N82802

82802AB INTEL | Alldatasheet

Document overview

• Manufacturer or author: Provided By ALLDATASHEET.COM(FREE DATASHEET DOWNLOAD SITE)
• PDF pages: 53

Technical content

Datasheet sections

Intel® 82802AB/82802AC Firmware Hub (FWH) Datasheet November 2000 Document Number: 290658-004 R

Intel® 82802AB/AC Firmware Hub R

2 Datasheet

Information in this document is provided in connection with Intel products. No license, express or implied, by estoppel or otherwise, to any intellectual property rights is granted by this document. Except as provided in Intel’s Terms and Conditions of Sale for such products, Intel assumes no liability whatsoever, and Intel disclaims any express or implied warranty, relating to sale and/or use of Intel products including liability or warranties relating to fitness for a particular purpose, merchantability, or infringement of any patent, copyright or other intellectual property right. Intel products are not intended for use in medical, life saving, or life sustaining applications. Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked "reserved" or "undefined." Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The Intel ® 82802AB/AC Firmware Hub (FWH) may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. I2C is a 2-wire communications bus/protocol developed by Philips. SMBus is a subset of the I2C bus/protocol and was developed by Intel. Implementations of the I2C bus/protocol may require licenses from various entities, including Philips Electronics N.V. and North American Philips Corporation. Alert on LAN is a result of the Intel-IBM Advanced Manageability Alliance and a trademark of IBM Copies of documents which have an ordering number and are referenced in this document, or other Intel literature, may be obtained from: Intel Corporation www.intel.com or call 1-800-548-4725 *Third-party brands and names are the property of their respective owners. Copyright © Intel Corporation 1999-2001

Intel® 82802AB/AC Firmware Hub R

4 Datasheet

Intel® 82802AB/AC Firmware Hub R

6 Datasheet

Revision History

Rev. Draft/Changes Date -001 • Initial Release April 1999 -002 • Added Chapter 6

• Updated programmer vendor/service provider information. May 1999 -003 • Changed VIH min. spec to reflect actual value.
• Updated programmer vendor/service provider information.
• Clarification of part numbering.
• Spec now includes all known issues from all densities/lithographies.
• Included FWH memory cycle and RNG information. May 2000 -004 • Removed All references to multi-byte read cycles
• Added DC Characteristics for A/A Mux mode November 2000

Intel ® 82802AB/AC Firmware Hub R Datasheet 7 Intel® 82802AB/AC Firmware Hub (FWH) Product Features /Ga7/G20Intel platform compatability  Enables security-enhanced platform infrastructure; facilitates option to remove ISA. /Ga7/G20Firmware hub hardware interface mode  5-Signal communication interface supporting byte-at-a-time reads and writes  Register-based read and write protection for each code/data storage block  Hardware write protect pins for the top boot block and the remaining code/data storage blocks  5 Additional GPIs for platform design flexibility  Contains a hardware Random Number Generator (RNG) for enhancing platform security  Integrated Command User Interface (CUI) for requesting access to locking, programming, and erasing options. The CUI also handles requests for data residing in status, ID, and block-lock registers.  Operates with 33-MHz PCI clock and 3.3 V I/O. /Ga7/G20Industry-standard packages (40L TSOP or 32L PLCC) /Ga7/G20Two configurable interfaces  Firmware hub interface for platform operation  Address/Address-Multiplexed (A/A Mux) interface for programming during manufacturing /Ga7/G204 or 8 Mbits of flash memory for platform code/data nonvolatile storage  Symmetrically blocked, 64-KB memory sections  Available in 8-Mbit (Intel® 82802AC) and 4- Mbit (Intel® 82802AB) densities  Automated byte program and block erase via an integrated Write State Machine (WSM) /Ga7/G20Address/Address-Multiplexed (A/A Mux) interface/mode  11-Pin multiplexed address and 8-pin data I/O interface  Supports fast on-board or out-of-system programming for manufacturing /Ga7/G20Case temprature operating range /Ga7/G20Power supply specifications  Vcc: 3.3 V ± 0.3 V  Vpp: 3.3 V and 12 V for fast programming, (80 hours maximum) The Intel® 82802 (FWH) firmware hub may contain design defects or errors known as errata that may cause the products to deviate from published specifications. Current characterized errata are available upon request.

8 Datasheet

Figure 1. Simplified Block Diagram

Intel ® 82802AB/AC Firmware Hub R Datasheet 9 1. Architectural Overview The Intel® 82802 Firmware Hub (FWH) discrete component is compatible with several Intel chipset platforms and a variety of applications. The device operates under the LPC/FWH interface/protocol. The hardware features of this device include a Random Number Generator (RNG), five General-Purpose Inputs (GPIs), register-based block locking, and hardware-based locking. This combination of logic features and non-volatile memory enables better protection for the storage and update of platform code and data, adds platform flexibility through additional GPIs, and allows for quicker introduction of new security/manageability features into current and future platforms. The platform RNG, accessed through the Intel ® Security Driver and third-party software, enables security features for the PC platform. See the product features listed previously for a list of more key features that the Intel FWH provides. 1.1. Interface Overview This device is equipped with two hardware interfaces. The state of the device’s “IC” (InterfaceConfiguration) pin determines which interface is in use. The interface mode must be selected prior topower-up or before return from reset (RST# or INIT# low-to-high transition). The Intel FWH interface isdesigned to work with the Intel family of I/O Controller Hubs (ICH) during platform operation. The A/A Mux interface is designed as a programming interface for OEMs, for use during motherboard manufacturing or component pre-programming. The A/A Mux interface is not intended for use during regular personal computer operation. Such a configuration would cause the expected (Intel FWH) interface to be disabled, and the system boot sequence would fail upon power-up. An internal Command User Interface (CUI) serves as the internal control center for the nonvolatilememory core in either of the two device interfaces (Intel FWH or A/A Mux). A single valid commandsequence written to the CUI initiates an automated sequence of internal events to complete various tasks. An internal Write State Machine (WSM) automatically executes the algorithms and timings necessary for block erase and program operations. Driving RST# or INIT# low resets the device, which resets the block-lock registers to their default (write-locked) condition and clears the status register. A reset time (tPHQV A/A Mux) is required from RST# or INIT# switching high until outputs are valid. Likewise, the device has a wake time (tPHRH A/A Mux) from RST# or INIT# high until writes to the CUI are recognized. A reset latency will occur if a reset procedure is performed during a programming or erase operation. Resetting the component will put the component back into read-array mode. Note: There is no chip enable (like CE#) in either interface. Stand-by current control in the Inel FWH interface is enabled automatically, if the Intel FWH4 is high and the device is not working to complete a requested activity.

