New "Windows 11 ready" BIOS updates for Z590 boards

[citay]

MSI has released a new BIOS for the Z590 mainboards which turns on the firmware TPM / fTPM (called PTT on Intel boards) by default:

Thus, one only has to enable Secure Boot to make the system fully Windows 11 ready. https://www.msi.com/blog/Windows-11-guidance
But Windows 11 can be installed even with Secure Boot off.
I think they couldn't turn on Secure Boot by default, because there is an extra step required upon enabling it, and it also depends on the other hardware such as the graphics card.

The new BIOS also includes the Intel microcode update revision 44 (with an 11th gen CPU), which can be checked in HWinfo64 under System Summary:

This can improve things like boosting behaviour or other CPU-related functions. It's basically a code update for the CPU.

Check your board's MSI support site for the newest BIOS from September with the following changelog:

- Windows 11 Supported.
- Improved compatibility for Intel Thunderbolt devices.

Update how-to:
1) Get the latest BIOS. It's the topmost one on the MSI support page for your board.
2) Extract the file and you will get a text file and the BIOS file. Put the BIOS file into the root folder of a USB stick/drive.
3) Enter the BIOS by pressing DEL during boot, go to "M-FLASH" in the BIOS.
4) Once M-Flash (the updater) is loaded, it will show a list of your drives. Select the USB stick and select the previously extracted BIOS file on there.
5) It will ask for confirmation and then update the BIOS. It's fully automatic from there, takes about two minutes.

 

[citay]

MSI get the microcode updates directly from Intel. Whatever microcode update revision you see is always supplied by Intel, MSI don't make their own, they just include the Intel updates in their BIOS releases. Microcode update revision 44 is obviously behind 50 and slightly older. But Intel supply a lot of updates, there were also many below 40, so i don't know where you got the "40-50" range from. Here you can read more details: https://www.anandtech.com/show/1654...fers-small-performance-gains-on-core-i711700k

Until MSI release a new BIOS, you won't get a newer microcode revision than 44. And for MSI to release a BIOS update, there would have to be a somewhat serious/annoying bug. Simply a newer microcode is not enough reason for them. They got their hands full with the 600-series boards for Alder Lake 12th gen, where the BIOS is in a very immature state and desperately needs optimization.

 

[mnemonic]

ok, i see. then the only option is to load newer mcu via windows and test. Some mcu's might carry important security mitigations/updates though. Apparently there is 4C, 4D and 50 already released after 44. And yes , intel is hard to follow as to what actually changed. Might be important , but it also might be nothing substantial, their documentation is slow to appear and hard to find.

 

[citay]

If there are really critical security fixes, Intel will supply Microsoft with the new microcode and they're gonna distribute it via Windows Update.
But most of the time there's "only" some minor performance improvements for example, those you may get in a BIOS update, provided there's gonna be another one.

 

[mnemonic]

i know, but i do like to decide myself. As if anyone would just have to trust big tech. Thanks for your reply.

 

[citay]

MSI released a new BIOS update for the Z590 boards today. As usual, backdated, and most likely quite incomplete changelog:

2022-01-18
Description
- Update CPU Microcode
- Adjust PCIe Lanes setting

 

[patsc158102e1]

The new bios still contains the old Intel Management Engine Firmware 15.0.35.1932. Current is 15.0.35.2028 and soon the
15.0.35.2039. MSI does not fix any serious security gaps! A decimal place is missing in the CPU base clock.
Also some "Auto" entries are only displayed with "Aut".

If you have your own values for Turbo Ratio and want to set everything back to Auto.
If you start from 1-Core Ratio Limit and go down and want to set
everything to Auto, then the bios freezes!
If you start from 8-Core Ratio Limit and go all the way up to Auto,
then the bios doesn't freeze!

 

[citay]

Well, the ME Version in the previous BIOS was 15.0.23.1777, so they went to a newer one with 15.0.35.1932, meaning technically, it's not "still the old one". I know what you mean, that they are behind, but that's not too unusual, a BIOS goes through a lot of hoops until it's released. Although clearly not enough, when they have "Aut" instead of "Auto" in some places etc...

I tried to find some Management Engine security advisories about the "serious security gaps", i could only find ones that need local access in front of the computer (no danger from remote/internet).
For example this, but it was already fixed in ME version 15.0.23: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00459.html

As far as CSME advisories (Converged Security and Mangement Engine), that's actually the most recent one i found on https://www.intel.com/content/www/us/en/security-center/default.html
Sure, the newer versions will fix some things, but i'm not entirely convinced that there is such a serious security issue. Or do you have some information you could link?

But thanks for finding those bugs, you should report that to MSI too.

