System and method for execution of a secured environment initialization instruction
View Patent ↗A method and apparatus for initiating secure operations in a microprocessor system is described. In one embodiment, one initiating logical processor initiates the process by halting the execution of the other logical processors, and then loading initialization and secure virtual machine monitor software into memory. The initiating processor then loads the initialization software into secure memory for authentication and execution. The initialization software then authenticates and registers the secure virtual machine monitor software prior to secure system operations.
1. A secure computing system having logic for initiating a secure processing environment comprising:
a processor to execute a first secure module to initialize the secure processing environment by establishing a root of trust usable to ensure that subsequent operations can be trusted;
a chipset having bus message security logic to monitor secure bus transactions associated with the first secure module and thereby verify that the first secure module and root of trust are secure; and
a secure virtual machine monitor (SVMM) module loaded in response to the first secure module after the root of trust has been established, the SVMM module preventing direct access to hardware resources from one or more untrusted operating systems, kernels, or applications.
2. The secure computing system as in claim 1 wherein instructions or operations normally performed by the operating system, kernel, or applications are trapped by SVMM and selectively permitted, partially permitted, or rejected.
3. The secure computing system as in claim 1 further comprising:
secure bus logic to monitor bus messages as the root of trust is established to ensure that the bus messages comply with a predefined security protocol.
4. The secure computing system as in claim 1 further comprising:
a secure memory to contain the first secure module prior to and during execution of the first secure module.
5. The secure computing system as in claim 4 further comprising:
secure load logic to load the first secure module prior to execution.
6. The secure computing system of claim 4 , wherein said secure memory includes a key for verifying the first secure module.
7. The secure computing system of claim 6 further comprising:
secure validation logic to validate the first secure module with the key.
8. The secure computing system as in claim 7 wherein the secure validation logic transfers execution control to the first secure module when validation completes.
9. The processor of claim 1 , wherein said first secure module transfers execution control to the SVMM module after the root of trust has been established.