Abstract: A system and method for efficiently measuring on-die power supply voltage are described. In various implementations, an integrated circuit includes at least one or more processors and on-chip memory. The on-chip memory has a higher security level than off-chip memory. One of the one or more processors is designated as a security processor. During the processing of the multiple boot steps of a bootup operation, the security processor initializes a message queue in on-chip memory. The security processor also loads multiple modules from off-chip memory into the on-chip memory. The processor executes the multiple loaded modules in an order based on using the message queue to implement inter-module communication among the plurality of boot modules. The security processor transfers requested data between modules using messages from the modules and data storage of the message queue. The modules are completed without reloading any modules from off-chip memory.

Abstract: Techniques described herein provide users with the ability to persistently adjust settings for boot-time features (BTF) of a computing device. A user requests a particular BTF configuration adjustment for a device via a device driver. The driver instructs trusted firmware of the device to store a boot override record in persistent storage accessible by a bootloader for the device. Upon implementation of the boot sequence for the device, the bootloader applies the changes reflected in the record to BTF configuration data. The boot override information is persistently available to the bootloader, which ensures that the configuration changes that the boot override record(s) represent are applied to the BTFs of the device until the boot override record(s) are cleared or invalidated. Further, to ensure the security of boot override record(s), the trusted firmware generates, for each record, an HMAC tag using an HMAC key derived from a Chip Endorsement Fused Secret from the hardware.

Abstract: A system and method for efficiently performing a bootup operation are described. In various implementations, an integrated circuit includes at least one or more processors and on-chip memory. The on-chip memory has a higher security level than off-chip memory. One of the one or more processors is designated as a security processor. During the processing of the multiple boot steps of a bootup operation, the security processor receives one or more out of band (OOB) events that are not included in the bootup operation. The security processor initializes both an OOB queue and a main boot queue in the on-chip memory. The security processor stores boot steps of the bootup operation in the main boot queue and stores received OOB events in the OOB queue. The security processor executes at least one OOB event prior to completing the bootup operation.

Abstract: A system and method for efficiently measuring on-die power supply voltage are described. In various implementations, an integrated circuit includes at least one or more processors and on-chip memory. The on-chip memory has a higher security level than off-chip memory. One of the one or more processors is designated as a security processor. During the processing of the multiple boot steps of a bootup operation, the security processor initializes a message queue in on-chip memory. The security processor also loads multiple modules from off-chip memory into the on-chip memory. The processor executes the multiple loaded modules in an order based on using the message queue to implement inter-module communication among the plurality of boot modules. The security processor transfers requested data between modules using messages from the modules and data storage of the message queue. The modules are completed without reloading any modules from off-chip memory.

Abstract: Techniques described herein provide users with the ability to persistently adjust settings for boot-time features (BTF) of a computing device. A user requests a particular BTF configuration adjustment for a device via a device driver. The driver instructs trusted firmware of the device to store a boot override record in persistent storage accessible by a bootloader for the device. Upon implementation of the boot sequence for the device, the bootloader applies the changes reflected in the record to BTF configuration data. The boot override information is persistently available to the bootloader, which ensures that the configuration changes that the boot override record(s) represent are applied to the BTFs of the device until the boot override record(s) are cleared or invalidated. Further, to ensure the security of boot override record(s), the trusted firmware generates, for each record, an HMAC tag using an HMAC key derived from a Chip Endorsement Fused Secret from the hardware.