From f4d92937f0473bd5d37c659a16cb229e4534bd1c Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Tue, 27 Dec 2016 19:57:12 +0100 Subject: 33c3: more work on the slides, hopefully nearing completion --- 2016/33c3/33c3-modems.adoc | 189 +++++++++++++++++++++++---------------- 2016/33c3/images/quectel_ipr.jpg | Bin 0 -> 59089 bytes 2 files changed, 110 insertions(+), 79 deletions(-) create mode 100644 2016/33c3/images/quectel_ipr.jpg (limited to '2016') diff --git a/2016/33c3/33c3-modems.adoc b/2016/33c3/33c3-modems.adoc index a79f784..4ba0bbd 100644 --- a/2016/33c3/33c3-modems.adoc +++ b/2016/33c3/33c3-modems.adoc @@ -26,30 +26,38 @@ Dissecting modern (3G/4G) cellular modems * 8 years since _Anatomy of Smartphone Hardware_ at 25C3 * 7 years since OsmocomBB for GSM * Used and built M2M devices using 2G modems at work -* Started to build Osmocom 3G/4G software, logs/traces help -* Build tools to help understanding cellular technology - -== History - -image:images/sl6087_hw.png[height=280,role="gimmick_right"] - -* OpenAT by Sierra Wireless -* Write C code using OpenAT APIs -* Dynamically loaded into the RTOS -* Runs without privilege separation, MMU -* Eclipse based IDE and plugins (in clojure) -* Protocol to multiplex AT, log, debug -* 2G and 3G modems were available -* Discontinued HW platform => Locked in -* Various other limitations +* so we're looking for a modem that can be used for +** our next-generation M2M/embedded devices +** testing/logging/tracing Osmocom 3G/4G network-side software +** building more tools to help understanding cellular technology + +== Cellular Modems in M2M + +image:images/sl6087_hw.png[height=300,role="gimmick_right"] + +* Assume you want to build a M2M device +* Classic approach to M2M/Embedded cellular: +** Cellular modem with AT commands over Serial/USB +** Main Processor runs M2M application +* if you run Application in Modem, you can save PCB space, power and BOM cost +** OpenAT by Sierra Wireless +*** Write C code using OpenAT APIs +*** Dynamically loaded into the RTOS +*** Runs without privilege separation, MMU +*** Protocol to multiplex AT, log, debug +*** Discontinued HW platform => Locked in +*** Various other limitations == Device requirements -* Get textual logging when handling messages -* Get a copy of the radio network message and export to GSMTAP -* Like Tobias Engels https://github.com/2b-as/xgoldmon[x-goldmon] -* But for GPRS, 3G and 4G -* Enabled by default and not locked down in the future +Our requirements for a good modem + +** Ability to run application code inside modem +** Avoid modem supplier vendor lock-in (EOL, ...) +** Get textual logging when handling messages +** Get a copy of the radio network messages and export to GSMTAP +*** Like Tobias Engels https://github.com/2b-as/xgoldmon[x-goldmon] +*** But for all GPRS, EGPRS, UMTS and LTE messages == Qualcomm DIAG protocol @@ -67,22 +75,20 @@ image:images/diag_frame.png[width="90%"] image:images/28c3_option_stick.png[width="30%",role="gimmick_right"] -* 3G Options Icon stick exposes DIAG out of the box -* Quectel UC20 (2G+3G) enable it by default -* Quectel EC20 (2G+3G+4G) enable it by default -* 2G, 3G and 4G sounds quite nice -* EC20 comes as mini-PCIe module as well - - -== Quectel EC20 +* Old Option Icon 225 stick exposes DIAG out of the box +* Quectel UC20 (2G+3G) expose DIAG by default +** but no LTE support +* Quectel EC20 (2G+3G+4G) expose DIAG by default +** 2G, 3G and 4G sounds quite nice +** EC20 not only a LGA solder module but also as mini-PCIe +*** convenient for early testing / prototyping without custom board -image:images/ec20.png[height=200,role="gimmick_right"] +image:images/ec20.png[height=300,role="gimmick_right"] -* Using a Qualcomm MDM9615 chipset +* EC20 using a Qualcomm MDM9615 chipset ** Also used in the iPhone5 -* Surprisingly runs Linux -* Not surprising to people familiar with MDM9615 (e.g https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Mickey-Shkatov-Jesse-Michael-Scared-poopless-LTE-and-your-laptop-UPDATED.pdf[Mickey Shkatov]) -* Almost no documentation available +** Almost no documentation on MDM9615 available +** Still, a good candidate for starting our research... // Erst ein mal EC20 und sagen wieso es interessant ist // und dann, dass es Linux hat.. um dann ein Block diagram @@ -91,21 +97,32 @@ image:images/ec20.png[height=200,role="gimmick_right"] [role="change_topic"] == An