Abstract: A bare metal resource includes a trusted portion and an untrusted portion. The trusted portion includes trusted hardware, an image repository, and a clearance manager. The clearance manager is executable during bootup of the bare metal resource to perform a clearance process on the untrusted portion, including deleting the BIOS in the untrusted portion and loading a trusted BIOS from the image repository on the untrusted hardware, to place the untrusted portion in a trusted state. The bare metal resource may be provisioned to a tenant of a cloud provider after being placed in the trusted state.

Abstract: A graphics rendering system is provided for controlling the rendering of images to manage expected errors. The graphics rendering system receives a specification of a render task to be performed to render an image of a graphics scene and then identifies computing devices that each have a graphics processing unit. The graphics rendering system directs each of the identified computing devices to render the image specified by the render task such that each identified computing device renders the same image. When the graphics rendering system detects that a computing device has completed the render task successfully, it provides the image rendered by that computing device as the rendered image of the render task such that any other image rendered by another of the computing devices is not needed.

Abstract: In various embodiments, methods and systems for optimizing allocation of dynamic resources are provided. A user service request resource instance is received at an allocator. The user service request resource instance is based on a dynamic resource protocol that supports generating and communicating resource instances between components in a resource allocation platform. The dynamic resource protocol also defines a set of rules for translating and representing resources as logical resource types and logical units. At a node, a node resource instance is generated and communicated, based on the dynamic resource protocol, from the node to the allocator. The node resource instance specifically comprises a resource interaction matrix that indicates dependencies between resource types. A resource allocation instance is generated at the allocator for the user service request resource instance.

Abstract: A graphics rendering system is provided for controlling the rendering of images to manage expected errors. The graphics rendering system receives a specification of a render task to be performed to render an image of a graphics scene and then identifies computing devices that each have a graphics processing unit. The graphics rendering system directs each of the identified computing devices to render the image specified by the render task such that each identified computing device renders the same image. When the graphics rendering system detects that a computing device has completed the render task successfully, it provides the image rendered by that computing device as the rendered image of the render task such that any other image rendered by another of the computing devices is not needed.

Abstract: A graphics rendering system is provided for controlling the rendering of images to manage expected errors. The graphics rendering system receives a specification of a render task to be performed to render an image of a graphics scene and then identifies computing devices that each have a graphics processing unit. The graphics rendering system directs each of the identified computing devices to render the image specified by the render task such that each identified computing device renders the same image. When the graphics rendering system detects that a computing device has completed the render task successfully, it provides the image rendered by that computing device as the rendered image of the render task such that any other image rendered by another of the computing devices is not needed.

Abstract: A bare metal resource includes a trusted portion and an untrusted portion. The trusted portion includes trusted hardware, an image repository, and a clearance manager. The clearance manager is executable during bootup of the bare metal resource to perform a clearance process on the untrusted portion, including deleting the BIOS in the untrusted portion and loading a trusted BIOS from the image repository on the untrusted hardware, to place the untrusted portion in a trusted state. The bare metal resource may be provisioned to a tenant of a cloud provider after being placed in the trusted state.

Abstract: In various embodiments, methods and systems for optimizing allocation of dynamic resources are provided. A user service request resource instance is received at an allocator. The user service request resource instance is based on a dynamic resource protocol that supports generating and communicating resource instances between components in a resource allocation platform. The dynamic resource protocol also defines a set of rules for translating and representing resources as logical resource types and logical units. At a node, a node resource instance is generated and communicated, based on the dynamic resource protocol, from the node to the allocator. The node resource instance specifically comprises a resource interaction matrix that indicates dependencies between resource types. A resource allocation instance is generated at the allocator for the user service request resource instance.

Abstract: A graphics rendering system is provided for controlling the rendering of images to manage expected errors. The graphics rendering system receives a specification of a render task to be performed to render an image of a graphics scene and then identifies computing devices that each have a graphics processing unit. The graphics rendering system directs each of the identified computing devices to render the image specified by the render task such that each identified computing device renders the same image. When the graphics rendering system detects that a computing device has completed the render task successfully, it provides the image rendered by that computing device as the rendered image of the render task such that any other image rendered by another of the computing devices is not needed.

Abstract: Safe exceptions detect and intervene in a malicious attack against an application or system component, even in the presence of a coding flaw such as a buffer overrun. A list of all the exception handlers in an image (e.g., a DLL or EXE) is desirably created. When loading the image into a process, the operating system loader finds and stores a reference to this list. When a subsequent attack targets exception handling by creating an attacker provided exception handler, the new attacker provided exception handler is compared to a list of the real exception handlers. The list of real exception handlers is stored in memory, and desirably cannot be modified. In particular, when an exception occurs, the operating system finds the proper exception handler from information on the stack (this may be under attack, so the information is not trusted) and compares it to the previously created read-only reference list.

Abstract: Safe exceptions detect and intervene in a malicious attack against an application or system component, even in the presence of a coding flaw such as a buffer overrun. A list of all the exception handlers in an image (e.g., a DLL or EXE) is desirably created. When loading the image into a process, the operating system loader finds and stores a reference to this list. When a subsequent attack targets exception handling by creating an attacker provided exception handler, the new attacker provided exception handler is compared to a list of the real exception handlers. The list of real exception handlers is stored in memory, and desirably cannot be modified. In particular, when an exception occurs, the operating system finds the proper exception handler from information on the stack (this may be under attack, so the information is not trusted) and compares it to the previously created read-only reference list.

Abstract: A certification or signature is incorporated in a computer program, an executable file, or code to assure its authenticity and integrity, particularly for receiving it over an open computer network like the Internet. The executable file may be of any executable form, including an executable or portable executable .exe file format, a .cab cabinet file format, an .ocx object control format, or a Java class file. The certification includes a keyed source confirmation with a secure representation of the executable file. In an embodiment, the certification is referenced in a header of the executable file, the reference including a pointer to the keyed source confirmation and an indication of the size of the keyed source confirmation.