Authenticated code module

An authenticated code module comprises a value that attests to the authenticity of the module. The value is encrypted with a key corresponding to a key of a computing device that is to execute the module.

RELATED APPLICATIONS

This application is related to application Ser. No. 10/039,961, entitled “Processor Supporting Execution Of An Authenticated Code Instruction”; and application Ser. No. 10/041,071, entitled “Authenticated Code Method And Apparatus” both filed on the same date as the present application.

BACKGROUND

Computing devices execute firmware and/or software code to perform various operations. The code may be in the form of user applications, BIOS routines, operating system routines, etc. Some operating systems provide limited protections for maintaining the integrity of the computing device against rogue code. For example, an administrator may limit users or groups of users to executing certain pre-approved code. Further, an administrator may configure a sandbox or an isolated environment in which untrusted code may be executed until the administrator deems the code trustworthy. While the above techniques provide some protection, they generally require an administrator to manually make a trust determination based upon the provider of the code, historic performance of the code, and/or review of the source code itself.

Other mechanisms have also been introduced to provide automated mechanisms for making a trust decision. For example, an entity (e.g. software manufacturer) may provide the code with a certificate such as a X.509 certificate that digitally signs the code and attests to the integrity of the code. An administrator may configure an operating system to automatically allow users to execute code that provides a certificate from a trusted entity without the administrator specifically analyzing the code in question. While the above technique may be sufficient for some environments, the above technique inherently trusts the operating system or other software executing under the control of the operating system to correctly process the certificate.

Certain operations, however, may not be able to trust the operating system to make such a determination. For example, the code to be executed may result in the computing device determining whether the operating system is to be trusted. Relying on the operating system to authenticate such code would thwart the purpose of the code. Further, the code to be executed may comprise system initialization code that is executed prior to the operating system of the computing device. Such code therefore cannot be authenticated by the operating system.

DETAILED DESCRIPTION

Example embodiments of a computing device100are shown inFIGS. 1A-1E. The computing device100may comprise one or more processors110coupled to a chipset120via a processor bus130. The chipset120may comprise one or more integrated circuit packages or chips that couple the processors110to system memory140, a physical token150, private memory160, a media interface170, and/or other I/O devices of the computing device100.

Each processor110may be implemented as a single integrated circuit, multiple integrated circuits, or hardware with software routines (e.g., binary translation routines). Further, the processors110may comprise cache memories112and control registers114via which the cache memories112may be configured to operate in a normal cache mode or in a cache-as-RAM mode. In the normal cache mode, the cache memories112satisfy memory requests in response to cache hits, replace cache lines in response to cache misses, and may invalidate or replace cache lines in response to snoop requests of the processor bus130. In the cache-as-RAM mode, the cache memories112operate as random access memory in which requests within the memory range of the cache memories112are satisfied by the cache memories and lines of the cache are not replaced or invalidated in response to snoop requests of the processor bus130.

The processors110may further comprise a key116such as, for example, a key of a symmetric cryptographic algorithm (e.g. the well known DES, 3DES, and AES algorithms) or of an asymmetric cryptographic algorithm (e.g. the well-known RSA algorithm). The processor110may use the key116to authentic an AC module190prior to executing the AC module190.

The processors110may support one or more operating modes such as, for example, a real mode, a protected mode, a virtual real mode, and a virtual machine mode (VMX mode). Further, the processors110may support one or more privilege levels or rings in each of the supported operating modes. In general, the operating modes and privilege levels of a processor110define the instructions available for execution and the effect of executing such instructions. More specifically, a processor110may be permitted to execute certain privileged instructions only if the processor110is in an appropriate mode and/or privilege level.

The processors110may also support locking of the processor bus130. As a result of locking the processor bus130, a processor110obtains exclusive ownership of the processor bus130. The other processors110and the chipset120may not obtain ownership of the processor bus130until the processor bus130is released. In an example embodiment, a processor110may issue a special transaction on the processor bus130that provides the other processors110and the chipset120with a LT.PROCESSOR.HOLD message. The LT.PROCESSOR.HOLD bus message prevents the other processors110and the chipset120from acquiring ownership of the processor bus130until the processor110releases the processor bus130via a LT.PROCESSOR.RELEASE bus message.

