The Serial Peripheral Interface (SPI0) supports two SPI flash devices via two chip select (SPI0_​CS0# and SPI0_​CS1#). The maximum size of flash supported is determined by the SFDP-discovered addressing capability of each device. Each component can be up to 16 MB (32 MB total addressable) using 3-byte addressing. Each component can be up to 64 MB (128 MB total addressable) using 4-byte addressing. Another chip select (SPI0_​CS2#) is also available and only used for TPM on SPI support. The processor drives the SPI0 interface clock at either 14 MHz, 25 MHz, 33 MHz and 50 MHz and will function with SPI flash/TPM devices that support at least one of these frequencies. The SPI interface supports 1.8 V only

A SPI0 flash device supporting SFDP (Serial Flash Discovery Parameter) is required for all design. A SPI0 flash device on SPI0_​CS0# with a valid descriptor must be attached directly to the processor.

The processor supports fast read which consist of:

1. Dual Output Fast Read (Single Input Dual Output)
2. Dual I/O Fast Read (Dual Input Dual Output)
3. Quad Output Fast Read (Single Input Quad Output)
4. Quad I/O Fast Read (Quad Input Quad Output)

The processor SPI0 has a third chip select SPI0_​CS2# for TPM support over SPI. The TPM on SPI0 will use SPI0_​CLK, SPI0_​MISO, SPI0_​MOSI and SPI0_​CS2# SPI signals.

SPI0 Supported Features

• Descriptor Mode

  Descriptor Mode is required for all SKUs of the processor. Non-Descriptor Mode is not supported.

• SPI0 Flash Regions

In Descriptor Mode the Flash is divided into five separate regions.

Only four controllers can access the regions: Host processor running BIOS code, Integrated Gigabit Ethernet and Host processor running Gigabit Ethernet Software, Intel Converged Security and Management Engine, and the EC.

The Flash Descriptor and Intel^® CSME region are the only required regions. The Flash Descriptor has to be in region 0 and region 0 must be located in the first sector of Device 0 (Offset 0). All other regions can be organized in any order.

Regions can extend across multiple components, but must be contiguous.

Flash Region Sizes

SPI0 flash space requirements differ by platform and configuration. The Flash Descriptor requires one 4 KB or larger block. GbE requires two 4 KB or larger blocks. The amount of flash space consumed is dependent on the erase granularity of the flash part and the platform requirements for the Intel^® CSME and BIOS regions. The Intel^® CSME region contains firmware to support Intel Active Management Technology and other Intel^® CSME capabilities.

Flash Descriptor

The bottom sector of the flash component 0 contains the Flash Descriptor. The maximum size of the Flash Descriptor is 4 KB. If the block/sector size of the SPI0 flash device is greater than 4 KB, the flash descriptor will only use the first 4 KB of the first block. It requires its own discrete erase block, so it may need greater than 4 KB of flash space depending on the flash architecture that is on the target system. Two additional redundant back-ups of the Flash Descriptor have been added for data resilience.The information stored in the Flash Descriptor can only be written during the manufacturing process as its read/write permissions must be set to read only when the computer leaves the manufacturing floor.

The Flash Descriptor is made up of fifteen sections as shown in the figure below:

• EC Firmware Pointer is located in the first 16 bytes of the Descriptor and contains the address location for EC flash region. The format for the EC Firmware Pointer address is dependent on EC vendors/OEM implementation of this field.
• The Flash signature at the bottom of the flash (offset 10h) must be 0FF0A55Ah in order to be in Descriptor mode.
• The Descriptor map has pointers to the lower five descriptor sections as well as the size of each.
• The Component section has information about the SPI flash part(s) the system. It includes the number of components, density of each component, read, write and erase frequencies and invalid instructions.
• The Region section defines the base and the limit of the BIOS, IFWI, GbE, Platform Data Region (PDR- Optional), Embedded Controller (EC- Optional) regions as well as their size.
• The processor soft strap sections contain configurable parameters.
• The Reserved region is for future processor usage.
• The Descriptor Upper Map determines the length and base address of the Intel ^® CSME VSCC Table.
• The Intel ^® CSME VSCC Table holds the JEDEC ID and the ME VSCC information for all the SPI Flash part(s) supported by the NVM image. BIOS and GbE write and erase capabilities depend on VSCC0 and VSCC1 registers in SPIBAR memory space.
• OEM Section is 256 bytes reserved at the top of the Flash Descriptor for use by OEM.

