Project Olympic: BCM4388 Autonomous Operating System Analysis
Documentation of Chipset-Level RTOS and Host Visibility Limitations
Overview
This directory contains analysis of the Poppy_CLPC_OS autonomous operating system running on the Broadcom BCM4388 wireless chipset. The research documents how this dedicated Real-Time Operating System (RTOS) operates independently of the Host iOS/Android kernel, creating visibility and auditability gaps for Host security controls.
Key Finding: The BCM4388 runs a complete operating system (Poppy_CLPC_OS with Oly.Nash 1.70.2 calibration modules) that executes continuously—including during Host CPU sleep states—with direct memory access privileges and persistent storage that survives factory reset.
Files
Primary Artifacts
| File | Size | MD5 | Description |
|---|---|---|---|
| bluetoothd-hci-2025_01_02-12_47_38.pklg | 1,729,081 bytes | 3c32f6926fa043e57c76b585a02341d0 |
HCI packet log with runtime behavior |
Analysis Documents
| Document | Focus |
|---|---|
| Technical Analysis.md | Comprehensive security architecture analysis |
The Poppy_CLPC_OS Environment
Identification
Firmware String Found in HCI Log:
BCM4388C0_22.2.507.1323_PCIE_Poppy_CLPC_OS_STATS_20241003.bin
Components:
- BCM4388C0: Chipset model identifier
- Poppy: Project codename
- CLPC_OS: Closed-Loop Power Control Operating System
- STATS: Telemetry collection enabled
- Build Date: October 3, 2024
Architecture
Operating System Modules Identified:
| Component | Version | Location | Function |
|---|---|---|---|
| Poppy_CLPC_OS | 22.2.507.1323 | Firmware image | Main RTOS for power and RF control |
| Oly.Nash | 1.70.2 | RAM offset 0x0032d6 | CLM calibration module (NVRAM) |
| ClmImport | 1.69.0 | RAM offset 0x0032d6 | Regulatory domain enforcement |
Compilation Evidence:
"Oly.Nash............1.70.2...........ClmImport: 1.69.0.............v2 Final 231204"
Build date: December 4, 2023
Hardware Privileges
Direct Memory Access (DMA) Channels:
10 independent DMA channels mapped in RAM dump:
| Channel | Offset | Descriptor Base | Buffer Address |
|---|---|---|---|
| wl0:dma0 | 0x1a99c0 | 0x008f9b28 | 0x18031220 |
| wl0:dma1 | 0x1e54d8 | 0x008f9b28 | 0x18031260 |
| wl0:dma2 | 0x1be214 | 0x008f9b28 | 0x180312a0 |
| ... | ... | ... | ... |
| wl0:dma9 | 0x1be44c | 0x008f9b28 | (varies) |
DMA Capabilities:
- Device-to-Host (D2H) memory writes confirmed via error strings
- Host-to-Device (H2D) memory reads confirmed via error strings
- Hardware-level access bypasses Host OS memory protection
- Operates during Host CPU sleep states
Operational Characteristics
Autonomous Execution Evidence
From HCI Packet Log Analysis:
| Metric | Value | Implication |
|---|---|---|
| AP Sleep/Wake cycles | 599 | Extensive autonomous operation periods |
| Packets in longest sleep | 90 (67 commands + 23 data) | Chipset processes traffic without Host oversight |
| Total HCI commands | 87,654 | Substantial autonomous decision-making |
| State machine error | 1 ("state:10") | Firmware encountered undefined state |
Key Observation: During extended Host sleep (1,307-byte window), Poppy_CLPC_OS processed 90 packets completely independently—managing Bluetooth connections, memory allocation, and network decisions without Host OS involvement.
Power State Correlation
Critical State Warnings:
- 79 total "2.4 GHz critical state" warnings observed
- 29 warnings (36.7%) occurred within 500 bytes of AP Sleep events
- Most common timing pattern: 89-byte distance (27.6% of correlations)
Interpretation: Power transitions create timing windows where Poppy_CLPC_OS state machines experience increased instability—consistent with complex asynchronous event handling during sleep/wake coordination.
Persistence
NVRAM-Backed Modules:
The Oly.Nash and ClmImport modules reside in non-volatile memory:
| Sanitization Procedure | iOS User Data | iOS System | Poppy_CLPC_OS Firmware | Oly.Nash NVRAM |
|---|---|---|---|---|
| Erase All Content | ✓ Deleted | Preserved | Preserved | Preserved |
| DFU Restore | ✓ Deleted | ✓ Reinstalled | Preserved | Preserved |
| Factory Reset | ✓ Deleted | ✓ Reinstalled | Preserved | Preserved |
Implication: The autonomous operating system and its calibration modules survive all standard Host OS reset procedures.
Security Architecture Implications
The Host OS Visibility Gap
What Host OS Can Monitor:
- High-level WiFi/Bluetooth on/off state
- Network traffic after encryption (application layer)
- General power state transitions (sleep/wake)
What Host OS Cannot Monitor:
- Poppy_CLPC_OS internal operations during Host sleep
- Real-time DMA transactions (only IOMMU policy enforcement)
- NVRAM module contents (Oly.Nash, ClmImport)
- Chipset state machine transitions
- Packet-level decisions during autonomous operation
Trust Boundary Analysis
| Security Control | Host OS Domain | Poppy_CLPC_OS Domain |
|---|---|---|
| Execution Control | Kernel enforces process isolation | Operates independently with dedicated RTOS |
| Memory Access | MMU enforces page tables | DMA with IOMMU policy (hardware-enforced) |
| Persistence | Factory reset clears all data | NVRAM survives factory reset |
| Audit Logging | Comprehensive syscall logs | Limited HCI logs (post-hoc only) |
| Real-Time Monitoring | Yes (when CPU active) | No (especially during sleep) |
Critical Finding: Poppy_CLPC_OS operates in a separate trust domain from the Host OS, with hardware-level privileges but limited real-time Host visibility.
