Abstract:
A multi-buffering apparatus in a random number generator. A microprocessor includes a random number generator that employs multiple buffers for buffering random data bytes generated by the generator. The apparatus maintains a first selector for selecting one of the buffers as the current buffer for filling with generated bytes. When the current fill buffer becomes full, the apparatus updates the first selector to a different buffer and continues the process until all buffers are full. The apparatus maintains a second selector for selecting one of the buffers as the current buffer for supplying random data bytes to an application. When the current supply buffer becomes empty, the apparatus updates the second selector to a different buffer and continues the process until all buffers are empty. The apparatus can concurrently fill the buffer selected by the fill selector and supply data from the buffer selected by the supply selector.

Description:
FIELD OF THE INVENTION  
         [0001]    This invention relates in general to the field of random number generation, and particularly to use buffering random numbers generated by a random number generator.  
         BACKGROUND OF THE INVENTION  
         [0002]    Historically, many computer software applications require a supply of random numbers. For example, Monte Carlo simulations of physical phenomena, such as large-scale weather simulations, require a supply of random numbers in order to simulate physical phenomenon. Other examples of applications requiring random numbers are casino games and on-line gambling to simulate card shuffling, dice rolling, etc.; lottery number creation; the generation of data for statistical analysis, such as for psychological testing; and use in computer games.  
           [0003]    The quality of randomness needed, as well as the performance requirements for generating random numbers, differs among these types of applications. Many applications such as computer games have trivial demands on quality of randomness. Applications such as psychological testing have more stringent demands on quality, but the performance requirements are relatively low. Large-scale Monte Carlo-based simulations, however, have very high performance requirements and require good statistical properties of the random numbers, although non-predictability is not particularly important. Other applications, such as on-line gambling, have very stringent randomness requirements as well as stringent non-predictability requirements.  
           [0004]    While these historical applications are still important, computer security generates the greatest need of high-quality random numbers. The recent explosive growth of PC networking and Internet-based commerce has significantly increased the need for a variety of security mechanisms.  
           [0005]    High-quality random numbers are essential to all major components of computer security, which are confidentiality, authentication, and integrity.  
           [0006]    Data encryption is the primary mechanism for providing confidentiality. Many different encryption algorithms exist, such as symmetric, public-key, and one-time pad, but all share the critical characteristic that the encryption/decryption key must not be easily predictable. The cryptographic strength of an encryption system is essentially the strength of the key, i.e., how hard it is to predict, guess, or calculate the decryption key. The best keys are long truly random numbers, and random number generators are used as the basis of cryptographic keys in all serious security applications.  
           [0007]    Many successful attacks against cryptographic algorithms have focused not on the encryption algorithm but instead on its source of random numbers. As a well-known example, an early version of Netscape&#39;s Secure Sockets Layer (SSL) collected data from the system clock and process ID table to create a seed for a software pseudo-random number generator. The resulting random number was used to create a symmetric key for encrypting session data. Two graduate students broke this mechanism by developing a procedure for accurately guessing the random number to guess the session key in less than a minute.  
           [0008]    Similar to decryption keys, the strength of passwords used to authenticate users for access to information is effectively how hard it is to predict or guess the password. The best passwords are long truly random numbers. In addition, in authentication protocols that use a challenge protocol, the critical factor is for the challenge to be unpredictable by the authenticating component. Random numbers are used to generate the authentication challenge.  
           [0009]    Digital signatures and message digests are used to guarantee the integrity of communications over a network. Random numbers are used in most digital signature algorithms to make it difficult for a malicious party to forge the signature. The quality of the random number directly affects the strength of the signature. In summary, good security requires good random numbers.  
           [0010]    Numbers by themselves are not random. The definition of randomness must include not only the characteristics of the numbers generated, but also the characteristics of the generator that produces the numbers. Software-based random number generators are common and are sufficient for many applications. However, for some applications software generators are not sufficient. These applications require hardware generators that generate numbers with the same characteristics of numbers generated by a random physical process. The important characteristics are the degree to which the numbers produced have a non-biased statistical distribution, are unpredictable, and are irreproducible.  
           [0011]    Having a non-biased statistical distribution means that all values have equal probability of occurring, regardless of the sample size. Almost all applications require a good statistical distribution of their random numbers, and high-quality software random number generators can usually meet this requirement. A generator that meets only the non-biased statistical distribution requirement is called a pseudo-random number generator.  
           [0012]    Unpredictability refers to the fact that the probability of correctly guessing the next bit of a sequence of bits should be exactly one-half, regardless of the values of the previous bits generated. Some applications do not require the unpredictability characteristic; however, it is critical to random number uses in security applications. If a software generator is used, meeting the unpredictability requirement effectively requires the software algorithm and its initial values be hidden. From a security viewpoint, a hidden algorithm approach is very weak. Examples of security breaks of software applications using a predictable hidden algorithm random number generator are well known. A generator that meets both the first two requirements is called a cryptographically secure pseudo-random number generator.  
           [0013]    In order for a generator to be irreproducible, two of the same generators, given the same starting conditions, must produce different outputs. Software algorithms do not meet this requirement. Only a hardware generator based on random physical processes can generate values that meet the stringent irreproducibility requirement for security. A generator that meets all three requirements is called a truly random number generator.  
           [0014]    Software algorithms are used to generate most random numbers for computer applications. These are called pseudo-random number generators because the characteristics of these generators cannot meet the unpredictability and irreproducibility requirements. Furthermore, some do not meet the non-biased statistical distribution requirements.  
           [0015]    Typically, software generators start with an initial value, or seed, sometimes supplied by the user. Arithmetic operations are performed on the initial seed to produce a first random result, which is then used as the seed to produce a second result, and so forth. Software generators are necessarily cyclical. Ultimately, they repeat the same sequence of output. Guessing the seed is equivalent to being able to predict the entire sequence of numbers produced. The irreproducibility is only as good as the secrecy of the algorithm and initial seed, which may be an undesirable characteristic for security applications. Furthermore, software algorithms are reproducible because they produce the same results starting with the same input. Finally, software algorithms do not necessarily generate every possible value within the range of the output data size, which may reflect poorly in the non-biased statistical distribution requirement.  
           [0016]    A form of random number generator that is a hybrid of software generators and true hardware generators are entropy generators. Entropy is another term for unpredictability. The more unpredictable the numbers produced by a generator, the more entropy it has. Entropy generators apply software algorithms to a seed generated by a physical phenomenon. For example, a highly used PC encryption program obtains its seed by recording characteristics of mouse movements and keyboard keystrokes for several seconds. These activities may or may not generate poor entropy numbers, and usually require some user involvement. The most undesirable characteristic of most entropy generators is that they are very slow to obtain sufficient entropy.  
           [0017]    It should be clear from the foregoing that certain applications, including security applications, require truly random numbers which can only be generated by a random physical process, such as the thermal noise across a semiconductor diode or resistor, the frequency instability of a free-running oscillator, or the amount a semiconductor capacitor is charged during a particular time period. Hardware random number generators employ the random physical processes such as these to generate numbers with desirable random number characteristics, if not truly random characteristics.  
           [0018]    Another advantage of hardware random number generators, in addition to their desirable random number characteristics, is that they can typically produce random numbers at a faster rate than software random number generators or entropy generators. In fact, a hardware random number generator may be capable of generating random numbers at an overall faster rate than the software application can consume them. However, many applications tend not to demand the random numbers at a constant rate. Instead, the applications tend to request a relatively large number of random data bytes in a chunk, use the large chunk, and then request another large chunk after a relatively large amount of time. For example, an encryption program might request 16 random data bytes, then use the 16 bytes to perform encryption for a relatively long time, and then ask for another 16 random data bytes. In addition, the operating system may perform a task switch and allow itself or another application to run on the processor for a while, during which time the software application consuming the random data bytes is not demanding random data. If the hardware random number generator is not generating random data while the application is not requesting it, then the next time the application requests more random data bytes the application will have to wait for the generator to generate the bytes. This detrimentally affects the performance of the application.  
           [0019]    Therefore, what is needed is a hardware random number generator that asynchronously generates random data and buffers the random data in such a way as to provide good performance characteristics.  
         SUMMARY  
         [0020]    The present invention provides an apparatus for buffering the random data using multiple large buffers for storing the data so that the hardware generator can continue to generate random data and have it ready for the application when the application requests it. Accordingly, in attainment of the aforementioned object, it is a feature of the present invention to provide an apparatus for efficiently buffering random data in a random number generator. The apparatus includes a demultiplexer. The demultiplexer includes a data input that receives a random data byte. The demultiplexer also includes at least first and second outputs that selectively output the random data byte. The demultiplexer also includes a control input that specifies which of the at least first and second outputs to provide the random data byte on. The apparatus also includes at least first and second buffers, having at least first and second inputs, respectively, coupled to the at least first and second demultiplexer outputs, respectively. The at least first and second buffers also have at least first and second outputs, respectively. The apparatus also includes control logic, coupled to the demultiplexer, which generates a control signal, coupled to the demultiplexer control input. The control signal specifies one of the at least first and second buffers to receive the random data byte.  
           [0021]    In another aspect, it is a feature of the present invention to provide a microprocessor. The microprocessor includes an instruction translator that translates an instruction. The instruction instructs the microprocessor to store random data into a memory coupled to the microprocessor. The microprocessor also includes a random number generator, coupled to the instruction translator, that has a plurality of buffers for storing random data bytes. The random number generator loads one or more random data bytes into a first of the plurality of buffers while concurrently storing one or more random data bytes from a second of the plurality of buffers to the memory in response to the instruction translator translating the instruction.  
           [0022]    In another aspect, it is a feature of the present invention to provide a method for generating random data. The method includes initializing a plurality of counters to zero. The plurality of counters specify a number of valid random data bytes stored in a plurality of corresponding buffers. The method also includes initializing first and second selectors to select a first of the plurality of buffers and a corresponding first of the plurality of counters. The method also includes loading a random data byte into one of the plurality of buffers selected by the first selector and incrementing the corresponding counter, determining whether one of the plurality of buffers selected by the first selector is full, and updating the first selector to select another one of the plurality of buffers if the one of the plurality of buffers selected by the first selector is full. The method also includes repeating the loading, the determining, and the updating.  
           [0023]    In another aspect, it is a feature of the present invention to provide an apparatus for efficiently buffering random data in a random number generator. The apparatus includes a random data byte generator, for generating random data bytes, and a plurality of buffers, coupled to the random data byte generator, which buffer the random data bytes. The apparatus also includes a write selector, coupled to the plurality of buffers, that selects one of the plurality of buffers to write one or more random data bytes into. The apparatus also includes a read selector, coupled to the plurality of buffers, that selects one of the plurality of buffers to read one or more random data bytes out of. The apparatus also includes control logic, coupled to the plurality of buffers, that generates the write selector and the read selector.  
           [0024]    An advantage of the present invention is that it allows random data bytes to be accumulated even when they are not being requested thereby improving the performance of software applications that demand random numbers by increasing the likelihood that random data will be available when requested. Another advantage is that for applications that request data at a high rate, the hardware generator is allowed to produce random data at or near its maximum capability.  
