Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Special Topics Intel Management Engine
2301

@ greg.chalk:

Thank you for the report greg.chalk. You said you flashed NOPDM firmware. So afterwards, it should have been 200 and not 020. Maybe you mixed up the numbers. To verify for sure, attach the result of command FWUpdLclWin -save me.bin here.

@ kostar20071:

Thank you for the report kostar20071. Before flashing, what ME firmware did you have? The latest BIOS from Lenovo for your model has Consumer 11.0.0.1160 firmware (NOPDM) so it should have been 200 (Consumer NOPDM) and not 300 (Corporate NOPDM) or 030 (Corporate PDM) before flash. It’s always better to upload actual MEInfo -verbose reports, otherwise there can be confusion with what got flashed and when.

@ rvail623:

You are confusing ME SKU and chipset/cpu SKU.

There are 2 chipsets: PCH-H (Performance) and PCH-LP (Low Power)

There are 4 cpu families: SKL-S, SKL-H, SKL-U and SKL-Y

PCH-H works with SKL-S and SKL-H
PCH-LP works with SKL-U and SKL-Y

Regarding Intel ME 11.x firmware:

PCH-H needs ME 11.x H firmware
PCH-LP needs ME 11.x LP firmware

There are 2 ME firmware SKUs: Consumer (less features) and Corporate (all features)

In total there are 4 ME 11.x firmware SKUs:

Consumer PCH-H
Consumer PCH-LP
Corporate PCH-H
Corporate PCH-LP

2302



OK so, to clarify:
Specifically for the GA-Z170MX-Gaming 5 board, which is a Skylake-S Consumer PCH-H chipset Socket LGA1151 board and uses the Consumer PCH-H 1.5 Mb NOPDM version 11.x ME firmware.
And: that "11.0.11.1005_CON_H_D0_NOPDM_PRD_RGN.bin" is the correct & latest ME firmware for the GA-Z170MX-Gaming 5 board.
Yes?

2303

That board requires Consumer PCH-H firmware. We don’t know what PDM is but it shouldn’t be important for end-users, otherwise we would have seen it being mentioned somewhere. Most tests show that flashing between PDM and NOPDM is not a problem but since there have been some problematic reports, the warning is found at the 1st post. So for your system, the latest CON PCH-H is all you need, PDM and NOPDM are still an unknown variable.

2304

@plutomaniac do we need to install the intel management engine components s/w? thanks.

2305

Why do you address this question to me?
Our expert for the topic "Intel Management Engine" is plutomaniac.

@plutomaniac :
Please be so kind and help khanmein.

2306

@Fernando sorry yeah cos i often saw u online. no offense for everyone.

2307

@ khanmein:

If you have a Consumer/1.5MB system then you only need the MEI driver. For Corporate/5MB systems you should install MEI Drivers & Software. For the latter, you can install only the MEI driver if you don’t use any Corporate/5MB firmware capabilities such as KVM, AMT etc.

2308

@plutomaniac my mobo is ASRock H97 Pro4. previously, i’m not able to update firmware using the Consumer/1.5MB but i manage to update using the Corporate/5MB.


i’m kinda confused cos by right this mobo should be under Consumer.

2309

No, your board uses Corporate/5MB firmware. Just input the ASRock BIOS at MEA and you’ll see for yourself. So in your case, you can either install the MEI-Only driver if you don’t use any 5MB features or the Driver & Software pack otherwise.

2310



Now you’re starting to sound like Donald Rumsfeld: "There are known knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we know we don’t know. But there are also unknown unknowns."

2311

@plutomaniac
Sorry for my late reply, I didn’t saw your post.

Because of the warnings, I triple checked the files before the ME update.

Here is the extracted me.bin you asked

me.zip (1.16 MB)

2312

Intel MEI Driver v11.5.0.1011 INF for manual installation
Intel SOL "Driver" v11.5.0.1003 INF for manual installation
Intel MEI Drivers & Software v11.5.0.1015 for Consumer systems complete package
Intel MEI Drivers & Software v11.5.0.1003 for Corporate systems complete package

Intel ME 11.5 Consumer PCH-LP Firmware v11.5.0.1058

Capture.PNG



For 100/200-series SKL/KBL-U and SKL/KBL-Y systems which come with ME firmware v11.5.x

Warning: KabyLake-U and KabyLake-Y are not released yet! For research only!

MEA: 11.5.0.1058_CON_LP_XX_UKPDM_PRD_EXTR_FFF127D25BB18FA2FD53564CAF3056EC2F79E5D5_SHA1

@ greg.chalk:

Your binary confirms that you have Consumer LP NOPDM firmware flashed. That exact firmware has been tested by someone else as far as the FW Status Register3 value is concerned. It should be 200 which we have associated with CON NOPDM. As a last test, run Flash Programming Tool with command fptw -greset and after the reset, check MEInfo again. Don’t you see 200?

2313

@plutomaniac
still the same, although the laptop seems to work fine.

1.png

2314

I don’t understand something, everybody here talks about gigabyte z*** boards, how they flash latest imei firmware, and i’m the only one who cannot update because it’s restricted??

