Intel Corporation

Palsamy Sakthikumar

Vincent J Zimmer

Robert Charles Swanson

Mallik Bulusu

Michael A Rothman

Ramamurthy Krithivas

David C Estrada

Sarathy Jayakumar

James Steven Burns

Robert Bruce Bahnsen

Eswaramoorthi Nallusamy

Gopal R Mundada

Various embodiments are directed to creating multiple device blocks associated with hardware devices, arranging the device blocks in an order indicative of positions of the hardware devices in a hierarchy of buses and bridges, and enabling access to the multiple device blocks from an operating system. An apparatus comprises a processor circuit and storage storing instructions operative on the processor circuit to create a device table comprising multiple device blocks, each device block corresponding to one of multiple hardware devices accessible to the processor circuit, the device blocks arranged in an order indicative of relative positions of the hardware devices in a hierarchy of buses and at least one bridge device; enable access to the device table by an operating system; and execute a second sequence of instructions of the operating system operative on the processor circuit to access the device table. Other embodiments are described and claimed herein.

Communication of device presence between boot routine and operating system

Methods and apparatus related to sharing Serial Peripheral Interface (SPI) flash memory in a multi-node server SoC (System on Chip) platform environment are described. In one embodiment, multi-port non-volatile memory is shared by a plurality of System on Chip (SoC) devices. Each of the plurality of SoC devices comprises controller logic to control access to the multi-port non-volatile memory and/or to translate a host referenced address of a memory access request to a linear address space and a physical address space of the multi-port non-volatile memory. Other embodiments are also disclosed and claimed.

Sharing serial peripheral interface flash memory in a multi-node server system on chip platform environment

An apparatus includes a memory that is accessible by an operating system; and a basic input/output system (BIOS) handler. The BIOS handler, in response to detected malicious software activity, stores data in the memory to report the activity to the operating system.

Reporting malicious activity to an operating system

In accordance with some embodiments, a single trusted platform module per platform may be used to handle conventional trusted platform tasks as well as those that would arise prior to the existence of a primary trusted platform module in conventional systems. Thus one single trusted platform module may handle measurements of all aspects of the platform including the baseboard management controller. In some embodiments, a management engine image is validated using a read only memory embedded in a chipset such as a platform controller hub, as the root of trust. Before the baseboard management controller (BMC) is allowed to boot, it must validate the integrity of its flash memory. But the BMC image may be stored in a memory coupled to a platform controller hub (PCH) in a way that it can be validated by the PCH.

Measuring platform components with a single trusted platform module

Methods and apparatus are disclosed to improve system boot speed. A disclosed example method includes associating a first serial peripheral interface (SPI) with a baseboard management controller (BMC), copying an image from the first SPI to a volatile memory in response to receiving power at the BMC, and in response to receiving an access request associated with the first SPI, providing access to the image stored in the volatile memory.

System and apparatus to improve boot speed in serial peripheral interface system using a baseboard management controller

Generally, this disclosure provides methods and systems for secure data protection with improved read-only memory locking during system pre-boot including protection of Advanced Configuration and Power Interface (ACPI) tables. The methods may include selecting a region of system memory to be protected, the selection occurring in response to a system reset state and performed by a trusted control block (TCB) comprising a trusted basic input/output system (BIOS); programming an address decoder circuit to configure the selected region as read-write; moving data to be secured to the selected region; programming the address decoder circuit to configure the selected region as read-only; and locking the read-only configuration in the address decoder circuit.

Secure data protection with improved read-only memory locking during system pre-boot

A method, system and computer-readable storage medium with instructions to migrate full-disk encrypted virtual storage between blade servers. A key is obtained to perform an operation on a first blade server. The key is obtained from a virtual security hardware instance and provided to the first blade server via a secure out-of-band communication channel. The key is migrated from the first blade server to a second blade server. The key is used to perform hardware encryption of data stored on the first blade server. The data are migrated to the second blade server without decrypting the data at the first blade server, and the second blade server uses the key to access the data. Other embodiments are described and claimed.

