4 ms·

What is the reason behind closed firmware? I understand that wifi devices may operate out of the certification depending on what the firmware does, but other de

What is the reason behind closed firmware? I understand that wifi devices may operate out of the certification depending on what the firmware does, but other devices... why do they have closed firmwares?

HideousKojima 5y ago
Probably to hide/protect corporate secrets, or if the firmware integrates proprietary code from a 3rd party it would be difficult to open source for legal reasons.
- p_l 5y ago
  To give an example, a huge issue over all of the OpenSolaris lifetime at Sun was reportedly due to third party licensed content Solaris had by itself, which is why OpenSolaris source contained only the very base system and was stripped of certain stuff (including X11 server Xsun, iirc)
- Shared404 5y ago
  Also in the case of Wifi/Bluetooth it seems like FCC regulations would make having open firmware difficult due to the fact that it would make it easier to allow end users to broadcast on arbitrary frequencies. This way they have deniability. ...That said, not a subject matter expert so take this with a grain of rock salt.
  - p_l 5y ago
    FCC doesn't prevent you from opening the firmware (now, trade secrets inside is another thing) - they just do not allow unlicensed devices i.e. you can't just build your own radio firmware and have it operate legally.
    - Shared404 5y ago
      So open firmware from the manufacturer is fine, but if you were to modify it and re-flash it yourself you would be breaking the law? I guess that makes sense, thanks for the clarification!
      - treesknees 5y ago
        I don't think that makes sense at all. One major part of Part 15 from the FCC covers this. A device would fall under the category as an intentional radiator in part 15.1. And in part 15.23, considered a home-built device. § 15.23 Home-built devices. (a) Equipment authorization is not required for devices that are not marketed, are not constructed from a kit, and are built in quantities of five or less for personal use. (b) It is recognized that the individual builder of home-built equipment may not possess the means to perform the measurements for determining compliance with the regulations. In this case, the builder is expected to employ good engineering practices to meet the specified technical standards to the greatest extent practicable. The provisions of § 15.5 apply to this equipment. https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-15 https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A... This entire part from the FCC basically states you don't need a license to operate in the frequencies for wifi, bluetooth, etc. You're not breaking a law by recompiling the firmware for your wifi module to fix a bug. You'd be breaking the law if you did so with the intention of operating within licensed spectrum/power levels, for example.
        p_l 5y ago
        The problem starts with the fact that the device doesn't have any way of showing that it was modified, and some of the frequencies involved are license-restricted (especially in 5GHz wifi bands - 2.4GHz is dumping ground free-for-all because of aircraft ovens anyway). So, let's say you modify something with your own firmware, break rules about ISM spectrum - or worse, mess with SDR hard enough you break some licensed spectrum, and upon investigation FCC certification marks are found and the number. Since certification points to vendor, vendor now has to explain why their device went outside of those limits, and might or might not be able to prove that you ran it with unlicensed firmware. So an obviously home build device will go under §15.23 easily, but inconspicuously modified commercially sold device won't - without possibly long court case, that is.
        franga2000 5y ago
        The FCC is very familiar with inconspicuously modified commercial devices - hams have been doing it since before "firmware" was even a word. The fact that it's replacing some code on a chip instead of a shunt resistor on a PCB really doesn't make a difference. And if this really was really the main issue, it seems pretty easy to just sign the firmware - I'm pretty sure many vendors do it already.
  - kelnos 5y ago
    That feels like a false excuse a manufacturer might make, as it seems plausible enough, but doesn't really hold up to deeper scrutiny. Even wifi chips that have closed firmware usually have a region setting, and there's nothing stopping you from selecting a region that includes frequencies that aren't allowed in your actual region. Sure, that's not quite the same as allowing completely arbitrary frequencies, but that feels like a distinction that wouldn't matter much when it comes to government regulations.
wmf 5y ago
For BIOS/UEFI a lot of hardware vendors outsource their firmware to AMI and AMI keeps everything proprietary so they can keep charging money. (Coreboot is not an option for real computers because it doesn't have menus and various other things.)
- trulyme 5y ago
  I would assume that building an UI with menus and whatnot is the easy part of it? (not an expert, genuinly curious)
  - wmf 5y ago
    It may be that writing the code is the easy part but caring enough to actually start on it is the hard part. There's been no visible progress on this... ever.
    - bubblethink 5y ago
      Coreboot doesn't deal with that, the payload does. And tianocore does come with a menu for changing boot order, boot devices etc.
      - floatboth 5y ago
        The stock edk2 menu has, like, two items. System76 have built a more serious setup UI: https://github.com/system76/firmware-setup https://github.com/system76/firmware-setup Microsoft’s https://github.com/microsoft/mu https://github.com/microsoft/mu also probably contains UI from the Surface line or something??
- pabs3 5y ago
  Aren't there coreboot payloads for doing menus/etc?
pabs3 5y ago
I've heard rumours that making firmware proprietary helps hide patent violations.
pabs3 5y ago
Open source WiFi firmware exists btw: https://github.com/qca/open-ath9k-htc-firmware https://github.com/qca/open-ath9k-htc-firmware https://github.com/chunkeey/carl9170fw https://github.com/chunkeey/carl9170fw http://netweb.ing.unibs.it/~openfwwf/ http://netweb.ing.unibs.it/~openfwwf/ None for recent WiFi standards though. Other open firmware: https://wiki.debian.org/Firmware/Open https://wiki.debian.org/Firmware/Open
typ 5y ago
Hardware defects are often worked around by firmware. It can be things like adjusting current drive or lowering the clocks conditionally to mitigate EMI. It can even check the serial numbers of the hardware to determine what to do for the pieces with inferior quality in order to pass QA and increase yields. If customers get to find out what kind of defects or which batches are inferior, that would imply costly consequences for business.

