Evolved stars hint to an external origin of enhanced metallicity in planet-hosting stars

Abstract: Exo-planets are preferentially found around high metallicity main sequence stars. We aim at investigating whether evolved stars share this property, and what this tells about planet formation. Statistical tools and the basic concepts of stellar evolution theory are applied to published results as well as our own radial velocity and chemical analyses of evolved stars. We show that the metal distributions of planet-hosting (P-H) dwarfs and giants are different, and that the latter do not favor metal-rich systems. Rather, these stars follow the same age-metallicity relation as the giants without planets in our sample. The straightforward explanation is to attribute the difference between dwarfs and giants to the much larger masses of giants' convective envelopes. If the metal excess on the main sequence is due to pollution, the effects of dilution naturally explains why it is not observed among evolved stars. Although we cannot exclude other explanations, the lack of any preference for metal-rich systems among P-H giants could be a strong indication of the accretion of metal-rich material. We discuss further tests, as well as some predictions and consequences of this hypothesis.

\section{Introduction}
Just a few years after the discovery of the first extra-solar planet (Mayor and Queloz 1995)
 it has become evident that giant planets   are preferentially found around
 metal-rich solar type stars  (e.g. Gonzalez 1997, 1998, 2001;  Santos et al. 2000, 2001, 2003, 2004,  Fischer \& Valenti 2005).
Subsequent studies have shown that this preference is real (e.g. not produced by spurious selection effects),
and that planet-hosting (P-H) stars are on average about 0.25 dex more metal-rich than
 their counterparts (Santos et al. 2004, 2005).
The immediate question, which is very relevant for the understanding of planet formation, is
if  this increased metallicity enhances planet formation, or if the high metallicity
is caused instead by the presence of a planetary system.

In the first case, favored by the core-accretion  scenario (Pollack et al. 1996), the stars
 should be overmetallic down to their center. This scenario proposes that a
solid core grows via the accretion of
planetesimals until it has sufficient mass to capture gas
from the nebula to form an envelope.
In this case, the planet formation depends strongly on  dust content (Ida \& Lin 2004).

In the second case the star was  polluted by the debris of the planetary system and
only the external layers were affected by this pollution (Laughlin \& Adams 1997).
This scenario is compatible with
the gravitational instability mechanism: a gravitationally unstable region in a protoplanetary
disk forms self-gravitating clumps of gas and dust within which the dust grains coagulate
and sediment to form a
central core  (Boss 1997). Boss (2002) argues that the gravitational instability model should
depend very weakly on metallicity, contrary to what is expected from the core accretion scenario.

The pollution scenario has been considered previously and
several authors have investigated the dependence of
metallicity on the effective temperature of P-H stars. Since the
 depth of the convective zone  increases with lower mass along the main sequence,
 a trend with stellar temperature is expected.  The effect, if present at all,
  is very small and this led most  authors to conclude that  an
  enhanced primordial
 metallicity of the host stars is favored (e.g. Santos 2005).
  The situation is however complicated because of additional mixing beyond the formal
 convective boundary, either due to thermohaline convection and
 ``metallic fingers'' (Vauclair 2004), or due to other effects which
 manifest themselves in the lithium dip in open clusters (Murray et
 al.\ 2001).

In the last years a few groups started  surveys of evolved stars, G and K giants, with the aim of
 learning how planets form among more massive stars and of understanding the radial velocity
variability of these objects (Setiawan et al. 2003b, 2004, Sato et al. 2007 ).
These surveys along with other sporadic observations led
to the discovery of 10  exo-planets around
giant stars. Several authors
 pointed out that planet-hosting giants are not  preferentially metal-rich systems.
 The data published were  so few and sparse, on the other
 hand, to prevent any further analysis.

\section{Giants hosting planets}
The 10 G and K  P-H giants
include  HD~137759 (Frink et al. 2002), HD~47536 and HD~122430 (Setiawan et al. 2003a,b),
 HD~104985 (Sato et al. 2003), HD~222404(Hatzes et al. 2003), HD~11977 (Setiawan et al. 2005), HD~13189 (Hatzes et al. 2005), $\beta$~Gem (Hatzes et al. 2006),
 4~UMa (D\"ollinger et al. 2007a), HD~28305 (Sato et al.  2007).
One of the latest:  4~UMa,  is  part of a survey started 4 years ago at the Tautenburg
observatory  (D\"ollinger et al. 2007a,b,c);  the
details about the observations, analysis,  and results can be found in the cited papers.
In addition to  4~UMa,  at least 4 other candidates are
 present in the Tautenburg survey (D\"ollinger et al. 2007c); adding these to  the stars in literature
 we have a total of 14 giants,  for 10 of  which all parameters have been derived in a
  homogeneous way.

The  metallicity distribution for these 14 giants is  shown in Figure 1 together with  the distribution of
 the P-H main sequence stars  (small black dots; data from the Schneider catalogue).
 The two distributions have a similar shape,
 but the giant distribution is  shifted by about 0.3 dex towards lower metallicity.
A K-S test shows that the probability for both distributions belonging
 to the same population is around 10$^{-4}$.  Systematic differences,
 such as due
 to the different metallicity scale adopted might be present,  but  they are
 certainly much  smaller than the shift observed.
We  caution, however, about two points.

1)  The giant survey is not explicitly biased towards metal-rich stars,
 while the search for planet around  main sequence stars might be (Fischer et al. 2005).
 Santos et al. (2004) and Fischer \& Valenti (2005) consider that
 the  shift of  0.25 dex between P-H and not P-H dwarfs is real.
Conversely,  the distribution of P-H giants  follows the general
 distribution for giants as seen in Figure 2, which shows
 the age-metallicity distribution of the
130 giants analyzed by our group (da Silva et al. 2006; D\"ollinger et al. 2007b).

2)  Giants do not posses short period planets, which would
  eventually have been swallowed  by the  expanding stellar envelope.
  Indeed,  the shortest period
  for a planet around a giant is 198 days for HD104985 (Sato et al. 2003).
 In Figure 1 the dashed  line represents  the distribution of the main sequence
 P-H stars with periods longer than 180 days.
Clearly, by selecting only the long period planets  the metal distribution of the dwarfs does not change.
We therefore conclude that  there is a real difference in the metal distribution of
 main sequence and  evolved P-H stars.
 Evolved P-H stars are 0.2-0.3~dex more metal-poor than main sequence P-H stars.
 Interestingly,  this difference is similar to that observed  between P-H and non-P-H main sequence stars.

\begin{figure}[h]
\resizebox{\hsize}{!}{\includegraphics{histo.ps}}
\caption{Metal distribution for planet-hosting (P-H) giants (full
  line), P-H dwarfs with periods larger than 180 days (dashed line)
  and all P-H dwarfs (dotted). The giants show a distribution  shifted
  to lower metallicity by about 0.2-0.3~dex with respect to the
  dwarfs.}
\label{fig1}
\end{figure}

\begin{figure}[h]
\resizebox{\hsize}{!}{\includegraphics{AMRLuca.ps}}
\caption{Age-metallicity relationship for all giants belonging to the da Silva et al. (2006) and D\"ollinger et al. (2007b) samples and for the P-H giants, which  closely follow the other  stars. }
\label{fig2}
\end{figure}

\section{Interpretation }

We can think of at least three main differences between main sequence
stars and giants:

1) On average giants have  a somewhat higher mass than the main sequence stars surveyed for planet search.
Even considering that  the determination of mass in giants suffers  large uncertainties,
the masses of planet-hosting giants  vary between $\sim$ 0.9  and $\sim$3 M$_{\odot}$
(Da Silva et al. 2006, D\"ollinger et al. 2007b), while  those of main sequence stars are
between $\sim$ 0.75  and $\sim$ 1.5 M$_{\odot}$.
Since the fraction of P-H giants  is basically independent of
metallicity,  it is feasible that
intermediate mass stars  favor a planet formation mechanism, such as
gravitational instability, which is independent of metallicity. One could speculate that such a
mechanism is more efficient in more massive stars, which (likely) have more massive disks.
 The dependence of metallicity on stellar  mass among main sequence P-H
 stars  has already been investigated by  Fischer and Valenti (2005)
 who derived fits to the mass-metallicity distribution of P-H and not P-H stars
of their sample. Both fits have the same slope and, independent of stellar mass,
P-H stars are more metal-rich than stars without planets.
   This result would therefore argue against the  hypothesis that the
  planet formation mechanism changes significantly with the stellar
  mass. We notice, however,  that the
  mass range covered by the Fischer and Valenti  study is limited to the 0.8-1.2  M$_{\odot}$,
  while  by observing giants we cover a larger range of stellar mass.

2)  Giants have on average radii which are about 10 times larger than
 solar-type stars.  If high metallicity favors the migration of planets towards
short period systems,  metal-rich stars have
more short period planets than  metal-poor stars. Since
these planets are  swallowed by the evolved star due to its
large radius, those  stars would be classified as P-H   on the main sequence,
and non-P-H when evolved.

The case of  metal-dependent migration has been discussed, for
example,  in Santos et al.( 2006): higher metallicity should result in a  shorter timescale
for inward migration. How effective this mechanism could be,  is however a matter of debate;
Livio and Pringle (2003) find that a decrease in metallicity by a
factor of 10 could slow down by at most a factor 2
the timescale for migration. While these
authors consider this negligible,
Boss (2005) argues that this factor  is enough to influence the observed
trend between metallicity and P-H stars.

The metallicity distribution of Figure 1 is  very different   for  P-H giants and  dwarfs  with
comparable long orbital periods. This indicates that the
effects of migration, if present, cannot explain
the different  metal distribution of P-H dwarfs and giants.

We cannot exclude that  several mechanisms are at work
simultaneously and that they combine to produce the observed distribution.
A dual formation scheme (one metal dependent, a second   metal independent) has been already  proposed
(see e.g.  Matsuo et al. 2007).
The  metal-independent planet formation mechanism could be  more effective for larger stellar  masses
and act therefore on giants much more than on main sequence stars.

