System and method of utilizing memory medium fault resiliency with secure memory medium portions
In one or more embodiments, one or more systems, one or more methods, and/or one or more processes may receive a request for a secure memory region with fault resiliency from first processor instructions being executed at a first processor privilege level; allocate a first enclave, in which the first enclave protects at least one of second processor instructions and data from being read by and from being altered by third processor instructions executing at a second processor privilege level; allocate a second enclave, in which the second enclave protects the at least one of the second processor instructions and the data from being read by and from being altered by the second processor instructions; store the at least one of the second processor instructions and the data in the first enclave; and mirror the at least one of the second processor instructions and the data in the second enclave.
1. An information handling system, comprising:
at least one processor;
one or more non-uniform memory access nodes; and
a memory medium, coupled to the at least one processor, that stores instructions executable by the at least one processor, which when executed by the at least one processor, cause the information handling system to:
receive a request for a secure memory region from first processor instructions being executed by the at least one processor at a first processor privilege level, wherein the request for the secure memory region further comprises an enclave fault resiliency (EFR) attribute;
provide, by an operating system driver, the request for the secure memory to information handling system firmware, which is compliant with at least one of a Unified Extensible Firmware Interface (UEFI) and an Advanced Configuration and Power Interface (ACPI), via a management information exchange;
determine, based on the EFR attribute, if the request for the secure memory region further comprises a request for fault resiliency;
determine, from the one or more non-uniform memory access nodes, if a plurality of non-uniform memory access nodes exist;
if the plurality of non-uniform memory access nodes do not exist:
allocate, via the operating system driver and the information handling system firmware, a first enclave via a first volatile memory medium associated with a first non-uniform memory access node that includes the first volatile memory medium, wherein the first enclave protects at least one of second processor instructions and data from being read by and from being altered by third processor instructions executing at a second processor privilege level, higher than the first processor privilege level; and
if the request for the secure memory region further comprises a request for fault resiliency, allocate, via the operating system driver and the information handling system firmware, a second enclave via the first volatile memory medium, wherein the second enclave protects the at least one of the second processor instructions and the data from being read by and from being altered by the third processor instructions executing at the second processor privilege level;
if the plurality of non-uniform memory access nodes exist:
allocate, via the operating system driver and the information handling system firmware, the first enclave via the first volatile memory medium associated with the first non-uniform memory access node that includes the first volatile memory medium; and
if the request for the secure memory region further comprises a request for fault resiliency, allocate, via the operating system driver and the information handling system firmware, the second enclave via a second volatile memory medium associated with a second non-uniform memory access node that includes the second volatile memory medium;
encrypt, by hardware-based encryption, the at least one of the second processor instructions and the data via an encryption key that is stored by the information handling system, external to the first enclave and not accessed by the third processor instructions executing at any processor privilege level, wherein if the request for the secure memory region further comprises a request for fault resiliency, the encryption key is stored external to the first enclave and external to the second enclave;
store the at least one of the second processor instructions and the data, as encrypted by the encryption key, in the first enclave; and
if the request for the secure memory region further comprises a request for fault resiliency, mirror the at least one of the second processor instructions and the data, as encrypted by the encryption key, in the second enclave.
2. The information handling system of claim 1 , wherein the instructions further cause the information handling system to:
determine that additional data is stored in the first enclave; and
in response to determining that the additional data is stored in the first enclave, mirror the additional data in the second enclave.
3. The information handling system of claim 1 , wherein if the request for the secure memory region further comprises a request for fault resiliency, the instructions further cause the information handling system to:
determine that a fault occurred with at least one of the first memory medium and the first enclave;
determine that access of the at least one of the second processor instructions and the data has been requested; and
provide at least a portion of the at least one of the second processor instructions and the data from the second enclave.
4. The information handling system of claim 1 , wherein the third processor instructions executing at the second processor privilege level include at least one of a virtual machine and an operating system virtualization instance.
5. The information handling system of claim 1 , wherein the instructions further cause the information handling system to:
disable one or more advanced reliability and security (ADV RAS) features if the request for the secure memory region further comprises a request for fault resiliency.
