System and method for execution of a secured environment initialization instruction
A method and apparatus for initiating secure operations in a microprocessor system is described. In one embodiment, one initiating logical processor initiates the process by halting the execution of the other logical processors, and then loading initialization and secure virtual machine monitor software into memory. The initiating processor then loads the initialization software into secure memory for authentication and execution. The initialization software then authenticates and registers the secure virtual machine monitor software prior to secure system operations.
1. A system comprising:
a plurality of processors;
an interconnect to couple two or more of the processors;
a system memory coupled to the two or more processors;
and an interface to at least one storage device;
at least one of the processors including:
a trusted memory of the processor to support secure initialization operations,
secure initialization logic of the processor to establish a root of trust for a secure execution environment,
execution logic of the processor to execute secure initialization program code within the secure execution environment, at least a portion of the secure initialization program code to be copied into the trusted memory,
the execution logic to validate the secure initialization program code prior to execution,
the execution logic to validate a virtual machine monitor (VMM) and copy the VMM to a trusted system memory area within the secure execution environment.
2. The system of claim 1 , further comprising access logic to permit or deny access to memory pages within the system memory.
3. The system of claim 1 , wherein validation of the VMM by the execution unit is to include cryptographic authentication of the VMM.
4. The system of claim 1 , further comprising a storage device coupled to the interface.
5. The system of claim 1 , wherein the interface is to a Peripheral Component Interconnect (PCI) bus.
6. The system of claim 1 , wherein the interface is a serial interface.
7. The system of claim 1 , wherein the interface is to a Universal Serial Bus (USB).
8. The system of claim 1 , wherein the interface is to a Low Pin Count (LPC) bus.
9. The system of claim 1 , wherein the interface is to an Integrated Drive Electronics (IDE) bus.
10. The system of claim 1 , wherein the interface is to a Small Computer Systems Interconnect (SCSI) bus.
11. A system comprising:
a plurality of processors;
an interconnect to couple two or more of the processors;
a system memory coupled to the two or more processors;
and an interface to at least one storage device;
at least one of the processors including:
a trusted memory of the processor to support secure initialization operations,
execution logic of the processor, the execution logic including secure initialization logic to establish a root of trust for a secure execution environment,
the execution logic to execute secure initialization program code within the secure execution environment, at least a portion of the secure initialization program code to be copied into the trusted memory,
the execution logic to validate the secure initialization program code prior to execution,
the execution logic to validate a virtual machine monitor (VMM) and copy the VMM to a trusted system memory area within the secure execution environment.
12. The system of claim 11 , further comprising access logic to permit or deny access to memory pages within the system memory.
13. The system of claim 11 , wherein validation of the VMM by the execution unit is to include cryptographic authentication of the VMM.
14. A system comprising:
a plurality of processors;
an interconnect to couple two or more of the processors;
a system memory coupled to the two or more processors;
and a serial interface to at least one storage device;
at least one of the processors including:
a trusted memory of the processor to support secure initialization operations,
secure initialization logic of the processor to establish a root of trust for a secure execution environment,
execution logic of the processor to execute secure initialization program code within the secure execution environment, at least a portion of the secure initialization program code to be copied into the trusted memory,
the execution logic to validate the secure initialization program code prior to execution,
the execution logic to validate a virtual machine monitor (VMM) and copy the VMM to a trusted system memory area within the secure execution environment.
15. The system of claim 14 , further comprising access logic to permit or deny access to memory pages within the system memory.
16. The system of claim 14 , wherein validation of the VMM by the execution unit is to include cryptographic authentication of the VMM.
17. The system of claim 14 , wherein the serial interface is to a Peripheral Component Interconnect (PCI) bus.
18. The system of claim 14 , wherein the serial interface is to a Universal Serial Bus (USB).