Software and hardware combined fine-grained memory protection mechanism

Abstract

The invention relates to a software and hardware combined fine-grained memory protection mechanism, which realizes high-speed mapping from a physical address to a fine-grained permission label by integrating a metadata search unit and a metadata conversion lookup buffer on a critical path of a processor loading / storage unit. An operating system maintains a multi-level fine-grained permission metadata table in a main memory, and the minimum memory protection granularity is refined to a 64-byte sub-page level. When a processor executes a memory access instruction, address conversion and permission verification are completed in parallel, an access type and a permission label are compared in real time within 1-2 clock periods, and when permission conflicts are detected, high-priority abnormity is triggered immediately, and illegal addresses and fault types are reported accurately. The method supports instruction set extension, buffer overflow protection, multi-level metadata management and user mode and kernel mode differentiated authority control, reduces the influence on the performance of the processor while improving the security of the memory, and is suitable for a computing system with high security and high performance.

Description

Technical Field

[0001] This application relates to the field of…, and in particular to a fine-grained memory protection mechanism that combines hardware and software. Background Technology

[0002] In current computer architectures, whether mainstream RISC or Complex Instruction Set Computing (CISC) processors, memory security primarily relies on the Memory Management Unit (MMU) and page table mechanisms. Process isolation and basic memory protection are achieved through page-level access control. However, the minimum protection granularity of this mechanism is typically fixed at the 4KB page level. Its design prioritizes address translation efficiency and hardware implementation complexity, rather than optimization for fine-grained memory security issues. As modern software systems continue to grow in scale and program execution paths become increasingly complex, memory security vulnerabilities are becoming more frequent and covert. In particular, buffer overflows, out-of-bounds reads and writes, and use-after-free vulnerabilities mostly occur between different data objects within the same page. Traditional page-level protection mechanisms cannot distinguish access permissions for different memory regions within a page, thus failing to provide effective protection and creating a long-standing "page-level security blind spot."

[0003] To address the aforementioned issues, the industry has proposed various improvement solutions, but all have significant limitations. On the one hand, pure software protection technologies verify memory accesses at the instruction level through compiler instrumentation, runtime boundary checks, or shadow memory. While these methods do not require additional hardware support, they significantly increase the number of instructions and memory accesses, leading to high performance overhead and increased energy consumption, which is unacceptable in high-performance computing or real-time systems. On the other hand, pure hardware solutions, such as tagged memory architectures, capability-based security mechanisms, or all-hardware memory tagging systems, can provide high-precision protection at the byte level or cache line level. However, these solutions typically require deep reconstruction of the processor pipeline, cache hierarchy, memory controller, and bus protocol. This not only results in complex and costly hardware implementations but also makes it difficult to integrate with existing operating systems, compilers, and application software ecosystems, hindering their widespread application on general-purpose computing platforms.

[0004] Regarding the aforementioned technologies, the inventors believe that, while ensuring high compatibility with existing architectures, how to refine memory protection granularity from the traditional page level to the 64-byte cache line level or even the subpage level through hardware and software collaboration, while controlling access verification latency within the acceptable range of the processor pipeline, has become a key technical problem that urgently needs to be solved in the fields of architecture and system security. Existing technologies lack a fine-grained memory protection mechanism that can effectively balance performance, implementation cost, and security. This is precisely the technical background and practical need that this invention attempts to address. Summary of the Invention

[0005] To address the technical challenges of achieving an effective balance between performance, implementation cost, and security in fine-grained memory protection mechanisms, this application provides a hardware-software integrated fine-grained memory protection mechanism.

[0006] The fine-grained memory protection mechanism combining hardware and software provided in this application adopts the following technical solution: A fine-grained memory protection mechanism combining hardware and software, characterized in that the method includes: Hardware acceleration integration: Hardware acceleration integration integrates a metadata lookup unit on the critical path of the processor core's load / store unit and sets up a dedicated metadata translation backup buffer, which is used to cache the mapping relationship between physical addresses and fine-grained permission tags. Fine-grained permission management: Fine-grained permission management is achieved by the operating system building and maintaining a multi-level fine-grained permission metadata table in the main memory. The multi-level fine-grained permission metadata table stores the permission information of the memory area and sets the minimum protection granularity to the 64-byte subpage level. Parallel verification process: When the processor executes a memory access instruction, the load / store unit initiates the standard address translation process and the metadata lookup unit's lookup and comparison process for fine-grained permission tags in parallel to eliminate verification delay; Low-latency verification: The metadata lookup unit first obtains the permission tag from the metadata conversion backup buffer, and compares and verifies the obtained tag with the access type of the current instruction in real time through combinational logic within one or two clock cycles. Precise exception triggering: If the metadata lookup unit detects a permission conflict, it immediately generates a high-priority, fine-grained memory protection exception and prevents the completion of the current memory access operation; Information Report: The hardware automatically records the precise virtual address and fault type that caused the anomaly into a dedicated control status register for the operating system to capture and analyze.

[0007] By adopting the above technical solution, without changing the existing page-level memory management architecture, a fine-grained memory protection mechanism with hardware and software collaboration is introduced. This effectively refines memory access control granularity to the 64-byte subpage level, enabling precise access control over different memory regions within a page. This compensates for the shortcomings of traditional page-level protection in page-level security. By integrating a metadata lookup unit on the critical path of the processor load / store unit and setting a dedicated metadata translation backup buffer, fine-grained permission tag lookup and standard address translation are executed in parallel, significantly reducing the additional latency caused by access verification and minimizing the impact on processor pipeline performance. Furthermore, combined with the multi-level fine-grained permission metadata table maintained by the operating system, flexible configuration and dynamic management of memory permissions are achieved. When unauthorized access is detected, a high-priority exception is triggered immediately, and the violation address and fault type are accurately reported, effectively preventing security issues such as buffer overflows and out-of-bounds access. This achieves a good balance between security, performance, and compatibility, improving the overall memory security protection capability of the system.

