uart.i2c.master.gpio/ UARTtoI2C] that can be used over UART. Most likely UART pins can be found in debug ports.

==MMC card==

The MMC controller pins are convertable to GPIO pins. See page 3 top-left of [[N900 Hardware Schematic]], and page 691 of spruf98.pdf.
This means that there are 6 available easily contactable GPIO pins, static protected. (see same page of schematic) along with a 3.3V possibly variable power supply.

==Debug ports==

Under the battery are several groups of test pad connectors.
With the camera on the left, and the battery removed.
These are numbered for the purposes of this page clockwise, with pad 1 of a connector at its top left.

Probable connections are anything that will enable full tests and bootstrap of of the phone without a case.

Obvious candidates are [http://en.wikipedia.org/wiki/JTAG JTAG] for flashing any bootloader, and USB for flashing the device.
Serial ports, I2C, SPI are also possible.

The third serial port is reportedly connected to these ports, so it is accessible.

* J1 - 2 pad connector to the middle left above the battery connector.
* J2 14 pad connector in two parts.
** (a) - 6 pad connector.
** (b) - 8 pad connector
* J3 - 7 pads.
* J4 - 7 pads.

Here are the pad names from the [http://wiki.maemo.org/N900_Hardware_Schematic schematic] linked in the resources section, using same logic for "+" vs "o"

<pre>
+ J5301
+ J5300

J2000 J2060
J2062 + o o o o o o
o o oTX o o o + J2061

J5602 J3109 J3111 J3113 J3115
o o o o + + + +
o o o + + +
J3110 J3112 J3114
</pre>

TX ~2.6V - signal from TX pin http://img36.imageshack.us/i/teki.png/

The plus-sign (supposedly) signifies invidual pad and group of lowercase "o" pads is a port (or something).

According to my measurements with DMM (Digital [http://en.wikipedia.org/wiki/Multimeter Multi Meter]) the following pads are [http://en.wikipedia.org/wiki/Ground_(electricity)#Electronics ground] (counting from top-left and always going left-to-right in case of group of pads): first of J2000, last of J2060, first of J5602 and J3115.

Based on quick reading (and copious use of search) of the [http://wiki.maemo.org/N900_Hardware_Schematic schematic] did not reveal where these pads might actually be connected to.

==Modifications==

===USB===

Further details can be found in the [[N900_Hardware_USB|USB on the N900]] page.

==Resources==

* N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld]
* N900 Service Manual - Level 3&4: [http://torrentpump.com/download/n900-rx-51-sm-l3-4-pdf-5228583 Torrent], [http://rghost.net/679258 rghost] or [http://rs768.rapidshare.com/files/314490131/N900_RX-51_SM_L3_4.pdf RapidShare]
* [[N900 Hardware Schematic]]
* A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly.
* Dissasembly [http://www.engadget.com/2009/12/04/nokia-n900-teardown-reveals-smartphone-semantics/ video] from tehkseven.

==Vendors==

* [http://www.tessco.com/products/bmd/listItemsForSelectedCategory.do?bmdTypeId=007_26&mfgName=007_26_NOKIA&modelId=785585&groupSubgroupId=SHOW_ALL Tessco] had a variety of n900 parts. Note that they sold Tessco Nokia parts [http://www.tessco.com/yts/faq/faq/faq_28.html only to Authorized Service Centers]. (they currently do not and have stopped listing parts for Nokia phones.)
* As always - [http://shop.ebay.co.uk/pid-handy-fit/m.html?_nkw=n900 ebay] - this vendor has at the moment a stock of screens and various other original parts.

[[Category:N900]]
[[Category:N900 Hardware]]

N900 Hardware Hacking

2010-07-14T13:32:17Z

80.189.50.167: /* Debug ports */

This page outlines what is known about the hardware of the [[Nokia N900|N900]], and possible modifications or additions to it.

Much of the information on this page may be incorrect, and may cause damage to your N900 if you attempt any of it.

==Hacks==

* Case
* Camera
* Wifi
* Bluetooth
* Battery
* Audio
* Video

==Additional Hardware==

===Compass===

The [http://search.digikey.com/scripts/DkSearch/dksus.dll?Cat=1967220&k=HMC5843 HMC5843] compass from honeywell seems as if it would be a simple addition, if it could be wired onto a I2C bus.

There is also miniSD [http://www.aichi-mi.com/ AMI603SD] 6 degree sensor available, if it is possible to wire that to microSD slot. The same manufacturer is also providing small magnetic sensors AMI304 to i2c bus with DIP8 so it would be easier to solder with capacitors but there is not much room inside N900.