           [0025]    Other features and advantages of the present invention will become apparent upon study of the remaining portions of the specification and drawings. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0026]    [0026]FIG. 1 is a block diagram illustrating a microprocessor according to the present invention.  
         [0027]    [0027]FIG. 2 is a block diagram illustrating the RNG unit of the microprocessor of FIG. 1 according to the present invention.  
         [0028]    [0028]FIG. 3 is a block diagram illustrating various registers in the microprocessor of FIG. 1 related to the RNG unit of FIG. 1 according to the present invention.  
         [0029]    [0029]FIG. 4 is a flowchart illustrating operation of the microprocessor of FIG. 1 when executing an instruction that loads a value into the XMM0 register of FIG. 3 according to the present invention.  
         [0030]    [0030]FIG. 5 is a block diagram illustrating operation of the microprocessor of FIG. 1 when executing an XLOAD instruction according to the present invention.  
         [0031]    [0031]FIG. 6 is a flowchart illustrating operation of the microprocessor of FIG. 1 when executing an XLOAD instruction according to the present invention.  
         [0032]    [0032]FIG. 7 is a block diagram illustrating operation of the microprocessor of FIG. 1 when executing an XSTORE instruction according to the present invention.  
         [0033]    [0033]FIG. 8 is a flowchart illustrating operation of the microprocessor of FIG. 1 when executing an XSTORE instruction according to the present invention.  
         [0034]    [0034]FIG. 9 is a flowchart illustrating an example of multi-tasking operation of the microprocessor of FIG. 1 with respect to random number generation according to the present invention.  
         [0035]    [0035]FIG. 10 is a block diagram illustrating the string filter of the RNG unit of FIG. 2 of the microprocessor of FIG. 1 according to the present invention.  
         [0036]    [0036]FIG. 11 is a flowchart illustrating operation of the string filter of FIG. 10 according to the present invention.  
         [0037]    [0037]FIG. 12 is a block diagram illustrating operation of the microprocessor of FIG. 1 when executing an XSTORE instruction according to an alternate embodiment of the present invention.  
         [0038]    [0038]FIG. 13 is a flowchart illustrating multi-buffering operation of the RNG unit of FIG. 2 according to the present invention.  
         [0039]    [0039]FIG. 14 is a flowchart illustrating operation of the microprocessor of FIG. 1 when executing an XLOAD instruction according to an alternate embodiment of the present invention.  
         [0040]    [0040]FIG. 15 is a flowchart illustrating operation of the microprocessor of FIG. 1 when executing an XSTORE instruction according to an alternate embodiment of the present invention.  
         [0041]    [0041]FIGS. 16 and 17 are block diagrams illustrating operation of the microprocessor of FIG. 1 when executing an XSTORE instruction according to alternate embodiments of the present invention. 
     
    
     DETAILED DESCRIPTION  
       [0042]    Referring now to FIG. 1, a block diagram illustrating a microprocessor  100  according to the present invention is shown. Microprocessor  100  of FIG. 1 is a pipelined microprocessor comprising multiple stages, each of which performs a portion of the execution of program instructions as described below.  
         [0043]    Microprocessor  100  includes a random number generator (RNG) unit  136 . Microprocessor  100  executes operating systems and application programs that may require a supply of random numbers for various functions such as data encryption, simulations of physical phenomena, statistical analysis, or numerical analysis, among others. RNG unit  136  generates random numbers for these uses. RNG unit  136  will be described in more detail below.  
         [0044]    Microprocessor  100  also includes an instruction cache  102 . Instruction cache  102  caches program instructions fetched from a system memory coupled to microprocessor  100 .  
         [0045]    Microprocessor  100  also includes an instruction fetcher  104  coupled to instruction cache  102 . Instruction fetcher  104  controls the fetching of the instructions from the system memory and/or instruction cache  102 . Instruction fetcher  104  selects a value for an instruction pointer maintained by microprocessor  100 . The instruction pointer specifies the next memory address from which to fetch instructions. Normally the instruction pointer is sequentially incremented to the next instruction. However, control flow instructions, such as branches, jumps, subroutine calls and returns, may cause the instruction pointer to be updated to a non-sequential memory address specified by the control flow instruction. In addition, interrupts may cause the instruction fetcher  104  to update the instruction pointer to a non-sequential address.  
         [0046]    Microprocessor  100  also includes an interrupt unit  146  coupled to instruction fetcher  104 . Interrupt unit  146  receives an interrupt signal  148  and an interrupt vector  152 . An entity external to microprocessor  100  may assert the interrupt signal  148  and provide an interrupt vector  152  to cause microprocessor  100  to execute an interrupt service routine. Interrupt unit  146  determines the memory address of an interrupt service routine based on the interrupt vector  152  and provides the interrupt service routine memory address to instruction fetcher  104 , which updates the instruction pointer to the interrupt service routine address. Interrupt unit  146  also selectively disables and enables interrupt servicing depending upon the particular instructions being executed by microprocessor  100 . That is, if interrupts are disabled, then the instruction pointer will not be changed even though interrupt line  148  is asserted until interrupts are enabled.  
         [0047]    Microprocessor  100  also includes an instruction translator  106  coupled to instruction fetcher  104 , interrupt unit  146 , and RNG unit  136 . Instruction translator  106  translates instructions received from instruction cache  102  and/or system memory. Instruction translator  106  translates the instructions and takes appropriate actions based on the type of instruction translated. Instruction translator  106  translates instructions defined in the instruction set of microprocessor  100 . Instruction translator  106  generates an illegal instruction exception if it translates an instruction that is not defined in the instruction set of microprocessor  100 .  
         [0048]    In one embodiment, the instruction set of microprocessor  100  is substantially similar to the instruction set of an Intel® Pentium III® or Pentium IV® microprocessor. However, advantageously microprocessor  100  of the present invention includes additional instructions relating to the generation of random numbers by RNG unit  136 . One additional instruction is an XSTORE instruction that stores random numbers generated by RNG unit  136 . Another additional instruction is an XLOAD instruction that loads control values from system memory into a control and status register (CSR)  226  in RNG unit  136  and into a Streaming SIMD Extensions (SSE) register XMM0  372 , which are described below with respect to FIGS. 2 and 3. The XSTORE and XLOAD instructions are described in more detail below.  
         [0049]    Additionally, instruction translator  106  provides information about translated instructions to interrupt unit  146  to enable interrupt unit  146  to appropriately enable and disable interrupts. Furthermore, instruction translator  106  provides information about translated instructions to RNG unit  136 . For example, instruction translator  106  provides information to RNG unit  136  about translated XSTORE and XLOAD instructions. In addition, instruction translator  106  informs RNG unit  136  when an instruction is translated that loads values into SSE register XMM0  372 , in response to which RNG unit  136  takes certain actions, such as setting a flag to indicate the possible occurrence of a task switch by the operating system, as described below.  
         [0050]    In one embodiment, instruction translator  106  translates a macroinstruction, such as a Pentium III or IV instruction, into one or more microinstructions that are executed by the microprocessor  100  pipeline.  
         [0051]    Microprocessor  100  also includes a microcode ROM  132  coupled to instruction translator  106 . Microcode ROM  132  stores microcode instructions for provision to instruction translator  106  to be executed by microprocessor  100 . Some of the instructions in the instruction set of microprocessor  100  are implemented in microcode. That is, when instruction translator  106  translates one of these instructions, instruction translator  106  causes a routine of microinstructions within microcode ROM  132  to be executed to perform the translated macroinstruction. In one embodiment, the XSTORE and/or XLOAD instructions are implemented in microcode. Additionally, in one embodiment, the XSTORE and XLOAD instructions are atomic because they are uninterruptible. That is, interrupts are disabled during the execution of XSTORE and XLOAD instructions.  
         [0052]    Microprocessor  100  also includes a register file  108  coupled to instruction translator  106 . Register file  108  includes the user-visible registers of microprocessor  100 , among others. In one embodiment, the user-visible registers of register file  108  include the user-visible register set of a Pentium III or IV. SSE registers  352  of FIG. 3 are included in register file  108 . SSE registers  352  are used by an SSE unit  134  included in microprocessor  100  and by RNG unit  136 , as described below. In particular, register file  108  includes registers that are known to contemporary operating systems. Consequently, when an operating system switches from a first task to a second task, the operating system saves to system memory the registers in register file  108 , including SSE registers  352 , for the first task and restores from system memory the registers in register file  108 , including SSF registers  352 , for the second task.  
         [0053]    Microprocessor  100  also includes an address generator  112  coupled to register file  108 . Address generator  112  generates memory addresses based on operands stored in register file  108  and based on operands supplied by the instructions translated by instruction translator  106 . In particular, address generator  112  generates a memory address specifying the location in system memory to which an XSTORE instruction stores bytes of random data. Additionally, address generator  112  generates a memory address specifying the location in system memory from which an XLOAD instruction loads control values for storage in CSR  226  of FIG. 2 via a data bus  142 .  
         [0054]    Microprocessor  100  also includes a load unit  114  coupled to address generator  112 . Load unit  114  loads data from the system memory into microprocessor  100 . Load unit  114  also includes a data cache that caches data read from the system memory. Load unit  114  loads data for provision to execution units in microprocessor  100 , such as SSE unit  134 , RNG unit  136  and execution units included in execute stage  116 , on data bus  142 . In particular, load unit  114  loads control values from system memory for storage in CSR  226  of FIG. 2 to execute an XLOAD instruction.  
         [0055]    Microprocessor  100  also includes execute stage  116  coupled to load unit  114  via data bus  142 . Execute stage  116  includes execution units such as arithmetic logic units for performing arithmetical and logical operations, such as adds, subtracts, multiplies, divides, and Boolean operations. In one embodiment, execute stage  116  includes an integer unit for performing integer operations and a floating-point unit for performing floating-point operations.  
         [0056]    Microprocessor  100  also includes SSE unit  134  coupled to load unit  114  and instruction translator  106 . SSE unit  134  includes arithmetic and logic units for executing SSE instructions, such as those included in the Pentium III and IV SSE or SSE2 instruction set. In one embodiment, although SSE registers  352  of FIG. 3 are included conceptually in register file  108 , they are physically located in SSE unit  134  for storing operands used by SSE unit  134 .  
         [0057]    Microprocessor  100  also includes RNG unit  136  coupled to instruction translator  106  and to load unit  114  via data bus  142 . RNG unit  136  provides on a data bus  144  the random data bytes and a count specifying the number of random data bytes provided for an XSTORE instruction. RNG unit  136  will be described in more detail below with respect to the remaining Figures.  
         [0058]    Microprocessor  100  also includes a store unit  118  coupled to execute unit  116 , SSE unit  134 , and RNG unit  136 . Store unit  118  stores data to the system memory and the data cache of load unit  114 . Store unit  118  stores results generated by execute unit  116 , SSE unit  134 , and RNG unit  136  to system memory. In particular, store unit  118  stores XSTORE instruction count and random data bytes provided on data bus  144  by RNG unit  136  to system memory.  
