N900 Hardware Hacking - Revision history

joerg_rw: /* Debug ports */ latest R&D on testpads

2017-03-08T14:39:41Z

Debug ports: latest R&D on testpads

← Older revision		Revision as of 14:39, 8 March 2017
Line 84:		Line 84:
	{{ambox		{{ambox
	\|type=delete		\|type=delete
-	\|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)	+	\|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)<br>
		+
		+	Pin number: AH8, name: etk_d15/sdti_txd3 (serial data out, system trace messages); power domain: vdds 1.8V [http://neo900.org/stuff/joerg/random-media/UART-console-pin/DSCF2376.JPG]<br>voltage level actually seen is a miracle
	}}		}}
	J2000		J2000

joerg_rw: /* Debug ports */ fixed anouther 1.8

2016-04-09T05:07:17Z

Debug ports: fixed anouther 1.8

← Older revision		Revision as of 05:07, 9 April 2016
Line 91:		Line 91:
	pin 3 :: USB VBUS 5V		pin 3 :: USB VBUS 5V
	pin 4 :: <unknown>		pin 4 :: <unknown>
-	pin 5 :: TX (confirmed by jacekowski ([[N900 Hardware Hacking/serial dump\|115200 8-N-1]] ~2.6 V ~~(NO, prolly ONE dot 8!!)~~ , connected to 1st UART in omap - <code>/dev/ttyS0</code> in Linux), and r00t (see below))	+	pin 5 :: TX (confirmed by jacekowski ([[N900 Hardware Hacking/serial dump\|115200 8-N-1]] ~2.6 V, connected to 1st UART in omap via some mysterious levelshifter - <code>/dev/ttyS0</code> in Linux), and r00t (see below))

joerg_rw: /* Debug ports */ indeed 2.8Volt despite UART is 1.8V - hidden levelshifter?

2016-04-09T04:51:55Z

Debug ports: indeed 2.8Volt despite UART is 1.8V - hidden levelshifter?

← Older revision		Revision as of 04:51, 9 April 2016
Line 84:		Line 84:
	{{ambox		{{ambox
	\|type=delete		\|type=delete
-	\|text=The serial port is NO RS232, it's a low-voltage direct UART IO from OMAP SoC. It's specified for 1.8V (ONE dot 8) and even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level)	+	\|text=The serial port is NO RS232, it's a low-voltage direct UART IO <s>from OMAP SoC. It's specified for 1.8V (ONE dot 8) and</s> even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here ''are confirmed - yet to get investigated how this level shift gets accomplished'' <s>might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level</s>)
	}}		}}
	J2000		J2000

joerg_rw: /* Debug ports */ more

2014-09-11T20:51:03Z

Debug ports: more

← Older revision		Revision as of 20:51, 11 September 2014
Line 87:		Line 87:
	}}		}}
	J2000		J2000
-	pin 1 :: GND	+	pin 1 :: GND (MIDDLE upper point, right to J2062 !)
	pin 2 :: RX, according to r00t		pin 2 :: RX, according to r00t
	pin 3 :: USB VBUS 5V		pin 3 :: USB VBUS 5V

joerg_rw: /* Debug ports */ further adjustments

2014-09-11T20:48:15Z

Debug ports: further adjustments

← Older revision		Revision as of 20:48, 11 September 2014
Line 98:		Line 98:
	+ J5300		+ J5300

-	J2000 J2060	+	J2000 J2060
-	J2062 + GND RX 1 o o 4	+	J2062 + GND RX 1 o o 4
-	5V o TX 5 o 7 + J2061	+	5V o TX 5 o 7 + J2061

	J5602 J3109 J3111 J3113 J3115		J5602 J3109 J3111 J3113 J3115

joerg_rw: /* Debug ports */ adjusted the "graphics"

2014-09-11T20:43:17Z

Debug ports: adjusted the "graphics"

← Older revision		Revision as of 20:43, 11 September 2014
Line 67:		Line 67:
	J2000 J2060		J2000 J2060
	J2062 + o o o o o o		J2062 + o o o o o o
-	o o o o o o + J2061	+	o o o o o o + J2061

