3 ms·

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

by cm3 12y ago

pgeorgi 12y ago
The ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features). vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.
- cm3 12y ago
  Oh no. I thought I could select the right chip like you can do to dodge TSX and HT. What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface?
  - stefantalpalaru 12y ago
    > What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface? AMD implements something similar with DASH in some of its APUs: http://www.amd.com/Documents/out-of-band-client-management-overview.pdf http://www.amd.com/Documents/out-of-band-client-management-o... On page 10 in that PDF it says: > DASH support is available in numerous client platforms, including the HP Elitebook 700 series, HP EliteOne 705, HP EliteDesk 705 Mini, HP EliteDesk 705, HP 6305 and Lenovo M78 ThinkCentre. Support is also available in management consoles, including the Symantec/Altiris Client Management Suite v7.5, and Microsoft System Center Configuration Manager (SCCM)*.
    - pgeorgi 12y ago
      The interesting thing is that they refer to NIC vendors all the time - as if that feature is integrated with the ethernet controller (plus some help of the chipset to keep it alive when everything else is off). However AMD has its own share of extra processors within the CPU and chipset, of which we (at coreboot) know of at least two: SMU and IMC. The firmware for both is still measured in kilobytes, and they seem to have limited access to hardware resources. (for SMU, see http://media.ccc.de/browse/congress/2014/31c3_-_6103_-_en_-_saal_2_-_201412272145_-_amd_x86_smu_firmware_analysis_-_rudolf_marek.html http://media.ccc.de/browse/congress/2014/31c3_-_6103_-_en_-_...) Newer chipsets (than kaveri/kabini) come with TrustZone (that ARM stuff) and a "Platform Security Processor", which indicates that there's at least one new processor, likely ARM based.
      - cm3 12y ago
        Good to know I can freely choose between AMD and Intel chips then. Let's hope lowRISC doesn't implement a similar attack vector.
sounds 12y ago
The real question is, what happens if you flash a custom BIOS that just ignores the ME? Intel chips up to (I think) 2006 would happily boot without the ME enabled ("ME optional"). Intel's newer chipsets have a watchdog in the ME hardware which will reset the main CPU if the ME is not initialized by the BIOS ("ME mandatory"). Combined with the as-of-yet unbroken RSA signature on any ME firmware, this has some pretty astounding implications.

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

by cm3 12y ago

Is it part of vPro or available in every cpu? Can it be disabled like TSX?

The ME is on _every_ CPU, and you can't easily disable it (there are ways, but it's unclear how much really shuts down, and you might lose power management features). vPro is merely the larger ME firmware: The small one is 1.5-2MB, the vPro one is 5-7. A non-vPro mainboard probably comes without a SOAP-capable webserver (although I wonder what they need 1.5MB of code for), but the chip to run it is all there.

cm3 12y ago
Oh no. I thought I could select the right chip like you can do to dodge TSX and HT. What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface?
- stefantalpalaru 12y ago
  > What if I get an AMD CPU? Do those also have an IPMI in disguise inside the CPU package wired to a network interface? AMD implements something similar with DASH in some of its APUs: http://www.amd.com/Documents/out-of-band-client-management-overview.pdf http://www.amd.com/Documents/out-of-band-client-management-o... On page 10 in that PDF it says: > DASH support is available in numerous client platforms, including the HP Elitebook 700 series, HP EliteOne 705, HP EliteDesk 705 Mini, HP EliteDesk 705, HP 6305 and Lenovo M78 ThinkCentre. Support is also available in management consoles, including the Symantec/Altiris Client Management Suite v7.5, and Microsoft System Center Configuration Manager (SCCM)*.
  - pgeorgi 12y ago
    The interesting thing is that they refer to NIC vendors all the time - as if that feature is integrated with the ethernet controller (plus some help of the chipset to keep it alive when everything else is off). However AMD has its own share of extra processors within the CPU and chipset, of which we (at coreboot) know of at least two: SMU and IMC. The firmware for both is still measured in kilobytes, and they seem to have limited access to hardware resources. (for SMU, see http://media.ccc.de/browse/congress/2014/31c3_-_6103_-_en_-_saal_2_-_201412272145_-_amd_x86_smu_firmware_analysis_-_rudolf_marek.html http://media.ccc.de/browse/congress/2014/31c3_-_6103_-_en_-_...) Newer chipsets (than kaveri/kabini) come with TrustZone (that ARM stuff) and a "Platform Security Processor", which indicates that there's at least one new processor, likely ARM based.
    - cm3 12y ago
      Good to know I can freely choose between AMD and Intel chips then. Let's hope lowRISC doesn't implement a similar attack vector.

sounds 12y ago

The real question is, what happens if you flash a custom BIOS that just ignores the ME? Intel chips up to (I think) 2006 would happily boot without the ME enabled ("ME optional"). Intel's newer chipsets have a watchdog in the ME hardware which will reset the main CPU if the ME is not initialized by the BIOS ("ME mandatory"). Combined with the as-of-yet unbroken RSA signature on any ME firmware, this has some pretty astounding implications.