         [0059]    Microprocessor  100  also includes a write-back unit  122  coupled to execute unit  116  and register file  108 . Write-back unit  122  writes back instruction results to register file  108 .  
         [0060]    Microprocessor  100  also includes write buffers  124  coupled to write-back unit  122 . Write buffers  124  hold data waiting to be written to system memory, such as XSTORE instruction count and data.  
         [0061]    Microprocessor  100  also includes a bus interface unit (BIU)  128  coupled to write buffers  124 . BTU  128  interfaces microprocessor  100  with a processor bus  138 . Processor bus  138  couples microprocessor  100  to the system memory. BIU  128  performs bus transactions on processor bus  138  to transfer data between microprocessor  100  and system memory. In particular, BIU  128  performs one or more bus transactions on processor bus  138  to store XSTORE instruction count and data to system memory. Additionally, BIU  128  performs one or more bus transactions on processor bus  138  to load XLOAD instruction control values from system memory.  
         [0062]    Microprocessor  100  also includes read buffers  126  coupled to BIU  128  and register file  108 . Read buffers  126  hold data received from system memory by BIU  128  while waiting to be provided to load unit  114  or register file  108 . In particular, read buffers  126  hold XLOAD instruction data received from system memory while waiting to be provided to load unit  114  and subsequently to RNG unit  136 .  
         [0063]    Referring now to FIG. 2, a block diagram illustrating RNG unit  136  of microprocessor  100  of FIG. 1 according to the present invention is shown.  
         [0064]    RNG unit  136  includes control logic  244 . Control logic  244  includes a large amount of combinatorial and sequential logic for controlling various elements of RNG unit  136 . Control logic  244  receives an xload signal  272  and an xstore signal  268  that indicate an XLOAD or XSTORE instruction, respectively, is being executed. Control logic  244  also receives a reset signal  248  that indicates RNG unit  136  is being reset. Control logic  244  is described below in detail in connection with the remainder of RNG unit  136 .  
         [0065]    RNG unit  136  also includes a self-test unit  202  coupled to control logic  244 . Self-test unit  202  receives a self-test enable signal  292  from a control and status register, referred to as machine specific register (MSR)  212 , which is described in more detail with respect to FIG. 3 below. MSR  212  is also coupled to control logic  244 . Self-test unit  202  provides a self-test fail signal  288  to control logic  244 . Self-test unit  202  performs various self-tests of RNG unit  136  if enabled by self-test enable signal  292 . If the self-tests fail, self-test unit  202  generates a true value on self-test fail signal  288 , which is also provided to MSR  212 . In one embodiment, self-test unit  202  performs statistical random number generator tests as defined by the Federal Information Processing Standards (FIPS) Publication 140-2 at pages 35-36, which are hereby incorporated by reference.  
         [0066]    In one embodiment, self-test unit  202  performs the self-tests upon demand by a user. In one embodiment, self-test unit  202  performs the self-tests after a reset of microprocessor  100 . If the self-tests fail, either on demand or on reset, self-test unit  202  generates a true value on self-test fail signal  288 , which is reflected in a self-test failed bit  318  of FIG. 3 of MSR  212 . Control logic  244  examines the self-test failed bit  318  on reset. If the self-test failed bit  318  is true, then control logic  244  asserts a false value on an RNG present signal  286  that is provided to MSR  212  for updating an RNG present bit  314  of FIG. 3.  
         [0067]    RNG present signal  286  is also provided to a CPUID register  204  that includes an RNG present bit  302  of FIG. 3 that is also updated by RNG present signal  286 . That is, RNG present bit  302  of CPUID register  204  is a copy of RNG present bit  314  of MSR  212 . In one embodiment, an application program may read CPUID register  204  by executing a CPUID instruction in the IA-32 instruction set. If RNG present bit  302  is false, then microprocessor  100  indicates that RNG unit  136  is not present and the random number generation features of microprocessor  100  are not available. Advantageously, an application requiring random numbers may detect the absence of RNG unit  136  in microprocessor  100  via RNG present bit  302  and choose to obtain random numbers by another, perhaps lower performance, source if the RNG unit  136  is not present.  
         [0068]    RNG unit  136  also includes two random bit generators, denoted random bit generator 0  206  and random bit generator 1  208 , coupled to control logic  244 . Each of the random bit generators  206  and  208  generate a stream of random bits that are accumulated by RNG unit  136  into bytes of random data. Each of the random bit generators  206  and  208  receive a power_cntrl signal  231  that specifies whether to power down the random bit generators  206  and  208 . In one embodiment, powering down the random bit generators  206  and  208  comprises not providing a clock signal to them. The random bit generators  206  and  208  each generate a series of random data bits based on random electrical characteristics of microprocessor  100 , such as thermal noise.  
         [0069]    Random bit generator 0  206  receives a DC bias signal  296  from MSR  212 . DC bias signal  296  conveys a value stored in DC bias bits  322  of FIG. 3 of MSR  212 . The DC bias signal  296  value specifies a direct current bias voltage for partially controlling an operating voltage of free running ring oscillators in random bit generator 0  206 .  
         [0070]    Random bit generator 0  206  is described in detail in pending U.S. patent applications Ser. Nos. 10/046055, 10/046054, and 10/046057 entitled APPARATUS FOR GENERATING RANDOM NUMBERS, OSCILLATOR BIAS VARIATION MECHANISM, and OSCILLATOR FREQUENCY VARIATION MECHANISM, respectively, (atty dkt# cntr.2113, cntr.2155, cntr.2156) which are hereby incorporated by reference in their entirety.  
         [0071]    RNG unit  136  also includes a two-input mux  214  whose inputs are coupled to the outputs of random bit generators  206  and  208 . Mux  214  selects one of the two inputs based on a control signal gen select  252  provided by CSR  226 . The gen select signal  252  conveys a value stored in a gen select bit  336  of FIG. 3 in CSR  226 .  
         [0072]    RNG unit  136  also includes a von Neumann whitener, or compressor,  216  coupled to the output of mux  214 . Whitener  216  is selectively enabled/disabled by a raw bits signal  254  received from MSR  212 . The raw bits signal  254  conveys a value stored in raw bits field  324  of FIG. 3 of MSR  212 . If raw bits signal  254  is true, then whitener  216  simply passes the bits received from mux  214  through to its output without performing the whitening function. Whitener  216  functions to significantly reduce residual bias that may exist in random bit generators  206  and  208  by receiving a pair of bits from mux  214  and outputting either one or none bits according to a predetermined put/output function. The input/output function of whitener  216  is described in Table 1 below.  
                           TABLE 1                                   Input   Output                           00   nothing           01   0           10   1           11   nothing                      
 
         [0073]    RNG unit  136  also includes an eight-bit shift register  218  coupled to whitener  216 . Shift register  218  buffers random data bits received from whitener  216 , accumulates the random data bits into eight-bit bytes, and outputs the accumulated random data bytes. Shift register  218  asserts a byte_generated signal  282  to control logic  244  to indicate that it has accumulated and output a random data byte  298 .  
         [0074]    RNG unit  136  also includes a continuous number test (CNT) unit  222  coupled to the output of shift register  218 . CNT unit  222  receives random bytes  298  from shift register  218  and performs a continuous random number generator test on the random bytes  298 . CNT unit  222  is selectively enabled/disabled by a CNT enable signal  284  received from CSR  226 . CNT enable signal  284  conveys a value stored in a CNT enable bit  342  of FIG. 3 of CSR  226 . If the continuous random number generator test fails, CNT unit  222  asserts a CNT fail signal  294  provided to CSR  226 , which is stored in CNT failed bit  344  of FIG. 3 in CSR  226 .  
         [0075]    In one embodiment, the continuous random number generator test performed by CNT unit  222  substantially conforms to the continuous random number generator test described on page 37 in FIPS 140-2, which is hereby incorporated by reference. In one embodiment, CNT unit  222  performs the test by employing two eight-byte buffers, referred to as “old” and “new.” After a reset, and after self-test if it is enabled, the first eight bytes delivered by shift register  218  are accumulated in buffer old. The next eight bytes are accumulated in buffer new. When an XSTORE instruction is executed, the eight bytes in buffer old are compared with the eight bytes in buffer new. If the bytes are not equal, then the test passes and the eight bytes in buffer new are moved to buffer old, and buffer new is cleared awaiting accumulation of eight more bytes. However, if the bytes are equal, CNT unit  222  asserts the CNT fail signal  294  to signify that the continuous random number generator test failed.  
         [0076]    In one embodiment, XSTORE instructions will return an available byte count of zero as long as the CNT enable  342  and CNT failed  344  bits of FIG. 3 are set. In one embodiment, microprocessor  100  stores the available byte count and random data bytes to system memory on the particular XSTORE instruction execution that triggered the continuous random number generator test that failed.  
         [0077]    In one embodiment, the continuous random number generator test is not performed across tasks that do not all have the test enabled. That is, the new and old buffers are updated and the continuous random number generator test is performed only for XSTORE instructions executed when the CNT enable bit  342  is set. Consequently, a given task is guaranteed to never receive two consecutive eight-byte values that are equal. However, if two tasks are running and one sets the CNT enable bit  342  and the other does not, then RNG unit  136  may XSTORE eight bytes to one task, a task switch occurs, and RNG unit  136  may XSTORE to the other task eight bytes equal to the previous eight bytes; however, the continuous random number generator test will not fail in this case.  
         [0078]    RNG unit  136  also includes a string filter  224  coupled to the output of shift register  218 . String filter  224  receives random bytes  298  from shift register  218  and selectively discards certain of the random bytes as described below, and outputs the non-discarded random bytes. String filter  224  ensures that no contiguous string of like bits, i.e., no contiguous string of zero bits or contiguous string of one bits, longer than a specified value is generated by RNG unit  136 . The value is specified by a max_cnt signal  258  received from CSR  226 . The max_cnt signal  258  conveys a value specified in string filter max_cnt field  346  of FIG. 3 in CSR  226 . In one embodiment, the default value of max_cnt  346  is 26 bits. In one embodiment, the value of the string filter max_cnt field  346  must be at least 8. If string filter  224  detects a contiguous string of like bits exceeding max_cnt  258 , then string filter  224  asserts a filter fail signal  256 , which is stored in string filter fail bit  338  of FIG. 3 in CSR  226 . String filter  224  is described in more detail below with respect to FIGS. 10 through 12.  
         [0079]    RNG unit  136  also includes a second two-input mux  228 . One of the inputs is coupled to the output of string filter  224 , and the other input is coupled to the output of shift register  218 . Mux  228  selects one of the inputs based on a filter enable signal  262  provided by CSR  226 , which conveys the value stored in a string filter enable bit  334  of FIG. 3 of CSR  226 .  
         [0080]    RNG unit  136  also includes a one-input, two-output demultiplexer  232  whose input is coupled to the output of mux  228 . A demultiplexer circuit includes a single data input and a plurality of data outputs. A demultiplexer also includes a control input. A demultiplexer selects one of the plurality of data outputs based on the control input and provides the data received on the data input to the selected output. Demux  232  selectively provides a random data byte received on its input to one of its outputs based on a fill_select signal  264  provided by control logic  244 .  
