Hardware verification of dynamically generated code
In an embodiment, dynamically-generated code may be supported in the system by ensuring that the code either remains executing within a predefined region of memory or exits to one of a set of valid exit addresses. Software embodiments are described in which the dynamically-generated code is scanned prior to permitting execution of the dynamically-generated code to ensure that various criteria are met including exclusion of certain disallowed instructions and control of branch target addresses. Hardware embodiments are described in which the dynamically-generated code is permitted to executed but is monitored to ensure that the execution criteria are met.
1. A method comprising:
monitoring, in a monitor circuit in a processor in a computer system, a dynamically-generated code sequence being executed in a dynamic code execution region of the computer system to ensure that the dynamically-generated code sequence meets execution criteria, wherein the execution criteria specify that:
none of a set of prohibited instructions is present in the dynamically-generated code sequence;
a branch target that is outside the dynamic code execution region is:
cryptographically signed with one of a set of one or more cryptographic keys; and
within one of one or more predefined address ranges outside of the dynamic code execution region;
detecting a violation of the execution criteria by the monitor circuit; and
forcing, by the monitor circuit, an exception based on detecting the violation.
2. The method as recited in claim 1 wherein the set of one or more cryptographic keys are not accessible to the dynamically-generated code sequence for cryptographic signing operations.
3. The method as recited in claim 2 wherein a second set of one or more cryptographic keys are provided for use by the dynamically-generated code sequence to cryptographically sign one or more target addresses into the dynamically-generated code sequence from an external source.
4. The method as recited in claim 1 wherein a pair of address ranges adjacent to an address range corresponding to the dynamic code execution region are inaccessible to instructions in the dynamically generated code sequence to prevent direct branch instructions from exiting the dynamic code execution region.
5. The method as recited in claim 4 wherein a size of a given address range of the pair of address ranges is based on an extent that is reachable with a given direct branch instruction within the dynamic code execution region.
6. The method as recited in claim 1 wherein the set of prohibited instructions include illegal instruction encodings.
7. A processor comprising:
one or more configuration registers programmable to define a dynamic code execution region in memory, wherein dynamically-generated code is executed in the dynamic code execution region during use; and
a monitor circuit coupled to the one or more configured registers and configured to:
monitor a dynamically-generated code sequence being executed in the processor to ensure that the dynamically-generated code sequence meets execution criteria, and
cause an exception in the processor based on a detection of a violation of the execution criteria,
wherein the execution criteria include;
an absence of a subset of instructions that are not permitted in the dynamically-generated code sequence; and
a requirement that a branch target that is outside the dynamic code execution region is cryptographically signed with one of a set of one or more cryptographic keys and is within one of one or more predefined address ranges outside of the dynamic code execution region.
8. The processor as recited in claim 7 wherein the set of one or more cryptographic keys are not accessible to the dynamically-generated code sequence.
9. The processor as recited in claim 8 wherein a second set of one or more cryptographic keys are provided for the dynamically-generated code sequence to cryptographically sign one or more target addresses into the dynamically-generated code sequence from an external source.
10. The processor as recited in claim 7 wherein the monitor circuit is configured to detect an attempt to access within a pair of address ranges adjacent to an address range corresponding to the dynamic code execution region and to prevent the access by causing an exception in the processor.
11. The processor as recited in claim 10 wherein a size of a given address range of the pair of address ranges is based on an extent that is reachable with a direct branch instruction within the dynamic code execution region.
12. The processor as recited in claim 7 wherein the subset of instructions include certain hint instructions.
13. A computer system comprising:
a memory system, wherein a dynamic code execution region is defined in an address range within the memory system, and wherein dynamically-generated code is executed in the dynamic code execution region during use; and
at least one processor coupled to the memory system, wherein the processor includes a monitor circuit that is configured to:
monitor a dynamically-generated code sequence being executed in the computer system to ensure that the dynamically-generated code sequence meets execution criteria,
wherein the execution criteria specify that:
none of a set of prohibited instructions is present in the dynamically-generated code sequence; and
a branch target that is outside the dynamic code execution region is cryptographically signed with one of a set of one or more cryptographic keys; and
wherein a second set of one or more cryptographic keys are provided for the dynamically-generated code sequence to cryptographically sign one or more target addresses into the dynamically-generated code sequence from an external source,
wherein the dynamically-generated code sequence is stored in the dynamic code execution region, and
wherein the processor is configured to take an exception based on a detection of a violation of the execution criteria.
14. The computer system as recited in claim 13 wherein the set of one or more cryptographic keys are not accessible to the dynamically-generated code sequence.
15. The computer system as recited in claim 13 wherein the execution criteria include a requirement that the branch target is within one of one or more predefined address ranges outside of the dynamic code execution region.
16. The computer system as recited in claim 13 wherein the processor is configured to detect an attempt to access within a pair of address ranges adjacent to an address range corresponding to the dynamic code execution region and to prevent the access by taking an exception, and wherein a size of a given address range of the pair of address ranges is based on an extent that is reachable with a direct branch instruction within the dynamic code execution region.
17. The computer system as recited in claim 13 wherein the set of prohibited instructions include certain cache control instructions.