743844-015.pdf - 第44页

Data in-memory and on the external memory buses is encrypted and exists in plain text only inside the processor . This allows existing software to operate without any modification while protecting memory using Intel TME.…

More information on Intel

SHA can be found at:

http://software.intel.com/en-us/artTGLes/intel-sha-extensions

User Mode Instruction Prevention

User Mode Instruction Prevention (UMIP) provides additional hardening capability to

the OS kernel by allowing certain instructions to execute only in supervisor mode

(Ring 0).

If the OS opt-in to use UMIP, the following instruction are enforced to run in supervisor

mode:

• SGDT - Store the GDTR register value

• SIDT - Store the IDTR register value

• SLDT - Store the LDTR register value

• SMSW - Store Machine Status Word

• STR - Store the TR register value

An attempt at such execution in user mode causes a general protection exception

(#GP).

UMIP specifications and functional descriptions are included in the Intel

Architectures Software Developer’s Manual, Volume 3. Available at:

http://www.intel.com/products/processor/manuals

Read Processor ID

A companion instruction that returns the current logical processor's ID and provides a

faster alternative to using the RDTSCP instruction.

Read Processor ID (RDPID) specifications and functional descriptions are included in

the Intel

64 Architectures Software Developer’s Manual, Volume 2. Available at:

http://www.intel.com/products/processor/manuals

Intel

Total Memory Encryption - Multi-Key

This technology encrypts the platform's entire memory with multiple encryption keys.

Intel

Total Memory Encryption (Intel

TME), when enabled via BIOS configuration,

ensures that all memory accessed from the Intel processor is encrypted.

Intel TME encrypts memory accesses using the AES XTS algorithm with 128-bit keys.

The global encryption key used for memory encryption is generated using a hardened

random number generator in the processor and is not exposed to software.

Software (OS/VMM) manages the use of keys and can use each of the available keys

for encrypting any page of the memory. Thus, Intel

Total Memory Encryption - Multi-

key (Intel

TME-MK) allows page granular encryption of memory. By default Intel

TME-MK uses the Intel TME encryption key unless explicitly specified by software.

2.3.10

2.3.11

2.3.12

Technologies—Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

May 2025 Datasheet, Volume 1 of 2

Doc. No.: 743844, Rev.: 015 43

Data in-memory and on the external memory buses is encrypted and exists in plain

text only inside the processor. This allows existing software to operate without any

modification while protecting memory using Intel TME. Intel TME does not protect

memory from modifications.

Intel TME allows the BIOS to specify a physical address range to remain unencrypted.

Software running on Intel TME enabled system has full visibility into all portions of

memory that are configured to be unencrypted by reading a configuration register in

the processor.

NOTES

• Memory access to nonvolatile memory (Intel

Optane

™

) is encrypted as well.

• More information on Intel TME-MK can be found at:

https://software.intel.com/sites/default/files/managed/a5/16/Total-Memory-

Encryption-Multi-Key-Spec.pdf

• A cold boot is required when enable/ disable Intel TME feature on this platform.

Intel

Control-flow Enforcement Technology

Return-oriented Programming (ROP), and similarly CALL/JMP-oriented programming

(COP/JOP), have been the prevalent attack methodology for stealth exploit writers

targeting vulnerabilities in programs.

Intel

Control-flow Enforcement Technology (Intel

CET) provides the following

components to defend against ROP/JOP style control-flow subversion attacks:

Shadow Stack

A shadow stack is a second stack for the program that is used exclusively for control

transfer operations. This stack is separate from the data stack and can be enabled for

operation individually in user mode or supervisor mode.

The shadow stack is protected from tamper through the page table protections such

that regular store instructions cannot modify the contents of the shadow stack. To

provide this protection the page table protections are extended to support an

additional attribute for pages to mark them as “Shadow Stack” pages. When shadow

stacks are enabled, control transfer instructions/flows such as near call, far call, call to

interrupt/exception handlers, etc. store their return addresses to the shadow stack.

The RET instruction pops the return address from both stacks and compares them. If

the return addresses from the two stacks do not match, the processor signals a

control protection exception (#CP). Stores from instructions such as MOV, XSAVE, etc.

are not allowed to the shadow stack.

Indirect Branch Tracking

The ENDBR32 and ENDBR64 (collectively ENDBRANCH) are two new instructions that

are used to mark valid indirect CALL/JMP target locations in the program. This

instruction is a NOP on legacy processors for backward compatibility.

The processor implements a state machine that tracks indirect JMP and CALL

instructions. When one of these instructions is seen, the state machine moves from

IDLE to WAIT_FOR_ENDBRANCH state. In WAIT_FOR_ENDBRANCH state the next

2.3.13

2.3.13.1

2.3.13.2

Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors—Technologies

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

Datasheet, Volume 1 of 2 May 2025

44 Doc. No.: 743844, Rev.: 015

instruction in the program stream must be an ENDBRANCH. If an ENDBRANCH is not

seen the processor causes a control protection fault (#CP), otherwise the state

machine moves back to IDLE state.

More information on Intel

CET can be found at:

https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-

enforcement-technology-preview.pdf

KeyLocker Technology

A method to make long-term keys short-lived without exposing them. This protects

against vulnerabilities when keys can be exploited and used to attack encrypted data

such as disk drives.

An instruction (LOADIWKEY) allows the OS to load a random wrapping value (IWKey).

The IWKey can be backed up and restored by the OS to/from the PCH in a secure

manner.

The Software can wrap it own key via the ENCODEKEY instruction and receive a

handle. The handle is used with the AES*KL instructions to handle encrypt and

decrypt operations. Once a handle is obtained, the software can delete the original key

from memory.

Devil’s Gate Rock

Devil’s Gate Rock (DGR) is a BIOS hardening technology that splits SMI (System

Management Interrupts) handlers into Ring 3 and Ring 0 portions.

Supervisor/user paging on the smaller Ring 0 portion will enforce access policy for all

the ring 3 code with regard to the SMM state save, MSR registers, IO ports and other

registers.

The Ring 0 portion can perform save/restore of register context to allow the Ring 3

section to make use of those registers without having access to the OS context or the

ability to modify the OS context.

The Ring 0 portion is signed and provided by Intel. This portion is attested by the

processor.

Power and Performance Technologies

Intel

Smart Cache Technology

The Intel

Smart Cache Technology is a shared Last Level Cache (LLC).

• The LLC is non-inclusive.

• The LLC may also be referred to as a 3rd level cache.

• The LLC is shared between all IA cores as well as the Processor Graphics.

• For P Cores The 1st and 2nd level caches are not shared between physical cores

and each physical core has a separate set of caches.

• For E Cores The 1st level cache is not shared between physical cores and each

physical core has a separate set of caches.

2.3.14

2.3.15

2.4

2.4.1

Technologies—Intel

Core

™

, Xeon

™

6300 And Xeon

™

E 2400 Processors

Generation Intel

Core

™

, Intel

Core

™

Generation, Intel

Core

™

Processor (Series 1) and (Series 2), Intel

Xeon

™

2400 Processor and Intel

Xeon

™

6300 Processor

May 2025 Datasheet, Volume 1 of 2

Doc. No.: 743844, Rev.: 015 45