Sipeed NanoKVM-PCIe(cnx-software.com)
cnx-software.com
Sipeed NanoKVM-PCIe
https://www.cnx-software.com/2024/12/24/sipeed-nanokvm-pcie-is-an-inexpensive-kvm-over-ip-solution-with-optional-wifi-6-and-poe-support/
45 comments
Worth mentioning also, it apparently has non-configurable (to off) root:root SSH on by default, according to the comments ...
Looks like the pcie slot is just used for power?
I'd love to see something like this where the board had a basic video card, so you could use it in a system without any video output. Bonus if it also had a usb controller and a serial port, so it didn't need to loop to plugs (although some of that could happen on the internal side as well)
I'd love to see something like this where the board had a basic video card, so you could use it in a system without any video output. Bonus if it also had a usb controller and a serial port, so it didn't need to loop to plugs (although some of that could happen on the internal side as well)
Likewise, I have never been able to get a satisfying answer as to why no one seems to be willing or able to put the same ASpeed AST2x00 chips that it seems half the OEM IPMI/iKVM/whatever solutions use on a standard PCIe card instead of embedding it in the motherboard or using some proprietary interface.
I have never been able to identify a technical barrier to doing this, the important features most people actually care about are implemented over a 1x PCIe link and USB, plus a couple of GPIOs to twiddle the power/reset button connections. Most OEM implementations also connect to the LPC bus and others on the server board to allow more in depth diagnostics, voltage logging, etc. but those are bonus features and not requirements for a useful product. I do not see any technical reason a useful generic PCIe implementation couldn't be produced, and as a result I have a strong feeling that the lack of such products is an intentional choice by one or more of the vendors involved to increase margins by pushing users who want these features up to entry level server boards instead of sticking a card in a higher-end desktop board that might better fit their needs.
I have never been able to identify a technical barrier to doing this, the important features most people actually care about are implemented over a 1x PCIe link and USB, plus a couple of GPIOs to twiddle the power/reset button connections. Most OEM implementations also connect to the LPC bus and others on the server board to allow more in depth diagnostics, voltage logging, etc. but those are bonus features and not requirements for a useful product. I do not see any technical reason a useful generic PCIe implementation couldn't be produced, and as a result I have a strong feeling that the lack of such products is an intentional choice by one or more of the vendors involved to increase margins by pushing users who want these features up to entry level server boards instead of sticking a card in a higher-end desktop board that might better fit their needs.
There's the ASRock PAUL: https://www.asrockrack.com/general/productdetail.asp?Model=P...
I have one, it works. Look at that board though! Given that component and board density, I don't find it very surprising that it costs around 200$ USD. Maybe you could get clever and design one that tries to work 100% via pcie device functions, and cut down the (physical) complexity of the IPMI device, but then the wide system and interface compatibility of the IPMI board would suffer.
To wit, the card needs to do the following, at a minimum:
1. Provide a VGA/UEFI/VFB-equivalent framebuffer for display capture
2. Provide a USB-device interface to emulate keyboard+mouse.
3. Provide a network interface of some sort for remote control
4. Provide GPIO headers/sinks at the appropriate power levels to replace traditional motherboard front-of-device switches -or- provide a PMBus header to perform equivalent functions with a support PSU.
You can get away with a subset of the above, but without that, you will be missing something critical to enabling lights-out-management. On top of that, a full-featured IPMI board is also generally expected to provide some fashion of environmental monitoring and fan control, which the PAUL does provide. It throws in some extra features as well, and provides some maintenance/lifecycle management capabilities of the board itself.
Providing all the above, is about the same amount of complexity of shipping a SBC and ecosystem itself, made moreso by the compatibility requirements.
You don't have nearly as big a market willing to pay $200 for all that -- its certainly not a matter of adding the chip and flash and dropping some vias.
Even having a standardish system-on-chip and non-bespoke firmware is 'new' (post-2020?). It could have been done 10-15 years ago sure, but noone was willing to do the long tail of tasks needed to get a product to market yet.
I have one, it works. Look at that board though! Given that component and board density, I don't find it very surprising that it costs around 200$ USD. Maybe you could get clever and design one that tries to work 100% via pcie device functions, and cut down the (physical) complexity of the IPMI device, but then the wide system and interface compatibility of the IPMI board would suffer.
