Optimizing Boundary Information Access in Buffer Protection

Abstract

A method, system and apparatus for providing boundary information access in buffer protection, comprising: providing a one-to-one mapping between boundary information in a general register and a BI (boundary information) register, saving loaded boundary information in the BI register for future use, providing integrity of the boundary information in the BI register, wherein the integrity of the boundary information is maintained as the program executes, and providing pre-active loading of the boundary information using an additional bit of control of a load instruction to the BI register.

Description

Technical Field

[0001] The present invention relates to embodiments of boundary information access methods, apparatus and systems, and more particularly, but not by way of limitation, to methods, apparatus and systems for optimizing boundary information access in buffer protection. Background Art

[0002] Memory safety vulnerabilities (e.g., buffer overflows, race conditions, page faults, null pointers, stack exhaustion, heap exhaustion / corruption, use-after-free, or double free, etc.) occur when software accidentally or intentionally accesses system memory in a manner that exceeds its allocated size and memory address.

[0003] Programs that are already widely used in certain operating systems and other programs, such as C and C++, can result in multiple memory security errors that attackers can exploit, resulting in dangerous and invasive consequences, such as remote code execution or privilege escalation flaws. For example, by reading out-of-bounds memory, an attacker may be able to obtain secret values, such as memory addresses, that can bypass protection mechanisms.

[0004] Therefore, there is a need for a technology that can reduce or eliminate memory security weaknesses in an effective manner. Summary of the invention

[0005] In view of the above and other problems, disadvantages and drawbacks of the above background technology, exemplary aspects of the present invention provide a method, apparatus and system for optimizing boundary information access in buffer protection.

[0006] An embodiment of the present invention is a method for providing boundary information access in buffer protection, including providing a one-to-one mapping between boundary information in a general register and a BI (boundary information) register, saving the loaded boundary information in the BI register for future use, providing integrity of the boundary information in the BI register, wherein the integrity of the boundary information is maintained as the program executes, and providing pre-active loading of the boundary information using an additional bit of control of a load instruction to the BI register.

[0007] An embodiment of the present invention, a system for providing boundary information access in buffer protection, includes: a memory, storing computer instructions; and a processor, configured to execute the computer instructions to provide a one-to-one mapping between general registers and boundary information in a BI (boundary information) register, save the loaded boundary information in the BI register for future use, provide integrity of the boundary information in the BI register, the integrity of the boundary information is maintained as the program is executed, and provide pre-active loading of the boundary information using an additional bit of control of the load instruction of the BI register.

[0008] Another embodiment of the present invention is a computer program product, comprising a computer-readable storage medium having program instructions, wherein the program instructions can be read and executed by a computer to cause the computer to perform a method for providing boundary information access in buffer protection, the method comprising providing a one-to-one mapping between boundary information in a general register and a BI (boundary information) register, saving the loaded boundary information in the BI register for future use, maintaining the integrity of the boundary information in the BI register as the program is executed, and providing pre-active loading of the boundary information using an additional bit of control of a load instruction to the BI register.

[0009] Therefore, certain embodiments of the invention have been outlined rather broadly so that the detailed description of the invention may be better understood, and so that the invention's contribution to the prior art may be better appreciated. Of course, additional embodiments of the invention will be described below, and they will form the subject matter of the appended claims.

[0010] It should be understood that the present invention is not limited in its application to the construction details and component arrangements set forth in the following description or shown in the accompanying drawings. The present invention can have embodiments other than those described, and can be practiced and executed in various ways. Moreover, it should be understood that the words and terms used herein and the abstract are for descriptive purposes and should not be considered as limiting.

[0011] Therefore, those skilled in the art will appreciate that the concepts upon which the present disclosure is based can be readily used as a basis for designing other structures, methods and systems for carrying out the several purposes of the present invention. It is therefore important that the claims be regarded as including such equivalent constructions as long as they do not depart from the spirit and scope of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Exemplary aspects of the present invention will be better understood through the following detailed description of exemplary embodiments of the present invention with reference to the accompanying drawings:

[0013] Figure 1A An example system illustrating an embodiment of the present invention;

[0014] Figure 1B A non-limiting example of a boundary information table of an embodiment of the present invention is shown;

[0015] Figure 2 The boundary information register file and the general register file of an embodiment of the present invention are shown;

[0016] Figure 3 shows a boundary information register file of an embodiment of the present invention;

[0017] Figure 4 shows the state of the boundary information register file of an embodiment of the present invention;

[0018] Figure 5 shows a plurality of BI register files of an embodiment of the present invention;

[0019] Fig. 6A Shows the maintenance of the BI register file of an embodiment of the present invention;

[0020] Figure 6B An example compiler 180 for use in C / C++ is shown;

