This Intel Management partition contains boot code for the Integrated Sensors Hub (ISH) and is digitally signed by the OEM.

This Intel Management block partition stores an OEM unlock token used to unlock debugging for the ME or Integrated Sensor Hub (ISH). This token is cryptographically signed by either the Intel private key or by an OEM private key, granting a level of access depending on which key was used. GREEN access is the default, when no UTOK is present and only allows TraceHub tracing and debug of the host CPU. ORANGE unlock allows debug of the Intel Sensor Hub, and RED unlock allows debugging the ME but will clear secrets from its memory before doing so.

This Intel Management partition provides a flash log that contains error and warning messages generated by ME modules, the data written here is a subset of the data output to the Tracehub.

This Intel Management partition provides translations for various AMT strings.

This Intel Management partition contains the Wireless LAN microcode.

This Intel Management partition is a code Non-Fault Tolerant Partition and provides additional code to the BUP. It is digitally signed by Intel.

This Intel Management partition stores a file system that contains ME-related data stored between runs. The low-level MFS implementation does not support file names or sizes. Files are identified by numbers.

This Intel Management encrypted block partition is used for “warm” start (like hibernate restoration) and is integrity protected with HMAC. It is unique for each platform (PCH-chip) and each boot.

This optional Intel Management partition stores the previous SVN (Secure Version Number) value and is used to calculate “previous security keys”. It must be impossible to install ME firmware with previous SVN without direct writing SPI Flash with chip programmer. Updates to the SVN causes alteration of related security keys. Having access to both “previous” and “current” keys allows migration of the MFS file system from old to new keys.

This Intel Management partition stores the IDLM module and is the only place (except ROM) where reading data from fuses is possible. The IDLM is signed with RSA-2048 and the owner of permitted RSA signing key can extract the HMAC key. The DLMP can overlap other partitions by design.

This Intel Management partition is a combination of the NFTP, WCOD and LOCL partitions.

This Intel Management partition is a Fault Tolerant Partition (FTP) code partition. Digitally signed processes of the correct type are started from this module, much like autorun. It is digitally signed by Intel.

UEFI firmware image viewer and editor