To wit, the card needs to do the following, at a minimum:
1. Provide a VGA/UEFI/VFB-equivalent framebuffer for display capture
2. Provide a USB-device interface to emulate keyboard+mouse.
3. Provide a network interface of some sort for remote control
4. Provide GPIO headers/sinks at the appropriate power levels to replace traditional motherboard front-of-device switches -or- provide a PMBus header to perform equivalent functions with a support PSU.
You can get away with a subset of the above, but without that, you will be missing something critical to enabling lights-out-management. On top of that, a full-featured IPMI board is also generally expected to provide some fashion of environmental monitoring and fan control, which the PAUL does provide. It throws in some extra features as well, and provides some maintenance/lifecycle management capabilities of the board itself.
Providing all the above, is about the same amount of complexity of shipping a SBC and ecosystem itself, made moreso by the compatibility requirements.
You don't have nearly as big a market willing to pay $200 for all that -- its certainly not a matter of adding the chip and flash and dropping some vias.
Even having a standardish system-on-chip and non-bespoke firmware is 'new' (post-2020?). It could have been done 10-15 years ago sure, but noone was willing to do the long tail of tasks needed to get a product to market yet.
> There's the ASRock PAUL
I was aware of these but I could have sworn when they came out they at least were only officially supported on ASRock Rack motherboards. That doesn't seem to be the case anymore, or I'm just entirely misremembering.
They do still seem to have the standard ASRock Rack problem of being very interesting to "homelab" and other small volume users but not exactly straightforward to obtain. No one who'll let me buy a single unit brand new has them in stock.
Definitely set an auto-notify on Newegg now that I know they work with generic motherboards, though it's a fair bit more expensive than a NanoKVM it's a lot more appealing to me to actually be a complete standalone internal device that doesn't rely on external wiring to function. The various "PCIe" versions of the PiKVM and its ilk still require an external HDMI connection and sometimes even external power.
I was aware of these but I could have sworn when they came out they at least were only officially supported on ASRock Rack motherboards. That doesn't seem to be the case anymore, or I'm just entirely misremembering.
They do still seem to have the standard ASRock Rack problem of being very interesting to "homelab" and other small volume users but not exactly straightforward to obtain. No one who'll let me buy a single unit brand new has them in stock.
Definitely set an auto-notify on Newegg now that I know they work with generic motherboards, though it's a fair bit more expensive than a NanoKVM it's a lot more appealing to me to actually be a complete standalone internal device that doesn't rely on external wiring to function. The various "PCIe" versions of the PiKVM and its ilk still require an external HDMI connection and sometimes even external power.
FWIW, Newegg is, in fact, where I got mine. It was definitely a matter of waiting some time to see it get in stock. If theres a way to track historical restocking rates/timing on newegg & other sites, that would be really handy to hae, but I haven't looked into it. That's definitely a real supply problem if you're not a big integrator ordering items by the pallet.
That card is beast! The list of internal connectors is incredible. To my eyes, 200 USD looks cheap for all of those features.
M.2 A or E might be better for this actually. A lot of boarda have slots for wifi/bluetooth with PCIe and USB. Would need a cable to a panel mount network jack and to pull in the front panel switches.
I've been thinking about this, using the tang mega FPGAs, but it's kinda hard as a software guy
I have had the same thought but I'm a networking guy who occasionally plays a software guy so I am even further out of my depth. Also I hadn't been able to find any FPGAs that had PCIe and weren't absurdly expensive with a half dozen other high speed I/O ports this wouldn't need. The Tang Mega series does look interesting though.
Basically like Dell's old DRAC boards. They used to do exactly that.
> Looks like the pcie slot is just used for power?
That's what they claim. Until another binary closed source firmware upgrade arrives, of course.
That's what they claim. Until another binary closed source firmware upgrade arrives, of course.
On a PCIe socket, the first part is power and the rest is data. Their product photos show a card that only touches the power pins.
So we can eliminate the risk of PCIe being exposed, nice. That's the best approach.
