Multi-chiplet trusted execution environment (TEE)

Abstract

Aspects of a multi-chiplet trusted execution environment (TEE) in a multi-chiplet architecture are described. A first chiplet receives a signal indicating creation of a TEE domain at a second chiplet in response to a process executed on the second chiplet. An identifier for the TEE domain is obtained based on the signal. Subsequently, a request associated with the TEE domain is received and verified using the obtained identifier. Upon successful verification, the request is executed. This approach enables secure communication, authentication, or execution of processes across multiple chiplets, thereby enhancing the overall integrity and trustworthiness of the chiplet-based system.

Description

STATEMENT OF FUNDING

[0001] This invention was made with government support under Grant UNICO-IPCEI-2023-001 funded by the European Union-Next Generation EU, ImportantProjects of Common European Interest (IPCEI).BACKGROUND

[0002] A secure enclave (e.g., trusted hardware, trusted execution, etc.) istypically a hardware-supported, protected area within a processor that is designed tosecurely store and process sensitive information. By leveraging cryptographicmechanisms at the hardware level, a secure enclave isolates confidential code ordata from both the operating system and potential malicious agents. This approachcan maintain the integrity of essential processes—such as license management,digital asset protection, and user authentication—and can ensure that even if theprimary system is compromised, critical computations remain secure. The hardware-based authentication within a secure enclave can support trusted attestations orsimplifies compliance with strict security standards.

[0003] A Trusted Execution Environment (TEE) is a secure enclave generallylocated within a main processor of a device. The TEE operates to isolate code ordata to ensure confidentiality or integrity of sensitive computations. By leveraginghardware-backed security mechanisms, the TEE can generally attest to theauthenticity of software components, preventing unauthorized manipulation ortampering of software. This approach can dimmish the overall attack surface of asystem or device. A TEE can also enable critical applications—such as mobilepayment services, digital rights management, and secure key management-toexecute in a protected context, significantly reducing exposure to malware or otherthreats. In an example, a TEE can facilitate secure provisioning of cryptographickeys or enable hardware-based attestation, enhancing trust in distributed systems.BRIEF DESCRIPTION OF THE DRAWINGS

[0004] In the drawings, which are not necessarily drawn to scale, referencenumerals are repeated to describe similar components in different views. Likenumerals having different letter suffixes may represent different instances of similarcomponents. The drawings illustrate generally, by way of example, but not by way oflimitation, various embodiments discussed in the present document.

[0005] FIG. 1 depicts a chiplet system implementing a multi-chiplet TEE,according to an embodiment.

[0006] FIG. 2 depicts a chiplet architecture for a multi-chiplet TEE, according toan embodiment.

[0007] FIG. 3 depicts TEE support in a chiplet for a multi-chiplet TEE, accordingto an embodiment.

[0008] FIG. 4 depicts component messaging, according to an embodiment.

[0009] FIG. 5 depicts a method for a multi-chiplet TEE, according to anembodiment.

[0010] FIG. 6 depicts a hardware arrangement of a data center used to providemultiple implementations or instances of a computing system, according to anexample.

[0011] FIGS. 7A and 7B depict arrangements of a chip assembly with expandedviews of the chiplets and processing units, according to an example.

[0012] FIG. 8 depicts a block diagram of a computing system, according to anexample.DETAILED DESCRIPTION

[0013] As the demand for computing resources continues to increase, specializedhardware-based computing using accelerators—such as Artificial Intelligence (AI)accelerators—has emerged as a mechanism for speeding up several criticaloperations. These operations can include Al workloads executed by Al accelerators,data transfer operations managed by specialized Direct Memory Access (DMA)engines (e.g., a data streaming accelerator), or graphics processing facilitated byGraphics Processing Units (GPUs). These specialized accelerators operate inconjunction with existing Central Processing Units (CPUs) or other primaryprocessors to improve performance. Often, tasks are executed collaboratively, suchas in many machine learning data pipelines in which data operations are jointlyperformed by CPUs and GPUs or other accelerators.

[0014] Modern workloads often expect (e.g., require) secure enclaves. Theseenclaves establish trusted domains within a network of machines (e.g., in the cloud)and are particularly notable for their ability to carve out isolated, protectedenvironments even in virtualized settings. However, there exists an issue inmaintaining a secure enclave across elements within a single machine or platform(e.g., in a system-on-chip (SoC) or the like). Generally, once a workload (e.g.,application) employs multiple accelerators in a pipeline model, the traditionaltechniques to implement a secure enclave in the context of compute elements tendto fail because these additional computing elements cannot enforce the exclusivity ofexecution and data used to maintain the secure enclave. In the context wheredifferent accelerators are working together-for example connected with a local orremote input-output (I / O) Hub or different interposers or optical connections—challenges exist in defining secure domains when configuration of the topology canchange.

[0015] To address these issues, architecture and techniques to implement amulti-chiplet TEE are described herein. These features enable inclusion of on-chipaccelerators within trusted domains (e.g., for VMs) by defining resources within acomponent (e.g., an accelerators) as part of a TEE via spatial or temporal slicing.Thus, the components (e.g., accelerators or parts of accelerators) within the TEEcan grow or shrink, over time, as defined by an inter-component definitionprocedure. This can be accomplished by including, in each TEE capable component,TEE circuitry configured to advertise TEE availability, and accept specifics (e.g.,encryption keys) for a TEE domain via an inter-component signaling mechanism.Thus, an orchestrating device, such as a CPU, can establish a TEE domain andexpand the elements within the TEE domain by sharing the domain specifics withother computing elements in within a computing device, such as chiplet-basedprocessors, System-on-chip (SoC) circuitry, System-in-Package (SiP) or System-on-Package (SoP) circuitry, and other modular packaging implementations of processorcircuitry. Additional details and examples are provided below.

[0016] FIG. 1 depicts a chiplet system implementing a multi-chiplet TEE,according to an embodiment. As illustrated, the chiplet system can include a chipletpackage 102 (e.g., an SoC, SiP, or SoP) that includes a compute tile 104, memory106 (e.g., random access memory (RAM)), a data movement accelerator 108, amedia or Al accelerator 110, sensor processor 114, and an off-package interface 112(e.g., a compute express link (CXL) interface). As illustrated, the compute tile 104 isdirectly connected to the memory 106—such as via a double data rate (DDR)memory interface, a High Bandwidth Memory (HBM) interface, Universal MemoryInterface (UMI), or Bunch of Wires (BoW) interface, etc.-the off-package interface112 is connected to an external component 116, such as a network interface, andthe remaining components communicate via an input-output (IO) hub 105 (e.g.,operating in accordance with a Universal Chiplet Interconnect Express (UCIe) familyof standards) the chiplet package 102.

[0017] The compute tile 104 includes hardware to implement a TEE domain 118,and thus the compute tile 104 can be considered an orchestrating component forimplementing the multi-chiplet TEE. Between the top image and the bottom image,the TEE domain 118 is expanded to include additional components, such as the datamovement accelerator 108, the media or Al accelerator 110, the off-packageinterface 112, and a sub-component of the external component 116. This expansionis accomplished by the transmission, from the compute tile 104 (e.g., TEE circuitry ofthe compute tile 104) a TEE domain identifier to, for example, TEE circuitry of themedia or Al accelerator 110. This TEE domain identifier is then used by the receivingTEE circuitry to establish TEE operating conditions (e.g., cryptographic keys,attestation information, etc.) such that TEE workloads can be executed on thereceiving component (e.g., the media or Al accelerator 110 or the data movementaccelerator 108).

