Secure boot sequence for selectively disabling configurable communication paths of a multiprocessor fabric
Disabling communication in a multiprocessor fabric. The multiprocessor fabric may include a plurality of processors and a plurality of communication elements and each of the plurality of communication elements may include a memory. A configuration may be received for the multiprocessor fabric, which specifies disabling of communication paths between one or more of: one or more processors and one or more communication elements; one or more processors and one or more other processors; or one or more communication elements and one or more other communication elements. Accordingly, the multiprocessor fabric may be automatically configured in hardware to disable the communication paths specified by the configuration. The multiprocessor fabric may be operated to execute a software application according to the configuration.
1. A system, comprising:
a multiprocessor fabric, wherein the multiprocessor fabric comprises elements that include a plurality of processors and a plurality of communication elements;
configuration logic, wherein the configuration logic is configured to:
receive a configuration for the multiprocessor fabric, wherein the configuration specifies disabling of communication paths between ones of the elements of the multiprocessor fabric; and
automatically configure the multiprocessor fabric to disable the communication paths specified by the configuration, wherein after said automatically configuring, the disabled communication paths are not restorable via software;
wherein, after said configuration, the multiprocessor fabric is configured to execute a software application while operating according to the configuration.
2. The system of claim 1 , wherein the system is configured to restore the disabled communication paths in response to a hardware reset.
3. The system of claim 1 , wherein the system includes:
decryption circuitry configured to decrypt encrypted program code for at least a portion of the software application;
wherein execution of the software application includes execution of at least a portion of the decrypted program code.
4. The system of claim 3 , wherein the decryption circuitry, the multiprocessor fabric, and the configuration logic are implemented on a single integrated circuit.
5. The system of claim 3 , further comprising:
authentication circuitry configured to authenticate a source of the program code.
6. The system of claim 5 , wherein the decryption circuitry, the authentication circuitry, the multiprocessor fabric, and the configuration logic are implemented on a single integrated circuit.
7. The system of claim 5 , further comprising:
one or more non-volatile storage elements configured to store:
instructions that specify a secure boot sequence that begins automatically in response to a hardware reset, loads the program code, and includes the automatically configuring;
one or more decryption keys used by the decryption circuitry; and
authentication information used or generated by the authentication circuitry.
8. The system of claim 1 , wherein system is further configured to, after a hardware reset:
receive a reconfiguration for the multiprocessor fabric, wherein the reconfiguration specifies disabling of a different set of communication paths between ones of the elements of the multiprocessor fabric than a set of disabled communication paths prior to the hardware reset;
authenticate a source of the reconfiguration; and
based on the authentication, automatically reconfigure the multiprocessor fabric to disable the communication paths specified by the reconfiguration.
9. The system of claim 1 , wherein system is further configured to, after a hardware reset:
receive an encrypted reconfiguration for the multiprocessor fabric, wherein the encrypted reconfiguration specifies disabling of a different set of communication paths between ones of the elements of the multiprocessor fabric than a set of disabled communication paths prior to the hardware reset;
decrypt the encrypted reconfiguration; and
based on the decrypted reconfiguration, automatically reconfigure the multiprocessor fabric to disable the communication paths specified by the reconfiguration.
10. A method, comprising:
receiving, by configuration logic, a configuration for a multiprocessor fabric, wherein the multiprocessor fabric comprises elements that include a plurality of processors and a plurality of communication elements, wherein the configuration specifies disabling of communication paths between ones of the elements of the multiprocessor fabric;
automatically configuring, by the configuration logic, the multiprocessor fabric to disable the communication paths specified by the configuration, wherein after said automatically configuring, the disabled communication paths are not restorable via software; and
operating the multiprocessor fabric to execute a software application while operating according to the configuration.
11. The method of claim 10 , wherein the disabled communication paths are restored in response to a hardware reset.
12. The method of claim 10 , further comprising:
decrypting, by decryption circuitry, encrypted program code for at least a portion of the software application;
wherein executing the software application includes executing at least a portion of the decrypted program code.
13. The method of claim 12 ; wherein the decryption circuitry, the multiprocessor fabric, and the configuration logic are implemented on a single integrated circuit.
14. The method of claim 12 , further comprising:
authenticating, by authentication circuitry, a source of the program code.
15. The method of claim 14 , wherein the decryption circuitry, the authentication circuitry, the multiprocessor fabric, and the configuration logic are implemented on a single integrated circuit.
16. The method of claim 14 , further comprising:
storing, by one or more non-volatile storage elements:
instructions that specify a secure boot sequence that begins automatically in response to a hardware reset, loads the program code, and includes the automatically configuring;
one or more decryption keys used by the decryption circuitry; and
authentication information used or generated by the authentication circuitry.
17. The method of claim 10 , further comprising, after a hardware reset:
receiving a reconfiguration for the multiprocessor fabric, wherein the reconfiguration specifies disabling of a different set of communication paths between ones of the elements of the multiprocessor fabric than a set of disabled communication paths prior to the hardware reset;
authenticating a source of the reconfiguration; and
based on the authentication, automatically reconfiguring the multiprocessor fabric to disable the communication paths specified by the reconfiguration.
18. The method of claim 10 , further comprising, after a hardware reset:
receiving an encrypted reconfiguration for the multiprocessor fabric, wherein the encrypted reconfiguration specifies disabling of a different set of communication paths between ones of the elements of the multiprocessor fabric than a set of disabled communication paths prior to the hardware reset;
decrypting the encrypted reconfiguration; and
based on the decrypted reconfiguration, automatically reconfiguring the multiprocessor fabric to disable the communication paths specified by the encrypted reconfiguration.