Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Intel CSME 12.0 Corporate PCH-H Firmware v12.0.3.1092

Capture.PNG



Intel PMC CNP PCH-H B1 Firmware v300.2.11.1013

Capture2.PNG

@plutomaniac what is the changelog for latest MEI v11.8.50.3474?
I’m using 3470. Any crucial bug fixes?

I saw that if you want to reset the intel me you need to shut-down the machine and remove the power for one minute at least .
But with mine testing if you want to properly reset the intel me in asus and asrock motherboards you must leave the power cord in and go to jumper move it to CMOS reset for 10 sec and then move it to the default position.

Then i found the post from raja asus that say the same thing (it speak for a bug in clock ):
-https://rog.asus.com/forum/showthread.ph
in-UEFI-The-Fix

In my case with an asrock motherboard if you flash a bios for motherboard that have intel me version smaller from the one that you have flased the fsb becomes bugged.
from 99.76 goes to 99.92 and the platform windows clock stack at 0.5 ms also the cpu fan dont change the fan speed with temps.
Now if u clear the intel me with the above solution the fsb becomes 99.76 and the platfrom clock becomes 15,625 ms.

For Consumer/1.5MB systems, a simple shutdown is enough for a (CS)ME reset. For Corporate/5MB systems, you need to shutdown and remove AC + Battery (not RTC) power for a few seconds because the (CS)ME may stay active for network functionality purposes.

If you’re talking about ME 9.0 systems, the wrong BCLK can be due to old BIOS and ME 9.1 incompatibilities, as explained at the 8-series Warning of the first post.

The machine i tested is a asrock with chipset z97 that is compatible with the 9.1 firmware and update with 1.5mb sytem.
The removal ac and cmos battery dont fix it, but it fixed with the above way.

The default uefi bios have the Intel ME FITC Version: 9.1, Build 1000, Hot Fix 10
this is combatible with the firmware ime update Intel ME 9.1, Build 1002, Hot Fix 37


Can u explain me why the asus tech said that intel me in asus clear in this way:

When the system POSTs, enter UEFI. Once in UEFI power down the motherboard. Keep the PSU attached and "on". Only the motherboard is powered off and in "standby". You will see the MB standby lights on (boards with start buttons onboard will be lit). Standby does not mean the board is actually running, standby means the board has power, but you have not pressed the power button to turn it on. Make sure the board is off before you go to the next step in this list. You will know if it is off because if you leave it for 5 seconds it should not POST~BOOT - this means it is in standby.
Clear CMOS (Clear RTC) for 10 seconds. This will clear the Management Engine.

Any chance of correcting sensor values and temperatures on the Maximus Ranger VIII motherboard through MEI? After delid my CPU the cores temperature stabilized at 25Âșc but the CPU Package temperature remains 53Âșc with 800Mhz.

@ boombastik @ robsonbyte:

Not related to (CS)ME but rather BIOS

I have update now my z170 Pro Gaming to latest v11.8.50.3474 and working.

Intel CSME 12.0 Consumer PCH-H Firmware v12.0.3.1092

Capture.PNG

If my Asus Maximus X Formula comes with the Intel CSME 11.8 Consumer PCH-LP Firmware v11.8.50.3470 firmware it’ll update to the Intel CSME 11.8 Consumer PCH-LP Firmware v11.8.50.3474 firmware just fine I found out but can it run the latest 300 series 12.0 firmware or does an 11.8 firmware board HAVE to run the 11.8 firmware.


It doesn’t, Z370 is PCH-H


No


It doesn’t, Z370 is PCH-H


No




ME Analyzer does say it’s the H version in the BIOS but 3470 and when I run FWUpdate with ‘11.8.50.3474_CON_H_D0_PRD_EXTR.bin’ it updates from 3470 to 3474.

Intel MEI v1826.12.0.1146 for Consumer systems Drivers & Software
Intel MEI v1826.12.0.1146 for Corporate systems Drivers & Software

Intel CSME System Tools v12 r7

There seem to exist firmware 12.0.5.1117, 11.8.55.3510, 10.0.60.3000, 9.5.65.3000 and 9.1.45.3000. All from June 2018. Probably some new vulnerability for (CS)ME 9-12. They’ll be uploaded here when found.

Hi Guys,

After the recent windows update I had some driver issues with MEI and although the driver update seemed to resolve it (on the surface) I have now gone down the rabbit hole of ensuring I have everything updated to the latest fw/sw and running as expected.

