(This is Josh - I fixed the video embed.)

Ylian

Now for serious business, as everyone noticed, the Intel AMT DTK has been pulled out of the Intel.com web site. I have gotten many mails about this and trying to catch up on my mail box now. The Intel AMT DTK was pulled out of the web site for internal Intel reasons, the same reasons that caused the DTK to be pulled out the first time. These days, we have been competing with other projects for management & legal time to put it back online. Because it’s not an Intel official project, it’s been low priority and caused the two months delay and, I don’t expect it to be put back soon. Comments from the community have raised the priority of the project and I hope that now that I am back, the process will speed up.

To end on an up note, I was searching Google for references to the DTK and found a video of myself on the CompUSA web site. Yes, I really need to fix my hair next time!

Ylian

Times have changed it seems and many users of Intel AMT don’t see local users and applications as being always hostile. There are many reasons why it would be very interesting to access all of the features of Intel AMT locally. For example

• If the user changes the name of the computer is the OS, it would be nice to have a local agent sync up the Intel AMT network with the OS name automatically. This way, when the computer goes to sleep next, Intel AMT will report the correct new name.
• Circuit breaker policies could be used as a local firewall implemented in hardware. Set it once and the gigabit network chip does all the filtering and counters at gigabit speeds.
• On a mobile platform, wireless profiles could also be synched up automatically. The user adds a new wireless profile with a WPA key and this profile is automatically added to Intel AMT.
• Enterprise provisioning of Intel AMT could be done entirely locally using local software removing the need for complicated centralized servers.

Instead of seeing the local user as hostile, the local application now cooperate to setup Intel AMT so that if something goes wrong, it’s ready to be used to recover the computer. All this and more would be possible if Intel AMT allows the local applications full access to all the remote interface features.

A local application can’t simply connect to TCP port 16992 or 16993 and access all of the Intel AMT features since the traffic has to flow thru the gigabit network interface. Connecting to 127.0.0.1 will not work, that will access the more limited local interface.

The solution is to use a reflection application like Intel AMT Reflector found in the Intel AMT DTK. This tool runs on a central always on server and simply reflects back all TCP connections back to the source on ports 16992 to 16995. Using this tool an Intel AMT console or even a web browser can connect to “http://reflector:16992” and log into its own Intel AMT remote services. However, there are issues with this solution: You need this reflector tool running and know where on the network it is running. Also, a rogue application could log into the remote interface and put an annoying circuit breaker policy to drop all packets, etc.

In the future, Intel AMT itself could be modified to allow all services on the local interface removing the need for the reflector. There are security considerations of course, but feedback from users of Intel AMT on this idea would be appreciated.

Ylian

In addition to the meetings, we had a great time visiting the old city of Jerusalem, the Dead Sea and later on my own the city of Elat and Petra in Jordan. I got some of the most wonderful pictures and uploaded some on Google servers here:

http://picasaweb.google.com/ysainthilaire/Israel200802

These pictures cover the 10 days of my trip, starting with the old city then me playing in the mud and floating in the Dead Sea and finishing with my visit to Jordan. Jordan was probably this highlight of this trip, there is something just odd about traveling in this vast desert and realizing that I was in the country that had a common border with Iraq. For most of us in the US, it seems so distant. The city of Petra in Jordon has unique sand stone carvings in the walls. Some people will also notice that the Indiana Jones movie was filmed at this location. Petra was named one of the new 7 wonders of the world and as a result got a surge in tourism. It’s a wonderful place, hot and laid back.

Most people travel by air from Jerusalem to Elat and Jordan, but I opted to take the bus. It’s a 4 and a half hour trip thru amazing scenery. It’s also inexpensive, about 12 to 15$ and much more convenient than by airplane. I will say that except for the bus, everything was very expensive in US dollars. It’s a shame the dollar is so weak, I don’t except to make many of these trips.

Last week was the holocaust memorial day in Israel and I happened to visit the Wailing Wall with some of my Intel co-workers just as 1000’s of people where attending a ceremony that was being broadcast live on TV. One of my pictures shows all the people at the wall.

The Dead Sea was really amazing, it’s so saturated with salt that you simply float. This sea is the lowest point on Earth I am told, it’s 1,378 feet below sea level. Your ears pop on the way there as the air pressure increases. As pressure increases so does the temperature which will often be 10 degrees hotter than Jerusalem. The Dead Sea is well known for the Dead Sea salts used as skin treatment. It also gave me a great excuse to play in the mud! You let it dry and wash it off to wonderful skin… but it’s also just loads of fun.

To sum it up, this 10 day trip was simply amazing. In addition to meeting many people who use the DTK, I also got to see and experience some unique places I will never forget.

