5 ms·

> I must say I strongly dislike losing control over my own device. It feels dystopian to me. Even with a rooted device where perhaps you personally coded up th

> I must say I strongly dislike losing control over my own device. It feels dystopian to me. Even with a rooted device where perhaps you personally coded up the ROM you are still missing a piece which is the binary blob that runs the baseband radio. That firmware is, afaik, not something which exists in any sort of open-source or rootable manner. It's a closed blob running proprietary software on your phone, and it runs at a lower level than the ROM/OS does. So, even if you go to great lengths to secure most of the software that runs on the device (a noble goal, it's your hardware after all!) then you still must contend with the uncertainty and perhaps risk (depending on your threat model) of that untrusted code running there. You can search around the web for articles covering baseband radio exploits that span the years...

cameronh90 4y ago
Moreover, some of these settings restrictions are encouraged or mandatory for the FCC/Ofcom/your-local-radio-regulator to certify your device. This is to prevent people from doing naughty things with the spectrum.
john61 4y ago
For the PinePhone you can install a free OS running the Baseband Processor: https://hackaday.com/2022/07/12/open-firmware-for-pinephone-lte-modem-whats-up-with-that/ https://hackaday.com/2022/07/12/open-firmware-for-pinephone-... Probably illegal and the firmware running the radio hardware is still proprietary.
- kube-system 4y ago
  That's partially open source software on the broader Quectel EC25-G modem, but not the Qualcomm’s MDM9207 baseband that the modem uses. > Not everything is open in this firmware. The baseband firmware, aka the RF bits known as ADSP firmware, remains closed and not yet reverse-engineered by anyone – you’re not gonna be running OpenBTS on this modem yet. > The TrustZone kernel remains closed too – my understanding is that it’s signed by Qualcomm.
kelnos 4y ago
I don't believe this is entirely true anymore. Yes, years ago, the baseband processor (and firmware) had full DMA capabilities to the RAM ostensibly managed by the OS, and could do nefarious things if it wanted to. But I believe nowadays the baseband is a bit more isolated, and communication with it is mediated by the CPU and OS. Some manufacturers likely still implement the "old" architecture, though.
- matheusmoreira 4y ago
  How can I find out what peripherals my smartphone's baseband processor has access to?
- Sirened 4y ago
  You would hope but to a large extent SMMUs are still not meaningfully deployed in consumer smartphones. Even when they do exist, the bounding enforced upon them are so expansive that it's essentially pointless. For example, one device I found had an SMMU in front of its BT/WiFi chip but, unfortunately, the driver on the AP side configured the SMMU to have access to all of system memory. Baffling.
  - deleted 4y ago
    [deleted]
mehdix 4y ago
IIRC in purism phones baseband is totally/mostly isolated and has no DMA. Edit typo

cameronh90 4y ago

Moreover, some of these settings restrictions are encouraged or mandatory for the FCC/Ofcom/your-local-radio-regulator to certify your device. This is to prevent people from doing naughty things with the spectrum.

john61 4y ago

For the PinePhone you can install a free OS running the Baseband Processor: https://hackaday.com/2022/07/12/open-firmware-for-pinephone-lte-modem-whats-up-with-that/ https://hackaday.com/2022/07/12/open-firmware-for-pinephone-... Probably illegal and the firmware running the radio hardware is still proprietary.

kube-system 4y ago
That's partially open source software on the broader Quectel EC25-G modem, but not the Qualcomm’s MDM9207 baseband that the modem uses. > Not everything is open in this firmware. The baseband firmware, aka the RF bits known as ADSP firmware, remains closed and not yet reverse-engineered by anyone – you’re not gonna be running OpenBTS on this modem yet. > The TrustZone kernel remains closed too – my understanding is that it’s signed by Qualcomm.

kelnos 4y ago

I don't believe this is entirely true anymore. Yes, years ago, the baseband processor (and firmware) had full DMA capabilities to the RAM ostensibly managed by the OS, and could do nefarious things if it wanted to. But I believe nowadays the baseband is a bit more isolated, and communication with it is mediated by the CPU and OS. Some manufacturers likely still implement the "old" architecture, though.

matheusmoreira 4y ago
How can I find out what peripherals my smartphone's baseband processor has access to?
Sirened 4y ago
You would hope but to a large extent SMMUs are still not meaningfully deployed in consumer smartphones. Even when they do exist, the bounding enforced upon them are so expansive that it's essentially pointless. For example, one device I found had an SMMU in front of its BT/WiFi chip but, unfortunately, the driver on the AP side configured the SMMU to have access to all of system memory. Baffling.
- deleted 4y ago
  [deleted]

mehdix 4y ago

IIRC in purism phones baseband is totally/mostly isolated and has no DMA. Edit typo