Realtek RTL836x series of Ethernet switch ICs has a 8051 hidden inside

https://twitter.com/whitequark/status/1175701730819895296

by dexen • 7 years ago

158 91 7 years ago

dexen• 7 years ago

Context - these two twitter threads: https://twitter.com/whitequark/status/1175692789171884032

so apparently most unmanaged switches have a 8051 connected to the switch fabric inside. would it occur to you that pretty much any switch on your network could be monitoring or injecting traffic? sure would not to me

https://twitter.com/whitequark/status/1175692567150653440

i wasn't previously aware that it's possible (it does makes sense i guess? doing switching entirely in gateware is more risky), and it's an absolutely incredible placement for a near-undetectable implant

swiley• 7 years ago

It’s fun when you find the firmware on periferals like this.

Did you know the processor in the b43 network cards use this really weird architecture developed by the company that made the backplane? It also doesn’t actually handle the radio baseband, that’s done entirely in hardware (If my reading of the firmware is correct.) Which makes me wonder why having more open source WiFi card firmware is rare, I guess it still handles calibration and some other things that you could use to intentionally make the card misbehave but it’s a lot more limited than I expected.

mysterydip2• 7 years ago

A reply in the twitter thread makes the most sense to me: "Interesting! I can imagine this being used to generate & monitor traffic for factory test." That would make verification much easier and also explain why it's undocumented. Of course if there's a way for testers to use it, there's potentially a way for others to use it as well.

8K832d7tNmiQ• 7 years ago

why would you need an 8051 to do an internal testing, though? and why would make it easier to test?

_nalply• 7 years ago

Speculating here, but perhaps the 8051 could mock a network with all possible failure cases.

mysterydip2• 7 years ago

I see it like debug statements in code. If the only access you have to a function is from the inputs and returns, it's difficult to see where the issue lies when the return value is wrong. Having an internally accessible layer of I/O lets you bypass certain areas or get values at different steps to determine root cause. Could be useful for firmware testing, fixing ones that fail a normal test, and RMA's.

You would want to leave the circuitry in place for production because it's largely unnoticeable and changing it could introduce bugs.

raverbashing• 7 years ago

A lot of devices use these simple microprocessors to do general management and talk to low speed buses

I remember in the times of region locked DVD players, some device hacks targeted the same processor inside the DVD player unit (I'm talking about the IDE/SATA drive, not the whole player)

milankragujevic• 7 years ago

I actually have a switch (TP-Link TL-SG105E "Easy Smart") that runs a whole Web UI on that built in CPU. It's quite neat, as the switch is 20$ yet has some "smart"-esque features :)

garamirez• 7 years ago

Wow! I just went back some 20+ years ago going through 8051 instruction set while at the University. It's amazing how versatile and useful it still is.

tyingq• 7 years ago

There's even some existing code to manipulate the firmware:

http://arny.tjps.eu/OpenWrt/EasyBox904xDSL/oem-firmware-info...

And

https://github.com/uwehermann/easybox-904-xdsl-firmware/blob...

rasz2• 7 years ago

not really

SMI SLAVE FOR EXTERNAL CPU

your links talk about external programming of smart switches, you could do this 10 years ago with RTL3866

https://hackaday.com/2010/05/26/unlocking-the-crippled-poten...

http://spritesmods.com/?art=rtl8366sb

or 15 years ago with RTL8309sb

https://web.archive.org/web/20061118184321/http://pupa.da.ru...

mbell2• 7 years ago

This is rather misleading. The RTL8366 pictured in the tweet doesn't have an 8051 in it which is why it's absent from the datasheet. I don't see anything in this thread that contradicts this. The RTL8367 does have an 8051 in it, and it is covered in the datasheet. As near as I can tell this entire claim is based on reading a RTL8366 datasheet when the part in question was a RTL8367.

I'm not seeing anything nefarious here at all, the RTL8367 is designed for 'smart switches', the 8051 is there to run the webUI. In general, 8051s are _everywhere_, it's one of the most used IP cores in the world. I'd bet the average household has a a few dozen of them in various devises.

EDIT: Looking through some older tweets from the same author, I think the claim is based on pinout similarities between the RTL8366 and the RTL8367. My guess would be that these two parts are the same die and the RTL8366 parts are the ones where a defect was found in the CPU core which would be a likely source of manufacturing defects.

joezydeco• 7 years ago

It's not always a binning thing.

I've used similar parts, like bluetooth transceivers, where there are two SKUs: one is a cheaper commodity part and comes with built-in firmware.

The other more expensive part allows for modifiable firmware (and, thus, exposes the processor inside). My cynical POV is that the chipmaker knows they'll be spending more internally on SDK development/support and field rep time. So that needs to be recaptured in the cost of the part.

sharpneli2• 7 years ago

It is expensive to tape out a different chip. As 8051 originally was about 50000 transistors that’s peanuts nowadays.