Ylian

I started out with an Intel DQ35JO motherboard, a Intel Core 2 QUAD processor, 4 hard disks, 3 gigs of RAM, 2 DVD recorders, an NVidia 6600 fan less video card, Hauppauge dual NTSC tuner and an HDHomerun dual ATSC tuner. All together, it's a great machine.

Probably the two biggest performance highlights of the system is the processor and the 4 hard disks in RAID5 configuration. I never had a RAID before and I am quite impressed. RAID comes built into the motherboard, just plug the hard disks and about 5 minutes of setup will get you going. Microsoft Vista RC1 includes the Intel RAID drivers in the setup disk so, starting with RC1 it's really easy.

One of the problems I ran into was the computer going into S3 state and hanging on a black screen when waking up. Many people face the same problem all over the Internet, in my case, the very latest Intel BIOS update did the trick. I will have to thank the guys releasing the Intel BIOS next time I see them, some of them at here in Oregon.

The weakest part of my computer is certainly the video card. I get top scores in Microsoft Vista's scoring for everything except the video card. Also, getting an HDCP compliant video card and BlueRay would also be cool at some point.

What makes this computer special for me of course is AMT 3.0... actually AMT 3.2 to be precise. This new update to Intel AMT offers improved WSMAN support but I have not tested it yet with the DTK and so, expect to start working on it now.

Of course, you can see me talk about my computer on this YouTube video.

Ylian

YouTube Video, 3:39m

If you guys have your own computer project that runs Intel AMT, please let me know. Better yet, if you have pictures it would be great to share with the community.

Ylian

Probably the area where the DTK is improving most is with general stability and WSMAN. When using Intel AMT 3.0, Intel AMT Commander and Intel AMT Outpost will use WSMAN instead of SOAP. Since all the calls are different, many new bugs showed up. As we get the benefit of more testing and feedback, the code keeps improving. Users can force Commander to use SOAP by going to the "View" - "Advanced properties". The second tab has a check box to remove using WSMAN first. WSMAN will of course still be used if Commander determines that WSMAN is the only available option.

Next week I am once again heading to Israel to meet with this Intel AMT firmware development team. Last year I had a pretty shaky flight over, something I had blogged about. Hopefully this year will be better. At Intel, this is going to be the ultimate meeting of everyone related to AMT, so I will get to meet some of the other people that post on the forums, and many of the people that I get the most complicated answers from.

Ylian

Many people have mailed me to ask when was going on and offer encouragements. First, I am not looking for a new job! (but thanks for the offers). The Intel AMT DTK makes use of a lot of different features from the latest Intel AMT platforms and so, internally to Intel there are many things to work out. This is all part of life in a large corporation. My only regret is that these internal issues have spilled over into disrupting the public distribution of the DTK. Again, my appologies. I am working hard to return everything back to normal.

Ylian

• Build-in C# WSMAN stack. As Intel AMT is transitioning to WSMAN calls for remote managibility, adding WSMAN support into the DTK has been increasly important. In the past, the DTK made use of WinRM, a Microsoft component that needed to be installed and configured. With version 0.51 of the DTK, I build my own WSMAN stack in C# right into the DTK stack. As a result, no more dependency on WinRM at all and no more compile problems. Additionaly, the DTK is now much faster at making WSMAN calls since all HTTP requests are now pipelined, and the DTK can connect to AMT computers that have invalid TLS certificates (a warning will be displayed of course). This is big news for anyone interested in WSMAN work. If you build your own managibility solution, I suggest you look at grabbing at least that part of the DTK source code.
• Intel AMT Flash Tool. This version of the DTK adds a new Intel AMT Flash Tool. It will help users correctly setup a USB flash key so that it can be use to provision Intel AMT computers. As many of you many know, Intel AMT will in the right conditions, read a setup.bin file in a USB flash key when booted and use the information to help setup Intel AMT. The setup.bin file must be at the very start of the USB key and this new tool with help with that. The new tool is based on a similar tool that has already been released on the Intel Pro Center.
• Intel AMT Reflector tool. Another new tool is a TCP connection reflector. It's a small generic tool that accepts connections and forwards the data back to the source IP address on a target port. It's useful for accessing Intel AMT from your own computer using a reflector on a different computer. I use it for recording some of my demonstration videos, but it can also be used by agents running localy that want to re-configure Intel AMT on itself. For example, detecting an OS name change and updating Intel AMT.

Many more changes and fixes have also been done, for example the terminal now correctly detects Serial-over-LAN disconnection, etc. For a full list, the DTK includes a change log.

