Patent ID: 8856925

Claim:
A computer-implemented method for executing a native code module, comprising: obtaining, by a computer, the native code module; loading the native code module into a secure runtime environment; and safely executing the native code module in the secure runtime environment using a set of software fault isolation (SFI) mechanisms by: constraining store instructions in the native code module by: bounding an address space and a call stack of the native code module with a set of unmapped pages; enforcing storage of valid data addresses in a stack pointer by: enabling store instructions that increment or decrement the stack pointer without masking; and masking direct updates to the stack pointer to keep a value of the stack pointer within the call stack; allowing a calculation of a store address only by combining a valid base register with an immediate offset and disabling any calculation of a store address that adds two registers together; and masking non-stack-relative store instructions.