Intel® 82802AB/AC Firmware Hub R

10 Datasheet

1.1.1. Intel Firmware Hub Interface The Intel Firmware Hub (Intel FWH) interface consists primarily of a 5-signal communication interface used to control the operation of the device in a system environment. The buffers for this interface were designed to be PCI compliant. To ensure the effective delivery of security and manageability features, the Intel FWH interface is the only way access the full feature set of the device. The Intel FWH interface is equipped to operate at 33 MHz, synchronous with the PCI bus. 1.1.2. Address/Address-Multiplexed Interface The A/A Mux refers to the multiplexed row and column addresses in this interface. This approach is required so that the device can be tested and programmed quickly with automated test equipment (ATE) or off-board PROM programmers in the OEM’s manufacturing flow. This interface also allows the device to have an efficient programming interface with potentially large future densities, while still fitting into a 32-pin package. Only basic reads, programming, and erasure of the nonvolatile memory blocks can be performed through the A/A Mux interface. In this mode, the Intel FWH features, security features, and registers are unavailable. A row/column (R/C#) pin determines which set of addresses (rows or columns) is latched. See the A/A Mux pin description table for more information. 1.2. Nonvolatile Flash Memory Core The primary feature of the Intel FWH component is a nonvolatile memory core based on Intel® Flash Technology. This high-performance memory array is arranged in eight (4-Mbit device) or sixteen (8- Mbit device) 64-KB blocks. Intel ® Flash Technology enables fast factory programming and low-power designs. Specifically designed for 3-V systems, this component supports read operations at 3.3 V VCC and block erase and program operations at 3.3 V and 12 V VPP. The 12 V VPP option yields the fastest program performance, which will increase factory throughput, but is not recommended for standard in-system FWH operation in the platform, due to an 80-hr limit for 12 V on the VPP pin over the lifetime of the device, whether or not programming is taking place. With the 3.3-V VPP option (recommended for in-system operation), VCC and VPP may be tied together for a simple, low-power 3-V design. In addition to the voltage flexibility, the dedicated VPP pin provides complete data protection when VPP ≤≤≤≤ VPPLK. Internal VPP detection circuitry automatically configures the device for block erase and program operations. While current for 12-V programming will be drawn from V PP, 3.3-V programming solutions should design their board such that VPP draws from the same supply as VCC, and should assume that full programming current may be drawn from either pin.

Figure 2. Device Memory Map with Intel FWH Hardware Lock Architecture Figure 3. Intel FWH Boot-Configuration System Memory Map

4 Mbit

8 Mbit

Intel® 82802AB/AC Firmware Hub R

12 Datasheet

This page is intentionally left blank.

14 Datasheet

VCC + 0.3 V max. unless otherwise noted. Table 1. Pin Descriptions return from reset, and must not be changed during device operation. which will select the Intel FWH mode. reset, the device defaults to read array mode. the processor. Do not use 3.3 V). that for the PCI clock and adheres to the PCI specification.

Intel ® 82802AB/AC Firmware Hub R Datasheet 15 Interface Symbol Type Intel FWH A/A Mux Name and Function ID[3:0] I X Identification Inputs. These four pins are part of the mechanism that allows multiple parts to be attached to the same bus. The strapping of these pins is used to identify the component. The boot device must have ID[3:0] = 0000, and it is recommended that all subsequent devices use sequential up-count strapping ( 0001, 0010,0011,...). These pins are pulled down with internal resistors, with values between 20 and 100 kΩ, when in the Intel FWH mode. Any ID pins pulled high will exhibit a leakage current of approximately 200 µA. Any pins intended to be low may be left to float. In a single Intel FWH system, all may be left floating. A/A Mux = A[3:0] FGPI[4:0] I X Intel FWH General Purpose Inputs. These individual inputs can be used for additional board flexibility. The state of these pins can be read immediately at boot, through Intel FWH registers. These inputs should be at their desired state before the start of the PCI clock cycle during which the read is attempted, and they should remain at the same level until the end of the read cycle. They may only be used for 3.3-V signals. Unused FGPI pins must not be floated. A/A Mux = A[10:6] TBL# I X Top Block Lock. When low, it prevents programming or block erase to the highest addressable block (7 in a 4-Mbit, 15 in an 8-Mbit component), regardless of the state of the lock register. TBL#-high disables hardware write protection for the top block, though register- based protection still applies. The status of TBL# does not affect the status of block-locking registers. A/A Mux = A4 WP# I X Write Protect. When low, prevents programming or block erase to all but the highest addressable block (0-6 in a 4-Mbit, 0-14 in an 8- Mbit component), regardless of the state of the corresponding lock registers. WP#-high disables hardware write protection for these blocks, though register-based protection still applies. The status of TBL# does not affect the status of block-locking registers. A/A Mux = A5 A[0:10] I X Low-Order Address Inputs. Inputs for low-order addresses during read and write operations. Addresses are internally latched during a write cycle. For the A/A Mux interface, these addresses are latched by R/C# and share the same pins as the high-order address inputs. DQ[0:7] I/O X Data Input/Outputs. These pins receive data and commands during CUI write cycles and transmit data during memory array, status register, and identifier code read cycles. Data pins float to high impedance when outputs are disabled. Data is internally latched during a write cycle. OE# I X Output Enable. Gates the device’s outputs during a read cycle R/C# I X Row-Column Address Select. For the A/A Mux interface, this pin determines whether the address pins are pointing to the row addresses (A[0:10]) or the column addresses (A[11:19]). WE# I X Write Enable. Controls writes to the CUI and array blocks. Addresses and data are latched on the rising edge of the WE# pulse.

