Intel (Converged Security) Management Engine: Drivers, Firmware and Tools (2-15)

Oh yes, I forgot that for a moment. You can open the firmware with a hex editor and find the production date easily from there:

@plutomaniac and @Fernando ,
Many thanks for the 2 replies.
Confusing was coming from Intel labelling, they should set in place a better coherent naming methodologyā€¦

I have installed the right V 10.0.30.1054 WHQL 64bits version with the ā€˜have diskā€™ method and all is working fine.
Regards

Sorry guys, donā€™t you know what these two letters ā€˜LPā€™ stand for in the firmware version string?

Perfect working fine new ME 9.1.25.1005 for my Z97 no issues so far.


it means Lynx Point which is the codename for Intelā€™s 8-series chipsets. Just an indication, nothing to worry about.



Thanks! But Iā€™m confused about another thing. If I got it right, ME firmware is a part of BIOS in a desktop/laptop motherboard which is stored on the same piece of silicon as the BIOS itself. In case of any Apple laptop there is no BIOS at all. There is EFI with SMC and I have no idea if it is even placed on a separate chip or somewhere else. Which means that flashing that MEI firmware from Bootcamp Windows is technically intruding into MacBookā€™s EFI firmware, and that is driving me nuts. I have no idea how this EFI thing is organized in Apple and how to recover/reflash it in case of any problems. There is even no access to it while booting. Iā€™m afraid that flashing firmware from Windows can lead to some problems in OS X like fan control or power settings while sleep\wake or cpu clock, etc, etcā€¦

It has BIOS, itā€™s called UEFI for some years now. When we say BIOS we mean UEFI for modern systems. If you want you can run all the tools that have EFI versions without the use of Bootcamp/Windows if Appleā€™s UEFI allows booting from external devices. I about SMC as I just have no experience with it.

It is by belief that the firmware update should just fine. However, since I have never heard of someone with a MAC trying to do it, I donā€™t know. Also, it is a little weird that I have never seen v9.5.3.1526 before (probably because itā€™s old). So, I cannot guarantee anything.

Letā€™s see if @CodeRush has any insight regarding updating the ME firmware on Apple hardware since I know he has done some work with Apple computers (UEFIPatch). It is safe to update the ME firmware on such systems or not? It should be safe but letā€™s check his opinion first.



I donā€™t believe itā€™s that so old as the manufactoring date of my macbook is December 2013 while I bought it in January 2014.



Yes, it would be great to hear comments from somebody with Apple experience! I really want to flash this MEI, I just donā€™t want to be the first one with a bricked piece of aluminum)

Well v9.5 firmware is relatively new (Haswell, 2013) so it makes perfect sense for your laptop to have such a firmware version. Also, most OEMs (except Lenovo or maybe HP) rarely update the ME firmware as they are bored to do so or donā€™t believe there is any actual benefit for their system.

Either way, if you end up with a ā€œproblematicā€ laptop when it comes to fan control etc (which I highly doubt) you can always go back to your current firmware if you make a backup of it. Use FWUpdate and -save ME.bin command for that. Can you attach this firmware update file to us here as well?

Are you sure that I can downgrade the firmware to the stock one after I flash it? I thought this procedure is non revertible.

Sure, here is my stock 9.5.3.1526-Update firmware from FWUpdate -save OLD.bin:

OLD.zip (582 KB)

Macs arenā€™t any more special then other Intel-based PCs in terms of ME, so you can just update it, if you want. Downgrade may or may not be possible depending of amount of security-related changes done between old and new versions, but normally itā€™s possible.
If you will FWUpdLcl to update the ME on your Mac, I donā€™t see any problems with it.

N.B. Macā€™s UEFI are now based on EDK2010 (aka EFI 1.1) with UEFI 2.3 support ported on top of it. It has some interesting things like usage of PDR region and OEM part of Descriptor regions, but ME works just the same way, because only Intel may change something in itā€™s behavior.
As far as I know, Apple still doesnā€™t locks read and write access to ME region in Descriptor, so you can use flashrom to dump your SPI chip, open the dump with UEFITool and see what it looks like.



