Hardware enforcement of providing separate operating system environments for mobile devices

A method of preventing cross-contamination between operating systems (OSs), the method comprising:

• providing a processor comprising a first privileged processor mode, a second privileged processor mode, a secure boot process, security extensions, a memory and hardware devices;
• instantiating, in the first privileged processor mode, a Secure Monitor Module (SMM) through the secure boot process to create a trusted computing base;
• creating, with the SMM, fully-isolated runtime environments, wherein each environment hosts an Operating System (OS) running in the second privileged processor mode;
• dividing the memory into a SMM memory region for hosting the SMM and memory regions, wherein each of the memory regions is associated with one of the OSs;
• disabling access to the SMM memory region from each of the OSs, and to the memory regions for other OSs of the OSs;
• enabling access, for an active OS of the OSs, to a respective memory region of the active OS;
• and
• causing the SMM to isolate the OSs from the hardware devices using a plurality of isolation methods selected from exclusive direct access, sequential direct access, paravirtualization indirect access and virtualization indirect access,
• wherein
• the secure boot process verifies an integrity and authenticity of a bootloader,
• the first privileged processor mode is more privileged than the second privileged processor mode, and
• the second privileged processor mode does not have a capability to enable and disable access to the SMM memory region and the memory regions.