3)  The most likely  explanation is  related to the quantity which varies most
  between dwarfs and giants: the mass  of the convective zone.
  While in the Sun the fraction of the solar mass
 in the convective envelope $M_\mathrm{ce}$ is  $\sim$0.022
  M$_{\odot}$ ($\log M_\mathrm{ce} = -1.67$) , when the star reaches
 its maximum depth along the RGB, this fraction is about 35 times higher,
 or almost 0.77 M$_{\odot}$  ($\log M_\mathrm{ce} = -0.11$).
 In general,  when a 1M$_{\odot}$ star becomes a K giant,  its convective envelope
  is  of the order of 0.7~$M_\odot$.
 If the high metallicity observed among main sequence stars was confined to the superficial layers,
 with a deepening convective envelope, this would be easily decreased to the
primordial abundance of the star.
 In Fig.~3 we show the fractional mass (in logarithmic units) contained in  the convective
 envelope of stars between 0.8 and 1.5~$M_\odot$, both on the main
 sequence and on the red giant branch where the convective envelope has
 reached its deepest. This indicates the maximum dilution factor.
Considering, for instance, an excess of  0.25 dex in [Fe/H] (Santos et
al. 2005) in a solar star,  that  would become less than 1\% in   a giant star,
a quantity which is beyond the actual detection capabilities in most
observational cases.

\begin{figure}[]
\resizebox{\hsize}{!}{\includegraphics[angle=-90,scale=0.4]{Fig3.eps}}
\caption{Convective envelope mass $M_\mathrm{ce}$ (logarithmic
  scale; in units of stellar mass)
for stars of varying mass and in two evolutionary phases.
Shown are three metallicity cases: $Z=0.005$ (solid lines), $Z=0.017$
  (dotted), and $Z=0.026$ (dashed). The lower set of lines corresponds
  to main sequence, the upper to red giant models.
The drastic enlargement of the
convective mass during the RGB ascent is clearly visible. It is close
to a factor $\sim$50 for a solar-type star.}
\label{fig3}
\end{figure}

As summarized in the introduction,  pollution  has been subject to several investigations
 (Santos et  al. 2005, Ecuvillon et al. 2006, Desidera et al. 2004 for binary systems), which
 did not find any evidence  for it.
Previous investigations, however,  were restricted to a limited range
 of  convective masses, while with giants we greatly enlarge this range.
 We also emphasize that the actual amount of envelope mass into
  which the accreted metals will be mixed on the main sequence
  is most likely not just the
  convective envelope, but the region into which thermohaline mixing
  reaches (Vauclair 2004), and this is determined mainly by molecular
  weight and not by the stellar mass.
 We have tested this effect on our own stellar models in the range of
0.6 to 0.9 M$_{\odot}$, finding that the total mass external to a layer
 with a given molecular weight is
the same (within  10$\%$), independent  of the stellar mass.
 If this mixing  is at work, a correlation between stellar metallicity and
 mass (or position on the main sequence) can therefore not be expected.
  The depleted solar Li abundance (M\"uller et al.  1975)
  clearly shows that the sun  has suffered some form of extra
  mixing, as did stars in open clusters. The additional mass affected
  might be as much as $0.05\,M_\odot$, which is more than twice the present
  convective envelope mass, but still small if compared to the envelope mass of a giant.

\begin{figure}[h]
\resizebox{\hsize}{!}{\includegraphics{fig4.ps}}
\caption{Metal distribution for all the giants from the da Silva et al. (2006) and D\"ollinger et al. (2007b)
sample  for all stars  (full line) and for not P-H giants (dashed-dotted line),
 for the volume limited sample of Favata et al. (1997, dashed) and Santos et al. (2004, 2005, points).
An excess of metal-rich stars might be present among the dwarfs. To make such a comparison significant, a number of
effects in the sample selection and in the analysis should be
considered.}
\label{fig4}
\end{figure}

Even if the observations of giants support the hypothesis that pollution is
very important, more evidence is required to prove it. A number of
 interesting tests could be performed.  We need  well controlled samples,
 in  age, mass,  and internal structure (e.g. if diffusion is at work).
If the hypothesis of pollution is true,
we expect an excess of metal-rich stars among main sequence stars
with respect to an {\it equivalent}  sample of giants.
In Figure \ref{fig4} we show the metal distribution of the giants from
da Silva et al. (2006) and D\"ollinger et al.
 (2007b) compared to the distribution of a volume limited sample of
 main sequence stars from Favata et al. (1997) and  Santos et al. (2004, 2005).
 As far as the giants  are concerned, we plot  the distribution of  the whole sample and
the distribution of the non-P-H stars separately.
No real difference can be discerned  between the two giant distributions.
 The giants and dwarfs distributions are also very similar, with the main sequence stars showing
 a (not significant)  excess in the highest metallicity bins.
  The comparison between the giants and the Favata et al. (1997) results in particular
 suggests that  the small  excess of metal-rich dwarfs is almost perfectly compensated by an
 excess of solar-metallicity giants, which is exactly the signature we would expect from  pollution.
However this excess is mostly
due to the coolest main sequence stars and  other aspects, such as age distribution and
galactic evaporation, should be taken into account to properly compare the data (Favata et al. 1997).

Any difference in the correlation between the presence of
 planets and metallicity should also become evident when
 observing stars on the hot and cool parts of the SGB, where
 the convective zone deepens by
 a factor 10-100 in a relatively short interval of magnitude and time.
 Fischer and Valenti (2005)
 searched for a slope in the metallicity distribution of
 subgiants but  did not find  any. Murray et al. (2001), however,  did find evidence for
 lower metallicity in  Hertzspung gap stars with respect to their main sequence sample.
 A dedicated study should be devoted to this point.

Open clusters and associations might be optimal sites for investigating the effects of pollution.
In the presence of P-H stars, a  direct measurement  should reveal
an excess of metallicity, or at least a larger spread  among the main sequence stars,
but not among the giants belonging to the same cluster.
This investigation could be also extended to the cooler part of the main sequence where the
 convective zone is  significantly deeper than for solar-type stars.  Most interesting could be a  search  for `outliers':
 proper motions and/or radial velocity open clusters' members
 with discrepant (higher) metallicity. This  could be an efficient
 way of identifying  P-H candidates
 in open clusters and associations and to prove  the pollution hypothesis.

\section{Conclusions}
 By enlarging the number of giants hosting exoplanets, it has been possible to establish that
 their metallicity distribution is very different from that of planet-hosting
 main sequence stars.
Giants hosting exoplanets do not favor high metallicity objects, but
 follow the age-metallicity distribution observed for all stars surveyed.

 The interpretation of the data is not straightforward: a scenario which
 includes strong differences in planet formation  with stellar  mass
   and possibly planet migration
 is plausible, but the most immediate explanation  is that the high metallicity observed among main
  sequence stars is  due to pollution of their atmospheres. The metal excess produced by this pollution,
 while visible in the thin atmospheres of solar-like stars, it  is
completely diluted in the extended, massive envelopes of the giants.
This interpretation is in apparent contrast with results on main sequence stars
obtained by several groups (Fischer and Valenti 2005, Ecuvillon et al. 2006 among others),
which favor the primordial scenario, where stars are born in high metallicity clouds.
We believe that the possible explanation of this discrepancy is that the effects of
pollution are rather tiny on the main sequence and difficult to
 detect. The fact that
Fischer and Valenti(2005)  do not find any evidence for dilution among
 a subsample of subgiants is of greater concern.
The subgiants analyzed by Fischer and Valenti (2005) belong to  the  survey of
156 subgiants (evolved A stars) by Johnson et al. (2006, 2007).
To the best of our knowledge, this planet - search survey is still on going.
 The four planets published from this survey, with metallicity of (Fe/H=0.11, -0.15, 0.12 and -0.07, Johnson et al. 2006, 2007)
 are very compatible with a normal metal distribution.
 We are eager to  see the final results of this and similar surveys and to compare their metal distributions
 with our.

\begin{acknowledgements}
Partially based on observations made with the 2-m Alfred Jensch Telescope of T-L Tautenburg.
M.D. was supported by ESO DGDF.
The Schneider planet encyclopedia has been used (http://vo.obspm.fr/exoplanetes/encyclo/index.php).
\end{acknowledgements}


Attacking the Nintendo 3DS Boot ROMs

Abstract: We demonstrate attacks on the boot ROMs of the Nintendo 3DS in order to exfiltrate secret information from normally protected areas of memory and gain persistent early code execution on devices which have not previously been compromised. The attack utilizes flaws in the RSA signature verification implementation of one of the boot ROMs in order to overflow ASN.1 length fields and cause invalid firmware images to appear valid to the signature parser. This is then used to load a custom firmware image which overwrites the data-abort vector with a custom data abort handler, then induces a data-abort exception in order to reliably redirect boot ROM code flow at boot time. This executes a payload which, due to its reliable early execution by a privileged processor, is able to function as a persistent exploit of the system in order to exfiltrate secret information (such as encryption keys) from normally protected areas of memory.

\section{Introduction}

As with all entertainment consoles, the Nintendo 3DS has the difficult task of
accommodating legitimate users while still enforcing a reasonable level of
device security. In pursuit of accomplishing this, all models of the Nintendo
3DS are equipped with two separate processors located in a single System-on-Chip
(``SoC''). There is a group ARM11 application processor (``ARM11'') which runs
the OS and is responsible for userspace-level tasks, and a group ARM9 security
processor (``ARM9'') which is responsible for enforcing permission rights and
managing access to cryptographic hardware and the filesystem. This system of
multiple processors with varying levels of access, designed with the principle
of least privilege in mind, allows for a chain of trust which ensures only
authorized code is executed \cite{cryptosystem}.

The root of trust for 3DS security, as with most embedded systems, is found
within the boot~ROMs burned into the processors at the factory. Specifically,
the ARM9 boot~ROM (``Boot9'') contains RSA public keys to which only Nintendo
has the matching private keys. This is used to implement a secure bootchain
designed to ensure that only firmware images signed by Nintendo will run on the
system. This bootchain, rooted at the public keys in Boot9, is responsible for
initializing device hardware and securely launching system firmware from
storage\cite{bootloader}.