6. The information handling system of claim 1 ,
wherein, to receive the request for the secure memory region from the first processor instructions, further cause the information handling system to receive, by an operating system enclave driver, the request for the secure memory region;
wherein the operating system driver is the operating system enclave driver; and
wherein, to provide, by the operating system driver, the request for the secure memory region to the information handling system firmware via the management information exchange, the instructions further cause the information handling system to provide, by the operating system enclave driver, the request for the secure memory region to the information handling system firmware via the management information exchange.
7. The information handling system of claim 1 , wherein the instructions further cause the information handling system to:
create, by an operating system enclave driver, a data structure configured to store a list of enclaves that have been requested for redundancy;
receive, by the operating system enclave driver, a request for additional storage space for the secure memory region;
extend, by the operating system enclave driver, the first enclave to include the additional storage space for the secure memory region;
extend, by the operating system enclave driver, the second enclave to include the additional storage space for the secure memory region; and
modify, by the operating system enclave driver, the data structure to include an indication of the additional storage space for the secure memory region.
8. A method, comprising:
receiving a request for a secure memory region from first processor instructions being executed by a processor of an information handling system, which includes one or more non-uniform memory access nodes, at a first processor privilege level, wherein the request for the secure memory region further comprises an enclave fault resiliency (EFR) attribute;
providing, by an operating system driver, the request for the secure memory region to information handling system firmware, which is compliant with at least one of a Unified Extensible Firmware Interface (UEFI) and an Advanced Configuration and Power Interface (ACPI), via a management information exchange;
determining, based on the EFR attribute, that the request for the secure memory region further comprises a request for fault resiliency;
determining, from the one or more non-uniform memory access nodes, that a plurality of non-uniform memory access nodes do not exist;
allocating, via the information handling system firmware, a first enclave via a first volatile memory medium associated with a first non-uniform memory access node that includes the first volatile memory medium, wherein the first enclave protects at least one of second processor instructions and data from being read by and from being altered by third processor instructions executing at a second processor privilege level, higher than the first processor privilege level;
in response to the request for the secure memory region further comprising a request for fault resiliency, allocating, via the information handling system firmware, a second enclave via the first volatile memory medium, wherein the second enclave protects the at least one of the second processor instructions and the data from being read by and from being altered by the third processor instructions executing at the second processor privilege level;
encrypting, by hardware-based encryption, the at least one of the second processor instructions and the data via an encryption key that is stored by the information handling system, external to the first enclave and not accessed by the third processor instructions executing at any processor privilege level, wherein in response to the request for the secure memory region further comprising a request for fault resiliency, the encryption key is stored external to the first enclave and external to the second enclave;
storing the at least one of the second processor instructions and the data, as encrypted by the encryption key, in the first enclave; and
in response to the request for the secure memory region further comprising a request for fault resiliency, mirroring the at least one of the second processor instructions and the data, as encrypted by the encryption key, in the second enclave.
9. The method of claim 8 , further comprising:
determining that additional data is stored in the first enclave; and
in response to the determining that the additional data is stored in the first enclave, mirroring the additional data in the second enclave.
10. The method of claim 8 , further comprising, in response to the request for the secure memory region further comprising a request for fault resiliency:
determining that a fault occurred with at least one of the first memory medium and the first enclave;
determining that access of the at least one of the second processor instructions and the data has been requested; and
providing at least a portion of the at least one of the second processor instructions and the data from the second enclave.
11. The method of claim 8 , wherein the third processor instructions executing at the second processor privilege level include at least one of a virtual machine and an operating system virtualization instance.
12. The method of claim 8 , further comprising:
disabling one or more advanced reliability and security (ADV RAS) features in response to the request for the secure memory region further comprising a request for fault resiliency.
13. The method of claim 8 ,
wherein the receiving the request for the secure memory region from the first processor instructions includes an operating system enclave driver receiving the request for the secure memory region from the first processor instructions;
wherein the operating system driver is the operating system enclave driver; and
wherein the providing, by the operating system driver, the request for the secure memory region to information handling system firmware via the management information exchange includes providing, by the operating system enclave driver, the request for the secure memory region to information handling system firmware via the management information exchange.
