5 ms·

OpenBSD does not run on the rPi because there are only a handful developers taking care of the arm subtree, and none of them have time for it or are simply not

OpenBSD does not run on the rPi because there are only a handful developers taking care of the arm subtree, and none of them have time for it or are simply not interested. Heck, their whole arm subtree has been rotting and needs some major overhaul. The main components of the new rPi are rather simple to get to work, so it's not a technical issue. The only real crapware inside is the usb controller. I bet if someone supplied a diff they'd gladly take it. Also, I wonder why this rather old post is up here.

ChuckMcM 11y ago
Actually if you read the comments from the developers in that thread they won't support it until there is documentation on the firmware "blobs" you need to have in order to even boot. I agree it is a fuzzy line but one which I happen to agree with. There is a probably a thesis to be had for the first person to build a provably trusted system using untrusted base hardware. I am not even sure how you would start such a project.
- messe 11y ago
  > Actually if you read the comments from the developers in that thread they won't support it until there is documentation on the firmware "blobs" you need to have in order to even boot. How exactly is that different to an undocumented or—forbid it—an unflashable BIOS? Don't even get me started on EFI... Aside from coreboot, I don't really see anybody drawing the ideological-line-in-the-sand there when it comes to running their PC.
  - Bluerise 11y ago
    The difference is that the rPi blobs actually run on the GPU, the CPU is unharmed. Still, both have access to the same memory. But that's a similar issue on the PC.
    - messe 11y ago
      Well perhaps a better example might be System Management Mode on Intel CPUs, which easily allows for undetectable backdoors with constant access to the same physical memory as anything else running on the CPU.
- Bluerise 11y ago
  I did read them. Now and a few months back. Janne raises concerns about running a blob on the CPU (which does not happen), while Stuart explains the boot stages correctly in detail and compares it to very similar issues on newer x86 technology.
- throwaway2048 11y ago
  It is a mischaracterization to say they have issues with the firmware, they clearly say they don't have the same objections to firmware running on the peripherals themselves. The issue here is that the rPI requires driver code running inside OpenBSD that is a closed source blob.
  - Bluerise 11y ago
    I'm sorry, but that is wrong. The main blobs are being run on the GPU, as bootloaders, even before the actual operating system is loaded. OpenBSD does not need to run _any_ blob itself. There used to be a 3d graphics driver blob, but afaik that got open sourced. Also, if you don't do 3d, you wouldn't even need it.
    - tedunangst 11y ago
      So, to summarize, if somebody makes a port that doesn't use a blob, all is good. The question seems to be not so much if the blob runs before or after OpenBSD, but whether we would need to distribute it. If it's in the ROM, then this isn't even a question. But if it's something we are expected to write to the flash drive, that's a potential problem. Anyway, the question isn't very interesting given that the magic porting elves haven't yet gifted us with an OpenBSD RPi port. I don't know exactly what the situation is. Don't care. I have a BeagleboneBlack if I wanted to watch the paint dry doing a build. :)
      - LukeShu 11y ago
        What's OpenBSD's policy on when something needs to be included? The rPi boot process requires several files to be on a FAT partition on an sd-card: bootcode.bin, fixup.dat, start.elf, config.txt and the OS kernel; the first 3 of which are blobs. Would those blobs need to be included, or would OpenBSD be fine saying "use your existing boot card, just drop in our kernel", or "go grab these files from https://github.com/raspberrypi/firmware/tree/master/boot https://github.com/raspberrypi/firmware/tree/master/boot when formatting the sd-card."?
- tagrun 11y ago
  They seem OK with BIOS, Intel microcode and other firmware on amd64 though.
  - ghshephard 11y ago
    They don't have to distribute it.
    - tagrun 11y ago
      Yes, but that's not relevant in this context, which is about OpenBSD trusting binary blobs ("a provably trusted system using untrusted base hardware").

ChuckMcM 11y ago

Actually if you read the comments from the developers in that thread they won't support it until there is documentation on the firmware "blobs" you need to have in order to even boot. I agree it is a fuzzy line but one which I happen to agree with. There is a probably a thesis to be had for the first person to build a provably trusted system using untrusted base hardware. I am not even sure how you would start such a project.

messe 11y ago
> Actually if you read the comments from the developers in that thread they won't support it until there is documentation on the firmware "blobs" you need to have in order to even boot. How exactly is that different to an undocumented or—forbid it—an unflashable BIOS? Don't even get me started on EFI... Aside from coreboot, I don't really see anybody drawing the ideological-line-in-the-sand there when it comes to running their PC.
- Bluerise 11y ago
  The difference is that the rPi blobs actually run on the GPU, the CPU is unharmed. Still, both have access to the same memory. But that's a similar issue on the PC.
  - messe 11y ago
    Well perhaps a better example might be System Management Mode on Intel CPUs, which easily allows for undetectable backdoors with constant access to the same physical memory as anything else running on the CPU.
Bluerise 11y ago
I did read them. Now and a few months back. Janne raises concerns about running a blob on the CPU (which does not happen), while Stuart explains the boot stages correctly in detail and compares it to very similar issues on newer x86 technology.
throwaway2048 11y ago
It is a mischaracterization to say they have issues with the firmware, they clearly say they don't have the same objections to firmware running on the peripherals themselves. The issue here is that the rPI requires driver code running inside OpenBSD that is a closed source blob.
- Bluerise 11y ago
  I'm sorry, but that is wrong. The main blobs are being run on the GPU, as bootloaders, even before the actual operating system is loaded. OpenBSD does not need to run _any_ blob itself. There used to be a 3d graphics driver blob, but afaik that got open sourced. Also, if you don't do 3d, you wouldn't even need it.
  - tedunangst 11y ago
    So, to summarize, if somebody makes a port that doesn't use a blob, all is good. The question seems to be not so much if the blob runs before or after OpenBSD, but whether we would need to distribute it. If it's in the ROM, then this isn't even a question. But if it's something we are expected to write to the flash drive, that's a potential problem. Anyway, the question isn't very interesting given that the magic porting elves haven't yet gifted us with an OpenBSD RPi port. I don't know exactly what the situation is. Don't care. I have a BeagleboneBlack if I wanted to watch the paint dry doing a build. :)
    - LukeShu 11y ago
      What's OpenBSD's policy on when something needs to be included? The rPi boot process requires several files to be on a FAT partition on an sd-card: bootcode.bin, fixup.dat, start.elf, config.txt and the OS kernel; the first 3 of which are blobs. Would those blobs need to be included, or would OpenBSD be fine saying "use your existing boot card, just drop in our kernel", or "go grab these files from https://github.com/raspberrypi/firmware/tree/master/boot https://github.com/raspberrypi/firmware/tree/master/boot when formatting the sd-card."?
tagrun 11y ago
They seem OK with BIOS, Intel microcode and other firmware on amd64 though.
- ghshephard 11y ago
  They don't have to distribute it.
  - tagrun 11y ago
    Yes, but that's not relevant in this context, which is about OpenBSD trusting binary blobs ("a provably trusted system using untrusted base hardware").