The Neo900 Open Smartphone a Platform with New Security Features Neo900.Org
Total Page:16
File Type:pdf, Size:1020Kb
The Neo900 Open Smartphone A platform with new security features neo900.org Werner Almesberger [email protected], J¨orgReisenweber [email protected] The Neo900 project Tired of closed mobile platforms ? Openmoko veterans, still hungry Open hardware Designed for Free Software New security features Inspired by Nokia N900 Linux-friendly platform Active community Has a real keyboard Making a smartphone in three easy steps Electronics (lots of them) Mechanical design (case) User-visible software Smartphone user interface The Openmoko experience: 2007.1: Gaudy, obese, unmaintainable, confusing 2007.2: Lighter, cryptic Let's try something new: Qtopia Let's try something else, too: Android 2008: Enlightenment Post-Openmoko: QtMoko, SHR Lession learned. Let's not do this again. Software evolution (simplified) Nokia Intel Linux Foundation Samsung Maemo Moblin LiMo Bada Nokia+Intel MeeGo Hildon Community Maemo 5 Mer (Fremantle) Intel+Samsung+LF Tizen Community Jolla Nemo Mobile Sailfish OS Software choices Neo900 is a Linux platform. Maemo (Fremantle) Hardware compatibility goal Debian / Devuan Board Support Package Replicant (Android) MeeGo ::: whatever you choose to install or port Hardware evolution Openmoko Golden Delicious Neo900 Nokia Linux Symbian 2006 2007 GTA01 (Neo1973) N800−810 (Tablet) N95 Case, LCD 2008 GTA02 (Freerunner) N96 Case, Maemo 2009 GTA03 N900 (Phone) N97 (Keyboard) 2010 2011 GTA04A3 N9 (no keyboard) 2012 GTA04A4 Know−how 2013 Neo900v0 Influence R&D 2014 Neo900v1 Product Prototype design 2015 GTA04A5 Neo900v2 Reusing the case N900 case is nice Making own would be too expensive N900 case is still available Problem: We need more space Original component heights Modem (PLS8) Top 2.3 mm max. 2.0 mm PCB 0.8 mm max. 1.5−2.0 mm Bottom Solution: Add another board Top max. 2.0 mm UPPER 0.8 mm Modem Board−to−board 2.5 mm +3.3 mm (PLS8) connector LOWER 0.8 mm max. 1.5−2.0 mm Bottom Original mechanical stacking Case bottom Case bottom Display PCB Display opening Keyboard frame Keyboard Dome sheet Keyboard frame Key mat The Spacer Frame Case bottom Spacer frame Display PCBs Display opening Keyboard Spacer frame Key mat Drawing not to scale Your smartphone, in theory Modem Application (GSM, ...) Environment (Linux) Closed Open In practice Modem Application (GSM, ...) Environment (Linux) Closed Open Keep them separated Application Modem Environment (GSM, ...) (Linux) Data Power Closed Open However, ::: Radio Application Modem Environment (GSM, ...) (Linux) Audio Data Power Closed Open Oops ! Radio Application Modem Environment (GSM, ...) (Linux) Audio Data ? Power Closed Open Oops ! Radio ROGUEApplication MODEM Modem NOT DETECTEDEnvironment (GSM, ...) (Linux) Audio Data ? Power Closed Open Sensory deprivation Radio Application Modem Environment (GSM, ...) (Linux) Audio Data STOP Power Closed Open ::: and monitor Radio Application Modem Environment (GSM, ...) (Linux) Audio Data Power Closed Open Just in case ::: Radio Application Modem Environment (GSM, ...) (Linux) Audio Data Power Closed Open Prototype V0/V1 Modem, some switches No CPU Goal: Test mechanical compatibility and modem Produced early in the project Prototype V2 Most components present External CPU (BeagleBoard) Refined mechanical design Goal: Test subsystems Working on this now Prototype V3 Complete system, with CPU Goal: Certification Goal: Finalize design before production Expected around end of 2015 CPU, Neo900 Block Diagram (Work in progress) power (3x) Comp. Modem TX (a) = EMERG_OFF, RING, Modem monitor monitor Connection through PCB contact(s) I2C#2 pcm[4] Modem+Navigation cell PWR_IND, LC_IND, CPU STATUS, 3G_WOE, Junction with branch 2 3 x INA231, TPS22963 PHS8/PLS8−E,US/PXS8 1 CPU MODEM_IGT eMMC (64 GB) GPS/GLONASS Crossing of separate connections VGNSS (b) = rst, clk, io, cd, power, MMC2_{CLK,CMD,DAT[8]} 2 LNA swp (a) 5 3 D+, D−, VBUS N signals on connection/branch ??? uart[4] gps BGM 1034N7 SIM switch N 5 GPS kill blue: I2C bus 10 44 USB PHY PE4259 ALERT, EN (b) 6 ULPI[12], RESETB USB3322 SIM #1 RAM_{CTRL[17],DA[32],AD[19]} 68 MMC#2 13 rst, io, clk, cd, power RAM (1 GB), SF7W006S4E BSP#4 3 int, en, strobe antenna (b) UART#1 USB#1 8 NAND (512 MB) NAND_{CTRL[9],ADDA[16]} 25 Flash LED driver CPU 3 cd 6 2 Flash LEDs SIM #2 I2C#2 data,ctrl CPU 1 KCE00E00CA I2C#2 ADP1653 2 x L130−5780002011001 NFC swp,control 101−00271−82 rst,int I2C#2 TRF7970A, KL16 uSD card MMC1_{CLK, 7 2 I2C#3 Audio, BTFM CPU 2 I2C#3 MMC#1 I2C#3 ST1W008S4B CMD,DAT[4]}, CD B2B UPPER−LOWER 2 cam_d3, CAM_XCLKA 2 x DF40HC(2.5)−60DS−0.4V, 2 x DF40C−60DP−0.4V 1 CAM_B_EN Batt. lid mag. BAT_LID 1 CPU CMOS camera (rear) B2B LOWER−BOB MLX90248ESE 4 CSI_A_B[4] 4 DF9−21P−1V, DF9−21S−1V 5 GHz Cam switch Main cam conn N97 cam, DF37NB−20DS−0.4V conn. 2.4 GHz ??? sdio[6] MMC#3 CAM_CLKB WLAN_{EN,IRQ} 1 WLAN/BT 2 x TS3DS26227 Baro, CSI_B[4] Accel BMX055 BME280 9−Axis CMOS camera (front) LIS302DL Tap uart[4] humidity RF UART#2 RGB.R 4 VS6555AC pcm[4] 1 INT1 (c) INT2/4/5 Diplexer 0R BSP#3 I2C#3 1 ??? BT_EN 1 INT2 (to cam, proxy, ambient) TBD WL1837MODGI (c) INT1/3, DRDY 1 PROXY Reflective switch (proximity) M50−3151042 DPX2012LL85R2455A Hackerbus 1 ALS_INT FM_nINT Ambient light sensor FM TX/RX TSL2563 FM TX I2C#2 LCD_LEDS Backlight LED driver SETCURR1, LCDLEDS_{1,2}, CABC 4 Si4721 CPU Compan Speakers 2 1 