14. The method of claim 8 , further comprising:
creating, by an operating system enclave driver, a data structure configured to store a list of enclaves that have been requested for redundancy;
receiving, by the operating system enclave driver, a request for additional storage space for the secure memory region;
extending, by the operating system enclave driver, the first enclave to include the additional storage space for the secure memory region;
extending, by the operating system enclave driver, the second enclave to include the additional storage space for the secure memory region; and
modifying, by the operating system enclave driver, the data structure to include an indication of the additional storage space for the secure memory region.
15. A computer-readable non-transitory memory medium that includes instructions that, when executed by at least one processor of an information handling system, cause the information handling system to:
receive a request for a secure memory region from first processor instructions being executed by the at least one processor at a first processor privilege level, wherein the request for the secure memory region further comprises an enclave fault resiliency (EFR) attribute;
provide the request for the secure memory region to information handling system firmware, which is compliant with at least one of a Unified Extensible Firmware Interface (UEFI) and an Advanced Configuration and Power Interface (ACPI), via a management information exchange;
determining, based on the EFR attribute, if the request for the secure memory region further comprises a request for fault resiliency;
determine, from the one or more non-uniform memory access nodes, if a plurality of non-uniform memory access nodes exist;
if the plurality of non-uniform memory access nodes do not exist:
allocate, via the information handling system firmware, a first enclave via a first volatile memory medium associated with a first non-uniform memory access node that includes the first volatile memory medium, wherein the first enclave protects at least one of second processor instructions and data from being read by and from being altered by third processor instructions executing at a second processor privilege level, higher than the first processor privilege level; and
if the request for the secure memory region further comprises a request for fault resiliency, allocate, via the information handling system firmware, a second enclave via the first volatile memory medium, wherein the second enclave protects the at least one of the second processor instructions and the data from being read by and from being altered by the third processor instructions executing at the second processor privilege level;
if the plurality of non-uniform memory access nodes exist:
allocate, via the information handling system firmware, the first enclave via the first volatile memory medium associated with the first non-uniform memory access node that includes the first volatile memory medium; and
if the request for the secure memory region further comprises a request for fault resiliency, allocate, via the information handling system firmware, the second enclave via a second volatile memory medium associated with a second non-uniform memory access node that includes the second volatile memory medium;
encrypt, by hardware-based encryption, the at least one of the second processor instructions and the data via an encryption key that is stored by the information handling system, external to the first enclave and not accessed by the third processor instructions executing at any processor privilege level, wherein if the request for the secure memory region further comprises a request for fault resiliency, the encryption key is stored external to the first enclave and external to the second enclave;
store the at least one of the second processor instructions and the data, as encrypted by the encryption key, in the first enclave; and
if the request for the secure memory region further comprises a request for fault resiliency, mirror the at least one of the second processor instructions and the data, as encrypted by the encryption key, in the second enclave.
16. The computer-readable non-transitory memory medium of claim 15 , wherein the instructions further cause the information handling system to:
determine that additional data is stored in the first enclave; and
in response to determining that the additional data is stored in the first enclave, mirror the additional data in the second enclave.
17. The computer-readable non-transitory memory medium of claim 15 , wherein if the request for the secure memory region further comprises a request for fault resiliency, the instructions further cause the information handling system to:
determine that a fault occurred with at least one of the first memory medium and the first enclave;
determine that access of the at least one of the second processor instructions and the data has been requested; and
provide at least a portion of the at least one of the second processor instructions and the data from the second enclave.
18. The computer-readable non-transitory memory medium of claim 15 , wherein the third processor instructions executing at the second processor privilege level include at least one of a virtual machine and an operating system virtualization instance.
19. The computer-readable non-transitory memory medium of claim 15 , wherein the instructions further cause the information handling system to
disable one or more advanced reliability and security (ADV RAS) features if the request for the secure memory region further comprises a request for fault resiliency.
20. The computer-readable non-transitory memory medium of claim 15 , wherein the instructions further cause the information handling system to:
create, by an operating system enclave driver, a data structure configured to store a list of enclaves that have been requested for redundancy;
receive, by the operating system enclave driver, a request for additional storage space for the secure memory region;
extend, by the operating system enclave driver, the first enclave to include the additional storage space for the secure memory region;
extend, by the operating system enclave driver, the second enclave to include the additional storage space for the secure memory region; and
modify, by the operating system enclave driver, the data structure to include an indication of the additional storage space for the secure memory region.