To help facilitate the security of this bootchain, both Boot9 and its ARM11
counterpart (``Boot11'') are split into two halves. The first half is readable
from firmware given sufficient privileges, while the second half is made
unreadable early in the boot process by setting specific registers which can
only be written to once per boot. By combining this concept of ``unprotected''
and ``protected'' halves with implementations of AES and RSA write-only
``keyslots'' (secure memory areas readable only by the respective hardware AES
and RSA implementations), Nintendo is able to store and use secret keys in such
a way that even a fully compromised system will not expose all secure data
\cite{AES_Registers}\cite{RSA_Registers}.

\section{Secure Bootchain}

\subsection{Known Information}

In the ``Nintendo Hacking 2016'' talk given at the 33\textsuperscript{rd} Chaos
Communication Congress (``33C3''), one of the speakers (``derrek'') detailed the
use of a known hardware ``Vector-Glitch'' attack to dump the protected half of
Boot9. This approach was reported to be highly unstable and, due to Boot9 being
unshareable copyrighted code, would have to be re-implemented by any successive
attacker (requiring access to prohibitively expensive hardware). Although this
means that the speaker's Vector-Glitch attack is impractical to reproduce
consistently, the talk is still useful due to the information it provides about
the protected half of Boot9\cite{33c3}.

\subsection{Firmware Images}

The firmware image loaded by Boot9 is stored encrypted on the boot device. The
plaintext of this encrypted image consists of a firmware image header and up to
four firmware `sections'. The firmware image header contains a magic value
(\texttt{FIRM}), a boot priority, the ARM9 and ARM11 entrypoints, the firmware
section headers, and an RSA-2048 signature over a SHA-256 hash of the rest of
the firmware header. The firmware section headers each contain the offset of the
firmware section, the physical address to load the section to, the size of the
firmware section, the copy method to use in loading the firmware section, and a
SHA-256 hash of the firmware section. In a stock firmware image, the firmware
sections contain the ARM9 kernel, the ARM11 kernel, and other data required to
initialize the system\cite{FIRM}.

\subsection{Boot Process}

All 3DS models have identical boot~ROMs burned in at the factory, and thus have
the same initial boot process implementation which is performed by
Boot9\cite{bootloader}\cite{33c3}:

\medskip
\begin{enumerate}
  \item Initialize AES keyslots with secret keys from Boot9 (using AES hardware
  to decrypt all subsequent data read from boot device)
  \item Initialize RSA keyslots with firmware public keys from Boot9 (using
  separate keys for various signature and console types)
  \item Select boot device (typically NAND flash storage)
  \item Read firmware header from selected boot device to memory
  \item Validate SHA-256 hash and RSA-2048 signature of firmware header
  \item Read firmware sections to memory according to parameters specified by
  firmware section headers
  \item Disable access to protected halves of Boot9 and Boot11
  \item Jump to ARM9 and ARM11 entrypoints specified by firmware header
\end{enumerate}
\medskip

This is a simple, robust boot process which seems secure from a conceptual
perspective. Any flaws in this bootchain must, therefore, lie in the
implementation rather than the theory.

\section{Signature Verification}

\subsection{Known Information}

In the previously mentioned ``Nintendo Hacking 2016'' talk, the existence of
several flaws in the implementation of this seemingly secure boot process were
revealed\cite{33c3}. Unfortunately, performing an attack based on these flaws
requires details which can only be found by examining the protected half of
Boot9. The speakers of the talk kept these details a secret, which required us
to pursue a more creative approach to exploit these flaws.

\subsection{Firmware Header Signatures}

Recall that RSA signatures are, essentially (as an oversimplification), a
specifically formatted hash which has been encrypted by a signer's private key.
These signatures are then verified by calculating the hash of the data,
decrypting the the signature using the signer's matching public key, then
verifying the hash which was calculated matches the hash embedded in the
signature. The exact formatting and `padding' used for the hash in an RSA
signature are extremely important for preventing numerous attacks on it.

In the case of the 3DS, the private key is possessed only by Nintendo, the
public key is embedded in Boot9, and the data being verified is the firmware
header loaded by Boot9. Specifically, the firmware header is signed by a
PKCS\#1v1.5 padded RSA-2048 signature with an embedded ASN.1 encoded SHA-256
hash. An RSA-2048 signature is \texttt{0x100} bytes in length, while a SHA-256
hash is only \texttt{0x20} bytes in length. This means that the remaining bytes
are filled by a deterministic padding of \texttt{FF} bytes followed by a fixed
ASN.1 DER encoding of the hash type.

To parse this relatively complex structure, Nintendo decided to write their own
signature parser. This signature parser is flawed in the following
ways\cite{33c3}:

\medskip
\begin{enumerate}
  \item Bounds checking is not performed when parsing one or more ASN.1 length
  fields, allowing for length values to point beyond the signature block
  \item PKCS\#1v1.5 Block Type 2 (designed for encrypted messages, not
  signatures) is permitted, allowing for arbitrary padding rather than just
  \texttt{FF} bytes
  \item Padding is not required to completely fill the signature block, allowing
  for a less strict signature layout
\end{enumerate}
\medskip

The first flaw is critical because the parser adds the ASN.1 length fields to
the current memory offset to arrive at the location of the SHA-256 hash embedded
in the signature (``embedded hash'') used for comparison. This means a signature
can be calculated where the length fields overflow valid lengths and cause the
parser to look elsewhere on the stack for the embedded hash.

This allows for an attack in which very specific length fields cause the
signature parser to use the exact area of memory on the stack where it already
stored the calculated SHA-256 hash of the firmware header (``calculated hash''),
rather than the area of memory on the stack where the embedded hash is. This
results in the signature parser comparing the calculated hash with itself
instead of the embedded hash, which never fails. This means any firmware image
using this signature will appear to be validly signed to the signature parser,
enabling the ``fakesigning'' of arbitrary firmware images.

The second and third flaws severely weaken the security of the signature itself
because they allow for attacks on RSA which would normally be stopped by strict
padding checks. This means that a search for a valid signature to exploit the
first flaw can take place in a significantly shorter amount of time than would
otherwise be possible.

\section{Blind Exploitation}

\subsection{Missing information}

As mentioned previously, knowledge of these flaws alone is not sufficient to
perform an attack. This is because the critical flaw allows for the the use of
crafted length fields to modify where the parser looks for the embedded hash on
the stack, which is only useful if the parser can be made to look at the
calculated hash. This requires knowledge of both which length fields are
improperly verified and where in the stack the calculated signature is located.
The first approach to try is to search for possible re-use of the flawed
signature parser elsewhere.

Examining the signature parser used by the firmware itself to verify the
integrity of software reveals it to be very similar to the described Boot9
signature parser, though with the addition of strict padding checks which
prevent an attack. These padding checks are present in all firmware versions
from 1.0.0 (kernel 0.14) onward, meaning that these flaws were noticed and fixed
some time after Boot9 was finalized but before firmware 1.0.0 was shipped.

\subsection{Factory Firmware}

NAND flash storage, as with most non-volatile storage mediums, does not actually
erase information completely when instructed to (in most cases); rather,
information is simply marked as erased and can be overwritten by new information
at a later time. By examining a decrypted 3DS NAND flash image, it is possible
to recover fragments of data left over from the firmware installed to the device
at the factory (which was erased from the device before it was sold).

When enough devices are examined (especially those which have only been lighly
used), it is possible to re-assemble these fragments into a pre-1.0.0 'factory
firmware' (kernel 0.13). When this factory firmware is examined, we see a
similar signature parser to firmware 1.0.0, but without the strict padding
checks. This means that factory firmware is vulnerable to the same signature
verification flaws as Boot9, and thus its signature parser can be inferred to be
very similar to the signature parser used in Boot9.

\subsection{Signature Calculations}

Note that different public keys are used for the various signature and console
types (a total of 6). These are split into the `Retail' and `Developer'
categories, where the former is used in standard consoles and the latter is used
in official Nintendo Developer Program Consoles.

The three signature types within these two categories are the following: the
`NCSD header' signature (verifies the partition layout and encryption methods),
the `NAND boot' signature (verifies firmware images loaded from NAND flash
storage), and the `non-NAND boot' signature (verifies firmware images loaded
from sources other than NAND flash storage). For this initial test, a retail
device booting from NAND flash storage was chosen.

By examining the signature parser used in factory firmware, we can both
determine which ASN.1 length fields are incorrectly verified and the location on
the stack where the calculated hash will be. With this information, we then
calculated a signature which correctly overflows the ASN.1 length fields to
exploit the factor firmware signature parser (``exploit signature'') and tested
it on Boot9. Unfortunately, this led us to the discovery that, while the
signature parser used by factory firmware is very similar to the signature
parser used in Boot9, they are not identical.

Interestingly, this caused Boot9 to display a black screen rather than the
standard blue error screen normally shown when Boot9 encounters an error (such
as a failed signature check). This means that, while the signature was
successful in causing the parser to look elsewhere on the stack for the embedded
hash, the memory the parser was trying to access was invalid which was resulting
in an unhandled data-abort exception. From this, we know that the calculated
hash is in a different location on the stack than it is for factory firmware.

\subsection{Brute-forcing Signatures}

We can calculate that, for this signature parser, there are only 128 possible
locations on the stack (relative to the signature) for which a signature can be
brute-forced in a reasonable amount of time to exploit the length field
vulnerability. Because this exploit has been performed before, we know that the
calculated hash for Boot9's signature parser must be in one of these 128
locations. We can then search through randomly generated signatures (a
``brute-force'') to find valid signatures that cause the signature parser to
look for the embedded hash at these 128 locations.

Recall that RSA signatures are created by powering plaintext message \(m\) by
secret \(d\) using modulus \(n\), and verified by powering signature \(s\) by
RSA exponent \(e\) (65537 in this case) using modulus \(n\):

\[s \equiv m^{d} \pmod{n} \quad \text{and} \quad v \equiv s^{e} \pmod{n}\]

The simple method for calculating signature \(s\) for an exploit plaintext
\(m\) would be to calculate \(m \equiv s^{65537} \pmod{n}\) for a random \(s\)
until a usable \(m\) is found. However, this method is extremely slow because it
requires 17 multiplication operations and 17 modulo operations per attempt.