I have read through this thread for relevant information and just can’t seem to wrap my arms around the fw status and update due to errors when determining my current set up with meinfo and other tools. Since I have exhausted myself at this point, I was hoping you guys could help!

System is an Asus Deluxe II x99
Intel Core i7-6900K Processor FC-LGA14A

---------------------------------------
MEINFO OUTPUT

Intel(R) MEInfo Version: 11.8.50.3470
Copyright(C) 2005 - 2017, Intel Corporation. All rights reserved.



Intel(R) ME code versions:

BIOS Version 1902
MEBx Version 0.0.0.0000

Error 328: Invalid descriptor region.
GbE Version Unknown
Vendor ID 8086
PCH Version 5
FW Version 9.1.37.1002 H
Security Version (SVN) 1
LMS Version Not Available
MEI Driver Version 11.7.0.1057
Wireless Hardware Version Not Available
Wireless Driver Version Not Available

FW Capabilities 0x40100940

Intel(R) Capability Licensing Service - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Service Advertisement & Discovery - PRESENT/ENABLED

Re-key needed False
Platform is re-key capable True
TLS Disabled
Last ME reset reason Power up
Local FWUpdate Enabled
BIOS Config Lock Disabled
GbE Config Lock Disabled
Host Read Access to ME Unknown
Host Write Access to ME Unknown
Host Read Access to EC Unknown
Host Write Access to EC Unknown
SPI Flash ID 1 Unknown
SPI Flash ID 2 Unknown
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer Unused
Slot 2 System Assembler Unused
Slot 3 Reserved Unused
M3 Autotest Disabled
C-link Status Disabled
Independent Firmware Recovery Enabled
EPID Group ID 0xAD8
LSPCON Ports Not set
5K Ports Not set
OEM Public Key Hash FPF Not set

Error 57: Failed getting variable “OEM Public Key Hash”,
Please make sure you are running on appropriate SKU


OEM Public Key Hash ME Not set
ACM SVN FPF Not set
KM SVN FPF Not set
BSMM SVN FPF Not set
GuC Encryption Key FPF Not set

Error 57: Failed getting variable “GuC Encryption Key”,
Please make sure you are running on appropriate SKU


GuC Encryption Key ME Not set

FPF ME
— –
Force Boot Guard ACM Not set
Error 57: Failed getting variable “Force Boot Guard ACM Enabled”,
Please make sure you are running on appropriate SKU


Not set
Protect BIOS Environment Not set
Error 57: Failed getting variable “Protect BIOS Environment Enabled”,
Please make sure you are running on appropriate SKU


Not set
CPU Debugging Not set
Error 57: Failed getting variable “CPU Debugging”,
Please make sure you are running on appropriate SKU


Not set
BSP Initialization Not set
Error 57: Failed getting variable “BSP Initialization”,
Please make sure you are running on appropriate SKU


Not set
Measured Boot Not set
Error 57: Failed getting variable “Measured Boot Enabled”,
Please make sure you are running on appropriate SKU


Not set
Verified Boot Not set
Error 57: Failed getting variable “Verified Boot Enabled”,
Please make sure you are running on appropriate SKU


Not set
Key Manifest ID Not set
Error 57: Failed getting variable “Key Manifest ID”,
Please make sure you are running on appropriate SKU


Not set
Enforcement Policy Not set
Error 57: Failed getting variable “Error Enforcement Policy”,
Please make sure you are running on appropriate SKU


Not set
---------------------------------------

---------------------------------------
MEANALYZER OUTPUT

ME Analyzer v1.55.4 r129
X99-DELUXE-II-ASUS-1902.CAP (1/1)
Firmware Family - ME
Firmware Version - 9.1.37.1002
Firmware Release - Production
Firmware Type - Region, Extracted
Firmware SKU - 1.5MB
Security Version Number - 1
Version Control Number - 12
Production Version - Yes
Firmware Date - 2015-11-07
Firmware Size - 0x17D000
Flash Image Tool - 9.1.10.1000
Chipset Support - LPT/WPT
Firmware Latest - Yes

---------------------------------------

OTHER POSSIBLY RELEVANT INFO
Windows 10 Professional (x64) Version 1803 (build 17692.1004)
Boot Mode: UEFI with successful Secure Boot
All other system drivers are the latest.
Board: ASUSTeK COMPUTER INC. X99-DELUXE II Rev 1.xx
BIOS UEFI: American Megatrends Inc. 1902 04/19/2018
NVIDIA GeForce GTX 1080 [Display adapter] (2x)
Intel(R) C600+/C220+ series chipset SATA AHCI Controller
Intel(R) C600+/C220+ series chipset sSATA AHCI Controller
Intel(R) C610 series/X99 chipset USB Enhanced Host Controller


The X99 chipset always seems to fall in this weird space that leaves me with limited info compared to the x299 for example.

