Micron Technology Incorporated

Lodestar Licensing Group LLC

Danilo Caraccio

Daniele Balluchi

Emanuele Confalonieri

Paolo Amato

Graziano Mirichigni

Luca Porzio

Marco Dallabora

Federico Tiziani

Alessandro Orlando

Roberto Izzi

Marco Sforzin

Giovanni Campardo

Manuela Scognamiglio

Victor Y Tsai

Amitava Majumdar

Antonino Pollio

Robert Warren

Massimo Iaculo

Neal Anthony Galbo

Francesco Falanga

Angelo Alberto Rovelli

Niccolò Izzo

Ornella Vitale

Federica Cresci

Claudio Giaccio

Craig A Jones

Ankush Lal

Anandhavel Nagendrakumar

Greg A Blodgett

Frank F Ross

Giuseppe D'Eliseo

Andrea Ghilardelli

Nicola Colella

Gian Pietro Vanalli

Kirthi Shenoy

Stefano Corno

Greg S Hendrix

Krunal Patel

Massimiliano Magni

Adam D Gailey

Sujeet V Ayyapureddi

Ameen D Akel

Yang Lu

Cagdas Dirik

Elliott Clifford Cooper-Balis

Gianfranco Ferrante

Edmund Gieske

Niccolo Izzo

Gianfranco Santopietro

William Yu

Robert Michael Walker

David Hulton

Markus H Geiger

Joemar Sinipete

Massimiliano Patriarca

Antonino Caprì

Mohammed Ebrahim Hargan

Neal A Galbo

Niccolo′ Izzo

Chad B Erickson

James G Steele

Thomas T Tangelder

Jacob S Robertson

Niccolo' Izzo

Chia Wei Chang

Scott Garner

Luca Castellazzi

Implementations described herein relate to an immutable certificate for a device identifier composition engine (DICE). In some implementations, a device may include a secure computing environment. The secure component environment may include a hardware root of trust (HRoT) DICE component, a DICE layer 0 (L0) component configured to derive a DICE identity key, wherein the DICE L0 component is above the HRoT DICE component in a layer stack, a DICE layer 1 (L1) component configured to derive a DICE alias key based on the DICE identity key, wherein the DICE L1 component is above the DICE L0 component in the layer stack, wherein the DICE L1 component and the DICE L0 component are implemented as mutable code, and a controller. The controller may be configured to generate a set of certificates based on a compound device identifier (CDI).

Immutable certificate for device identifier composition engine

Protection for a secure boot procedure can be provided in addition to cryptographic verification of boot firmware associated with the boot procedure. While the boot firmware is being verified and executed at a secure sub-system, an open sub-system can be put into a halt state, during which the open sub-system is prevented from performing the boot procedure. The open sub-system is still prevented from performing the boot procedure even if the boot firmware is verified and/or executed unless the open sub-system is put into the resume state again.

Secure boot procedure

The present disclosure includes apparatuses and methods for command queuing. A number of embodiments include receiving a queued command request at a memory system from a host, sending a command response from the memory system to the host that indicates the memory system is ready to receive a command in a command queue of the memory system, and receiving, in response to sending the command response, a command descriptor block for the command at the memory system from the host.

Command queuing

Methods, systems, and devices related to field firmware update (FFU). A first memory of a memory module may receive an encrypted segment of a FW package associated with FFU. A decrypted segment of the FW package may be stored by the first memory. A re-encrypted segment of the FW package may be stored by the first memory. The re-encrypted segment of the FW package may be communicated to a second memory of the memory module.

Field firmware update

In a memory controller system, a system and method to identify memory errors which may require soft package repair or hard package repair to rows of DRAM memory. When data is written to a row of DRAM, the data is immediately and automatically read back and scanned for bit errors. If bit errors are identified, the data is corrected and written back to the same memory location. The memory location is re-read. If bit errors are again identified, the memory location is marked for soft or hard repair. If, upon rereading the memory location, additional bit errors are identified, a historical record of memory errors is reviewed to determine if bit errors have occurred previously at the same memory location. If yes, the memory location is again marked for a soft post package repair or a hard post package repair.

