ASRock Z370/Z390 Taichi (and some others, actively modding!) Firmware with Intel Management Engine Disabled

[Mork_vom_Ork]

I'll give it a try.
Thanx so much for all your help. I appriciate.

 

[R-T-B]

I'll give it a try.
Thanx so much for all your help. I appriciate.

No problem man, I want to support more boards and I thank you for actually reporting what happens. That is most helpful.

Maybe I can move this board from "EXPERIMENTAL" to the standard supported folder.

PS: If you have trouble/ a bad flash, above all else don't panic. I can likely bail you out with a little time and energy.

 

[Mork_vom_Ork]

Back with good and bad news:

GOOD: SuperCarrier accepted the modified bios for instant flash.
After that i did a reboot and left all settings untouched, booted into WINDOWS10 and

BAD: got this in CMD shell when trying to downgrade ME firmware:

"C:\temp\intel_me>fwupdlcl64.exe -F me.bin

Intel (R) Firmware Update Utility Version: 11.6.0.1136
Copyright (C) 2007 - 2016, Intel Corporation. All rights reserved.
Communication Mode: MEI Checking firmware parameters...

Warning: Do not exit the process or power off the machine before the firmware update process ends.

Are you sure you want to perform a Firmware Downgrade? (Y/N): Y

Sending the update image to FW for verification: (COMPLETE )

Do not Interrupt

Error 8805: FW downgrade is not allowed due to SVN restrication.
C:\temp\intel_me>"

Also interesting is the following (might be of interest for you, too):
when the instant flash is ready, machine makes a reboot (of cause)
Than when i enter the BIOS setup and check under CHIPSET settings, there is always be shown the current ME firmware version 11.8.50.3460
Also if i check currently installed ME firmware with an other tool, i always get this version as result.

 

[R-T-B]

hmmm...

3460 is the version my "disabled" ME firmware is based on.

In other words, the management engine is already disabled. It doesn't really matter what version you are on because it is nonfunctional. As long as they are not blocking the management engine in the kernel (the only thing that loads, and it does very little due to space limitations), a Coffee Lake CPU SHOULD work.

Do you have one you can try?

If not, I have some other ideas. PM me if CPU is not already working and I'll be glad to walk you through it in a private chat.

A final thing you can try is taking my image, and attempt to flash it using the tool FPTW64. It is a windows land utility. Download it here along with a mess of other tools, and then type the following with my image in FPTW64's folder:

FPTW64 -F Z270SC_NOME_CL_R2_2.40 -ME

That will attempt to forcibly downgrade the ME partition. However, it may fail if my image did not unlock the flash descriptor (quite possible). If it does, no harm done, but certainly not success either. Hopefully you won't even need to try this and you already have a CL CPU running.

 

[Mork_vom_Ork]

Yes, got the i3-8350K here (4 Core CoffeeLake).
I'll give it a try. Could take some time, cause i have to change SKYLAKE CPU for this one.
I'll be back when finished the test with CL-CPU. Stay tuned

 

[R-T-B]

For added luck, you could try the FPTW command above. IF it works you are good for sure, if not you still have a probably 50/50 shot.

If all that fails, well, this may be one for a hardware programmer, but I'll poke around one last time just for fun.

 

[Mork_vom_Ork]

wrinting this right now from my MacBook:
CL-CPU does NOT work: computer turns on for just a second, than immediatly shuts down.
So there seems to be relevant part of ME still active. Also tried CMOS-Reset with NO luck.

One more last chance: i will remove CMOS-battery for a few minutes to see what happens

 

[R-T-B]

Ah. Darn. They protect it in the kernel. Intel is clever like that, should've expected it. We do need a full downgrade then.

You aren't done yet though, I found some hidden bios options that may remove the protections from downgrading if turned on. If you are willing to go back to the old CPU and humor me, I think I can get it to flash despite the version mismatch.

 

[Mork_vom_Ork]

I knew these settings, cause i use AMIBMP, too for getting some settings for Thunderbolt, which normally are hidden.
Also i set my preffered settings with it - so i am familar with this App.

Tried the setting set to ENABLED already. After switching to ENABLED, the bios files is no longer a valid BIOS for Instant flash :-(

Hold a second, i mod back to SKYLAKE-CPU

 

[R-T-B]

I knew these settings, cause i use AMIBMP, too for getting some settings for Thunderbolt, which normally are hidden.
Also i set my preffered settings with it - so i am familar with this App.

AH, good job then.

Please try the FPT command if you have not already, listed in post #29. If it goes through you will almost certainly have downgraded. Try it both with the ME FW ReFlash option set, and not set.

Of course it is seldom that easy, but I can hope.

If that fails, run this command and PM me the result DUMP.ROM file. It will contain some semi-personal info (MAC Address, etc) so do not post it publically, only in PM.

FPTW64 -D DUMP.ROM

It will certainly succeed, and tell me a lot about our options from here (it just is a bios dump, but I can tell what actually happened and learn a lot from that).

