I sat down this morning to jot down a few words about the latest Yocto Project development milestone, which has the very homely name of "M2". We pause at this time to branch our code, run a full pass of our QA suite and make sure we are on track with major features. (This is all good by the way).

The developers working on the Yocto Project are a very interesting bunch - we have people who have worked in open source projects for their entire careers and others who come from the world of product development. It's fascinating to see these worlds intermix as we try to do the right thing to make Linux the  best choice for embedded development.

Now before you think I'm totally confused on this point, let me assure you, I am not. The Yocto Project is not a product. It is an open source project, which will form the upstream for products, ranging from devices to board support packages to operating systems from the like of Mentor Graphics and Wind River Systems. To be a stable basis for these products, we take seriously the need to track the health of our bits as we develop them.

You can track project health with all kinds of metrics and dashboards and charts. Often it comes down to the experience and intuition of the project leaders to figure things out.

In 2001, the Oakland Athletics baseball team was eliminated from the playoffs by the New York Yankees, a team with three times the money available for players. How could the Athletics (or A's as they are called) ever hope to beat a team with so much money to spend? The tale is told in Moneyball, nominated for the 2011 Best Picture Oscar.

Now, I will confess, I am not such a fan of baseball, and I have a hard time caring about such things. What drew me in was the way players are traditionally chosen in baseball. Professional scouts, who are quite experienced in baseball, will evaluate a player based on everything from their statistics to how pretty their girlfriend is.

How in the world could you evaluate a player on whether they had an attractive girlfriend? This was part of the intuition the scouts would use to indicate a player's confidence.

The A's general manager tries a different tactic. Could you apply economic theory and create a formula that would boil down all of the metrics for a player and create a single number to evaluate them? And can the movie's makers take such a dry topic and make it interesting, as Aaron Sorkin did with The Social Network, 2010's Best Picture.

Well, you can judge that last bit for yourself. I thought it was very good (and beautifully photographed as well).

How about the Yocto Project? Can we as leaders boil all those statistics down to a single number to tell us the health of the project? I'd like to think we do.

Meet the Weighted Defect Density:

This is just a snapshot I grabbed from the end of https://wiki.yoctoproject.org/wiki/Yocto_Bug_Trend - you can see all kinds of other statistics in there as well. But this is the one I look at first when I want to know how we're doing. TO compute it, we eliminate the bugs which are not defects (there are enhancements and features tracked in Bugzilla as well) and then weight the open bugs by their severity and track this number over time.

This single trend chart gives us a lot of insight into the project. It helps us to ask more questions about what is going on, to drill into other data and to potentially change course. Do we think we're going to hit our goals for the release? Do we need to stop development work and focus people on bug fixing for a while? Maybe we need to stop testing so much and work on fixing bugs. Or maybe the line is lower than we expect it to be and we should be doing more testing.

Using a Weighted Defect Density in a project is not a new idea[1]. I first heard about it and used it way back in the early 1990s. But it has proven to be a good indicator of Yocto Project health and helped us make informed decisions.

In Moneyball, the hero played by Brad Pitt says his ultimate goal is to change the way the game of baseball is played. He sounds like he could be on the Yocto Project. We're trying to change the way the world develops devices. Time will tell if we're right.

[1] Robert Baetke, an associate at Sequent Computer Systems learned about the Weighted Defect Density metric at a talk given about how Boeing developed the 787 aircraft. He brought the tool to Sequent and employed in there, and I am very grateful for his contribution to my way of thinking about development.

A few weeks back I went on eBay and got myself two Pogoplug devices. Very nice little media and file sharing devices, you plug storage in the USB ports and you get access to the data anywhere on the internet. The devices are not expensive at all and very functional. One of the things that interested me in the device is that you can enable SSH on them, login and install and run more software. Of course, the Meshcentral peer-to-peer agent would be a great target for such a device. You can leave your Pogoplug on all the time and then, use it as a low-power presence on the network to wake up other computers, monitor sleeping Intel AMT computers, etc. Best of all, you can use both Meshcentral along with the original Pogoplug software.

So, earlier today I downloaded the proper cross-compiler. I am really getting the hang of this, it took me about an hour to compile the mesh agent and get it running on the device! I also added the new mesh agent to the list of available agents on Meshcentral.com. Now, this is not for everyone just yet, you need to have a good idea what you are doing with Linux and the command prompt. I also did not research how to auto-start the mesh agent yet when the device boots up. Regardless, enable SSH on the Pogoplug web site in the settings and security menu, then I log in and remount the root file system and create a new folder with these commands:

mount -o rw,remount /
mkdir /usr/local/mesh
cd /usr/local/mesh

I am then ready to cut & paste the agent download and launch code from the Meshcentral.com account page (hit the Install link). After about a minute, the device will show up on Meshcentral.com and you can access file, get the command prompt, etc. Obviously, no remote desktop available.

That's it for now. Have fun with your new Pogoplug features!

Ylian
meshcentral.com

One of the problems I have been facing over the last few months was around the Mac OSX mesh agent. It just did not work right and so, over the last two weeks, I really made a big effort to improve it. Today, I released version 1.54 of the agent that seems to work much better. First, the remote desktop feature is back into the mesh agent. It's been out of over two months. So you get the same, entirely web based remote desktop that is already available on Linux and Windows. The mesh agent is also improved with all the latest features and bug fixes.

One of them problems the MacOSX agent still has it that it can't seem to resolve the DNS name of meshcentral.com correctly. So in this version and for MacOSX only, the IP address is hard coded into the mesh agent.  I will need to work to figure out that is causing this problem.

Anyway, Mac users, please try the latest agent and let me know what you think!

