Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

@plutomaniac
I updated my Skylake Y device to version PCH-LP 11.0.12.1001, there aren’t any issues as far as i can tell.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
Intel(R) MEInfo Version: 11.0.11.1002
Copyright(C) 2005 - 2016, Intel Corporation. All rights reserved.
 

 
Intel(R) ME code versions:

BIOS Version 1.8
MEBx Version 11.0.0.0005
GbE Region does not exist.
GbE Version Unknown
Vendor ID 8086
PCH Version 21
FW Version 11.0.12.1001 LP
LMS Version Not Available
MEI Driver Version 11.0.5.1189
Wireless Hardware Version Not Available
Wireless Driver Version Not Available

FW Capabilities 0x31111A40

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/ENABLED

TLS Disabled
Last ME reset reason Global system reset
Local FWUpdate Enabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Enabled
Host Write Access to ME Enabled
Host Read Access to EC Enabled
Host Write Access to EC Enabled
SPI Flash ID 1 EF4017
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Enabled
Independent Firmware Recovery Disabled
EPID Group ID 0xF86
OEM Public Key Hash FPF Not set
OEM Public Key Hash ME 0F969281816FA625B5C67109C8029D074CDE27903DC753EDD6FE6E2D14984B20
ACM SVN FPF 0x0
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF Not set
GuC Encryption Key ME 6DB65FD59FD356F6729140571B5BCD6BB3B83492A16E1BF0A3884442FC3C8A0E

FPF ME
--- --
Force Boot Guard ACM Not set Disabled
Protect BIOS Environment Not set Disabled
CPU Debugging Not set Enabled
BSP Initialization Not set Enabled
Measured Boot Not set Disabled
Verified Boot Not set Disabled
Key Manifest ID Not set 0x0
Enforcement Policy Not set 0x0
PTT Not set Enabled
EK Revoke State Not Revoked
PTT RTC Clear Detection FPF Not set
 

@Wootever

Thank you a lot for your report. I remember that you have a PCH-LP system and was hoping you would reply with a result. I was thinking of sending a pm and ask manually but you beat me to it. Based on the last two posts, I have removed the Warning from the first post and adjusted the warning text at my reply post above to a toned down note in case someones knows what “PDM” stands for. For now, it seems that it doesn’t matter as far as updating is concerned. Again, thank you for helping out.

As requested:

MEinfo:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
 

Intel(R) MEInfo Version: 11.0.11.1002
Copyright(C) 2005 - 2016, Intel Corporation. All rights reserved.
 

 
Intel(R) Manageability and Security Application code versions:
 
BIOS Version N1CET43W (1.11 )
MEBx Version 11.0.0.0005
GbE Version 1.3
Vendor ID 8086
PCH Version 21
FW Version 11.0.12.1001 LP
LMS Version 11.0.0.1184
MEI Driver Version 11.0.0.1181
Wireless Hardware Version 2.1.77
Wireless Driver Version 18.40.0.9

FW Capabilities 0x7DF65A45

Intel(R) Active Management Technology - PRESENT/DISABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Service Advertisement & Discovery - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/DISABLED

Intel(R) AMT State Disabled
TLS Enabled
Last ME reset reason Global system reset
Local FWUpdate Password Protected
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Disabled
Host Write Access to ME Disabled
Host Read Access to EC Disabled
Host Write Access to EC Disabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 4c656e6f-766f-0000-0000-000000000000
Link Status Link Up
System UUID 788ff64c-3058-11b2-XXXX-XXXXXXXXXXXX
MAC Address 50-7b-9d-XX-XX-XX
IPv4 Address 0.0.0.0
Wireless MAC Address 00-00-00-00-00-00
Wireless IPv4 Address 0.0.0.0
IPv6 Enablement Disabled
Wireless IPv6 Enablement Disabled
Configuration State Not Started
Provisioning Mode PKI
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x000017AA
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Enabled
C-link Status Enabled
Wireless Micro-code Mismatch No
Wireless Micro-code ID in Firmware 0x24F3
Wireless LAN in Firmware Intel(R) Dual Band Wireless-AC 8260
Wireless Hardware ID 0x24F3
Wireless LAN Hardware Intel(R) Dual Band Wireless-AC 8260
Localized Language German
Independent Firmware Recovery Disabled
EPID Group ID 0xFA6
OEM Public Key Hash FPF B81780CA1F680177E08349A29C256B6677XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
OEM Public Key Hash ME 6DD000353945F50D729F0CB6AC151C64F5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
ACM SVN FPF 0x2
KM SVN FPF 0x0
BSMM SVN FPF 0x0
GuC Encryption Key FPF 0000000000000000000000000000000000000000000000000000000000000000
GuC Encryption Key ME 6DB65FD59FD356F6729140571B5BCD6BB3XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

