743844-015.pdf - 第43页

More information on Intel ® SHA can be found at: http://software.intel.com/en-us/artT GLes/intel-sha-extensions User Mode Instruction Prevention User Mode Instruction Prevention (UMIP) provides additional hardening capab…

• Providing of architectural definition for platform manufacturer Boot Policy.

• Enforcing manufacturer provided Boot Policy using Intel architectural components.

Benefits of this protection are that Boot Guard can help maintain platform integrity by

preventing re-purposing of the manufacturer’s hardware to run an unauthorized

software stack.

NOTE

Boot Guard availability may vary between the different SKUs.

Intel

Supervisor Mode Execution Protection

Intel

Supervisor Mode Execution Protection (Intel

SMEP) is a mechanism that

provides the next level of system protection by blocking malicious software attacks

from user mode code when the system is running in the highest privilege level. This

technology helps to protect from virus attacks and unwanted code from harming the

system. For more information, refer to Intel

64 Architectures Software Developer’s

Manual, Volume 3 at:

http://www.intel.com/products/processor/manuals

Intel

Supervisor Mode Access Protection

Intel

Supervisor Mode Access Protection (Intel

SMAP) is a mechanism that provides

next level of system protection by blocking a malicious user from tricking the

operating system into branching off user data. This technology shuts down very

popular attack vectors against operating systems.

For more information, refer to the Intel

64 Architectures Software Developer’s

Manual, Volume 3:

http://www.intel.com/products/processor/manuals

Intel

Secure Hash Algorithm Extensions

The Intel

Secure Hash Algorithm Extensions (Intel

SHA Extensions) is one of the

most commonly employed cryptographic algorithms. Primary usages of SHA include

data integrity, message authentication, digital signatures, and data de-duplication. As

the pervasive use of security solutions continues to grow, SHA can be seen in more

applications now than ever. The Intel

SHA Extensions are designed to improve the

performance of these compute-intensive algorithms on Intel

architecture-based

processors.

The Intel

SHA Extensions are a family of seven instructions based on the Intel

Streaming SIMD Extensions (Intel

SSE) that are used together to accelerate the

performance of processing SHA-1 and SHA-256 on Intel architecture-based

processors. Given the growing importance of SHA in our everyday computing devices,

the new instructions are designed to provide a needed boost of performance to

hashing a single buffer of data. The performance benefits will not only help improve

responsiveness and lower power consumption for a given application, but they may

also enable developers to adopt SHA in new applications to protect data while

delivering to their user experience goals. The instructions are defined in a way that

simplifies their mapping into the algorithm processing flow of most software libraries,

thus enabling easier development.

2.3.7

2.3.8

2.3.9

Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors—Technologies

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

Datasheet, Volume 1 of 2 May 2025

42 Doc. No.: 743844, Rev.: 015

More information on Intel

SHA can be found at:

http://software.intel.com/en-us/artTGLes/intel-sha-extensions

User Mode Instruction Prevention

User Mode Instruction Prevention (UMIP) provides additional hardening capability to

the OS kernel by allowing certain instructions to execute only in supervisor mode

(Ring 0).

If the OS opt-in to use UMIP, the following instruction are enforced to run in supervisor

mode:

• SGDT - Store the GDTR register value

• SIDT - Store the IDTR register value

• SLDT - Store the LDTR register value

• SMSW - Store Machine Status Word

• STR - Store the TR register value

An attempt at such execution in user mode causes a general protection exception

(#GP).

UMIP specifications and functional descriptions are included in the Intel

Architectures Software Developer’s Manual, Volume 3. Available at:

http://www.intel.com/products/processor/manuals

Read Processor ID

A companion instruction that returns the current logical processor's ID and provides a

faster alternative to using the RDTSCP instruction.

Read Processor ID (RDPID) specifications and functional descriptions are included in

the Intel

64 Architectures Software Developer’s Manual, Volume 2. Available at:

http://www.intel.com/products/processor/manuals

Intel

Total Memory Encryption - Multi-Key

This technology encrypts the platform's entire memory with multiple encryption keys.

Intel

Total Memory Encryption (Intel

TME), when enabled via BIOS configuration,

ensures that all memory accessed from the Intel processor is encrypted.

Intel TME encrypts memory accesses using the AES XTS algorithm with 128-bit keys.

The global encryption key used for memory encryption is generated using a hardened

random number generator in the processor and is not exposed to software.

Software (OS/VMM) manages the use of keys and can use each of the available keys

for encrypting any page of the memory. Thus, Intel

Total Memory Encryption - Multi-

key (Intel

TME-MK) allows page granular encryption of memory. By default Intel

TME-MK uses the Intel TME encryption key unless explicitly specified by software.

2.3.10

2.3.11

2.3.12

Technologies—Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

May 2025 Datasheet, Volume 1 of 2

Doc. No.: 743844, Rev.: 015 43

Data in-memory and on the external memory buses is encrypted and exists in plain

text only inside the processor. This allows existing software to operate without any

modification while protecting memory using Intel TME. Intel TME does not protect

memory from modifications.

Intel TME allows the BIOS to specify a physical address range to remain unencrypted.

Software running on Intel TME enabled system has full visibility into all portions of

memory that are configured to be unencrypted by reading a configuration register in

the processor.

NOTES

• Memory access to nonvolatile memory (Intel

Optane

™

) is encrypted as well.

• More information on Intel TME-MK can be found at:

https://software.intel.com/sites/default/files/managed/a5/16/Total-Memory-

Encryption-Multi-Key-Spec.pdf

• A cold boot is required when enable/ disable Intel TME feature on this platform.

Intel

Control-flow Enforcement Technology

Return-oriented Programming (ROP), and similarly CALL/JMP-oriented programming

(COP/JOP), have been the prevalent attack methodology for stealth exploit writers

targeting vulnerabilities in programs.

Intel

Control-flow Enforcement Technology (Intel

CET) provides the following

components to defend against ROP/JOP style control-flow subversion attacks:

Shadow Stack

A shadow stack is a second stack for the program that is used exclusively for control

transfer operations. This stack is separate from the data stack and can be enabled for

operation individually in user mode or supervisor mode.

The shadow stack is protected from tamper through the page table protections such

that regular store instructions cannot modify the contents of the shadow stack. To

provide this protection the page table protections are extended to support an

additional attribute for pages to mark them as “Shadow Stack” pages. When shadow

stacks are enabled, control transfer instructions/flows such as near call, far call, call to

interrupt/exception handlers, etc. store their return addresses to the shadow stack.

The RET instruction pops the return address from both stacks and compares them. If

the return addresses from the two stacks do not match, the processor signals a

control protection exception (#CP). Stores from instructions such as MOV, XSAVE, etc.

are not allowed to the shadow stack.

Indirect Branch Tracking

The ENDBR32 and ENDBR64 (collectively ENDBRANCH) are two new instructions that

are used to mark valid indirect CALL/JMP target locations in the program. This

instruction is a NOP on legacy processors for backward compatibility.

The processor implements a state machine that tracks indirect JMP and CALL

instructions. When one of these instructions is seen, the state machine moves from

IDLE to WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next

2.3.13

2.3.13.1

2.3.13.2

Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors—Technologies

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

Datasheet, Volume 1 of 2 May 2025

44 Doc. No.: 743844, Rev.: 015