Hacker News Reader

Comment by levidos | Hacker News Reader

Noob question but why is it the firmware that needs reverse engineered and not the driver?

In this instance, it appears the author's motivation was to facilitate a clean room reimplementation by "producing a natural-language specification for others to reimplement". In other instances security researchers might reverse firmware in order to find vulnerabilities. As the article states:

> One example motivating the production of open source firmware for the BCM5719 is that it's the only closed-source firmware blob found in the Talos II, a high-performance POWER9-based system otherwise wholly free of firmware blobs... Once this is delivered, it will be possible to use Raptor's POWER9 systems with purely 100% free, open source firmware. As far as I am aware, there is no other machine in the same performance class which can make such a claim.

>All Raptor systems shipped after May 10, 2021 use the open-source Ortega firmware for the BCM5719 device.

https://wiki.raptorcs.com/wiki/BCM5719

My old team did some work in this area a few years ago. We got the Talos II BMC code to be binary reproducible, and had a go at automating David A. Wheeler's compiler diversification to stop compiler subversion. We checked the boxes we intended to, though never got enough funding to polish it up. It's probably broken now, but we did post a portion of our work on gitlab: https://gitlab.com/deepthirst.

In the simplest sense, because they already have source for the driver, and not for the firmware.

More broadly (no pun intended), NIC vendors want to work with Linux and the GPL means they have to release the source of a driver to do so. No such legal requirement applies to firmware.

Because the open drivers are good enough but have to deal with a proprietary blob that can't be fixed for bugs and has undefined features/behavior.

Because vendors have realized GPL condoms are a thing and have started basically sacrificing the driver layer to the legal requirements of GPL, while keeping the secret sauce secret through firmware.

Firmware is the new proprietary/FLOSS boundary layer.

Didn't the GPLv3 work to eliminate this? With the "Tivoization" thing

Unfortunately (for better or worse) GPLv3 flopped

There are a lot of misconceptions around Tivo. Tivo did not do what people think Tivo did and refer to as "Tivoization". Tivo broke their proprietary software when you modified the installed Linux kernel. Both the GPLv2 and GPLv3 allow what Tivo did. Both GPLv2 and GPLv3 require that users can modify installed GPLed software.

https://sfconservancy.org/blog/2021/jul/23/tivoization-and-t... https://sfconservancy.org/blog/2021/mar/25/install-gplv2/ https://events19.linuxfoundation.org/wp-content/uploads/2017...

The situation around GPL "condoms" would be the same for both GPLv2 and GPLv3 too, if the firmware can be considered a derivative work then there may still be a GPL violation, but more likely the driver<>firmware interface would be fairly high-level, so all the functionality is in the firmware.

Reply on news.ycombinator.com