[0021] Figure 6C An exemplary runtime 190 and compile time 192 in C / C++ are shown;

[0022] Figure 7 shows example instructions in embodiments of the present invention;

[0023] Fig. 8A shows an example load instruction in an embodiment of the present invention;

[0024] Figure 8B An example storage instruction in an embodiment of the present invention is shown;

[0025] Fig. 9A shows when boundary information should or should not be pre-fetched in an embodiment of the present invention;

[0026] Fig. 9B shows examples of when boundary information should or should not be prefetched in an embodiment of the present invention;

[0027] Fig.10 An embodiment of the present invention is shown;

[0028] Fig.11 An exemplary hardware / information processing system is shown in which exemplary embodiments of the present invention may be incorporated;

[0029] Fig.12 A signal bearing storage medium for storing machine readable instructions of a program implementing a method according to an exemplary embodiment of the present invention is shown;

[0030] Fig.13 depicts a cloud computing node according to an example embodiment of the present invention;

[0031] Fig.14 depicts a cloud computing environment according to an example embodiment of the present invention; and

[0032] Fig.15 An abstract model layer according to an example embodiment of the present invention is shown. DETAILED DESCRIPTION

[0033] The present invention will now be described with reference to the accompanying drawings, wherein like reference numerals represent like parts throughout. It is emphasized that, according to convention, the various features of the drawings are not necessarily drawn to scale. On the contrary, the dimensions of the various features may be arbitrarily enlarged or reduced for clarity. The exemplary embodiments provided below are for illustrative purposes and are not intended to limit the claims. In addition, please note that any steps may be performed in a different order, in combination, or simultaneously. In addition, any of the structures and embodiments shown may be modified or combined.

[0034] Memory references outside of their bounds can lead to serious security issues. Buffer overflow vulnerabilities have been a problem for at least 30 years, for example, Morris Internet Worm (1988). Buffer overflow vulnerabilities have enabled many forms of attacks, including buffer overflow-based code injection, return-oriented programming (ROP), and "HeartBleed".

[0035] Some work has been done to address the effects of buffer overflow attacks or buffer overflow attacks, such as "stack canaries", WXOR X memory pages, ASLR, "shadow stacks", and other methods for protecting "control flow integrity".

[0036] Oracle Silicon Secure Memory (SSM) ("color" data in memory & prevents access by pointers with the "wrong color". SSM has some limitations, such as only 14 colors, and the granularity of protected data is 64 bytes.

[0037] It is important to check whether each memory reference, load or store is within its memory boundary. An existing solution is INTEL's Memory Protection Extension (MPX) system. MPX introduces a new ISA (Instruction Collective Architecture) and hardware support for precise boundary checking. In memory, the boundary information (BI) of each buffer is stored / retrieved with a pointer value as a keyword. In the core, the pointer and its BI are in registers, and the mapping is maintained by additional instructions added by the compiler. The original calculation and boundary protection operations share the same hardware resources. There are other methods that try to remove or reduce memory security vulnerabilities.

[0038] However, all these other solutions have a major problem of needing to add multiple instructions, and also have expensive implementations. As a result, the number of instructions can increase by four or more times, and the execution time can increase by two or more times even when bounds checking is turned off.

[0039] INTEL MPX protects buffers from out-of-bounds references using precise bounds information (BI). MPX stores the BI of a buffer in a BI table by hashing the pointer value. When a pointer is loaded, the BI for the pointer is entered in a general register. Bookkeeping code is added to propagate the BI in the register to its consumer: load / store instructions. Bounds-checking instructions are inserted before load / store.

[0040] An additional problem with MPX is that the load of the BI may not be used and there are two levels of memory access for the BI. Other conventional approaches have the problem of causing excessive load requests for BI entries, and the BI is loaded and used in the same instruction, so the latency is not hidden.

[0041] It is necessary to detect when references to array elements (including pointer references to array elements, (e.g., x[i], *P++, P->foo)) are out of bounds.

[0042] This needs to be able to be done without rewriting existing programs and without significant space or time overhead.

[0043] The present invention solves the above-mentioned problem of memory security vulnerability without increasing the number of instructions as in previous solutions.

[0044] The present invention provides precise protection, where it protects the precision of each buffer and byte. The system can be applied to C / C++ applications and other programs that may have memory issues, where there is arbitrary pointer arithmetic, and the number of buffers to be protected in an application can range from thousands to millions.

[0045] Figure 1A An example system of an embodiment of the present invention is shown. This is a non-limiting example, and other configurations can be made. System 100 includes a CPU (central processing unit) core 10 and a memory 20. The CPU core 10 includes an instruction fetch and decode 12, an ALU (arithmetic logic unit) 14, a general file register 16, a boundary register file 18, and a boundary processing unit 20. The general file register communicates with a data cache 22, and the boundary register file 18 is linked to a boundary information (BI) cache 24. A boundary information (or information of multiple boundaries) cache 24 can be added to limit any slowdown in access to a boundary information table 26 in the memory 20.

