Enable KVM AMT on Dell 7060 - it's gone a bit wrong

Special Topics Intel Management Engine
1

After sorting out the AMT on my Dell 9020 - Enable KVM AMT on Dell 9020 , I’ve not looked at a Dell 7060. I think I’ve now bricked the machine. I’ll explain.

Using the method I used for in the above post.

- Chipset is 300 Series so I downloaded Intel CSME System Tools v12 r28 - (2020-10-31).
- Run

1
 
FPTW64.exe -d hydrogen.bin
 

- Ran MA Analyser on this to see that the version is 12.0.0.1069. SKU = H Corp and Chipstep is B
- Downloaded 'Intel CSME 12.0 Firmware Repository r24', unpacked and made a copy of the file 12.0.0.1069_COR_H_BA_PRD_EXTR-Y.bin naming it ME Sub Partition.bin
- Then ran fit.exe, made sure the three KVM options were yes. Build menu -> Build Settings -> untick 'Generate intermediate build files'. Make the XML file. Closed FIT.exe
- Copied my 'ME Sub Partition.bin' over 'Intel CSME System Tools v12 r28\Flash Image Tool\WIN32\hydrogen\Decomp\ME Sub Partition.bin'.
- Start FIT.exe again, loaded the xml file, checked my settings were still there, then ran BUILD.
- The resulting outimage.bin file was the same size as the original dumped .bin file, good news.
- Closed FIT.exe and then ran
1
 
FPTW64.exe -f (path to outimage.bin)
 

- This succeeded.
- Then ran
1
 
FPTW64.exe -greset
 
. This too succeeded.
- with power off I removed the jumper, powered on, no MEBx boot option when you press F12, odd. I rebooted a few times just in case, no, never appeared. So I went through the above procedure again but this time after running
1
 
FPTW64.exe -f (path to outimage.bin)
 
I then shut the PC down as I found in another post on this forum (I can't find the post now to tell you which post is was, typical). Now the bad news!
- PC WON'T BOOT AT ALL NOW :( The power button led flashes 5 white slashes followed by 2 orange flashes. Nothing appears on the screen. I guess I've bricked the motherboard, have I?

Help, anyone know how to get the PC back and why the MEBx menu isn't available?

One thing I did notice when I run ME Analyser on the initial .bin file was that it said "FWUpdate Support" = "Impossible"

Thanks in advance.

Chris
2

forgot to add, a copy of the bin file after setting AMT and what was flashed to the pc is at http://www.damtp.cam.ac.uk/user/cm214/tmp/hydrogen.bin

3

Found the post where is said to turn off the PC after running FTPW64.exe -f outimage.bin - Optiplex 9020 and AMT/ME

4

[quote=osk866|

One thing I did notice when I run ME Analyser on the initial .bin file was that it said “FWUpdate Support” = “Impossible”

[/quote]

Saying that I have seen this is previous ME Analyser output and the flashing worked fine so I’m not sure if this is a red hearing or not.

5

What is this hydrogen.bin you linked? Seems that’s the name you gave your first backup of the bios? New builds you named outimage bin?

Please post (again) original unchanged backup/ dump and latest version you flashed.

(The last ‘hydrogen bin’ you attached doesn’t have a valid structure)

6



Hello.

Hydrogen is the name of the PC I was working on.

The output of the initial bin

1
 
fptw64.exe -d
 
is at http://www.damtp.cam.ac.uk/user/cm214/tm...en_original.bin

[quote="lfb6, post:5, topic:35961"] The last \'hydrogen bin\' you attached doesn\'t have a valid structure [/quote] , that's interesting/worry, how did you work this out? When I applied hydrogen.bin with fptw64.exe -f is transferred fine, no errors, nothing to suggest a problem with it.

As you say, the fptw64.exe -f command uses the file outimage.bin, I renamed it to hydrogen.bin when I copied it to my web space as I already had a file called outimage.bin. The link in post 2 is the latest .bin file that I used to flash hydrogen with last Friday.

Thanks for any help.
7

, that’s interesting/worry, how did you work this out? When I applied hydrogen.bin with fptw64.exe -f is transferred fine, no errors, nothing to suggest a problem with it. …

Opening original file in UEFItoolNE

111.jpg
111.jpg1208×902 81.9 KB



Opening changed file in UEFItoolNE

112.jpg
112.jpg1197×894 48.4 KB



That’s not a good sign, normally and an easy check. It doesn’t mean that everything is good if there are no errors in the parser, but if the file doesn’t open with that error it’s quite sure it’ll brick…

FPTw doesn’t check, it flashes whatever you give it, checks if flashed content is identical, and if that’s the case it thinks everything is fine.


