Intel MPX, BNDSTX, BNDLDX

Question

Intel MPX, described in the following document for those new to it: https://software.intel.com/sites/default/files/managed/68/8b/319433-019.pdf

I'm not sure I understand how BNDLDX and BNDSTX work. Take, for example, BNDSTX.

From the document (p. 855):

"BNDSTX is used to store the boundaries associated with the buffer, and the" pointer value "of the pointer to this buffer to write the related table through address translation using a two-level structure, see section 9.3.8. For example, the software has a buffer with boundaries stored in BND0, the buffer pointer is located in ESI, the following sequence will store the "pointer value" (buffer) and boundaries in the associated record of the binding table, using address translation from the linear address associated with the base of the SIB addressing form, yaschey of the base register and index register "

MOV ECX, Dword ptr [ESI] ; store the pointer value in the index register ECX MOV EAX, ESI ; store the pointer in the base register EAX BNDSTX Dword ptr [EAX+ECX], BND0 ; perform address translation from the linear address of the base EAX and store bounds and pointer value ECX onto a bound table entry. 

The example shows that ESI contains some pointer, if so, then the first instruction mov ecx, dword ptr [esi] makes simple mov by indirect addressing and retrieves the dword of any esi pointing to ecx, this is what I mean by them pointer or do they mean something else? What is the purpose of this and how does this relate to the address translation performed by BNDSTX?

The second command seems quite intuitive, it just wants to save this pointer in the buffer and make a copy of it. However, why this is strictly necessary is also a bit strange. Doesn't BND0 already contain the beginning of the buffer? Not just duplicating a lower bound pointer? And again, exactly, what purpose is this "pointer value" I do not understand.

Answer 1

Intel's example is very poorly worded. ESI initially contains a pointer to a pointer to buf. The pointer value is checked because code without MPX could change the value of the pointer without changing the bounds. If this happens, the boundaries are invalidated by the BNDLNX statement:

From https://software.intel.com/sites/default/files/managed/0d/53/319433-022.pdf :

BNDLDX uses a linear address constructed from the base register and the offset of the SIB addressing form of the memory operand (mib) to perform address translation for accessing a linked table record and conditional boundary load in the BTE to the destination. The destination register is updated with restrictions in the BTE if the contents of the mib index register matches the pointer value stored in the BTE.

If the comparison of pointer values ​​fails, the destination is updated with the INIT bounds (lb = 0x0, ub = 0x0) (note: as stated above, the upper bound is represented using 1 complement, therefore, the 0x0 value of the upper bound allows access to the full memory )