[0046] Figure 1B A non-limiting example of a boundary information table of an embodiment of the present invention is shown.

[0047] BI table 26 may be organized as a linear table containing a plurality of BI entries 29, wherein each BI entry contains a base address field 40 and an object size or length field 42. Each BI entry of BI table 26 may be associated with a heap object. Accessing a particular BI entry of BI table 26 corresponding to a given object may involve a single table lookup. A single table lookup may, for example, involve using an index that may be embedded in a pointer during object allocation.

[0048] Return to reference Figure 1A , the CPU core 10 communicates information with the BI table 26 in the memory via paths 23 and 26. Likewise, different configurations may be provided as this is merely an example.

[0049] Generally speaking, the present invention introduces BI register 18 to hold boundary information (or information such as limit information or multiple boundaries). When loading boundary information for boundary checking for load / store instructions, system 100 saves it into BI register 18.

[0050] The system 100 avoids BI loads for loads from the same buffer. The system 100 can maintain the BI register 18 by hardware. The present invention can propagate the BI between the BI registers 18 for pointers to the same buffer, rather than just using the same register. No extra instructions are added in the code by the present invention. When loading a pointer from memory 20, the system 100 loads the BI register 18. The present invention can prefetch the BI to hide latency, propagate the BI to more pointers, and be assisted by the compiler to avoid useless prefetches.

[0051] The present invention uses the BI register 18 through load / store, wherein the bounds check using the BI register 18 is performed by hardware and no code changes are required for such checking.

[0052] Figure 2 The boundary information register file and the general register file of the embodiment of the present invention are shown.

[0053] 18 in Figure 2 The BI register file is further detailed with the help of . There is a one-to-one mapping (virtual) 40 between the general purpose registers 18 and the BI registers 18, BIRi (or BIRn as shown, where n is an integer) 44 entries use identity mapping to maintain boundary information for general purpose register information GPRi (or GPRn as shown, where n is an integer) 42.

[0054] The BI register file 18 is not used directly in instructions. The BI register file 18 is accessed implicitly using an index to the general register file 16 in the instruction.

[0055] Figure 3A boundary information register file of an embodiment of the present invention is shown.

[0056] refer to Figure 3 , each BI register 18 has three fields: (index 46, LB (lower boundary) 48, UB (upper boundary) 50). As seen in this embodiment, the upper boundary (UB) 50 is the rightmost cell 50. The index 46 is described in the next paragraph.

[0057] "Unused bits" in a pointer are repurposed to be used to check or track the range of addresses accessible via the pointer. For example, in a 64-bit architecture, object pointers have unused bits because they typically store virtual addresses with 48 bits or less of information. The disclosed techniques can utilize these unused bits to: (a) allocate entries in a bounds table to store information for multiple bounds when an object is allocated; (b) repurpose unused bits (e.g., top bits) of an object pointer to store an index to a bounds table entry; (c) automatically propagate indexes when subsequent addresses are derived via assignment statements or pointer arithmetic; and / or (d) perform bounds checking on load and store instructions in hardware by using the index bits in the address to access the appropriate bounds information when an object is allocated.

[0058] Figure 4 The state of the boundary information register file of the embodiment of the present invention is shown.

[0059] The lower boundary LB 48 and the upper boundary LB 50 are used for the buffer. The BI register file 18 has three states. The first state is "non-pointer", that is, the data in the paired general register 16 is not a pointer. The "non-pointer" state can be represented as (-1, *), as seen in the exemplary boundary information BIR1.

[0060] The second state is the "index only" state, i.e. the data in the paired general register 16 is a pointer, but its boundary information has not yet been loaded. The "index only" state can be represented as (index, N / A, N / A), as seen in the example boundary information BIR2. "N / A" stands for not available, and provides the index value.

[0061] The third state is the "BI-loaded" state, i.e. when the boundary information has been loaded. The BI register 18 then contains (index, LB, UB), as seen in the exemplary boundary information BIR3. The third state would then contain boundary information values ​​for index 46, lower boundary 48, upper boundary 50, assuming there is a fast way to detect the state of the BI register 18. Other states may also be added, or states may be removed.

[0062] The BI register file 18 is part of the machine state, where there is a save / restore, or when restoring the context without saving the context, all BI register files are set to null-BI (null boundary information). For example, index 0x0 can be reserved for a null pointer (e.g., pointer value "0") to support free calls to null pointers.

[0063] Figure 5 Multiple BI register files are shown. System 200 is similar to Figure 1A The system 100 may include a plurality of BI registers 181 to 18 n , where n is an integer.

