Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

You can find that ME does at the first link of the original post of mine. Consumer (1.5MB) firmware does not have the features that you want such as AMT.

I updated to the lasted Inel ME 9.0.31.1487 Corporate 5MB Firmware but I don’t understand what different form my older 9.0.30.1482 firmware . Can you tell me the changelog form the lasted Firmware? Thank you

@ thanh25896:

Intel doesn’t officially release the changelog so we don’t know. You may find some stuff though from either Lenovo or HP. In the case of 9.0.31 both of them released some changelog which can be found here and here. The actual firmware release notes can only be found at the 9.0.31 package from Intel which I don’t have.

Intel MEI Drivers & Software v11.0.5.1192 for Corporate systems complete package:

http://asrock.pc.cdn.bitgravity.com/Driv…5.1192_SW).zip

Intel MEI Drivers & Software v11.0.5.1192 for Corporate systems

Intel ME System Tools v11.0 r17 (ReUp) :

Updated Documentation (Bring Up, FW Release Notes, MEBx, BIOS)


Thanks to ASRock for the newer driver package and ex58 for letting me know!

Note: There should be firmware 11.0.11.1003 out there.

plutomaniac,

need to fix link for v11.0.5.1192 Corporate in OP.

@ ex58:

Ah yes, the link is now fixed.

hi,one question please.this me region clear me or not? i can use in apple?

Hello,

sorry to interrupt with a quick question but this seems the only place to ask:
Will i be able to unlock Intel Standard Manageability to Intel AMT with remote KVM using a reflash? Or is there any other way?
Hardware is an i5-6500 with Q150 chipset (Fujitsu D756) and Intel ME v11.0.10.1002

regards
t.

@ k-pax:

What do you mean exactly? Your English don’t make sense. By “clear” I assume you mean “clean”. Which firmware exactly? What Apple computer model do you have exactly?

@ trezn0r:

From what I can see the latest BIOS for your model is D3431-A1x V5.0.0.11 - R1.13.0 (19/02/2016), correct? The ME firmware included is Corporate H and from what I can see at Flash Image Tool, all AMT capabilities are enabled, including KVM.

Capture.PNG



Maybe Fujitsu is provisioning the shipped systems differently per customer request? I know Dell does that but in this case, I don’t know why Fujitsu would include a configured (EXTR) ME region at their latest BIOS if it cannot be used/flashed at all targeted systems.

Even if indeed your current ME firmware supports only Standard Manageability, you need to have Read/Write access to the ME region in order to reflash it with full AMT support. Your Flash Descriptor needs to be unlocked for that. You can quickly test by running Flash Programming Tool with command fptw -d spi.bin . If the operation completes successfully without any access or cpu errors then your Flash Descriptor is unlocked. If it’s locked, check the motherboard for any jumpers or the BIOS for any setting that temporarily disables the ME in order to service (reflash) it.

After your Flash Descriptor is (hopefully) unlocked, compress and attach a dump of your firmware with the command fptw -d spi.bin in order to verify whether your system has AMT indeed disabled. If it does, then we can fix it and flash it back. Let me know either way.

Hello plutomaniac,

thank you very much for investigating my case, it is also very helpful in understanding how to work with the tools supplied by OP.

R1.13 BIOS for the D3431-A1x board is correct, i just flashed from R1.11 just to see if it would unlock ME, but to no avail.
It still says Standard Manageability in MEBx.

The flash descriptor also seems to be locked, i tried fptw -d spi.bin - error 310, no access for host CPU.
There’s also only one Recovery Jumper on the board, which Fujitsu tells me is for resetting a BIOS password.
I can deactivate ME in the BIOS, but it is hinted that works only for the BIOS Extension, not the entire ME hardware.
Running fptw -disableME as per Skylake-H Client SPI Programming Guide.pdf gives me Error396: The request to disable the ME failed.
(irrespective of turning MEBx on/off in BIOS)

When i run ME Analyzer(r51) on the newest BIOS file available, i get the same output as you, but also underneath in yellow text:

→ Note: Multiple (2) Intel Engine Firmware detected in file!

I guess that’s why we see a fully unlocked ME in the BIOSfile, while only Std. Manageability is available in MEBx, right?

Do you have any further tips, or should i rather assume my case is lost?

regards,

t.

Update: Windows 10 is running great with ME version v8.1.65.1586 along with IME driver 11.0.0.1181 - I no longer have any issues in device manager.
Edit: My ME was corrupt I was doing some reading this morning and I flashed the ME region and was able to repair the corrupt ME. Going to upgrade to v8.1.65.1586 and try Windows 10 again.


