7 ms·

The radio firmware is something that is at another level. Even if you end up unlocking the bootloader, that doesn't give you access to the radio firmware, that

The radio firmware is something that is at another level. Even if you end up unlocking the bootloader, that doesn't give you access to the radio firmware, that is proprietary and needs to be signed, and cannot be modified. It's basically seen by the OS as a modem to which they talk trough AT commands (yes, they are still in use), the same thing that you would obtain by plugging in an USB modem to a normal PC. For Wi-Fi you can tweak the driver, if you want. But you can do the same with a network card that you buy for a couple of dollars so what's the point? Transmitting on the 2.4Ghz is something everyone can do if he wants. It's nonsense what you said. There nothing evil you can do by unlocking a phone. In Android an unlock triggers a factory reset, that will prevent accessing people personal data (and it's not really necessary if you have disk encryption, that every modern phone has as a default), so the concern of accessing people data doesn't exist. The concern about: but then a criminal can steal your phone and use it. Yes, there is. We can require to unlock the phone requesting a code from a website of the manufacturer so they can prove that you bought the phone, as some manufacturers do. But in reality, does it make sense? You can nowaday get a phone that is more powerful than the PC that I used 5 years ago for 200$, I mean 8 core CPU, 8Gb of RAM, 256Gb internal flash, in the following years the price will probably go even lower. Should I care? They only thing that I care is that whoever stoles the phone cannot access my personal data, and this is achieved by the disk encryption, everything else to me is useless, I would just buy another phone, but in reality is more probable that I will loose or break my phone that someone steals it.

R0b0t1 5y ago
This is not always true. There are chips where the radio DSP cores have their program loaded into main memory and it's unsigned. You talk to them with mutexes and shared memory pages. There is also no legal basis for requiring radio controllers to have signature enforced firmware loading. He's being sarcastic. It's think of the children but with electronics and PII.
- alerighi 5y ago
  I don't think that is the case of any smartphone SOC. Even for questions about power management you tend to implement radio function with a dedicated hardware, so that for example the CPU can go to sleep and be waked up when a phone call arrives (for examaple). It would be too expensive to have the main CPU implement the 4G radio in software, they don't do so, it would also require precise timing that a non real time OS cannot provide. Typically you have the modem that has its own microcontroller inside that runs its own firmware, that is encrypted. On Android phones you have a partition for the radio firmware, that you should really never touch (since doing so you can brick your device). Of course there will be a shared memory area between the radio and the main CPU to talk, but that is only for communication, then the radio microcontroller has its own RAM to implements its functions.
  - R0b0t1 5y ago
    The MT6737 is a chip that works as I have described. The baseband is fully accessible. Even for other more common chips, like the Qualcomm ones, the AT command set is actually synthesized with shared memory as I detailed. These coprocessors are not microcontrollers, they are realtime application processors and may have MMUs.
- Silhouette 5y ago
  There is also no legal basis for requiring radio controllers to have signature enforced firmware loading. If someone actually tried to write their own radio firmware and made a mistake, there very soon would be. Messing around with radio transmission is not a game. Make enough noise on the wrong frequency and now you're interfering with communications for emergency services responding to a disaster or air traffic control guiding flights in crowded airspace, with a very real danger of loss of life. And there is no way for anyone to stop you until they've physically tracked down the source of the bad transmission, which can take hours. I am very much in favour of rights to repair and against almost any restriction on what individuals can do with their own hardware, but giving people who don't know what they're doing unrestricted access to a radio transmitter on that basis is a bit like giving everyone in your city a button that detonates the nuke because you believe in a right to bear arms. At some point, you need to draw a line and say only qualified people past this point, or very bad things start to happen.
  - jsight 5y ago
    People can buy software defined radios and effectively already have that access.
  - netr0ute 5y ago
    You say all this as if the megacorps with signed firmware can't make mistakes.
    - Silhouette 5y ago
      Of course they can. But usually they don't, not for something like this. I have been witness to the kind of search I mentioned. Usually it happens because of a freak hardware failure, not a malicious act or negligence. Unfortunately the innocence of all involved does not reduce the severity of the potential consequences. As I said, this stuff is not a game.
  - R0b0t1 5y ago
    People do this all the time with routers. The FCC has been trying to require firmware signing but it has been pushed off for now because there is very little demonstrable harm. I can go buy a bunch of passives off of ebay and make a noisy oscillator that will kill everything for a couple blocks but nobody seems to do it.
judge2020 5y ago
> The radio firmware is something that is at another level. Even if you end up unlocking the bootloader, that doesn't give you access to the radio firmware, that is proprietary and needs to be signed, and cannot be modified. It's basically seen by the OS as a modem to which they talk trough AT commands (yes, they are still in use), the same thing that you would obtain by plugging in an USB modem to a normal PC. Who's to say this? What if i'm Apple and my ''partner'' radio chip manufacturer (cough qualcomm cough) doesn't give me access to changing the bootloader? Why wouldn't 'forced unlocked bootloader' also apply to Apple-owned devices?

