11 ms·
Realtek RTL836x series of Ethernet switch ICs has a 8051 hidden inside
- dexen 7y agoContext - these two twitter threads: https://twitter.com/whitequark/status/1175692789171884032 https://twitter.com/whitequark/status/1175692789171884032 >so apparently most unmanaged switches have a 8051 connected to the switch fabric inside. would it occur to you that pretty much any switch on your network could be monitoring or injecting traffic? sure would not to me https://twitter.com/whitequark/status/1175692567150653440 https://twitter.com/whitequark/status/1175692567150653440 >i wasn't previously aware that it's possible (it does makes sense i guess? doing switching entirely in gateware is more risky), and it's an absolutely incredible placement for a near-undetectable implant
- swiley 7y agoIt’s fun when you find the firmware on periferals like this. Did you know the processor in the b43 network cards use this really weird architecture developed by the company that made the backplane? It also doesn’t actually handle the radio baseband, that’s done entirely in hardware (If my reading of the firmware is correct.) Which makes me wonder why having more open source WiFi card firmware is rare, I guess it still handles calibration and some other things that you could use to intentionally make the card misbehave but it’s a lot more limited than I expected.
- mysterydip 7y agoA reply in the twitter thread makes the most sense to me: "Interesting! I can imagine this being used to generate & monitor traffic for factory test." That would make verification much easier and also explain why it's undocumented. Of course if there's a way for testers to use it, there's potentially a way for others to use it as well.
- 8K832d7tNmiQ 7y agowhy would you need an 8051 to do an internal testing, though? and why would make it easier to test?
- _nalply 7y agoSpeculating here, but perhaps the 8051 could mock a network with all possible failure cases.
- mysterydip 7y agoI see it like debug statements in code. If the only access you have to a function is from the inputs and returns, it's difficult to see where the issue lies when the return value is wrong. Having an internally accessible layer of I/O lets you bypass certain areas or get values at different steps to determine root cause. Could be useful for firmware testing, fixing ones that fail a normal test, and RMA's. You would want to leave the circuitry in place for production because it's largely unnoticeable and changing it could introduce bugs.
- raverbashing 7y agoA lot of devices use these simple microprocessors to do general management and talk to low speed buses I remember in the times of region locked DVD players, some device hacks targeted the same processor inside the DVD player unit (I'm talking about the IDE/SATA drive, not the whole player)
- milankragujevic 7y agoI actually have a switch (TP-Link TL-SG105E "Easy Smart") that runs a whole Web UI on that built in CPU. It's quite neat, as the switch is 20$ yet has some "smart"-esque features :)
- garamirez 7y agoWow! I just went back some 20+ years ago going through 8051 instruction set while at the University. It's amazing how versatile and useful it still is.
- derba 7y agoYou can only imagie how Versatile and Useful it was in 1979.
- tyingq 7y agoThere's even some existing code to manipulate the firmware: http://arny.tjps.eu/OpenWrt/EasyBox904xDSL/oem-firmware-info/research/ http://arny.tjps.eu/OpenWrt/EasyBox904xDSL/oem-firmware-info... And https://github.com/uwehermann/easybox-904-xdsl-firmware/blob/master/package/infineon-utilities/feeds/ifx_feeds_uboot/open_uboot/src.904dsl/drivers/net/vr9_sw.c https://github.com/uwehermann/easybox-904-xdsl-firmware/blob...
- rasz 7y agonot really >SMI SLAVE FOR EXTERNAL CPU your links talk about external programming of smart switches, you could do this 10 years ago with RTL3866 https://hackaday.com/2010/05/26/unlocking-the-crippled-potential-of-an-unmanaged-switch/ https://hackaday.com/2010/05/26/unlocking-the-crippled-poten... http://spritesmods.com/?art=rtl8366sb http://spritesmods.com/?art=rtl8366sb or 15 years ago with RTL8309sb https://web.archive.org/web/20061118184321/http://pupa.da.ru/avrsw/ https://web.archive.org/web/20061118184321/http://pupa.da.ru...
