Flags

Flags define the acceptance behavior of a token.

• Globally valid

  Disables the validation of the token’s part ID(s). The token can be applied to any platform.

  Note:

  Globally valid feature is only applicable to OEM tokens.

• No anti-replay

  Disables the validation of the part ID’s ‘nonce’ field. Every time the firmware generates a new part ID, the stored nonce field is updated. If no anti-replay has been set, a token is still valid even the nonce field on the platform has changed.

  Note:

  Anti-replay with Expiration is the most secure setting as it prohibits the same token from being re-used. A token with no anti-replay set is not invalidated by requesting a new Part ID.

• No expiration

  The token does not expire.

  Note:

  Non expiration requires no anti-replay to be set as well.

Expiration

The time after a token expires in seconds beginning from the time the Part ID has been generated.

Part ID (a.k.a. Part Data or PID)

The Part ID is a function of a Platform identifier, nonce and time base. It defines where the token can be applied. Unless configured differently using flags, the Part ID is verified by the Intel® CSME firmware to ensure the token is (still) valid and has been created for the associated platform instance.

A Part ID is generated by the Intel® CSME Firmware on request. Intel® System Debugger supports to request the Part ID from the running platform’s firmware via Intel® DCI. In future releases Intel® System Debugger plans to support HECI and Intel® Download and Execute (Intel® DnX) for this purposes as well. It is not supported to manually create Part IDs, but if available an existing Part ID can be reused and provided to the tool. Check the Token’s Guide in Intel® CSME firmware kit on how to get Part ID, if not using the Intel® System debugger.

Unlock State of the System

The unlock state maps the hardware stored system debug state to a human-readable format. The detailed status can be obtained while being connected using hotham.loader.dscp.get_​dfx_​state().