System and method for secure movement of trusted memory regions across NUMA nodes
An information handling system includes a first memory having a trusted memory region, wherein the trusted memory region is an area of execution that is protected from processes running in the information handling system outside the trusted memory region. A secure cryptographic module may receive a request to create the trusted memory region from a dependent application, and create a mapping of the trusted memory region along with an enhanced page cache address range mapped to a non-uniform memory access (NUMA) node. The module may also detect a NUMA migration event of the dependent application, identify the trusted memory region corresponding to the NUMA migration event, and migrate the trusted memory region from the NUMA node to another NUMA node.
1. A method comprising:
receiving, by a processor, a request to create a trusted memory region from a dependent application;
creating a mapping of the trusted memory region along with an enhanced page cache address range mapped to a non-uniform memory access (NUMA) node;
detecting a NUMA migration event of the dependent application; and
subsequent to the detecting the NUMA migration event, identifying the trusted memory region corresponding to the NUMA migration event, and migrating the trusted memory region from the NUMA node to another NUMA node that includes:
in response to determining that the trusted memory region and the NUMA node are not located in same NUMA node, encrypting a page in the trusted memory region and writing the page in an unprotected memory region; and
moving content of the trusted memory region from the NUMA node to the unprotected memory region in the another NUMA node.
2. The method of claim 1 , wherein the trusted memory region is a protected area of execution.
3. The method of claim 1 , further comprising fetching page cache regions associated with the trusted memory region.
4. The method of claim 1 , wherein the migrating of the trusted memory region is based on a trusted memory region identifier.
5. The method of claim 1 , further comprising determining whether the NUMA node mapped to the trusted memory region and the another NUMA node mapped to the dependent application are same.
6. The method of claim 1 , further comprising invoking Intel software guard extensions workflow.
7. The method of claim 6 , further comprising creating a cryptographic message authentication code of the page and storing the cryptographic message authentication code in the unprotected memory region.
8. An information handling system, comprising:
a first memory including a trusted memory region, wherein the trusted memory region is an area of execution that is protected from processes running in the information handling system outside the trusted memory region; and
a secure processor configured to:
receive a request to create the trusted memory region from a dependent application;
create a mapping of the trusted memory region along with an enhanced page cache address range mapped to a non-uniform memory access (NUMA) node;
detect a NUMA migration event of the dependent application; and
subsequent to detection of the NUMA migration event, identify the trusted memory region corresponding to the NUMA migration event, and migrate the trusted memory region from the NUMA node to another NUMA node that includes:
in response to determining that the trusted memory region and the NUMA node are not located in same NUMA node, encrypting a page in the trusted memory region and writing the page in an unprotected memory region; and
moving content of the trusted memory region from the NUMA node to the unprotected memory region in the another NUMA node.
9. The information handling system of claim 8 , wherein the secure processor includes Intel software guard extensions instructions.
10. The information handling system of claim 8 , wherein the secure processor is further configured to interface with BIOS to get an address range of the trusted memory region.
11. The information handling system of claim 8 , wherein the secure processor is further configured to create the trusted memory region in the NUMA node.
12. The information handling system of claim 8 , wherein the secure processor is further configured to use an ECREATE command that includes an API attribute identifying the NUMA node.
13. A non-transitory computer-readable medium including code that when executed performs a method, the method comprising:
receiving a request to create a trusted memory region from a dependent application;
creating a mapping of the trusted memory region along with an enhanced page cache address range mapped to a non-uniform memory access (NUMA) node;
detecting a NUMA migration event of the dependent application; and
subsequent to the detecting the NUMA migration event, identifying the trusted memory region corresponding to the NUMA migration event, and migrating the trusted memory region from the NUMA node to another NUMA node that includes:
in response to determining that the trusted memory region and the NUMA node are not located in same NUMA node, encrypting a page in the trusted memory region and writing the page in an unprotected memory region; and
moving content of the trusted memory region from the NUMA node to the unprotected memory region in the another NUMA node.
14. The non-transitory computer-readable medium of claim 13 , wherein the trusted memory region is a protected area of execution.
15. The non-transitory computer-readable medium of claim 13 , wherein the method further comprising fetching associated page cache regions.
16. The non-transitory computer-readable medium of claim 13 , wherein the migrating the trusted memory region is based on a trusted memory region identifier.
17. The non-transitory computer-readable medium of claim 13 , wherein the method further comprising determining whether the NUMA node mapped to the trusted memory region and the another NUMA node mapped to the dependent application are same.
18. The non-transitory computer-readable medium of claim 13 , wherein the method further comprising creating a cryptographic message authentication code of a memory page and storing the cryptographic message authentication code in the unprotected memory region.