Intel® 82802AB/AC Firmware Hub R

16 Datasheet

Block Erase/Program Power Supply. For erasing array blocks or programming data. VPP = 3.3 V or 12 V VPP. With VPP ≤ VPPLK, memory contents cannot be altered. Attempting a block erase or program with an invalid V PP (see DC Characteristics) will produce spurious results and should not be attempted. VPP may only be held at 12 V for 80 hours over the lifetime of the device. VCC PWR X X Device Power Supply. Internal detection automatically configures the device for optimized read performance. Do not float any power pins. With V CC ≤ VLKO, all attempts to write to flash memory are inhibited. Device operations at invalid VCC voltages (see DC Characteristics) produce spurious results and should not be attempted. GND PWR X X Ground. Do not float any ground pins. VCCa PWR X X Analog Power Supply. This supply should share the same system supply as VCC. GNDa PWR X X Analog Ground. Should be tied to same plane as GND. RFU X Reserved For Future Use. These pins are reserved for future generations of this product. They may be left disconnected or driven. If they are driven, the voltage levels should satisfy V IH and VIL requirements. A/A Mux = DQ[7:4] NC X X No Connect. Pin may be driven or floated. If it is driven, the voltage levels should satisfy VIH and VIL. No connects appear only on the 40ld TSOP package. Ry/By# 0 X Ready/Busy. Valid only in A/A Mux Mode. This output pin is a reflection of bit 7 in the Status Register. This pin is used to determine block erase or program completion.

Intel ® 82802AB/AC Firmware Hub R Datasheet 17 3. Interface Operation Description 3.1. Read Memory information, identifier codes, GPI registers or the status register can be read, regardless of the VPP voltage. Commands using the read mode include: reading memory from the array, reading the identifier codes, reading the status register, reading the lock bit registers, reading the random number generator, reading the GPI registers, and reading the RNG status register. Upon initial device power-up or after exit from reset, the device automatically resets to read array mode. 3.2. Write Writes to the memory array’s CUI are initiating by issuing a write through the Intel FWH interface. (See the following information on timing and Intel FWH cycle write protocol specifics.) The CUI does not occupy a single, specific memory location—any valid address may be given. However, certain commands, such as block erase, require the address be within the range of the desired address block. 3.3. Output Disable When the Intel FWH is not selected through a FWH read or write cycle, the Intel FWH interface outputs (FWH[3:0]) are disabled and is placed in a high-impedance state. 3.4. Reset RST# or INIT# at VIL initiates a device reset. In the read mode, RST# or INIT# low deselects the memory, places output drivers in a high-impedance state, and turns off all internal circuits. RST# or INIT# must be held low for time t PLPH (A/A Mux and FWH operation). The Intel FWH resets to read array mode upon return from reset, and all blocks are set to default (locked) status (see 4.9.1), regardless of their locked state prior to reset. During block erase or program, driving RST# or INIT# low will abort the operation underway, in addition to causing a reset latency. Memory contents being altered are no longer valid, since the data may be partially erased or programmed. It is important to assert RST# or INIT# during system reset. When the system comes out of reset, it will expect to read from the memory array of the device. If a system reset occurs with no FWH reset—this is hardware dependent—it is possible that proper processor initialization will not occur. (The Intel FWH memory may be providing status information instead of memory array data.)

Intel® 82802AB/AC Firmware Hub R

18 Datasheet

3.5. Operational Effects of Hardware Write-Protect Pins TBL# and WP# The TBL# and WP# pins on the Intel FWH provide hardware write protect capabilities. The Top Block Lock (TBL#) pin, when held low (active), prevents program or block erase operations in the top-most block of the device where critical code can be stored. When TBL# is high, hardware write protection of the top block is disabled. The Write Protect (WP#) pin has a function similar to TBL#, but affects all remaining blocks. WP# operates independently from TBL# and does not affect the lock status of the top block. The TBL# and WP# pins must be set to the desired protection state prior to starting a program or erase operation, since they are sampled at the beginning of the operation. Changing the state of TBL# or WP# during a program or erase operation may cause unpredictable results. If the state of TBL# or WP# changes during a program suspend or erase suspend state, the changes to the device’s locking status do not take place immediately. The suspended operation may be resumed to successfully complete the program or erase operation. The new lock status will take place after the program or erase operation completes. These pins function in combination with the register-based block locking described in Section 4.9. When active, these pins write-protect the appropriate block(s), regardless of the associated block-locking registers. (For example, when TBL# is active, writing to the top block is prevented, regardless of the state of the write-lock bit for the top block’s locking register. In such a case, clearing the write-protect bit in the register will have no functional effect, even though the register may indicate that the block is no longer locked. The register may still be set to read-lock the block, if desired.) See Section 4.9 for further information.

block erase and program operations. Table 2. Command Definitions SRD = Data read from status register.

1. Following the Read Identifier Codes command, read operations access manufacturer and device.

See Table 4 for the read identifier code data.

1. The block must not be write locked when attempting block erase or program operations. Attempts

to issue a block erase or program to a write-locked block will fail.

1. Either 40h or 10h are recognized by the WSM as the program setup.

20 Datasheet

Table 3. Status Register Definition 7 Write State Machine Status (SR.7). Check SR.7 to determine block erase or program completion. SR.6–0 are invalid while SR.7 = 0. 6 Erase Suspend Status (SR.6). reports accurate feedback only when VPP ≠ VPPH1/2. 2 Program Suspend Status (SR.2). the selected block is locked. when polling the status register.

