Abstract: Files can be segmented into distinct groups and allocated storage units such as blocks. Files associated with parent and child files can be segmented into separate groups, for instance. Further, a group associated with parent files can be extended to include additional blocks reserved for subsequent update. Additionally, metadata can be merged across groups to provide a unified view of the distinct groups.

Abstract: The disclosed technology is generally directed to integrated circuit technology with defense-in-depth. In one example of the technology, an integrated circuit includes a set of independent execution environments including at least two independent execution environments. At least two of the independent execution environments are general purpose cores with differing capabilities. The independent execution environments in the set of independent execution environments are configured to have a defense-in-depth hierarchy.

Abstract: Model-based virtual system provisioning includes accessing a model of a workload to be installed on a virtual machine of a system as well as a model of the system. A workload refers to some computing that is to be performed, and includes an application to be executed to perform the computing, and optionally includes the operating system on which the application is to be installed. The workload model identifies a source of the application and operating system of the workload, as well as constraints of the workload, such as resources and/or other capabilities that the virtual machine(s) on which the workload is to be installed must have. An installation specification for the application is also generated, the installation specification being derived at least in part from the model of the workload and the model of the virtual system.

Abstract: Files can be segmented into distinct groups and allocated storage units such as blocks. Files associated with parent and child files can be segmented into separate groups, for instance. Further, a group associated with parent files can be extended to include additional blocks reserved for subsequent update. Additionally, metadata can be merged across groups to provide a unified view of the distinct groups.

Abstract: Techniques for creating breadcrumbs for a trail of activity are described. The trail of activity may be created by recording movement information based on inferred actions of walking, not walking, or changing floor levels. The movement information may be recorded with an accelerometer and a pressure sensor. A representation of a list of breadcrumbs may be visually displayed on a user interface of a mobile device, in a reverse order to retrace steps. In some implementations, a compass may additionally or alternatively be used to collect directional information relative to the earth's magnetic poles.

Abstract: Files can be segmented into distinct groups and allocated storage units such as blocks. Files associated with parent and child files can be segmented into separate groups, for instance. Further, a group associated with parent files can be extended to include additional blocks reserved for subsequent update. Additionally, metadata can be merged across groups to provide a unified view of the distinct groups.

Abstract: The described implementations relate to virtual computing techniques. One implementation provides a technique that can include receiving a request to execute an application. The application can include first application instructions from a guest instruction set architecture. The technique can also include loading an emulator and a guest operating system into an execution context with the application. The emulator can translate the first application instructions into second application instructions from a host instruction set architecture. The technique can also include running the application by executing the second application instructions.

Abstract: Briefly stated, the disclosed technology is generally directed to integrated circuit (IC) technology for an IoT processor. In one example, multiple components may be tightly or otherwise integrated onto a single die, e.g., a single monolithic integrated circuit. In one basic example, the components may include a security processing unit and a radio. The components may also include one or more microprocessors (e.g., a processor capable of executing a high-level operating system), microcontrollers, secure memories, encryption components, peripheral interfaces, and/or the like. The security processing unit and/or the configuration of the components may enable, facilitate, or otherwise provide for security features such as tamper resistance, data security, and/or the like.

Abstract: The disclosed technology is generally directed to integrated circuit technology with defense-in-depth. In one example of the technology, an integrated circuit includes a set of independent execution environments including at least two independent execution environments. At least two of the independent execution environments are general purpose cores with differing capabilities. The independent execution environments in the set of independent execution environments are configured to have a defense-in-depth hierarchy.

Abstract: Model-based virtual system provisioning includes accessing a model of a workload to be installed on a virtual machine of a system as well as a model of the system. A workload refers to some computing that is to be performed, and includes an application to be executed to perform the computing, and optionally includes the operating system on which the application is to be installed. The workload model identifies a source of the application and operating system of the workload, as well as constraints of the workload, such as resources and/or other capabilities that the virtual machine(s) on which the workload is to be installed must have. An installation specification for the application is also generated, the installation specification being derived at least in part from the model of the workload and the model of the virtual system.

Abstract: Application compatibility is facilitated by use of library operating systems. Library operating systems can encapsulate portions of an application likely to break application compatibility. An application can be bound to a compatible library operating system that operates over a host operating system. Furthermore, library operating system version can be greater than, equal, or less than the version of the host operating system. Consequently, both backward and forward compatibility is enabled.

