Intel Corporation

Krishnakumar Narasimhan

Karunakara Kotary

Nicholas J Adams

Vincent J Zimmer

David M Durham

Siddhartha Chhabra

Prashant Dewan

Reouven Elbaz

Brett P Wang

Sudhakar Otturu

Ashish Hira

Technologies for secure memory usage include a computing device having a processor that includes a memory encryption engine and a memory device coupled to the processor. The processor supports multiple processor usages, such as secure enclaves, system management firmware, and a virtual machine monitor. The memory encryption engine is configured to protect a memory region stored in the memory device for a processor usage. The memory encryption engine restricts access to one or more configuration registers to a trusted code base of the processor usage. The processor executes the processor usage and the memory encryption engine protects contents of the memory region during execution. The memory encryption engine may access integrity metadata based on the address of the protected memory region. The memory encryption engine may prepare top-level counter metadata for entering a low-power state. Other embodiments are described and claimed.

Technologies for a memory encryption engine for multiple processor usages

A computing device that implements a secure and transparent firmware update process is provided. The computing device includes a secure memory area and a secure device that separately executes firmware updates in parallel with other processes executed by a CPU. The secure memory area may be allocated by the CPU and/or a memory controller using any of a variety of memory protection techniques. System software executed by the CPU receives update firmware requests from a trusted source, stores a firmware payload included in these requests in the secure memory area, and executes the next scheduled process. Firmware executed by the secure device retrieves the firmware payload from the secure memory area, authenticates the firmware payload, and applies the firmware payload to a firmware storage device. The secure device performs these acts transparently from the point of view of the CPU, these avoiding consumption of resources of the CPU.

Secure firmware devices and methods

Technologies for performing a secure firmware update include a compute device that includes a memory device to store firmware update payload, one or more devices that have direct memory access (DMA) to the memory, a DMA remap module, and a firmware update module. The DMA remap module is to create a memory isolation domain for each of the one or more devices. Each memory isolation domain comprises a physical address space in the memory that is mutually exclusive to the physical address spaces of the other memory isolation domains. The firmware update module is to (i) analyze the firmware update payload to identify one or more of the devices associated with the firmware update payload and (ii) move the firmware update payload to the memory isolation domains of each associated device to enable secure transmission of the firmware update payload to the associated devices.

Technologies for securing a firmware update

Technologies for secure hybrid standby power management include a computing device with a processor supporting low-power idle standby. An operating system writes a power management sleep request, such as an ACPI S3 request, to a power management control register of the computing device. The processor traps the write to the power management control register and executes a firmware sleep mapper that causes the processor to enter an idle standby power state such as S0ix. The firmware sleep mapper may be included in a firmware isolated memory region. The address of the firmware sleep mapper may be included in a model-specific register of the processor. The processor may verify the firmware sleep mapper before execution. In response to a wake event, the processor resumes the firmware sleep mapper, which switches the processor to real mode and jumps to a waking vector of the operating system. Other embodiments are described and claimed.

Technologies for secure hybrid standby power management

A mechanism is described for facilitating dynamic capsule generation and recovery in computing environments according to one embodiment. A method of embodiments, as described herein, includes accessing a current firmware and a capsule driver binary file ('capsule file') from a storage device, and merging the current firmware with the capsule file and a capsule header into a capsule payload. The method may further include assigning a security protocol to the capsule payload to ensure a secured capsule payload, and storing the secured capsule payload at the storage device for subsequent updates.

Dynamic capsule generation and recovery in computing environments

Apparatuses, methods and storage medium associated with provision of power management data packages are disclosed herein. In embodiments, an apparatus may include one or more processors, memory to store a power management data package having a first plurality of descriptions of always present fixed platform devices and a second plurality of descriptions of potentially present variable platform devices; and firmware coupled with the one or more processors and memory to provide basic input/output services to an operating system operated by the one or more processors, wherein the operating system has an operational requirement for the power management data package. The basic input/output services may include a service to modify the power management data package to bring the power management data package into compliance with the operational requirement of the operating system. Other embodiments may be described and/or claimed.

Growing community of inventors

Hillsboro, OR, United States of America

Krishnakumar Narasimhan