Abstract: Methods, systems, and devices associated with techniques for secure writes by non-privileged users are described. A memory device may be configured with one or more blocks of memory operating in a secure write mode. The memory device may receive an append command from a non-privileged user. The append command may indicate data to write to the block of memory at an address determined by the memory device. The memory device may identify a pointer to the address for storing the data within the block of memory. The memory device may write the data to a portion of the block of memory based on identifying the pointer and may update the pointer associated with the block of memory based on writing the data.

Abstract: A hardware monitor arranged to detect out-of-bounds violations in a hardware design for an electronic device. The hardware monitors include monitor and detection logic configured to monitor the current operating state of an instantiation of the hardware design and detect when the instantiation of the hardware design implements a fetch of an instruction from memory; and assertion evaluation logic configured to evaluate one or more assertions that assert a formal property that compares the memory address of the fetched instruction to an allowable memory address range associated with the current operating state of the instantiation of the hardware design to determine whether there has been an out-of-bounds violation. The hardware monitor may be used by a formal verification tool to exhaustively verify that the hardware design does not cause an instruction to be fetched from an out-of-bounds address.

Abstract: A system includes a plurality of processes, a network fabric, and a shared memory accessible by the plurality of processes over the network fabric, the shared memory to store a plurality of elements of a data structure. A first process is designated as being allowed to update a target variable stored in the shared memory, and a second process of the plurality of processes writes a request for an atomic operation to a first region in the shared memory. The first process is responsive to the request to perform the atomic operation that updates the target variable, and write a result including a value of the updated target variable to a second region in the shared memory, the second region readable by the second process, the request and the result being elements of the data structure.

Abstract: Methods and systems are disclosed for implementing a secure application execution environment using Derived User Accounts (SAE DUA) for Internet content. Content is received and a determination is made if the received content is trusted or untrusted content. The content is accessed in a protected derived user account (DUA) such as a SAE DUA if the content is untrusted otherwise the content is accessed in a regular DUA if the content is trusted.

Abstract: Direct inter-processor communication is enabled with respect to data in a memory location without having to switch specific circuits through a switching element (e.g., an optical switch). Rather, in this approach a memory pool is augmented to include a dedicated portion that serves as a disaggregated memory common space for communicating processors. The approach obviates the requirement of switching of physical memory modules through the optical switch to enable the processor-to-processor communication. Rather, processors (communicating with another) have an overlapping ability to access the same memory module in the pool; thus, there is no longer a need to change physical optical switch circuits to facilitate the inter-processor communication. The disaggregated memory common space is shared among the processors, which can access the common space for reads and writes, although particular locations in the memory common space for reads and writes are different.

Abstract: The present invention provides a system on chip (SoC), wherein the SoC comprises a first processor, a second processor and a memory. The memory stores a first parameter and a second parameter, wherein the first parameter is set by the first processor to indicate whether a specific region of the memory is locked or unlocked, and the second parameter is set by the first processor to indicate whether the specific region of the memory is locked or unlocked. In the operations of the SoC, before the first processor intends or prepares to access the specific region, the first processor refers to the second parameter to determine if the specific region is allowed to be accessed by the first processor.

Abstract: A system and method of registering one or more objects in a container of a multi-threaded computing system. A method includes prefixing, to each object of the one or more objects, an object header having a version counter with an initial version count of zero. The method further includes for each object to be allocated to a thread of the multi-threaded computing system, allocating an object frame associated with each allocated object to the thread while maintaining the object header. The method further includes constructing each allocated object in the object frame after the object header, and initializing the object header of each allocated object by executing a store/store memory barrier and incrementing the version counter by a count of one to mark the associated allocated object as valid.

Abstract: The controller has a communication unit that receives read/write requests specifying an address of the same virtual area from a plurality of clients, and an actual area to be read/written by the communication unit. The communication unit has a management table that associates an identifier of the client with an address of the actual area that is different for each client, and an address conversion unit that carries out reading and writing to the address of the actual area associated with the identifier of the client with reference to the management table.

