Did not work on Gigabyte GA-P55A-UD3R (1.0)

[lbschenkel]

Motheboard: GA-P55A-UD3R https://www.gigabyte.com/Motherboard/GA-P55A-UD3R-rev-10#sp
BIOS: F14B http://download.gigabyte.eu/FileList/BIOS/motherboard_bios_ga-p55a-ud3r_f14b.exe

Used version 2e8761e.
Follow guide from here: https://github.com/corna/me_cleaner/wiki/Internal-flashing-with-OEM-firmware

ifdtool and me_cleaner passed all checks, both pre- and post-cleaning. Tried flashing cleaned image via built-in motherboard "QFlash" utility, it refused claiming BIOS image was corrupt. Tried via flashrom in Linux, it "worked" (as in: flash succeeded). After power cycling, computer booted but froze during POST (screen is displayed with CPU and memory information but cannot enter BIOS, keyboard is unresponsive, it never reaches the next stage when you see messages from Intel AHCI).

Motherboard has dual BIOS, triggered backup BIOS in order to recover.

This is an old machine and removing ME in it is not critical for me, I was mostly trying it out to check if it worked. I can provide additional logs, BIOS images, etc. if requested.

[rnhmjoj]

QFlash must be using a checksum: It fails even if a single bit is flipped.
Can you tell me which options for flashrom you used? I can't get it to detect the BIOS.

[lbschenkel]

I compiled flashrom from source, commit is aa91d5c16858cb400cc61e8a759838f645e3f314:
flashrom -p internal -c MX25L1605 ...
I had to specify -c because the probing detects three candidates, I picked the first one.

[rnhmjoj]

Well, it looks like my system is not supported. I will have to try with an external programmer.

[corna]

Quite strange, as it seems that the BIOS supports the modifications introduced by me_cleaner (= the raminit succeeds), however it refuses to continue with the boot. Can you try with the dev branch of me_cleaner?

[lbschenkel]

@corna By using the dev branch you mean specifically the new -s option? Since that requires extracting ME from the BIOS, how do I flash it afterwards (or merge it back into the BIOS update file)?

[lbschenkel]

OK, I misread "requires a full dump" as "requires separate ME/TXE image". I tried now with -s, and QFlash did not complain, however I am not sure if it had any effect:

Output of intelmetool -s:

Bad news, you have a `P55 Chipset LPC Interface Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI was hidden on PCI, now unlocked
MEI found: [8086:3b64] 5 Series/3400 Series Chipset HECI Controller

ME Status   : 0xee110205
ME Status 2 : 0xb001f

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : YES
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Normal
ME: Current Operation State : Preboot
ME: Current Operation Mode  : (null)
ME: Error Code              : No Error
ME: Progress Phase          : ROM Phase
ME: Power Management Event  : Clean Moff->Mx wake
ME: Progress Phase State    : (null)

ME: Extend Register not valid

ME: timeout waiting for data: expected 8, available 6
ME: GET FW VERSION message failed
ME: timeout waiting for data: expected 5, available 0
ME: GET FWCAPS message failed
Re-hiding MEI device...done

Unfortunately I did not save the output pre-cleaning, but I did read it multiple times and from memory it looks visually identical to the above (so no change).

I did try flashing with flashrom as well but the results were the same.

I can flash the original ROM again, but I'm reasonably confident that the output of intelmetool in the pre-clean state is the same.

[ghost]

Confirming output from a non-cleaned Gigabyte GA-P55A-UD3R:

Bad news, you have a `P55 Chipset LPC Interface Controller` so you have ME hardware on board and you can't control or disable it, continuing...

MEI was hidden on PCI, now unlocked
MEI found: [8086:3b64] 5 Series/3400 Series Chipset HECI Controller

ME Status   : 0xee110205
ME Status 2 : 0xb001f

ME: FW Partition Table      : OK
ME: Bringup Loader Failure  : NO
ME: Firmware Init Complete  : YES
ME: Manufacturing Mode      : NO
ME: Boot Options Present    : NO
ME: Update In Progress      : NO
ME: Current Working State   : Normal
ME: Current Operation State : Preboot
ME: Current Operation Mode  : (null)
ME: Error Code              : No Error
ME: Progress Phase          : ROM Phase
ME: Power Management Event  : Clean Moff->Mx wake
ME: Progress Phase State    : Global reset after an error

ME: Extend Register not valid

ME: timeout waiting for data: expected 8, available 6
ME: GET FW VERSION message failed
ME: timeout waiting for data: expected 5, available 0
ME: GET FWCAPS message failed
Re-hiding MEI device...done
intelmetool -s  6.19s user 0.43s system 34% cpu 19.030 total

I wonder if it matters which of the detected chip names I specify when flashing the rom, reading the bios gives me the same checksum on all of them, I don't want to brick this system so I didn't write anything yet, but idftool and me_cleaner seem to like the bios dumps.

flashrom v0.9.9-r1955 on Linux 4.12.10-1-hardened (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Calibrating delay loop... OK.
Found chipset "Intel P55".
This chipset is marked as untested. If you are using an up-to-date version
of flashrom *and* were (not) able to successfully update your firmware with it,
then please email a report to flashrom@flashrom.org including a verbose (-V) log.
Thank you!
Enabling flash write... OK.
Found Macronix flash chip "MX25L1605" (2048 kB, SPI) mapped at physical address 0x00000000ffe00000.
Found Macronix flash chip "MX25L1605A/MX25L1606E/MX25L1608E" (2048 kB, SPI) mapped at physical address 0x00000000ffe00000.
Found Macronix flash chip "MX25L1605D/MX25L1608D/MX25L1673E" (2048 kB, SPI) mapped at physical address 0x00000000ffe00000.
Multiple flash chip definitions match the detected chip(s): "MX25L1605", "MX25L1605A/MX25L1606E/MX25L1608E", "MX25L1605D/MX25L1608D/MX25L1673E"
Please specify which chip definition to use with the -c <chipname> option.

me_cleaner.py output, stable branch, just -O parameter:

Full image detected
The ME/TXE region goes from 0x1000 to 0x21000
Found FPT header at 0x1010
Found 5 partition(s)
Found FTPR header: FTPR partition spans from 0x10000 to 0x11000
ME/TXE firmware version 6.0.20.1185
Removing extra partitions...
Removing extra partition entries in FPT...
Removing EFFS presence flag...
Correcting checksum (0x6a)...
Reading FTPR modules list...
 ROMP             (Huffman, fragmented data    ): NOT removed, essential
The ME minimum size should be 81920 bytes (0x14000 bytes)
The ME region can be reduced up to:
 00001000:00014fff me
Setting the AltMeDisable bit in PCHSTRP10 to disable Intel ME...
Checking the FTPR RSA signature... VALID
Done! Good luck!

[ghost]

I decided to flash it after all, after reboot I got about 5 seconds of black screen, after that it reached the gigabyte logo screen where it froze with all the indicator LEDs on the mobo lit up and CPU fan at max. Not sure if the logo even showed up at 1st because I also did a bios clear. Backup bios didn't automatically kick in, had to short pin 4+7 on M_BIOS chip with a paper clip for a second after powering on to force it to work (this is a delicate operation if you don't have proper tools), but at least it booted now.

[lbschenkel]

I managed to trigger the backup BIOS by powering it on holding the reset button at the same time, after a few seconds it turns off and on and starts restoring the BIOS from the backup chip.