Compaq dc7800 - Convertible Minitower PC User Manual

vPro Prerequisites and Trade-offs for the dc7800p Business

PC with Intel vPro Processor Technology

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Setup and Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Hard Drive Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Network Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Memory Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

MAC (Media Access Control) Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Trade-offs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Memory Subsystem Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Power Consumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

AMT vs. ASF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Network Performance Impact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Third Party Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

Hard Drive Capacity Loss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Hard Drive Duplication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

HP Backup and Recovery Manager Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Driver and Service Verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1

Introduction

Intel vPro processor technology* is a new technology designed to revolutionize the digital office. Intel vPro

Technology allows for remote management of a PC regardless of system power state or operating system condition, as long as the system is attached to AC power and a network. Intel vPro also improves system security against malicious software attacks. Intel vPro’s goal is to simplify back-office management and reduce IT-related expenditures.

As with any substantial new technology, questions arise about the requirements to utilize Intel vPro’s benefits. There are certain prerequisites to use the features, and certain trade-offs that the IT professional should understand before deploying Intel vPro technology branded systems.

This white paper assumes some basic knowledge of AMT (Active Management Technology) and Intel Virtualization Technology compatible with Intel vPro processor technology.

The following provides a brief history of AMT evolution:

• AMT 1.0 - Introduced with the Intel 945 chipset, but not shipped with HP Business PCs.

• AMT 2.0 - Introduced with the Intel Q965 chipset and shipped with HP Compaq dc7700p Business

PCs.

• AMT 2.1 - Introduced in March 2007 and shipped with HP Compaq dc7700p Business PCs.

• AMT 2.2 - Will be available as a Web download in the Fall of 2007 with the HP Compaq dc7700p

Business PCs.

• AMT 3.0 - Introduced with the Intel Q35 chipset and will be shipped with HP Compaq d7800p systems.

AMT 3.0 provides many new features over AMT 2.x. This white paper includes the new features of AMT

3.0 for the HP Compaq dc7800p Business PC.

Virtual Appliance (VA) is minimally covered in this white paper. For detailed VA coverage, read the HP

Compaq Business PCs with Intel vPro Processor Technology and Virtual Appliances white paper, available on www.hp.com

.

* The HP dc7700p PC is enabled for Intel vPro Processor Technology. Some functionality of this technology, such as Intel Active

Management Technology and Intel Virtualization Technology, requires additional 3rd party software in to run. Availability of future

“virtual appliance” applications for Intel vPro Processor Technology is dependant on 3rd party software providers. Compatibility of this generation of Intel vPro Processor Technology-based hardware with future “virtual appliances” and Microsoft Windows Vista operating system is yet to be determined.

Prerequisites

An Intel vPro processor technology branded system has hardware, software, and firmware prerequisites.

Hardware

An Intel vPro technology system with AMT 3.0 requires the following hardware:

• Intel Core 2 Duo processor (E6x50)

• Intel Q35 with ICH9-DO chipset

2

• Intel 82566DM Network Interface Controller

• 1.2 TCP compliant TPM

The HP Compaq dc7800p Business PC is an Intel vPro processor technology branded system that meets all Intel vPro processor technology hardware requirements.

The Intel Q35 chipset includes several devices that support AMT functions:

• Intel Management Engine (ME) Interface

• Serial-over-LAN

• IDE-Redirect

Some of these internal devices need drivers to function. See the Software section for more details.

Software

Required Operating System

Windows XP Pro with Service Pack 2 (32-bit) or Vista (32/64-bit) version that will work with any current version AMT or VA.

Windows Vista (32-bit or 64-bit) will work with all current versions of AMT, but does not work with current

VAs.

The Windows XP Pro and Vista software images require three deliverables:

• Intel ME Interface driver

• SOL driver

• LMS

Go to www.hp.com

to check for the latest versions of these deliverables

Intel ME Interface (Intel Management Engine Interface)

The Intel ME Interface driver allows third party agents in the user operating system to communicate with the ME for out-of-band access to the non-volatile data store. All third party software products supporting

Intel vPro technology may not utilize these operating system services.

The Intel ME Interface driver controls the management engine that enumerates under System Devices in

Device Manager.

The MEI driver for Windows XP and Vista 32-bit is HECI.SYS.

The MEI driver for Vista 64-bit is HECIX64.SYS.

NOTE : Using Remote Configuration on an HP Compaq dc7700p system that has been updated to AMT

2.2 requires updating the MEI (HECI.SYS) driver to version 2.1.22.1026 or later.