Table 4. Identifier Codes

Intel® 82802AB/AC Firmware Hub R

22 Datasheet

4.5. Block Erase Command The erase command operates on one block at a time. This command requires an (arbitrary) address within the block to be erased. Recall that erasure changes all block data to FFh. Block preconditioning, erase, and erase verify are handled internally by the WSM, which is transparent to the system. After issuing the erase command, the device automatically outputs status register data when read. When the block erase completes, the status register may be checked. If the FWH detects a block erase error, the status register should be cleared before system software attempts corrective actions. After a block erase, the CUI remains in read status register mode until a new command is issued. Successful block erasure requires that the corresponding block’s write-lock-bit is cleared, and the corresponding write-protect pin (TBL# or WP#) is inactive. If a block erase is attempted when the block is locked, the block erase will fail, with the reason for failure in the status register. Successful block erase only occurs when V PP = VPPH1 or VPPH2. If the erase operation is attempted at VPP ≠≠≠≠ VPPH1 or VPPH2, erratic results may occur. 4.6. Program Command Program command operates on one byte at a time. This command specifies the address and data to be programmed. After the CUI receives the command, the WSM takes over, controlling the program and verify algorithms internally. After the program command is written, the device automatically outputs the status register data when read. When programming is complete, the status register may be checked. If a program error is detected, the status register should be cleared before corrective action is taken by the software. The internal WSM verification error checking only detects 1s that does not successfully program to 0s. The CUI remains in read status register mode until it receives another command. Reliable programming only occurs when V PP = VPPH1 or VPPH2. If programming is attempted at VPP ≠≠≠≠ VPPH1 or VPPH2, erratic results may occur. Successful program operation also requires that the corresponding block’s write-lock bit be cleared and that the corresponding write-protect pin (TBL# or WP#) be inactive. If program operation is attempted when the block is locked, the operation will fail.

Intel ® 82802AB/AC Firmware Hub R Datasheet 23 4.7. Block Erase Suspend Command The Block Erase Suspend command allows block-erase interruption to read or program data in another block of memory. Once the block erase process starts, writing the Block Erase Suspend command requests that the WSM suspend the block erase sequence at a predetermined point in the algorithm. The device outputs status register data when read after the Block Erase Suspend command is written. Polling the status register can help determine when the block erase operation was suspended. After a successful suspend, a Read Array command may be written to read data from a block other than the suspended block. A Program command sequence may also be issued during erase suspend to program data in blocks other that the block currently in the erase suspend mode. The other valid commands while block erase is suspended include Read Status Register and Block Erase Resume. After a Block Erase Resume command is written, the WSM will continue the block erase process. V PP must remain at VPPH1/2 (the same VPP level initially used for the block erase) while block erase is suspended. RST# or INIT# must also remain at VIH. Block erase cannot resume until program operations initiated during block erase suspend have completed. 4.8. Program Suspend Comand The Program Suspend command allows program interruption to read data in other memory locations. Once the program process starts, writing the Program Suspend command requests that the WSM suspend the program sequence at a predetermined point in the algorithm. The device continues to output status register data when read after the Program Suspend command is written. Polling status register bits will help determine when the program operation was suspended. After a successful suspend, a Read Array command can be written to read data from locations other than that which is suspended. The only other valid commands while program is suspended are Read Status Register and Program Resume. After Program Resume command is written, the WSM will continue the programming process. V PP must remain at VPPH1/2 (the same VPP level used for program) while in program suspend mode. RST# or INIT# must also remain at VIH. 4.9. Register Based Locking, General-Purpose Input, and Random Number Generator Registers A series of registers are available in the Intel FWH to provide software read- and write-locking and GPI feedback. Also available are the set of control registers for controlling and gathering random numbers. These registers are accessible through standard addressable memory space (see the following table). It is recommended that the GPI pins be in the desired state before FWH4 is brought low for the beginning of the next bus cycle, and remain in that state until the end of the read.

24 Datasheet

Table 5. Intel Firmware Hub Register Configuration Map

• Assumes RNG is present and not disabled.

1 = Prevents read operations in the block where set. 0 = Normal operation for reads in the block where clear. This is the default state. 1 = Prevents program or erase operations in the block where set. This is the default state. 0 = Normal operation for programming and erase in the block where clear. Table 6. Register-Based Locking Value Definitions 02h 00000 0 1 0 Locked open (full access locked down). 03h 00000 0 1 1 Write-locked down. 05h 00000 1 0 1 Read and write locked. 06h 00000 1 1 0 Read-locked down. 07h 00000 1 1 1 Read- and write-locked down.

Intel® 82802AB/AC Firmware Hub R

26 Datasheet

The default write status of all blocks upon power-up is write-locked. Any program or erase operations attempted on a locked block will return an error in the status register (indicating block lock). The status of the locked block can be changed to unlocked by clearing the write-lock bit, provided the lock-down bit also is not set. The current write-lock status of a particular block can be determined by reading the corresponding write-lock bit. The write-lock functions in conjunction with the hardware write-lock pins, TBL# and WP#. When active, these pins take precedence over the register locking function and write- lock the top block or remaining blocks, respectively. Reading this register will not read the state of the TBL# or WP# pin. Read Lock The default read status of all blocks upon power-up is read-unlocked. When a block’s read-lock bit is set, data cannot be read from that block. An attempted read from a read-locked block will result in the data 00h. (Note that failure is not reflected in the status register.) The read-lock status can be unlocked by clearing the read-lock bit, provided the lock-down bit has not been set. The current read-lock status of a particular block can be determined by reading the corresponding read-lock bit. Lock-Down In the Intel FWH interface mode, the default lock-down status of all blocks upon power-up is not-locked- down. The lock-down bit for any block may be set, but only once, because future attempts to change that block-locking register will be ignored. The lock-down bit is cleared only upon a device reset with RST# or INIT#. The current lock-down status of a particular block can be determined by reading the corresponding lock-down bit. Once a block’s lock-down bit is set, the read- and write-lock bits for that block can no longer be modified, and the block is locked-down in its current state of read and write accessibility. 4.9.2. General-Purpose Input Register This register reads the status of the FGPI [4:0] pins on the Intel FWH. Since this is a pass-through register, there is no default value, only the state of the pins at power-up. 4.9.2.1. GPI_REG — General-Purpose Input Register Memory Address: FFBC0100h Default Value: N/A Access: R0 Size: 8 bits Bit Function 7:5 Reserved 4 FGPI[4]. Reads status of general-purpose input pin (PLCC-30/TSOP-7). 3 FGPI[3]. Reads status of general-purpose input pin (PLCC-3/TSOP-15). 2 FGPI[2]. Reads status of general-purpose input pin (PLCC-4/TSOP-16). 1 FGPI[1]. Reads status of general-purpose input pin (PLCC-5/TSOP-17). 0 FGPI[0]. Reads status of general-purpose input pin (PLCC-6/TSOP-18).

