Dear all,
Thanks for this extensive work on intel ME. Very interesting topic.
I have a problem for which I would gladly receive any hint or help.
I have an HP all-in-one Pavilion 23-q208nf (Intel skylake i5-6400T), which for quite some time takes ages to boot, is sluggish and doesn’t poweroff at shutdown.
The BIOS post shows MANAGEMENT PLATFORM (ME) IN MANUFACTURING MODE.
Windows 10 doesnt show any ME interface device, although it did in the past.
MEInfo doesn’t work.
Error 86: Communication error between application and Intel(R) ME module (FWU client)
Error 81: Internal error (Could not determine FW features information)
MEManuf doesn’t work.
Error 86: Communication error between application and Intel(R) ME module (FWU client)
Error 125: Internal error (Could not determine FW features information)
Error 117: MEManuf Operation Failed
Using Flash Programming Tool, I was able to dump flash descriptor region and BIOS region, but ME region seems to be locked.
I’ve tried reinstalling drivers (refused to install), updating BIOS to latest (A0.18 OK but no change) and updating ME using HP tools (platform not supported)
I assume that a reflash or update of ME might help restore normal behavior.
I have tried the guide to unlock the FD, but cannot find a suitable way :
- E1 : no visible audio chip (maybe at the back of the MB)
- E2 : no MB jumper found (no jumper indication except CN12 and CN20, no MB documentation found)
- E3 : no tool found
- E4 : no tool found
- E5 : tried win + left arrow + right arrow
- E6 : BIOS update is an executable file which I’m unable to process/unpack
- E7 : I don’t have an Hardware SPI Programmer, nor the knowledge to use one.
I have read quite some of the guides and forums, but I am stuck.
I would appreciate any help, thanks. Sorry if I’ve missed a previous discussion on this issue.
To check the status of the CSE, run MEInfo with -fwsts parameter. Compress and attach the dumped Flash Descriptor region (fpt -desc -d desc.bin) to see the allowed read/write access. Do you have some quality photos of the motherboard to see if it has anything interesting on it? What is its model by the way.
Hi plutomaniac,
Thanks for your kind answer. Here is the info requested :
MEInfo -fwsts output :
Copyright(C) 2005 - 2019, Intel Corporation. All rights reserved.
FW Status Register1: 0x8030404E
FW Status Register2: 0x340D0006
FW Status Register3: 0x00000420
FW Status Register4: 0x00000000
FW Status Register5: 0x00000000
FW Status Register6: 0x00000000
CurrentState: Unknown (14)
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Initializing
BUPLoadState: Success
ErrorCode: Debug Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
FPF HW Source value: Not Applicable
ME FPF Fusing Patch Status: ME FPF Fusing patch NOT applicable
Phase: BringUp
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
PhaseStatus: CHECK_BUP_OVERRIDE_STRAP
FPF and ME Config Status: Not committed
Model number : I thought it was 23-q208nf but I found a Product Number : W1C80EA#ABF
Dumped FD : enclosed
MB picture : enclosed.
Thanks again for your help.
desc.zip (423 Bytes)
I forgot to mention that I also tried CMOS reset (CN12, pins 3-4 shorted) and battery removal with no change.
Alright, the FD is locked so you have no read/write access to the CSME firmware. The latter is probably corrupted and needs repairing. Have you tried re-flashing the latest HP BIOS, just in case it manages to fix the issue? Maybe these BIOS recovery options can do something. I have attached the actual SPI/BIOS for your machine, as extracted from sp97015 so that you can try E6. You can also try to get the BIOS configuration using HP BIOS Configuration Utility (BCU) via /get parameter. Maybe something interesting can be found there as well.
sp97015_2B45_A018.rar (4.02 MB)
Hi plutomaniac,
I’ve alreday tried updating the BIOS with this version but i’ll try again. Thanks for the tool and unpacked BIOS, I’ll try to investigate further and will keep you posted.
Thanks for your help.
Hi plutomaniac,
I’ve made some progress but I’m afraid I’m still stuck…
- reflashed BIOS : no change.
- HP BCU : was able to retrieve config (attached), tried to set Manufacturer mode to unlock but always ended up having error 6 (access denied), whatever the way used (set variable, set config) or the variable targeted, although BIOS has no password set.
- Unlock mehtod E6 : I think that I managed to do an EFI extract of the setup part (attached). Found this interesting section :
0x221E4 One Of Option: Disabled, Value (8 bit): 0x0 (default) {09 07 04 00 30 00 00}
0x221EB One Of Option: Enabled, Value (8 bit): 0x1 {09 07 03 00 00 00 01}
Booted on EFI shell, tried setup_var 0x99 0x1 but got a strange message :
var name : Setup
var size : 12
var guid : 80e1202e-2697-4264 9c-c9-80-76-2c-3e-58-63
Guid doesn’t match expected guid, trying anyway…
error : offset is out of range.
Of course, when I rebooted, the ME section was still locked, impossible to dump it.
I’m unsure where to go next. Did I make any mistake ?
Thanks for your feedback.
BCU getconfig.txt (3.59 KB)
Regarding HP BCU, do you run it as administrator? Have you also tried running under an EFI environment in case that makes a difference? I think it has an EFI executable. If it still says access denied it must be some sort of protection which does not allow changing that lock. HP has many such locks…
As for E6 method, it is possible that @Lost_N_BIOS can recommend a better way to attempt enabling the "Me FW Image Re-Flash" option of the BIOS.
Thanks @plutomaniac for your quick reply.
Yes BCU was run as administrator. I couldn’t find any EFI binaries in the install folder nor on HP website. Anyway I’m note sure that manufacturing programming mode is relevant here, it seems more related to HP asset management information.
Waiting other ideas or @Lost_N_BIOS input, I think I’m going to try undocumented jumpers to see if that can help.
Just for the sake of posterity, I found the solution once I could spare a day to tinker with the computer.
- tested all jumpers until I found that closing jumper CN20 unlocked the firmware (undocumented)
- applied the recipe ([Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization) to dump flash, clean ME and integrate a new initialized version of ME in the firmware.
- flashed back the full firmware, removed the CN20 jumper and voilà !
The computer has no error message anymore, and can now boot/sleep/shutdown properly. And shows the Intel ME interface device in windows device manager.
A small hack but a great victory for me.
A long and happy life to you @plutomaniac for your support and these invaluable guides !