Thank you for the response. In the code, I see the registers set to the appropriate PCIe memory mapped address of 0xe0078000, which corresponds to PCIe bus 0, device 15, function 0 as expected. Then it uses offset 0x60 for the HOST2CSE and 0x70 for the CSETOHOST register. Do you know where the detailed specification for offset 0x60 and offset 0x70 are in the documentation? From: Rangarajan, Ravi P <ravi.p.rangarajan(a)intel.com&gt; Sent: Tuesday, May 28, 2019 11:16 AM To: Kruno Peric <K.Peric(a)astronautics.com&gt;; sbl-devel(a)lists.01.org Subject: RE: ring buffer protocol Hi On APL, we use the ring buffer protocol communication with the CSME to fetch the IBB from the flash. The protocol was documented in the BIOS Spec and the Apollolake FAS. Basically it uses two registers HOST2CSE and CSE2HOST. At a high level, the RBP involves specifying the IbbSize in the register. The IBB size field in that register starts from bits 4. That is the reason for shift left 4. BIT30 is the microcode load status and BIT31 is the trigger for RBP. After that, the CSE fetches the IBB one chunk at a time and is copied to cache by the IBBL. Thanks Ravi From: Sbl-devel [mailto:sbl-devel-bounces@lists.01.org] On Behalf Of Kruno Peric Sent: Friday, May 24, 2019 3:00 PM To: sbl-devel@lists.01.org<mailto:sbl-devel@lists.01.org> Subject: [Sbl-devel] ring buffer protocol Can anyone direct me to specific Intel documentation on the ring-buffer protocol used in SBL function LoadStage1B (Platform/ApollolakeBoardPkg/Library/LoaderLib.c). I can see a high level overview in section 9.1 of volume II of the BIOS spec, but I can't find details about where the registers are and what they do. For instance, where can I go to find out why the size of data is OR'd with 0xc0000000 and left shited by 4 on line 96 from the source: 95 /* Request data from CSE */ 96 HostToCse = (IbbSize << 4) | 0xC0000000; 97 ChunkIndex = 0; 98 CSE_HOST2CSE = HostToCse;