Address pinning

1. A method comprising:

loading a software module into a sandbox environment;

receiving, a message from the software module to a recipient, the message includes a memory address;

determining whether to pin the memory address, where pinning comprises limiting the memory address to a subset of all memory address values; and

passing the message to an address pinning unit which replaces at least a portion of the memory address with at least a portion of a specified replacement address, when it is determined to pin the memory address, and passes the modified message to be delivered to the recipient.

2. The method of claim 1 , wherein determining whether to pin the memory address comprises determining that the message comprises an indirect control flow change.

3. The method of claim 1 , wherein determining whether to pin the memory address comprises determining that the message comprises a data access message.

4. The method of claim 1 , the method further comprising:

before receiving the message from the software module:

receiving process control from the software module,

disabling, responsive to receiving process control, address pinning, and

passing, responsive to disabling the address pinning unit, the message to the recipient; and

after the modified message is delivered to the recipient:

enabling the address pinning, and

passing, responsive to enabling the address pinning, process control to the software module.

5. The method of claim 1 , wherein the method further comprises:

determining that the address pinning is enabled, wherein when the address pinning is enabled the address pinning replaces at least a portion of the memory address with at least a portion of a specified replacement address.

6. The method of claim 1 , wherein loading the software module into the sandbox environment comprises:

examining the software module to determine whether the software module includes instructions to configure the address pinning; and

rejecting the second software module if the software module is determined to include instructions to configure the address pinning.

7. The method of claim 1 , wherein the software module and the sandbox environment run at the same permission level.

8. A method comprising:

loading a software module into a sandbox environment;

determining whether to pin a memory address of a message, where pinning comprises limiting the memory address to a subset of all memory address values;

receiving, by a hardware-based address pinning unit, the message from the software module to a recipient, the message includes a memory address;

replacing, by the address pinning unit when it is determined to pin the memory address, at least a portion of the memory address with at least a portion of a pre-determined replacement address; and

passing, by the address pinning unit, the modified message to be delivered to the recipient.

9. The method of claim 8 , wherein determining whether to pin the memory address comprises determining that the message comprises an indirect control flow change.

10. The method of claim 8 , wherein determining whether to pin the memory address comprises determining that the message comprises a data access message.

11. The method of claim 8 , further comprising, prior to the address pinning unit receiving the message from the software module:

receiving, at the sandbox environment, process control from the software module;

disabling, responsive to receiving process control, the address pinning unit; and

passing, responsive to disabling the address pinning unit, the message to the address pinning unit; and

further comprising, after the modified message is delivered to the recipient:

enabling the address pinning unit; and

passing, responsive to enabling the address pinning unit, process control to the software module.

12. The method of claim 8 , wherein the address pinning unit has a first register for specifying m number of high-order bits to be affected, a second register for specifying n number of low-order bits to be affected, and a third register containing replacement bits.

13. The method of claim 12 , wherein replacing at least a portion of the memory address with at least a portion of a specified replacement address comprises:

replacing the m highest-order bits of the memory address with the m highest-order replacement bits; and

replacing the n lowest-order bits of the memory address with the n lowest-order replacement bits.

14. The method of claim 8 , wherein the method further comprises:

determining, by the address pinning unit, that the address pinning unit is enabled; and

wherein the address pinning unit replaces at least a portion of the memory address with at least a portion of a specified replacement address in response to determining that the address pinning unit is enabled.

15. The method of claim 8 , wherein loading the software module into the sandbox environment comprises:

examining the software module to determine whether the software module includes instructions to configure the address pinning unit; and

rejecting the second software module if it is determined to include instructions to configure the address pinning unit.

16. The method of claim 8 , wherein the software module and the sandbox environment run at the same permission level.

17. The method of claim 8 , wherein the address pinning unit is a sub-component of a hardware processor.

18. The method of claim 8 , wherein the address pinning unit is designated for data messages and the message from the software module is configured to access data at the memory address; and

wherein the method further comprises:

receiving, by a second hardware-based address pinning unit, a second message from the software module to a second recipient, the message includes a request to pass control to instructions at a second memory address;

replacing, by the second address pinning unit, at least a portion of the second memory address with at least a portion of a second specified replacement address; and

passing, by the address pinning unit, the modified second message to be delivered to the second recipient.

19. A system comprising:

a computer configured to perform operations comprising:

loading a software module into a sandbox environment;

receiving, a message from the software module to a recipient, the message includes a memory address;

determining whether to pin the memory address, where pinning comprises limiting the memory address to a subset of all memory address values; and

passing the message to an address pinning unit which replaces at least a portion of the memory address with at least a portion of a specified replacement address, when it is determined to pin the memory address, and passes the modified message to be delivered to the recipient.