Intel ® 82802AB/AC Firmware Hub R Datasheet 27 4.9.3. Random Number Generator Registers When enabled and active, the Random Number Generator (RNG) is designed to fill an 8-bit register, a bit at a time, with hardware-generated random numbers. When this register is full, a flag bit in the RNG data status register transitions to a 1, indicating that a valid random number is ready to be read. This bit will immediately reset to 0 upon reading the RNG data register. The advantages of random numbers over pseudo-random numbers as well as a brief overview of the simple mathematics of testing RNGs are discussed superficially in the companion document, The Intel Platform RNG Tech Brief, which is available online. 4.9.3.1. RNG Hardware Status Register Memory Address: FFBC015Fh Default Value: 40h, for typical component out of reset Access: RO Size: 8 bits Bit Function

7 Reserved

6 RNG Present—RO. Determines whether or not an RNG is present on this component, or if it has been disabled. 1 = RNG Present 0 = RNG not present 5:1 Reserved 0 RNG Enabled—R/W. Determines whether the RNG is generating a random number. 1 = RNG enabled 0 = RNG disabled 4.9.3.2. RNG Data Status Register Memory Address: FFBC0160h Default Value: 00h Access: RO Size: 8 bits Bit Function 7:1 Reserved 0 RNG Output Valid. Determines whether the RNG data register contains a valid random number. 1 = RNG data register contians valid random data 0 = RNG data register contents not valid

Intel® 82802AB/AC Firmware Hub R

28 Datasheet

4.9.3.3. RNG Data Register Memory Address: FFBC0161h Default Value: 40h, for typical component out of reset Access: RO Size: 8 bits Bit Function 7:0 RNG Output: (Should only be used if RNG Data Status Register indicates valid output.) 4.10. Using the Random Number Generator The Intel Firmware Hub integrates a Random Number Generator that utilizes thermal noise generated as a result of the inherently random quantum mechanical properties of silicon, in order to modulate a proven hardware RNG design. Internal circuitry is included to enhance the entropy of the output. Since the output of the RNG is non-deterministic, it is an excellent choice for cryptography applications, but it also is a convenient source of random numbers for mathematics, modeling, graphics algorithms, artificial intelligence, entertainment, and many other applications. The fact that it is a component of the platform and may be utilized remotely on a locked-away server makes it an ideal (and much more reliable) source of entropy for applications that, in the past, have relied exclusively on a key press or other environmental input. Several Intel Firmware Hub components may be used in tandem (see the following section) when additional RNG bandwidth is required. When not generating new random bits, the RNG circuitry will enter a low power state. 4.11. Detecting and Initializing the RNG Device Before any process attempts to read random data directly from the Intel Firmware Hub RNG device, it should execute a process to verify that a supported RNG device is available for use, enable the device, and verify the correct functionality. This initialization process is described in a following subsection. 4.11.1. Detecting the RNG Device The Manufacturer Code and Hardware Status registers are used to determine whether a supported RNG device is available on the system. Step 1: From the system BIOS or using the Read Identifier Codes command, as specified in the Intel ® 82802AB/82802AC Firmware Hub (FWH) datasheet, verify the Intel® 82802 manufacturer code. Step 2: If a valid Intel® 82802 FWH is found, then the RNG Present bit (bit 6) of the Hardware Status register should be checked in order to verify that an RNG device is available. Note: There is a chance that, even if no RNG device is present, the physical memory locations described above may coincidentally match the values expected for an RNG device. For this reason, before random data is sent to an application, the device should be exercised to verify that it is indeed an RNG. This can be accomplished by enabling the device and running an initial test (e.g., FIPS (Federal Information Processing Standard) 140-1) before use.

Intel ® 82802AB/AC Firmware Hub R Datasheet 29 4.11.2. Initializing the RNG Device Once the RNG device is detected, it must be enabled and should be tested before use. Step 1: The RNG Enabled bit (bit 0) of the Hardware Status register must be set to enable the RNG device. Step 2: Once the RNG is enabled, an initial read of the RNG Data register should be made to clear any preexisting data from the register. Step 3: A test (e.g., FIPS 140-1) should be run on the RNG Device. This test will ensure that there was no error in detecting the device and that the device is functioning properly. 4.11.3. Selecting Appropriate FWH IDs and Densities It is possible, using different ID strapping, to use multiple FWH components in a system. While the FWH protocol supports up to 16 FWH devices, the BIOS support, bus loading or the attaching bridge may limit this number. Note that, regardless of the number of FWH components, the maximum “window” of the FWH array visible at one time is 4 MB (for Intel ® ICH1) and 8MB for Intel® ICH2. The boot device must have an ID (as determined by ID [0:3]) of 0. For clarity, it is advisable that subsequent devices use incremental numbering. The most straightforward method of using multiple FWH components is to use devices of equal density. This is the recommended technique. In special applications, when it is desirable to use multiple FWH components of different densities—if multiple RNGs or more GPIs are required, for instance, without the need for greater array space—IDs must be chosen such that component memory array spaces do not cross the boundaries delimited by the highest-capacity device, as illustrated in the following table. For example, in a design with 8- and 4-Mbit components, the 8-Mbit part must either be first or must be after enough 4-Mbit parts to add up to a multiple of 8 Mbits. Yes No Yes

8 Mbits 4 Mbits 4 Mbits

8 Mbits 4 Mbits

4 Mbits 8 Mbits

Biggest is 8 Mbits.

