Page 1
Broadwell Platform Controller Hub- Low Power (PCH-LP) SPI Programming Guide June 2014 Revision 1.0 Intel Confidential Document Number:...
Page 2
Service Provider. Consult your system manufacturer and Service Provider for availability and functionality. Service may not be available in all countries. Intel assumes no liability for lost or stolen data and/or systems or any other damages resulting thereof. For more information, visit http://www.intel.com/go/anti-theft.
This tool programs the SPI flash device on the Broadwell PCH-LP platforms. This section will talk about requirements needed for FPT to work. Chapter 9, “SPI Flash Programming Procedures” Guide on how to program the SPI flash on the Intel CRB and PCH based platforms. ® Chapter 10, “Intel ME Disable for Debug/Flash Burning Purposes”...
Intel firmware that adds Intel Active Management Technology, Braidwood ® Firmware (Intel ME FW) Technology, Intel Anti-Theft Technology, Corwin Springs, Castle Peak, Sentry Peak, etc. Intel PCH Intel Platform Controller Hub Intel PCHn family All PCHn derivatives including PCHn (desktop) and PCHnM (mobile) Low Pin Count Bus- bus on where legacy devices such a FWH reside PCH–LP...
TPM on SPI Bus Broadwell PCH-LP Family supports Intel TPM on the SPI bus. Intel TPM attached to the system may be using LPC or SPI. SPI Intel TPM is accessed much like direct reads and direct writes. Boot Destination Option 2.5.1...
PDR – Platform Data Region The descriptor (Region 0) must be located in the first sector of component 0 (offset 0x10). Descriptor and Intel ME regions are required for all Broadwell PCH-LP Family based platforms. If Regions 0, 2, 3 or 4 are defined they must be on SPI. BIOS can be on either FWH or SPI.
Hardware sequencing has a predefined list of opcodes with only the erase opcode being ® programmable. This mode is only available if the descriptor is present and valid. Intel ME Firmware and Integrated LAN FW, and integrated LAN drivers all must use HW sequencing, so BIOS must properly set up the PCH to account for this.
® microarchitecture code name Broadwell Intel PCH-LP SPI Flash Requirements • Broadwell PCH-LP Family allows for up to two SPI flash devices to store BIOS, ® Intel ME FW and security keys for Platform Data Region and integrated LAN information.
3.1.3 Intel Management Engine Firmware (Intel ME FW) SPI Flash Requirements Intel Management Firmware must meet the SPI flash based BIOS Requirements plus: 3.1.4 SFDP 3.1.5 JEDEC ID (Opcode 9Fh) 3.1.6 Multiple Page Write Usage Model 3.1.7 Hardware Sequencing Requirements Flash part must be uniform 4 KB erasable block throughout the entire part.
The Intel firmware usage models require the capability for multiple data updates within any given page. These data updates occur via byte-writes without executing a preceding erase to the given page. Both the BIOS and Intel Management Engine firmware multiple page write usage models apply to sequential and non- sequential data writes.
Discoverable opcodes are obtained from each Read Discoverable component’s SFDP table Dual I/O Fast Read Discoverable Opcode is optained from each component’s SFDP table Quad I/O Fast Read Discoverable Opcode is optained from each component’s SFDP table 523462 Intel Confidential...
SPI_CLK High time 26.37 t189a SPI_CLK Low time 26.82 Notes: 1.Typical clock frequency driven by Broadwell PCH-LP Family is 17.86 MHz. 2.Measurement point for low time and high time is taken at .5(VccME3_3). Table 3-2. SPI Timings (33 MHz) Parameter Units...
Page 20
2, 3 Notes: 1.Typical clock frequency driven by Broadwell PCH-LP Family is 50 MHz. 2.When using 50 MHz mode ensure target flash component can meet t188c and t189c specifications. Recommended to use SPI flash component rated at 66 MHz or faster.
