Hello,
I am new in BIOS modding. Actually I do not know about what is bios modding means.
Last week I get thinkpad x220 to replace my old x200 notebook.
I upgrade this new machine as much as possible, update BIOS to latest add more RAM, upgrade HDD etc.
I just notice that after thinkpad screen, there is a text on upper left said “ME is in recovery state” before enter OS.
That is start me curious what is this, good one or bad one I have no idea.
Try searching info from local and Lenovo forums seem nobody know or got any solution about this.
Until I found this Forums. Read a lot of thread and try to understand what went wrong seem I repeat as below thread
Dell Latitude e6320 enable ME
Here below MEinfo
Intel(R) MEInfo Version: 7.1.50.1166
Copyright(C) 2005 - 2011, Intel Corporation. All rights reserved.
Intel(R) ME code versions:
BIOS Version: 8DET72WW (1.42 )
MEBx Version: 7.0.0.63
Gbe Version: 1.3
VendorID: 8086
PCH Version: 4
FW Version: 7.1.86.1221
UNS Version: 7.1.80.1213
LMS Version: 7.1.80.1213
MEI Driver Version: 7.1.70.1198
Wireless Hardware Version: Not Available
Wireless Driver Version: Not Available
FW Capabilities: 28318816
Intel(R) Anti-Theft Technology - PRESENT/ENABLED
Intel(R) Capability Licensing Service - PRESENT/ENABLED
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
CPU Upgrade State: Upgrade Capable
Cryptography Support: Enabled
Last ME reset reason: Firmware reset
Local FWUpdate: Enabled
BIOS and GbE Config Lock: Enabled
Host Read Access to ME: Disabled
Host Write Access to ME: Disabled
SPI Flash ID #1: C22017
SPI Flash ID VSCC #1: 20052005
SPI Flash BIOS VSCC: 20052005
BIOS boot State: Pre Boot
OEM Id: 4c656e6f-766f-0000-0000-000000000000
Error 8199: Communication error between application and Intel(R) ME (Get Intel(R) AMT State)
Error 8199: Communication error between application and Intel(R) ME (Get System UUID)
Error 8199: Communication error between application and Intel(R) ME (Get Ipv4 Info)
Error 8199: Communication error between application and Intel(R) ME (Get Ipv4 Info)
Error 8199: Communication error between application and Intel(R) ME (Get Provisioning State)
Error 8199: Communication error between application and Intel(R) ME (Get Provisioning Mode)
Capability Licensing Service: Enabled
Capability Licensing Service Status: Permit info not available
OEM Tag: 0x00000000
Here below MEManuf info
Intel(R) MEManuf Version: 7.1.50.1166
Copyright(C) 2005 - 2011, Intel Corporation. All rights reserved.
Platform stepping value is 4
FW Status Register1: 0x00200252
FW Status Register2: 0x65000006
CurrentState: Recovery
ManufacturingMode: Enabled
FlashPartition: Valid
OperationalState: M0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
ICC: Valid OEM data, ICC programmed
Get FWU info command…done
Get FWU version command…done
Get FWU feature state command…done
Get ME FWU platform type command…done
Get ME FWU feature capability command…done
Feature enablement is 0x1B01C60
gFeatureAvailability value is 0x1
OEM ICC data valid and programmed correctly
Request Intel(R) ME test result command…done
vsccommn.bin was created on 04:35:50 08/08/2012 GMT
SPI Flash ID #1 ME VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xC22017) ME VSCC value checked
SPI Flash ID #1 BIOS VSCC value is 0x2005
SPI Flash ID #1 (ID: 0xC22017) BIOS VSCC value checked
FPBA value is 0x0
No Intel Wireless device was found
Request Intel(R) ME Runtime BIST test command…done
Get Intel(R) ME test data command…done
Total of 13 Intel(R) ME test result retrieved
Micro Kernel - Blob Manager: Set - Passed
Micro Kernel - Blob Manager: Get - Passed
Micro Kernel - Blob Manager: Remove - Passed
Policy Kernel - SMBus: Read byte - Passed
Policy Kernel - ME Password: Valid MEBx password - Passed
Policy Kernel - Power Package: Package 1 supported - Passed
Policy Kernel - Power Package: Default package supported - Passed
Policy Kernel - ME Configuration: Wlan Power Well - Passed
Policy Kernel - ME Configuration: CPU Missing Logic - Passed
Policy Kernel - ME Configuration: M3 Power Rails Available - Passed
Policy Kernel - Embedded Controller: Get power source - Passed
MCTP - General: Connectivity to 3G using SMT1 - Failed
No error information for this application
Policy Kernel - Power Package: Live Heap Test - Passed
Error 9314: Intel(R) ME test result reports error(s)
Clear Intel(R) ME test data command…done
Error 9296: MEManuf Test Failed (9314)
Erroe 26 when use ftpw64 -d X220.bin
To solve this problem, Please kindly advice.
Regards,
KochT
Is the system new? If yes, it might be better/easier to use the warranty. Especially when you don’t have access to the ME region for reflashing. You mentioned updates and upgrades. Was the error shown from the start or did it start after changing something? Does the BIOS have any option to enable write access to the ME such as “Enable ME Reflash”, “HMRFPO” or anything flash protection related? Try using Flash Programming Tool with command “fptw -greset” command which will immediately soft-reset the system to restart the ME in case it’s stuck but I doubt it will help in this case.
It is notebook from my friend. It is a old one. Warranrty was already expired since 2014.