         [0081]    RNG unit  136  also includes two data buffers, denoted buf0  242  and buf1  246 , coupled to the outputs of demux  232 . Buf0  242  and buf1  246  accumulate random data bytes to be stored to system memory by XSTORE instructions. In one embodiment, buf0  242  and buf1  246  each are capable of storing up to 15 bytes of random data. In one embodiment, buf0  242  and buf1  246  each are capable of storing up to 16 bytes of random data.  
         [0082]    RNG unit  136  also includes a third two-input mux  236  whose inputs are coupled to the outputs of buf0  242  and buf1  246 . Mux  236  selects one of the sets of random data bytes on its inputs based on a store_select signal  266  provided by control logic  244  to output on a data bus  278 .  
         [0083]    RNG unit  136  also includes a TSPO flag register  274  coupled to control logic  244 . TSPO flag register  274  stores a flag indicating whether a task switch by the operating system possibly occurred. Use of TSPO flag register  274  will be described below in more detail.  
         [0084]    RNG unit  136  also includes a second two-output demux  215  coupled to control logic  244 . The input of demux  215  is coupled to receive an increment signal  221  generated by control logic  244 . Control logic  244  asserts increment signal  221  each time a random data byte is stored into buf0  242  or buf1  246 . Demux  215  selectively provides increment signal  221  received on its input to one of its outputs based on fill_select signal  264 .  
         [0085]    RNG unit  136  also includes a third two-input demux  217  coupled to control logic  244 . The input of demux  217  is coupled to receive a clear signal  223  generated by control logic  244 . Control logic  244  asserts clear signal  223  each time an XSTORE instruction is executed such that the valid random data bytes are removed from buf0  242  or buf1  246 . Demux  217  selectively provides clear signal  223  received on its input to one of its outputs based on store_select signal  266 .  
         [0086]    RNG unit  136  also includes two counters, denoted cntr0  211  and cntrl  213 , coupled to demux  215  and demux  217 . Cntr0  211  and cntr1  213  each have an increment, or count, input. The count inputs are coupled to the outputs of demux  215 . Hence, when control logic  244  asserts increment signal  221 , one of cntr0  211  and cntr1  213  specified by fill_select signal  264  is incremented. Cntr0  211  and cntr1  213  also each have a clear input. The clear inputs are coupled to the outputs of demux  217 . Hence, when control logic  244  asserts clear signal  223 , one of cntr0  211  and cntr1  213  specified by store_select signal  266  is cleared to zero.  
         [0087]    RNG unit  136  also includes two comparators  225  coupled to the outputs of cntr0  211  and cntr1  213 . Comparators  225  compare the counts output by cntr0  211  and cntr1  213  with the number of bytes cntr0  211  and cntr1  213  are capable of storing to determine whether cntr0  211  and cntr1  213  are full and generate a full0 signal  229  and full1 signal  227  to indicate the comparison results to control logic  244 .  
         [0088]    RNG unit  136  also includes a fourth two-input mux  219  whose inputs are coupled to the output of cntr0  211  and cntr1  213 . Mux  219  selects one of the counts on its inputs based on store_select signal  266  to output as an available byte count  234 . The available byte count  234  is also provided to CSR  226 .  
         [0089]    RNG unit  136  also includes a register denoted RNG R5  238 , or R5  238 . R5  238  has one input coupled to the output of mux  236  to receive data bytes 278. R5  238  has another input coupled to the output of mux  219  to receive available byte count  234 . The output of R5  238  is coupled to data bus  144  of FIG. 1. R5  238  holds the count and data for an XSTORE instruction. In one embodiment, the count is stored in the least significant byte of R5  238  and the valid data bytes are stored in increasingly significant byte locations contiguous to the count. In one embodiment, R5  238  is capable of storing one count byte plus the number of random data bytes capable of being stored by buf0  242  and buf1  246 .  
         [0090]    In one embodiment, RNG unit  136  includes four buffers rather than two. Each of the buffers is capable of storing up to eight bytes of random data. In this embodiment, demux  215 ,  217 , and  232  comprise four-output demuxes; mux  219  and  236  comprise four-input muxes; comparators  225  comprise four comparators that generate four full outputs; and fill_select signal  264  and store_select signal  266  comprise two bits for selecting one of the four counters and buffers.  
         [0091]    Referring now to FIG. 3, a block diagram illustrating various registers in microprocessor  100  of FIG. 1 related to RNG unit  136  of FIG. 1 according to the present invention is shown.  
         [0092]    [0092]FIG. 3 shows CPUID register  204  of FIG. 2. CPUID register  204  includes an RNG present bit  302 . RNG present bit  302  is a read-only feature-flags bit. If RNG present bit  302  is 1, then RNG unit  136  is present and enabled on microprocessor  100 . If RNG present bit  302  is 0, then RNG unit  136  is not present, and the XLOAD and XSTORE instructions are invalid and if encountered by instruction translator  106  will cause an invalid instruction exception. Additionally, the bits in MSR  212  are undefined when read and have no effect when written. RNG present bit  302  is a copy of RNG present bit  314  of MSR  212 .  
         [0093]    [0093]FIG. 3 also shows MSR  212  of FIG. 2. MSR  212  includes an RNG enable bit  312 . RNG enable bit  312  is writable. Writing RNG enable bit  312  to a 1 enables RNG unit  136 . Writing RNG enable bit  312  to a 0 disables RNG unit  136 . If RNG enable bit  312  is 0, then the XLOAD and XSTORE instructions are invalid and if encountered by instruction translator  106  will cause an invalid instruction exception. Additionally, the bits in MSR  212  are undefined when read and have no effect when written. The value of RNG enable bit  312  immediately after reset is 0.  
         [0094]    MSR  212  also includes a read-only RNG present bit  314 . RNG present bit  314  indicates whether RNG unit  136  exists on microprocessor  100 . If RNG present bit  314  is 0, then RNG unit  136  cannot be enabled by setting RNG enable bit  312 , and the bits in MSR  212  are undefined when read and have no effect when written. Additionally, RNG present bit  314  is cleared if the RNG unit  136  self-test fails, as described above with respect to FIG. 2.  
         [0095]    MSR  212  also includes a read-only statistical self-test enabled bit  316 . Self-test enabled bit  316  indicates whether the reset self-test described above with respect to FIG. 2 is currently enabled. If self-test enabled bit  316  is 0, then no self-test is performed after reset. If self-test enabled bit  316  is 1, then a self-test is performed after reset. In one embodiment, a self-test is performed after a warm reset as well as a power-up reset of microprocessor  100 .  
         [0096]    MSR  212  also includes a read-only statistical self-test failed bit  318 . Self-test failed bit  318  indicates whether the last reset self-test described above with respect to FIG. 2 failed or not. In one embodiment, if self-test failed bit  318  is 1, then RNG unit  136  cannot be enabled.  
         [0097]    MSR  212  also includes writable DC bias bits  322 . In one embodiment, DC bias bits  322  comprise three bits. DC bias bits  322  control the DC bias supplied to random bit generator 0  206 , which affects the speed and possible randomness of random bit generator 0  206 . In one embodiment, if the statistical self-test is performed at reset, then the self-test unit  202  determines a correct or best value for DC bias bits  322  and sets them to the value. The value of DC bias bits  322  immediately after a reset is 000.  
         [0098]    MSR  212  also includes writable raw bits bit  324 . If the raw bits bit  324  is set to 0, then whitener  216  of FIG. 2 performs its whitening function described above with respect to FIG. 2 and delivers whitened bits to shift register  218 . If the raw bits bit  324  is set to 1, then whitener  216  does not perform its whitening function and instead delivers the raw bits from mux  214  to shift register  218 . The value of the raw bits bit  324  immediately after a reset is 0.  
         [0099]    [0099]FIG. 3 also shows CSR  226  of FIG. 2. In one embodiment, CSR  226  is a 128-bit register. CSR  226  includes a read-only available byte count field  332 . The available byte count field  332  specifies how many bytes of random data are currently available in buf0  242  or buf1  246  as selected by store_select signal  266  for storing via an XSTORE instruction. Software can read the available byte count field  332 , if desired, in order to determine the number of random data bytes currently available for storing via an XSTORE instruction. Because RNG unit  136  synchronously accumulates bytes into buf0  242  and buf1  246 , the actual number of bytes available to be stored by an XSTORE may be greater at the time the XSTORE is executed than the available byte count  332  previously read by an XLOAD. The value of the available byte count field  332  immediately after RNG unit  136  is enabled is 0.  
         [0100]    CSR  226  also includes a writable string filter enable bit  334 . If string filter enable bit  334  is 1, then string filter  224  is enabled; otherwise string filter  224  is disabled. The operation of string filter  224  is described below in more detail with respect to FIGS. 10 through 12. The value of the string filter enable bit  334  immediately after RNG unit  136  is enabled is 0.  
         [0101]    CSR  226  also includes a writable gen select bit  336 . If gen select bit  336  is set to 0, then random bit generator 0  206  is selected via mux  214  of FIG. 2 to provide the random bit stream for accumulation; otherwise, random bit generator 1  208  is selected. The value of the gen select bit  336  immediately after RNG unit  136  is enabled is 0.  
         [0102]    CSR  226  also includes a string filter fail bit  338 . String filter fail bit  338  is set to 1 to indicate that string filter  224  detected a contiguous string of like bits longer than a value specified in string filter max_cnt field  346  as described above with respect to FIGS.  2 , and  10  through  12 . Only RNG unit  136  can set the string filter fail bit  338  to 1. However, software may clear string filter fail bit  338  by writing a 0 to it. In one embodiment, filter fail bit  338  is set to 1 by a pulse on filter fail signal  256  and remains set to 1 until software clears it. The value of the string filter fail bit  338  immediately after RNG unit  136  is enabled is 0.  
         [0103]    CSR  226  also includes a writable CNT enable bit  342 . If the CNT enable bit  342  is 1, then CNT unit  222  performs its continuous random number generator tests as described above with respect to FIG. 2. The value of the CNT enable bit  342  immediately after RNG unit  136  is enabled is 0.  
         [0104]    CSR  226  also includes a read-only CNT failed bit  344 . RNG unit  136  sets CNT failed bit  344  to 1 if the CNT enable bit  342  is 1 and the continuous random number generator tests fail. In one embodiment, an XSTORE instruction executed while both the CNT enable bit  342  and the CNT failed bit  344  are 1 results in the XSTORE storing an available byte count of 0 and no data bytes to system memory. Hence, if a task sets the CNT enable bit  342  and a failure occurs while the task is executing, RNG unit  136  is effectively disabled for the task. However, RNG unit  136  is not disabled for other tasks not setting the CNT enable bit  342 . The value of the CNT failed bit  344  immediately after RNG unit  136  is enabled is 0.  
         [0105]    CSR  226  also includes a writable string filter max_cnt field  346 . Software writes the string filter max_cnt field  346  to specify the maximum number of allowable contiguous like bits tolerable, as described with respect to FIGS. 10 through 12 below. In one embodiment, the string filter max_cnt field  346  comprises 5 bits. In one embodiment, the default value of string filter max_cnt field  346  is 26.  