211.jpg
211.jpg599×557 66.2 KB



But I see all the AMT options enabled in your dump already. Is there a misunderstandable syntax in FIT 12? What am I missing here?

Anyway- do you have a programmer? If not: Buy a CH341 programmer and if chip’s soldered a soic8 clip and if spi is an 1.8V type an 1.8V adapter.

8

Thanks lfb6, that’s really useful. A few questions/points.

1. I’ve not seen the uefitool tool you show screenshots of, I’ll have to find it and download it, looks handy, it would of saved my from being the state I’m in.

2. Flashing UEFI bios, can we still use the Flash Image Tool and the FPTW tool as we would for older non-UEFI BIOS or do we need to treat UEFI in a different way?

3. The AMT settings as you point out were set to ‘Yes’ but the MEBx F12 menu didn’t show up even with the option to ‘Show the MEBx’ BIOS option ticked. I therefore thought I must of missed something somewhere. I also tried CTRL-P, no good either, I’m not sure this works on newer PCs anyway.

4. I don’t have a programmer. The PC is under warranty so I could fix it this way but it’s made me very nervous flashing any more machines in case I brick these too. To me it seems a gamble if the flashing will work or brick the machine, with around 200 PCs to enable AMT on I don’t feel at all confident I can get this right.

Thanks for your help.

9

@osk866 Flash Image Tool and the FPTW tool are tools for UEFI bios. They were never available for legacy bios.

As discussed in another thread already- are the conditions for AMT/KVM fullfilled? Chipset seems to be Q370 for all(?), but which processor?

CH341 doesn’t cost too much, if you want to continue with this it’s a meaningful purchase!

10

The info about this PC - Hydrogen:

Computer Manufacturer"=“Dell Inc.
Computer Model”=“OptiPlex 7060
Processor”="Intel(R) Core™ i5-8500 CPU @ 3.00GHz
Intel(R) 300 Series Chipset Family SATA AHCI Controller
Intel(R) 300 Series Chipset Family LPC Controller (Q370) - A306

The Intel website https://ark.intel.com/content/www/us/en/…o-4-10-ghz.html reports ‘vPro = Yes’.

I’ll look into the CH341, google here I come.

Any idea why MEBx boot menu not visible?

thanks

11

Which number does the sticker inside the chassis have? See:
https://www.dell.com/support/article/en-…-327359?lang=en
(Other modell, but numbering system is still same)

What does MEInfo -verbose tell you for one of the other 199 machines? Put complete output in spoiler, thanks.

12



It says ‘AMT/VPRO 1’ which does tie up with the output of hydrogen_orignal.bin so in a way there should be no need to re-flash it but then there doesn’t seem to be a way to configure ME when booting (MEBx).



This I can find out tomorrow when I can physically change the service jumper on one the these 199 machines. I’ll report back with a spoiler.

Thanks

13

@osk866 No, no- don’t change the service jumper, we need the information in normal state!

14

from the same spec machine (name of INIPC160 if this matters) …

Intel (R) MEInfo Version: 12.0.70.1652
Copyright (C) 2005 - 2020, Intel Corporation. All rights reserved.


Windows OS Version : 10.0

LPC Device Id: A306.
Platform: Cannonlake Platform
General FW Information
FW Status Register1: 0x94000245
FW Status Register2: 0x69000506
FW Status Register3: 0x00000030
FW Status Register4: 0x00004000
FW Status Register5: 0x00001F01
FW Status Register6: 0x47C00BC9

CurrentState: Normal
ManufacturingMode: Disabled
FlashPartition: Valid
OperationalState: CM0 with UMA
InitComplete: Complete
BUPLoadState: Success
ErrorCode: No Error
ModeOfOperation: Normal
SPI Flash Log: Not Present
Phase: HOSTCOMM Module
PhaseStatus: UNKNOWN
ME File System Corrupted: No
FPF and ME Config Status: Committed
FW Capabilities value is 0x31119140
Feature enablement is 0x11119140
Platform type is 0x42000492

Platform Type Desktop
FW Type Production
Last ME Reset Reason Unknown
BIOS boot State Post Boot
Slot 1 Board Manufacturer 0x00001028
Slot 2 System Assembler 0x00000000
Slot 3 Reserved 0x00000000
Capability Licensing Service Enabled
Local FWUpdate Enabled
OEM ID 68853622-EED3-4E83-8A86-6CDE315F6B78
Integrated Sensor Hub Initial Power State Disabled
Intel(R) PTT Supported Yes
Intel(R) PTT initial power-up state Disabled
OEM Tag 0x00
TLS Disabled