The processors110may however support alternative and/or additional methods of locking the processor bus130. For example, a processor110may inform the other processors110and/or the chipset120of the lock condition by issuing an Inter-Processor Interrupt, asserting a processor bus lock signal, asserting a processor bus request signal, and/or causing the other processors110to halt execution. Similarly, the processor110may release the processor bus130by issuing an Inter-Processor Interrupt, deasserting a processor bus lock signal, deasserting a processor bus request signal, and/or causing the other processors110to resume execution.

The processors110may further support launching AC modules190and terminating execution of AC modules190. In an example embodiment, the processors110support execution of an ENTERAC instruction that loads, authenticates, and initiates execution of an AC module190from private memory160. However, the processors110may support additional or different instructions that cause the processors110to load, authenticate, and/or initiate execution of an AC module190. These other instructions may be variants for launching AC modules190or may be concerned with other operations that launch AC modules190to help accomplish a larger task. Unless denoted otherwise, the ENTERAC instruction and these other instructions are referred to hereafter as launch AC instructions despite the fact that some of these instructions may load, authenticate, and launch an AC module190as a side effect of another operation such as, for example, establishing a trusted computing environment.

In an example embodiment, the processors110further support execution of an EXITAC instruction that terminates execution of an AC module190and initiates post-AC code (See,FIG. 6). However, the processors110may support additional or different instructions that result in the processors110terminating an AC module190and launching post-AC code. These other instructions may be variants of the EXITAC instruction for terminating AC modules190or may be instructions concerned primarily with other operations that result in AC modules190being terminated as part of a larger operation. Unless denoted otherwise, the EXITAC instruction and these other instructions are referred to hereafter as terminate AC instructions despite the fact that some of these instructions may terminate AC modules190and launch post-AC code as a side effect of another operation such as, for example, tearing down a trusted computing environment.

The chipset120may comprise a memory controller122for controlling access to the memory140. Further, the chipset120may comprise a key124that the processor110may use to authentic an AC module190prior to execution. Similar to the key116of the processor110, the key124may comprise a key of a symmetric or asymmetric cryptographic algorithm.

The chipset120may also comprise trusted platform registers126to control and provide status information about trusted platform features of the chipset120. In an example embodiment, the chipset120maps the trusted platform registers126to a private space142and/or a public space144of the memory140to enable the processors110to access the trusted platform registers126in a consistent manner.

For example, the chipset120may map a subset of the registers126as read only locations in the public space144and may map the registers126as read/write locations in the private space142. The chipset120may configure the private space142in a manner that enables only processors110in the most privileged mode to access its mapped registers126with privileged read and write transactions. Further, the chipset120may further configure the public space144in a manner that enables processors110in all privilege modes to access its mapped registers126with normal read and write transactions. The chipset120may also open the private space142in response to an OpenPrivate command being written to a command register126. As a result of opening the private space142, the processors110may access the private space142in the same manner as the public space144with normal unprivileged read and write transactions.

The physical token150of the computing device100comprises protected storage for recording integrity metrics and storing secrets such as, for example, encryption keys. The physical token150may perform various integrity functions in response to requests from the processors110and the chipset120. In particular, the physical token150may store integrity metrics in a trusted manner, may quote integrity metrics in a trusted manner, may seal secrets such as encryption keys to a particular environment, and may only unseal secrets to the environment to which they were sealed. Hereinafter, the term “platform key” is used to refer to a key that is sealed to a particular hardware and/or software environment. The physical token150may be implemented in a number of different manners. However, in an example embodiment, the physical token150is implemented to comply with the specification of the Trusted Platform Module (TPM) described in detail in the Trusted Computing Platform Alliance (TCPA) Main Specification, Version 1.1, 31 Jul. 2001.

The private memory160may store an AC module190in a manner that allows the processor or processors110that are to execute the AC module190to access the AC module190and that prevents other processors110and components of the computing device100from altering the AC module190or interfering with the execution of the AC module190. As shown inFIG. 1A, the private memory160may be implemented with the cache memory112of the processor110that is executing the launch AC instruction. Alternatively, the private memory160may be implemented as a memory area internal to the processor110that is separate from its cache memory112as shown inFIG. 1B. The private memory160may also be implemented as a separate external memory coupled to the processors110via a separate dedicated bus as shown inFIG. 1C, thus enabling only the processors110having associated external memories to validly execute launch AC instructions.

