If you missed the hubbub this week, it was discovered that the Raspberry Pi Foundation added code in the firmware that locks the boot process up if non-original RAM chips are detected onboard. Hot-rodding your Pi is a time-honored tradition in these parts. We do wonder just how many folks are taking the risk of hot-airing the memory off the board, versus paying the extra cash to get one with more RAM. But according to Raspberry Pi, enough boards are showing up that have the RAM surreptitiously replaced, and often defective, that they took the step to lock the machine down.
Should users be alerted to potentially unscrupulous behavior by the companies selling them single-board computers? I think we’d all say “sure”. But should that entirely brick the device? And prevent people from upgrading their own? The hacker in me says “no”. Is there any way to reconcile these two? Our own [Arya Voronova] suggests that it’s no big deal to flash an older version of the initial firmware, and we concur, although it does leave behind all the improvements since 2023, and it will only get less fresh as time goes by.
How to announce that the board has non-factory memory without breaking it? [Jeff Geerling] suggested a non-matching-memory bit that users could check, but then they could also neglect to check. My cellphone has a screen that appears every bootup, and requires me to press the power button to continue, because I rooted the phone and installed an open-source OS. It’s a hassle for sure, but it’s a lot better than bricking the phone or disallowing user firmware entirely.
Doing the same thing for the Raspberry Pi isn’t as easy. You never know what, if any, peripherals are connected, so you can’t guarantee that there’s a screen to alert you or even necessarily a keyboard on which you could acknowledge. We’re reminded of a similar situation with FTDI USB-to-serial converter chips ages ago. Their driver software simply refused to work with counterfeit versions of their chips. Hackers were up in arms, largely because we couldn’t know if the parts were genuine at purchase time, and the counterfeits were widely distributed even by reliable resellers.
So what about it? Can you think up a tamper-evident signal that could run on boot on a Raspberry Pi, maybe a headless system installed in some difficult-to-reach place? Maybe ideally the equivalent of the cell phone’s scare message? It would have to be hard to overlook, but keep the machine running, notifying the user that things aren’t kosher, but not preventing them from getting to work. Sounds like a tall order to us.
I don’t see the point.
No, literally, what is the point of worrying about an upgrade path that less than 1% of 1% would perform for legitimate reasons?
You’d be better off writing a detailed article about the features lost by using an older boot firmware. At least then those thinking of upgrading the ram on a pi can understand what the implications are for themselves.
Of all the pi’s sold, what percentage of owners could remove the memory chip? What percentage of those that could remove it could replace it successfully. Of those, what percentage would care to do this. Of those, what percentage would bother?
This is all about somebody acting like they were told they can’t do something they wouldn’t have done in the first place and now being upset because in a theoretical universe they might have, possibly, maybe, had a reason one day to do something.
Mark, you’re not thinking the implications of this through. Think season 3 premiere – What if the Vulcan physiology had a firmware update that prevented “Bones” McCoy from installing a remote controller in Spock’s body while they tried to recover Spock’s brain, which was stolen to run the visited planet’s water treatment facility? Spock would have died and Season 3 would have ended then and there, and we would be stuck watching reruns of Lost in Space. If I buy a DCC controller for my model train layout and want to upgrade or downgrade it by borrowing Elon Musk’s brain, I should have a right to do so, because I OWN it. Right to repair. We can’t stand by while the other Elon, Elon Upjohn of Raspberry Computers says “Ram and ram. What is ram?”. We need to stop this now and demand our rights, such as a $35 computer with 16GB, model updates every 18 months, and totally free magazines and books. WE hackers MADE Raspberry Computers, Inc, and thus are entitled to these things. Unite behind Jeff before it’s too late!
If you want to argue purity of open source you probably shouldn’t be using a Pi in the first place.
Sad but true. It’s open source until dollar signs get attached to it. Bambu Labs, for instance.
Turns out it’s kind of hard to make money by giving stuff away for free
And it’s kinda hard to make free stuff without having any money. Who’da thunk it.
Wish I could reply to Dude but….. FACTS.
that’s just a jerk response. I’m just not going to buy from them. I’m making no other demands.
Indeed, even most HAD readers won’t bother, and that is even if they already had all the hot air rework kit for that memory chip footprint in stock!
As in quantity bugger all a new RAM chip these days is going to be expensive, and likely not actually a good chip anyway – trust in the supply chain is tricky on parts that are not currently fantastically overpriced by high demand, so in this case…
IMO trying to source the part just isn’t worth the hassle in the first place before you even get to doing the work – way too much effort for such a cheap (relatively speaking) and available brand new total board leaving you another Pi to toss in some other project/tinker with.