FPF ME
--- --
Force Boot Guard ACM Enabled Enabled
Protect BIOS Environment Enabled Enabled
CPU Debugging Enabled Enabled
BSP Initialization Enabled Enabled
Measured Boot Disabled Disabled
Verified Boot Enabled Enabled
Key Manifest ID 0x1 0x1
Enforcement Policy 0x3 0x3
PTT Enabled Enabled
PTT Lockout Override Counter 0x0
EK Revoke State Not Revoked
PTT RTC Clear Detection FPF 0x0

 
 



MEManuf output:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
 

Intel(R) MEManuf Version: 11.0.0.1202
Copyright(C) 2005 - 2015, Intel Corporation. All rights reserved.
 
FW Status Register1: 0x94000245
FW Status Register2: 0x88100106
FW Status Register3: 0xC0000030
FW Status Register4: 0x00084000
FW Status Register5: 0x00001F01
FW Status Register6: 0x44400AC9
 
CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: Maestro
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
FPF and ME Config Status: Match
 
FW Capabilities value is 0x7DF65A45
Feature enablement is 0x5DF25A41
Platform type is 0x42111421
Found an Intel vPro Wireless device
Feature enablement is 0x5DF25A41
ME initialization state valid
ME operation mode valid
Current operation state valid
ME error state valid
OEM ICC data valid and programmed correctly
MFS is not corrupted
PCH SKU Emulation is correct
FPF and ME Config values matched
 
Request Intel(R) ME BIST status command... done
 
Get Intel(R) ME test data command... done
 
Get Intel(R) ME test data command... done
 
Get Intel(R) ME test data command... done
Total of 27 Intel(R) ME test result retrieved
 

Policy Kernel - Power Package : Live Heap Test - Passed
Common Services - LAN : Connectivity to NIC in M3 - Passed
Common Services - Wireless LAN : Connectivity to NIC - Passed
Policy Kernel - Boot Guard : Self Test - Passed
Policy Kernel - Embedded Controller : Power source type - Passed
MCA - MCA Tests : Blob - Passed
MCA - MCA Tests : MCA Manuf - Passed
SMBus - SMBus : Read byte - Passed
VDM - General : VDM engine - Passed
GFX - General : Sampling engine - Passed
USBr - General : Storage - Passed
USBr - General : KVM - Passed
Common Services - LAN : Connectivity to NIC in M0 - Passed
AMT - KVM : Compression engine - Passed
AMT - KVM : Compare engine - Passed
AMT - EC : Basic connectivity - Passed
Policy Kernel - ME Password : Validate MEBx password - Passed
Policy Kernel - ME Configuration : M3 Power Rails Available - Passed
Policy Kernel - ME Configuration : PROC_MISSING - Passed
Common Services - General : WLAN enabled only on mobile or desktop - Passed
Policy Kernel - ME Configuration : Wlan Power Well - Passed
Common Services - EHBC State : EHBC and Privacy Level states compatibility - Passed
Common Services - EHBC State : Valid Embedded Host Based Configuration (EHBC) state - Passed
Common Services - Privacy Level : Valid Privacy Level settings - Passed
AMT - Power : M3 power rail supported - Passed
AMT - Power : Valid WLAN power well (Mobile) - Passed
AMT - Power : Valid LAN power well - Passed
 
Clear Intel(R) ME test data command... done
 

 

MEManuf Operation Passed
 
 

Everything looks ok, the PCH-LP 11.0.12.1001 warnings have been removed since yesterday.