[0018] The following examples illustrate the procedure from the perspective ofthe additional component, and more specifically from processing circuitry of thatcomponent implementing TEE domain activities on the component. Accordingly, theprocessing circuitry of a first chiplet (e.g., the media and Al accelerator 110) isconfigured to receive (e.g., via the IO hub 105) a signal indicating creation of theTEE domain 118 at a second chiplet (e.g., the compute tile 104). As noted above,the creation of the TEE domain 118 is based on a process of the second chiplet 104.That is, the second chiplet establishes the TEE domain 118 for whatever reason-such as a request from software, a configuration of an operating system, workloadsecurity rules, etc.—and notifies the first chiplet of inclusion into the TEE domain 118via the signal. In an example, traffic (e.g., inter-chiplet communications) is encrypted,for example, over the IO hub 105 or the off-package interface 112) to secure thetraffic at the communication layer. The encryption can be based on (e.g., use) thesame key employed by the TEE circuitry to ensure security of the process within agiven chiplet.

[0019] The processing circuitry is configured to obtain (e.g., retrieve, receive,create, etc.) an identifier of the TEE domain based on the signal. The signal caninclude a simple message provoking the first chiplet to contact a facility (e.g.,another chiplet, and external component, etc.) to retrieve the identifier. In anexample, the signal can include a component from which the identifier can bedetermined (e.g., a seed applied to a built-in cryptographic technique to generate akey). In an example, the signal can include the identifier in its entirety. For example,the signal can include a base memory address to indicate the start of a virtualizedmemory space for a process. Here, the identifier is the base memory address of theprocess on the second chiplet.

[0020] As noted above, the signal can provoke the first chiplet into requesting theidentifier. Accordingly, in an example, to obtain the identifier, the processing circuitryis configured to make (e.g., transmit, cause to be transmitted, invoke, trigger, etc.) arequest for the identifier of the second chiplet in response to the signal. Here, theidentifier is received as a response to the request. For example, the compute tile 104sends the signal to the media or Al accelerator 108. The TEE circuitry in the mediaor Al accelerator 108 responds to the signal with a TEE domain key request from thecompute tile 104, and the compute tile 104 again responds with the TEE domain key.Many TEE identifiers are cryptographic elements, such as encryption keys, and areused by the TEE circuitry to, for example, encrypt and decrypt instructions or dataon-the-fly to ensure the security of the TEE domain 118. Accordingly, in an example,the identifier is a cryptographic element used to ensure execution isolation in a TEEof the second chiplet. In an example, the cryptographic element is a signature. In anexample, the cryptographic element is a decryption key. In an example, thedecryption key is a symmetric key.

[0021] Once the identifier is obtained by the processing circuitry of the firstchiplet, the first chiplet is capable of operating within the TEE domain 118. This isrealized, when for example, the processing circuitry of the first chiplet receives arequest for the TEE domain 118. For example, if the compute tile 104 is executing aprogram with a graphical output that can be accelerated with a single-instruction-multiple-data (SIMD) processing pipeline, such as is common with GPUacceleration. The compute tile 104 can push these operations to the media or Alaccelerator 108 using, for example, an encryption based on the identifier. When therequest to compute the raster output is received by the media or Al accelerator 108,the TEE processing circuitry of the media or Al accelerator 108 can decrypt therequest and access data or parameters to execute the request.

[0022] The processing circuitry of the first chiplet is configured to verify therequest based on the identifier prior to execution. In an example, verifying therequest based on the identifier includes using a Resource Arbitration Login (RAL)component of the first chiplet. The RAL is generally a component that addressesrace conditions, or other resource conflict issues, that can arise in the first chiplet.However, because the RAL mediates access to resources, the RAL provides aconvenient implementation point in the first chiplet to enable or disable accessbased on the TEE domain 118. Thus, the request can be tagged with, for example, avalid memory range that corresponds to the TEE domain 118, and thus verified bythe RAL. In an example, the processing circuitry is configured to write a RAL localidentifier to the RAL based on the identifier. Here, a RAL specific access identifier isassigned to the TEE domain 118 based on the original TEE domain identifier. TheRAL specific identifier can include, for example, an instruction address range specificto the TEE domain 118 that is carried or assigned to the request when it arrives atthe first chiplet. In an example, the processing circuitry of the first chiplet isconfigured to detect the identifier in the request and also configured to verify theidentifier in the request using the RAL local identifier.

[0023] In an example, verifying the request based on the identifier includes usinga Trust Provisioning Agent (TPA) component of the first chiplet. The TPA is generallya more full-featured TEE component, providing, for example, encryption-decryptionfacilities, secure registers, attestation components, etc. In an example, theprocessing circuitry is configured to write a TPA local identifier to the TPA based onthe identifier to create a TPA local identifier. In an example, the processing circuitry isconfigured to detecting the identifier in the request and verifying the identifier in therequest using the TPA local identifier.

[0024] In an example, where the identifier is a base memory address of theprocess on the second chiplet, verifying the request based on the identifier includesusing a Memory Management Unit (MMU) component of the first chiplet. In anexample, the processing circuitry is configured to write the base memory address tothe MMU for the process.

[0025] Once the TEE domain request has been successfully verified, the firstchiplet is configured to execute the request. In examples where the identifier isfunctional, such as when the identifier is a cryptographic key, the verification canincludes using the key to successfully decode the request or a portion of the request(e.g., the data or instruction in the request). In examples where the identifier is alabel, then successful verification involves matching the label to the locally storedversion of the label.

[0026] In an example, executing the request includes using a set of componentsof the first chiplet. These components could be memory, accelerator circuitry, orother discrete elements of the first chiplet. In an example, the set of components aredefined by the second chiplet. Here, the second chiplet (e.g., the orchestratingchiplet) is defining what elements are part of the TEE domain 118. Thus, the secondchiplet determines whether a shader is an included valid component in a GPUchiplet, for example. In an example, the set of components are defined based ontime. This example enables time slicing of components for TEE domain inclusion.Thus, the memory 106 could be part of the TEE domain 118 during a certain windowof time and not part of the TEE domain 118 at other times.

[0027] Dynamically enabling inclusion into the TEE domain 118 further enablesfuture chiplet integrations that can also be dynamic. For example, future chipletscould be optically connected to other I / O Hubs, enabling the dynamic creation ofsystems where new chiplets can be made available at runtime. In an example, theTEE circuitry (e.g., a TPA) can be configured to perform attestation of chiplets,including chiplets being added to the TEE domain 118. Attestation is a procedure inwhich the TPA can establish that a target chiplet is the expected chiplet (e.g., thecorrect type, working correctly, unmodified with malicious code, etc.) and thus willfunction as expected if added to the TEE domain 118. Attestation often involvesquerying the target chiplet and comparing response against known values for theresponses to determine whether they match. These known results can be obtained,or the entire attestation verified, by an external entity (e.g., the external attestationentity 212 illustrated in FIG. 2). By using attestation, the TEE circuitry can ensure theintegrity of the TEE domain 118 even with dynamically added chiplets. Accordingly,in an example, the TEE circuitry of the first chiplet is configured to receive anattestation query from the second chiplet and to respond to the attestation query withan attestation metric of the first chiplet. In an example, the second chiplet providesthe attestation metric received from the first chiplet to an external attestation entity toverify the second chiplet.

[0028] In an example, the first chiplet prevents operations from other domains onthe set of components. Thus, if another TEE domain than the TEE domain 118, or anon-TEE process attempt to use the set of components, the first chiplet prevents theprocess from using these components. In an example, the set of componentsinclude a memory device, an accelerator, a processor, or an interface. Theseexamples help to ensure security for TEE domain workloads by preventing otherworkloads from running on the same hardware when the component is in the TEEdomain 118.

