Experiments with disabling the ME on Sandybridge x230

Re:Experiments with disabling the ME on Sandybridge x230 by 0x0 on Tuesday September 13, 2016 @01:41PM (#12490534)

I thought you couldn't disable it?

https://www.coreboot.org/pipermail/coreboot/2016-September/0... - "AFAIK the ME will allow the platform to stay on for 30 minutes, and will then shut it down hard." (when the firmware/ME has gone bad)

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by gmazza on Tuesday September 13, 2016 @01:49PM (#12490619)

This 30-minutes-then-shutdown annoyance looks to be optional and disabled at the very least on the x230 machine that trmm is hacking on:

https://www.coreboot.org/pipermail/coreboot/attachments/2016...

If this will turn out to be something that could be reliably disabled on other laptops, this is going to be huge.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by sevensor on Tuesday September 13, 2016 @02:07PM (#12490775)

Heck, it would be big news even if this applied only to the x230. Or even if it only applied to some x230s. It means there's a somewhat modern x64 laptop on which the ME can be disabled.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by m3rc on Tuesday September 13, 2016 @03:09PM (#12491301)

As an owner of an x230 I'm very very interested.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by yuhong on Tuesday September 13, 2016 @01:42PM (#12490547)

I am talking about the remote management feature, aka Intel AMT.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by derefr on Tuesday September 13, 2016 @03:08PM (#12491283)

As much as people are freaked out by the capabilities of ME, I really like the concept of AMT.

I built a headless compile-slave box recently, and was looking forward to using AMT features to manage it and keep it headless, but found out too late that the board I ordered didn't have AMT support. Now, whenever its fragile boot-stack of GRUB+iSCSI+Xen+LVM decides to wedge into single-user mode on a reboot, I have to power the box off and carry it over to a monitor to see what's wrong. I'd much rather just fix it from my laptop.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by lima on Tuesday September 13, 2016 @04:13PM (#12491816)

These kinds of features are standard for servers and nobody bats an eye ("out of band management"). You need them unless you want to attach a remote KVM to every single server. AMT is just that - out of band management. Intel's implementation is a lot more secure than, say, SuperMicro IPMI which had its fair share of issues.

You can disable SuperMicros IPMI though by pulling out the PCI card, though :-)

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by robryk on Tuesday September 13, 2016 @04:44PM (#12492066)

Why can't you attach a serial console? This will help with any problems that still let you get to grub (BIOS Setup likely doesn't support UI over serial, unless it's a server-like machine).

Once you have a serial console, you can either just plug the cable into your laptop (likely through USB-attached serial port) or set up a small second box (that just runs an ssh daemon and has something like picocom installed) and connect it to that. Then you'll have access over the network.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by jcrawfordor on Tuesday September 13, 2016 @07:20PM (#12493039)

The capabilities of an out-of-band management system are much, much greater than the serial console offers. BIOS and UEFI configuration are an obvious case, but you also use out-of-band management to bail yourself out of situations where the OS is unresponsive or unbootable, and to take many other management actions that would normally require physical access.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by Sanddancer on Tuesday September 13, 2016 @09:08PM (#12493573)

Serial consoles don't help if the box is properly wedged, or has eaten its own bootloader. With a good out of band management system, you can install an OS remotely, with disks on the session driving it appearing as local disks to the machine. Or, you can power off a box as needed, power it on, reconfigure raid cards, etc. A remote serial console is very limited in comparison.

[ Parent | on HN ]

Re:Experiments with disabling the ME on Sandybridge x230 by userbinator on Tuesday September 13, 2016 @08:45PM (#12493463)

I really like the concept of AMT.

As long as the actual owner has the keys, I agree.

[ Parent | on HN ]