Likely cheaper to manufacture a single chip and do market segmentation via software than manufacture two if the savings are measly (let’s assume 16nm process) 1/500 mm^2 per chip.

IfOnlyYouKnew• 7 years ago

My cynical POV is that the chipmaker knows they'll be spending more

I don't even see the cynicism. But, in any case, most people would probably consider the standard business school price finding advice to be more cynical: costs are a lower limit only. Beyond that, only the customer's willingness to pay is relevant.

Airline fares are good examples, or any of the food products being sold branded as well as unbranded/store-brand/generic/white label versions.

paggle• 7 years ago

It’s probably just cheaper to include the 8051 in every part and disable it for people who have bought the cheaper part. The way that some Teslas are range handicapped and can be upgraded over the air and given out for free during emergencies.

zxcvbn4038• 7 years ago

Back in the day my father was a service tech for NCR retail systems. For one of the lines they shipped out every system fully loaded with ram and disk - however how much their customers got to use depended on jumper configurations which the service techs would set and verify. I think IBM does the same thing with their mainframes - they ship out fully loaded but you can only use what you pay for, the rest is used as hot stand-by for hardware failures.

asveikau5• 7 years ago

I may get flack for this, but that sounds ethically questionable. The sale has been made, why not just give the customer a better car for free?

kurthr• 7 years ago

I'd agree, but there's little reason to speculate. If you can't run it (disabled by fuses), I'm not sure it matters... if you want to confirm the silicon presence, then a little concentrated sulfuric acid to take the package off, and just a 100x microscope and you'll be able to see the memories for the uP.

A strange accusation without proof.

Fair warning I can't open the Tweet, Twitter is blocking me... or maybe I uBlock them? so I'm making a statement in similar unsupported ignorance.

ryanianian• 7 years ago

Tweet has been deleted (URL 404s). Internet archive has some but not all of the thread https://web.archive.org/web/20190922094616/https://twitter.c...

1ris• 7 years ago

Author writes:

whitequark

‏>nonconsensually submitted to the orange website

userbinator2• 7 years ago

WTF... if I remember correctly, the legality of linking (as opposed to copying content) was already established by a few court cases long ago.

I could understand if your personal site gets "HN'd", but a Twitter user doesn't pay for bandwidth.

dkersten• 7 years ago

If you post something to the public internet, you cannot control where it ends up. If that is a problem for you, then you should probably not post on a non-private social media account. That doesn’t negate their right to delete their post after, of course, like this guy has done. Just can’t expect that nobody saw it or screenshotted it or whatever.

victorheld• 7 years ago

https://twitter.com/whitequark/status/1175767033360740352

tambourine_man5• 7 years ago

I’ve seen this hatred towards HN before on Twitter and I don’t really get it. HN is one of the most polite places on the internet, including Twitter.

tptacek• 7 years ago

It's good to remember that things end up on HN because random people post them here, not because their original authors want them here. HN is not, as a rule, good at keeping this in mind, and tends to treat anything that lands on HN as if it was part of a discussion they are (1) a part of and (2) welcome to participate directly in.

I think it's in fact super healthy for people to set clear boundaries about how they engage with this place, and "this Twitter thread was not posted as a solicitation for an HN thread, or for HN people to jump onto my TL" is a very sane boundary indeed.

That people read this kind of boundary drawing as "hatred" is itself a good illustration of the issue!

DINKDINK• 7 years ago

Archiveis link before being memoryholed: http://archivecaslytosk.onion/mtow1

tambourine_man5• 7 years ago

Honest, tangentially related question from someone unfamiliar with the field:

Why are we still using old 80xx chips in embedded applications? Expired patents? Existing toolchain? Inertia?

It’s hard to believe we couldn’t do better, cheaper and more power efficient solutions with all the tricks we’ve learned in those almost 40 years.

LIV2• 7 years ago

Probably the same reasons the 6502 core is being used so much.

Well known cores that are proven reliable over several decades, very well documented and seemingly any bugs are known already. Also cheap

tambourine_man5• 7 years ago

That much cheaper than a modern 32 bit ARM?

I imagine it has to deal with encrypted traffic, IPv6 these days, which doesn’t sound fun on 8bit chips.

It seems weird to me, but again, it’s not my field.

Does any one know what is the market share for 6502, 8051 and ARM?

jagger27• 7 years ago

Well, it's not as if we're using old stock 80xx chips. They're being laid out on modern foundry processes, AFAIK. With that comes most of the power efficiency.

antonyme• 7 years ago

The core is simple, small, cheap or even free, requires few resources, has plenty of tool support, is well-understood and well-documented, and is easy to debug and deploy. The 8051 is perfectly sufficient for many simple embedded applications that only require an 8-bit micro.