         [0106]    In one embodiment, various ones of the fields of MSR  212  are included in CSR  226  rather than MSR  212 . Hence, the values in MSR  212  are saved and restored with CSR  226  to accommodate multitasking operation as described herein, and particularly with respect to FIGS. 4 through 9.  
         [0107]    [0107]FIG. 3 also shows RNG R5 register  238  of FIG. 2. R5  238  comprises two fields: an available byte count field  362  and another field  364  for storing random data bytes, as described above. In one embodiment, the valid random data bytes are right adjusted next to the available byte count field  362 .  
         [0108]    [0108]FIG. 3 also shows SSE registers  352 . SSE registers  352  comprise eight  128  -bit registers denoted XMM0 through XMM7. XMM0 is designated XMM0  372 , XMM3 is designated  376 , and XMM5 is designated XMM5  374  in FIG. 3. In one embodiment, SSE registers  352  are substantially similar to SSE registers comprised in a Pentium III or IV as described on page 10-4 of IA-32® Intel Architecture Software Developer&#39;s Manual, Volume 1: Basic Architecture, 2002, which is hereby incorporated by reference. RNG CSR  226  shadows XMM0  372  and RNG R5  238  shadows XMM5  374  as described below.  
         [0109]    In one embodiment, microprocessor  100  includes various fuses that may be temporarily or permanently set during the manufacturing process of microprocessor  100  to select values of various bits in the CSR  226  and MSR  212  at reset time in order to override the reset values described above.  
         [0110]    Referring now to FIG. 4, a flowchart illustrating operation of microprocessor  100  of FIG. 1 when executing an instruction that loads a value into XMM0 register  372  of FIG. 3 according to the present invention is shown. An instruction that loads XMM0  372  is an instruction executed by the microprocessor that loads the XMM0 register  372  with a value from system memory, such as a MOVAPS instruction. The MOVAPS instruction moves data from system memory to a specified XMM register, or vice versa, and is described on pages 3-443 through 3-444 of the IA-32® Intel Architecture Software Developer&#39;s Manual, Volume 2: Instruction Set Reference, 2001, which are hereby incorporated by reference. Examples of other instructions that load XMM0  372  from system memory are MOVAPD and MOVDQA. Because XMM0  372  is a register saved to memory and restored from memory by the operating system on a task switch, when a task switch occurs the operating system will execute an instruction such as a MOVAPS instruction to restore the switched-to task&#39;s previous value of XMM0  372  from memory. Flow begins at block  402 .  
         [0111]    At block  402 , microprocessor  100  executes an instruction such as the MOVAPS instruction by fetching the value from the location in system memory specified by the instruction and loads the value into XMM0  372 . Hence, any time XMM0  372  is loaded from memory, it is possible that a task switch has occurred. Flow proceeds to block  404 .  
         [0112]    At block  404 , instruction translator  106  notifies RNG unit  136  that a MOVAPS instruction, or similar instruction that loads XMM0  372  from memory, has been translated. Once the value has been loaded into XMM0  372 , control logic  244  of RNG unit  136  sets the TSPO flag  274  to indicate that a task switch possibly occurred. Flow ends at block  404 .  
         [0113]    Referring now to FIG. 5, a block diagram illustrating operation of microprocessor  100  of FIG. 1 when executing an XLOAD instruction according to the present invention is shown. The XLOAD instruction is the means by which software loads a value into the CSR  226  of FIG. 2 to specify the control values under which RNG unit  136  will operate. A new instruction beyond the Pentium III or IV instruction set is required to load CSR  226  since CSR  226  does not exist in a Pentium III or IV. Advantageously, the XLOAD instruction also loads the control values into XMM0  372  to facilitate multitasking operation with RNG unit  136  as described herein.  
         [0114]    [0114]FIG. 5 shows the format of an XLOAD instruction specifying XMM0  372 , which is:  
         [0115]    XLOAD XMM0 , memaddr  
         [0116]    where memaddr specifies a memory address in system memory  502 . The XLOAD instruction operates like the MOVAPS instruction except that CSR  226  is also loaded with the value from memory in addition to XMM0  372 . In one embodiment, XLOAD moves 16 bytes of data  504  from memaddr into CSR  226  and also into XMM0  372 , as shown. In one embodiment, the opcode value for the XLOAD instruction is 0×0F 0×5A followed by the standard mod R/M register and address format bytes specified by ×86 instructions. In another embodiment, the opcode value for the XLOAD instruction is 0×0F 0×A6 0×C0. If an XLOAD instruction specifies one of the SSE registers  352  other than XMM0  372 , then the specified SSE register  352  is loaded; however, CSR  226  is not loaded.  
         [0117]    Referring now to FIG. 6, a flowchart illustrating operation of microprocessor  100  of FIG. 1 when executing an XLOAD instruction to XMM0 register  372  of FIG. 3 according to the present invention is shown. Flow begins at block  602 .  
         [0118]    At block  602 , microprocessor  100  loads CSR  226  of FIG. 2 and XMM0  372  of FIG. 3 with the value in system memory  502  at the memory address specified by the XLOAD instruction as shown in FIG. 5. Flow proceeds to block  604 .  
         [0119]    At block  604 , RNG unit  136  discards the contents of buf0  242  and buf1  246  in response to the loading of CSR  226  since the random data bytes accumulated in buf0  242  and buf1  246  may not have been generated with the control values in CSR  226  required by the new task that is now loading CSR  226 . Flow proceeds to block  606 .  
         [0120]    At block  606 , RNG unit  136  clears the available byte count to 0 in cntr0  211  and cntr1  213  since the random data bytes in buf0  242  and buf1  246  were discarded at block  604 . Flow proceeds to block  608 .  
         [0121]    At block  608 , RNG unit  136  restarts the random number accumulation. That is, the random bit generator  206  or  208  selected by gen select signal  252  generates random bits based on DC bias signal  296  in the case of random bit generator 0  206 ; whitener  216  selectively whitens the bits based on the raw bits signal  254 ; CNT unit  222  selectively performs continuous random number generator tests based on CNT enable signal  284 ; string filter  224  selectively filters the bytes accumulated by shift register  218  based on filter enable signal  262  and max_cnt signal  258 ; buf0  242  and buf1  246  accumulate the random data bytes based on fill_select signal  264 ; and cntr0  211  and cntr1  213  count the bytes accumulated in buf0  242  and buf1  246  based on fill_select signal  264 . Flow proceeds to block  612 .  
         [0122]    At block  612 , control logic  244  clears TSPO flag  274  since CSR  226  has been updated to the control values desired by the current task. Flow ends at block  612 .  
         [0123]    Referring now to FIG. 7, a block diagram illustrating operation of microprocessor  100  of FIG. 1 when executing an XSTORE instruction according to the present invention is shown. The XSTORE instruction is the means by which software stores the count of available random data bytes and the random data bytes themselves from R5  238  to system memory. A new instruction beyond the Pentium III or IV instruction set is required to store RNG R5  238  since it does not exist in a Pentium III or IV. Advantageously, the XSTORE instruction atomically writes the count and data bytes to memory to facilitate multitasking operation with RNG unit  136  as described herein. That is, the XSTORE instruction is not interruptible. Hence, when a task executes an XSTORE instruction, another task may not interrupt the XSTORE instruction to modify the available byte count or random data bytes that will be written to system memory by the XSTORE instruction. Hence, the XSTORE instruction advantageously inherently facilitates multitasking with respect to supplying a variable number of random data bytes by atomically writing both the data and count.  
         [0124]    [0124]FIG. 7 shows the format of an XSTORE instruction, which is:  
         [0125]    XSTORE memaddr, XMM5  
         [0126]    Memaddr specifies a memory address in system memory  502 . The XSTORE instruction operates like the MOVAPS instruction except that the specified XMM register is not stored to system memory; instead R5  238  is stored to system memory if XMM5  374  is specified. That is, R5  238  shadows XMM5  374 . XSTORE moves the count specifying the available valid random data bytes 362 of FIG. 3 from R5  238  to a location  702  at memaddr in system memory  502 , as shown. Additionally, XSTORE moves the valid random bytes of data  364  specified by the count  362  to a location  704  in system memory  502  immediately adjacent to the available byte count  702 , as shown.  
         [0127]    In one embodiment, the opcode value for the XSTORE instruction is 0×0F 0×5B followed by the standard mod R/M register and address format bytes specified by ×86 instructions. In another embodiment, the opcode value for the XSTORE instruction is 0×0F 0×A7 0×C0. In one embodiment, the XSTORE instruction requires that the ES:EDI registers in register file  108  specify memaddr, i.e., point to the starting memory address where the count and random data bytes are to be stored. In one embodiment, the XSTORE does not allow segment overriding. If an XSTORE instruction specifies one of the SSE registers  352  other than XMM5  374 , then the results are undefined.  
         [0128]    In one embodiment, the number of random data bytes 704 that microprocessor  100  stores to system memory equals the available byte count  702  also written to system memory.  
         [0129]    In another embodiment, the number of random data bytes 704 that microprocessor  100  stores to system memory is equal to one less than the size in bytes of RNG R5  238 . That is, if RNG R5  238  is a 16-byte register capable of holding up to 15 random data bytes 364 and one byte of available byte count  362 , then microprocessor  100  stores 16 bytes to system memory  502 : 15 bytes of random data to the random data bytes 704 location and one count byte to the available byte count  702  location in system memory  502 . However, some of the 15 bytes written to system memory  502  may not be valid. In one embodiment, the number of bytes written to memory is always a power of 2. Only the first N bytes are valid, where N is the available byte count  702 .  
         [0130]    In this embodiment, RNG unit  136  clears the buffer, i.e., buf0  242  or buf1  246  of FIG. 2, implicated by an XSTORE operation. By clearing the buffer, microprocessor  100  improves security by avoiding the problem of tasks being able to view one another&#39;s random data. For example, assume a first task performs a first XSTORE that stores 15 bytes of random data from buf0  242  to system memory and a second XSTORE that stores 15 bytes of random data from buf1  246  to system memory; then the operating system switches to a second task which immediately executes an XSTORE before RNG unit  136  has accumulated any more bytes of random data into buf0  242 . If the RNG unit  136  did not clear buf0  242  after the first XSTORE, then the random data received by the first task would also be stored to the second task&#39;s memory location, thereby enabling the second task to view the first task&#39;s random data.  
         [0131]    In one embodiment, the XSTORE instruction specifies a maximum number of random data bytes to store to system memory. In one embodiment, the maximum number of bytes is specified in one of the general-purpose registers of register file  108 , such as ECX. In this embodiment, if more bytes are available in buf0  242  or buf1  246  selected by store_select  266  than the maximum number specified in ECX, then microprocessor  100  only stores the maximum number of bytes specified in ECX; otherwise, the XSTORE instruction stores the number of valid bytes available. In either case, the XSTORE instruction stores into the available byte count location  702  the number of valid random data bytes stored to the data byte location  704  in system memory  502 .  
