Patent Description:
Trusted computing environments allows end-users to ensure security and privacy when operating in a cloud or shared environment. However, current trusted computing environments have limited flexibility and scalability.

<CIT> relates to methods and apparatuses for trusted devices using trust domain extensions. The method is implemented on a compute platform including one or more devices and a set of hardware, firmware, and software components associated with a trusted computing base (TCB), including a host operating system and virtual machine manager (VMM). A device trust domain (dTD) is implemented in a trusted address space that is separate from the TCB, and one or multiple of the devices are bound to the dTD, which enables one or more virtual machines (VMs) or trusted domains (TDs) to access one or more functions provided by the bound device(s) in a secure and trusted manner. Firmware from a device is onloaded to the dTD and executed in the trusted address space to facilitate secure access to functions provided by the bound devices without using the VMM.

White paper "Intel® Trust Domain Extensions" describes architectural elements to deploy hardware-isolated, virtual machines (VMs) called trust domains (TDs).

In the following description, numerous specific details are set forth, such as examples of specific types of processors and system configurations, specific hardware structures, specific architectural and micro architectural details, specific register configurations, specific instruction types, specific system components, specific measurements/heights, specific processor pipeline stages, and operation, etc. in order to provide a thorough understanding of the present disclosure. It will be apparent, however, to one skilled in the art that these specific details need not be employed to practice embodiments of the present disclosure. In other instances, well-known components or methods, such as specific and alternative processor architectures, specific logic circuits/code for described algorithms, specific firmware code, specific interconnect operation, specific logic configurations, specific manufacturing techniques and materials, specific compiler implementations, specific expression of algorithms in code, specific power down and gating techniques/logic and other specific operational details of a computer system haven't been described in detail in order to avoid unnecessarily obscuring embodiments of the present disclosure.

Although the following embodiments may be described with reference to energy conservation and energy efficiency in specific integrated circuits, such as in computing platforms or microprocessors, other embodiments are applicable to other types of integrated circuits and logic devices. Similar techniques and teachings of embodiments described herein may be applied to other types of circuits or semiconductor devices that may also benefit from better energy efficiency and energy conservation. For example, the disclosed embodiments are not limited to desktop computer systems or Ultrabooks™ and may also be used in other devices, such as handheld devices, tablets, other thin notebooks, systems on a chip (SOC) devices, and embedded applications. Some examples of handheld devices include cellular phones, Internet protocol devices, digital cameras, personal digital assistants (PDAs), and handheld PCs. Embedded applications typically include a microcontroller, a digital signal processor (DSP), a system on a chip, network computers (NetPC), set-top boxes, network hubs, wide area network (WAN) switches, or any other system that can perform the functions and operations taught below. Moreover, the apparatus', methods, and systems described herein are not limited to physical computing devices but may also relate to software optimizations for energy conservation and efficiency. As will become readily apparent in the description below, the embodiments of methods, apparatus', and systems described herein (whether in reference to hardware, firmware, software, or a combination thereof) are vital to a `green technology' future balanced with performance considerations.

As computing systems are advancing, the components therein are becoming more complex. As a result, the interconnect architecture to couple and communicate between the components is also increasing in complexity to ensure bandwidth requirements are met for optimal component operation. Furthermore, different market segments demand different aspects of interconnect architectures to suit the market's needs. For example, servers require higher performance, while the mobile ecosystem is sometimes able to sacrifice overall performance for power savings. Yet, it's a singular purpose of most fabrics to provide highest possible performance with maximum power saving. Below, a number of interconnects are discussed, which would potentially benefit from aspects of the present disclosure.

Referring to <FIG>, an embodiment of a fabric composed of point-to-point links that interconnect a set of components is illustrated. System <NUM> includes processor <NUM>, controller hub <NUM>, and system memory <NUM> coupled to controller hub <NUM>. Processor <NUM> includes any processing element, such as a microprocessor, a host processor, an embedded processor, a co-processor, or other processor. Processor <NUM> is coupled to controller hub <NUM> through front-side buses (FSB) <NUM>. It should be appreciated that, in some embodiments, the computing system <NUM> may include more than one processor. In computing systems <NUM> with more processors, each pair of processors may be connected by a link. In one embodiment, FSB <NUM> is a serial point-to-point interconnect as described below. In another embodiment, link <NUM> includes a serial, differential interconnect architecture that is compliant with different interconnect standard, such as a Quick Path Interconnect (QPI) or an Ultra Path Interconnect (UPI). In some implementations, the system may include logic to implement multiple protocol stacks and further logic to negotiation alternate protocols to be run on top of a common physical layer, among other example features.

System memory <NUM> includes any memory device, such as random access memory (RAM), non-volatile (NV) memory, or other memory accessible by devices in system <NUM>. In the illustrative embodiment, the system memory <NUM> is coupled to the controller hub <NUM>. Additionally or alternatively, in some embodiments, the system memory <NUM> is coupled to processor <NUM> though a memory interface. Examples of a memory interface include a double-data rate (DDR) memory interface, a dual-channel DDR memory interface, and a dynamic RAM (DRAM) memory interface.

In one embodiment, controller hub <NUM> is a root hub, root complex, or root controller in a Compute Express Link (CXL) or Peripheral Component Interconnect Express (PCIe or PCIE) interconnection hierarchy. Examples of controller hub <NUM> include a chipset, a memory controller hub (MCH), a northbridge, an interconnect controller hub (ICH) a southbridge, and a root controller/hub. Often the term chipset refers to two physically separate controller hubs, i.e. a memory controller hub (MCH) coupled to an interconnect controller hub (ICH). Note that current systems often include the MCH integrated with processors <NUM>, while controller <NUM> is to communicate with I/O devices, in a similar manner as described below. In some embodiments, peer-to-peer routing is optionally supported through root complex <NUM>. In some embodiments, some or all of the controller hub <NUM> may be integrated with the processor <NUM>.

The controller hub <NUM> also includes an input/output memory management unit (IOMMU) <NUM>. In some embodiments, the IOMMU <NUM> may be referred to as a translation agent. In the illustrative embodiment, the IOMMU <NUM> forms part of the controller hub <NUM>. Additionally or alternatively, in some embodiments, some or all of the IOMMU <NUM> may be a separate component from the controller hub <NUM>. The IOMMU <NUM> can include hardware circuitry, software, or a combination of hardware and software. The IOMMU <NUM> can be used to provide address translation services (ATS) for address spaces in the memory <NUM> to allow one or more of the offload devices <NUM> to perform memory transactions to satisfy job requests issued by the host system.

Here, controller hub <NUM> is coupled to switch/bridge <NUM> through serial link <NUM>. Input/output modules <NUM>, <NUM>, and <NUM>, which may also be referred to as interfaces/ports <NUM>, <NUM>, and <NUM> include/implement a layered protocol stack to provide communication between controller hub <NUM> and switch <NUM>. In one embodiment, multiple devices are capable of being coupled to switch <NUM>. In some embodiments, the port <NUM> may be referred to as a root port <NUM>.