	J5602 J3109 J3111 J3113 J3115		J5602 J3109 J3111 J3113 J3115
-	o o o o + + + +	+	o o o o + + + +
-	o o o + + +	+	o o o + + +
	J3110 J3112 J3114		J3110 J3112 J3114
	</pre>		</pre>
Line 91:		Line 91:
	pin 3 :: USB VBUS 5V		pin 3 :: USB VBUS 5V
	pin 4 :: <unknown>		pin 4 :: <unknown>
-	pin 5 :: TX (confirmed by jacekowski ([[N900 Hardware Hacking/serial dump\|115200 8-N-1]] ~2.6 V, connected to 1st UART in omap - <code>/dev/ttyS0</code> in Linux), and r00t (see below))	+	pin 5 :: TX (confirmed by jacekowski ([[N900 Hardware Hacking/serial dump\|115200 8-N-1]] ~2.6 V (NO, prolly ONE dot 8!!) , connected to 1st UART in omap - <code>/dev/ttyS0</code> in Linux), and r00t (see below))


Line 100:		Line 100:
	J2000 J2060		J2000 J2060
	J2062 + GND RX 1 o o 4		J2062 + GND RX 1 o o 4
-	5V o TX 5 o 7 + J2061	+	5V o TX 5 o 7 + J2061

	J5602 J3109 J3111 J3113 J3115		J5602 J3109 J3111 J3113 J3115
-	1 o o 4 + + + +	+	1 o o 4 + + + +
-	5 o 7 + + +	+	5 o 7 + + +
	J3110 J3112 J3114		J3110 J3112 J3114
	</pre>		</pre>

joerg_rw: /* Debug ports / UART is VIO_18, NOT* 2.8V

2014-09-11T20:16:45Z

Debug ports: UART is VIO_18, *NOT* 2.8V

← Older revision		Revision as of 20:16, 11 September 2014
Line 84:		Line 84:
	{{ambox		{{ambox
	\|type=delete		\|type=delete
-	\|text=The serial port is NO RS232, it's a low-voltage direct UART IO from OMAP SoC. It's specified for 2.8V and even 3.3V seem to destroy it.	+	\|text=The serial port is NO RS232, it's a low-voltage direct UART IO from OMAP SoC. It's specified for 1.8V (ONE dot 8) and even 3.3V seem to destroy it. (the probed 2.7V you see in some pictures here might be from error in probing procedure, I.E. having an implicit pullup on UART output by connecting other end of DMM to Vbat+ instead of GND, thus adding Vfwd of clamp diodes on top of the 1V8 nominal signal level)
	}}		}}
	J2000		J2000

172.56.2.197: /* External antennas */

2014-07-25T23:54:13Z

External antennas

← Older revision		Revision as of 23:54, 25 July 2014
Line 124:		Line 124:
	===External antennas===		===External antennas===

-	On the N900 there are three ''Reverse Polarity'' [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways.	+	On the N900 there are three ''Reverse Polarity'' [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways. As an alternative to the RP Hirose U.FL connectors, the antennas are each attached to two solder points on the bottom of the motherboard, visible as small orange rectangles in the images below.

	The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.		The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.

172.56.2.197: /* External antennas */

2014-07-25T23:49:36Z

External antennas

← Older revision		Revision as of 23:49, 25 July 2014
Line 124:		Line 124:
	===External antennas===		===External antennas===

-	On the N900 there are three ''Reverse Polarity''[http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways.	+	On the N900 there are three ''Reverse Polarity'' [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways.

	The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.		The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.

172.56.2.197: /* External antennas */ Not actuall Hirose U.FL

2014-07-25T23:48:47Z

External antennas: Not actuall Hirose U.FL

← Older revision		Revision as of 23:48, 25 July 2014
Line 124:		Line 124:
	===External antennas===		===External antennas===

-	On the N900 there are three [http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways.	+	On the N900 there are three ''Reverse Polarity''[http://en.wikipedia.org/wiki/Hirose_U.FL Hirose U.FL] connectors. These RP Hirose U.FL connectors were noted as test connectors however with the right equipment attached these can be used to increase the range of the said chips that has such connectors attached, if not to increase range it can be used possibly in other ways.

