BYT Tools and Manufacturing

Flow for Android

Ranran Xu

INTEL CONFIDENTIAL
 Agenda

• Overview
• Online Download Flow For Developer
• Manufacturing Flow & related tools
• TXE tools introduction
 TXEInfo
 TXEManuf
 FPT
 FWUpdLcl
• Appendix

2 INTEL CONFIDENTIAL 4/9/21

 Overview

3 INTEL CONFIDENTIAL
 Overview
• Storage devices for firmware and OS:
1. A SPI NOR device that is used to store the firmware “similar
to the BIOS on the PC architecture”
2. A eMMC where the Android OS is stored.

• The NOR device must be programmed offline before the SMT

process
• Once the firmware have been programmed, future updates
can be done via USB using the fastboot protocol, FPT, etc.

• The Android OS can be programmed into the eMMC either offline,

before SMT, or online using the fastboot protocol.

4 INTEL CONFIDENTIAL 4/9/21

 IAFW in SPI NOR

• SPI Gang Programmer(M) & Dediprog(D):

Equipment to program at least 8 SPI devices simultaneously

Intel TXE
Descriptor Reserved PDR BIOS
Intel TXE apps

5 INTEL CONFIDENTIAL 4/9/21

 AOS in EMMC

USER

RPMB

BOOT2

BOOT1

6 INTEL CONFIDENTIAL 4/9/21

 Online Download Flow For
Developer

7 INTEL CONFIDENTIAL
 Online Download Flow

8 INTEL CONFIDENTIAL 4/9/21

 Online Download Flow

• Based on SPI NOR has burned offline and finished

SMT/System assembly.

Blank EMMC

Power On
Execute:
Enter IAFW dnx Fastboot boot droidboot.img
mode Fastboot dontinue

No-Blank EMMC Warm reset;

Power Key + Droidboot.img to RAM

Vol+ & Vol-
Fastboot flash AOS Enter fastboot mode

9 INTEL CONFIDENTIAL 4/9/21

 Phone Flash Tool

Summary
Phone Flash tool is a cross platform host based tool
to flash phones in a lab or development
environment

Features
 One shot flashing process to download complete
phone image
 Has a command line version to help with
automation.
 Android .apk provisioning
 User’s data provisioning
 User data backup and restore functionality
 Supports Windows* and Linux

10 INTEL CONFIDENTIAL 4/9/21

 Manufacturing Flow

11 INTEL CONFIDENTIAL
 Manufacturing Flow

• Online Flash

SPI NOR Factory OS Update SPI

SMT
IAFW / UEFI Download FPT / FWUpdLcl

System Level Test System Assembly Board Level Test

TXE Test &

Provisioning Shipping OS
ACD write

12 INTEL CONFIDENTIAL 4/9/21

 Offline Flash

SPI NOR
IAFW / UEFI
Update SPI
SMT Board Level Test
FPT / FWUpdLcl
EMMC Burn
Factory OS

TXE Test &

System
Shipping OS Provisioning System Level Test
Assembly
ACD write

13 INTEL CONFIDENTIAL 4/9/21

 Board Level Test

TXEManuf UI WIFI BT
TXEManuf MAT/CIT MAT/CIT MAT/CIT

GPS Sensor
Circuit RF/CAL
MAT/CIT MAT/CIT

etc

14 INTEL CONFIDENTIAL 4/9/21

 Android System Level Test

UI WIFI BT IMEI
MAT/CIT MAT/CIT MAT/CIT CIT/PT

GPS Camera
Circuit RF/CAL MAT/CIT/Custo
MAT/CIT mized

Sensor Audio
MAT/CIT/Custo
mized
MAT/CIT/Custo
mized
etc

15 INTEL CONFIDENTIAL 4/9/21

 TXE Test & Provisioning

Push TXE tools

to data/local/

TXEManuf
ACD write TXEInfo FPT: write FPF
Test
TXEI_SEC_TOOLS TXEInfo (optional) FPT -writefpf
TXEManuf

Produ Test Manuf Mode

FPT: GV set
Line Close Close
FPT -writeglobal
TXEManuf -EOL FPT -closemnf

16 INTEL CONFIDENTIAL 4/9/21

 Tools For Android

TOOLS Function Used in

Fundamental function test,
MAT running in devices
Board & System Level Test

Fundamental function test && Board & System Level Test &&
CIT provisioning, running in PC Provisioning
Provision SN, WiFi/BT Addr,
TXEI_SEC_TOOLS Provisioning
Keybox to TXE ACD region
SPI NOR programming Offline flash IAFW to SPI NOR SPI NOR
mFlashtool Online download Test OS or
Factory OS Download
USB driver Shipping OS to emmc
TXE tool(TXEManuf, FPT, HW verification, FPF written,
TXE Test
TXEInfo) GV set, FPF lock, etc
Offline flash Test OS or
eMMC Offline programming
Shipping OS to emmc
RF calibration tool RF calibration Board Level Test