Switch/bridge <NUM> routes packets/messages from offload device <NUM> upstream, i.e., up a hierarchy towards a root complex, to controller hub <NUM> and downstream, i.e., down a hierarchy away from a root controller, from processor <NUM> or system memory <NUM> to offload device <NUM>. Switch <NUM>, in one embodiment, is referred to as a logical assembly of multiple virtual PCI-to-PCI bridge devices. Offload device <NUM> includes an input/output module <NUM>, which may also be referred to as an interface <NUM> or port <NUM>. Offload device <NUM> includes any internal or external device or component to be coupled to an electronic system, such as an I/O device, a Network Interface Controller (NIC), an add-in card, an audio processor, a network processor, a hard-drive, a storage device, a CD/DVD ROM, a monitor, a printer, a mouse, a keyboard, a router, a portable storage device, a Firewire device, a Universal Serial Bus (USB) device, a scanner, an accelerator device, a field programmable gate array (FPGA), an application specific integrated circuit, and other input/output devices. Often in the PCIe vernacular, such as device, is referred to as an endpoint. Although not specifically shown, offload device <NUM> may include a PCIe to PCI/PCI-X bridge to support legacy or other version PCI devices. Endpoint devices in PCIe are often classified as legacy, PCIe, or root complex integrated endpoints.

Graphics accelerator <NUM> is also coupled to controller hub <NUM> through serial link <NUM>. In one embodiment, graphics accelerator <NUM> is coupled to an MCH, which is coupled to an ICH. Switch <NUM>, and accordingly offload device <NUM>, is then coupled to the ICH. I/O modules <NUM> and <NUM> are also to implement a layered protocol stack to communicate between graphics accelerator <NUM> and controller hub <NUM>. Similar to the MCH discussion above, a graphics controller or the graphics accelerator <NUM> itself may be integrated in processor <NUM>. Further, one or more links (e.g., <NUM>) of the system can include one or more extension devices (e.g., <NUM>), such as retimers, repeaters, etc..

In the illustrative embodiment, a trusted domain <NUM> is established the covers a trusted domain operating system (TD OS) <NUM> on the processor <NUM> as well as a trusted domain bit-stream <NUM> on the offload device <NUM>. The illustrative system <NUM> allows a trusted domain <NUM> running on the processor <NUM> to expand the trusted domain <NUM> into other XPU devices, such as a graphics processing unit (GPU), a field-programmable gate array (FPGA), an accelerator, a smart network interface controller (NIC), etc. In the illustrative embodiment, the XPU device may be embodied as or otherwise included in an offload device <NUM>. The trusted domain can be expanded to include additional hardware, shrunk to include less hardware, merge with another trusted domain, or be split into two or more trusted domains. Trusted domains provides the capability for cloud service providers to offer secure virtual machine isolation to end users or software-as-a-service providers on the cloud. As trusted domains can be expanded and contracted on demand, an expanded domain can be used to handle events such as end of month or quarter spikes.

A trusted and secured protocol provide interfaces and logic to (<NUM>) create a compute instantiation (e.g., a bit-stream) to trusted domain of a processor <NUM>, (<NUM>) associate XPU resources with the trusted domain, and (<NUM>) provide the trusted domain of the processor <NUM> access to the XPU resources. In order to perform that functionality securely, there must be an attestation flow or root of trust in order to have the processor <NUM> and XPU trust each other. In some embodiments, the trusted domain OS <NUM> can exist alongside a legacy OS <NUM> and/or a legacy virtual machine <NUM>.

Turning to <FIG> an embodiment of a layered protocol stack is illustrated. Layered protocol stack <NUM> includes any form of a layered communication stack, such as a Quick Path Interconnect (QPI) stack, an Ultra Path Interconnect (UPI) stack, a PCIe stack, a Compute Express Link (CXL), a next generation high performance computing interconnect stack, or other layered stack. Although the discussion immediately below in reference to <FIG> are in relation to a UPI stack, the same concepts may be applied to other interconnect stacks. In one embodiment, protocol stack <NUM> is a UPI protocol stack including protocol layer <NUM>, routing layer <NUM>, link layer <NUM>, and physical layer <NUM>. An interface or link, such as link <NUM> in <FIG>, may be represented as communication protocol stack <NUM>. Representation as a communication protocol stack may also be referred to as a module or interface implementing/including a protocol stack.

UPI uses packets to communicate information between components. Packets are formed in the Protocol Layer <NUM> to carry the information from the transmitting component to the receiving component. As the transmitted packets flow through the other layers, they are extended with additional information necessary to handle packets at those layers. At the receiving side the reverse process occurs and packets get transformed from their Physical Layer <NUM> representation to the Data Link Layer <NUM> representation and finally to the form that can be processed by the Protocol Layer <NUM> of the receiving device.

In one embodiment, protocol layer <NUM> is to provide an interface between a device's processing core and the interconnect architecture, such as data link layer <NUM> and physical layer <NUM>. In this regard, a primary responsibility of the protocol layer <NUM> is the assembly and disassembly of packets. The packets may be categorized into different classes, such as home, snoop, data response, non-data response, non-coherent standard, and non-coherent bypass.

The routing layer <NUM> may be used to determine the course that a packet will traverse across the available system interconnects. Routing tables may be defined by firmware and describe the possible paths that a packet can follow. In small configurations, such as a two-socket platform, the routing options are limited and the routing tables quite simple. For larger systems, the routing table options may be more complex, giving the flexibility of routing and rerouting traffic.

Link layer <NUM>, also referred to as data link layer <NUM>, acts as an intermediate stage between protocol layer <NUM> and the physical layer <NUM>. In one embodiment, a responsibility of the data link layer <NUM> is providing a reliable mechanism for exchanging packets between two components. One side of the data link layer <NUM> accepts packets assembled by the protocol layer <NUM>, applies an error detection code, i.e., CRC, and submits the modified packets to the physical layer <NUM> for transmission across a physical to an external device. In receiving packets, the data link layer <NUM> checks the CRC and, if an error is detected, instructs the transmitting device to resend. In the illustrative embodiment, CRC are performed at the flow control unit (flit) level rather than the packet level. In the illustrative embodiment, each flit is <NUM> bits. In other embodiments, each flit may be any suitable length, such as <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, or <NUM> bits.

In one embodiment, physical layer <NUM> includes logical sub block <NUM> and electrical sub-block <NUM> to physically transmit a packet to an external device. Here, logical sub-block <NUM> is responsible for the "digital" functions of Physical Layer <NUM>. In this regard, the logical sub-block includes a transmit section to prepare outgoing information for transmission by physical sub-block <NUM>, and a receiver section to identify and prepare received information before passing it to the Link Layer <NUM>.