Could you please check/verify the archive for "Intel ME System Tools v8.1 r7 - (Updated: 17/11/2015)"
→ This archive appears to be broken! At least I could not open it using several tools – I also checked one of the other archives and it worked fine, so in general it should work.

@ ME analyst:

It’s mentioned 4 times throughout the first post that WinRar v5.x or later is needed for extraction.

Yes I did not take WinRar – but as I said, the other archives (!!from you!!) work fine. I find it hard to believe that this particular archive is broken when using the tools I tested :-/

I opens just fine, I tested it before replying to you for the first time. Not all archives in the first post are RAR5, some smaller in size are RAR2 like INF drivers. Use the latest version of WinRar or 7-zip.

Intel ME System Tools v11.0 r19 :

Flash Image Tool: 11.0.10.1002
Flash Programming Tool(EFI64): 11.0.10.1002
Flash Programming Tool(Windows): 11.0.10.1002
Flash Programming Tool(Windows64): 11.0.10.1002
MEManuf(DOS): 11.0.0.1205
MEManuf(EFI64): 11.0.0.1205
MEManuf(Windows): 11.0.0.1205
MEManuf(Windows64): 11.0.0.1205
CCT(DOS): 11.0.0.1205
CCT(EFI): 11.0.0.1205
CCT(Windows): 11.0.0.1205
Manifest Extension Utility: 11.0.0.1205

Note: These tools are also compatible with Intel C620 Lewisburg PCH. It is mentioned at the System Tools User Guide that FPT will work with C620 if some BIOS settings are first altered. One of those is called DFX which according to Intel stands for “Design for Manufacturability, Testability and Debuggability”. Once again, according to Intel, the DFx setting can also be called PDM, specifically PDM/DFx. I still don’t know what it means exactly but I suspect that the “PDM” text at the latest 11.0.12.1001 PCH-LP ME firmware has either to do with C620 or some enabled setting on that binary release.

Thanks to this site I was able to update my OLD! MEI Firmware to 7.1.80.1214 but if I read correctly I could go even further and update this to 8.1, any info on how to achieve this?

I have tried FWUpdLcl.exe -F <file> but this fails

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
 
Intel(R) MEInfo Version: 7.1.50.1166
Copyright(C) 2005 - 2011, Intel Corporation. All rights reserved.
 
PMXUtil: Error during PMX Call: PMxDrv!MAPPHYS - Bad Input Parameters
GBE Region does not exist.
Intel(R) ME code versions:
 
BIOS Version: R1102T6
MEBx Version: Not available
Gbe Version: Unknown
VendorID: 8086
PCH Version: 4
FW Version: 7.1.80.1214
UNS Version: Not Available
LMS Version: Not Available
MEI Driver Version: 11.0.0.1181
Wireless Hardware Version: 0.1.225
Wireless Driver Version: 15.18.0.1
 
FW Capabilities: 17833024
 
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
 
CPU Upgrade State: Upgrade Capable
Cryptography Support: Disabled
Last ME reset reason: Power up
Local FWUpdate: Enabled
BIOS and GbE Config Lock: Unknown
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4016
SPI Flash ID VSCC #1: 20052005
SPI Flash BIOS VSCC: 20052005
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
OEM Tag: 0x00000000
 

No you cannot upgrade to another major version. You are up to date.

I thought this meant I could, I have a 6-Series

Only for some desktop systems for which the OEM has released a BIOS with ME8, not mobile and not without an upgrade from the OEM first.

@plutomaniac

New ME Firmware out at Station-Drivers: 11.0.11.1005

Intel MEI Driver v11.0.11.1193 MEI-Only Installer
Intel MEI Drivers & Software v11.0.11.1193 for Corporate systems

Intel MEI Drivers & Software v11.0.11.1193 for Consumer systems (Update @ 03/06/2016)

Intel ME 11.0 Corporate PCH-LP Firmware v11.0.12.1003 (Update @ 03/06/2016)

Pic1.png



MEA: 11.0.12.1003_COR_LP_XX_PRD_RGN_2B217AE2440B436CA5F72708CB37D744497EE286_SHA1

Intel ME 11.0 Consumer PCH-H Firmware v11.0.11.1005

Pic2.png



Note: Version Control Number (VCN) was increased to 14. No downgrade via FWUpdate possible after updating.