I feel like this feature was added by a junior dev somewhere on a whim and now he’s in a huge amount of hot water for a throwaway poorly-thought-out idea to verify the authenticity of RAM chips during a RAM shortage. You’re right that this was an insignificant use case, infinitesimal actually… so the scrutiny applied to it was possibly also very small, at least until the blowback. I expect they’ll probably release firmware without it soon. Unless it was dictated to them by a RAM supplier for some reason. No idea.
Exactly the opposite holds true as well. Why is Raspberry Pi worrying about this? Is it really hurting their bottom line, these sketchy upgraded Pis? Should the consumer be more conscientious of who they are buying their Pi from? The Raspberry Pi people aren’t at fault. Caveat Emptor ( It is a legal principle that places the burden of proof on the buyer to ensure the quality and fitness of the goods or services purchased, in all countries based on English Common Law (US, Canada, UK, Australia, N.Zealand, etc.) The company insists is is PROTECTING US??!?!?! That’s not they’re job. If they want to, they should be searching the web themselves outing the sellers that are doing this, not crippling their own product.
That isn’t true in the uk for new goods. We have common law true, but consumer rights sit on top and grant additional rights. If a new product fails within 6 months of purchase, the vendor/manufacturer must prove the fault occurred after sale. In practice this is difficult, and the manufacturer is liable
That said, I don’t see how bricking the device helps them. The consumer still has a broken device, and rpi still have to demonstrate that it was ‘damaged’ after sale
The caveat emptor principle applies to private sales and other goods sold “as is” between individuals. It doesn’t apply to public commercial entities that have to follow general product safety standards and other liability rules.
The big thing is their ethos. They are willing to brick a victim’s hardware over the fact they didn’t get more money.
Every reply so far missed the point IMO :) i thought Arya got at it in the last article, though.
If you are a hacker buying a board for hacking, then locking it down is violence against you. If you are an end user buying a board for ‘end use’, you probably don’t care and/or you might have a thing for ‘certified authenticity.’ From the manufacturer’s perspective, it’s a question of which kind of user will you support.
Raspberry, for its entire history of Linux SBCs, has been viciously against hackers and hacking. With a lot of unfortunate consequences. So as long as hackers know this, we can make an informed decision. And if we don’t, then it’s a problem.
If you are a company that uses a RPi in your product and they brick it for your customers you care. You care a lot.
but then you got a shady pi that might fail violetnly and weirdly with a mem fault – and they want to prevernt exactly that. as a company wiht a pi in my device I want it to be a stable rela pi – and they managed to verify exactly that.
Might fail and definitively bricked are two different things.
yeah, though, in my opinion pi shouldn’t be used in products. and in my experience, the companies that use pi in products are dumb as rocks anyways (writing logs to non-replaceable SD! my god!). and an top of that, typically they don’t allow firmware updates after they ship.
It should be a flag that prevents boot until acknowledged, but only on first boot for any given storage device. So you insert a new SD card and on first boot it refuses to boot until you hit a specific keyboard button or load an acknowledgment text file, and in the meantime it flashes a red light error pattern. Can’t miss hacked 3rd party boards, but once you’re up and running it’s all good.
“Only on first boot” doesn’t work though, because the unscrupulous board vendors just boot it up once, reset the flag, and ship it.
Unfortunately, the nag has to be every time to be effective against the bad actors. Which means, it hassles the good hackers too…
What’s preventing them from just downgrading the bootloader image? I don’t think this is really stopping the fakes in any way.
because as soon as their customer flashes an SD card and lets the rapsi update process run the firmware will update and the system will now reveal the shady vendor’s substitutions. So within the first hour of use the customer should know they have been scammed, which will allow them to get that refund etc.
You actually think you are getting a refund from a shady seller?
Probably not willingly, but most nations have consumer protection laws that would apply if they won’t. So the bank gives you your money back at least.
Ah, so maybe the raspberry pi update process should have a config option for “allow aftermarket RAM upgrades”. That would be transparent and make it clear what is actually happening.
The “this version of windows is not authentic “ watermark on the bottom right of my desktop really stopped me from running it….for the 7 years it took me to get through college and grad school and then when I had a real income get a dell instead of a Frankenstein machine.
If the flag is stored on the SD card, the user would see it after they install the OS and boot it for the first time.
Re tamper evidence: Soldermask that permanent changes color when the board is reworked.
Tricky, As anything added onto the board after production can no doubt be washed off and/or replaced and anything integrated into the PCB production as silkscreening is would almost certainly be triggered during the initial population of the board. As soldering the parts on for the first time should be pretty comparable to the rework heat wise.