 

[Mork_vom_Ork]

FPTW64 -D DUMP.ROM gives me this error:

"Error 367: [FPTw64.exe] cannot be run on the current platform.
Please contact your vendor."

WTF! i dont know, whats going on here. Also for me it seems, after rebuild the SKYLAKE CPU (remember i did a CMOS-RESET and removed CMOS-battery)
ALL BIOS-Settings where the prefered one, which i saved in a fresh 2.40 flashrom and which WAS copied by the machine to the BIOS B Chip automatically.

I knew about this, because that was the first thing i tried: thought "Well, no problem, lets make a secure-backup from BIOS B chip with the labled 2.10 ROM to the BIOS A chip"
But there wasn't any 2.10 ROM on that Chip anymore - it was upgraded with my latest (with UBU modified) 2.40 ROM - which have the latest GOP, VBIOS, RAID-EFI, Network-EFI, desired Microcodes etc.

 

[R-T-B]

That is odd... It is a 64-bit OS correct? Running it as admin? Huh. ASRock seems to have stepped down the protections from the z270 -> z370, which is not what I'd expect. Your board is setup way more strict that my Taichi...

You tried that with both ME FW Reflash setting on and off?

Well then.

You can try this, if nothing else. Sounds like you have a dual bios board, maybe you are in luck:

We need to convince the board the main bios is completely corrupt, or it will keep the more up to date components instead of rewriting them from secondary (Like the ME, and other working stuff).

We can do that by shorting some pins, but maybe there is an easier way. Do you have a jumper labeled "BIOS_TEST1" on the board next to the DR DEBUG LED? If so, short during boot (don't let it unshort until done flashing!) that and it should force the backup bios to overwrite the main one.

If that even fails to replace the ME, we will have to do a manual short, which isn't that hard, but any time you short something in your computer there is SOME danger. Let me know if you want to proceed.

EDIT: If you are really desperate to do this without hardware programmer, there are also ways you could defeat the dual bios mechanism and force it to use the backup bios every boot. That would be a loss of some function, though, and quite bad if you ever had a bad flash. I would suggest first booting into the backup bios itself just once and seeing if you can determine it's actual version. I can advise on that as well.

If you don't have the jumper, let me know and I will set up a chat room so we can deal with this more directly and quickly. Thanks for your continued testing and patience, feel free to call quits anytime.

EDIT EDIT: I am moving this to a PM now, will report to TPU when I finish or my new test subject gives up.

 

[Mork_vom_Ork]

Thats what i told in my last post: i closed that jumper, which results on next reboot, that machine thinks, main BIOS is corrupt and starts the SECURE_BACKUP routine, which copied flashrom B to flashrom A. But there lies the problem: when i received the borad as new, both BIOS chips contained BIOS ROM 2.10. Working chip is chip A - but if the machine detects a newer ROM on chip A , which booted for sometime without any problems, it gets automatically copied to chip B.

So now i have the same BIOS ROM on both chips. I don't know, if there is any way to get these chips set to factory default.
Well, on tuesday i will receive my chipprogrammer, than i can flash chip back to a BIOS prior v2.20.

No early quit here, cause i am happy, that u are willing to help.

 

[R-T-B]

Sent you a PM with a place we can chat, so not to spam the forum, if you are willing.

Glad you just closed that jumper and did not execute the uefi function, that would've lost your old image in the backup bios for certain. As it is, it might still be there.

 

[Mork_vom_Ork]

Attached you will find a picture of the two BIOS chips and the PINS, which needs to be closed to SECURE_BACKUP content CHIP B ---> CHIP A

CHIP A is Main BIOS - Chip B is Backup BIOS

 

[R-T-B]

Yep, the problem as we both have learned, is that jumper won't reflash your bios because it does not think it's corrupt.

I don't understand why ASRock does that: makes a "force flash" jumper that does a heath check, it seems like "force flash" should mean "no matter what," but I am not a board designer.

Walking him through the scary process of shorting some bios legs to make his main bios appear corrupt so it will downgrade from backup right now. Will update.

EDIT: This guy deserves a gold star, he did it!

Unfortunately it did nothing. I think his backup bios is just too new for some reason. Or he failed to short it right.

Fortunately, I found a bios key that forces the ME version to 0.0.0.0, which should allow us to downgrade (or upgrade in Intel's eyes) to whatever we want. Which is great because I hate putting metal implements anywhere near a nice computer.

EDIT: A long, multistepped process later and we got him downgraded. I will do my best to document and reproduce it soon (though at least one step has me genuinely confused how it worked at all...)

He's testing a coffee lake CPU as we speak.

As the standard 11.8.3460 based ME "cleaned" image was tested and works fine as long as you don't want Coffee Lake with your Z270, I am moving it to the stable directory. Coffee lake support is still experimental, and undocumented as of now.