[0029] FIG. 2 depicts a chiplet architecture for a multi-chiplet TEE, according toan embodiment. As illustrated, the chiplet package (e.g., SoC, SiP, etc.) includes acompute tile and a number of other components, including data movementaccelerator, media or Al accelerator, and external interface chiplets and an externalnetwork card. Each of these components includes TEE accelerator circuitry-suchas TEE accelerator circuitry 212 in the network card to interact with other TEEelements and establish the trust domain across components. In operation, the trustdomain 202 is established in the compute tile and signaled to the other componentsto create the trust domain 204 in the data movement accelerator tile, the trustdomain 206 in the media or Al accelerator tile, the trust domain 208 in the externalinterface tile, and the trust domain 210 in the network card. These trust domainsoperate similarly such that the sharing of TEE parameters (such as a cryptographickey) enables the TEE accelerator circuitry in each component to execute a workloadas if the workload were executing on the compute tile.

[0030] The illustrated architecture is an expansion to TEE circuitry distributionbetween components when compared to other arrangements that enable TEEdomain use of on-die accelerators as part of trustable resources. Part of thisexpansion is the local facility in accelerators to map requests or corresponding dataflows (e.g. access to memory) into configurable, and perhaps multiple, TEEdomains. Thus, the TEE accelerator circuitry on the components is configured toperform process verification or security to prevent elements outside the TEE domainto access the accelerator data (e.g. registers, memory, cache, etc.). The TEEaccelerator circuitry can also be configured to prevent requests for a particular TEEdomain workload from using resources allocated to another TEE domain.

[0031] As noted in FIG. 1, there are several ways in which the TEE acceleratorcircuitry of the component can enforce TEE domain integrity. For example, simpletransformations can be employed. For example, if a component in TEE domain Xattempts to copy a memory range from memory to a network interface card (NIC)memory using a Data Copy Accelerator (DCA), the DCA will verify that the memoryin the copy range is allocated to the TEE domain X before performing the copy. In anexample, pipeline accelerations can be employed. Here, the data copying operationcan be directed through a set of pipelines of accelerators. For example, a DCAcopying data from memory and sending it to an Al agent. The Al agent can thenperform analytics (e.g., stored in the memory of the TEE domain X) and the NICagent can encrypt the data provided by the Al agent before storing into memory onthe BIC.

[0032] FIG. 3 depicts TEE support in a chiplet for a multi-chiplet TEE, accordingto an embodiment. The illustrated architecture identifies a couple of elements thatare enhanced to support the TEE domain expansion described herein. For example,existing RAL 304 circuitry is modified to enable the identification of TEE domainassociation of a workload and record to which resources that TEE domain hasaccess. Here, during process arbitration of resources, the RAL 304 can enforce TEEdomain workload restrictions for the governed resources.

[0033] In an example, the Trust Provisioning Agent TPA circuitry 302 of, forexample, a compute tile 300, is modified to enable virtual partitioning (e.g., slicing) ofon-tile components into the TEE domain. Further, similar functionality is included ineach of the accelerators, such as the TEE circuitry 308 on the peer accelerator 306.The TEE circuitry 308 can be configured to associate resources or tag resources(e.g. queue entries) into particular trusted domains (e.g. identified with a processaddress ID) or control who access to data or state corresponding to the TEEdomain.

[0034] The TEE circuitry 308 can be configured to ensure that workloads (e.g.,processes, access requests, interrupts, debugging signals, etc.) cannot accessresources that belong other trusted domains. As illustrated, the compute tile 300, oranother component, operates as a primary component (e.g., director, orchestrator,conductor, etc.) that is responsible for trust establishment and generally spawns theprimary process for a given application. From this initial position, the othercomponents (e.g., other chiplets or accelerators) are in a different TEE domain(including no TEE domain) and the primary component coordinates the distributionof TEE domain specifics (e.g., TEE domain IDs, keys, operating ranges, etc.) when,for example, the TEE domain is created for the primary process, to the othercomponents, such as the peer chiplet accelerator 306. There is no requirement thatthe primary chiplet be the compute tile 300, or any specific chiplet. Rather, whichever chiplet started a TEE domain can operate as the primary for coordinating theexpansion of the TEE domain to peer chiplets or other components. In an example,the primary component is configured to perform attestation of a potential peer chipletupon discovery to ensure that the TEE circuitry 308, or the like, in the peer chipletprovides the expected security to avoid compromising the TEE domain.

[0035] As noted earlier, traditional TEE elements (e.g., RAL 304 or TPA 302) thatare responsible to arbitrate resources between use can be configured to provide anumber of additional functions. For example, TEE elements (e.g., RAL 304 or TPA302) can be configured to enable access to a particular die accelerator or to a set ofresources hosted within a chiplet or another component. Resources may includememory or other elements that can be mapped into a TEE domain. The TEEelements (e.g., RAL 304 or TPA 302) can be configured to allow requestscorresponding to a TEE domain being processed at the accelerator 306 to access toother resources for that request. This may include memory regions that are used tostore results from the accelerator 306. In an example, the TEE elements (e.g., RAL304 or TPA 302) are configured to enable (e.g., allow) at least some TEE domainrestricted data into the accelerator 306 to perform operations (e.g., a transformation)to complete the request. For example, if there is a need to store some keys todecrypt certain data that is provided as part of the request.

[0036] In an example, the TEE circuitry 308 is configured to coordinate with theTEE elements (e.g., RAL 304 or TPA 302). In an example, the TEE circuitry 308 isconfigured to process requests coming to the accelerator 306-either directly fromthe compute tile 300 or from another accelerator in a pipeline created by thecompute tile 300.

[0037] In an example, structures in the accelerator 306—such as ingress, egress,queues, etc. are configured to be indexed or mapped (e.g., using a table of requestID to a process address space ID (PASID) or TEE domain) to trusted domains. Here,any request or data being processed by the accelerator 306 can be mapped at anytime to a corresponding TEE domain ID, for example. In an example, the TEEcircuitry 308 is configured to manage requests coming from the TEE elements (e.g.,the RAL 304 or the TPA 302) to associate specific resources into the TEE domain orto, for example, notify internal components that a TEE domain will start sendingrequests, for example, directly or through a pipeline for the accelerator 306.Generally, the request checker is configured to ensure that a request beingprocessed in the accelerator 306 and belonging a TEE domain has access to therequested resources. The request checker can also be configured to ensure thatentities (e.g., devices, workloads, processes, etc.) outside the TEE domain cannotaccess the resources or data generated from requests belonging (e.g., have TEEparameters for the TEE domain) to the TEE domain.

[0038] FIG. 4 depicts component messaging, according to an embodiment. Aftera peer chiplet passes attestation (e.g., verification), the primary component canassociate a TEE domain ID (e.g., a PASID) to the TEE circuitry on the peer chiplet(operation 402). The peer chiplet TEE circuitry can respond with a NACK and notparticipate in the TEE domain or can respond with an ACK to become included in theTEE domain (operation 404). Once the ACK is received, the primary component canvalidate TEE domain requests and forward onto the peer chiplet.

[0039] When the peer chiplet receives a TEE domain workload (operation 406),the TEE circuitry of the peer chiplet verifies the TEE domain ID (operation 408). Ifthe verification response (operation 410) passes, then the peer chiplet executes theTEE domain workload (operation 412).