Its just one of those slashed warranty void stickers over the RAM.
Obviously its not completly infallible, but nothing is perfect. If you get a Pi with a damaged, missing, or false serial number on the sticker, then your Pi has replaced RAM. Consumers know and can check the legitimacy of their board, and hackers will rip it off as quickly as they do on all the other devices with warranty void stickers.
Production boards often get rework. No yield is 100%. A better solution would to sell boards with different colored solder mask for different RAM capacities.
Let the bootloader check for a file named “THIS_PI_HAS_FAKE_RAM” on the boot partition (/boot/firmware when booted). If it’s there, allow the modification. Works when headless, easily visible and explained to anybody who starts working with a pi.
Expect a flag in config.txt instead of a magic file name.
That doesn’t solve the problem for people using different operating systems.
the solution is to check the OS boot string for a value that the user needs to add during the OS setup.
The value needs to be something that is difficult or annoying to automate.
You want the “system” to require the user to make a small, but definitely change each time the load a new firmware and/or OS to prove that they are aware of the potential problems and accept them.
Awareness is the problem.
Example. Firmware generates a string which is saved to itself the first time it runs or when the string location is cleared.
Booting halts on a screen that displays a warning, and that string, or outputs the warning and string on serial, or some other output method.
User adds that string to MODIFIED_RAM boot flag with that let’s board boot normally.
Reinstall the OS? Need to add the string to the new one.
Flash new firmware? Need to add the new string.
Once the user is aware of the potential problems, and accepts responsibility for them, no further action should be required until a major system change happens.
And the firmware should be very clear about what the problem is.
“This board has RAM installed that is different from when it was manufactured. To find out more information see (URL). 123abc456def”
Alternate OS are all still using a Raspi boot loader, as far as I know anyway nobody has created the coreboot equivalent for the broadcom chips involved. So that initial bootloader is acting much like your regular PC bios – if it says no then nothing at the higher level OS gets to do anything, as it won’t even get started in the first place. Putting a text file the partition that the boot loader reads to set up for the OS to boot and contains the “Shut up and do as I tell you, the RAM is fine” flag would be fairly trivial and work against any OS, but wouldn’t be the default any of them shipped with.
The only thing such a mechanism doesn’t do is help the user catch the shady vendor if they insist on never running an OS that does the firmware updates to get the patch looking for it. But that would be a problem no matter what without hardware changes.
No, for safety considerations: Fail hard when something isn’t right. That signature from the RAM not only tells you they’re original. If you try to read the signature and it’s not right, can you be sure it’s not an original chip that’s gone bad? Best to be safe and make the user replace the suspicious computer, in case it’s in critical infrastructure. Detect on power-up and make the LED blink in the ‘error’ pattern.
Fully agree. I prefer my hardware to be reliable, if I modify it, I can curse myself and I would be right. And when I buy it, I want to be sure that I get what I paid for. I’ve lost enough time and money with dodgy hardware that was pretending what it wasn’t.
That’s an excellent idea, but how do you determine that failing hard is safe?
On the one hand you don’t want tampered with hardware to make its way into critical infrastructure (an automatic cat feeder is critical infrastructure if you are a cat, it’s all relative) on the other hand you don’t wast some self test routine to decide to fail hard and your cat to go hungry.
I think that the integrity of generic hardware is essential to customer exceptance. The whole point is that one board is like another.
I hade a perfectly nice Volvo that intermittently would decide that the the serial numbers of all the parts did not match and stop running. In the middle if the freeway at 70mph. Volvo would not fix it because it was out of warranty.
Apparently the only manufacturer that took a sane approach to anti theft was Hyundai / Kia and they got pilloried for expecting users to use common sense.
i like the idea of a jumper trace you can cut to disable the check (with “warranty void if cut” printed right on the silkscreen), which will show up if the boards are ever returned. a fuse bit might get burned if the trace is ever cut, as a backup. fry your board its on you.
Would it really deter the sellers from selling the modified RPIs, though? If we can workaround it, they can, too.
Not if the entire board is covered in epoxy.
Given the flood of comments please pardon potential repetitions, but all I want RPi to state on the record is that they’ll drop an unlock update 2-5 years after the corresponding board has gone out of production, by which time I find it reasonable to help owners better stave off obsolescence a bit.
The best defense against dodgy upgrades is for them to make no economic sense, and I choose to believe we’ll eventually escape the current downward spiral.
