Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Intel CSME System Tools v12 r10

Hello to all. We developed a motherboard on the Intel Atom c3538 denverton_ns. We need the Intel SPS ME (Intel server platform services (SPS) manageability engine (ME) firmware & tools) package or at least the spsFITc utility from this package to modify the custom BIOS for our motherboard. Intel support cannot or does not want us to provide this package. We have privileged access and CNDA, but we cannot provide the package. Who faced similar? Can someone tell me a solution? Or tell me where we can just download this program (spsFITc)?

@dubel1976 - hopefully plutomaiac will be able to help you once he sees this request. He may need to know the ME SPS version, like V2, V3, V4 etc

Good Morning.

I’d like to clean me region using Intel Flash Image Tool. Version: 11.8.50.3460. But when I am trying open 16 MB bios file program shows an error. I would be greatful if anyone could help me.

Use the latest version of ME Analyzer and check for any errors. Also, compress & attach or link to your SPI dump.

I guess there is no errors or is there any command which looking for one? Here is a SPI Dump

That SPI/BIOS was built with a very old FIT v11.0.0.1160 which was probably slightly bugged as any version after it fails to open that image. Do you want to clean the initialization and update the firmware to the latest?

Yes i want to clean the initialized in data section. It doesn’t have to be the latest version of me region. Is there any way to clean that bios? Would it work in older version of FIT v11? i cannot find this older version anywhere.


I have attached the equivalent Configured and not Initialized SPI image.

dump CLEAN.rar (4.15 MB)



We need IntelÂŽ Server Platform Services for Harrisonville MicroserverPlatforms PV 4.0.3.068.0 (ver. 4). We really need help with getting this software. An example of the BIOS is attached (HVLRCRB.86B.WR.64.2018.41.4.01.1353.HCV15D96).

HVLRCRB.86B.WR.64.2018.41.4.01.1353.HCV15D96.rar (3.62 MB)

Thanks @dubel1976 - I’m sure once plutomaniac has a chance to check he will PM you.

Intel CSME 11.8 Consumer PCH-LP Firmware v11.8.59.3560

Capture1.PNG



Intel CSME 11.8 Corporate PCH-LP Firmware v11.8.59.3560

Capture2.PNG



Intel CSME System Tools v11 r16

Intel CSME 12.0 Slim PCH-H Firmware v12.0.9.1125

Capture.PNG



Intel CSME 11.8 Slim PCH-LP Firmware v11.8.58.3511

Capture2.PNG

Intel CSME 12.0 Consumer PCH-H Firmware v12.0.10.1127

Capture1.PNG



Intel CSME 12.0 Corporate PCH-H Firmware v12.0.10.1127

Capture2.PNG



Intel CSME 12.0.10.1127 Changelog

  • Intel MEI Driver version shown in IMSS might differ from the version shown in the device manager.
  • Intel MEI Installer might need /skipstartmenu parameter to remove start menu path.
  • An extra reset might be performed automatically when resuming from S4/S5 in DC mode.
  • Black screen might be shown after the system boots from S4/S5 instead of displaying the user consent screen.
  • Intel CSME might crash after transiting to states Hx/Sx.
  • Intel AMT might cause panic with DAM (Delayed Authentication Mode) enabled in BIOS.
  • Intel CSME might hang during WLAN initialization which occurs on CM_off resume flow.
  • A warning yellow mark might be displayed in the device manager on Intel Smart Sound Technology driver after performing Clear TPM.

Intel CSME 12.0 Consumer PCH-LP Firmware v12.0.7.1122

Capture2.5.PNG



Intel PMC CNP PCH-H B Firmware v300.2.11.1018

Capture3.PNG



Intel CSME System Tools v12 r11

Intel CSME System Tools v11 r16


Thanks, all works.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
Intel(R) ME code versions:
BIOS Version 1.10
MEBx Version 0.0.0.0000
GbE Version Unknown
PMC FW Version 300.2.11.1018
Descriptor Version 1.0
Vendor ID 8086
FW Version 12.0.10.1127 H Consumer
LMS Version Not Available
MEI Driver Version 1828.12.0.1152
Wireless Hardware Version 2.1.77
Wireless Driver Version 20.90.0.100
 
PCH Information
PCH Version 10
PCH Device ID A305
PCH Step Data B1
PCH SKU Type Production Pre-QS Revenue
PCH Replacement Counter 0
PCH Replacement State Disabled
PCH Unlocked State Disabled
 
FW Capabilities 0x11109140
 
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Persistent RTC and Memory - PRESENT/ENABLED
 
FW Type Production
TLS Disabled
Last ME reset reason Global system reset
Local FWUpdate Enabled
BIOS Config Lock Enabled
GbE Config Lock Enabled
Host Read Access to ME Enabled
Host Write Access to ME Enabled
Host Read Access to EC Enabled
Host Write Access to EC Enabled
SPI Flash ID 1 EF4018
SPI Flash ID 2 Not Available
BIOS boot State Post Boot
OEM ID 00000000-0000-0000-0000-000000000000
Capability Licensing Service Enabled
OEM Tag 0x00000000
Slot 1 Board Manufacturer 0x00000000
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
M3 Autotest Disabled
C-link Status Disabled
EPID Group ID 0x28BC
Keybox Not Provisioned
Intel(R) PTT Supported No
Intel(R) PTT initial power-up state Disabled
PAVP Supported Yes
Integrated Sensor Hub Initial Power State Disabled
End of Manufacturing Enable No
Post Manufacturing NVAR Config Enabled Yes
Minimum Allowed Anti Rollback SVN 1
Image Anti Rollback SVN 4
Trusted Computing Base SVN 1
ACM SVN FPF 0x00
KM SVN FPF 0x00
BSMM SVN FPF 0x00
OEM Public Key Hash FPF Not set
OEM Public Key Hash UEP 0000000000000000000000000000000000000000000000000000000000000000
OEM Public Key Hash ME FW 0000000000000000000000000000000000000000000000000000000000000000
HW Binding Enabled
 
