Intel ME Disabled on Lenovo M920s After ME_DIS Jumper

Special Topics Intel Management Engine
1

I have a Lenovo M920s computer.
I once used a CH341A programmer to modify and flash the BIOS. Originally, there was no fTPM option, but I managed to enable it and even unlocked some hidden menus.

One day, I tried to clear the CMOS, but accidentally connected the ME_DIS jumper, which caused the ME firmware to become disabled. Since then, I have never been able to re-enable it.

I’ve tried many methods, but none worked:

  1. Clear CMOS (shorted the CMOS jumper, rebooted twice, and also removed the battery to discharge).

  2. Flashed all my previous BIOS backups, including dumps that it‘s ME File Sytem State is “Configured”.

  3. Flashed BIOS images from the same series found online.

  4. Used fptw -me -f to directly write the ME region.

  5. Executed fptw -greset.

But the ME remains disabled no matter what I do.
Now I want to use fTPM, but without ME, fTPM cannot work.

This issue has been troubling me for more than a year and a half.Can anyone please help me figure this out?

MEInfoWin64.exe -verbose

Intel (R) MEInfo Version: 12.0.90.2077
Copyright (C) 2005 - 2022, Intel Corporation. All rights reserved.

Windows OS Version : 10.0

LPC Device Id: A306.
Platform: Cannonlake Platform
General FW Information
FW Status Register1: 0x80042044
FW Status Register2: 0x30280116
FW Status Register3: 0x00000030
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0xC0000004

CurrentState:                              Disabled
ManufacturingMode:                         Disabled
FlashPartition:                            Valid
OperationalState:                          CM0 with UMA
InitComplete:                              Initializing
BUPLoadState:                              Success
ErrorCode:                                 Disabled
ModeOfOperation:                           Unsecured mode by H/W jumper
SPI Flash Log:                             Not Present
Phase:                                     BringUp
PhaseStatus:                               CM0_TEMP_DISABLE
ME File System Corrupted:                  No
FPF and ME Config Status:                  Committed

Error 198: ME disabled.

MEManufWin64.exe -verbose

Intel (R) MEManuf Version: 12.0.85.1919
Copyright (C) 2005 - 2021, Intel Corporation. All rights reserved.

Windows OS Version : 10.0

LPC Device Id: A306.
Platform: Cannonlake Platform
General FW Information
FW Status Register1: 0x80042044
FW Status Register2: 0x30280116
FW Status Register3: 0x00000030
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0xC0000004

CurrentState:                              Disabled
ManufacturingMode:                         Disabled
FlashPartition:                            Valid
OperationalState:                          CM0 with UMA
InitComplete:                              Initializing
BUPLoadState:                              Success
ErrorCode:                                 Disabled
ModeOfOperation:                           Unsecured mode by H/W jumper
SPI Flash Log:                             Not Present
Phase:                                     BringUp
PhaseStatus:                               CM0_TEMP_DISABLE
ME File System Corrupted:                  No
FPF and ME Config Status:                  Committed

Error 678: Read PCI failed.

Error 81: MEManuf Operation Failed.

2

Hi! I’m not an expert on this, but I think if you disable it with a jumper you should be able to enable it with one too. Is there more pins or just two sets (can’t really find a good image of this MB)? To me it’s seems like a physical lock if re flashing doesn’t do anything.

Did you tried to jump it again, maybe?

3

Yes, I’ve tried reconnecting the jumper, but it made no difference.

The motherboard is I370MS Ver 1.0.
Here are two pictures below.

m920s_ughmm_en
m920s_ughmm_en2057×2911 498 KB

I370MS
I370MS1646×1646 487 KB

4

I also found another user on the Win-Raid forum who had a similar issue — ME remained disabled even after disconnecting the ME_DIS jumper. However, he was eventually able to restore it after flashing the entire BIOS.

Need help to unlock Lenovo M720q BIOS settings

5

Odd. But the info says it is unsecured by hw jumper still (according to your first post). I assume the jumpers are the red ones above the sata ports. Did you tried me analyser, does it report something on the dumps?

6

I have several backup versions of the BIOS from before. Some of them have the ME File System State marked as Configured, while others are Initialized.
However, no matter which version I flash, the ME still cannot be enabled.

╔═══════════════════════════════════════════╗
║         ME Analyzer v1.307.0 r373         ║
╚═══════════════════════════════════════════╝

╔═════════════════════════════════════════════╗
║             2025100520.bin (1/1)            ║
╟─────────────────────────────┬───────────────╢
║            Family           │     CSE ME    ║
╟─────────────────────────────┼───────────────╢
║           Version           │  12.0.64.1551 ║
╟─────────────────────────────┼───────────────╢
║           Release           │   Production  ║
╟─────────────────────────────┼───────────────╢
║             Type            │   Extracted   ║
╟─────────────────────────────┼───────────────╢
║             SKU             │  Corporate H  ║
╟─────────────────────────────┼───────────────╢
║           Chipset           │ CNP/CMP-H B,A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │       1       ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │       9       ║
╟─────────────────────────────┼───────────────╢
║    Version Control Number   │       23      ║
╟─────────────────────────────┼───────────────╢
║       Production Ready      │      Yes      ║
╟─────────────────────────────┼───────────────╢
║      OEM Configuration      │       No      ║
╟─────────────────────────────┼───────────────╢
║       FWUpdate Support      │   Impossible  ║
╟─────────────────────────────┼───────────────╢
║             Date            │   2020-02-27  ║
╟─────────────────────────────┼───────────────╢
║      File System State      │  Initialized  ║
╟─────────────────────────────┼───────────────╢
║             Size            │    0x77C000   ║
╟─────────────────────────────┼───────────────╢
║       Flash Image Tool      │  12.0.70.1652 ║
╚═════════════════════════════╧═══════════════╝

