Computer system software/firmware and a processor unit with a security module

1. A computer implemented method for use with a security module including program instructions for providing a secret store in a volatile memory for secret data and an interface for interacting with an operating system, the method comprising:

storing, in a processor cache included in a processor, data constituting the security module in an encrypted form that can be decrypted by a secret key;

switching the processor to a secure mode;

responsive to the switching to the secure mode, disabling a write operation, with the write operation being an operation that writes the data constituting the security module from the processor cache to a volatile memory;

decrypting, in the processor cache, the data constituting the security module with the secret key;

configuring dynamic address translation to prevent access to portions of the volatile memory outside of the secret store;

receiving data through the interface of the security module;

encrypting, by the security module and in the processor cache, the data received through the interface of the security module using a public key;

enabling the write operation; and

switching the processor to a normal operating system mode;

wherein the processor cache included in the processor includes:

a first level instruction cache included in the processor;

a first level data cache included in the processor;

a second level instruction cache included in the processor; and

a second level data cache included in the processor.

2. The method of claim 1 further comprising:

disabling the write operation for data tagged with a non-secure flag.

3. The method of claim 1 wherein the interface of the security module is in the form of an application programming interface using a crypto architecture.

4. The method of claim 1 further comprising:

receiving, by the processor, an interrupt request;

responsive to the interrupt request, suspending execution of the security module; and

subsequent to the encryption of the security module, passing control to an interrupt handling program.

5. The method of claim 4 further comprising:

terminating the interrupt request; and

responsive to the termination of the interrupt request, restarting the security module.

6. The method of claim 1 further comprising:

sharing the security module between a plurality of programs using a semaphore mechanism to serialize access to the secret store of the volatile memory.