-	The three chips that ~~has~~ Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.	+	The three chips that have RP Hirose U.FL connectors attached are: GSM, GPS and Bluetooth/Wireless LAN. Note that the Bluetooth/Wireless LAN share the same Hirose U.FL connector.

-	However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's Hirose U.FL connector is the most easily accessible as it is on the underside of the N900's PCB (where one can see those solder pads when the battery is taken out of N900). Access to Bluetooth and Wireless LAN's as well as GPS receiver's Hirose U.FL are on the obverse side of that N900 PCB.	+	However there are some restrictions imposed on accessing these test connectors. The first restriction is that it seems GSM's RP Hirose U.FL connector is the most easily accessible as it is on the underside of the N900's PCB (where one can see those solder pads when the battery is taken out of N900). Access to Bluetooth and Wireless LAN's as well as GPS receiver's RP Hirose U.FL are on the obverse side of that N900 PCB.

	The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly (~50-200 cycles) so that would leave the most appropriate solution is to get an adapter/converter.		The next set of limitation is to find appropriate adapters/converters and possibly attached with a cable as allows the converted adapter's head to be placed in a location where one prefers to have the head placed. Hirose U.FL is noted best to not be used in a manner that one connects and disconnects the cable constantly (~50-200 cycles) so that would leave the most appropriate solution is to get an adapter/converter.

-	~~Most common adapter/converter would be a~~ Hirose U.FL ~~connector~~ -> [http://en.wikipedia.org/wiki/RP-SMA#Reverse_polarity_SMA RP-SMA] ~~as these~~ can be ~~commonly found in various setup~~, ~~furthermore~~ SMA connector itself would have a longer wear than Hirose U.FL ~~itself~~ along with the fact that there are many antennas available in the form of RP-SMA connector form. With the cable attached and if one prefers the connector to be attached to the back of the device, this highlights the issue noted beforehand with the connectors on the obverse side of the device.	+	While Hirose U.FL -> [http://en.wikipedia.org/wiki/RP-SMA#Reverse_polarity_SMA RP-SMA] adapters are commonly available, it is much more difficult to find a ''Reverse Polarity'' Hirose U.FL ->RP-SMA adapter. If one can be obtained, the SMA connector itself would have a longer wear than Hirose U.FL along with the fact that there are many antennas available in the form of RP-SMA connector form. With the cable attached and if one prefers the connector to be attached to the back of the device, this highlights the issue noted beforehand with the connectors on the obverse side of the device.

	Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance.		Also it is worthy to note that the size (in diameter or thickness), grade and length of the cable would also impede on the quality of communication. Too thin of a cable would make the transmitted/received signal be more susceptible to other interference, the same goes with too long for a cable would also make it more susceptible. Too thick of a cable especially if used on the obverse side of the device makes the cable unable to be able to loop around to the other side of the PCB should the owner want the actual head of the connector to be on the same side as the GSM connector for instance.

N900 Hardware Hacking - Revision history

joerg_rw: /* Debug ports */ latest R&D on testpads

joerg_rw: /* Debug ports */ fixed anouther 1.8

joerg_rw: /* Debug ports */ indeed 2.8Volt despite UART is 1.8V - hidden levelshifter?

joerg_rw: /* Debug ports */ more

joerg_rw: /* Debug ports */ further adjustments

joerg_rw: /* Debug ports */ adjusted the "graphics"

joerg_rw: /* Debug ports */ UART is VIO_18, *NOT* 2.8V

172.56.2.197: /* External antennas */

172.56.2.197: /* External antennas */

172.56.2.197: /* External antennas */ Not actuall Hirose U.FL

joerg_rw: /* Debug ports / UART is VIO_18, NOT* 2.8V