Secure arbitration mode to build and operate within trust domain extensions

1. A processor comprising:

a range register to store information that identifies a reserved range of memory associated with a secure arbitration mode (SEAM) of the processor; and

a processor core coupled to the range register, wherein the processor core comprises security logic to unlock the range register on a logical processor, of the processor core, that is to initiate the SEAM; and

wherein the logical processor, via execution of the security logic, is to:

store, in the reserved range of the memory identified by the information stored in the range register, a SEAM module and a manifest associated with the SEAM module, wherein the SEAM module is to support execution of one or more trust domains;

initialize a SEAM virtual machine control structure (VMCS) within the reserved range of the memory, the SEAM VMCS to control state transitions between a virtual machine monitor (VMM) and the SEAM module; and

authenticate the SEAM module using a manifest signature of the manifest;

wherein the manifest comprises at least two of:

a manifest signers public key;

a first digest of the manifest signers public key, wherein the first digest is the identity of the SEAM module that is recorded;

a second digest of the SEAM module and associated loadable components; or

attributes of the SEAM module; and

wherein, to record a measurement of the SEAM module, the security logic is to:

generate a third digest of a combination of: (i) the SEAM module and associated loadable components; and (ii) the manifest signature; and

record, in at least one of a plurality of measurement registers, the third digest as the measurement of the SEAM module.

2. The processor of claim 1 , further comprising a plurality of measurement registers and a security virtual number (SYN) register, wherein the security logic is further to:

record, into the plurality of measurement registers, a measurement, an identity, and a SVN value of the SEAM module; and

verify the SVN value against a previously recorded SYN value stored in the SVN register.

3. The processor of claim 1 , wherein the security logic is further to, in response to a request to load the SEAM module:

generate a page table to map the reserved range of the memory;

generate a configurable number of software-writeable page directory pointer (PDP) structures to map additional memory, the additional memory to store data of the one or more trust domains;

store, within the reserved range of the memory, the page table and the software-writable PDP structures; and

store a page table pointer, which points to the page table, in the SEAM VMCS to establish a SEAM state on a subsequent execution of a SEAMCALL instruction.

4. The processor of claim 1 , wherein the security logic is further to:

initialize, with a data array, a configuration area within the reserved range of the memory; and

initialize, within the data array, multiple SEAM VMCSs comprising the SEAM VMCS, each of which is assigned to a different logical processor of the processor core, wherein to initialize the multiple VMCSs comprises to initialize fields of each VMCS.

5. The processor of claim 1 , wherein the processor core is further to execute memory check firmware to:

verify that the reserved range, which was programmed by basic input/output system (BIOS) firmware into the range register, does not overlap with other reserved ranges of the memory;

verify that a multi-key, total memory encryption (MK-TME) engine of the processor is configured with integrity enabled;

configure a platform-reserved encryption key of the MK-TME engine to encrypt and integrity and replay protect data stored to the reserved range of the memory; and

mark the reserved range the memory as valid in which to store the SEAM module.

6. The processor of claim 5 , further comprising a memory controller comprising the MK-TME engine, the memory controller to:

encrypt the SEAM module, using the platform-reserved encryption key, before the SEAM module is stored into the reserved range of the memory; and

encrypt and integrity protect, using the platform-reserved encryption key, data stored in and retrieved from the reserved range of the memory.

7. The processor of claim 1 , wherein the processor core is further to execute memory check firmware to:

partition key identifier (ID) space according to a partition set by basic input/output system (BIOS) firmware within a configuration register upon boot, wherein the key ID spaced is partitioned between at least a first range of values that identify private key IDs and a second range of values that identify shared key IDs; and

configuration lock the key ID space via a lock on the configuration register.

8. The processor of claim 1 , wherein the logical processor is to execute the VMM, wherein the VMM is to call for execution of a SEAMCALL instruction, in response to which the processor core is to:

transfer virtual root mode operational control to the SEAM module as a virtual machine (VM) exit; and

register a call of the secure arbitration mode as a reason for the VM exit.

9. The processor of claim 8 , wherein the processor core is further to:

store a first state of the VMM into the SEAM VMCS;

load, into the processor from the SEAM VMCS, a second state associated with the SEAM module;

operate in a SEAM virtual root mode using the SEAM module with the second state loaded into the processor; and

launch, using the SEAM module, a first trust domain (TD) to run in SEAM virtual non-root mode.

10. The processor of claim 9 , wherein, in response to a system management interrupt, the processor core is further to:

cause an exit from the first TD to the SEAM virtual root mode;

retrieve confidential data from hardware registers that are associated with operation of the first TD within the SEAM;

store a TD state of the first TD to a TD VMCS of the first TD stored in memory; and

turn control over to the SEAM module, which is to call for execution of a SEAMEXIT instruction to transfer virtual root mode operational control to the VMM.