One way to improve the speed of this signature search is to check \(-m\) when
checking \(m\). This is because, if \(-m\) is a match, then \(-s\) is its
signature. Because subtraction is significantly faster than multiplication, this
method nearly doubles the speed of our search.

Another way to improve the speed of our search is to take advantage of the
second and third flaw in the padding checks of Boot9's signature parser. Because
we do not have to adhere to strict padding checks, an `RSA Multiplicative
Attack' is possible: if \(s_{a}\) and \(s_{b}\) are signatures for messages
\(a\) and \(b\), then \(s_{a}s_{b} \pmod{n}\) is a signature for message \(ab
\pmod{n}\). This results in another significant performance gain. This results
in the following brute-force search method:

\medskip
\begin{enumerate}
  \item Select random root \(r\) such that \(1 < r < n\)
  \item Calculate multiplier \(k\) such that \(k = r^{65537} \pmod{n}\)
  \item Set \(y = 1\) and \(z = 0\)
  \item Define parameters for validity (based on 128 possible locations)
  \item Loop:
    \begin{enumerate}
      \item Increment \(z\) by 1
      \item Perform \(y = (y * k) \pmod{n}\)
      \item Check whether \(y\) is valid
        \begin{itemize}
          \item Return \(r^{z} \pmod{n}\)
        \end{itemize}
      \item Check whether \(n - y\) is valid
        \begin{itemize}
          \item Return \(-r^{z} \pmod{n}\)
        \end{itemize}
    \end{enumerate}
\end{enumerate}
\medskip

While it is difficult to express the exact probability of finding a valid
signature with this method due to the complexities in representing the
parameters of a valid signature mathematically, we hypothesized that the
probability of finding a valid signature was approximately 1 in \(2^{43}\).

We then used a modular multiplication algorithm for Graphics Processing Units
(``GPUs'') created by Kaiyong Zhao\cite{modmult} to write an implementation of
this brute-force search method that could find valid RSA signatures for each
signature and console type\cite{sighaxgpu}. This implementation was then run
using a few desktop machines with high-end consumer GPUs and two Amazon Web
Services GPU compute (``p2.8xlarge'') instances.

By trying each valid signature as it was found, we determined that the correct
relative location of the calculated hash for the Boot9 signature parser is
immediately after the signature on the stack.

\begin{figure}[h]
  \begin{minipage}{.60\linewidth}
    \tiny{\texttt{\noindent
      \sethlcolor{lightgrey}\hl{XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX\\
      XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX}\\
      \sethlcolor{lightpurple}\hl{00 02 }\sethlcolor{lightblue}\hl{B3 13 31 C7 10 41 23 33 A5 87 89 0F 9C F0\\
      B6 A8 6E 71 C8 A7 8F 96 B7 60 82 90 3B 3E 54 EA\\
      9A B9 35 97 8B BF 24 93 BB 82 9E 9A 5A 60 60 B0\\
      C7 81 18 81 17 6B CF 9F E8 B1 C5 C5 E0 A9 53 27\\
      DB 8B 52 EC 17 8A 88 4A D9 CF 28 DB 8B BF 29 22\\
      C0 5F D0 34 AC 81 BD 23 1A EB 0C BE F6 F7 DE 6F\\
      3A 30 81 2B 9F 9A 83 BF 33 25 18 91 BF A1 8F A3\\
      8A 64 C6 FF 5F 77 DB E1 1C 37 80 C2 3E A9 F6 D0\\
      0F 9C 01 D6 FC 8A 87 85 91 D3 6C 4F 64 AC A6 B8\\
      D1 1B BE B2 14 76 10 3C 6E 86 FF 21 96 D4 65 BA\\
      4D B7 8F 81 F1 D3 BC CA 18 6B DD D5 67 39 A1 2D\\
      D3 61 22 F3 F5 B3 DD 51 8D DA C4 FA 29 39 5E A4\\
      CD 9D FD 80 AF 8A 39 99 90 F4 FD D3 CD 6B 07 EC\\
      21 22 43 7C CF C3 B6 2B 1D 14 93 A7 DB B4 42 00}\\
      \sethlcolor{lightpink}\hl{30 }\sethlcolor{lightorange}\hl{62 }\sethlcolor{lightpink}\hl{30 }\sethlcolor{lightorange}\hl{1A }\sethlcolor{lightred}\hl{C0 A5 D8 7E 1E 31 A4 02 0F 0B EA EC\\
      26 99 4D 25 80 32 4E 60 C6 CE AB A6 53 9A }\sethlcolor{lightpink}\hl{C8 }\sethlcolor{lightorange}\hl{14}\\
      \sethlcolor{lightgreen}\hl{XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX\\
      XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX}\\
      \sethlcolor{lightgrey}\hl{XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX\\
      XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX}
    }}
  \end{minipage
  \begin{minipage}{.40\linewidth}
    \linespread{1.3}{\scriptsize{\texttt{\noindent
      \sethlcolor{lightpurple}\hl{ {} } - Flag Byte\\
      \sethlcolor{lightblue}\hl{ {} } - Padding\\
      \sethlcolor{lightpink}\hl{ {} } - ASN.1 Type Field\\
      \sethlcolor{lightorange}\hl{ {} } - ASN.1 Length Field\\
      \sethlcolor{lightred}\hl{ {} } - Added Length\\
      \sethlcolor{lightgreen}\hl{ {} } - Calculated Hash\\
      \sethlcolor{lightgrey}\hl{ {} } - Other Stack Data\\
    }}}
  \end{minipage
  \caption{Structure of a plaintext exploit signature in memory}
\end{figure}

With our search method, we found 1 valid signature per approximately 8 trillion
attempts, which was within 10\% of our estimate (though we do acknowledge that
our sample size was small). At this rate, on this hardware, it took
approximately 9 days to find valid signatures for all 6 signature variants.

With these signatures, we now have the capability to fakesign custom firmware
images and run our own code. Additionally, because the Boot9 is burned into the
ARM9 processor, this RSA signature parsing vulnerability cannot be patched with
an update to the system firmware.

\section{Exfiltrating Secrets}

\subsection{Utilizing New Privileges}

Unfortunately, because access to the protected boot~ROMs is disabled in the boot
process just before Boot9 jumps to the firmware entrypoint, merely having the
ability to run custom code from fakesigned firmware images is not enough to gain
access to the protected halves of Boot9 and Boot11. Fortunately, this is not the
only ability we have gained.

Recall that the various firmware header and firmware section header parameters
include, among other things, the boot priority, the ARM9 and ARM11 entrypoints,
the physical addresses to load firmware sections to, the size of firmware
sections, and the copy method used in loading the firmware section. Of these,
the most interesting is the location the physical addresses firmware sections
are loaded to.

\subsection{Firmware Section Copying}

In the previously mentioned ``Nintendo Hacking 2016'' talk, we learned that
Boot9 checks the location specified in the firmware section header against a
blacklist of memory regions, but they are not very thorough. Specifically, only
the Boot9 data regions are blacklisted. Fortunately, there are other data
regions which are just as dangerous.

\begin{figure}[h]
  \footnotesize{\texttt{
    \setlength\extrarowheight{1.5pt}
    \begin{tabularx}{\linewidth}{lrrl}
      Region & Address    & Size       & Description \smallskip\\
      0      & 0x20000000 & 0x08000000 & FCRAM \\\rowcolor{lightgreen}
      1      & 0x10000000 & 0x10000000 & I/O Registers \\
      2      & 0x08000000 & 0x00100000 & ARM9 Memory \\
      3      & 0x08000000 & 0x00000400 & ARM9 Memory \\
      4      & 0xFFF00000 & 0x00004000 & DTCM \\
      5      & 0x07FF8000 & 0x00008000 & ITCM \\
      6      & 0xFFFF0000 & 0x00010000 & Boot9 Data \\
      7      & 0x1FFFE000 & 0x00000800 & AXI WRAM \\
    \end{tabularx}
  }}
  \caption{ARM9 memory layout \cite{memorylayout}}
\end{figure}

The area of immediate interest is the I/O registers. Specifically, the `New'
Direct Memory Access (``NDMA'') engine is a memory-mapped I/O register. By
constructing an NDMA copy request as a firmware section and loading it to the
NDMA registers using the firmware section header, the NDMA engine will perform a
Direct Memory Access (``DMA'') to copy the protected half of Boot9 to somewhere
else in memory.

Because this NDMA copy is triggered by the loading of the firmware section, it
occurs before access to Boot9 is disabled. We gave this copy request a firmware
section header which loaded it to the NDMA registers, then placed in a
fakesigned firmware image which would boot normally after performing the
request. We were then able to successfully retreive the protected half of Boot9
from ARM9 memory after the boot completed.

\section{Code Execution}

\subsection{Boot9 Code Execution}

By using the NDMA engine in the way described, we can now copy data from our
firm sections to any location. Of these locations, one of the most interesting
is the exception vectors. Because there are no restrictions on where we can copy
data, this allows for an attack in which we overwrite the data-abort vector with
our own handler before inducing a data-abort by attempting to copy to
\texttt{NULL}. This allows us to redirect code flow to gain Boot9 code execution
before access to the protected half of Boot9 is disabled.

\subsection{Boot11 Code Execution}

Though we have managed to thoroughly break the security of Boot9, this does not
yet allow for access to the protected half of Boot11. Fortunately, this task is
made relatively easy by the access we have gained up to this point. The ARM11
processor operates in a \texttt{0x80000} byte region of `work' SRAM (``WRAM'')
connected to the SoC by Advanced Extensible Interface (``AXI'').

Because we already have reliable Boot9 code execution, we have full access to
the ARM11's memory from Boot9. This allows us to trivially overwrite a specific
Boot11 function pointer in AXI WRAM at the correct time, replacing it with a
pointer of our own. When this pointer is dereferenced by Boot11, code flow will
be redirected and we will gain Boot11 code execution before the protected half
of Boot11 is disabled, allowing us to gain access to the protected half of
Boot11.

\subsection{Implementation Details}

It is important to note that access to the Fast Cycle DRAM (``FCRAM'') is
enabled for each processsor by the same register which disables access to the
protected half of that processor's boot~ROM. Because access to FCRAM is
necessary for running the 3DS OS, it is not sufficient to simply skip enabling
these registers and leave the boot~ROMs unprotected. This means that the
implementation of these code execution vulnerabilities must take this into
account.