[0040] FIG. 5 depicts a method 500 for a multi-chiplet TEE, according to anembodiment. The operations of the method 500 are implemented in computerhardware, such as that described above or below (e.g., processing circuitry).

[0041] At operation 502, a signal indicating creation of a TEE domain at a secondchiplet is received at processing circuitry of a first chiplet in a chiplet system. Here,the creation of the TEE domain is based on a process of the second chiplet.

[0042] At operation 504, an identifier of the TEE domain is obtained based on thesignal. In an example, the identifier is a base memory address of the process on thesecond chiplet.

[0043] In an example, obtaining the identifier includes making a request for theidentifier of the second chiplet in response to the signal, and receiving the identifieras a response to the request. In an example, the identifier is a cryptographic elementused to ensure execution isolation in a TEE of the second chiplet. In an example, thecryptographic element is a signature. In an example, the cryptographic element is adecryption key. In an example, the decryption key is a symmetric key.

[0044] At operation 506, a request for the TEE domain is received.

[0045] At operation 508, the request is verified based on the identifier. In anexample, verifying the request based on the identifier includes using a ResourceArbitration Login (RAL) component of the first chiplet. In an example, wherein themethod 500 includes the operation of writing a RAL local identifier to the RAL basedon the identifier in response to obtaining the identifier to create a RAL local identifier.In an example, wherein the method 500 includes the operations of detecting theidentifier in the request, and verifying the identifier in the request using the RAL localidentifier.

[0046] In an example, verifying the request based on the identifier includes usinga Trust Provisioning Agent (TPA) component of the first chiplet. In an example, themethod 500 includes the operation of writing a TPA local identifier to the TPA basedon the identifier in response to obtaining the identifier to create a TPA local identifier.In an example, the method 500 includes the operations of detecting the identifier inthe request, and verifying the identifier in the request using the TPA local identifier.

[0047] In an example, where the identifier is a base memory address of theprocess on the second chiplet, verifying the request based on the identifier includesusing a Memory Management Unit (MMU) component of the first chiplet. In anexample, the method 500 includes the operation of writing the base memory addressto the MMU for the process.

[0048] At operation 510, the request is executed based on a successfulverification of the request. In an example, executing the request includes using a setof components of the first chiplet. In an example, the set of components are definedby the second chiplet. In an example, the set of components are defined based ontime. In an example, the first chiplet prevents operations from other domains on theset of components. In an example, the set of components include a memory device,an accelerator, a processor, or an interface.

[0049] FIGS. 6, 7A, 7B, and 8 respectively depict simplified aspects of examplecomputing architectures in which any of the techniques and configurations abovemay be implemented. It will be understood that the elements described above formulti-chiplet TEE may be integrated into various forms of the following hardwarecomponents.

[0050] FIG. 6 depicts an example hardware arrangement of a data center 600used to provide multiple implementations or instances of a computing system (e.g.,computing system 800, discussed below), with each instance of the computingsystem being identified as a respective platform (e.g., platform 630). The data center600 includes data center infrastructure 601, a data center network fabric 602, and apower distribution unit 603 to support multiple racks of compute platforms, with asingle instance of a rack 610 depicted. The data center infrastructure 601 mayprovide physical components that host the compute platform hardware, storagecomponents, and networking equipment; the data center network fabric 602 mayinclude switches and networking components to support data flows among variouscompute platforms and storage devices throughout the data center; and the powerdistribution unit 603 may include components to distribute and control power amongthe various compute platforms, networking, and storage devices.

[0051] The rack 610 includes but is not limited to cooling infrastructure 611, anetwork interface 612, and related physical components (not shown) to supportdiscrete instances of multiple chassis. The rack 610 provides power, connectivity,and cooling to each of the multiple chassis in a single rack, with a single instance ofa chassis 620 depicted in FIG. 6. The chassis 620 includes but is not limited tocooling infrastructure 621, a chassis network fabric 622, and a power supply 623,which provides cooling, network connectivity, and power to multiple platforms withinthe chassis, with a single instance of a platform 630 depicted in FIG. 6. It will beunderstood that a common data center rack configuration may include dozens ofchassis, with each chassis adapted to support a number of platforms depending onthe physical size of the platform hardware and supporting equipment.

[0052] The platform 630 in some implementations may be referred to as a serveror node, depending on the use case for the platform 630 and the data center 600.The platform 630 includes but is not limited to implementations of a discretecomputing system hosted on a single board. The platform 630 is depicted as hostinga chip assembly 640A and chip assembly 640B on a first board provided by a printedcircuitry board (PCB) or other platform board, shown as PCB 631. In someexamples, the platform 630 may include only one chip package, whereas the PCB631 depicts interconnection of multiple chip assemblies via a device-to-deviceinterface (e.g., a PCI express (PCIe) or compute express link (CXL) interface).Additional chip packages and components (not shown) may also be hosted on thePCB 631.

[0053] Some implementations of the chip assembly 640A and 640B may betermed as a System-on-Chip (SoC) package, as modular chiplets that performdifferent functions are integrated into a single package-even though this chippackage is composed of multiple dies unlike a traditional SoC design that uses asingle die. Other implementations of the chip assembly 640A and 640B may betermed as a System-on-Package (SoP), System-in-a-Package (SiP), or similarreferences to a single chip package. Various combinations of 2D, 2.5D, and 3Dpackaging technologies may be used to manufacture and assemble the chippackage and its underlying structure, and different manufacturing processes may beused to provide chiplets and components from different process nodes (e.g.,semiconductor fabrication systems).

[0054] The chip assembly 640A and chip assembly 640B are each packages thatinclude multiple chiplets or dies for respective functions, such as separate chipletsfor processing (e.g., CPU or GPU chiplets), memory (e.g., cache or high-bandwidthmemory chiplets), I / O (e.g., I / O chiplets), acceleration (e.g., AI / ML accelerationchiplets), signal processing (e.g., audio or video processing chiplets), and the like. Aclose-up of chip assembly 640A is depicted as including a I / O Hub chiplet 641,chiplets 642, and a power supply 643. These components may be hosted on aninterposer that is designed to connect multiple dies or components within a singlesemiconductor package (e.g., chip package). In some examples, the chiplets 642may be manufactured and sourced separately and later assembled into the chippackage to create the chip assembly 640A. Various connections may be providedamong the chiplets 642 such as with the use of Universal Chiplet InterconnectExpress (UCIe) or similar chiplet-to-chiplet interfaces and interconnects (e.g.Advanced Interface Bus (AIB), Bunch of Wires (BoW), etc.), or between chiplets andon-chip memory (e.g., high-bandwidth memory (HBM)) using HBM3 (JEDEC),Universal Memory Interface (UMI), or other memory interfaces. Similar interfacesand interconnects may be used for chip-to-chip or die-to-die communications (e.g.,using NVIDIA® NVLink-C2C, Cache Coherent Interconnect for Accelerators (CIX),Compute Express Link (CXL), Advanced eXtensible Interface (AXI), and certainimplementations of PCIe, CXL, etc.).

[0055] FIG. 7A depicts an example arrangement of a chip assembly 740A (e.g., amulti-processing core implementation of chip assembly 640A or 640B), withexpanded views of the chiplets and processing units included therein. Thisarrangement shows how the chip assembly 740A, which may constitute a SoC, SoP,SiP, or other type of chip package, is composed from chiplets such as chiplet 710A,chiplet 710B, etc. and associated on-package memory (e.g., high-speed memory)such as 3D-stacked, HBM instances shown as HBM 720A, HBM 720B, interfaces(e.g., UCle interfaces) shown as UCIe 721A, UCIe 721B, and I / O hub 730 (e.g.,which may be implemented by a I / O chiplet). Other hardware elements of a chippackage are not depicted for simplicity.