I2C bus can have chained up to 112 slave devices. Only problem is to get those pins available maybe de-soldering some component first... also one free GPIO/interrupt line would be good thing to have. There seems to be some pads available for I2C when looking from [[N900_Hardware_Schematic]], J6183 and J6184 in H7 Top layout near FM transmitter. Most probably too small to solder by hand.
There seems to be also one interrupt line used by transmitter in J6181.

If not needing the FM TX it could be possible remove whole component and replace it with compass.

==Gyroscope==

The forthcoming invensense [http://invensense.com/mems/gyro/itg3200.html itg3200] is a gyroscope chip that could similarly be connected to a I2C bus.

==UART to I2C bridge==

There is also available some bridge chips [http://ics.nxp.com/products/bridges/uart.i2c.master.gpio/ UARTtoI2C] that can be used over UART. Most likely UART pins can be found in debug ports.

==MMC card==

The MMC controller pins are convertable to GPIO pins. See page 3 top-left of [[N900 Hardware Schematic]], and page 691 of spruf98.pdf.
This means that there are 6 available easily contactable GPIO pins, static protected. (see same page of schematic) along with a 3.3V possibly variable power supply.

==Debug ports==

Under the battery are several groups of test pad connectors.
With the camera on the left, and the battery removed.
These are numbered for the purposes of this page clockwise, with pad 1 of a connector at its top left.

Probable connections are anything that will enable full tests and bootstrap of of the phone without a case.

Obvious candidates are [http://en.wikipedia.org/wiki/JTAG JTAG] for flashing any bootloader, and USB for flashing the device.
Serial ports, I2C, SPI are also possible.

The third serial port is reportedly connected to these ports, so it is accessible.

* J1 - 2 pad connector to the middle left above the battery connector.
* J2 14 pad connector in two parts.
** (a) - 6 pad connector.
** (b) - 8 pad connector
* J3 - 7 pads.
* J4 - 7 pads.

Here are the pad names from the [http://wiki.maemo.org/N900_Hardware_Schematic schematic] linked in the resources section, using same logic for "+" vs "o"

<pre>
+ J5301
+ J5300

J2000 J2060
J2062 + o o o o o o
o o oTX o o o + J2061

J5602 J3109 J3111 J3113 J3115
o o o o + + + +
o o o + + +
J3110 J3112 J3114
</pre>

TX ~2.6V
The plus-sign (supposedly) signifies invidual pad and group of lowercase "o" pads is a port (or something).

According to my measurements with DMM (Digital [http://en.wikipedia.org/wiki/Multimeter Multi Meter]) the following pads are [http://en.wikipedia.org/wiki/Ground_(electricity)#Electronics ground] (counting from top-left and always going left-to-right in case of group of pads): first of J2000, last of J2060, first of J5602 and J3115.

Based on quick reading (and copious use of search) of the [http://wiki.maemo.org/N900_Hardware_Schematic schematic] did not reveal where these pads might actually be connected to.

==Modifications==

===USB===

Further details can be found in the [[N900_Hardware_USB|USB on the N900]] page.

==Resources==

* N900 Service Manual - Level 1&2: [http://www.mediafire.com/?ndmjylkj4wk MediaFire] or [http://maemoworld.org/wp-content/uploads/2009/12/Nokia_N900_RX-51_Service_Manual_Service_Level_1_2 Maemoworld]
* N900 Service Manual - Level 3&4: [http://torrentpump.com/download/n900-rx-51-sm-l3-4-pdf-5228583 Torrent], [http://rghost.net/679258 rghost] or [http://rs768.rapidshare.com/files/314490131/N900_RX-51_SM_L3_4.pdf RapidShare]
* [[N900 Hardware Schematic]]
* A teardown with [http://techblog.gr/mobile/nokia-n900-teardown-08635/ some pics] from Greece, and a video of reassembly.
* Dissasembly [http://www.engadget.com/2009/12/04/nokia-n900-teardown-reveals-smartphone-semantics/ video] from tehkseven.

==Vendors==

* [http://www.tessco.com/products/bmd/listItemsForSelectedCategory.do?bmdTypeId=007_26&mfgName=007_26_NOKIA&modelId=785585&groupSubgroupId=SHOW_ALL Tessco] had a variety of n900 parts. Note that they sold Tessco Nokia parts [http://www.tessco.com/yts/faq/faq/faq_28.html only to Authorized Service Centers]. (they currently do not and have stopped listing parts for Nokia phones.)
* As always - [http://shop.ebay.co.uk/pid-handy-fit/m.html?_nkw=n900 ebay] - this vendor has at the moment a stock of screens and various other original parts.

[[Category:N900]]
[[Category:N900 Hardware]]