[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

[Kameaman]

Just want say, EC frimware with update tool from site and EC in BIOS from site are 100% same.

[L36]

Just tried that file, unfortunately same condition.

Fullimage SPI from MSI with change only BIOS section with your original dump.

Never heard of that utility. Also, how could I just flash the BIOS section of the chip?

[lfb6]

@L36

I did not go over every single line but from a my scan it looked identical.

fc /b will compare two binary files in a command window, HxD has a compare function…

(Certain places a single bit will make a difference)

@Kameaman

Fullimage SPI from MSI with change only BIOS section with your original dump.

No, you’d have to exchange the bios region manually with UEFITool or a hex editor.

But: If flashed correctly a stock bios should work and there’s no reason to believe that the system will react differently after a 3rd flash when the first 2 flashes were done properly.

[lfb6]

I wouldn’t even try to flash ME with afuwin*. There are more reliable ways like a programmer or Intel tools.

And don’t forget to make a valid (!!) dump of the firmware before flashing something. (And don’t use afuwin for that either!)

[chupacabra]

Recently acquired a few Dell Precision t5820 workstations. Unfortunately they came from Dell with ME disabled and i would love to enable it for KVM purposes. Been reading the procedures above and trying to see if i can get this to work. The first hurdle I came across is that i get a 318 error when trying to dump the existing BIOS. In searching the forums, there was mentions of a service mode jumper, but i cannot locate that on the motherboard. I also read another thread that mentioned a CH341A programmer to perform the reads and writes. is that the only option for this motherboard?

[lfb6]

There might be just the pads for the jumper and they might work or not.

Regarding unlocking the flash descriptor:

[Guide] Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing

Guide-How To: Unlock Intel Flash Descriptor Read/Write Access Permissions for SPI Servicing Last Updated: 2018-03-20 This guide is relevant to those who need to understand what the Intel Flash Descriptor is, how its SPI Region Read/Write Access Permissions work, how to check its Locked/Unlocked status and what methods are available to unlock it for system firmware repair and/or updating. In this guide, the term "system" means an individual user machine whereas "model" refers to all those "syste…

CH341:

[Guide] Using CH341A-based programmer to flash SPI EEPROM

There are many different SPI programmers on the market right now and almost any microcontroller-based board can be used as one, but this time I will speak about one of the cheapest programmers to date - CH341A-based. They are sold from various chinese suppliers for about 4 euro and are capable of flashing with both SPI and I2C chips, working as USB-TTL adapter and USB-I2C bridge. In this guide I will only cover the SPI part of functionality because this is what you need to flash modified or res…

[Guide] How to Use a CH341A SPI Programmer/Flasher (with Pictures!)

If you’re worried about flashing your motherboard with an SPI Programmer, then this is the guide for you. Each step is explained in detail, with pictures. We’ll go over everything, from buying your Programmer to flashing your chip with Flashrom. As per usual, this is a tutorial on the internet. Do anything you see here at your own risk. I am not responsible if anything goes wrong. This tutorial couldn’t have been possible without: Fernando, for the Win-Raid Forum, ProIIIu3Hb, for their PIII D…

Otherwise are you correct that the procedure resembles the ‘cleaning procedure’ just with one additional steps - changing the required settings.

[MeatWar]

@chupacabra

In searching the forums, there was mentions of a service mode jumper, but i cannot locate that on the motherboard.

Seems to exist… if it fits on the task wanted, its up to you to find out.

[chupacabra]

D’oh, i’ve been staring at that area of the board for hours and never saw the service mode descriptor above the CMOS jumper. my board looks more like your last image where the service mode does not have jumper pins. will experiment shorting them with something.

[chupacabra]

thank you for all the info, will continue to read and see what i can come up with

[chupacabra]

ok, next hurdle! i was able to set the 5820 into service mode which allowed me to download the firmware. Step 4 of the guide says to get the firmware file that matches the version. Version on my machine is 11.12.95.2499, but the latest one in the repository shows 11.12.92.2222. i searched the forums to see if there was a later version to match and found one in this post. Problem is that firmware shows a File System State of Unconfigured which does not match step 5 in the guide. should i try it with the 11.12.92 version or try to figure out this latest version that actually matches?

[lfb6]

Step 5 in section D4 covers ME in your own dump? That one should indeed have a configuration.

[chupacabra]

yep, I’m an idiot… i read that as using the downloaded firmware. All steps seem to have worked and the updated firmware was pushed to the machine per the instructions. My goal was to enable AMT so i could do KVM on these machines, but it appears that those options are still disabled.

[lfb6]

What is the hardware configuration- chipset, cpu, graphics, nic?

Attach the complete firmware or at least ME region.

[chupacabra]

First, thank you very much for all the help already provided, I really appreciate it. Here is the info
Chipset: Intel C422
CPU: Xeon W-2245
graphics: AMD Radeon r9 M360
NIC: Intel i219-LM

Here is the original bios dump:
dell03_orig.rar (9.5 MB)

Here is the modified one:
outimage.rar (9.3 MB)

[lfb6]

• I can’t find any differences in configuration? The two attached firmwares are identically configured?

• KvmSupported value=“No” … If this setting have been set to disabled it cannot be re-enabled once the descriptor has been locked.
  It’s unclear what this means, afaik the only setting that’s written permanently into FPFs for ME 11 is the formware TPM?

• Normally processor graphics is used to redirect screen content to KVM, but officially this Xeon doesn’t have a graphics unit. But may there’s something ‘unofficially’ hidden just to serve AMT?

Please double check the Flash descriptor, ist mostly PCH straps that are stored there, but just to be sure!

[chupacabra]

As far as the flash descriptor, i was able to dump the firmware via fpt -d and then i turned around and updated it with the downloaded on via fpt -f without any errors which leads me to believe the descriptors are RW enabled. let me try the process again, maybe I screwed up the settings on the updated firmware.

EDIT: SUCCESS! I repeated the steps with the original dump, but this time i saw a post around additional configuration settings in FIT. these seemed to do the trick on my workstation.

Now i just need to figure out why the NIC is no longer working…

[lfb6]

Thanks for the feedback. I don’t think these 2 values are relevant.

Regarding NIC:

• GbE written back correctly?
• Other changes in FIT?
• Checked old FD against new FD?

[chupacabra]

I didn’t make any changes in the Networking region, though in checking the original dump to the cleaned one, i do see that the GbE PCIe Port Select changed from PORT4 to PORT5. I’m going to update that and try again.

[lfb6]

Would you mind posting the cleaned firmware?

[chupacabra]

here is the one that is currently on the machine, i have not changed the port yet.
Dell03_outimage.zip (9.8 MB)