{"id":51,"date":"2013-08-11T17:18:34","date_gmt":"2013-08-11T17:18:34","guid":{"rendered":"http:\/\/blog.ignoranthack.me\/?p=51"},"modified":"2014-04-21T14:07:21","modified_gmt":"2014-04-21T14:07:21","slug":"allmost-there-intel-amt-on-my-thinkpad-t520","status":"publish","type":"post","link":"http:\/\/blog.ignoranthack.me\/?p=51","title":{"rendered":"AllMost There — Intel AMT on my ThinkPad T520"},"content":{"rendered":"

Spent some time this week screwing around with the “serial” port on my laptop.\u00a0 Serial consoles are one of those things that you seem to always need when doing o\/s development.\u00a0 Its the only reliable way to get debugging information and on PC architectures, its really the best way to find and resolve serious problems in the kernel or drivers.<\/p>\n

Laptops dropped their DB-9, RS-232 connection years ago and up until recently, you couldn’t really do much with debugging except take pictures of your laptop’s console when it had crashed.\u00a0 I discovered that my laptop has AMT features built into it and decided to see if I could make FreeBSD use it as a serial console for debugging and diagnostics.\u00a0 Turns out, its mostly functional and seems to do what I want.<\/p>\n

Turning AMT on is a bit goofy, mainly do to some fairly strict password requirements, but lets start from the beginning.\u00a0 I’m using my Lenovo T520 as an example, so your BIOS will vary based on your laptop vendor.<\/p>\n

Hit your “enter the bios key command” which on my ThinkPad is the blue “ThinkVantage” button, but for the rest of the universe is probably F10, DEL or some other normal key.\u00a0 This should bring up your bios selection menu and now enter your bios configuration menus.<\/p>\n

Turn AMT on in BIOS<\/p>\n

\"AMT_BIOS2\"<\/a> I left the values, more or less, at the defaults here.<\/p>\n

\"AMT_BIOS1\"<\/a>Save, reboot.\u00a0 Now when you hit your bios configuration button:<\/p>\n

\"AMT_Boot\"<\/a><\/p>\n

Hit <ctrl-P> now to enter the AMT configuration screens.\u00a0 \"AMT_Boot2\"<\/a><\/p>\n

The first time you do this, there will only be one option, so hit “1” to enter the AMT configuration screens.\u00a0 We’ll come back to this menu list later.<\/p>\n

\"AMT_Main\"<\/a>If this is your first time entering this machine’s AMT device, its going to force you to reset the password from “admin” to something else.\u00a0 The password requirements on the AMT device are pretty strict, but this<\/a> should explain it for you.<\/p>\n

You’ll need to adjust one or two settings and activate the AMT configuration’s IPv4 settings.<\/p>\n

\"AMT_Timeout\"<\/a>Select SOL\/IDRR\/KVM.\u00a0 We’re going to activate Legacy Serial Redirection here<\/p>\n

\"AMT_Conf0\"<\/a>Select SOL<\/p>\n

\"AMT_Conf1\"<\/a>Obviously, Enable is what we want here.<\/p>\n

\"AMT_Conf2\"<\/a>Select Legacy Redirection Mode, then select Enable<\/p>\n

\"AMT_Conf8\"<\/a><\/p>\n

Back to Main Menu and Select Network Setup<\/p>\n

\"AMT_Conf3\"<\/a>TCP\/IP Settings and Setup Wired Lan IPv4 Configuration<\/p>\n

\"AMT_Conf4\"<\/a>I’m going to set DHCP mode for this test.\u00a0 You can set static IP if you wish.<\/p>\n

\"AMT_Conf5\"<\/a>Yet another Enable here.<\/p>\n

\"AMT_Conf6\"<\/a>At this point, you’re ready to save\/exit\/reboot.\u00a0 To test that the DHCP settings are working, toggle your BIOS button again (F10\/DEL\/ThinkVantage) and hit <ctrl-P> to get the AMT menu again.<\/p>\n

\"AMT_DHCP\"<\/a>Hit “2” to check that the AMT can indeed get an IP address.\u00a0 Note that this address is the same as your laptop IP, at least it should be.\u00a0 There is some magic going on here that allows the AMT device to share the MAC address and the IP address of your host.\u00a0 Its interesting but also causes odd things to happen that we’ll dig into a little bit later in the post.<\/p>\n

Now that you’ve gotten an IP address, you can boot normally into FreeBSD.\u00a0 We now need to modify FreeBSD to boot up onto a non-standard (COM1,2,3,4) and get the serial console working.\u00a0 This is pretty standard stuff, \/etc\/ttys, \/boot\/loader.conf, \/etc\/make.conf things.<\/p>\n

