netdev - RE: [Intel-wired-lan] [PATCH] e1000e: bump up timeout to wait when ME un-configure ULP mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8fa6ec1ce4ad4b89ae68107a55ce2381@AcuMS.aculab.com>
Date:   Sat, 28 Mar 2020 10:55:59 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Kai-Heng Feng' <kai.heng.feng@...onical.com>,
        Paul Menzel <pmenzel@...gen.mpg.de>
CC:     Sasha Neftin <sasha.neftin@...el.com>,
        Aaron Ma <aaron.ma@...onical.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>,
        "David Miller" <davem@...emloft.net>, Rex Tsai <rex.tsai@...el.com>
Subject: RE: [Intel-wired-lan] [PATCH] e1000e: bump up timeout to wait when ME
 un-configure ULP mode

From: Kai-Heng Feng
> Sent: 26 March 2020 11:30
...
> > Regarding Intel Management Engine, only Intel knows what it does and what the error is, as the ME
> firmware is proprietary and closed.
> >
> > Lastly, there is no way to fully disable the Intel Management Engine.
> > The HAP stuff claims to stop
> > the Intel ME execution, but nobody knows, if it’s successful.

This isn't the only 'bug' caused by the ME logic.

Some systems occasionally spin for many multiples of 50us on any
write to any MAC register - eg to indicate there is a packet to tx.

I really don't understand WTF this ME is playing at on an unmanaged
desktop system - if it receives or sends a packet it is most likely
to be some kind of security attack.
I'm not even sure it needs access during the boot sequence.
Maybe there are some features to get the console output over
ethernet - but they have to be enabled in the BIOS.

We have some small server boards (for 1U systems) that have a
separate ethernet interface for (I think) the ME code.
Better - except you plug a cable in and wonder why is doesn't work.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)