I’m trying to resolve power on\off\sleep issues in my brother in law’s Asus X510UQR laptop that runs windows 10 x64. He claims the issues started after a failed windows update (he doesn’t use the laptop much, so it maybe an old update).
The symptoms are very slow boot - when pressing the power on button, the screen is blank for a minute or two until it gets to the ASUS logo, and then another minute until it shows the spinning wheel and the windows logon screen. The same when powering off - it takes a minute or two to get the system turned off. Also, the following error message appeared after the ASUS logo was shown - “(A7) Me FW Downgrade - Request MeSpiLock Failed”.
Unfortunately, I worked on it yesterday late at night and didn’t document my progress too well… I’ll try to describe my progress to the best I can. After reading a bit online, I figured this may be related to the Intel Management Engine. I installed the Intel MEI Driver v11.7.0.1069 Drivers. I was able to run the MEInfo tool, but it didn’t finish running (got stuck without terminating, and only half the output was shown). The BIOS version was 300. I upgraded it to 302 using the update utility in the BIOS but it didn’t solve the issue. I read here that Asus doesn’t embed the ME firmware in the BIOS images on their site, so it makes sense. However, it got things a bit worse - The Intel Management Engine Interface device on device manager disappeared, and running MEInfo resulted in a communication error. I rolled back the BIOS to 300 and it worked again.
I think that at some point then, the system somehow started to behave correctly. I was also able to run MEInfo without errors or hangs. I also successfully took a dump using FPT, but I have lost this dump later on I then proceeded to update windows (thinking I need to get this done anyway to consider everything “fixed”). The KBs are: KB4458469 and KB4100347 (Later discovered its related to Intel micro-code stuff. Hmmm…). Installation failed with SYSTEM_PTE_MISUSE BSoD when trying to boot after the update. Windows then rolled back the updates and booted fine. I then updated the BIOS again to 302, and then I updated windows again. This time successfully. However, the Intel Management Engine Interface disappeared again. Rolling the BIOS back to 300 didn’t help this time.
So, right now the system misbehaves as before, but windows is fully updated. I’m at BIOS version 300. The Intel Management Engine Interface device is gone, and also the Trusted Platform Module 2.0 device is failing to start with error code 10: "A protocol error was detected between the driver and the device."
Despite all of the above, I’m able to dump the SPI chip without errors using FPT! Therefore it seems that the SPI is unlocked(?). ME Analyzer spits this output (and error) on the dump:
╔══════════════════════════════════════════╗ ║ ME Analyzer v1.61.1 r139 ║ ╚══════════════════════════════════════════╝
╔═════════════════════════════════════════════╗ ║ dump.bin (1/1) ║ ╟─────────────────────────┬───────────────────╢ ║ Firmware Family │ CSE ME ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware Version │ 11.7.0.3290 ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware Release │ Production ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware Type │ Region, Extracted ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware SKU │ Consumer LP ║ ╟─────────────────────────┼───────────────────╢ ║ Chipset Stepping │ C0 ║ ╟─────────────────────────┼───────────────────╢ ║ Security Version Number │ 1 ║ ╟─────────────────────────┼───────────────────╢ ║ Version Control Number │ 193 ║ ╟─────────────────────────┼───────────────────╢ ║ Power Down Mitigation │ No ║ ╟─────────────────────────┼───────────────────╢ ║ Lewisburg PCH Support │ No ║ ╟─────────────────────────┼───────────────────╢ ║ Production Version │ Yes ║ ╟─────────────────────────┼───────────────────╢ ║ OEM Unlock Token │ No ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware Date │ 2017-05-24 ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware Size │ 0x1BF000 ║ ╟─────────────────────────┼───────────────────╢ ║ Flash Image Tool │ 11.7.0.1292 ║ ╟─────────────────────────┼───────────────────╢ ║ Chipset Support │ SPT/KBP ║ ╟─────────────────────────┼───────────────────╢ ║ Firmware Latest │ No ║ ╚═════════════════════════╧═══════════════════╝
Error: Detected CSE Extension 0x03 with wrong Partition Hash at FTPR > FTPR.man!
If I understand things correctly, this dump can be cleaned up, and then flashed back to the chip, fixing the messed up state of the IME. Also, I think it would be wise to ensure that what I flash back is fully unlocked, so if the IME is fully operational again, I will still be able to mess with it. I have seen that on offset 0x80 of the dump it’s not exactly 0xFF over there, as suggested in the unlock guide. Would love to get some help and\or confirmation on this.
Thank you very much! (Sorry for the super long post…)
Thank you for the detailed report on the problem. From your dump I can see that the Platform Trust Technology (PTT) module which handles TPM is corrupted for some reason:
Thank you for the super fast reply!! I have already prepared the fixed dump file, and will now work on unlocking the SPI for writing. However, I will not do anything physical to the computer, as it is still under warranty. Can you suggest a specific unlock method for my configuration that doesn’t involve opening up the laptop?
The non-hardware invasive methods are E3, E4, E5 and E6. The first two (E3 and E4) are not applicable to this case so that leaves E5 and E6. The easiest and safest is E5 but it’s also the most unlikely to be present, who knows though. Then E6 but it’s success is hit & miss. Generally, if you can use the warranty, do so. Certainly try E5 and maybe E6 first.