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- mbell 7y agoThis is rather misleading. The RTL8366 pictured in the tweet doesn't have an 8051 in it which is why it's absent from the datasheet. I don't see anything in this thread that contradicts this. The RTL8367 does have an 8051 in it, and it is covered in the datasheet. As near as I can tell this entire claim is based on reading a RTL8366 datasheet when the part in question was a RTL8367. I'm not seeing anything nefarious here at all, the RTL8367 is designed for 'smart switches', the 8051 is there to run the webUI. In general, 8051s are _everywhere_, it's one of the most used IP cores in the world. I'd bet the average household has a a few dozen of them in various devises. EDIT: Looking through some older tweets from the same author, I think the claim is based on pinout similarities between the RTL8366 and the RTL8367. My guess would be that these two parts are the same die and the RTL8366 parts are the ones where a defect was found in the CPU core which would be a likely source of manufacturing defects.
- joezydeco 7y agoIt's not always a binning thing. I've used similar parts, like bluetooth transceivers, where there are two SKUs: one is a cheaper commodity part and comes with built-in firmware. The other more expensive part allows for modifiable firmware (and, thus, exposes the processor inside). My cynical POV is that the chipmaker knows they'll be spending more internally on SDK development/support and field rep time. So that needs to be recaptured in the cost of the part.
- sharpneli 7y agoIt is expensive to tape out a different chip. As 8051 originally was about 50000 transistors that’s peanuts nowadays. Likely cheaper to manufacture a single chip and do market segmentation via software than manufacture two if the savings are measly (let’s assume 16nm process) 1/500 mm^2 per chip.
- bhouston 7y agoIntel only taps out about three different dies per generation line I believe. For example the Skylake-SP line just has LCC, HCC and XCC dies, and the the whole multitude of their product line comes from those three. https://investorshub.advfn.com/boards/read_msg.aspx?message_id=141418711 https://investorshub.advfn.com/boards/read_msg.aspx?message_...
- ryanianian 7y agoTweet has been deleted (URL 404s). Internet archive has some but not all of the thread https://web.archive.org/web/20190922094616/https://twitter.com/whitequark/status/1175701730819895296 https://web.archive.org/web/20190922094616/https://twitter.c...
- 1ris 7y agoAuthor writes: >whitequark >nonconsensually submitted to the orange website
- userbinator 7y agoWTF... if I remember correctly, the legality of linking (as opposed to copying content) was already established by a few court cases long ago. I could understand if your personal site gets "HN'd", but a Twitter user doesn't pay for bandwidth.
- klyrs 7y agoThere's a wide chasm between good manners and legality. Don't get offended when your actions offend people. At best, it's hypocritical. Said differently: the legality of complaining about people being rude is already established. It isn't even slander/libel if you weren't actually rude, because being rude isn't a crime.
- compuguy 7y agoIt's quite simple: Whitequark deleted the thread because there is a portion of users/readers on HN that are toxic and/or hostile. People don't want to deal with that type of traffic blowing up their Twitter notification feed.
- dkersten 7y agoIf you post something to the public internet, you cannot control where it ends up. If that is a problem for you, then you should probably not post on a non-private social media account. That doesn’t negate their right to delete their post after, of course, like this guy has done. Just can’t expect that nobody saw it or screenshotted it or whatever.
- tambourine_man 7y agoHonest, tangentially related question from someone unfamiliar with the field: Why are we still using old 80xx chips in embedded applications? Expired patents? Existing toolchain? Inertia? It’s hard to believe we couldn’t do better, cheaper and more power efficient solutions with all the tricks we’ve learned in those almost 40 years.
- deleted 7y ago[deleted]
- LIV2 7y agoProbably the same reasons the 6502 core is being used so much. Well known cores that are proven reliable over several decades, very well documented and seemingly any bugs are known already. Also cheap
- tambourine_man 7y agoThat much cheaper than a modern 32 bit ARM? I imagine it has to deal with encrypted traffic, IPv6 these days, which doesn’t sound fun on 8bit chips. It seems weird to me, but again, it’s not my field. Does any one know what is the market share for 6502, 8051 and ARM?