For this implementation, we use a fakesigned custom firmware image comprised of
4 firmware sections. Section 0 contains a Boot11 hook and an ARM11 `Stage 2'
payload, which are copied to AXI WRAM. Section 1 contains a custom data-abort
handler, a custom data-abort vector, two Boot9 hooks, and an ARM9 `Stage 2'
payload, which are copied to a safe area in ARM9 memory. Section 2 contains NDMA
copy reqests to copy the data from Section 1 to the correct locations, which is
copied to the NDMA registers. Section 3 contains invalid data, which is loaded
to \texttt{NULL} to induce a data-abort.

After all of these firmware sections are copied to the correct locations, the
attempt to copy the invalid data of Section 3 triggers a data-abort exception.
When this happens, code flow is redirected to our installed data-abort handler
which installs both Boot9 hooks by overwriting specific Boot9 function pointers.
The data-abort handler then skips the copy instruction which caused the
data-abort before continuing the normal ARM9 boot process.

When Boot9 dereferences the first overwritten function pointer, the first Boot9
hook is called. This hook installs the Boot11 hook by overwriting a
specific Boot11 function pointer, sets up the Memory Protection unit (``MPU''),
and sets a specific flag in memory to communicate with Boot11. It then continues
the normal ARM9 boot process.

When Boot9 dereferences the second overwritten function pointer, the second
Boot9 hook is called. This hook will wait in a loop until it receives a signal
from the Boot11 hook. While this is happening, the Boot11 hook is called at some
point in the normal ARM11 boot process. This hook copies the protected half of
Boot11 to a specific location in AXI WRAM, signals to the second Boot9 hook,
then waits in a loop until it receives a signal from the second Boot9 hook.

Once the second Boot9 hook receives the signal from the Boot11 hook, it copies
the protected half of Boot11 to a safe location in ARM9 memory, signals to the
Boot11 hook, then copies the protected half of Boot9 to another safe location in
ARM9 memory. At this point, both protected boot~ROM halves have been copied to
ARM9 memory and both processors are synchronized.

Once the hooks are finished, both processors then jump to the Stage 2
entrypoints. Stage 2 will check if a specific key combination is being held
down. If it is, it will copy the protected halves of Boot9 and Boot11 to the
device's SD card and shut down. Otherwise, it will attempt to load a second
custom firmware image from the SD card, activate access to FCRAM by disabling
access to the protected boot~ROMs (if requested to by the custom firmware
image), then continue the boot process. This second custom firmware image is
user-replacable and allows for adding in-memory patches to the official device
firmware on boot.

\subsection{Boot Devices}

Recall that Boot9 has three public key signature types: the NCSD header
signature, the NAND boot signature, and the non-NAND boot signature. We have
already explored how the ability to create NAND boot signatures which appear
valid can be useful to an attacker who already has sufficient device access to
install a firmware image to NAND flash storage, but it is difficult to reach
that level of access because a chain of exploits is needed (the firmware's
signature parser is not flawed like Boot9's). Fortunately, we have the ability
to create valid signatures for each of the other types too.

The NCSD header signature type is not particularly interesting because it also
requires access to NAND flash storage, but the remaining non-NAND boot signature
type sounds promising. In the previously mentioned ``Nintendo Hacking 2016''
talk, the ability for Boot9 to load signed firmware images from the Wi-Fi SPI
flash storage was mentioned (presumably for device repair purposes), but an
examination of this storage shows it to be unwritable without special hardware,
and is thus even less accessible than NAND flash storage for booting a custom
firmware image.

What was not mentioned, however, was the second alternative boot method we
discovered upon examining the protected half of Boot9. Before Boot9 attempts to
load a firmware image from NAND, it checks to see if the device's shell is
closed and if a specific key combination (\texttt{START} + \texttt{SELECT} +
\texttt{X}) is being held. If both of these are done, Boot9 will check if a
standard DS cartridge (``NTR'' cartridge) is inserted, then attempt to load a
signed firmware image from it.

By utilizing an exploit RSA signature for the non-NAND boot signature type, it
is possible to boot a custom firmware image from one of the many commonly
available rewritable NTR cartridges (``flashcarts''). We can then use a similar
implementation as before, but this time have Stage 2 utilize its ARM9 code
execution to install our original custom firmware image implementation to NAND
flash storage.

This flashcart is then inserted into the device. Though it should be impossible
to press the required key combination while the shell is closed due to the
device's design, a magnet can be used to trick the shell sensor. We then just
hold the required key combination and power on the device, which loads our
custom firmware image and installs the previously described exploit
implementation to NAND flash storage.

\section{Conclusion}

We have demonstrated attacks on the secure bootchain of the Nintendo 3DS which
defeat its primary protection mechanisms. We used `blind exploitation'
techniques to forge signatures and exfiltrate device secrets based on limited
information, then took advantage of weak internal security mechanisms to gain
reliable early code execution and a method to exploit devices which have not
previously been compromised. This weak internal security was best demonstrated
by the failure to properly validate the copy locations specified in firmware
section headers, showing an implicit trust placed in the signature validation
process. This use of signed malicious firmware images shows the need for strong
internal security mechanisms to mitigate damage in the case of primary security
mechanisms being defeated.

\bibliographystyle{IEEEtran.bst}

Attacking the Nintendo 3DS Boot ROMs


Balmer line shifts in quasars

Abstract: We offer a broad review of Balmer line phenomenology in type 1 active galactic nuclei, briefly sum- marising luminosity and radio loudness effects, and discussing interpretation in terms of nebular physics along the 4D eigenvector 1 sequence of quasars. We stress that relatively rare, peculiar Balmer line profiles (i.e., with large shifts with respect to the rest frame or double and multiple peaked) that start attracted attentions since the 1970s are still passable of multiple dynamical interpretation. More mainstream objects are still not fully understood as well, since competing dynamical models and geometries are possible. Further progress may come from inter-line comparison across the 4D Eigenvector 1 sequence.

\section{Introduction: Quasars and line shifts}
\label{intro}

Internal line shifts in quasar spectra have played an ever-increasing role in our understanding of quasar
structure and dynamics. Apart from early attempts to explain quasar cosmological redshifts as intrinsic to
the quasar \citep[see e.g., the historical account in Chapter 2 of ][]{donofrioetal12}  that lead to
serious inconsistency  \citep{greensteinschmidt64}, the realization that all lines in a quasar do not yield
the same  redshift was slow to come. Until the early 1980s and the pioneering paper by Martin Gaskell
\citep{gaskell82}    {\em redshift difference between emission lines had not been systematically studied
in quasars, } even if some  cases of broad line shifts ($\sim 1000$ km~s$^{-1}$ with respect to narrow lines)
had been noted in Seyfert galaxies \citep{osterbrock79}.  Gaskell's  results on the difference between
low- and high-ionization lines (LILs and HILs, represented by {Mg\sc{ii}}$\lambda$2800\/\ and {\sc{Civ}}$\lambda$1549\/\ respectively) have remained
valid since then, and have yielded the observational basis for a model that is still today providing a basic
interpretative sketch for the structure of the broad line emitting region \citep{collinsouffrinetal88}. In
that model, HIL blue shifts are associated with radial motion in a flattened structure (the accretion disk)
emitting mainly LILs.  Later developments  \citep{tytlerfan92,marzianietal96,corbinboroson96} confirmed the
earlier results.  \citet{sulenticetal95} suggested that results were not the same for all quasars, and that a
first distinction between radio-loud and radio-quiet quasars was necessary: blueshifts were mostly present
in radio quiet (RQ) quasars, but definitely rarer or of lower amplitudes in radio loud (RL). This finding (confirmed in \citealt{marzianietal96}
and \citealt{richardsetal11}) has been further contextualised within the Pop. A and B concept in the
4D Eigenvector 1 formalism \citep[e.g.][]{sulenticetal00a,sulenticetal07,sulenticetal11}. In the following we
will focus attention on the {\sc{H}}$\beta$\/\ line, as representative of LILs, and its contextualization within 4DE1 (\S \ref{4de1}).
We   report the observational properties in a systematic way (\S \ref{phen}) that includes a robust empirical
interpretation based on nebular physics (\S \ref{ei}), and effects of luminosity and radio loudness (\S \ref{effects}).
We then discuss the physical processes that may be relevant in line profile broadening (\S \ref{physics}).
We conclude with remarks on unknown aspects and desiderata for further observations (\S \ref{build} and \S\ \ref{open}).

\section{(4D)Eigenvector 1 quasar contextualization at low-$z$}
\label{4de1}

The (4D) Eigenvector 1 quasar con\-text\-ualiz\-ation sch\-eme at low-$z$ offers a powerful tool for
interpretation of the {\sc{H}}$\beta$\/\  emission line (and of LILs in general)  profiles.  Eigenvector 1 was
originally defined from a Principal Component Analysis (PCA) of 87 PG quasars involving an anticorrelation
between optical FeII intensity, half-maximum profile width of {\sc{H}}$\beta$\/\  and peak intensity of {\sc [Oiii]}$\lambda$5007\ \citep{borosongreen92}.
E1 was afterwards expanded to 4DE1 with the addition of X-ray photon index and {\sc{Civ}}$\lambda$1549\/\ profile
shift measures \citep{sulenticetal00a,sulenticetal08,sulenticetal11}. 4DE1 allows one to define a quasar main
sequence in 4DE1 space \citep{sulenticetal00a,marzianietal01}.