Hello I have an Asus Maximus V Formula. I am having issues with my Intel Management Engine in Windows 10. It causes slow boot up and shutdown times. With any IME driver 11, when I install 9.5 it works fine. I am trying to flash the ME v8.1.65.1586 but I keep getting an error

"Can’t locate ME device driver."

I installed Windows 8.1 to see if that was the issue but I get the same error.

When I try to use MEInfo I get error 9458 "Communication error between application and Intel<r> ME module (FW Update Client)

I am on the latest bios 1903

Edit more info: When IME 11 driver is installed I get error 10 in device manager. status power failure
Current driver installed with no issues 9.5.10.1658
Current ME version: 8.1.0.1248

Also added my 8MB dump

spi.zip (4.69 MB)

@ trezn0r:

Usually such boards, with Corporate firmware, tend to have either a jumper or a BIOS settings to disable/service the ME. I suggest you try that jumper and the BIOS option with fptw -d test and see if any can unlock the Flash Descriptor. Otherwise, only with a programmer.

The note shown at MEA has nothing to do with that. It’s just that Fujitsu has a unique way of packing their BIOS updates (.UPD) by also including another stock/unconfigured ME region as well for some reason. That’s not in the actual SPI chip though. So it’s not related.

hi,where download the me region clear 7.0.0.1193(a1278 2011) and 8.0.4.1441(a1278 2012)
this me region this is foro,is upadate or clear me?,thank you

Intel MEI Drivers & Software v11.0.5.1192 (1.5M) is out.

Intel MEI Driver v11.0.5.1192 MEI-Only Installer

Intel ME System Tools v11.0 r17 (ReUp):

Flash Programming Tool(DOS): 11.0.10.1002


Thanks to SD/Pacman for the newer MEI-Only Installer.

@ k-pax:

There are no clean ME Regions (RGN) for Apple firmware, only EXTR from their official EFI updates. You can use FWUpdate tool with the equivalent UPD image of the latest ME7 Apple firmware as provided at the first post. For ME8, use FWUpdate again with the latest ME8 1.5MB firmware as Apple doesn’t have a special SKU there.

Intel ME 11.0 Consumer PCH-LP Firmware v11.0.12.1001
Intel ME 11.0 Corporate PCH-H Firmware v11.0.12.1001
Intel ME 11.0 Corporate PCH-LP Firmware v11.0.12.1001

Capture.PNG



Note: The filenames for PCH-LP 11.0.12.1001 contained the text “PDM”. I haven’t seen that before and don’t know what it stands for. Based on the fact that the previous firmware released from the same source is the same we already have and flashed (11.0.0.1205) as well as the positive results below, it’s ok for flashing. Obviously, if someone knows what “PDM” stands for and can shade some light, please do.

Note: Version Control Number (VCN) was increased to 15. No downgrade via FWUpdate possible after updating.

Note: It cannot be a coincidence that every time a new firmware is released by one OEM, the others follow. Intel probably has a schedule on when OEMs should release the new firmware, maybe to also test them internally first. We should expect Consumer PCH-H soon if that’s true.

Changelog:

(New) Added support for Microsoft Windows 7 32-bit
(Fix) Fixed an issue where 802.1x authentication might fail when the Intel ME firmware had a profile with authentication protocol - EAP_FASTTLS
(Fix) Fixed an issue where the Host Name and Domain Name might be cleared instead of returning to factory defaults when performing Full Unprovision or Intel ME Unconfiguration after EOM.
(Fix) Fixed an issue where the system might hang if Intel ME firmware-initiated reset occurred while High Definition audio was disabled.
(Fix) Fixed an issue where the system may hang when running hibernate stress tests
(Fix) Fixed multiple security issues
(Fix) Fixed an issue where LAN speed dropped or couldn’t connect to the network after resuming from sleep
(Fix) Fixed an issue where multi-factor authentication might take longer time to respond when resuming from sleep or hibernate.
(Fix) Fixed a potential boot failure.
(Fix) Fixed an issue where the Intel AMT WebUI on systems with Intel Core m# processors might display the processor family as “Unknown”
(Fix) Fixed an issue where the Intel AMT Web UI sometimes might not display data in Microsoft InstantGo mode.
(Fix) Fixed an issue where the processor couldn’t enter package C3-state after booting with Intel wired LAN connection.
(Fix) Fixed an issue where the WLAN card might remain powered on during sleep, hibernate or shutdown mode on DC mode.
(Fix) Fixed an issue where the Intel ME firmware might not send watch dog notification to MEI driver.
(Fix) Fixed an issue where the ME might not function properly after boot up.
(Fix) Fixed an issue where incorrect firmware status was reported.
(Fix) Fixed an issue where Intel ME might reset unexpectedly after resuming from system sleep + shutdown, via Intel AMT remote control operation.
(Fix) Fixed an issue where redundant flash writes might be executed upon TPM2 startup after a non-orderly shutdown impacting flash wear-out.
(Fix) Fixed an issue where KVM might attempt to start instead of return “Sprite failure” when the Secured I/O service (used for Privacy / User Consent Sprite display) was disabled.
(Fix) Fixed possible corrupted playback of PAVP 2.0 or 3.0.
(Fix) Fixed an issue where the system might beep when doing a global reset.
(Fix) Fixed a potential memory leak.
(Fix) Fixed an issue where cutting the power twice during firmware update might prevent the platform from booting.
(Fix) Fixed an issue where setting the system to sleep, hibernate or shutdown during firmware update might cause the system to hang.
(Fix) Fixed an issue where error messages might be displayed during Intel ME Unconfiguration.
(Fix) Fixed an issue where connectivity with Intel AMT might fail during sleep, hibernate or shutdown mode after WS-MAN provisioning with static IP.
(Fix) Fixed an issue where PCH thermal data might not be available after resuming from deep sleep.

MEA:

11.0.12.1001_CON_LP_C0_PRD_RGN_A738B86A2DD8184233EE91500DA26EE57D840E41_SHA1
11.0.12.1001_COR_H_XX_PRD_RGN_6A35AA2DA4D7EE137A733C9082662D83D0D89DD5_SHA1
11.0.12.1001_COR_LP_C0_PRD_RGN_069A57044E86CEC57EAB0C37A21094932243F1C8_SHA1

Intel ME System Tools v11.0 r18 :

MEInfo(DOS): 11.0.11.1002
MEInfo(EFI64): 11.0.11.1002
MEInfo(Windows): 11.0.11.1002
MEInfo(Windows64): 11.0.11.1002


Thanks to Lenovo for the new PCH-LP firmware. Also, thanks to HP for the new PCH-H firmware and tools. Last but not least, thanks to Pacman/SD for letting me know of the PCH-H firmware.

Regarding the PCH-LP 11.0.12.1001 “PDM” firmware:

I have only received one report. A negative one. The system was ok at 11.0.10.1002 (MEInfo/MEManuf) but showed errors after updating to 11.0.12.1001. It could be a coincidence, a one time/system specific issue but it could also due to the “PDM” addition, whatever it means. More reports are needed to know for sure.

Obviously, if someone knows what “PDM” stands for and can shade some light, please do. In the mean time, users of PCH-LP, if you decide to update to the 11.0.12.1001 firmware I have listed despite the warning, please report back to avoid issues.

EDIT: UPDATE

Hi,

short question: I’ve got a Lenovo Thinkpad T460s and flashed FW 11.0.12.1001 from https://download.lenovo.com/pccbbs/mobiles/n1crg34w.txt without a problem (looks like this is the new “PDM” file).

Intels msinfo module and MEA reports the new firmware however MEBx and LMS version looks outdated:


I am unsure if I can use images from Intel ME 11.0 Firmware Repository Pack r25 to update MBEx and LMS (looks like the latest Corporate version for LP is 11.0.0.1205 however I am not sure if I understand _H and _LP – I am assuming I need something with _LP suffix because meinfo reports FW with LP suffix).

@Whistl0r

Thank you for the report. Can you also attach the outputs of MEInfo and MEManuf? Only these are the proper tools to check if everything went properly which it should since Lenovo themselves released that for their models. Still, I would like to see some details at the MEInfo output.

MEBx is a BIOS module and LMS a driver so these have nothing to do with the ME firmware uploaded at the ME 11.0 Repository. The latest at r25 is indeed 11.0.0.1205 but that’s because the newer firmware were found this week and the pack won’t be updated until Sunday. Your MEBx module is updated to my knowledge (11.0.0.0005) and for the newest driver check section A of the first post.

Speaking of the first post, check the “Warning for 100 series” to learn what H and LP stands for. You have a PCH-LP system which runs Corporate ME firmware.