Jump to content

Intel MPX

From Wikipedia, the free encyclopedia

Intel MPX(Memory Protection Extensions) are discontinued set of extensions to thex86instruction set architecture.Withcompiler,runtime libraryandoperating systemsupport, Intel MPX claimed to enhance security tosoftwareby checkingpointer referenceswhose normal compile-time intentions are maliciously exploited at runtime due tobuffer overflows.In practice, there have been too many flaws discovered in the design for it to be useful, and support has been deprecated or removed from most compilers and operating systems. Intel has listed MPX as removed in 2019 and onward hardware in section 2.5 of its Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 1.[1]

Extensions

[edit]

Intel MPX introduces new boundsregisters,and newinstruction setextensions that operate on these registers. Additionally, there is a new set of "bound tables" that store bounds beyond what can fit in the bounds registers.[2][3][4][5][6]

MPX uses four new 128-bit bounds registers,BND0toBND3,each storing a pair of 64-bit lower bound (LB) and upper bound (UB) values of a buffer. The upper bound is stored inones' complementform, withBNDMK(create bounds) andBNDCU(check upper bound) performing the conversion. The architecture includes two configuration registersBNDCFGx(BNDCFGUin user space andBNDCFGSin kernel mode), and a status registerBNDSTATUS,which provides a memory address and error code in case of an exception.[7][8]

Two-level address translation is used for storing bounds in memory. The top layer consists of a Bounds Directory (BD) created on the application startup. Each BD entry is either empty or contains a pointer to a dynamically created Bounds Table (BT), which in turn contains a set of pointer bounds along with the linear addresses of the pointers. The bounds load (BNDLDX) and store (BNDSTX) instructions transparently perform the address translation and access bounds in the proper BT entry.[7][8]

Intel MPX was introduced as part of theSkylakemicroarchitecture.[9]

IntelGoldmontmicroarchitecture also supports Intel MPX.[9]

Software support

[edit]
  • glibcremoved support in version 2.35.
  • GNU Compiler Collection(GCC) 5.0 added support for MPX.[10]In 2018, support for these extensions waned due to maintenance burdens andInteldevelopers intermittently contributing patches, resulting in a proposal to drop support in GCC 9.0.[11]Support was removed in GCC 9.1.[12]
  • Intel C++ Compiler(icc) 15.0 added support for Intel MPX.[10]
  • Kernel-level software support for Intel MPX was merged into theLinux kernel mainlinein kernel version 3.19, which was released on February 8, 2015.[13][14]In 2018, Thomas Gleixner proposed removing MPX support from Linux kernel 4.18.[15]The pull request with its removal was posted in December 2018, during 4.20 development cycle,[16]but wasn't accepted. The second attempt was made in July 2019.[17]MPX support was removed in 5.6.[18]
  • QEMUsupported MPX since version 2.6[19]and dropped its support in 4.0 release.[20]
  • Microsoft Visual Studio 2015Update 1 added experimental support for MPX.[21]

Analysis of Intel MPX

[edit]

A study examined a detailed cross-layer dissection of the MPX system stack and comparison with three prominent software-based memory protection mechanisms (AddressSanitizer,SAFECode, and SoftBound) and presents the following conclusions.[8]

  • Even though Intel MPX is a specially designed hardware-assisted approach with its own added set of hardware registers, it is not faster than any of the software-based approaches. New Intel MPX instructions can cause up to 4× slowdown in the worst case, although compiler optimizations amortize it and lead to runtime overheads of ~50% on average.
  • In contrast to the other software-based solutions, Intel MPX provides no protection against temporal memory safety errors.
  • Reading and writing from the doubly-indirected bounds tables is not thread-safe.
  • MPX does not support several commonC/C++programming idioms, such asflexible array members,referencing one field as an offset from another, etc.
  • MPX conflicts with some other ISA extensions, resulting in performance and security issues. More specifically, these issues arise when Intel MPX is used in combination with other hardware-based protection mechanisms, such asIntel TSXandIntel SGX.
  • MPX instructions incur a significant performance penalty (15+%) even on Intel CPUs without MPX support.

