Intel® CSE Secure Boot (Type 0x10) Rules

1. There can be more than one Intel® CSE Secure Boot entries in the FIT, the order of these entries in the FIT table is not important.
2. The CSE created FIT table would have the OEM Key Manifest and OEM Boot Policy Manifest entries in it.
3. The Reserved field in the FIT table (refer to Table1) will be used to further distinguish the type:

0 = Reserved

1 = Key Hash 1

2 = CSE Measurement Hash

3 = Boot Policy

4 = Other Boot Policy

5 = OEM SMIP

6 = MRC Training Data

7 = IBBL Hash

8 = IBB Hash

9 = OEM ID

10 = OEM SKU ID

11 = Boot Device Indicator(1= SPI, 2= eMMC, 3 = UFS, else are reserved)

12 = FIT Patch Manifest (FPM)

13 = AC Module Manifest (ACMM)

14 onwards = Reserved

The OEM SMIP, MRC Training Data and IBB Hash, are not present in the initial SRAM map, but will be placed in the shared SRAM later (after Ring Buffer protocol is done) for IBBL to consume. This use of the Reserved field does not interfere in any way with the CPU microcode operation.

4. The Version field should be set to 0x0100.
5. The C_​V bit in this entry should be clear.
6. The Checksum field is set to 0.