Intel® 82802AB/AC Firmware Hub R

30 Datasheet

4.11.4. Mapping FWH Devices onto Memory Map There is 4 MB of available memory space devoted to the FWH. Therefore, the Intel ICH has the ability to select which FWH device maps into each region of the system address space. In the existing Intel ICH, the address map is broken up into eight 512-KB segments. The BIOS Select Register in the Intel ICH is a 32-bit register that contains the needed mapping information, thereby determining which FWH receives requests from which portion of the address map. For example, in a system with four 8-Mbit devices, this register would be 00112233h, which is the default power-up state for this register. In a system with eight 4-Mbit devices, the register must be changed to 01234567h. Note: The FWH indicated in the most-significant nibble of the register may be shadowed elsewhere in the system memory map. The FWH with ID 0 may not be re-mapped. 4.11.5. Paging FWH Devices for Greater Than 4 MB of FWH Memory In certain applications, even a 4-MB window of flash memory is inadequate. It is possible to exceed this amount by using a paging scheme. Individual FWH devices may then be “swapped” in and out of system memory space. This must be implemented at the BIOS level, to permit modification of the Intel ICH BIOS Select Register. A number of paging algorithms may be used successfully with the FWH memory space, using the Intel ICH BIOS Select Register. This register, then, determines which FWH device gets mapped into each 512 KB “slice” of the system memory map. The 0th FWH (ID=0) may not be remapped. Reference the Intel ® 82801AA (ICH) and Intel® 82801AB (ICH0) I/O Controller Hub Datasheet (order number: 290655) for information regarding these components and the BIOS Select Register. Note: The paging of FWH devices will also “page” features, potentially affecting the visibility or location of the FGPI register (see Section 4.9.2.1) or of an active/ready RNG. When a paging scheme is used, it is recommended that critical FPGIs be used only on the ID 0 FWH device, which must remain mapped at the top of memory. Ideally, the RNG driver in a system with more than four FWHs should verify the mapping of FWHs in order to keep track of which RNGs are active and which are present in the memory map. There is no convenient way, aside from checking the select register, to determine which IDed FWH is in which location in the memory map. 4.11.6. Programming Multiple FWH Devices Special considerations must be taken into account when programming multiple FWH devices in-system. Since there is no ID support in the A/A Mux mode, the recommended means of programming multiple devices is either out-of-system programming with standalone PROM programmers or in-system programming using the FWH mode. In cases where programming time is critical or ATE programming is required, provisions should be made to isolate the component from its neighboring devices during A/A Mux programming, or the other devices should be held in a reset (or otherwise disabled) state until programming of the intended device is complete. Do not switch one component into the A/A Mux mode, thereby leaving the others in the FWH mode.

Figure 6. Automated Block Erase Flowchart before full status is checked. retry or other error recovery. Repeat for subsequent block erasures. Write FFh after the last operation to place device in read array mode.

Intel® 82802AB/AC Firmware Hub R

32 Datasheet

This page left intentionally blank

1. Electrical Specifications

may affect device reliability.

1. All specified voltages are with respect to GND. The minimum DC voltage on the V

CC + 2.0 V for periods of <20 ns.

1. The maximum DC voltage on V PP may overshoot to +14.0 V for periods of <20 ns.
2. Output shorted for no more than one second. No more than one output is shorted at a time. This

note applies only to non-PCI outputs.

1. Connection to supply of V HH is allowed for a maximum cumulative period of 80 hours.
2. Do not violate processor or chipset limitations on the INIT# pin.

Table 7. Temperature and VCC

1. This temperature requirement differs from the normal commercial operating condition of flash

34 Datasheet

Table 8. Intel FWH Interface DC Input/Output Specifications

1. Input leakage currents include hi-Z output leakage for all bi-directional buffers with tri-state
2. Inputs are not “5 volt safe.”

to the pin descriptions (Table 1).

1. Do not violate processor or chipset specifications regarding the INIT# pin voltage.

Table 9. Power Supply Specifications — All Interfaces

1. All currents are RMS, unless otherwise noted. These currents are valid for all packages.
2. V IH = 0.9 VCC , VIL = 0.1 VCC per the PCI output VOH and VOL specifications of Table 8.
3. This number is the worst case of I PP + ICC memory core + ICC FWH interface.

36 Datasheet

Table 10. Intel FWH Interface AC Input/Output Specifications

0.7 V CC < VOUT < VCC Equation C

0.18 V CC > VOUT > 0 Equation D

1. PCI specification output load is used.

Table 11. Clock Specification

1. PCI components must work with any clock frequency between nominal DC and 33 MHz.
2. Applies only to the rising edge of the signal. See Chapter 4 of the PCI electrical specification.

Figure 7. Clock Waveform

0.3 Vcc

0.4 Vcc

0.5 Vcc

0.2 Vcc

0.6 Vcc

0.4 Vcc, p-to-p

38 Datasheet

Table 12. Signal Timing Parameters

1. Minimum and maximum times have different loads. See PCI spec.
2. For purposes of active/float timing measurements, the Hi-Z or Off state is defined as that in which
3. This parameter applies to any input type (excluding CLK).