Intel(R) ME code versions:
BIOS Version 1.3.4
MEBx Version 12.0.0.0010
Vendor ID 8086
FW Version 12.0.24.1314 H Corporate
LMS Version Not Available
MEI Driver Version 1904.12.0.1208
Wireless Hardware Version Not Available
Wireless Driver Version Not Available

IUPs Information
PMC FW Version 300.2.11.1020
LOCL FW Version 12.0.24.1314
WCOD FW Version 12.0.24.1314

PCH Information
PCH Version 12
PCH Device ID A306
PCH Step Data B2
PCH SKU Type Production PRQ Revenue
PCH Replacement State Disabled
PCH Replacement Counter 0
PCH Unlocked State Disabled

Flash Information
SPI Flash ID 1 Not Available
SPI Flash ID 2 Not Available
Host Read Access to ME Not Available
Host Write Access to ME Not Available
Host Read Access to EC Not Available
Host Write Access to EC Not Available

FW Capabilities 0x31119140
Protect Audio Video Path - PRESENT/ENABLED
Intel(R) Dynamic Application Loader - PRESENT/ENABLED
Intel(R) Platform Trust Technology - PRESENT/DISABLED
Service Advertisement & Discovery - NOT PRESENT
Persistent RTC and Memory - PRESENT/ENABLED

End Of Manufacturing
Post Manufacturing NVAR Config Enabled No
HW Binding Enabled
End of Manufacturing Enable Yes

Intel(R) Active Management Technology -
Intel(R) AMT State Disabled
M3 Autotest Enabled
Localized Language English
C-link Status Enabled
AMT Global State Enabled
Privacy/Security Level Default

Intel(R) Protected Audio Video Path
Keybox Not Provisioned
Attestation KeyBox Not Available
EPID Group ID 0x28D3
Re-key needed False
PAVP Supported Yes

Security Version Numbers
Minimum Allowed Anti Rollback SVN 1
Image Anti Rollback SVN 4
Trusted Computing Base SVN 1

FW Supported FPFs
FPF UEP ME FW
*In Use
— — -----
Enforcement Policy 0x03 0x03 0x03
EK Revoke State Not Revoked Not Revoked Not Revoked # Not Revoked=0, Revoked=1
PTT Enabled Enabled Enabled # Disabled=0, Enabled=1
OEM ID 0x00 0x00 0x00
OEM Key Manifest Present Not Present Not Present Not Present # Not Present=0, Present=1
OEM Platform ID 0x00 0x00 0x00
OEM Secure Boot Policy 0x3F9 0x3F9 0x3F9
CPU Debugging Enabled Enabled Enabled # Enabled=0, Disabled=1
BSP Initialization Enabled Enabled Enabled # Enabled=0, Disabled=1
Protect BIOS Environment Enabled Enabled Enabled # Disabled=0, Enabled=1
Measured Boot Enabled Enabled Enabled # Disabled=0, Enabled=1
Verified Boot Enabled Enabled Enabled # Disabled=0, Enabled=1
Key Manifest ID 0x0F 0x0F 0x0F
Persistent PRTC Backup Power Enabled Enabled Enabled # Enabled=0, Disabled=1
RPMB Migration Done Disabled Disabled Disabled # Disabled=0, Enabled=1
SOC Config Lock Done Not Done Done # Not Done=0, Done=1
SPI Boot Source Enabled Enabled Enabled # Enabled=0, Disabled=1
TXT Supported Disabled Disabled Disabled # Disabled=0, Enabled=1

ACM SVN FPF 0x02
BSMM SVN FPF 0x00
KM SVN FPF 0x00
OEM Public Key Hash FPF 69602F34CC9D121ECB7785F4F5CA4153ADC35633FF13A76B914FB2FE2835F691
OEM Public Key Hash UEP 69602F34CC9D121ECB7785F4F5CA4153ADC35633FF13A76B914FB2FE2835F691
OEM Public Key Hash ME FW 69602F34CC9D121ECB7785F4F5CA4153ADC35633FF13A76B914FB2FE2835F691
PTT Lockout Override Counter FPF 0x00

15

Having now discovered the ‘UEIFTool’ I ran through the same proceedure as post 1 to make a new outimage.bin for Hydrogen. A copy is at http://www.damtp.cam.ac.uk/user/cm214/tm…ogen_remade.bin . In the UEIFTool it loads without the error I get with my ‘how to brick a PC’ .bin file. Is part of ‘what have we learnt from this post’ is that the resulting outimage.bin file should be loaded into UEFITool first before sending it to the BIOS?

