Group: Hardware/Restrictions/anti-freedom/Intel Management Engine

== TODO ==
This article has been imported from the [https://www.coreboot.org/Intel_Management_Engine old Coreboot wiki page on the Management Engine].

* Clean it up

== Uses of the Management Engine ==
The Intel Management Engine (abbreviated "ME") is a CPU which:
* permits [https://en.wikipedia.org/wiki/Out-of-band_management out of band management] of the computer. See the [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology#Using_Intel_AMT Wikipedia AMT article] for example use cases.
* on recent versions:
** initializes the hardware, before the boot firmware(BIOS/EFI/UEFI/Coreboot/etc...).
** DRM
** TPM
** Other applications

== Freedom and security issues ==

* The code that is running inside the management engine is proprietary and signed. Therefore, it cannot easily be audited, tested, or replaced, except by those people with access to the relevant private keys, i.e. a handful of Intel staff (and possibly government agents).
* The ME has access to a lot of things, see "physical capabilities" column below for more details.
* In addition to obvious attack vectors (the ME could be used by an adversary to spy on the PC user, tamper with their documents, etc), it could also potentially be used to alter the contents of the motherboard's BIOS flash chip, thereby polluting Coreboot builds based upon extracting the contents of that flash chip.

== Versions ==
{| class="wikitable"  border="1"
! ME firmware version
! Microarchitecture
! Chipset
! AMT versions
! ME firmware versions
! Applications
! Location
! Required modules
! Bit
|-
| N/A (ME predecessor)
| 
| ICH7
| 1.0
|
|
* AMT
| 82573E Gigabit Ethernet Controller<ref name=amt-versions>https://en.wikipedia.org/wiki/Intel_AMT_versions</ref>
| rowspan="3" | None
| rowspan="3" | ?
|-
|
|
|Q963<ref name=amt-versions/>
| 2.0
|
|
* AMT
|-
|
|
|Q965<ref name=amt-versions/>
| 2.0
| 3.0<ref name=ark-DQ965GFE>https://ark.intel.com/products/41972/Intel-Desktop-Board-DQ965GFE</ref>
|
* AMT
* No TPM
|-
|-
|
* 6.0<ref name=Silent-Bob-is-Silent>https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075</ref>
* 6.1<ref name=Silent-Bob-is-Silent/>
* 6.2<ref name=Silent-Bob-is-Silent/>
| 1st Gen Core:<ref name=Silent-Bob-is-Silent/>
* Nehalem?
* Other?
|
|
|
|
|
| rowspan="6"|
* BUP<ref name=me_cleaner-how-does-it-work>https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F</ref>
| rowspan="6"|
* AltMeDisable<ref name=me_cleaner-HAP-AltMeDisable-bit>https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit</ref>
|-
|
| Nehalem<ref name=intel-5-series>https://en.wikipedia.org/wiki/Intel_5_Series#Ibex_Peak</ref>
| Q57
| 6.0<ref name=amt-versions/>
| 6.0, 6.1 <ref name=ark-q57>https://ark.intel.com/products/42706/Intel-Q57-Express-Chipset</ref>
|
|-
|
* 7.0<ref name=Silent-Bob-is-Silent/>
* 7.1<ref name=Silent-Bob-is-Silent/>
| 2nd Gen Core<ref name=Silent-Bob-is-Silent/>
|
|
|
|
|
|-
|
* 8.0<ref name=Silent-Bob-is-Silent/>
* 8.1<ref name=Silent-Bob-is-Silent/>
| 3rd Gen Core<ref name=Silent-Bob-is-Silent/>
|
|
|
|
|
|-
|
* 9.0<ref name=Silent-Bob-is-Silent/>
* 9.1<ref name=Silent-Bob-is-Silent/>
* 9.5<ref name=Silent-Bob-is-Silent/>
| 4th Gen Core<ref name=Silent-Bob-is-Silent/>
|
|
|
|
|
|-
|
* 10.0<ref name=Silent-Bob-is-Silent/>
| 5th Gen Core:<ref name=Silent-Bob-is-Silent/>
* Broadwell
* Other?
|
|
|
|
|
|-
| 
* 11.x<ref name=me_cleaner-how-does-it-work/>
| Skylake
|
|
|
|
|
| rowspan="3"|
* RBE
* BUP
* KERNEL
* SYSLIB<ref name=me_cleaner-how-does-it-work/>
|
* HAP<ref name=me_cleaner-HAP-AltMeDisable-bit>https://github.com/corna/me_cleaner/wiki/HAP-AltMeDisable-bit</ref>
|-
|
* 11.0<ref name=Silent-Bob-is-Silent/>
| 6th Gen Core<ref name=Silent-Bob-is-Silent/>
|
|
|
|
|
|-

|-
|
* 11.5<ref name=Silent-Bob-is-Silent/>
* 11.6<ref name=Silent-Bob-is-Silent/>
| 7th Gen Core<ref name=Silent-Bob-is-Silent/>
|
|
|
|
|
|}

