7 ms·

With or without binary blobs and undocumented registers/IPs?

by bfrog 3y ago

nomel 3y ago
Naive question. What's the practical impact for not having these? It seems that AMD and Intel are also guilty.
- lrvick 3y ago
  Those blobs, if backdoored, could have massive security implications. Also those blobs are often targeted at specific kernel versions, so in 2 years when the upstream vendors stop releasing updated blobs, then it no longer becomes possible to upgrade the kernel, making it very very hard to keep last gen devices secure. This exact problem is why I was forced to admit there is no secure path to use Android today, and a big reason why I gave up on smartphones entirely.
  - fsflover 3y ago
    > and a big reason why I gave up on smartphones entirely This is not necessary: my Librem 5 doesn't rely on blobs in kernel and runs FSF-endorsed GNU/Linux, PureOS.
    - fifteen1506 3y ago
      Pixels may also be an option -- though Librem 5 is, in this context, better. Pixels Pro have now... 7 or 8 years support.
    - dawidpotocki 3y ago
      Because Purism cheated and just moved the blobs into a chip that you can't update and made it go through a separate processor[1]. FSF-endorsement is meaningless. This is worse than having a loadable blob from a kernel. [1]: https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurdle/ https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd...
      - fsflover 3y ago
        I don't see how it's worse. As a consequence, it's the only phone that can run fully free OS and have lifetime updates.
        dawidpotocki 3y ago
        You can't update the firmware at all and you are still running it. Librem 5 has very dated hardware that barely runs. It has only Cortex A53 cores @ 1.5 GHz that were released in 2012. You will see it even lag in Purism's videos. Modern Android phones have better OS, hardware security, battery life and will be useful for longer and cheaper. Librem 5 now costs 1000 USD, the same price that Google Pixel 8 Pro costs which also has guaranteed 7 years of OS support. Will you want to use Librem 5 in 7 years? Also let's not forget how Purism took forever to ship the devices and was declining refunds from people that didn't even get sent the device and waited way over a year. Oh and there are Android phones that can run on mainline kernels.
        fsflover 3y ago
        > Will you want to use Librem 5 in 7 years? Yes: Librem 5 is a full desktop, with my full control, "Thinkpad T400 in mobile". It will always run latest Linux and all desktop apps. I can use it as a full desktop connected to keyboard/screen. On the other hand, Android is not a general purpose computer, which only runs what Google allows you to run. You should try SXMo if you want to see how smoothly Librem 5 and even Pinephone can work if the software is optimized. > You can't update the firmware at all and you are still running it. Is there even theoretically an attack vector here? Yes, Purism has been having problems with refunds. It doesn't affect security or freedom of they devices. Don't buy from them if you will want a refund.
        forty 3y ago
        How will you fix it in 4 years? I don't see were they sell spare parts.
    - HappyDaoDude 3y ago
      It is the closest we have to a freedom respecting device. The baseband processor is still a closed blob but it is a lot better than pretty much everything else out there. Maybe Pinephone eventually will get there as well.
  - nomel 3y ago
    AMD and Intel both have their share of proprietary blobs, in their "open source" packages, including microcode. Where do you see a secure path, for any computing, especially high performance?
    - yjftsjthsd-h 3y ago
      > Where do you see a secure path, for any computing, especially high performance? I believe POWER9 is the only modern option that doesn't use blobs? Of course that doesn't remove the possibility of hardware backdoors (nothing does, except maybe an electron microscope and a lot of free time), but that's a higher bar.
      - lrvick 3y ago
        I do in fact have a Power9 workstation next to my desk, though sadly not in use as the biggest security wins for my workflow come from QubesOS which cannot run on Power9, yet.
    - AnthonyMouse 3y ago