[0056] Each chiplet includes multiple processing units and each processing unitincludes one or multiple cores. For instance, chiplet 710A as depicted includes fourprocessing units (processing unit 700A, processing unit 700B, processing unit 700C,and processing unit 700D) and an L3 cache 704. Each processing unit may includeone or multiple processing cores, one or multiple caches, and optionally otherprocessing units or elements. For instance, processing unit 700A is depicted asincluding two cores (core 701A and core 701B), vector processing unit 702, and anL2 cache 703. Accordingly, a single-core processing unit arrangement can provide 4cores per chiplet and 8 total cores in a two-chiplet chip assembly, whereas a dual-core processing unit arrangement can provide 8 cores per chiplet and 16 total coresin a two-chiplet chip assembly. Other permutations may also be provided. A varietyof signaling interfaces and protocols (not shown) may be used for core-to-core andinter-processor communications, including but not limited to the use of coherencyprotocols, mesh, ring, or hybrid ring-mesh interconnects, Network-on-Chip (NoC)and packet switched communications, and the like.

[0057] FIG. 7B depicts an example arrangement of a chip assembly 740B (e.g., amulti-chiplet high-performance computing (HPC) implementation of chip assembly640A, 640B), adapted for HPC applications (e.g., parallel processing operationsinvolving thousands, millions, or more of processors or cores operatingsimultaneously). The example chip assembly 740B depicts placement as a SiP, SoC,or other package onto a platform board (e.g., PCB 631), and optionally in a datacenter (e.g., data center 600) or in a standalone deployment setting (e.g., in astandalone computer system, mobile computing device, autonomous device, etc.).

[0058] The chip assembly 740B is composed of multiple chiplets, shown with fourchiplets, chiplet 710C, chiplet 710D, chiplet 710E, chiplet 710F. Each chipletincludes multiple processing units, such as 32 processing units with a correspondingL3 cache for each processing unit. Each processing unit may include one or multiplecores, such as a single-core processing unit 700E shown as part of chiplet 710C.The chip assembly 740B is also composed of corresponding memory resources,such as HBM elements corresponding to respective banks of processing units (e.g.,HBM 720B and HBM 720C corresponding respective sets of processing units ofchiplet 710C), UCIe interfaces, and an IO Hub.

[0059] The chip assembly and related products or devices described herein maybe configured in a variety of computing system implementations. Suchimplementations include machine-readable non-transitory media storing machine-readable instructions and one or more processors coupled to the memory, such thatexecuting the machine-readable instructions configure the computing system andimplementing hardware (e.g., the processing unit 700, chiplet 710, chip 640, platform630) to perform steps and operations described above for electronic systems ordevices (e.g., to implement a multi-chiplet TEE, etc.). It should be further understoodthat software including one or more computer-executable instructions that facilitateprocessing and operations as described above may be distributed, installed, orotherwise provided with networked devices (e.g., servers or cloud computingsystems). Alternatively, in some examples, the software may be obtained and loaded(or, re-loaded / upgraded) from one or more servers and / or cloud computing systems,such as software stored on a server for distribution over the Internet, for example.

[0060] FIG. 8 depicts a block diagram of an example computing system 800(e.g., device, apparatus, machine, etc.) that may be programmed into a specialpurpose machine suitable for implementing one or more embodiments for a multi-chiplet TEE and like aspects disclosed herein. For instance, the components or sub-components described above may be embodied by the computing system 800, suchas in the form of a computer or specialized electronic device that includes sufficientprocessing power, memory resources, and communications throughput capability toperform operations consistent with the examples herein.

[0061] The computing system 800 may include at least one hardware processingunit 802 such as a central processing unit (CPU), a graphics processing unit (GPU),a vector processing unit (VPU), a neural processing unit (NPU), a hardwareaccelerator, or combinations or variants thereof. The at least one hardwareprocessing unit 802 is an implementation of processor circuitry and may beembodied by various types of chip assemblies, products, or packages as discussedwith reference to FIGS. 6 to 7B. Circuitry (e.g., processing circuitry) as used hereinis a collection of circuits implemented in tangible entities of the computing system800 that include hardware (e.g., simple circuits, gates, logic, etc.). Circuitrymembership may be flexible over time. Circuitries include members that may, aloneor in combination, perform specified operations when operating. In some examples,hardware of the circuitry may be immutably designed to carry out a specificoperation (e.g., hardwired).

[0062] In an example, the hardware of the circuitry may include variablyconnected physical components (e.g., execution units, transistors, simple circuits,etc.) including a machine-readable medium physically modified (e.g., magnetically,electrically, moveable placement of invariant massed particles, etc.) to encodeinstructions of the specific operation. In connecting the physical components, theunderlying electrical properties of a hardware constituent are changed, for example,from an insulator to a conductor or vice versa. The instructions enable embeddedhardware (e.g., the execution units or a loading mechanism) to create members ofthe circuitry in hardware via the variable connections to carry out portions of thespecific operation when in operation. Accordingly, the machine-readable mediumelements can be part of the circuitry or communicatively coupled to the othercomponents of the circuitry when the device is operating. Also, in some examples,any of the physical components may be used in more than one member of morethan one circuitry. For example, under operation, execution units may be used in afirst circuit of a first circuitry at one point in time and reused by a second circuit in thefirst circuitry, or by a third circuit in a second circuitry at a different time.

[0063] The computing system 800 may also include at least one memory device804 such as volatile memory 806 and non-volatile memory 808, and at least onestorage device such as removable storage 810 and / or non-removable storage 812such as a drive unit, some or all of which may communicate with each other via aninterconnect, fabric, link, or bus 820.

[0064] The computing system 800 may include an output interface 816 such asan interface connected to a display device, and an input interface 814 such as aninterface connected to an alphanumeric input device or a user interface (UI)navigation device. In some examples, a connected I / O device may also include adisplay device, alphanumeric input device, and navigation device that is integratedinto a single unit such as a touch screen display.

[0065] The computing system 800 may additionally include a communicationinterface 818, such as for connection with a network interface device used totransmit and receive electronic signals on a network. The computing system 800may also include other interfaces or hardware (not shown) in connection with asignal generation device (e.g., an audio or radio signal generation device), an outputcontroller (e.g., for connection with a serial, universal serial bus (USB), parallel, orother wired or wireless connection such as which uses via infrared (IR) or near fieldcommunication (NFC) technologies), an input controller (e.g., for connection withsensors or peripheral devices), and the like.

[0066] Any of the memory or storage devices such as the volatile memory 806,the non-volatile memory 808, the removable storage 810, or the non-removablestorage 812 may provide a machine-readable medium. Some examples of amachine-readable medium are a non-transitory medium that hosts or stores one ormore sets of data structures or instructions (e.g., software instructions) embodyingor utilized by any one or more of the techniques or functions described herein. Suchinstructions are collectively labeled as instructions 824 with respectiveimplementations of instructions 824A, 824B, 824C, 824D, and 824E.