Abstract: Model-based virtual system provisioning includes accessing a model of a workload to be installed on a virtual machine of a system as well as a model of the system. A workload refers to some computing that is to be performed, and includes an application to be executed to perform the computing, and optionally includes the operating system on which the application is to be installed. The workload model identifies a source of the application and operating system of the workload, as well as constraints of the workload, such as resources and/or other capabilities that the virtual machine(s) on which the workload is to be installed must have. An installation specification for the application is also generated, the installation specification being derived at least in part from the model of the workload and the model of the virtual system.

Abstract: Virtual machines are made lightweight by substituting a library operating system for a full-fledged operating system. Consequently, physical machines can include substantially more virtual machines than otherwise possible. Moreover, a hibernation technique can be employed with respect to lightweight virtual machines to further increase the capacity of physical machines. More specifically, virtual machines can be loaded onto physical machines on-demand and removed from physical machines to make computational resources available as needed. Still further yet, since the virtual machines are lightweight, they can be hibernated and restored at a rate substantially imperceptible to users.

Abstract: The described implementations relate to virtual computing techniques. One implementation provides a technique that can include receiving a request to execute an application. The application can include first application instructions from a guest instruction set architecture. The technique can also include loading an emulator and a guest operating system into an execution context with the application. The emulator can translate the first application instructions into second application instructions from a host instruction set architecture. The technique can also include running the application by executing the second application instructions.

Abstract: Implementations for providing a persistent secure execution environment with a hosted computer are described. A host operating system of a computing system provides an encrypted checkpoint to a persistence module that executes in a secure execution environment of a hardware-protected memory area initialized by a security-enabled processor. The encrypted checkpoint is derived at least partly from another secure execution environment that is cryptographically certifiable as including another hardware-protected memory area established in an activation state to refrain from executing software not trusted by the client system.

Abstract: Implementations for providing a secure execution environment with a hosted computer are described. A security-enabled processor establishes a hardware-protected memory area with an activation state that executes only software identified by a client system. The hardware-protected memory area is inaccessible by code that executes outside the hardware-protected memory area. A certification is transmitted to the client system to indicate that the secure execution environment is established, in its activation state, with only the software identified by the request.

Abstract: An illustrative operating system distributes two or more instances of the operating system over heterogeneous platforms of a computing device. The instances of the operating system work together to provide single-kernel semantics to present a common operating system abstraction to application modules. The heterogeneous platforms may include co-processors that use different instruction set architectures and/or functionality, different NUMA domains, etc. Further, the operating system allows application modules to transparently access components using a local communication path and a remote communication path. Further, the operating system includes a policy manager module that determines the placement of components based on affinity values associated with interaction relations between components. The affinity values express the sensitivity of the interaction relations to a relative location of the components.

Abstract: Described herein are implementations for providing a platform adaptation layer that enables applications to execute inside a user-mode hardware-protected isolation container while utilizing host platform resources that reside outside of the isolation container. The platform adaptation layer facilitates a system service request interaction between the application and the host platform. As part of the facilitating, a secure services component of the platform adaptation layer performs a security-relevant action.

Abstract: The disclosed architecture facilitates the sandboxing of applications by taking core operating system components that normally run in the operating system kernel or otherwise outside the application process and on which a sandboxed application depends on to run, and converting these core operating components to run within the application process. The architecture takes the abstractions already provided by the host operating system and converts these abstractions for use by the sandbox environment. More specifically, new operating system APIs (application program interfaces) are created that include only the basic computation services, thus, separating the basic services from rich application APIs. The code providing the rich application APIs is copied out of the operating system and into the application environment—the application process.

Abstract: The disclosed architecture facilitates the sandboxing of applications by taking core operating system components that normally run in the operating system kernel or otherwise outside the application process and on which a sandboxed application depends on to run, and converting these core operating components to run within the application process. The architecture takes the abstractions already provided by the host operating system and converts these abstractions for use by the sandbox environment. More specifically, new operating system APIs (application program interfaces) are created that include only the basic computation services, thus, separating the basic services from rich application APIs. The code providing the rich application APIs is copied out of the operating system and into the application environment—the application process.