- icegreentea2 7y agoThese 8/16bit cores are rarely used for the main function of the device. They often exist as a general purpose controller to glue together random logic. For example, they might implement the logic that makes the LED be blue when the device is on, and flash blue when the power button is held for 3 seconds, and then trigger a power off when held for 10 seconds (or whatever). They sometimes might even exist along side of a fully 32bit ARM micro.
- Kirby64 7y agoYes. If only because ARM cores mean you need to pay a licensing fee, often times, whereas the 8051, 6502, etc, tend to have significantly better royalty agreements (in my understanding). Also, like the other post says, these aren't used for huge computational uses, it's more for really really basic stuff. You'd be amazed at the amount of chips that have an 8051 in them...
- peterwwillis 7y agoThis post is gone. Tweets make bad HN posts; not only because they disappear, but they're too short to have all the details, they don't capture a whole conversation, when they do it's disjointed and in pieces, people jump to conclusions, etc.
- whitequark_ 7y agoAlso I got pinged by like a dozen different HN bots, because each time any of them tweets a link, Twitter thinks it's a quote-tweet and sends a notification. Annoying.
- Kenji 7y agoTweet deleted. She tweeted "nonconsensually submitted to the orange website" hahaha.
- compuguy 7y ago> Tweet deleted. She tweeted "nonconsensually submitted to the orange website" hahaha. And this is why people avoid this site....
- deleted 7y ago[deleted]
- ranma42 7y agoOld D-Link DGS-1008D switches with Vitesse chipsets also have a built-in 8051 for firmware (but only 8KB SPI flash loaded into 8KB of embedded RAM, so pretty useless). I think it's mostly used for the cable test when powering on the switch.
- perlgeek 7y agoCan somebody please explain what the big deal about it is, if it's even true?
- morganvachon 7y agoIt's a documented part, the OP was just confusing two different parts/part revisions. The paranoid would say "it's a hidden backdoor for running shady code". However, anyone with even a passing interest in embedded computing would recognize that it's designed to store and run official firmware; nothing shady or underhanded about it. So in short, in this particular instance it's much ado about nothing.
- RodgerTheGreat 7y agoThe hardware doesn't care what it was designed for; it does what it's told. It is extremely plausible that capabilities which exist for testing purposes can also be exploited for running malware.
- morganvachon 7y agoCorrect, but the implication in the tweet was that it was secretly embedded by the manufacturer for nefarious purposes. The Twitter OP jumped to paranoid conclusions in part because of their obvious lack of understanding of even simple embedded hardware concepts. You can kill someone with a hammer, but that doesn't mean the hammer was designed for killing.
- rasz 7y agoTwo different parts build using same silicon. Standard industry practice. ESP8266 started its life as a slave SDIO network card with undocumented master mode.
- non-entity 7y agoA few weeks back, I was working on trying to patch a BSD driver for another Realtek product (a wireless network adapter) and their were a handful of comments / source reference mentioning "8051". I assumed this to be the microcontroller and, out of curiosity, attempted to disassemble the provided firmware binaries, sadly to no avail. Does realtek publish their documentation on products publicly? I found it interesting that the author of the tweet has, for example, a pinout.
- andrewshadura 7y agoNo, they don't, and they usually don't answer to emails asking for it. You may be lucky finding it at pudn.com or other datasheet-sharing websites, but not officially from them.
- userbinator 7y agoIt's common with a lot of Chinese companies; they won't answer requests for datasheets, yet you can find them "leaked" elsewhere and they're not really bothered by it. I suspect it's more of a "we're not interested in answering your questions, which you will certainly have if we give you a datasheet directly" than any real concern over IP.
- Someone 7y agoTweet is gone, so I can’t check whether it matches, but I would think http://realtek.info/pdf/rtl8366_8369_datasheet_1-1.pdf http://realtek.info/pdf/rtl8366_8369_datasheet_1-1.pdf is a data sheet for this part. It has a pinout.
- ngcc_hk 7y agoThere is one mentioned an z80 as well.