Intel MPX

Intel MPX (Memory Protection Extensions) is a set of extensions to the x86 instruction set architecture. With compiler, runtime library and operating system support, Intel MPX brings increased security to software by checking pointer references whose normal compile-time intentions are maliciously exploited at runtime due to buffer overflows.

Extensions

Intel MPX introduces new bounds registers, and new instruction set extensions that operate on these registers. Additionally, there is a new set of "bound tables" that store bounds beyond what can fit in the bounds registers.[1][2][3][4][5]

MPX uses four new 128-bit bounds registers, BND0 to BND3, each storing a pair of 64-bit lower bound (LB) and upper bound (UB) values of a buffer. The upper bound is stored in ones' complement form, with BNDMK (create bounds) and BNDCU (check upper bound) performing the conversion. The architecture includes two configuration registers BNDCFGx (BNDCFGU in user space and BNDCFGS in kernel mode), and a status register BNDSTATUS, which provides a memory address and error code in case of an exception.[6][7]

Two-level address translation is used for storing bounds in memory. The top layer consists of a Bounds Directory (BD) created on the application startup. Each BD entry is either empty or contains a pointer to a dynamically created Bounds Table (BT), which in turn contains a set of pointer bounds along with the linear addresses of the pointers. The bounds load (BNDLDX) and store (BNDSTX) instructions transparently perform the address translation and access bounds in the proper BT entry.[6][7]

Intel MPX was introduced as part of the Skylake microarchitecture.[8]

Intel Goldmont microarchitecture also supports Intel MPX.[8]

Software support

Analysis of Intel MPX

A study examined a detailed cross-layer dissection of the MPX system stack and comparison with three prominent software-based memory safety systems (AddressSanitizer, SAFECode, SoftBound) and presents the following conclusions.[7]

  • Even though Intel MPX is a specially designed hardware-assisted approach, it is not faster than the software-based approaches. New Intel MPX instructions can cause up to 4× slowdown in the worst case, although compiler optimizations amortize it and lead to runtime overheads of ~50% on average.
  • In contrast to other solutions, Intel MPX provides no protection against temporal memory safety errors.
  • Intel MPX does not support multithreading inherently, which can lead to unsafe data races in legacy threaded programs and if compilers do not synchronize bounds explicitly.
  • Intel MPX does not support several common C/C++ programming idioms due to restrictions on the allowed memory layout.
  • Intel MPX is conflicting with some other ISA extensions resulting in performance and security issues. More specifically, these issues arise when Intel MPX is used in combination with Intel TSX and Intel SGX.
  • Lastly, MPX instructions incur significant performance penalty (15+%) even on earlier Intel CPU generations without MPX support (e.g., Haswell).

In addition, a review concluded MPX was not production ready, and AddressSanitizer was a better option.[7] A review by Kostya Serebryany at Google, AddressSanitizer's developer,[15] had similar findings.[16]

See also

References

  1. ↑ "Intel ISA Extensions". Intel. Retrieved 2013-11-04.
  2. ↑ "Introduction to Intel Memory Protection Extensions". Intel. 2013-07-16. Retrieved 2013-09-10.
  3. ↑ "Discussion of Intel Memory Protection Extensions (MPX) and comparison with AddressSanitizer". code.google.com. Retrieved 2013-11-04.
  4. ↑ "Intel® Memory Protection Extensions (Intel® MPX) support in the GCC compiler". gcc.gnu.org. Retrieved 2013-11-04.
  5. ↑ "Intel MPX Explained: Storing bounds in memory". intel-mpx.github.io. Retrieved 2017-02-06.
  6. 1 2 "Intel Architecture Instruction Set Extensions Programming Reference" (PDF). Intel. December 2013. Retrieved 2014-01-17.
  7. 1 2 3 4 Oleksenko, Oleksii; Kuvaiskii, Dmitrii; Bhatotia, Pramod; Felber, Pascal; Fetzer, Christof (2017). "Intel MPX Explained: An Empirical Study of Intel MPX and Software-based Bounds Checking Approaches". arXiv:1702.00719 [cs.CR].
  8. 1 2 "Intel Software Development Emulator". Intel. 2012-06-15. Retrieved 2013-11-04.
  9. 1 2 "Design of Intel MPX". Intel.
  10. ↑ "GCC 9 Looks Set To Remove Intel MPX Support". Phoronix. Retrieved 2018-04-27.
  11. ↑ "Linux kernel 3.19, Section 1.2. Support for the Intel Memory Protection Extensions". kernelnewbies.org. February 9, 2015. Retrieved February 9, 2015.
  12. ↑ Jonathan Corbet (January 29, 2014). "Supporting Intel MPX in Linux". LWN.net. Retrieved February 9, 2015.
  13. ↑ "The Linux Kernel Might Drop Memory Protection Extensions Support". Phoronix.
  14. ↑ "Visual Studio 2015 Update 1: New Experimental Feature – MPX". Microsoft.
  15. ↑ "Konstantin Serebryany - Research at Google". research.google.com.
  16. ↑ "Discussion of Intel Memory Protection Extensions (MPX) and comparison with AddressSanitizer". Google. Retrieved 2013-11-04.
  • Intel Architecture Instruction Set Extensions Programming Reference (PDF). Intel. July 2013. Retrieved 2016-01-10.
  • Oleksenko, Oleksii; Kuvaiskii, Dmitrii; Bhatotia, Pramod; Felber, Pascal; Fetzer, Christof (2017). "Intel MPX Explained: An Empirical Study of Intel MPX and Software-based Bounds Checking Approaches". arXiv:1702.00719 [cs.CR].
  • "Introduction to Intel Memory Protection Extensions". Intel. 2013-07-16. Retrieved 2013-09-10.
  • "Intel ISA Extensions". Intel. Retrieved 2013-11-04.
  • "Intel® Memory Protection Extensions (Intel® MPX) support in the GCC compiler". gcc.gnu.org. Retrieved 2013-11-04.
  • Hansen, Dave (2016-03-16). "Intel® Memory Protection Extensions (Intel® MPX) for Linux". Retrieved 2018-05-17.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.