Thanks for your reply! So you say that only Intel knows whatā€™s inside that ME firmware code, and Apple couldnā€™t make any changes in it or build its own custom firmware, am I right?



Iā€™ve noticed one thing, could you please explain it? It is stated in the MEinfo report that Host read access to ME is enabled while Host write access is disabled, what does it mean?

Thank you very much for the reply Coderush. So as I said a lot of times, an Intel system is an Intel system. You should have absolutely no issue after updating the ME firmware. I do not blame you for being careful though, good thinking. Itā€™s safe, especially with FWUpdate because it does a lot of checks to verify that what you are trying to flash is compatible with your system. The one exception is updating to v9.1 (9-series) firmware in 8-series machines (ME v9.0) which is allowed but leads to problems. But that has been added as a warning for some time to the main thread and truthfully does not concern your machine.

I didnā€™t know that Apple does not lock the flash descriptor. Itā€™s weird if you think that we are talking about Apple with all the security and rules they have in place. If that is true then we can find out very easily: Run fptw64 -d BIOS.bin -ME command. If it does not show any error, you have an unlocked descriptor which gives you more liberty to do other things in the feature as well if you want. For now though, do it and upload the result here so that I can check that ME region of yours. Itā€™s definitely exactly the same as everyone elseā€™s but why not check?

Regarding how old your current firmware is, you can clearly see that itā€™s not new even for your December 2013 made machine:



Regarding downgrade, all ME firmware have a SVN, VCN & PV number. The rule of thumb is that you cannot downgrade a higher SVN/VCN ME firmware to a lower one. Intel has given more attention to this number since TXE firmware was released. Details:


They could, but it will be really hard and almost pointless for them, so I really doubt they will change anything besides normal ME settings, which are preserved during update by FwUpdLcl.


Sure. It means you can read your ME region using PCH SPI interface (which means you can make a full dump of your BIOS chip, including ME), but you canā€™t write anything there using this interface, so the only two paths for you to update ME is either use FwUpdLcl or hardware SPI programmer. Default settings from Intel prevent both read and write from/to ME region, but Apple changed them a bit.



Here you are. I also made the full dump just in case.

BIOS.zip (623 KB)

BIOS_FULL.zip (4.25 MB)

Alright, go ahead and update your 1.5MB ME firmware from v9.5.3.1526 (10/05/2013) to v9.5.41.1904 (22/09/14) using ME v9.5 FWUpdate tool. The exact command in your case is:

FWUpdLcl64 -f ME9.5_1.5M_Production.bin

After it has finished successfully, restart your MAC and boot into Windows again. Now you should run the ME v9.5 MEInfo & MEManuf tools to verify that everything checks out. The commands are:

MEInfoWin64 (post a picture if you want, it should not report any errors)
MEManufWin64 (it should report MEManuf Operation Passed in green letters)

@Fernando

What is the recommended firmware and driver set for the ASUS P8Z68-V/GEN3 running in AHCI and Windows 8.1 x64 nowadays? And is is recommended to install just the driver itself in Windows or should I install the software that comes with it also?

If you are talking about AHCI/RAID drivers this is neither the thread nor the sub-forum for it. If you are talking about ME:

a) It has nothing to do with AHCI/RAID
b) Download v8.1.52.1496 1.5MB firmware and v10.0.30.1054 drivers (no software needed)



Sorry, I was talking about ME. I just reiterated my systemā€™s config.

Thanks for the recommendation. Is it the most compatible for my 6-series motherboard?

In the OP, why is it stated that Intel ME7 Consumer 1.5MB Firmware v7.1.60.1193 is the recommended version for Intel 6-series boards?

Originally 6-series came with ME7 but some of them could be later upgraded to ME8 in order to support Ivy Bridge processors. Your Z68 machine has been updated to ME8 so you need to update that version. Check the * near ME8 which takes you to the bottom of the main topic.