[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization

@plutomaniac
original FD with 0x0B0A means?
actually i do not know how to found it.
can u please describe? bcoz to unlock fd i did same as u describe in fd unlock article.
please check my send bios (outimage) detail if possible.
i want to know did i clean me of it same as you define or not?

If you change the FD to FFFF FFFF FFFF then youā€™ll leave it unlocked. If you change it to 0B0A 0D0C 0808 then youā€™ll lock it. If you can unlock it with other methods for repairing (programmer, pinmod etc) then leave it locked for slightly higher security. Otherwise, leave it unlocked. The choice is yours. As for cleaning, as far as I can see both the FITC xml and ConfigParams.txt files are the same so the guide was probably followed correctly. Besides, I donā€™t think Ignition SKU ever needs cleaning due to how bare-bones it was.

@plutomaniac
when i clean me of ZBook 15 G5 it shows error pch strap length does not match.
is it avoidabe or not? why this error is generating bcoz i faces same this issue with Dell Precision 5530 & dell xps9550 also.
when fitc decompose it, here are another new file region CSE REGION i found.
bcoz normally we change bios region or clean me /txe region but now cse region exist too.we replace me sub partition with our repository.
so my question is if problem regarding bios region or me/txe region we can solve it as per your guide.but if problem is regarding CSE REGION
how we identify it symptos & what is solution for this region?
after build image with fitc 2 other file of cse region related create automatically.
what section is inside in two cse file which fitc provide with clean me image?



https://drive.google.com/file/d/1Sk5Pq7_ā€¦86Q6xr/view?usp

error.png

Ignore the warning by opening FIT, setting the SKU to PCH-H No Emulation and then dropping the SPI image. Follow the guide to the letter afterwards.

@plutomaniac
@ lost_N_bios
@ who know the answerā€¦

thanks for helpā€¦
if any bios dump in me analyzer shows firmware update impossibe
what it indicate in reality?
is it means oem will not provide any type update for this bios?
or
we can not update its me region or bios region etc.
and if we clean v12 clean me, is it necessary or mandatory we should update its PMC always or its depend on own choice?

OR its just a process that if we clean engine of any bios we should update it PMC or replace with same version PMC, if it contain PMC?

imp.png



pmc.png

Hi everyone, I am posting a help request here as I seem to be at the final stages of a seemingly impossible challenge and wanted to just check what Iā€™m missing to get this complete.

I have a Dell XPS 9360 (ME 11.8.x) which by design has the OPI Link Speed locked to 2x PCIe lanes in its ME configuration. The quasi-identical boards in the XPS 9370 and XPS 9380 have unlocked the PCIe lanes to x4, and Iā€™ve found the offending parameter in the ME configuration, using FIT. Using the guide outlined in the first post, I can successfully dump the ME (by unlocking the ME region through a UEFI variable), clean it and build a new image with FIT.exe. I can also successfully flash the new outimage.bin back to the ME and the laptop boots fine. Itā€™s got BootGuard and VerifiedBoot enabled but allows changes to the ME partition. In fact I have upgraded the ME version several times using this method.

The problem is - I cannot seem to make any changes to the ME configuration. If I set the specific parameters to change PCIe speed from x2 to x4 in FIT.exe (Internal PCH Buses -> OPI Configuration -> OPI Link Speed -> 4GT/s) and build the image, the settings do not persist in the binary. This is not something related to the Flash Descriptor as itā€™s the new outimage.bin thatā€™s missing the changes, so I just wanted to check what Iā€™m doing wrong here.

Iā€™ve linked my full chip dump and ME dumps to this fileshare here: https://mega.nz/#F!I0ZFECwK!FJvqWpiB0NJPMysuPGdOnA

Happy to share it on another fileshare if it helps.

Thanks in advance

@jkbuha - As I mentioned to you in PM, QPI link speed is not same/has nothing to do with PCIE lane width, two VERY different things there.

Yes thanks - I do understand the difference between the two but the entry clearly says OPI not QPI on my Flash Image Tool (11.8 r28). Isnā€™t that the correct parameter to modify?

Also - it still doesnā€™t explain why no settings are preserved when I build the new image. What am I doing wrong here?

OPI??? As Iā€™ve said all along, show me an image of exactly what you are looking at, so I can look at same in FITc myself.
OPI (DMI link speed) is also not PCIE Lane width (That, PCIE Lane width, is only that, which I showed you image of in FITc)
But, I do see this, so you may be onto something - https://egpu.io/forums/pc-setup/skykaby-ā€¦andwidth-issue/
However, changing that, even if it actually changed immediately, would still leave your PCIE lanes set exactly as I showed you in ME FW and exactly how they are set in BIOS too (They wouldnā€™t automatically change)

I will look at this again now, sorry, this is first time I noticed you said OPI and not QPI

Please do keep in mind, your original MW FW is corrupted, and may still be same if you rebuilt/updated using your own ME/BIOS dump as base, you better check it with ME Analyzer and see if you get 100 errors like the original dump you sent me.