[0064] Fig. 6A The maintenance of the BI register file according to an embodiment of the present invention is shown. Figure 6B An example compiler 180 is shown that may be used in C / C++. Figure 6C Example compile time 190 and run time 192 in C / C++ are shown.

[0065] Reference Fig. 6A , the BI register file 18 can be maintained as follows. One of the goals is to initialize the boundary information in the BI register file 18 and propagate it along with the program execution. It is a runtime data flow and does not require the help of program analysis.

[0066] The method is as follows. BI register file 18 is automatically managed by hardware. No instructions are added. Register file 18 usage for each instruction BI is checked.

[0067] When a load / store is executed 130, the BI register file 18 paired with the source address pointer is initialized with the BI loaded for bounds checking 132 (see also Figure 6C 194). For example, return reference Figure 3 , for GPR3 ​​= load GPR5, BIR5 will be set to the BI used for bounds checking for the load.

[0068] Please refer to Fig. 6A , when the register is assigned the immediate value 134, the BI register 18 paired with the result register is set to a "non-pointer" state with a value of "-1", such as Figure 4 As seen in BIR1 (step 136). For example, for GPR7=100, BIR7 is set to "non-pointer".

[0069] When a register is calculated with a source register 138, system 100 copies the BI register file 18 for the source register to the BI register file 18 for the result register 140. For example, for GPR3=GPR7+10, BIR3 is assigned BIR7.

[0070] When calculating registers with more than one source register 142 , the following may occur: If only one BI register 18 of the source registers is not “not a pointer”, the system 100 copies that BI register to the BI register of the result register 144 .

[0071] For example, for pointer q, pq=p+idx, since GPR3=GPR7+GPR8, if p has BI in BI register 18, BIR3 is assigned BIR7.

[0072] Otherwise, the system 100 assigns "non-pointer" to the BI register 18 (step 146). For example, for the floating point operation z = x + y, BIR3 is assigned NULL-BI because GPR3 ​​= GPR7 + GPR8. Another example is for register = 0, BIR3 is assigned non-pointer because R3 = R3xor R3. However, another example is for pointer subtraction offset = pq, because GPR3 ​​= GPR7-GPR8, BIR3 is assigned non-pointer.

[0073] When a register is loaded from memory 148, BI register 18 is paired with the result register and is set to "non-pointer" unless compiler 180 marks the load as a load of pointer 150. For example, for int x = *P, BIR3 is assigned non-pointer due to GPR3 ​​= load GPR7. Another example is that for *q = *P, BIR3 is assigned (index, N / A, N / A) due to GPR3 ​​= pointer-load, where the index is retrieved from an unused bit in GPR3.

[0074] However, if the compiler 180 specifically marks the load as loaded with boundary information 152, the BI register 18 paired with the result register is set to "BI-load" 154. For example, for Int *q = *p, since GPR3 ​​= pointer BI-load GPR7, the boundary information for the pointer in GPR3 ​​is loaded and assigned to BIR3. The boundary information for the pointer in GPR3 ​​is loaded using information from the "index bit" in GPR3. This is a prefetch BI. ISA support is required, where existing load instructions are changed to use one bit to indicate prefetch or a BI prefetch instruction is introduced, such as GPRi = BI_Load GPRi.

[0075] When "createBI" (create boundary information) is called 156, the BI register paired with the address pointer is set with its BI 158. For better performance, this step is optional and requires additional ISA support.

[0076] Return to reference Figure 3 6, the use of the BI register file 18 is as follows. A load / store instruction attempts to use the BI register (BIRn) 44 paired with its address register (GPRn) 42 (step 160). The system 100 checks whether the BIRn 44 is a BI-load and contains the same index as in the address pointer 162. If the result of the check is yes, a bounds check 164 is performed using the LB and UB in the BIRn. Otherwise, a load request for the bounds information must be issued 166.

[0077] The check on the index is needed for the following reason. When the pointer is out of bounds, the index value in its unused bits can be changed. This check can detect this situation.

[0078] Figure 7 Example instructions in an embodiment of the invention are shown. For columns BIRp, BIRq and BIRr (pointers p, q, r), the result at the end of the instruction is shown.

[0079] Fig. 8A An example load instruction 402 is shown in an embodiment of the present invention. Figure 8B Example store instructions 412 in an embodiment of the present invention are shown.

[0080] Fig. 9A It shows when boundary information should or should not be pre-fetched in an embodiment of the present invention.

[0081] The following shows when boundary information should be pre-fetched. Extraction of boundary information is beneficial when there is a possibility to reduce the number of BI loads or to hide latency.

