Secure arbitration mode to build and operate within trust domain extensions

A processor comprising:

• decode circuitry to decode a SEAMCALL instruction for a virtual machine monitor (VMM) in legacy VMX root operation mode;
• and
• execution circuitry to perform operations corresponding to the SEAMCALL instruction, including to:
• cause a virtual machine (VM) exit;
• transition the processor from the legacy VMX root operation mode to a secure arbitration mode (SEAM) VMX root operation mode, wherein a SEAM module is to be hosted in the SEAM VMX root operation mode;
• store a VMM state of the processor to a virtual machine control structure (VMCS);
• load a SEAM module state of the processor from the VMCS;
• inhibit system management interrupts (SMI) and non-maskable interrupts (NMI) in the SEAM VMX root operation mode;
• and
• invoke the SEAM module.

A system comprising:

• a system memory;
• and
• a processor coupled with the system memory, the processor comprising:
• decode circuitry to decode a SEAMCALL instruction for a virtual machine monitor (VMM) in legacy VMX root operation mode;
• and
• execution circuitry to perform operations corresponding to the SEAMCALL instruction, including to:
• cause a virtual machine (VM) exit;
• transition the processor from the legacy VMX root operation mode to a secure arbitration mode (SEAM) VMX root operation mode, wherein a SEAM module is to be hosted in the SEAM VMX root operation mode;
• store a VMM state of the processor to a virtual machine control structure (VMCS);
• load a SEAM module state of the processor from the VMCS;
• inhibit system management interrupts (SMI) and non-maskable interrupts (NMI) in the SEAM VMX root operation mode;
• and
• invoke the SEAM module.

A method comprising:

• decoding a SEAMCALL instruction for a virtual machine monitor (VMM) in legacy VMX root operation mode;
• and
• performing operations corresponding to the SEAMCALL instruction, including:
• causing a virtual machine (VM) exit;
• transitioning a processor used to perform the operations from the legacy VMX root operation mode to a secure arbitration mode (SEAM) VMX root operation mode, wherein a SEAM module is hosted in the SEAM VMX root operation mode;
• storing a VMM state of the processor to a virtual machine control structure (VMCS);
• loading a SEAM module state of the processor from the VMCS;
• inhibiting system management interrupts (SMI) and non-maskable interrupts (NMI) in the SEAM VMX root operation mode;
• and
• invoking the SEAM module.