Figure 8. Output Timing Parameters

Figure 9. Input Timing Parameters Table 13. Interface Measurement Condition Parameters

1 V/ns

1. The input test environment uses 0.1 V CC of overdrive over VIH and VIL. Timing parameters must

must correlate results back to these parameters. Table 14. AC Waveform for Reset Operation

1. There will be a 20- µs reset latency if a reset procedure is performed during a programming or

40 Datasheet

Table 15. Programming Times

3.3 V V PP 12 V V PP

1. Typical values measured at T A = +25°C and nominal voltages.
2. Excludes system-level overhead.

The firmware hub relies on the Intel Firmware Hub interface to communicate with the outside world. Intel FWH interface is designed to use an LPC-compatible start cycle, with a reserved cycle type code. FWH, without becoming “confused” by the different protocol. components supporting the Intel FWH interface (e.g., ASICs, PLDs). for read and write operations. The following tables list the field sequences for read and write cycles. will be required to translate these to the actual locations in the memory map (and vice versa).

Table 16. FWH Read Cycle 1 START 1101 IN FWH4 must be active (low) for the part to respond. indicate an FWH memory read cycle.

2 IDSEL 0000

address. YYYY is one nibble of the entire address. Addresses are transferred most-significant nibble first. be zero, depending on page size.

10 IMSIZE 0000 (1 byte)

only support single-byte transfers.

11 TAR0 1111 IN

12 TAR1 1111 (float) Float then

The FWH takes control of the bus during this cycle. is a function of the device’s access time.

15 RSYNC 0000 (READY) OUT During this clock cycle, the FWH will generate a “ready-

during the next clock cycle.

16 DATA YYYY OUT YYYY is the least-significant nibble of the least-

17 DATA YYYY OUT YYYY is the most-significant nibble of the least-

1 RSYNC +

2 DATA

wait-syncs + 1 ready-sync + 2 data nibbles. The FWH supports only n=0000 (single-byte) reads.

1. Field contents are valid on the rising edge of the present clock cycle.

42 Datasheet

Figure 10. FWH Single-Byte Read Waveforms valid flash command. Refer to the waveforms in Figure 11. Table 17. FWH Write Cycle 1 START 1110 IN FWH4 must be active (low) for the part to respond. contents indicate an FWH memory write cycle.

10 IMSIZE 0000 (1 byte) IN This size field indicates how many bytes will be

only supports single-byte writes.

11 DATA YYYY IN This field is the least-significant nibble of the data

into the flash memory or any valid flash command.

12 DATA YYYY IN This field is the most-significant nibble of the data

13 TAR0 1111 IN

14 TAR1 1111 (float) Float then

The FWH takes control of the bus during this cycle.

15 RSYNC 0000 OUT The FWH outputs the values 0000, indicating that it

has received data or a flash command.

16 TAR0 1111 OUT

17 TAR1 1111 (float) Float then

1. Field contents are valid on the rising edge of the present clock cycle.

Figure 11. Write Waveforms

• Address out of range: The Intel FWH address sequence is 7 fields long (28 bits), but only the last five address fields (20 bits) will be decoded by an 8-Mbit FWH. (For a 4-Mbit density, the most- significant bit (FWH3) in the third address field also will be ignored.) The Intel FWH will respond to these lower addresses, regardless of the value of the more-significant address bits. Address A22 has the special function of directing reads and writes to the flash core (A22 = 1) or to the register space (A22 = 0).
• Invalid IMSIZE field: If the Intel FWH receives an invalid size field during a read or write operation, the internal state machine will reset and no operation will be attempted. The Intel FWH will generate no response of any kind in this situation. Invalid-size fields for a read cycle are anything but 0000. Invalid-size fields for a write cycle are anything but 0000. When accessing register space, invalid field sizes are anything but 0000.
• Non-page-aligned address: The Intel FWH assumes that multibyte read addresses are page aligned (i.e., for a 32-byte access, the lower 5 address bits will be zero). If they are not zero, the first byte of data returned by the Intel FWH will correspond to that explicit address, and subsequent data will be as if the first address was indeed page aligned. Once valid START, IDSEL, and IMSIZE fields are received, the Intel FWH always will respond to subsequent inputs as if they were valid. As long as the states of FWH [3:0] and FWH4 are known, the response of the Intel FWH to signals received during the FWH cycle should be predictable. The Intel FWH will make no attempt to check the validity of incoming flash operation commands.

44 Datasheet

the FWH state machine will reset. has just been initiated). If FWH4 is asserted during this time frame, the internal operation will not abort. The software must send an explicit flash command to terminate or suspend the operation. Refer to Figure Figure 12 and Figure 13. Table 18. Signal Timing Parameters

1. Minimum and maximum times have different loads. See the PCI specification.
2. For purposes of active/float timing measurements, the Hi-Z or “off” state is defined as the state
3. This parameter applies to any input type (excluding CLK).

Table 19. RNG Timing Characteristics

1. Sampled, not 100% tested.

Table 20. RNG Statistical Characteristics

1. Sampled, not 100% tested.

Figure 12. Intel FWH Output Timing Parameters

46 Datasheet

Figure 13. Intel FWH Input Timing Parameters

Intel ® 82802AB/AC Firmware Hub R Datasheet 47 6. PROM Programming Specifications 6.1. Programming (“A/A Mux”) Mode Operation The Intel® 82802 is designed to offer a parallel programming mode for faster factory programming. This mode, called the A/A Mux mode, is selected by IC high. The IC pin is pulled down internally in the Intel ® 82802, so it should be expected that a modest current will be drawn. (See the pin descriptions in Table 1 for further information.) The following information applies only to the Intel® 82802 when in the A/A Mux mode. Information regarding the FWH mode (i.e., the standard operating mode) is provided in earlier chapters of this document 6.2. Bus Operation All A/A mux bus cycles can be conformed to operate on most automated test equipment and PROM programmers. 6.2.1. Output Disable/Enable With OE# at the logic-high level (VIH), the device outputs are disabled. Output pins DQ0–DQ7 are placed in the high-impedance state. With OE# at the logic-low level (VIL), the device outputs are enabled. Output pins DQ0–DQ7 are placed in the output-drive state. 6.2.2. Row/Column Addresses R/C# is the A/A mux control pin used to latch row (A0–A10) and column addresses (A11–A18/4 Mbits, or A[11:19] /8 Mbits). R/C# latches row addresses on the falling edge and column addresses on the rising edge. 6.2.3. Read Operation Block information, identifier codes or status register data can be read independently of the VPP voltage. The first task is to write the appropriate read-mode command (Read Array, Read Identifier Codes or Read Status Register) to the CUI. Upon initial device power-up or after exit from reset, the device defaults to the read array mode. Four control pins dictate the data flow into and out of the component: R/C#, OE#, WE#, and RST#. R/C# is the A/A mux control pin used to latch row and column addresses. OE#, the data output control pin (DQ0–DQ7), drives the selected memory data onto the I/O bus, when active. WE# and RST# must be at V IH.

