4 ms·

Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. Most platforms don't have a way to change BIOS or firmware settings, and if they do, i

by Tiksi 10y ago

Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways.

zrm 10y ago
> Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. That's the point. If all you need is the ability to power on the machine, why are you exposing any more than that to the network? > Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways. And the party in control of that is Intel, so they could provide that API instead of IME.
- Tiksi 10y ago
  Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Automatic hardware provisioning fully depends on BMCs. Intel is the party in control, and Dell, and Supermicro, and HP, and.... IPMI is the API you're looking for, you can always just shut off the networking. But again, it's still done through the BMC. SOMETHING has to do it, and that something needs access independent of the OS and the rest of the system due to the nature of the settings you can change. Also how is IME any different than providing an API? The api has to actually do something, how exactly do you propose to do that without something like IME?
  - zrm 10y ago
    > Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Turning on a powered-off machine is the only thing that couldn't be done by a hypervisor. Once the machine is turned on, a hypervisor should be able to do anything IME does by doing it the same way IME does it, as long as the hardware is sufficiently documented. The part of IME that is unnecessary is the software, because it's software in lieu of transparency and documentation. A separate management processor that you could install your own software on would not be a problem, and then you could even turn on the machine.
    - Tiksi 10y ago
      A hypervisor isn't going to be able to interact with Option ROMs, change C states, change the CPU's vt-x/vt-d parameters, configure the HBA, change device addressing, configure port signaling speed, etc. That could all be implemented, but it would require another hardware controller or some sort of api that has lower level hardware access than the OS does, and something to actually provide that access and communicate with the various components, at which point you just invented IME/BMCs. Edit: >The part of IME that is unnecessary is the software, because it's software in lieu of transparency and documentation. A separate management processor that you could install your own software on would not be a problem, and then you could even turn on the machine. I suppose I can agree with that, and that's basically what most BMCs are, though installing your own software is hit or miss. (I've read about someone that got a stripped down linux kernel+userspace running directly on a SM BMC once) , Intel just moved it into the cpu. IME just seems like a strange hill to die on when it's probably more secure than 90% of the remote management setups in use today, yet everyone seems perfectly ok with those.
      - zrm 10y ago
        > That could all be implemented, but it would require another hardware controller or some sort of api that has lower level hardware access than the OS does, and something to actually provide that access and communicate with the various components, at which point you just invented IME/BMCs. What you've really invented is hardware drivers, which have been at home in the OS forever. > IME just seems like a strange hill to die on when it's probably more secure than 90% of the remote management setups in use today. The problem is they put it everywhere instead of only where people asked for it. You can get away with more on something which is opt in because the people who don't like it can get the one without it. So now it doesn't have to be as secure as the other remote management setups, it has to be as secure as not having remote management.
        Tiksi 10y ago
        >What you've really invented is hardware drivers, which have been at home in the OS forever. Those drivers need to actually communicate with something though, that something is exactly what BMCs are. If the hardware physically providing communication with those systems isn't there, no amount of drivers will help. Additionally, many of those things have to be configured before the OS is loaded and the hardware they control is fully initialized. Not possible inside the OS. >The problem is they put it everywhere instead of only where people asked for it. You can get away with more on something which is opt in because the people who don't like it can get the one without it. So now it doesn't have to be as secure as the other remote management setups, it has to be as secure as not having remote management. Yeah, I guess that's an aspect I didn't think of. I can see why people wouldn't be happy running remote management on their consumer hardware, I guess my view is biased by the fact that on systems I frequently work with, having a BMC is a given. My only experience with IME in consumer-level hardware was a neutered version of it where remote access wasn't an option, just some local hardware monitoring/management that seemed mostly useless, but I guess that must've changed.

by Tiksi 10y ago

Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways.

zrm 10y ago

> Comparing Wake on LAN to a BMC is like comparing a text editor to an IDE. That's the point. If all you need is the ability to power on the machine, why are you exposing any more than that to the network? > Most platforms don't have a way to change BIOS or firmware settings, and if they do, it's via the BMC anyways. And the party in control of that is Intel, so they could provide that API instead of IME.

Tiksi 10y ago
Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Automatic hardware provisioning fully depends on BMCs. Intel is the party in control, and Dell, and Supermicro, and HP, and.... IPMI is the API you're looking for, you can always just shut off the networking. But again, it's still done through the BMC. SOMETHING has to do it, and that something needs access independent of the OS and the rest of the system due to the nature of the settings you can change. Also how is IME any different than providing an API? The api has to actually do something, how exactly do you propose to do that without something like IME?
- zrm 10y ago
  > Yes, but BMCs do more than just power machines on and off, and are used for more than powering machines on and off. Turning on a powered-off machine is the only thing that couldn't be done by a hypervisor. Once the machine is turned on, a hypervisor should be able to do anything IME does by doing it the same way IME does it, as long as the hardware is sufficiently documented. The part of IME that is unnecessary is the software, because it's software in lieu of transparency and documentation. A separate management processor that you could install your own software on would not be a problem, and then you could even turn on the machine.
  - Tiksi 10y ago
    A hypervisor isn't going to be able to interact with Option ROMs, change C states, change the CPU's vt-x/vt-d parameters, configure the HBA, change device addressing, configure port signaling speed, etc. That could all be implemented, but it would require another hardware controller or some sort of api that has lower level hardware access than the OS does, and something to actually provide that access and communicate with the various components, at which point you just invented IME/BMCs. Edit: >The part of IME that is unnecessary is the software, because it's software in lieu of transparency and documentation. A separate management processor that you could install your own software on would not be a problem, and then you could even turn on the machine. I suppose I can agree with that, and that's basically what most BMCs are, though installing your own software is hit or miss. (I've read about someone that got a stripped down linux kernel+userspace running directly on a SM BMC once) , Intel just moved it into the cpu. IME just seems like a strange hill to die on when it's probably more secure than 90% of the remote management setups in use today, yet everyone seems perfectly ok with those.
    - zrm 10y ago
      > That could all be implemented, but it would require another hardware controller or some sort of api that has lower level hardware access than the OS does, and something to actually provide that access and communicate with the various components, at which point you just invented IME/BMCs. What you've really invented is hardware drivers, which have been at home in the OS forever. > IME just seems like a strange hill to die on when it's probably more secure than 90% of the remote management setups in use today. The problem is they put it everywhere instead of only where people asked for it. You can get away with more on something which is opt in because the people who don't like it can get the one without it. So now it doesn't have to be as secure as the other remote management setups, it has to be as secure as not having remote management.
      - Tiksi 10y ago
        >What you've really invented is hardware drivers, which have been at home in the OS forever. Those drivers need to actually communicate with something though, that something is exactly what BMCs are. If the hardware physically providing communication with those systems isn't there, no amount of drivers will help. Additionally, many of those things have to be configured before the OS is loaded and the hardware they control is fully initialized. Not possible inside the OS. >The problem is they put it everywhere instead of only where people asked for it. You can get away with more on something which is opt in because the people who don't like it can get the one without it. So now it doesn't have to be as secure as the other remote management setups, it has to be as secure as not having remote management. Yeah, I guess that's an aspect I didn't think of. I can see why people wouldn't be happy running remote management on their consumer hardware, I guess my view is biased by the fact that on systems I frequently work with, having a BMC is a given. My only experience with IME in consumer-level hardware was a neutered version of it where remote access wasn't an option, just some local hardware monitoring/management that seemed mostly useless, but I guess that must've changed.