Intel Corporation

Sagar V Dalvi

Sergiu D Ghetie

Neeraj S Upasani

Wojciech S Powiertowski

Jeanne Guillory

Mohan J Kumar

Jason W Brandt

Murugasamy K Nachimuthu

Joseph Nuzman

Lihu Rappoport

Shahrokh Shahidzadeh

Robert S Chappell

Deepak K Gupta

Jared Warner Stark, Iv

Rodrigo Branco

Alberto J Munoz

Scott P Bobholz

Ariel Sabba

Chukwunenye S Nnebe

David P Turley

Scott J Cape

Allen R Wishman

Mark D Chubb

Yair Berger

Gilad Holzstein

Hisham Shafi

Srihari Narayanan

Francisco Orlando C Arbildo

Yogesh Bijlani

Neeraj Upasani

Methods and apparatuses relating to mitigations for speculative execution side channels are described. Speculative execution hardware and environments that utilize the mitigations are also described. For example, three indirect branch control mechanisms and their associated hardware are discussed herein: (i) indirect branch restricted speculation (IBRS) to restrict speculation of indirect branches, (ii) single thread indirect branch predictors (STIBP) to prevent indirect branch predictions from being controlled by a sibling thread, and (iii) indirect branch predictor barrier (IBPB) to prevent indirect branch predictions after the barrier from being controlled by software executed before the barrier.

Apparatuses and methods for speculative execution side channel mitigation

Embodiments are generally directed apparatuses, methods, techniques and so forth to receive a sled manifest comprising identifiers for physical resources of a sled, receive results of an authentication and validation operations performed to authenticate and validate the physical resources of the sled, determine whether the results of the authentication and validation operations indicate the physical resources are authenticate or not authenticate. Further and in response to the determination that the results indicate the physical resources are authenticated, permit the physical resources to process a workload, and in response to the determination that the results indicate the physical resources are not authenticated, prevent the physical resources from processing the workload.

Techniques to verify and authenticate resources in a data center computer environment

A processor can be configured to access boot firmware from a remote location independent from use of a chipset. After a processor powers-on or reboots, the processor can execute microcode. The microcode will cause the processor to train a link with a remote device. The remote device can provide the processor with access to boot firmware. The processor can copy the boot firmware to the processor's cache or memory. The processor will attempt to authenticate the boot firmware. If the boot firmware is authenticated, the processor executes the copy of the boot firmware.

Techniques for processor boot-up

Embodiments detailed herein include, but are not limited to, a hardware processor to execute instructions and security circuitry to perform pre-boot operations including signature verification of a portion of firmware in a firmware storage hardware and initiating recovery upon a signature verification failure. The hardware processor comprises a plurality of cores in some embodiments. The hardware processor a multicore processor in some embodiments.

Systems, apparatuses, and methods for platform security

Growing community of inventors

Hillsoro, OR, United States of America

Sagar V Dalvi