---
name: "hfsts"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/hfsts"
---

# hfsts(4)

Intel Management Engine Host Firmware Status debug probe

## NAME

**hfsts**, **hfstsfd** – Intel Management Engine Host Firmware Status debug probe

## SYNOPSIS

**device pci** **device isa** **device hfsts**

Alternatively, to load the driver as a module at boot time, place the following line in [loader.conf(5)](/loader.conf/5.md):

```
hfsts_load="YES"
```

## DESCRIPTION

The **hfsts** driver is a debug probe that decodes the Intel Management Engine's Host Firmware Status (HFSTS) registers. It is deliberately *not* a full MEI host-client driver: it attaches only to the PCI function and decodes the Host Firmware Status registers available on that generation (HFSTS1–HFSTS6), which live entirely in PCI configuration space. BAR0, the circular-buffer messaging ring used for actual host-ME communication, is never mapped.

The number of Host Firmware Status registers available depends on the PCH generation: ICH10 provides HFSTS1 only, PCH5 through PCH7 provide HFSTS1 and HFSTS2, and PCH8 and later provide all six. Older ICH devices without a defined Host Firmware Status register are not matched.

On attach, the driver decodes the Current Working State, Operation State, Operation Mode, and Error Code fields into named strings and derives a one-word summary, one of “Normal”, “Active”, “Disabled”, or “Absent”, for consumers that do not want to parse the raw fields.

### hfstsfd

**hfstsfd** (Function Disable) is a companion probe that reports whether the MEI function exists in silicon but has been hidden by firmware. The MEI PCI function never enumerates when firmware has disabled it via the PCH Function Disable mechanism, so there is no PCI device instance for **hfsts** to attach to. Instead, **hfstsfd** attaches below the PCI-ISA bridge device and reads the Function Disable register in the chipset's RCBA space to check whether HECI1/HECI2 are present but hidden. If the MEI function is visible on the PCI bus, **hfstsfd** is not needed and does not attach; the two drivers are mutually exclusive, so a system exposes either *dev.hfsts.0* or *dev.hfstsfd.0*, never both. **hfstsfd** only attaches on the following PCH generations:

- Ibex Peak

- Cougar Point

- Panther Point

- Lynx Point

- Wildcat Point

On any other chipset **hfstsfd** does not attach at all. When it does attach, its *status* sysctl is one of:

- **rcba-disabled**

  RCBA is present but not enabled, so the Function Disable register cannot be read.

- **checked**

  FD2 was read successfully; the *mei1\_disabled* and *mei2\_disabled* sysctls reflect its bits.

## SYSCTL VARIABLES

The following [sysctl(8)](/sysctl/8.md) variables are available under *dev.hfsts.N* when the driver is attached to a PCI MEI/HECI function. Each is read live from PCI configuration space on every access, not cached at attach time, since the ME's firmware status can change while the system is running (CWS resets, HAP toggles, M0/M3 power transitions):

- *hfs1*

  Raw Host Firmware Status 1 register value.

- *hfs2*

  Raw Host Firmware Status 2 register value, on PCH5 and later.

- *hfs3*, *hfs4*, *hfs5*, *hfs6*

  Raw Host Firmware Status 3 through 6 register values, on PCH8 and later.

- *d0i3\_supported*

  ME D0i3 capability, from HFS1, on PCH8 and later.

- *opmode*

  ME operation mode, from HFS1, as a numeric value.

- *pm\_event*

  ME power management event, from HFS2, on PCH5 and later.

- *fw\_sku*

  ME firmware SKU, from HFS3, on PCH8 and later.

- *mfg\_mode*

  Non-zero if the ME is running in Manufacturing Mode, from HFS1.

- *update\_in\_progress*

  Non-zero if an ME firmware update is in progress, from HFS1.

- *state*

  ME Current Working State, decoded to a string such as “Normal” or “Disabled”.

- *opstate*

  ME Current Operation State, decoded to a string.

- *opmode\_str*

  ME Current Operation Mode, decoded to a string.

- *error*

  ME Error Code, decoded to a string.

- *summary*

  One-word ME state summary; one of “Normal”, “Active”, “Disabled”, or “Absent”.

The *status* [sysctl(8)](/sysctl/8.md) variable is available under *dev.hfstsfd.N* when the **hfstsfd** identify driver has attached. It contains the function-disable check result; one of the states listed in hfstsfd above.

When *status* is **checked**, the following additional variables are available:

- *fd2*

  Raw Function Disable 2 register value.

- *mei1\_disabled*

  Non-zero if HECI1 is disabled via the Function Disable register.

- *mei2\_disabled*

  Non-zero if HECI2 is disabled via the Function Disable register.

## EXAMPLES

Show the decoded ME state on a system where MEI enumerates normally:

```
sysctl dev.hfsts.0
```

Check whether HECI has been hidden via PCH Function Disable on a system where no MEI PCI function is present:

```
sysctl dev.hfstsfd.0
```

## SEE ALSO

[ichwd(4)](/ichwd/4.md), [pci(4)](/pci/4.md), [sysctl(8)](/sysctl/8.md)

## HISTORY

The **hfsts** and **hfstsfd** drivers first appeared in FreeBSD 16.0.

## AUTHORS

Abdelkader Boudih ⟨*seuros@FreeBSD.org*⟩.

## CAVEATS

**hfsts** only decodes PCI-configuration-space firmware status registers; it provides no access to the MEI messaging ring and cannot be used to communicate with the ME.

**hfstsfd** identifies HECI Function Disable state on a known set of PCH generations only; chipsets that moved ME-disable to a P2SB-sideband mechanism (Skylake/Sunrise Point and later) are not probed, so **hfstsfd** never attaches on them.