FPF UEP ME FW
*In Use
--- --- -----
Key Manifest ID Not set 0x00 0x00
PTT Not set Enabled Enabled
SPI Boot Source Not set Enabled Enabled
Enforcement Policy Not set 0x00 0x00
OEM ID Not set 0x00 0x00
TXT Supported Disabled Disabled Disabled
OEM Key Manifest Present Not Present Not Present Not Present
OEM Platform ID Not set 0x00 0x00
SOC Config Lock Not set Not Done Not Done
Persistent PRTC Backup Power Enabled Enabled Enabled
CPU Debugging Not set Disabled Disabled
BSP Initialization Not set Disabled Disabled
Measured Boot Not set Disabled Disabled
Verified Boot Not set Disabled Disabled
Protect BIOS Environment Not set Disabled Disabled
 
FW Status Register1: 0x94000255
FW Status Register2: 0x02F10506
FW Status Register3: 0x00000020
FW Status Register4: 0x00004800
FW Status Register5: 0x00000000
FW Status Register6: 0x00000006
 
CurrentState: Normal
ManufacturingMode: Enabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: ROM/Preboot
ME File System Corrupted: No
PhaseStatus: PROTECTED_START
FPF and ME Config Status: Not committed
 



Flash succeeded.

As far as I can tell the changelog for 11.8.59.3560 over 11.8.55.3510 is just "Fixed an issue where PXE Boot might fail after configuring Intel AMT".

https://pcsupport.lenovo.com/us/en/downloads/ds120415

Thank you very, very much Plutomaniac and Fernando for this guide! Worked well for me, updating Asus Sabertooth X79 to later version of IME 8.1 firmware (using the Local-Win64 FWUpdlcl64 tool, and only after confirming installed Intel Management version with HWInfo64 and confirming functionality of UEFI-BIOS with MEInfoWin64 and MEManufWin64).

In Chapter B of initial (Guide) post, in the paragraph beginning:
“Warning for 8-series systems:”
the 8-series is referring to the Intel chipset version and/or processor generation, and is NOT referring to Intel Management Engine firmware version. Thus, the original following 4 paragraphs of this post, about a possible typographical error, were moot and were subsequently removed (on 11/23/2018). My bad.

A single suggestion regarding the guide is to consider making it explicitly clear that (at least some of) the command line tools for Intel Management Engine assessment may require an “elevated command prompt” or, in other words, command line opened with administrator privileges. I fumbled around for a bit before I realized what I was doing wrong. Currently the only references to that detail are under the specific sections of “Notice for CSME v11 INTEL-SA-00086” and under "Engine Firmware Updating."

That trivia aside, thank you both again for this excellent guide!



Hello!

First of all, I would like to thank you for the spectacular guide.

Two months ago I bought a shiny new rig, after having the same computer equipment since 2006, and thus I was slightly confused by the extra things Intel packed into their processors (yes, I chose Intel).

Anyway, I didn’t know one can update a processor’s firmware (OK, one of its components, but still) and paint me surprised when I stumbled upon this thread! Through thorough absorption of the (CS)ME topic presented here, and use of the bundled tools from the first post (Intel CSME System Tools v12 r11 [2018-11-03]), plus HWInfo, CPU-Z, and Intel Management Engine Critical Firmware Update, I determined my i5-8400 would be suitable for:

- Intel CSME 12.0 Consumer PCH-H Firmware v12.0.10.1127 and
- Intel PMC CNP PCH-H B Firmware v300.2.11.1018

firmware updates. But since I need to merge both of the above via the FIT tool, and only then I can update via the FWUpdate tool, I now have five questions about the validation of the whole procedure for my particular case:

1) The instructions distinguish that I need to adjust PCH Type & SKU in the drop-down menu and I know I need to set it to the H version of the H310 chipset (even the motherboard, of Gigabyte, has H310 DS2 in its name), but it says Intel Cannonlake H Series Chipset, and since 8th generation is supposed to be Coffelake, and 9th generation is supposed to be Cannonlake exactly, I am now confused… are these selections viable? The earlier versions of FIT have no choice for the H310 chipset.

2) I don’t need to change the IFWI layout option from the default 1.6 to 2.0, do I?

3) There is also no need to include Chipset Initialization Binary during the merge procedure, yes?

4) The FIT tool asked me about having the Boot Guard Disabled On Platform. Does it mean I made an error somewhere during the process?

5) If I have Intel MEI drivers and software installed and MEI firmware updated, I don’t need to do the same for CS TXE and CS SPS, or should I? Damn, this is all too wild.

Thank you in advance!

Intel CSME 12.0 Slim PCH-H Firmware v12.0.11.1130

Capture.PNG



@ dmanuele:

X79 is 7-series

@ Wickez:

1. CSME 12 runs on top of Cannon Point PCH which was supposed to be released with CannonLake but we all know the story. Ignore the name at FIT, you’ll find H310 under the H drop down menu.
2. No
3. No
4. Normal, ignore it
5. I don’t understand what MEI has to do with CSTXE or CSSPS. Don’t do anything on those.

Guys, sorry if this is a dumb question but I have no clue which Intel Management Engine driver would be compatible for my device.

I have a Gigabyte Z370 HD motherboard (Z370 Chipset) with an i5-8600K CPU. The one Gigabyte’s website offers is outdated. Intel’s website does not offer any Intel Management Engine drivers for my device components.

Is there an official compatible IME Driver for my device?