== Where ==
{| class="wikitable"  border="1"
! Board
! Firmware
! Microarchitecture
! ME location and physical capabilities
! ME restrictions
|-
| Lenovo X60/X60s/X60T
| rowspan="2"| None. <ref name="nic-amt">The Ethernet controller is capable of running some fimrwares( like [https://en.wikipedia.org/wiki/Intel_AMT_versions#Versions AMT 1.0]), but the hardware is not configured to do it on that machine. So no firmwares are loaded. See [[Intel_82573_Ethernet_controller]] for more details.</ref>
| rowspan="2"| I945 + ICH7
| rowspan="2"|
* Inside the ethernet controller, disabled: no Ethernet controller fimrware. <ref name="nic-amt"></ref>
| rowspan="2"|
* Disabled: No Ethernet controller fimrware. <ref name="nic-amt"></ref>
|-
| Lenovo T60
|-
| [[Board:lenovo/x200|Lenovo x200]]
| Me firmware with [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology AMT] and other modules
| rowspan="1" | GM45/GS45
| rowspan="15" |
The ME is inside the [https://en.wikipedia.org/wiki/Platform_Controller_Hub PCH], it:
* Has access to the computer's memory/RAM
* Controls the computer's original networking adapters 
| rowspan="1" | 
* Signed firmware
* The ME can be disabled (no Firmware is run by it).
|-
| [[Board:lenovo/x201|Lenovo x201]]
| Me firmware with [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology AMT] and other modules
| rowspan="2" | [https://en.wikipedia.org/wiki/Nehalem_%28microarchitecture%29 Nehalem]
| 
* Signed firmware
* If ME firmware is absent, the computer freezes about 30min after boot.
|-
| [[Board:packardbell/ms2290|Packard Bell EasyNote LM85 (MS2290)]]
| ?
| 
* Signed firmware
|-
| [[Board:samsung/lumpy| Samsung Series 5 550 Chromebook]]
| [http://review.coreboot.org/gitweb?p=blobs.git;a=tree;f=mainboard/samsung/lumpy;h=b4c159f20789c0eacdf5a25135a3275d277cf256;hb=HEAD me.bin]
| rowspan="3" | [https://en.wikipedia.org/wiki/Sandy_Bridge_%28microarchitecture%29 Sandy Bridge]
| rowspan="3" | 
* Signed firmware
|-
| [[Board:samsung/stumpy|Samsung Series 3 Chromebox]]
| [http://review.coreboot.org/gitweb?p=blobs.git;a=tree;f=mainboard/samsung/stumpy;h=ede43b2bda02cd574646e16cdd224b1d0ffad786;hb=HEAD me.bin]
|-
| [[Board:lenovo/t520| Lenovo t520]]
| Me firmware with [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology AMT] and other modules
|-
| [[Board:google/butterfly| Google/HP Pavilion Chromebook 14]]
| [http://review.coreboot.org/gitweb?p=blobs.git;a=tree;f=mainboard/google/butterfly;h=8b288bd915906a18379718be4b6080a3fd2cc554;hb=HEAD me.bin]
| rowspan="7" | [https://en.wikipedia.org/wiki/Ivy_Bridge_%28microarchitecture%29 Ivy Bridge]
| rowspan="7" | 
* Signed firmware
|-
| [[Board:google/link|Google Chromebook Pixel]]
| [http://review.coreboot.org/gitweb?p=blobs.git;a=tree;f=mainboard/google/link;h=ea8c42b0890aee9b2e20bd2c10edab547d4d69c5;hb=HEAD me.bin]
|-
| [[Board:google/parrot|Google/Acer C7 Chromebook]]
| [http://review.coreboot.org/gitweb?p=blobs.git;a=tree;f=mainboard/google/parrot;h=880f5e52eadb1af9ab3cce568e70770682780383;hb=HEAD me.bin]
|-
| [[Board:google/stout|Google/Lenovo Thinkpad X131e Chromebook]]
| [http://review.coreboot.org/gitweb?p=blobs.git;a=tree;f=mainboard/google/stout;h=73defa57f190949004ef85942c403136726c5c6a;hb=HEAD me.bin]
|-
| [[Board:lenovo/t530| Lenovo t530]]
| Me firmware with [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology AMT] and other modules
|-
| [[Board:lenovo/x230| Lenovo x230]]
| Me firmware with [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology AMT] and other modules
|-
| [[Board:kontron/ktqm77| Kotron KTQM77/mITX]]
| ?
|-
| [[Board:google/peppy|Google/Acer C720 Chromebook]]
| ?
| rowspan="2" | [https://en.wikipedia.org/wiki/Haswell_%28microarchitecture%29 Haswell]
| rowspan="2" |
* Signed firmware
|-
| [[Board:google/falco| Google/HP Chromebook 14]]
| ?
|-
|}

== Reducing harm without fixing the issue ==
* There are several versions of the Management Engine OS for a given Management Engine hardware. Smaller versions can contain less code.
* me_cleaner can remove some of the Management Engine OS code.

However none of the above fixes the fact that nonfree code runs on hardware that has too many capability and that is meant to remove users control of their computer.

