Tag: Pixel 4

Mobile FeliCa preinstalled on all Pixel 4 and later models

After posting about the global NFC possibility of Pixel 5 and Fitbit, FeliCa Dude forwarded some interesting Pixel 4 FeliCa information. We all know that smartphones are required to have NFC A-B-F support for NFC certification and that all smartphones can read and write all flavors of NFC. However, the software that supports Secure Element transactions is another story. Android vendors usually only preinstall EMV and MIFARE, not Mobile FeliCa, but Google is doing something different with Pixel devices.

We all know the official story that Mobile FeliCa apps only launch on Japanese Pixel 4 SKUs and no other models but it’s important to remember the basics: Mobile FeliCa is a Java Card applet on a secure element. If the right applet is present with the right keys, and the NFC CLF (contactless front-end) is configured to route Type F frames to the SE, you can enable Mobile FeliCa on any SE.

Let’s test for Mobile FeliCa
There are indications that Google installed Mobile FeliCa in all Pixel 4 models worldwide but only enables it in the Japanese SKUs. A reader asked me to post some information so that we can find out the truth with help from other readers of this blog. We are looking for non-JP Pixel 4/4a SKU users who can tag read their Pixel 4/4a device with another Android device loaded with the NXP NFC TagInfo app downloaded from Google Play. The steps to do this:

  1. Install the TagInfo app, turn off NFC-A and NFC-B reads as we only want to read NFC-F tags (screenshot directly below)
  2. Tag read the Pixel 4/4a with the TagInfo installed Android device
  3. Take a screenshot of the NFC scan results #1
  4. Tag read the Pixel 4/4a a second time, take a screenshot of scan results #2

Read #1 (Before Enablement): If FeliCa is present the Primary System Code in the Detailed protocol information section should be 0xFFFF. Additionally, Mobile FeliCa 4.1 will show a pre-enablement IDm starting with 05:FE.

Read #2 (After Enablement): On a JP Pixel 4 in the screenshot below, the Common Area (0xFE00) will be present, and the Primary System Code will have changed to 0xFE00, that of the Common Area. On non-JP models enablement doesn’t happen, read #2 will match read #1.

Enablement means running the Osaifu Keitai app. Let me know by Twitter @Kanjo or email the following: (1) the Pixel 4/4a model, (2) if the read #1 result indicates FeliCa with System Code OxFFFF, (3) if the first 4 digits of the IDm begin with 05:FE in read #1. Both reads should look identical so also let me know if anything changes in read #2.

The Premise
What does it mean if all Pixel 4/4a models have FeliCa, does it change anything? It simply means that Mobile FeliCa is loaded and present in all Pixel 4/4a devices but Google only turns it on for full activations on Japanese models. This doesn’t change anything in the short term. The real value is that it helps us understand what Google is up to and possible changes that might be coming later on with Pixel 5: i.e. global NFC just like Apple.

The Results
Readers results indicate Mobile FeliCa 4.1 is pre-installed in every Pixel Phone SKU regardless of country. Mobile FeliCa is ready but the entitlement step does not occur as some system parameter prevents the Osaifu Keitai app from running. In short Pixel 4 and later all have the same NFC hardware and Mobile FeliCa software pre-installed ready to run, but Google kneecaps the software on non-JP SKU Pixel. This explains reports of Pixel 4 and later users rooting non-JP SKUs and running Osaifu Keitai.

2021-10-20 UPDATE
Pixel 6 goes cheap instead of deep for Mobile FeliCa support, the same Pixel 4~5 story. Even so it’s important to remember some recent big Mobile FeliCa changes only noticed by FeliCa Dude: 1) Mobile FeliCa 4.0 removed the FeliCa Networks/FeliCa chip requirement, any 3rd party GlobalPlatforms certified Secure Element (NXP, etc.) can host Mobile FeliCa apps. Google can hit the on switch for Mobile FeliCa with an OTA update…if they want to. See Mobile FeliCa evolution for more details.

Pixel 4 goes cheap instead of deep

As I tweeted earlier today, the updated Pixel Phone Help hardware pages tell the whole story: if you purchased your Pixel 4, 3a or 3 phone in Japan, a FeliCa chip is located in the same area as the NFC.

This is a little misleading because as FeliCa Dude pointed out in tweets, the Pixel 3 uses the global NFC PN81B ‘all in one chip’ from NXP. There is no separate ‘FeliCa chip’:

All the Pixel 3 devices have an eSE…A teardown of the global edition Pixel 3 XL (G013C) reveals a <NXP> PN81B.

FeliCa Dude

Pixel 4 teardowns will certainly reveal a PN81B or similar all in one NFC chip from NXP. Google could have gone global NFC with Pixel 4 and given Android users everywhere access to Google Pay Suica. Unfortunately Google went cheap instead of deep, sticking with the same Pixel 3 policy of only buying FeliCa keys for JP Pixel models.

Why is Google turning off FeliCa on Pixel models outside of Japan? I doubt it is a licensing restriction because the whole point of NXP PN81 is having all the global NFC licensing pieces, NFC A-B-F/EMV/FeliCa/MIFARE, all on one chip, all ready to go. It could have something to do with Google Pay Japan. For Apple Pay Japan, Apple licensed all the necessary technology and built it into their own Apple Pay.

Instead of that approach Google Pay Japan is a kind of candy wrapper around the existing ‘Osaifu Keitai’ software from Docomo and FeliCa Networks, and all of the existing Osaifu Keitai apps from Mobile Suica to iD to QUICPay. That’s why having a ‘Osaifu Keitai’ Android device is a requirement for using Google Pay Japan. Perhaps Google is content in candy wrapping things instead of retooling it all as basic Google Pay functionality and letting Android OEMs benefit from that.