Physical block <NUM> includes a transmitter and a receiver. The transmitter is supplied by logical sub-block <NUM> with symbols, which the transmitter serializes and transmits onto to an external device. The receiver is supplied with serialized symbols from an external device and transforms the received signals into a bit-stream. The bit-stream is de-serialized and supplied to logical sub-block <NUM>. In the illustrative embodiment, the physical layer <NUM> sends and receives bits in groups of <NUM> bits, called a physical unit or phit. In some embodiments, a line coding, such as an 8b/10b transmission code or a 64b/66b transmission code, is employed. In some embodiments, special symbols are used to frame a packet with frames <NUM>. In addition, in one example, the receiver also provides a symbol clock recovered from the incoming serial stream.

As stated above, although protocol layer <NUM>, routing layer <NUM>, link layer <NUM>, and physical layer <NUM> are discussed in reference to a specific embodiment of a QPI protocol stack, a layered protocol stack is not so limited. In fact, any layered protocol may be included/implemented. As an example, a port/interface that is represented as a layered protocol includes: (<NUM>) a first layer to assemble packets, i.e. a protocol layer; a second layer to sequence packets, i.e. a link layer; and a third layer to transmit the packets, i.e. a physical layer. As a specific example, a common standard interface (CSI) layered protocol is utilized.

Referring next to <FIG>, an embodiment of a UPI serial point-to-point link is illustrated. Although an embodiment of a UPI serial point-to-point link is illustrated, a serial point-to-point link is not so limited, as it includes any transmission path for transmitting serial data. In the embodiment shown, a basic UPI serial point-to-point link includes two, low-voltage, differentially driven signal pairs: a transmit pair <NUM>/<NUM> and a receive pair <NUM>/<NUM>. Accordingly, device <NUM> includes transmission logic <NUM> to transmit data to device <NUM> and receiving logic <NUM> to receive data from device <NUM>. In other words, two transmitting paths, i.e. paths <NUM> and <NUM>, and two receiving paths, i.e. paths <NUM> and <NUM>, are included in a UPI link.

A transmission path refers to any path for transmitting data, such as a transmission line, a copper line, an optical line, a wireless communication channel, an infrared communication link, or other communication path. A connection between two devices, such as device <NUM> and device <NUM>, is referred to as a link, such as link <NUM>. A link may support one lane - each lane representing a set of differential signal pairs (one pair for transmission, one pair for reception). To scale bandwidth, a link may aggregate multiple lanes denoted by xN, where N is any supported Link width, such as <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, or wider. In some implementations, each symmetric lane contains one transmit differential pair and one receive differential pair. Asymmetric lanes can contain unequal ratios of transmit and receive pairs. Some technologies can utilize symmetric lanes (e.g., UPI), while others (e.g., Displayport) may not and may even including only transmit or only receive pairs, among other examples. A link may refer to a one-way link (such as the link established by transmission logic <NUM> and receive logic <NUM>) or may refer to a bi-directional link (such as the links established by transmission logic <NUM> and <NUM> and receive logic <NUM> and <NUM>).

A differential pair refers to two transmission paths, such as lines <NUM> and <NUM>, to transmit differential signals. As an example, when line <NUM> toggles from a low voltage level to a high voltage level, i.e. a rising edge, line <NUM> drives from a high logic level to a low logic level, i.e. a falling edge. Differential signals potentially demonstrate better electrical characteristics, such as better signal integrity, i.e. cross-coupling, voltage overshoot/undershoot, ringing, etc. This allows for better timing window, which enables faster transmission frequencies.

Referring now to <FIG>, in an illustrative embodiment, the processor <NUM> establishes an environment <NUM> during operation. The illustrative environment <NUM> includes a basic input/output system (BIOS) <NUM>, a host operating system <NUM>, a virtual machine manager <NUM>, XPU attestation <NUM>, multi-key total memory encryption (MKTME) <NUM>, XPU SEcure Arbitration Mode (SEAM) Arbitration <NUM>, input/output memory management unit (IOMMU) <NUM>, and an interconnect module <NUM>. The various modules of the environment <NUM> may be embodied as hardware, software, firmware, or a combination thereof. For example, the various modules, logic, and other components of the environment <NUM> may form a portion of, or otherwise be established by, the controller hub <NUM> (which may be a root complex), the port <NUM> (which may be a root port), or other hardware components of the computing system <NUM>. As such, in some embodiments, one or more of the modules of the environment <NUM> may be embodied as circuitry or collection of electrical devices (e.g., XPU attestation circuitry <NUM>, MKTME circuitry <NUM>, XPU SEAM arbitration circuitry <NUM>, etc.). It should be appreciated that, in such embodiments, one or more of the circuits (e.g., the XPU attestation circuitry <NUM>, the MKTME circuitry <NUM>, the XPU SEAM arbitration circuitry <NUM>, etc.) may form a portion of one or more of the controller hub <NUM>, the port <NUM>, and/or other components of the computing system <NUM>. In some embodiments, some modules (such as the host OS <NUM>, the virtual machine manager <NUM>, etc.) may be embodied as instructions stored on the system memory <NUM>, the processor <NUM>, or a storage device and executed by the processor <NUM>. Additionally, in some embodiments, one or more of the illustrative modules may form a portion of another module and/or one or more of the illustrative modules may be independent of one another. Further, in some embodiments, one or more of the modules of the environment <NUM> may be embodied as virtualized hardware components or emulated architecture. It should be appreciated that some of the functionality of one or more of the modules of the environment <NUM> may require a hardware implementation, in which case embodiments of modules which implement such functionality will be embodied at least partially as hardware.

The BIOS <NUM> is configured to perform initial setup and test of the processor <NUM> or other hardware. In the illustrative embodiment, the BIOS <NUM> executes at startup and then control of the system <NUM> is passed to the host OS <NUM>.

The host OS <NUM> is configured to manage applications, interface with hardware, etc. The host OS <NUM> may host the virtual machine manager <NUM>.

The virtual machine manager <NUM> is configured to manage one or more virtual machines, including trusted domains. In the illustrative embodiment, the virtual machine manager <NUM> (or any other component outside of the trusted domain) cannot access any of the resources of a trusted domain. Rather, the virtual machine manager <NUM> configures the trusted domain, controls when it can use resources, etc. The virtual machine manager <NUM> includes a SEAM module <NUM>. The SEAM module <NUM> is configured to manage trusted domains.

The XPU attestation <NUM> is capable of establishing a root of trust relation between the processor <NUM> and one or more offload devices <NUM>. The XPU attestation <NUM> will, at boot time, share its proof of identity with the offload device <NUM> (e.g., the multiple hashes that can be generated for firmware and other elements of the processor <NUM> that must be attested). Attestation may happen at multiple levels.

The processor <NUM> may discover what modules at the offload device <NUM> can be attested to and establish minimum requirements that must be met in order for a trusted domain to be expanded into the offload device <NUM>.