The private memory160may also be implemented via the system memory140. In such an embodiment, the chipset120and/or processors110may define certain regions of the memory140as private memory160(seeFIG. 1D) that may be restricted to a specific processor110and that may only be accessed by the specific processor110when in a particular operating mode. One disadvantage of this implementation is that the processor110relies on the memory controller122of the chipset120to access the private memory160and the AC module190. Accordingly, an AC module190may not be able to reconfigure the memory controller122without denying the processor110access to the AC module190and thus causing the processor110to abort execution of the AC module190.

The private memory160may also be implemented as a separate memory coupled to a separate private memory controller128of the chipset120as shown inFIG. 1E. In such an embodiment, the private memory controller128may provide a separate interface to the private memory160. As a result of a separate private memory controller128, the processor110may be able to reconfigure the memory controller122for the system memory140in a manner that ensures that the processor110will be able to access the private memory160and the AC module190. In general, the separate private memory controller128overcomes some disadvantages of the embodiment shown inFIG. 1Dat the expense of an additional memory and memory controller.

The AC module190may be provided in any of a variety of machine readable mediums180. The media interface170provides an interface to a machine readable medium180and AC module190. The machine readable medium180may comprise any medium that can store, at least temporarily, information for reading by the machine interface170. This may include physical storage media such as various types of disk and memory storage devices.

Referring now toFIG. 2, an example embodiment of the AC module190is shown in more detail. The AC module190may comprise code210and data220. The code210comprises one or more code pages212and the data220comprises one or more data pages222. Each code page212and data page222in an example embodiment corresponds to a 4 kilobyte contiguous memory region; however, the code210and data220may be implemented with different page sizes or in a non-paging manner. The code pages212comprise processor instructions to be executed by one or more processors110and the data pages222comprise data to be accessed by one or more processors110and/or scratch pad for storing data generated by one or more processors110in response to executing instructions of the code pages212.

The AC module190may further comprise one or more headers230that may be part of the code210or the data220. The headers230may provide information about the AC module190such as, for example, module author, copyright notice, module version, module execution point location, module length, authentication method, etc. The AC module190may further comprise a signature240which may be a part of the code210, data220, and/or headers230. The signature240may provide information about the AC module190, authentication entity, authentication message, authentication method, and/or digest value.

The AC module190may also comprise an end of module marker250. The end of module marker250specifies the end of the AC module190and may be used as an alternative to specifying the length of the AC module190. For example, the code pages212and data pages222may be specified in a contiguous manner and the end of module marker250may comprise a predefined bit pattern that signals the end of the code pages212and data pages222. It should be appreciated that the AC module190may specify its length and/or end in a number of different manners. For example, the header230may specify the number of bytes or the number of pages the AC module190contains. Alternatively, launch AC and terminate AC instructions may expect the AC module190be a predefined number of bytes in length or contain a predefined number of pages. Further, launch AC and terminate AC instructions may comprise operands that specify the length of the AC module190.

It should be appreciated that the AC module190may reside in a contiguous region of the memory140that is contiguous in the physical memory space or that is contiguous in virtual memory space. Whether physically or virtually contiguous, the locations of the memory140that store the AC module190may be specified by a starting location and a length and/or end of module marker250may specify. Alternatively, the AC module190may be stored in memory140in neither a physically or a virtually contiguous manner. For example, the AC module190may be stored in a data structure such as, for example, a linked list that permits the computing device100to store and retrieve the AC module190from the memory140in a non-contiguous manner.

As will be discussed in more detail below, the example processors110support launch AC instructions that load the AC module190into private memory160and initiate execution of the AC module190from an execution point260. An AC module190to be launched by such a launch AC instruction may comprise code210which when loaded into the private memory160places the execution point260at a location specified one or more operands of a launch AC instruction. Alternatively, a launch AC instruction may result in the processor110obtaining the location of the execution point260from the AC module190itself. For example, the code210, data220, a header230, and/or signature240may comprise one or more fields that specify the location of the execution point260.

As will be discussed in more detail below, the example processors110support launch AC instructions that authenticated the AC module190prior to execution. Accordingly, the AC module190may comprise information to support authenticity determinations by the processors110. For example, the signature240may comprise a digest value242. The digest value242may be generated by passing the AC module190through a hashing algorithm (e.g. SHA-1 or MD5) or some other algorithm. The signature240may also be encrypted to prevent alteration of the digest value242via an encryption algorithm (e.g. DES, 3DES, AES, and/or RSA algorithms). In example embodiment, the signature240is RSA-encrypted with the private key that corresponds to a public key of the processor key116, the chipset key122, and/or platform key152.

