# AMD PSP and Intel ME (or IME)



## Maelstorm (Jul 27, 2018)

How does FreeBSD handle this backdooring technology in AMD and Intel CPUs and chipsets?  I understand the need for it in an enterprise environment, but beyond that, if it can read files off the filesystem, does it understand FreeBSD's disk formats?  It seems that it can also access Ethernet traffic and the CPU L1 and L2 caches.  I did some research and it seems that AMD is allowing it to be disabled, but Intel only disables it for customers who have specialized requirements.

Since this is an integral part of many mainboards today, I asked this in the system hardware forum.


----------



## Crivens (Jul 27, 2018)

From the OS level, you can't do anything. You need to do things with evil hacks or your wallet. From the manufacturers view, things are turned. You are welcome to brick your system, but _how dare you never to buy our stuff again!_
I for one will not buy intel ever again. Or AMD, should it surface that the disable-psp button in the firmware does nothing.
I don't need x86 compatibility.


----------



## Maelstorm (Jul 27, 2018)

Intel has acknowledged that the HAP_Enable bit, when turned on, will disable ME after the main processor starts...but it can't be disabled completely because it has taken over some of the functionality of the southbridge.  Intel has also stated that this is not a valid or supported configuration.  AMD flat states that the BIOS setting will terminate their PSP after the main CPU boots.  I also found out that the CPU has rings -1 and -2 which the OS cannot see (It can only see the normal rings 0-3.) and those are used during the hardware initialization process.  I understand why someone would want this functionality.  I have a Sun Microsystems Sunfire T2000 server here (Sparc Platform) which uses AMT-ALO which is basically the same thing.  It allows me to run tests on the hardware, perform boot configurations, etc... all without turning the main system on.  It has its own Ethernet port and such, so it can be on a physically separate network (preferably one that is air-gapped) in a rack mount environment.


----------