The principle parameters of the 4DE1 space are:

 \begin{itemize}
 \item Full width at half maximum of broad {\sc{H}}$\beta$\/\ (FWHM {\sc{H}}$\beta$\/) which is our diagnostic low ionization lines
observable from the ground out to z $\approx$ 0.9 with optical and (intermittently to $z = 3.7$) with
infrared spectroscopy. It (and/or FWHM {Mg\sc{ii}}$\lambda$2800\/) is thought to be a measure of assumed virialized motions
in the AD and is thus crucial for estimating black hole masses for large samples of quasars.
\item  Ratio of the equivalent width of the 4570 \AA\ optical FeII blend and broad {\sc{H}}$\beta$\/\ ($R_{\rm FeII}$ = W 4570
FeII blend/W {\sc{H}}$\beta$\/ ). It is sensitive to the ionization state, the electron density and column density of
the BLR gas arising, as far as we can tell, in (at least part of) the gas that produces
{\sc{H}}$\beta$\/\ \citep[e.g.,][]{huetal08,marzianietal10}. \item Centroid shift at FWHM of the high ionization
line {\sc{Civ}}$\lambda$1549\/\ (at half, maximum, c(1/2)). It is a strong diagnostic of winds/outflows
\citep[e.g.,][]{marzianietal96,leighlymoore04}. \item  Soft X-ray photon index ($\Gamma_\mathrm{S}$\/). Most likely an indicator
of optically thick Comptonized radiation, and probably a diagnostic of the thermal emission from the AD
or of a Compton-thick corona above the disk \citep[][]{doneetal12,haardtmaraschi91,jinetal09}.
\end{itemize}

The 4DE1 approach allows the definition of spectral types following source occupation in the optical
4DE1 plane FWHM(H$\beta$) vs $R_{\rm FeII}$\ \citep{sulenticetal02} and can be extended to include all four dimensions
\citep[e.g., ][for {\sc{Civ}}$\lambda$1549\/]{bachevetal04}. It is possible to identify two populations along the sequence: Population
A with FWHM(H$\beta$)$\le 4000$ km~s$^{-1}$, and a second Population B of sources with broader lines \citep[see ][for the
rationale behind two distinct quasar populations]{sulenticetal07,sulenticetal11}.

\section{The phenomenology of the {\sc{H}}$\beta$\/\ emission line profile in the 4DE1 context}
\label{phen}

It is customary to distinguish between broad and narrow components of Balmer lines, with Type 1 AGN showing
a non-zero broad component \citep[the case closest to type 2 is type 1.9, for which the BC is visible in
{\sc H}$\alpha$\ but not in {\sc{H}}$\beta$\/][]{osterbrock81}. It is widely believed that the emitting region of these sources suffers
heavy obscuration \citep{antonuccimiller85,antonucci93}. In some cases -- but apparently not in all sources
\citep{pappaetal01,wolteretal05,bianchietal08,petrov09} -- a BC becomes visible in polarised light.
In the following we restrict attention to sources that do not show strong evidence of obscuration in their
line profiles (i.e., we will exclude type 1.5, 1.8 and 1.9 sources of the old Osterbrock's classification).

\begin{figure*}[htp!]
\includegraphics[scale=0.1]{hba4.jpg}
\includegraphics[scale=0.1]{hbb1pp.jpg}
\caption{Median composite {\sc{H}}$\beta$\/\ profiles at the extreme ends of the 4DE1 sequence: spectral type A4 (left), spectral type (B1++), from the sample of \citet{marzianietal13a}. The full specfit model of the spectrum is traced by the magenta dotted line. Narrow lines are colored yellow, the BC black, the blue shifted component blue, and the VBC red. The {Fe \sc{ii}}$_{\rm opt}$\/\ emission (very strong in A4 but almost undetectable in B1++) is coloured pale green. Abscissae are rest frame wavelength in \AA\ and radial velocity from the peak position of {\sc{H}}$\beta_{\rm NC}$\/. The bottom panels show the difference between the spectrum and its model. }
\label{fig:e1}
\end{figure*}

Before 4DE1, several workers provided excellent data on {\sc{H}}$\beta$\/\  \citep[e.g.,][]{shuder81,stirpe90} but their
interpretation was limited by the lack of  any contextualization. Without contextualization every quasar is an
island under itself without a clear understanding of how it fits into the general population. The FWHM {\sc{H}}$\beta$\/\ distribution
is puzzling since its includes profiles over a very wide range of widths, from less than 1000 to more than
20000 km~s$^{-1}$. These line width limits can be related to physical processes, although under several assumptions
\citep{laor03} that may be  justified  only after a first organization of empirical properties is accomplished. A
first attempt to describe in a systematic way the shape of broad lines in low-$z$\ quasars devised a qualitative
assignment based on peak shift and shape asymmetry:  for example, a redward asymmetric profile with a redshifted
peak would be classified as AR,R, a symmetric unshifted as S, etc. \citep{sulentic89}. This and more quantitative
analyses of the line wing shape stressed  the systematic changes occurring in large samples
\citep{borosongreen92,robinson95}.  Further  work of our group involved the analysis of observations collected
over a decade and presented in \citet{marzianietal03a}. Results from the analysis of those data were later
confirmed by a larger sample of 470 bright quasars from SDSS DR5 \citep{zamfiretal10}. The main findings can be
summarised as follows:

\begin{itemize}
\item  There is  a trend in {\sc{H}}$\beta$\/\ line profile properties that is correlated with the 4DE1 sequence \citep{sulenticetal07}.
Line profile shapes change along the sequence, from a Lorentzian with a blue shifted excess at the line base to a redward
asymmetric profile best fit with 2 Gaussian components. The latter profile is typical of the larger
FWHM $\gtrsim 4000$ km~s$^{-1}$. Fig. \ref{fig:e1} shows the spectral types at the opposite ends of the sequence. In spectral
type A4 (at the high FeII end of the 4ED1 sequence)  the blue excess of {\sc{H}}$\beta$\/\ is especially evident, as the shallow, redward very broad profile is for B1++ (at the opposite end of the sequence, with broadest lines and very weak FeII emission).
\item Peculiar, double- or multiple peaked profiles are more frequent toward the extreme Pop. B spectral types
i.e., B1++ with FWHM ({\sc{H}}$\beta$\/) $\ge$ 12000 km~s$^{-1}$.
\item Radio loud sources are predominantly Pop. B \citep{marzianietal96,marzianietal01,sulenticetal03,rokakietal03,zamfiretal08};
radio core-dominated (CD) sources show systematically narrower profiles (and distribute in 4DE1 spaced like radio-quiet sources),
while lobe-dominated (LD assumed to be Fanaroff-Riley II,FRII) are frequently  associated with very broad profiles (almost exclusively Population B).
\end{itemize}

Peculiar profiles can be empirically grouped in three large categories: (1) double peaked profiles with small peak separation
($\ltsim 10^{3}$ km~s$^{-1}$).  These sources are apparently rare, since only a  handful are known. We stress the apparently since some cases could be masked by the blending of {\sc{H}}$\beta_{\rm BC}$\/\ and  {\sc{H}}$\beta_{\rm NC}$\/. Prototypes include Akn 120, IC 4329A,
and OX 169 \citep{marzianietal92}; (2) wide separation double peaked profiles ($\Delta v \gtsim 10^{3}$ km~s$^{-1}$), whose prototype
are Arp 120B and 3C 390.3 \citep{chenetal89,zhang11}. An example is shown in Fig. \ref{fig:pec}. (3) Single peaked profiles
with a large shift, either to the blue or to the red (two examples, one for each case, are also shown in Fig. \ref{fig:pec}). A prototypical source, Mkn 668 \citep{marzianietal93}, shows a peak displacement of $+3000$ km~s$^{-1}$. \citet{stratevaetal03} found
that class (2) profiles are also relatively rare ($\simlt 2$\%, considering that most of the \citealt{stratevaetal03} sources are not actually double-peaked sources). The prevalence is higher among RL   but significant also among RQ sources.

\subsection{Empirical Interpretation of the {\sc{H}}$\beta$\/\ emission line profile along the 4DE1 sequence}
\label{ei}

Attempts at interpretation of single emission lines are doomed to provide rather ambiguous results. The emitting region is not spatially resolved, and the profiles are usually smooth. They can be described by simple functional forms (logarithmic, or
Lorentzian), and these profile can be  modelled assuming widely different structural and dynamical conditions. On the converse, comparison of representative HILs to  representative LILs ({\sc{H}}$\beta$\/\ and {Mg\sc{ii}}$\lambda$2800\/) provides important insights \citep{marzianietal96}. Some {\sc{H}}$\beta$\/\ profiles show a significant excess with respect to a symmetric Lorentzian especially in the spectral types associated with the highest $L/L_{\rm Edd}$\ \citep{marzianietal13}. The blue shifted emission has been interpreted as an outflowing component which has a physical correspondence
if there is e.g. a non-rotating radiation driven wind \citep[][]{elvis00}.

Further  interpretation  of the broad profiles involves ``stratification'' of the emitting region: we associate (likely an over-simplification of a continuous radial trend) the broad component  with a lower ionization Broad Line Region (BLR), where line broadening is predominantly virial, and where {Fe\sc{ii}}\/, {Ca{\sc ii}}\ are also emitted \citep[][and references therein]{martinez-aldamaetal15}.  Consistently, there is no significant shift ($\ltsim 200$ km~s$^{-1}$) between {\sc{H}}$\beta$\/\ BC and {Fe\sc{ii}}\/\ optical emission
\citep{sulenticetal12}. The very broad component is associated with an inner region of higher
ionization, the Very Broad Line Region (VBLR) emitting no {Fe\sc{ii}}\/\ and showing lower continuum responsivity \citep{sneddengaskell07,goadkorista14}. The typical decomposition BC/VBC is shown by the mock profile in Fig. \ref{fig:mock} as well as by the composite profile in Fig. \ref{fig:e1}. LIL profiles often show asymmetries but the amplitude of the asymmetries and shifts is usually much less than their FWHM \citep{sulentic89,marzianietal03a,zamfiretal10}.  The stratification view is consistent with  virial motions dominating both the core and the wings of the Pop. B LILs, although the redward asymmetry of
Balmer and other LILs is difficult to explain.