It should be appreciated that the AC module190may be authenticated via other mechanisms. For example, the AC module190may utilize different hashing algorithms or different encryption algorithms. Further, the AC module190may comprise information in the code210, data220, headers230, and/or signature240that indicate which algorithms were used. The AC module190may also be protected by encrypting the whole AC module190for decryption via a symmetric or asymmetric key of the processor key116, chipset key124, or platform key152.

An example embodiment of the processor110is illustrated in more detail inFIG. 3. As depicted, the processor110may comprise a front end302, a register file306, one or more execution units370, and a retirement unit or back end380. The front end302comprises a processor bus interface304, a fetching unit330having instruction and instruction pointer registers314,316, a decoder340, an instruction queue350, and one or more cache memories360. The register file306comprises general purpose registers312, status/control registers318, and other registers320. The fetching unit330fetches the instructions specified by the instruction pointer registers316from the memory140via the processor bus interface304or the cache memories360and stores the fetched instructions in the instruction registers314.

An instruction register314may contain more than one instruction. According, the decoder340identifies the instructions in the instruction registers314and places the identified instructions in the instruction queue350in a form suitable for execution. For example, the decoder340may generate and store one or more micro-operations (uops) for each identified instruction in the instruction queue350. Alternatively, the decoder340may generate and store a single macro-operation (Mop) for each identified instruction in the instruction queue350. Unless indicated otherwise the term ops is used hereafter to refer to both uops and Mops.

The processor110further comprises one or more execution units370that perform the operations dictated by the ops of the instruction queue350. For example, the execution units370may comprise hashing units, decryption units, and/or microcode units that implement authentication operations that may be used to authenticate the AC module190. The execution units370may perform in-order execution of the ops stored in the instruction queue350. However, in an example embodiment, the processor110supports out-of-order execution of ops by the execution units370. In such an embodiment, the processor110may further comprise a retirement unit380that removes ops from the instruction queue350in-order and commits the results of executing the ops to one or more registers312,314,316,318,320to insure proper in-order results.

The decoder340may generate one or more ops for an identified launch AC instruction and the execution units370may load, authenticate, and/or initiate execution of an AC module190in response to executing the associated ops. Further, the decoder340may generate one or more ops for an identified terminate AC instruction and the execution units370may terminate execution of an AC module190, adjust security aspects of the computing device100, and/or initiate execution of post-AC code in response to executing the associated ops.

In particular, the decoder340may generate one or more ops that depend on the launch AC instruction and the zero or more operands associated with the launch AC instruction. Each launch AC instruction and its associated operands specify parameters for launching the AC module190. For example, the launch AC instruction and/or operands may specify parameters about the AC module190such as AC module location, AC module length, and/or AC module execution point. The launch AC instruction and/or operands may also specify parameters about the private memory160such as, for example, private memory location, private memory length, and/or private memory implementation. The launch AC instruction and/or operands may further specify parameters for authenticating the AC module190such as specifying which authentication algorithms, hashing algorithms, decryption algorithms, and/or other algorithms are to be used. The launch AC instruction and/or operands may further specify parameters for the algorithms such as, for example, key length, key location, and/or keys. The launch AC instruction and/or operands may further specify parameters to configure the computer system100for AC module launch such as, for example, specifying events to be masked/unmasked and/or security capabilities to be updated.

The launch AC instructions and/or operands may provide fewer, additional, and/or different parameters than those described above. Furthermore, the launch AC instructions may comprise zero or more explicit operands and/or implicit operands. For example, the launch AC instruction may have operand values implicitly specified by processor registers and/or memory locations despite the launch AC instruction itself not comprising fields that define the location of these operands. Furthermore, the launch AC instruction may explicitly specify the operands via various techniques such as, for example, immediate data, register identification, absolute addresses, and/or relative addresses.

The decoder340may also generate one or more ops that depend on the terminate AC instructions and the zero or more operands associated with the terminate AC instructions. Each terminate AC instruction and its associated operands specify parameters for terminating execution of the AC module190. For example, the terminate AC instruction and/or operands may specify parameters about the AC module190such as AC module location and/or AC module length. The terminate AC instruction and/or operands may also specify parameters about the private memory160such as, for example, private memory location, private memory length, and/or private implementation. The terminate AC instruction and/or operands may specify parameters about launching post-AC code such as, for example, launching method and/or post-AC code execution point. The terminate AC instruction and/or operands may further specify parameters to configure the computer system100for post-AC code execution such as, for example, specifying events to be masked/unmasked and/or security capabilities to be updated.