[0008] Optionally, the lookup latency of the metadata translation backup buffer is optimized to 1-2 clock cycles, which is comparable to the address translation latency of the standard address translation backup buffer, thereby ensuring that the impact of fine-grained verification on processor pipeline performance is minimized.

[0009] By adopting the above technical solution, the lookup latency of the metadata translation backup buffer is optimized to 1-2 clock cycles, making the latency of fine-grained permission verification basically consistent with the standard address translation latency. This enables memory access permission checks to be completed with almost no increase in processor pipeline wait time, optimizes and ensures that the impact of fine-grained memory protection mechanism on processor performance is minimized, and achieves high-speed, real-time permission verification, providing reliable technical support for in-page security protection in high-performance computing environments.

[0010] Optionally, when searching for permission tags, the metadata lookup unit uses the intra-page block index of the physical address (e.g., 6 bits) as part of the index to directly locate the permission tag of the target block in the 64 64-byte protection blocks within the 4-kilobyte page.

[0011] By adopting the above technical solution, the permission tag of the target memory block is directly located using the intra-page block index of the physical address, enabling fast access and verification of 64 64-byte protection blocks within a 4-kilobyte page. This reduces the complexity and latency of permission lookup, allowing fine-grained memory protection to achieve efficient and precise access control at the subpage level. The hardware-level direct indexing mechanism ensures that the permission verification process is highly parallel to regular memory access, improving the overall system performance and security.

[0012] Optionally, the method further includes an extension to the instruction set architecture, introducing the following custom instructions: an atomic label setting instruction, used by privileged software to atomically update the permission label corresponding to a specified physical address to a new value; and a metadata cache refresh instruction, used to invalidate cache entries in the metadata conversion back buffer corresponding to the address range after the operating system modifies the multi-level fine-grained permission metadata table, so as to ensure the consistency of the software and hardware states.

[0013] By adopting the above technical solutions, atomic tag setting instructions and metadata cache refresh instructions are introduced into the instruction set architecture to achieve efficient management and consistent maintenance of fine-grained permission tags. The atomic tag setting instructions ensure that privileged software can safely and without contention update memory block permissions, while the metadata cache refresh instructions can promptly invalidate the corresponding cache entries after the operating system modifies the permission metadata table, preventing old permission information from affecting access control, improving system security, and ensuring that the impact of fine-grained permission management on processor performance is minimized.

[0014] Optionally, the fine-grained memory protection anomaly can report the precise virtual address and permission label status of the violation to the operating system through a dedicated control status register, and the operating system can distinguish the anomaly from a page-level protection fault.

[0015] By adopting the above technical solutions, precise control of memory access permissions can be achieved through hardware and software collaboration. The introduced custom instructions enable the operating system or privileged software to atomically update permission tags and refresh metadata cache in a timely manner, ensuring the consistency and real-time nature of permission information, preventing unauthorized access due to permission lag, and enhancing system security in a multi-tasking environment. At the same time, while ensuring access control precision, performance overhead is minimized, achieving a balance between fine-grained memory protection and efficient operation.

[0016] Optionally, the fine-grained memory protection mechanism is used for hardware-assisted buffer overflow protection, and is implemented through the following steps: when allocating a buffer, the compiler or runtime library reserves at least one 64-byte aligned protection block at the end; when updating the multi-level fine-grained permission metadata table, the operating system sets the permission tag of the protection block to prohibit write permissions.

[0017] By adopting the above technical solution, buffer overflows are effectively protected at the hardware level. An aligned protection block is reserved at the end of the buffer and its permission is set to prohibit writing. Any out-of-bounds write will immediately trigger a fine-grained memory protection exception to prevent illegal memory access. This mechanism does not rely on software detection and can identify and block overflow attacks in real time and accurately. At the same time, it is compatible with existing applications and effectively improves system security and memory access reliability.

[0018] Optionally, the fine-grained permission metadata table adopts a multi-level hierarchical structure, with its lowest-level entry pointing to a metadata page. The metadata page stores a set of permission tags for all 64 64-byte protection blocks within a 4-kilobyte page.

[0019] By adopting the above technical solution, the multi-level hierarchical fine-grained permission metadata table enables permission information to be organized hierarchically. The lowest-level entry points to the metadata page, and the permission tags of all 64 64-byte protection blocks within a 4-kilobyte page are centrally stored. This reduces memory overhead, improves the hit rate and access speed of permission lookup, and ensures the precision of fine-grained memory protection while minimizing the impact on processor pipeline performance.

[0020] Optionally, the permission tag is a 4-8 bit encoded field, which includes at least independent read permission bits, write permission bits, and execute permission bits, as well as an allocation status identifier used to encode whether the memory block has been legally allocated.

[0021] By adopting the above technical solution, the 4-8 bit permission tag not only independently identifies read, write, and execute permissions, but also records the legal allocation status of memory blocks through the allocation status identifier. This enables the hardware to quickly determine whether the access is legal when performing memory access verification, supports fine-grained permission management at the subpage level, improves memory security, effectively prevents out-of-bounds access and illegal operations, and maintains the low-latency characteristics of permission verification without significantly affecting processor performance.

