Help me understand the Intel ME firmware update

Special Topics Intel Management Engine
1

The motherboard ASUS Z170-WS had at the purchase time:
BIOS → Intel ME firmware
3105 → 11.6.10.1196
I ran “ME Update Tool” in Windows and updated Intel ME firmware ->11.8.50.3399
I skipped over the BIOS versions:
BIOS → Intel ME firmware
3204 → 11.6.10.1196
3601 → 11.8.60.3561
I received from ASUS after a long insistence a new version of BIOS:
BIOS → Intel ME firmware
3602 → 11.8.65.3590
(checked with UEFITool).
I flashed BIOS 3602 with ASUS EZ Flash 3, the microcode version was updated (checked with UEFITool) but the Intel ME firmware remained 11.8.50.3399 from the update with the “ME Update Tool”. The BIOS update ran without any error.
MEInfo:


Intel(R) MEInfo Version: 11.8.65.3590
Copyright(C) 2005 - 2018, Intel Corporation. All rights reserved.
Driverless mode
Intel(R) ME code versions:
BIOS Version
MEBx Version
GbE Version 0.7
Vendor ID 8086
PCH Version 31
FW Version 11.8.50.3399 H
Security Version (SVN) 3
MEI Driver Version Not Available
Wireless Hardware Version Not Available
Wireless Driver Version Not Available
FW Capabilities 0x11111540
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Re-key needed False
Platform is re-key capable True
TLS Disabled
Last ME reset reason Firmware reset
Local FWUpdate Enabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Enabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Disabled
Independent Firmware Recovery Disabled
EPID Group ID 0xF83
LSPCON Ports None
5K Ports None
OEM Public Key Hash FPF 0000000000000000000000000000000000000000000000000000000000000000
OEM Public Key Hash ME 0000000000000000000000000000000000000000000000000000000000000000
ACM SVN FPF 0x0
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 0000000000000000000000000000000000000000000000000000000000000000
FPF ME
— –
Force Boot Guard ACM Disabled Disabled
Protect BIOS Environment Disabled Disabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Disabled Disabled
Verified Boot Disabled Disabled
Key Manifest ID 0x0 0x0
Enforcement Policy 0x0 0x0

Local FWUpdate → Enabled allows updating with FWUpdate but blocks the upgrade to the existing version in the new BIOS?
Should I try manual updating with FWUpdate (I am now running Linux so FWUpdLcl version for LINUX64)?

2

Yes use FWUpdate tool to update the CSME firmware.

3

I confirm that the FWUpdate version for LINUX64 (FWUpdLcl) works properly.

4

Intel CSME System Tools v11 r26 -> FWUpdate -> LINUX64 -> FWUpdLcl -> 499 KB
Intel CSME System Tools v11 r26 -> FWUpdate -> LINUX64 -> FWUpdLcl -> Portable -> FWUpdLcl -> 503 KB

What is the difference between these two versions and what should I use?

5

Has anyone tried updating Intel ME in Linux remote -> ssh?

6

@ibsajc :
Our Intel ME expert plutomaniac has currently no opportunity to be online.
Please wait until he will answer your questions. This may take several days or maybe even several weeks.

7

Thanks @Fernando.
I do not expect @plutomaniac to answer my questions personally, its activity is much more important and many users depend on it.
At the previous question a response from a user who has tried this is sufficient. I have also received responses for using the Intel ME update tool on Linux in the past from @thurask. If I had a test system I would have tried and then posted on the forum the result in case someone else needed it.