Intel Corporation

Mingwei Zhang

Ravi L Sahita

Vedvyas Shanbhogue

Michael Lemay

Xiaoning Li

David M Durham

Jason W Brandt

Mingqiu Sun

Baiju V Patel

Jr-Shian Tsai

Vadim Sukhomlinov

Deepak K Gupta

Chunhui Zhang

Krishna Bhuyan

Gilbert A Neiger

Barry E Huntley

Michael E Kounavis

Karanvir S Grewal

Joseph Nuzman

Abhay Kanhere

Yi Gai

Josh Triplett

Amitabh Das

Chih-Yuan Yang

David Hansen

James C Farwell

Aravind Subramanian

Ye Zhuang

Kshitij Arun Doshi

Mohan J Kumar

Ravishankar Iyer

Andrew J Herdrich

Sara S Baghsorkhi

David A Koufaty

Alexander Bachmutsky

Ian M Steiner

Zheng Zhang

Jeffrey D Chamberlain

Nilesh K Jain

Eric Dahlen

Salmin Sultana

Mohammad R Haghighat

Amin Firoozshahian

Yeluri Raghuram

Dmitry Babokin

Anil Rao

Leeor Peled

Areg Melik-Adamyan

Harshad S Sane

Teck Joo Goh

Anup Mohan

Michael Prinke

David D Durham

Wenyong Huang

Technologies for untrusted code execution include a computing device having a processor with sandbox support. The computing device executes code included in a native domain in a non-privileged, native processor mode. The computing device may invoke a sandbox jump processor instruction during execution of the code in the native domain to enter a sandbox domain. The computing device executes code in the sandbox domain in a non-privileged, sandbox processor mode in response to invoking the sandbox jump instruction. While executing in the sandbox processor mode, the processor denies access to memory outside of the sandbox domain and may deny execution of one or more prohibited instructions. From the sandbox domain, the computing device may execute a sandbox exit instruction to exit the sandbox domain and resume execution in the native domain. The computing device may execute processor instructions to configure the sandbox domain. Other embodiments are described and claimed.

Technologies for untrusted code execution with processor sandbox support

Embodiments of systems, apparatuses and methods provide enhanced function as a service (FaaS) to users, e.g., computer developers and cloud service providers (CSPs). A computing system configured to provide such enhanced FaaS service include one or more controls architectural subsystems, software and orchestration subsystems, network and storage subsystems, and security subsystems. The computing system executes functions in response to events triggered by the users in an execution environment provided by the architectural subsystems, which represent an abstraction of execution management and shield the users from the burden of managing the execution. The software and orchestration subsystems allocate computing resources for the function execution by intelligently spinning up and down containers for function code with decreased instantiation latency and increased execution scalability while maintaining secured execution. Furthermore, the computing system enables customers to pay only when their code gets executed with a granular billing down to millisecond increments.

Function as a service (FaaS) system enhancements

A malicious object detection system for use in managed runtime environments includes a check circuit to receive call information generated by an application, such as an Android application. A machine learning circuit coupled to the check circuit applies a machine learning model to assess the information and/or data included in the call and detect the presence of a malicious object, such as malware or a virus, in the application generating the call. The machine learning model may include a global machine learning model distributed across a number of devices, a local machine learning model based on use patterns of a particular device, or combinations thereof. A graphical user interface management circuit halts execution of applications containing malicious objects and generates a user perceptible output.

Malicious object detection in a runtime environment

Disclosed embodiments relate to encoded inline capabilities. In one example, a system includes a trusted execution environment (TEE) to partition an address space within a memory into a plurality of compartments each associated with code to execute a function, the TEE further to assign a message object in a heap to each compartment, receive a request from a first compartment to send a message block to a specified destination compartment, respond to the request by authenticating the request, generating a corresponding encoded capability, conveying the encoded capability to the destination compartment, and scheduling the destination compartment to respond to the request, and subsequently, respond to a check capability request from the destination compartment by checking the encoded capability and, when the check passes, providing a memory address to access the message block, and, otherwise, generating a fault, wherein each compartment is isolated from other compartments.