[0022] Optionally, the metadata translation backup buffer adopts a replacement and consistency maintenance strategy that is parallel to or partially shared with the standard address translation backup buffer. When a process context switch, address space identifier switch, or page table update occurs, the metadata translation backup buffer entries are selectively invalidated or refreshed based on the address space identifier or process identifier to avoid interference between fine-grained permission tags of different processes.

[0023] By adopting the above technical solutions, fine-grained memory protection consistency and isolation can be achieved in multi-task and multi-process environments. The metadata conversion backup buffer adopts a parallel or partially shared replacement strategy, and combines address space identifiers or process identifiers to selectively invalidate or refresh entries, ensuring that the permission tags of different processes do not interfere with each other when switching processes or updating page tables.

[0024] Optionally, the fine-grained memory protection mechanism further supports differentiated permission control between user mode and kernel mode. The permission tag includes a privilege level identifier. When the hardware performs memory access verification, it makes a comprehensive judgment based on the current processor privilege level to distinguish the access permissions of the same physical memory block under different privilege levels and enhance the memory isolation security between the operating system kernel and user programs.

[0025] By adopting the above technical solution, differentiated access control between user mode and kernel mode can be implemented on the same physical memory block. The permission tag contains a privilege level identifier bit. When the hardware performs memory access verification, it makes a real-time judgment based on the current privilege level of the processor, preventing low-privilege programs from illegally accessing high-privilege memory areas. This strengthens the isolation between the operating system kernel and user programs, improves the overall security of the system, and achieves efficient and precise fine-grained permission management without additional software intervention.

[0026] In summary, this application includes at least one of the following beneficial technical effects: Achieve fine-grained memory protection at the subpage level: Through a hardware and software collaborative mechanism, the granularity of memory access permission control is refined to the 64-byte subpage level, enabling precise access control over different memory regions within a page, effectively compensating for the shortcomings of traditional page-level protection in terms of in-page security.

[0027] Low-latency, high-performance verification: A metadata lookup unit is integrated on the critical path of the processor load / store unit, and a dedicated metadata translation backup buffer is set up to enable fine-grained permission lookup and standard address translation to be executed in parallel, significantly reducing verification latency and ensuring that the impact on processor pipeline performance is minimized.

[0028] Dynamic permission management and consistency maintenance: By combining the multi-level fine-grained permission metadata table maintained by the operating system with custom instructions, it enables flexible configuration, atomic updates and cache refresh of permission tags, ensuring consistency of software and hardware status, and supporting dynamic memory allocation and multi-tasking environments.

[0029] High-precision anomaly detection and reporting: When unauthorized access or buffer overflow is detected, the hardware immediately triggers a high-priority anomaly and accurately reports the violation address and fault type through a dedicated control status register, which facilitates timely response and security protection of the operating system.

[0030] Buffer overflow protection: By reserving a protection block at the end of the buffer and setting write restrictions, hardware-level real-time protection is achieved to prevent out-of-bounds writes and enhance the overall memory security of the system.

[0031] Multi-process and privilege level isolation: Supports selective refresh of metadata cache in multi-tasking and multi-process environments, and combines privilege level identifiers to realize differentiated permission control between user mode and kernel mode, strengthen memory isolation between kernel and user programs, and improve system security.

[0032] Balancing security, performance, and compatibility: While maintaining high security capabilities, it minimizes the impact on processor performance and does not require major modifications to the existing page-level memory management system, achieving compatibility with the existing software ecosystem. Attached Figure Description

[0033] Figure 1 This is a hardware design architecture diagram of the fine-grained memory protection mechanism in an embodiment of this application.

[0034] Figure 2 This is a flowchart illustrating the execution of key instructions for the fine-grained memory protection mechanism in this application embodiment. Detailed Implementation

[0035] The following is in conjunction with the appendix Figure 1-2 This application will be described in further detail.

[0036] This application discloses a fine-grained memory protection mechanism combining hardware and software. (Refer to...) Figure 1 and Figure 2 This includes hardware acceleration integration: hardware acceleration integration is performed on the critical path of the processor core's load / store unit, integrating a metadata lookup unit and setting up a dedicated metadata translation backup buffer, which is used to cache the mapping relationship between physical addresses and fine-grained permission tags. Fine-grained permission management: Fine-grained permission management is achieved by the operating system building and maintaining a multi-level fine-grained permission metadata table in the main memory. The multi-level fine-grained permission metadata table stores the permission information of the memory area and sets the minimum protection granularity to the 64-byte subpage level. Parallel verification process: When the processor executes a memory access instruction, the load / store unit initiates the standard address translation process and the metadata lookup unit's lookup and comparison process for fine-grained permission tags in parallel to eliminate verification delay; Low-latency verification: The metadata lookup unit first obtains the permission tag from the metadata conversion backup buffer, and compares and verifies the obtained tag with the access type of the current instruction in real time through combinational logic within one or two clock cycles. Precise exception triggering: If the metadata lookup unit detects a permission conflict, it immediately generates a high-priority, fine-grained memory protection exception and prevents the completion of the current memory access operation; Information Report: The hardware automatically records the precise virtual address and fault type that caused the anomaly into a dedicated control status register for capture and analysis by the operating system. While maintaining the existing page-level memory management architecture, this technical solution introduces a hardware-software co-operational fine-grained memory protection mechanism, refining access control down to 64-byte subpages to achieve precise access control within pages, thus compensating for the shortcomings of page-level protection. By integrating a metadata lookup unit and a dedicated translation backup buffer into the critical path of the processor load / storage unit, permission tag lookup and address translation are executed in parallel, reducing verification latency and minimizing the impact on pipeline performance. Combined with the multi-level permission metadata table maintained by the operating system, permissions can be flexibly and dynamically managed, and exceptions can be triggered immediately and violations can be accurately reported in case of unauthorized access, effectively preventing buffer overflows and out-of-bounds access, balancing security, performance, and compatibility.