      People rightly disapprove of the AMD and Intel blobs and do what they can to disable or remove them, but at least those have stable interfaces that don't decay when there is a new kernel version. Basically every x86_64 processor ever made can run the latest version of the Linux kernel. Would that it were for Qualcomm.
      - nomel 3y ago
        > do what they can to disable or remove them Is there open source microcode, at this point? I can't find anything that suggests there is.
        fsflover 3y ago
        The parent probably speaks of Intel ME neutralizing/disablement.
        3y ago
  - jancsika 3y ago
    > Also those blobs are often targeted at specific kernel versions, so in 2 years when the upstream vendors stop releasing updated blobs, then it no longer becomes possible to upgrade the kernel, making it very very hard to keep last gen devices secure. Is this true for the blobs in the Snapdragon 8 Gen 3 Mobile Platform?
  - surajrmal 3y ago
    Isn't it true that even if the firmware was open, as long as the hardware is closed it could still be backdoored and doing things you don't want it to? Where do you draw the line?
    - fsflover 3y ago
      You don't draw the line: you support practical, existing systems that are as open as possible. Also, there is Precursor, which is open hardware.
- fsflover 3y ago
  https://www.gnu.org/philosophy/free-software-even-more-important.html https://www.gnu.org/philosophy/free-software-even-more-impor...
foobiekr 3y ago
Someone knows Qualcomm.
wyldfire 3y ago
As a practical matter, I think the article happens to describe the steps to test it out yourself. I suppose the absence of a mention of binary blobs doesn't necessarily mean that they're not being used, I think it's plausible that there aren't (m)any. > How do I run AOSP using Mainline? > One might think it is quite hard to run AOSP with mainline on such a new platform, but in reality, not at all! Thanks to the long term effort of Linaro and Google engineers making it possible to run AOSP with vanilla Linux releases. Thanks to Amit Pundir for providing a helping hand to get AOSP on this platform. > To generate an AOSP image for the Snapdragon 8 Gen 3 Qualcomm Reference Device using the current set of patches available on the mailing list, use the following instructions, which are derived from here https://source.android.com/docs/setup/build/devices https://source.android.com/docs/setup/build/devices with some small changes.
- spookie 3y ago
  This is quite refreshing! Thanks for the details
almatabata 3y ago
At minimum i expect QSEE and all their TAs to remain binary blobs, like the keymaster for example.
aseipp 3y ago
The kernel will work fine, but at minimum EL2 runs the Qualcomm Hypervisor (Gunyah) which prevents native KVM virtualization from taking place. This is true of all Snapdragon platforms. Windows supports virtualization on the 8 Gen 3 only because they use a custom setup to load a signed binary blob ("applet") into the EL2 hypervisor, whose signature it is is hardcoded to accept, and that blob/applet then can be used by Windows as a kind of shim into EL2-land to spawn VMs, etc. But Qualcomm's hypervisor is always present and enforcing its security policy. In practice every single modern system is running tons of binary firmware blobs, it's mostly where you draw the line on functionality and isolation of components (security, integrity, availability.) Here, Qualcomm does intentionally reduce some functionality, which is pretty bad when you consider that the UEFI spec for ARM mandates EL2 handover, I think, and they just ignore it.
- asddubs 3y ago
  What's EL2 exactly?
  - baby_souffle 3y ago
    > What's EL2 exactly? Probably execution level 2.
  - Avery3R 3y ago
    Exception Level 2 [1] They're analogous to "protection rings" on x86. Generally, EL0 is usermode, EL1 is kernel mode, EL2 is hypervisor, and EL3 is the "secure monitor"/firmware code, closest analogy I think would be SMM on x86. On top of all of that there's also trustzone with its own EL0 and EL1. 1: https://developer.arm.com/documentation/102412/0103/Privilege-and-Exception-levels/Exception-levels https://developer.arm.com/documentation/102412/0103/Privileg...
- thomastjeffery 3y ago
  > In practice every single modern system is running tons of binary firmware blobs This is a problem we should be loud critics of. Proprietary firmware hurts us all, and practically benefits no one.
robert_foss 3y ago
The GPU probably runs a firmware blob. Other than that Linaro is serious about upstream support.