Ylian
meshcentral.com

1.  Create certificates for Intel AMT TLS encryption using the Intel AMT SDK and OpenSSL
2.  Using the  TLS.ps1 script,  configure non TLS configured Intel AMT systems to use  TLS communication

Before you get started with the following steps, you may need to make sure your system is configure to run the Intel vPro Module PowerShell Scripts - see the following blog for instructions:

• How to Configure your System to Run the IntelvPro PowerShell Module

STEP 1: Modify the configuration server to not delete the private key and public key:

Open the file: <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\ConfigScripts\provend.bat

Comment out or delete the two lines:

STEP 2:

If your AMT Client is not part of the Domain, you will need to do the following:

• Go to the <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig folder

• Edit the Uss.cfg file and look for the commonName_value.

Following =$ENV::PROVISIONING_HOSTNAME.$ENV Delete: “.$ENV::PROVISIONING_DOMAIN ”,

• Next look for [alt_names]

DNS.1 =$ENV::PROVISIONING_HOSTNAME.$ENV::PROVISIONING_DOMAIN,

Delete: “.$ENV::PROVISIONING_DOMAIN

STEP 3: If the Certificate details such as Organization Name, Country Name, etc. need to be modified to suit local needs, then the following files will have to updated:

• <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig\Auditor.cfg
• <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig\rootCA.cfg
• <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecConfig\subCA.cf

• countryName_default             = IL
• countryName_value                = US
• organizationName                     = Organization Name (eg, company)
• organizationName_value       = Your Company Name
• commonName                             = Common Name (eg, YOUR name)
• commonName_value                = Intel® Active Management Technology root CA demo

STEP 4:  Your certificate needs to reflect the correct Provisioning Hostname. Edit Certgen.bat.

To create the Certificate for a specific AMT Client, set the Provisioning Hostname to reflect the AMT Hostname for your AMT System.

<SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\certgen.bat

IF "%PROVISIONING_HOSTNAME%"=="" SET PROVISIONING_HOSTNAME= <no quotes, the host name given to AMT>

STEP 5: Create the certificates by running the following (in this order)

For all the questions, respond with “Y"; no command window is necessary, just double click

1. <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\checkca.bat
2. <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\certgen.bat

All three certificates will be created.

STEP 6: Copy the hash from the following files for the Root CA, AMT Private Key and the AMT Certificate into the appropriate sections in the TLS.ps1 script (Create a file on your computer by cutting and pasting from this blog.)

Bring up PowerShell ISE as Administrator  and open the TLS.ps1 script.

• The hashes are in the following files:
  • Trusted Root CA - cacert.cer
  • AMT Private Key - newkey.pem
  • AMT Certificate - newcert.pem

Trusted root CA:

• <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\rootCA\cacert.cer

AMT Private Key:

• <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\newkey.pem

AMT Certificate:

• <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\newcert.pem

Look for the following sections in the TLS.ps1 script and copy the blobs from the above files into the blob sections of the TLS.ps1 file as follows:

cacert.cer:

newkey.pem

newcert.pem:

STEP 7:

Run the TLS.ps1 script, it should install the RootCA and the AMT Private key, AMT Certificate on the AMT Client.

Make sure to update the Adress - this is the ip address of the AMT Client.  Also ensure you can connect to the Webui - if there is something wrong with the network connection, the TLS.ps1 script will not run.

If the TLS.ps1 file executes without error, your AMT client will now be operating using TLS communication.

You should now be able to connect to the WebUI using https and port 16993:

STEP 8: When connecting via TLS, you will now get a certificate warning

In order for the WebUI to open (without the certificate warning), make sure the following certificates are installed in the respective machine from which the WebUI is being accessed:

• RootCA:
  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\rootCA\cacert.cer
• and SubCA:
  • <SDK_Root>\Windows\Intel_Manageability_Configuration\Bin\CertGenerator\SecScripts\subCA\subcacert.der

STEP 9:  Creating additional Certificates

1. Modify the host name as defined in Step 4.
2. After the new host name is modified, run the certgen.bat file from step 5.
3. Follow steps 6 and 7 to configure the new AMT client for TLS encryption.

_________________________________________________________________________________________________

The TLS.PS1 file is as follows (cut and paste it and put it into a script file that can be run on your system.)

Note: This file is a conglomeration of some of the ps scripts that exist in the Intel AMT SDK. The same licensing for this snippet is applicable. To view the legal notice for the Intel AMT SDK go to the download link (it appears when you go to download the SDK.)

Download Intel® AMT SDK

########################################
# Create a Wsman Connection Object #
########################################
$wsmanConnectionObject = new-object 'Intel.Management.Wsman.WsmanConnection'
$wsmanConnectionObject.Username = "admin"
$wsmanConnectionObject.Password = "P@ssw0rd"
$wsmanConnectionObject.Address = "http://10.14.164.24:16992/wsman"

