Lenovo Yoga 2 13 - broken ME interface and other glitches

Hi everyone!

A few days ago I bought a used laptop Lenovo Yoga 2 13. It basically works (except WiFi), but there are a few problems:
Every time I turn it on (cold start), I notice delay of 4-7 seconds before the appearance of the Lenovo logo.
Windows 10 loading takes up to 30-45 seconds (from Samsung EVO 850 SSD), then in “Device Manager” I can see "Intel Management Engine Interface"
with “!” sign, Error Code 10 “STATUS_DEVICE_POWER_FAILURE”.
I can “disable” this interface in device manager, after this Windows loads fast (I.e. as usual, ~10 sec.) most of the time.
In case of reboot (warm start) “Lenovo” logo shows up almost immediately, but Windows still loads very slow (if ME interface is not disabled).
Also this leads to unreliable work of WiFi network adapter, from the beginning it doesn’t work at all (everything seems Ok, but it can’t connect to WiFi networks).
Sometimes (about 1 time from 20) Windows starts up fast and I can see working ME interface in device manager, but after reboot - everything back to “unnormal” :slight_smile:
Sometimes Windows starts up fast, but no Intel ME interface interface present in device manager
In BIOS settings “Intel ME Version / SKU” stated as “UnKnown”.


Some details about laptop:
Intel i3-4010U, 8Gb RAM, 120Gb SSD, WiFi
OS: Windows 10 x64
BIOS: Latest version from manufacturer site - v1.17 (InsydeH2O BIOS)

So I read some threads on this forum, and realize this behavior can be related to corrupted ME firmware/data.

I already have SPI flash programmer (CH341A based), so I made a full dump.
One 64Mbit (8Mb) SPI flash chip in my case. BIOS itself takes 6Mb of space, other space occupied by ME firmware and etc.

This is MEA report on physical dump file



This is MEA report on original BIOS file extracted from latest BIOS update utility



1. At first I was trying to use original BIOS update utility, so I just update BIOS with the same version and reset BIOS setings to default. After this - WiFi adapter can connect to networks, but all other symptoms remained.

2. Next I was trying to reset ME settings with the command: fptw64 -greset (From Windows).

After this BIOS setup utility show actual version of Intel ME / SKU. But, unfortunately, nothing else changed.


3. So I download Intel ME firmware from this site (9.5.60.1952_1.5MB_PRD_RGN.bin) for size and byte signature reference. Then I extract ME region from bios dump and from Lenovo bios update file.
I’ve compared this files. File from bios dump have some chunks with differences (about 154Kb total), but in “update” file, this chunks is blank (filled with FF). So I decided - the only difference is platform/system specific data.

So now I need some advice, what to do next. Can I validate this platform/system data using some Intel tools?

P.S. Since public sharing of BIOS dump is not good idea, I can provide a link by PM

Thanks!|addpics|es7-1-a0c3.jpg-invaddpicsinvv,es7-2-9acd.jpg-invaddpicsinvv,es7-3-614c.jpg-invaddpicsinvv,es7-4-3652.jpg-invaddpicsinvv,es7-5-8066.jpg-invaddpicsinvv|/addpics|

me_region_from_dump.zip (1.2 MB)

me_region_from_update.zip (1.09 MB)

Lenovo_Yoga_2_13_BIOS_v1.17.zip (4.85 MB)

Hello Nifty. First of all, great post. You’ve clearly done your research before asking for help and it shows.

That “-greset” command does not reset ME settings but the ME state. Basically if it is stuck, this can help it. In your case, I believe that apart from a stuck ME state, the DATA section of the ME (see Section A) might also be corrupted or miss-configured. Nothing that cannot be solved by your programmer though. You have two options:

1) Using UEFITool, extract the ME region of the original Lenovo “BIOS”/SPI (should be EXTR, meaning OEM-configured - not RGN, stock). The open your dump with UEFITool and replace the corrupt ME region with the one from Lenovo. In this case the ME region size should be the same, make sure it is regardless.

2) If using the Lenovo ME region does not help, you can follow the ME cleanup guide. I suggest you use as input SPI image the one from step 1, meaning your own SPI dump but with the Lenovo ME region in place, to avoid any Flash Image Tool crashes due to corrupt ME settings or similar.

Remember that after any ME region reflash, you need to trigger a “-greset”. For 1.5MB firmware that’s equivalent to shutting down the system and removing all power (external + battery) for 30 seconds but I believe “-greset” is easier and faster.