[0037] The purpose of this technical solution is to provide a fine-grained memory protection mechanism that combines hardware and software. By working together with processor hardware expansion and operating system management, it achieves subpage-level permission verification for memory access with extremely low runtime performance overhead, thereby significantly enhancing the system's ability to defend against in-page security vulnerabilities.

[0038] This application aims to provide an innovative hardware-software co-processing fine-grained memory protection mechanism. The method embeds a dedicated hardware acceleration unit into the processor core of a reduced instruction set computer (RISC) system and, in conjunction with the operating system, performs fine-grained management of memory permission metadata. This reduces the minimum granularity of memory protection from the 4-kilobyte page level to the 64-byte cache line level. This periodic parallel verification capability provides robust defense against in-page security vulnerabilities with extremely low runtime performance overhead. 1. Processor core hardware architecture expansion and integration To achieve extremely low verification latency, this patent features a finely crafted microarchitectural extension on the critical path of memory access in the processor core.

[0039] 1.1 Integration and Functionality of the Metadata Lookup Unit in the Load / Storage Unit The metadata lookup unit is the core hardware verifier for fine-grained verification in this patent. It is precisely integrated into the load / store unit of the processor pipeline, located between the instruction execution phase and the memory access phase. This unit employs a parallel lookup mechanism, ensuring its workflow is completely parallel to standard address translation. When the instruction decoder issues a load or store request, the load / store unit simultaneously initiates two parallel lookup processes: one is address translation, where the memory management unit and its address translation back buffer are responsible for converting virtual addresses to physical addresses; the other is permission lookup, initiated simultaneously by the metadata lookup unit, which obtains the fine-grained permission tag for the corresponding address by accessing the metadata translation back buffer. This parallel strategy allows the latency of fine-grained permission verification to be hidden behind the address translation latency, and when the metadata translation back buffer is hit, it introduces almost no additional latency to the processor core pipeline. The permission verification combinational logic module is a key circuit within the metadata lookup unit. Based on high-speed combinational logic design, it can complete permission comparison within a single clock cycle. This logic circuit receives the following key input signals: first, a fine-grained permission tag obtained from the metadata conversion back buffer, which is a 4- to 8-bit field encoding permission information; second, the current access type, i.e., the operation type signal provided by the instruction (read, write, or execute). The verification logic is responsible for decoding the permission bits in the tag and comparing them bit by bit with the actual access type. For example, if the tag indicates that the memory block is read-only, but the load / store unit is currently receiving a write operation signal, the combinational logic will immediately output a high-level permission conflict signal. The collision signal injection mechanism prioritizes collision signals generated by the metadata lookup unit. These signals are rapidly injected into the pipeline control logic, ensuring that related operations are effectively intercepted before data is actually written to or read from the data cache.

[0040] 1.2 Structure and Low-Latency Optimization of Metadata Transformation Backup Buffer The metadata translation back buffer is a high-speed on-chip cache dedicated to caching physical address-to-fine-grained permission tag mappings. Its existence is crucial for ensuring high performance through fine-grained protection. In terms of structural characteristics, the metadata translation back buffer adopts a high-way set-associative or fully associative structure. The high associativity is chosen primarily to maximize cache hit rate, because if the metadata translation back buffer is missing, the processor needs to access the fine-grained permission metadata table in main memory, which will result in a delay of hundreds of clock cycles. Optimizations for low latency are achieved primarily through two levels. First, the physical design has been specifically optimized, including hardware layout and circuit design, employing custom low-latency cells to ensure that lookup path latency is strictly controlled within 1-2 clock cycles. Second, its indexing and lookup tags are mainly based on the high-order bits of the physical address and the intra-page block index used to identify 64-byte blocks. This physical address-based indexing design makes its lookup process independent of the virtual address translation process, thereby simplifying synchronization issues with the address translation backup buffer.

[0041] Each cache entry contains the following parts: physical address label, valid bits, least recently used bits, and most importantly, 4-8 bit permission labels.

[0042] In terms of replacement strategy, the metadata translation lookup buffer typically employs the least recently used algorithm or an approximation of it. When a miss occurs, the processor writes a new mapping obtained from main memory to a group of the metadata translation lookup buffer, replacing the least recently accessed old entry in that group.

[0043] 2. Fine-grained permission metadata management system Another key component of this technical solution is the fine-grained permission metadata table established and maintained by the operating system at the software level.