# Add the Trusted Root CA
$certificateBlob = "MIIDBzCCAe+gAwIBAgIJAJehJZlKRi2YMA0GCSqGSIb3DQEBBQUAMDIxFTATBgNV
BAMTDERlbW8gUm9vdCBDQTELMAkGA1UEBhMCSUwxDDAKBgNVBAsTA0ZUTDAeFw0x
MDExMjIwODI1MDhaFw0yMDExMTkwODI1MDhaMDIxFTATBgNVBAMTDERlbW8gUm9v
dCBDQTELMAkGA1UEBhMCSUwxDDAKBgNVBAsTA0ZUTDCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBAL4S0DXjcngUXGlqX0oezRHDpUJV0bsp9uQNMPc+LhQe
pb0aR7Mgyec4zoI5wMhlHsyjbGEo/AzkoQQiZ5d7YVreh7cqfowXkqvCud/+NnCb
0Dy7bPSCfrSygAaMQ2Dgu1GZZIgd9oPYU1o/P/SK+xS1+PTa2G6CrJ++yjywcPWM
avOCe7hDYXo9TlscbJizsvBfglzweJsHjZLZMW5YK62+PS1CzMUY9uQimz3dVUgz
tItqfefDkMVwJQcAMsTOwg8nj9xZ10LKBRs9+xW2d0exJcAqkwM5df3FoVO9GUjF
a4qsqGjt3Yj/17H8G0Qtn/nGyrleQyx82mdzvGSCAPcCAwEAAaMgMB4wDwYDVR0T
AQH/BAUwAwEB/zALBgNVHQ8EBAMCAbYwDQYJKoZIhvcNAQEFBQADggEBABD/TQ+w
tcejnCCSLI9HRJq1YdtVqreXD0Q3gmsrltrabi09oJkqtILVZwX0C/I3laOObcgy
n2nv3AT4HjEoGY+ezoUNNZwWyoCIMz11FqkLinUKqfGWjBJbagk9tw2bpibIydFJ
M1a0Wnn/51mgbSHkNc5q80kHui/8SUkHh9XZ28FbqgLA5k4hSuFLO+K81ATVgqgO
657yZ0e/wl4l3Qs4Ssn3T7rdq7KumLQKFFfKlSdbNULW5dvNVRK0yMNcYpbFRa/x
ghBmBFpIPze/TCUhir8ysL19MBvX5fjmnjGZHfvl3KPNz0YrBvGCtNNX5J3CJFbH
CaJLIH3FAIfVFMs="
$publicKeyManagementServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_PublicKeyManagementService WHERE Name='Intel(r) AMT Public Key Management Service'")
$inputObject = $publicKeyManagementServiceRef.CreateMethodInput("AddTrustedRootCertificate")
$inputObject.AddProperty("CertificateBlob", $certificateBlob)
$outputObject = $publicKeyManagementServiceRef.InvokeMethod($inputObject)
$returnValue = $outputObject.GetProperty("ReturnValue")
if($returnValue -like "0")
{
# The $publicKeyCertificateRef is an EPR to the new AMT_PublicKeyCertificate object.
$publicKeyCertificateRef = $outputObject.GetProperty("CreatedCertificate").Ref
}

# Add AMT private Key
$keyBlob = "MIIEogIBAAKCAQEA9NvDxsVLUAf4N7iZgCpjDdTCehQFgQKTtDKTWl8J000NOVvF
UiniEJUaQzZkRUIQRQcmr82mBe8NYLZeLR+c6FKE1BH9dFFWX7SSvNdWOyVBMGLK
z5gSbAWidluuzrbreTOnkaNu8jztdAoqCocL3SIIZgdJR5mmSm4lTlvkINgPPQ9r
SHGdhG4CI0BGAgdxMZ6lvsOqJBhEowEQXueqGwH4/wPfU0++sMrGhmYnsDMkSETk
23nI+vS9hIlCu0iagtAdBTJgeNd0TYi2kRBmBx7qVjbeFhVdBvtCveqTkz7hhu5M
BXT7f/xplgWCR1x4UKIpvimgs7Qu9qvSIxtVWQIDAQABAoIBAHlYB5eT4pTQvkPu
6bNITjpme9I/5dJfUo90mO2qN5ZNkwYf4pOrSerp2VABvoNMEAAFYTiyc1pxc3HA
Lr+x8PJ5InZuS+q+/E0Fkcqf9I3vEnVGIDfspwR9blu1Z9XtdJhl7t8P3UWSyCI/
f0IkVs7JtNvLNJeVH4G3QCmrBEz5jbI4+NikQSPFkueoDGhlMpTr1XpICU0Xre/z
Jc5Q5KVzuZp+J7B2857MKRm19d0zbzOZv9e1jqpXgNOZYRnU/SSSDGrLxbDjdgB3
hCb4HzQWp+F503SzsE7zYoDh2Xo/0MGB0gmHRhO7PGLwrpjRJR5TLg0rGgCLe31F
7gO+sBkCgYEA/wHiLgSe5BPxGoyIQTnFodoomLs1AMmhrjoay6XpozBffEPWQ9gY
ikZl9zRJVx1lQNmO0F3eK7f8d8iGALPSgaKDZlFgaOG7c+a2FzGThREC20GBmHes
6cIYkctnhAU63XH3xVIf/TRy3IJVni2pp+tXNMqGrvC5zSbNBsc+dacCgYEA9c/E
jfNmUEIidVFc+mPTDnY67kWtb+oR/GzE3YhGQKCyOkgxlB1JHNFusevCzX1/A+5F
LdAPn1fjU/IBK+boKVqDODeQEVAQvRp+p+XUs5bknYctM3g7q8usr68dqRmx5AGl
nEmKsL3R2KKFXKvef38QwFO2T0uY8Pq5C0FHPP8CgYBniGw8IsQf9bi9/rCTStFi
lSBGYjtyxmpOQmj+pa3mA43A9gnYIbRU76AWbbQZGmYxniLNlk7NkTV/rHo7bsbY
uxJ+SCvMaVmiBNmJMSejrvRp8H6dWHlrrtIq31p3z2fG4K6n/l/efZzkykXYotFu
y63sUQ29mR7WnBpB1kMVoQKBgD40sxAdPZIn+mJoEbiH1Jx/TRCJb4e3249e0z8g
wm6OfCwFow5RjvQNCA9ck3K/RIpxHO6oDZwMeMoAn01F5RC6CCUM4pePBH1mnBDP
N9Gu6PH4iHbTAX7LT0sybLYje4Iw7IEtlzx8/QLutgMqt2baeBnD1YohnnW1bWis
v2NvAoGACmpT0xDNQMgRz6lUIKkhjvm94apBMkiiRNw0+4FKd8j1IphZLoyrA7W3
MpIP4UlXRgtOkp33q9L23b/mwLTHHSvhkkSRgSYtM4lHyhpyzkzsSMynVEECdaOD
4eQg6GG2x7LKl2j1cFAo/61tUEtaKSstqkQ+vvDVoD6O8LFCC6E="
$publicKeyManagementServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_PublicKeyManagementService WHERE Name='Intel(r) AMT Public Key Management Service'")
$inputObject = $publicKeyManagementServiceRef.CreateMethodInput("AddKey")
$inputObject.AddProperty("KeyBlob", $keyBlob)
$outputObject = $publicKeyManagementServiceRef.InvokeMethod($inputObject)
$returnValue = $outputObject.GetProperty("ReturnValue")
if($returnValue -like "0")
{
# The $publicPrivateKeyPairRef is an EPR to the new AMT_PublicPrivateKeyPair object.
$publicPrivateKeyPairRef = $outputObject.GetProperty("CreatedKey").Ref
}