Error detection, correction, and media management on a dram device

Error detection, correction, and media management on a memory device

Disclosed in some examples are methods, systems, and devices for authenticating a firmware object on a device and in some examples to safeguard the attestation process from the execution of malicious firmware. In some examples, a firmware update process may, in addition to updating the firmware on the device, write a hash of the authentic firmware code in a secure storage device (e.g., a register). This may be done in some examples in a protected environment (e.g., a trusted execution environment or a protected firmware update process). Upon first boot after the update, a firmware update checker compares the firmware object that is booted with the value of the secure storage device. If the values match, the alias certificate may be regenerated, and the boot continues. If the values do not match, then the alias certificate may not be regenerated, and the system may have an authenticity failure because the key and the certificate do not match.

Firmware authenticity check

In a compute express link (CXL) memory controller system, a system and method to identify memory errors which may require soft package repair or hard package repair to rows of DRAM memory. When data is written to a row of DRAM, the data is immediately and automatically read back and scanned for bit errors. If bit errors are identified, steps are taken to determine if the memory location requires no repair, soft repair, or hard repair. The data is corrected and written back to a new memory location which is memory-mapped to the original location, thus effecting the soft- or hard-repair. The present system and method does not repair the entire row of memory, but only repairs the specific die(s) that exhibit memory error in the row.

Selective per die DRAM PPR for memory device

Methods, systems, and devices related to built-in self-test (BIST) circuitry of a controller. The controller can be coupled to multiple memory devices. The BIST circuitry can include registers configured to store burst patterns. The BIST circuitry can perform a BIST operation on the memory devices contemporaneously and using the number of burst patterns.

Built-in self-test circuitry

In some implementations, a system includes a set of servers configured to establish a set of virtual machines to provide a computing environment; a set of compute express link (CXL) interface components configured to communicate with the set of servers via a set of CXL interconnects; and a controller configured to at least one of: encrypt protocol data against a CXL interposer security threat associated with the set of CXL interconnects or a malicious extension security threat, provide a secure handshake verification of an identity of the set of CXL interface components, enforce a chain of trust rooted in hardware of the set of CXL interface components; restrict access to an area of memory of the set of CXL interface components that stores security data for verified or secured processes; or perform a security check and set up a set of security features of the set of CXL interface components.

Classification and mitigation of compute express link security threats

Methods, systems, and devices related to built-in self-test burst patterns based on architecture of memory. A controller can be coupled to a memory device. The controller can include built-in self-test (BIST) circuitry. The BIST circuitry can include registers configured to store respective write burst patterns and read burst patterns based on an architecture of the memory device.

Built-in self-test burst patterns based on architecture of memory

A processing device of a memory sub-system can monitor a plurality of received commands to identify a forced unit access command. The processing device can identify a metadata area of the memory device based on the forced unit access command. The processing device can also perform an action responsive to identifying a subsequent forced unit access command to the metadata area.

Storage traffic pattern detection in memory devices

A channel width can depend on a quantity of memory units (e.g., memory dice) that forms a channel as well as a size of the memory units. A memory system can operate with memory units configured to exchange (e.g., transfer to and/or from) data at a rate of smaller granularity that can provide more various options for channel widths, which can further allow a fine-tuned optimization of the memory system in association with its bandwidth and latency in transferring data from and/or to the memory units. The channels whose channel width is fine-tuned with such memory units can be further used to provide a reliability, availability, and serviceability (RAS) protection, such as a redundant array of independent disks (RAID) protection.

Apparatus for redundant array of independent disks

Methods, systems, and devices for detecting page fault traffic are described. A memory device may execute a self-learning algorithm to determine a priority size for read requests, such as a maximum readahead window size or other size related to page faults in a memory system. The memory device may determine the priority size based at least in part on by tracking how many read requests are received for different sizes of sets of data. Once the priority size is determined, the memory device may detect subsequent read requests for sets of data having the priority size, and the memory device may prioritize or other optimize the execution of such read requests.

Detecting page fault traffic

Systems and methods for finite time counting period counting of infinite data streams is presented. In particular example systems and methods enable counting row accesses to a memory media device over predetermined time intervals in order to deterministically detect row hammer attacks on the memory media device. Example embodiments use two identical tables that are reset at times offset in relation to each other in a ping-pong manner in order to ensure that there exists no false negative detections. The counting techniques described in this disclosure can be used in various types of row hammer mitigation techniques and can be implemented in content addressable memory or another type of memory. The mitigation may be implemented on a per-bank basis, per-channel basis or per-memory media device basis. The memory media device may be a dynamic random access memory type device.

Finite time counting period counting of infinite data streams

Growing community of inventors

Buonalbergo, Italy

Danilo Caraccio