I recall reading briefly about the capability to set up an isolated region of memory at boot time that gets locked down after creation and can run independently, at a more isolated level than a hypervisor etc. I can't recall the name of the technology to go dig into it.