# Add AMT Certificate
$certificateBlob = "MIIDcDCCAligAwIBAgIBAjANBgkqhkiG9w0BAQsFADAyMRUwEwYDVQQDEwxEZW1v
IFJvb3QgQ0ExCzAJBgNVBAYTAklMMQwwCgYDVQQLEwNGVEwwHhcNMTAxMTIyMDgy
NTMwWhcNMTExMTIyMDgyNTMwWjAYMRYwFAYDVQQDEw1kdXQuaW50ZWwuY29tMIIB
IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9NvDxsVLUAf4N7iZgCpjDdTC
ehQFgQKTtDKTWl8J000NOVvFUiniEJUaQzZkRUIQRQcmr82mBe8NYLZeLR+c6FKE
1BH9dFFWX7SSvNdWOyVBMGLKz5gSbAWidluuzrbreTOnkaNu8jztdAoqCocL3SII
ZgdJR5mmSm4lTlvkINgPPQ9rSHGdhG4CI0BGAgdxMZ6lvsOqJBhEowEQXueqGwH4
/wPfU0++sMrGhmYnsDMkSETk23nI+vS9hIlCu0iagtAdBTJgeNd0TYi2kRBmBx7q
VjbeFhVdBvtCveqTkz7hhu5MBXT7f/xplgWCR1x4UKIpvimgs7Qu9qvSIxtVWQID
AQABo4GqMIGnMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgeAMCAGA1UdJQEB/wQWMBQG
CCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQU4v65z5NAqLepfzhYCzgNpnDt
JEQwTAYDVR0jBEUwQ6E2pDQwMjEVMBMGA1UEAxMMRGVtbyBSb290IENBMQswCQYD
VQQGEwJJTDEMMAoGA1UECxMDRlRMggkAl6ElmUpGLZgwDQYJKoZIhvcNAQELBQAD
ggEBAKF7TxMp3dnTkPRxCaWhdEAmCQbox74OGzZg29SlT2TpZVHMe6i5AgFr/JPs
uFXokBW338Pvhkk916jxzpTF9HwNmYr4DGc01wLcT0mOe2HqR7XF2SAzkcvAaObi
sSfrBZ/PHKwgP4T+8Wi0cVYapuM3JwwRQIZxD4vxm0PFJ+ean1G161ks+2S/oIoU
1+CEOK4alIRMygTi9uMbv15Gda2Woh4V2E0SN/8kV7f5oO51LtXYl8WX5igN5O8y
Pv5fNQjnSxNdAjYK2XhG0p4yp3k2GsOb6PqeCfXeohltWswMND9x49Bx3nLg7FaZ
LJ0fAsQOO/8ZtEaIpYUOdqW76xQ="
$publicKeyManagementServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_PublicKeyManagementService WHERE Name='Intel(r) AMT Public Key Management Service'")
$inputCertificate = $publicKeyManagementServiceRef.CreateMethodInput("AddCertificate")
$inputCertificate.AddProperty("CertificateBlob", $certificateBlob)
$outputObject = $publicKeyManagementServiceRef.InvokeMethod($inputCertificate)
$returnValue = $outputObject.GetProperty("ReturnValue")
if($returnValue -like "0")
{
# The $publicKeyCertificateRef is an EPR to the new AMT_PublicKeyCertificate object.
$publicKeyCertificateRef = $outputObject.GetProperty("CreatedCertificate").Ref
}

# Add TLS certificate
$tlsProtocolEndpointCollectionRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_TLSProtocolEndpointCollection WHERE ElementName='TLSProtocolEndpoint Instances Collection'")
$tlsCredentialContextInstance = $wsmanConnectionObject.NewInstance("AMT_TLSCredentialContext")
# $publicKeyCertificateRef is an EPR to the AMT_PublicKeyCertificate object created by the 'Add a Public Key Certificate' use case.
$tlsCredentialContextInstance.SetProperty("ElementInContext", $publicKeyCertificateRef)
$tlsCredentialContextInstance.SetProperty("ElementProvidingContext", $tlsProtocolEndpointCollectionRef)
$tlsCredentialContextInstance.Create()

# Enable TLS on remote interface
$tlsSettingDataRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_TLSSettingData WHERE InstanceID='Intel(r) AMT 802.3 TLS Settings'")
$tlsSettingDataInstance = $tlsSettingDataRef.Get()
$tlsSettingDataInstance.SetProperty("Enabled", "true")
$tlsSettingDataInstance.SetProperty("MutualAuthentication", "false")
$tlsSettingDataRef.Put($tlsSettingDataInstance)

