Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Special Topics Intel Management Engine
5198

Intel CSME System Tools v11 r36 - (2020-10-31) -> FWUpdate (LINUX64): 11.8.80.3762
Which to choose:
Intel CSME Firmware v11.8.80.3746 (CON H DA) -> 11.8.80.3746_CON_H_DA_PRD_RGN.bin
or
Intel CSME Firmware v11.8.81.3781 (CON H DA) -> 11.8.81.3781_CON_H_DA_PRD_RGN.bin
Can I expect problems if the version of Intel CSME Firmware is smaller than the version for FWUpdate?

5199

Intel CSME 11.8 Corporate PCH-LP C YPDM Firmware v11.8.81.3781

Capture.PNG



@ ibsajc:

Choose the latest. No problem with FWUpdate.

5200


INTEL-SA-00391 it is also mentioned here -> https://www.station-drivers.com/index.ph…id=4652&lang=en


Now its up! https://www.intel.com/content/www/us/en/…l-sa-00391.html
I wonder how often these updates come up meanwhile. Reading about the new Apple M1 approach makes me also wonder how long someone wants to mess with all these flaws in self built systems.

5201

@ plutomaniac:

ME 14, dump from this thread, machine bricked after just reading? bios chips
After reading BIOS chips, Dell Latitude 3510 won’t start

ME 14.0.37.1165, built with FIT 14.0.11.1205 (updated?)

FIT 14.0.36.1158 can’t read image (used according to recommendation “For Comet Lake H/LP systems which run CSME v14.0.20 or newer”)

me14_1.jpg




FIT 14.0.11.1205 opens the image without complaining

ME14_2.jpg



MEA reads “unconfigured” and reports an unrecognizable format in MFS partition at 0x10700.

║ ME Analyzer v1.173.0 r216 ║
…
║ Family │ CSE ME ║
╟─────────────────────────────┼──────────────╢
║ Version │ 14.0.37.1165 ║
╟─────────────────────────────┼──────────────╢
…
╟─────────────────────────────┼──────────────╢
║ SKU │ Consumer LP ║
╟─────────────────────────────┼──────────────╢
║ Chipset Stepping │ B, A ║
╟─────────────────────────────┼──────────────╢
…
╟─────────────────────────────┼──────────────╢
║ File System State │ Unconfigured ║
╟─────────────────────────────┼──────────────╢
…
║ Flash Image Tool │ 14.0.11.1205 ║
…
Error: Skipped MFS partition at 0x107000, unrecognizable format!


“Unconfigured”, brick, and errors in FIT when opening dump would fit toghether just fine, but on the other hand this dump opens without any complaint in an older FIT version and does have a configuration.

Is this ME region really unconfigured, and has an MFS partition with an urecongnizable format or is this just a glitch in the Matrix?

Thanks in advance!


╔═══════════════════════════════════════════╗
║ ME Analyzer v1.173.0 r216 ║
╚═══════════════════════════════════════════╝