Abstract: Systems and methods are provided to reduce the number of redundant copy operations performed as part of a live migration of a virtual machine executing a guest. While pre-copying for the live migration of the VM, the guest may continue to write to the pages. A hypervisor may clear the dirty pages and schedule the copy operations of the modified pages in a processing engine for copying to a target device. In one embodiment, before initiating the copy operation, the processing engine may check if the page has been modified again and omit the copy operation if the page has been modified again.

Abstract: A memory system includes a controller and a non-volatile memory device. The controller is connectable to a host device by a bus conforming to a serial peripheral interface (SPI) standard, and configured to recognize a command signal that is received over the bus immediately after a chip select signal is received over the bus. The non-volatile memory device stores first information indicating a data size, second information indicating a manufacturer ID, third information indicating a device ID, and fourth information. The controller, upon recognizing that the command signal is an identification (ID) read command, outputs to the host device, response information that has the data size indicated by the first information and includes any one of: (i) the second information and the third information, and (ii) the second information, the third information, and the fourth information.

Abstract: Systems for identifying misappropriation of forensically-watermarked video content. A method embodiment for forensic watermarking commences upon identifying video sources. A video is partitioned into frame ranges or “chunks”. Different watermarking schemes are applied to the chunks to generate different watermarked versions of each chunk. Upon receiving a request from a user to view a requested video, a digital signature is generated from a set of request attributes such as a user ID or session ID. A video stream is assembled wherein the stream chunk order comprises a particular recoverable sequence of the differing watermarked chunks, where the sequence is based on bit sequences of the digital signature. A misappropriated video or portion thereof can be analyzed to identify the particular recoverable sequence or portion thereof. Based on the recoverable sequence, the digital signature can be recovered, and based on the digital signature, the source of the misappropriation can be determined.

Abstract: Disclosed herein are system, method, and computer program product embodiments for efficiently providing transaction-consistent snapshots of data stored in or associated with a database stored within a database management system. An embodiment operates by receiving, at a source database, an update request to update a table at the source database and transmitting a message to a cache node to invalidate a copy of a table time stamp associated with the table, where the copy of the table time stamp is stored at the cache node. The embodiment continues by updating the table at the source database based on the update request.

Abstract: A data processing system and a method of operating the same may include a host system and a memory system. The host system may include a host memory and a host controller, and the memory system may include a memory controller and a nonvolatile memory device. The memory controller may include a data attribute determination circuit and a memory selection circuit. The data attribute determination circuit may be configured to determine an attribute of write data received from the host controller. The memory selection circuit may be configured to select, based on the determined attribute of the write data, any one of the host memory and the nonvolatile memory device as a location where the write data is to be stored.

Abstract: A lightweight always-on monitoring, collecting, diagnosing, and correcting utility operates in an enhanced storage manager that manages a data storage management system. The always-on utility provides a comprehensive and pro-active approach, which is intended to reduce, if not altogether eliminate, the need for after-the-fact diagnostics. The always-on utility also enforces so-called best practices and other heuristics, which include pro-actively activating certain database settings that are not enabled by default; manipulating certain aspects of the database to improve performance; and reporting aspects that are outside best-practice parameters to the trouble report system so that system administrators and/or developers may intervene before a catastrophic failure occurs. In some cases, the best-practice parameters represent heuristics designed by the present inventors to improve the performance and general health of the management database.

Abstract: A product code decoder to implement a method of bit correction in a codeword buffer to support error correcting code (ECC). The method loads a location entry from a correction queue, where the location entry includes a data word address and bit location information. The method performs a fast path data word address comparison to determine whether data from the data word address is being processed by a previous entry from the correction queue. The method further combines a correction of the data at the data word address specified by the location entry with a correction of a copy of the data being processed based on a previous location entry, in response to a fast path data word address comparison match, and stores the combined data in the codeword buffer.