# Enable TLS on local interface.
$tlsSettingDataRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_TLSSettingData WHERE InstanceID='Intel(r) AMT LMS TLS Settings'")
$tlsSettingDataInstance = $tlsSettingDataRef.Get()
$tlsSettingDataInstance.SetProperty("Enabled", "true")
$tlsSettingDataInstance.SetProperty("MutualAuthentication", "false")
$tlsSettingDataRef.Put($tlsSettingDataInstance)

# Commit changes
$setupAndConfigurationServiceRef = $wsmanConnectionObject.NewReference("SELECT * FROM AMT_SetupAndConfigurationService WHERE Name='Intel(r) AMT Setup and Configuration Service'")
$inputObject = $setupAndConfigurationServiceRef.CreateMethodInput("CommitChanges")
$outputObject = $setupAndConfigurationServiceRef.InvokeMethod($inputObject)
$returnValue = $outputObject.GetProperty("ReturnValue")

Remove-Module 'IntelvPro'

##### End of file

Top 15 Forum Threads

1. HP DC7700 (2007)
2. Intel Management Engine Password Reset (2007)
3. AMT Error Message "[UNS] Failed to subscribe to local Intel(R) AMT" (2008)
4. how to install AMT SOL/LMS and HECI drivers silently (2008)
5. lms service cannot connect to heci driver (2009)
6. "Me is in recovery state" (2008)
7. Intel AMT status is disabled (2007)
8. Need to Enable or Disable AMT on your system? (2008)
9. problem with HECI and network connection? (2008)
10. intel management engine interface device cannot start code 10 on HP 8200 elite (2011)
11. Intel Active Management Technology Status: Disable  (2008)
12. AMT is disabled (2009)
13. Enabling AMT on system (2008)
14. AMT status error message  (2007)
15. Intel motherboard monitoring (voltage/fan/temperature/CI status) programming documentation (2009)

 Forum posts can be great for finding answers to your questions, but it is even better if the question has been blogged. Here are Top Blogs that our developers have been reading:

Top 20 Blogs (pretty much the same list as from last month with a couple of exceptions.)

1. Let us talk about HECI and LMS   (2007)
2. Understanding VT-d: Intel Virtualization Technology for Directed I/O (2009)
3. Intel AMT software: LMS, HECI, MEI... why do I need those? Part 10 in the series (2009)
4. I forgot my "ME" Password! (2008)
5. All about System Power States (S0-S5) (2007)
6. Tips & Tricks for Setting up & Accessing an Intel AMT Client (2008)
7. Step by Step Guide on How to Enable VT-d and Perform Direct Device Assignment (2009)
8. Intel Management and Security Status (IMSS), advanced configurations. Part 9 (2009)
9. To VT-d or Not to VT-d? A guide on whether to Utilize Direct Device Attach in your Virtualized System? (2010)
10. UNS "Failed to subscribe to local Intel AMT" Error Messages and how to fix them (Intel AMT SW, 7th part) (2009)
11. Instructions to disable the Intel AMT privacy notification popup (2007)
12. Meshcentral.com - New Mobile Application (New in Jan 2012!)
13. How about a Security Layer? (2011)
14. Dual Boot Windows Vista and Windows Server 2008  (2008)
15. More configurations (disabling) of the Intel AMT icon. Part 4 in the Intel AMT software series (2008)
16. And the Lenovo T400 said: "Beep.Beep-Beep-Beep.Beep-Beep-Beep.Beep! (2009)
17. Wake On LAN and the Magic Packet (2007)
18. Sharing Virtual Disks Among VMs using VMware* ESX Server (2009)
19. The Keys to Intel vPro Technology: HECI-MEI-LMS-SOL-UNS (2011)
20. Intel® AMT User Notification Service (2009)

With this post, I want to cover how Meshcentral.com powers up sleeping computers. As many of you know, you can go on the web site, see all your computers and select one or many and remotely powered them off, reset them, etc. These operations are fairly simple, just tell the mesh agent to instruct the operating system to do the operation. The real magic comes when you want to wake a system back up. I use this operation myself to wake up my Microsoft Home Server which is set to go to sleep after an hour.

To remotely wake a computer, the web site can't just hop in a cab, go to the computer's location and press the power button... but almost all desktop computers sold in the last 10 years support "wake-on-lan", also know as the "magic packet". Your are very likely to have this on your computer if, when you power your computer down, your Ethernet port is still blinking. Meshcentral has two requirements to get wake working. You need another mesh computer on the same network powered on, and you need your computer to have wake-on-lan enabled.

The first requirement is required since, in order to get passed the home router, there needs to be a mesh agent acting as the relay. The relay node can be a full computer, a laptop, a plugpc, router or android device. As long as it runs the mesh agent and belong to your account, you are set. If you have more than one, even better.

The second requirement is also important since, by default Wake-on-LAN is often disabled. You may need to go into the BIOS and enable it, also in Microsoft Windows, go in the device manager, go in the properties of your network card, power management tab and enable it. I suggest also selecting "Only allow a magic packet to wake the computer" because if you don't any packet that hits a listening port with wake the computer (it's called wake on pattern) and it causes the computer of wake up too often.

Well, that is it. If you meet these two requirements, your computer will wake up, even from a full S5 power off using Meshcentral.com or the Meshcentral mobile application.

Have fun!
Ylian
meshcentral.com

As many of you know, Meshcentral.com works best when you have a few computers on your local network. For example: To wake up a computer within your network, another computer needs to be on. Whatever computer is powered on will serve as the relay to send the wake-on-lan packet to the computer that is off. Same goes for Intel AMT if you have it, one powered computer needs to be present to monitor the others. In my own home network, it's my mesh enabled router that serves as the always-on computer. It's small, reliable, low-power and serves as a presence in my network for Meshcentral to use to do it's thing.