SOL (Serial-over-LAN)

The SOL driver allows a management system to remotely display the keyboard interface of a managed client. The display is typically shown through a management console, and it emulates serial communication over standard network connection. This allows a management system to remotely control a client system.

SOL is also known as KT (Keyboard and Text redirection).

3

The SOL driver comes as an INF file and contains the strings for device identification. The driver uses the

SERIAL.SYS and SERNUM.SYS driver from both Windows XP and Vista, and appears as a COM device.

LMS (Local Manageability Service)

LMS is a service that enables local applications running on AMT capable systems to use the same SOAP

(Simple Object Access Protocol) functionality available to remote applications. LMS routes all traffic to the

ME firmware through the ME interface.

LMS includes three components - the service, the system status, and the user notification. An AMT dialog box also displays at XP or Vista boot up, informing you that AMT is active. The dialog box contains a check box that allows you to prevent the dialog box from appearing in subsequent boots. This check box displays for each profile; therefore, if a new profile is created, the AMT dialog box displays for the new profile until it is disabled.

IDE-R (Integrated Drive Electronics Redirect)

The IDE-R is a function that allows a client system to access the ATA, ATAPI, and floppy devices on the management system. When booting through IDE-R, the client system ATA/ATAPI commands are forwarded to the management system and it will respond back to the client as if it issued the command.

The remote capabilities of IDE-R allow for client systems to load operating system or diagnostic images from a management system. The IDE-R interface is fully compliant with the ATA/ATAPI-6 specification.

At this time, IDE-R does not need a driver file. It is displayed as a real IDE controller during normal operation. When a remote IDE-R session is established, the Intel virtual driver string and device are shown. The

ME FW has the strings for device identification. IDE-R devices use the same mechanism as real IDE devices in Device Manager.

There may be a driver file associated with IDE-R in the future to assist with enumeration issues when in

Compatibility mode for SATA hard drives.

Other Operating System Support

There is no support for Windows XP Pro x64 and older Microsoft operating systems.

Firmware

To support future updates, the system BIOS may require an upgrade. Initial units shipped may not have full system BIOS support for the Vista operating system and XP-based virtual appliances. ME firmware may require an upgrade as well. Please check the HP support site for updated system BIOS, and work with your management console vendor for required ME firmware updates.

The HP Compaq dc7700p Business PC uses the 786E1 BIOS family.

The HP Compaq dc7800p Business PC uses the 786F1 BIOS family.

For best performance and to take advantage of AMT 3.0 features, make sure HP Compaq dc7800p Business PCs have a BIOS revision of at least version 1.04, a ME firmware of at least version 3.0.1.1104, and a MEBx of at least version 3.0.2.0004.

Shipping HP Compaq dc7700p Business PCs with AMT 2.0 or 2.1 can be upgraded to AMT 2.2 through a BIOS upgrade available using Web download.

For best performance and to take advantage of AMT 2.2 features, make sure the HP Compaq dc7700p

Business PCs have a BIOS revision of at least version 3.03, a ME firmware of at least version 2.2.1.1034, and a MEBx of at least version 2.1.4.000.

4

Setup and Configuration

All Intel vPro technology branded systems should be set up before deployment to enable AMT. AMT setup and configuration is also known as Provisioning .

There are several ways to set up a system:

• Purchase configured (pre-provisioned) systems from HP.

• Use a USB key in conjunction with a setup and configuration server console for one-touch deployment.

• Manually enter the data into the MEBx (Management Engine BIOS Extension) setup module.

• Remote configuration with AMT 3.0.

Enterprise provisioning of AMT requires networking infrastructure, including DHCP, DNS, a Setup and

Configuration console, and a management console. To utilize recommended security, Transport Layer

Security (TLS) is required. Without TLS, AMT uses HTTP digest for security.

You can find more details about provisioning in the HP white paper, “vPro Setup and Configuration for the dc7800 Business PC with Intel vPro Technology” at http://www.hp.com

.

AMT-capable systems that you deploy without being provisioning are vulnerable to attack, which can lead to full hijacked control of the system. This may require costly manual provisioning at a later time to use the AMT system again.

The IT administrator must keep pre-shared keys used in provisioning a secret. Stolen keys can be used in rogue provisioning servers to take control of systems.

HP provides a fee-based customized service that will configure (pre-provision) AMT systems in the factory and securely provide pre-shared keys to the customer. HP offers a secured service that will eliminate manual setup/configuration (provisioning) of each unit at the customer site. Please contact HP for more information about this valuable service.