Intel AMT DTK v0.51x Audio Blog (.mp3)

Ylian

TCP-over-Serial-over-LAN. The Intel AMT serial port I am told, was originally designed as an easy way to remotely take control of the BIOS and recovery OS remotely. Designers needed a way for BIOS to be able to send test display data to a remote console. A virtual serial port was a great solution. It so happens that in the original design, this serial port was always enabled and usable, even when the normal OS was running. This allows a serial agent to talk to a console while bypassing the OS’s network stack. This is interesting on its own and I started work on a serial agent of my own. Things took a weird twist when I started sending binary data and sending files over this serial port, making it very valuable. It’s only a few weeks later that I realized I could also send TCP traffic over this serial link, making it possible to contact TCP services on the Intel AMT computer even if the network stack was disabled. A few days later, I showcased the first demonstration of VNC-over-SOL, and turning this abuse of the serial port into an instant hit. To this day, VNC-over-SOL is still, one of the most impressive demonstrations of Intel AMT.

Reverse Watchdog. When Intel sales people demonstrate Intel AMT to customers, they often get asked if you can shutdown gracefully an Intel AMT computer using Intel AMT. The simple answer was no, Intel AMT will perform a brutal shutdown or reset upon request. To perform operations like a clean shutdown or reset, sleep or hibernation requires the involvement of the OS. You could tell a serial agent like Intel AMT Outpost to perform the shutdown, but that required opening the serial connection and could be a problem if you had to shutdown many computers. I needed a way to pass a small amount of information to a running Intel AMT agent on the PC, do it using SOAP/WSMAN only and if possible get confirmation of reception. We could store the command into 3PDS and have the agent read it periodically, but 3PDS required setup and that little amount of data would have required allocation of a 4K flash page. The solution came when looking at the agent presence feature. When a console creates a new agent, the agent can now register this agent locally. The agent also get the timeout of the agent in seconds (from 1 to 65535), this would be the key. By constantly trying to register a known GUID, Intel AMT Outpost could see if the agent existed or not. If suddenly the registration works, the timeout value would indicate that type of shutdown operation to perform. Better yet, the simple fact that registration occurred changes the state of the agent to “Running”, confirming to the console that the message was indeed received. Today the Intel AMT Terminal has “Agent Commands” in the remote control that allows a user to perform soft operations when the agent is running, even if the OS network stack is not working.

Mouse over serial. A few months back I started work on a smaller version of Intel AMT Outpost called Intel AMT Guardpost. The idea was that if a serial agent was going to be useful, it was going to need to run on a recovery OS, run in the background with no dependencies and with as little footprint as possible (Is it not annoying to have all there background processes running?). The C/C++ version of Intel AMT Outpost was on its way. One feature I always wanted to work on was a remote Windows command prompt; it took over a week to finally pull this off. I could now remotely shell to DOS and perform basic command line operations. I could also enter the command like editor with the “Edit” command at which point, the temptation to support the mouse-over-serial-over-LAN was a must have. Using the binary serial protocol, I added the support to the terminal in a few hours. To this day, it’s still a fun and amazing demonstration of outstanding remote manageability.

IDE-R within the OS. A few days after first enabling IDE-R within Intel AMT Commander, I stumbled upon something I had not noticed before. If an administrator where to start IDE redirection and the OS was to re-scan its plug & play devices, the additional floppy and CDROM drive would show up in Microsoft Windows. This was immediately interesting since transferring files over the serial port was limited to 115kb/sec a very slow speed in today’s world. With IDE-R, you can copy files at around CDROM 4x speed on a local network. All I needed was a way for Intel AMT Outpost to cause the OS to rescan its plug & play devices. A few hours later the “HWRESCAN” command was built and for the first time, an administrator could mount a CDROM remotely and install a patch as high speed without ever using the OS’s network stack. This feature also turned out to be an excellent compliment to VNC-over-SOL.

Fast data path using IDE-R. This is not an idea I never built into the DTK, but I wanted to add it to this list since it would also be an interesting was to use existing features in new ways. The serial-over-LAN feature turned out to be extremely valuable, but it is also slow. Serial ports are very inefficient. One way someone could speed things up is to use IDE-R as a fast by-pass to the OS. An administrator would mount a virtual floppy disk drive containing a single file. This file, would not really exist, it would contain different data each time it was read, making it possible to send data to an OS agent thru Intel AMT at much higher speeds. Also, since the floppy is a read/write device, the agent could write into the virtual file data that it wants to send to the console. It would be quite a bit of work to pull this off, but it certainly seems possible. Someone would just have to know the internal format of an .img file.

That’s my top 5. I realize this is probably a rather advanced blog article, but this is proof that you can have a lot of fun to any technologies.

Ylian (Intel AMT Blog)