Intel MPX (Memory Protection Extensions) are a discontinued set of extensions to the

x86 x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel, based on the 8086 microprocessor and its 8-bit-external-bus variant, the 8088. Th ...

instruction set architecture In computer science, an instruction set architecture (ISA) is an abstract model that generally defines how software controls the CPU in a computer or a family of computers. A device or program that executes instructions described by that ISA, ...

. With

compiler In computing, a compiler is a computer program that Translator (computing), translates computer code written in one programming language (the ''source'' language) into another language (the ''target'' language). The name "compiler" is primaril ...

runtime library A runtime library is a library that provides access to the runtime environment that is available to a computer program tailored to the host platform. A runtime environment implements the execution model as required for a development environme ...

and

operating system An operating system (OS) is system software that manages computer hardware and software resources, and provides common daemon (computing), services for computer programs. Time-sharing operating systems scheduler (computing), schedule tasks for ...

support, Intel MPX claimed to enhance security to

software Software consists of computer programs that instruct the Execution (computing), execution of a computer. Software also includes design documents and specifications. The history of software is closely tied to the development of digital comput ...

by checking pointer references whose normal compile-time intentions are maliciously exploited at runtime due to buffer overflows. In practice, there have been too many flaws discovered in the design for it to be useful, and support has been deprecated or removed from most compilers and operating systems.

Intel Intel Corporation is an American multinational corporation and technology company headquartered in Santa Clara, California, and Delaware General Corporation Law, incorporated in Delaware. Intel designs, manufactures, and sells computer compo ...

has listed MPX as removed in 2019 and onward hardware in section 2.5 of its Intel® 64 and IA-32 Architectures Software Developer's Manual Volume 1.

Extensions

Intel MPX introduces new bounds registers, and new

instruction set In computer science, an instruction set architecture (ISA) is an abstract model that generally defines how software controls the CPU in a computer or a family of computers. A device or program that executes instructions described by that ISA, s ...

extensions that operate on these registers. Additionally, there is a new set of "bound tables" that store bounds beyond what can fit in the bounds registers. MPX uses four new 128-bit bounds registers, BND0 to BND3, each storing a pair of 64-bit lower bound (LB) and upper bound (UB) values of a buffer. The upper bound is stored in

ones' complement The ones' complement of a binary number is the value obtained by inverting (flipping) all the bits in the Binary number, binary representation of the number. The name "ones' complement" refers to the fact that such an inverted value, if added t ...

form, with BNDMK (create bounds) and BNDCU (check upper bound) performing the conversion. The architecture includes two configuration registers BNDCFGx (BNDCFGU in user space and BNDCFGS in kernel mode), and a status register BNDSTATUS, which provides a memory address and error code in case of an exception. Two-level address translation is used for storing bounds in memory. The top layer consists of a Bounds Directory (BD) created on the application startup. Each BD entry is either empty or contains a pointer to a dynamically created Bounds Table (BT), which in turn contains a set of pointer bounds along with the linear addresses of the pointers. The bounds load (BNDLDX) and store (BNDSTX) instructions transparently perform the address translation and access bounds in the proper BT entry. Intel MPX was introduced as part of the

Skylake Skylake or Sky Lake may refer to: * Skylake (microarchitecture) Skylake is Intel's codename for its sixth generation Core microprocessor family that was launched on August 5, 2015, succeeding the Broadwell microarchitecture. Skylake is a mic ...

microarchitecture. Intel

Goldmont Goldmont is a microarchitecture for low-power Atom, Celeron and Pentium branded processors used in systems on a chip (SoCs) made by Intel. They allow only one thread per core. The ''Apollo Lake'' platform with 14 nm Goldmont core was unve ...

microarchitecture also supports Intel MPX.

Software support

glibc The GNU C Library, commonly known as glibc, is the GNU Project implementation of the C standard library. It provides a wrapper around the system calls of the Linux kernel and other kernels for application use. Despite its name, it now also dir ...

removed support in version 2.35. *

GNU Compiler Collection The GNU Compiler Collection (GCC) is a collection of compilers from the GNU Project that support various programming languages, Computer architecture, hardware architectures, and operating systems. The Free Software Foundation (FSF) distributes ...