Well, I have been looking around the Internet for small low-power computers that I could mesh-enable. Something the is network enabled and runs a Linux kernel. In the past, I enabled PlugPC's, in fact I have a blog and video about it. At 99$, these boxes are quite pretty and work very well, I have one in my lab and put a "meshcentral.com" sticker on it. More recently, I have been following the story of Raspberry Pi, a 25$ computer. I am actually more interested in the 35$ version that has a Ethernet jack. It would make for and outstanding mesh network presence and it's powered with a micro-USB cable. So, as soon as I can get my hands on a few, I want to compile the mesh agent for it and have them fully Meshcentral enabled. That would just be great. The Ubuntu/ARM port of the mesh agent may even work on it as-is... I can't wait to give it a try.

In the mean time, I ordered another PlugPC and it should be in the mail now. Plenty more toys to play with. If you know of other low-cost Linux computers, please comment!

Ylian
meshcentral.com

Just two days after spotting an article about Meshcentral.com on The Verge, I noticed some more traffic on the server and started looking around to see why. Well, I found another article on a German online publication, Golem.de. I am often confused for a German but, sadly, I dont' speak the language and can't ready it... well, can still pick up a few things here and there.

Also just a quick update to mention that I have been fixing bugs. One of them involved using some special characters in password that would cause the session to fail. I got that fixed today, if Meshcentral did not work for you today, I noticed the problem and fixed... sorry to that unlucky person, but thank you for finding the bug! I am also working on getting remote desktop working again on Mac OS X. I got the new agent working almost perfectly, I still have a glitch to fix. I am hoping to a release early next week. Ever since The Verge published the article with a Mac OS X screen shot, I saw the number of Mac clients go up a lot... making fixing that remote desktop feature a higher priority.

Ylian
meshcentral.com

A few people within Intel today mailed me to said they had seen an article about Meshcentral.com on The Verge, an online publication. The full article is here, titled "Meshcentral: multi-platform remote access built on HTML5". It's short and accurate except they misspelled my name! One of the thing that most surprised me about the write up how they got the security story right. Some users ask why Meshcentral uses two passwords, a web account one and a mesh one. Indeed, it's because the second password is not stored by Meshcentral and so, imposes limits what the web site is capable of doing (Also, that second password can't be recovered). I will probably write much more about security in upcoming blogs since it's such an interesting topic to me.

I had no knowledge of the online publication until today, I am sure to put it in my reading list from now on.

Ylian
meshcentral.com

It's 2012 now and time to get back to work, but not before telling you a little about what I have been doing over the holiday break. Yes, I have been coding! About two months ago, I started working on a new version of the Meshcentral mobile application, this time, I wanted it to work on Android and iOS, and both phones and tablets, all with a single code base. Well today, I am unveiling the Meshcentral.com mobile application!

For Android devices, you can get it on the Google Android Market. For iPhones and iPads, just add this link as a desktop icon. This application requires having a Meshcentral.com account, once you sign in, you will see all of your computers, current and past power stat. You can then remotely turn computers on/off/sleep/hibernate and, if you are on a tablet device, you get the "Terminal" option allowing you to remotely go to the computer's command prompt. Other features include posting text messages on the remote compute and changing the computer's icon in application. It's just my first version, but so far it's working pretty well.

Now for some technical details. This application is entirely built on HTML5 and wrapped on Android as a native application using PhoneGAP 1.3. PhoneGAP is a framework that allows developers to turn a web application into a native app you can post on the Android Market. For iOS, I added some HTML tags, icons and bitmaps to make this web application look like a native application. Since it's a web application, you can even try it right now, on your browser.

Already I have been using this application to wake up my Microsoft Home Server 2011 when I need it, otherwise I put it on a 1 hour sleep timer to save some power. I need another mesh node in my network to be always on and my mesh-enabled DD-WRT router serves that role. So Meshcentral uses my router as the source of the wake-on-lan packet.

In any case, please feel free to try the application out and give me feedback. I am already preparing an updated version with some bug fixes.

Ylian
meshcentral.com

As the calendar year winds down, I find myself tapping away at the keyboard at my sister's house in Denver, Colorado in a snowstorm. I just spent the morning digging out our rental car and shoveling my sister's driveway and her next-door neighbors. It is a time like this to reflect and, yes, to remember that one of the reasons I moved to Portland, Oregon was to escape the snow!

This has been a busy month in the Yocto Project, with all kinds of activity jumping along:

• We launched a maintenance release 1.0, dubbing it Yocto Project v1.0.2. Our 1.0 release was last April, but we try to provide update support for at least a year after release. This release includes security patches as promised and some fixes to make sure the build works with more recent Linux distributions.
• We're also working on a maintenance release for 1.1, which came out last October. Nobody should ever fear that compatability has been broken in a maintenance release. My mental rule of thumb after a few decades in the software game is that you should have no more than 10 - 12 bug fixes in a maintenance release, which also constrains the amount of QA you need to do. 1.1.1 though will have a few more changes in place because we want to address some issues raised by Matthew at FreeScale and to make sure that the release meets their needs. More on this later.
• Our development, QA and release engineers also produced the first milestone from our 1.2 release, due this coming April. We produce these milestone releases every 6 weeks or so. Our idea is to constrain the length of time that the development window is open to make sure we can freeze, stabilize and run a full QA sweep. Then we provide these little milestone releases to you so that you can have some demonstratable features to use in a somewhat more stable form. At least, it should be more stable than developing on the Master branch! As I wrote this, we decided to go ahead and release the M1 milestone.

It may seem like we're putting an inordinate effort into producing these maintenance releases. In fact, we had hoped to have 1.1.1 out in December, but putting three releases out in one month was just too much for our release engine to handle.

