Hacker News Reader

The theory is that the boot firmware is executed with the MMU off, and then jumps to your code and is done. Unless you specifically call into ROM, it just sits there unused.

Now it could be that there is some hardcoded exception handler in the memory controller that jumps to a specific area of ROM when a certain instruction is hit, and that causes exfiltration of data. But to do that would require a lot of separate components interacting, including ones that Freescale doesn't have access to (i.e. the A9 RTL, and possibly the PL-310 and the memory controller) and would require Freescale put the data exfiltration routine in ROM, or maybe there's an exfiltration routine hardcoded into the PL-310, in which case I wonder how they actually get data out of the machine.

As you say, that firmware can't be changed. It can be read out and analyzed for possible security problems, and I hope someone does that. The code is mostly concerned with validating signed boot images for "secure boot" where manufacturers don't want third-party firmwares to be used. It checks the firmware signature / decrypts the firmware using a key burned into OTP fuse bits. Novena doesn't use fuse bits, and in fact doesn't even blow the "boot source" fuses, meaning you're free to change the boot source from internal SD to external SD to SSD to booting from USB.

You can actually blow the fuses yourself and load a key known only to you, which means only you can sign firmware that it'll boot.

xobs, What was your experience working with the CPU vendors to open up the ROM or atleast provide a method to by pass the ROM and use an external ROM?

"Bypass the ROM" would be a custom chip, albeit a small variation. So that's not going to happen. However the boot ROM isn't actually a secret, it's right there in the memory map for the processor and as Bunnie says you can just read it out.

Given that it's a ROM and not reprogrammable, and not used after it transfers control to the user bootloader, I think it's fair to treat it more as part of the silicon than as a piece of software. It might be worth auditing for bugs in the boot assurance crypto though.

(If the hardware is malicious, it would be far simpler and less detectable to do it as a silent peripheral, possibly even a whole other processor, than in the boot ROM)

This is purely speculation, but I wouldn't be at all surprised if there was a pin-strapping method that disabled the boot ROM and caused it to be read off the EIM interface, which is probably how the ROM was debugged in the first place.

People are afraid of the Intel Management Engine, and you can read about it here: http://libreboot.org/faq/#intel

It is a dense and very detailed text, but basically your Intel CPU contains Active Management Technology (AMT) which lets remote users control your computer, which may or may not be what you want, and there might be backdoors hiding here.

It also includes Intel Boot Guard, which prevents users from installing their own firmware (such as libreboot and coreboot) because it needs to be signed with a key from Intel.

The page sums it up like this:

> In summary, the Intel Management Engine and its applications are a backdoor with total access to and control over the rest of the PC. The ME is a threat to freedom, security, and privacy, and the libreboot project strongly recommends avoiding it entirely. Since recent versions of it can't be removed, this means avoiding all recent generations of Intel hardware.

Also see Joanna Rutkowska's recent paper: https://news.ycombinator.com/item?id=10458318 (fun reading).

I've asked a couple of times here, but I haven't had an answer:

I've got an X1 carbon where the vPro/AMT/ME setup screen doesn't load (CTRL+P on boot does nothing, missing UEFI binary?). Can I still activate it in Linux for my own purposes?

Intel firmware is obfuscated, closed-source and very low-level which means that it could be running nearly anything -- you don't know what it is.

The SoC has closed-source blobs, but it's all debugging and reversible which is not as good as OSS, but not as bad as opaque blobs from Intel.

I really can't wait for the first fully open down to the metal system. A few arm cores, a few vulcan-ish gpu cores, optional fpga. Just nice compute power easy to tap into for oss devs.

ps: I shouldn't have written ARM, I meant simple ARM-like ISA (from what I understand it's way smaller than x86).

Supposedly the CHIP computer project has committed Allwinner to open source their SoC. I don't know exactly what that entails since it's an ARM core chip, but I'm tentatively holding my breath for that. I will be extremely surprised if they deliver on that commitment, but if they do it could be really great for the open hardware community.

Allwinner uses closed source GPUs, Mali and PowerVR, they have been quite good in documenting their own stuff though.

Is Allwinner actually providing code, or is Next Thing using the linux-sunxi contributions to mainline?

That I have no idea on. I couldn't find many details either. I assume it's because CHIP doesn't want this to be a selling point on the project because most likely it won't happen given Allwinner's past total disregard for being GPL compliant.