I tried to proceed with E5 - went over the different menus of the BIOS. There are very few of them - it is VERY basic, even when entering “Advanced mode”. I also downloaded and over-viewed the laptop’s user manual, and indeed it reveals nothing interesting about the BIOS (or at all).
So, I went on with E6. I was able to find the “Me FW Image Re-Flash” variable. Tried to use the EFI shell to change it to 0x1 (Enabled) but it didn’t work. In fact, I got the same error (“error: offset is out of range…”) as the guy in the other thread got here: ASUS GL552VW boot issue after ME FW update
Do you have an idea of how to proceed from here? Thank you very much! Your support is really outstanding!
Can you try E6 with the efi executable called “AMISetupWriter” from here? The offset and value are of course the same as the ones you found at your BIOS IFR, only the utility is different (not grub).
Okay, it didn’t work. Here is what I did, please let me know if it was correct:
I extracted the contents of the Boot_Shell_AmiSetupWriter.rar archive into a flash drive. Booted the laptop from it. Got a shell. Here is a console screenshot showing my operations there:
Then I just typed ‘exit’, booted windows, and executed the following:
--- Flash Devices Found --- W25Q64FV ID:0xEF4017 Size: 8192KB (65536Kb)
Unable to detect ME disabled. Do you wish to proceed with the flash write operation? Y/<N> or q to quit : y
GbE Region does not exist.
Error 451: The host CPU does not have write access to the target flash area. To enable write access for this operation you must modify the descriptor settings to give host access to this region. FPT Operation Failed.
Clearly, it didn't work :( One thing I noticed is that when I typed 'exit', I got back to the BIOS screen (I booted to the flash drive from it). I then exited the BIOS without saving settings (ESC + Enter). However, maybe this has somehow still changed the NVRAM and "sabotaged" our little operation?...
Anyway, any ideas on how to proceed?.. As always, thank you very much!
I left the laptop running after the last attempt. Since it got into sleep mode and I could not wake it up, I had to forcefully shut it down (long press the power button). Then, when it booted up, I noticed immediately that it doesn’t hang when powering up! I immediately suspected that after I had changed the “Me FW Image Re-Flash” BIOS variable, it wasn’t actually loaded by the BIOS, as I only “soft rebooted” rather than having a full power cycle (if you remember, I just typed ‘exit’ in the EFI shell, and then also exited the BIOS). I think that completely shutting the machine down, and then powering it up again, caused the BIOS to actually load the new setting.
Then, when Windows booted, I proceeded to flashing the fixed image. Unsurprisingly, attempting to flash the entire SPI chip failed (BIOS region was not writable, but I wanted to try). However, flashing only the ME region worked like a charm!! Here is the complete session:
Afterwards, I continued with the 'FPTW64.exe -greset' command. When the machine booted up again, the Intel Management Engine Interface device appeared again in the device manager, and also the Trusted Platform Module 2.0 device started working again! MEInfo command worked like a charm, and everything seems to be fine now!
I also booted back the EFI shell to turn off the "Me FW Image Re-Flash" setting, but apparently it turned itself off again (probably after post-flash reboot).
Then, I proceeded to update the BIOS to version 302 again. Why not... It went on smoothly.
Now, I wonder whether to update CSME to latest version using FWUpdLcl64.exe, and the 'Intel CSME Firmware v11.8.55.3510 (CON LP)' firmware. What do you think? Is it recommended, or should I just leave everything as it is?
And last but not least, thanks a million!!! You have saved me so much trouble, and I have also learned a lot. You sir are a true master!
Ah perfect. Yes, that’s why the instructions say to manually/forcefully restart the platform. A full re-boot in needed for the option to take effect as the BIOS needs to load again for its option to do the trick. What’s interesting here is that the AMISetupWriter utility works much better than grub so, at least for AMI BIOS, I will have to change the instructions and advise people to use that tool instead. Now that your CSME firmware is healthy again, you can update to the latest 11.8 Consumer LP NPDM via FWUpdate tool. You could have also just picked the latest firmware during the CleanUp Guide instead.
Just wanted to report that I have successfully completed the FWUpdate firmware update. All went well. I also had to re-key, so I followed the instructions to do so. The instructions specify to run MESetup.exe with the -nodrv flag. I guess this caused the drivers themselves to not update. Device manager showed that drivers version was still old. Therefore, after the re-keying process was successful, I removed the drivers and re-installed just by double click, to get them updated. It worked. I guess its possible to just omit the -nodrv flag to avoid the hassle? I’m not sure. Didn’t want to test.
Regarding the force-reboot when following the “AMISetupWriter” guide - maybe I missed it, but I think it wasn’t mentioned. Anyway, I think it is worthwhile to emphasize it in the guide, just in case . Edit: Just realized you were referring to the instructions in the E6 section of the unlock guide, and not in @SoniX guide. So you are right - it is mentioned. Still, it is important to clearly state that “soft-reboot” is not enough (like what I did - exit BIOS without saving settings. This only “soft-reboots” the system).
Again, thank you very much for your support and patience.