This is what UEFITool shows in the ‘Parser’ tab for the hydrogen_remade.bin file:

1
2
3
4
5
6
7
 
FfsParser::parseIntelImage: unknown flash descriptor version 0.0
FfsParser::parseVolumeNonUefiData: non-UEFI data found in volume's free space
FfsParser::parseVendorHashFile: new AMI hash file found
FfsParser::parsePadFileBody: non-UEFI data found in pad-file
FfsParser::findFitRecursive: FIT table candidate found, but not referenced from the last VTF
FfsParser::findFitRecursive: real FIT table found at physical address FFD20100h
 
 


Do I worry about the first line
1
 
unknown flash descriptor version 0.0
 
?
16

@osk866 This isn’t consistent. This machine has a newer ME/PMC firmware and AMT/ TLS is disabled. Might be just updated, or another configuration?

I’m sorry, but it’s necessary to have:
- a firmware dump of this specific machine, too, and
- the value of the service tag of this specific machine, too
(or a set of MEInfo -verbose, service tag value and SPI/Bios dump of the same specific machine)

You don’t happen to have these systems in China, France, Hong Kong, Israel, Korea, Poland, or Russia? (KVM should anyway be possible without TLS, and- just in case- without TPM chip, too)


Intel (R) MEInfo Version: 12.0.70.1652
…
TLS Disabled
…
IUPs Information
PMC FW Version 300.2.11.1020
LOCL FW Version 12.0.24.1314
WCOD FW Version 12.0.24.1314
…
Intel(R) Active Management Technology -
Intel(R) AMT State Disabled
…
AMT Global State Enabled
…

╔════════════════════════════════════════════════╗
║ hydrogen_original.bin (1/1) ║
╟───────────────────────────────┬────────────────╢
║ Family │ CSE ME ║
╟───────────────────────────────┼────────────────╢
║ Version │ 12.0.0.1069 ║
╟───────────────────────────────┼────────────────╢
╔═════════════════════════════════════════════╗
║ Power Management Controller ║
╟─────────────────────────────┬───────────────╢
║ Family │ PMC ║
╟─────────────────────────────┼───────────────╢
║ Version │ 300.2.11.1011 ║


"The No TLS option only applies to the following countries: China, France, Hong Kong, Israel, Korea, Poland, and Russia."
https://www.dell.com/community/Desktops-…MT/td-p/5100084

17

When I said I have 200 machines to enable AMT I should of explained that they are different models of Dell, they’re not the same as Hydrogen. There’s Optiplex 7010, 7040, 7060, 7070, 3070 and 9020’s. Are we going slightly of topic here with the MEInfo -verbose output the machine INIPC160? INIPC160 is a i5-8500 like Hydrogen, that’s why I chose that machine.

I can get a firmware dump of INIPC160 tomorrow but will this help me work out why the MEBx boot option wasn’t availableon HYDROGEN (sorry if I’m missing the link here)?

For info the service tag of INIPC160 is 4HFRQX2

thanks again for your continual help.

18

@osk866 It depends. Had this other PC been exactly the same then it had been inconsistent. If it’s another configuration it might just be that that one has AMT disabled.

The other thing is: What happened to your image?

UEFItooNE is a very fine tool for scanning images and new parser messages are always suspect. If you have a programmer and a good backup one might decide for oneself if time for hardware reflashing or exploring these messages is more important.

Service tag- I’m sorry, meant the sticker inside the chassis with the AMT code.

I still got some difficulties to reproduce your file…

19



Do you mean the image that bricked the PC, hydrogen.bin?



I can find this tomorrow when I have physical access to it. I’ll report back when I have this information.



Which file?

thanks

20

@osk866 Can’t reproduce hydrogen_remade file.

Otherwise it’s two different questions:

- Why didn’t the first machine have AMT accessible even when all settings in ME from original bios dump are enabled and DELL sticker says ‘fully enabled’?

- For the second machine: Is MEInfo consistent with the ME sticker and settings in ME firmware? If yes can AMT enabled the ‘normal way’?

First question requires a programmer, since system is bricked. Starting point would anyway be flashing the original bios since it’s got all settings enabled.

Second question requires bios dump and info from sticker. If second machine has consistent information (sticker, MEInfo, firmware) and AMT can be enabled according to the book, everything is fine.


@plutomaniac Regarding settings for AMT/ clean ME- Do you have an idea why FIT v12 in its latest version no longer can write a correct FD version and changes order for ME boot and data partition?

Versions
FIT 12.0.49.1536 Tools <= r25
FIT 12.0.64.1551 Tools >= r26 unknown FD version, changed partition order

This is consistent with the older ME/ PMC files from original image and also when exchanging with latest versions.

444.jpg



Would you prefer a version here? (I’d tend to making a ME region with latest tool and replacing it via UEFItool in original bios to keep FD?)