System, apparatus and method for performing secure memory training and management in a trusted environment
View Patent ↗In one embodiment, a system includes: a processor; a security processor to execute in a trusted executed environment (TEE), the security processor to execute memory reference code (MRC) stored in a secure storage of the TEE to train a memory coupled to the processor; and the memory coupled to the processor. Other embodiments are described and claimed.
1. A system comprising:
at least one hardware processor core to execute instructions; and
a microcontroller in circuit with the at least one hardware processor core, the microcontroller to execute a security engine in a trusted execution environment to, in response to a hot plug insert of a first memory, train the first memory transparently to an operating system (OS), the security engine including a memory reference code (MRC), the MRC stored in an internal memory, the security engine to:
in response to the hot plug insert of the first memory, execute the MRC to perform, transparently to the OS, the training of the first memory while the at least one hardware processor core performs a workload orthogonal to the training;
securely communicate a memory error to a remote entity via an out-of-band channel; and
dynamically update the MRC stored in the internal memory based on an MRC update obtained from the remote entity via the out-of-band channel; and
a platform driver to receive a communication from a basic input/output system (BIOS) indicating the detection of the hot plug insert, the platform driver to issue a request to the security engine to perform the training of the memory.
2. The system of claim 1 , further comprising the BIOS, the BIOS to execute on the at least one hardware processor core.
3. The system of claim 2 , wherein the security engine is to alert the platform driver regarding a result of the training.
4. The system of claim 2 , wherein the security engine is to update a memory controller with configuration information of the hot plug inserted memory.
5. The system of claim 1 , wherein the security engine is to, responsive to execution of the dynamically updated MRC, update at least one configuration parameter of the first memory to reduce an exploit scenario.
6. At least one non-transitory computer readable storage medium comprising instructions that when executed by one or more microcontrollers implementing a security engine in a trusted execution environment (TEE), cause the one or more microcontrollers to at least:
obtain, from a platform driver, receive, in a trusted execution environment (TEE), a request to perform training of a memory of the computing system, the request initiated by a basic input/output system (BIOS) of a computing system in response to detection of a hot plug insert of the memory;
perform the training of the memory transparently to the BIOS via the TEE based on memory reference code (MRC) stored in an internal memory of the TEE;
report a result of the training to the platform driver that executes on at least one hardware processor core of the computing system, wherein the at least one hardware processor core is to execute at least one workload during the training, the workload being orthogonal to the training;
securely communicate, from the TEE, a memory error to an external entity via an out-of-band channel;
receive, in the TEE, update information for the training code from the external entity via the out-of-band channel; and
dynamically update the training code in the internal memory of the TEE based on the received update information.
7. The at least one non-transitory computer readable storage medium of claim 6 , wherein the request to perform the training is from the platform driver, responsive to the platform driver receiving an indication of a hot plug insert from the BIOS.
8. The at least one non-transitory computer readable storage medium of claim 6 , wherein the update information includes updated configuration parameter information to mitigate an exploit scenario.
9. The at least one non-transitory computer readable storage medium of claim 8 , wherein the update information is based on crowd-sourced data.
10. The at least one non-transitory computer readable storage medium of claim 8 , wherein the update information includes refresh rate information.
11. A system comprising:
a hardware processor;
a microcontroller implementing a security engine, the security engine responsive to a communication from platform driver initiated by a basic input/output system (BIOS), the communication indicating detection of a hot plug insert of a memory, the security engine to:
execute memory reference code (MRC) in a trusted execution environment (TEE) transparently to the BIOS to train the memory, the MRC stored in a secure storage of the TEE;
communicate a memory error to a remote entity via an out-of-band channel;
obtain one or more MRC patch updates from the remote entity via the out-of-band channel; and
update the MRC based on the one or more MRC patch updates;
wherein the hardware processor includes at least one hardware processor core to execute an orthogonal workload while the security engine executes the MRC to train the memory.
12. The system of claim 11 , further comprising a network interface to communicate with the remote entity.
13. The system of claim 12 , wherein the security engine is to execute, responsive to a next request to train the memory, the MRC updated with the one or more MRC patch updates.
14. The system of claim 11 , further comprising a network interface to communicate with a malware remediation agent, the security engine to: (i) execute malware detection code; (ii) communicate with the malware remediation agent via an out-of-band channel; (iii) receive one or more malware detection code patch updates via the out-of-band channel; and (iv) store the one or more malware detection code patch updates in the secure storage.