[0082] Fig. 9A This includes starting to determine when boundary information should be pre-fetched 502. The system 100 determines whether there is a benefit by reducing the number of BI loads at step 504. If the system 100 determines "yes", then the boundary information should be pre-fetched 508. If the system 100 determines "no", then the boundary information should not be pre-fetched 510.

[0083] The system 100 also checks whether hiding the delay would be beneficial at step 506. If the system 100 determines "yes", then the boundary information should be pre-fetched 508. If the system 100 determines "no", then the boundary information should not be pre-fetched 510.

[0084] Fig. 9BExamples are shown when boundary information should or should not be prefetched in an embodiment of the present invention.

[0085] In embodiment 1 (602), the number of loads is reduced. If the load at [1] is marked, the boundary information for Rp will be loaded into BIRp. BIRp is copied to BIRq at [2] and to BIRt at [4]. The loads at [3] and [5] can use their BI register 18 for boundary checking without a load request for BI. If the load at [1] is not marked, the loads at [3] and [5] will both need to fetch BI. They use different registers.

[0086] In Example 2 (604) it is shown when boundary information should not be prefetched. In Example 2 (604), the load at [1] should not be prefetched. The number of BI requests remains the same. The first load execution at [4] will initialize BIRp. BIRp will be propagated to [4] along the loop execution. There is no more load BI for the subsequent load execution at [4]. There is not much latency hiding. There are only two simple instructions between [1] and [4]. The load BI at [1] may not be used, and [4] is in a branch and may not be executed.

[0087] Referring back to Figures 1, 6B and 6C, the following shows how compiler 180 determines. Basically, compiler 180 runs static data flow analysis to find out whether the load of the pointer should be marked. This determination is only a performance issue, not a correctness issue. Heuristics are used to simplify the problem and deal with unknown factors.

[0088] The system 100 selects a method to handle each pointer load separately as follows. The system only considers the subgraph of the program that is dominated and affected by the load. If the load is marked as a prefetch BI, then there is one BI load for the subgraph. If this load is not marked, the system 100 calculates how many BI loads will be required for this subgraph. The system 100 considers the path possibilities. Therefore, the system makes comparisons and decisions. It is assumed that the index is stored in the unused bits of the pointer and always remains the same. Hardware BI propagation always succeeds.

[0089] The subgraph affected by the prefetch BI is constructed as follows. Assume that the load of the pointer is the target, root load, where S0:ptr=load addr. At S0, the system 100 fine-tunes the control flow graph and only keeps the nodes dominated by the load.

[0090] The effect of prefetching may extend beyond this range, but is ignored. The system 100 finds all load / store instructions that can use the prefetched BI register for the result register ptr that is loaded therefor.

[0091] System 100 can apply pointing analysis with some customization. For example, instead of a memory object for a pointer, analyze the BI for the pointer. The one generated for ptr at S0, called the BI-root, is of interest. Other BIs can be ignored. Pointing analysis is a compile-time technique that helps identify the relationship between a pointer variable and the memory location to which the pointer variable points during program execution.

[0092] The system 100 can prune the control flow graph and keep only the nodes whose pointer sets contain the BI-root and are live. The address used for load / store is the consumer.

[0093] The resulting graph, denoted as S0-graph, will be used in the next step as shown below. The details of the exemplary illustration are as follows. With respect to the state set below, the compiler basically runs a static data flow analysis to find out if the load of the pointer should be marked for prefetching. During the traversal of the control flow graph, these three references are relied upon to describe the nodes. "v: pointer to element, mo: memory object pointed to, p: path possibility information which can be a value in [0, 1] or a state {definite, possible}".

[0094] Elements in the state group: tuple (v, mo, p)

[0095] v: pointer to the element

[0096] mo: The memory object pointed to

[0097] p: path possibility information

[0098] Can be a value in [0, 1] or a state {definite, possible}

[0099] Starting node: ptr1 = load address

[0100] GEN = {(ptr1, bi-obj, 1)}

[0101] Arithmetic instruction: ptr2 = op (ptr1, other operands)

[0102] KILL = {(ptr2, mo, p) | (ptr2, mo, p) in IN}

[0103] GEN = {(ptr2, mo, p') | (ptr1, mo, p) is in IN and p' is the current path}

[0104] Load / Store Instructions: Load address or store address

[0105] Assume that only BI register 18 is used. If different boundary information is loaded due to the check, it is not of concern here.

[0106] Transfer function: OUT = IN - KILL + GEN

[0107] Merge function: When (ptr, mo, p1) and (ptr, mo, p2) come from two paths, the result is (Optr, mo, p1+p2).

