Abstract:
In one embodiment, a processor can enforce a blacklist and validate, according to a multi-phase lockstep integrity protocol, a device coupled to the processor. Such enforcement may prevent the device from accessing one or more resources of a system prior to the validation. The blacklist may include a list of devices that have not been validated according to the multi-phase lockstep integrity protocol. Other embodiments are described and claimed.
Abstract:
A SYSTEM AND METHOD FOR PERMITTING THE EXECUTION OF SYSTEM MANAGEMENT MODE (SMM) CODE DURING SECURE OPERATIONS IN A MICROPROCESSOR SYSTEM IS DESCRIBED. IN ONE EMBODIMENT, THE SYSTEM MANAGEMENT INTERRUPT (SMI) MAY BE FIRST DIRECTED TO A HANDLER IN A SECURED VIRTUAL MACHINE MONITOR (SVMM). THE SMI MAY THEN BE REDIRECTED TO SMM CODE LOCATED IN A VIRTUAL MACHINE (VM) THAT IS UNDER THE SECURITY CONTROL OF THE SVMM. THIS REDIRECTION MAY BE ACCOMPLISHED BY ALLOWING THE SVMM TO READ AND WRITE THE SYSTEM MANAGEMENT (SM) BASE REGISTER IN THE PROCESSOR.
Abstract:
A METHOD AND APPARATUS FOR RESETTING AND MODIFYING SPECIAL REGISTERS IN A SECURITY TOKEN IS DESCRIBED. IN ONE EMBODIMENT, A REGISTER MAY BE RESET WHEN A RESET FLAG IS TRUE WHEN A SPECIAL TRANSMISSION ON A BUS DEMONSTRATES THE MUTUAL LOCALITY OF THE ASSOCIATED PROCESSOR AND CHIPSET. A MODIFY FLAG MAY ALSO BE USED TO INDICATE WHETHER THE REGISTER CONTENTS MAY BE MODIFIED. MODIFICATIONS MAY ALSO BE DEPENDENT UPON DEMONSTRATION OF MUTUAL LOCALITY.
Abstract:
A method and apparatus is provided in which a trustable operating system is loaded into a region in memory. A start secure operation (SSO) triggers a join secure operation (JSO) to halt all but one central processing unit (CPU) in a multi-processor computer. The SSO causes the active CPU to load a component of an operating system into a specified region in memory, register the identity of the loaded operating system by recording a cryptographic hash of the contents of the specified region in memory, begin executing at a known entry point in the specified region and trigger the JSO to cause the halted CPUs to do the same.