[0067] The instructions 824 may reside, during execution or other operation ofthe computing system 800, completely or at least partially within the volatile memory806 as instructions 824B, within non-volatile memory 808 as instructions 824C,within removable storage as instructions 824D, within non-removable storage asinstructions 824E, or within the hardware processing unit 802 as instructions 824A.Thus, any combination of the hardware processing unit 802, the volatile memory806, the non-volatile memory 808, or a storage device of the removable storage 810or non-removable storage 812 may constitute a machine-readable medium ormedia. The instructions 824A, when loaded and executed by the hardwareprocessing unit 802, may invoke or utilize a defined instruction set 822 of thehardware processing unit 802, such as a processor instruction set defined by aninstruction set architecture (ISA) of a reduced instruction set computer (RISC) orcomplex instruction set computer (CISC) architecture—including but not limited tothe RISC-V Instruction Set provided in a RISC-V architecture. It will be understoodthat a RISC-V architecture and instruction set is one of several availablearchitectures and instruction sets that may be used in implementations of thefunctional compute components (e.g., the hardware processing unit 802) discussedherein.

[0068] The term "machine readable medium” may include any medium that iscapable of storing, encoding, or carrying instructions for execution by components orthe whole of the computing system 800 (or a similar machine) and that cause thecomputing system 800 or its components to perform any one or more of thetechniques or functions described herein, or that is capable of storing, encoding orcarrying data structures used by or associated with such instructions. Non-limitingmachine-readable medium examples may include solid-state memories, and opticaland magnetic media. Specific examples of machine-readable media may includenon-volatile memory, such as semiconductor memory devices (e.g., ElectricallyProgrammable Read-Only Memory (EPROM), Electrically Erasable ProgrammableRead-Only Memory (EEPROM)) and flash memory devices; magnetic disks, such asinternal hard disks and removable disks; and optical or magneto-optical disks.

[0069] The instructions 824 may further be transmitted or received over acommunications network using a transmission medium via the communicationinterface 818 and related devices utilizing any one of a number of transfer protocols(e.g., frame relay, internet protocol (IP), transmission control protocol (TCP), userdatagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Examplecommunication networks may include a local area network (LAN), a wide areanetwork (WAN), a packet data network (e.g., the Internet), mobile telephonenetworks (e.g., cellular networks), and wireless data networks (e.g., Institute ofElectrical and Electronics Engineers (IEEE) 802.11 family of standards known as Wi-Fi®), IEEE 802.15.4 family of standards, peer-to-peer (P2P) networks, amongothers.

[0070] Method examples or other operations described herein can beimplemented in part or in whole by the aforementioned machines, platforms, ordevices, or related systems (including computer, robotic, and autonomous systems).The components of the illustrative devices, systems, and methods employed may beimplemented in various examples by digital electronic circuitry, analog electroniccircuitry, or in computer hardware, firmware, software, or in combinations of them.These components may be implemented, for example, as a computing programproduct such as a computing program, program code or computer instructionstangibly embodied in an information carrier, or in a machine-readable storagedevice, for execution by, or to control the operation of, a data processing apparatussuch as a programmable processor, a computer, or multiple computers.

[0071] A computing program may be written in any form of programminglanguage, including compiled or interpreted languages, and it may be deployed inany form, including as a stand-alone program or as a module, component,subroutine, or other unit suitable for use in a computing environment. Also, functionalprograms, codes, and code segments for accomplishing the techniques describedherein may be easily construed as within the scope of the present disclosure byprogrammers skilled in the art.

[0072] Method steps associated with the illustrative embodiments may beperformed by processing circuitry executing a computing program, code, orinstructions to perform operations or functions (e.g., by operating on input dataand / or generating an output). Further, such operations or functions may beembodied by a machine-readable medium, which is capable of storing instructionsfor execution by processing circuitry (including the specific processing unit examplesdiscussed herein), such that the instructions, when executed by the processingcircuitry, cause the processing circuitry to perform any one or more of themethodologies described herein.

[0073] Additional examples of the presently described embodiments include thefollowing, non-limiting implementations. Each of the following non-limiting examplesmay stand on its own or may be combined in any permutation or combination withany one or more of the other examples provided below or throughout the presentdisclosure.

[0074] As a summary of the present disclosure, unit (e.g., chiplet, accelerator,etc.) enhancements can include TEE or TEE-like structures to enable TEEoperations within these units. In order to extend TEE domains, these unit specificTEE structures can accept and use TEE parameters (e.g., process ID enable lists,encryptions keys, etc.) from another unit such that processes running on any unit inthe TEE domain share these same parameters. Thus, the TEE operationalenvironment is essentially cloned across units and extends the TEE domain acrossdiscrete operational units of a package or even outside of the package.

[0075] These features enable inclusion of on-chip accelerators within trusteddomains (e.g., for VMs) by defining resources within a component (e.g., anaccelerators) as part of a TEE via spatial or temporal slicing. Thus, the components(e.g., accelerators or parts of accelerators) within the TEE can grow or shrink, overtime, as defined by an inter-component definition procedure. This can beaccomplished by including, in each TEE capable component, TEE circuitryconfigured to advertise TEE availability, and accept specifics (e.g., encryption keys)for a TEE domain via an inter-component signaling mechanism. Thus, anorchestrating device, such as a CPU, can establish a TEE domain and expand theelements within the TEE domain by sharing the domain specifics with othercomputing elements in within a computing device, such as chiplet-based processors,System-on-chip (SoC) circuitry, System-in-Package (SiP) or System-on-Package(SoP) circuitry, and other modular packaging implementations of processor circuitry.Additional details and examples are provided below.

[0076] Example 1 is a chiplet for a multi-chiplet trusted execution environment(TEE), the chiplet comprising: an interface configured to communicate with a secondchiplet; and processing circuitry that, when in operation, is configured to: receive, viathe interface, a signal indicating creation of a TEE domain at the second chiplet, thecreation of the TEE domain based on a process of the second chiplet; obtain anidentifier of the TEE domain based on the signal; receive, via the interface, a requestfor the TEE domain; verifying the request based on the identifier; and executing therequest based on a successful verification of the request.

[0077] In Example 2, the subject matter of Example 1, wherein, to obtain theidentifier, the processing circuitry is configured to: make a request for the identifier ofthe second chiplet in response to the signal; and receive the identifier as a responseto the request.

[0078] In Example 3, the subject matter of any of Examples 1-2, wherein theidentifier is a cryptographic element used to ensure execution isolation in a TEE ofthe second chiplet.

[0079] In Example 4, the subject matter of Example 3, wherein the cryptographicelement is a signature.

[0080] In Example 5, the subject matter of any of Examples 3–4, wherein thecryptographic element is a decryption key.

[0081] In Example 6, the subject matter of Example 5, wherein the decryption keyis a symmetric key.

[0082] In Example 7, the subject matter of any of Examples 1-6, wherein thechiplet includes a Resource Arbitration Login (RAL) component, and wherein, toverify the request based on the identifier, the processing circuitry is configured to usethe RAL component.

[0083] In Example 8, the subject matter of Example 7, wherein the processingcircuitry is configured to write a RAL local identifier to the RAL component based onthe identifier in response to obtaining the identifier to create a RAL local identifier.

[0084] In Example 9, the subject matter of Example 8, wherein the processingcircuitry is configured to: detect the identifier in the request; and verify the identifierin the request using the RAL local identifier.

[0085] In Example 10, the subject matter of any of Examples 1–9, wherein thechiplet includes a Trust Provisioning Agent (TPA) component, and wherein, to verifythe request based on the identifier, the processing circuitry is configured to use theTPA component.

[0086] In Example 11, the subject matter of Example 10, wherein the processingcircuitry is configured to write a TPA local identifier to the TPA component based onthe identifier in response to obtaining the identifier to create a TPA local identifier.

