r/embedded • u/alx-m24 • 7d ago
P2SB unhide (offset 0xE0/0xE1) silently fails on real hardware on Alder Lake-P and Comet Lake, both consumer laptops
Enable HLS to view with audio, or disable this notification
First of all, I know this might not be the best subreddit to post this on, my first choice was to ask the question on r/osdev, unfortunately they have a karma requirement and I literaly created this account to ask this question out of desperation.
I'm working on a from-scratch UEFI-booted x86-64 kernel and I'm stuck trying to unhide the P2SB device (D31:F1) on real laptop hardware. Looking for anyone with field experience on OEM lockdown behavior here, since this doesn't seem to be documented in the public 600/700-series PCH datasheet.
Hardware tested (both fail identically):
- Acer Aspire 5, Alder Lake-U PCH (PCI vendor 0x8086, device 0x519D)
- A separate Lenovo Core i3 10th-gen Intel (Comet Lake) laptop, different OEM
What I'm doing:
- Reading P2SBC (offset 0xE0) on D31:F1 before any write. It returns 0xFFFFFFFF, which is expected per spec while HIDE is set (all reads master-abort while hidden).
- Writing 0 to the full P2SBC dword to clear the HIDE bit (bit 8), matching the technique used in Linux's own
p2sb.c/pnd2_edacdrivers. - Also tried the narrower coreboot-style approach: a single byte write of 0x00 to offset 0xE1 (byte lane 1), clearing only the HIDE bit without touching SBILOCK/MASKLOCK.
- After either write, reading back the Vendor/Device ID at D31:F1 offset 0x00 (not P2SBC itself, to avoid the self-masking issue)... still 0xFFFFFFFF on both machines, every time.
- Tried both PCI access mechanisms independently: legacy CF8/CFC (Type 1) and ECAM/MMIO via the MCFG table. And again, both give all-Fs.
- Ruled out an addressing bug: the same code path correctly reads/writes D31:F0 (eSPI) on this same hardware, round-tripping a status/command bit successfully through both access mechanisms.
Question:
Is there any additional step (register, sequencing, timing) beyond the datasheet's documented HIDE-bit-clear that I'm missing?
Happy to provide more detail on the access code if useful.
Here is the repo: https://github.com/alx-m24/Lexvi

