Apparatus and method for secure, efficient microcode patching

A method comprising:

• providing a package comprising one or more integrated circuit dies, the one or more integrated circuit dies comprising:
• a plurality of cores;
• and
• a security controller coupled to the plurality of cores, the method further comprising:
• decoding by a decoder a microcode patching instruction, the microcode patching instruction comprising an operand to be used to identify an address;
• and
• executing, by execution circuitry, the microcode patching instruction, wherein responsive to the microcode patching instruction, the execution circuitry and/or security controller are to perform the operations of:
• retrieving a microcode patch from a location in memory based on the address,
• validating the microcode patch,
• applying the microcode patch to update or replace microcode associated with the one or more integrated circuit dies, and
• transmitting the microcode patch to a persistent storage device;
• wherein the microcode patch is to be subsequently retrieved from the persistent storage device by one or more external security controllers of one or more external integrated circuit dies, the one or more external security controllers to cause the microcode patch to be applied to update or replace microcode associated with the one or more external integrated circuit dies.

A system comprising:

• a first package comprising a first one or more integrated circuit dies, the first one or more integrated circuit dies comprising:
• a first plurality of cores;
• and
• a first security controller coupled to the plurality of cores, a first core of the first plurality of cores comprising:
• a first decoder to decode a microcode patching instruction, the microcode patching instruction comprising an operand to be used to identify a first address;
• and
• first execution circuitry to execute the microcode patching instruction, wherein responsive to the microcode patching instruction, the execution circuitry and/or security controller are to:
• retrieve a microcode patch from a memory based on the first address,
• validate the microcode patch,
• apply the microcode patch to update or replace microcode associated with the first one or more integrated circuit dies, and
• transmit the microcode patch to a persistent storage device;
• a second package on a different computing device than the first package, the second package comprising a second one or more integrated circuit dies, the second one or more integrated circuit dies comprising:
• a second plurality of cores;
• and
• a second security controller coupled to the second plurality of cores, the second security controller to read the microcode patch from the persistent storage device, verify the microcode patch, and store the microcode patch to the memory or a different memory at a second address,
• a second core of the second plurality of cores to read the microcode patch from the memory or the different memory based on the second address and to apply the microcode patch to update or replace microcode associated with the second one or more integrated circuit dies.

An apparatus comprising:

• means for providing a package comprising one or more integrated circuit dies, the one or more integrated circuit dies comprising:
• a plurality of cores;
• and a security controller coupled to the plurality of cores, the method further comprising:
• means for decoding by a decoder a microcode patching instruction, the microcode patching instruction comprising an operand to be used to identify an address;
• and
• means for executing, by execution circuitry, the microcode patching instruction, wherein responsive to the microcode patching instruction, the execution circuitry and/or security controller are to perform the operations of:
• retrieving a microcode patch from a location in memory based on the address,
• validating the microcode patch,
• applying the microcode patch to update or replace microcode associated with the one or more integrated circuit dies, and
• transmitting the microcode patch to a persistent storage device;
• wherein the microcode patch is to be subsequently retrieved from the persistent storage device by one or more external security controllers of one or more external integrated circuit dies, the one or more external security controllers to cause the microcode patch to be applied to update or replace microcode associated with the one or more external integrated circuit dies.