Hi! Thank you! I will try.

Unfortunately, UEFITool is not usable in my case. Both versions - new (A40) and old (0.21.5) can’t properly recognize ME region in Lenovo BIOS update file.
So I used ME region previously extracted from Lenovo BIOS update file by hex editor.
Old UEFITool (0.21.5) can recognize ME region in my bios dump ( new one doesn’t have “builder” functionality yet).
So I replaced ME region by original one. But as I can see, UEFITool doesn’t do anything except direct replacement of one byte block to another one, so I decided to keep using hex editor, and replace ME region by myself.

Then I flashed modified dump into chip, plug in battery and power adapter and turn on laptop. Everything works great so far! Windows starts fast, I can see working “Intel ME Interface” in device manager. After several restarts (cold and warm) it still works as it should.

This is logs from Intel “MEInfo”

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
Intel(R) MEInfo Version: 9.5.35.1850
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.
 
GBE Region does not exist.
Intel(R) ME code versions:
 
BIOS Version: 96CN31WW(V1.17)
MEBx Version: 0.0.0.0000
Gbe Version: Unknown
VendorID: 8086
PCH Version: 4
FW Version: 9.5.20.1742 LP
LMS Version: Not Available
MEI Driver Version: 11.5.0.1011
Wireless Hardware Version: 2.1.77
Wireless Driver Version: 19.50.1.5
 
FW Capabilities: 0x31101A60
 
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/DISABLED
 
TLS: Disabled
Last ME reset reason: Power up
Local FWUpdate: Enabled
BIOS Config Lock: Enabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: EF4017
SPI Flash ID VSCC #1: 20252025
SPI Flash BIOS VSCC: 20252025
BIOS boot State: Post Boot
OEM Id: 00000000-0000-0000-0000-000000000000
Capability Licensing Service: Enabled
OEM Tag: 0x00000000
Localized Language: Unknown
Independent Firmware Recovery: Enabled
OEM Public Key Hash (FPF): 0000000000000000000000000000000000000000000000000000000000000000
OEM Public Key Hash (ME):
ACM SVN FPF: 0x0
KM SVN FPF: 0x0
BSMM SVN FPF: 0x0
 
FPF ME
--- --
Force Boot Guard ACM: Disabled
Protect BIOS Environment: Disabled
CPU Debug Disabled: Disabled
BSP Initialization Disabled: Disabled
Measured Boot: Disabled
Verified Boot: Disabled
Key Manifest ID: 0x0
Enforcement Policy: 0x0
PTT: Enabled
PTT Lockout Override Counter: 0x0
EK Revoke State: Not Revoked
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
 

Intel(R) MEInfo Version: 9.5.35.1850
Copyright(C) 2005 - 2014, Intel Corporation. All rights reserved.
 

FW Status Register1: 0x1E000245
FW Status Register2: 0x66002306
FW Status Register3: 0x00000200
FW Status Register4: 0x00004000
FW Status Register5: 0x00000000
FW Status Register6: 0x40000000
 
CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
Phase: HOSTCOMM Module
ICC: Valid OEM data, ICC programmed
ME File System Corrupted: No
FPF and ME Config Status: Match
 
 


The only issue, now I can't make "-greset". I'm always get "Could not set the GlobalReset bit" message. Windows or DOS, doesn't matter.



Since during flashing all power sources was unplugged from laptop for a long time, I doesn't care too much about "-greset".
But I would greatly appreciate, if you can point me out - why this may happened.
Also, can you please tell me, Is any reason to update ME region to the latest version of "9.5" branch?

Thank you very much for you work!!!|addpics|es7-6-15a8.jpg-invaddpicsinvv|/addpics|

Well if you are able to use a hex editor, figure out where the ME region starts & ends etc, then of course you can do it manually. I recommend UEFITool because most people don’t know these things well.

It doesn’t matter if greset fails, you can do it manually regardless as I explained above. I think it has some conditions to work, the ME must be in manufacturing (unlocked FD) or recovery mode etc.

You don’t have to update it and there are no official/public changelogs. You can check the intro paragraph of the ME thread to see what it does and judge for yourself.

Ok, thanks a lot!

A small donation sent by the forum button.

Thank you very much for your contribution and again for your great prior research. Enjoy your repaired system.

Hi Nifty,
can you share the modified BIOS? I have the same problems but not enought experience to modify the BIOS. Thanks a lot!!
Can you explain also the way to flash the new BIOS? Is it enought the lenovo utility? Thanks.