Abstract:
A method and apparatus for providing, in a processor, a shift operation on a packed data element having multiple values. The apparatus having multiple muxes, each of the multiple muxes having a first input, a second input, a select input and an output. Each of the multiple bits that represent a shifted packed intermediate result on a first bus is coupled to the corresponding first input. Each of the multiple bits representing a replacement bit for one of the multiple values is coupled to a corresponding second input. Each of the multiple bits driven by a correction circuit is coupled to a corresponding select input. Each output corresponds to a bit of a shifted packed result.
Abstract:
In an embodiment of the present invention, a technique is provided for remote attestation. An interface maps a device via a bus to an address space of a chipset in a secure environment for an isolated execution mode. The secure environment is associated with an isolated memory area accessible by at least one processor. The at least one processor operates in one of a normal execution mode and the isolated execution mode. A communication storage corresponding to the address space allows the device to exchange security information with the at least one processor in the isolated execution mode in a remote attestation.
Abstract:
The present invention is a method and apparatus to protect a subset of a software environment. A key generator generates an operating system nub key (OSNK). The OSNK is unique to an operating system (OS) nub. The OS nub is part of an operating system in a secure platform. A usage protector uses the OSNK to protect usage of a subset of the software environment.
Abstract translation:本发明是一种保护软件环境子集的方法和装置。 密钥生成器生成操作系统nub(OSNK)。 OSNK是操作系统(OS)nub所独有的。 OS nub是安全平台中操作系统的一部分。 使用保护程序使用OSNK来保护软件环境的子集的使用。
Abstract:
A processor capable of secure execution. The processor contains an execution unit and secure partition logic that secures a partition in memory. The processor also contains cryptographic logic coupled to the execution unit that encrypts and decrypts secure data and code.
Abstract:
In one embodiment, a method of remote attestation for a special mode of operation. The method comprises storing an audit log within protected memory of a platform. The audit log is a listing of data representing each of a plurality of IsoX software modules loaded into the platform. The audit log is retrieved from the protected memory in response to receiving a remote attestation request from a remotely located platform. Then, the retrieved audit log is digitally signed to produce a digital signature for transfer to the remotely located platform.
Abstract:
A method and apparatus for enabling hardware platform identification while ensuring privacy protection. The apparatus comprises a computer-readable medium that stores computer-executable instructions. Those instructions, when executed by a microprocessor, cause an expected hash value, which is derived from a key and a first identifier for a computer system; to be compared with a hash value, which is derived from the key and a second identifier for a computer system. A microprocessor for executing those instructions may comprise an identifier that identifies the microprocessor, and embedded instructions for comparing a hash value, derived from the identifier and a key, to an expected hash value.
Abstract:
The present invention provides a method, apparatus, and system for controlling memory accesses to multiple isolated memory areas in an isolated execution environment. A page manager is used to distribute a plurality of pages to a plurality of different areas of a memory, respectively. The memory is divided into non-isolated areas and isolated areas. The page manager is located in an isolated area of memory. Further, a memory ownership page table describes each page of memory and is also located in an isolated area of memory. The page manager assigns an isolated attribute to a page if the page is distributed to an isolated area of memory. On the other hand, the page manager assigns a non-isolated attribute to a page if the page is distributed to a non-isolated area of memory. The memory ownership page table records the attribute for each page. In one embodiment, a processor having a normal execution mode and an isolated execution mode generates an access transaction. The access transaction is configured using a configuration storage that contains configuration settings related to a page and access information. An access checking circuit coupled to the configuration storage checks the access transaction using at least one of the configuration settings and the access information and generates an access grant signal if the access transaction is valid.
Abstract:
An apparatus for performing a shift operation on a packed data element having a multiple values. The apparatus having multiple muxes, each of the multiple muxes having a first input, a second input, a select input and an output. Each of the multiple bits that represent a shifted packed intermediate result on a first bus is coupled to the corresponding first input. Each of the multiple bits representing a replacement bit for one of the multiple values is coupled to a corresponding second input. Each of the multiple bits driven by a correction circuit is coupled to a corresponding select input. Each output corresponds to a bit of a shifted packed result.
Abstract:
A branch operation is processed using a branch predict instruction and an associated branch instruction. The branch predict instruction indicates a predicted direction, a target address, and an instruction address for the associated branch instruction. When the branch predict instruction is detected, the target address is stored at an entry indicated by the associated branch instruction address and a prefetch request is triggered to the target address. The branch predict instruction may also include hint information for managing the storage and use of the branch prediction information.
Abstract:
Atomic memory operations are provided by using exportable “fetch and add” instructions and by emulating IA-32 instructions prepended with a lock prefix. In accordance with the present invention, a CPU includes a default control register that includes IA-32 lock check enable bit (LC) that when set to “1”, causes an IA-32 atomic memory reference to raise an IA-32 intercept lock fault. An IA-32 intercept lock fault handler branches to appropriate code to atomically emulate the instruction. Furthermore, the present invention defines an exportable fetch and add (FETCHADD) instruction that reads a memory location indexed by a first register, places the contents read from the memory location into a second register, increments the value read from the memory location, and stores the sum back to the memory location. Associated with each virtual memory page is a memory attribute that can assume a state of “cacheable using a write-back policy” (WB), “uncacheable” (UC), or “uncacheable and exportable” (UCE). When a FETCHADD instruction is executed and the memory location accessed is in a page having an attribute set to WB, the FETCHADD is atomically executed by the CPU by obtaining exclusive use of the cache line containing the memory location. However, when a FETCHADD instruction is executed and the memory location accessed is in a page having an attribute set to UCE, the FETCHADD is atomically executed by exporting the FETCHADD instruction to a centralized location, such as a memory controller.