* Edit @jkbuha - OK, I checked, and your error is do to the broken ME FW you have as base.
I downloaded another dump BIOS from this same system with older ME FW, and without as many ME FW errors (3 vs 30+ in yours), and I can change that setting and rebuild without issue and the setting is retained in outimage rebuild
If you use that ME FW, I would follow the cleanup guide, update it to latest version, and then at last step before build image, make your setting change to OPI

Yes thatā€™s correct thanks - now weā€™re getting somewhere :slight_smile:

Iā€™ve managed to flash the ME image you found but for some reason I canā€™t change any settings in the outimage.bin. It must be something Iā€™m doing wrong, because when I load the outimage.bin the settings I changed are not there.

Just to be clear, this is what Iā€™m doing:

1) Dumping the existing ME (or with the file you showed me, loading that ME instead)
2) Save the config.xml
3) Replace file with new ME Region.bin
4) Opening FIT again and choosing config.xml
5) Making proposed settings changes (eg: OPI -> 4x)
6) Build Image (successful)

When I reload the resulting outimage.bin back into FIT.exe, it does not have the new settings I applied in 5). What am I doing wrong?

@jkbuha - Youā€™re welcome It must be your process? Drop the BIOS I linked you to (in-full) on FITc, run through the cleanup guide and update the ME FW (this not required, but suggested), then right before you do your build image, change that setting.
In outimage, replace BIOS region with yours instead using UEFITool 25. Unlock FD via straight hex edit, then program BIOS back into board. If you need me to do, let me know, I can do all that, since I have your programmer backup.

Or, maybe you simply need to delete the config.ini file before you re-open your outimage, because when ā€œConfig.iniā€ is in folder that is auto-loaded upon opening of FITc
In that case, youā€™d see settings shown of whatever is in that config, so if you didnā€™t change setting before you made config.ini, then the setting change wouldnā€™t be there

Ok thanks, so Iā€™ve managed to successfully change the ME settings if I use the FULL dump. But unfortunately I havenā€™t found a way to unlock the FD on the 9360 board and the bios chip is WSON not SOIC (so the CH341 method doesnā€™t work). So until I find a way to flash the full chip without using a programmer I cannot use this method.

The only way I can flash the ME back is if I directly write to the ME Region using FPT. And using this method Iā€™ve discovered an issue - when I only edit the ME.BIN, any changes arenā€™t saved back. I maybe asking something really stupid here - but do any new changes in ME get written back to the ME Region or the FD? If itā€™s the FD region then Iā€™m stuck as I cannot write to the FD :frowning:

@jkbuha - Well you donā€™t have to unlock the FD, I only mentioned that as a good thing to do since you were programming BIOS back (I assumed, forgot about WSON)
Youā€™ll have to either get adapter and remove WSON, or replace it with SOIC8, or do pinmod to unlock FD and then dump it with FPT, edit, flash it back.

If you can write ME region with FPT, then what you write should be placed into the ME FW region. I donā€™t understand what you mean >> "when I only edit the ME.BIN, any changes arenā€™t saved back"
Are you saying, that you write ME FW with FPT, and then dump it again, and your written file is not what is dumped out? If yes, is the new version dumped out and just not the changed setting, or not even the same version you wrote?
Are you sure FPT is writing ME FW region at all? Usually this requires a jumper, or unlocked FD to allow ME FW region to even be written, unless you have a BIOS option that you enabled to allow it.
If you are sure itā€™s writing, then you can do this, and then there should be no way old ME FW remains in place (unless replaced by some backup ME FW and some BIOS auto-recovery function) >> FPTw.exe -rewrite -me -f me.bin
That will erase the entire ME FW region before it writes anything, so be 100% everything is OK in what you write in, and be sure you do the command exactly and when doing that I would also only use ME FW region extracted from the final mod BIOS with UEFITool as the source file.

I can correctly flash ME FW properly with FPT and confirm that the region is flashed properly (it happens only when I unlock ME region for flashing with a specific UEFI variable).

The problem is generating the outimage.bin itself. If I edit the FULL BIOS dump (32MB) (from FPT -D ALL.BIN) and make changes (eg: OPI Link Speed -> GT4) the outimage.bin is successfully changed (confirmed because I reload the outimage.bin and the OPI are changes saved). However, when I only edit the ME partition dump (8MB) (from FPT -ME -D ME.BIN) and make the same changes and build the image, there is no change in the outimage.bin.

