I believe the 'standard' two, 3D graphics and the LTE radio. I've seen efforts to create an open source graphics driver for Adreno (the GPU) but not the radio. Once you've got both of those you can build a phone for Stallman with all the code available for inspection. Maybe the Ettus guys could help with that.

There's quite a bit of proprietary software in a smartphone beyond just the GPU and modem driver. The entire baseband firmware is another (closed) operating system to contend with.

Is the baseband code replaceable, or permanent burnt onto a chip which can only be modified by replacing the physical chip with a new one?

I tend to bundle the baseband blob and the modem blob as "the radio" but agree that is an over simplification.

A big simplification indeed. Replacing the modem bit should actually be pretty easy, it's just the interface glue. Replacing the baseband is much harder as that implements all the wireless protocols needed for GSM/3G/LTE. Since the baseband tends to run on an independent processor capable of accessing all main memory it's kind of scary what could be there. Even if the hardware design is better and the baseband is behind some form of MMU it is still capable of sending your location and all your traffic to an attacker. That together with the fact that most Android phones don't get any meaningful upgrades makes Android a minefield when it comes to security.

> Even if the hardware design is better and the baseband is behind some form of MMU it is still capable of sending your location and all your traffic to an attacker.

We could just consider baseband to be on the untrusted side of the network. Without access to anything but the restricted communication channels the worst things it could do is perform some calculations to eat your battery.

Network operator already knows (or may discover) your rough location and has access to your traffic anyway. So, just make sure private traffic's well encrypted and authenticated, and develop the hardware to be capable of provably powering down the whole baseband module when you want it to be off (location privacy). Problem solved.

And audio, and camera... Etc.

Qualcomm doesn't release open source drivers for Adreno graphics, so there's that at least. There's a reverse engineering project "freedreno" but I doubt they use that (I don't think it even supports all features).

In the ARM SoC space that's quite common (blobs at least for 3D graphics).

I don't know if there's something else.

If you are worried about security, that ship has sailed- have you heard about the baseband processor?

Absolutely. I understand that cell phones are primarily used for spying and occasionally used for making phone calls. I'm looking for a phone that requires the fewest number of proprietary components in order to function adequately.