Relationship to Main Repository
Main Repo (BCM4387c2): Universal Architecture
The parent repository documents features common across all wireless chipsets:
- ThreadX RTOS presence
- DMA operations (52 references)
- Power state management
- NVRAM calibration storage
This Study (BCM4388): Specific Implementation
Project "Poppy_CLPC_OS" extends the analysis with:
- Named RTOS identification: Poppy_CLPC_OS (not generic ThreadX)
- Versioned modules: Oly.Nash 1.70.2, ClmImport 1.69.0
- Runtime behavior: 599 sleep cycles with autonomous packet processing
- Timing patterns: 36.7% correlation, 89-byte event structure
- Detailed DMA mapping: 10 channels with exact memory addresses
Bridge: Main repo shows what chipsets do architecturally. This study shows how Poppy_CLPC_OS implements that architecture with specific modules and runtime behavior.
Key Takeaways
Technical Reality
- Autonomous Operating System: BCM4388 runs Poppy_CLPC_OS—a complete RTOS managing power, RF, and network operations
- Hardware Privileges: 10 DMA channels provide direct memory access (IOMMU-constrained)
- Persistent Modules: Oly.Nash calibration in NVRAM survives factory reset
- Independent Operation: Processes 90 packets during Host sleep with zero Host oversight
- Timing Dependencies: 36.7% correlation between power transitions and critical warnings
Security Implications
If Poppy_CLPC_OS Firmware Were Compromised:
- Would operate with DMA privileges during Host sleep states
- Could persist through factory reset (NVRAM modules)
- Would have limited Host OS visibility or detection
- Could make autonomous network and memory decisions
Current Protections:
- IOMMU enforces DMA access policies (hardware-level)
- Firmware signing by Broadcom (update integrity)
- Limited attack surface (no direct user input to chipset)
Gaps:
- No real-time Host monitoring during chipset autonomous operation
- No Host OS verification of NVRAM contents
- Limited audit logging of chipset-level decisions
- Factory reset does not clear chipset firmware/NVRAM
Context and Limitations
Why This Architecture Exists
Poppy_CLPC_OS autonomous operation is required for:
- 802.11 Power Save Mode (maintain connectivity during Host sleep)
- Real-time packet processing (multi-gigabit WiFi 6 performance)
- Battery life optimization (Host CPU sleep while maintaining network)
- Regulatory compliance (independent CLM enforcement)
What This Analysis DOES Show
✓ Detailed identification of autonomous OS (Poppy_CLPC_OS)
✓ Documentation of hardware privileges (10 DMA channels)
✓ Evidence of persistent modules (Oly.Nash NVRAM)
✓ Runtime behavior patterns (autonomous packet processing)
✓ Host OS visibility limitations (especially during sleep)
Verification
Quick Check Commands
md5sum bluetoothd-hci-2025_01_02-12_47_38.pklg
# Expected: 3c32f6926fa043e57c76b585a02341d0
# Extract Poppy_CLPC_OS reference
strings bluetoothd-hci-2025_01_02-12_47_38.pklg | grep Poppy_CLPC_OS
# Output: BCM4388C0_22.2.507.1323_PCIE_Poppy_CLPC_OS_STATS_20241003.bin
# Count DMA channels
strings SoC_RAM.bin | grep "wl0:dma" | sort
# Output: wl0:dma0 through wl0:dma9
Analysis Script Usage
See detailed analysis documents for:
- Python scripts for DMA channel extraction
- HCI log parsing for power state correlation
- Statistical analysis of timing patterns
- Binary offset verification
Recommendations
For Security Practitioners
- Threat Modeling: Include Poppy_CLPC_OS autonomous operation in device threat models
- IOMMU Verification: Ensure DMA protections properly configured on platforms
- Persistent Firmware: Consider chipset firmware in device sanitization procedures
- Visibility Gaps: Acknowledge limited monitoring during Host sleep states
For Researchers
- Comparative Analysis: Examine RTOS implementations in Qualcomm/Intel/MediaTek chipsets
- Dynamic Analysis: Instrument DMA transactions during power transitions
- NVRAM Study: Investigate Oly.Nash module integrity verification
- Timing Analysis: Further study of 89-byte event structure pattern
For Industry
- Firmware Transparency: Disclose autonomous OS capabilities (e.g., Poppy_CLPC_OS)
- Attestation: Standardize firmware integrity verification mechanisms
- Audit Logging: Enhance real-time visibility into chipset operations
- User Controls: Provide mechanisms to audit NVRAM-backed modules
Attribution
Analysis Date: December 2025
Researcher: Joseph Goydish II
Primary Finding: Identification and characterization of Poppy_CLPC_OS autonomous operating system in BCM4388
Citation
Goydish II, J. (2025). Poppy_CLPC_OS: BCM4388 Autonomous Operating System Analysis.
Documentation of Chipset-Level RTOS and Host Visibility Limitations.
License
Analysis & Documentation: Public benefit, freely shareable with attribution
This research documents architectural characteristics of commercial chipset firmware for educational and security research purposes.