Re: Putting together a computer from old components

Jaimie Vandenbergh <[email protected]> wrote:
> On 29 Nov 2021 at 18:46:48 GMT, "Spiros Bousbouras" <[email protected]>
> wrote:
> > - Do ARM processors have anything analogous to the Intel management engine ?
> > If not then yes , that's a plus in my book. Plus I want to learn some ARM
> > assembly so having an ARM processor would be a bonus.
> 
> I am fairly sure (but not 100%) that they do not. Raspberry have solid
> documentation, and I've not found an extra controller inside but also
> they don't make a statement that there isn't (I mean why would they
> think to?)
> https://www.raspberrypi.com/documentation/computers/processors.html#bcm2835

Arm designs processors, it doesn't design chips.  It's up to the chip designer
to decide what else to put in there.  For example you can get the same Arm
core with an Arm, Qualcomm or Broadcom GPU.

It is quite common for systems on chip to have additional microcontroller
cores for managing things, for example booting, clocks, power and DDR
timing.  Some of those may be exposed (as a 'system control unit'), but
others aren't.  For example the battery will have a microcontroller in it to
keep an eye on the charging/discharging profile, the touchpad will have a
microcontroller for speaking USB, etc etc.  Many of those microcontrollers
don't have access to system memory (especially not the ones off-chip), but
some do.  They don't often appear on the datasheet as a 'processor' but
simply as a functional block for doing those things (eg a battery monitoring
unit).  Almost none of the firmware that runs on all of these pieces is open
source.

In the Raspberry Pi case there's a GPU that runs closed-source firmware, so
it's not unusual in that respect.  Whether it's analogous to the Intel ME
depends on what you're concerned about: the GPU doesn't have a network
socket on it, but then it can reach the ethernet controller (maybe another
CPU!) over the memory interconnect.  (Arm offers a System MMU to provide
some degree of protection here, but the RPi doesn't use one).

So if you were worried about a supply chain attack providing you malicious
GPU firmware then it's not going to help.  If you're worried about malicious
network traffic attacking the GPU, that won't get to the GPU in normal
operation.

I'm not familiar with the internals of the 15-20 year old AMD systems you're
talking about, but I would be unsurprised if there were similar control
processors in there for doing similar kinds of tasks - just more basic ones. 
And of course those systems haven't had a BIOS update in 15 years so any
vulnerability lurking in there is not going to be patched.  When you start
building a system with a GPU, network card, storage controller, etc, that's
all firmware that hasn't seen updates in a decade or more.

TL;DR: you need to boil down to exactly what is objectionable in the Intel
ME before asking whether the same threat exists on other platforms.  'Other
things running software you can't see / isn't open source' is a given, on
anything more complex than a Sinclair Spectrum.

Theo