Intel Corporation

Aditya Katragada

Prashant Dewan

Uttam K Sengupta

Karunakara Kotary

Peter Munguia

Nivedita Aggarwal

Gregg Lahti

Mohamed Haniffa

Vinupama Godavarthi

Kenji Chen

Chao B Zhang

Purushottam Goel

Michael Neve De Mevergnies

Enrico David Carrieri

Kumar Narasimhan Dwarakanath

Chao Zhang

Neel Piyush Shah

Andrzej Mialkowski

Kar Leong Wong

Jonathan Mark Lutz

Maciej Kusio

Alex Izbinsky

Bhavana Prabhakar

Techniques are described for providing consistent memory operations and security across electronic circuitry components having disparate memory and/or security architectures when integrating such disparately architected components within a single system, such as a system on chip. A programmable logical hierarchy of isolated memory region (IMR) enforcement circuits is provided to protect such IMRs, allowing or preventing memory access requests from one of multiple distinct circuitry components based on configuration registers for the IMR enforcement circuits. Integration of multiple trust domain architectures associated with the multiple distinct circuitry components is facilitated via trust domain conversion bridge circuitry that includes translation logic for generating information in accordance with a first trust domain architecture based on information provided in accordance with a distinct second trust domain architecture.

Integration of disparate system architectures using configurable isolated memory regions and trust domain conversion bridge

An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.

Firmware verification mechanism

An apparatus to collect firmware measurement data at a computing system is disclosed. The apparatus includes a plurality of agents, each including a non-volatile memory storing firmware executed to perform a function associated with the agent, verification logic to generate measurement data by verifying the integrity of the firmware and a register to store the measurement data, and a processor to execute an instruction to collect firmware measurement data from each of the plurality of agents.

Platform measurement collection mechanism

An apparatus to implement an IP independent secure firmware load into an IP agent without a ROM to establish hardware root of trust is disclosed. The apparatus includes a plurality of agents, at least one agent including an isolated memory region accessible only to a trusted entity of the at least one agent and a main memory, and a processor to allocate a section of the isolated memory region of the at least one agent, verify a first stage firmware module, the first stage firmware module comprising instructions to enable the at least one agent to load and verify a second stage firmware module, place the first stage firmware module into memory of the at least one agent without a ROM to establish the hardware root of trust.

Non-ROM based IP firmware verification downloaded by host software

A processor that was manufactured by a manufacturer comprises privileged debug operational circuitry, a debug restriction fuse, a credential store, a credential of the manufacturer in the credential store, and debug control circuitry. The debug restriction fuse is a one-time programmable fuse. The debug control circuitry is to automatically restrict access to the privileged debug operational circuitry, based on the debug restriction fuse. The processor may also include public debug operational circuitry, a prevent-unauthorized-debug (PUD) fuse, and an undo-PUD fuse. When the PUD fuse is set and the undo-PUD fuse is clear, the debug control circuitry may respond to an attempt by a debugger to use the public debug operational circuitry by determining whether the debugger is authorized, disallowing access if the debugger is not authorized, and allowing access if the debugger is authorized. Other embodiments are described and claimed.

Technology for controlling access to processor debug features

There is disclosed in one example, a system-on-a-chip (SoC), including: a processor core; a fabric; an intellectual property (IP) block communicatively coupled to the processor core via the fabric, the IP block having a microcontroller configured to provide a microcontroller architecture; a firmware load interface configured to provide a standardized hardware interface to the microcontroller architecture, wherein the standardized hardware interface provides an architecture-agnostic mechanism to securely load a firmware to the intellectual property block; and logic to provide a loader to load a firmware to the IP block via the firmware load interface.

Standardized interface for intellectual property blocks

Growing community of inventors

Austin, TX, United States of America

Aditya Katragada