Abstract: A method and apparatus are described for converting a number from a floating point format to an integer format or from an integer format to a floating point format responsive to a control signal of a control signal format. Numbers are stored in the floating point format in a register of a first set of architectural registers in a packed format. One or more numbers in the floating point format are converted to the integer format and placed in a register of a second set of architectural registers in a packed format. Conversion from integer format to floating point format is performed in a similar manner. A floating point arithmetic apparatus is described that provides for converting a plurality of numbers between integer formats and a floating point formats, further providing for conversion operations that require a greater data path width than floating-point arithmetic operations.

Abstract: In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.

Abstract: An apparatus and method for performing a shuffle operation on packed data is described. In one embodiment, a 128-bit packed data operand having at eight data elements is accessed. In one embodiment, one of the data elements in the upper half of the data operand is shuffled into the upper half of a destination register. In another embodiment, one of the data elements in the lower half of the data operand is shuffled into the lower half of a destination register.

Abstract: The present invention is a method and apparatus to generates an isolated bus cycle for a transaction in a processor. A configuration storage contains configuration parameters to configure a processor in one of a normal execution mode and an isolated execution mode. An access generator circuit generates an isolated access signal using at least one of the isolated area parameters and access information in the transaction. The isolated access signal is asserted when the processor is configured in the isolated execution mode. A bus cycle decoder generates an isolated bus cycle corresponding to a destination in the transaction using the asserted isolated access signal and the access information.

Abstract: In some embodiments, the invention involves receiving remotely originating data (ROD) and creating a customized identification (CID) which is at least partially created through encrypting the ROD as a function of a platform key (PK) and a random number (RN) of a computer system receiving the ROD. Further, content is received which includes at least one watermark in which at least part of the CID is embedded. Authentication comparison data (ACD) is created which is at least partially created through decrypting data embedded in the watermark. In some embodiments, content includes first and second data sets, wherein the first data set is used to create a watermark key (WK) and the second data set is extracted utilizing the WK and the ACD includes at least part of the second data set.

Abstract: A file is sent to a remote signing authority via a network. The signing authority checks the file and provides a signature indicating file integrity of the file. The signature returned from the signing authority via the network is verified.

Abstract: In one embodiment, a method comprises configuring an access transaction generated by a processor by a configuration storage containing configuration parameters. The processor has a normal execution mode and an isolated execution mode. The access transaction has access information. In a further embodiment, a method comprises checking the access transaction by an access checking circuit using at least one of the configuration parameters and the access information.

Abstract: A chipset is initialized in a secure environment for an isolated execution mode by an initialization storage. The secure environment has a plurality of executive entities and is associated with an isolated memory area accessible by at least one processor. The at least one processor has a plurality of threads and operates in one of a normal execution mode and the isolated execution mode. The executive entities include a processor executive (PE) handler. PE handler data corresponding to the PE handler are stored in a PE handler storage. The PE handler data include a PE handler image to be loaded into the isolated memory area after the chipset is initialized. The loaded PE handler image corresponds to the PE handler.

Abstract: The present invention is a method and apparatus to protect a subset of a software environment. A key generator generates an operating system nub key (OSNK). The OSNK is unique to an operating system (OS) nub. The OS nub is part of an operating system in a secure platform. A usage protector uses the OSNK to protect usage of a subset of the software environment.

Abstract: Briefly, one embodiment of a platform for generating and utilizing a protected audit log is described. The platform comprises a system memory and a memory to contain an audit log. The audit log includes a plurality of single-write, multiple read entries. At least one of the entries of the audit log includes stored data integrity information loaded into the system memory during its power cycle.

Abstract: A chipset is initialized in a secure environment for an isolated execution mode by an initialization storage. The secure environment has a plurality of executive entities and is associated with an isolated memory area accessible by at least one processor. The at least one processor has a plurality of threads and operates in one of a normal execution mode and the isolated execution mode. The executive entities include a processor executive (PE) handler. PE handler data corresponding to the PE handler are stored in a PE handler storage. The PE handler data include a PE handler image to be loaded into the isolated memory area after the chipset is initialized. The loaded PE handler image corresponds to the PE handler.

