Intel Active Management Technology

Intel AMT 개요와 OOB 관리

Intel ME Interface의 대표적인 용도는 Intel ME firmware에서 실행되는 Intel Active Management Technology, 즉 Intel AMT와 통신하는 것입니다.

Intel AMT는 host processor의 OS가 crash하거나 sleep 상태여도 out-of-band 방식으로 host를 원격 관리할 수 있게 합니다.

용도에는 hardware·platform component 상태 감시, 원격 전원 on·off, OS update, software asset 같은 platform 정보 저장, hardware KVM, 원격 정책에 따른 Ethernet·IP flow 격리, 원격 console의 IDE device redirection이 있습니다.

Intel AMT OOB 통신은 remote management console에서 받은 HTTP/S 위 SOAP 또는 HTTP/S 위 WS-Management를 사용합니다. SOAP 방식은 Release 6.0부터 deprecated되었습니다.

.. SPDX-License-Identifier: GPL-2.0

Intel(R) Active Management Technology (Intel AMT)
=================================================

Prominent usage of the Intel ME Interface is to communicate with Intel(R)
Active Management Technology (Intel AMT) implemented in firmware running on
the Intel ME.

Intel AMT provides the ability to manage a host remotely out-of-band (OOB)
even when the operating system running on the host processor has crashed or
is in a sleep state.

Some examples of Intel AMT usage are:
   - Monitoring hardware state and platform components
   - Remote power off/on (useful for green computing or overnight IT
     maintenance)
   - OS updates
   - Storage of useful platform information such as software assets
   - Built-in hardware KVM
   - Selective network isolation of Ethernet and IP protocol flows based
     on policies set by a remote management console
   - IDE device redirection from remote management console

Intel AMT (OOB) communication is based on SOAP (deprecated
starting with Release 6.0) over HTTP/S or WS-Management protocol over
HTTP/S that are received from a remote management console application.

For more information about Intel AMT:
https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm

Intel Local Management Service

Platform에서 실행되는 local application은 Intel AMT 2.0 이후 release와 network application과 같은 방식으로 통신합니다. Release 6.0부터 deprecated된 HTTP 위 SOAP 또는 HTTP 위 SOAP를 사용하는 WS-Management로 일부 AMT 기능에 접근할 수 있습니다.

Local application이 local Intel AMT host 이름으로 message를 보내면 그 이름의 traffic을 듣고 있는 Intel LMS가 message를 가로채 Intel MEI로 routing합니다.

Intel LMS는 Intel MEI driver를 사용해 정의된 GUID의 LMS firmware feature에 연결합니다.

이후 Intel AMT Port Forwarding Protocol, 즉 Intel APF protocol로 통신합니다. 하나의 application에서 Intel AMT와 여러 session을 유지하는 protocol입니다.

Intel AMT Applications
----------------------

    1) Intel Local Management Service (Intel LMS)

       Applications running locally on the platform communicate with Intel AMT Release
       2.0 and later releases in the same way that network applications do via SOAP
       over HTTP (deprecated starting with Release 6.0) or with WS-Management over
       SOAP over HTTP. This means that some Intel AMT features can be accessed from a
       local application using the same network interface as a remote application
       communicating with Intel AMT over the network.

       When a local application sends a message addressed to the local Intel AMT host
       name, the Intel LMS, which listens for traffic directed to the host name,
       intercepts the message and routes it to the Intel MEI.
       For more information:
       https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm
       Under "About Intel AMT" => "Local Access"

       For downloading Intel LMS:
       https://github.com/intel/lms

       The Intel LMS opens a connection using the Intel MEI driver to the Intel LMS
       firmware feature using a defined GUID and then communicates with the feature
       using a protocol called Intel AMT Port Forwarding Protocol (Intel APF protocol).
       The protocol is used to maintain multiple sessions with Intel AMT from a
       single application.

       See the protocol specification in the Intel AMT Software Development Kit (SDK)
       https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm
       Under "SDK Resources" => "Intel(R) vPro(TM) Gateway (MPS)"
       => "Information for Intel(R) vPro(TM) Gateway Developers"
       => "Description of the Intel AMT Port Forwarding (APF) Protocol"

Local Agent를 이용한 원격 구성

Local Agent는 setup에 필요한 추가 자료를 미리 설치하지 않고도 IT 관리자가 Intel AMT를 출고 상태에서 구성할 수 있게 합니다.

원격 구성 과정에는 host에서 실행되는 ISV 개발 remote configuration agent가 포함될 수 있습니다. 자세한 절차는 Intel AMT setup·configuration SDK의 Local Agent sample에 설명되어 있습니다.

2) Intel AMT Remote configuration using a Local Agent

   A Local Agent enables IT personnel to configure Intel AMT out-of-the-box
   without requiring installing additional data to enable setup. The remote
   configuration process may involve an ISV-developed remote configuration
   agent that runs on the host.
   For more information:
   https://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm
   Under "Setup and Configuration of Intel AMT" =>
   "SDK Tools Supporting Setup and Configuration" =>
   "Using the Local Agent Sample"

Intel AMT OS Health Watchdog

Intel AMT Watchdog은 OS hang·crash를 감시하는 OS Health watchdog입니다. Host에 심각한 장애가 있어도 OS가 멈추면 Intel AMT가 event subscriber에게 통지하므로 IT가 platform crash를 알 수 있습니다.

Watchdog은 heartbeat를 받고 중단 시 event를 보내는 firmware feature와, 그 feature에 연결해 watchdog을 구성하고 heartbeat를 보내는 Intel MEI iAMT watchdog driver로 구성됩니다.

Driver는 kernel watchdog API로 Intel AMT Watchdog을 구성하고 heartbeat를 전송합니다. 기본 timeout은 120초입니다.

Firmware에서 Intel AMT가 활성화되지 않으면 watchdog client가 ME client bus에 enumerate되지 않고 watchdog device도 노출되지 않습니다. 문의 주소는 `linux-mei@linux.intel.com`입니다.

Intel AMT OS Health Watchdog
----------------------------

The Intel AMT Watchdog is an OS Health (Hang/Crash) watchdog.
Whenever the OS hangs or crashes, Intel AMT will send an event
to any subscriber to this event. This mechanism means that
IT knows when a platform crashes even when there is a hard failure on the host.

The Intel AMT Watchdog is composed of two parts:
    1) Firmware feature - receives the heartbeats
       and sends an event when the heartbeats stop.
    2) Intel MEI iAMT watchdog driver - connects to the watchdog feature,
       configures the watchdog and sends the heartbeats.

The Intel iAMT watchdog MEI driver uses the kernel watchdog API to configure
the Intel AMT Watchdog and to send heartbeats to it. The default timeout of the
watchdog is 120 seconds.

If the Intel AMT is not enabled in the firmware then the watchdog client won't enumerate
on the me client bus and watchdog devices won't be exposed.

---
linux-mei@linux.intel.com