I suspect its something to do with the peculiar design of the Pi — it boots using what is essentially a proprietary Broadcomm processor which then loads the Pi code as an application. There are plenty of other “Pi Like” boards out there if you want to tinker so why bother?
I’ve always seen the Pi as tool to play with OSes and software and peripherals, rather than as something to hack at the board level.
Nodding toward the FOSS elephant in the room: fork the OS. Build and maintain a version that allows whatever features you want.
This isn’t a hardware or software issue. It’s barely a social issue. It’s an “I care enough to complain about this, but don’t care enough to invest my own time or effort building something I like better” issue.
The appropriate response according to FOSS philosophy is well established: sucks to be you.
FOSS has a long-standing problem with parasites: organisms that take resources away from a host without giving anything back. FOSS has almost unlimited capacity to support free riders, but parasites don’t ride free. They have a unit cost, and there’s a scale where they cost enough to destroy any host. Look at the projects that have shut down because the developers got tired of obnoxious complaints. Look at the projects currently trying to avoid drowning in LLM slop ‘bug reports’.
Parasites turn the magic cauldron into the tragedy of the commons, and going all the way back to The Magic Cauldron, the response to uninformed comments has been clear: ignore them. FOSS is egalitarian in the sense that anyone is free to develop expertise, but has never held the delusion that everyone’s opinion is equally valuable.
FOSS embraces The Bazaar of parallel projects approaching the same problem from different angles. It rejects The Cathedral of a single solution no one is allowed to question. The entire FOSS framework reduces the legal barriers and technical friction of forking a project, and doing so gives FOSS developers the absolute right to say “your wish list isn’t my problem, fork your own version”.
We desperately need to stop turning every project into a mini-cathedral with the impossible mandate to please everyone, and re-embrace the competition of the bazaar.
There is no competition when you rule out the judges, or the other people with “wish lists” who act to define a set of requirements and criteria that a good project should fulfill. If it’s just “my project, my rules, don’t like it, get out”, there’s no feedback for improvement. Each project inevitably defines the problem to meet the solution the have.
You have to agree on something, otherwise it’s not even a bazaar, it’s the city of Babel with a tower that never gets finished and never serves any purpose because the people cannot communicate their intents and desires.
Interesting you should mention that. I went to the firmware repository with the intention of forking it and ripping the offending code out. I couldn’t find the source. It’s just a bunch of binaries.
https://github.com/raspberrypi/firmware
https://github.com/raspberrypi/rpi-eeprom
I could build it from scratch, but there’s no need. If I’m not going to run PiOS, I can just run anything on the older firmware and not worry. It’s only PiOS that’s doing the auto-update to the newest firmware versions. (from what I understand) I guess I could look to fork PiOS and rip out the auto-update code, but I would have preferred to rip out the RAM restricting code and kept the rest of the updates. It’s a considerably smaller target.
It seems PiOS is a bit spread out:
https://github.com/raspberrypi/linux
https://github.com/RPi-Distro
It’s not at all true that people like to complain and aren’t willing to do anything. It’d be nice if the firmware were open source.
Let’s not forget that FTDI actively bricked devices that their driver decided were not genuine.
Agreed, as a victim I was pissed. Devices worked fine on Linux until someone connected them to a Windows machine, and then they were permanently bricked.
Just wanted to point out that although initially it was taken as permanent. It was not permanent, you could run a tool to fix the usb register. I made some grad school money fixing gps equipment that died this way.
I’ll put forth “What did we think was going to happen when they went public?” – $350 for a Pi?
It’s implied that there’s probably a lot of bogus RMA’s happening when unqualified or unlucky people do the work, which is costly. I’m sure the margins on the higher RAM models are pretty sweet, but that’s what’s generating the pressure. Again, what did people think was going to happen?
I do like the “void if cut” trace idea though, but it’s never going to happen, period. Not when it can be fixed from the vendor standpoint in software. But who cares? The Pi is largely past its prime anyway for lots of reasons that pretty much everybody agrees on.
Whether “The Pi is largely past its prime ” depends on what you are using it for.
If having a cheap easy to get device that is standardized that will run specific software and hardware is important and you, as a vendor don’t want to supply the device, it’s still the best thing out there. Lots of products dominate, not because they are better, but because they are good enough and ubiquitous.
Bogus framing. It only matters if your device is not working properly. If there is a warning on bootup that is all that is needed. People upgrade their laptop memory all the time. If Dell (or any other vendor) did the same to our laptop, would you accept that?
Lenovo did. Replace the wifi card, and the thing refuses to boot. It’s evil. And as another commenter noted, FTDI’s driver didn’t “refuse to work” – it actively broke devices. Just like this change.