With or without binary blobs and undocumented registers/IPs?

by bfrog 3y ago

With or without binary blobs and undocumented registers/IPs?

nomel 3y ago

Naive question. What's the practical impact for not having these? It seems that AMD and Intel are also guilty.

lrvick 3y ago
Those blobs, if backdoored, could have massive security implications. Also those blobs are often targeted at specific kernel versions, so in 2 years when the upstream vendors stop releasing updated blobs, then it no longer becomes possible to upgrade the kernel, making it very very hard to keep last gen devices secure. This exact problem is why I was forced to admit there is no secure path to use Android today, and a big reason why I gave up on smartphones entirely.
- fsflover 3y ago
  > and a big reason why I gave up on smartphones entirely This is not necessary: my Librem 5 doesn't rely on blobs in kernel and runs FSF-endorsed GNU/Linux, PureOS.
  - fifteen1506 3y ago
    Pixels may also be an option -- though Librem 5 is, in this context, better. Pixels Pro have now... 7 or 8 years support.
  - dawidpotocki 3y ago
    Because Purism cheated and just moved the blobs into a chip that you can't update and made it go through a separate processor[1]. FSF-endorsement is meaningless. This is worse than having a loadable blob from a kernel. [1]: https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurdle/ https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd...
    - fsflover 3y ago
      I don't see how it's worse. As a consequence, it's the only phone that can run fully free OS and have lifetime updates.
      - dawidpotocki 3y ago
        You can't update the firmware at all and you are still running it. Librem 5 has very dated hardware that barely runs. It has only Cortex A53 cores @ 1.5 GHz that were released in 2012. You will see it even lag in Purism's videos. Modern Android phones have better OS, hardware security, battery life and will be useful for longer and cheaper. Librem 5 now costs 1000 USD, the same price that Google Pixel 8 Pro costs which also has guaranteed 7 years of OS support. Will you want to use Librem 5 in 7 years? Also let's not forget how Purism took forever to ship the devices and was declining refunds from people that didn't even get sent the device and waited way over a year. Oh and there are Android phones that can run on mainline kernels.
        fsflover 3y ago
        > Will you want to use Librem 5 in 7 years? Yes: Librem 5 is a full desktop, with my full control, "Thinkpad T400 in mobile". It will always run latest Linux and all desktop apps. I can use it as a full desktop connected to keyboard/screen. On the other hand, Android is not a general purpose computer, which only runs what Google allows you to run. You should try SXMo if you want to see how smoothly Librem 5 and even Pinephone can work if the software is optimized. > You can't update the firmware at all and you are still running it. Is there even theoretically an attack vector here? Yes, Purism has been having problems with refunds. It doesn't affect security or freedom of they devices. Don't buy from them if you will want a refund.
        forty 3y ago
        How will you fix it in 4 years? I don't see were they sell spare parts.
  - HappyDaoDude 3y ago
    It is the closest we have to a freedom respecting device. The baseband processor is still a closed blob but it is a lot better than pretty much everything else out there. Maybe Pinephone eventually will get there as well.
- nomel 3y ago
  AMD and Intel both have their share of proprietary blobs, in their "open source" packages, including microcode. Where do you see a secure path, for any computing, especially high performance?
  - yjftsjthsd-h 3y ago
    > Where do you see a secure path, for any computing, especially high performance? I believe POWER9 is the only modern option that doesn't use blobs? Of course that doesn't remove the possibility of hardware backdoors (nothing does, except maybe an electron microscope and a lot of free time), but that's a higher bar.
    - lrvick 3y ago
      I do in fact have a Power9 workstation next to my desk, though sadly not in use as the biggest security wins for my workflow come from QubesOS which cannot run on Power9, yet.
  - AnthonyMouse 3y ago
    People rightly disapprove of the AMD and Intel blobs and do what they can to disable or remove them, but at least those have stable interfaces that don't decay when there is a new kernel version. Basically every x86_64 processor ever made can run the latest version of the Linux kernel. Would that it were for Qualcomm.
    - nomel 3y ago
      > do what they can to disable or remove them Is there open source microcode, at this point? I can't find anything that suggests there is.
      - fsflover 3y ago
        The parent probably speaks of Intel ME neutralizing/disablement.
      - 3y ago
- jancsika 3y ago
  > Also those blobs are often targeted at specific kernel versions, so in 2 years when the upstream vendors stop releasing updated blobs, then it no longer becomes possible to upgrade the kernel, making it very very hard to keep last gen devices secure. Is this true for the blobs in the Snapdragon 8 Gen 3 Mobile Platform?
- surajrmal 3y ago
  Isn't it true that even if the firmware was open, as long as the hardware is closed it could still be backdoored and doing things you don't want it to? Where do you draw the line?
  - fsflover 3y ago
    You don't draw the line: you support practical, existing systems that are as open as possible. Also, there is Precursor, which is open hardware.
fsflover 3y ago
https://www.gnu.org/philosophy/free-software-even-more-important.html https://www.gnu.org/philosophy/free-software-even-more-impor...