[0044] 2.1 Hierarchical Structure and Physical Address Mapping Mechanism of Fine-Grained Permission Metadata Table The fine-grained permission metadata table is designed with a multi-level hierarchical structure, mimicking the existing page table structure. This hierarchical design has a key advantage: it ensures that only the memory regions actually used require storage space for the fine-grained permission metadata table, thus effectively conserving memory resources. To achieve 64-byte granularity mapping, the physical address is partitioned and indexed as follows. First, the high-order bits of the physical address are used to index the higher-level directory of the fine-grained permission metadata table, progressing layer by layer until the metadata area within the storage page is located. Second, the intra-page block index (6 bits) is the core of fine-grained mapping. Within a standard 4-kilobyte page, there are 64 64-byte fine-grained protection blocks. These 64 blocks are uniquely identified by 6 bits in the physical address. During the lowest-level lookup of the fine-grained permission metadata table, these 6 bits are directly used to locate the permission tag of the target 64-byte block. Judging from the content of the entries, the lowest-level entries in the fine-grained permission metadata table point to a dedicated 4KB metadata page. This page does not store program data, but rather stores the set of permission tags in a compact format for all 64 64-byte blocks within the corresponding 4KB page. Since each tag occupies only 4 to 8 bits, the space required to store all 64 tags is very small, which ensures that the fine-grained permission metadata table has high storage efficiency.

[0045] 2.2 Fine-grained coding and functions of permission tags Permission tags are the smallest unit of permission stored in the fine-grained permission metadata table and the metadata transformation back buffer. They are typically stored in a 4- to 8-bit encoded form, carrying detailed security information. The basic access permission bits in the tag contain at least three independent control bits. The read permission bit controls whether loading the 64-byte block is allowed; the write permission bit controls whether storing the memory block is allowed; and the execute permission bit controls whether the contents of the 64-byte block are interpreted as instructions and executed. Beyond basic permissions, the remaining bits are used as status and type identifiers to support richer and more enhanced security policies. The allocation status identifier marks whether the 64-byte block has been legally allocated to the current process by the operating system. This helps detect unauthorized access to unallocated memory regions. The pointer type identifier, in systems supporting advanced security policies, marks whether the memory block stores pointer data. If marked as non-pointer data, the system can prohibit certain pointer-related operations on it. Furthermore, security domain identifiers are used to distinguish different security domains or trusted areas. For example, different identifiers can be assigned to data with different security levels, thereby preventing lower-security-level domains from accessing data in higher-security-level areas.

[0046] 3. Periodic parallel access verification process and pipeline control The core technological advantage of this patent lies in its minimal impact on the processor pipeline and its ability to provide precise, real-time responses to various fine-grained security violations. 3.1 Periodic Alignment of Parallel Search and Verification The lookup request is initiated when the instruction enters the memory access phase of the pipeline. The load / store unit simultaneously sends lookup requests to both the address translation back buffer and the metadata translation back buffer to initiate address translation and permission tag lookup in parallel. Subsequently, the address translation backup buffer returns the physical address, and the metadata translation backup buffer returns the authorization label. This result return process typically completes within the first or second clock cycle. Next, the synchronous verification phase begins. The verification logic of the metadata lookup unit uses both the returned permission tag and the instruction access type signal to complete permission comparison and verification within one clock cycle. Since the three key steps of address translation, tag lookup, and permission verification are highly overlapping and closely aligned in time, the actual impact of the entire fine-grained protection mechanism on processor performance can be controlled to within the additional overhead incurred only when the metadata translation backup buffer is missing. 3.2 Mechanism for handling missing backup buffers after metadata transformation When the metadata lookup unit cannot find the required tag in the metadata transformation back buffer, a missing tag handling process is triggered, and the following operations are performed: First, the pipeline is paused. The metadata lookup unit immediately generates a pause signal and injects it into the pipeline control logic. This operation temporarily freezes the execution of subsequent instructions. Its purpose is to prevent the processor from continuing to use memory addresses or data that have not undergone fine-grained permission verification. Next, the system will initiate a memory access lookup of the fine-grained permission metadata table. The control logic of the metadata lookup unit will initiate a series of memory access requests to the main memory based on the current physical address and the multi-level hierarchical structure of the fine-grained permission metadata table. This process may require accessing 2 to 4 cascaded fine-grained permission metadata table directories in sequence, and each memory access operation may cause a delay of tens of clock cycles. Afterwards, the system will perform the writing of the metadata translation back buffer and pipeline resumption. Once the correct permission tag is successfully obtained from the fine-grained permission metadata table, the control logic of the metadata lookup unit will perform the following operations: first, write the new physical address-to-permission tag mapping relationship into the metadata translation back buffer; second, use this new permission tag to complete the permission verification of the currently suspended instruction; finally, release the pipeline pause signal, allowing the processor to resume execution. Although memory access operations to fine-grained permission metadata tables have high overhead, the metadata translation back buffer typically has a very high hit rate, making these high-overhead events extremely infrequent in actual operation. Therefore, overall, this mechanism still ensures excellent average system performance. 3.3 Precise Anomaly Triggering and Fault Information Reporting This technical solution introduces a novel fine-grained memory protection exception, which is designed to precisely handle security violations occurring within a page. Upon detecting a permission violation, the system immediately injects an exception. Specifically, once the metadata lookup unit completes verification and confirms failure, it immediately generates a fine-grained memory protection exception signal and injects it into the processor core's exception handling logic. This new exception is prioritized higher than standard page-level protection exceptions to ensure that the processing core can respond to and handle fine-grained security issues first. At the same time, the hardware mechanism automatically records detailed violation information. The precise virtual address that triggered the violation, the type of operation that occurred, and the privilege level at that time are all automatically recorded in a dedicated set of control status registers. This design enables precise fault location. By reading these dedicated control status registers, the operating system can accurately obtain the specific 64-byte memory block address where the fault occurred, along with a detailed explanation of the violation. This capability provides powerful and accurate support for security auditing, vulnerability analysis, and process debugging, offering a level of detail far exceeding traditional mechanisms, which typically only report the address range of the problematic 4-kilobyte page.

