# Intel platforms
Over the years and decades, Intel has developed many hardware platforms[^14].
Since the 4-bit 4004 in 1971, they have progressed over 8-bit up to 64-bit
systems, retaining a lot of backwards compatibility. Starting with the ICH7
based platforms, Intel introduced their AMT (Active Management Technology)[^15],
an out-of-band management solution[^1] for remote provisioning and support.
AMT evolved with more features over time, carrying the vPro label for machines
targeting the business market[^16] and finally converging with more security
features such as Boot Guard[^2], Intel's secure boot implementation, digital
content protection (DRM), and more[^20].
Now running on a coprocessor called the (Converged Security and) Manageability
Engine[^3], or (CS)ME for short, henceforth abbreviated as _ME_, a full second
operating system of its own is backing the platform.
## Boot flow
The ME has its own firmware and bootstraps an Intel platform[^19]. The main x86
cores are held in reset until the ME releases them to boot with their own
firmware.
Both the ME firmware and the main x86 firmware are stored in the same flash part
on a mainboard, partitioned via the Intel Flash Descriptior (IFD).
The following diagram is based on knowledge from various sources, including the
[coreboot documentation on Intel](https://doc.coreboot.org/soc/intel/fit.html).
<img src="intel_flash_partitioning.png" width=40%>
The boot flow for trusted boot is documented publicly[^17] by Intel.
## ME classification and security
Security researchers have analyzed the ME[^18] and divided hardware variants
into 3 generations[^4] thus far, each with their own multiple firmware versions,
including security patch releases[^5][^6].
One core aspect in security research has been Boot Guard[^7][^8], which had
been introduced with Haswell, Intel's 4th generation Core series platforms[^10],
and discussed in the coreboot community[^11].
Note that the ME generations roughly correspond with the overall platform, in
that ranges of Intel platforms are expected to carry a certain ME hardware
generation and specific platforms a certain firmware version range. For example,
Lenovo ThinkPad X270 laptops came with 6th/7th gen Intel Core processors, which
means 3rd generation ME hardware and version 11.x.x.x ME firmware.
## Processor names
Intel publicly documents how to interpret procesor names[^12] and what their
suffixes mean[^13].
## Abbreviations
| ACM | Authenticated Code Module |
| AMT | Active Management Technology |
| CSME | Converged Security and Manageability Engine |
| DAL | Dynamic Application Loader |
| FIT | Firmware Interface Table |
| FPT | Firmware Partition Table |
| HAP | High-Assurance Platform |
| {I,M,P}CH | {I/O,Memory,Platform} Controller Hub |
| IFD | Intel Flash Descriptor |
| PTT | Platform Trust Technology |
| RBE | ROM Boot Extensions (part of ME firmware) |
| SPS | Server Platform Services |
| TXE | Trusted Execution Engine |
| TXT | Trusted Execution Technology |
### Ambiguities
There are colliding acronyms, even within this domain.
The following abbreviations have a second meaning:
- FIT: _Flash Image Tool_ (sometimes also called _FITC_)
- FPT: _Flash Programming Tool_
