5 ms·

Are chips with this feature sold in consumer devices? I'm planning to buy a new computer soon. How can I avoid or boycott the chips in question? Or can the feat

by Pyxl101 12y ago

Are chips with this feature sold in consumer devices? I'm planning to buy a new computer soon. How can I avoid or boycott the chips in question? Or can the feature be definitively disabled through the BIOS? If I buy a computer, then I want to own it completely and not have arbitrary DRM bullshit remove capabilities. If I wish to take a screenshot of copyright content and share it with friends (fair use), then I should be able to do that, and I will be seriously pissed if my own machine gets in the way. Does anyone know which chips include this feature, and/or whether it can be disabled?

pm24601 12y ago
thats the point. It helps Hollywood, at your expense. You as the purchaser of the computer are not "entitled" to being able to use the computer exactly as you want.
redstripe 12y ago
I believe this is part of "vPro" in intel marketing speak. Yes, many consumer CPUs have it. Intel provides pretty good feature lists by CPU if you want to avoid it: e.g. http://ark.intel.com/search/advanced?s=t&FamilyText=4th%20Generation%20Intel%C2%AE%20Core%E2%84%A2%20i5%20Processors&VProTechnology=true http://ark.intel.com/search/advanced?s=t&FamilyText=4th%20Ge...
- rasz_pl 12y ago
  Chipsets, not CPUs, but that is a moot distinction as Intel stopped licensing their ISA, so you have no choice but to use intel chipset with spyware buildin
pgeorgi 12y ago
All Intel chips since 2010 or so have the management engine. There's a reason why the "reclaim your freedom" notebook is still a Lenovo X60. Some of them come with larger firmware (5MB, making up vPro and AMT), others with the smaller one (1.5MB) that merely does the DRM stuff, but all of them have the full hardware access detailled in the article. AMD is clean on the chipset side until kaveri/kabini. After that, they come with a "platform security processor". I think the GPU has some DRM features (mostly concerned with adding Macrovision noise to the output signal), but I'm not into GPUs very much. Contemporary ARM stuff mostly comes with TrustZone, which can typically be used for DRM as well. AMD adopted the TrustZone model for their current CPUs, too. Since Protected A/V Path and similar DRM systems require OS cooperation, the easiest way to stay clear of them is to use Open Source media players, on an Open Source OS. If you want to avoid supporting proponents of such hardware assisted DRM systems, plain ARM systems that ship without fixed operating system (eg. the cuBox series, rPI & follow ups) are your best bet.
- Audiophilip 12y ago
  @pgeorgi: >All Intel chips since 2010 or so have the management engine. Do you have sources for this? I wanted to verify it, but after a few Google searches I could not find anything that states exactly that. I have a Haswell CPU, but I have no Management Engine settings in my BIOS. How does the vPro feature correlate with the Management Engine? Because not all Intel CPU's come with vPro. Or is that only a firmware difference? Would be nice to see clearer in this issue, but most websites contain only marketing nonsense.
  - eeZi 12y ago
    It is part of the chipset and has other functions too (parts of the power management, for example).
  - pgeorgi 12y ago
    My source is that I work on coreboot, where we have to interact with that stuff all the time. It's actually somewhat hidden in our haswell driver because so much is now binary-only on Intel platforms. But look at http://review.coreboot.org/gitweb?p=coreboot.git;a=blob;f=src/northbridge/intel/haswell/finalize.c;hb=HEAD http://review.coreboot.org/gitweb?p=coreboot.git;a=blob;f=sr... whose comments refer to both "ME" (the management engine) and "PAVP", which is the "Protected A/V Path" referred to in the article. One sure way to figure it out is to get a full image of your firmware flash, and analyze it. coreboot has a tool called ifdtool which can parse the "intel firmware descriptor", which is kind of a partitioning scheme for flash - among other things, to make room for the ME firmware. Sometimes board vendors have full images available for download that you could use for analysis, but these days they're often smaller, shipping only the changed parts. flashrom (www.flashrom.org) might be able to read out the chip on your running system, but on Intel platforms in particular, this is often restricted and you'd need to attach some external flash programmer to read it out and be sure. I think it speaks volumes that you have to work around such things on your own hardware in the first place... As far as I know, vPro only requires the larger firmware and the use of on-chipset hardware, in particular NIC and GPU, since the vPro firmware doesn't support external devices. I don't know if that's just economics (no need to write drivers for tons of devices, no desire to support other vendors' hardware) or if the ME is too limited for that - but my guess is the former. One way we (at coreboot) can test ME involvement is to corrupt the ME firmware with an external flasher (while leaving everything else intact) and see the system either not start at all, or reliably shut down after 30 minutes. The exact behaviour depends on some wiring on the board, I guess.
hrrsn 12y ago
Yes. I have a 2012 MacBook Pro 15" Retina and as described in the article, the chip & driver are present in my machine. $ ioreg|grep AppleIntelMEI | | | | +-o AppleIntelMEIDriver <class AppleIntelMEIDriver, id 0x100000302, registered, matched, active, busy 0 (0 ms), retain 7>
- Corrado 12y ago
  My mid 2010 MacBook Pro 17" machine does not have the chip & driver (at least ioreg doesn't report anything). Just another data point.
Fuxy 12y ago
Intel Xeon processors don't seem to ship with this. Then again intel doesn't expect many people using a xenon on a workstation motherboard as their PC. I got lucky getting this.