17 INTEL CONFIDENTIAL 4/9/21

 Manufacturing Flash Tool

Summary
Host based reference design tool to flash all or part
of the phone SW/FW image.
The tool can flash up to 8 devices at the same time
to support manufacturing.

Features
 One shot flashing process to download complete
phone image
 FIRMWARE
 POS
 Modem*
 Production OS
 Auto-start flashing when new device detected
 Supports asynchronous flashing
 Source code available to OEM to use as needed.

18 INTEL CONFIDENTIAL 4/9/21

 MAT Demo

19 INTEL CONFIDENTIAL 4/9/21

 MAT Demo

20 INTEL CONFIDENTIAL 4/9/21

 ACD Mapping

21 INTEL CONFIDENTIAL 4/9/21

 ACD Write - Keybox
• WV is a DRM key that is used by Google* and other
companies to perform licensing and protected playback of
video content

• Write to ACD:
 adb push keybox.dat/data/local
 adb shell TXEI_SEC_TOOLS –acd –write
1/data/local/keybox.dat 128 128

• Read from ACD

 adb shell TXEI_SEC_TOOLS –acd –read
1/data/local/wv_read.dat

• Delete the WV file after reading

 adb shell rm/dat/local/wv_read.dat

22 INTEL CONFIDENTIAL 4/9/21

 TXE Tools Introduction

23 INTEL CONFIDENTIAL
 Intel® Trusted Execution Engine (Intel® TXE)

The Intel® TXE is an independent processor core

embedded inside the SoC.
• Operates independently from the main processor, BIOS,
and OS, but can interact with the BIOS.
• Executes from ROM or RAM in the SoC, or from main
memory, or the Intel TXE Region of SPI Flash.

24 INTEL CONFIDENTIAL 4/9/21

 Intel® TXE Manufacturing Tool Set
Tool Name Feature To Test Stage

TXEManuf • Validate all hardware components and necessary platform MFG Line
configuration Run on every single
• EOL test, run basic Intel recommended configuration device
checks before shipment.

TXEInfo • Display Intel TXE firmware version, status, and also FW MFG Line -optional
capability on the platform.
• Additionally, some HOST info can also be displayed.

FPT • Flash whole ifwi MFG Line

• Update regions(TXE, BIOS, FOV) Run on every single
• Erase/read/write/compare regions device
• Program fuses(FPF)

FWUpdate • Updates the Intel TXE firmware code part MFG Line Optional
• Keep user data un changed
• Need IFWI to be alive when update.

25 INTEL CONFIDENTIAL 4/9/21

 TXEManuf Overview

• For production testing of Intel® TXE.

• Auto-detects the hardware/firmware SKU
• Auto-runs tests to check functionality of related features.
• Can run regardless of TXE Manufacturing mode status
• Provides a color-coded pass/fail indicator.
• EOL (End of Line) check, default or configurable check of
platform configuration, for use at end of line.

26 INTEL CONFIDENTIAL 4/9/21

 TXEManuf cmd line options

Purpose: Verify Information About the Security

Firmware on a Device

Command Line Option Description

-H|? Displays help screen.

-VER Displays version information.

-EXP Displays example usage of this tool.

-VERBOSE <file> Display the debug information of the tool.

-S0 Do runtime test, no reset/hibernate is needed .

-F <filename> Load EOL config file .

-TEST Rerun full test .

-EOL[var|config] Do end of line check according to TXEManuf.cfg.

-PAGE Limits the display to one complete screen of information at a time.

-CFGGEN <filename> Generate default end of line configuration file.

Source: VLV Tools HLD, Chapter 6

27 INTEL CONFIDENTIAL 4/9/21
 TXEInfo Overview

• It is not a test, but can be optionally used to provide

additional information about TXE Firmware status and
settings.
• It can provide information for all features that the firmware is
capable of (whether they are enabled or not), or it can be
used to query specific features.
• Displays BIOS VSCC as well as TXE VSCC and some other
Host based information
• Display FPF values

28 INTEL CONFIDENTIAL 4/9/21

 TXEInfo cmd line options
Purpose: Displays Information About the Security
Firmware on a Device
Command Line Option Description

-H|? Displays help screen.