The Controller region defines read and write access setting for each region of the SPI0 device. The Controller region recognizes four Controllers: BIOS, Gigabit Ethernet, Intel^® CSME, and EC. Each Controller is only allowed to do direct reads of its primary regions.

Flash Access

There are two types of accesses: Direct Access and Program Register Accesses.

• Direct Access
  • Controllers are allowed to do direct read only of their primary region
    • Gigabit Ethernet region can only be directly accessed by the Gigabit Ethernet controller. Gigabit Ethernet software must use Program Registers to access the Gigabit Ethernet region.
  • Controller's Host or Management Engine virtual read address is converted into the SPI0 Flash Linear Address (FLA) using the Flash Descriptor Region Base/Limit registers

    Direct Access Security

  • Requester ID of the device must match that of the primary Requester ID in the Controller Section
  • Calculated Flash Linear Address must fall between primary region base/limit
  • Direct Write not allowed
  • Direct Read Cache contents are reset to 0's on a read from a different Controller

• Program Register Access
  • Program Register Accesses are not allowed to cross a 4 KB boundary and cannot issue a command that might extend across two components
  • Software programs the FLA corresponding to the region desired
    • Software must read the devices Primary Region Base/Limit address to create a FLA.

  • Register Access Security

    Only primary region Controllers can access the registers

Flash Descriptor Redundancy and Recovery

In order to provide descriptor redundancy and recovery, SPI flash controller uses two 4 KB spaces or regions as the backup descriptor regions. Each backup descriptor region size is 4 KB.

In the main and backup descriptor regions, the following fields are defined for the descriptor integrity check and recovery. Before SPI controller reads the descriptor, it

• Reads Main Descriptor Region and calculates SHA-256 hash.
• Reads Active Backup Descriptor Region and calculates hash.
• Compares each hash result with the hash in that region.
• Takes action based on result and policy byte (in Main Descriptor).

RPMC Configuration

Intel Replay Protection Monotonic Counter (RPMC) is a capability providing Anti-Replay Protection using Monotonic Counters inside SPI Flash. Intel RPMC is a critical security feature designed to protect the SPI part of Intel platforms from unauthorized write operations. This innovative technology acts as a robust defense mechanism, ensuring that only authorized write operations are permitted, thus preventing any unauthorized access to the SPI.

RPMC protection relies on:

• Special RPMC HW and logic inside the SPI Flash.
• Intel CSME FW support that utilizes RPMC capabilities within Flash.

The session key is a cryptographic key derived from several factors residing on the processor . These factors are carefully selected and stored upon provisioning RPMC to the SPI part. The session key serves as a means of authenticating each incoming write message to the SPI. When an authorized operation is initiated, the session key is used to verify the legitimacy of the request. If the session key does not match the expected value, the SPI part will reject the request, effectively blocking malicious or unauthorized write operations.

Furthermore, the session key also extends its protective shield to cover a specific set of sensitive read messages. This holistic approach ensures that not only write operations but also read operations involving sensitive data are monitored and authenticated, enhancing the overall security of the system.

Two features of RPMC can be enabled:

• RPMC will be enabled on platforms with RPMC SPI. During Intel End of Manufacturing the processor will be bound with RPMC SPI
• When SPI is replaced, re-binding between the new RPMC SPI and theprocessor will happen automatically on first boot.

Monotonic counters are counters on the SPI Flash maintained by Intel CSME FW. SPI Flash has a set of four 32-bit monotonic counters, where Intel CSME FW uses two of these counters. Intel CSME FW ensures FW write operations will not exceed SPI RPMC monotonic counter increment rate specified by RPMC HW during platform lifetime supported by Intel. Reading and incrementing the counters in the Flash is done using authenticated commands with a key known to both: SPI Flash and Intel® CSME FW

RPMC Binding pairs between SPI Flash and the processor by provisioning the Binding key produced by the processor into SPI Flash. This pairing is done as part of the EOM flow which usually takes place at the manufacturing line.

In conclusion, Intel RPMC, with its Replay Monotonic Counter and session key mechanism, stands as a powerful safeguard against unauthorized write operations and unauthorized access to sensitive data in the SPI part. This robust security feature, derived from the session key, adds an additional layer of protection to Intel platforms, making them more resilient against potential threats and ensuring the integrity and confidentiality of the data stored in the SPI.