IP Library Granted Patent US 12,669,947
Granted Patent B2
US 12,669,947 · App. 17/957,814 · Granted Jun 30, 2026

Memory safety with single memory tag per allocation

Inventors: David M. Durham (Beaverton, OR); Michael LeMay (Hillsboro, OR); Sergej Deutsch (Hillsboro, OR); Dan Baum (Haifa, IL)
Assignee: Intel Corporation
G06F3/0631G06F3/0604G06F3/0659G06F3/0679
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,669,947
App. No.
17/957,814
Granted
Jun 30, 2026
Kind
B2
Abstract

A processor includes a register to store an encoded pointer for a memory address within a first memory allocation of a plurality of memory allocations in a memory region of a memory. The processor further includes circuitry to receive a memory operation request based on the encoded pointer and to obtain a first tag of a plurality of tags stored in a table in the memory. Each memory allocation of the plurality of memory allocations is associated with a respective one of the plurality of tags stored in the table. The circuitry is to further obtain pointer metadata stored in the encoded pointer and to determine whether to perform a memory operation corresponding to the memory operation request based, at least in part, on a determination of whether the first pointer metadata corresponds to the first tag.

Claims (62)

1 . A processor, comprising:

a register to store an encoded pointer for a memory address within a first memory allocation of a plurality of memory allocations in a memory region of a memory; and

circuitry to:

receive a memory operation request based on the encoded pointer;

obtain a first tag of a plurality of tags stored in a table in the memory, wherein each memory allocation of the plurality of memory allocations is associated with a respective one of the plurality of tags stored in the table;

obtain first pointer metadata stored in the encoded pointer; and

determine whether to perform a memory operation corresponding to the memory operation request based, at least in part, on a determination of whether the first pointer metadata corresponds to the first tag.

2 . The processor of claim 1 , wherein the table is to include a plurality of sets of metadata associated respectively with the plurality of memory allocations, wherein each tag of the plurality of tags is included in a respective one of the plurality of sets of metadata.

3 . The processor of claim 2 , wherein the plurality of memory allocations is associated with at least two different allocation sizes.

4 . The processor of claim 1 , wherein a first set of metadata stored in the table is associated with the first memory allocation and includes the first tag, wherein the first memory allocation is defined by a first allocation size.

5 . The processor of claim 4 , wherein based on the first allocation size corresponding to a single granule, the first set of metadata includes only the first tag.

6 . The processor of claim 4 , wherein based on the first allocation size corresponding to two granules, the first set of metadata includes the first tag and a descriptor.

7 . The processor of claim 4 , wherein based on the first allocation size corresponding to more than two granules, the first set of metadata includes the first tag, a descriptor, and at least one instance of bounds information.

8 . The processor of claim 4 , wherein the first set of metadata is indexed in the table based on a first midpoint of a first slot in the memory to which the first memory allocation is assigned, wherein the memory is apportioned into a plurality of slots associated with a plurality of slot sizes based on multiple power of two numbers.

9 . The processor of claim 8 , wherein the table is to include a plurality of entries and the first set of metadata is to be stored in one or more entries of the plurality of entries.

10 . The processor of claim 9 , wherein each one of the plurality of entries corresponds to a midpoint of a respective slot having a first slot size of one granule of the memory, and wherein each adjacent pair of entries in the table corresponds to a respective slot having a second slot size of two or more granules of the memory.

11 . The processor of claim 8 , wherein the circuitry is further to:

determine a first memory location of the first set of metadata based on the first midpoint of the first slot to which the first memory allocation is assigned.

12 . The processor of claim 4 , wherein the circuitry is further to:

obtain second pointer metadata from the encoded pointer;

in response to determining that the second pointer metadata represents a size corresponding to more than two granules, obtain a descriptor from the first set of metadata;

obtain at least first bounds information from the first set of metadata;

determine a first bounds of the first memory allocation based on the first bounds information and the descriptor; and

determine whether the memory address is within the first bounds.

13 . The processor of claim 1 , wherein the circuitry is further to:

obtain second pointer metadata from the encoded pointer; and

in response to determining that the second pointer metadata in the encoded pointer represents a power corresponding to a single granule of the memory, determine whether the first pointer metadata corresponds to the first tag.

14 . The processor of claim 1 , wherein the first memory allocation is a contiguous range of linear addresses.

15 . The processor of claim 1 , wherein the first memory allocation of a contiguous range of physical addresses.

16 . The processor of claim 1 , wherein the first memory allocation is a page of the memory.

17 . The processor of claim 1 , wherein the circuitry is further to:

in response to a second determination that the first pointer metadata does not correspond to the first tag, enable a software exception handler to take an action.

18 . The processor of claim 17 , wherein the circuitry is further to:

in response to determining that an object cache of a core of the circuitry contains a first set of metadata containing the first tag, clear the first set of metadata from the object cache;

clear the first set of metadata from the table in the memory; and

synchronize at least one or more other object caches of one or more other cores of the circuitry.

19 . The processor of claim 1 , wherein the memory is apportioned into a plurality of slots associated with a plurality of slot sizes based on multiple power of two numbers, wherein two or more of the plurality of tags are to be clustered in the memory based on a first slot size, and wherein two or more other tags of the plurality of tags are to be clustered in the memory based on a second slot size.