Determine what the pci bus address of the UART is in your system via:
\npciconf -l | grep uart<\/strong>
\nuart0@pci0:0:22:3: class=0x070002 card=0x21cf17aa chip=0x1c3d8086 rev=0x04 hdr=0x00
\n<\/strong>or
\ndmesg | grep uart
\nuart0: <Intel AMT – KT Controller> port 0x6070-0x6077 mem 0xf522c000-0xf522cfff irq 19 at device 22.3 on pci0
\nuart0: console (115200,n,8,1)
\nuart0: fast interrupt
\n<\/strong><\/p>\n

make.conf:
\nBOOT_COMCONSOLE_SPEED=115200<\/strong><\/p>\n

loader.conf:
\nconsole=”comconsole”<\/strong>
\n comconsole_speed=”115200″<\/strong>
\n comconsole_pcidev=”0:22:3″ #Determine this value from the pciconf -l <\/strong><\/p>\n

device.hints:
\nIf you have a device.hints file, comment out the hints for hw.uart settings.\u00a0 Leave only the setting for the flags:
\n#hint.uart.0.at=”isa”<\/strong>
\n #hint.uart.0.port=”0x3F8″<\/strong>
\n hint.uart.0.flags=”0x10″<\/strong>
\n #hint.uart.0.irq=”4″<\/strong>
\n #hint.uart.1.at=”isa”<\/strong>
\n #hint.uart.1.port=”0x2F8″<\/strong>
\n #hint.uart.1.irq=”3″ <\/strong><\/p>\n

boot.config:
\nadd the -Dh<\/strong> for dual console support<\/p>\n

\/etc\/ttys:
\nEnable ttyu0
\nttyu0 “\/usr\/libexec\/getty std.115200” vt100 on secure<\/strong><\/p>\n

Issue a kill -HUP 1 <\/strong>to let init fire up your getty instance.\u00a0 If all is well, you can now go to the computer you want to use to as a console device for this laptop.\u00a0 Using FreeBSD ports, install comms\/amtterm. <\/strong>In order to connect to your laptop and validate that its working correctly, issue the following command:
\namtterm -p <password you set in the AMT> <IP address of laptop><\/strong><\/p>\n

If you get a tty login, you’ve suceeded!amtterm: NONE -> CONNECT (connection to host)<\/strong>
\nipv4 192.168.1.209 [192.168.1.209] 16994 open<\/strong>
\namtterm: CONNECT -> INIT (redirection initialization)<\/strong>
\namtterm: INIT -> AUTH (session authentication)<\/strong>
\namtterm: AUTH -> INIT_SOL (serial-over-lan initialization)<\/strong>
\namtterm: INIT_SOL -> RUN_SOL (serial-over-lan active)<\/strong>
\nserial-over-lan redirection ok<\/strong>
\nconnected now, use ^] to escape<\/strong><\/p>\n

FreeBSD\/amd64 (powernoodle) (ttyu0)<\/strong><\/p>\n

login: <\/strong><\/p>\n

 <\/p>\n

The last steps are fairly trivial.\u00a0 You need to rebuild your kernel to pickup the changes to \/etc\/make.conf.\u00a0 If you do an installkernel and reboot, you’ll now be able to capture the boot up sequence (no boot0 support) once loader starts.\u00a0 You’ll get to see the beastie menu in all its glory.<\/p>\n

The machine I’m using uses a Intel Ethernet chipset via the em(4) driver, this has some very strange behavior that I will take a look at over the next couple of weeks.<\/p>\n

With AMT enabled, the ethernet connection only negotiates to 100Mbit.\u00a0 This is very amusing to me as it acts a lot like IPMI in this regard.\u00a0 When em(4) initializes it *will* drop your amtterm connection.\u00a0 Irritating, but em(4) hasn’t been taught enough logic to deal with the connection to the AMT device.<\/p>\n

Rebooting the laptop will disconnect your AMT session.\u00a0 AMT is not a server grade thing like IPMI, so there’s no garauntee of reliability at all.\u00a0 AMT is sniffing packets that are addressed to the laptop and snipping them out of the air.\u00a0 Its a very delicate hardware hack but it does to the trick.<\/p>\n

Since AMT presents itself as a non-standard COM port, I’m pretty sure that the boot0 and boot2 loaders can’t use AMT as a serial console.\u00a0 This means that things like gptzfsboot might have issues that you cannot debug.\u00a0 As far as I can tell however, this is the one of the most likely to work mechanisms for administration of your laptop and development for things like suspend\/resume support.<\/p>\n","protected":false},"excerpt":{"rendered":"

Spent some time this week screwing around with the “serial” port on my laptop.\u00a0 Serial consoles are one of those things that you seem to always need when doing o\/s development.\u00a0 Its the only reliable way to get debugging information and on PC architectures, its really the best way to find and resolve serious problems […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"_share_on_mastodon":"0"},"categories":[2],"tags":[],"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=\/wp\/v2\/posts\/51"}],"collection":[{"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=51"}],"version-history":[{"count":17,"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=\/wp\/v2\/posts\/51\/revisions"}],"predecessor-version":[{"id":91,"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=\/wp\/v2\/posts\/51\/revisions\/91"}],"wp:attachment":[{"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.ignoranthack.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}