HideousKojima 5y ago

Probably to hide/protect corporate secrets, or if the firmware integrates proprietary code from a 3rd party it would be difficult to open source for legal reasons.

p_l 5y ago
To give an example, a huge issue over all of the OpenSolaris lifetime at Sun was reportedly due to third party licensed content Solaris had by itself, which is why OpenSolaris source contained only the very base system and was stripped of certain stuff (including X11 server Xsun, iirc)
Shared404 5y ago
Also in the case of Wifi/Bluetooth it seems like FCC regulations would make having open firmware difficult due to the fact that it would make it easier to allow end users to broadcast on arbitrary frequencies. This way they have deniability. ...That said, not a subject matter expert so take this with a grain of rock salt.
- p_l 5y ago
  FCC doesn't prevent you from opening the firmware (now, trade secrets inside is another thing) - they just do not allow unlicensed devices i.e. you can't just build your own radio firmware and have it operate legally.
  - Shared404 5y ago
    So open firmware from the manufacturer is fine, but if you were to modify it and re-flash it yourself you would be breaking the law? I guess that makes sense, thanks for the clarification!
    - treesknees 5y ago
      I don't think that makes sense at all. One major part of Part 15 from the FCC covers this. A device would fall under the category as an intentional radiator in part 15.1. And in part 15.23, considered a home-built device. § 15.23 Home-built devices. (a) Equipment authorization is not required for devices that are not marketed, are not constructed from a kit, and are built in quantities of five or less for personal use. (b) It is recognized that the individual builder of home-built equipment may not possess the means to perform the measurements for determining compliance with the regulations. In this case, the builder is expected to employ good engineering practices to meet the specified technical standards to the greatest extent practicable. The provisions of § 15.5 apply to this equipment. https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-15 https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A... This entire part from the FCC basically states you don't need a license to operate in the frequencies for wifi, bluetooth, etc. You're not breaking a law by recompiling the firmware for your wifi module to fix a bug. You'd be breaking the law if you did so with the intention of operating within licensed spectrum/power levels, for example.
      - p_l 5y ago
        The problem starts with the fact that the device doesn't have any way of showing that it was modified, and some of the frequencies involved are license-restricted (especially in 5GHz wifi bands - 2.4GHz is dumping ground free-for-all because of aircraft ovens anyway). So, let's say you modify something with your own firmware, break rules about ISM spectrum - or worse, mess with SDR hard enough you break some licensed spectrum, and upon investigation FCC certification marks are found and the number. Since certification points to vendor, vendor now has to explain why their device went outside of those limits, and might or might not be able to prove that you ran it with unlicensed firmware. So an obviously home build device will go under §15.23 easily, but inconspicuously modified commercially sold device won't - without possibly long court case, that is.
        franga2000 5y ago
        The FCC is very familiar with inconspicuously modified commercial devices - hams have been doing it since before "firmware" was even a word. The fact that it's replacing some code on a chip instead of a shunt resistor on a PCB really doesn't make a difference. And if this really was really the main issue, it seems pretty easy to just sign the firmware - I'm pretty sure many vendors do it already.
- kelnos 5y ago
  That feels like a false excuse a manufacturer might make, as it seems plausible enough, but doesn't really hold up to deeper scrutiny. Even wifi chips that have closed firmware usually have a region setting, and there's nothing stopping you from selecting a region that includes frequencies that aren't allowed in your actual region. Sure, that's not quite the same as allowing completely arbitrary frequencies, but that feels like a distinction that wouldn't matter much when it comes to government regulations.

wmf 5y ago

For BIOS/UEFI a lot of hardware vendors outsource their firmware to AMI and AMI keeps everything proprietary so they can keep charging money. (Coreboot is not an option for real computers because it doesn't have menus and various other things.)

trulyme 5y ago
I would assume that building an UI with menus and whatnot is the easy part of it? (not an expert, genuinly curious)
- wmf 5y ago
  It may be that writing the code is the easy part but caring enough to actually start on it is the hard part. There's been no visible progress on this... ever.
  - bubblethink 5y ago
    Coreboot doesn't deal with that, the payload does. And tianocore does come with a menu for changing boot order, boot devices etc.
    - floatboth 5y ago
      The stock edk2 menu has, like, two items. System76 have built a more serious setup UI: https://github.com/system76/firmware-setup https://github.com/system76/firmware-setup Microsoft’s https://github.com/microsoft/mu https://github.com/microsoft/mu also probably contains UI from the Surface line or something??
pabs3 5y ago
Aren't there coreboot payloads for doing menus/etc?

pabs3 5y ago

I've heard rumours that making firmware proprietary helps hide patent violations.

pabs3 5y ago

Open source WiFi firmware exists btw: https://github.com/qca/open-ath9k-htc-firmware https://github.com/qca/open-ath9k-htc-firmware https://github.com/chunkeey/carl9170fw https://github.com/chunkeey/carl9170fw http://netweb.ing.unibs.it/~openfwwf/ http://netweb.ing.unibs.it/~openfwwf/ None for recent WiFi standards though. Other open firmware: https://wiki.debian.org/Firmware/Open https://wiki.debian.org/Firmware/Open

typ 5y ago

Hardware defects are often worked around by firmware. It can be things like adjusting current drive or lowering the clocks conditionally to mitigate EMI. It can even check the serial numbers of the hardware to determine what to do for the pieces with inferior quality in order to pass QA and increase yields. If customers get to find out what kind of defects or which batches are inferior, that would imply costly consequences for business.