Abstract: Devices and techniques for status management in storage backed memory are disclosed herein. An encoded message can be received at a first interface of the memory package. Here, the memory package also includes a second interface to a host. The message can be decoded to obtain a decoded message that includes an attribute. The attribute can be compared a set of attributes that correspond to an advertised status of the memory package. The comparison enables a determination that the attribute is in the set of attributes. The advertised status of the memory package can then be modified in response to the determination that the attribute is in the set of attributes.

Abstract: A data processing apparatus and method serve to manage access permission checking in respect of contingent memory access operations (the access permission failure of which does not alter program flow) in dependence of a contingent-access permission checking disable flag. If the contingent access disable flag has a first value, then this disables memory permission circuitry e.g. a walk state machine 22, from performing a check as to whether or not the memory access circuitry is permitted to perform a requested memory access. Non-contingent memory accesses are able to utilise the memory permission circuitry irrespective of the value of the contingent-access permission checking disable flag.

Abstract: In accordance with embodiments of the present disclosure, a binary translator can perform address shifting on the binary code of an executing application. Address shifting serves to shift the addresses of memory operations that can access locations in the kernel address space into address locations in the user space, thus avoiding speculative access into the kernel address space.

Abstract: Embodiments of the present invention set forth techniques for allocating execution resources to groups of threads within a graphics processing unit. A compute work distributor included in the graphics processing unit receives an indication from a process that a first group of threads is to be launched. The compute work distributor determines that a first subcontext associated with the process has at least one processor credit. In some embodiments, CTAs may be launched even when there are no processor credits, if one of the TPCs that was already acquired has sufficient space. The compute work distributor identifies a first processor included in a plurality of processors that has a processing load that is less than or equal to the processor loads associated with all other processors included in the plurality of processors. The compute work distributor launches the first group of threads to execute on the first processor.

Abstract: A memory device comprises a memory array with I/O path and security circuitry coupled to the I/O path of the memory array. The memory device comprises control circuitry, responsive to configuration data, to invoke the security circuitry. The memory device comprises a configuration store, storing the configuration data accessible by the control circuitry to specify location and size of a security memory region in the memory array. Responsive to an external command and the configuration data, the control circuitry can be configured to invoke the security circuitry on an operation specified in the external command in response to accesses into the security memory region, or to not invoke the security circuitry in response to accesses to outside the security memory region.

Abstract: Apparatuses and methods related to authenticating memory. Memory devices can be authenticated utilizing authentication codes. An authentication code can be generated based on information stored in a fuse array of the memory device. The authentication code can be compared to an externally provided authentication code to authenticate the memory device. The memory device may be authenticated to ensure that the memory device is not a security threat.

Abstract: Check point recovery based on identifying used blocks for block-based backup files is described. At least one data block is identified that is used by a system since a point in time in response to receiving a request to restore the system based on the point in time. At least one data block, corresponding to the identified at least one data block, is recovered from at least one backup file for the system, without reading each data block backed up via the at least one backup file for the system. The system is restored based on the recovered at least one data block.

Abstract: Methods and a system for secure data storage are described. In particular, a digital storage system for storing and retrieving user data is described, said system comprising: one or more independent digital storage devices, each digital storage device comprising a data storage device configured to store user data; a switch for regulating a supply of electrical power to the or each data storage device; and a security module for activating the switch and for storing timing restrictions that define a time window. The switch may only be activated to power the data storage device during the time window, improving the security of the user data.

Abstract: The present technology pertains to a organization directory hosted by a synchronized content management system. The corporate directory can provide access to user accounts for all members of the organization to all content items in the organization directory on the respective file systems of the members' client devices. Members can reach any content item at the same path as other members relative to the organization directory root on their respective client device. In some embodiments novel access permissions are granted to maintain path consistency.