Why did you point out the Base Clock 100.0 MHz?

 

[mnemonic]

All went well on update, i didn't notice any "Aut" instead of the "Auto" though when checking and setting the options again after the flash (everything reverts to default including the Secure boot function and keys), maybe needs a reflash when that happens?

 

[citay]

I only spotted one "Aut" on his second picture, after "CPU Ratio".
Gonna update my Z590 in two days, don't have enough free time at a stretch until then. Cause i always like to do stability testing afterwards.

 

[citay]

Ok, i've just completed almost two hours of testing with the new BIOS.
I went from BIOS 7D06vA3 ("Windows 11 Supported") to 7D06vA4 ("Update CPU Microcode") on my MPG Z590 GAMING FORCE.

First of all, the Management Engine 15.0.35.1932 is not vulnerable to any relevant security flaws anymore. I've ran the CSME Version Detection Tool (under \DiscoveryTool.GUI) with the previous BIOS ("This system is vulnerable.") and with the new BIOS ("This system is not vulnerable. It has already been patched.").

Secondly, the Microcode update revision for Rocket Lake CPUs went from 44 to 50, as displayed in the BIOS under system status or by HWinfo64:

Thirdly, all my stability testing so far reveal no problems with this BIOS. Performance is pretty much the same, every stress test is passed.


But i can also confirm two small problems that @patsc158102e1 reported above:

1) I had the BIOS freeze on me one time while i was writing something down and not doing anything in the BIOS.

2) The last character is missing on a couple of settings (just certain settings, not everywhere).
I have seen several settings where "Auto" was turned into "Aut" and one setting where 100.00 was turned into 100.0.

Previous BIOS version:

New BIOS version (i hadn't set up my RAM properly yet, but it's just to show the "Aut" thing):

Now, i don't consider these two bugs a dealbreaker, because i usually just set all my settings in the BIOS and then i'm never in there again for a while. So to me, as long as everything runs stable and i get the latest updates and fixes, i don't particularly care if one letter is missing from an option, as long as it works correctly. Therefore i will stay on this BIOS.

I would still like for MSI to test their BIOS releases more thoroughly. For example the "Auto -> Aut" bug is almost immediately obvious once you work a bit with the BIOS. The only explanation why nobody spotted that is probably because in Taiwan (MSI HQ), they use the Chinese version of the BIOS.

Overall, i can still recommend this BIOS if you want to have the latest security fixes and Intel microcode update.

 

[milaaaan_63]

Thanks for your thoughts, and what about power draw? does it use more power than the previous BIOS? and what is your memory latency? if you dont mind to ask. Could you put here an AIDA 64 memory benchmark? thank you

 

[citay]

does it use more power than the previous BIOS?

Power draw is exactly the same (with the same settings). I tested it with an energy meter at the wall outlet for idle power draw, then during WinRAR bench, Prime95 Small FFTs, Linpack, Cinebench.

and what is your memory latency? if you dont mind to ask. Could you put here an AIDA 64 memory benchmark?

Sure, but i don't know how relevant the values are for you, because i manually tuned the secondary RAM timings.

No major differences to the values with the previous BIOS (within the margin of error, plus AIDA64 is not 100% consistent with measuring the values anyway).

 

[milaaaan_63]

Thank you these are mine, do you think should I update to the A.40 BIOS?

 

[citay]

I can only speak for myself. I always update, and if i find a dealbreaker, i'll just downgrade again. This way there's no risk. And when something fails, i have the Flash BIOS Button.
Sometimes staying on an old version can be more risky than updating (security flaws). I don't think the ME flaws in the older versions are too critical, but it's nice to have everything halfway current.

 

[milaaaan_63]

I already updated too. Thank you again for your help.

 

[peshirley159802e0]

And who did this update and now has their Internal GPU completely removed yet it's been in use for a year... They even removed the option to enable the Internal GPU from the BIOS.... WHHHHHHHY, ruined my entire evening when I go to click go live and see I'm not even running on GPU1

 

[citay]

Huh? I use my iGPU no problem, i don't even have a graphics card right now. Also, the setting "Initiate Graphics Adapter" (IGP/PEG) is still there and i set it to IGP.

 

[peshirley159802e0]

Mines been set

 

[peshirley159802e0]

Was working fine until I did the new bios update and why would I not want better CPU performance and security so I've gotta go through the process of reverting the bios...Bios.... Super LAME

 

[peshirley159802e0]

I have a GPU so I can't set the BIOS 2 igp or when I got 2 boot I'll be F***** as my MB HDMI nor DP ports are even in the device list, I can't even install the display drivers from Intel but tell me how they left the Intel Graphics Command Center as a total Laugh in my face