초록 ▼

The present invention is a method and apparatus to generates an isolated bus cycle for a transaction in a processor. A configuration storage contains configuration parameters to configure a processor in one of a normal execution mode and an isolated execution mode. An access generator circuit genera

The present invention is a method and apparatus to generates an isolated bus cycle for a transaction in a processor. A configuration storage contains configuration parameters to configure a processor in one of a normal execution mode and an isolated execution mode. An access generator circuit generates an isolated access signal using at least one of the isolated area parameters and access information in the transaction. The isolated access signal is asserted when the processor is configured in the isolated execution mode. A bus cycle decoder generates an isolated bus cycle corresponding to a destination in the transaction using the asserted isolated access signal and the access information.

대표청구항 ▼

What is claimed is: 1. A system comprising: a processor that supports two or more operating modes with different levels of privilege, including a ring 0 operating mode and a higher ring operating mode; a chipset responsive to the processor, wherein the chipset supports communication between the pro

What is claimed is: 1. A system comprising: a processor that supports two or more operating modes with different levels of privilege, including a ring 0 operating mode and a higher ring operating mode; a chipset responsive to the processor, wherein the chipset supports communication between the processor and a memory; configuration storage within the processor to store configuration parameters comprising: a first configuration setting to define an isolated memory area within the memory; and a second configuration setting to switch the processor between an isolated execution mode within the ring 0 operating mode and a non-isolated execution mode within the ring 0 operating mode; an isolated execution circuit within the processor to generate isolated bus cycles when the processor executes in the isolated execution mode, wherein the isolated bus cycles enable a module to access a resource that is only accessible from the isolated execution mode of the ring 0 operating mode; and a logical processor counter in the chipset that is updated in a first direction in response to a logical processor entry to the isolated execution mode and is updated in a second direction in response to a logical processor withdrawal from the isolated execution mode. 2. The system of claim 1, wherein the isolated bus cycles generated by the isolated execution circuit comprise: a data access cycle; a control access cycle; and a logical processor access cycle. 3. The system of claim 1, wherein the isolated bus cycles generated by the isolated execution circuit comprise at least one isolated bus cycle selected from the group consisting of: a data access cycle; a control access cycle; and a logical processor access cycle. 4. The system of claim 3, wherein the isolated execution circuit generates the data access cycle in response to a transaction involving a reference to the isolated memory area. 5. The system of claim 3, wherein the isolated execution circuit generates the control access cycle in response to a transaction involving an input/output reference to an isolated register in a chipset external to the processor. 6. The system of claim 3, wherein the isolated execution circuit generates the logical processor access cycle in response to a transaction involving one of the logical processor entry to the isolated execution mode or the logical processor withdrawal from the isolated execution mode. 7. The system of claim 1, wherein the isolated bus cycles generated by the isolated execution circuit comprise an isolated bus cycle that enables access to at least one resource selected from the group consisting of: the isolated memory area; an isolated register; and an isolated state. 8. The system of claim 1, wherein the first configuration setting to define the isolated memory area comprises at least one value selected from the group consisting of: a mask value; a base value; and a length value. 9. The system of claim 1, wherein the first configuration setting to define the isolated memory area comprises a mask value, a base value, and a length value. 10. The system of claim 1, further comprising: a processor control register within the isolated execution circuit; and an execution mode word in the processor control register that is asserted when the processor is configured in the isolated execution mode. 11. The system of claim 1, further comprising: an access generator circuit in the isolated execution circuit, the access generator circuit to generate an isolated access signal based on access information in a transaction and at least one of the configuration parameters, the isolated access signal being asserted when the processor is configured in the isolated execution mode, and a bus cycle decoder in the isolated execution circuit, the bus cycle decoder to generate an isolated bus cycle corresponding to a destination in the transaction based on the access information and the asserted isolated access signal. 12. An apparatus comprising: a processor capable of supporting two or more operating modes with different levels of privilege, including a ring 0 operating mode and a higher ring operating mode, wherein the processor allows modules executing in ring 0 to access data associated with modules executing in the higher ring, but the processor does not allow modules executing in the higher ring to access data associated with modules executing in ring 0; an isolated execution circuit within the processor that supports bifurcation of the ring 0 operating mode into an isolated execution mode and a non-isolated execution mode, by allowing the processor to be switched between the isolated execution mode and the non-isolated execution mode, and by generating isolated bus cycles when the processor executes in the isolated execution mode, wherein the isolated bus cycles enable a module to access a resource that is only accessible from the isolated execution mode of the ring 0 operating mode; a machine accessible medium responsive to the processor; and instructions encoded in the machine accessible medium, wherein the instructions, when executed, cause the processor to perform operations comprising: receiving a first configuration setting to define an isolated memory area within memory external to the processor; receiving a second configuration setting to switch the processor between the isolated execution mode within the ring 0 operating mode and the non-isolated execution mode within the ring 0 operating mode; loading a processor nub into the isolated memory area, using isolated bus cycles; and loading an operating system nub into the isolated memory area, using isolated bus cycles. 13. The apparatus of claim 12, wherein the isolated bus cycles comprise: a data access cycle; a control access cycle; and a logical processor access cycle. 14. The apparatus of claim 12, wherein the isolated bus cycles comprise at least one isolated bus cycle selected from the group consisting of: a data access cycle; a control access cycle; and a logical processor access cycle. 15. The apparatus of claim 14, wherein the isolated execution circuit generates the data access cycle in response to a transaction involving a reference to the isolated memory area. 16. The apparatus of claim 14, wherein the isolated execution circuit generates the control access cycle in response to a transaction involving an input/output reference to an isolated register in a chipset external to the processor. 