Intel Management Engine

Uses of the Management Engine

The management engine(Often abreviated ME) is a CPU which permits Out of band management of the computer. See the Wikipedia AMT article for example use cases.

Freedom and security issues

• The code that is running inside the management engine is proprietary and signed
• The management engine CPU has access to a lot of things, see "ME physical capabilities" for more details.

Where

Board	Firmware	Microarchitecture	ME location and physical capabilities	ME restrictions
Lenovo X60/X60s/X60T	None. <ref name="nic-amt">The Ethernet controller is capable of running some fimrwares( like AMT 1.0), but the hardware is not configured to do it on that machine. So no firmwares are loaded. See Intel_82573_Ethernet_controller for more details.</ref>	I945 + ICH7	Inside the ethernet controller, disabled: no Ethernet controller fimrware. <ref name="nic-amt"></ref>	Disabled: No Ethernet controller fimrware. <ref name="nic-amt"></ref>
Lenovo T60
Lenovo x201	AMT	Nehalem	The ME is inside the PCH, it: Has access to the computer's memory/RAM Controls the computer's original networking adapters	Signed firmware If ME firmware is absent, the computer freezes about 30min after boot.
Packard Bell EasyNote LM85 (MS2290)	AMT?
Samsung Series 5 550 Chromebook	me.bin	Sandy Bridge	The ME is inside the PCH, it: Has access to the computer's memory/RAM Controls the computer's original networking adapters	Signed firmware
Samsung Series 3 Chromebox	me.bin
Lenovo t520	AMT
Google/HP Pavilion Chromebook 14	me.bin	Ivy Bridge	The ME is inside the PCH, it: Has access to the computer's memory/RAM Controls the computer's original networking adapters	Signed firmware
Google Chromebook Pixel	me.bin
Google/Acer C7 Chromebook	me.bin
Google/Lenovo Thinkpad X131e Chromebook	me.bin
Lenovo t530	AMT
Lenovo x230	AMT
Kotron KTQM77/mITX	AMT?
Google/Acer C720 Chromebook	?	Haswell	The ME is inside the PCH, it: Has access to the computer's memory/RAM Controls the computer's original networking adapters	Signed firmware
Google/HP Chromebook 14	?

Why there is no replacement for it yet

Replacing the ME firmware is not that easy because:

• The ME bootrom checks the firmware signature.
• On recent chipset its RAM reagion is locked while it is allocated.
• Power glitches(by the ec) while the ME is checking its firmware is probably not practically doable.

So even if some people partially documented some ME firmware format, there is very few probability of having a free software replacement for it one day.

Coreboot also support other systems than the ones with recent intel CPU/chipsets. The List of supported mainboard list some of them.

See also

• http://me.bios.io/ME:About
• http://me.bios.io/ME
• Igor Skochinsky Paper very good and detailed presentation about ME
• decompress ME v6.x (5 series / ironlake)

References

<references/>