Determining integrity-driven error types in memory buffer devices

1 . A memory buffer device comprising:

an error correction code (ECC) block to detect and correct errors in cache lines read from a dynamic random access memory (DRAM) device; and

an in-line memory encryption (IME) block to generate a message authentication code (MAC) for each cache line to provide cryptographic integrity for accesses to the respective cache line; and

security logic coupled to the ECC block and the IME block, wherein the security logic is to:

track historical ECC corrected errors at cache line granularity;

detect an error, uncorrected by the ECC block, in a cache line using a MAC of the cache line;

differentiate the error as caused by i) a MAC verification failure caused by an ECC escape or ii) an attack on the cache line, by analyzing at least one of historical MAC verification failures or the historical ECC corrected errors overtime; and

perform an action responsive to the error as caused by the attack, wherein the security logic, responsive to the error being detected, is to:

write a pattern to the cache line; and

read the pattern from the cache line to test the cache line, wherein a match between the read pattern and the written pattern indicates that the error is caused by the attack.

2 . The memory buffer device of claim 1 , wherein the security logic is to migrate the cache line from a first physical location to a second physical location for subsequent monitoring.

3 . The memory buffer device of claim 2 , wherein migration of the cache line from the first physical location to the second physical location does not change an address used by a connected host.

4 . The memory buffer device of claim 1 , wherein the security logic is to rearrange cache lines of the DRAM device for subsequent monitoring.

5 . The memory buffer device of claim 1 , further comprising a data structure associated with the security logic, wherein the data structure is to store information about the at least one of the historical MAC verification failures or the historical ECC corrected errors over time.

6 . The memory buffer device of claim 5 , wherein the information identifies an address of the cache line, a timestamp of the error, and an error type.

7 . The memory buffer device of claim 5 , wherein the data structure is a first-in-first-out (FIFO) buffer to store a last N number of the historical MAC verification failures, where N is a positive integer greater than zero, and wherein the security logic is to query the FIFO buffer responsive to the error being detected in the cache line.

8 . The memory buffer device of claim 5 , wherein the data structure is to store the information at a cache line granularity or a page granularity.

9 . The memory buffer device of claim 1 , wherein the security logic is to:

write first data to the cache line, wherein the first data is a known pattern;

read second data from the cache line;

determine whether the second data and the first data match; and

determine the error as having been caused by the attack on the cache line responsive to the first data and the second data matching.

10 . The memory buffer device of claim 1 , further comprising a data structure to track a number of corrections to the cache line.

11 . The memory buffer device of claim 1 , wherein the security logic is to track a number of corrections to the cache line as a value in the cache line.

12 . The memory buffer device of claim 1 , further comprising:

a Compute Express Link (CXL) controller coupled to the IME block and one or more hosts or a fabric manager;

a memory controller coupled to the ECC block and the DRAM device; and

a management processor coupled to the CXL controller.

13 . A memory buffer device comprising:

an in-line memory encryption (IME) circuit to detect an error in a message authentication code (MAC) associated with data stored in volatile memory coupled to the memory buffer device; and

security logic coupled to the IME circuit, wherein the security logic is to:

track information about historical MAC verification failures and historical ECC corrected errors at cache line granularity; and

differentiate the error between a first type of error caused by an attack on the volatile memory and a second type of error caused by an uncorrected error, wherein the security logic, responsive to the error being detected, is to:

write a pattern to a cache line associated with the error; and read the pattern from the cache line to test the cache line, wherein a match between the read pattern and the written pattern indicates that the error is caused by the attack.

14 . The memory buffer device of claim 13 , further comprising:

an error correction code (ECC) circuit coupled to the IME circuit, the ECC circuit to detect up to a first specified number of errors in the data and correct up to a second specified number of errors in the data using ECC information stored in connection with the data;

a memory controller coupled to the ECC circuit and the volatile memory;

a controller coupled to the IME circuit and one or more hosts or a fabric manager, the controller to support a remote memory protocol; and

a management processor coupled to the controller.

15 . The memory buffer device of claim 14 , further comprising a System on Chip (SoC) comprising the IME circuit, the ECC circuit, the memory controller, the controller, and the management processor.

16 . A memory module that supports a remote memory protocol, the memory module comprising:

one or more volatile memory devices;

an encryption circuit to generate a message authentication code (MAC) to be stored with each cache line and verify the MAC when accessing the respective cache line;

an error correction code (ECC) circuit to generate ECC information to be stored with each cache line, wherein the ECC circuit is to detect up to a first specified number of errors in a cache line and correct up to a second specified number of errors in the cache line using the ECC information; and

security logic coupled to the encryption circuit and the ECC circuit, wherein the security logic is to:

track historical ECC corrected errors at cache line granularity;

detect an error, uncorrected by the ECC circuit, in a first cache line using a first MAC of the first cache line;

determine whether the error is caused by an attack on the first cache line or a MAC verification failure caused by an ECC escape; and

perform an action responsive to the error being caused by the attack, wherein the security logic, responsive to the error being detected, is to:

write a pattern to the first cache line; and

read the pattern from the first cache line to test the first cache line, wherein a match between the read pattern and the written pattern indicates that the error is caused by the attack.

17 . The memory module of claim 16 , further comprising:

a memory controller coupled to the ECC circuit and the one or more volatile memory devices; and

a controller coupled to the encryption circuit and one or more hosts.

18 . The memory module of claim 16 , further comprising:

a memory controller coupled to the ECC circuit and the one or more volatile memory devices;

a controller coupled to the encryption circuit; and

a management processor coupled to the controller and a fabric manager.