Reference

hfsts(4)

Intel Management Engine Host Firmware Status debug probe

NAME

hfsts, hfstsfd – Intel Management Engine Host Firmware Status debug probe

SYNOPSIS

device pci device isa device hfsts

Alternatively, to load the driver as a module at boot time, place the following line in loader.conf(5):

hfsts_load="YES"

DESCRIPTION

The hfsts driver is a debug probe that decodes the Intel Management Engine's Host Firmware Status (HFSTS) registers. It is deliberately not a full MEI host-client driver: it attaches only to the PCI function and decodes the Host Firmware Status registers available on that generation (HFSTS1–HFSTS6), which live entirely in PCI configuration space. BAR0, the circular-buffer messaging ring used for actual host-ME communication, is never mapped.

The number of Host Firmware Status registers available depends on the PCH generation: ICH10 provides HFSTS1 only, PCH5 through PCH7 provide HFSTS1 and HFSTS2, and PCH8 and later provide all six. Older ICH devices without a defined Host Firmware Status register are not matched.

On attach, the driver decodes the Current Working State, Operation State, Operation Mode, and Error Code fields into named strings and derives a one-word summary, one of “Normal”, “Active”, “Disabled”, or “Absent”, for consumers that do not want to parse the raw fields.

hfstsfd

hfstsfd (Function Disable) is a companion probe that reports whether the MEI function exists in silicon but has been hidden by firmware. The MEI PCI function never enumerates when firmware has disabled it via the PCH Function Disable mechanism, so there is no PCI device instance for hfsts to attach to. Instead, hfstsfd attaches below the PCI-ISA bridge device and reads the Function Disable register in the chipset's RCBA space to check whether HECI1/HECI2 are present but hidden. If the MEI function is visible on the PCI bus, hfstsfd is not needed and does not attach; the two drivers are mutually exclusive, so a system exposes either dev.hfsts.0 or dev.hfstsfd.0, never both. hfstsfd only attaches on the following PCH generations:

  • Ibex Peak

  • Cougar Point

  • Panther Point

  • Lynx Point

  • Wildcat Point

On any other chipset hfstsfd does not attach at all. When it does attach, its status sysctl is one of:

rcba-disabled

RCBA is present but not enabled, so the Function Disable register cannot be read.

checked

FD2 was read successfully; the mei1_disabled and mei2_disabled sysctls reflect its bits.

SYSCTL VARIABLES

The following sysctl(8) variables are available under dev.hfsts.N when the driver is attached to a PCI MEI/HECI function. Each is read live from PCI configuration space on every access, not cached at attach time, since the ME's firmware status can change while the system is running (CWS resets, HAP toggles, M0/M3 power transitions):

hfs1

Raw Host Firmware Status 1 register value.

hfs2

Raw Host Firmware Status 2 register value, on PCH5 and later.

hfs3, hfs4, hfs5, hfs6

Raw Host Firmware Status 3 through 6 register values, on PCH8 and later.

d0i3_supported

ME D0i3 capability, from HFS1, on PCH8 and later.

opmode

ME operation mode, from HFS1, as a numeric value.

pm_event

ME power management event, from HFS2, on PCH5 and later.

fw_sku

ME firmware SKU, from HFS3, on PCH8 and later.

mfg_mode

Non-zero if the ME is running in Manufacturing Mode, from HFS1.

update_in_progress

Non-zero if an ME firmware update is in progress, from HFS1.

state

ME Current Working State, decoded to a string such as “Normal” or “Disabled”.

opstate

ME Current Operation State, decoded to a string.

opmode_str

ME Current Operation Mode, decoded to a string.

error

ME Error Code, decoded to a string.

summary

One-word ME state summary; one of “Normal”, “Active”, “Disabled”, or “Absent”.

The status sysctl(8) variable is available under dev.hfstsfd.N when the hfstsfd identify driver has attached. It contains the function-disable check result; one of the states listed in hfstsfd above.

When status is checked, the following additional variables are available:

fd2

Raw Function Disable 2 register value.

mei1_disabled

Non-zero if HECI1 is disabled via the Function Disable register.

mei2_disabled

Non-zero if HECI2 is disabled via the Function Disable register.

EXAMPLES

Show the decoded ME state on a system where MEI enumerates normally:

sysctl dev.hfsts.0

Check whether HECI has been hidden via PCH Function Disable on a system where no MEI PCI function is present:

sysctl dev.hfstsfd.0

SEE ALSO

ichwd(4), pci(4), sysctl(8)

HISTORY

The hfsts and hfstsfd drivers first appeared in FreeBSD 16.0.

AUTHORS

Abdelkader Boudih ⟨[email protected]⟩.

CAVEATS

hfsts only decodes PCI-configuration-space firmware status registers; it provides no access to the MEI messaging ring and cannot be used to communicate with the ME.

hfstsfd identifies HECI Function Disable state on a known set of PCH generations only; chipsets that moved ME-disable to a P2SB-sideband mechanism (Skylake/Sunrise Point and later) are not probed, so hfstsfd never attaches on them.