In addition, a review concluded MPX was not production ready, andAddressSanitizerwas a better option.[8]A review by Kostya Serebryany at Google, AddressSanitizer's developer,[22]had similar findings.[23]

Meltdown

[edit]

Another study[24]exploring the scope ofSpectreandMeltdownsecurity vulnerabilities discovered that Meltdown can be used to bypass Intel MPX, using the Bound Range Exceeded (#BR) hardware exception. According to their publication, the researchers were able to leak information through a Flush+Reload covert channel from an out-of-bound access on an array safeguarded by the MPX system. Their Proof Of Concept has not been publicly disclosed.

See also

[edit]

References

[edit]
  1. ^Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 1: Basic Architecture.Intel.November 2020.Retrieved2021-03-03.
  2. ^"Intel ISA Extensions".Intel.Retrieved2013-11-04.
  3. ^"Introduction to Intel Memory Protection Extensions".Intel.2013-07-16.Retrieved2013-09-10.
  4. ^"Discussion of Intel Memory Protection Extensions (MPX) and comparison with AddressSanitizer".code.google.Retrieved2013-11-04.
  5. ^"Intel® Memory Protection Extensions (Intel® MPX) support in the GCC compiler".gcc.gnu.org.Retrieved2013-11-04.
  6. ^"Intel MPX Explained: Storing bounds in memory".intel-mpx.github.io.Retrieved2017-02-06.
  7. ^ab"Intel Architecture Instruction Set Extensions Programming Reference"(PDF).Intel.December 2013.Retrieved2014-01-17.
  8. ^abcd Oleksenko, Oleksii; Kuvaiskii, Dmitrii; Bhatotia, Pramod; Felber, Pascal; Fetzer, Christof (2017). "Intel MPX Explained: An Empirical Study of Intel MPX and Software-based Bounds Checking Approaches".arXiv:1702.00719[cs.CR].
  9. ^ab"Intel Software Development Emulator".Intel.2012-06-15.Retrieved2013-11-04.
  10. ^ab"Design of Intel MPX".Intel.
  11. ^"GCC 9 Looks Set To Remove Intel MPX Support".Phoronix.Retrieved2018-04-27.
  12. ^"Intel MPX Support Removed From GCC 9 - Phoronix".phoronix.
  13. ^"Linux kernel 3.19, Section 1.2. Support for the Intel Memory Protection Extensions".kernelnewbies.org.February 9, 2015.RetrievedFebruary 9,2015.
  14. ^Jonathan Corbet (January 29, 2014)."Supporting Intel MPX in Linux".LWN.net.RetrievedFebruary 9,2015.
  15. ^"The Linux Kernel Might Drop Memory Protection Extensions Support".Phoronix.
  16. ^"[GIT PULL] x86: remove Intel MPX".
  17. ^"[PATCH 0/3] [RFC] x86: start the MPX removal process".
  18. ^"Intel MPX Support Is Dead With Linux 5.6 - Phoronix".phoronix.
  19. ^"ChangeLog/2.6".
  20. ^"QEMU 4 arrives with toys for Arm admirers, RISC-V revolutionaries, POWER patriots... you get the idea".The Register.
  21. ^"Visual Studio 2015 Update 1: New Experimental Feature – MPX".Microsoft.2016-01-20.
  22. ^Serebryany, Konstantin."Konstantin Serebryany".Google Research.Archived fromthe originalon 2023-07-27.Retrieved2024-07-18.
  23. ^"AddressSanitizerIntelMemoryProtectionExtensions".GitHub.Archivedfrom the original on 2024-07-18.Retrieved2013-11-04.
  24. ^Canella, Claudio; Van Bulck, Jo; Schwarz, Michael; Lipp, Moritz; von Berg, Benjamin; Ortner, Philipp; Piessens, Frank; Evtyushkin, Dmitry; Gruss, Daniel (2018). "A Systematic Evaluation of Transient Execution Attacks and Defenses".arXiv:1811.05441[cs.CR].
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Intel_MPX&oldid=1235325282"