TPS61041 17 LCD_{RST,CDP[8],SPI[4]} 17 LCD SPI#3 ACX565AKM−7 FM_ANT FM_AUDIO[4] B2B 2 audio 2 1 4 Main flex connector Resistive Speaker 2 TSC_RST, PEN_INT I2C#2 Touch scrn ctrl X/Y 4 CRTOUCHB10 touch screen amplifier I2S 4 3 audio 2 Stereo NRST[2], RGB_INT, RGB_CTRL_EN audio BSP#2 18 Kbd LEDs RGB TPA2012 1 4 audio codec CODEC_RST 1 6 x MSL0201RGB 2 1 Basic RGB Earpiece 2 x TINY control(s) IR LED LED drivers 3 Privacy EAR 2 RX DM3730CBP IR Logic VSMB2948SL ? SMLP36RGB2W3 Flex IR ? 2 x LP55281 3 1 UART[4] EAR 5000246471 From GTA04A4 3 bias, clk, data 3 UART#3 1 IR sense Mod LEDs 4 LTST−C190KRKT, audio PMIC_INT, I2C#4USB#0 I2C#1 RX VEMD10940F I2C#3 LTST−C190TBKT, Codec From GTA04b7v2 Digital microphones nRESPWRON, Codec 3 LTST−C190KFKT 2 x SPK0415HM4H 4 TLV320AIC34 2 2 1 NCX2200, UART[4] Fancy RGB 6 (pre−reorg) NSLEEP1, Fuel TBD LED driver Aux LEDs ... 1 NX3V1G66 4 3 2 x MSL0201RGB 3 I2C_SR[2] ULPI I2C_CNTL[2] Other origin Mic Itf. 3 line[2], bias I2C#2 12 LP55231 CPU 2 4 VBUS, D+, D−, ID VBUS, D+, D− 3 EMIF02−MIC07F3 Headphone amplifer 5 CHRG_IND Companion 4 Privacy.B Being discussed 2 1 HEADPH_EN LCD_LEDS Batt charger 1 CPU BL Battery (contact) I2C#2 1 USB AB 47590−0001 BQ24297 CPU BSI_HDQ Keep/same TPA6130 2 BKBAT CPU, Compan ECI Mic/TV Backup 1 BTEMP 2 1 ??? TLV1702 TS5A22366 ? battery Add / change Ring switch 1 present "TWL4030" 1 POWERON Fuel gauge CPU GPO 3 1 TVOUT, 2 I2C#2 PAS3225P 3R3113 TPS65950 IR BQ27200 Future development CPU 1 TVOUT_EN TS3A225 2 2 I2C#2 Kbd scan ECI[3] VIBRA_{P,M} CPU Batt. CPU CPU CPU CPU I2C#2CPU I2C#3 CPU 2 TCA8418 mic temp. 1 SCREEN_LCK 1 SLIDE_SW 2 CAM_CAP[2] 1 cam_d11 1 stylus ECI_AD Vibra motor KEYIRQ, RESET 2 2 CPU 18 Compan Slide mag. 3.5 mm 3 Power Lock Capture Cam cover 2 Stylus 2 HEADPH_IND ROW[8], COL[10] 18 sensor CPU CPU Vol +/− EVQ−P42B3M ESE16 MLX90248ESE EVQQ0G03K TMD26713 TMD26713 1 5469246 304−106 2 x EVQ−P42B3M ??? 2016−04−25 20:47:19 −0300 Feature comparison (1/2) N900 ! Neo900 CPU TI OMAP3xxx, 600 MHz ! 1 GHz RAM 256 MB ! 1 GB eMMC 32 GB ! 64 GB Modem GSM, UMTS ! Various options Touch Resistive + Dual-touch Sensors Accel, light + Add compass, gyro, baro Infrared Consumer IR (TX only) ! CIR (TX/RX), IrDA Positioning GPS + GLONASS Modem Bands PHS8 4×GSM, 5×UMTS PLS8-E 2×GSM, 3×UMTS, 5×LTE PLS8-US 4×GSM, 3×UMTS, 4×LTE PXS8 4×GSM, 5×UMTS, 3×CDMA2000 Feature comparison (2/2) New features: Neo900 NFC TRF7970A Expansion Hackerbus What we keep: Neo900 Screen 3.5", 800 x 480, Transflective Front camera VGA Main camera 5.0 MP Products NeoN: Upgrade kit (boards, parts) Bring your own N900 No soldering required Neo900: Complete device Built from N900 still in the market More information Web: neo900.org Village: see us at the Neo village.