The terminate AC instructions and/or operands may provide fewer, additional, and/or different parameters than those described above. Furthermore, the terminate AC instructions may comprise zero or more explicit operands and/or implicit operands in a manner as described above in regard to the launch AC instructions.

Referring now toFIG. 4, there is depicted a method400of launching an AC module190. In particular, the method400illustrates the operations of a processor110in response to executing an example ENTERAC instruction having an authenticate operand, a module operand, and a length operand. However, one skilled in the art should be able implement other launch AC instructions having fewer, additional, and/or different operands without undue experimentation.

In block404, the processor110determines whether the environment is appropriate to start execution of an AC module190. For example, the processor110may verify that its current privilege level, operating mode, and/or addressing mode are appropriate. Further, if the processor supports multiple hardware threads, the processor may verify that all other threads have halted. The processor110may further verify that the chipset120meets certain requirements. In an example embodiment of the ENTERAC instruction, the processor110determines that the environment is appropriate in response to determining that the processor110is in a protected flat mode of operation, that the processor's current privilege level is 0, that the processor110has halted all other threads of execution, and that the chipset120provides trusted platform capabilities as indicated by one or more registers126. Other embodiments of launch AC instructions may define appropriate environments differently. Other launch AC instructions and/or associated operands may specify environment requirements that result in the processor110verifying fewer, additional, and/or different parameters of its environment.

In response to determining that the environment is inappropriate for launching an AC module190, the processor110may terminate the ENTERAC instruction with an appropriate error code (block408). Alternatively, the processor110may further trap to some more trusted software layer to permit emulation of the ENTERAC instruction.

Otherwise, the processor110in block412may update event processing to support launching the AC module190. In an example embodiment of the ENTERAC instruction, the processor110masks processing of the INTR, NMI, SMI, INIT, and A20M events. Other launch AC instructions and/or associated operands may specify masking fewer, additional, and/or different events. Further, other launch AC instructions and/or associated operands may explicitly specify the events to be masked and the events to be unmasked. Alternatively, other embodiments may avoid masking events by causing the computing device100to execute trusted code such as, for example, event handlers of the AC module190in response to such events.

The processor110in block416may lock the processor bus130to prevent the other processors110and the chipset120from acquiring ownership of the processor bus130during the launch and execution of the AC module190. In an example embodiment of the ENTERAC instruction, the processor110obtains exclusive ownership of the processor bus130by generating a special transaction that provides the other processors110and the chipset120with a LT.PROCESSOR.HOLD bus message. Other embodiments of launch AC instructions and/or associated operands may specify that the processor bus130is to remain unlocked or may specify a different manner to lock the processor bus130.

The processor110in block420may configure its private memory160for receiving the AC module190. The processor110may clear the contents of the private memory160and may configure control structures associated with the private memory160to enable the processor110to access the private memory160. In an example embodiment of the ENTERAC instruction, the processor110updates one or more control registers to switch the cache memory112to the cache-as-RAM mode and invalidates the contents of its cache memory112.

Other launch AC instructions and/or associated operands may specify private memory parameters for different implementations of the private memory160. (See, for example,FIGS. 1A-1E). Accordingly, the processor110in executing these other launch AC instructions may perform different operations in order to prepare the private memory160for the AC module190. For example, the processor110may enable/configure a memory controller (e.g. PM controller128ofFIG. 1E) associated with the private memory160. The processor110may also provide the private memory160with a clear, reset, and/or invalidate signal to clear the private memory160. Alternatively, the processor110may write zeros or some other bit pattern to the private memory160, remove power from the private memory160, and/or utilize some other mechanism to clear the private memory160as specified by the launch AC instruction and/or operands.

In block424, the processor110loads the AC module190into its private memory160. In an example embodiment of the ENTERAC instruction, the processor110starts reading from a location of the memory140specified by the address operand until a number of bytes specified by the length operand are transferred to its cache memory112. Other embodiments of launch AC instructions and/or associated operands may specify parameters for loading the AC module190into the private memory160in a different manner. For example, the other launch AC instructions and/or associated operands may specify the location of the AC module190, the location of the private memory160, where the AC module190is to be loaded in the private memory160, and/or the end of the AC module190in numerous different manners.