         [0132]    In one embodiment, the XSTORE instruction specifies a required number of random data bytes to store to system memory. In this embodiment, the required number of bytes is specified in one of the general-purpose registers of register file  108 , such as ECX. In this embodiment, the XSTORE instruction is prefixed with an ×86 REP prefix. In this embodiment, the REP XSTORE instruction is not atomic. That is, the REP XSTORE is interruptible since the number of random bytes required may be large. However, since the number of random data bytes stored is not variable, i.e., the software knows the number of random data bytes that are to be stored to memory, it is not necessary that the instruction be atomic.  
         [0133]    Referring now to FIG. 8, a flowchart illustrating operation of microprocessor  100  of FIG. 1 when executing an XSTORE instruction from XMM5 register of FIG. 3 according to the present invention is shown. Flow begins at block  802 .  
         [0134]    At block  802  interrupt unit  146  of FIG. 1 disables interrupts in response to instruction translator  106  of FIG. 1 notifying interrupt unit  146  that an XSTORE instruction was translated. Flow proceeds to decision block  804 .  
         [0135]    At decision block  804 , control logic  244  of FIG. 2 examines TSPO flag  274  to determine whether the flag is set. If so flow proceeds to block  806 . Otherwise, flow proceeds to block  816 .  
         [0136]    At block  806 , RNG unit  136  copies the contents of XMM0  372  to CSR  226  and clears the TSPO flag  274 . Since TSPO flag  274  indicates that a task switch may have possibly occurred since the last XSTORE or XLOAD, as indicated by a load from system memory of XMM0  372  according to step  402  of FIG. 4, the possibility exists that CSR  226  does not have the correct control values for the task currently executing the XSTORE instruction. Hence, the XSTORE instruction must update the CSR  226  with the correct control values. The correct values are stored in XMM0  372 , since the correct control values were originally loaded into XMM0  372  and also into CSR  226  by an XLOAD executed when the task initialized and were restored to XMM0  372  by the operating system when it switched hack to the current task. Flow proceeds to block  808 .  
         [0137]    At block  808 , RNG unit  136  discards the contents of buf0  242  and buf1  246  in response to the loading of CSR  226  since the random data bytes accumulated in buf0  242  and buf1  246  may not have been generated with the control values in CSR  226  required by the new task for which new control values were copied into CSR  226  in block  806 . Flow proceeds to block  812 .  
         [0138]    At block  812 , RNG unit  136  clears the available byte count to 0 in cntr0  211  and cntr1  213  since the random data bytes in buf0  242  and buf1  246  were discarded at block  808 . Flow proceeds to block  814 .  
         [0139]    At block  814 , RNG unit  136  restarts the random number accumulation, as described above with respect to block  608  of FIG. 6. Flow proceeds to block  816 .  
         [0140]    At block  816 , RNG unit  136  atomically stores R5  238  to system memory  502  at the memory address specified by the XSTORE instruction, which holds the value of cntr0  211  or cntr1  213  specified by store_select signal  266  along with the valid random data bytes from buf0  242  or buf1  246  specified by store_select signal  266 , as shown in FIG. 7. Flow proceeds to block  818 .  
         [0141]    At block  818 , control logic  244  asserts clear signal  223  to clear cntr0  211  or cntr1  213  specified by store_select signal  266  since the valid random data bytes have been consumed by the store to memory at block  816 . Flow proceeds to block  822 .  
         [0142]    At block  822 , control logic  244  updates store_select signal  266 . That is, if store_select signal  266  was 0, then control logic  244  updates store_select signal  266  to 1. Conversely, if store_select signal  266  was 1, then control logic  244  updates store_select signal  266  to 0. Flow proceeds to block  824 .  
         [0143]    At block  824 , interrupt unit  146  enables interrupts since the XSTORE instruction has completed execution. Flow ends at block  824 .  
         [0144]    Referring now to FIG. 9, a flowchart illustrating an example of multi-tasking operation of microprocessor  100  of FIG. 1 with respect to random number generation according to the present invention is shown. The flowchart of FIG. 9 illustrates a typical scenario in which two tasks each initialize RNG unit  136  and execute XSTORE instructions to store random data bytes to memory. FIG. 9 illustrates how the present invention advantageously supports multitasking between the two tasks, task A and task B, even though the operating system does not include support for saving and restoring the state of RNG unit  136 , namely CSR  226 . Flow begins at block  902 .  
         [0145]    At block  902 , a reset occurs, which causes control logic  244  to clear TSPO flag  274 . Flow proceeds to block  904 .  
         [0146]    At block  904 , the operating system starts up task A, and task A&#39;s initialization code executes an XLOAD instruction to XMM0  372  to initialize CSR  226  and XMM0  372  with the desired control values denoted value A. Flow proceeds to block  906 .  
         [0147]    At block  906 , RNG unit  136  discards the contents of buf0  242  and buf1  246 , clears cntr0  211  and cntr1  213 , restarts random number generation and accumulation, and clears TSPO flag  274  in response to the XLOAD, according to blocks  604 ,  606 ,  608 , and  612  of FIG. 6. Flow proceeds to block  908 .  
         [0148]    At block  908 , task A executes an XSTORE instruction to store random data generated based on control value A loaded into CSR  226  at block  904 . Flow proceeds to block  912 .  
         [0149]    At block  912 , to execute the XSTORE of the previous block, RNG unit  136  atomically stores the count and data to system memory accumulated since the restart at block  906 , as shown in FIG. 7 and described in FIG. 8. Flow proceeds to block  914 .  
         [0150]    At block  914 , the operating system performs a task switch from task A to task B. Among other things, the operating system stores the value of XMM0  372 , which contains control value A, to system memory to save the state of task A. However, the operating system does not store CSR  226  to memory to save its state because the operating system does not know about CSR  226 . Flow proceeds to block  916 .  
         [0151]    At block  916 , RNG unit  136  sets TSPO flag  274  in response to the load of XMM0  372  at block  914 , according to step  404  of FIG. 4. Flow proceeds to block  918 .  
         [0152]    At block  918 , the operating system starts up task B, and task B&#39;s initialization code executes an XLOAD instruction to XMM0  372  to initialize CSR  226  and XMM0  372  with the desired control values denoted value B. Flow proceeds to block  922 .  
         [0153]    At block  922 , RNG unit  136  discards the contents of buf0  242  and buf1  246 , clears cntr0  211  and cntr1  213 , restarts random number generation and accumulation, and clears TSPO flag  274  in response to the XLOAD, according to blocks  604 ,  606 ,  608 ,  612  of FIG. 6. Flow proceeds to block  924 .  
         [0154]    At block  924 , task B executes an XSTORE instruction to store random data generated based on control value B loaded into CSR  226  at block  918 . Flow proceeds to block  924 .  
         [0155]    At block  926 , to execute the XSTORE of the previous block, RNG unit  136  atomically stores the count and data to system memory accumulated since the restart at block  922 , as shown in FIG. 7 and described in FIG. 8. Flow proceeds to block  928 .  
         [0156]    At block  928 , the operating system performs a task switch from task B to task A. Among other things, the operating system stores the value of XMM0  372 , which contains control value B, to system memory to save the state of task B. However, the operating system does not store CSR  226  to memory to save its state because the operating system does not know about CSR  226 . Additionally, the operating system restores the state of task A, which includes loading into XMM0  372  value A from system memory previously saved at block  914 . Flow proceeds to block  932 .  
         [0157]    At block  932 , RNG unit  136  sets TSPO flag  274  in response to the load of XMM0  372  at block  928 , according to step  404  of FIG. 4. Flow proceeds to block  934 .  
         [0158]    At block  934 , task A executes an XSTORE instruction to store random data generated based on control value A loaded into CSR  226  at block  904 . However, value A was overwritten in CSR  226  at block  918 . Hence, the random data bytes currently accumulated in buf0  242  and buf1  246  were not generated based on value A, but instead were generated based on value B. Flow proceeds to block  936 .  
         [0159]    At block  936 , RNG unit  136  determines that TSPO flag  274  is set according to block  804  of FIG. 8, and consequently copies the contents of XMM0  372  to CSR  226 , thereby restoring value A to CSR  226 , according to block  806  of FIG. 8. In addition, RNG unit  136  clears TSPO flag  274 , according to block  806 , since CSR  226  has been restored. Flow proceeds to block  938 .  
         [0160]    At block  938 , RNG unit  136  discards the contents of buf0  242  and buf1  246 , clears cntr0  211  and cntr1  213 , and restarts random number generation and accumulation, in response to the copy into CSR  226  at block  936 , according to blocks  808 ,  812 , and  814  of FIG. 8. Flow proceeds to block  942 .  
         [0161]    At block  942 , to execute the XSTORE of block  934 , RNG unit  136  atomically stores the count and data to system memory accumulated since the restart at the previous block, as shown in FIG. 7 and described in FIG. 8. In this case, the count is 0 and no valid random data bytes are stored to system memory since cntr0  211  and cntr1  213  were cleared and the contents of buf0  242  and buf1  246  were discarded at the previous block. Flow proceeds to block  944 .  
         [0162]    At block  944 , task A executes an XSTORE instruction to store random data generated based on control value A loaded into CSR  226  at block  904 , which was restored to value A at block  936 . Flow proceeds to block  946 .  
         [0163]    At block  946 , to execute the XSTORE of the previous block, RNG unit  136  atomically stores the count and data to system memory accumulated since the restart at block  938 , as shown in FIG. 7 and described in FIG. 8. Flow proceeds to block  948 .  
         [0164]    At block  948 , task A executes an XSTORE instruction to store random data generated based on control value A loaded into CSR  226  at block  904 , which was restored to value A at block  936 . Flow proceeds to block  952 .  
         [0165]    At block  952 , to execute the XSTORE of the previous block, RNG unit  136  atomically stores the count and data to system memory accumulated since the restart at block  938 , less the bytes stored by the last XSTORE, which was at block  946 , as shown in FIG. 7 and described in FIG. 8. Flow ends at block  952 .  
         [0166]    Referring now to FIG. 10, a block diagram illustrating string filter  224  of RNG unit  136  of FIG. 2 of microprocessor  100  of FIG. 1 according to the present invention is shown.  
         [0167]    For the purposes of the present disclosure, leading one bits are defined as the contiguous one bits at the beginning of a byte. A byte may contain between zero and eight, inclusive, leading one bits. For example, the byte 00011111 has five leading one bits; the byte 11111110 has zero leading one bits; and the byte 11111111 has eight leading one bits.  
         [0168]    For the purposes of the present disclosure, leading zero bits are defined as the contiguous zero bits at the beginning of a byte. A byte may contain between zero and eight, inclusive, leading zero bits. For example, the byte 11100000 has five leading zero bits; the byte 00000001 has zero leading zero bits; and the byte 00000000 has eight leading zero bits.  
         [0169]    For the purposes of the present disclosure, trailing one bits are defined as the contiguous one bits at the end of a byte; however a byte that is all ones is defined as having no trailing one bits. A byte may contain between zero and seven, inclusive, trailing one bits. For example, the byte 11110000 has four trailing one bits; the byte 11111110 has seven trailing one bits; the byte 01111111 has zero trailing one bits; and the byte 11111111 has zero trailing one bits.  