[0047] 4. Software interface, instruction set, and system support The effectiveness and manageability of this technical solution depend on the operating system's fine-grained management of extended hardware.

[0048] 4.1 Expansion and Management of Control Status Registers This technical solution introduces a new set of control status registers into the processor architecture, serving as a hardware and software interface for managing fine-grained memory protection functions. This set of registers mainly comprises three categories. First, configuration registers are used to control hardware units. The metadata lookup unit control bits allow privileged mode software to enable or disable all functions of the metadata lookup unit. The fine-grained privilege metadata table base address register stores the starting address of the root directory of the fine-grained privilege metadata table in physical memory; the processor uses this address as the starting point when performing a lookup of the fine-grained privilege metadata table. The metadata translation back buffer control register is used to configure various parameters of the metadata translation back buffer, such as replacement policy, cache granularity, and partition information. Secondly, there's the status information register, used to monitor the system's runtime status. The hit rate counter records the total number of accesses and hits to the metadata translation back buffer in real time, allowing the operating system to monitor the actual effect of hardware acceleration. The exception status register stores the current working status of the metadata lookup unit, such as whether it's in the process of handling a missing metadata translation back buffer. The last category is the fault information register, which is specifically used to record detailed information about abnormal events. The fault virtual address register stores the precise virtual address that caused the fine-grained protection failure. The fault cause encoding register stores a specific encoded value to identify the specific type of fault. 4.2 Custom Instruction Set Extensions and Atomic Operations To ensure that the operating system can safely and atomically manipulate the fine-grained permission metadata table and the metadata transition back buffer state, this patent introduces the following new custom instructions. Atomic tag setting instructions allow privileged software to atomically update the permission tags of a 64-byte protected block within a specified physical address range to a new value. This atomicity ensures that in a multi-core processor environment, even if multiple cores are simultaneously allocating memory and setting permissions, permission conflicts will not occur due to race conditions. The metadata cache refresh instruction is a mandatory synchronization instruction. This instruction must be executed whenever the operating system makes any modifications to the fine-grained permission metadata table in main memory. This instruction instructs the metadata lookup unit hardware to immediately invalidate all cache entries in the metadata translation back buffer that are related to the modified address, thereby ensuring that subsequent memory accesses can be forced to reload the latest permission information from the fine-grained permission metadata table. 4.3 Cooperative Integration of Operating System and Application Layers The ultimate security effect of this patent relies on the cooperative support of the operating system kernel, application compiler, and runtime library. Its cooperative design is mainly reflected in the following aspects: At the operating system level, memory management needs to be extended. This requires the operating system to implement a synchronous update mechanism, meaning that when allocating and reclaiming memory, both the standard page table and the fine-grained permission metadata table must be updated simultaneously. Specifically, when allocating a 4-kilobyte page, the operating system, while updating the standard page table, also needs to calculate the initial permission tags for the 64 64-byte blocks within that page and write them to the fine-grained permission metadata table in main memory. Simultaneously, the operating system must also extend its exception handlers to identify and handle fine-grained memory protection exceptions generated by the metadata lookup unit. By reading dedicated fault registers, the operating system can accurately identify violations and execute corresponding security policies accordingly. One of the most direct applications of this application is to implement hardware-assisted buffer overflow protection. This requires support from the compiler or runtime library to ensure that the buffer is aligned to 64 bytes when it is allocated, and to reserve at least one or more 64-byte protection blocks at the end of the actual allocated area. Then, when the operating system sets the fine-grained permission metadata table, it will mark the permission tags of these protection blocks as write-prohibited or access-prohibited. In this way, once program code or malware attempts to access or write to the adjacent protection block due to a buffer overflow, the metadata lookup unit will immediately detect the permission conflict and trigger a precise exception. This mechanism can effectively prevent attacks before data is illegally overwritten, thereby achieving highly efficient and extremely accurate hardware-assisted security protection.

[0049] The fine-grained memory protection mechanism combining hardware and software proposed in this application has the following significant advantages in terms of security, performance, and cost control compared to traditional page-level protection mechanisms, pure software runtime inspection schemes, and pure hardware tagging architectures: 1. Extremely low runtime performance overhead and high-performance acceleration: The hardware extension design of this application integrates the metadata lookup unit into the critical path of the load / store unit, and, in conjunction with the high-speed caching capability of the metadata translation back buffer, achieves periodic parallelization of fine-grained permission verification. This means that the permission verification and address translation process for memory access are performed synchronously. With an extremely high hit rate of the metadata translation back buffer, fine-grained protection introduces almost no additional latency to the processor's instruction pipeline, eliminating performance bottlenecks. In contrast, pure software solutions must insert a large number of additional instructions for dynamic checks, typically leading to a 30% or greater performance drop in applications. This application, through hardware acceleration, reduces runtime performance overhead to a negligible level, greatly improving system throughput and response speed, enabling the deployment of fine-grained security protection even in high-performance computing environments.

