User-level segmentation mechanism that facilitates safely executing untrusted native code

1. A computing device that uses segmentation to safely execute native code, comprising:

a processing element that executes the native code;

a memory configured to store code and data for the processing element; and

an instruction-processing unit within the processing element, wherein the instruction-processing unit implements a user-level segmentation mechanism including a user descriptor table register and one or more user-level instructions that are operable to create and control user-level memory segments entirely from the user-level, wherein the user-level segmentation mechanism can limit memory accesses by the native code to the user-level memory segments; and

a descriptor table in the memory, wherein the descriptor table is in user memory and contains memory segment descriptors that define one or more segments in the memory, and wherein user-level instructions can read and write segment descriptors in the descriptor table;

wherein the user-level instructions include a user-level instruction operable to initialize the user descriptor table register with an address of the descriptor table.

2. The computing device of claim 1 , wherein the user-level segmentation mechanism includes:

one or more registers containing data from the descriptor table that describes a specified segment presently being accessed by the native code module.

3. The computing device of claim 1 , further comprising a secure runtime environment which enforces code integrity, control flow integrity, and data integrity for native code executing on the processing element;

wherein the secure runtime environment is configured to limit the ability of native code to access the user-level segmentation mechanism; and

wherein the secure runtime environment is configured to use the user-level segmentation mechanism to enforce control flow and data integrity for the native code module.

4. The computing device of claim 3 ,

wherein the processing element includes an enable bit that enables the user-level segmentation mechanism to be configured; and

wherein the processing element includes a status bit that indicates whether the user-level segmentation mechanism can be configured; and

wherein the secure runtime environment checks the status bit and if necessary unsets the enable bit to ensure that native code cannot configure the user-level segmentation mechanism.

5. The computing device of claim 3 , wherein the secure runtime environment includes a validation mechanism configured to validate that the native code does not include instructions which configure the user-level segmentation mechanism.

6. The computing device of claim 1 , further comprising a web browser configured to download and execute native code on the processing element.

7. The computing device of claim 1 , wherein the processing element includes a feature bit that indicates that the processing element supports user-level memory segmentation.

8. The computing device of claim 1 , wherein:

the instruction-processing unit executes the user-level instructions in a current process, wherein the current process has a user space;

addresses in the memory segment descriptors are addresses in the user space of the current process; and

the user-level memory segments are subject to operating system page protections.

9. A method for using segmentation to safely execute native code, comprising:

receiving native code to be executed on a processing element;

executing a user-level instruction which configures a user-level segmentation mechanism in the processing element to limit the native code to accessing a specified memory segment, wherein executing the user-level instruction includes executing a user-level instruction that initializes a descriptor table register with an address of a descriptor table that contains memory segment descriptors that define one or more segments in the memory, wherein the descriptor table is in user memory; and

executing the received native code received on the processing element.

10. The method of claim 9 , wherein executing the user-level instruction involves accessing:

one or more registers containing data from the descriptor table that describes a memory segment presently being accessed by the native code module.

11. The method of claim 9 ,

wherein receiving the native code involves loading the native code into a secure runtime environment which enforces code integrity, control flow integrity, and data integrity for the native code;

wherein the secure runtime environment limits the ability of the native code to access the user-level segmentation mechanism; and

wherein executing the user-level instruction involves executing the user-level instruction through the secure runtime environment.

12. The method of claim 9 ,

wherein the processing element includes an enable bit that enables the user-level segmentation mechanism to be configured;

wherein the processing element includes a status bit that indicates whether the user-level segmentation mechanism can be configured; and

wherein the method further comprises checking the status bit, and if necessary unsetting the enable bit, to ensure that the native code module cannot configure the user-level segmentation mechanism.

13. The method of claim 9 , wherein the method further comprises validating that the native code module does not include instructions which can configure the user-level segmentation mechanism.

14. The method of claim 9 , wherein receiving the native code involves receiving the native code from a web browser which downloaded the native code from a remote website.

15. A non-transitory computer-readable storage medium storing instructions that when executed by a computing device cause the computing device to perform a method for using segmentation to safely execute native code, comprising:

receiving native code to be executed on a processing element;

executing a user-level instruction which configures a user-level segmentation mechanism in the processing element to limit the native code to accessing a specified memory segment, wherein executing the user-level instruction includes executing a user-level instruction that initializes a descriptor table register with an address of a descriptor table that contains memory segment descriptors that define one or more segments in the memory, wherein the descriptor table is in user memory; and

executing the received native code received on the processing element.

16. The computer-readable storage medium of claim 15 , wherein executing the user-level instruction involves accessing:

one or more registers containing data from the descriptor table that describes a memory segment presently being accessed by the native code module.

17. The computer-readable storage medium of claim 15 ,

wherein receiving the native code involves loading the native code into a secure runtime environment which enforces code integrity, control flow integrity, and data integrity for the native code;

wherein the secure runtime environment limits the ability of the native code to access the user-level segmentation mechanism; and

wherein executing the user-level instruction involves executing the user-level instruction through the secure runtime environment.

18. The computer-readable storage medium of claim 15 ,

wherein the processing element includes an enable bit that enables the user-level segmentation mechanism to be configured;

wherein the processing element includes a status bit that indicates whether the user-level segmentation mechanism can be configured; and

wherein the computer-readable storage medium further comprises checking the status bit, and if necessary unsetting the enable bit, to ensure that the native code module cannot configure the user-level segmentation mechanism.

19. The computer-readable storage medium of claim 15 , wherein the method further comprises validating that the native code module does not include instructions which can configure the user-level segmentation mechanism.

20. The computer-readable storage medium of claim 15 , wherein receiving the native code involves receiving the native code from a web browser which downloaded the native code from a remote website.

21. The computer-readable storage medium of claim 15 , wherein the processing element includes a feature bit that indicates whether the processing element supports user-level memory segmentation.