Patchwork [1/3] x86, mpx: add documentation on Intel MPX

login
register
mail settings
Submitter Qiaowei Ren
Date Dec. 6, 2013, 6:52 p.m.
Message ID <1386355976-11732-1-git-send-email-qiaowei.ren@intel.com>
Download mbox | patch
Permalink /patch/298041/
State New
Headers show

Comments

Qiaowei Ren - Dec. 6, 2013, 3:55 p.m.
> -----Original Message-----

> From: Borislav Petkov [mailto:bp@alien8.de]

> Sent: Friday, December 06, 2013 9:27 PM

> To: Ren, Qiaowei

> Cc: Paolo Bonzini; H. Peter Anvin; Ingo Molnar; Thomas Gleixner;

> x86@kernel.org; linux-kernel@vger.kernel.org; qemu-devel@nongnu.org;

> kvm@vger.kernel.org; Xudong Hao; Liu, Jinsong

> Subject: Re: [PATCH 1/3] x86, mpx: add documentation on Intel MPX

> 

> On Sat, Dec 07, 2013 at 02:52:54AM +0800, Qiaowei Ren wrote:

> > This patch adds the Documentation/intel_mpx.txt file with some

> > information about Intel MPX.

> >

> > Signed-off-by: Qiaowei Ren <qiaowei.ren@intel.com>

> > Signed-off-by: Xudong Hao <xudong.hao@intel.com>

> > Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>

> > ---

> >  Documentation/intel_mpx.txt |   77

> +++++++++++++++++++++++++++++++++++++++++++

> 

> Documentation/x86/ is probably a more fitting place for this.

> 

Yes. I will move it to Documentation/x86.

> >  1 files changed, 77 insertions(+), 0 deletions(-)  create mode 100644

> > Documentation/intel_mpx.txt

> >

> > diff --git a/Documentation/intel_mpx.txt b/Documentation/intel_mpx.txt

> > new file mode 100644 index 0000000..3d947d0

> > --- /dev/null

> > +++ b/Documentation/intel_mpx.txt

> > @@ -0,0 +1,77 @@

> > +Intel(R) MPX Overview:

> > +=====================

> > +

> > +Intel(R) Memory Protection Extensions (Intel(R) MPX) is a new

> > +capability introduced into Intel Architecture. Intel MPX can increase

> > +the robustness of software when it is used in conjunction with

> > +compiler changes to check memory references, for those references

> > +whose compile-time normal intentions are usurped

> 

> That's a strange formulation, what does it actually mean? The intentions of

> references??

> 

It is from public introduction and specification, you can refer to http://software.intel.com/en-us/articles/introduction-to-intel-memory-protection-extensions 

Thanks,
Qiaowei
Borislav Petkov - Dec. 6, 2013, 4:06 p.m.
On Fri, Dec 06, 2013 at 03:55:10PM +0000, Ren, Qiaowei wrote:
> It is from public introduction and specification, you can refer to
http://software.intel.com/en-us/articles/introduction-to-intel-memory-protection-extensions

Yep, saw it there too. Which doesn't make it any less strange :)

Btw, if you're going to quote the public documentation, why even add the
text file here? You can simply add the link above as a comment to the
code or as a oneliner somewhere in Documentation/x86/.

Thanks.
Qiaowei Ren - Dec. 6, 2013, 4:11 p.m.
> -----Original Message-----

> From: Borislav Petkov [mailto:bp@alien8.de]

> Sent: Saturday, December 07, 2013 12:06 AM

> To: Ren, Qiaowei

> Cc: Paolo Bonzini; H. Peter Anvin; Ingo Molnar; Thomas Gleixner;

> x86@kernel.org; linux-kernel@vger.kernel.org; qemu-devel@nongnu.org;

> kvm@vger.kernel.org; Xudong Hao; Liu, Jinsong

> Subject: Re: [PATCH 1/3] x86, mpx: add documentation on Intel MPX

> 

> On Fri, Dec 06, 2013 at 03:55:10PM +0000, Ren, Qiaowei wrote:

> > It is from public introduction and specification, you can refer to

> http://software.intel.com/en-us/articles/introduction-to-intel-memory-protecti

> on-extensions

> 

> Yep, saw it there too. Which doesn't make it any less strange :)

> 

> Btw, if you're going to quote the public documentation, why even add the text

> file here? You can simply add the link above as a comment to the code or as a

> oneliner somewhere in Documentation/x86/.