20 . One or more non-transitory machine readable media comprising instructions that, when executed by a processor, cause the processor to:

receive a memory operation request based on an encoded pointer for a memory address within a first memory allocation of a plurality of memory allocations in memory;

obtain a first tag of a plurality of tags stored in a table in the memory, wherein each memory allocation of the plurality of memory allocations is associated with a respective one of the plurality of tags stored in the table;

obtain first pointer metadata stored in the encoded pointer; and

determine whether to perform a memory operation corresponding to the memory operation request based, at least in part, on a determination of whether the first pointer metadata corresponds to the first tag.

21 . The one or more non-transitory machine readable media of claim 20 , wherein the table is to include a plurality of sets of metadata associated respectively with the plurality of memory allocations, wherein each tag of the plurality of tags is included in a respective one of the plurality of sets of metadata.

22 . A system, comprising:

memory circuitry including a memory region apportioned into a plurality of slots;

processor circuitry including a register to store an encoded pointer for a memory address within a first memory allocation of a plurality of memory allocations in the memory region; and

memory controller circuitry to:

receive a memory operation request based on the encoded pointer;

obtain a first tag of a plurality of tags stored in a table in the memory circuitry, wherein each memory allocation of the plurality of memory allocations is associated with a respective one of the plurality of tags stored in the table;

obtain first pointer metadata stored in the encoded pointer; and

based, at least in part, on a determination that the first pointer metadata corresponds to the first tag, perform a memory operation corresponding to the memory operation request.

23 . The system of claim 22 , wherein the plurality of memory allocations is associated with at least two different allocation sizes, and wherein the first memory allocation is a contiguous range of linear addresses, a contiguous range of physical addresses, or a page of memory.

24 . A method, comprising:

receiving, by a processor a memory operation request based on an encoded pointer for a memory address within a first memory allocation of a plurality of memory allocations in memory;

obtaining a first tag of a plurality of tags stored in a table in the memory, wherein the first tag is associated with the first memory allocation;

obtaining first pointer metadata stored in the encoded pointer; and

based, at least in part, on a determination that the first pointer metadata corresponds to the first tag, performing a memory operation corresponding to the memory operation request.

25 . The method of claim 24 , further comprising:

receiving a second memory operation request based on a second encoded pointer to a second memory address within a second memory allocation of the plurality of memory allocations in the memory;

determining that a second tag associated the second memory allocation is omitted from an object cache;

specifying, by an exception handler in software, an index for an object cache entry in the object cache; and

overwriting metadata in the object cache entry by storing the second tag in the object cache entry based on the index.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 3, 2022
From: DURHAM, DAVID M.; LEMAY, MICHAEL; DEUTSCH, SERGEJ; BAUM, DAN
To: INTEL CORPORATION
Reel/Frame 061294/0293 →
Continuity (2)
Provisional Application 63349011 · Jun 3, 2022
Related Publication 20230393769A1 · Dec 7, 2023
References Cited (10)
US 20200125742A1 · Kounavis · 2020 [cited by examiner]
US 20210405896A1 · Durham · 2021 [cited by examiner]
“Armv8.5—A Memory Tagging Extension,” Arm, White Paper, Aug. 2, 2019, retrieved from https://developer.arm.com/documentation/102925/0100 (9 pages). [cited by applicant]
Bannister, Steve, “Memory Tagging Extension: Enhancing memory safety through architecture,” Arm Community Blogs, Architectures and Processor blog, Aug. 5, 2019, retrieved from https://community.arm.com/arm-community-blo… [cited by applicant]
Bernhard, Lukas et al., “xTag: Mitigating User-After-Free Vulnerabilities via Software-Based Pointer Tagging on Intel x86-64,” Cornell University, arXiv:2203.04117 [cs.CR], Mar. 8, 2022, 18 pages, retrieved from https:/… [cited by applicant]
Bialek, Joe et al., “Security Analysis of Memory Tagging,” githubusercontent.com, Mar. 2020, retrieved from https://raw.githubusercontent.com/microsoft/MSRC-Security-Research/master/papers/2020/Security%20analysis%20of%… [cited by applicant]
Chen, Tony et al., “Pointer Tagging for Memory Safety,” microsoft.com, Jul. 19, 2019, 23 pages, retrieved from https://www.microsoft.com/en-us/research/uploads/prod/2019/07/Pointer-Tagging-for-Memory-Safety.pdf (23 page… [cited by applicant]
Gretton-Dann, Matthew, “Arm A-Profile Architecture Developments 2018: Armv8.5-A,” Arm Community Blogs, Architectures and Processor blog, Sep. 17, 2018, retrieved from https://community.arm.com/arm-community-blogs/b/arch… [cited by applicant]
Mitsunami, Koki, “Delivering enhanced security through Memory Tagging Extension,” Arm Community Blogs, Architectures and Processor blog, Jun. 24, 2021, retrieved from https://community.arm.com/arm-community-blogs/b/arch… [cited by applicant]
Serebryany, Kostya et al., “Memory Tagging and how it improves C/C++ memory safety,” arXiv.org, Feb. 26, 2018, retrieved from https://arxiv.org/pdf/1802.09517 (14 pages). [cited by applicant]