Oh, I didn't understand they made AW to open source the SoC..

What do you mean by "open source the SoC"?

You can always go for the Samsung S3C SoC which loads 4kB of code from NAND flash. Now if you ask me whether the loading is software in a certain boot rom internal to the chip or hardware logic I don't know.

You can also try Texas Instruments chips too but I think the initial bootup starts from a ROM.

What's the probability that ARM will open-source their CPU core designs?

ARM isn't open sourcing anything anytime soon. Take a look at OpenRISC and RISC-V. They're aiming at a fully open source SoC implementation in silicon.

http://openrisc.io/

http://riscv.org/

Alternatively there's the Open Processor Foundation, who are taking advantage of the fact that Hitachi's SuperH patents are lapsing over the next few years (some already have): http://0pf.org/about-ocf.html

The official website above has a lot of info, but there is a nicer intro @ lwn: https://lwn.net/Articles/647636/

But IIRC (some blog benchmark) they are very very slow.

Also, the benchmarks we did a while ago on a taped-out chip with our in-order RV64 core, Rocket, showed that it compared quite favorably to an ARM Cortex A5.

http://riscv.org/download.html#tab_rocket_core

Unfortunately, it would be quite difficult for outside organizations to replicate these measurements unless they can pay TSMC for a fab run.

(Disclaimer: I am a PhD student in the Berkeley computer architecture group, which designs RISC-V)

An ISA can't be "fast" or "slow". It's just a specification. There's no reason you can't build a RISC-V core that's just as fast as an ARM or x86 core. The only reason we haven't done so is because we don't have access to the modern fabrication technologies that Intel and commercial ARM licensees use.

Instruction sets very much can be fast or slow, at least in the context of discussing specific use cases. Many of the inner loops that take up most of the active cycles on a CPU today (crypto, compression, imaging, signal processing, linear algebra) have very specific code patterns that are can be targeted with specialized instructions that provide integer-multiple reductions in instruction count.

Let's assume that application-targeted instructions can reduce the size of the inner loops in these applications by 2x. Even the RISCiest cores do not, in practice, run at 2x the clock speed or 2x the issue rate of cores with application-targeted instructions. Thus, ISAs with baked in support for these use-case accelerating instructions will be more performant.

The RISCy core probably wins on mm^2, but a perf/mm^2 analysis will be highly dependent on how well designed the application-specific instructions are for area conservation.

Okay, fair enough. What you describe are essentially extended instructions, and RISC-V has support for it. One of our teams is currently working on a vector co-processor that can get very good performance on compute-heavy workloads.

I really wonder what is the point of OpenRISC/RISC-V, isn't there already open SPARC? I know that they removed quite a lot of things (too much IMHO) in the RISC-V ISA to reduce the number of gates needed, but this has a price: there is probably much more support for SPARC in compilers/applications than for RISC-V.

I know. I was trying to be subtly sarcastic (and obviously failed).

We already have open Sparc. Apparently what we need is a fully open SoC (all the other stuff) along with a CPU that's tested as a full ASIC (as opposed to FPGA) design. Some comments in this sub-thread:

https://news.ycombinator.com/item?id=10458577

Personally I'd love for some foundation to just buy up Motorola and open up everything, but I'm guessing a) they depend on IP they can't open up, and b) I guess Google kept all that, and the Motorola that Lenovo now owns(?) is just a brand?

Moto's chipmaking division was spun off as Freescale Semiconductor. NXP (née Phillips) acquired Freescale earlier this year.

Both FSL and NXP are large ARM licensees so yeah, ain't gonna happen.

Small, since that's how they make their money (design licenses)

But there's a completely open ARMv2 clone: http://opencores.org/project,amber

Which is probably the third open source attempt. ARM usually stomps hard on these project. Anybody remember blackARM, nn ARM?

Clones are even worse out. TurboSilicon was attacked so hard they were thankful to hand all their assets to ARM.

"Instead we chose an ARM-based Freescale i.MX6 system-on-a-chip, which has no such updatable code"

Genuinely curious ... in a previous HN discussion:

https://news.ycombinator.com/item?id=10458318

ARM chips with special "9th cores" were discussed:

https://news.ycombinator.com/item?id=10459158

Do ARM based Freescale chips, like the i.MX6, have "features" like this ?