Micron Technology Incorporated

Lodestar Licensing Group LLC

Danilo Caraccio

Daniele Balluchi

Emanuele Confalonieri

Paolo Amato

Graziano Mirichigni

Luca Porzio

Marco Dallabora

Alessandro Orlando

Federico Tiziani

Roberto Izzi

Marco Sforzin

Giovanni Campardo

Niccolò Izzo

Manuela Scognamiglio

Victor Y Tsai

Neal Anthony Galbo

Amitava Majumdar

Antonino Pollio

Robert Warren

Massimo Iaculo

Francesco Falanga

Angelo Alberto Rovelli

Ornella Vitale

Federica Cresci

Claudio Giaccio

Craig A Jones

Anandhavel Nagendrakumar

Ankush Lal

Greg A Blodgett

Frank F Ross

Giuseppe D'Eliseo

Andrea Ghilardelli

Nicola Colella

Gian Pietro Vanalli

Kirthi Shenoy

Stefano Corno

Greg S Hendrix

Krunal Patel

Massimiliano Magni

Adam D Gailey

Sujeet V Ayyapureddi

Ameen D Akel

Yang Lu

Cagdas Dirik

Elliott Clifford Cooper-Balis

Gianfranco Ferrante

Edmund Gieske

Gianfranco Santopietro

Niccolo Izzo

William Yu

Robert Michael Walker

David Hulton

Markus H Geiger

Joemar Sinipete

Massimiliano Patriarca

Antonino Caprì

Mohammed Ebrahim Hargan

Chia Wei Chang

Niccolo′ Izzo

Chad B Erickson

James G Steele

Thomas T Tangelder

Jacob S Robertson

Luca Castellazzi

Niccolo' Izzo

Scott Garner

Victor Tsai

Neal Galbo

Implementations described herein relate to a device identifier composition engine (DICE) 3-layer architecture. In some implementations, a device may include a secure computing environment including a hardware root of trust (HRoT) DICE component. The secure computing environment may include a DICE layercomponent configured to derive a DICE identity key. The secure computing environment may include a DICE layercomponent configured to derive a DICE alias key based on the DICE identity key. The secure computing environment may include a controller configured to receive an update to firmware of a component. The controller may be configured to update the firmware of the component based on receiving the update. The controller may be configured to update one or more keys of the component or one or more keys of one or more components above the component in a layer stack.

Device identifier composition engine 3-layer architecture

A controller can be configured to enable a host to control media testing on a memory device. The interface between the host and the memory can be abstract, such that the host does not have direct control over the memory. Instead, the controller can provide translation between a host protocol, such as compute express link (CXL), and a memory protocol, such as a protocol to control a dual data rate (DDR) interface. The controller can enable media test capability discovery, configuration, and/or control for the host. The controller can enable media test result reporting from the memory to the host.

Host controlled media testing of memory

Implementations described herein relate to an immutable certificate for a device identifier composition engine (DICE). In some implementations, a device may include a secure computing environment. The secure component environment may include a hardware root of trust (HRoT) DICE component, a DICE layer 0 (L0) component configured to derive a DICE identity key, wherein the DICE L0 component is above the HRoT DICE component in a layer stack, a DICE layer 1 (L1) component configured to derive a DICE alias key based on the DICE identity key, wherein the DICE L1 component is above the DICE L0 component in the layer stack, wherein the DICE L1 component and the DICE L0 component are implemented as mutable code, and a controller. The controller may be configured to generate a set of certificates based on a compound device identifier (CDI).

Immutable certificate for device identifier composition engine

Protection for a secure boot procedure can be provided in addition to cryptographic verification of boot firmware associated with the boot procedure. While the boot firmware is being verified and executed at a secure sub-system, an open sub-system can be put into a halt state, during which the open sub-system is prevented from performing the boot procedure. The open sub-system is still prevented from performing the boot procedure even if the boot firmware is verified and/or executed unless the open sub-system is put into the resume state again.

Secure boot procedure

The present disclosure includes apparatuses and methods for command queuing. A number of embodiments include receiving a queued command request at a memory system from a host, sending a command response from the memory system to the host that indicates the memory system is ready to receive a command in a command queue of the memory system, and receiving, in response to sending the command response, a command descriptor block for the command at the memory system from the host.

