Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Intel has recently added new instructions to their instruction set to support bounds checking. Intel calls them the Memory Protection Extensions (MPX), and they are described in Chapter 9 of this manual. In a nutshell, you can use the new MPX instructions to load a base and upper limit into special registers before doing a memory operation; the processor will then check that the memory address is within bounds and will trap if not. Basically, this is hardware-level support for bounds checking.

This looks highly intriguing. Up until now, one of the major challenges with deploying automatic bounds-checking for C and C++ programs is performance: if a compiler option will slow down your program by 50%, or 10%, many developers may be reluctant. This hardware extension sounds like the sort of thing that could potentially address the performance address, and maybe also make it easier for compilers to enable automatic bounds-checking with less complexity in the compiler code.

So, is this useful in practice? Do any existing compilers offer support for hardware-accelerated bounds checking using these instructions? Are there any measurements on what the performance overhead of this kind hardware-accelerated bounds checking?

share|improve this question
    
For c/c++ the main challenge is associating the bounds with a pointer. For for .net and java this could give a nice speedup. –  CodesInChaos Nov 9 '13 at 9:59

1 Answer 1

There is apparently a development branch of gcc that includes support for bounds-checking using the MPX extensions. It looks interesting. No performance numbers are provided.

The AddressSanitizer project has experimented with using the MPX extensions in their project, but their reactions are mixed. They predict that for some programs this approach might be very fast, but for others it might be slow. It's hard to know for sure.

One challenge is that no shipping processor supports the MPX (at present), so it is hard to know exactly how well or poorly this will perform. All we can do right now is run the code inside an emulator, not run it on an actual hardware CPU.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.