Crazy attempt at modding Intel AMT into a BIOS via FFS modules

Discussion in 'BIOS Mods' started by johnkeates, Mar 1, 2014.

  1. johnkeates

    johnkeates MDL Novice

    Oct 2, 2009
    #1 johnkeates, Mar 1, 2014
    Last edited: Mar 1, 2014
    Hi MDL People,

    I have a SuperMicro X10SLV-Q motherboard (Socket 1150, Xeon E3-1225 V3, Q87 Chipset, AMI EFI Firmware) which was supposed to have AMT (since it's vPro all the way), but it seems like it doesn't.

    Now, I'd settle for Standard Manageability (SoL, remote power control and remote BIOS), but not even that is supported in the BIOS.

    There are no BIOS upgrades, and only the one already flashed on the mobo is downloadable from the website.

    MMTool does seem to be able to open this BIOS, and so does AMIBCP. Looks like I'll be able to add the required modules and enable the BIOS menu entries...

    Since the chipset already has the ARC coprocessor embedded, this should only be a case of:

    - Adding MEBx extensions
    - Adding AMT modules
    - ????
    - PROFIT!

    To get those modules, I have found a board that is a lot like this one, except it has more DIMM slots, and is a bigger form factor. It has the same chipset, and from what I can see, very similar configuration. It's the X10SLQ. That one has AMT listed on the SuperMicro page as supported by default.

    I have already sent SuperMicro a support request, and I did a bit of research regarding the modules.

    From what I can find online and in the manuals, modules are supposed to be unique in their firmware volumes within the ROM, they need to be in the proper firmware volume (for the DRVR, FRFM, DXEC, RAW, PEIM, APPN, PEIC, SECC types) and should not be near the firmware volume that is required to POST successfully.

    Since I can get to the FFS files by extracting them from a very close sibling board with a very similar BIOS, I should be able to import them into the BIOS for my board, flash it, and have AMT, right?

    Looking at the Lynx Point (Q87) block diagrams, there is no component outside of the chipset that is needed for AMT to work, only the SPI line to the BIOS Flash chip containing the firmware.

    The MEBx configuration page is an OpROM on old style BIOSes, and on most EFI types they are an internal application like the Intel PXE OpROMs. After MEBx is configured, the AMT software just runs inside the Q87 chip on the ARC Coprocessor that is always there anyway.


    So, I did a bit of research on AMT 9.0 (which is what Q87 is supposed to support).
    It seems that all the required hardware for AMT is on the PCH/Chipset, and uses SPI to access the Flash ROM for it's firmware.
    Next, it required SMBus access and PCIe access to a vPro supported LAN controller.
    For RAM, it uses system RAM, like an IGP does.

    So we have:

    - a dedicated AMT CPU in the PCH/Chipset (that ARC Coprocessor)
    - firmware in Flash (compressed)
    - RAM (shared from main DIMMs)
    - I/O (via PCIe and SPI and I2C)

    This is like any regular Q87 setup, my board has all of the above, so the only thing that seems to be missing is the software bit... at least according to: ..

    If we look at it seems like this confirms my findings with various sources.

    Looking at the block diagram from intel:
    and a diagram from one implementation:
    it seems like those are indeed the connections that I can find in documentation and on my board.


    One 'but' arises... I have two Ethernet ports on my motherboard, a I217-V and a I210. The I217-V is specifically NOT capable of vPro according to ark @ intel. The I210 doesn't specify vPro or AMT at all.. so there is still hope.
    Looking at an older AMT spec page, a specific vPro supported network chip is required for AMT to work. They specify a I217-LM here: and a Clarksville 82579 LM is specified here: which leads me to believe an on-board LM-suffixed chip is required for AMT to work... bummer. Is this the end? I don't know. I'll do a bit more research I guess. Maybe I can just get Standard Manageability to work, that would be enough. But now, I'm not going to randomly flash a hacky firmware if it might not meet the requirements at all.

    And as always:

    Is there anyone here with ideas, pointers or more expertise on such things? Any thoughts?
  2. johnkeates

    johnkeates MDL Novice

    Oct 2, 2009
    So, after some more research, without an -LM NIC part, you cannot have AMT functionality, since the coprocessor won't be able to intercept packets from the ethernet interface.
    It appears to be a specific kind of communication between the ethernet chip and the AMT CPU that cannot be done with a standard NIC.

    I asked SuperMicro to comment on this, but no response so far.

    I guess the next stop for me is to interface a raspberry pi with the SMBus/LPC/I2C bus, hardware interface it with the power/reset/power led headers and use it as a BMC/LOM controller.

    I could even hook up 2 serial ports, redirect the BIOS to one serial port and the OS to another. Or, maybe load google's SGABios OpROM to make sure a serial BIOS interface is possible.