Coming from the era of computers when dinosaurs ruled the earth and computers were the size of a floor in an office building here. I’ve been building and fixing computers for 50+ years. I’m reminded of the right to repair issue with John Deere tractors. Back in the 1980’s when the Commodore 64 and Apple //e were the ultimate in computers, companies would release games. You had 3 types of computer people: Those who would buy or support shareware, those who would wait for a cracked version and not buy/support shareware, and those who would crack the game and send it out over the bulletin board systems.
Same thing here. You’re going to have people who buy the $300 Pi with the expensive RAM already on it, people who will buy the $200 version and add their own expensive RAM, and those who won’t buy it at all.
Take the games DOOM and Quake. Same thing. Some buy, some support, and some flat out refuse to buy because they believe they’re entitled to it. The C64 and Apple //e were made to be expandable.
You had magazines where you could type in the machine code listed in the pages within and have a game.
That’s the era I come from. As far as the Pi goes, wasn’t it touted as something that you could modify when it first came out? I don’t own one and haven’t followed it. This is just my old gray haired curmudgeonly opinion, but if I want to buy a cheaper Pi and modify it later, that should my choice. Naturally I wouldn’t if the product were still under warranty, but I suppose there are people who would attempt the modification, and send their product back under warranty when it fails. Purposely bricking hardware? Not good for the reputation or bottom line. Bricking counterfeits? Still a gray area but you get what you pay for.
I miss typing in the basic code and then playing lunar lander on my dads machine. It felt so cool. Nothing today will compare to that for me.
Try Net Yaroze. It’s coding but for PS1.
I feel it’s fully excited for new people who will become programmers.
I am fully in the right to repair or modify camp. The pi started as a cheap, accessible, open platform, then once they got the money they bait and switched and now say you no longer have that right? It doesn’t matter how many or few were capable of using it or ever would, the act of sabotaging that on an open platform turns this from a matter of practicality to a matter of principle.
This article mentions the ease of flashing an older firmware to a pi. This ignores the technical aspects of flashing to a bricked system, the security aspects of being restricted to older firmware, or the moral issue of needing to in the first place. Being locked out of updated firmware, for instance, leaves any internet connected modified pi vulnerable to being hijacked for a botnet.
Here’s the deeper problem. Building any such mechanism into an end product, for any reason, is a crime against the consumer. Self destruct features, especially those that are automated or remotely triggered, are inherently anti-consumer, an act of fraud and pre-meditated vandalism. If you sell me a piece of hardware, it becomes my property and you relinquish all access or control over it.
The first paragraph of the article sums it up nicely. They are trying to lock down consumers from buying the cheap version and doing an aftermarket upgrade rather than paying them the for the overpriced higher ram boards. It has nothing to do with protecting anything but their own greed. Compare to Valve, for instance. I purchased a 64 gig Steam Deck and replaced it with an aftermarket 2 TB SSD. There is at least one modder out there doing aftermarket ram chip replacements to double the ram of the system, Valve hasn’t bricked any decks for it. Be like Valve.
Just another data point for why Raspberry Pi is another Github: a proprietary product extruded by an evil corporation we widely and unwisely depend on.
I haven’t used one myself, but I would guess it has a power LED controlled by the processor? Make it flash instead of lighting continuously?
But from what I’ve heard from people talking about it, (among other things that the 5 has a serial number also printed on the box, Broadcomm’s reputation, etc.), turning to enshittification this way doesn’t surprise me. They want to charge extra for more RAM, over what the extra RAM costs, and they don’t want competition in that, that’s my assumption.
To directly answer the question posed by OP (Elliot Williams), the notification doesn’t need to be bulletproof. The only people who need a notification because you can assume they aren’t intentionally hacking the hardware and you can also assume they won’t ever think to check even if they have problems are people who are using defaults all around. Aren’t those people using “Raspberry Pi OS” distributed directly by the vendor? Just put the notification in that OS…like in /etc/motd and/or in the default X11 root background image or whereever this ‘normal user’ will see it.
Normal users do normal things, you don’t have to go out of your way to make sure they couldn’t miss this warning message if they do something abnormal.
I can think of a way, how about put a so-dimm slot on the thing so you can upgrade the ram without desoldering anything, then it doesn’t matter if its locked down.
Blocking on boot is certainly better notification of an issue than silently bricking the device. If the user doesn’t understand how to get the I/O they’ll return the device as DOA.
That’s my opinion, though, and I’m not on the board of RPF. They can do wnatever they want with their Broadcom boxes.