         [0170]    For the purposes of the present disclosure, trailing zero bits are defined as the contiguous zero bits at the end of a byte; however a byte that is all zeros is defined as having no trailing zero bits. A byte may contain between zero and seven, inclusive, trailing zero bits. For example, the byte 00001111 has four trailing zero bits; the byte 00000001 has seven trailing zero bits; the byte 10000000 has zero trailing zero bits; and the byte 0000000 has zero trailing zero bits.  
         [0171]    String filter  224  includes compare logic  1002 . Compare logic  1002  receives random data byte  298  from shift register  218  of FIG. 2. Compare logic  1002  examines the bits in the random data byte  298  and generates various signals used to detect contiguous strings of ones and zeros as now described.  
         [0172]    Compare logic  1002  generates a num_leading_ones signal  1022 A that specifies the number of leading one bits in random data byte  298 .  
         [0173]    Compare logic  1002  generates a num_trailing_ones signal  1028 A that specifies the number of trailing one bits in random data byte  298 .  
         [0174]    Compare logic  1002  also generates an all_ones signal  1048 A that is true if random data byte  298  contains all one bits.  
         [0175]    Compare logic  1002  also generates a leading_ones signal  1036 A that is true if random data byte  298  contains leading one bits.  
         [0176]    Compare logic  1002  also generates a trailing_ones signal  1038 A that is true if random data byte  298  contains trailing one bits.  
         [0177]    String filter  224  also includes a first counter  1016 A for storing the current count of contiguous one bits. In one embodiment, counter  1016 A comprises a six-bit register. The output of counter  1016 A is a ones_cnt signal  1024 A.  
         [0178]    String filter  224  also includes a first adder  1012 A that adds num_leading_ones  1022 A and ones_cnt signal  1024 A to produce a new_ones_cnt signal  1026 A.  
         [0179]    String filter also includes a first four-input mux  1014 A. Mux  1014 A receives on its inputs ones_cnt signal  1024 A, new_ones_cnt signal  1026 A, num_trailing_ones signal  1028 A, and a hard-coded value of zero  1032 A. Mux  1014 A selects one of the inputs for outputting to counter  1016 A based on a one_select signal  1042 A.  
         [0180]    Compare logic  1002  generates a num_leading_zeros signal  1022 B that specifies the number of leading zero bits in random data byte  298 .  
         [0181]    Compare logic  1002  generates a num_trailing_zeros signal  1028 B that specifies the number of trailing zero bits in random data byte  298 .  
         [0182]    Compare logic  1002  also generates an all_zeros signal  1048 B that is true if random data byte  298  contains all zero bits.  
         [0183]    Compare logic  1002  also generates a leading_zeros signal  1036 B that is true if random data byte  298  contains leading zero bits.  
         [0184]    Compare logic  1002  also generates a trailing_zeros signal  1038 B that is true if random data byte  298  contains trailing zero bits.  
         [0185]    String filter  224  also includes a second counter  1016 B for storing the current count of contiguous zero bits. In one embodiment, counter  1016 B comprises a six-bit register. The output of counter  1016 B is a zeros_cnt signal  1024 B.  
         [0186]    String filter  224  also includes a second adder  1012 B that adds num_leading_zeros  1022 B and zeros_cnt signal  1024 B to produce a new_zeros_cnt signal  1026 B.  
         [0187]    String filter also includes a second four-input mux  1014 B. Mux  1014 B receives on its inputs zeros_cnt signal  1024 B, new_zeros_cnt signal  1026 B, num_trailing_zeros signal  1028 B, and a hard-coded value of zero  1032 B. Mux  1014 B selects one of the inputs for outputting to counter  1016 B based on a zero_select signal  1042 B.  
         [0188]    String filter  224  also includes a first comparator  1046 A that compares new_ones_cnt signal  1026 A with max_cnt signal  258  of FIG. 2. If new_ones_cnt signal  1026 A is greater than max_cnt signal  258 , then comparator  1046 A generates a true value on ones_exceeded signal  1034 A; otherwise, comparator  1046 A generates a false value on ones_exceeded signal  1034 A.  
         [0189]    String filter  224  also includes a second comparator  1046 B that compares new_zeros_cnt signal  1026 B with max_cnt signal  258  of FIG. 2. If new_zeros_cnt signal  1026 B is greater than max_cnt signal  258 , then comparator  1046 B generates a true value on zeros exceeded signal  1034 B; otherwise, comparator  1046 B generates a false value on zeros_exceeded signal  1034 B.  
         [0190]    String filter  224  also includes a two-input OR gate  1004  whose inputs are coupled to the outputs of comparator  1046 A and comparator  1046 B. OR gate  1004  receives ones_exceeded signal  1034 A and zeros_exceeded signal  1034 B on its inputs. OR gate  1004  generates a max_cnt_exceeded signal  1044 , which is provided as an input to select logic  1006 .  
         [0191]    String filter  224  also includes a two-input AND gate  1008  coupled to OR gate  1004 . AND gate  1008  receives max_cnt_exceeded signal  1044  from OR gate  1004  on one input and filter enable signal  262  of FIG. 2 on its other input. The output of AND gate  1008  is filter fail signal  256  of FIG. 2.  
         [0192]    String filter  224  also includes select logic  1006  coupled to receive all_ones signal  1048 A, leading_ones signal  1036 A, trailing_ones signal  1038 A, max_cnt_exceeded signal  1044 , leading_zeros signal  1036 B, trailing_zeros signal  1038 B, and all_zeros signal  1048 B. Select logic  1006  generates one_select signal  1042 A and zero_select signal  1042 B according to the following code.  
                                                                                                                                                                   retain_counts = max_cnt_exceeded &amp; filter enable;       increment_zeros = all_zeros &amp; (! retain_counts);       load_zeros = trailing_zeros &amp; (! retain_counts) &amp; (! increment_zeros);       clear_zeros = (! retain_counts) &amp; (! increment_zeros) &amp; (! load_zeros);       increment_ones = all_ones &amp; (! retain_counts);       load_ones = trailing_ones &amp; (! retain_counts) &amp; (! increment_ones);       clear_ones = (! retain_counts) &amp; (! increment_ones) &amp; (! load_ones);       if (retain_counts) {                zero_select = 3; // select zeros_cnt input            } else if (increment_zeros) {                zero_select = 2; // select new_zeros_cnt input            } else if (load_zeros) {                zero_select = 1; // select num_trailing_zeros input            } else if (clear_zeros) {                zero_select = 0; // select hard-coded 0 input            }       if (retain_counts) {                one_select = 3; // select ones_cnt input            } else if (increment_ones) {                one_select = 2; // select new_ones_cnt input            } else if (load_ones) {                one_select = 1; // select num_trailing_ones input            } else if (clear_ones) {                one_select = 0; // select hard-coded 0 input            }                  
 
         [0193]    Referring now to FIG. 11, a flowchart illustrating operation of string filter  224  of FIG. 10 according to the present invention is shown. Flow begins at block  1102 .  
         [0194]    At block  1102 , counters  1016 A and  1016 B are initialized to a zero value. Flow proceeds to block  1104 .  
         [0195]    At block  1104 , RNG unit  136  of FIG. 1 generates a byte of random data on random byte signal  298  of FIG. 2 and compare logic  1002  generates its signals based on examination of random data byte  298 . Flow proceeds to block  1106 .  
         [0196]    At block  1106 , adder  1012 A adds num_leading_ones  1022 A and ones_cnt  1024 A to produce new_ones_cnt  1026 A and adder  1012 B adds num_leading_zeros  1022 B and zeros_cnt  1024 B to produce new_zeros_cnt  1026 B. Flow proceeds to decision block  1112 .  
         [0197]    At block  1112 , select logic  1006  examines max_cnt_exceeded  1044  to determine whether the number of contiguous zeros or ones has exceeded max_cnt  298 . If so, flow proceeds to decisions block  1114 . Otherwise, flow proceeds to decision block  1124 .  
         [0198]    At decision block  1114 , AND gate  1008  examines filter enable  262  signal to determine whether string filter  224  is enabled. If so, AND gate  1008  generates a true value on filter fail signal  256  of FIG. 2. Flow proceeds to block  1118 .  
         [0199]    At block  1118 , in response to filter fail signal  256  being true, control logic  244  does not assert the increment signal  221  of FIG. 2 and does not cause random byte  298  to be loaded into buf0  242  or buf1  246 , even though shift register  218  has generated a true value on byte_generated signal  282 . Thus, RNG unit  136  discards random byte  298  since random byte  298  has caused the number of contiguous ones or zeros to exceed max_cnt  258 . Flow proceeds to block  1122 .  
         [0200]    At block  1122 , select logic  1006  generates a value of 3 on one_select signal  1042 A and on zero-select signal  1042 B in order to cause muxes  1014 A and  1014 B, respectively, to retain the current ones_cnt  1024 A and zeros_cnt  1024 B, respectively. Flow returns to block  1104 .  
         [0201]    At decision block  1124 , select logic  1006  examines all_zeros signal  1048 B to determine whether random data byte  298  contains all zeros. If so, flow proceeds to block  1126 . Otherwise, flow proceeds to decision block  1128 .  
         [0202]    At block  1126 , select logic  1006  generates a value of 2 on zero select signal  1042 B to cause mux  1014 B to select new_zeros_cnt  1026 B and generates a value of 0 on one_select signal  1042 A to cause mux  1014 A to select hard-coded 0 input  1032 A. Flow proceeds to block  1148 .  
         [0203]    At decision block  1128 , select logic  1006  examines trailing_zeros signal  1038 B to determine whether random data byte  298  contains any trailing zeros. If so, flow proceeds to block  1132 . Otherwise, flow proceeds to block  1134 .  
         [0204]    At block  1132 , select logic  1006  generates a value of 1 on zero_select signal  1042 B to cause mux  1014 B to select num_trailing_zeros  1028 B and generates a value of 0 on one_select signal  1042 A to cause mux  1014 A to select hard-coded 0 input  1032 A. Flow proceeds to block  1148 .  
         [0205]    At block  1134 , select logic  1006  generates a value of 0 on zero_select signal  1042 B to cause mux  1014 B to select hard-coded 0 input  1032 B. Flow proceeds to decision block  1136 .  
         [0206]    At decision block  1136 , select logic  1006  examines all_ones signal  1048 A to determine whether random data byte  298  contains all ones. If so, flow proceeds to block  1138 . Otherwise, flow proceeds to decision block  1142 .  
         [0207]    At block  1138 , select logic  1006  generates a value of 2 on one_select signal  1042 A to cause mux  1014 A to select new_ones_cnt  1026 A. Flow proceeds to block  1148 .  
         [0208]    At decision block  1142 , select logic  1006  examines trailing_ones signal  1038 A to determine whether random data byte  298  contains any trailing ones. If so, flow proceeds to block  1144 . Otherwise, flow proceeds to block  1146 .  
         [0209]    At block  1144 , select logic  1006  generates a value of 1 on one_select signal  1042 A to cause mux  1014 A to select num_trailing_ones  1028 A. Flow proceeds to block  1148 .  