Expansion of trusted domains may depend on which resources are going to be used on the offload device <NUM>. For example, if the trusted domain that will be created on the offload device <NUM> will not use a media accelerator and will use an artificial intelligence accelerator, only the artificial intelligence accelerator may need to be attested to.

The XPU attestation <NUM> accesses an attestation resource (such as a remote trusted attestation service) to perform the validation for each of the provided proofs. After receiving an attestation result from the remote trusted attestation service, the XPU attestation <NUM> may determine whether or not to accept the offload device <NUM> as trusted. If the offload device <NUM> is trusted, then a trusted domain may expand to the offload device <NUM>.

The XPU attestation <NUM> may store entries for resources in a table, such as table <NUM> in <FIG>. Each entry in the table may include an identifier for the XPU or offload device <NUM>, the resource of the offload device <NUM>, and an attestation result (i.e., positive or negative). Entries in the table <NUM> may be stored in hardware registers of the processor <NUM> that cannot be modified by untrusted components.

The XPU SEAM arbitration <NUM> is configured to manage expansion of a trusted domain to an offload device <NUM>. The XPU SEAM arbitration <NUM> will arbitrate with a corresponding entity on the offload device <NUM> (e.g., the CPU SEAM arbitration <NUM> discussed below in regard to <FIG>) in order to expand a trusted domain to the offload device <NUM>.

The XPU SEAM arbitration <NUM> can map a resource or part of a resource of the offload device <NUM> to a trusted domain already configured on the processor <NUM>. In some embodiments, the trusted domain can be identified by a process address space ID (PASID) of the processor <NUM>. Additionally or alternatively, the XPU SEAM arbitration <NUM> can instantiate a new compute entity with a set of resources on the offload device <NUM>. For example, the XPU SEAM arbitration <NUM> can send a bit-stream to the offload device <NUM>, launch a process on compute cores of the offload device <NUM>, etc. The XPU SEAM arbitration <NUM> may work with or include a trusted provisioning agent, which may itself be in a trusted domain. The XPU SEAM arbitration <NUM> will create a trusted domain on the offload device <NUM>, and that trusted domain will be mapped to the corresponding trusted domain of the processor <NUM>.

The XPU SEAM arbitration <NUM> will instantiate the corresponding execution of the instance and associate and configure the selected resources. For example, the XPU SEAM arbitration <NUM> may copy multi-key total memory encryption (MKTME) keys stored in MKTME <NUM> to the MKTME <NUM> on the offload device <NUM> and map them into the trusted domain on the offload device <NUM>, which would allow the trusted domain on the processor <NUM> to access memory on the offload device <NUM>. In the illustrative embodiment, the XPU SEAM arbitration <NUM> may authenticate the offload device <NUM> before sending the MKTME key to the offload device <NUM>. As another example of resource mapping, the XPU SEAM arbitration <NUM> may associate a specific set of accelerators of the offload device <NUM> to the trusted domain. The accelerators that are selected may depend on the attestation performed by the XPU attestation <NUM>.

The XPU SEAM arbitration <NUM> will also control resource access from the processor <NUM> to the offload device <NUM> and vice versa. Only entities that belong to a trusted domain, such as a PASID on the processor <NUM> or bit-stream on the offload device <NUM>, can access resources that belong to the trusted domain. Secure memory access is provided by the MKTME keys. Other types of resources may implement other policies such as implementing access lists (e.g., mapping a PASID into a trusted domain to indicate what resources or range of resources can be accessed).

The IOMMU <NUM> is configured to provide address translation services (ATS) for address spaces in the memory <NUM> to allow one or more of the offload devices <NUM> to perform memory transactions to satisfy job requests issued by the host system. In the illustrative embodiment, the IOMMU <NUM> can verify that an offload device <NUM> making a resource request for a resource in a trusted domain is part of the trusted domain.

Interconnect module <NUM> is configured to manage communications over an interconnect, such as a CXL or PCIe interconnect. The interconnect module <NUM> may be embodied as or otherwise include the controller hub <NUM> described above.

Referring now to <FIG>, in an illustrative embodiment, the offload device <NUM> establishes an environment <NUM> during operation. The illustrative environment <NUM> includes a basic input/output system (BIOS) <NUM>, a host operating system <NUM>, an XPU SEAM module <NUM>, CPU attestation <NUM>, CPU SEAM arbitration <NUM>, a PASID to trusted domain module <NUM>, MKTME <NUM>, IOMMU <NUM>, and interconnect module <NUM>. The various modules of the environment <NUM> may be embodied as hardware, software, firmware, or a combination thereof. For example, the various modules, logic, and other components of the environment <NUM> may form a portion of, or otherwise be established by, the offload device <NUM>. As such, in some embodiments, one or more of the modules of the environment <NUM> may be embodied as circuitry or collection of electrical devices (e.g., XPU SEAM module <NUM>, CPU attestation circuitry <NUM>, PASID to TD circuitry <NUM>, etc.). It should be appreciated that, in such embodiments, one or more of the circuits (e.g., the XPU SEAM module <NUM>, the CPU attestation circuitry <NUM>, the PASID to TD circuitry <NUM>, etc.) may form a portion of one or more of various components of the offload device <NUM>, such as a processor unit, firmware, software, etc. In some embodiments, some modules (such as the host OS <NUM>) may be embodied as instructions stored on a local memory or storage of the offload device <NUM> and executed by a processor of the offload device <NUM>. Additionally, in some embodiments, one or more of the illustrative modules may form a portion of another module and/or one or more of the illustrative modules may be independent of one another. Further, in some embodiments, one or more of the modules of the environment <NUM> may be embodied as virtualized hardware components or emulated architecture. It should be appreciated that some of the functionality of one or more of the modules of the environment <NUM> may require a hardware implementation, in which case embodiments of modules which implement such functionality will be embodied at least partially as hardware.

The BIOS <NUM> is configured to perform initial setup and test of some or all of the offload device <NUM>. In the illustrative embodiment, the BIOS <NUM> executes at startup and then control of the system <NUM> is passed to the host OS <NUM>.

The host OS <NUM> is configured to manage applications, interface with hardware, etc. The host OS <NUM> may manage the creation of trusted domains or other tasks to be performed on the offload device <NUM>.

The XPU SEAM module <NUM> is configured to manage one or more trusted domains that include hardware on the offload device <NUM>. The XPU SEAM module <NUM> may receive instructions from the processor <NUM> regarding what modules of the offload device <NUM> will be included in a trusted domain, parameters of the trusted domain such as an identifier, etc..