In block428, the processor110may further lock the private memory160. In an example embodiment of the ENTERAC instruction, the processor110updates one or more control registers to lock its cache memory112to prevent external events such as snoop requests from processors or I/O devices from altering the stored lines of the AC module190. However, other launch AC instructions and/or associated operands may specify other operations for the processor110. For example, the processor110may configure a memory controller (e.g. PM controller128ofFIG. 1E) associated with the private memory160to prevent the other processors110and/or chipset120from accessing the private memory160. In some embodiments, the private memory160may already be sufficiently locked, thus the processor110may take no action in block428.

The processor in block432determines whether the AC module190stored in its private memory160is authentic based upon a protection mechanism specified by the protection operand of the ENTERAC instruction. In an example embodiment of the ENTERAC instruction, the processor110retrieves a processor key116, chipset key124, and/or platform key152specified by the protection operand. The processor110then RSA-decrypts the signature240of the AC module190using the retrieved key to obtain the digest value242. The processor110further hashes the AC module190using a SHA-1 hash to obtain a computed digest value. The processor110then determines that the AC module190is authentic in response to the computed digest value and the digest value242having an expected relationship (e.g. equal to one another). Otherwise, the processor110determines that the AC module190is not authenticate.

Other launch AC instructions and/or associated operands may specify different authentication parameters. For example, the other launch AC instructions and/or associated operands may specify a different authentication method, different decryption algorithms, and/or different hashing algorithms. The other launch AC instructions and/or associated operands may further specify different key lengths, different key locations, and/or keys for authenticating the AC module190.

In response to determining that the AC module190is not authentic, the processor110in block436generates an error code and terminates execution of the launch AC instruction. Otherwise, the processor110in block440may update security aspects of the computing device100to support execution of the AC module190. In an example embodiment of the ENTERAC instruction, the processor110in block440writes a OpenPrivate command to a command register126of the chipset120to enable the processor110to access registers126via the private space142with normal unprivileged read and write transactions.

Other launch AC instructions and/or associated operands may specify other operations to configure the computing device100for AC module execution. For example, a launch AC instruction and/or associated operands may specify that the processor110leave the private space142in its current state. A launch AC instruction and/or associated operands may also specify that the processor110enable and/or disable access to certain computing resources such as protected memory regions, protected storage devices, protected partitions of storage devices, protected files of storage devices, etc.

After updating security aspects of the computing device100, the processor110in block444may initiate execution of the AC module190. In an example embodiment of the ENTERAC instruction, the processor110loads its instruction pointer register316with the physical address provided by the module operand resulting in the processor110jumping to and executing the AC module190from the execution point260specified by the physical address. Other launch AC instructions and/or associated operands may specify the location of the execution point260in a number of alternative manners. For example, a launch AC instruction and/or associated operands may result in the processor110obtaining the location of the execution point260from the AC module190itself.

Referring now toFIG. 5, there is depicted a method500of terminating an AC module190. In particular, the method500illustrates the operations of a processor110in response to executing an example EXITAC instruction having a protection operand, an events operand, and a launch operand. However, one skilled in the art should be able to implement other terminate AC instructions having fewer, additional, and/or different operands without undue experimentation.

In block504, the processor110may clear and/or reconfigure the private memory160to prevent further access to the AC module190stored in the private memory160. In an example embodiment of the EXITAC instruction, the processor110invalidates its cache memory112and updates control registers to switch the cache memory112to the normal cache mode of operation.

A terminate AC instruction and/or associated operand may specify private memory parameters for different implementations of the private memory160. (See, for example,FIGS. 1A-1E). Accordingly, a terminate AC instruction and/or associated operand may result in the processor110performing different operations in order to prepare the computing device100for post-AC code execution. For example, the processor110may disable a memory controller (e.g. PM controller128ofFIG. 1E) associated with the private memory160to prevent further access to the AC module190. The processor110may also provide the private memory160with a clear, reset, and/or invalidate signal to clear the private memory160. Alternatively, the processor110may write zeros or some other bit pattern to the private memory160, remove power from the private memory160, and/or utilize some other mechanism to clear the private memory160as specified by a terminate AC instruction and/or associated operands.