48 Datasheet

confirm the proper device ID. command are latched on the WE# rising edge. Table 21. Bus Operations

1. When V PP ≤ VPPLK, the memory contents can be read, but not altered.
2. X can be V IL or VIH for the control and address input pins and VPPLK or VPPH1/2 for the VPP supply

pin. See the DC characteristics for the VPPLK and VPPH1/2 voltages.

1. See Table 4 for the read identifier code data and addresses.
2. Command writes involving block erase or program are reliably executed when V
3. Refer to Table 2 for the valid D IN during a write operation.
4. V IH and VIL refer to the DC Characteristics associated flash memory output buffers:

Flash core programming commands in A/A Mux mode are identical to commands for the FWH mode. Refer to Section 4 of this document. Mux mode. Refer to Section 5 of this document and use the Intel FWH mode specifications.

Intel ® 82802AB/AC Firmware Hub R Datasheet 49 6.4.1. Reset Operations # Symbol Parameter Notes Min. Max. Unit P1 t PLPH RST# pulse low time (If RST# is tied to V CC, this specification is not applicable.) 100 ns P2 t PLRH RST# low to reset during block erase or program 1, 2 20 µs Note: 1. If RST# is asserted when the WSM is not busy (RY/BY# = ‘1’), the reset will complete within 100 ns. 2. A reset time, t PHAV, is required from the latter of RY/BY# or RST# going high until outputs are valid. 6.4.2. AC Waveforms for Reset Operations IHV ILV RST# (P) IHV ILV RY/BY# (R) 6.4.3. A/A Mux Read-Only Operations (1,3) # Symbol Parameter Notes Min. Max. Unit R1 t AVAV Read cycle time 250 ns R2 t AVCL Row address setup to R/C# low 50 ns R3 t CLAX Row address hold from R/C# low 50 ns R4 t AVCH Column address setup to R/C# high 50 ns R5 t CHAX Column address hold from R/C# high 50 ns R6 t CHQV R/C# high to output delay 2 150 ns R7 t GLQV OE# low to output delay 2 50 ns R8 t PHAV RST# high to row address setup 1 µs R9 t GLQX OE# low to output in low Z 0 ns R10 t GHQZ OE# high to output in high Z 50 ns R11 t QXGH Output hold from OE# high 0 ns Note: 1. See the AC input/output reference waveform for the maximum allowable input slew rate. 2. OE# may be delayed up to t CHQV – tGLQV after the rising edge of R/C# without affecting tCHQV. 3. T c = 0 °C to + 85 °C, 3.3 V ± 0.3 V VCC

50 Datasheet

Figure 14. A/A Mux Read Timing Diagram

Intel ® 82802AB/AC Firmware Hub R Datasheet 51 6.4.4. A/A Mux Write Operations (1,2) # Symbol Parameter Notes Min. Max. Units W1 t PHWL RP# high recovery to WE# low 1 µs W2 t WLWH Write pulse width low 100 ns W3 t DVWH Data setup to WE# high 1 50 ns W4 t WHDX Data hold from WE# high 1 5 ns W5 t AVCL Row address setup to R/C# low 1 50 ns W6 t CLAX Row address hold from R/C# low 1 50 ns W7 t AVCH Column address setup to R/C# high 1 50 ns W8 t CHAX Column address hold from R/C# high 1 50 ns W9 t WHWL Write pulse width high 100 ns W10 t CHWH R/C# high setup to WE# high 50 ns W11 t VPWH V PP1,2 setup to WE# high 100 ns W12 t WHGL Write recovery before read 150 ns W13 t WHRL WE# high to RY/BY# going low 0 ns W14 t QVVL V PP1,2 hold from valid SRD, RY/BY# high 0 ns Note: 1. Refer to Table 6-28 [?] for valid A IN and DIN for block erase or program or other commands. 2. Tc = 0 °C to + 85 °C, 3.3 V ± 0.3 V V CC

52 Datasheet

Figure 15. A/A Mux Write Timing Diagram

2200 Mission College Boulevard

P.O. Box 58119 Santa Clara, CA 95052-8119 USA Phone: (800) 628-8686 Europe Intel Corporation (UK) Ltd. Pipers Way Swindon Wiltshire SN3 1RJ UK Phone: England (44) 1793 403 000 Germany (49) 89 99143 0 France (33) 1 4571 7171 Italy (39) 2 575 441 Israel (972) 2 589 7111 Netherlands (31) 10 286 6111 Sweden (46) 8 705 5600 Asia-Pacific Intel Semiconductor Ltd. 32/F Two Pacific Place

88 Queensway, Central

Hong Kong, SAR Phone: (852) 2844 4555 Japan Intel Kabushiki Kaisha P.O. Box 115 Tsukuba-gakuen 5-6 Tokodai, Tsukuba-shi Ibaraki-ken 305 Japan Phone: (81) 298 47 8522 South America Intel Semicondutores do Brazil Rue Florida, 1703-2 and CJ22 CEP 04565-001 Sao Paulo-SP Brazil Phone: (55) 11 5505 2296 For more information To learn more about Intel Corporation, visit our site on the World Wide Web at www.intel.com