by Pyxl101 12y ago

pm24601 12y ago

thats the point. It helps Hollywood, at your expense. You as the purchaser of the computer are not "entitled" to being able to use the computer exactly as you want.

redstripe 12y ago

I believe this is part of "vPro" in intel marketing speak. Yes, many consumer CPUs have it. Intel provides pretty good feature lists by CPU if you want to avoid it: e.g. http://ark.intel.com/search/advanced?s=t&FamilyText=4th%20Generation%20Intel%C2%AE%20Core%E2%84%A2%20i5%20Processors&VProTechnology=true http://ark.intel.com/search/advanced?s=t&FamilyText=4th%20Ge...

rasz_pl 12y ago
Chipsets, not CPUs, but that is a moot distinction as Intel stopped licensing their ISA, so you have no choice but to use intel chipset with spyware buildin

pgeorgi 12y ago

All Intel chips since 2010 or so have the management engine. There's a reason why the "reclaim your freedom" notebook is still a Lenovo X60. Some of them come with larger firmware (5MB, making up vPro and AMT), others with the smaller one (1.5MB) that merely does the DRM stuff, but all of them have the full hardware access detailled in the article. AMD is clean on the chipset side until kaveri/kabini. After that, they come with a "platform security processor". I think the GPU has some DRM features (mostly concerned with adding Macrovision noise to the output signal), but I'm not into GPUs very much. Contemporary ARM stuff mostly comes with TrustZone, which can typically be used for DRM as well. AMD adopted the TrustZone model for their current CPUs, too. Since Protected A/V Path and similar DRM systems require OS cooperation, the easiest way to stay clear of them is to use Open Source media players, on an Open Source OS. If you want to avoid supporting proponents of such hardware assisted DRM systems, plain ARM systems that ship without fixed operating system (eg. the cuBox series, rPI & follow ups) are your best bet.

Audiophilip 12y ago
@pgeorgi: >All Intel chips since 2010 or so have the management engine. Do you have sources for this? I wanted to verify it, but after a few Google searches I could not find anything that states exactly that. I have a Haswell CPU, but I have no Management Engine settings in my BIOS. How does the vPro feature correlate with the Management Engine? Because not all Intel CPU's come with vPro. Or is that only a firmware difference? Would be nice to see clearer in this issue, but most websites contain only marketing nonsense.
- eeZi 12y ago
  It is part of the chipset and has other functions too (parts of the power management, for example).
- pgeorgi 12y ago
  My source is that I work on coreboot, where we have to interact with that stuff all the time. It's actually somewhat hidden in our haswell driver because so much is now binary-only on Intel platforms. But look at http://review.coreboot.org/gitweb?p=coreboot.git;a=blob;f=src/northbridge/intel/haswell/finalize.c;hb=HEAD http://review.coreboot.org/gitweb?p=coreboot.git;a=blob;f=sr... whose comments refer to both "ME" (the management engine) and "PAVP", which is the "Protected A/V Path" referred to in the article. One sure way to figure it out is to get a full image of your firmware flash, and analyze it. coreboot has a tool called ifdtool which can parse the "intel firmware descriptor", which is kind of a partitioning scheme for flash - among other things, to make room for the ME firmware. Sometimes board vendors have full images available for download that you could use for analysis, but these days they're often smaller, shipping only the changed parts. flashrom (www.flashrom.org) might be able to read out the chip on your running system, but on Intel platforms in particular, this is often restricted and you'd need to attach some external flash programmer to read it out and be sure. I think it speaks volumes that you have to work around such things on your own hardware in the first place... As far as I know, vPro only requires the larger firmware and the use of on-chipset hardware, in particular NIC and GPU, since the vPro firmware doesn't support external devices. I don't know if that's just economics (no need to write drivers for tons of devices, no desire to support other vendors' hardware) or if the ME is too limited for that - but my guess is the former. One way we (at coreboot) can test ME involvement is to corrupt the ME firmware with an external flasher (while leaving everything else intact) and see the system either not start at all, or reliably shut down after 30 minutes. The exact behaviour depends on some wiring on the board, I guess.

hrrsn 12y ago

Yes. I have a 2012 MacBook Pro 15" Retina and as described in the article, the chip & driver are present in my machine. $ ioreg|grep AppleIntelMEI | | | | +-o AppleIntelMEIDriver <class AppleIntelMEIDriver, id 0x100000302, registered, matched, active, busy 0 (0 ms), retain 7>

Corrado 12y ago
My mid 2010 MacBook Pro 17" machine does not have the chip & driver (at least ioreg doesn't report anything). Just another data point.

Fuxy 12y ago

Intel Xeon processors don't seem to ship with this. Then again intel doesn't expect many people using a xenon on a workstation motherboard as their PC. I got lucky getting this.