PineModems

Modems used in Pine64 boards and devices

Quectel EG25-G Modem

Quectel EG25-G is an LTE Cat 4 module optimized specially for M2M and IoT applications. It is used in the PinePhone.

• Specifications:
  File:Quectel EG25-G LTE Standard Specification V1.3.pdf
• Hardware design:
  File:Quectel EG25-G Hardware Design V1.4.pdf
• AT Interface reference manual:
  • 1.3 for EC25:
    File:Quectel EC25&EC21 AT Commands Manual V1.3.pdf
  • 2.0 for EC25 and EG25-G:
    File:Quectel EC2x&EG9x&EG2x-G&EM05 Series AT Commands Manual V2.0.pdf
• AT Interface file operations:
  File:Quectel EC2xEG25-GEG9xEM05 FILE AT Commands Manual V1.0.pdf
• GNSS Application note:
  File:Quectel EC2x&EG9x&EG2x-G&EM05 Series GNSS Application Note V1.3.pdf

Specifications

Processor Family	Qualcomm MDM9607
CPU	Qualcomm MDM9207
Cores	1 ACPU Core, Qualcomm Hexagon DSP
Total RAM	256Mb
Total flash space	256Mb
Available RAM for the ACPU	160Mb

NAND Partition table layout

Index	Name	Description
MTD0	SBL	Secondary Bootloader, called from the BootROM. Used to start the TrustZone kernel and the Application Bootloader (LK). Also used to enter Quectel's recovery mode
MTD1	mibib	NAND Partition table
MTD2	EFS2	IMEI and settings used by the ADSP are stored here
MTD3	sys_rev	Unexplored
MTD4	rawdata	This is where FOTA update data exists before being commited to system or recoveryfs partitions
MTD5	tz	TrustZone kernel
MTD6	rpm	Resource / Power Manager
MTD7	cust_info	Unexplored
MTD8	aboot	Application Bootloader. Uses LK (LittleKernel, LK embedded kernel) as the bootloader. By default it allows flashing unsigned images but won't allow booting them, soft-bricking the modem until you enter EDL mode
MTD9	boot	OpenEmbedded boot kernel + DTB
MTD10	recovery	Recovery kernel (used for FOTA updates)
MTD11	modem	ADSP firmware blobs
MTD12	misc	Some settings are stored here, along with commands that need to be picked by LK on next boot (to reboot to fastboot or recovery mode)
MTD13	recoveryfs	Recovery filesystem image (FOTA updates)
MTD14	usr_data	User data partition (/data when mounted by OpenEmbedded)
MTD15	sec	Used to blow fuses in the mdm9207 from images generated by Qualcomm Sectools
MTD16	system	Linux OpenEmbedded root image, formatted in UBIFS (Unsorted Block Image File System, Wikipedia)

Firmware Recovery

Warning: The following instructions are directed towards expert-level users and developers!

The System partition is mounted as read-only mode, but the data partition is writable. It might be possible, if there's an unexpected reset or power is lost while running, that the data partition gets corrupt and thus unable to boot.

PinePhone USB_BOOT test points

The modem has 4 different boot modes:

• Normal boot
• Recovery mode (used by the modem usually to install a FOTA update)
• Fastboot mode
• Qualcomm EDL Mode

If the modem is unable to boot, depending on the type of crash, it might:

• not show anywhere (USB device missing)
• or malfunction (no radio but USB working)
• or enter EDL mode, if the entire flash is corrupt.

Boot the device in EDL mode

To check if the device is booted in EDL mode, run lsusb (a part of the usbutils package) in a terminal and inspect the output. You should see the following device listed:

Bus 003 Device 003: ID 05c6:9008 Qualcomm, Inc. Gobi Wireless Modem (QDL mode)

In any scenario, the modem can be triggered to enter EDL mode by shorting two test pins on the PinePhone motherboard.

1. Power off the phone
2. short the two test points
3. boot the phone while keeping the test points shorted until fully booted up, at least until you hear the camera clicking twice (which is normally when the modem is powered).

Get the Firmware Recovery Package

The Firmware Recovery Package is at: https://github.com/Biktorgj/quectel_eg25_recovery

Either clone its repo with git, or download its archive & unzip it.

As you should have no access to the Internet on PinePhone when its modem need a Recovery, you can fetch it on other devices and copy it to the Pinephone.

Execute the Quectel QFirehose utility

Once in EDL mode, open a terminal, navigate to the root directory of the recovery package, and run:

• If you use an ARM64 distribution (most likely): sudo ./qfirehose -f ./ or sudo ./qfirehose_arm64 -f ./
• If you use an ARMHF (32 bit) distribution: sudo ./qfirehose_armhf -f ./

It will reboot the modem after finished. After about 30 seconds, it will get back up and running. To check the firmware version after that, use an AT command AT+QGMR like at PinePhone#Firmware_update.

Bootloader unlocking

Warning: The following instructions are directed towards expert-level users and developers!

The Modem has a locked bootloader. It won't allow to boot unsigned Kernel images, but will allow to flash them, making it easy to brick the modem. To fix this, you can flash an unlocked bootloader, which will then allow you to do as you please with the hardware.

Unlocked bootloader:

• Source code: https://github.com/Biktorgj/quectel_lk
• Prebuilt binary releases: https://github.com/Biktorgj/quectel_lk/releases

Custom Kernels and system images

Warning: The following instructions are directed towards expert-level users and developers!

Custom kernel builds and system images can be created for the modem, though they require a couple of things to be correctly built and be bootable.

• The source code release for the kernel provided by the manufacturer is incomplete and won't build
• Common Android tools like mkbootimg and dtbtool won't build a bootable image, even if the kernel is correctly compiled and all the DTBs attached.
• Further, there's no source for the OpenEmbedded parts, so building a new system image must be done from scratch, and retrieving the mandatory binary blobs to use the ADSP part of the modem.

There's a work in progress SDK to allow creating custom kernels and system images, which can be downloaded from the following repository: https://github.com/Biktorgj/pinephone_modem_sdk

See its readme for infomations and instructions. Once downloaded, you should run the init.sh script, which will create all the base directories and download all the different repositories required to build. After the initial setup is complete, runmake without arguments to list the available options.