Actually I did not familiar about "ME problem" before. I do not notice it.
Just get this new machine, then backup data and update everything.
After use it for a while, found that the "ME is in recovery state" message.
In BIOS there is nothing mention about ME or HMRFPO.
I use windows 7 64bit.
when run dos box as administrators either fptw -greset or fptw64 -greset
computer black out suddenly and restart.
ME is in recovery state still exist.
Please kindly advice.
The ME region needs to be reflashed. Since your Flash Descriptor is locked (error 26 at fpt) and there is no easy BIOS option, you can only use methods that require hardware access. Meaning either the pinmod (short two pins of the audio chip during system POST) followed by FPT reflashing or the use of a programmer by desoldering and resoldering the SPI chip.
Before do something which I not familiar with hardware pinmod.
Plese kindly advice what I have to do.
Before start disassembly my notebook. i just search picture mainboard x220 machine.
Ref : http://www.myfixguide.com/manual/lenovo-…220-disassembly.
I try follow the previous post of dell. How to pinmod please kindly explain in detail. I will follow your process. please kindly see attach file is this the chip I looking for?
http://files.homepagemodules.de/b2001010/a_1319_250dd40a.png
(photo from google I will confirm once I start disassembly my x220.
According to Lenovo X220 specs, the audio chip should be the Conexant CX20672. I couldn’t find it’s pinout but provided that it’s the same as CX20671, I think you need to short pins 4 (S DATA_OUT) and 18 (DVDD_3.3) while the system boots, at POST, after which you can stop shoring. For example stop when the OS starts to load. You can test if it worked by running “fpt -d spi.bin” command which will dump the full SPI image and not show the error 26.
I already disassembly notebook to find that chip. I think I found it.
It is under the plam rest but cover by stikey black plastic sticker.
(Glue from black plastic was clear the marking text I think.)
Hardly see the mark but still some stain of C symbol. Am I correct?
To make sure I do correctly before start operation.
I do short the pin 4 and 18 with sharp probe. then switch on the machine.
Keep short circuit until the win logo appear then I remove the probe.
After that just check with fpt -d command.
If there is no code 26, Can I aseembly it back? (to correct the ME region later)
Regards,
By the way the pin is very small, I think smaller than needle.
probe tip should be very small. That is might be a mission impossible for me.
It might end up to do this at electronic shop which have more equipment.
A steady hand and needle pin size probe require.
God bless me, old Blunt one with a shaking hand plus 75% vision. 
Please kindly advise.
now i am at the shop. first attempt fail code 26 still exist.
Confirm pin mod work.
I have to fptw64 -d right after pinmod.
here below file I dump
spi.rar (5.72 MB)
x220ME.rar (3.66 MB)
The pinmod is temporary, at the next restart it will stop bypassing the FD lock. So after the pinmod (check with fptw -d), flash the attached SPI image. Use FPT with command “fptw -f spi_fix.bin” followed by “fptw -greset”. The fixed SPI image has a clean/configured ME based on your provided dump and the FD Locks disabled so that you won’t need to use the pinmod again if you need to reflash.
spi_fix.rar (5.03 MB)
I will go to shop again tomorrow no problem. and will be back to summerize the process.
Thank you very much for your help.
Regards,
KochT.
new promblems cannot flash spi_fix. error code 28 protected range registers are currently set by bios.
PDR region does not exist.
Additional info once I closed the lid (hibernate) open the lid again and run ftpw64 -f spi_fix.bin
another additional error shown see attach.
Make sure you have the latest v11.0 MEI driver installed from the ME thread. Now, since we don’t care about the BIOS, let’s flash the Descriptor and ME regions only. Download the attached files and run “fptw -f desc_fix.bin -desc” , “fptw -f me_fix.bin -me” followed by “fptw -greset” upon successful completion.
desc_fix.rar (373 Bytes)
me_fix.rar (2.97 MB)
Thank you very much for your support. I do believe it should work perfectly.
But since there is no choice for me much yesterday. Shop propose manage this issue in his way to get rid this problem.
I have no spare time. I decide take the shop advice.
Now the machine is already spoiled, I just remove replacement part. HDD / RAM, and backward to my old machine.
So I cannot confirm the latest process result. But pinmod is working for sure.
Best regards,
KochT.
hi,i get same error
when startup laptop show ME is in recovery state,windows10 is normal ,but i want fix it.,can you help me?
how can i contact you with IM?
Unless you have the same model, am I supposed to guess what hardware you have? If you do, follow the above instructions to dump your SPI image first.
I just followed the cleanup guide on your SPI dump. The resulting file is attached. Flash with command “fptw -f spi_fix.bin” followed by “fptw -greset”. Once the system resets, check if everything is ok.
spi_fix.rar (5.03 MB)
thank you , i am trying
pdr region does not exist
error 28
you can see img
cann’t flash it ,and what am i suppose to do next？
We can work around that error by flashing only the descriptor and me regions but before that, I think your problem is elsewhere. I see that you can dump your full SPI image with fpt -d command even though your Flash Descriptor is locked. So that means that you have enabled some BIOS option such as “ME Reflash” or an equivalent hardware jumper (maybe keyboard combination) to enable read/write access to it for servicing. If that’s the case then it’s normal for it to not be operational and thus in a “recovery” state. It’s also normal for the MEI device and it’s driver to not appear at the operating system, thus the “HECI” error you received. So first make sure you don’t have any such option enabled.