== Research on removing the Management Engine OS ==

=== Removing the ME partition on platforms earlier than GM45 ===

It's probably possible to remove the ME or AMT partitions on chipset before GM45 simply by not using the flash partition table.

=== Removing the ME partition on GM45 ===

On The GM45 Chipset, the flash partition table can be configured to not have any ME partition. So it's possible to remove the ME firmware completely.

Though the ME probably has a bootrom, which probably hasn't been dumped for the GM45.

=== Removing the ME partition on post-GM45 ===

Some computers, with more recent chipsets than GM45 are able to boot with the ME partition removed:
* There are some interesting bug reports in the [https://github.com/corna/me_cleaner/issues me_cleaner bug tracker]. Some people have removed the Management Engine OS on computers with chipsets more recent than GM45, but Coreboot hasn't been ported yet on such computers.
* There is a [https://www.win-raid.com/t2443f39-Guide-Disable-amp-Remove-Intel-Ibex-Peak-ME-Ignition-firmware.html report of removing the Management Engine OS] for an asus P55 Extreme, again Coreboot hasn't been ported yet to the computer.

To be added to Libreboot a computer would need at least:
* To be supported in Coreboot or other boot software (u-boot, etc)
* To be usable without nonfree software, like the CPU microcode
* Not to have hardware issues that are only fixable from within the Management Engine: On GM45 Chipsets the method to remove the Management Engine firmware was supported by Intel even if it wasn't very well known publicly, before being used in free software projects.

=== When code on the Management Engine is strictly required to boot ===

All the following research and attempts would in addition need someone to write free software code running inside the Management Engine to boot the computer.

It's still unknown how much work this could be.

==== DCI ====

It is possible to get JTAG through what is called DCI. 

The idea is that it may enable to create modchip-like computers to boot recent Intel computers.

However, last time I checked using DCI still require:
* Nonfree software to be dowloaded from Intel website in trial version. The DCI / red unlock would need to be reimplemented as free software.
* Another similar Intel computer to run that software. This also need to be replaced with USB3 SBC, or FPGA but the protocol that is on the modified USB cable is still unknown at this point.

It might also be used to understand more the Intel platforms, dump the ME bootrom? and find ways around the code signature?

==== GPIO33 / HDA? ====

On GM45, the GPIO33 location is known on the Thinkpad X200. 

What really happens when this pin is grounded?

Does it also disable code signature on the Management Engine?

What happens between the different ME generations?

== Upstream sustainability ==

Coreboot is removing many boards from new revisions of Coreboot. 

Boards are typically removed because they weren't converted in time to new frameworks.

The issue is that one needs to already be involved in Coreboot development and follow very closely the mailing list, and what is happening to catch that early enough.

You could have less than one month to convert the code, if you don't catch it in time, especially because you are not contacted. It's up to you to follow what hapening upstream.

While this lower the maintenance burden, as the maintainers don't need to care about converting the older code to the new frameworks, we also need to take it into account when deciding which computers to focus work on.

Here's what I know on that so far:
* The MAINTAINERS file has maintainers for specific computers. If a computer is maintained we probably have good enough assurance that it'll stick around.
* It's possible to pay some companies to do the maintenance work, but I don't have much information on that yet.

=== Why does that matters ===

While Coreboot itself is not FSDG compliant and expect users to download and use nonfree software for being able to use it on many computers, it's still interesting to have code maintained there.

This then enables FSDG compliant Coreboot distributions like Libreboot or the deblobed versions of Coreboot published as part of the RYF initiative, to still be able to benefit from new developments and bugfixes upstream.

It also enables to build virtuous circles between non-FSDG compliant projects like Coreboot and downstream projects, where code can be maintained by the upstream project, even if the computers can't meet the RYF certification.

The x86 RYF laptops were made possible thanks to that kind of relationship: The fully free GPU initialization code was made by Ron Minnich for the Chromebook Pixel, which is a computer that is fatally flawed as it cannot even boot with free software as it requires a nonfree Management Engine firmware to boot. This code was then reused to get a fully free GPU initialization in Coreboot for the Thinkpad X60. Coreboot (once deblobbed) was then used to create Libreboot and make the first RYF laptops certified.

As compilers evolve, it's also important to still be able to build the source code without having to build very old compilers.

== See also ==
* [https://en.wikipedia.org/wiki/Intel_Active_Management_Technology The Wikipedia article on the Intel AMT]
* [https://en.wikipedia.org/wiki/Intel_AMT_versions The Wikipedia article on the Intel AMT versions]
* http://me.bios.io/ME:About
* http://me.bios.io/ME
* [https://github.com/skochinsky/papers/raw/master/2014-10%20%5BBreakpoint%5D%20Intel%20ME%20-%20Two%20Years%20Later.pdf Igor Skochinsky Paper very good and detailed presentation about ME]
* [http://io.netgarage.org/me/ decompress ME v6.x through ME v10 (prior to skylake)]
* [http://blog.ptsecurity.com/2017/08/disabling-intel-me.html Disabling Intel ME 11 via undocumented mode]
* [http://flashrom.org/ME The respective flashrom page]

== References ==
<references/>

[[Category:Blobs|Blobs]]