[0087] In Example 12, the subject matter of Example 11, wherein the processingcircuitry is configured to: detect the identifier in the request; and verify the identifierin the request using the TPA local identifier.

[0088] In Example 13, the subject matter of any of Examples 1-12, wherein theidentifier is a base memory address of the process on the second chiplet.

[0089] In Example 14, the subject matter of Example 13, wherein the chipletincludes a Memory Management Unit (MMU) component, and wherein, to verify therequest based on the identifier, the processing circuitry is configured to use the MMUcomponent.

[0090] In Example 15, the subject matter of Example 14, wherein the processingcircuitry is configured to write the base memory address to the MMU for the process.

[0091] In Example 16, the subject matter of any of Examples 1-15, wherein thechiplet includes a set of components including at least one component, and wherein,to execute the request, the processing circuitry is configured to use the set ofcomponents.

[0092] In Example 17, the subject matter of Example 16, wherein the set ofcomponents are defined by the second chiplet.

[0093] In Example 18, the subject matter of any of Examples 16–17, wherein theset of components are defined based on time.

[0094] In Example 19, the subject matter of any of Examples 16-18, wherein theprocessing circuitry is configured to prevent operations from other domains on theset of components.

[0095] In Example 20, the subject matter of any of Examples 16–19, wherein theset of components include a memory device, an accelerator, a processor, or aninterface.

[0096] In Example 21, the subject matter of any of Examples 1-20, wherein theprocessing circuitry is configured to: receive, via the interface, an attestation queryfrom the second chiplet; and respond, via the interface, to the attestation query withan attestation metric.

[0097] In Example 22, the subject matter of Example 21, wherein the secondchiplet provides the attestation metric received from the chiplet to an externalattestation entity to verify the chiplet.

[0098] Example 23 is a method for a multi-chiplet trusted execution environment(TEE), the method comprising: receiving, at processing circuitry of a first chiplet in achiplet system, a signal indicating creation of a TEE domain at a second chiplet, thecreation of the TEE domain based on a process of the second chiplet; obtaining anidentifier of the TEE domain based on the signal; receiving a request for the TEEdomain; verifying the request based on the identifier; and executing the requestbased on a successful verification of the request.

[0099] In Example 24, the subject matter of Example 23, wherein obtaining theidentifier includes: making a request for the identifier of the second chiplet inresponse to the signal; and receiving the identifier as a response to the request.

[0100] In Example 25, the subject matter of any of Examples 23–24, wherein theidentifier is a cryptographic element used to ensure execution isolation in a TEE ofthe second chiplet.

[0101] In Example 26, the subject matter of Example 25, wherein thecryptographic element is a signature.

[0102] In Example 27, the subject matter of any of Examples 25–26, wherein thecryptographic element is a decryption key.

[0103] In Example 28, the subject matter of Example 27, wherein the decryptionkey is a symmetric key.

[0104] In Example 29, the subject matter of any of Examples 23–28, whereinverifying the request based on the identifier includes using a Resource ArbitrationLogin (RAL) component of the first chiplet.

[0105] In Example 30, the subject matter of Example 29, comprising writing aRAL local identifier to the RAL component based on the identifier in response toobtaining the identifier to create a RAL local identifier.

[0106] In Example 31, the subject matter of Example 30, comprising: detectingthe identifier in the request; and verifying the identifier in the request using the RALcomponent local identifier.

[0107] In Example 32, the subject matter of any of Examples 23-31, whereinverifying the request based on the identifier includes using a Trust ProvisioningAgent (TPA) component of the first chiplet.

[0108] In Example 33, the subject matter of Example 32, comprising writing aTPA local identifier to the TPA component based on the identifier in response toobtaining the identifier to create a TPA local identifier.

[0109] In Example 34, the subject matter of Example 33, comprising: detectingthe identifier in the request; and verifying the identifier in the request using the TPAlocal identifier.

[0110] In Example 35, the subject matter of any of Examples 23–34, wherein theidentifier is a base memory address of the process on the second chiplet.

[0111] In Example 36, the subject matter of Example 35, wherein verifying therequest based on the identifier includes using a Memory Management Unit (MMU)component of the first chiplet.

[0112] In Example 37, the subject matter of Example 36, comprising writing thebase memory address to the MMU component for the process.

[0113] In Example 38, the subject matter of any of Examples 23–37, whereinexecuting the request includes using a set of components of the first chiplet.

[0114] In Example 39, the subject matter of Example 38, wherein the set ofcomponents are defined by the second chiplet.

[0115] In Example 40, the subject matter of any of Examples 38–39, wherein theset of components are defined based on time.

[0116] In Example 41, the subject matter of any of Examples 38–40, wherein thefirst chiplet prevents operations from other domains on the set of components.

[0117] In Example 42, the subject matter of any of Examples 38–41, wherein theset of components include a memory device, an accelerator, a processor, or aninterface.

[0118] In Example 43, the subject matter of any of Examples 23-42, comprising:receiving an attestation query from the second chiplet; and responding, via theprocessing circuitry, to the attestation query with an attestation metric.

[0119] In Example 44, the subject matter of Example 43, wherein the secondchiplet provides the attestation metric received from the first chiplet to an externalattestation entity to verify the first chiplet.

[0120] Example 45 is a system comprising means to perform any method ofExample 23-44.

[0121] Example 46 is machine readable media including instructions that, whenexecuted by processing circuitry, cause the processing circuitry to perform anymethod of Examples 23-44.

[0122] Example 47 is a machine readable media including instructions that, whenexecuted by processing circuitry of a first chiplet in a chiplet system, cause theprocessing circuitry to perform operations comprising: receiving a signal indicatingcreation of a Trusted Execution Environment (TEE) domain at a second chiplet, thecreation of the TEE domain based on a process of the second chiplet; obtaining anidentifier of the TEE domain based on the signal; receiving a request for the TEEdomain; verifying the request based on the identifier; and executing the requestbased on a successful verification of the request.

[0123] In Example 48, the subject matter of Example 47, wherein obtaining theidentifier includes: making a request for the identifier of the second chiplet inresponse to the signal; and receiving the identifier as a response to the request.

[0124] In Example 49, the subject matter of any of Examples 47–48, wherein theidentifier is a cryptographic element used to ensure execution isolation in a TEE ofthe second chiplet.

[0125] In Example 50, the subject matter of Example 49, wherein thecryptographic element is a signature.

[0126] In Example 51, the subject matter of any of Examples 49–50, wherein thecryptographic element is a decryption key.

[0127] In Example 52, the subject matter of Example 51, wherein the decryptionkey is a symmetric key.

[0128] In Example 53, the subject matter of any of Examples 47–52, whereinverifying the request based on the identifier includes using a Resource ArbitrationLogin (RAL) component of the first chiplet.

[0129] In Example 54, the subject matter of Example 53, comprising writing aRAL local identifier to the RAL component based on the identifier in response toobtaining the identifier to create a RAL local identifier.

[0130] In Example 55, the subject matter of Example 54, wherein the operationscomprise: detecting the identifier in the request; and verifying the identifier in therequest using the RAL component local identifier.

[0131] In Example 56, the subject matter of any of Examples 47–55, whereinverifying the request based on the identifier includes using a Trust ProvisioningAgent (TPA) component of the first chiplet.

[0132] In Example 57, the subject matter of Example 56, wherein the operationscomprise writing a TPA local identifier to the TPA component based on the identifierin response to obtaining the identifier to create a TPA local identifier.

[0133] In Example 58, the subject matter of Example 57, wherein the operationscomprise: detecting the identifier in the request; and verifying the identifier in therequest using the TPA local identifier.