The processor110in block506may update security aspects of the computing device100based upon the protection operand to support post-AC code execution. In an example embodiment of the EXITAC instruction, the protection operand specifies whether the processor110is to close the private space142or leave the private space142in its current state. In response to determining to leave the private space142in its current state, the processor110proceeds to block510. Otherwise, the processor110closes the private space142by writing a ClosePrivate command to a command register126to prevent the processors110from further accessing the registers126via normal unprivileged read and write transactions to the private space142.

A terminate AC instruction and/or associated operands of another embodiment may result in the processor110updating other security aspects of the computing device100to support execution of code after the AC module190. For example, a terminate AC instruction and/or associated operands may specify that the processor110enable and/or disable access to certain computing resources such as protected memory regions, protected storage devices, protected partitions of storage devices, protected files of storage devices, etc.

The processor110in block510may unlock the processor bus130to enable other processors110and the chipset120to acquire ownership of the processor bus130. In an example embodiment of the EXITAC instruction, the processor110releases exclusive ownership of the processor bus130by generating a special transaction that provides the other processors110and the chipset120with a LT.PROCESSOR.RELEASE bus message. Other embodiments of terminate AC instructions and/or associated operands may specify that the processor bus130is to remain locked or may specify a different manner to unlock the processor bus130.

The processor110in block514may update events processing based upon the mask operand. In example embodiment of the EXITAC instruction, the mask operand specifies whether the processor110is to enable events processing or leave events processing in its current state. In response to determining to leave events processing in its current state, the processor110proceeds to block516. Otherwise, the processor110unmasks the INTR, NMI, SMI, INIT, and A20M events to enable processing of such events. Other terminate AC instructions and/or associated operands may specify unmasking fewer, additional, and/or different events. Further, other terminate AC instructions and/or associated operands may explicitly specify the events to be masked and the events to be unmasked.

The processor110in block516terminates execution of the AC module190and launches post-AC code specified by the launch operand. In an example embodiment of the EXITAC instruction, the processor110updates its code segment register and instruction pointer register with a code segment and segment offset specified by the launch operand. As a result, the processor110jumps to and begins executing from an execution point of the post-AC code specified by the code segment and segment offset.

Other terminate AC modules and/or associated operands may specify the execution point of the post-AC code in a number of different manners. For example, a launch AC instruction may result in the processor110saving the current instruction pointer to identify the execution point of post-AC code. In such an embodiment, the terminate AC instruction may retrieve the execution point saved by the launch AC instruction and initiate execution of the post-AC code from the retrieved execution point. In this manner, the terminate AC instruction returns execution to the instruction following the launch AC instruction. Further, in such an embodiment, the AC module190appears to have been called, like a function call or system call, by the invoking code.

Another embodiment of the computing device100is shown inFIG. 6. The computing device100comprises processors110, a memory interface620that provides the processors110access to a memory space640, and a media interface170that provides the processors110access to media180. The memory space640comprises an address space that may span multiple machine readable media from which the processor110may execute code such as, for example, firmware, system memory140, private memory160, hard disk storage, network storage, etc (See,FIGS. 1A-1E). The memory space640comprises pre-AC code642, an AC module190, and post-AC code646. The pre-AC code642may comprise operating system code, system library code, shared library code, application code, firmware routines, BIOS routines, and/or other routines that may launch execution of an AC module190. The post-AC code646may similarly comprise operating system code, system library code, shared library code, application code, firmware routines, BIOS routines, and/or other routines that may be executed after the AC module190. It should be appreciated that the pre-AC code642and the post-AC code646may be the same software and/or firmware module or different software and/or firmware modules.

An example embodiment of launching and terminating an AC module is illustrated inFIG. 7A. In block704, the computing device100stores the AC module190into the memory space640in response to executing the pre-AC code642. In an example embodiment, the computing device100retrieves the AC module190from a machine readable medium180via the media interface170and stores the AC module190in the memory space640. For example, the computing device100may retrieve the AC module190from firmware, a hard drive, system memory, network storage, a file server, a web server, etc and may store the retrieved AC module190into a system memory140of the computing device100.

The computing device100in block708loads, authenticates, and initiates execution of the AC module190in response to executing the pre-AC code642. For example, the pre-AC code642may comprise an ENTERAC instruction or another launch AC instruction that results in the computing device100transferring the AC module190to private memory160of the memory space640, authenticating the AC module190, and invoking execution of the AC module190from its execution point. Alternatively, the pre-AC code642may comprise a series of instructions that result in the computing device100transferring the AC module190to private memory160of the memory space640, authenticating the AC module190, and invoking execution of the AC module190from its execution point.