Output Fall Slew Rate (0.6 Vcc - 0.2 Vcc) V/ns Note: 1.Testing condition: 1K pull up to Vcc, 1kohm pull down and 10 pF pull down and 1/2 inch trace. See Figure 3.3 for more detail. Figure 3-2. PCH Test Load § § 523462 Intel Confidential...
The Flash Descriptor is a data structure that is programmed on the SPI flash part on Broadwell PCH-LP based platforms. The Descriptor data structure describes the layout of the flash as well as defining configuration parameters for the PCH. The descriptor is on the SPI flash itself and is not in memory mapped space like PCH programming registers.
• PCH chipset soft strap sections contain PCH configurable parameters. • The Reserved region is for future chipset usage. ® • The Descriptor Upper Map determines the length and base address of the Intel VSCC Table. ® • The Intel ME VSCC Table holds the JEDEC ID and the ME VSCC information for all the SPI Flash part(s) supported by the NVM image.
Set this field to 10b Flash Master Base Address (FMBA). This identifies address bits [11:4] for the Master portion of the Flash Descriptor. Bits [24:12] and bits [3:0] are 0. Set this field to 06h. This will define FMBA as 60h 523462 Intel Confidential...
Notes: 1.If more than one Flash component exists, this field must be set to the lowest common frequency of the different Flash components. 2.If setting to 50 MHz, ensure flash meets timing requirements defined in Table 3-3 523462 Intel Confidential...
Page 27
2.It is strongly recommended to set this bit to 1b Read Clock Frequency. 000 = 20 MHz All other Settings = Reserved 19:17 Note: 1.If more than one Flash component exists, this field must be set to the lowest common frequency of the different Flash components. 523462 Intel Confidential...
3.Region limit address Bits[11:0] are assumed to be FFFh Reserved Region Base. This specifies address bits 26:12 for the Region Base. 14:0 Note: If the BIOS region is not used, the Region Base must be programmed to 7FFFh 523462 Intel Confidential...
Region Limit. This specifies bits 26:12 of the ending address for this Region. Notes: 30:16 ® 1.Ensure size is a correct reflection of actual Intel ME firmware size that will be used in the platform 2.Region limit address Bits[11:0] are assumed to be FFFh...
Requester ID: This is the Requester ID (Bus/Device/Function Number_ of the Host CPU 15:0 For the host CPU, this should be set to Bus/Device/Function: 0/0/0 4.1.4.2 FLMSTR2—Flash Master 2 (Intel ® (Flash Descriptor Records) Memory Address: FMBA + 004h Size:32 bits...
® 4.1.7 Intel ME Vendor Specific Component Capabilities Table Entries in this table allow support for a SPI flash part for Intel Management Engine ® capabilities including Intel Active Management Technology. Since Flash Partition Boundary Address (FPBA) has been removed, UVSCC and LVSCC has been replaced with VSCC0 and VSCC1 in Broadwell PCH-LP.
4.If bit 3 (WSR) is set to 1b and bit 4 (WEWS) is set to 0b then sequence of 50h 01h 00h is sent to unlock the SPI flash on EVERY write and erase that Intel Management Engine firmware performs.
Page 34
Descriptor Overview ® Note: “n” is an integer denoting the index of the Intel ME VSCC table. Bits Description 31:24 Reserved SPI Component Device ID 1. This field identifies the second byte of the Device ID of the SPI 23:16 Flash Component.
5.If bit 3 (WSR) is set to 0b and bit 4 (WEWS) is set to 0b or 1b then sequence of 60h is sent to unlock the SPI flash on EVERY write and erase that Processor or Intel GbE FW performs.
Regions of the flash can be defined from read or write access by setting a protection parameter in the Master section of the Descriptor. There are only three masters that ® have the ability to access other regions: CPU/BIOS, Intel ME Firmware, and GbE software/driver running on CPU.
1.‡ = Value dependent on if PDR is implemented and if Host access is desired. 4.3.2 Overriding Region Access Once access Intel recommended Flash settings have been put into the flash descriptor, it may be necessary to update the ME region with a Host program or write a new Flash descriptor.