[0108] When there is no prefetch, the system 100 calculates the following. The system 100 finds the loads / stores that need to load BI, but instead of finding it from the BI register 18, the system 100 starts with the loads / stores that are close to the root load and unwinds. The system 100 identifies the load / store that can use the BI register due to another load / store. The system 100 repeats until all loads / stores can be overwritten. Example non-limiting instructions are as follows:

[0109] Work_graph = S0-graph;

[0110] save=0;

[0111] While (work_graph also contains loads / stores besides S0) {

[0112] Idom_set = {loads / stores in work_graph immediately dominated by s0}

[0113] For instruction si: load addr or store addr in idom

[0114] p is the path possibility of si;

[0115] Add KILL of {(addr, bi-obj, p)} to si

[0116] Save += p

[0117] }

[0118] Run the data flow again;

[0119] Work_graph = work_graph - idom_set - all loads / stores not using bi-obj are not reached;

[0120] }

[0121] If (saved>1) mark s0 for prefetching BI

[0122] Fig.10 An embodiment of the present invention is shown. Any of the following steps shown may be performed in parallel or in a different order.

[0123] The system 100 provides a one-to-one mapping of boundary information (BI) in the general registers 16 and the BI registers 18 (step 702).

[0124] The system 100 saves the loaded boundary information in the BI register 18 for future use 704. The system 100 provides that the integrity of the boundary information in the BI register 18 is maintained as the program executes 708.

[0125] The system 100 provides for proactive loading of boundary information using one bit of additional control of the load instruction to the BI register 18 (step 710). The compiler 180 determines candidate loads for proactive loading of boundary information.

[0126] The system 100 manages the loading of boundary information to minimize memory bandwidth requirements or hide loading delays. The system uses static program analysis to select beneficial situations. The system 100 determines the prefetching of boundary information based on whether the boundary information loading is reduced. The system 100 determines the prefetching of boundary information based on the determination of hiding delays. The boundary information in the boundary information register 18 is initialized and propagated with program execution.

[0127] Thus, the present invention is able to provide precise protection, where the system 100 protects each buffer with down to byte precision, while still reducing load requests for boundary information. The present invention can be applied to traditional programs such as C / C++ applications, which include arbitrary pointer arithmetic, and the number of buffers to be protected in an application can range from thousands to millions.

[0128] Thus, as shown above, the hardware component is the BI register 18. A one-to-one mapping of the general register 16 to the BI in the BI register 18 is automatically provided. The system 100 saves the boundary information of the load in the BI register 18 for future use. The integrity of the boundary information in the BI register 18 is automatically maintained as the program executes. Pre-active loading of the BI is supported by an additional bit of control on the load instruction.

[0129] The software components include a compiler 180 that determines candidate loads for pre-active loading of boundary information. The compiler 180 also reduces load requests for boundary information, or hides load delays. The system 100 utilizes static program analysis to select beneficial cases.

[0130] The different features shown in the different figures of FIGS. 1 to 10 may be combined, changed or switched between the different examples. Systems 100 and 200 are shown as non-limiting examples for illustration purposes only. Any other configuration may be used. For example, the systems 100 and 200 shown in FIGS. 1 to 10 may also be used in Figures 11 to 15 The hardware and software shown in FIG.

[0131] Fig.11 Another hardware configuration of the system is shown, in which there is an information processing / computer system 1100 according to the present invention, and it preferably has at least one processor or central processing unit (CPU) 1110, which can implement the technology of the present invention in the form of a software program for software intelligence as a service.

[0132] The CPU 1110 is interconnected via a system bus 1112 to a random access memory (RAM) 1114, a read-only memory (ROM) 1116, an input / output (I / O) adapter 1118 (for connecting peripheral devices such as a disk unit 1121 and a tape drive 1140 to the bus 1112), a user interface adapter 1122 (for connecting a keyboard 1124, a mouse 1126, a speaker 1128, a microphone 1132 and / or other user interface devices to the bus 1112), a communications adapter 1134 for connecting the information processing system to a data processing network, the Internet, an intranet, a personal area network (PAN), etc., and a display adapter 1136 for connecting the bus 1112 to a display device 1138 and / or a printer 1139 (e.g., a digital printer, etc.).

[0133] In addition to the hardware / software environment described above, various aspects of the present invention include computer-implemented methods for performing the above methods. As an example, the method can be implemented in the specific environment discussed above.

[0134] For example, this method can be implemented by operating a computer implemented by a digital data processing device to execute a sequence of machine-readable instructions. These instructions can reside in various types of signal-bearing media.

[0135] Thus, this aspect of the invention relates to a programming product comprising a signal bearing storage medium tangibly embodying a program of machine readable instructions executable by a digital data processor in combination with the CPU 1110 and the hardware described above to perform the method of the invention.

[0136] Such signal bearing storage media may include, for example, RAM contained within CPU 1110, such as represented by fast access memory.

[0137] Alternatively, the instructions may be contained in another signal-bearing storage medium 1200, such as flash memory 1210 or an optical storage disk 1220 ( Fig.12 ) and can be accessed directly or indirectly by CPU 1110.

