Privacy question - is GPS active with phone powered off?

[Zebulon Walton]

A privacy question but hardware-related: Is GPS tracking of the Pinephone still active if it is turned off and no other action is taken (battery left in place)? Or is it necessary to remove the battery and/or turn off the DIP switch to disable the GPS?

[marcih]

If you can read schematics, you can take a look at the phone schematics, the GPS component is part of the modem. I tried opening up the schematics of the revision that I have and had no idea what I was looking at beyond the basic block diagram and the power tree.

All I could gather is that the modem and WiFi modules are powered by the battery directly and bypass the AXP803 chip, which powers all the other components and takes care of battery charging. The fact that the modem is connected via USB (which means there's nobody to listen to it since the CPU would be powered down) doesn't make a difference I don't think, I imagine that as long it gets power it can still connect to a satellite and report your location (the Quectel modem's firmware is a full Linux distro!).

[Zebulon Walton]

Thanks, it sounds then like removing the battery (or turning off the switch) is necessary to be sure GPS is inactive. Probably easier to remove the battery. Normally I leave the phone off unless I need to use it.

[bcnaz]

There was some lengthy discussion about the Pine phone GPS software here on the forum just 2 or 3 months back
That you may find that interesting.

[Zebulon Walton]

There was some lengthy discussion about the Pine phone GPS software here on the forum just 2 or 3 months back
    That you may find that interesting.

Was it in this hardware forum or one of the other Pinephone forums?

[wibble]

It crops up all over from time to time so using the forum search is probably easiest.

From the privacy/location perspective the cell part of the modem is probably as much of an issue as the GPS anyway. See the 3GPP specs for details - there's all sorts of stuff in there that you probably wouldn't think your cell provider ought to know about your phone.
https://www.3gpp.org/specifications/

[bokomaru]

Is GPS tracking of the Pinephone still active if it is turned off and no other action is taken (battery left in place)? Or is it necessary to remove the battery and/or turn off the DIP switch to disable the GPS?

I want to say the modem actually isn't powered while the PinePhone is turned off.

If you can read schematics

I tried. :-)

Can't say if I'm right, but somebody could verify this with a multimeter. I have an idea for that at the end of this post.

Schematics are here. I'm looking at "PinePhone v1.2b Released Schematic.pdf". Datasheets here, where you can find the Allwinner A64 SoC datasheet, "A64_Datasheet_V1.1.pdf".

Page 6 is the "Power" page. It has the battery connector J600, and the positive battery terminal goes to VBAT. VBAT basically just goes through a resistor and connects to 4G-VBAT.

Page 15 is the "Modem 4G" page. Like @marcih says, the GPS functionality is provided by the cell modem, the EG25-G, which is U1500.

The modem killswitch is SW1-A. Pretty sure in the "off" position, the switch is open.

The "baseband" and "RF" power to the modem are provided by VBAT_BB, which isn't the same signal as VBAT. The connection goes like

VBAT -> 4G-VBAT -> VBAT_BB.

But for power to go from 4G-VBAT to VBAT_BB, the transistor Q1500 has to be "on".

I _think_ that Q1500 would by default be "off". To turn it on, _another_ transistor Q1501 has to be "on". Why? I think there's a lot of power going through Q1500. I guess it requires two levels of gates. Ask a hardware developer.

I _think_ that Q1501 is also "off" by default. To turn it on, I think two conditions need to happen. 1) SW1-A must be on. 2) PL7-4G-PWR-BAT must be "high".

Page 5 is the "CPU" page. PL7-4G-PWR-BAT is an output from the Allwinner SoC, the main processor chip, U1. While the Allwinner SoC is powered off, PL7-4G-PWR-BAT should be at "high impedance" with no pull up/down. Meaning this signal is basically connected to nothing. Importantly, it's not driven "high".

Putting it together: To me, this means, when the PinePhone is off... regardless of the position of SW1-A... Q1501 is off, so Q1500 is off, so the modem's power supply VBAT_BB isn't connected to the battery.

To verify: Take apart a PinePhone. Maybe just need to remove the second plastic cover with the screws in it? The modem is already visible after popping off the first cover, you just can't see the pins under the second cover. Now, with the phone powered on and the modem enabled, check the voltage of the VBAT_BB and VBAT_RF pins with a multimeter, confirming that you see like 3 V or 4 V or something. Now power the phone off and check again. It's either on or it's off, right? Then we'll really know.

There's a "Quectel_EG25-G_Hardware_Design_V1.2.pdf" document on the net somewhere which shows VBAT_BB and VBAT_RF as pins 57, 58, 59, 60. Looking at a picture of the mainboard, I can see those pins are exposed. Just have to count them, and I don't think it's even a problem if you use too big a probe with shaky hands and short any of pins 57 through 60 together. They're all connected together anyways on the mainboard. You wouldn't want to short those out to something else though, like the modem's metal case, which I'm going to say is probably grounded :-P

[bokomaru]

I want to say the modem actually isn't powered while the PinePhone is turned off.

Confirmed.

Can't say if I'm right, but somebody could verify this with a multimeter.

I did it.

So I must've read the schematics well enough to come up with the correct conclusion here.

To verify: Take apart a PinePhone. Maybe just need to remove the second plastic cover with the screws in it?

Nope! Those pins aren't exposed, even if it looked like they were in a photo. I even took the metal cover off the modem, no good. Here's what I did instead...

I tore apart a PinePhone. Had to unplug all the connectors and remove the mainboard, then remove the big metal plate covering up everything on the back side.

I identified some big components in the schematics which connect to VBAT_BB. I picked C1502 and C1506. I found those in the "PinePhone mainboard bottom placement v1.1" drawing. C1502 and C1506 are the big capacitors right next to the battery connector.

Obviously, it's not as easy to power up this mainboard without the rest of the phone attached. But it's easy enough for me to just hold the battery terminals up to the battery connector. So that's what I did.

To confirm battery contact, I measured the voltage between ground and the VBAT test point next to the battery connector (other side on the front face). I got around 4.1 V, since my battery was mostly full.

Now, without the battery connected, I used my multimeter's "connectivity" function across each of those big capacitors to give them a little charge. I switched back to voltage measurement mode and verified that I could read almost 1.0 V before the capacitor discharged through my multimeter. Cool, so I've confirmed that if the capacitors are charged, I'll be able see it.

Next, I repeated the "connectivity" test, but before measuring the voltage across the capacitors, I attached the battery. The voltage is 0.0 V. This implies that not only is the modem not being powered, but its VBAT_BB is actually grounded I guess.

Repeated this test while the modem killswitch was in the "on" position. Same result.

It's either on or it's off, right? Then we'll really know.

It's off.

Hope that gives everyone some confidence. If you would like me to measure something else, ask me before I put this thing back together. :-)

Even better, I hope someone else tries it too. Don't just take my word for it. ;-)

---

Why? I think there's a lot of power going through Q1500. I guess it requires two levels of gates. Ask a hardware developer.

Nah, it's probably an inverter. So for PL7-4G-PWR-BAT, "high" means "on". With only one transistor there, "low" would mean "on".