Abstract: In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.

Abstract: In one embodiment, a method for certifying an attestation key comprises generating a remote attestation key pair within a platform and producing a certificate. The certificate includes a public attestation key to attest that a private attestation key, corresponding to the public attestation key, is stored in hardware-protected memory.

Abstract: In one embodiment, a method of remote attestation for a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing each of a plurality of IsoX software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving a remote attestation request from a remotely located platform. Then, the retrieved audit log is digitally signed to produce a digital signature for transfer to the remotely located platform.

Abstract: A method and apparatus for executing partial-width packed data instructions are discussed. The processor may include a plurality of registers, a register renaming unit, a decoder, and a partial-width execution unit. The register renaming unit provides an architectural register file to store packed data operands each of which include a plurality of data elements. The decoder is to decode a first and second set of instructions that each specify one or more registers in the architectural register file. The first set of instructions specify operations to be performed on all of the data elements stored in the one or more specified registers. In contrast, the second set of instructions specify operations to be performed on only a subset of the data elements. The partial-width execution unit is to execute operations specified by either of the first or the second set of instructions.

Abstract: A processor executive (PE) handles an operating system executive (OSE) in a secure environment. The secure environment has a fused key (FK) and is associated with an isolated memory area in the platform. The OSE manages a subset of an operating system (OS) running on the platform. The platform has a processor operating in one of a normal execution mode and an isolated execution mode. The isolated memory area is accessible to the processor in the isolated execution mode. A PE supplement supplements the PE with a PE manifest representing the PE and a PE identifier to identify the PE. A PE handler handles the PE using the FK and the PE supplement.

Abstract: A processor executive (PE) handles an operating system executive (OSE) in a secure environment. The secure environment has a platform key (PK) and is associated with an isolated memory area in the platform. The OSE manages a subset of an operating system (OS) running on the platform. The platform has a processor operating in one of a normal execution mode and an isolated execution mode. The isolated memory area is accessible to the processor in the isolated execution mode. A PE supplement supplements the PE with a PE manifest representing the PE and a PE identifier to identify the PE. A PE handler handles the PE using the PK and the PE supplement.

Abstract: The present invention provides a method, apparatus, and system for controlling memory accesses to multiple memory zones in an isolated execution environment. A processor having a normal execution mode and an isolated execution mode generates an access transaction. The access transaction is configured using a configuration storage that stores configuration settings. The configuration settings include a plurality of subsystem memory range settings defining memory zones. The access transaction also includes access information. A multi-memory zone access checking circuit, coupled to the configuration storage, checks the access transaction using at least one of the configuration settings and the access information. The multi-memory zone access checking circuit generates an access grant signal if the access transaction is valid.

Abstract: A method and apparatus are disclosed for staggering execution of an instruction. According to one embodiment of the invention, a macro instruction specifying an operation, and specifying a first and a second data operand in first and second registers, respectively, is received. The macro instruction is then split into a first micro instruction and a second micro instruction, the first micro instruction specifying the operation on a first corresponding segment including a first portion of the first data operand and a first portion of the second data operand, and the second micro instruction specifying the operation on a second corresponding segment including a second portion of the first data operand and a second portion of the second data operand. The first and second micro instructions are then executed.

Abstract: The present invention discloses a method and apparatus for saving and restoring registers. A single instruction is decoded. The single instruction moves contents of a plurality of registers associated with a functional unit in a processor to a memory; the processor operates under a plurality of operational modes and operand sizes. The single instruction arranges the contents in the memory according to a predetermined format into a plurality of groups, each group is aligned at an address boundary which corresponds to a multiple of 2N bytes. The predetermined format is constant for the plurality of operational modes and operand sizes. The single instruction retains the contents of the plurality of registers after moving.