 

[VasDrakken]

Intel's machine firmware update should do some of that as the point of the ime is so that if someone is stealing assets at a company the ime can be used to monitor the computer at the cpu level without the end user knowing, but even as an aderno developer I agree with the original poster that usually all it ends up doing is fubar the system. Good idea but if you have physical access to the machine you can get around the IME by pulling the drives and cloning them, and there is nothing the ime end can tell, since it is basically a network boot that tries to dial home to the motherboard mkg, on xcore and xeon and higher cpu chipsets. Technically you can not install the ime driver when you install windows but the uefi bios is still going to try and dial home.

As long as you are not using remote desktop to troubleshoot the machine or have it head less enviroment, in theory you can code a halt state to the parts of the processer that run the intel management engine as if you were disabling a core that was partially functional but I am not sure the syntax you would need to use to issue a halt command at post, it would most likely have to be at compile time and it might not be documented externally even in the adreno so people do not accidentally brick their cpus. the old riva tunner code might have a way to do since you can enable and disable gpu parts but intel has been writing code longer than most companies so they may not even use the assembler halt code.

 

[Mork_vom_Ork]

first of all i would like to thank R-T-B for his great HELP/SUPPORT.
He has done a great job by supporting me to get my currently installed ME firmware 11.8.50.3470 downgraded to 11.0.6.xx, which i need for my "i3-8350K Coffeelake CPU running on Intel Z270 Board" project. He did a lot of modifications for me on provided BIOS files and after about 4 or 5 hours we (more HE than me) finally succeed:

Got the latest BIOS file for my ASRock Z270 Super Carrier with the above mentioned ME firmware. Now i just have to switch SKYLAKE i7 6700K against that i3-8350K Coffeelake CPU on the Super Carrier.
I would like to take this thread to once again give him a big T H A N K Y O U for his support.

Currently i am looking for the solution on what BIOS Error 18 exactly means - seems to be related to some memory glitches. Once i fixed them and get the Super Carrier successfully bottet into WINDOWS and macOS i will let you all know.

Regards...

 

[R-T-B]

sounds like you are making headway at least! Is the Error 18 on the on-mobo POST code led display or somewhere else? Could be the Coffee Lake CPU is setting up memory timings wrong and you may need to find a way to set them by hand.

Do keep us informed. I unfortunately know very little beyond just getting the management engine where it needs to be.

 

[Mork_vom_Ork]

yes, seems to memory-timing. currently i am stilling looking for a way to fix it.
i will check all my BIOS settings right now (still on SKYLAKE). if find the solution, i'll keep you informed on what it was

 

[R-T-B]

yes, seems to memory-timing. currently i am stilling looking for a way to fix it.
i will check all my BIOS settings right now (still on SKYLAKE). if find the solution, i'll keep you informed on what it was

Probably setting the ram voltage slightly higher may help the CL post.

May have an idea relating to microcode that would be causing your error, sent you a pm if you want to run some test roms.

 

[Mork_vom_Ork]

@R-T-B - just to let you know: WE DID IT, finally. Running my i3-8350K Coffee Lake CPU on the ASRock Z270 Super Carrier:

Guess, what the final problem was? I just forget to implement microcode for CPUID 906EB (i3-8350K Coffee Lake) ;-)
After fixing that with the latest UBU tool, i was able to boot into WINDOWS 7, WINDOWS 10 and macOS High Sierra 10.13.5

I could not often enough say, how grateful i am about finding YOU and THIS thread here on techpowerup.com - W O N D E R F U L L.
Thanx again and again and again <---- sorry for spamming, but i am so happy about it. Your next drink is on me, defenitly.

 

[R-T-B]

Wow, I thought something was up with the microcode (sent you a PM about it) but then falsely concluded I was just seeing things and started looking at the GOP driver... Good eye!

I will be producing a kit for people to do this with instuctions, based on our chat log. It will be very beta, and require no less than three seperate flashes to ensure everything works (I can't narrow it down to less unfortunately)... but maybe some brave soul can try it and we'll get it ready for anyone to use with mostly "for dummies" style instructions (not for idiots, none of this is for idiots lol).

Good work and glad I could help! Your board has been good for science today.

 

[Mork_vom_Ork]

i could sent you the latest BIOS, cause i have to patch it two more times:
a) including the forgotten microcode for CPUID 906EB and
b) have to patch another one for missing PCIe slot#1 on first boot. This is a known error and needs extra patching. Tools and discussion thread for that error could be found here:
Fernandos WIN-RAID Forum

 

[R-T-B]

i could sent you the latest BIOS, cause i have to patch it two more times:
a) including the forgotten microcode for CPUID 906EB and
b) have to patch another one for missing PCIe slot#1 on first boot. This is a known error and needs extra patching. Tools and discussion thread for that error could be found here:
Fernandos WIN-RAID Forum

If you could send your final bios when you get it all "tuned" that would be excellent. Wait until it is working properly for a bit, because I will need a day or two to write good instructions anyways.

Of course for my collection I will have to setup the AMIBCP tables to defaults rather than your custom settings, but no issue that's easy to do.

For now, I am taking the coffee lake firmware down because without instructions, they are just asking for people to do weird things to their board. The Managment Engine cleaning firmware worked fine though, and is safe at least for that use, so it stays up.