2315

Rewritten Warning 1 for 100-series systems to add more details and better explanation
Rewritten Warning 2 for 100-series systems to change most of the stuff that were written before
Reuploaded Intel ME 11.0 CON/COR PCH-H/LP Firmware with latest version regardless of PDM and a new "Term Help" file

Capture1.PNG



@ greg.chalk:

Thank you for showing me some proof greg.chalk. I’m not saying that the laptop is not working properly. After your report and Pacman’s, I just realized that a) we cannot use FW Status Register3 to determine PDM/NOPDM and b) I’m sick of dealing with this PDM nonsense. It seems to work for most people and reflashing will usually resolve FWUpdate getting stuck the first time. Thus, I decided to change the 2nd SKL warning as seen above. Again, thank you for that last report.

@ burner07:

What do you mean “restricted”? Explain in detail what you are trying to do. If you are getting the “Local ME Firmware Update disabled” error then the problem is BIOS related. Make sure you have the latest BIOS flashed, otherwise contact Gigabyte and ask them to fix it.

2316

Re: "Since FWUpdate v11.0 tool does not have a safeguard implemented to check between PCH-H and PCH-LP ME firmware, if you flash the wrong SKU you will end up with a bricked motherboard after which a SPI chip reflash is needed."
Wouldn’t the secondary backup bios feature on most Gigabyte motherboards (and a few other boards from other brands) suffice to recover from a faulty ME firmware flash?

2317

Today I tried to update my ME firmware for my ASRock Z170 Extreme4, after any ME update until 11.0.11.xxxx went well.
Trying to respect all the new warnings I took 11.0.15.1003_CON_H_D0_UKPDM_PRD_EXTR_FWU.bin (Consumer) for my board. I loaded system tools v11.0 r19, startet upgrade FWUpdLcl64.exe -f me.bin and about ~60% I got an error.

So I rebootet, startet Update again, but it failed right after start, because Intel Management Engine Interface was missing now. I entered UEFI to check which ME FW was displayed, it said: 0.0.0.0
I reflashed UEFI to get back ME which worked and now I stick at version 11.0.0.1180 which came from UEFI update, until things are more clear to me. Maybe I shouldn’t do the update with update 11.5.0.1011?

Sadly the second update has overwritten the old errorlog instead creating a new, so it wont help much.

1
2
3
4
5
6
7
 

Error 8193: Fail to load MEI device driver (PCI access for Windows)
Above error is often caused by one of below reasons:
Administrator privilege needed for running the tool
ME is in an error state causing MEI driver fail
MEI driver is not installed
 
 
2318

@ rvail623:

If the FD of the 1st chip is unlocked (Gigabyte leaves both of them unlocked to my knowledge) then of course you can switch to the 2nd chip, boot, switch to 1st and relfash the SPI image or just ME region.

@ Morku:

It’s the stupid PDM issue all over again. I don’t think the 11.5 driver is related because it’s supposed to support 100-series systems. But in your case, I would use the older and definitely stable 11.0 driver just to be on the safe side. At least until the 11.5 branch has matured a bit more. Does your system have an unlocked Flash Descriptor? That’s the only way to recover from a bad ME firmware flash unless your board uses ASRock’s ME “recovery” feature, which enforces only one version and reverts back whenever a newer one is flashed - probably not since you said you were at 11.0.11 firmware. Based on the fact that you received an error, it may be that the 11.0.15 we have is PDM and you are one of the cases where “cross-flashing” NOPDM and PDM leads to FWUpdate errors and thus ME corruption. For some people, retrying to flash the same firmware (even PDM), after restoring the previous working one, worked the 2nd time without issues. I don’t really know what to suggest. It depends on whether you can always restore/reflash the SPI in case of trouble. If you can, I would say to install 11.0 driver and try again 11.0.15 followed by 11.0.12 PDM if the former is (again) unsuccessful.

2319

Thanks for the explanation, but I have no idea if ASRock have an unlocked Flash Descripter or recovery. All I can say is, that I was definitely on 11.0.11.1005. MEInfo and the ASRock UEFI display confirmed.
As I said, after that bad flash, my Intel ME Interface was gone and UEFI displayed 0.0.0.0. I wanted to try a second flash (after reboot), because of the reports that it may success, but I couldn’t.
When it does an UEFI update, it checks ME firmware and do an ME update before UEFI gets updated. When ME firmware is higher than ME version which comes with the UEFI update, it skips that step. Because of my version 0.0.0.0 it updated back to 11.0.0.1180.

Which tasks works in background and how it gets done… I don’t know… thats why I will wait some more, because I really don’t want get some serious trouble. When I checked FW Status Register3, I have NOPDM (if it’s still important, because the information is missing now in first post). Why isn’t 11.0.11.1005 NOPDM attached in first post anymore?
But if I still can help somehow with information, just tell me how.

2320

To check if your FD is locked, just run Flash Programming Tool with command “fptw -d spi.bin”. If you see “cpu access error” then you FD is locked, otherwise unlocked.

In your case though, you definitely have the ASRock ME recovery feature. Based on what you described, they changed it. Previously it forced 11.0.0.1180 even if the user updated properly to a newer version. Now it seems to only restore in case the version if older or the fw is corrupted (no driver interface available, version 0.0.0.0).

I changed how I deal with PDM some days ago due to conflicting reports and lack of any info from Intel or new packages. The FW Status Register3 of 11.0.15 was new, another user was seeing the value of PDM firmware (020) even though he had clearly flashed NOPDM (200) etc. I got tired of dealing with PDM, especially since Intel only documents Register1 and 2 with no mention for 3 or higher. If you need the last NOPDM firmware again then check the Engine Firmware Repository thread.