@jkbuha - Donā€™t edit your ME FW from FPT -D ALL.BIN dumped off your board, your ME FW is corrupted as Iā€™ve mentioned all along (or at least has 30+ errors the other one doesnā€™t) Edit the ME FW in the BIOS I linked you to, update if you want or not, then make your changes.
Then with that BIOS, replace the ā€œBIOS Regionā€ with BIOS region from your original FPT Dumped BIOS region and you then have whole good BIOS specific to your board again, then reflash ME FW.
Or, simply extract the ME FW from the final edited BIOS (not yours, the one I linked), then flash that with FPT. Donā€™t edit only the ME FW itself, edit the BIOS as a whole, then extract the ME FW and FPT flash it.

Unfortunately it didnā€™t work. I extracted the ME FW from the modded BIOS and flashed it (FPT -ME -F ME_NEW.bin was successful and new ME partition re-initialised successfully), but the old settings persisted. This leads me to conclude that the OPI settings must be stored in the FD region, for which I donā€™t have write access yet.

Thereā€™s a way to unlock the FD from the system board using a jumper short, but I havenā€™t managed to get it working yet. Will resort to try using a modified SOIC clip to better fit WSON chips againā€¦

Yes, it could be that, or it could be that BIOS settings also need changed too as I mentioned. Iā€™d try once more with this command (donā€™t always use this either) >> FPTw.exe -rewrite -me -f MENew.bin << Remove that underscore
Then issue FPTw.exe -greset
If it does not auto-reboot at -greset command, then shut down, remove all power (cables and batteries etc), then short power on pins or button for 10-15 seconds, then let sit for 1+ minute without power
Then start it up again and load optimal default in BIOS, then save and reboot back to BIOS and make any changes you need, and carry on with testing.

If there is FD/ME jumper on board, put jumper on there, reboot to windows twice, then do your FD dump/edit/flash back. You could easily see if FD is holding some change, by comparing FD extracted from source before/after ME FITc edit.

There is also pinmod method to unlock FD, see E.1 on page one of this thread.

I will look at BIOS and see if I can find anything OPI related * Edit = Nothing found Do you know what is this an abbreviation for? Maybe in BIOS itā€™s using full name instead of OPI

FPT -rewrite doesnā€™t change anything unfortunately. Same results. The pinmod method worked on my old XPS 15 (HDAOUT), but hasnā€™t worked so far on the XPS 13. Will try again when I dismantle the laptopā€¦

OPI stands for ā€œOn Package (DMI interconnect) Interfaceā€.
More info here: https://egpu.io/forums/pc-setup/skykaby-ā€¦andwidth-issue/

Did you do the -greset or power drain timeout too? Pinmod only needed if you canā€™t write to ME FW area, or want to unlock FD etc. But yes, sorry, I forgot you suspected maybe something changes at FD to, so that may be needed after all.
Did you compare FD of input BIOS and outimage file, and see changes at FD? If not, then there is your answer.

Thank you for the link and extended name, I will look through BIOS again and see if I notice anything related. Funny, that page you linked is the one I had open the other day when I first looked up OPI

*Edit - In BIOS @ Chipset >> DMI Config >> DMI Max Link Speed (This set Auto, may need set Gen3)
If that does not help alone, there may be some other BIOS module that needs updated by Dell (And Adandtech mentions DMI Gen3 too, so auto may be setting Gen2 on this BIOS)

I have Z170N used with G3258 Haswell and I3-9100F Coffee CPU and I checked my BIOS/ME, and itā€™s set to OPI 2GT/s too, but that article says only Sky/Kaby ULV CPUā€™s/system affected. Does this mean only those need the 4GTā€™s setting due to some bug, and others are OK on 2GT/s?
My speeds are correct for my NVME specs and do not seem limited in any way like shown in the article. I checked this, because I was going to test outcome on my end, but I guess I canā€™t and may not be affected by this bug due to not using a ULV CPU?



Yes thatā€™s correct - FD of input BIOS has changed when the entire (outimage.bin) is written. But because FD is locked I canā€™t make changes to it.



I had tried these (and other) UEFI settings as well, but no answer. I believe the only way is to set OPI max speed to GT4 via ME/FD.



I donā€™t think itā€™s a bug with ULV. The XPS 9370 has the same ULV chip (i7-8550) and its OPI speed is set to GT4. Have a look at the BIOS here: https://www.dell.com/support/home/us/en/ā€¦?driverid=9w1mx