(GCC) 5.0 added support for MPX. In 2018, support for these extensions waned due to maintenance burdens and

developers intermittently contributing patches, resulting in a proposal to drop support in GCC 9.0. Support was removed in GCC 9.1. *

Intel C++ Compiler Intel oneAPI DPC++/C++ Compiler and Intel C++ Compiler Classic (deprecated icc and icl is in Intel OneAPI HPC toolkit) are Intel’s C, C++, SYCL, and Data Parallel C++ (DPC++) compilers for Intel processor-based systems, available for Wind ...

(icc) 15.0 added support for Intel MPX. *

Kernel Kernel may refer to: Computing * Kernel (operating system), the central component of most operating systems * Kernel (image processing), a matrix used for image convolution * Compute kernel, in GPGPU programming * Kernel method, in machine learnin ...

-level software support for Intel MPX was merged into the

Linux kernel mainline The Linux kernel is a Free and open-source software, free and open source Unix-like kernel (operating system), kernel that is used in many computer systems worldwide. The kernel was created by Linus Torvalds in 1991 and was soon adopted as the k ...

in kernel version 3.19, which was released on February 8, 2015. In 2018, Thomas Gleixner proposed removing MPX support from Linux kernel 4.18. The pull request with its removal was posted in December 2018, during 4.20 development cycle, but wasn't accepted. The second attempt was made in July 2019. MPX support was removed in 5.6. *

QEMU The Quick Emulator (QEMU) is a free and open-source emulator that uses dynamic binary translation to emulate a computer's processor; that is, it translates the emulated binary codes to an equivalent binary format which is executed by the mach ...

supported MPX since version 2.6 and dropped its support in 4.0 release. * Microsoft Visual Studio 2015 Update 1 added experimental support for MPX.

Analysis

A study examined a detailed cross-layer dissection of the MPX system stack and comparison with three prominent software-based memory protection mechanisms ( AddressSanitizer, SAFECode, and SoftBound) and presents the following conclusions. * Even though Intel MPX is a specially designed hardware-assisted approach with its own added set of hardware registers, it is not faster than any of the software-based approaches. New Intel MPX instructions can cause up to 4× slowdown in the worst case, although compiler optimizations amortize it and lead to runtime overheads of ~50% on average. * In contrast to the other software-based solutions, Intel MPX provides no protection against temporal memory safety errors. * Reading and writing from the doubly-indirected bounds tables is not thread-safe. * MPX does not support several common C/ C++ programming idioms, such as

flexible array member C struct data types may end with a flexible array member with no specified size: struct vectord ; Typically, such structures serve as the header in a larger, variable memory allocation: struct vectord *vector = malloc(...); vector->len ...

s, referencing one field as an offset from another, etc. * MPX conflicts with some other ISA extensions, resulting in performance and security issues. More specifically, these issues arise when Intel MPX is used in combination with other hardware-based protection mechanisms, such as Intel TSX and

Intel SGX Intel Software Guard Extensions (SGX) is a set of instruction codes implementing trusted execution environment that are built into some Intel central processing units (CPUs). They allow user-level and operating system code to define protected priv ...

. * MPX instructions incur a significant performance penalty (15+%) even on Intel CPUs without MPX support. In addition, a review concluded MPX was not production ready, and AddressSanitizer was a better option. A review by Kostya Serebryany at Google, AddressSanitizer's developer, had similar findings.

Meltdown

Another study exploring the scope of

Spectre Spectre, specter or the spectre may refer to: Religion and spirituality * Vision (spirituality) * Apparitional experience * Ghost Arts and entertainment Film and television * ''Spectre'' (1977 film), a made-for-television film produced and writt ...

and Meltdown security vulnerabilities discovered that Meltdown can be used to bypass Intel MPX, using the Bound Range Exceeded (#BR) hardware exception. According to their publication, the researchers were able to leak information through a Flush+Reload covert channel from an out-of-bound access on an array safeguarded by the MPX system. Their Proof Of Concept has not been publicly disclosed.

References

External links