R0b0t1 5y ago

This is not always true. There are chips where the radio DSP cores have their program loaded into main memory and it's unsigned. You talk to them with mutexes and shared memory pages. There is also no legal basis for requiring radio controllers to have signature enforced firmware loading. He's being sarcastic. It's think of the children but with electronics and PII.

alerighi 5y ago
I don't think that is the case of any smartphone SOC. Even for questions about power management you tend to implement radio function with a dedicated hardware, so that for example the CPU can go to sleep and be waked up when a phone call arrives (for examaple). It would be too expensive to have the main CPU implement the 4G radio in software, they don't do so, it would also require precise timing that a non real time OS cannot provide. Typically you have the modem that has its own microcontroller inside that runs its own firmware, that is encrypted. On Android phones you have a partition for the radio firmware, that you should really never touch (since doing so you can brick your device). Of course there will be a shared memory area between the radio and the main CPU to talk, but that is only for communication, then the radio microcontroller has its own RAM to implements its functions.
- R0b0t1 5y ago
  The MT6737 is a chip that works as I have described. The baseband is fully accessible. Even for other more common chips, like the Qualcomm ones, the AT command set is actually synthesized with shared memory as I detailed. These coprocessors are not microcontrollers, they are realtime application processors and may have MMUs.
Silhouette 5y ago
There is also no legal basis for requiring radio controllers to have signature enforced firmware loading. If someone actually tried to write their own radio firmware and made a mistake, there very soon would be. Messing around with radio transmission is not a game. Make enough noise on the wrong frequency and now you're interfering with communications for emergency services responding to a disaster or air traffic control guiding flights in crowded airspace, with a very real danger of loss of life. And there is no way for anyone to stop you until they've physically tracked down the source of the bad transmission, which can take hours. I am very much in favour of rights to repair and against almost any restriction on what individuals can do with their own hardware, but giving people who don't know what they're doing unrestricted access to a radio transmitter on that basis is a bit like giving everyone in your city a button that detonates the nuke because you believe in a right to bear arms. At some point, you need to draw a line and say only qualified people past this point, or very bad things start to happen.
- jsight 5y ago
  People can buy software defined radios and effectively already have that access.
- netr0ute 5y ago
  You say all this as if the megacorps with signed firmware can't make mistakes.
  - Silhouette 5y ago
    Of course they can. But usually they don't, not for something like this. I have been witness to the kind of search I mentioned. Usually it happens because of a freak hardware failure, not a malicious act or negligence. Unfortunately the innocence of all involved does not reduce the severity of the potential consequences. As I said, this stuff is not a game.
- R0b0t1 5y ago
  People do this all the time with routers. The FCC has been trying to require firmware signing but it has been pushed off for now because there is very little demonstrable harm. I can go buy a bunch of passives off of ebay and make a noisy oscillator that will kill everything for a couple blocks but nobody seems to do it.

judge2020 5y ago

> The radio firmware is something that is at another level. Even if you end up unlocking the bootloader, that doesn't give you access to the radio firmware, that is proprietary and needs to be signed, and cannot be modified. It's basically seen by the OS as a modem to which they talk trough AT commands (yes, they are still in use), the same thing that you would obtain by plugging in an USB modem to a normal PC. Who's to say this? What if i'm Apple and my ''partner'' radio chip manufacturer (cough qualcomm cough) doesn't give me access to changing the bootloader? Why wouldn't 'forced unlocked bootloader' also apply to Apple-owned devices?