foobiekr 3y ago

Someone knows Qualcomm.

wyldfire 3y ago

As a practical matter, I think the article happens to describe the steps to test it out yourself. I suppose the absence of a mention of binary blobs doesn't necessarily mean that they're not being used, I think it's plausible that there aren't (m)any. > How do I run AOSP using Mainline? > One might think it is quite hard to run AOSP with mainline on such a new platform, but in reality, not at all! Thanks to the long term effort of Linaro and Google engineers making it possible to run AOSP with vanilla Linux releases. Thanks to Amit Pundir for providing a helping hand to get AOSP on this platform. > To generate an AOSP image for the Snapdragon 8 Gen 3 Qualcomm Reference Device using the current set of patches available on the mailing list, use the following instructions, which are derived from here https://source.android.com/docs/setup/build/devices https://source.android.com/docs/setup/build/devices with some small changes.

spookie 3y ago
This is quite refreshing! Thanks for the details

almatabata 3y ago

At minimum i expect QSEE and all their TAs to remain binary blobs, like the keymaster for example.

aseipp 3y ago

The kernel will work fine, but at minimum EL2 runs the Qualcomm Hypervisor (Gunyah) which prevents native KVM virtualization from taking place. This is true of all Snapdragon platforms. Windows supports virtualization on the 8 Gen 3 only because they use a custom setup to load a signed binary blob ("applet") into the EL2 hypervisor, whose signature it is is hardcoded to accept, and that blob/applet then can be used by Windows as a kind of shim into EL2-land to spawn VMs, etc. But Qualcomm's hypervisor is always present and enforcing its security policy. In practice every single modern system is running tons of binary firmware blobs, it's mostly where you draw the line on functionality and isolation of components (security, integrity, availability.) Here, Qualcomm does intentionally reduce some functionality, which is pretty bad when you consider that the UEFI spec for ARM mandates EL2 handover, I think, and they just ignore it.

asddubs 3y ago
What's EL2 exactly?
- baby_souffle 3y ago
  > What's EL2 exactly? Probably execution level 2.
- Avery3R 3y ago
  Exception Level 2 [1] They're analogous to "protection rings" on x86. Generally, EL0 is usermode, EL1 is kernel mode, EL2 is hypervisor, and EL3 is the "secure monitor"/firmware code, closest analogy I think would be SMM on x86. On top of all of that there's also trustzone with its own EL0 and EL1. 1: https://developer.arm.com/documentation/102412/0103/Privilege-and-Exception-levels/Exception-levels https://developer.arm.com/documentation/102412/0103/Privileg...
thomastjeffery 3y ago
> In practice every single modern system is running tons of binary firmware blobs This is a problem we should be loud critics of. Proprietary firmware hurts us all, and practically benefits no one.

robert_foss 3y ago

The GPU probably runs a firmware blob. Other than that Linaro is serious about upstream support.