What is the latest firmware/driver I need? Any other relevant information is sincerely appreciated!

Thank you!!!

@MNOiSY
For ASUS SabertoothX99 I do use these MEI items:

X99_MEI_driver_15juillet18.PNG

X99_MEI_firmware_15juillet18.PNG

Thank you so much for that info! Mine seems to match yours but I do have tons of Not Capable and Disables in the Firmware capabilities section of HWinfo. Is that typical?

@MNOiSY
I don’t worry about ‘capabilities’ information. For me it does seem normal to have ‘not capable’ and ‘disabled’ MEI features reported for our specific MEI version running well.

Thank you!

Intel CSME 12.0 Consumer PCH-H Firmware v12.0.5.1117

Capture1.PNG



Intel CSME 12.0 Slim PCH-H Firmware v12.0.1.1085

Capture2.PNG



Intel CSME 12.0 Slim PCH-LP Firmware v12.0.1.1085

Capture3.PNG



Intel CSME 11.8 Corporate PCH-H Firmware v11.8.55.3510

Capture8.PNG



Intel CSME 11.8 Consumer PCH-LP Firmware v11.8.55.3510

Capture4.PNG



Intel CSME 11.8 Corporate PCH-LP Firmware v11.8.55.3510

Capture5.PNG



Intel PMC CNP PCH-H B1 Firmware v300.2.11.1014

Capture6.PNG



Intel PMC CNP PCH-LP C0 Firmware v300.1.20.1009

Capture7.PNG



Intel CSME System Tools v12 r8

Intel CSME System Tools v11 r13

Notice about CSME 12 FWUpdate Tool: Starting from CSME 12, Intel FWUpdate tool does not work with bare RGN or EXTR CSE firmware as it requires that they are first combined/stitched with the equivalent Power Management Controller (PMC) firmware, which is updated alongside the main CSE firmware. The CSME v12 archives below always include bare RGN or EXTR CSE firmware images so you must always stitch the equivalent PMC firmware first, via Flash Image Tool (FIT), before using Intel FWUpdate tool. To check if a CSE RGN/EXTR firmware region is already FWUpdate compatible, input it at ME Analyzer tool and make sure that “FWUpdate Support” is reported as “Yes”.

To generate FWUpdate compatible CSME + PMC firmware via FIT with OEM SPI/BIOS images as input:

  • Load the full SPI/BIOS image into Flash Image Tool
  • Set “Flash Settings > Flash Components > Number of Flash Components” to "0"
  • Build the image and use “cse_image_FWU_Base.bin” at Intel FWUpdate tool

To generate FWUpdate compatible CSME + PMC firmware via FIT with CSME RGN/EXTR images as input:

  • Load the bare CSME RGN/EXTR firmware into Flash Image Tool
  • Input the compatible, based on PCH SKU & Stepping, Power Management Controller (PMC) firmware at "Flash Layout > Ifwi: Intel(R) Me and Pmc Region > PMC Binary File"
  • Adjust the PCH SKU selection at the top of the FIT window to the equivalent “H or LP Series Chipset” so that it matches the one from the CSME and PMC firmware
  • Set “Flash Settings > Flash Components > Number of Flash Components” to "0"
  • Build the image and use “cse_image_FWU_Base.bin” at Intel FWUpdate tool

CSME 12.0.5.1117 & 11.8.55.3510 Changelog:

  • Fixed security vulnerabilities CVE-2018-3655, CVE-2018-3657, CVE-2018-3658, CVE-2018-3659, CVE-2018-3616, CVE-2018-3643 & CVE-2018-3644
  • Intel AMT might fail to connect to 802.1x WLAN Environment
  • Intel FWUpdate tool hangs when attempting to perform an update on a corrupted image
  • Intel MEInfo returns an error after running MEInfoWin64.exe

Hi,

Have a stupid question regarding Intel CSME 11.8 Consumer PCH-H Firmware v11.8.50.3474. When I opened up the image I noticed it says its a Production-Extracted release. I thought Extracted MEs are dirty and not safe to flash unless they are cleaned first?

Thanks.