[0138] The instructions may be stored on a variety of machine-readable data storage media, whether contained within flash memory 1210, optical disk 1220, computer / CPU 1110, or elsewhere.

[0139] Therefore, the present invention may be a system, method and / or computer program product.The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform various aspects of the present invention.

[0140] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device (e.g., a punch card or a raised structure in a groove with instructions recorded thereon), and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated through a waveguide or other transmission medium (e.g., a light pulse through an optical fiber cable), or an electrical signal transmitted through a wire.

[0141] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0142] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​(such as Smalltalk, C++, etc.) and conventional procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider through the Internet). In certain embodiments, in order to perform various aspects of the present invention, the electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA) can execute the computer-readable program instructions by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0143] Various aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0144] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing apparatus create a device for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0145] These computer-readable program instructions may also be stored in a computer-readable storage medium, which may direct a computer, a programmable data processing apparatus and / or other device to work in a specific manner, so that the computer-readable storage medium in which the instructions are stored includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0146] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0147] Flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in flow chart or block diagram can represent the module, segment or part of instruction, and it comprises one or more executable instructions for realizing the logical function of appointment.In some alternative embodiments, the function mentioned in the frame may not occur in the order mentioned in the figure.For example, two frames shown continuously can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of the frame in each frame of block diagram and / or flow chart illustration and block diagram and / or flow chart illustration can be realized by the dedicated hardware-based system of performing specified function or action or performing the combination of special hardware and computer instruction.

[0148] Reference now Fig.13 , a schematic diagram 1400 of an example of a cloud computing node is shown. Cloud computing node 1400 is only one example of a suitable cloud computing node and is not intended to impose any limitations on the scope of use or functionality of the embodiments of the present invention described herein. Regardless, cloud computing node 1400 can be implemented and / or perform any of the functions set forth above. As previously described, system 100 of FIG. 1 can be used in a system such as Fig.13 (as well as Fig.14 and 15 ) is implemented in a cloud infrastructure of a computer system. In the cloud computing node 1400, there is a computer system / server 1412, which can operate with many other general or special computing system environments or configurations. Examples of well-known computing systems, environments and / or configurations that can be applied to the computer system / server 1412 include, but are not limited to, personal computer systems, server computer systems, thin clients, fat clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems or devices, etc.

[0149] Computer system / server 1412 may be described in the general context of computer system executable instructions, such as program modules, executed by the computer system. In general, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. Computer system / server 1412 may be practiced in a distributed cloud computing environment, where tasks are performed by remote processing devices linked through a communications network. In a distributed cloud computing environment, program modules may be located in local and remote computer system storage media, including memory storage devices.

[0150] like Fig.13 As shown, the computer system / server 1412 in the cloud computing node 1400 is shown in the form of a general-purpose computing device. The components of the computer system / server 1412 may include, but are not limited to, one or more processors or processing units 1416, a system memory 1428, and a bus 1418 that couples various system components including the system memory 1428 to the processor 1416.

[0151] Bus 1418 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, these architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0152] Computer system / server 1412 typically includes a variety of computer system readable media. Such media can be any available media that can be accessed by computer system / server 1412, and it includes volatile and nonvolatile media, removable and non-removable media.

[0153] System memory 1428 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1430 and / or cache memory 1432. Computer system / server 1412 may also include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 1434 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, and commonly referred to as a "hard drive"). Although not shown, a disk drive for reading from and writing to a removable, non-volatile disk (e.g., a "floppy disk") may be provided, as well as an optical drive for reading from or writing to a removable, non-volatile optical disk such as a CD-ROM, DVD-ROM or other optical media. In such instances, each may be connected to bus 1418 via one or more data media interfaces. As will be further depicted and described below, memory 1428 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of an embodiment of the present invention.

[0154] By way of example and not limitation, a program / utility 1440 having a set (at least one) of program modules 1442, as well as an operating system, one or more application programs, other program modules, and program data, may be stored in memory 1428. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a networking environment. Program modules 1442 generally perform the functions and / or methods of embodiments of the invention described herein.

[0155] The computer system / server 1412 may also communicate with: one or more external devices 1414, such as a keyboard, a pointing device, a display 1424, etc.; one or more devices that enable a user to interact with the computer system / server 1412; and / or any device that enables the computer system / server 1412 to communicate with one or more other computing devices (e.g., a network card, a modem, etc.). Such communication may occur via an input / output (I / O) interface 1422. In addition, the computer system / server 1412 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 1420. As shown, the network adapter 1420 communicates with other components of the computer system / server 1412 via a bus 1418. It should be understood that, although not shown, other hardware and / or software components may be used in conjunction with the computer system / server 1412. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems, etc.