The CPU attestation <NUM> is capable of establishing a root of trust relation between the offload device <NUM> and the processor <NUM>. The CPU attestation <NUM> is the complementary component to the XPU attestation <NUM> on the processor <NUM>. The CPU attestation <NUM> will, at boot time, share its proof of identity with the processor <NUM>. The CPU attestation <NUM> may access an attestation resource (such as a remote trusted attestation service) to perform the validation for each of the provided proofs. After receiving an attestation result from the remote trusted attestation service, the CPU attestation <NUM> may determine whether or not to accept the processor <NUM> as trusted. If the processor <NUM> is trusted, then the offload device <NUM> will allow a trusted domain to expand from the processor <NUM> to the offload device <NUM>.

The CPU attestation <NUM> may store entries for resources in a table, such as table <NUM> in <FIG>. Each entry in the table may include an identifier for the CPU or processor <NUM>, the resource, and an attestation result (i.e., positive or negative). Entries in the table <NUM> may be stored in hardware registers of the offload device <NUM> that cannot be modified by untrusted components.

The CPU SEAM arbitration <NUM> is configured to manage expansion of a trusted domain to the offload device <NUM>. The CPU SEAM arbitration <NUM> will arbitrate with a corresponding entity on the processor <NUM> (e.g., the XPU SEAM arbitration <NUM> discussed above in regard to <FIG>) in order to expand a trusted domain to the offload device <NUM>.

The CPU SEAM arbitration <NUM> can map a resource or part of a resource of the offload device <NUM> to a trusted domain already configured on the processor <NUM>. In some embodiments, the trusted domain can be identified by a process address space ID (PASID) of the processor <NUM>. Additionally or alternatively, the CPU SEAM arbitration <NUM> can coordinate with the processor <NUM> to instantiate a new compute entity with a set of resources on the offload device <NUM>. For example, the CPU SEAM arbitration <NUM> can receive a bit-stream from the processor <NUM>, launch a process on compute cores of the offload device <NUM>, etc. The CPU SEAM arbitration <NUM> may work with or include a trusted provisioning agent, which may itself be in a trusted domain. The CPU SEAM arbitration <NUM> will create a trusted domain on the offload device <NUM>, and that trusted domain will be mapped to the corresponding trusted domain of the processor <NUM>.

The CPU SEAM arbitration <NUM> may instantiate the corresponding execution of the instance and associate and configure the selected resources. For example, the CPU SEAM arbitration <NUM> may receive a copy of MKTME keys stored in MKTME <NUM> and store them in the MKTME <NUM> on the offload device <NUM>, which allows the trusted domain on the processor <NUM> to access memory on the offload device <NUM>. As another example of resource mapping, the CPU SEAM arbitration <NUM> may associate a specific set of accelerators of the offload device <NUM> to the trusted domain. The CPU SEAM arbitration <NUM> will also control resource access from the processor <NUM> to the offload device <NUM> and vice versa.

The PASID to trusted domain module <NUM> is configured to map a trusted domain that includes some or all of the offload device <NUM> to a PASID on the processor <NUM>. In the illustrative embodiment, the offload device <NUM> may a table such as table <NUM> in <FIG>. Entries in the table <NUM> may include a PASID, a trusted domain identifier, and a list of resources available on the trusted domain. Entries in the table <NUM> may be stored in hardware registers of the offload device <NUM> that cannot be modified by untrusted components.

The IOMMU <NUM> is configured to provide address translation services (ATS) for the offload device <NUM>. The IOMMU <NUM> may include an input/output translation lookaside buffer (IOTLB) to speed up memory access to memory on the offload device <NUM> and/or the system memory <NUM>. In the illustrative embodiment, the IOMMU <NUM> can verify that an offload device <NUM> making a resource request for a resource in a trusted domain is part of the trusted domain.

Interconnect module <NUM> is configured to manage communications over an interconnect, such as a CXL or PCIe interconnect. The interconnect module <NUM> may be embodied as or otherwise include the port <NUM> of the offload device <NUM>.

Referring now to <FIG>, in use, the computing system <NUM> may execute a method <NUM> for managing trusted domains, which may be performed by hardware, software, firmware, or any combination thereof. The method <NUM> begins in block <NUM>, in which the system <NUM> performs attestation between the processor <NUM> and one or more offload devices <NUM>. In block <NUM>, he system <NUM> can determine which modules can be attested, such as specific accelerators of an accelerator device. In block <NUM>, the system <NUM> determines whether trusted domains can be extended to the offload device <NUM>. As part of performing the attestation, in block <NUM>, the processor <NUM> and/or offload device <NUM> may access a remote trusted attestation server. In block <NUM>, the processor <NUM> and/or the offload devices <NUM> may store attestation information in hardware registers, such as in the tables <NUM>, <NUM>.

In block <NUM>, the system <NUM> determines parameters of a trusted domain. The system <NUM> may, e.g., receive parameters from a user or user's application with information indicating what resources a trusted domain may need. In block <NUM>, the system <NUM> determines which, if any, offload devices <NUM> to be part of the trusted domain. In block <NUM>, the system <NUM> determines which modules will be part of the trusted domain, such as which accelerators of an accelerator device. The system <NUM> may verify whether the resources requested to be part of a trusted domain have been properly attested to.

In block <NUM>, the system <NUM> establishes the trusted domain. In block <NUM>, in some embodiments, the system <NUM> may establish a trusted domain that includes one or more offload devices <NUM>, with or without including the processor <NUM>. In block <NUM>, the system <NUM> sends a bit-stream to the offload device <NUM> to execute as part of the trusted domain.

Referring now to <FIG>, in block <NUM>, the system <NUM> determines whether to modify the trusted domain. For example, a user or user application may determine that more resources are need to perform a particular task, such as a monthly or quarterly report, or a user or user application may determine that fewer resources are need because a particular task is complete. The system <NUM> may modify the trusted domain in several different ways. For example, in block <NUM>, the system <NUM> may determine whether to expand a trusted domain to an offload device <NUM>. In block <NUM>, the system <NUM> may determine whether to merge two trusted domains. In block <NUM>, the system <NUM> may determine whether to split a trusted domain into two or more trusted domains. In block <NUM>, the system <NUM> may determine whether to contract the trusted domain, such as by removing one or more resources of an offload device <NUM> from the trusted domain. The system <NUM> may verify that the resources the trusted domain is being extended to are considered trusted.

In block <NUM>, if the trusted domain is not to be modified, the method <NUM> loops back to block <NUM>. If the trusted domain is to be modified, the method <NUM> proceeds to block <NUM>, in which the system <NUM> modifies the trusted domain. The system <NUM> may expand the trusted domain to an offload device <NUM>, such as a compute resource of an offload device, in block <NUM>. The system <NUM> may merge two trusted domains in block <NUM>. The system <NUM> may split a trusted domain into two or more trusted domains in block <NUM>. The system <NUM> may contract the trusted domain in block <NUM>.