Why make the effort to do maintenance releases? Here's the way I think about it:

• The Yocto Project is an open source project, not a software product. So we're not supporting our releases for years and years. We're looking for our friends at Mentor Graphics, Montavista, Timesys, Wind River and others to produce software products which use Yocto as the upstream.
• On the other hand, by providing these additional stable releases, it shows that we care about the developers who base their products on the Yocto Project. We know not every product development cycle perfectly aligns with the every six month Yocto Project cycle. Having these maintenance releases helps to support them.
• As I mentioned, we try to keep these releases as stable as possible, just fixing critical bugs or security patches from upstream.
• So we think these maintenance releases matter, to demonstrate that we care about you the developer who uses the Yocto Project to make the magic happen on your devices.

By the way, I'd like to offer a shout out to Joshua Lock, who has been spearheading the development side of these maintenance releases, Beth Flanagan for release engineering work, Jiajun and the project-wide QA team. And also to Paul Eggleton for reminding us to get the 1.0.2 maintenance release on the schedule.

In the past few weeks I have been working hard to add load-balancing support to the Meshcentral server. Mind you, Meshcentral.com itself is currently still running on a single computer, with double power-supply, mirrored hard drives, but still, it's a single computer and so, easy to code against. As other groups within Intel get interested in running their own version of Meshcentral, it's been important to upgrade the design and software to be able to run in a truly scalable way.

One of the key features of being hosted in big professorial environments is the presence of load-balancers that stand ahead of the servers and split the incoming connections evenly to the servers in the back. If your connections are completely stateless, this is not a problem at all, you handle the request, close the connection and move on. This is why I have been moving as fast as possible to web sockets lately, it allows for complex sessions while still being state-less across connections.

For older browsers that don't support web sockets, I have to hack the system to allow for some sessions state on one of the servers that would still work in the back of the load-balancers. The hack involved creating state on one server and having the other servers re-route HTTP calls that land on the wrong server to the correct one. Not real load-balancing but it will do until we can move entirely over to web sockets.

In general, I am very excited to be working on this project, it's just a load of fun.

Ylian
meshcentral.com

Motivation

We had vague requests from customers to implement a memory pool (Wikipedia calls it region) or some of its properties in the TBB scalable memory allocator. We summarized these requests and general information on memory pools from the Internet and got the following compilation of major properties and abilities:

• Memory pools basically do the same job as standard memory allocators but additionally group memory objects under umbrella of a specific pool instance which enables:
  • fast deallocation of all the memory at once on pool destruction or for sake of further reuse
  • less memory fragmentation and related synchronization between independent groups
• Memory pools allow more control over acquisition and release of memory resources, and may have user-specific sources of memory:
  • memory chunk/buffer of a fixed size
  • redirection to a specific memory provider, e.g. standard or custom implementation of malloc, big memory pages, memory tied to specific NUMA node, IPC shmem regions.

To squeeze more performance and to fight memory fragmentation, some specific implementations allocate objects of fixed size only (so called object pools, e.g. boost::pool, Wikipedia calls it memory pool) or are unable to deallocate individual object ("arena allocator"). In our implementation, we tried to provide more general functionality in thread-safe and scalable way. For that purpose, the implementation of the memory pools is based on TBB scalable memory allocator and so has similar speed and memory consumption properties. Later we may address more specific use cases, based on the feedback.

Usage

Our memory pools API consists of two classes for thread-safe memory management: tbb::fixed_pool and tbb::memory_pool. The first one is for the simple case when an already allocated memory block and is used for allocation of smaller objects. And the second one utilizes a user-specified memory provider to obtain big chunks of memory where smaller objects reside. As opposed to fixed_pool, memory_pool is able to grow on demand and relinquish unused chunks back to the provider.

Both classes provide familiar methods for allocation and deallocation:

void *ptr = my_pool.malloc( (size_t) 10 );  // allocate 10 bytes
ptr = my_pool.realloc( ptr, (size_t) 12 );  // extend the allocation to 12 bytes
my_pool.free( ptr );                        // deallocate it

Additionally, there is a method which deallocates all the memory at once, i.e. it is a faster equivalent to a series of calls to my_pool.free() for each pointer obtained in this pool by previous calls to my_pool.malloc():

my_pool.recycle();  // Frees all the memory in the pool for reuse

Please note, that it is not thread-safe to call it concurrently to other methods on the same instance (similarly to clear() method in containers).
We also provide an (almost, except absence of default constructor) STL-compliant allocator class to enable pools inside STL containers:

typedef tbb::memory_pool_allocator<int> pool_allocator_t;
std::list<int, pool_allocator_t> my_list( (pool_allocator_t( my_pool )) );

Now, the only thing that holds us back from the first experiment with this new feature of TBB is the question – how to create the ‘my_pool’.  First, we need to enable this feature and include the header:

#define TBB_PREVIEW_MEMORY_POOL 1
#include “tbb/memory_pool.h”

If you want to create a memory pool on top of your memory block, let’s specify its address and size in bytes to the constructor of tbb::fixed_pool class, as in following excerpt:

char buffer[1024*1024];
// The casts below are just to show the types of arguments.
tbb::fixed_pool my_pool( (void*)buffer, (size_t)1024*1024*sizeof(char) );

The maximal amount of memory which can be allocated from the pool declared above is limited by size of the buffer minus some space for control structures. And if you want to avoid this limitation, let’s use tbb::memory_pool template class specifying memory provider (which will be discussed later) as its template argument:

tbb::memory_pool< std::allocator<char> > my_pool(/*optionally: allocator instance*/);

You can specify any STL-compatible allocator as the memory provider (though this is a subject to change). It will provide (big) memory chunks for  my_pool when necessary. The destructor of the memory_pool class implies release of all the memory chunks back to the memory provider.

