Intel Corporation

Other

Sham M Datta

Mohan J Kumar

Vincent J Zimmer

Ernie F Brickell

Mani Ayyar

James A Sutton, Ii

Mahesh S Natu

Ioannis T Schoinas

Andrew J Fish

Michael A Rothman

Martin Guy Dixon

James P Kardach

Scott Dion Rodgers

Robert J Greiner

Stephen S Pawlowski

Sarathy Jayakumar

Kirk D Brannock

William A Stevens, Jr

James Paul Held

Scott H Robinson

Sailesh Kottapalli

Kushagra V Vaid

Allen Jay Baum

Rajesh S Parthasarathy

Suresh K Marisetty

James R Vash

Frank Binns

Douglas Raymond Moran

Amy L Santoni

Yan Li

Ernest F Brickell

Keshavan K Tiruvallur

Anna Trikalinou

Scott P Bobholz

Daniel S Lake

George Thangadurai

Larry O Smith

Asher M Altman

Madhavan Parthasarathy

John K Grooms

Jeff Wiedemeier

Amy L O'Donnell

Jayesh M Joshi

Andy Miga

Bill Alexander

Maheeh Natu

Technologies disclosed herein provide mitigations against warm boot attacks on memory modules. For instance, in one embodiment, a non-volatile dual in-line memory module (NVDIMM) in a host computing system may detect a transition from a low-power state to a full-power state, receive a nonce value from a processor of the host computing system after the transition, verify the nonce value, and allow access to data stored on the NVDIMM based on successful verification of the nonce value. In another embodiment, an NVDIMM may be locked in response to detecting a transition from a high-power state to a low-power state in a host computing system. After a transition from the low-power state to the full-power state, the NVDIMM may obtain one or more passphrases, verify the one or more passphrases, and allow access to data stored on the NVDIMM based on successful verification of the one or more passphrases.

Warm boot attack mitigations for non-volatile memory modules

Systems, apparatuses, and methods, and for entering a secured system environment using multiple authenticated code modules are disclosed. In one embodiment, a processor includes a decoder and control logic. The decoder is to decode a secured enter instruction. The control logic is to find an entry corresponding to the processor in a match table in a master authenticated code module and to read a master header and an individual authenticated code module from the master authenticated code module in response to decoding the secured enter instruction.

Entering a secured computing environment using multiple authenticated code modules

Apparatuses, methods, and systems for reconfiguring a secure system are disclosed. In one embodiment, an apparatus includes a configuration storage location, a lock, and lock override logic. The configuration storage location is to store information to configure the apparatus. The lock is to prevent writes to the configuration storage location. The lock override logic is to allow instructions executed from sub-operating mode code to override the lock.

Reconfiguring a secure system

In an embodiment, memory access requests for information stored within a system memory pass through an integrated circuit. The system memory may include a micro-architectural memory region to store instructions and/or data, where the micro-architectural memory region is to be exclusively accessible by a micro-architectural agent The integrated circuit may include memory access director to direct memory access requests to the micro-architectural memory region if the memory access director determines that the memory access request includes a location within the at least one micro-architectural memory region and the micro-architectural agent is operating in a micro-architectural memory region access mode.

Apparatus and method for directing micro architectural memory region accesses

Apparatuses, methods, and systems for enabling system management mode in a secure system are disclosed. In one embodiment, a processor includes sub-operating-system mode logic, virtual machine logic, and control logic. The sub-operating-system mode logic is to support a sub-operating-system mode. The virtual machine logic is to support virtualization. The control logic is to prevent virtualization from being enabled when the sub-operating-system mode is disabled.

Enabling system management mode in a secure system

Apparatus and systems, as well as methods and articles, may operate to detect an input/output access operation associated with a configuration memory address and a first memory address bit size. The configuration memory address and associated configuration data may be combined into a packet having a second memory address bit size (e.g., 64 bits) greater than the first memory address bit size (e.g., 32 bits). The packet may be used to establish compatibility for legacy operating systems that attempt to communicate with peripheral component interconnect (PCI) interface-based peripherals, and similar platform devices, that have been integrated into the same package as the processor.

Address space emulation

Systems and methods for enabling Reliability, Availability & Serviceability features after launching a secure environment under the control of LaGrande Technology (LT), or comparable security technology, without compromising security are provided. In one embodiment, the method comprises adding at least one specific capability to a processor to enable at least one of CPU hot-plug, CPU migration, CPU hot removal and capacity on demand.

Supporting advanced RAS features in a secured computing system

Multi-node and multi-processor security management is described in this application. Data may be secured in a TPM of any one of a plurality of nodes, each node including one or more processors. The secured data may be protected using hardware hooks to prevent unauthorized access to the secured information. Security hierarchy may be put in place to protect certain memory addresses from access by requiring permission by VMM, OS, ACM or processor hardware. The presence of secured data may be communicated to each of the nodes to ensure that data is protected. Other embodiments are described.

Security management in multi-node, multi-processor platforms

Embodiments of the invention provide systems and methods associated with a measurement engine in a server platform. In one such embodiment of the invention, the measurement engine hardware verifies/authenticates its own firmware and then system initialization firmware by measuring such firmware and storing measurement results in a register that is not spoofable by malicious code. In this instance, the measurement engine holds the host CPU complex in a reset state until the measurement engine has verified the system initialization firmware. In another such embodiment of the invention, the measurement engine hardware also measures firmware associated with one or more system service processors and stores such measurement results in a register. In this case, the measurement engine holds the system service processors and the host CPU complex in reset until the measurements are completed. Other embodiments are described.

System and method for establishing a trust domain on a computer platform

A method includes determining a plurality of memory addresses, each memory address being different from one another. The method further includes generating a plurality of system management interrupt interprocessor interrupts, each system management interrupt interprocessor interrupt having a corresponding processor in a plurality of processors in a system and each system management interrupt interprocessor interrupt including one of the plurality of memory addresses. The method further includes directing each system management interrupt interprocessor interrupt to the corresponding processor. An associated machine readable medium is also disclosed.

Methods and apparatus for generating system management interrupts

A boot routine is initialized in a computer by bootstrapping a volume top file (VTF) located in a first addressable location accessible upon the initializing of the boot routine and the volume top file bootstrapping a set of firmware modules.

Method and apparatus for using a volume top file to boot firmware modules

In one embodiment, a computer boot method allows choosing a predetermined data block alignment for a cache that has multiple cross processor interactions. A cache RAM column of a cache as RAM system is loaded with a tag to prevent unintended cache line evictions, and boot code is executed, with the preloaded cache RAM appearing to the executing boot code stream as a memory store.

Processor cache memory as RAM for execution of boot code

Methods and apparatus to reinitiate failed processors in multiple-processor systems are described herein. In an example method, a failure associated with a first processor of a plurality of processors in a multiple-processor system is detected by a second processor of the plurality of processors. In response to detection of the failure associated with the first processor, the second processor restores the first processor.

Methods and apparatus to reinitiate failed processors in multiple-processor systems

Growing community of inventors

Hillsboro, OR, United States of America

Sham M Datta