This is the first byte returned by the Read JEDEC-ID command (opcode 9Fh). ® If using Flash Image Tool (FIT) refer to System Tools user guide in the Intel ME FW kit and the respective FW Bring up Guide on how to build the image. If not, refer to 4.1.6.1...
4.If bit 3 (WSR) is set to 1b and bit 4 (WEWS) is set to 0b then sequence of 50h 01h 00h is sent to unlock the SPI flash on EVERY write and erase that Intel Management Engine firmware performs.
Page 40
Descriptor Overview Erase Opcode (EO) and Block/Sector Erase Size (BSES) should be set based on ® the flash part and the firmware on the platform. For Intel ME enabled platforms this should be 4 KB. Write Status Required (WSR) or Write Enable on Write Status (WEWS) should be set on flash devices that require an opcode to enable a write to the status register.
Figure 5-1. SFDP Read Instruction Sequence Dis cov ery 24 Bit W ait Sta te s O pco de Addre ss Da ta By te D ata Byte Addr + 1h Hi gh Z 523462 Intel Confidential...
BIOS region only. It should not affect the ME or GbE regions. All the SPI flash devices that meet the SPI flash requirements in the Broadwell PCH-LP Family External Design Specification (EDS) will be unlocked by writing a 00h to the SPI flash’s status register.
“90h” opcode. Intel utilities such as the Flash Programming Tool will incorrectly detect the flash part in the system and it may lead to undesired program operation.
Flash Partition Boundary Address (FBPBA) has been removed and UVSCC and LVSCC has been replaced with VSCC0 and VSCC1 in Broadwell PCH-LP. VSCC0 is for SPI component 0 and VSCC1 is for SPI component 1. SPI controller will determine which...
Refer to VSCC— Lower Vendor Specific Component Capabilities Register and in the Broadwell PCH-LP Family External Design Specification (EDS). See text below the tables for explanation on how to determine VSCC register values. Table 6-3. VSCC0 - Vendor-Specific Component Capabilities Register for SPI Component...
Page 47
Hardware takes no action based on the value of this register. The contents of this register are to be used only by software and can be read in the HSFSTS.BERASE register in both the BIOS and the GbE program registers if FLA is less than FPBA. 523462 Intel Confidential...
Page 48
‘1’ = 06h will be the opcode used to unlock the status register if WSR (bit 3) is set to 1b. This register is locked by the Vendor Component Lock (VCL) bit. Table 6-5 Please refer to for a description of how these bits is used. 523462 Intel Confidential...
If write enable (06h) will unlock the status register. Opcodes sequence sent to SPI flash will bit 06h 01h 00h. Sequence of 60h is sent to unlock the SPI flash on EVERY write and erase that 0 or 1b Processor or Intel GbE FW performs. 523462 Intel Confidential...
When VCL and FLOCKDN are set, it is possible that you may not be able to use in system programming methodologies including Intel Flash Programming Tool if programmed improperly. It will require a system reset to unlock this register and BIOS not to set this bits.
The purpose of the Flash Image Tool is to simplify the creation and configuration of the Flash image for the Broadwell PCH-LP family platforms. The Flash Image Tool makes a flash image by creating a descriptor and combining the following image files: •...
Intel ME Clock control, Intel AMT, etc. • GbE: Optional region that contains code and configuration data for Intel integrated Gigabit Ethernet and 10/100 Ethernet. • Platform Data Region: Optional region that contains data reserved for BIOS/Host usage.
Some SPI flash devices support both standard and fast read opcodes. Fast reads are able to operate at faster frequencies than the regular reads. For PCH to support these faster read commands, fast read support must be set to true. For Broadwell PCH-LP, ®...
The Upper and Lower Flash Erase sizes and Flash Partition Boundary address is not editable from this view. In order to modify these entries you must enter the Build Settings dialog box. Note that asymmetric flash parts are no longer supported. 523462 Intel Confidential...