Referring to <FIG>, an embodiment of a block diagram for a computing system including a multicore processor is depicted. Processor <NUM> includes any processor or processing device, such as a microprocessor, an embedded processor, a digital signal processor (DSP), a network processor, a handheld processor, an application processor, a co-processor, a system on a chip (SOC), or other device to execute code. Processor <NUM>, in one embodiment, includes at least two cores-core <NUM> and <NUM>, which may include asymmetric cores or symmetric cores (the illustrated embodiment). However, processor <NUM> may include any number of processing elements that may be symmetric or asymmetric.

In one embodiment, a processing element refers to hardware or logic to support a software thread. Examples of hardware processing elements include: a thread unit, a thread slot, a thread, a process unit, a context, a context unit, a logical processor, a hardware thread, a core, and/or any other element, which is capable of holding a state for a processor, such as an execution state or architectural state. In other words, a processing element, in one embodiment, refers to any hardware capable of being independently associated with code, such as a software thread, operating system, application, or other code. A physical processor (or processor socket) typically refers to an integrated circuit, which potentially includes any number of other processing elements, such as cores or hardware threads.

A core often refers to logic located on an integrated circuit capable of maintaining an independent architectural state, wherein each independently maintained architectural state is associated with at least some dedicated execution resources. In contrast to cores, a hardware thread typically refers to any logic located on an integrated circuit capable of maintaining an independent architectural state, wherein the independently maintained architectural states share access to execution resources. As can be seen, when certain resources are shared and others are dedicated to an architectural state, the line between the nomenclature of a hardware thread and core overlaps. Yet often, a core and a hardware thread are viewed by an operating system as individual logical processors, where the operating system is able to individually schedule operations on each logical processor.

Physical processor <NUM>, as illustrated in <FIG>, includes two cores-core <NUM> and <NUM>. Here, core <NUM> and <NUM> are considered symmetric cores, i.e. cores with the same configurations, functional units, and/or logic. In another embodiment, core <NUM> includes an out-of-order processor core, while core <NUM> includes an in-order processor core. However, cores <NUM> and <NUM> may be individually selected from any type of core, such as a native core, a software managed core, a core adapted to execute a native Instruction Set Architecture (ISA), a core adapted to execute a translated Instruction Set Architecture (ISA), a co-designed core, or other known core. In a heterogeneous core environment (i.e. asymmetric cores), some form of translation, such a binary translation, may be utilized to schedule or execute code on one or both cores. Yet to further the discussion, the functional units illustrated in core <NUM> are described in further detail below, as the units in core <NUM> operate in a similar manner in the depicted embodiment.

As depicted, core <NUM> includes two hardware threads 1101a and 1101b, which may also be referred to as hardware thread slots 1101a and 1101b. Therefore, software entities, such as an operating system, in one embodiment potentially view processor <NUM> as four separate processors, i.e., four logical processors or processing elements capable of executing four software threads concurrently. As alluded to above, a first thread is associated with architecture state registers 1101a, a second thread is associated with architecture state registers 1101b, a third thread may be associated with architecture state registers 1102a, and a fourth thread may be associated with architecture state registers 1102b. Here, each of the architecture state registers (1101a, 1101b, 1102a, and 1102b) may be referred to as processing elements, thread slots, or thread units, as described above. As illustrated, architecture state registers 1101a are replicated in architecture state registers 1101b, so individual architecture states/contexts are capable of being stored for logical processor 1101a and logical processor 1101b. In core <NUM>, other smaller resources, such as instruction pointers and renaming logic in allocator and renamer block <NUM> may also be replicated for threads 1101a and 1101b. Some resources, such as re-order buffers in reorder/retirement unit <NUM>, ILTB <NUM>, load/store buffers, and queues may be shared through partitioning. Other resources, such as general purpose internal registers, page-table base register(s), low-level data-cache and data-TLB <NUM>, execution unit(s) <NUM>, and portions of out-of-order unit <NUM> are potentially fully shared.

Processor <NUM> often includes other resources, which may be fully shared, shared through partitioning, or dedicated by/to processing elements. In <FIG>, an embodiment of a purely exemplary processor with illustrative logical units/resources of a processor is illustrated. Note that a processor may include, or omit, any of these functional units, as well as include any other known functional units, logic, or firmware not depicted. As illustrated, core <NUM> includes a simplified, representative out-of-order (OOO) processor core. But an in-order processor may be utilized in different embodiments. The OOO core includes a branch target buffer <NUM> to predict branches to be executed/taken and an instruction-translation buffer (I-TLB) <NUM> to store address translation entries for instructions.

Core <NUM> further includes decode module <NUM> coupled to fetch unit <NUM> to decode fetched elements. Fetch logic, in one embodiment, includes individual sequencers associated with thread slots 1101a, 1101b, respectively. Usually core <NUM> is associated with a first ISA, which defines/specifies instructions executable on processor <NUM>. Often machine code instructions that are part of the first ISA include a portion of the instruction (referred to as an opcode), which references/specifies an instruction or operation to be performed. Decode logic <NUM> includes circuitry that recognizes these instructions from their opcodes and passes the decoded instructions on in the pipeline for processing as defined by the first ISA. For example, as discussed in more detail below decoders <NUM>, in one embodiment, include logic designed or adapted to recognize specific instructions, such as transactional instruction. As a result of the recognition by decoders <NUM>, the architecture or core <NUM> takes specific, predefined actions to perform tasks associated with the appropriate instruction. It is important to note that any of the tasks, blocks, operations, and methods described herein may be performed in response to a single or multiple instructions; some of which may be new or old instructions. Note decoders <NUM>, in one embodiment, recognize the same ISA (or a subset thereof). Alternatively, in a heterogeneous core environment, decoders <NUM> recognize a second ISA (either a subset of the first ISA or a distinct ISA).

In one example, allocator and renamer block <NUM> includes an allocator to reserve resources, such as register files to store instruction processing results. However, threads 1101a and 1101b are potentially capable of out-of-order execution, where allocator and renamer block <NUM> also reserves other resources, such as reorder buffers to track instruction results. Unit <NUM> may also include a register renamer to rename program/instruction reference registers to other registers internal to processor <NUM>. Reorder/retirement unit <NUM> includes components, such as the reorder buffers mentioned above, load buffers, and store buffers, to support out-of-order execution and later in-order retirement of instructions executed out-of-order.

Scheduler and execution unit(s) block <NUM>, in one embodiment, includes a scheduler unit to schedule instructions/operation on execution units. For example, a floating point instruction is scheduled on a port of an execution unit that has an available floating point execution unit. Register files associated with the execution units are also included to store information instruction processing results. Exemplary execution units include a floating point execution unit, an integer execution unit, a jump execution unit, a load execution unit, a store execution unit, and other known execution units.

Lower level data cache and data translation buffer (D-TLB) <NUM> are coupled to execution unit(s) <NUM>. The data cache is to store recently used/operated on elements, such as data operands, which are potentially held in memory coherency states. The D-TLB is to store recent virtual/linear to physical address translations. As a specific example, a processor may include a page table structure to break physical memory into a plurality of virtual pages.