One the one hand adding radios (WiFi, LTe) to KVM over IP device sounds tempting on the other hand given the track record of KVM over IP devices it sound terrifying to give them the ability of bypass points of policy enforcement.
so true.
and all those things are another OS which you have zero visibility or control, but have to manage just like a production server. there's probably tons of ipmi backdoors all over the place and nobody cares much besides limiting routing to some lan.
and all those things are another OS which you have zero visibility or control, but have to manage just like a production server. there's probably tons of ipmi backdoors all over the place and nobody cares much besides limiting routing to some lan.
So have they released a kernel yet, or nah?
Their updater for the standalone unit has all sorts of bug reports.
I cannot figure out how these manufacturers can produce such nice hardware and such horrible software. And repeatedly, repeatedly miss the mark on understanding how important kernel/OSS releases are.
Their updater for the standalone unit has all sorts of bug reports.
I cannot figure out how these manufacturers can produce such nice hardware and such horrible software. And repeatedly, repeatedly miss the mark on understanding how important kernel/OSS releases are.
My cynical view: Because the software is more difficult to create/maintain than hardware.
Is there a version with a three (or even four) port VLAN capable switch? One port for the BMC, one looped back into the normal NIC and one (or two) upstream ports? Of course it would require a full height PCI bracket, but it would be perfect for colocated servers (no additional space or power requirements) and maybe cheap enough for budget hosters to offer as a reasonably priced KVM option.
It would also be interesting to make the PCIe card a good enough NIC (please use an effectively universally supported chip) to avoid the loopback cables.
About 99% of the time I want console access I would vastly prefer a proper serial port (≥115200 baud, 8N1, hardware flow control and break condition). Make that and power control (status, on, off, warm reset, cold reset) available via SSH over WireGuard. If done well it requires a lot less bandwidth and is more snappy. While I'm wishing for things please add mosh too ;-).
It would also be interesting to make the PCIe card a good enough NIC (please use an effectively universally supported chip) to avoid the loopback cables.
About 99% of the time I want console access I would vastly prefer a proper serial port (≥115200 baud, 8N1, hardware flow control and break condition). Make that and power control (status, on, off, warm reset, cold reset) available via SSH over WireGuard. If done well it requires a lot less bandwidth and is more snappy. While I'm wishing for things please add mosh too ;-).
For what it's worth, the "right" way to handle this is NCSI, which allows a management interface to piggyback on the host's NIC:
https://en.wikipedia.org/wiki/NC-SI
Unfortunately, support for NCSI can't be added to most motherboards; it requires the NIC to support it.
https://en.wikipedia.org/wiki/NC-SI
Unfortunately, support for NCSI can't be added to most motherboards; it requires the NIC to support it.
I have the standalone unit and other than the painfully slow 100mbit Ethernet that's too slow to upload ISOs and which also doesn't work with many modern switches - it's really nice for the price.
The problem with a pcie one for me is that modern motherboards suffer from having hardly any PCIe ports - and when they do they're mashed in close to each other essentially making one useless if you have a decent GPU.
The problem with a pcie one for me is that modern motherboards suffer from having hardly any PCIe ports - and when they do they're mashed in close to each other essentially making one useless if you have a decent GPU.
I run this in a 1u rack. Rather than mess with a pcie riser, you can power the kvm via an internal USB header from the motherboard to the kvm USB header directly for both power and HID.
From the article “It would be laughable to argue the low-end SG2002 AI SoC poses a threat to any country…”
I can see a great deal of trouble capable of coming from a networked device capable of watching the screens 24x7 and potentially intercepting passwords being entered. And those are the legitimate functions for this device. Wouldn’t take much to throw a reverse shell for external access if you wanted to be particularly nefarious.
Not saying there’s any evidence this kvm is malicious. But I probably wouldn’t put it in anything more than one of my toy home lab servers.
I can see a great deal of trouble capable of coming from a networked device capable of watching the screens 24x7 and potentially intercepting passwords being entered. And those are the legitimate functions for this device. Wouldn’t take much to throw a reverse shell for external access if you wanted to be particularly nefarious.
Not saying there’s any evidence this kvm is malicious. But I probably wouldn’t put it in anything more than one of my toy home lab servers.