Hard Drive Layout

Intel vPro technology requires a separate hard drive partition for a future Virtual Appliances. This partition is known as the SOS (Service Operating System) partition. The Virtual Appliance in the SOS partition is a single binary image, and includes:

• Intel LVMM (Light-weight Virtual Machine Monitor)

• Service Operating System (SOS)

• Third party embedded applications (if any)

The SOS partition is a 102MB partition of type 72h. It is not formatted or given a drive letter, has no file system, and cannot be directly accessed through Windows Explorer. However, the SOS partition is visible in Disk Management, so care must be taken to insure that it is not accidentally or maliciously deleted.

NOTE : Once a Virtual Appliance is installed in the SOS partition, its type will become 71h.

NOTE : Not all third party software products supporting Intel vPro processor technology offer Virtual

Appliances.

5

At launch, HP Compaq dc7800p Business PC configurations will have a blank SOS partition. This partition is located at the end of the hard drive and is inaccessible. The main client operating system partition

(COS) housing Windows XP or Vista is at the front of the hard drive, and the HP Backup and Recovery

Manager partition is located behind the COS.

Figure 1 HDD partition layout

Customers who build their own images should be aware of the partition layout requirements for Intel vPro technology. The SOS partition must be exactly 102MB, be type 72h, not formatted, not enumerated, and located at the end of the hard drive.

Network Changes

Intel vPro technology requires usage of the embedded Intel 82566DM Network Interface Controller

(NIC).

After a Virtual Appliance is installed, PCI and PCI-e add-in NICs will no longer function. This is a security feature to prevent network traffic from add-in NICs bypassing the SOS. This may be a limitation for customers that require multiple NICs. However, USB NICs are not virtualized by the Intel LVMM, and therefore may circumvent installed Intel vPro processor technology compatible management and security appliances.

For more details about network controller behavior, see the HP Compaq Business PCs with Intel vPro Processor Technology and Virtual Appliances white paper at www.hp.com

.

Memory Changes

The management engine requires that memory is populated in channel A. If memory is not populated in channel A, the ME cannot function and all AMT or ASF features are lost. A POST error message displays if memory is not populated in channel A. If this occurs, power off and unplug the system so memory can be reconfigured.

The POST error is as follows:

2211-Memory not configured correctly for proper MEBx execution.

Make sure there is a memory module in the black DIMM socket.

6

The DIMM slots for the Compaq dc7800 Business PC are color coded. The first DIMM slot in channel A is black and all other DIMM slots are white. Populating a DIMM in the black slot insures memory is in channel A.

For more information, see “Memory Subsystem Changes” on page 7 .

MAC (Media Access Control) Address

HP Compaq dc7700 and dc7800 Business PCs have two MAC addresses, one for the NIC and another for the ME. This is a change from previous HP Business PCs, which had only one MAC address for the

NIC.

Trade-offs

Intel vPro processor technology delivers many benefits for IT professionals and everyday users. However, as with many new technologies, these benefits are not without trade-offs.

Memory Subsystem Changes

The management engine uses system memory, much like UGA graphics. It can take up to 16MB from the operating system, not including any installed software running under the operating system or LVMM.

Virtualized appliances consume additional system memory, resulting in less usable memory for Windows

XP or Vista. The amount of memory depends on the application, but can be as high as 100-200MB. The

IT administrator might want to consider a minimum of 1GB system memory for use with future virtual appliances.

Since the ME requires power in all sleep states, the memory slots remain powered at all times. The only safe way to add or remove memory modules is to first unplug the unit from A/C power. Failing to do so can cause damage to the system, memory module, and possibly the person changing the memory.

CAUTON : Unplug the system before removing or inserting memory modules.

Refer to HP service and support documentation before installing or removing memory modules.

Power Consumption

Once a system is set up and configured (provisioned), the ME and system memory require power even in the sleep states (S3 Standby, S4 Hibernate, and S5 Off). Because of this, an AMT-enabled system consumes more power than a non-AMT system.

The additional power consumption is minimized with the Wake-On-ME feature. Wake-On-ME allows the

ME to be in an off state while the system is in the S3-S5 sleep states except when there are pending management functions. The user can set the time out value for the ME to go to sleep in the MEBx.

You can find more details on Wake-On-ME in the vPro Setup and Configuration for the dc7800 Business

PC with Intel vPro Processor Technology white paper, located at the HP Web site at: www.hp.com

.

7

AMT vs. ASF

HP Compaq dc7800 and dc7800p Business PC products are configured for AMT by default, but can support both AMT and ASF (Alert Standard Format). Once AMT is provisioned, ASF is no longer available

(and vice-versa). AMT provides equivalent or better alerting and remote control capabilities with supporting management console software. Customers and IT professionals must determine which management standard is right for them.