[0134] In Example 59, the subject matter of any of Examples 47–58, wherein theidentifier is a base memory address of the process on the second chiplet.

[0135] In Example 60, the subject matter of Example 59, wherein verifying therequest based on the identifier includes using a Memory Management Unit (MMU)component of the first chiplet.

[0136] In Example 61, the subject matter of Example 60, wherein the operationscomprise writing the base memory address to the MMU component for the process.

[0137] In Example 62, the subject matter of any of Examples 47–61, whereinexecuting the request includes using a set of components of the first chiplet.

[0138] In Example 63, the subject matter of Example 62, wherein the set ofcomponents are defined by the second chiplet.

[0139] In Example 64, the subject matter of any of Examples 62–63, wherein theset of components are defined based on time.

[0140] In Example 65, the subject matter of any of Examples 62–64, wherein thefirst chiplet prevents operations from other domains on the set of components.

[0141] In Example 66, the subject matter of any of Examples 62–65, wherein theset of components include a memory device, an accelerator, a processor, or aninterface.

[0142] In Example 67, the subject matter of any of Examples 47–66, wherein theoperations comprise: receiving an attestation query from the second chiplet; andresponding, via the processing circuitry, to the attestation query with an attestationmetric.

[0143] In Example 68, the subject matter of Example 67, wherein the secondchiplet provides the attestation metric received from the first chiplet to an externalattestation entity to verify the first chiplet.

[0144] Example 69 is a system for a multi-chiplet trusted execution environment(TEE), the system comprising: means for receiving, at a first chiplet in a chipletsystem, a signal indicating creation of a TEE domain at a second chiplet, thecreation of the TEE domain based on a process of the second chiplet; means forobtaining an identifier of the TEE domain based on the signal; means for receiving arequest for the TEE domain; means for verifying the request based on the identifier;and means for executing the request based on a successful verification of therequest.

[0145] In Example 70, the subject matter of Example 69, wherein the means forobtaining the identifier include: means for making a request for the identifier of thesecond chiplet in response to the signal; and means for receiving the identifier as aresponse to the request.

[0146] In Example 71, the subject matter of any of Examples 69–70, wherein theidentifier is a cryptographic element used to ensure execution isolation in a TEE ofthe second chiplet.

[0147] In Example 72, the subject matter of Example 71, wherein thecryptographic element is a signature.

[0148] In Example 73, the subject matter of any of Examples 71–72, wherein thecryptographic element is a decryption key.

[0149] In Example 74, the subject matter of Example 73, wherein the decryptionkey is a symmetric key.

[0150] In Example 75, the subject matter of any of Examples 69–74, wherein themeans for verifying the request based on the identifier include means for using aResource Arbitration Login (RAL) component of the first chiplet.

[0151] In Example 76, the subject matter of Example 75, comprising means forwriting a RAL local identifier to the RAL component based on the identifier inresponse to obtaining the identifier to create a RAL local identifier.

[0152] In Example 77, the subject matter of Example 76, comprising: means fordetecting the identifier in the request; and means for verifying the identifier in therequest using the RAL local identifier.

[0153] In Example 78, the subject matter of any of Examples 69–77, wherein themeans for verifying the request based on the identifier include means for using aTrust Provisioning Agent (TPA) component of the first chiplet.

[0154] In Example 79, the subject matter of Example 78, comprising means forwriting a TPA local identifier to the TPA component based on the identifier inresponse to obtaining the identifier to create a TPA local identifier.

[0155] In Example 80, the subject matter of Example 79, comprising: means fordetecting the identifier in the request; and means for verifying the identifier in therequest using the TPA local identifier.

[0156] In Example 81, the subject matter of any of Examples 69–80, wherein theidentifier is a base memory address of the process on the second chiplet.

[0157] In Example 82, the subject matter of Example 81, wherein the means forverifying the request based on the identifier include means for using a MemoryManagement Unit (MMU) component of the first chiplet.

[0158] In Example 83, the subject matter of Example 82, comprising means forwriting the base memory address to the MMU component for the process.

[0159] In Example 84, the subject matter of any of Examples 69–83, wherein themeans for executing the request include means for using a set of components of thefirst chiplet.

[0160] In Example 85, the subject matter of Example 84, wherein the set ofcomponents are defined by the second chiplet.

[0161] In Example 86, the subject matter of any of Examples 84–85, wherein theset of components are defined based on time.

[0162] In Example 87, the subject matter of any of Examples 84–86, wherein thefirst chiplet prevents operations from other domains on the set of components.

[0163] In Example 88, the subject matter of any of Examples 84–87, wherein theset of components include a memory device, an accelerator, a processor, or aninterface.

[0164] In Example 89, the subject matter of any of Examples 69–88, comprising:means for receiving an attestation query from the second chiplet; and means forresponding to the attestation query with an attestation metric.

[0165] In Example 90, the subject matter of Example 89, wherein the secondchiplet provides the attestation metric received from the first chiplet to an externalattestation entity to verify the second chiplet.

[0166] Example 91 is at least one machine-readable medium includinginstructions that, when executed by processing circuitry, cause the processingcircuitry to perform operations to implement of any of Examples 1–90.

[0167] Example 92 is an apparatus comprising means to implement of any ofExamples 1-90.

[0168] Example 93 is a system to implement of any of Examples 1–90.

[0169] Example 94 is a method to implement of any of Examples 1–90.

Claims

What is claimed is:

1. A method comprising:receiving, at processing circuitry of a first chiplet in a chiplet system, a signalindicating creation of a trusted execution environment (TEE) domain at asecond chiplet, the creation of the TEE domain based on a process of thesecond chiplet;obtaining an identifier of the TEE domain based on the signal;receiving a request for the TEE domain;verifying the request based on the identifier; andexecuting the request based on a successful verification of the request.

2. The method of claim 1, wherein obtaining the identifier includes:making a request for the identifier of the second chiplet in response to the signal;andreceiving the identifier as a response to the request.

3. The method of any of claims 1–2, wherein the identifier is a cryptographicelement used to ensure execution isolation in a TEE of the second chiplet.

4. The method of any of claims 1–3, wherein verifying the request based on theidentifier includes using a Resource Arbitration Login (RAL) component of the firstchiplet.

5. The method of claim 4, further including writing a RAL local identifier to theRAL component based on the identifier in response to obtaining the identifier to create aRAL local identifier.

6. The method of claim 5, further including:detecting the identifier in the request; andverifying the identifier in the request using the RAL component local identifier.

7. The method of any of claims 1–6, wherein verifying the request based on theidentifier includes using a Trust Provisioning Agent (TPA) component of the first chiplet.

8. The method of claim 7, further including writing a TPA local identifier to the TPAcomponent based on the identifier in response to obtaining the identifier to create a ТРАlocal identifier.

9. The method of claim 8, further including:detecting the identifier in the request; andverifying the identifier in the request using the TPA local identifier.

10. The method of any of claims 1–9, wherein the identifier is a base memoryaddress of the process on the second chiplet.

11. The method of claim 10, wherein verifying the request based on the identifierincludes using a Memory Management Unit (MMU) component of the first chiplet.

12. The method of any of claims 1-11, wherein executing the request includesusing a set of components of the first chiplet.

13. The method of claim 12, wherein the first chiplet prevents operations fromother domains on the set of components.

14. A system comprising means to perform any method of claim 1-13.

15. Machine readable media including instructions that, when executed byprocessing circuitry, cause the processing circuitry to perform any method of claims 1-13.

Images