Abstract: High reliability and high performance of a storage device formed of a Dual port NVMe SSD are achieved while preventing the risk of destruction of data. The storage device includes a main memory that belongs to each of two or more clusters and that stores data related to an IO request; and a processor belonging to each of the clusters controlling accesses to the main memory. The main memory includes a first region where writing from the memory drive is permitted and a second region where the writing is prohibited. The processor selects the first region as a transfer destination related to the IO request from the memory drive when the IO request is a first request, and selects the second region as the transfer destination related to the IO request from the memory drive while permitting writing to the second region when the IO request is a second request.

Abstract: Protection from malware download is provided. A first input is received to access one of an email attachment or a web site link using an application. A newly generated secure virtual machine is obtained from one of a network server or a cloud computing service. The one of the email attachment or the web site link is sent to the newly generated secure virtual machine for processing.

Abstract: A system for decrypting encrypted data may include a data storage server that may store encrypted data in a server memory, communicate a portion of the encrypted data to a first user device, and generate an access code for decrypting the portion of the encrypted data. The data storage device may also communicate the access code to a second user device. The first user device may display, on a first device display, a visual representation of the portion of the encrypted data. The second user device may acquire the visual representation of the portion of the encrypted data from the first device display, decrypt the portion of the encrypted data based upon the access code and the visual representation, and display the decrypted portion of the encrypted data on a second device display.

Abstract: Various embodiments are generally directed to an apparatus, method and other techniques for allocating a portion of the memory as system management random access memory (SMRAM) including a system management interrupt (SMI) handler for a system management mode (SMM), the SMI handler to handle SMIs for the SMM, generating a page table for the SMM, the page table comprising one or more mapped pages to map virtual addresses to physical addresses for the SMM, and setting one or more page table attributes for the page table to prevent a malicious code attack on the SMM.

Abstract: Aspects of the disclosure provide for mechanisms for memory protection of virtual machines in a computer system. A method of the disclosure includes: obtaining, by a hypervisor, a guest page table associated with a virtual machine, wherein the guest page table comprises a first guest page table entry associated with a privilege flag indicating that a first virtual page of a guest memory of the virtual machine is accessible to unprivileged code; and in view of a determination that the virtual machine is running in a kernel mode, generating a first host page table in view of the guest page table, wherein the first host page table comprises a first host page table entry corresponding to the first guest page table entry, and wherein the first host page table entry is associated with a privilege flag indicating that the first virtual page is not accessible to the unprivileged code.

Abstract: Some embodiments of the present invention include a method comprising: accessing units of network storage that encode state data of respective virtual machines, wherein the state data for respective ones of the virtual machines are stored in distinct ones of the network storage units such that the state data for more than one virtual machine are not commingled in any one of the network storage units.

Abstract: Various embodiments relate generally to computer software and systems, including a subset of intermediary executable instructions constituting an communication interface between various software and/or hardware platforms, and, more specifically, to an application interface integration design management platform configured to analyze distinctive repositories (e.g., version-control application-based repositories) and identify application interface files and data components to form a consolidated data source with which to perform a unified search (e.g., a global search) to implement different portions of various application interfaces in development of application program interfaces (“APIs”), and the like.

Abstract: The herein described technology facilitates sharing of notes and files with a locked computing device. The locked computing device may receive a file sharing request that includes a file identifier identifying a location of a source file. The locked processing device provides a user account of the processing device with access to content of the source file responsive to authentication of a recipient access credential associated with the user account.

Abstract: A fingerprint recognition based authentication method and apparatus is disclosed. The authentication apparatus may obtain an input fingerprint from a touch input of a user, determine an input number corresponding to the input fingerprint using preregistered fingerprint-number mapping information, and authenticate the user based on whether an input number sequence corresponding to an input fingerprint sequence is identical to a reference number sequence.

Abstract: A hardware monitor arranged to detect out-of-bounds violations in a hardware design for an electronic device. The hardware monitors include monitor and detection logic configured to monitor the current operating state of an instantiation of the hardware design and detect when the instantiation of the hardware design implements a fetch of an instruction from memory; and assertion evaluation logic configured to evaluate one or more assertions that assert a formal property that compares the memory address of the fetched instruction to an allowable memory address range associated with the current operating state of the instantiation of the hardware design to determine whether there has been an out-of-bounds violation. The hardware monitor may be used by a formal verification tool to exhaustively verify that the hardware design does not cause an instruction to be fetched from an out-of-bounds address.