It's the instruction set that has been retained, not the silicon design. The variants these days are more power-efficient and powerful in terms of MIPS and peripherals, and have indeed benefited from years of R&D.

tambourine_man5• 7 years ago

But is a ISA that wasn’t designed for embedded really that well suited for it?

And if the silicon design is new, we are not benefiting all the much from decades of battle testing, right?

I can’t imagine how a clean, embedded first 32bit ISA design wouldn’t be more appropriate.

cptskippy2• 7 years ago

That's a naive statement that presumes the design used today is mostly similar to the 40 year old design.

Even if it was the exact same circuit design, that's only a small part of what makes a processor and negates all of the advancements in chemistry, lithography, engineering, and everything thing else that goes into manufacturing a chip.

It's like saying "why are we still using scissors|staplers|brushed electric motors|internal combustion engines?"

KSteffensen• 7 years ago

Why are we still using internal combustion engines?

kbumsik• 7 years ago

Because it doesn't need to be better.

It's an embedded application - if the core does the job exactly what it is intended to be, why upgrade? What do you expect more from an eth chip when it already provide full 1gbps capabilities? In other words, there is no room to be better. It could be more power efficient but it is alway efficient enough. Also changing the core will cost a huge amount of money as it needs to change the production line.

Using more recent tech such as ARM isn't always cheaper or better.

monocasa• 7 years ago

So much about how processor design has evolved isn't about stuff we've learned, it's about how moore's law has allowed us to have more gates for the same cost, and "what is the best use of all these new gates". 8051s are still pretty competitive in their gate count niche.

It's sort of like how MIPS never really got a lot of traction outside of 5ish stage, in order, optional FPU designs. That's ultimately the gate count niche where they're still competitive.

peterwwillis• 7 years ago

This post is gone.

Tweets make bad HN posts; not only because they disappear, but they're too short to have all the details, they don't capture a whole conversation, when they do it's disjointed and in pieces, people jump to conclusions, etc.

whitequark_• 7 years ago

Also I got pinged by like a dozen different HN bots, because each time any of them tweets a link, Twitter thinks it's a quote-tweet and sends a notification. Annoying.

Kenji• 7 years ago

Tweet deleted. She tweeted "nonconsensually submitted to the orange website" hahaha.

compuguy3• 7 years ago

Tweet deleted. She tweeted "nonconsensually submitted to the orange website" hahaha.

And this is why people avoid this site....

ranma42• 7 years ago

Old D-Link DGS-1008D switches with Vitesse chipsets also have a built-in 8051 for firmware (but only 8KB SPI flash loaded into 8KB of embedded RAM, so pretty useless). I think it's mostly used for the cable test when powering on the switch.

perlgeek• 7 years ago

Can somebody please explain what the big deal about it is, if it's even true?

morganvachon2• 7 years ago

It's a documented part, the OP was just confusing two different parts/part revisions.

The paranoid would say "it's a hidden backdoor for running shady code". However, anyone with even a passing interest in embedded computing would recognize that it's designed to store and run official firmware; nothing shady or underhanded about it.

So in short, in this particular instance it's much ado about nothing.

RodgerTheGreat• 7 years ago

The hardware doesn't care what it was designed for; it does what it's told. It is extremely plausible that capabilities which exist for testing purposes can also be exploited for running malware.

rasz2• 7 years ago

Two different parts build using same silicon. Standard industry practice. ESP8266 started its life as a slave SDIO network card with undocumented master mode.

non-entity• 7 years ago

A few weeks back, I was working on trying to patch a BSD driver for another Realtek product (a wireless network adapter) and their were a handful of comments / source reference mentioning "8051". I assumed this to be the microcontroller and, out of curiosity, attempted to disassemble the provided firmware binaries, sadly to no avail.

Does realtek publish their documentation on products publicly? I found it interesting that the author of the tweet has, for example, a pinout.

andrewshadura2• 7 years ago

No, they don't, and they usually don't answer to emails asking for it. You may be lucky finding it at pudn.com or other datasheet-sharing websites, but not officially from them.

userbinator2• 7 years ago

It's common with a lot of Chinese companies; they won't answer requests for datasheets, yet you can find them "leaked" elsewhere and they're not really bothered by it.

I suspect it's more of a "we're not interested in answering your questions, which you will certainly have if we give you a datasheet directly" than any real concern over IP.

Someone• 7 years ago

Tweet is gone, so I can’t check whether it matches, but I would think http://realtek.info/pdf/rtl8366_8369_datasheet_1-1.pdf is a data sheet for this part. It has a pinout.

ngcc_hk• 7 years ago

There is one mentioned an z80 as well.

Realtek RTL836x series of Ethernet switch ICs has a 8051 hidden inside

Related Stories