Multiple Guard Tag Setting Instruction for Memory Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Memory-related errors in compiled code, such as bounds violations, use-after-free, use-after-return, use-out-of-scope, and use-before-initialization errors, are prevalent due to the lack of runtime error checks in memory-unsafe languages like C and C++, making them vulnerable to exploitation by attackers.
Innovation Solution
The implementation of tag-guarded memory access operations within the instruction set architecture, where memory access circuitry compares an address tag with a guard tag stored in the memory system, generating an indication of match or mismatch to control memory access and trigger error handling, and a multiple guard tag setting instruction to efficiently update guard tags for consecutive memory blocks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If guard tags are set for each memory block individually, then memory safety is improved through runtime error detection, but the overhead of setting guard tags increases and productivity decreases
Solution Approach 1:
The patent combines multiple guard tag setting operations into a single instruction (SMT instruction) that can update guard tags for multiple consecutive memory blocks simultaneously. This merging of operations reduces the total number of instructions needed and improves tag setting efficiency while maintaining memory safety through runtime error detection.
Solution Approach 2:
The patent performs guard tag setting as a preliminary action during memory allocation or before bulk memory operations. By setting multiple guard tags in advance using the SMT instruction, the system prepares memory regions for safe access without incurring overhead during actual memory operations, thus improving both reliability and productivity.
2Reliability
If multiple guard tag setting operations are performed sequentially, then memory safety is maintained, but the time required for tag setting increases
Solution Approach 1:
The SMT instruction merges multiple guard tag setting operations into a single atomic operation that updates guard tags for multiple consecutive memory blocks in one execution cycle. This eliminates the sequential overhead and reduces tag setting time while maintaining comprehensive memory safety coverage.
Solution Approach 2:
The patent enables continuous guard tag setting across multiple memory blocks within a single instruction execution, eliminating gaps or delays between individual tag setting operations. This continuous action approach maintains memory safety while minimizing the total time required for tag configuration.
3Reliability
If runtime error detection checks are implemented, then memory safety is improved, but device complexity increases
Solution Approach 1:
The patent implements a self-service mechanism where the guard tag comparison and error detection are automatically performed by the memory access circuitry during normal memory operations. The system serves itself by integrating safety checks into the existing memory access path without requiring additional complex control logic or separate verification processes.
Solution Approach 2:
The guard tag mechanism is designed to work with existing memory access instructions and the existing instruction set architecture. The same memory access circuitry that performs normal read/write operations also performs guard tag comparison, making the safety mechanism universal and applicable to all memory operations without adding specialized complex instructions.
Data Source
AI summary
An apparatus has memory access circuitry to perform a tag-guarded memory access operation in response to a target address. The tag-guarded memory access operation comprises: comparing an address tag associated with the target address with a guard tag stored in a memory system in association with a block of one or more memory locations comprising an addressed location identified by the target address, and generating an indication of whether a match is detected between the guard tag and the address tag. An instruction decoder decodes a multiple guard tag setting instruction to control the memory access circuitry to trigger memory accesses to update the guard tags associated with at least two consecutive blocks of one or more memory locations.