17. The apparatus of claim 14, wherein the isolated execution circuit generates the logical processor access cycle in response to a transaction involving one of a logical processor entry to the isolated execution mode or a logical processor withdrawal from the isolated execution mode. 18. The apparatus of claim 12, wherein the isolated bus cycles generated by the isolated execution circuit comprise an isolated bus cycle that enables access to at least one resource selected from the group consisting of: the isolated memory area; an isolated register; and an isolated state. 19. The apparatus of claim 18, wherein the isolated execution circuit generates at least one of the isolated bus cycles based on an access type and a destination of a transaction. 20. The apparatus of claim 12, wherein the processor further comprises configuration storage to contain memory settings to define the isolated memory area. 21. The apparatus of claim 20, wherein the memory settings comprise at least one value selected from the group consisting of: a mask value; a base value; and a length value. 22. The apparatus of claim 12, wherein the isolated execution circuit comprises an address detector to detect if a physical address in a transaction is within the isolated memory area. 23. The apparatus of claim 12, wherein the isolated execution circuit comprises a processor control register to contain an execution mode word that is asserted when the processor is configured in the isolated execution mode. 24. The apparatus of claim 12, wherein the isolated execution circuit generates an isolated bus cycle based on an access type of a transaction. 25. A method comprising: receiving, at a processor, a first configuration setting to define an isolated memory area within memory external to the processor, wherein: the processor supports two or more operating modes with different levels of privilege, including a ring 0 operating mode and a higher ring operating mode; the processor allows modules that execute in ring 0 to access data associated with modules that execute in the higher ring; and the processor prevents modules that execute in the higher ring from accessing data associated with modules that execute in ring 0; receiving, at an isolated execution circuit of the processor, a second configuration setting to switch the processor between an isolated execution mode within the ring 0 operating mode and a non-isolated execution mode within the ring 0 operating mode; generating isolated bus cycles with the processor executing in the isolated execution mode, wherein the isolated bus cycles enable a module to access a resource that is only accessible from the isolated execution mode of the ring 0 operating mode; loading a processor nub into the isolated memory area, using isolated bus cycles; and loading an operating system nub into the isolated memory area, using isolated bus cycles. 26. A method according to claim 25, further comprising: configuring the processor in one of the non-isolated execution mode or the isolated execution mode, based on configuration parameters in a configuration storage in the processor; asserting an isolated access signal by an access generator circuit, based on at least one of the configuration parameters and access information in a transaction when the processor is configured in the isolated execution mode; and generating an isolated bus cycle corresponding to a destination in the transaction by a bus cycle decoder, based on the asserted isolated access signal and the access information. 27. The method of claim 25, further comprising: initializing the isolated execution mode, using a processor nub loader; loading the processor nub into the isolated memory area, using isolated bus cycles; and verifying the operating system nub, using the processor nub. 28. The method of claim 27, further comprising: if the operating system nub verifies as good, loading the operating system nub into the isolated memory area, using isolated bus cycles. 29. The method of claim 25, further comprising: generating platform verification data, based on attributes comprising: a platform key; the processor nub; and the operating system nub. 30. The method of claim 29, further comprising: switching from the isolated execution mode to the non-isolated execution mode; and loading an operating system kernel into non-isolated memory. 31. The method of claim 30, further comprising: switching from the ring 0 operating mode to the higher ring operating mode; and executing an application in the higher ring operating mode. 32. The method of claim 25, wherein the operation of generating isolated bus cycles comprises generating at least one isolated bus cycle selected from the group consisting of: a data access cycle; a control access cycle; and a logical processor access cycle. 33. The method of claim 32, wherein the operation of generating at least one isolated bus cycle comprises: generating the data access cycle in response to a transaction involving a reference to the isolated memory area. 34. The method of claim 32, wherein the operation of generating at least one isolated bus cycle comprises: generating the control access cycle in response to a transaction involving an input/output reference to an isolated register in a chipset external to the processor. 35. The method of claim 32, wherein the operation of generating at least one isolated bus cycle comprises: generating the logical processor access cycle in response to a transaction involving one of a logical processor entry to the isolated execution mode or a logical processor withdrawal from the isolated execution mode. 36. The method of claim 25, wherein the operation of generating isolated bus cycles comprises generating an isolated bus cycle that enables access to at least one resource selected from the group consisting of: the isolated memory area; an isolated register; and an isolated state. 37. The method of claim 25, wherein the operation of receiving a first configuration setting to define an isolated memory area comprises receiving at least one value selected from the group consisting of: a mask value; a base value; and a length value. 38. The method of claim 25, further comprising: asserting an execution mode word in a processor control register within the isolated execution circuit when the processor is configured in the isolated execution mode. 39. A method comprising: receiving, at a processor, a first configuration setting to define an isolated memory area within memory external to the processor, wherein: the processor supports two or more operating modes with different levels of privilege, including a ring 0 operating mode and a higher ring operating mode; the processor allows modules that execute in ring 0 to access data associated with modules that execute in the higher ring; and the processor prevents modules that execute in the higher ring from accessing data associated with modules that execute in ring 0; receiving, at an isolated execution circuit of the processor, a second configuration setting to switch the processor between an isolated execution mode within the ring 0 operating mode and a non-isolated execution mode within the ring 0 operating mode; generating isolated bus cycles with the processor executing in the isolated execution mode, wherein the isolated bus cycles enable a module to access a resource that is only accessible from the isolated execution mode of the ring 0 operating mode; and in response to a logical processor entry to the isolated execution mode, updating a logical processor counter in a chipset in a first direction. 40. The method of claim 39, further comprising: in response to a logical processor withdrawal from the isolated execution mode, updating the logical processor counter in the chipset in a second direction.