[0050] 2. Effectively eliminates security blind spots within pages, achieving precise security protection: This application refines the smallest granularity of memory protection from a coarse 4-kilobyte page to a 64-byte cache line level. This leapfrog improvement in granularity completely eliminates the security blind spots existing in traditional page-level protection mechanisms within pages. The introduction of fine-grained permission tags allows the operating system to set independent read, write, and execute permissions for different 64-byte blocks within the same 4-kilobyte page. Especially for critical vulnerabilities such as buffer overflows, this mechanism can achieve hardware-assisted buffer overflow protection: by marking the 64-byte protected block immediately adjacent to the buffer as write-prohibited in the fine-grained permission metadata table, any attempt to write beyond the boundary will be intercepted in real time by the metadata lookup unit within 1-2 clock cycles and trigger an exception, thus successfully preventing attacks before data corruption. This high-precision, high-real-time protection capability is unattainable by any existing pure software or coarse-grained hardware solution.

[0051] 3. High architectural compatibility and low hardware cost: The hardware extension of this application has strong locality and compatibility. It is mainly achieved by locally integrating metadata lookup units and metadata translation back buffers in the load / store unit, without the need for large-scale modifications to the processor's entire cache hierarchy, memory controller, or bus protocol. This design strategy greatly reduces chip area overhead, design complexity, and dynamic power consumption. The hardware implementation cost is far lower than that of tagged architectures that require modification of the entire memory subsystem. At the same time, this mechanism interacts with the existing RISC computer instruction set architecture through a small number of custom instructions and control status registers, ensuring good compatibility with the mainstream hardware ecosystem and facilitating the rapid deployment and promotion of the technology.

[0052] 4. Provides accurate fault reporting and high manageability: The exception handling mechanism designed in this application provides unparalleled fault accuracy. When the metadata lookup unit detects a fine-grained permission conflict, the triggered fine-grained memory protection exception can report the precise virtual address and fault type of the violation to the operating system through a dedicated control status register. This precise 64-byte granular information enables the operating system to perform fine-grained exception handling, such as terminating only the thread or security domain where the error occurred, rather than simply and brutally terminating the entire process. This greatly simplifies the system's security auditing, vulnerability analysis, and runtime debugging, and improves the system's reliability and maintainability. In addition, the permission metadata is atomically managed by the operating system through extended custom instructions, giving the system a high degree of flexibility and allowing security policies to be dynamically adjusted and switched according to runtime requirements.

[0053] The technical problem this solution aims to solve is how to achieve fine-grained memory protection at the 64-byte level without significantly reducing performance. Although there are various solutions in the existing technical field that attempt to solve memory security problems, these alternatives have insurmountable structural defects in terms of performance overhead, hardware cost, architecture compatibility, memory resource consumption, or protection granularity. They cannot achieve the high-performance, high-precision collaborative protection effect on the existing processor architecture with extremely low runtime overhead, as this patent does.

[0054] Alternative Solution 1: Pure Software Runtime Dynamic Inspection Solution Alternative Solution 1 relies entirely on software to achieve fine-grained protection, primarily through compiler instrumentation or binary rewriting techniques. It inserts additional runtime boundary checks before and after each memory access instruction. These code segments dynamically read and compare pointer security metadata. The core drawback of Alternative Solution 1 lies in its enormous performance overhead. Each memory access operation expands from a single instruction to a sequence of multiple check instructions, leading to a dramatic increase in the number of runtime instructions. Studies show that Alternative Solution 1 typically incurs a performance penalty of 30% or even higher. In throughput- and latency-sensitive applications such as servers, this overhead is an unacceptable structural flaw. Furthermore, its protection scope is incomplete, failing to cover the operating system kernel or dynamically generated runtime code. Additionally, most solutions require shadow memory to store metadata, resulting in memory redundancy overhead several times that of main memory.

[0055] Alternative Solution 2: Fine-grained partitioning scheme based on traditional hardware page table mechanism Alternative Solution 2 attempts to modify the page table mechanism of the existing memory management unit by further dividing the standard 4-kilobyte page into smaller virtual subpages and creating an independent page table entry for each subpage. The fatal flaw of this approach is the exponential expansion of the page table structure. Reducing the page granularity will cause the number of page table entries required to increase exponentially, resulting in a sharp increase in the physical memory space occupied by the entire page table. More seriously, the surge in page table entries will cause a catastrophic increase in the missing rate of the processor address translation back buffer. Each missing address translation back buffer will trigger expensive operating system trap handling and main memory access, resulting in severe performance degradation. Limited by hardware architecture support, the smallest granularity of this solution is also difficult to achieve the 64-byte level required by this patent.

[0056] Alternative Solution 3: Pure Hardware Tagging Architecture Alternative solution 3 requires a complete overhaul of the underlying hardware, attaching a hardware tag to each memory unit and synchronously checking these tags by modifying the processor, cache, and bus protocol. This comprehensive overhaul results in extremely high hardware costs, requiring a huge chip area overhead for tag storage and significantly increasing chip power consumption. From an architectural compatibility perspective, the tagging architecture requires a complete modification of the processor's instruction set architecture and memory access protocol, leading to complete incompatibility with existing RISC computer instruction set architectures. This means that the entire software ecosystem needs to be rebuilt, software porting costs are high, and design verification is extremely difficult due to the modifications involved in all core hardware modules.

[0057] Alternative Solution 4: Capability-Based Architecture Alternative 4 replaces the pointers used in the program with unforgeable capability objects, which encapsulate security information such as address, length, and permissions. Any operation on memory must be verified through a valid capability object. The disadvantage of Alternative 4 is that pointer operations are complex. Since capability objects are usually more complex and occupy more space than traditional pointers, each verification, dereferencing, and permission check of capability objects requires additional hardware logic and execution time, increasing the latency of the processor's critical path. In addition, Alternative 4 also requires large-scale modifications to the operating system kernel and the application's memory allocation model, resulting in extremely high challenges and costs in terms of software portability and compatibility.

