Intel Corporation

Mcafee, Inc.

Other

Marvell International Limited

Musarubra US LLC

Intel Corproation

Vincent J Zimmer

Michael A Rothman

Rajesh Poornachandran

Mallik Bulusu

Robert Charles Swanson

Ned M Smith

Kshitij Arun Doshi

Rahul Khanna

Francesc Guim Bernat

Mohan J Kumar

Mahesh S Natu

Travis T Schluessler

Glenn J Hinton

David M Durham

Hormuzd M Khosravi

Igor G Muttik

Kapil Sood

Jian Jun Wang

John Joseph Browne

Simon R Hunt

Prashant Dewan

Barnes Cooper

Uttam K Sengupta

Gilbert A Neiger

Ravi L Sahita

Jiewen Yao

Mark Doran

Andrew J Fish

Mingqiu Sun

Karunakara Kotary

Bin Xing

Karthik Kumar

Willard M Wiseman

Sarathy Jayakumar

Marcos Emanuel Carranza

Scott H Robinson

Bryant E Bigbee

Daniel Nemiroff

David Kimbal Dorwin

Kirk D Brannock

Kushagra V Vaid

Sven Schrecker

Jim Santiago Baca

Shahrokh Shahidzadeh

Saurabh Gupta

Alan D Ross

Chao B Zhang

Nimrod Diamant

Cedric Cochin

Malay Trivedi

Venkatesh Ramamurthy

Victoria C Moore

Carlos V Rozas

Barry E Huntley

Baiju V Patel

Andrew V Anderson

Richard A Uhlig

Murugasamy K Nachimuthu

Yu Meng Li

Jing Li

Arvind A Kumar

Steven M Bennett

Blaise B Fanning

Raj K Ramanujan

Saurabh Dadu

Wei Ey Li

Raghunandan Makaram

Stephen S Pawlowski

Eugene Gorbatov

H Peter Anvin

Howard C Herbert

Fei Li

Erik C Cota-Robles

Devadatta V Bodas

Ashok Raj

Robert E Gough

Krystof C Zmudzinski

Sebastian Schoenberg

Qi Rong Wang

Nathan Heldt-Sheller

John S Howard

Ulf Hanebutte

Joel Robert Spurlock

Gunner D Danneels

William A Stevens, Jr

Stalinselvaraj Jeyasingh

James Paul Held

Carl M Ellison

Madhusudhan Rangarajan

Narayan Ranganathan

Ying Liu

Sergiu D Ghetie

Patrick G Kutch

Theodros Yigzaw

Rajesh Sankaran Madukkarumukumana

Nagasubramanian Gurumoorthy

Michael D Rosenzweig

Julius Yuli Mandelblat

Amber D Huffman

George W Cox

Apparatus and method for secure instruction set execution, emulation, monitoring, and prevention. A processor embodiment includes registers, evaluator, and execution unit. The registers are to store rules which specify actions to be taken with respect to one or more instructions. The evaluator is to detect a request to execute a first instruction and to evaluate the first instruction based on the rules stored in the one or more registers. The evaluator is further to block execution of the first instruction when a first rule corresponding to the first instruction specifies that execution of the first instruction is prohibited, and to allow execution of the first instruction when there is no rule in the one or more registers specifying that the execution of the first instruction is prohibited. The execution unit is to execute the first instruction when the evaluator allows execution of the first instruction.

Apparatus and method for secure instruction set execution, emulation, monitoring, and prevention

Various systems and methods for enabling derivation and distribution of an attestation manifest for a software update image are described. In an example, these systems and methods include orchestration functions and communications, providing functionality and components for a software update process which also provides verification and attestation among multiple devices and operators.

Attestation manifest derivation and distribution using software update image

Methods, apparatus, systems, and articles of manufacture to increase boot performance are disclosed. An example apparatus including instructions stored in the apparatus; and processor circuitry to execute the instructions to: during a boot process: identify a boot task that is to be performed during the boot process; execute the boot task using a first processor component; collect data corresponding to the execution of the boot task on the first processor component; categorize the boot task based on the collected data; and generate an entry for a boot table based on the categorization, the boot table used to schedule the boot task on at least one of the first processor component or a second processor component different than the first processor component based on the categorization.

Methods and apparatus to increase boot performance by categorizing boot tasks

An electronic device is disclosed, including a first set of processor cores including at least one processor core and a second set of processor cores including at least one processor core. The electronic device is configured such that during initialization of the electronic device: the first set of processor cores executes first initialization instructions in a first execution environment, the second set of processor cores executes second initialization instructions in a second execution environment, and the first set and the second set at least one of read or write to a shared register.

Decoupling silicon initialization and bootloader by providing silicon initialization service

An embodiment of a semiconductor package apparatus may include technology to determine version information for a new firmware component, read dependency information corresponding to the firmware component, and determine if dependency is satisfied between the new firmware component and one or more other firmware components based on the version information and the dependency information of the new firmware component. Other embodiments are disclosed and claimed.

Firmware component with self-descriptive dependency information

A system management mode (SMM) runtime resiliency manager (SRM) augments computing resource protection policies provided by an SMM policy shim. The SMM shim protects system resources by deprivileging system management interrupt (SMI) handlers to a lower level of privilege (e.g., ring 3 privilege) and by configuring page tables and register bitmaps (e.g., I/O, MSR, and Save State register bitmaps). SRM capabilities include protecting the SMM shim, updating the SMM shim, protecting a computing system during SMM shim update, detecting SMM attacks, and recovering attacked or faulty SMM components.

