Systems and methods for transforming instructions for metadata processing

Abstract

According to at least one aspect, a hardware system include a host processor, a policy engine, and an interlock is provided. These components can interoperate to enforce security policies. The host processor can execute an instruction and provide instruction information to the policy engine and the result of the executed instruction to the interlock. The policy engine can determine whether the executed instruction is allowable according to one or more security policies using the instruction information. The interlock can buffer the result of the executed instruction until an indication is received from the policy engine that the instruction was allowable. The interlock can then release the result of the executed instruction. The policy engine can be configured to transform instructions received from the host processor or add inserted instructions to the policy evaluation pipeline to increase the flexibility of the policy engine and enable enforcement of the security policies.

1 . A system comprising:
 a policy engine configured to:
 receive first instruction information associated with at least one first instruction executed by a host processor; 
 transform the first instruction information into second instruction information; and 
 determine, using second metadata associated with the second instruction information, whether the at least one first instruction is allowable according to at least one policy. 
   
     
     
         2 . The system of  claim 1 , wherein:
 in response to determining that the at least one first instruction is allowable, provide, to an interlock, an indication to release a queued result of executing the at least one first instruction.   
     
     
         3 . The system of  claim 1 , wherein:
 transforming the first instruction information into second instruction information comprises:
 obtaining, using the first instruction information, first metadata associated with the at least one first instruction; 
 obtaining, using the first metadata, the second instruction information and the second metadata used to determine whether the at least one first instruction is allowable. 
   
     
     
         4 . The system of  claim 3 , wherein:
 the first metadata comprises at least one pointer to at least one data structure comprising:
 the second instruction information; and 
 the second metadata associated with the second instruction information. 
   
     
     
         5 . The system of  claim 1 , wherein:
 the second instruction information is associated with a plurality of second instructions; and   the at least one first instruction is convertible into the plurality of second instructions.   
     
     
         6 . The system of  claim 1 , wherein:
 the second instruction information is associated with a plurality of second instructions; and   a first execution of the at least one first instruction and a second execution of the plurality of second instructions have a same input-output behavior.   
     
     
         7 . The system of  claim 1 , wherein:
 the second instruction information is associated with a plurality of second instructions; and   a first execution of the at least one first instruction and a second execution of the plurality of second instructions have a same effect on one or more hardware entities and/or one or more memory locations.   
     
     
         8 . (canceled) 
     
     
         9 . The system of  claim 1 , wherein:
 the at least one first instruction comprises a first branch instruction that is part of an instruction path; and   the second instruction information is associated with:
 a result of removing one or more instructions from the instruction path; and/or 
 a result of replacing one or more instructions in the instruction path with one or more other instructions, wherein the one or more instructions and the one or more other instructions represent a same operation. 
   
     
     
         10 . The system of  claim 1 , wherein the policy engine is further configured to:
 generate third metadata using the second instruction information and/or the second metadata; and   update at least one metadata storage location using the third metadata.   
     
     
         11 . The system of  claim 10 , wherein:
 the at least one metadata storage location comprises at least one location selected from a group consisting of: a tag map table location, a hardware register location , and a metadata memory location.   
     
     
         12 .- 16 . (canceled) 
     
     
         17 . The system of  claim 10 , wherein:
 the policy engine comprises tag processing hardware and policy processing software executed by at least one processor;   the tag processing hardware is configured to:
 receive the first instruction information; and 
 in response to receiving the first instruction information, query the policy processing software to validate the at least one first instruction; and 
   the policy processing software is configured to:
 receive the query; and 
 determine the third metadata in response to the query. 
   
     
     
         18 . The system of  claim 10 , wherein:
 the policy engine comprises tag processing hardware and policy processing software executed by at least one processor;   the policy processing software is configured to:
 provide, to the tag processing hardware, at least one rule for use in generating to the third metadata; and 
   the tag processing hardware is configured to:
 receive the at least one rule; 
 evaluate the at least one rule to generate the third metadata; and 
 update the at least one metadata storage location using the third metadata. 
   
     
     
         19 . The system of  claim 17 , wherein:
 the policy processing software is further configured to:   update the at least one metadata storage location using the third metadata.   
     
     
         20 . The system of  claim 10 , wherein:
 the second instruction information is associated with at least one second instruction; and   the at least one second instruction comprises an inserted instruction to effectuate updating the at least one metadata storage location.   
     
     
         21 .- 23 . (canceled) 
     
     
         24 . The system of  claim 10 , wherein:
 the policy engine is configured to implement a stack policy indicating read-only access to one or more locations in a call stack associated with a metadata tag by instructions within a body of a function during calls to the function;   the at least one first instruction indicates completion of a call to the function; and   updating the at least one metadata storage location using the generated third metadata comprises disassociating the metadata tag from the one or more locations in the call stack .   
     
     
         25 . (canceled) 
     
     
         26 . The system of  claim 1 , wherein:
 the at least one first instruction is in a host Instruction Set Architecture (ISA) used by the host processor;   the second instruction information comprises a translation of at least a portion of the first instruction information, the translation not in the host ISA;   the first instruction information further comprises an address of the at least one first instruction;   the second metadata is obtained using the address of the first instruction.   
     
     
         27 . (canceled) 
     
     
         28 . The system of  claim 26 , wherein:
 the translation of at least a portion of the first instruction information is in a policy engine ISA.   
     
     
         29 . The system of  claim 26 , wherein:
 generating the translation of at least a portion of the first instruction information comprises converting the at least one first instruction in the host ISA to at least one second instruction in a policy engine ISA according to a mapping implemented using a look-up table, a field-programmable gate array, or dedicated logic circuits.   
     
     
         30 . (canceled) 
     
     
         31 . The system of  claim 26 , wherein:
 generating the translation of at least a portion of the first instruction information comprises identifying at least one data structure comprising at least one instruction in a policy engine ISA, and   the translation of at least a portion of the first instruction information comprises the at least one instruction in the policy engine ISA.   
     
     
         32 . A method performed by a system comprising at least one processor, the method comprising acts of:
 receiving first instruction information associated with at least one first instruction executed by a host processor;   transforming the first instruction information into second instruction information; and   determining, using second metadata associated with the second instruction information, whether the at least one first instruction is allowable according to at least one policy.   
     
     
         33 . At least one computer-readable medium having encoded thereon instructions which, when executed by at least one processor, cause the at least one processor to perform a method comprising acts of:
 receiving first instruction information associated with at least one first instruction executed by a host processor;   transforming the first instruction information into second instruction information; and   determining, using second metadata associated with the second instruction information, whether the at least one first instruction is allowable according to at least one policy.