The setting shown above is the minimum set of the read/write parameters for GbE LAN master access recommended for production phase. It will lock down descriptor region ® with a necessary level of security for Intel ME enabled systems. There are recommended settings (intended for debug/manufacturing or production phase) provided by FITC for different Master Access.
A and the respective FW Bringup Guide. Management Engine VSCC Table This section is used to store information to setup flash access for Intel ME. This does not have any effect on the usage of the Flash programming Tool (FPT) if the information in this section is incorrect, the Intel ME Firmware may not communicate ®...
Vendor ID, Device ID 0 and Device ID 1 (three components of JEDEC ® ® ID) See 4 .4 Intel ME Vendor-Specific Component Capabilities (Intel ME VSCC) Table for more detailed information on how to set the VSCC register value. Figure 7-10. VSCC Table Entry 7.4.2...
This tool can program an individual region, or the entire flash device. • Descriptor • BIOS • Gigabit Ethernet ® • Intel • Platform Data Region BIOS Support FPT requires proper opcodes programmed if the FLOCKDN bit is set. Please refer to Software Sequencing Opcode Recommendations 6.3 SPI Protected Range Register...
This defines the size of flash space for the flash programming tool. This value is the size of the flash in bits in hexadecimal (0x) notation. For example 8 Mb part = (8*1024*1024) = (8,388,608) convert to hex 0x800000. 523462 Intel Confidential...
This field dictates how many bytes will be written for each write command. Broadwell PCH-LP only supports 1 or 64 B writes. Flash devices that allow writes more than a single byte at a time usually support up to 256 bytes at a time. Look to see how many bytes the 02h opcode can support.
SPI Flash Programming Procedures SPI Flash Programming Procedures This chapter assumes the use of Intel flash tools: Flash Programming Tool and Flash Image Tool (FPT and FITC). Updating BIOS If the target system does not have a have a working BIOS and no alternate method of booting (for example: FWH) then you must use a 3 party out of system programmer.
3. Use -disableME command line option through FPT tool. ® HECI ME region unlock - There is a HECI command that allows Intel ME FW to boot up in a temporarily disabled state and allows for a host program to overwrite the ME region.
Page 66
® Intel ME Disable for Debug/Flash Burning Purposes 523462 Intel Confidential...
Please note that not all of these options will be optimal for your manufacturing process. Any method of programming SPI flash where the system is not powered will ® not result in any interference from Intel ME FW. The following methods are ® for Intel ME FW: •...
Page 68
Recommendations for SPI Flash Programming in Manufacturing Environments 523462 Intel Confidential...
Q: How do I find the Flash Programming Tool (FPT) and Flash Image Tool (FITC) for my platform? A: The aforementioned flash tools are included in the system tools director in Intel® ME FW kit. Please ensure that you download the appropriate kit for the target platform.
Page 70
PCH-LP Family External Design Specification (EDS), support may be added for the device. BIOS will have to set up the Host VSCC registers. The Intel Management Engine ® VSCC table in the descriptor will also have to be set up in order to get Intel ® ®...
Hardware Sequencing Flash Status Register in the Broadwell PCH-LP Family External Design Specification (EDS) for the location for the HSFS. Try reflashing the SPI device with a Party programmer. If you still see this error message, please contact your BIOS vendor to ensure that they are not setting this bit.
Page 72
7 .2 Modifying the Flash 4 5 6 H Descriptor Region for more information. This error can also result if BIOS has not correctly set up software sequencing. See Software Sequencing Opcode Recommendations for Opcodes required for FPT operation. § § 523462 Intel Confidential...
The following section describes functionality and how to set soft strapping for a target platform. Improper setting of soft straps can lead to undesired operation and may lead to returns/recalls. Only default values that will be provided are for softstraps that are reserved. 523462 Intel Confidential...
