Intel Management Engine Interface Information (Type 219)

Source: reverse engineered from the dumps of the data corpus. The layouts of the firmware status registers are the ones coreboot describes in src/soc/intel/common/block/include/intelblocks/cse.h and the me.h headers of the systems on a chip.

Keeps the firmware status registers of the Host Embedded Controller Interfaces (HECI) of the Intel Management Engine, as the firmware of the host has read them at boot. Most tables hold a group association (type 14) named $MEI, which is not a reliable way to find the structure: in about half of the tables of the data corpus the group gives handle 0, and in some it refers to Intel firmware version information (type 221) or to other structures.

The structures are found on Intel platforms whatever the vendor of the firmware is. The reference code gives them type 219 by default, which some vendors give to structures of their own: Dell places the structures at type 203 or 235, or keeps them at type 219 on some systems, e.g. XPS 13 9350, while HP servers carry none. The structure is told by its version, 1, and by the name of the first interface, MEI1, which every known structure holds, so that the structures vendors give the same types are not taken for it.

Table 1. Intel Management Engine Interface Information structure
Offset	Version	Name	Length	Value	Description
`0x00`	2.0+	Type	`BYTE`	`219`	Intel Management Engine Interface Information indicator, `203` on Dell platforms
`0x01`	2.0+	Length	`BYTE`	Varies	Length of the structure, `0x06` + 25 × Interface Count
`0x02`	2.0+	Handle	`WORD`	Varies
`0x04`	2.0+	Version	`BYTE`	`NUMBER`	`1` in all known data
`0x05`	2.0+	Interface Count	`BYTE`	`NUMBER`	Number of interfaces, 3 or 4
`0x06`	2.0+	Interfaces	Varies	Varies	Interfaces, see Interfaces

1. Intel Management Engine Interface Information — Interfaces

The interfaces are the PCI functions 0:16.0, 0:16.1, 0:16.4 and 0:16.5, named MEI1 to MEI4. The registers are the ones of the PCI configuration space of the function, at offsets 0x40, 0x48, 0x60, 0x64, 0x68 and 0x6C. An absent function reads with all bits set. Interfaces whose registers are all zeroes are not reported, e.g. MEI4 on most platforms of the data corpus.

Table 2. Intel Management Engine Interface Information: Interface
Offset	Name	Length	Value	Description
`0x00`	Name	`BYTE`	`STRING`	Name of the interface, e.g. `MEI1`
`0x01`	HFSTS1	`DWORD`	`BITFIELD`	Firmware status register 1, see HFSTS1
`0x05`	HFSTS2	`DWORD`	`BITFIELD`	Firmware status register 2: boot progress, which depends on the generation
`0x09`	HFSTS3	`DWORD`	`BITFIELD`	Firmware status register 3, see HFSTS3
`0x0D`	HFSTS4	`DWORD`	`BITFIELD`	Firmware status register 4, which depends on the generation
`0x11`	HFSTS5	`DWORD`	`BITFIELD`	Firmware status register 5, which depends on the generation
`0x15`	HFSTS6	`DWORD`	`BITFIELD`	Firmware status register 6, which depends on the generation. coreboot describes only bits 30 and 31 of it, for Skylake, as the commit state of the field programmable fuses (FPF)

2. Intel Management Engine Interface Information — HFSTS1

The layout of the first register of the first interface is the same in all generations of the Management Engine.

Table 3. Intel Management Engine Interface Information: HFSTS1
Bits	Name	Description
0-3	Working State	`0` reset, `1` initializing, `2` recovery, `3` test, `4` M3 without UMA (disabled on the 6 series chipsets), `5` normal, `6` waiting for the platform to be disabled, `7` transition of the operation state, `8` invalid CPU plugged in
4	Manufacturing Mode	Firmware is in the manufacturing mode, in which the platform is not locked down yet
5	FPT Bad	Flash partition table is corrupted
6-8	Operation State	Power state of the firmware: `0` preboot, `1` M0 with UMA, `2` M0 power gated, `4` M3 without UMA, `5` M0 without UMA, `6` bring-up, `7` M0 without UMA with an error
9	Initialization Complete	Firmware has completed its initialization
10	Bring-up Load Failure
11	Update in Progress	Firmware is being updated
12-15	Error Code	`0` no error, `1` uncategorized failure, `3` image failure, `4` debug failure
16-19	Operation Mode	`0` normal, `2` debug, `3` temporarily disabled, `4` security override by jumper, `5` security override by message
20-23	Reserved
24	Boot Options Present
25-29	Reserved
30	D3 Support Valid
31	D0i3 Support Valid

The bits from 20 on are the ones coreboot gives for Skylake and later.

3. Intel Management Engine Interface Information — HFSTS3

Table 4. Intel Management Engine Interface Information: HFSTS3
Bits	Name	Description
0-3	Reserved
4-6	Firmware SKU	`2` consumer, `3` corporate, `5` lite, `0` for none on some firmware of Management Engine 11.0. Matches the version string of the `ME Firmware Version` component of Intel firmware version information otherwise
7-31	Reserved	Depend on the generation