Enhanced security for accessing virtual memory
A disclosed method includes obtaining a physical address corresponding to a virtual address responsive to detecting a virtual address associated with a memory access instruction and, responsive to identifying a memory page associated with the physical address as a sensitive memory page, evaluating sensitive access information associated with the memory page. If the sensitive access information satisfies a sensitive access criteria, invoking a sensitive access handler to control execution of the memory access instruction.
1. A processor comprising:
a core to execute instructions; and
a memory management unit coupled to the core to cause a handler to control execution of a memory access instruction responsive to determination that a physical address corresponding to a virtual address in the memory access instruction is associated with a memory page having a first indicator to indicate that the memory page includes particular information and a second indicator to indicate that a recency of a most recent access of the memory page exceeds a threshold recency.
2. The processor of claim 1 , wherein the first indicator is to be asserted under control of an access policy stored in storage.
3. The processor of claim 1 , further comprising a translation lookaside buffer having a plurality of entries each to store address translation information and access control information.
4. The processor of claim 3 , wherein the access control information includes the first indicator and the second indicator.
5. The processor of claim 1 , wherein the handler is to verify an execution environment before the memory access instruction is permitted to access the memory page.
6. The processor of claim 1 , wherein the handler is to validate an integrity of the memory page before the memory access instruction is permitted to access the memory page.
7. The processor of claim 1 , wherein the memory management unit is to permit a subsequent memory access instruction to access the memory page without the handler if the subsequent memory access instruction is received within the threshold recency of the memory access instruction.
8. The processor of claim 1 , wherein the particular information comprises sensitive information, wherein the sensitive information comprises one or more of privacy information and security information.
9. The processor of claim 1 , wherein the core is to set the first indicator responsive to a first instruction.
10. A system comprising:
a processor including a memory management unit to invoke a handler to control execution of a memory access instruction responsive to determination that a physical address associated with the memory access instruction is associated with a memory page having a first indicator to indicate that the memory page includes particular information and a second indicator to indicate that a recency of a most recent access of the memory page exceeds a threshold recency;
a touchscreen controller to communicate with a touchscreen display; and
a memory coupled to the processor.
11. The system of claim 10 , wherein the handler is to evaluate execution environment characteristics to determine whether to permit access to the memory page.
12. The system of claim 11 , wherein the execution environment characteristics include characteristics indicative of one or more of an application program that initiated the access to the memory page, an identity of a user device that initiated the access to the memory page, and a network and protocol associated with the user device.
13. A non-transitory machine-readable medium having stored thereon instructions, which cause at least one machine to perform a method comprising:
obtaining a physical address corresponding to a virtual address associated with a memory access instruction;
determining a state of an enable indicator associated with the memory page; and
if the enable indicator is of a first state, determining if a second indicator associated with the memory page is of a second state, and if not, invoking a handler to control execution of the memory access instruction, including evaluating execution environment characteristics to determine whether to allow the memory access instruction to access the memory page.
14. The non-transitory machine-readable medium of claim 13 , wherein the method further comprises executing the memory access instruction without involving the handler if a most recent access of the memory page occurred less recently than a threshold recency.
15. The non-transitory machine-readable medium of claim 13 , wherein the method further comprises setting the second indicator associated with the memory page to the second state to indicate a recency of a most recent access to the memory page relative to a specified grace period.
16. The non-transitory machine-readable medium of claim 15 , wherein the method further comprises setting the second indicator to the first state after the specified grace period.
17. The non-transitory machine-readable medium of claim 16 , wherein the method further comprises setting the second indicator associated with the memory page to the second state responsive to execution of the handler.
18. The non-transitory machine-readable medium of claim 13 , wherein the method further comprises setting the enable indicator to the first state based on an information characteristic of the memory page, wherein the information characteristic is indicative of a characteristic of information stored on the memory page.
19. The non-transitory machine-readable medium of claim 18 , wherein the information characteristic indicates that information stored on the memory page includes one or more of personally identifying information, personal financial information, and protection level information.
20. The non-transitory machine-readable medium of claim 18 , wherein the information characteristic indicates that information stored on the memory page is to access one or more of network configuration information and execution context information.