[0058] The technical solution of this application successfully avoids the inherent defects of all the above-mentioned alternatives through ingenious hardware and software co-design: Periodic parallel verification is achieved by using a dedicated metadata lookup unit and a metadata conversion backup buffer, avoiding the high-performance overhead of pure software. By constructing an independent, fine-grained permission metadata table, the problem of missing address translation backup buffers caused by page table bloat is avoided. Localized hardware expansion also ensures low hardware costs and good compatibility with existing architectures, thus achieving the best balance between performance and security.

[0059] The implementation principle of the hardware-software combined fine-grained memory protection mechanism in this application embodiment is as follows: Without changing the existing page-level memory management architecture, the operating system constructs and maintains a 64-byte fine-grained permission metadata table in the main memory, and performs atomic updates and consistency maintenance of permission tags through custom instructions; the processor performs address translation and permission tag lookup in parallel in the critical path of the load / store unit, and completes permission verification in 1 to 2 clock cycles with the help of the metadata translation backup buffer. When unauthorized access is detected, memory access is blocked immediately and a high-priority exception is triggered. At the same time, the violation address and fault type are accurately recorded, thereby achieving precise access control and highly reliable memory security protection at the subpage level within the page with extremely low performance overhead.

[0060] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A fine-grained memory protection mechanism combining hardware and software, characterized in that: The method includes: Hardware acceleration integration: Hardware acceleration integration integrates a metadata lookup unit on the critical path of the processor core's load / store unit and sets up a dedicated metadata translation backup buffer, which is used to cache the mapping relationship between physical addresses and fine-grained permission tags. Fine-grained permission management: Fine-grained permission management is achieved by the operating system building and maintaining a multi-level fine-grained permission metadata table in the main memory. The multi-level fine-grained permission metadata table stores the permission information of the memory area and sets the minimum protection granularity to the 64-byte subpage level. Parallel verification process: When the processor executes a memory access instruction, the load / store unit initiates the standard address translation process and the metadata lookup unit's lookup and comparison process for fine-grained permission tags in parallel to eliminate verification delay; Low-latency verification: The metadata lookup unit first obtains the permission tag from the metadata conversion backup buffer, and compares and verifies the obtained tag with the access type of the current instruction in real time through combinational logic within one or two clock cycles. Precise exception triggering: If the metadata lookup unit detects a permission conflict, it immediately generates a high-priority, fine-grained memory protection exception and prevents the completion of the current memory access operation; Information Report: The hardware automatically records the precise virtual address and fault type that caused the anomaly into a dedicated control status register for the operating system to capture and analyze.

2. The method according to claim 1, characterized in that: The lookup latency of the metadata translation backup buffer is optimized to 1-2 clock cycles, which is comparable to the address translation latency of the standard address translation backup buffer, thereby ensuring that the impact of fine-grained verification on processor pipeline performance is minimized.

3. The method according to claim 1, characterized in that: When searching for permission tags, the metadata lookup unit uses the intra-page block index of the physical address (e.g., 6 bits) as part of the index to directly locate the permission tag of the target block in the 64 64-byte protection blocks within the 4-kilobyte page.

4. The method according to claim 1, characterized in that: The method further includes an extension to the instruction set architecture, introducing the following custom instructions: atomic tag setting instruction: used by privileged software to atomically update the permission tag corresponding to a specified physical address to a new value; metadata cache refresh instruction: used to invalidate cache entries in the metadata conversion back buffer corresponding to the address range after the operating system modifies the multi-level fine-grained permission metadata table, so as to ensure the consistency of the software and hardware state.

5. The method according to claim 1, characterized in that: The fine-grained memory protection exception can report the exact virtual address and permission label status of the violation to the operating system through a dedicated control status register. The operating system can distinguish this exception from page-level protection failures.

6. The method according to claim 1, characterized in that: The fine-grained memory protection mechanism is used for hardware-assisted buffer overflow protection and is implemented through the following steps: when allocating a buffer, the compiler or runtime library reserves at least one 64-byte aligned protection block at the end; when the operating system updates the multi-level fine-grained permission metadata table, it sets the permission tag of the protection block to prohibit write permissions.

7. The method according to claim 1, characterized in that: The fine-grained permission metadata table adopts a multi-level hierarchical structure, with its lowest-level entry pointing to a metadata page. The metadata page stores a set of permission tags for all 64 64-byte protection blocks within a 4-kilobyte page.

8. The method according to claim 1, characterized in that: The permission tag is a 4-8 bit encoded field, which includes at least independent read permission bits, write permission bits, and execute permission bits, as well as an allocation status identifier used to encode whether the memory block has been legally allocated.

9. The method according to claim 1, characterized in that: The metadata translation backup buffer adopts a replacement and consistency maintenance strategy that is parallel to or partially shared with the standard address translation backup buffer. When a process context switch, address space identifier switch, or page table update occurs, the metadata translation backup buffer entries are selectively invalidated or refreshed based on the address space identifier or process identifier to avoid interference between fine-grained permission tags of different processes.

10. The method according to claim 1, characterized in that: The fine-grained memory protection mechanism further supports differentiated permission control between user mode and kernel mode. The permission tag includes a privilege level identifier. When the hardware performs memory access verification, it makes a comprehensive judgment based on the current processor privilege level to distinguish the access permissions of the same physical memory block under different privilege levels and enhance the memory isolation security between the operating system kernel and user programs.

Images