> 

It is just partly from that link, I will modify it to be any less strange. :)

Thanks,
Qiaowei
Qiaowei Ren - Dec. 6, 2013, 6:52 p.m.
This patch adds the Documentation/intel_mpx.txt file with some
information about Intel MPX.

Signed-off-by: Qiaowei Ren <qiaowei.ren@intel.com>
Signed-off-by: Xudong Hao <xudong.hao@intel.com>
Signed-off-by: Liu Jinsong <jinsong.liu@intel.com>
---
 Documentation/intel_mpx.txt |   77 +++++++++++++++++++++++++++++++++++++++++++
 1 files changed, 77 insertions(+), 0 deletions(-)
 create mode 100644 Documentation/intel_mpx.txt

Patch

diff --git a/Documentation/intel_mpx.txt b/Documentation/intel_mpx.txt
new file mode 100644
index 0000000..3d947d0
--- /dev/null
+++ b/Documentation/intel_mpx.txt
@@ -0,0 +1,77 @@ 
+Intel(R) MPX Overview:
+=====================
+
+Intel(R) Memory Protection Extensions (Intel(R) MPX) is a new
+capability introduced into Intel Architecture. Intel MPX can
+increase the robustness of software when it is used in conjunction
+with compiler changes to check memory references, for those
+references whose compile-time normal intentions are usurped
+at runtime due to buffer overflow or underflow.
+
+Two of the most important goals of Intel MPX are to provide
+this capability at very low performance overhead for newly
+compiled code, and to provide compatibility mechanisms with
+legacy software components. A direct benefit Intel MPX provides
+is hardening software against malicious attacks designed to
+cause or exploit buffer overruns.
+
+For details about the Intel MPX instructions, see "Intel(R)
+Architecture Instruction Set Extensions Programming Reference".
+
+Intel(R) MPX Programming Model
+------------------------------
+
+Intel MPX introduces new registers and new instructions that
+operate on these registers. Some of the registers added are
+bounds registers which store a pointer's lower bound and upper
+bound limits. Whenever the pointer is used, the requested
+reference is checked against the pointer's associated bounds,
+thereby preventing out-of-bound memory access (such as buffer
+overflows and overruns). Out-of-bounds memory references
+initiate a #BR exception which can then be handled in an
+appropriate manner.
+
+Loading and Storing Bounds using Translation
+--------------------------------------------
+
+Intel MPX defines two instructions for load/store of the linear
+address of a pointer to a buffer, along with the bounds of the
+buffer into a paging structure of extended bounds. Specifically
+when storing extended bounds, the processor will perform address
+translation of the address where the pointer is stored to an
+address in the Bound Table (BT) to determine the store location
+of extended bounds. Loading of an extended bounds performs the
+reverse sequence.
+
+The structure in memory to load/store an extended bound is a
+4-tuple consisting of lower bound, upper bound, pointer value
+and a reserved field. Bound loads and stores access 32-bit or
+64-bit operand size according to the operation mode. Thus,
+a bound table entry is 4*32 bits in 32-bit mode and 4*64 bits
+in 64-bit mode.
+
+The linear address of a bound table is stored in a Bound
+Directory (BD) entry. And the linear address of the bound
+directory is derived from either BNDCFGU or BNDCFGS registers.
+Bounds in memory are stored in Bound Tables (BT) as an extended
+bound, which are accessed via Bound Directory (BD) and address
+translation performed by BNDLDX/BNDSTX instructions.
+
+Bounds Directory (BD) and Bounds Tables (BT) are stored in
+application memory and are allocated by the application (in case
+of kernel use, the structures will be in kernel memory). The
+bound directory and each instance of bound table are in contiguous
+linear memory.
+
+XSAVE/XRESTOR Support of Intel MPX State
+----------------------------------------
+
+Enabling Intel MPX requires an OS to manage two bits in XCR0:
+  - BNDREGS for saving and restoring registers BND0-BND3,
+  - BNDCSR for saving and restoring the user-mode configuration
+(BNDCFGU) and the status register (BNDSTATUS).
+
+The reason for having two separate bits is that BND0-BND3 is
+likely to be volatile state, while BNDCFGU and BNDSTATUS are not.
+Therefore, an OS has flexibility in handling these two states
+differently in saving or restoring them.