I was worrying about typical Chinese cloud you cannot turn off (seems to be present on all cheap IP cameras), but this device is actually pretty good.
For remote access, there is no cloud. But you can BYO tailscale or FRP [0] (note: I really like the FRP idea, as it's trivial to self-host)
For updating, there is a central server. But at least the process seems to be manually-initiated [1].
I am not saying the firmware is backdoor-free, but at least it would be feasible to monitor/block all outgoing network connection attempts, and still have a functional device.
[0] https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/network/tail...
[1] https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/system/updat...
For remote access, there is no cloud. But you can BYO tailscale or FRP [0] (note: I really like the FRP idea, as it's trivial to self-host)
For updating, there is a central server. But at least the process seems to be manually-initiated [1].
I am not saying the firmware is backdoor-free, but at least it would be feasible to monitor/block all outgoing network connection attempts, and still have a functional device.
[0] https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/network/tail...
[1] https://wiki.sipeed.com/hardware/en/kvm/NanoKVM/system/updat...
Speaking of cameras, I got some Reolink cameras for $40 and they're great. I run then on a wifi that has no internet access, but which I can access through Tailscale, and all functionality works (except notifications, obviously), as the cameras have a LAN only mode.
About this KVM, I really like the Tailscale access ability, though I'm worried about the binary blob.
About this KVM, I really like the Tailscale access ability, though I'm worried about the binary blob.
For FRP do you mean https://github.com/fatedier/frp?
You can selfhost the control server, look at headscale, all the clients support this.
Are there feasible open alternatives to this closed-source blob? The fundamental capabilities seem nice, on paper.
Also, is there Windows / Mac compatibility?
Also, is there Windows / Mac compatibility?
They are open sourcing it apparently. At least they promised.
And yes it works fine on windows. I've got one. Haven't tried it on Mac yet though.
And yes it works fine on windows. I've got one. Haven't tried it on Mac yet though.
> At least they promised
Would you count on a Chinese supplier fulfilling their promise given the past history of relationships with open source?
Would you count on a Chinese supplier fulfilling their promise given the past history of relationships with open source?
This is a great device but I can't imagine giving so much power and control to a closed-source, self-updating device.
They opened the standalone unit, assuming this will be also?
i'm using one of the pcie ones right now, it's pretty nice.
uses exactly the same firmware image as the little usb ones. i also have one of the "full" and "mini" usb ones.
have connected it to the motherboard headers for power, reset, leds etc... including usb directly to motherboard header. documentation is pretty decent, was quite easy.
would still be better if it contained a usb hub on the pcie port, but they've basically just modified their existing design for poe/pcie power in addition to the preexisting usb, and slapped it on a card.
uses exactly the same firmware image as the little usb ones. i also have one of the "full" and "mini" usb ones.
have connected it to the motherboard headers for power, reset, leds etc... including usb directly to motherboard header. documentation is pretty decent, was quite easy.
would still be better if it contained a usb hub on the pcie port, but they've basically just modified their existing design for poe/pcie power in addition to the preexisting usb, and slapped it on a card.
Hey, billions of people use Windows and Mac OS.
But billions of people don't use Sipeed NanoKVM that gets an OOBM access to critical infrastructure
Don't buy. Their standalone hardware unit has lots of hardware ground issues.
Dumb question maybe, but what does this thing do?
Edit - ChatGPT to the rescue:
> KVM over IP (Keyboard, Video, Mouse over Internet Protocol) is a hardware solution that allows administrators to remotely access and manage servers and other devices at the BIOS level, even when the operating system is not running. It provides complete remote control, enabling tasks like system reboots, troubleshooting, and OS installations as if you were physically present with the machine.
Edit - ChatGPT to the rescue:
> KVM over IP (Keyboard, Video, Mouse over Internet Protocol) is a hardware solution that allows administrators to remotely access and manage servers and other devices at the BIOS level, even when the operating system is not running. It provides complete remote control, enabling tasks like system reboots, troubleshooting, and OS installations as if you were physically present with the machine.
Apparently it's the Bitmain cryptominer folk? Nice context from Tom's.
https://www.tomshardware.com/tech-industry/artificial-intell...