x86 Instruction Set – Security (CET, SGX, TDX, SEV, SMX, MPX)

Introduction

These sets protect code and data, each against a different threat:

• CET (Control-flow Enforcement Technology) stops attacks that redirect returns and indirect jumps. A shadow stack keeps a second copy of each return address, in pages that ordinary stores cannot write, and a return faults (#CP) when the two differ. Indirect branch tracking makes every indirect call and jmp land on an endbr. Intel’s Tiger Lake brought both in 2020; AMD’s Zen 3 the same year brought shadow stacks only. CPUID leaf 7: ECX bit 7 for shadow stacks, EDX bit 20 for indirect branch tracking.
• SGX (Software Guard Extensions), from Intel’s Skylake in 2015, runs part of a program in an enclave, memory that is encrypted and that not even the operating system can read. Intel has since dropped it from its desktop and laptop processors, from the 11th-generation Core on, and kept it on Xeon. CPUID leaf 7: EBX bit 2.
• TDX (Trust Domain Extensions, Intel) and SEV-SNP (Secure Encrypted Virtualization with Secure Nested Paging, AMD) run whole virtual machines whose memory the hypervisor can neither read nor remap. TDX came with the 4th- and 5th-generation Xeon processors in 2023; SEV-SNP with the EPYC 7003 (Milan) in 2021, CPUID leaf 8000_001Fh: EAX bit 4.
• SMX (Safer Mode Extensions), Intel’s Trusted Execution Technology, starts a measured, trusted environment from a known state. CPUID leaf 1: ECX bit 6.
• PCONFIG and PBNDKB program the keys of Intel’s memory and storage encryption engines.
• MPX (Memory Protection Extensions), from Skylake in 2015, checked pointers against bounds in four new registers, bnd0 to bnd3. It was little used, and Intel has withdrawn it: its newer processors lack it, and GCC and Linux have dropped support. It is still in Intel’s manual, and the disassembler decodes it. CPUID leaf 7: EBX bit 14.

Most of these instructions run only at privilege level 0, or only inside an enclave or a guest. SGX, SMX, TDX and SEV pick a function with a leaf number in EAX or RAX, as CPUID does: one opcode covers many operations.

The instructions

In the forms, r32 and r64 are general registers, bnd a bound register in ModRM.reg, and m a memory operand. NP means that no 66, F2 or F3 prefix may be present.

Notes

• Prefixes pick the instruction. 0F 01 CC to CF, FD to FF and E8 to EA each hold several of these instructions, told apart by the 66, F2 or F3 prefix, and some only in 64-bit mode. Outside 64-bit mode the disassembler, as LLVM does, leaves the 64-bit-only ones out and shows the plain form, such as rdpru for F3 0F 01 FD.
• Shadow-stack faults. A mismatched return, a bad token or a missing endbr raises #CP (control protection, vector 21).
• ENDBR on other processors. 0F 1E lies in the hint no-operation space, so processors without CET run endbr32 and endbr64 as no-operations, which is why compilers can emit them everywhere.

Links