Firmware verification mechanism
An apparatus to verify firmware in a computing system, comprising a non-volatile memory, including firmware memory to store agent firmware associated with each of a plurality of interconnect protocol (IP) agents and version memory to store security version numbers (SVNs) included in the agent firmware, a security controller comprising verifier logic to verify an integrity of the version memory by applying a hash algorithm to contents of the version memory to generate a SVN hash, and a trusted platform module (TPM) to store the SVN hash.
1 . An apparatus comprising:
non-volatile memory coupled to processing circuitry, the non-volatile memory comprising:
firmware memory to store agent firmware associated with an interconnect protocol (IP) agent;
version memory to store security version numbers (SVNs) included in the agent firmware;
a security controller to examine a breadcrumb token indicating an IP agent having a version number that is to be updated and store a SVN in the version memory upon determining that the identifier indicates that the version number is to be updated, wherein the security controller to facilitate storing the SVN upon validating the agent firmware.
2 . The apparatus of claim 1 , further comprising a storage register to store the breadcrumb token.
3 . The apparatus of claim 2 , wherein the storage register comprises a persistent storage accessible by a basic input output system (BIOS) and an operating system.
4 . The apparatus of claim 1 , wherein the security controller is further to generate a SVN hash of the contents of the version memory.
5 . The apparatus of claim 4 , further comprising a trusted platform module (TPM) to store the SVN hash.
6 . The apparatus of claim 4 , wherein the security controller is further to verify integrity of the version memory by generating a check hash of the contents of the version memory and comparing the check hash to the SVN hash.
7 . The apparatus of claim 6 , wherein the security controller is further to verify the integrity of the agent firmware upon determining that the check hash matches the SVN hash.
8 . The apparatus of claim 1 , wherein the security controller is further to facilitate storing the SVNs store the SVN at the version memory upon storing the agent firmware in the firmware memory, the processing circuitry comprising application processing circuitry.
9 . At least one non-transitory computer readable medium having stored thereon instructions which, when executed, cause a computing device to perform operations comprising:
receiving agent firmware including a security version number (SVN);
examining a breadcrumb token indicating an interconnect protocol (IP) agent having a version number that is to be updated; and
storing the SVN in version memory of non-volatile memory of the computing device upon determining that the identifier indicates that the version number is to be updated, and further storing the SVN upon validating agent firmware.
10 . The non-transitory computer readable medium of claim 9 , wherein the operations further comprise:
generating a SVN hash of the contents of the version memory; and
storing the SVN hash.
11 . The non-transitory computer readable medium of claim 10 , wherein the operations further comprise:
generating a check hash of the contents of the version memory; and
comparing the check hash to the SVN hash.
12 . The non-transitory computer readable medium of claim 11 , wherein verifying the integrity of the agent firmware further comprises determining that the check hash matches the SVN hash.
13 . The non-transitory computer readable medium of claim 9 , wherein the operations further comprise storing the SVN at the version memory upon storing the received agent firmware in firmware memory of the non-volatile memory coupled with processing circuitry having application processing circuitry.
14 . A method comprising:
receiving agent firmware including a security version number (SVN);
examining a breadcrumb token indicating an interconnect protocol (IP) agent having a version number that is to be updated; and
storing the SVN in version memory of non-volatile memory of the computing device upon determining that the identifier indicates that the version number is to be updated, and further storing the SVN upon validating agent firmware.
15 . The method of claim 14 , further comprising:
generating a SVN hash of the contents of the version memory; and
storing the SVN hash.
16 . The method of claim 15 , further comprising:
generating a check hash of the contents of the version memory; and
comparing the check hash to the SVN hash.
17 . The method of claim 16 , wherein verifying the integrity of the agent firmware further comprises determining that the check hash matches the SVN hash.
18 . The method of claim 17 , wherein the operations further comprise storing the SVN at the version memory upon storing the received agent firmware in firmware memory of the non-volatile memory coupled with processing circuitry having application processing circuitry.