MEA: 11.0.11.1005_CON_H_D0_PRD_RGN_9D0E12D285DDCB42BB10651130B9EBFE9E5C9DA7_SHA1

Note: There should be 11.0.15.100x firmware out there.

Thanks to Pacman/SD for the newer PCH-H Consumer firmware and drivers as well as Orsox for letting me know.

I am getting the follow error :

C:\TOOLS\Intel ME System Tools v11.0 r19\MEManuf\WINDOWS64>MEManufWin64 -verbose

Intel(R) MEManuf Version: 11.0.0.1205
Copyright(C) 2005 - 2016, Intel Corporation. All rights reserved.

FW Status Register1: 0x1E000245
FW Status Register2: 0x60002306
FW Status Register3: 0x00000200
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0x30000020

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: HOSTCOMM Module
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
FPF and ME Config Status: Not committed

FW Capabilities value is 0x40100940
Feature enablement is 0x40100940
Platform type is 0x463F0302
No Intel vPro Wireless device was found
Feature enablement is 0x40100940
ME initialization state valid
ME operation mode valid
Current operation state valid
ME error state valid
OEM ICC data valid and programmed correctly
MFS is not corrupted
PCH SKU Emulation is correct

Request Intel(R) ME BIST status command… done

Error 128: Intel(R) test failed to start, error 0x9 returned


Error 117: MEManuf Operation Failed



When using FWUpdLcl.exe -f 9.1.37.1002_1.5MB_PRD_RGN.bin

I get Intel (R) Firmware Update Utility Version: 11.0.0.1205
Copyright (C) 2007 - 2016, Intel Corporation. All rights reserved.


Cannot locate hardware platform identification

Error 8743: Unknown or Unsupported Platform


?!? What could be wrong about my method ?

@futiless
You can’t use “Intel ME System Tools v11 r19” for your Firmware 9.1.37.1002_1.5MB_PRD_RGN.bin

What Motherboard / Chipset do you have? If you use MEAnalyzer with -info, your current Firmware-Version should be displayed, what is it?

UBU resp. the included ME Analyzer detects the Intel ME Firmware of the BIOS file, which is provided by the mainboard manufacturer. The tool is not able to detect the Intel ME Firmware, which is within the BIOS chip of your system.


I don’t really understand this… Are you saying that there’s no way to apply newer firmware version for MEI? My BIOS shows the latest/newest version of MEI (after I updated it), but UBU MEI Analyzer shows the original (the oldest) version of MEI. Which version do I have exactly then? Or is this because MEI Firmware is updated outside of UBU and thus not included in my latest modded BIOS files? That would make sense, BUT I saved my current BIOS (with the latest MEI Firmware) to a file (I think…).

If MEI Analyzer doesn’t detect the correct firmware version, then what is the purpose of it? Is there a way to make it detect the correct version?

@MonarchX
“MEA -info” will Display the current Version of ME Firmware that is currently running on your PC. You can get the latest ME Analyzer here
The Ubu MEA detects the ME Version inside the bios-file you opened with Ubu!

If your Motherboard bios displays the latest version as you said, everything is fine

@MonarchX :
Orsox is right.

No, but you have to flash the Intel ME Firmware separately. The Intel ME Analyzer of the UBU tool just shows the Intel ME version of the BIOS file, which it just has opened, but is unabe to update it. This procedure has to be done separately. The UEFI BIOS Updater just updates the modules, which belong to the BIOS Region of the BIOS file. The other parts of the BIOS incl. the ME Region stays untouched.

The Intel ME Analyzer does detect the correct Intel ME Firmware version of any UEFI BIOS, which has been opened by the tool.
The purpose of the ME Analyzer as part of the UBU tool is, that the user can easily realize, whether the latest BIOS, which has been delivered by the mainboard manufacturer, contains a newer Intel ME Firmware version than the Intel ME Region has, which is currently working within the user’s mainboard BIOS chip. If the user wants to get the newer Intel ME Firmware, he has to flash it separately by using a special Intel ME Firmware Update tool.