blob: 10cb37d226561d1692782fc39e4fafbc4ce182d6 [file] [log] [blame]
Stefan Tauner25ffba72011-11-13 23:03:30 +00001= BBAR on ICH8 =
2 There is no sign of BBAR (BIOS Base Address Configuration Register) in the
3 public datasheet (or specification update) of the ICH8. Also, the offset of
4 that register has changed between ICH7 (SPIBAR + 50h) and ICH9 (SPIBAR +
5 A0h), so we have no clue if or where it is on ICH8. Out current policy is to
6 not touch it at all and assume/hope it is 0.
7
8= Accesses beyond region bounds in descriptor mode =
9 Intel's flash image tool will always expand the last region so that it covers
10 the whole flash chip, but some boards ship with a different configuration.
11 It seems that in descriptor mode all addresses outside the used regions can not
12 be accessed whatsoever. This is not specified anywhere publicly as far as we
13 could tell. flashrom does not handle this explicitly yet. It will just fail
14 when trying to touch an address outside of any region.
15 See also http://www.flashrom.org/pipermail/flashrom/2011-August/007606.html
16
Stefan Taunerd94d25d2012-07-28 03:17:15 +000017= (Un)locking the ME region =
Stefan Tauner2abab942012-04-27 20:41:23 +000018 If the ME region is locked by the FRAP register in descriptor mode, the host
Stefan Taunerd94d25d2012-07-28 03:17:15 +000019 software is not allowed to read or write any address inside that region.
20 Although the chipset datasheets specify that "[t]he contents of this register
21 are that of the Flash Descriptor" [PANTHER], this is not entirely true.
22 The firmware has to fill at least some of the registers involved. It is not
23 known when they become read-only or any other details, but there is at least
24 one HM67-based board, that provides an user-changeable setting in the firmware
25 user interface to enable ME region updates that lead to a FRAP content that is
26 not equal to the descriptor region bits [NC9B].
27
28 There are different ways to unlock access:
Stefan Tauner2abab942012-04-27 20:41:23 +000029
30 - A pin strap: Flash Descriptor Security Override Strap (as indicated by the
31 Flash Descriptor Override Pin Strap Status (FDOPSS) in HSFS. That pin is
32 probably not accessible to end users on consumer boards (every Intel doc i
33 have seen stresses that this is for debugging in manufacturing only and
34 should not be available for end users).
35 The ME indicates this in bits [19:16] (Operation Mode) in the HFS register of
36 the HECI/MEI PCI device by setting them to 4 (SECOVR_JMPR) [MODE_CTRL].
37
38 - Intel Management Engine BIOS Extension (MEBx) Disable
39 This option may be available to end users on some boards usually accessible
40 by hitting ctrl+p after BIOS POST. Quote: "'Disabling' the Intel ME does not
41 really disable it: it causes the Intel ME code to be halted at an early stage
42 of the Intel ME's booting so that the system has no traffic originating from
43 the Intel ME on any of the buses." [MEBX] The ME indicates this in
44 bits [19:16] (Operation Mode) in the HFS register of the HECI/MEI PCI device
45 by setting them to 3 (Soft Temporary Disable) [MODE_CTRL].
46
47 - Previous to Ibex Peak/5 Series chipsets removing the DIMM from slot (or
48 channel?) #0 disables the ME completely, which may give the host access to
49 the ME region.
50
51 - HMRFPO (Host ME Region Flash Protection Override) Enable MEI command
52 This is the most interesting one because it allows to temporarily disable
53 the ME region protection by software. The ME indicates this in bits [19:16]
54 (Operation Mode) in the HFS register of the HECI/MEI PCI device by setting
55 them to 5 (SECOVER_MEI_MSG) [MODE_CTRL].
56
57== MEI/HECI ==
58 Communication between the host software and the different services provided by
59 the ME is done via a packet-based protocol that uses MMIO transfers to one or
60 more virtual PCI devices. Upon this layer there exist various services that can
61 be used to read out hardware management values (e.g. temperatures, fan speeds
62 etc.). The lower levels of that protocol are well documented:
63 The locations/offsets of the PCI MMIO registers are noted in the chipset
64 datasheets. The actually communication is documented in a whitepaper [DCMI] and
65 an outdated as well as a current Linux kernel implementation (currently in
66 staging/ exist [KERNEL]. There exists a patch that re-implements this in user
67 space (as part of flashrom).
68
69== Problems ==
70 The problem is that only very few higher level protocols are documented publicly,
71 especially the bunch of messages that contain the HMRFPO commands is probably
72 well protected and only documented in ME-specific docs and the BIOS writer's
73 guides. We are aware of a few leaked documents though that give us a few hints
74 about it, but nothing substantial regarding its implementation.
75
76 The documents are somewhat contradicting each other in various points which
77 might be due to factual changes in process of time or due to the different
78 capabilities of the ME firmwares, example:
79
80 Intel's Flash Programming Tool (FPT) "automatically stops ME writing to SPI
81 ME Region, to prevent both writing at the same time, causing data corruption." [ME8]
82
83 "FPT is not HMRFPO-capable, so needs [the help of the FDOPS pin] HDA_SDO if
84 used to update the ME Region." [SPS]
85
86 When looking at the various ME firmware editions (and different chipsets), things
87 get very unclear. Some docs say that HMRFPO needs to be sent before End-of-POST
88 (EOP), others say that the ME region can be updated in the field or that some
89 vendor tools use it for updates. This needs to be investigated further before
90 drawing any conclusion.
91
Stefan Taunerd94d25d2012-07-28 03:17:15 +000092[PANTHER] Intel 7 Series Chipset Family Platform Controller Hub (PCH) Datasheet
93 Document Number: 326776, April 2012, page 857
94[NC9B] Jetway NC9B flashrom v0.9.5.2-r1517 log with ME region unlocked.
95 NB: "FRAP 0e0f" vs. "FLMSTR1 0a0b".
96 http://paste.flashrom.org/view.php?id=1215
Stefan Tauner2abab942012-04-27 20:41:23 +000097[MODE_CTRL] Client Platform Enabling Tour: Platform Software
98 Document Number: 439167, Revision 1.2, page 52
99[MEBX] Intel Management Engine BIOS Extension (MEBX) User's Guide
100 Revision 1.2, Section 3.1 and 3.5
101[DCMI] DCMI Host Interface Specification
102 Revision 1.0
103[KERNEL] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=drivers/staging/mei;hb=HEAD
104[SPI_PROG] Ibex Peak SPI Programming Guide
105 Document Number: 403598, Revision 1.3, page 79
106[ME8] Manufacturing with Intel Management Engine (ME) Firmware 8.X on Intel 7 Series
107 Revision 2.0, page 59
108[SPS] Manufacturing with Intel Management Engine (ME) on Intel C600 Series Chipset 1
109 for Romley Server 2 Platforms using Server Platform Services (SPS) Firmware
110 Revision 2.2, page 51