unexpected surprise -== GPL compliance +== Firmware update, hints of Linux -* Got a firmware upgrade to fix stability +* Got a firmware upgrade to fix stability / bugs * Looks like it contains traces of Linux? +* Looks like it uses fastboot for the update +* Other people have already found Linux in MDM9615 based products (e.g https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Mickey-Shkatov-Jesse-Michael-Scared-poopless-LTE-and-your-laptop-UPDATED.pdf[Mickey Shkatov] at DEFCON 23) +* But why would there be Linux inside a Modem? +** Qualcomm is known for their REX/AMSS on Hexagon baseband ?!? +* And if it contains Linux, GPL requires them to mention that, include + License text and provide source code ?!? + +== GPL compliance + * No written offer, let's see if it runs Linux * Armijn Hemels `gpltool.git` has `unyaffs` to unpack yaffs -* strings, etc., `AT+QLINUXCMD=?` -* The fun and exploration begins - +* `strings`, etc. clearly reveal Linux, glibc, busyox +** other intresting strings like `AT+QLINUXCMD=?` show up +* The fun and exploration begins... +** technical analysis (serial console, firmware reversing, ...) +** legal enforcement to get source code of GPL/LGPL components (Harald is founder of http://gpl-violations.org[gpl-violations.org]) == GPL compliance * Linux basis created by Qualcomm and used by Quectel -* https://wiki.codeaurora.org/xwiki/bin/QLBEP/ -* Many branches, releases, which to use? +** https://wiki.codeaurora.org/xwiki/bin/QLBEP/ +** Many branches, releases, which to use? [quote, Tonino Perazzi] I tried instruction above to build yaffs2 for MDM9615, so I downloaded source `M9615AAAARNLZA1611161.xml` but during compilation I faced some libs that are missing such as libQMI and acdb-loader.. @@ -116,33 +133,30 @@ image:images/qualcom_many_releases.png[width="80%"] [qanda] Asking for the complete and corresponding source:: - Receiving source for the flash tool - -== GPL compliance - +[quote,Quectel] +** The source code of Qflash tool in Linux is attached, [...] [qanda] -Asking for the complete and corresponding source:: - We never been in legal dispute and we always make sure to understand IPR ahead of using technology belonging to third party. +Asking again for the complete and corresponding source:: +[quote,Quectel] +We never been in legal dispute and we always make sure to understand IPR ahead of using technology belonging to third party. +image:images/quectel_ipr.jpg[width="100%"] == GPL compliance [qanda] Asking for the complete and corresponding source:: +[quote,Quectel] We appreciate the efforts that your client had put into the open source -project netfilter/iptable. However, We have some doubts about the alleged -copyright. From our perspective, your client does not have the right to -empower the copyright. We think software netfilter/iptable is built on -the code operating system GUN/Linux, thus subject to GPL terms, where FSF +project netfilter/_iptable_. However, [...] *your client does not have the right to +empower the copyright*. We think software netfilter/iptable is built on +the code operating system _GUN_/Linux, thus subject to GPL terms, where FSF requires that each author of code incorporated in FSF projects either -provide copyright assignment to FSF or disclaim copyright (“we should keep -the copyright status of the program as simple as possible. We do this by -asking each contributor to either assign the copyright on his contribution -to the FSF, or disclaim copyright on it and thus put it in the public -domain”). Therefore, It seems that your client does not have the copyright -on netfilter/iptable. -As one of the leading providers of wireless solution, Quectel is always -respectful IPR. We would like to compliant with GPL and do some necessary +provide copyright assignment to FSF or disclaim copyright. Therefore, +It seems that *your client does not have the copyright on netfilter/iptable.