Unfortunately MPX sounds cool but is a lot of fluff IMO. It is absolutely not "minimal overhead" in its current implementation and it is very invasive in some ways, and breaks many programs. (It also doesn't even provide temporal protection, and is slower than ASAN in those modes?) There's probably a reason almost nobody uses it from what I see; it sounds pretty half-baked...
Yes, it might have stopped the CloudFlare case, if they were willing to pay (I believe) for L4 over-read protection overheads (2x I believe, with a LOT of variance between GCC and Intel's compiler), and give up multithreading[1] in their application, and probably deal with other false positives and unsupported things.
SGX is completely neutered in Skylake and totally useless without getting your enclave signed by Intel, unless Google has struck a deal or something. You can mostly ignore it. It's good for preparation of your application against future processors where you'll have control over this, though, I guess...
TSX would be nice, yes. It's deeply annoying it's taken them so long to get right and that they've stratified that feature amongst CPUs -- is there any _real_ reason my Kaby Lake XPS13 can't support TSX? I doubt it other than "market segmentation makes us more money". I guess now I'm just ranting, though.
Wasn't TSX completely disabled in all Intel processors because of silicon bugs? If it is enabled in the Skylake E5 Xeon series that Google is rolling out, does it mean the Skylake E5 Xeons are the first processors to have a working TSX implementation?
AIUI that was just certain flavors of Broadwell and possibly all (or maybe just all-released-at-the-time) Haswell chips, so later Broadwell steppings had a working TSX implementation.
(As an example, my Xeon D-1540, a Broadwell-family chip, advertises the TSX bits in CPU feature flags, so it's not errata'd off there.)
I don't think Google provides SGX on their cloud instances (SGX is extremely limited right now, since any code your placing in an enclave must be signed by Intel).
SGX (secure enclaves)
TSX (Hardware Transactional Memory)
SGX can store SSL keys in a hardware protected enclave that can't be accessed by hypervisors/AMT so that can be useful for security sensitive stuff.
Cloudflare probably could have used MPX to prevent their recent leak with minimal performance overhead.
TSX is cool.