From eLinux.org
Jump to: navigation, search


The Nokia N950 is a Linux based smartphone from Nokia, which has been released in July 2011 as developer device. N9 is pretty similar.

Custom Kernel Trees


Basic support like booting, serial console and MMC works with right config. There are patches for video. Without right drivers, battery discharges even when connected to computer by USB (and empty battery is problem on N950; but there's flasher trick to unbrick the system).

Kernel Status

This table represents the mainline kernel status. It's expected, that features marked as missing are available in the N950 specific kernel tree from Nokia. The Hardware column contains the Chip/IP-Core name and Description is a human readable description for the hardware (as short as possible). The Docs column describes the documentation status and, if available, a link to the datasheet. The driver column gives the current driver status (green = available in mainline, yellow + link = patch on mailinglists, yellow + ? = status unknown, red = not available in mainline) and the DT column gives the current device tree file status (entry in arch/arm/boot/omap3-n950.dts) with the same color usage. Last but not least the FW column gives hints about any required firmwares.

Hardware Description Docs Driver DT FW
OMAP3630 SoC OMAP3630 TRM Yes Yes N/A
↳ Cortex A8 CPU ARM infocenter Yes Yes N/A
↪ Cortex A8 - 1GHz Support CPU N/A Yes v4.7-rc1 N/A
↳ PowerVR SGX530 GPU No No No N/A
↳ TMS320C64x DSP datasheet No No N/A
↳ ISP Image Signal Processor see OMAP3630 TRM Yes Yes N/A
↳ MUSB USB Interface see OMAP3630 TRM Yes Yes N/A
Memory (1GB) - - Yes N/A
GPMC OneNAND Storage (512MB) Code Yes Yes N/A
eMMC Storage (8GB) N/A Yes Yes N/A
TWL5031 Analog Companion Chip Code Yes Yes N/A
↳ Audio Audio Codec Code Yes No N/A
↳ Vibrator Vibrator Code Yes v4.7-rc1 N/A
↳ Keypad QWERTY Keyboard Code Yes v4.7-rc1 N/A
AU Optronics H397VN01 (AKA Nokia Himalaya) 4" FWVGA TFT (MIPI DSI) Code PATCHv1 (2016-03-08) N/A
Atmel mXT Capacitive Touchscreen Code Yes No RM-680_Himalaya_AUO_V1_1.raw
BQ24153A Battery Charging (6b@i2c-2) ti.com, talk.maemo.org Yes No N/A
bq27521 / sn27521 Battery fuel gauge (55@i2c-2) see below Patch for 4.13/14 No N/A
LP5523 LED Code Yes No N/A
lis3lv02 Accelerometer Code Yes v4.7-rc1 N/A
ak8974 Magnetometer Code v4.8 No N/A
bh1770glc Proximity + Ambient Light Sensor Code no DT support, misc instead of iio No N/A
tlv320dac33 stereo audio DAC ti.com Yes No N/A
tpa6130a2 headphone amplifier ti.com Yes No N/A
gpio-keys keypad slider switch N/A Yes v4.7-rc1 N/A
debug leds cpu idle/sleep status leds N/A Yes v4.7-rc1 N/A
HSI/SSI bus used by modem Code 4.6-rc1 4.6-rc1 N/A
↳ Rapuyama GSM/UMTS modem Code 4.6-rc1 4.6-rc1 N/A
Broadcom BCM4751 GPS Code No No N/A
wl1273 WLAN IEEE 802.11 a/b/g/n Code Yes 4.6-rc1 linux-firmware.git
↳ bluetooth Bluetooth (nokia-h4p) Code 4.12 merproject.org/nemo
↳ radio FM radio Code Yes No merproject.org/nemo
Toshiba HES7 (SMIA compatible) Main Camera (12 MP) Code Yes <4.13 N/A
AS3645A Flash Torch (I2C) AMS.com <4.13 4.14 N/A
AD58xx Autofocus (I2C) Code <4.13 No N/A
Nokia SMIA VGA Front Camera (VGA) Code Yes Yes N/A

Battery fuel gauge

The bq27521/sn27521 seems to be a bq27xxx series chip specially manufactured for Nokia devices. In opposit to other devices from the same series it does not measure the battery's state of charge. This is done in software with a battery discharge profile.

sn27521 register map

More information about the chip, including test commands, is at https://ruedigergad.com/2012/06/03/nemomer-vs-battery-status-vs-n9n950/ .

Rev. 13 and Rev. 14 can be distinguished via the device info register, which should have 0x21 in its upper byte.

Offset Rev. 13 Offset Rev. 14 Description Unit
0x00 0x02 Control bit 6 = reset clear, bit 7 = reset, bit 8 = current interrupt enable
0x02 0x04 Config 1 -
0x04 0x06 Config 2 -
0x06 0x08 Status bit 6 = reset event, bit 7 = busy event, bit 8 = current event
0x08 0x0a Temperature 1/10 Kelvin
0x0a 0x0c Voltage mV
0x0c 0x0e Current mA
0x0e 0x10 Avg. Current mA
0x10 0x12 accumulated current [upper] mAs
0x12 0x14 accumulated current [lower] mAs
0x24 0x26 current limit mA
0x26 0x28 current hys mA
0x32 0x34 device info -
0x34 0x36 fw revision -
0x62 0x62 read-only boot low threshold mV
0x64 0x64 read-only boot always mV
0x66 0x66 read-only boot limit mV

BL-4D Information

  • max. allowed current: 750 mA
  • max. voltage: 4200 mV
  • high voltage: 4179 mV
  • low voltage: 3640 mV
  • nominal capacity: 1200 mAh
  • internal resistance: 140 mOhm

open-circuit voltage curve

Voltage (mV) SoC (mAh)
3136 0
3190 17
3244 70
3287 130
3335 193
3383 265
3431 346
3477 440
3521 523
3566 596
3611 797
3653 998
3694 1070
3736 1185
3774 1200
3810 1211
3851 1220
3892 1226
3933 1232
3974 1237
4015 1241
4056 1245
4097 1247
4138 1250
4159 1251


The kernel driver only forwards MEIF encoded data from userspace to the device. The protocol itself was implemented in userspace. [this page] works on reverse engineering the protocol.

Running upstream kernel on N950

A work in progress guide using Debian as the example operating system. First, make sure to turn off the watchdogs

sudo 0xFFFF -F no-omap-wd,no-ext-wd,no-lifeguard-reset

Then flash Ubiboot and bootstrap a Debian system, as described here.

Currently the armmp kernel doesn't work, this guide will be updated.

Booting custom kernels

Run your kernels with something like:

  1. power off your phone

sudo ../maemo/0xffff/src/0xFFFF -l -m kernel:arch/arm/boot/$IMG -b

  1. plug in the phone.

Your usually get an error here:

Waiting for ASIC ID... Error: Invalid size of ASIC ID Error: Reading ASIC ID failed Error: No device detected ^C

Hit ^c, and restart 0xFFFF. You should get

Sending image...

 100% [#################################################################]



You should get /!\ Warning! screen now. Some bootloader versions way for ~10 seconds, some don't. Some bootloader versions power off immediately if you attempt to supply command line arguments.

Watch the screen. It will go dark. If it blinks, it is a good sign. You may want to check with flashlight, maybe there's almost invisible text there.

Ignore the notification LED. It seems to blink even without kernel involvement.

Keyboard "debug enabled" LED can be used for debugging.