Earlier quoted context omitted.
>>remote monitoring and control > There are opensource ways to do out of band management without it. I'd be surprised if there is a cost-effective open source alternative to this requirement: Remotely access and control a computer under any circumstance where it has power and a physical network connection. Solutions like AMT work even if there is no functioning processor or memory, because ME provides its own process…
Wouldn't it just take a motherboard maker or two to find an alternative to the PCH, like Nvidia nforce or a VIA chipset. adopt something like openbmc and sell it as an open feature? No intel PCH, no Intel ME. Seems like the Linux kernel is eager to support it: https://lwn.net/Articles/683320/ What happened to 3rd parties making chipsets? Another case of Intel abusing it's monopoly?
Disabling Intel ME 11 via undocumented mode
191–200 of 228 posts
Re: Disabling Intel ME 11 via undocumented mode
#192Earlier quoted context omitted.
Speaking as a naive outside observer, I am excited with the rumors that Microsoft and Apple will be making a move toward ARM in the nearish future. I don't think ARM is the answer (dear god give us riscv) but I see it as a step in the right direction away from closed systems.
ARM chips are going to end up with management cores for the same reasons that the ME exists.
But there exist more producers of ARM chips, so it is more likely that one of them also produces one without a management core.
Re: Disabling Intel ME 11 via undocumented mode
#193Earlier quoted context omitted.
This is why Russia makes their own chips in their own fabs for defense applications. [1] 1. https://en.m.wikipedia.org/wiki/MCST
They're actually fabbed by TSMC. MCST is fabless, not an IDM.
According to their videos, their most recent chips are made by TSMC, but the older ones are made in Russia (I believe these are used for war applications). When the Russian factory switches to a better fab process, they'll also use it for modern chips. Indeed, the Russian factory is not theirs, though, as they are fabless.
Re: Disabling Intel ME 11 via undocumented mode
#194Earlier quoted context omitted.
> The underlying reason why ME became popular ... ... is also because it provides management features that are wanted by enterprise customers. If you're running hundreds of servers in a data center, the more management you can do remotely, without visiting the machine room and preferably automated as much as possible, the better. This is quite irrelevant and even undesirable for an individual's personal computer.
I read statements like this often on HN, but not once during my years of work as a sysadmin in enterprise IT in different countries did I meet anyone who used ME/AMT for employee laptops. Also not at conferences. Admins use the ILOM/IPMI for servers, so you don't really need it for server CPUs. For laptops all management happens at the operating system level, not below it.
Admins used the "Intel System Defense Utility"[1] back in the vPro/AMT days. It allowed for "nice" BMC-like features for normal desktops and laptops. I know about it from "The Website is Down"[2], but I find it hard to believe that nobody used it.
[1]: https://downloadcenter.intel.com/download/15362/index.htm?ii... [2]: https://www.youtube.com/watch?v=v0mwT3DkG4w
Re: Disabling Intel ME 11 via undocumented mode
#195Is this the same Dmitry Sklyarov who got caught up in a DMCA debacle over a decade ago?
Re: Disabling Intel ME 11 via undocumented mode
#196Earlier quoted context omitted.
Why not?
Register windows and delay slots. These turned out to be not such a great idea.
[I'm not a microarchitecture expert]
I've read that x86 has multiple registers (eg, https://news.ycombinator.com/item?id=9264195, http://blog.erratasec.com/2015/03/x86-is-high-level-language...). "You want to do something with rax, so the processor grabs one of its 168 internal registers to play the role of rax for a moment" sounds like a type of register-window implementation to me. Or I'm completely misinterpreting the term.
Note that my sentiment/tone in asking this is "huh, if that's the case then POWER and other architectures could really compete with x86!". (Assuming POWER doesn't use that approach.)
Re: Disabling Intel ME 11 via undocumented mode
#197Earlier quoted context omitted.
>>remote monitoring and control > There are opensource ways to do out of band management without it. I'd be surprised if there is a cost-effective open source alternative to this requirement: Remotely access and control a computer under any circumstance where it has power and a physical network connection. Solutions like AMT work even if there is no functioning processor or memory, because ME provides its own process…
Right, out of band management (by today's definition) means - assuming the chassis has power and network, you can manage the machines, this is primarily a hardware problem. As much as I root for Open Source software, I don't see how OSS can replace the AMT stack. Our team has several racks of R&D servers 7500km away from the bulk of the team, and having OOB management is vital. Absolutely vital.
> As much as I root for Open Source software, I don't see how OSS can replace the AMT stack.
The claim that extant FLOSS solutions can stand in for AMT was false, but now the replies to that have set up a false dichotomy.
The opposite of a monstrously complicated, buggy proprietary interface with undocumented features is a compartmentalized, robust proprietary interface with a fully-documented public interface. "Sorry, we don't want to show you the design specs for our hardware." "Sorry, we don't want to show you the code for our secret sauce." That's fine. Just give the bits that can be flipped to slide all the way from maximum ease like your R&D use case to maximum lockdown like a Bitcoin-based service.
Re: Disabling Intel ME 11 via undocumented mode
#198Earlier quoted context omitted.
I read statements like this often on HN, but not once during my years of work as a sysadmin in enterprise IT in different countries did I meet anyone who used ME/AMT for employee laptops. Also not at conferences. Admins use the ILOM/IPMI for servers, so you don't really need it for server CPUs. For laptops all management happens at the operating system level, not below it.
Admins used the "Intel System Defense Utility"[1] back in the vPro/AMT days. It allowed for "nice" BMC-like features for normal desktops and laptops. I know about it from "The Website is Down"[2], but I find it hard to believe that nobody used it. [1]: https://downloadcenter.intel.com/download/15362/index.htm?ii... [2]: https://www.youtube.com/watch?v=v0mwT3DkG4w
I hadn't seen that episode of TWiD. So hilarious, with a mix of sad how true it is.
Re: Disabling Intel ME 11 via undocumented mode
#199Earlier quoted context omitted.
If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too? It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough. The underlying reason why ME became popular is the same reason why proprietary walled…
> The underlying reason why ME became popular ... ... is also because it provides management features that are wanted by enterprise customers. If you're running hundreds of servers in a data center, the more management you can do remotely, without visiting the machine room and preferably automated as much as possible, the better. This is quite irrelevant and even undesirable for an individual's personal computer.
Are there any enterprise-useful features provided by ME that couldn't be provided external to the CPU?
Since the boot process already involves some amount of hand holding from outside the CPU, any of those features could have been provided by a designed-for-enterprise motherboard with ME-like features in the BIOS/UEFI or even some sort of peripheral in the PCH (or wherever).
Re: Disabling Intel ME 11 via undocumented mode
#200Earlier quoted context omitted.
>>remote monitoring and control > There are opensource ways to do out of band management without it. I'd be surprised if there is a cost-effective open source alternative to this requirement: Remotely access and control a computer under any circumstance where it has power and a physical network connection. Solutions like AMT work even if there is no functioning processor or memory, because ME provides its own process…
Most BMCs are rather limited aren't they? They can switch power off and on, read a few sensors. ME goes well beyond that from what I gather.
They've supported a lot more than that for a very long time. The BMCs on both my ThinkServer TD340 and ProLiant ML10 support remote KVM access, CD/DVD emulation (mount a local .iso as a virtual drive on the server), firmware updates, and quite a bit more.
On top of that, I should note they do this without assistance of the Intel ME. The remote KVM access is handled through a video adapter embedded in the BMC.