╔════════════════════════════════════════════╗
║ test (1/1) ║
╟─────────────────────────────┬──────────────╢
║ Family │ CSE ME ║
╟─────────────────────────────┼──────────────╢
║ Version │ 14.0.37.1165 ║
╟─────────────────────────────┼──────────────╢
║ Release │ Production ║
╟─────────────────────────────┼──────────────╢
║ Type │ Extracted ║
╟─────────────────────────────┼──────────────╢
║ SKU │ Consumer LP ║
╟─────────────────────────────┼──────────────╢
║ Chipset Stepping │ B, A ║
╟─────────────────────────────┼──────────────╢
║ TCB Security Version Number │ 1 ║
╟─────────────────────────────┼──────────────╢
║ ARB Security Version Number │ 7 ║
╟─────────────────────────────┼──────────────╢
║ Version Control Number │ 3 ║
╟─────────────────────────────┼──────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼──────────────╢
║ OEM Configuration │ Yes ║
╟─────────────────────────────┼──────────────╢
║ FWUpdate Support │ No ║
╟─────────────────────────────┼──────────────╢
║ Date │ 2020-05-20 ║
╟─────────────────────────────┼──────────────╢
║ File System State │ Unconfigured ║
╟─────────────────────────────┼──────────────╢
║ Size │ 0x335000 ║
╟─────────────────────────────┼──────────────╢
║ Flash Image Tool │ 14.0.11.1205 ║
╟─────────────────────────────┼──────────────╢
║ Chipset Support │ CMP-H/LP ║
╟─────────────────────────────┼──────────────╢
║ Latest │ No ║
╚═════════════════════════════╧══════════════╝
╔═════════════════════════════════════════════╗
║ Power Management Controller ║
╟─────────────────────────────┬───────────────╢
║ Family │ PMC ║
╟─────────────────────────────┼───────────────╢
║ Version │ 140.1.01.1010 ║
╟─────────────────────────────┼───────────────╢
║ Release │ Production ║
╟─────────────────────────────┼───────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼───────────────╢
║ Chipset SKU │ LP ║
╟─────────────────────────────┼───────────────╢
║ Chipset Stepping │ A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │ 2 ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │ 2 ║
╟─────────────────────────────┼───────────────╢
║ Version Control Number │ 0 ║
╟─────────────────────────────┼───────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼───────────────╢
║ Date │ 2020-03-18 ║
╟─────────────────────────────┼───────────────╢
║ Size │ 0x14000 ║
╟─────────────────────────────┼───────────────╢
║ Chipset Support │ CMP-H/LP ║
╟─────────────────────────────┼───────────────╢
║ Latest │ Yes ║
╚═════════════════════════════╧═══════════════╝
╔════════════════════════════════════════════════════════╗
║ Platform Controller Hub Configuration ║
╟─────────────────────────────┬──────────────────────────╢
║ Family │ PCHC ║
╟─────────────────────────────┼──────────────────────────╢
║ Version │ 14.0.0.7001 ║
╟─────────────────────────────┼──────────────────────────╢
║ Release │ Production, Engineering ║
╟─────────────────────────────┼──────────────────────────╢
║ Type │ Independent ║
╟─────────────────────────────┼──────────────────────────╢
║ TCB Security Version Number │ 0 ║
╟─────────────────────────────┼──────────────────────────╢
║ ARB Security Version Number │ 0 ║
╟─────────────────────────────┼──────────────────────────╢
║ Version Control Number │ 0 ║
╟─────────────────────────────┼──────────────────────────╢
║ Production Ready │ Yes ║
╟─────────────────────────────┼──────────────────────────╢
║ Date │ 2019-05-01 ║
╟─────────────────────────────┼──────────────────────────╢
║ Size │ 0x1000 ║
╟─────────────────────────────┼──────────────────────────╢
║ Chipset Support │ CMP-H/LP ║
╟─────────────────────────────┼──────────────────────────╢
║ Latest │ No ║
╚═════════════════════════════╧══════════════════════════╝

Error: Skipped MFS partition at 0x107000, unrecognizable format!

5202


The CSE File System (MFS) is corrupted. It could explain the brick. MEA detects that and skips it to avoid a crash.

If the image was built with 4.0.11 then it probably needs to be opened with <= 4.0.11. The CSME firmware version is newer due to FWUpdate usage most probably.

Even if FIT does not show an MFS error, it cannot parse that corrupted mess so don’t trust it. If the MFS is corrupted then another healthy dump needs to be found, clean that and move the cleaned/configured ME Region manually using UEFITool or similar.

5203

Thanks a lot!

Wasn’t aware of this logic in MEA, but it’s quote obvious that MEA considers ME ‘unconfigured’ if it can’t read the configuration correctly. A nice feature would be a different marking in the ‘File system state’ field like ‘unclear’. That would describe the current state a little more consistent for the unexperienced.
Rebuild the ME with (probably corrupted…) settings with Fit 14.0.11, opens correctly in both FIT versions now, so this error hadn’t anything to do with FIT versions, but was caused by corrupt MFS partition.