Notes: client and switch network interface devices. If not using Intel integrated wired LAN or if disabling it, then set to '1' If using Intel integrated wired LAN solution AND the If not using Intel’s integrated wired solution, then this...
Page 75
BIOS developer and the platform hardware designer. SMLink0 Enable (SML0_EN): Configures if SMLink0 This bit MUST be set to ’1’ when Intel NFC enabled on segment is enabled the platform. 0 = Disabled...
Quad I/O Read Enable (QIORE): This soft strap only has effect if Quad Output Read is discovered as supported via the SFDP ‘0’: Quad I/O Read is disabled ‘1’: Quad I/O Read is enabled (Default) Chipset configuration, set to ‘1111b’ 523462 Intel Confidential...
31:25 Intel ME SMBus I C* Address (MESMI2CA): This address is only used by Intel ME FW for testing purposes. If MESMI2CEN (PCHSTRP2 bit 24) is set Defines 7 bit Intel ME SMBus I C target address to 1 then the address used in this field must be non-...
SMBus communication between the Intel integrated MAC and PHY. Reserved, set to ’0’ 15:9 This is the Intel integrated wired MAC’s SMBus address. GbE MAC SMBus Address: This field must be programmed to 70h. This is the 7 bit SMBus address uses to accept SMBus cycles from the PHY.
Page 79
APPENDIX A - Descriptor Configuration Bits Description Usage Gbe MAC SMBus Address Enable This bit must be set to ’1’ if Intel integrated wired LAN (GBEMAC_SMBUS_ADDR_EN): solution is used. 0 = Disable 1 = Enable If not using, or if disabling Intel integrated wired LAN solution, then this field must be set to ’0’.
4 byte payload to an external MESMAUDID[31:16] - Subsystem Device ID master when a GET UDID Block read command is made to Intel ME SMBus ASD’s address. The values contained in MESMAUDID[15:0] and MESMAUDID[31:16] are provided as bytes 8-9 and 10-11 of...
1b. 13:12 Reserved, set to ‘0’ Intel PHY Over PCI Express Enable (PHY_PCIE_EN): This bit MUST be set to ’1’ if using Intel integrated wired LAN solution. 0 = Intel integrated wired MAC/PHY communication is not enabled over PCI Express*.
Page 82
The platform 101: Port 5 Lane 3 hardware designer or schematic review can 110-111: Reserved determine what PCIe Port the Intel wired PHY is routed. Chipset configuration. set to’1’b Reserved, set to ’0’ PCIe Lane Reversal 2 (PCIELR2) If configuring PCIe port 5 as a x4 PCIe bus, reversing the lanes of this port is done via this strap.
This bit will only be set to ’1’ in order to work around issues in pre-production hardware and Intel ME FW. Note: This field should only be set to ’1b’ if the Intel ME binary loaded in the platform has a ME ROM Bypass image Reserved, Default set to ’0’...
The setting This bit MUST be set to ’0’ if PCH thermal reporting is of this field must be determined by the BIOS not used. developer and the platform hardware designer. 523462 Intel Confidential...
1x4. Note: This setting is dependent on the board design. The platform hardware designer must Note: This field only is in effect if PCIEPCS3 is set to '11'b. determine if this port needs lane reversal. 523462 Intel Confidential...
Page 86
0 = OPI PLL is the source (default) 1 = PCIe PLL is the source. PCIe NAND x1 or x2 Select (PNX1X2S): 0 = NAND Cycle Router configured for PCIe NAND x1 1 = NAND Cycle Router configured for PCIe NAND x2 523462 Intel Confidential...
1 = Enable Intel integrated wired LAN Solution This must be set to ’0’ if not using Intel’s integrated Notes: This must be set to '1' if the platform is using Intel's wired LAN solution or if disabling it. integrated wired LAN solution. Set to ’0’ if not using Intel integrated wired LAN solution or if disabling it.
Need help?
Do you have a question about the PCH-LP and is the answer not in the manual?
Questions and answers