# OS Guard and SMEP Architecture reference: Feex Also called OS Guard Intel OS Guard is associated with Supervisor-Mode Execution Prevention, SMEP. It restricts supervisor execution of user-accessible code pages and must not be confused with the separate SMAP data-access protection. ## What you need to know Intel OS Guard is associated with Supervisor-Mode Execution Prevention, SMEP. It restricts supervisor execution of user-accessible code pages and must not be confused with the separate SMAP data-access protection. ## How it works When the OS enables SMEP, instruction fetches in supervisor mode are checked against page-table user/supervisor permissions. This helps prevent a kernel control-flow error from directly executing code mapped as user accessible. The OS still controls page mappings and its own privileged code. ## Where it is useful A kernel that accidentally redirects execution into a user page can fault under SMEP. This is a particular execution boundary; it does not independently validate the kernel's logic, loaded drivers or allowed supervisor mappings. ## How to check support and enablement CPUID.07H.00H:EBX bit 7 enumerates SMEP; CR4.SMEP is the OS control. SMAP has a separate bit and control. Check the running OS's documented protection configuration rather than trying to change privileged controls from an application. Capability, enablement and enforcement must be checked separately. A processor can support a protection while the OS, application or virtual-machine policy does not activate it. A database support field is not an attestation of a running system. ## What the feature does not establish OS Guard is not Boot Guard. A database field reading OS Guard (SMAP) mixes two different architectural concepts and cannot establish both; verify SMEP and SMAP independently. The feature does not make a vulnerable driver safe. ## Compatibility and performance in practice Keep the OS, firmware and affected runtime current. If a protection exposes a compatibility problem, use vendor diagnostics and supported updates first. A broad protection toggle can affect unrelated applications and should follow an explicit deployment and recovery policy. ## A practical verification checklist 1. Record the exact processor or platform model and the application, OS and runtime versions involved. Preserve the wording of the actual error or requirement. 2. Check the manufacturer reference for that exact model, then inspect the effective capability and enabled state in the environment where the program runs. 3. Compare every requirement of the selected binary or backend. A similarly named feature, alias or broad technology label is not enough. 4. Confirm the application selected the intended implementation. Use its documented diagnostics and a supported fallback when requirements are not met. 5. Make one supported change at a time and repeat the same workload. Keep the original configuration and recovery path available. ## If the feature is listed but software cannot use it Start with the exact failing component. A hardware database describes recorded capability; the operating system or hypervisor can expose a different effective environment. An illegal-instruction error also needs investigation of the actual faulting instruction and binary build, because corruption or an unrelated unsupported instruction can produce a similar symptom. Install the application, driver or runtime version supported for the exact platform, and use the vendor's documented baseline or fallback build if needed. A software update cannot create an instruction that the processor lacks. Firmware and security-policy changes should follow the system manufacturer's procedure and a recovery plan rather than a generic optimization recipe. ## Related features and useful distinctions [SMAP](https://feex.it/wiki/hardware/system/smap/) · [Execute Disable (NX)](https://feex.it/wiki/hardware/system/execute-disable/) · [Boot Guard](https://feex.it/wiki/hardware/system/boot-guard/) · [Control-flow Enforcement (CET)](https://feex.it/wiki/hardware/system/cet/) ## Sources and scope of this explanation [Intel 64 and IA-32 Architectures Software Developer's Manual](https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html) · [Intel security features related to transient execution attacks](https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/related-intel-security-features-technologies.html) These references establish architectural behavior and software requirements. They do not independently verify every feature value on a linked hardware model page. For model support, use that page's manufacturer evidence and check the effective system configuration. This article does not supply a benchmark, certification or independent review date. ## Related These entities connect to this article. Type is shown on every link. [SMAP: Architecture reference](https://feex.it/wiki/hardware/system/smap/)[Execute Disable (NX): Architecture reference](https://feex.it/wiki/hardware/system/execute-disable/)[Boot Guard: Architecture reference](https://feex.it/wiki/hardware/system/boot-guard/)[Control-flow Enforcement (CET): Architecture reference](https://feex.it/wiki/hardware/system/cet/) ## Sources and verification Editorial ownership: Feex. No independent review date is recorded. [How we research](https://feex.it/wiki/research/). - [Intel 64 and IA-32 Architectures Software Developer's Manual ](https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html)· Volumes 1 and 2 describe the named instruction families and CPUID; Volume 3 describes state, paging, VMX and protection controls. Architecture documentation does not establish support for a particular model. - [Intel security features related to transient execution attacks ](https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/related-intel-security-features-technologies.html)· Identifies Intel OS Guard with SMEP. This is distinct from SMAP, despite some imported feature labels mixing those names. [Report a correction to Feex](https://feex.it/contact/) ## Was this article useful? A yes or no is enough. Pick a reason if you want, or add a short note. Quick facts The short identity of this page. Specs, sources, and the full story stay in the article. --- Source: [Canonical Feex Wiki page](https://feex.it/wiki/hardware/system/os-guard/) [Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)