Difference between revisions of "PinePhone v1.1 - Braveheart"
(Add info about modem I2C issue) |
(Note AT+QIIC) |
||
Line 47: | Line 47: | ||
=== Modem has access to sensors on I2C1 === | === Modem has access to sensors on I2C1 === | ||
The modem is a master on the I2C1 bus. A malicious firmware on the modem would be able to read the phone's gravity/light/proximity sensors and prevent the main Linux OS from reading them. | The modem is a master on the I2C1 bus. A malicious firmware on the modem would be able to read the phone's gravity/light/proximity sensors and prevent the main Linux OS from reading them. The [https://www.quectel.com/UploadImage/Downlad/Quectel_WCDMA<E_Audio_Design_Note_V1.1.pdf modem's audio design note] describes the <tt>AT+QIIC</tt> command which can be used to read and write registers on I2C devices. | ||
According to the modem documentation, its I2C interface is only used for direct connection to a standalone audio codec. On the PinePhone, since the modem's audio is routed through the A64 SoC, the modem's I2C interface has no legitimate use. | According to the modem documentation, its I2C interface is only used for direct connection to a standalone audio codec. On the PinePhone, since the modem's audio is routed through the A64 SoC, the modem's I2C interface has no legitimate use. | ||
The modem's I2C interface should be left floating. U1503 pins A1, A2, B1, and B2 can be disconnected, and R1527/R1528 can be removed. | The modem's I2C interface should be left floating. U1503 pins A1, A2, B1, and B2 can be disconnected, and R1527/R1528 can be removed. |
Revision as of 19:02, 12 January 2020
The PinePhone v1.1 "Braveheart" is a hardware revision of the PinePhone due to ship in January 2020.
This page contains resources which are exclusive to the 1.1 revision of the PinePhone. For other revisions, or for resources related to all PinePhone revisions, see PinePhone.
Schematic
Changes from 1.0
Braveheart is slightly different from the 1.0 revision of the Pinephone. These differences should not require creating different images.
- Added CPU shielding and cover plate
- Swap PC3 to FLASH_EN and PD24 to FLASH_TRIGOUT, where previously they were reversed
- Add pulldown resistor on PD24 (FLASH_TRIGOUT) so the flash LED does not light on boot
- Connect WiFi enable to VD33
- Set the EG25G's PWRKEY on by default (see resistor R1526)
- Add R630 resistor location, populate with 0K by default. Allows adjusting to different battery thermistors in case this is not possible in software.
- Add voltage shift to Pogo pins I2C-CLK, I2C-DATA, and INT. The Pogo Pin specified voltage is 3.3v while the A64's I2C is 2.8V.
Known issues
This section lists problems known on the 1.1 revision hardware, possibly because they carried over from the 1.0 revision.
AXP803 does not disable USB power input while driving USB OTG
The AXP803's N_VBUSEN/DRIVEVBUS input, labeled USB-DRVVBUS on the schematic, is not connected to the USB OTG boost regulator enable input, because R1300 is marked "NC". This prevents the AXP803 from automatically detecting when the USB port is being powered from the battery. It continues to draw power from the USB port, and this doubles the drain on the battery (since the whole phone is being powered by the USB OTG boost regulator).
This would be fixed by populating R1300.
There is a possible (but less reliable) software workaround.
Modem Ring Indicator placement is not ideal
The EG25G's Ring Indicator pin is currently routed to GPIO pin PB2.
Ring Indicator is a configurable signaling pin capable of notifying the modem's host of incoming messages or calls. This makes it important to read the status of the pin during (ARISC / Super Standby) sleep, since incoming calls or text messages must wake the device.
Using the PB bank of GPIO on the A64 requires VCC-IO to be switched on. The only bank that does not have this requirement is the PL bank, at least as far as we can tell. Using information from the (related) A83T's manual:
"In the super standby mode,GPIO B/C/D/E/F/G/H of VDD_SYS domain can hold a particular output state through GPIO pad hold function,but VCC power of GPIO can not be closed at this time"
Ideally, Ring Indicator would be routed to somewhere on the PL bank because it stays active even when VCC-IO is switched off. In the current form, VCC-IO must stay on in Super Standby to allow the use of the Ring Indicator. The power usage difference between VCC-IO off and on is currently unknown, however, since crust is not able to disable peripherals or clock trees.
Re-routing Ring Indicator would require a new Device Tree for the system, so different images may need to be created.
Modem has access to sensors on I2C1
The modem is a master on the I2C1 bus. A malicious firmware on the modem would be able to read the phone's gravity/light/proximity sensors and prevent the main Linux OS from reading them. The modem's audio design note describes the AT+QIIC command which can be used to read and write registers on I2C devices.
According to the modem documentation, its I2C interface is only used for direct connection to a standalone audio codec. On the PinePhone, since the modem's audio is routed through the A64 SoC, the modem's I2C interface has no legitimate use.
The modem's I2C interface should be left floating. U1503 pins A1, A2, B1, and B2 can be disconnected, and R1527/R1528 can be removed.