Methods and systems for securely executing untrusted software

A method for executing code in a data processing system, the code compiled by a compiler, the method comprising:

• creating a first virtual memory mapping from a readable and executable (RX) virtual memory space to physical memory, the physical memory being designated for use in storing code and data produced by the compiler;
• creating a second virtual memory mapping from a readable and writeable (RW) virtual memory space to the physical memory, the RW virtual memory space for storing data used in one or more processes resulting from execution of software stored in the RX virtual memory space;
• allocating a memory region in one or more pages of memory, the memory region being at least writeable;
• writing into the memory region an executable function configured to copy input data into the RW virtual memory space at a specified offset;
• converting the memory region, after the writing, into an execute only memory region having an execute only privilege;
• storing a pointer to the memory region, the pointer being used during a write operation that uses the executable function;
• compiling the code to create compiled software and storing the compiled software in the physical memory by using the pointer to call for the execution of the executable function to cause the compiled software to be written, through the RW virtual memory space to physical memory mapping, to the physical memory.

A non-transitory machine readable medium storing executable program instructions which when executed by a data processing system cause the data processing system to perform a method comprising:

• compiling, by a compiler prior to run time, software code to create compiled software, the compiled software to be stored in a readable and executable (RX) virtual memory address space at run time, the RX virtual memory address space to be mapped to physical memory by a first virtual memory address mapping;
• creating, by the compiler, an executable function to be stored in a memory region which is at least writeable when the executable function is written to the memory region at run time, wherein the executable function is configured to copy at run time input data into a readable and writeable (RW) virtual memory address space at a specified offset, the RW virtual memory address space to be mapped to the physical memory by a second virtual memory address mapping at run time;
• creating, by the compiler, executable software which at run time converts the memory region into an execute only memory region and stores a pointer to the converted memory region, the pointer being used during a write operation, at run time, by one or more processes resulting from execution of the compiled software in the RX virtual memory address space, wherein at run time, when a request from the one or more processes requires writing first data, the pointer is used to call the executable function to cause the first data to be written, through the RW virtual memory address space, to the physical memory.

A non-transitory machine readable medium storing executable instructions which when executed cause a method for executing code in a data processing system, the method comprising:

• obtaining a memory region in one or more pages of memory, the memory region being at least writeable;
• writing into the memory region an executable function configured to write one or more functions or data into a writeable virtual memory space;
• converting the memory region, after the writing, into an execute only memory region having an execute only privilege;
• storing a pointer to the memory region, the pointer being used during a write operation that uses the executable function;
• receiving a request, from one or more processes, which requires writing functions or data, and using the pointer, calling the execution of the executable function to cause the functions or data to be written, through the writeable virtual memory space to physical memory mapping, to the physical memory.

A non-transitory machine readable medium storing executable instructions which when executed cause a method for executing code in a data processing system, the method comprising:

• obtaining a memory region in one or more pages of memory, the memory region being at least writeable;
• writing into the memory region an executable function configured to perform a cryptographic function;
• converting the memory region, after the writing, into an execute only memory region having an execute only privilege;
• storing a pointer to the memory region, the pointer being used in response to a request to perform the cryptographic function;
• receiving a request, from one or more processes, which requires use of the cryptographic function, and using the pointer, calling the execution of the cryptographic function.