╔═════════════════════════════════════════════╗
║              20251005.bin (1/1)             ║
╟─────────────────────────────┬───────────────╢
║            Family           │     CSE ME    ║
╟─────────────────────────────┼───────────────╢
║           Version           │  12.0.94.2380 ║
╟─────────────────────────────┼───────────────╢
║           Release           │   Production  ║
╟─────────────────────────────┼───────────────╢
║             Type            │   Extracted   ║
╟─────────────────────────────┼───────────────╢
║             SKU             │  Corporate H  ║
╟─────────────────────────────┼───────────────╢
║           Chipset           │ CNP/CMP-H B,A ║
╟─────────────────────────────┼───────────────╢
║ TCB Security Version Number │       1       ║
╟─────────────────────────────┼───────────────╢
║ ARB Security Version Number │       14      ║
╟─────────────────────────────┼───────────────╢
║    Version Control Number   │       62      ║
╟─────────────────────────────┼───────────────╢
║       Production Ready      │      Yes      ║
╟─────────────────────────────┼───────────────╢
║      OEM Configuration      │       No      ║
╟─────────────────────────────┼───────────────╢
║       FWUpdate Support      │   Impossible  ║
╟─────────────────────────────┼───────────────╢
║             Date            │   2023-05-18  ║
╟─────────────────────────────┼───────────────╢
║      File System State      │   Configured  ║
╟─────────────────────────────┼───────────────╢
║             Size            │    0x77C000   ║
╟─────────────────────────────┼───────────────╢
║       Flash Image Tool      │  12.0.85.1919 ║
╚═════════════════════════════╧═══════════════╝
7

I’m at the limit of my knowledge, but configured should be OEM stock and initialised should be from a running system as per the me cleaning guide here.

I suspect that the “ModeOfOperation: Unsecured mode by H/W jumper” would prevent it from be enabled at all, cuz it’s think that the hardware override is still in place.

Sorry that it’s seems like I can’t help you, but maybe a ME wizard will heave some time to look at your problem later.

8

[Guide] Clean Dumped Intel Engine (CS)ME/(CS)TXE Regions with Data Initialization - Special Topics / Intel Management Engine - Win-Raid Forum

And make a regular (CMOS 3,3v on) and a deep/cold CMOS reset on the system, you may short the CMOS carrier pads, before and after the IC programming.

9

I think I’ve already performed a full CMOS clear.
First, I connected the CLR_CMOS jumper and rebooted until I heard the beep-beep-beep sound, then rebooted once more until it beeped again.
After that, I unplugged the power cable, removed the battery from the motherboard, and held down the power button for about one minute.
Then I reconnected the power and booted up again.

But none of these steps were able to re-enable the ME.

10

I have a circuit diagram for the ME_DIS jumper from a Lenovo I4X0MS motherboard.
I believe it should be the same as on mine.

image
image689×459 16.8 KB

11

Never… powering up a system with a shorthed CMOS was never a goal in the industry, the goal is a COLD reset not providing more power to the rest of the circuit.

Yes the MS-7C43 Lenovo I470MS or the MS-7C50 Lenovo I3X0MS will have similar circuit to debug your mb.

12

Thanks for the explanation.
Could you please tell me how to correctly perform a cold CMOS reset?

13

“Cold” is a total drain of the circuit, leave it alone with no power source a fair amount of time, user choice from 10m to eternety… :zany_face: and during so, it can shorted in CMOS battery carrier.
You can even short handed the DIS jumper with a conductor, when booting then verifying it by the schematic that its open in regular state.

14

I’ve discovered a serious issue — the onboard sound card on my motherboard has also disappeared.
I believe this is related to the ME being disabled.

15

Sir… by now you would already done the guide linked 3 days ago by me… did you perform it?

16

I’m sorry for not replying to you sooner.
The ME File System State I’m using is Configured, so I believe there’s no need to clean it again.
I inserted a clean ME region myself using Intel Flash Image Tool.

As for clearing the CMOS, I’m not entirely sure if I did it the right way, but I’ve already tried before — I removed the motherboard battery, held down the power button for about one minute, and unplugged the power cable for around ten minutes.
I’m certain that the BIOS has been reset to its default settings, and even the NVRAM information was cleared, but unfortunately, it still didn’t help.

17

I already know that and i noticed in your posts…still you dont lose anything to try it… you may get surprised…or not at all, your call.
That’s all from me regarding your issue, good luck.

18

Thank you very much.
I’ll try the method you suggested again.
I’m also purchasing a 1KΩ resistor and some Dupont wires, planning to draw a 3.3V power source from another point on the motherboard and connect it to pin 1 of the ME_DIS jumper to see if pulling it high can force the ME to re-enable.

19

@plutomaniac
I tried connecting the VCCSPI pin from the SPI_DEBUG1 header to pin 1 of the ME_DIS jumper, but it didn’t make any difference.
Could it be that the PCH (Southbridge) has already been fused via FPF, making the ME permanently unrecoverable?

20

The problem I’m encountering is exactly the same as the one described in this post:
https://winraid.level1techs.com/t/thinkbook-14-iil-bios-issue/90093/16