Abstract: A memory subsystem includes a memory interface for accessing a non-volatile memory (NVM), a host interface for communicating with a host, and a processor. The processor is configured to calculate a signature over program code that is used by the host and is stored in the NVM, to verify, upon detecting a boot process performed by the host, whether the boot process is legitimate, and, only if the boot process was verified to be legitimate, to provide the signature to the host for authentication to a remote server.

Abstract: A method for reducing I/O performance impacts associated with a data commit operation is disclosed. In one embodiment, such a method includes periodically performing a data commit operation wherein modified data is destaged from cache to persistent storage drives. Upon performing a particular instance of the data commit operation, the method determines whether modified data in the cache is a metadata track. In the event the modified data is a metadata track, the method attempts to acquire an exclusive lock on the metadata track. In the event the exclusive lock cannot be acquired, the method skips over the metadata track without destaging the metadata track for the particular instance of the data commit operation. A corresponding system and computer program product are also disclosed.

Abstract: Techniques are disclosed in which a secure circuit controls a gating circuit to enable or disable other circuitry of a device (e.g., one or more input sensors). For example, the gating circuit may be a power gating circuit and the secure circuit may be configured to disable power to an input sensor in certain situations. As another example, the gating circuit may be a clock gating circuit and the secure circuit may be configured to disable the clock to an input sensor. As yet another example, the gating circuit may be configured to gate a control bus and the secure circuit may be configured to disable control signals to an input sensor. In some embodiments, hardware resources included in or controlled by the secure circuit are not accessible by other elements of the device, other than by sending requests to a predetermined set of memory locations (e.g., a secure mailbox).

Abstract: A call path identifier is maintained which is permuted in response to a calling instruction for calling a target function, based on a function return address. The call path identifier is used as a modifier value for authentication code generating and checking instructions for generating and checking authentication codes associated with source values. In response to the authentication code checking instruction, if an expected authentication code mismatches a previously generated authentication code for a source value then an error handling response is triggered. This is useful for preventing attacks where address pointers which are valid in one part of the code are attempted to be reused in other parts of code.

Abstract: An apparatus includes an interface and storage circuitry. The interface is configured to communicate with a memory including multiple memory cells that store data as respective analog values. The memory is addressable using physical addresses. The storage circuitry is configured to perform a first read operation from a physical address, and determine a first sequence of analog values retrieved by the first read operation, to further perform a second read operation from the physical address, and determine a second sequence of analog values retrieved by the second read operation, to evaluate a variation between the first sequence and the second sequence, and to determine that an unauthorized re-programming to the physical address has occurred between the first read operation and the second read operation, in response to the evaluated variation exceeding a predefined variation level.

Abstract: A system can apply file placement rules to dynamically place files and directories within file system views backed by objects in an object storage system. After detection of an update to a first file system view that causes an update of an object in a storage grid, an object manager begins evaluation of file placement rules against metadata of the object. For each file placement rule that is triggered, the object manager determines identifies gateways that export the first file system view. The object manager then instructs the gateways to update their representations of the first file system view. The disclosed embodiments may be able to scale to managing hundreds of billions of files spanning thousands of file system views, especially in the presence of disconnected operation.

Abstract: Numerous embodiments of a precision tuning algorithm and apparatus are disclosed for precisely and quickly depositing the correct amount of charge on the floating gate of a non-volatile memory cell within a vector-by-matrix multiplication (VMM) array in an artificial neural network. Selected cells thereby can be programmed with extreme precision to hold one of N different values.