Here, cores <NUM> and <NUM> share access to higher-level or further-out cache, such as a second level cache associated with on-chip interface <NUM>. Note that higher-level or further-out refers to cache levels increasing or getting further way from the execution unit(s). In one embodiment, higher-level cache is a last-level data cache-last cache in the memory hierarchy on processor <NUM>-such as a second or third level data cache. However, higher level cache is not so limited, as it may be associated with or include an instruction cache. A trace cache-a type of instruction cache-instead may be coupled after decoder <NUM> to store recently decoded traces. Here, an instruction potentially refers to a macro-instruction (i.e. a general instruction recognized by the decoders), which may decode into a number of micro-instructions (micro-operations).

In the depicted configuration, processor <NUM> also includes on-chip interface module <NUM>. Historically, a memory controller, which is described in more detail below, has been included in a computing system external to processor <NUM>. In this scenario, on-chip interface <NUM> is to communicate with devices external to processor <NUM>, such as system memory <NUM>, a chipset (often including a memory controller hub to connect to memory <NUM> and an I/O controller hub to connect peripheral devices), a memory controller hub, a northbridge, or other integrated circuit. And in this scenario, bus <NUM> may include any known interconnect, such as multi-drop bus, a point-to-point interconnect, a serial interconnect, a parallel bus, a coherent (e.g. cache coherent) bus, a layered protocol architecture, a differential bus, and a GTL bus.

Memory <NUM> may be dedicated to processor <NUM> or shared with other devices in a system. Common examples of types of memory <NUM> include DRAM, SRAM, non-volatile memory (NV memory), and other known storage devices. Note that device <NUM> may include a graphic accelerator, processor or card coupled to a memory controller hub, data storage coupled to an I/O controller hub, a wireless transceiver, a flash device, an audio controller, a network controller, or other known device.

Recently however, as more logic and devices are being integrated on a single die, such as SOC, each of these devices may be incorporated on processor <NUM>. For example in one embodiment, a memory controller hub is on the same package and/or die with processor <NUM>. Here, a portion of the core (an on-core portion) <NUM> includes one or more controller(s) for interfacing with other devices such as memory <NUM> or a graphics device <NUM>. The configuration including an interconnect and controllers for interfacing with such devices is often referred to as an on-core (or un-core configuration). As an example, on-chip interface <NUM> includes a ring interconnect for on-chip communication and a high-speed serial point-to-point link <NUM> for off-chip communication. Yet, in the SOC environment, even more devices, such as the network interface, co-processors, memory <NUM>, graphics processor <NUM>, and any other known computer devices/interface may be integrated on a single die or integrated circuit to provide small form factor with high functionality and low power consumption.

In one embodiment, processor <NUM> is capable of executing a compiler, optimization, and/or translator code <NUM> to compile, translate, and/or optimize application code <NUM> to support the apparatus and methods described herein or to interface therewith. A compiler often includes a program or set of programs to translate source text/code into target text/code. Usually, compilation of program/application code with a compiler is done in multiple phases and passes to transform hi-level programming language code into low-level machine or assembly language code. Yet, single pass compilers may still be utilized for simple compilation. A compiler may utilize any known compilation techniques and perform any known compiler operations, such as lexical analysis, preprocessing, parsing, semantic analysis, code generation, code transformation, and code optimization.

Larger compilers often include multiple phases, but most often these phases are included within two general phases: (<NUM>) a front-end, i.e. generally where syntactic processing, semantic processing, and some transformation/optimization may take place, and (<NUM>) a back-end, i.e. generally where analysis, transformations, optimizations, and code generation takes place. Some compilers refer to a middle, which illustrates the blurring of delineation between a front-end and back end of a compiler. As a result, reference to insertion, association, generation, or other operation of a compiler may take place in any of the aforementioned phases or passes, as well as any other known phases or passes of a compiler. As an illustrative example, a compiler potentially inserts operations, calls, functions, etc. in one or more phases of compilation, such as insertion of calls/operations in a front-end phase of compilation and then transformation of the calls/operations into lower-level code during a transformation phase. Note that during dynamic compilation, compiler code or dynamic optimization code may insert such operations/calls, as well as optimize the code for execution during runtime. As a specific illustrative example, binary code (already compiled code) may be dynamically optimized during runtime. Here, the program code may include the dynamic optimization code, the binary code, or a combination thereof.

Similar to a compiler, a translator, such as a binary translator, translates code either statically or dynamically to optimize and/or translate code. Therefore, reference to execution of code, application code, program code, or other software environment may refer to: (<NUM>) execution of a compiler program(s), optimization code optimizer, or translator either dynamically or statically, to compile program code, to maintain software structures, to perform other operations, to optimize code, or to translate code; (<NUM>) execution of main program code including operations/calls, such as application code that has been optimized/compiled; (<NUM>) execution of other program code, such as libraries, associated with the main program code to maintain software structures, to perform other software related operations, or to optimize code; or (<NUM>) a combination thereof.

Referring now to <FIG>, shown is a block diagram of another system <NUM> in accordance with an embodiment of the present disclosure. As shown in <FIG>, multiprocessor system <NUM> is a point-to-point interconnect system, and includes a first processor <NUM> and a second processor <NUM> coupled via a point-to-point interconnect <NUM>. Each of processors <NUM> and <NUM> may be some version of a processor. In one embodiment, <NUM> and <NUM> are part of a serial, point-to-point coherent interconnect fabric, such as a high-performance architecture. As a result, aspects of the present disclosure may be implemented within the QPI architecture.

While shown with only two processors <NUM>, <NUM>, it is to be understood that the scope of the present disclosure is not so limited. In other embodiments, one or more additional processors may be present in a given processor.

Processors <NUM> and <NUM> are shown including integrated memory controller units <NUM> and <NUM>, respectively. Processor <NUM> also includes as part of its bus controller units point-to-point (P-P) interfaces <NUM> and <NUM>; similarly, second processor <NUM> includes P-P interfaces <NUM> and <NUM>. Processors <NUM>, <NUM> may exchange information via a point-to-point (P-P) interface <NUM> using P-P interface circuits <NUM>, <NUM>. As shown in <FIG>, IMCs <NUM> and <NUM> couple the processors to respective memories, namely a memory <NUM> and a memory <NUM>, which may be portions of main memory locally attached to the respective processors.

Processors <NUM>, <NUM> each exchange information with a chipset <NUM> via individual P-P interfaces <NUM>, <NUM> using point to point interface circuits <NUM>, <NUM>, <NUM>, <NUM>. Chipset <NUM> also exchanges information with a high-performance graphics circuit <NUM> via an interface circuit <NUM> along a high-performance graphics interconnect <NUM>.

A shared cache (not shown) may be included in either processor or outside of both processors; yet connected with the processors via P-P interconnect, such that either or both processors' local cache information may be stored in the shared cache if a processor is placed into a low power mode.

