Wave Systems Corp. (fka WAVXQ)

[Dabears4]

Awk - if you have not already,

become familiar with the PCIe Trusted Configuration Space, it might be something you would want to check out.

I suspect this is the current/first incarnation of NGSCB (when it is combined with a TPM and the memory partitioning capabilities of LT).


http://download.microsoft.com/download/9/8/f/98f3fe47-dfc3-4e74-92a3-088782200fe7/TWAR05006_WinHEC05...

http://www.pcisig.com/specifications/pciexpress/specifications/ECN_Trusted_Configuration_Space_1jul2...

X.2. Example TCS/TSE Implementation685
--------------------------------------------------------------The Trusted Computing Group (TCG) has produced a specification for a trusted subsystem that can be used in platforms containing the necessary enabling hardware. (Seehttp://www.trustedcomputinggroup.org for more details.) One important hardware component required by that specification is the Trusted Platform Module (TPM).The TPM can optionally provide a number of general purpose input/output (GPIO) pins. Access to and control of these pins can be gated by the TPM’s rich access control semantics which include the ability to specify what software must be running in the Trusted Software Environment. TPM GPIOpins are in an asserted state when they are at low voltage.In this example, the root complex for a platform compliant with the v1.2 TCG specification provides a TCS_EN# pin as a mechanism to enable Trusted Configuration Space accesses. When the TCS_EN#695pin is deasserted (high), all accesses made to Trusted Configuration Space via the TCAM are ignored.Reads return all 1 bits.The system board for our example implementation would connect TPM GPIO pin 0 to the TCS_EN#pin of the root complex as illustrated in Figure X-1 below.700Figure X-1: Gating TCS Access Via TPMWhen software running in the TSE wishes to access Trusted Configuration Space, it would first issue a TPM_GPIO command to cause the TPM to assert TCS_EN# (drive it low) in order to enable themechanism. A v1.2 TPM can differentiate requests, and in particular TPM_GPIO command requests,that are sent by software running in the TSE, using a combination of TPM hardware and firmware705features. Using these features, the TPM would give access to GPIO pin 0 to only the software that has been authorized to access Trusted Configuration Space and would restrict the ability of unauthorizedsoftware to initiate TCS requests.