In block712, the computing device100executes the code210of the AC module190(See,FIG. 2). The computing device100in block716terminates execution of the AC module190and initiates execution of the post-AC code646of the memory space640. For example, the AC module190may comprise an EXITAC instruction or another terminate AC instruction that results in the computing device100terminating execution of the AC module190, updating security aspects of the computing device100, and initiating execution of the post-AC code646from an execution point of the post-AC code646. Alternatively, the AC module190may comprise a series of instructions that result in the computing device100terminating execution of the AC module190and initiating execution of the post-AC code646from an execution point of the post-AC code646.

Another example embodiment of launching and terminating an AC module is illustrated inFIG. 7B. In block740, the computing device100stores the AC module190into the memory space640in response to executing the pre-AC code642. In an example embodiment, the computing device100retrieves the AC module190from a machine readable medium180via the media interface170and stores the AC module190in the memory space640. For example, the computing device100may retrieve the AC module190from firmware, a hard drive, system memory, network storage, a file server, a web server, etc and stores the retrieved AC module190into a system memory140of the computing device100.

The computing device100in block744loads, authenticates, and initiates execution of the AC module190response to executing the pre-AC code642. The computing device in block744further saves an execution point for the post-AC code646that is based upon the instruction pointer. For example, the pre-AC code642may comprise an ENTERAC instruction or another launch AC instruction that results in the computing device100transferring the AC module190to private memory160of the memory space640, authenticating the AC module190, invoking execution of the AC module190from its execution point, and saving the instruction pointer so that the processor110may return to the instruction following the launch AC instruction after executing the AC module190. Alternatively, the pre-AC code642may comprise a series of instructions that result in the computing device100transferring the AC module190to private memory160of the memory space640, authenticating the AC module190, invoking execution of the AC module190from its execution point, and saving the instruction pointer.

In block748, the computing device100executes the code210of the AC module190(See,FIG. 2). The computing device100in block752terminates execution of the AC module190, loads the instruction pointer based execution point saved in block744, and initiates execution of the instruction following the launch AC instruction or the series of instructions executed in block744. For example, the AC module190may comprise an EXITAC instruction or another terminate AC instruction that results in the computing device100terminating execution of the AC module190, updating security aspects of the computing device100, and initiating execution of the post-AC code646from an execution point of the post-AC code646specified by the instruction pointer saved in block744. Alternatively, the AC module190may comprise a series of instructions that result in the computing device100terminating execution of the AC module190, updating security aspects of the computing device100, and initiating execution of the post-AC code646from an execution point of the post-AC code646specified by the instruction pointer saved in block744.

FIG. 8illustrates various design representations or formats for simulation, emulation, and fabrication of a design using the disclosed techniques. Data representing a design may represent the design in a number of manners. First, as is useful in simulations, the hardware may be represented using a hardware description language or another functional description language which essentially provides a computerized model of how the designed hardware is expected to perform. The hardware model810may be stored in a storage medium800such as a computer memory so that the model may be simulated using simulation software820that applies a particular test suite830to the hardware model810to determine if it indeed functions as intended. In some embodiments, the simulation software is not recorded, captured, or contained in the medium.

Additionally, a circuit level model with logic and/or transistor gates may be produced at some stages of the design process. This model may be similarly simulated, sometimes by dedicated hardware simulators that form the model using programmable logic. This type of simulation, taken a degree further, may be an emulation technique. In any case, re-configurable hardware is another embodiment that may involve a machine readable medium storing a model employing the disclosed techniques.

Furthermore, most designs, at some stage, reach a level of data representing the physical placement of various devices in the hardware model. In the case where conventional semiconductor fabrication techniques are used, the data representing the hardware model may be the data specifying the presence or absence of various features on different mask layers for masks used to produce the integrated circuit. Again, this data representing the integrated circuit embodies the techniques disclosed in that the circuitry or logic in the data can be simulated or fabricated to perform these techniques.

In any representation of the design, the data may be stored in any form of a computer readable medium. A memory850, or a magnetic or optical storage840such as a disc may be the medium. The set of bits describing the design or the particular part of the design are an article that may be sold in and of itself or used by others for further design or fabrication.