Whatever the reason, the moral of this story is that Google Pay Suica will not be a transit option for inbound Android users during the 2020 Tokyo Olympics. Unfortunately, the Android equivalent of the global NFC iPhone has yet to appear.

UPDATE
Pixel 4/4a all have the same NFC hardware and Mobile FeliCa software, but non-JP models block Mobile FeliCa apps from running.

Pixel 3 Global NFC Evolution

Reader feedback and discussion from my earlier post analyzing the fuzzy state of iPhone 7 FeliCa and its possible support of Apple Pay Octopus, resulted in some interesting discussion about the Pixel 3 Japanese FeliCa model. From FeliCa Dude’s epic Reddit Octopus on iPhone 7 post:


<reader comment> Regarding the Pixel though, are you sure that the non-Japanese Pixel 3 models even have an eSE <embedded secure element>? I was under the impression that these were HCE <host card emulation> only.

<Felica Dude answer> All the Pixel 3 devices have an eSE, but it might not be able to be enabled by the end-user, and even if it is possible, it won’t be provisioned. A teardown of the global edition Pixel 3 XL (G013C) reveals a <NXP> PN81B.

The NXP PN81 announced in February is all-in-one off the shelf global NFC chip that includes both the frontend NFC A-B-F hardware and the necessary embedded secure element (eSE) + keys for EMV, FeliCa and MIFARE. The odd thing is that the Google Pixel 3 Japanese model apparently doesn’t use the PN81 for FeliCa, and has a separate FeliCa chip sitting in the fingerprint sensor assembly inside the back case.

Google Pixel 3 JP SKU iFixit teardowns do not exist but I did run across an interesting article from the Keitai Watch site showing a Pixel 3 JP SKU being taken apart for repair at an iCracked repair shop.

Just for kicks, I called the iCracked shop and asked about repairing a faulty FeliCa Pixel 3 device. The Pixel 3 repair technician explained that a FeliCa chip replacement was not expensive because it is not on the motherboard, “it’s attached to the fingerprint sensor assembly.” Look carefully at the picture from Keitai Watch piece and you can see the back case with fingerprint sensor assembly that the technician was referring to.

Disassembled Pixel 3 JP model from Keitai Watch

This presents a very strange situation. All Pixel 3 SKUs have the FeliCa ready PN81 chip but don’t use it, while Pixel 3 Japan SKUs might have another separate FeliCa chip attached to the back case finger sensor assemble. Google alludes to this on the Pixel 3 support page: If you purchased your Pixel 3 or Pixel 3a phone in Japan, a FeliCa chip is located in the same area as the NFC. There is also the recent batch of Pixel 3a Japan SKUs with bad FeliCa chips, but reports of bad NFC (EMV) Pixel 3a international SKUs have not surfaced; this also suggests a separate FeliCa chip. Why have two FeliCa chips in a device when one will do?

My take is different from FeliCa Dude: the Pixel 3 does not use the PN81 eSE or ‘pie in the sky’ HCE for anything. Instead, Google Pixel 3 uses the Titan M chip Secure Enclave as the virtual eSE for EMV and MIFARE, similar to what Apple does with the A/S Series Secure Enclave. Titan M FeliCa support was either not ready, or Google wanted to test the Japanese market before making a custom hardware commitment.

The point of all this is that Google has laid the foundation for a global NFC Pixel 4 made possible by a custom Google chip. The Titan M is Google’s answer to Apple’s A/S Series Secure Enclave that can host any kind of virtual embedded secure element for any kind of transaction technology, from EMV to PBOC.

I might be wrong, but even if my virtual eSE on Titan M take is incorrect, taken all together with the NXP PN81 development, I think Pixel 4 will finally be the global NFC Android device that many have hoped for.

UPDATE: extensive testing by FeliCa Dude did not support my eSE on Titan theory. The chip in question is the FPC1075 chip interface between the fingerprint sensor and the SPI bus. Pixel 4 is not global NFC, which says it all and knocks everything back to square one: there is no separate FeliCa chip, it’s a NXP PN81 chip all the way. Google hardware support page wording is very misleading, nothing more.

Apple Pay Octopus and the Pixel 4 Global NFC Question

Apple Pay Octopus on iOS 13 this fall puts Pixel 4 and Google Pay in an awkward market position. Pixel 3 is a success in the Japanese market because of the inclusion of a dedicated FeliCa chip in Japanese models. Non-JP Pixel 3 models have a global NFC ready NXP PN81 chip but FeliCa is not activated for some reason, inbound users cannot use Google Pay Suica, or anything else, in Japan.

The question for Pixel 4 is this: will Google Pay use all the features of the NXP PN81 chip, or go with a custom implementation of FeliCa on their own chip for a global NFC device along with an enhanced Google Pay that seamlessly incorporates and builds on Osaifu Keitai software (killing off JP carrier Osaifu-Keitai SIM nonsense for good) instead of simply candy wrapping it, like they do for Pixel 3 JP Google Pay.

If Google goes with the first choice, Google Pay Octopus becomes a future possibility. It would also force other Android smartphone manufacturers to follow suit.

If Google keeps that same Pixel 3 arrangement they have for Pixel 4, a separate hardware model for Japan, Google Pay Octopus becomes a murky proposition. More of the same would be a shame. I hope Google does the smart thing and the right thing: global NFC on all devices is the way to go.

10/16 UPDATE: We have an answer: Pixel 4 is not global NFC, FeliCa support is restricted to JP models, the same story as Pixel 3. Google did the cheap thing again and chose not to buy FeliCa keys for all Pixel 4 models.