* + + + +As one of the leading providers of wireless solution, *Quectel is always +respectful IPR*. We would like to compliant with GPL and do some necessary statements，including a disclaimer or appropriate notices. Under the terms of GPL, we would like to dedicate Kernel code of EC25x to free software community. @@ -151,39 +165,45 @@ community. [qanda] Asking for the complete and corresponding source:: +[quote,Quectel] Many thanks for your detailed explanations GPL/LGPL license terms and the practical methods. I will carefully study your suggestions again and find a proper way to open GLP/LGPL licensed software. Basically, we will simply provide a tarball of open source for download at this time. And release the git repositories in next step. -== GPL compliance - [qanda] Asking for the complete and corresponding source:: +[quote,Quectel] We are always willing to achieve GPL compliance. -== GPL compliance - [qanda] Asking for the complete and corresponding source:: - To be frank, we have no experience over Open Source things before. So we need some time to know of all things and construct the Open Source projects. Within a short time, we cannot construct a perfect web site to present Open Source things now. However, we will continue to do like that. +[quote,Quectel] + So we need some time to know of all things and construct the Open Source projects. Within a short time, we cannot construct a perfect web site to present Open Source things now. However, we will continue to do like that. == GPL compliance [qanda] Your tarball is missing some files:: - We have issued all GPL licensed source code. - We have no the xt_dscp file in the project, and nor Qulacomm. It must be - caused by your compilation environment. - If you have more question or problem during the development with Quectel - module, please add my Skype ID (XXXXX), I will continue to support you - on Skype. - The email will not discuss the compiling issue any more.'' +[quote,Quectel] +We have issued all GPL licensed source code. +*We have no the xt_dscp file in the project, and nor Qulacomm*. It must be +caused by your compilation environment. +If you have more question or problem during the development with Quectel +module, please add my Skype ID (XXXXX), I will continue to support you +on Skype. + +*The email will not discuss the compiling issue any more.* == GPL compliance * ... many months later -* License compliance still not achieved +** we have received various source tarballs +** they contain not only GPL/LGPL code but other FOSS code (thanks!) +** full license compliance still not achieved, but improving... * Sierra Wireless Legato is a positive example of a competitor +** they not only provide the OE/Linux source but extensive +documentation! +** but they try to lure customers into a proprietary Legato framework, +and thus again vendor-lock-in :( image:images/legato_flash.png[width="80%"] @@ -301,8 +321,8 @@ We found a bunch of proprietary Linux userspace programs |`atfwd_daemon`|Implement Quectel-Specific AT Commands |`quectel_daemon`|?; various ASoC related bits |`qti`|? -|`mbim`|Mobile Broadband IF Model (tranlates MBIM to QMI) -|`QCMAP_ConnectionManager`|runs linux-base WiFi AP/router wit LTE backhaup +|`mbim`|Mobile Broadband IF Model (translates MBIM to QMI) +|`QCMAP_ConnectionManager`|runs linux-base WiFi AP/router with LTE backhaup |`quec_bridge`|reads GPS NMEA from `/dev/nmea` and writes it to `/dev/ttyGS0` |=== @@ -405,21 +425,32 @@ Start download fota for update.zip * Add status and reboot to recovery * Apply update.zip and reboot -== Recommedation +== Recommedation to modem vendors -* Please keep it open, good for learning +* It is great to have an open and accessible Qualcomm based modem for + further research and developing custom applicatins/extensions +* Security issues (particularly unverified FOTA) must be fixed +* We need security from attackers _without locking out the user/owner_ +** If vendors introduce verified boot and/or FOTA, allow owner specified keys! +* Please keep it open, good for learning and many applications * Allow owners to modify the software of their device * Secure the FOTA upgrading with owner specified keys +== Unrelated Announcement + +* Osmocom project has gained support for 3G/3.5G during 2016 +* Osmocom suffers from lack of contributions :( +* We want to motivate more contriutions +** _Accelerate 3.5G_ programme provides 50 free 3.5 femtocells to contributors +** tell us how you would use your free femtocell to improve Osmocom +** Call for Proposals runs until January 31st, 2017. +** FIXME: link to wiki page == Questions * Questions? -== Announcement - -* 3G femtocells for Osmocom/OpenBSC development == Links diff --git a/2016/33c3/images/quectel_ipr.jpg b/2016/33c3/images/quectel_ipr.jpg new file mode 100644 index 0000000..011bd36 Binary files /dev/null and b/2016/33c3/images/quectel_ipr.jpg differ -- cgit v1.2.3