\begin{figure}[htp!]
\includegraphics[scale=0.09]{pechb.jpg}
\caption{Three examples of peculiar {\sc{H}}$\beta$\/\ profiles from the sample of \citet{zamfiretal10}.  Abscissa is rest frame wavelength in \AA, ordinate is specific flux in 10$^{-17}$ ergs s$^{-1}$\/\ cm$^{-2}$\/\ \AA$^{-1}$.   }
\label{fig:pec}
\end{figure}

\begin{figure}[htp!]
\includegraphics[scale=0.15]{mockprofa.jpg}
\includegraphics[scale=0.15]{mockprofb.jpg}
\caption{Mock {\sc{H}}$\beta$\/\ profile illustrating the line decomposition into a BC and a blueshifted  component for Pop. A (top), and into a BC, VBC and blue shifted component for Pop. B (bottom). Radial velocities are measured for the peak intensity $I_\mathrm{p}$,  and the centroids (black spots) at different fractional intensities on the {\em full} profile, to obtain a quantitative parameterisation that is independent of the decomposition of the profile.   }
\label{fig:mock}
\end{figure}

\subsection{Luminosity and radio-loudness effects on the {\sc{H}}$\beta$\/\ line profile}
\label{effects}

The main luminosity effect on {\sc{H}}$\beta$\/\ is a systematic increase in the minimum FWHM \citep{marzianietal09}
which has been shown in several papers since 2009 and will not be shown again. At the same time we
see that shifts toward the red close to the line base, at 1/4 fractional intensity become more
frequent in higher $L$\ sources (this is reflected in an increased redward asymmetry). At
present we do not see any strong RL effect on {\sc{H}}$\beta$\/. The median {\sc{H}}$\beta$\/\ line profiles for RL and
RQ Pop. B sources are practically indistinguishable \citep{marzianietal03b,zamfiretal08}. Extreme
cases of  redward asymmetry are found among radio loud quasars but there is no doubt that
Pop. B RQ sources are also capable of impressive redward asymmetries (especially at high luminosity)
with AI$\approx$ 0.5. Most of the quasars in our high $L$\  sample \citep{marzianietal09}
are RQ quasars (Fig. \ref{fig:lum}).

As mentioned, RL effects on LILs can be viewed as second order, if they exist at all. In the plane c(1/4) vs FWHM {\sc{H}}$\beta$\/\ the bulk of the radio loud sources occupies the same area of RQ Pop. B, with some CDs trespassing to the Pop. A side, most likely because of an orientation effect, as they are viewed close to the radio axis (Fig. \ref{fig:par}).   The distribution  of redshifts at 1/4 peak intensity shows no difference for Pop. B RQ and RL, if measurements uncertainties are taken into account (lower panel of Fig. \ref{fig:par}).  There is no correlation with radio-loudness parameters. The panels of Fig. \ref{fig:rl} shows that the {\sc{H}}$\beta$\/\ AI does not depend neither on  {$R{\rm _K}$}\/\ nor on specific radio power.

The behaviour of LILs is definitely different from the one of HILs, where the suppression of {\sc{Civ}}$\lambda$1549\/\ blueshifts occurs mainly in RL sources, making the redward asymmetry associated with the VBC more prominent. In RQ sources, the redward asymmetry is masked by some
blue shifted emission. The VBLR is believed by some to be a source of strong {\sc{Civ}}$\lambda$1549\/\ emission \citep{marzianietal10}. The difference between the {\sc{H}}$\beta$\/\ and {\sc{Civ}}$\lambda$1549\/\ profiles can be explained, at least in part, by adding blue shifted {\sc{Civ}}$\lambda$1549\/\ emission in RQ sources.

\begin{figure}[htp!]
\includegraphics[scale=0.09]{diag3.jpg}
\caption{Luminosity effects on line profiles shapes: the {\sc{H}}$\beta$\/\ AI behaviour  as a function of bolometric luminosity in ergs s$^{-1}$\/. Black symbols: RQ, red symbols: RL, squares: Pop. B, circles: Pop. A. from the sample of \citet{zamfiretal10}. The magenta points at high $L_\mathrm{bol}$\ represent the sample of \citet{marzianietal09}. The shaded band width is set  by the uncertainty at a $\pm2 \sigma$\ confidence level in individual AI measurements. Within this band, profiles can be considered symmetric.  }
\label{fig:lum}
\end{figure}

\section{The physical and dynamical  interpretation of line shifts}
\label{physics}
\subsection{Atomic physics}

Line broadening and shifts can be produced because of particular physical conditions, for example, for a medium at very high pressure such as in white dwarf atmospheres \citep[][and references
therein]{halenkaetal15} by quantum mechanical effects \citep{wiesekelleher71}. Such shifts are however rather modest even at the highest density. Generally speaking natural and collisional broadening produce Lorentzian profiles \citep[e.g.,][]{peach81}. We find many Balmer line profiles in Pop. A sources that are Lorentzian-like (to be more precise, they are Voigt due to the convolution with the (Gaussian) instrumental profile). The width is however too large to be produced by collisional effects; Lorentzian profiles are possible also for processes associated with gas motion and geometry.

 In principle, thermal broadening  could  yield a Gaussian line with FWHM$= \sqrt{8 k T_{e} \ln 2 / m_{e}c^{2}} \lambda_{0}$, where $k$ is the Boltzmann constant $T_\mathrm{e}$\ the electron temperature, $m_\mathrm{e}$\ the electron mass, and $\lambda_{0}$\ the line rest frame wavelength. For a typical FWHM {\sc{H}}$\beta$\/\ = 4000 km~s$^{-1}$, the electron temperature   needs to be $\sim 10^{9}$ K, too high.

Optical depth effects may also produce  shifts and absorptions dips in the emission profiles. Narrow dips and not widely-spaced double peaks are sometimes observed in {\sc{H}}$\beta$\/\ profiles (typical cases: IC 4329A,
Akn 120, and OX 169 \citealt{marzianietal92,korista92,halperneracleous00}),  but optical depth effects
are  usually not considered as a possible cause of the absorption, even if the Balmer line optical
depth is $\tau \sim 10^{2} \gg 1$. Self-absorption requires that the emitting gas cloud is seen through
the line of sight \citep{smith80}, which may occur occasionally but not very frequently (a case known
for many years involves the {\sc H}$\alpha$\ profile of NGC 4151, \citealt{andersonkraft69}). Accordingly, only
a few cases of {\sc{H}}$\beta$\/\  BAL profiles are known \citep[e.g.,][and references therein]{aokietal06,jietal12}.
The rarity of these sources is most likely a consequence of the physical conditions needed to produce significant absorption: the maintenance of a large population of HI atoms with electrons excited to level $n = 2$ via { Ly}$\alpha$\ resonance scattering, so that the $n = 2$\ level can become a pseudo-ground level and {\sc{H}}$\beta$\/\ itself ``behave'' like a resonant line.

\begin{figure}[htp!]
\includegraphics[scale=0.09]{diag1r.jpg}
\vspace{-2cm}
\includegraphics[scale=0.09]{diag2.jpg}
\caption{Top: FWHM {\sc{H}}$\beta$\/\ vs c(1/4)   parameter  in km~s$^{-1}$ \ for RQ       (open circles),   core-dominated (green squares) and FRII (red circles) in the \citet{zamfiretal08} sample.  The shaded band width is set  by the uncertainty at a $\pm2 \sigma$\ confidence level in individual AI measurements, as in the previous figure.  Bottom: Histogram of the c(1/4) distribution for Pop. B sources, with bin width  corresponding to the $2 \sigma$\ uncertainty associated with c(1/4), for RQ and RL (red). The restriction to Pop. B is motivated by the paucity of RL sources in Pop. A.   }
\label{fig:par}
\end{figure}

\begin{figure}[htp!]
\includegraphics[scale=0.09]{diag4.jpg}
\vspace{-2cm}
\includegraphics[scale=0.09]{diag5.jpg}
\caption{Radio-loudness effects  on {\sc{H}}$\beta$\/\ line profiles. Top: {\sc{H}}$\beta$\/\ AI vs. radio-loudness parameter {$R{\rm _K}$}\/, for radio-detected RQ quasars (open circles) and RL quasars (filled circles) from the sample of \citet{marzianietal03a}. The vertical line shows the nominal boundary for RL objects.   An unweighted lsq fit yields a trend with a slope not significantly different from 0 (straight red line). Bottom: AI vs. radio power at 20cm for Pop. B sources in the sample of \citet{zamfiretal08}. Meaning of symbols is the same as in Fig. \ref{fig:par}.  The slope of the straight line is $0.14 \pm 0.10$, again not significantly different from 0. }
\label{fig:rl}
\end{figure}

\subsection{Scattering processes}

The BLR is believed to be optically thin for electron scattering \citep{davidsonnetzer79}. However it is still possible that broad line photons are scattered by hot electron surrounding or embedding the line emitting gas \citep{shieldsmckee81}, as in the case of an hot inter cloud medium or of an ionised
atmosphere above a dense accretion disk. Support for the latter hypothesis has been found by spectropolarimetric analysis of the broad {\sc H}$\alpha$\ profile: in about ten objects, the PA of the polarisation vector rotates across the profile, reaching opposite PA in the red and blue wings \citep{smithetal05},
as expected if light is scattered from a rotating disk. Since the emitting region radius is now
believed to be much smaller than in the past (the inner radius might be less than 100 R$_{\rm g}$\/), it
is possible that the innermost broad line emission, already associated with gas in rapid motion, is
further broadened by a screen of hot electrons \citep{laor06}. It is intriguing that \citet{smithetal05} found lower polarisation in the line core. This is consistent with a two component model (i.e., BC + VBC) where the core is emitted further out than the line wings, possibly outside of the screen of scattering material.

Other scattering processes might be operating as well. Rayleigh scattering could be relevant if there is neutral material
of high column density, as might be present in an accretion disk or a molecular torus. It could be more important than electron scattering in the UV \citep{gaskellgoosmann13}. Rayleigh scattering could contribute the broadening of the extended line wings
in { Ly}$\alpha$\ if { Ly}$\alpha$\ is emitted above the disk and scattered towards the observer by the dense accretion disk \citep{lee05}.

Fast (relativistic) electrons moving in a dense med\-ium could be give rise to Cerenkov line-like radiation
\citep{youetal86,chengetal90}. Densities above $n_{\mathrm{H}}$\/$\gtrsim$ $10^{13}$ cm$^{-3}$\/ are required for a significant effect.
This may be the case for an accretion disk as well as for dense gas clumps emitting the LILs in extreme Population A
sources \citep{negreteetal12}. Shifts on the order of $\sim 1000 $km~s$^{-1}$ should appear as a net redshift in the Balmer
and Lyman lines \citep{liuetal14}.