Comparison of AMT vs ASF Capabilities

Capabilities AMT ASF

OOB (Out Of Band) Management Yes - From any power state (S0,

S3, S4, S5)

Remote Control Yes - SOL, IDE-R, reboot, wake, shutdown, and more

Event Alerting

Non-Volatile Storage

Event Logging

Remote Boot

Yes - Policy-based (flexible)

Yes

Yes - PXE or IDE-R

Limited - System must be in S0, needs to be remotely woken first

Limited - Remote reboot and wake only

Yes - Preset (restrictive)

Yes - Third Party Data Store (3PDS) No

No

Yes - PXE

Asset Information

Remote ME FW Update

Secure Communication

Connection Protocol

Layer 4 Stack

Broad Enterprise ISV Support

Yes - HW and SW

Yes

TLS / HTTP Digest

HTTP

(Accessible by Web browser)

TCP

(Preferred routing protocol)

Yes

No

No

Simple Authentication

RMCP

UDP

(Often blocked by routers)

No

8

Network Performance Impact

The installation of a virtualized appliance will virtualize all network controller devices. The Intel 82566DM network controller will change its device ID dynamically. This should result in “New hardware found” messages and the installation of different virtual drivers.

Figure 2 Virtualized Intel 82566DM Network Adapter

Note that this causes redirection of user networking I/O to the virtual partition, which can impact network traffic performance. Third party appliances that inspect network packets will impact this further.

Read the HP Compaq Business PCs with Intel vPro Processor Technology and Virtual Appliances white paper on www.hp.com

for more details on network controller behavior.

Third Party Appliances

Intel vPro technology only supports a single virtual appliance for now. The customer will need to select the right VA to suit their needs.

Virtual Appliances available at launch of the HP Compaq dc7800 Business PC will only support Windows XP.

There could be some minor impact to runtime power consumption and suspend/resume latencies due to virtualization of processor registers required for these features.

Read the HP Compaq Business PCs with Intel vPro Processor Technology and Virtual Appliances white paper on www.hp.com for more details on Virtual Appliances.

9

Hard Drive Capacity Loss

Intel vPro processor technology branded HP Compaq dc7800 Business PC configurations include an SOS partition. This partition uses 102MB of hard drive space even with no virtual appliance installed.

If Intel vPro processor technology is not longer desired, the hard drive space used by the SOS partition cannot be reclaimed into the COS partition with the hard drive layout in the shipping configuration. The

SOS partition is separated from the COS partition by the HP Backup and Recovery Manager partition. To reclaim the SOS partition into the COS partition, the HP Backup and Recovery Manager partition must also be reclaimed for one contiguous drive space. See “Hard Drive Layout” on page 5 for partition placement.

Hard Drive Duplication

There are limitations in the way you can duplicate hard drives using duplication software (for example

Symantec Ghost), once a virtual appliance is installed. Because of the LVMM and the way it boots, hard drive cloning through software means is only possible for same sized hard drives.

Corporate customers planning on image deployment over systems with different hard drives must be aware of this limitation. You can properly duplicate only hard drives of the same size once a VA is installed.

HP Backup and Recovery Manager Behavior

HP Backup and Recovery Manager is a backup and restore application designed to make backup images of the hard drive and restore them if needed. The SOS partition is not backed up or restored by

HP Backup and Recovery Manager.

10

Driver and Service Verification

To verify AMT drivers and services are loading properly, look for them in Device Manager or Services.

Intel Management Engine Interface

Figure 3 Intel ME Interface in Device Manager

11

Serial-over-LAN

Figure 4 SOL in Device Manager

The COM port assigned to SOL can vary. It does not have to be COM4.

Local Manageability Service

Figure 5 AMT LMS System Status and User Notification in Services

12

Figure 6 AMT Status check box

IDE-Redirect

Figure 7 IDE-R during normal session in Device Manager

13

Figure 8 IDE-R (CD-ROM and Floppy) during redirected session in Device Manager

Figure 9 Explorer showing IDE-R floppy and CD-ROM drive

The virtual drives and any media within them will show up in Windows Explorer. A system can be directed to boot from the virtual drive and media.

14

© 2007 Hewlett-Packard Development Company, L.P. The information in this document is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

Microsoft, MS-DOS, Windows, and Windows NT are trademarks of Microsoft Corporation in the U.S. and other countries.

434478-003, 10/2007

15