Hardware verification of dynamically generated code
In an embodiment, dynamically-generated code may be supported in the system by ensuring that the code either remains executing within a predefined region of memory or exits to one of a set of valid exit addresses. Software embodiments are described in which the dynamically-generated code is scanned prior to permitting execution of the dynamically-generated code to ensure that various criteria are met including exclusion of certain disallowed instructions and control of branch target addresses. Hardware embodiments are described in which the dynamically-generated code is permitted to executed but is monitored to ensure that the execution criteria are met.
1. A method, comprising:
monitoring, by a monitor circuit of a computer system, a dynamically-generated code sequence being executed in the computer system to ensure that the dynamically-generated code sequence meets one or more execution criteria, wherein the one or more execution criteria specify that a branch target that is outside an execution region of a memory storing the dynamically-generated code sequence is permitted when the branch target is within one of one or more predefined address ranges outside of the execution region;
detecting, by the monitor circuit, a violation of the one or more execution criteria; and
forcing, by the monitor circuit, an exception based on detecting the violation.
2. The method of claim 1 , wherein a set of cryptographic keys is provided to the dynamically-generated code sequence to cryptographically sign one or more target addresses into the dynamically-generated code sequence from an external source.
3. The method of claim 1 , wherein a pair of address ranges adjacent to an address range that corresponds to the execution region are inaccessible to instructions in the dynamically-generated code sequence to prevent direct branch instructions from exiting the execution region.
4. The method of claim 3 , wherein a size of a given address range of the pair of address ranges is based on an extent that is reachable with a given direct branch instruction within the execution region.
5. The method of claim 1 , wherein the one or more execution criteria specify that dynamically-generated code sequences are prohibited from including an unauthenticated indirect branch instruction.
6. The method of claim 1 , wherein the one or more execution criteria include a requirement that a branch target that is outside the execution region is signed with a key that is not accessible to the dynamically-generated code sequence.
7. The method of claim 1 , wherein the execution region is defined by one or more registers of the computer system that are programmable.
8. A processor, comprising:
one or more registers programmable to define an execution region in a memory, wherein dynamically-generated code is stored in the execution region during use; and
a monitor circuit coupled to the one or more registers and configured to:
monitor a dynamically-generated code sequence that is being executed in the processor to ensure that the dynamically-generated code sequence meets one or more execution criteria, wherein the one or more execution criteria specify that a branch target that is outside the execution region is permitted when the branch target is within a predefined address range outside of the execution region; and
cause an exception in the processor based on a detection of a first particular violation of the one or more execution criteria.
9. The processor of claim 8 , wherein the monitor circuit is configured to:
based on a detection of a second particular violation of the one or more execution criteria that pertains to signing a particular pointer, modify an execution of a sign instruction associated with the second particular violation.
10. The processor of claim 8 , wherein the monitor circuit is configured to:
detect an attempt by the dynamically-generated code sequence to access an address within a pair of address ranges adjacent to an address range corresponding to the execution region; and
prevent the access by causing an exception in the processor.
11. The processor of claim 10 , wherein a size of a given address range of the pair of address ranges is based on an extent that is reachable with a direct branch instruction within the execution region.
12. The processor of claim 8 , wherein the one or more execution criteria specify that none of a set of prohibited instructions is present in the dynamically-generated code sequence.
13. The processor of claim 8 , wherein the one or more execution criteria include a requirement that a branch target that is outside the execution region is signed with a key that is not accessible to the dynamically-generated code sequence.
14. The processor of claim 8 , wherein the monitor circuit is configured to:
evaluate a program counter of the processor to determine when the dynamically-generated code sequence is being executed in the processor to ensure that the dynamically-generated code sequence meets one or more execution criteria.
15. A computer system, comprising:
a memory system, wherein a dynamic code execution region is defined in an address range within the memory system, and wherein dynamically-generated code is stored in the dynamic code execution region during use; and
at least one processor that is coupled to the memory system and configured to:
monitor a dynamically-generated code sequence being executed in the computer system to ensure that the dynamically-generated code sequence meets one or more execution criteria, wherein the one or more execution criteria specify that a branch target that is outside the dynamic code execution region is permitted when the branch target is within a predefined address range outside of the dynamic code execution region; and
take an exception based on a detection of a violation of the one or more execution criteria.
16. The computer system of claim 15 , wherein the at least one processor is configured to provide a set of cryptographic keys to the dynamically-generated code sequence to cryptographically sign one or more target addresses into the dynamically-generated code sequence from an external source.
17. The computer system of claim 15 , wherein the at least one processor is configured to enforce the one or more execution criteria on code based on a detection that execution of the code is occurring within the dynamic code execution region.
18. The computer system of claim 15 , wherein the at least one processor is configured to detect an attempt to access within a pair of address ranges adjacent to an address range corresponding to the dynamic code execution region and to prevent the access by taking an exception, and wherein a size of a given address range of the pair of address ranges is based on an extent that is reachable with a direct branch instruction within the dynamic code execution region.
19. The computer system of claim 15 , wherein the one or more execution criteria specify that a branch target that is outside the dynamic code execution region is cryptographically signed with one of a set of one or more cryptographic keys.
20. The computer system of claim 15 , wherein the one or more execution criteria specify that dynamically-generated code sequences are prohibited from including illegal instruction encodings.