[Replicant] Replicant on Nexus One

[Simon Shields]

Hi,

On 23 January 2018 at 18:47, Simon Josefsson <simon at josefsson.org> wrote:
> Kurtis Hanna <kurtis at riseup.net> writes:
>
>>> Jeremy_Rand[m]: [...] most dumbphones haven't been audited
>>> for the ability of the carrier to remotely turn on the microphone, and
>>> we know from court documents that this capability exists on a lot of
>>> phones.  Most Replicant supported phones have been audited for such
>>> capability, and found not to have it.
>>
>>> Jookia: Jeremy_Rand[m]: i don't think they've been audited have they
>>
>>> Jookia: if you look at the block diagram/schematics of the i9100 you
>>> can see the microphone is connected to the modem for instance
>>
>>> Jeremy_Rand[m]: Jookia: is the mic connected to the modem on the S2?
>>> Wasn't aware of that, link please?  AFAIK the Replicant devs have looked
>>> at most of the supported phones and discarded any models that obviously
>>> fail a cursory audit.  The audits definitely aren't as thorough as we'd
>>> like though.
>>
>>> Jookia: Jeremy_Rand[m]: https://files.catbox.moe/fnzqss.png see
>>> Jookia: AUDIO block containing SPEECH_PCM connects directly to the
>>> codec and ports, bypassing the CPU
>>
>>> Jookia:
>>> https://i.pinimg.com/originals/b4/33/db/b433db446415bc7cb2c238c563748556.jpg
>>> looks like the mic is wired to the modem in the galaxy s3
>>> Jeremy_Rand[m]: Jookia: out of curiosity, is that modem/mic info
>>> documented on the Replicant wiki?  Seems like it'd be important to add
>>> to one of the research pages if not already there
>>
>>> Jeremy_Rand[m]: Jookia: unfortunately most of the audits I mentioned
>>> are not publicly documented, it's research that (AFAIK) Paul did, and
>>> then never completely wrote down publicly.  Or maybe he did and I just
>>> never noticed them?
>>
>> I'm curious, does nonfree software (via the modem) control the
>> microphone on the S2 and S3, or not?

I found a schematic for the i9300 online - with some choice keywords
and "filetype:pdf",
I'm sure anyone could ;-). It indicates that the "2MIC" (which is an
Audience EarSmart ES305B[0])
has both I2C, reset and PCM lines wired directly to the modem.

However, the microphones themselves appear to be attached to the WM1811 codec
(and Audience's "sample use" diagrams suggest that the ES305B doesn't
support receiving
microphone input directly[1]. "MAIN_MIC" (main mic), "SUB_MIC"
(secondary mic), and
"EAR_MIC" (headset mic, if present) are all connected to the
WM1811[2], which is controlled by the
SoC, rather than the modem. It seems that the WM1811's microphone inputs can be
disabled using the INxL/INxR_EN registers (documented at the bottom of
page 43 in [2]).
On I9300, IN1L is the main mic, IN1R is the secondary mic, IN2L is the
mic attached to the
plugged-in headset, and IN2R is either the third mic or (if it's
enabled) the FM radio.


>
> I don't know.  Another interesting question is whether there is any way
> to notice whether the modem does anything unwanted with the microphone?

The WM1811 supports disabling any PCM communication with the modem by disabling
all the AIF2 controls (documented at the top of page 169 in [2]).

[0]: http://web.archive.org/web/20130505161256/http://audience.com/products/our-processors/es305
[1]: http://web.archive.org/web/20130503043138/http://www.audience.com:80/pdf/Audience_eS305.pdf
[2]: https://d3uzseaevmutz1.cloudfront.net/pubs/proDatasheet/WM1811G_v4.1.pdf
>
> /Simon

Note - this is just my interpretation from a brief look at the datasheet for the
WM1811 and the schematic. It's entirely possible I've gotten some of
the details wrong,
and I'm not sure what the side effects of disabling AIF2 on the WM1811
would be -
but hopefully this helps clear things up a bit :)

Cheers,
Simon