Intel Corporation

Shamanna M Datta

Mahesh S Natu

Mohan J Kumar

Murugasamy K Nachimuthu

Frank Binns

Scott T Durrant

Robert Charles Swanson

Rajesh S Parthasarathy

Alberto J Munoz

Baskaran Ganesan

Thanunathan Rangarajan

Vincent J Zimmer

Michael A Rothman

Stephen Anthony Fischer

Anna Trikalinou

Brent D Thomas

Daniel S Lake

Gautam Doshi

Rajesh Nagaraja Murthy

Mohamed Arafa

Asher M Altman

John K Grooms

Albert J Munoz

Rajesh S Parathasarathy

Techniques for tamper detection of a memory module having non-volatile memory devices resident on a printed circuit board (PCB) by circuitry of a controller also resident on the PCB. Examples include determining resistance values of a character pattern sprayed on a side of a cover facing the non-volatile memory devices using conductive ink following first and second boots of the memory module and asserting a bit of a register to indicate tampering of the memory modules based on a comparison of the resistance values. Tamper policy actions may be initiated based on detection of tampering.

Techniques for tamper detection and protection of a memory module

An interface is provided to update a firmware of a persistent memory module at runtime without restarting an operating system on the platform. The operating system initiates the firmware update by triggering a sleep state or by entering a soft reboot. The interface is capable of preserving the state of the platform for all memory modes that support volatile memory regions, persistent memory regions, or both, and reducing or eliminating the demand for access to memory during the firmware update. The persistent memory module is capable of updating the firmware responsive to a platform instruction generated using the interface, including preserving operational states for memory devices in all memory regions, including memory devices in volatile and persistent memory regions.

Runtime firmware activation for memory devices

Various embodiments are generally directed to the provision and use of various hardware and software components of a computing device to monitor the state of layered virtual machine (VM) monitoring software components. An apparatus includes a first processor element; and logic to receive an indication that a first timer has reached an end of a first period of time, monitor execution of a VMM (virtual machine monitor) watcher by a second processor element, determine whether the second processor element completes execution of the VMM watcher to verify integrity of a VMM before a second timer reaches an end of a second period of time, and transmit an indication of the determination to a computing device. Other embodiments are described and claimed.

Layered virtual machine integrity monitoring

Systems, apparatuses and methods may provide for receiving one or more debug communications and programming, via a bus, a set of debug registers with debug information corresponding to the one or more debug communications. Additionally, tunnel logic hardware may be instructed to transfer the debug information from the set of debug registers to one or more test access ports of an intelligent device such as a non-volatile memory storage unit having a microcontroller. In one example, if it is detected that debug permission has been granted during a boot process, a control status register may be unlocked. If, on the other hand, the debug permission is not detected during the boot process, the control status register may be locked. Accordingly, an enable bit of the control status register may be used to activate the tunnel logic hardware only if the control status register is unlocked.

Secure tunneling access to debug test ports on non-volatile memory storage units

An apparatus and method for hardware protection of a virtual machine monitor (VMM) runtime integrity watcher is described. A set of one or more hardware range registers that protect a contiguous memory space that is to store the VMM runtime integrity watcher. The set of hardware range registers are to protect the VMM runtime integrity watcher from being modified when loaded into the contiguous memory space. The VMM runtime integrity watcher, when executed, performs an integrity check on a VMM during runtime of the VMM.

Hardware protection of virtual machine monitor runtime integrity watcher

In one embodiment, the present invention includes a processor that has an on-die storage such as a static random access memory to store an architectural state of one or more threads that are swapped out of architectural state storage of the processor on entry to a system management mode (SMM). In this way communication of this state information to a system management memory can be avoided, reducing latency associated with entry into SMM. Embodiments may also enable the processor to update a status of executing agents that are either in a long instruction flow or in a system management interrupt (SMI) blocked state, in order to provide an indication to agents inside the SMM. Other embodiments are described and claimed.

Providing state storage in a processor for system management mode

Providing state storage in a processor for system management mode selectively enabled by register bit instead of external SMRAM

A method is described that includes detecting that a memory access of system management mode program code is attempting to reach program code outside of a protected region of memory by comparing a target memory address of a memory access instruction of the system management program code again information that defines confines of the protection region. The method also includes raising an error signal in response to the detecting.

Processor that detects when system management mode attempts to reach program code outside of protected space

A technique to verify firmware. One embodiment of the invention uses a processor's micro-code to verify a system's firmware, such that the firmware can be included in a trusted chain of code along with the operating system.

Technique for providing secure firmware

Methods and apparatus for initiating secure operations in a microprocessor system are described. In one embodiment, a system includes a processor to execute a secured enter instruction, and a chipset to cause the system to enter a quiescent state during execution of the secured enter instruction.

Execution of a secured environment initialization instruction on a point-to-point interconnect system

Methods and systems to perform platform security in conjunction with hardware-base root of trust logic are presented. In one embodiment, a method includes determining whether a status from an authenticated code module is indicative of an error or not. The method further includes determining whether the hardware-based root of trust logic is enabled based on content in a non-volatile memory location. If the hardware-based root of trust is enabled and the status is indicative of an error, the method further includes writing to the non-volatile memory location to disable hardware-based root of trust logic during a next boot sequence. In one embodiment, a platform initializes and uses the trusted platform module in conjunction with the hardware-based root of trust logic or with a platform-based root of trust logic.

Methods and apparatuses for recovering usage of trusted platform module

An apparatus and method for hardware protection of a virtual machine monitor (VMM) runtime integrity watcher is described. A set of one or more hardware range registers that protect a contiguous memory space that is to store the VMM runtime integrity watcher. The set of hardware range registers are to protect the VMM runtime integrity watcher from being modified when loaded into the contiguous memory space. The VMM runtime integrity watcher, when executed, performs an integrity check on a VMM during runtime of the VMM. Execution of the VMM runtime integrity watcher is triggered by a timer event generated based on multiple frequency bands.

Growing community of inventors

Hillsboro, OR, United States of America

Shamanna M Datta