Let’s consolidate our knowledge in one artificial example:

// Link this with tbbmalloc library
#define TBB_PREVIEW_MEMORY_POOL 1
#include "tbb/memory_pool.h"
#include <list>
#include <stdio.h>

void main() {
    static char buf[1024*1024*4]; // buffer for interim data
    tbb::fixed_pool interim_pool(buf, sizeof(buf)); // pool for temporary objects
    tbb::memory_pool< std::allocator<char> > result_pool; // pool to store the results

    typedef tbb::memory_pool_allocator<int> result_allocator_t; // interface to STL containers
    std::list<int, result_allocator_t> result_list( (result_allocator_t( result_pool )) );

    for(int result = 0, i = 0; i < 100; i++, result = 0) {
        for(int j = 0; j < 1000000; j++) {
            int *p = (int*)interim_pool.malloc(4);
            if( p ) result++; // really dummy :)
        }
        // in real application, here can be some processing of allocated objects
        result_list.push_back(result); // no memory fragmentation here - separate pool
        interim_pool.recycle(); // free all the interim objects
        printf("%d\n", result); // should be the same number on each iteration
    }
} // all the memory is released back implicitly

The simple part is done, and I hope that you are interested enough to proceed with more complex questions, and tell us what you think about it.

Someone may want to know whether it is possible to construct a pool in a memory allocated form another pool. It is possible, but one should take care to destroy the inner pool prior to destruction of the outer pool or a call to recycle(). Do you know a good reason to enable such a nesting?

Memory provider interface

From an API designer perspective, the memory provider is the most questionable part of the scalable pools API. And since it is yet a community preview feature, you are welcome to influence its design. Curious readers might want to ask questions like the following:

• what are the requirements for the template argument?
• why is std::allocator used as a memory provider?
• why the type used with std::allocator in examples above is “char”?

The template argument of tbb::memory_pool accepts a memory provider class which satisfies minimal requirements of STL compatible allocator according to the last C++11 standard: allocate and deallocate methods, and a value_type definition.

Using std::allocator and compatible classes is perhaps the most straight-forward way to enable memory_pool anywhere. However from efficiency standpoint, it makes probably not much sense because such allocators are intended for rather small objects by design while memory provider should operate with megabytes. For users who don’t care what the memory provider is, we could better provide a default one instead which would map to system-default way for memory mapping.

And finally, TBB memory pools don’t really need the type of allocation (i.e. char in the declaration of tbb::memory_pool<std::allocator<char>>), but rather need to know the granularity of requests to the memory provider. And this is not only specification for type of arguments for allocate and deallocate, this information is used in our implementation to determine size of memory requests to memory provider. For example, consider big pages which can be mapped only by chunks of megabytes:

// A custom memory provider for memory_pool
class big_pages {
public:
    typedef char[2*1024*1024] value_type;
    void *allocate(size_t pages) {
        return mmap(0x0UL, pages*2*1024*1024, PROT_READ | PROT_WRITE,
                    MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, 0, 0);
    }
    // the pointer type requirement is also actually relaxed
    void deallocate(void *ptr, size_t pages) {
        munmap(ptr, pages*2*1024*1024);
    }
};
// usage:
tbb::memory_pool<big_pages> my_pool;

Some food for thoughts

The way granularity is specified in the line 4 in the above example is not straight-forward and can be viewed as confusing. This is the price of STL-compliant interface of the memory provider and we are not sure if it has more pros than cons:

• STL compatibility is supposed to reuse widely implemented memory allocators.
  • On the other hand, these allocators are usually purposed for small sizes of allocations but a pool will need memory chunks of at least hundreds of kilobytes.
• In theory, it allows easy nesting of memory pools using our memory_pool_allocator class.
  • But we studied that nesting of the pool in some other implementations does not mean reusing the memory allocated by parent pool but rather a hierarchy of pool objects.
  • And such a nesting is not yet supported anyway
• It is easier to remember the requirements based on well-known standard interface
• Granularity is a property of the memory provider and must be passed along with it

As an alternative interface, we consider to make the granularity explicitly specified but in a separate trait class which should be specialized only for the memory providers with granularity of allocations > 1. It is even possible to keep STL-compatibility using metaprogramming magic, e.g. define the granularity to sizeof(value_type) if value_type defined.

Another question is how to introduce alignment in the interface of memory pools. Basically, it can be either aligned_malloc() and aligned_realloc(), or an optional argument for malloc() and realloc() methods.

Also, are the suggested class names good, or do we need to find better names (for instance, "fixed_region" and "dynamic_region" to align with terms of Wikipedia)?

Feedback is very welcome

We are very eager to hear from you what do you think about above and how can it be used in your projects.

A few months back, I had added support for web sockets in Meshcentral.com, up until now it's only been used for noVNC, the all-Javascript VNC client and nothing else. Web sockets allow for full two-way communication between the server and the web browser for almost all browsers except Internet Explorer (this will be fixed in IE10). Using web sockets instead of the emulated technique using a series of HTTP calls allows for better performance and much less overhead. I can also handle many more sessions on the server side.

Well, in the last few days, I have been attempting to make use of web sockets more broadly thru out the site. Yesterday I released a new version of the site that makes use of them, when the browser supports it, for the remote desktop and remote terminal. If you notice any issues, please post a comment below. In general it seems to work ok, I am still working out all the kinks.

Quick update: I had to back-off using web sockets on Safari browsers including iOS because web sockets seems to be crashing the browser. So, it's back to AJAX HTTP for Safari just like IE. Firefox and Chrome seem to be powering thru with web sockets.

Ylian
meshcentral.com

The Linux Foundation did a nice little two-minute video clip of Jefro, our Yocto Project Community Manager, talking about last October's 1.1 release, and the upcoming 1.2 release planning. Check it out!

Jefro discusses the Yocto Project 1.1 release

Jefro claims that he looks kind of sleepy, but clearly the camera loves him!