Command queuing

Methods, systems, and devices related to field firmware update (FFU). A first memory of a memory module may receive an encrypted segment of a FW package associated with FFU. A decrypted segment of the FW package may be stored by the first memory. A re-encrypted segment of the FW package may be stored by the first memory. The re-encrypted segment of the FW package may be communicated to a second memory of the memory module.

Field firmware update

In a memory controller system, a system and method to identify memory errors which may require soft package repair or hard package repair to rows of DRAM memory. When data is written to a row of DRAM, the data is immediately and automatically read back and scanned for bit errors. If bit errors are identified, the data is corrected and written back to the same memory location. The memory location is re-read. If bit errors are again identified, the memory location is marked for soft or hard repair. If, upon rereading the memory location, additional bit errors are identified, a historical record of memory errors is reviewed to determine if bit errors have occurred previously at the same memory location. If yes, the memory location is again marked for a soft post package repair or a hard post package repair.

Error detection, correction, and media management on a dram device

Error detection, correction, and media management on a memory device

Disclosed in some examples are methods, systems, and devices for authenticating a firmware object on a device and in some examples to safeguard the attestation process from the execution of malicious firmware. In some examples, a firmware update process may, in addition to updating the firmware on the device, write a hash of the authentic firmware code in a secure storage device (e.g., a register). This may be done in some examples in a protected environment (e.g., a trusted execution environment or a protected firmware update process). Upon first boot after the update, a firmware update checker compares the firmware object that is booted with the value of the secure storage device. If the values match, the alias certificate may be regenerated, and the boot continues. If the values do not match, then the alias certificate may not be regenerated, and the system may have an authenticity failure because the key and the certificate do not match.

Firmware authenticity check

In a compute express link (CXL) memory controller system, a system and method to identify memory errors which may require soft package repair or hard package repair to rows of DRAM memory. When data is written to a row of DRAM, the data is immediately and automatically read back and scanned for bit errors. If bit errors are identified, steps are taken to determine if the memory location requires no repair, soft repair, or hard repair. The data is corrected and written back to a new memory location which is memory-mapped to the original location, thus effecting the soft- or hard-repair. The present system and method does not repair the entire row of memory, but only repairs the specific die(s) that exhibit memory error in the row.

Selective per die DRAM PPR for memory device

Methods, systems, and devices related to built-in self-test (BIST) circuitry of a controller. The controller can be coupled to multiple memory devices. The BIST circuitry can include registers configured to store burst patterns. The BIST circuitry can perform a BIST operation on the memory devices contemporaneously and using the number of burst patterns.

Built-in self-test circuitry

In some implementations, a system includes a set of servers configured to establish a set of virtual machines to provide a computing environment; a set of compute express link (CXL) interface components configured to communicate with the set of servers via a set of CXL interconnects; and a controller configured to at least one of: encrypt protocol data against a CXL interposer security threat associated with the set of CXL interconnects or a malicious extension security threat, provide a secure handshake verification of an identity of the set of CXL interface components, enforce a chain of trust rooted in hardware of the set of CXL interface components; restrict access to an area of memory of the set of CXL interface components that stores security data for verified or secured processes; or perform a security check and set up a set of security features of the set of CXL interface components.

Classification and mitigation of compute express link security threats

Methods, systems, and devices related to built-in self-test burst patterns based on architecture of memory. A controller can be coupled to a memory device. The controller can include built-in self-test (BIST) circuitry. The BIST circuitry can include registers configured to store respective write burst patterns and read burst patterns based on an architecture of the memory device.

Built-in self-test burst patterns based on architecture of memory

A processing device of a memory sub-system can monitor a plurality of received commands to identify a forced unit access command. The processing device can identify a metadata area of the memory device based on the forced unit access command. The processing device can also perform an action responsive to identifying a subsequent forced unit access command to the metadata area.

Storage traffic pattern detection in memory devices

A channel width can depend on a quantity of memory units (e.g., memory dice) that forms a channel as well as a size of the memory units. A memory system can operate with memory units configured to exchange (e.g., transfer to and/or from) data at a rate of smaller granularity that can provide more various options for channel widths, which can further allow a fine-tuned optimization of the memory system in association with its bandwidth and latency in transferring data from and/or to the memory units. The channels whose channel width is fine-tuned with such memory units can be further used to provide a reliability, availability, and serviceability (RAS) protection, such as a redundant array of independent disks (RAID) protection.

Apparatus for redundant array of independent disks

Growing community of inventors

Buonalbergo, Italy

Danilo Caraccio