In one embodiment, first bus <NUM> may be a Peripheral Component Interconnect (PCI) bus, or a bus such as a PCI Express bus or another third generation I/O interconnect bus, although the scope of the present disclosure is not so limited.

As shown in <FIG>, various I/O devices <NUM> are coupled to first bus <NUM>, along with a bus bridge <NUM> which couples first bus <NUM> to a second bus <NUM>. In one embodiment, second bus <NUM> includes a low pin count (LPC) bus. Various devices are coupled to second bus <NUM> including, for example, a keyboard and/or mouse <NUM>, communication devices <NUM> and a storage unit <NUM> such as a disk drive or other mass storage device which often includes instructions/code and data <NUM>, in one embodiment. Further, an audio I/O <NUM> is shown coupled to second bus <NUM>. Note that other architectures are possible, where the included components and interconnect architectures vary. For example, instead of the point-to-point architecture of <FIG>, a system may implement a multi-drop bus or other such architecture.

A design may go through various stages, from creation to simulation to fabrication. Data representing a design may represent the design in a number of manners. First, as is useful in simulations, the hardware may be represented using a hardware description language or another functional description language. Additionally, a circuit level model with logic and/or transistor gates may be produced at some stages of the design process. Furthermore, most designs, at some stage, reach a level of data representing the physical placement of various devices in the hardware model. In the case where conventional semiconductor fabrication techniques are used, the data representing the hardware model may be the data specifying the presence or absence of various features on different mask layers for masks used to produce the integrated circuit. In any representation of the design, the data may be stored in any form of a machine readable medium. A memory or a magnetic or optical storage such as a disc may be the machine readable medium to store information transmitted via optical or electrical wave modulated or otherwise generated to transmit such information. When an electrical carrier wave indicating or carrying the code or design is transmitted, to the extent that copying, buffering, or re-transmission of the electrical signal is performed, a new copy is made. Thus, a communication provider or a network provider may store on a tangible, machine-readable medium, at least temporarily, an article, such as information encoded into a carrier wave, embodying techniques of embodiments of the present disclosure.

A module as used herein refers to any combination of hardware, software, and/or firmware. As an example, a module includes hardware, such as a micro-controller, associated with a non-transitory medium to store code adapted to be executed by the micro-controller. Therefore, reference to a module, in one embodiment, refers to the hardware, which is specifically configured to recognize and/or execute the code to be held on a non-transitory medium. Furthermore, in another embodiment, use of a module refers to the non-transitory medium including the code, which is specifically adapted to be executed by the microcontroller to perform predetermined operations. And as can be inferred, in yet another embodiment, the term module (in this example) may refer to the combination of the microcontroller and the non-transitory medium. Often module boundaries that are illustrated as separate commonly vary and potentially overlap. For example, a first and a second module may share hardware, software, firmware, or a combination thereof, while potentially retaining some independent hardware, software, or firmware. In one embodiment, use of the term logic includes hardware, such as transistors, registers, or other hardware, such as programmable logic devices.

Use of the phrase `configured to,' in one embodiment, refers to arranging, putting together, manufacturing, offering to sell, importing and/or designing an apparatus, hardware, logic, or element to perform a designated or determined task. In this example, an apparatus or element thereof that is not operating is still `configured to' perform a designated task if it is designed, coupled, and/or interconnected to perform said designated task. As a purely illustrative example, a logic gate may provide a <NUM> or a <NUM> during operation. But a logic gate `configured to' provide an enable signal to a clock does not include every potential logic gate that may provide a <NUM> or <NUM>. Instead, the logic gate is one coupled in some manner that during operation the <NUM> or <NUM> output is to enable the clock. Note once again that use of the term `configured to' does not require operation, but instead focus on the latent state of an apparatus, hardware, and/or element, where in the latent state the apparatus, hardware, and/or element is designed to perform a particular task when the apparatus, hardware, and/or element is operating.

Furthermore, use of the phrases 'to,' `capable of/to,' and or 'operable to,' in one embodiment, refers to some apparatus, logic, hardware, and/or element designed in such a way to enable use of the apparatus, logic, hardware, and/or element in a specified manner. Note as above that use of to, capable to, or operable to, in one embodiment, refers to the latent state of an apparatus, logic, hardware, and/or element, where the apparatus, logic, hardware, and/or element is not operating but is designed in such a manner to enable use of an apparatus in a specified manner.

A value, as used herein, includes any known representation of a number, a state, a logical state, or a binary logical state. Often, the use of logic levels, logic values, or logical values is also referred to as <NUM>'s and <NUM>'s, which simply represents binary logic states. For example, a <NUM> refers to a high logic level and <NUM> refers to a low logic level. In one embodiment, a storage cell, such as a transistor or flash cell, may be capable of holding a single logical value or multiple logical values. However, other representations of values in computer systems have been used. For example the decimal number ten may also be represented as a binary value of <NUM> and a hexadecimal letter A. Therefore, a value includes any representation of information capable of being held in a computer system.

Moreover, states may be represented by values or portions of values. As an example, a first value, such as a logical one, may represent a default or initial state, while a second value, such as a logical zero, may represent a non-default state. In addition, the terms reset and set, in one embodiment, refer to a default and an updated value or state, respectively. For example, a default value potentially includes a high logical value, i.e. reset, while an updated value potentially includes a low logical value, i.e. set. Note that any combination of values may be utilized to represent any number of states.

The embodiments of methods, hardware, software, firmware or code set forth above may be implemented via instructions or code stored on a machine-accessible, machine readable, computer accessible, or computer readable medium which are executable by a processing element. A non-transitory machine-accessible/readable medium includes any mechanism that provides (i.e., stores and/or transmits) information in a form readable by a machine, such as a computer or electronic system. For example, a non-transitory machine-accessible medium includes random-access memory (RAM), such as static RAM (SRAM) or dynamic RAM (DRAM); ROM; magnetic or optical storage medium; flash memory devices; electrical storage devices; optical storage devices; acoustical storage devices; other form of storage devices for holding information received from transitory (propagated) signals (e.g., carrier waves, infrared signals, digital signals); etc., which are to be distinguished from the non-transitory mediums that may receive information there from.

Claim 1:
A processor (<NUM>) comprising:
attestation circuitry (<NUM>) to determine whether a compute resource of an offload device (<NUM>) connected to the processor (<NUM>) by an interconnect (<NUM>) is trusted; and
secure arbitration mode, SEAM, arbitration circuitry (<NUM>) to:
receive an instruction to form a trusted domain for a virtual machine that includes the compute resource of the offload device (<NUM>); and
provision the trusted domain for the virtual machine that includes the processor (<NUM>) and the compute resource,
wherein the SEAM arbitration circuitry (<NUM>) is to arbitrate with a SEAM arbitration circuitry (<NUM>) of the offload device (<NUM>) to expand the trusted domain to the offload device (<NUM>).