Migration of full-disk encrypted virtualized storage between blade servers

A method, apparatus, system, and computer program product for secure server system management. A payload containing system software and/or firmware updates is distributed in an on-demand, secure I/O operation. The I/O operation is performed via a secured communication channel inaccessible by the server operating system to an emulated USB drive. The secure communication channel can be established for the I/O operation only after authenticating the recipient of the payload, and the payload can be protected from access by a potentially-infected server operating system. Furthermore, the payload can be delivered on demand rather than relying on a BIOS update schedule, and the payload can be delivered at speeds of a write operation to a USB drive.

Demand based USB proxy for data stores in service processor complex

A network interface card with read-only memory having at least a micro-kernel of a cluster computing operation system, a server formed with such network interface card, and a computing cluster formed with such servers are disclosed herein. In various embodiments, on transfer, after an initial initialization phase during an initialization of a server, the network interface card loads the cluster computing operation system into system memory of the server, to enable the server, in conjunction with other similarly provisioned servers to form a computing cluster. Other embodiments are also disclosed and claimed.

Cluster computing&#x2014;NIC based OS provision

Memory reconfiguration during system run-time is described. In one example, a system includes a memory slot to carry a memory board and to connect the memory board to a memory controller for read and write operations, a logic device having a plurality of status registers to record the status of the memory slot and a plurality of control registers to control the operation of the memory slot, and a bus interface coupled through direct signal lines to the memory slot to communicate status and control signals with the memory slot and coupled through a serial bus to the logic device to communicate status and control signals with the logic device.

Logic device having status and control registers for recording the status and controlling the operation of memory slots such that each memory slot is identified using a bus address and port number

A software-defined radio (SDR) capability may be provided in a general purpose, many core processing system by sequestering one or more partitions running on one or more cores and instantiating a communications capability by having discrete SDR functions performed by the sequestered partitions. Each SDR module embodied in a sequestered partition may be independently upgraded without modifying the hardware of the underlying processing system. By executing SDR modules in cores not accessible by application programs and/or an operating system (OS), a better Quality of Service (QoS) may be provided for wireless communications on the general purpose, multi-core processing system. An embodiment comprises isolating a core of a many core processing system as a sequestered partition, loading a software-defined radio module onto the core, and executing the software-defined module to implement wireless communications.

Software-defined radio support in sequestered partitions

Techniques and architectures to provide high assurance image invocation in a pre-boot environment. These techniques may augment implementations of the Unified Extensible Firmware Interface (UEFI) to invoke UEFI images using Trusted Execution Technology (TXT). This can operate to combine pre-boot secure flows, such as UEFI image invocation, with the secure launch instruction set extensions of TXT. This may entail combination of the UEFI StartImage instruction with the SMX leaf SENTER instruction. This may operate to allow original equipment manufacturer (OEM) firmware as a guard and that uses UEFI and TXT access control logic at the same instance to pass control to the operating system (OS).

Enhanced network and local boot of Unified Extensible Firmware Interface images

A method, apparatus, system, and computer program product for multi-owner deployment of firmware images. The method includes obtaining a signed firmware image that comprises a first code module signed by a first code owner and a second code module signed by a second code owner. The method further includes obtaining an updated first code module comprising updated code for the first code module, verifying that the updated first code module is signed by the first code owner, and updating the signed firmware image with the updated first code module in response to verifying that the updated first code module is signed by the first code owner. The signed firmware image may further comprise an access control list that authorizes updates to the first code module by the first code owner and updates to the second code module by the second code owner.

Multi-owner deployment of firmware images

Radio frequency identification (RFID) tags embedded in processors within a computing system provide a separate communication path to other components of the computing system during initialization processing, apart from the system interconnect. Upon powering up, each processor causes its RFID tag to broadcast data regarding the processor's interconnect location and initialization status. A RFID receiver senses the RFID tags in the Platform Control Hub (PCH), and each processor's interconnect location and initialization status data is stored in registers within the PCH. During system initialization processing, the BIOS accesses these PCH registers to obtain the processor's data. The interconnect location and initialization status data is used by the BIOS to select the optimal routing table and configure the virtual network within the computing system based on the optimal routing table and the RFID tag data, without interrogating each processor individually over the system interconnect.

Growing community of inventors

Puyallup, WA, United States of America

Palsamy Sakthikumar