         [0210]    At block  1146 , select logic  1006  generates a value of 0 on one_select signal  1042 A to cause mux  1014 A to select hard-coded 0 input  1032 A. Flow proceeds to block  1148 .  
         [0211]    At block  1148 , control logic  244  causes random data byte  298  to be loaded into buf0  242  or buf1  246  selected by fill_select signal  264  and asserts increment signal  221  to increment cntr0  211  or cntr1  213  selected by fill_select signal  264 . Flow returns to block  1104 .  
         [0212]    Referring now to FIG. 12, a block diagram illustrating operation of microprocessor  100  of FIG. 1 when executing an XSTORE instruction according to an alternate embodiment of the present invention is shown. The XSTORE instruction of FIG. 12 is similar to the XSTORE instruction of FIG. 7, however in the alternate embodiment, the count of valid random data bytes is loaded into one of the general purpose registers in register file  108 , such as the EAX  1202  register, rather than being stored to system memory. Advantageously, like the XSTORE instruction of FIG. 7, the XSTORE instruction of FIG. 12 atomically loads the count into EAX along with storing the random data bytes to memory to facilitate multitasking operation with RNG unit  136 . That is, the XSTORE instruction of FIG. 12 is also not interruptible.  
         [0213]    Referring now to FIG. 13, a flowchart illustrating multi-buffering operation of RNG unit  136  of FIG. 2 according to the present invention is shown. Flow begins at block  1302 .  
         [0214]    At block  1302 , reset signal  248  is asserted. Flow proceeds to block  1304 .  
         [0215]    At block  1304 , control logic  244  of FIG. 2 initializes fill_select signal  264  and store_select signal  266  to 0, and clears cntr0  211  and cntr1  213  in response to the reset at block  1302 . Flow proceeds to decision block  1306 .  
         [0216]    At decision block  1306 , control logic  244  determines whether an XSTORE instruction is being executed by examining xstore signal  268 . If so, flow proceeds to decision block  1308 . Otherwise, flow proceeds to decision block  1322 .  
         [0217]    At decision block  1308 , control logic  244  determines whether random bit generator 0  206  or random bit generator 1  208  selected by gen select signal  252  is powered off. If so, flow proceeds to block  1312 . Otherwise, flow proceeds to block  1314 .  
         [0218]    At block  1312 , control logic  244  powers up the selected random bit generator via power_cntr1 signal  231 . Flow proceeds to block  1314 .  
         [0219]    At block  1314 , microprocessor  100  atomically stores to system memory the value in cntr0  211  or cntr1  213  selected by store_select signal  266  and the valid data bytes in buf0  242  or buf1  246  selected by store_select signal  266 , according to block  816  of FIG. 8 and as shown in FIG. 7. Flow proceeds to block  1316 .  
         [0220]    At block  1316 , control logic  244  asserts clear signal  223  to clear cntr0  211  or cntr1  213  selected by store_select signal  266 . Flow proceeds to block  1318 .  
         [0221]    At block  1318 , control logic  244  updates store_select signal  266  to select the other buffer and counter. In embodiments in which RNG unit  136  includes more than two buffers, store_select signal  266  comprises more than one bit, and updating store_select signal  266  comprises incrementing store_select signal  266  and wrapping around back to zero when incrementing past the number of buffers. Flow proceeds to decision block  1322 .  
         [0222]    At decision block  1322 , control logic  244  determines whether a good random data byte was generated by examining byte_generated signal  282  to see if it is true and examining filter fail signal  256  to see if it is false. If so, flow proceeds to block  1324 . Otherwise, flow returns to decision block  1306 .  
         [0223]    At block  1324 , control logic  244  loads the good random data byte into buf0  242  or buf1  246  selected by fill_select signal  264  and increments cntr0  211  or cntr1  213  selected by fill_select signal  264 . Flow proceeds to decision block  1326 .  
         [0224]    At decision block  1326 , control logic  244  examines full0 signal  229  or full1 signal  227  specified by fill_select signal  264  to determine whether buf0  242  or buf1  246  selected by fill_select signal  264  is full. If so, flow proceeds to block  1328 . Otherwise, flow returns to block  1306 .  
         [0225]    At block  1328 , control logic  244  updates fill_select signal  264 . In one embodiment in which RNG unit  136  includes two buffers, updating fill_select signal  264  comprises toggling fill_select signal  264 . In embodiments in which RNG unit  136  includes more than two buffers, fill_select signal  264  comprises more than one bit, and updating fill_select signal  264  comprises incrementing fill_select signal  264  and wrapping around back to zero when incrementing past the number of buffers. Flow proceeds to decision block  1332 .  
         [0226]    At decision block  1332 , control logic  244  examines full0 signal  229  or full1 signal  227  specified by fill_select signal  264  as updated at block  1328  to determine whether buf0  242  or buf1  246  selected by fill_select signal  264  is full, i.e., to determine whether all the buffers are full. If so, flow proceeds to block  1334 . Otherwise, flow returns to block  1306 .  
         [0227]    At block  1334 , control logic  244  powers off random bit generator 0  206  and random bit generator 1  208  via power cntr1 signal  231  since all the buffers are full. Flow returns to decision block  1306 .  
         [0228]    Referring now to FIG. 14, a flowchart illustrating operation of microprocessor  100  of FIG. 1 when executing an XLOAD instruction of FIG. 3 according to an alternate embodiment of the present invention is shown. The flowchart of FIG. 14 is identical to the flowchart of FIG. 6 and like numbered blocks are the same, except that FIG. 14 includes an additional decision block  1403 . Flow proceeds from block  602  to decision block  1403 . At decision block  1403 , control logic  244  of FIG. 2 determines whether relevant bits in CSR  226  have been changed by the load of CSR  226  at block  602 . If so flow proceeds to block  604  as in FIG. 6. Otherwise, flow proceeds to block  612 , as shown. The alternate embodiment has the advantage of not unnecessarily discarding already accumulated random bytes and restarting random byte accumulation. That is, if the load of CSR  226  did not change any of the values affecting the generation of random numbers by RNG unit  136 , then there is no need to discard already accumulated random bytes and restart random byte accumulation since the random bytes were generated using the desired control values. In one embodiment, the relevant CSR  226  bits are string filter enable bit  334 , gen select bit  336 , CNT enable bit  342 , and string filter max_cnt  346 .  
         [0229]    Referring now to FIG. 15, a flowchart illustrating operation of microprocessor  100  of FIG. 1 when executing an XSTORE instruction of FIG. 3 according to an alternate embodiment of the present invention is shown. The flowchart of FIG. 15 is identical to the flowchart of FIG. 8 and like numbered blocks are the same, except that FIG. 15 includes an additional decision block  1507 . Flow proceeds from block  806  to decision block  1507 . At decision block  1507 , control logic  244  of FIG. 2 determines whether relevant bits in CSR  226  have been changed by the copy to CSR  226  at block  806 . If so flow proceeds to block  808  as in FIG. 8. Otherwise, flow proceeds to block  816 , as shown. The alternate embodiment has the advantage of not unnecessarily discarding already accumulated random bytes and restarting random byte accumulation. That is, if the copy to CSR  226  did not change any of the values affecting the generation of random numbers by RNG unit  136 , then there is no need to discard already accumulated random bytes and restart random byte accumulation since the random bytes were generated using the desired control values. In one embodiment, the relevant CSR  226  bits are string filter enable bit  334 , gen select bit  336 , CNT enable bit  342 , and string filter max_cnt  346 .  
         [0230]    Referring now to FIG. 16, a block diagram illustrating operation of microprocessor  100  of FIG. 1 when executing an XSTORE instruction according to an alternate embodiment of the present invention is shown. The XSTORE instruction of FIG. 16 is similar to the XSTORE instruction of FIG. 12, however in the alternate embodiment of FIG. 16, the destination operand of the XSTORE instruction of FIG. 16 specifies a register of microprocessor  100 , such as an XMM register or a floating-point register or an MMX register or one of the integer unit registers, such as EBX, rather than specifying an address in system memory. That is, the valid random data bytes are atomically written into one of the user-visible registers in register file  108 , rather than being stored to system memory. In the example of FIG. 16, the XSTORE instruction specifies the XMM3 register  376  register of SSE registers  352  of FIG. 3 to write the valid random data bytes into, as shown. Advantageously, like the XSTORE instruction of FIG. 12, the XSTORE instruction of FIG. 16 atomically writes the random data bytes into the user-visible register along with loading the count to EAX  1202  to facilitate multitasking operation with RNG unit  136 . That is, the XSTORE instruction of FIG. 16 is also not interruptible.  
         [0231]    Referring now to FIG. 17, a block diagram illustrating operation of microprocessor  100  of FIG. 1 when executing an XSTORE instruction according to an alternate embodiment of the present invention is shown. The XSTORE instruction of FIG. 17 is similar to the XSTORE instruction of FIG. 12, however in the alternate embodiment of FIG. 17, the XSTORE instruction includes an ×86 architecture REP prefix. With the REP XSTORE instruction, the count of bytes of random data to be stored to system memory is specified as an input parameter in the ECX register  1702  of register file  108 , as shown. Software loads into ECX  1702  the desired count of random data bytes to be stored to system memory prior to executing the REP XSTORE instruction.  
         [0232]    In one embodiment, the REP XSTORE is interruptible between stores of random data bytes to system memory. The memory address is initially specified in general purpose registers of register file  108 . In the example of FIG. 17, the memory address is specified in ES:EDI  1704  of register file  108 , as shown. Each time one or more random data bytes are written to system memory, ES:EDI  1702  is updated to the next location in system memory where the random data bytes are to be stored. Additionally, each time one or more random data bytes are stored to system memory, ECX  1702  is updated to reflect the number of random bytes remaining to be stored. Assume, for example, a REP XSTORE instruction specifies in ECX  1702  a byte count of 28 and a memory address of 0×12345678. Assume the RNG unit  136  has 8 bytes available in one of buf0  242  and buf1  246  and writes the 8 bytes to system memory while more random data bytes are accumulating. When the 8 bytes are written to memory, ECX  1702  is updated to 20 to indicate that 20 more random data bytes must be written to system memory. Additionally, the address is updated to 0×12345680 as the next location in system memory where the next chunk of random data bytes will be written. An interrupt may occur at this point, and software can examine the updated values. When the interrupt has been serviced and control is returned to the REP XSTORE instruction, the REP XSTORE will resume execution using the updated values in ECX  1702  and ES:EDI  1704 . In addition, at completion of the REP XSTORE instruction, the current value of CSR  226  of FIG. 2 is copied to the EAX register  1202  of register file  108 .  
         [0233]    Although the present invention and its objects, features, and advantages have been described in detail, other embodiments are encompassed by the invention. For example, although the present invention has been described with respect to certain numbers of buffers, the invention is adaptable to use with various numbers of buffers. In addition, the size of the buffers employed may be adapted as needed.  
         [0234]    Those skilled in the art should appreciate that they can readily use the disclosed conception and specific embodiments as a basis for designing or modifying other structures for carrying out the same purposes of the present invention without departing from the spirit and scope of the invention as defined by the appended claims.