Hacker News Reader

Comment by rwmj | Hacker News Reader

Actually ILO is pretty useful :-)

I have an APM (ARM64) Mustang, and this takes a rather different approach, but probably not one you'll think is better. The chip advertises 8 x 64 bit cores, but there's a 9th 32 bit core which runs all the time, even when the machine is powered down (although obviously still connected to mains power). It runs a separate firmware, in its own RAM, but can access the main memory at will and invisibly to the main OS.

One way to look at this is it's brilliant that we can just put a tiny Cortex-M3 in a spare bit of silicon and have it do useful management stuff.

View on HN

It runs a separate firmware, in its own RAM, but can access the main memory at will and invisibly to the main OS

All watched over by hypervisors of loving grace.

How do you know what the firmware does? Is it even possible to inspect it, let alone replace it? It's just another part of the attack surface - not necessarily deliberately, but if there are exploitable bugs in that firmware that can be triggered from the rest of the system, it's another security risk.

It's possible to update it, not sure about replacing it with ones own code. I know this is "whataboutism" but here goes: Is this different from Intel ME processors with their "hidden" Sparc core?

http://www.slideshare.net/codeblue_jp/igor-skochinsky-enpub

> Is this different from Intel ME processors with their "hidden" Sparc core?

Minor quibble: The IME is not Sun's SPARC architecture, it's ARC International's ARC, the Argonaut RISC Core, which has its origins in (of all things) the Super Nintendo's SuperFX chip.

Didn't even know they had ARC processors in them. That's a trip.

Is this what I've got in my Lenovo X1 with vPro? The Ctrl+P shortcut to get into the config at boot doesn't work - can I poke at it any other way?

In case of high end Texas Instrument's ARM MCUs + Linux, M3 is used for power management. Though the firmware is provided as a binary blob and there's no way to control or check what it actually does (as far as I know).

"but there's a 9th 32 bit core which runs all the time, even when the machine is powered down"

So it's like the situation on mobile phones, with their baseband processors. Except on a general purpose computer.

Awesome.

I think x86 chips with Intel Active Management has the 'Management Engine' which runs an ARC processor with a ThreadX RTOS on it. It even has it's own network interface separate from the rest of the CPU. As far as I can tell this is for Enterprise users who need to manage the PC's and Rack computers remotely, even when the OS dies.

Most motherboard vendors also thrown stuff onto enterprise motherboards for doing things remotely. They can have issues: https://www.youtube.com/watch?v=GZeUntdObCA

Terrifying! Is there a way to disable that?

I don't know which chip OP is using but no you can't. It is usually a small CPU which is part of the GPU video decoder that is used as the 'boot' processor. It usually executes first level ROM code and fetches the first stage boot loader from flash, USB, etc.

It can also do PMU control when the machine is 'turned off'. The alternative is to use an external microcontroller. It is actually quiet useful.

What is your reason for wanting to disable it?

It is another "DMA hacking" vector, one that is always on. https://en.wikipedia.org/wiki/DMA_attack

I have to disagree.

Those core execute the codes from their local SRAM which can only be written to under very specific conditions. You can't arbitrarily write to their SRAMs.

An SOC has various bus arbitrators that are built into hardware which control the dataflow. It is part of the chip's backbone. I've never seen an architecture in which you could easily write to the aux core's SRAM. This is partially because those cores are often responsible for DRM therefore access to them is very restricted, but also because it is expensive (in terms of gates) and unnecessary to hang them off the main bus.

It is a very unlikely "DMA hacking" vector.

The peripheral can just as easily DMA to main memory and overwrite kernel code if the memory apertures are set wide open to allow peripheral to DMA anything into the host. Additionally unless you have PCIe or a similar bus with mastering capability a peripheral can't DMA.

It's basically a fundamental part of the SoC, so I doubt it could be disabled.

That's more or less what the Management Engine (Intel) and Platform Security Processor (AMD) are. In the latter case, it's also some smaller ARM core.

Reply on news.ycombinator.com