\subsection{Gravitational redshift}

An early analysis of gravitational redshift in the context of broad line emission was given by \citet{netzer77}. A detailed discussion of gravitational redshift effects on the Balmer line profiles is provided by Bon et al. (submitted for this volume).
Here we just recall that gravitation can induce a shift \
$
\Delta z \approx     \frac{G M_\mathrm{BH}}{R  c^2} =  \frac{1}{2}
\frac{R_{\mathrm{S}}}{R}
$
where  $M_\mathrm{BH}$\ is the black hole mass, and $R_\mathrm{S}$\ the Schwarzschild radius  ($2GM_\mathrm{BH}/c^{2}$).
This relation is valid with an approximation of 4\%\ down to a 20 Schwarzschild radii. The  total shift of
line profiles would include the effect of transverse Doppler redshift, so that the expected shift
is $\Delta z \approx      \frac{3}{4} \frac{R_{\mathrm{S}}}{R}$. Two considerations are in order:
\begin{itemize}
\item the most massive BHs may be associated with the strongest red-ward asymmetries in the {\sc{H}}$\beta$\/\  line \citep{marzianietal09};
\item ray tracing in Kerr metrics produce red wings that reproduce fairly well the observations of observed
profiles in several high-luminosity sources.
\end{itemize}
Is this enough to justify the claim that grav $z$\ produces the redward asymmetry in Pop. B sources? The answer is "No". The
problem is that the models assume disk emission with steep emissivity laws that give a significant weight to the
inner disk regions. Since the radii needed to explain the centroid shifts at 1/4 or the VBC displacements are
$\sim$ 100 $R_{S}$, there is not likely to be enough cold gas to explain the most luminous sources. A more detailed model
that includes both kinematics and emitting gas physical conditions (assuming, for instance, that the gas in confined to
a dense disk) is needed before a conclusion can be reached (Bon et al.).

\subsection{Doppler effect due to an ordered velocity field}

There are several lines of evidence supporting virial motion as an important source of line broadening:
\begin{itemize}
\item  velocity resolved reverberation mapping studies \citep{koratkargaskell91,grieretal13}  exclude outflows
as the broadening source at least in the LILs of Population B sources.
\item an anti-correlation between size (derived from reverberation mapping) and line width found for several lines
in the same sources \citep{petersonwandel99}: a central massive object gravitationally dominates cloud motions,
with the lines  emitted by ionic species of higher ionization potential due to gas moving faster, and  emitted
closer to the central massive object.
\item a fairly symmetric profile is by far the most frequent; apart from the peculiar cases, shifts are usually less
than 0.1 of the line width at the same fractional height \citep{sulentic89}.
\item {\sc{H}}$\beta$\/\ and {Mg\sc{ii}}$\lambda$2800\/\ show a trend in line width consistent with the domination of virial motions. {Mg\sc{ii}}$\lambda$2800\/\ is
preferentially emitted at slightly larger distance than {\sc{H}}$\beta$\/\ from the continuum source \citep{marzianietal13a};
\item there is a gradient in ionization level (approximated in the decomposition BLR/VBLR) that is consistent
with a virial velocity field.
\end{itemize}

Extreme population A sources (spectral type A3 and A4) often show a blue-shifted excess indicative of radial motion and
most likely associated with an outflow. This said, the geometry of the gas is not yet clear. The fundamental issue
of whether the gas is associated with a disk or with a system of clouds is still not settled. Clouds models are still
formulated at the time of writing perhaps by authors unaware  of the confinement problems that cloud models
face \citep{shadmehri15}, of which the most serious remains the expected decay time due to the viscous attrition with
some putative ``inter cloud medium.''  Disk + wind models provide some consistency with ideas about
Pop. B sources \citep{flohicetal12}, but they still fail to reproduce a typical Pop. B {\sc{H}}$\beta$\/\ profile. At the same time,
a Lorentzian profile might be reasonably  associated with an extended disk, but other models can also produce Lorentzian or almost Lorentzian
shapes, most notably a system of clouds under the combined influence of gravity and radiation pressure
forces \citep[][]{mathews93,netzermarziani10}.

\subsection{Peculiar profiles: Binary BLR, disks and/or outflows?}

\paragraph{Binary BH}  The search for binary black holes is still in its infancy. Apart from a few very special cases
such as OJ 287 \citep{sillanpaaetal88}, evidence in favour of sub-parsec binaries that could significantly affect the
broad line profiles is still sparse, and has been hard to find \citep{bonetal12}. Some of the most classical double
peaked sources (Arp 102B, \citealt{halpernfilippenko88}) show remarkable stability of the peak positions over decades,
ruling out a binary system with reasonable masses \citep{gezarietal07}. Similar considerations were made for OX 169  \citep{halperneracleous00}. Sub-pc BBH should be numerous at high $z$ but rarer in the local Universe \citep{volonterietal09}. It
is still unclear whether we should look for a sizeable minority population or for extremely rare event, as coalescence times
depend on the evolution of the binary orbit eccentricity, and circularised orbit are ``stiff" since they do not yield to
orbital losses due to gravitational radiation. Profiles with large shifts  are perhaps more promising \citep{borosonlauer09}, and  extensive searches for eventual monitoring are being carried out \citep[e.g.,][]{juetal13}.

The accretion disk explanation that fits Arp 102B so well fails for other double peaked sources for which a more suitable
model may be offered by elliptical disks \citep{eracleousetal95}. Accretion disk emission has been postulated for
the broad line wings \citep{bonetal09a}. Modelling of a disk may require abandoning the weak field treatment in order
to model the red asymmetry of Balmer line profiles in Pop.  B (Bon et al. submitted).

Single peaked profiles with large shift can be explained by radially moving gas.  However, inferences on the direction of
radial motions are affected by isotropy of line emission: if the line is anisotropically emitted as expected for the
Balmer lines in the physical conditions  of the BLR \citep{ferlandetal92}, then a redshift corresponds to inflow (accretion?),
and a blueshift to outflow (winds?), although it is still possible that we see emission mainly from the shielded face of
clouds \citep{ferlandetal09}.

\section{How can LIL shifts and other profile properties help  build a physical scenario}
\label{build}

Line profiles of Balmer lines are orientation dependent. This result emerges on a statistical basis by comparing
the average line widths of lobe-dominated and core-dominated radio-loud sources \citep{willsbrowne86,mcluredunlop02,sulenticetal03}.  Conservation of angular momentum accounts for the the spherical symmetry break that leads to the formation of a Keplerian (or quasi-Keplerian) accretion disk around the black hole. Not surprisingly, a flattened configuration was already ``in place'' in the
minds of astronomers from heuristic considerations during the 1970s \citep[e.g.,][]{osterbrock78}. However, the viewing angle
is a parameter that is generally unknown for RQ sources and can be estimated only for superluminal
radio loud sources on an individual basis \citep{rokakietal03,sulenticetal03}. Approaches using
polarimetry \citep{afanasievpopovic15} and gravitational redshift (if found appropriate) can in principle lead to an estimate
of the viewing angle \citep{gavrilovicetal07,kollatschny03}.  A flattened or a ``bowl''-shaped geometry \citep{kollatschnyzetzl11,goadetal12} is   suggested by the dependence of line width on viewing angle. \citet{goadetal12} suggested that line emission
may occur in the outer region of the accretion disk, where it should merge with the surrounding molecular torus, and were
able to obtain Lorentzian profiles for the integrated emission from that region. This model is intriguing and may
well be applicable to extreme Pop. A sources.

Heuristic considerations and black hole and Eddington ratio estimates suggest that the main driver of the quasar main sequence is Eddington ratio \citep[e.g.,][]{marzianietal01,marzianietal03b,kuraszkiewiczetal09}.  Population A and B are distinct in terms of Eddington ratio: the boundary value (for BH mass of 10$^8$ M$_\odot$\/) is estimated to be $L/L_{\rm Edd}$ $\approx 0.2 \pm 0.1$
\citep{marzianietal03b}. It is interesting to note that this is the limit at which the transition from a geometrically thin to a geometrically thick disk is expected \cite[][and references therein]{abramowiczetal88,franketal02}. So, any model of the
BLR should be based on this constraint, with models valid for Pop. A including a geometrically thick disk, its anisotropy and
shadowing effects. A first attempt to include a geometrically thick disk in a BLR model has been carried out by  \citet{wangetal14a}, but the predictions until now contradict the observations.

\section{Key Open issues and conclusions}
\label{open}

It is perhaps disappointing  that after 40 years of effort the structure and dynamics of the regions emitting the
LILs are poorly understood. However, on the bright side,  some key points have been clarified:

\begin{itemize}
\item we now have a contextualization which allows us to relate, and discriminate between  source classes;
\item a trend in Balmer line shapes is systematic along the 4DE1 sequence;
\item Lorentzian (Pop. A) or double Gaussian (Pop. B) are by far the most frequent {\sc{H}}$\beta$\/\ and {Mg\sc{ii}}$\lambda$2800\/\ profiles;
\item only a minority of sources show very broad profiles that are immediately consistent with accretion disk emission;
\item the wide range of HIL FWHM suggests that black hole mass estimates using this measure as a virial estimator
must be treated with caution. No model can explain this range invoking only line of sight orientation of a flattened disk.
The rules for mass estimation are likely different for Pop. A and B sources.
\end{itemize}

The profile differences may be associated with an accretion state transition.

Degeneracy of the regular profile with respect to competing models is still a major problem. Knowing however that $L/L_{\rm Edd}$\ is a major driver in HIL profile diversity along the 4DE1 sequence will help building more focused models.

\begin{acknowledgements}
AdO and JS acknowledge the support by the Junta de Andaluc\' \i a through project TIC114,and the Spanish Ministry of Economy and Competitiveness (MINECO) through project AYA2013-42227-P.
\end{acknowledgements}
\newpage
\newpage
\pagebreak

\vfill\eject

\newpage\pagebreak
\bibliographystyle{spr-mp-nameyear-cnd}

Balmer line shifts in quasars