PR_MPX_ENABLE_MANAGEMENT(2)

✨ PR_MPX_ENABLE_MANAGEMENT(2) ✨

Okay bestie, this is the System Calls Manual page for PR_MPX_ENABLE_MANAGEMENT(2) 💖 Let's get into it 🫶

🎀 NAME 🎀

PR_MPX_ENABLE_MANAGEMENT, PR_MPX_DISABLE_MANAGEMENT — turn kernel management of Memory Protection eXtensions (MPX) on or off 🦋

📚 LIBRARY 📚

Standard C library (libc, -lc) 🌸

💅 SYNOPSIS 💅

#include <linux/prctl.h>  /* Definition of PR_* constants */
#include <sys/prctl.h>

[[deprecated]] int prctl(PR_MPX_ENABLE_MANAGEMENT, 0L, 0L, 0L, 0L);
[[deprecated]] int prctl(PR_MPX_DISABLE_MANAGEMENT, 0L, 0L, 0L, 0L);

Heads up, both of these are deprecated 💀

✨ DESCRIPTION ✨

Okay so these two calls let you flip kernel management of MPX bounds tables on or off 🔥

MPX is a hardware-assisted way to do bounds checking on pointers 🧚 The CPU has a set of registers that store bounds info, plus some special instruction prefixes that tell it which instructions should get bounds enforcement. Literally there are only so many of those registers, so once you have more pointers than registers, the contents have to get "spilled" into a set of tables. Those tables are called "bounds tables", and the MPX prctl() operations decide whether the kernel is the one handling their allocation and freeing 👑

When management is enabled, the kernel takes over allocating and freeing the bounds tables 🫶 It does this by catching the #BR exceptions that pop up the first time you touch a bounds table that doesn't exist yet. Instead of passing the exception along to user space, the kernel allocates the table and fills the bounds directory with the location of the new one. When it comes to freeing, the kernel checks for bounds tables sitting around for memory that isn't allocated anymore, and frees them if it finds any 🧹

Before you turn on MPX management with PR_MPX_ENABLE_MANAGEMENT, your app has to first allocate a user-space buffer for the bounds directory, then put the address of that directory in the bndcfgu register 📝 Don't skip this step, bestie 🙈

These calls will fail if the CPU or kernel doesn't support MPX 💀 Kernel support is controlled by the CONFIG_X86_INTEL_MPX configuration option. To check if your CPU supports MPX, look for the mpx CPUID bit. You can do that with this command:

cat /proc/cpuinfo | grep ' mpx '

⚠️ A thread is not allowed to switch in or out of long (64-bit) mode while MPX is enabled. Be careful with that one, it's a whole vibe.

Also, all threads in a process get affected by these calls, so it's not a per-thread thing 🧵

The child of a fork(2) inherits the MPX management state 🍓 During execve(2), MPX management gets reset as if PR_MPX_DISABLE_MANAGEMENT had been called 🌈

🎯 RETURN VALUE 🎯

On success, you get 0 back ✨ On error, you get -1 back, and errno gets set to tell you what went wrong 💜

🚨 ERRORS 🚨

• ENXIO — The kernel or the CPU doesn't support MPX management. Double-check that both the kernel and your processor have MPX support 😭

📜 STANDARDS 📜

None. 🤷‍♀️

⏳ HISTORY ⏳

This was added in Linux 3.19, then removed in Linux 5.4, and it was only ever on x86 🦋

Due to a lack of toolchain support, PR_MPX_ENABLE_MANAGEMENT and PR_MPX_DISABLE_MANAGEMENT are not supported in Linux 5.4 and later. So yeah, they're gone 💀

🔗 SEE ALSO 🔗

prctl(2) 💖

If you want more on Intel MPX, check out the kernel source file Documentation/x86/intel_mpx.txt 📖✨

---

Okay bestie, that's the whole page 🫶 This came from the Linux man-pages 6.9.1 project, last updated 2024-06-01 🌸 Stay iconic, stay safe with your pointers 💅💖