5204

Intel CSME 14.0 Consumer PCH-H A Firmware v14.0.46.1431

Capture.PNG
Capture.PNG491×647 13.3 KB




Such a thing exists already. When the MFS analysis starts but crashes midway, the File System State shows a red "Error" instead:

Capture1.PNG



But if MEA cannot even detect the MFS as a valid File System, it skips it beforehand and shows that error message. In that case it does seem to show "Unconfigured" instead which is not wrong but I agree that it can cause confusion. I’ll see if I can make it show the red "Error" state as well in that case. Interesting observation/suggestion, thank you lfb6.


In this case, it is not just bad settings. The entire structure of the MFS is filled/mixed with garbage data. Another dump needs to be used for cleaning and then moving back.

5205

Tried to update with this latest firmware, built the image as usual, as described, but when I try to update I get an error.
Error 639: Loader failed to verify manifest signature of PPHY.
Any ideas ?

5206

That doesn’t make sense to me. PPHY is not a CSME 14.0 partition. Are you using the latest FWUpdate we have (14.0.45.1389) with the correct combination of firmware components?

Intel CSME 14.0 Consumer PCH-H A Firmware v14.0.46.1431
Intel PMC CMP PCH-H A Firmware v140.2.01.1011
Intel PCHC CMP PCH-H/LP Firmware v14.0.0.1002

5207

Yes, using all the latest, but the Intel PCHC CMP PCH-H/LP Firmware v14.0.0.7002 because…1002 gives some other error.

5208

Good. On that same system, had you updated to the previous firmware version 14.0.45.1389 without a problem?

5209

Yes, previously it worked perfectly, but I recall getting the same error when I tried to … overwrite the firmware with the one prebuilt by ASUS, same version, with allowsv argument.

Untitled-1.png

5210

The one the OEMs provide is the pre-stiched CSME+PMC+PCHC. There is no need to re-flash it. Aside from that, I don’t see anything wrong with the firmware or steps used. It could be a FWUpdate <= 14.0.45.1389 (tool) or CSME 14.0.45.1389 (firmware) bug. Run “FWUpdLcl64 -save upd.bin”. Also, if you have read access to the CSE region of the SPI/BIOS chip, run “fptw64 -me -d cse.bin”. Compress and attach/link to these files.

5211

OK, I think I found the issue, but no idea what went wrong, where or how.
When I ran the "FWUpdLcl64 -save upd.bin" command I got the following errors :
Error 357: Restore Point Image was requested, but it is not allowed because CSE is in Recovery Mode.
Error 329: Restore Point Image Failure. Reboot may be required.

5212

Then run MEInfo -verbose and MEManuf -verbose to check the state of the CSE. You might have a corrupted firmware or similar issue.

5213

Thanks again! I’ve never seen that “Error” message before- that’s what I meant! But as I wrote: It’d be a ‘nice to have’, obviously this will not show up so often anyway.

Regarding ‘cleaning’ with a corrupt MFS partition as base for configuration- I’m aware of that, possibly the whole dump contains errors. It was just curiousity if there was a version incompatibility in addition.

5214

Here we go.

meinfo.txt (8.35 KB)

memanuf.txt (2.05 KB)

5215


Nothing wrong in MEInfo and MEManuf. Either a system-specific issue or something between FWUpdate/CSE and that firmware. I can’t really explain it in any other way. Stay at 4.0.45 for now and try again once we have a newer FWUpdate and/or firmware available.

5216

Even weirder is that I had the same error with the 4.0.45 firmware downloaded from ASUS, using the same FWUpdate version.

5217

Some system specific (ASUS, BIOS) error then. I’m sure others will not be facing such a problem.