System management mode runtime resiliency manager

Methods, apparatus, and articles of manufacture to conditionally activate a big core in a computing system are disclosed. An example apparatus including instructions stored in the apparatus; and processor circuitry to execute the instructions to: in response to a request to operate two or more processing devices as a single processing device, determine whether the two or more processing devices are available and capable of executing instructions according to the request; when the two or more processing devices are available and capable: split the instructions into first sub-instructions and second sub-instructions; provide (a) the first sub-instructions to a first processing device of the two or more processing devices and (b) the second sub-instructions to a second processing device of the two or more processing devices; and generate an output by combining a first output of the first processing device and a second output of the second processing device.

Methods and apparatus to conditionally activate a big core in a computing system

During a computing system boot sequence, reference firmware provided by a computing system component supplies Advanced Configuration and Power Interface (ACPI) code that generates ACPI tables and definition blocks to a bootloader. During a boot sequence, the reference firmware receives an indication from the bootloader which components the reference firmware is to initialize. As part of component initialization performed by the reference firmware, the reference firmware populates hand-off data structures (e.g., hand-off blocks (HOBs)) with ACPI code (AML code) that, when executed by the bootloader, generates and populates ACPI tables (e.g., DSDT and SSDT tables) and definition blocks with information pertinent to the initialization and runtime management of computing system components. Component initialization and runtime configuration workarounds can be implemented in the bootloader incorporating reference firmware updates provided by the component vendor.

Platform hardening for bootloaders via reference firmware

Systems, apparatuses and methods may provide for technology that detects an over current condition associated with a voltage regulator in a computing system, identifies a configurable over current protection policy associated with the voltage regulator, and automatically takes a protective action based on the configurable over current protection policy. In one example, the protective action includes one or more of a frequency throttle of a processor coupled to the voltage regulator in isolation from one or more additional processors in the computing system, a deactivation of the processor in isolation from the one or more additional processors, an issuance of a virtual machine monitor notification, an issuance of a data center fleet manager notification, or an initiation of a migration of a workload from the processor to at least one of the additional processor(s).

Application aware graceful over current protection for multi-socket platforms

Systems, apparatuses and methods may provide for technology that identifies, during a first boot process, whether at least one task associated with at least one software program is set to occur in a single-threaded process or a multithreaded process, in response to the at least one task being set to occur in the multithreaded process, executing the at least one task in the multithreaded process during the first boot process, and in response to the at least one task being set to occur in the single-threaded process, executing the at least one task in the single-threaded process during the first boot process.

Firmware boot task distribution to enable low latency boot performance

A data processing system comprises a processing core to execute a basic input/output system (BIOS) as part of a boot process. The data processing system also comprises static random-access memory (SRAM) in communication with the processing core. The data processing system also comprises a pre-BIOS component in communication with the SRAM. The pre-BIOS component is configured to execute a pre-BIOS block before the processing core begins executing the BIOS. The pre-BIOS block, when executed by the pre-BIOS component, causes the pre-BIOS component to (a) initialize the pre-BIOS component, (b) measure an amount of time taken to initialize the pre-BIOS component, and (c) save the measured amount of time to the SRAM as a pre-BIOS boot-time record. Other embodiments are described and claimed.

Technology to measure boot activity before a processor enters a working state

An apparatus to facilitate provenance audit trails for microservices architectures is disclosed. The apparatus includes one or more processors to obtain provenance metadata for a microservice from a local blockchain of provenance metadata maintained for the hardware resource executing a task performed by the microservice, the provenance metadata comprising identification of the microservice, operating state of at least one of a hardware resource or a software resource used to execute the microservice and the task, and an operating state of a sidecar of the microservice during the task; access one or more policies established for the microservice; analyze the provenance metadata with respect to the one or more policies to identify if there is a violation of the one or more policies; and generate one or more evaluation metrics based on whether the violation of the one or more policies is identified.

Provenance audit trails for microservices architectures

Systems, methods, and apparatuses relating to circuitry to implement a multiprocessor boot flow for a faster boot process are described. In one embodiment, a system includes a hardware processor comprising a processor core, a cache coupled to the hardware processor, storage for hardware initialization code, and a controller circuit to initialize a portion of the cache as memory for usage by the hardware initialization code before beginning execution of the hardware initialization code after a power on of the system.

Methods, systems, and apparatuses for a multiprocessor boot flow for a faster boot process

Technologies for privacy-safe security policy evaluation are disclosed herein. An example apparatus includes at least one memory, and at least one processor to execute instructions to at least identify one or more non-sensitive parameters of a plurality of policy parameters and one or more sensitive parameters of the plurality of the policy parameters, the plurality of the policy parameters obtained from a computing device in response to a request from a cloud analytics server for the plurality of the policy parameters, encrypt the one or more sensitive parameters to generate encrypted parameter data in response to the identification of the one or more sensitive parameters, and transmit the encrypted parameter data to the cloud analytics server, the cloud analytics server to curry a security policy function based on one or more of the plurality of the policy parameters.

Technologies for privacy-preserving security policy evaluation

Growing community of inventors

Federal Way, WA, United States of America

Vincent J Zimmer