[0156] Reference now Fig.14 , depicts an illustrative cloud computing environment 1550. As shown, the cloud computing environment 1550 includes one or more cloud computing nodes 1400, and local computing devices used by cloud consumers can communicate with one or more cloud computing nodes 1400, and the local computing devices such as, for example, personal digital assistants (PDAs) or cellular phones 1554A, desktop computers 1554B, laptop computers 1554C and / or automobile computer systems 1554N. Nodes 1400 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or combinations thereof, as described above. This allows the cloud computing environment 1550 to provide infrastructure, platforms, and / or software as a service for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Fig.14 The types of computing devices 1554A-N shown in are intended for illustration only, and computing node 1400 and cloud computing environment 1550 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0157] Reference now Fig.15 , showing the cloud computing environment 1550 ( Fig.14 ) provides a set of functional abstraction layers. It should be understood in advance that Fig.15 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0158] The hardware and software layer 1600 includes hardware and software components. Examples of hardware components include mainframes, in one example, System; A server based on the RISC (Reduced Instruction Set Computer) architecture, in one example the IBM System; IBM System; IBM systems; storage devices; networks and network components. Examples of software components include network application server software, in one example IBM application server software; and database software, in one instance IBM Database software. (IBM, zSeries, pSeries, xSeries, BladeCerter, WebSphere and DB2 are trademarks of International Business Machines Corporation, registered in many jurisdictions throughout the world).

[0159] Virtualization layer 1620 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications and operating systems; and virtual clients.

[0160] In one example, the management layer 1630 may provide the functionality described below. Resource provisioning provides dynamic procurement of computing resources and other resources used to perform tasks within a cloud computing environment. Metering and pricing provides cost tracking when resources are utilized in a cloud computing environment, as well as billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment provides pre-scheduling and procurement of cloud computing resources, where future demand is anticipated based on the SLA.

[0161] Workload layer 1640 provides examples of functionality that can take advantage of a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include functionality such as mapping and navigation; software development and lifecycle management; virtual classroom education delivery; data analytics processing; transaction processing; and, more specifically, with respect to the present invention, an API and runtime system component that generates search auto-completion suggestions based on contextual input.

[0162] From the detailed description, many features and advantages of the present invention are apparent, therefore, the appended claims are intended to cover all such features and advantages of the present invention that fall within the true spirit and scope of the present invention. In addition, since many modifications and variations will readily occur to those skilled in the art, it is not desired to limit the present invention to the exact construction and operation illustrated and described, and therefore, all suitable modifications and equivalents that fall within the scope of the present invention may be resorted to.

[0163] It should be understood that the present invention is not limited in its application to the construction details and component arrangements set forth in the following description or shown in the accompanying drawings. The present invention can have embodiments other than those described, and can be practiced and executed in various ways. Moreover, it should be understood that the words and terms used herein and the abstract are for descriptive purposes and should not be considered as limiting.

[0164] Therefore, those skilled in the art will appreciate that the concepts upon which the present disclosure is based can be readily used as a basis for designing other structures, methods and systems for carrying out the several purposes of the present invention. It is therefore important that the claims be regarded as including such equivalent constructions as long as they do not depart from the spirit and scope of the present invention.

Claims

1. A method for providing boundary information access, comprising: In response to receiving one or more pointers associated with one or more load / store instructions of one or more programs at a general purpose register, loading one or more boundary information BI registers, wherein the general purpose register and the one or more BI registers are mapped one to one; determining that one or more loads of boundary information associated with the one or more pointers are beneficial loads; prefetching boundary information associated with the one or more beneficial loads into one or more BI registers; loading boundary information associated with one or more of the one or more loads into one or more BI registers; as well as Boundary information is propagated along the execution of the program in one or more BI registers. 2 . The method of claim 1 , wherein the one or more beneficial loads include one or more delayed-hiding loads. 3 . The method of claim 1 , wherein the one or more beneficial loads include a reduced number of loads of boundary information. The method of claim 1 , wherein the determining utilizes static program analysis to select beneficial cases.

5. The method of claim 1, wherein the determining is based on a number of the load / store instructions that will use one or more BI registers for prefetching in the one or more loads. The method of claim 1 , wherein the determining is performed by a compiler running static data analysis.

7. The method according to claim 1, wherein: The one or more BI registers comprise a hardware component.

8. A system for providing access to boundary information, comprising: Memory, which stores computer instructions; as well as A processor configured to execute the computer instructions to implement the method according to any one of claims 1 to 7.

9. A computer program product, comprising a computer-readable storage medium having program instructions, wherein the program instructions can be read and executed by a computer to cause the computer to perform the method for providing boundary information access according to any one of claims 1 to 7.

Images