Securely exposing an accelerator to privileged system components

An apparatus, comprising:

• circuitry, the circuitry arranged to:
• receive, from a hardware accelerator, an instruction including an indication of a privileged component;
• determine whether the instruction is invalid based on a configuration, the configuration to provide a set of security rules to determine whether the instruction complies with one or more security features of a system;
• apply a restriction to the instruction based on a determination that the instruction is invalid;
• determine a set of associated system management operations to restore the system to a secure operating state before receipt of the invalid instruction using state information stored in the configuration;
• and
• send instructions to restore the system to the secure operating state.

At least one non-transitory computer-readable medium, comprising instructions that when executed by a security broker coupled to a hardware accelerator and a privileged component, cause the security broker to:

• determine whether an instruction received from the hardware accelerator is invalid based on a configuration, the configuration to provide a set of security rules to determine whether the instruction complies with one or more security features of a system, the instruction comprising an indication of the privileged component;
• apply a restriction to the instruction based on a determination that the instruction is invalid;
• determine a set of associated system management operations to restore the system to a secure operating state before receipt of the invalid instruction using state information stored in the configuration;
• and
• send instructions to restore the system to the secure operating state.

A system, comprising:

• a hardware accelerator;
• and
• circuitry coupled to the hardware accelerator, the circuitry to:
• determine whether an instruction received from the hardware accelerator is invalid based on a configuration, the configuration to provide a set of security rules to determine whether the instruction complies with one or more security features of a system, the instruction comprising an indication of a privileged component;
• apply a restriction to the instruction based on a determination that the instruction is invalid;
• determine a set of associated system management operations to restore the system to a secure operating state before receipt of the invalid instruction using state information stored in the configuration;
• and
• send instructions to restore the system to the secure operating state.

A system, comprising:

• a privileged component;
• and
• circuitry coupled to the privileged component, the circuitry to:
• determine whether an instruction received from a hardware accelerator is invalid based on a configuration, the configuration to provide a set of security rules to determine whether the instruction complies with one or more security features of a system, the instruction comprising an indication of the privileged component;
• apply a restriction to the instruction based on a determination that the instruction is invalid;
• determine a set of associated system management operations to restore the system to a secure operating state before receipt of the invalid instruction using state information stored in the configuration;
• and
• send instructions to restore the system to the secure operating state