-VER Displays version information.

-EXP Displays example usage of this tool.

-VERBOSE <file> Display the debug information of the tool.

-FITCVER Displays FITC version information (available only in VLV QC)

-FEAT <name> Retrieves the specified platform setting.

-VALUE <value> An expected platform setting value. Must be used in conjunction with
“-FEAT <name>”
-FWSTS Displays the raw and decode TXE Firmware status register values
-PAGE Limits the display to one complete screen of information at a time.

-PID <filename> Append/Export Platform ID to the binary file.

-DUMPIDLM <filename> Displays Platform ID list in an IDLM binary.

29 INTEL CONFIDENTIAL 4/9/21

 FPT Overview
Purpose: All things related to reading, writing and
verifying SPI NOR

Write, Erase, Whole Chip

Help, Version, List SPI Flash
Verify, Query Erase and
Usage Parts
SPI Flash Verify

View Lock
View/Update End of
Status and Global Reset
FOVs Manufacturing
Lock Regions

View, Update, Read, Write,

Commit
View SPI BAR Compare Compare,
changes
NVARS Verify FPF data

30 INTEL CONFIDENTIAL 4/9/21

 FWUpdLcl
• FW update tool updates only the code difference in Intel
TXE FW, and does not touch the data portion
• FWUpdate does not update the BIOS, or Descriptor Regions
• TXE firmware must active and alive for FWupdate tool
• “FWUpdLcl.exe -f TXE_region.bin” This usage will update the
firmware via TXEI with the bin file provided
• The TXE fw image file that the tool uses for the update is the
same image file that is used by the FITC tool to create a
firmware image for use in the SPI
• FWUpdate verifies that the update is successful or not
• After FWUpdate, a host reset is needed to complete FW
update

31 INTEL CONFIDENTIAL 4/9/21

 FWUpdLcl cmd line options
Purpose: Update security firmware in a reliable manner
Command Line Option Description

-H|? Displays help screen.

-VER Displays version information.

-EXP Displays example usage of this tool.

-VERBOSE <file> Display the debug information of the tool.

-F <file> File used for updating the FW.

-Y Automatically answer Yes to prompts.

-SAVE <file> Save the current FW to an update image.

-FWVER <file> Display the FW Version of current FW or update image.

-ALLOWSV Allows same version firmware updates.

-FORCERESET Automatically Reboots system after update (if needed).

-OEMID <UUID> OEM ID needed to perform firmware update.

-GENERIC Perform the update through TXEI without credentials.

32 INTEL CONFIDENTIAL 4/9/21

 Appendix

33 INTEL CONFIDENTIAL
 mFlash Tool Set UP

34 INTEL CONFIDENTIAL 4/9/21

 Download Env. configure recommended

• PC Host
• Intel® core i5 (or better), 3GB RAM
• Windows™ win7 or XP SP3
• USB High Speed ports on PC main board
• Latest USB Driver (https
://mobilecommunicationsportal.intel.com)
• Possible customer specific driver

• Device:
• Full powered boards or phones (power supply at least 3.8V,
4.2V most)

35 INTEL CONFIDENTIAL 4/9/21

 Flash Image Tool - FITC

Summary
Host side tool used to create a complete firmware
image.
The output image is used for offline and in circuit
programming of the firmware into the NOR chip.

Features
 Graphical user interface to easily configure all the
parameters
 It can store changes made as a template to be used
on subsequent image creations

36 INTEL CONFIDENTIAL 4/9/21

 BYT Tools List

Tools Function Status

MAT tool Manual board test/function test 　
Provisioning tools Writing device specific date like SN, WiFi/BT Addr, Keybox
SPI NOR programming Solution & images to program SPI NOR 　
mFlashtool flashing binaries 　
Android
Manufact USB driver USB driver of host PC 　
uring TXE tool Security test and fuse tool , including TXEManuf, FPT, TXEInfo 　
tools
eMMC Offline 　
Solution & images to offline program eMMC
programming
RF calibration tool Modem RF calibration 　
Final test tool Modem RF test tool 　
Sound Designer Audio tuning tool
Phone flash tool Flashing tool
Android MPTA Logging tool
developm
ent tools MPPA PnP tool
GPA Graphics tool
Modem debug tool Include IMC Flashtool, RF cal, MA, etc.

37 INTEL CONFIDENTIAL 4/9/21