Encoded inline capabilities

Systems, methods, and apparatuses relating to instructions to compartmentalize memory accesses and execution (e.g., non-speculative and speculative) are described. In one embodiment, a compartment manager circuit is to determine, when a compartment control register of a hardware processor core is set to an enable value, that a first subset of code requested for execution on the hardware processor core in user privilege is within a first compartment of memory, load a first compartment descriptor for the first compartment into one or more registers of the hardware processor core from the memory, check if the first compartment is marked in the first compartment descriptor, within the one or more registers of the hardware processor core, as a management compartment, and, when the first compartment is marked in the first compartment descriptor as the management compartment, allowing the first subset of the code within the first compartment to load a second compartment descriptor for a second compartment of the memory into the one or more registers of the hardware processor core from the memory, switching execution from the first subset of code within the first compartment to a second subset of code in user privilege within the second compartment, allowing speculative memory accesses for the second subset of code only within the second compartment, and preventing a memory access outside of the second compartment for the second subset of code as indicated by the second compartment descriptor stored within the one or more registers of the hardware processor core.

Apparatuses, methods, and systems for instructions to compartmentalize code

An apparatus and method for memory management using compartmentalization. For example, one embodiment of a processor comprises: execution circuitry to execute instructions and process data, at least one instruction to generate a system memory access request using a first linear address; and address translation circuitry to perform a first walk operation through a set of one or more address translation tables to translate the first linear address to a first physical address, the address translation circuitry to concurrently perform a second walk operation through a set of one or more linear address metadata tables to identify metadata associated with the linear address, and to use one or more portions of the metadata to validate access by the at least one instruction to the first physical address.

Memory management apparatus and method for compartmentalization using linear address metadata

Embodiments include side channel defender circuitry to protect shared code pages in executable only memory (XOM) from side-channel exploits. The side channel defender circuitry receives system calls and determines whether code pages include executable code, whether the code pages include writeable code, and whether the code pages include instructions capable of altering or modifying one or more protection keys associated with code pages stored in XOM. If the code pages contain executable code that is writeable or executable code that includes instructions capable of altering or modifying one or more protection keys associated with code pages stored in XOM the side channel defender circuitry, the side channel defender circuitry aborts the system call.

Mitigating side-channel attacks using executable only memory (XOM)

In embodiments, an apparatus for computing includes a protection key register (PKR) having 2bits, where N is an integer, to store a plurality of permission entries corresponding to protected memory domains, and a protected memory domain controller, coupled to the PKR. In embodiments, the memory domain controller is to: obtain protection key (PK) bits from a page table entry for a target page address; obtain one or more additional PK bits from a target linear memory address; and combine the PK bits and the additional PK bits to form a PK domain number to index into the plurality of permission entries in the PKR to obtain a permission entry for a protected memory domain.

Memory domains protection method and apparatus with composite protection key numbers

Systems, apparatuses and methods may provide technology for securing untrusted code using memory protection keys and control flow integrity, by applying a memory protection key to one or more memory regions, enforcing control flow integrity with respect to the one or more memory regions, and executing untrusted code in an isolated region of the one or more memory regions.

Securing untrusted code using memory protection key and control flow integrity

Methods and apparatus related to checkpointing for Solid State Drives (SSDs) that include no DRAM (Dynamic Random Access Memory) are described. In one embodiment, Non-Volatile Memory (NVM) stores an original Logical address to Physical address (L2P) table entry and a shadow L2P table entry. Allocation logic circuitry causes storage of the original L2P table entry and the shadow L2P table entry sequentially in the NVM. Data read from the shadow L2P table entry is capable to indicate a state of the original L2P table entry. Other embodiments are also disclosed and claimed.

Checkpointing for DRAM-less SSD

Apparatuses for computing are disclosed herein. In embodiments, an apparatus may include one or more processors, a memory, and a compiler to be operated by the one or more processors to compile a computer program. The compiler may include one or more analyzers to parse and analyze source code of the computer program that generates pointers or de-references pointers. The compiler may also include a code generator coupled to the one or more analyzers to generate executable instructions for the source code of the computer program including insertion of additional encryption or decryption executable instructions into the computer program, based at least in part on a result of the analysis, to authenticate memory access operations of the source code.

Crypto-enforced capabilities for isolation

Growing community of inventors

Hillsboro, OR, United States of America

Mingwei Zhang