Abstract: According to an example, cache operations may be managed by detecting that a cacheline in a cache is being dirtied, determining a current epoch number, in which the current epoch number is associated with a store operation and wherein the epoch number is incremented each time a thread of execution completes a flush-barrier checkpoint, and inserting an association of the cacheline to the current epoch number into a field of the cacheline that is being dirtied.

Abstract: A semiconductor package including an insulating encapsulation, an integrated circuit component, and conductive elements is provided. The integrated circuit component is encapsulated in the insulating encapsulation, wherein the integrated circuit component has at least one through silicon via protruding from the integrated circuit component. The conductive elements are located on the insulating encapsulation, wherein one of the conductive elements is connected to the at least one through silicon via, and the integrated circuit component is electrically connected to the one of the conductive elements through the at least one through silicon via.

Abstract: A method for data protection in a memory system includes receiving, from entity, an address range and a set command, the address range corresponding to at least a portion of a memory partition in the memory system. The method further includes determining whether the entity is an authenticated entity. The method further includes based on the determination of whether the entity is an authenticated entity, setting, using the set command, access characteristics of the portion of the partition corresponding to the address range.

Abstract: A data processing system includes multiple processing units all having access to a shared memory. A processing unit includes a processor core that executes memory access instructions including a store-conditional instruction that generates a store-conditional request specifying a store target address and store data. The processing unit further includes a reservation register that records shared memory addresses for which the processor core has obtained reservations and a cache that services the store-conditional request by conditionally updating the shared memory with the store data based on the reservation register indicating a reservation for the store target address. The processing unit additional includes a blocking state machine configured to protect the store target address against access by any conflicting memory access request during a protection window extension following servicing of the store-conditional request.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed to facilitate distributed data backup. An example apparatus includes a controller to detect a trigger event for a distributed backup mode; and, in response to detection of the trigger event, trigger the distributed backup mode. When in the distributed backup mode, the controller of the example apparatus is to identify one or more receiving devices within communication range of the apparatus available to receive a data backup from the apparatus. The example apparatus includes a data distributor to distribute data from the apparatus among the one or more receiving devices. The controller of the example apparatus is to confirm receipt of the distributed data by the one or more receiving devices.

Abstract: A storage device includes an antenna, a first nonvolatile memory that is operable using power generated at the antenna by an electromagnetic induction caused by an external device, and stores lock state information, a first controller configured to change the lock state information in response to a command that is wirelessly transmitted from the external device through the antenna, a second nonvolatile memory, and a second controller configured to allow access to a memory region of the second nonvolatile memory depending on the lock state information stored in the first nonvolatile memory.

Abstract: The present disclosure includes systems and methods relating to information flow tracking and detection of unintentional design flaws of digital devices and microprocessor systems. In general, in one implementation, a technique includes: receiving a hardware design specifying an implementation for information flow in a hardware configuration; receiving one or more labels annotating the hardware design; receiving one or more security properties specifying a restriction relating to the one or more labels for implementing an information flow model; generating the information flow model; performing verification using the information flow model, wherein verification comprises verifying whether the information flow model passes or fails against the one of more security properties; and upon verifying that the information flow model passes, determining that an unintentional design flaw is not identified in the hardware design.

Abstract: A system and method for utilizing a security key stored in non-volatile memory, and for generating a PUF-based data set on an integrated circuit including non-volatile memory cells, such as flash memory cells, are described. The method includes storing a security key in a particular block in a plurality of blocks of the non-volatile memory array; utilizing, in a security logic circuit coupled to the non-volatile memory array, the security key stored in the particular block in a protocol to enable access via a port by external devices or communication networks to data stored in blocks in the plurality of blocks; and enabling read-only access to the particular block by the security logic for use in the protocol, and preventing access to the particular block via the port.

Abstract: An operating method of a memory controller to control a nonvolatile memory device includes receiving information about operation failure from the nonvolatile memory device, receiving lock-out status information from the nonvolatile memory device, determining whether a lock-out signal is output based on the lock-out status information, and determining a failure block corresponding to the information about the operation failure as a normal block or a bad block depending on the determination result.