Google Inc.

Microsoft Technology Licensing, LLC

Luigi Semenzato

Randall Spangler

William Alexander Drewry

Sumit Gwalani

Gaurav Shah

Ryan Tabone

Vyacheslav Vladimirovich Malyugin

Santhosh Rao

Choon Ping Chng

Shinye Shiu

Geoffrey Roeder Pike

Sameer Nanda

Keith Robert Pflederer

William Frank Richardson

Rahul Jagdish Thakur

Aaron Durbin

Hsiao-Heng Kelin Lee

Methods and apparatus for verifying a boot process of a computing system are disclosed. An example computer-implemented method includes reading, by a computing system during a boot process, a header section of a read-write portion of firmware of the computing system. The example method further includes generating, using a first cryptographic hash algorithm, a message digest corresponding with the header. The example method also includes decrypting, using a first public-key, an encrypted signature corresponding with the header. The example method still further includes comparing the message digest corresponding with the header and the decrypted signature corresponding with the header. In the event the message digest corresponding with the header and the decrypted signature corresponding with the header match, the example method includes continuing the boot process. In the event the message digest corresponding with the header and the decrypted signature corresponding with the header do not match, the example method includes halting the boot process.

Firmware verified boot

Systems, devices, and methods for managing fragmentation in hardware-assisted compression of data in physical computer memory which may result in reduced internal fragmentation. An example computer-implemented method comprises: providing, by a memory management program to compression hardware, a compression command including an address in physical computer memory of data to be compressed and a list of at least two available buffers for storing compressed data; using, by the compression hardware, the address included in the compression command to retrieve uncompressed data; compressing the uncompressed data; and selecting, by the compression hardware, from the list of at least two available buffers, at least two buffers for storing compressed data based on an amount of space that would remain if the compressed data were stored in the at least two buffers, wherein each of the at least two selected buffers differs in size from at least one other of the selected buffers.

Managing memory fragmentation in hardware-assisted data compression

Provided are methods and systems for memory decompression using a hardware decompressor that minimizes or eliminates the involvement of software. Custom decompression hardware is added to the memory subsystem, where the decompression hardware handles read accesses caused by, for example, cache misses or requests from devices to compressed memory blocks, by reading a compressed block, decompressing it into an internal buffer, and returning the requested portion of the block. The custom hardware is designed to determine if the block is compressed, and determine the parameters of compression, by checking unused high bits of the physical address of the access. This allows compression to be implemented without additional metadata, because the necessary metadata can be stored in unused bits in the existing page table structures.

Transparent hardware-assisted memory decompression

To provide a secure installation and execution software environment, locked version numbers are maintained. A locked version number associated with a software program may be stored. When a request is received to update the software program with an update package, a package number of the update package may be compared to the locked version number. The software program may be updated with the update package if the package number is at least as recent as the locked version number, and the updating of the software program with the update package may be restricted if the package number is earlier than the locked version number.

Secure versioning of software packages

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for providing time series information with search results. In one aspect, a method includes determining that a first query is indicative of a request for time series information; generating a cost estimate that quantifies one or more costs of including the time series information with one or more search results, each search result including a resource locator that references a corresponding resource determined to be responsive to the query; generating a benefit estimate; determining to generate the time series information when the benefit estimate is greater than the cost estimate and generating the time series information in response to the determination, wherein generating the time series information includes collecting responsive time series information from one or more resources; and determining to not generate the time series information when the cost estimate is greater than the benefit estimate.

Providing time series information with search results

A computer-implemented method for verifying a boot process of a computing system includes reading, by the computing system during the boot process, a header section of a read-write portion of firmware of the computing system. The method further includes generating, using a first cryptographic hash algorithm, a message digest corresponding with the header, and decrypting, using a first public-key, an encrypted signature corresponding to the header. The method further includes comparing the message digest corresponding with the header and the decrypted signature corresponding to the header. In the event the message digest corresponding to the header and the decrypted signature corresponding to the header match, the boot process is continued. In the event the message digest corresponding to the header and the decrypted signature corresponding to the header do not match, the boot process is halted.

A system and method is disclosed for locking down a capability of a computer system. Hardware instructions initiate a sequence of boot cycles to launch a computer operating system on a computer-enabled device. During the boot cycles, multiple levels of boot code are verified. Each verified stage of boot code verifies a subsequent stage of boot code. If the subsequent stage of boot code cannot be verified, the verified stage locks a capability of the computer so that the subsequent stage of boot code cannot modify the capability.

System and method for locking down a capability of a computer system

A plug-in executes as a separate computer process from a platform process in which the plug-in is installed and which invokes execution of the plug-in. The plug-in therefore has a context which is independent of the context of the platform process. Specifically, the plug-in is separated into a plug-in controller and a plug-in body. The plug-in body is a collection of computer instructions execution of which perform the substantive task of the plug-in, i.e., the task by which the plug-in extends the functionality of the platform process. The plug-in controller is installed in the platform process as a plug-in using the plug-in installation mechanism of the platform process. Once invoked by the platform process, typically in response to user-generated signals received by the platform process, the plug-in controller invokes execution of the plug-in body as a separate computer process from the platform process. The platform process creates a window into which the plug-in can display images and information and passes to the plug-in controller a window identifier of the window to thereby grant the plug-in controller access to the window. The plug-in controller passes the window identifier to the plug-in body through an argument list in execution of the exec( ) system call. The plug-in body avoids deletion of the window by creating a sub-window of the window and manipulating the window hierarchy to prevent deletion of the sub-window as a consequence of deletion of the window provided by the platform process.

Growing community of inventors

Oakland, CA, United States of America

Luigi Semenzato